The pbkdf2 crate pulls in an old version of the rand crate (0.5.x), but this dependency can be removed if pbkdf2's default features aren't used.

I checked the code, and indeed default features can be disabled. Doing this drops 7 crates (rand 0.5.x, rand_core 0.3.x, rand_core 0.4.x, etc).