Bump base64-ng from 1.0.5 to 1.3.7

[dependabot]

Bumps base64-ng from 1.0.5 to 1.3.7.

Release notes

Sourced from base64-ng's releases.

base64-ng 1.3.7

1.3.7 is a maintenance and crate-family version synchronization patch for the base64-ng crate family.

Highlights

• Synchronized all workspace crate package versions to 1.3.7.
• Updated public dependency examples, migration guidance, crate-family release metadata, and publishing order for the new patch version.
• Updated the active release toolchain to Rust 1.97.0 while continuing to test Rust 1.90.0 as the MSRV.
• Added a fail-closed CI assertion that the selected rustc exactly matches the release-toolchain pin.
• Updated test-only byte iteration syntax for Rust 1.97.0 Clippy.
• Updated the constant-time assembly evidence parser for Rust 1.97.0's v0 symbols while retaining compatibility with legacy Rust symbol mangling and requiring concrete text-section definitions for both formats.
• Updated the optional bytes and sanitization companions to bytes 1.12.1 and exact-pinned sanitization 1.2.4.
• Pinned GitHub Actions to checkout v6.0.2, rust-cache v2.9.1, and install-action v2.83.0, using their verified release commits.
• Added the 210-test nextest suite to GitHub CI and disabled install-action fallback installation for supported binaries. Cargo-deny uses a separate exact-version locked Cargo installation because its current binary is not available through install-action.
• Hardened Tokio reader-buffer cleanup and made read-all temporary allocations wipe through RAII on success, error, and cancellation.
• Limited oversized-input detection to one lookahead byte and documented the adjacent-frame behavior for generic AsyncRead sources.
• Capped limited-helper eager allocation at 8 KiB and made per-read staging cleanup proportional to received input while retaining full cancellation cleanup.
• Pinned documented release/deep-check tool versions to the current audited releases, including cargo-nextest 0.9.140 and cargo-fuzz 0.13.2.
• Scheduled the stronger RISC-V RVV proof and backend-admission review for 1.3.8, preserving the current QEMU-tested scalar/fallback posture until a dedicated evidence cycle is complete.

Notes

No core encode/decode logic, SIMD admission scope, unsafe boundary, target evidence, or core zero-dependency policy changes in this release. Existing RISC-V QEMU evidence remains valid functional and fallback evidence, but it is not real hardware acceleration, performance, timing, side-channel, or register-retention proof.

base64-ng 1.3.6

1.3.6 is a documentation and crate-family version synchronization patch for

... (truncated)

Changelog

Sourced from base64-ng's changelog.

1.3.7 - 2026-07-10

• Synchronized all workspace crate package versions to 1.3.7.
• Prepared release metadata, dependency examples, migration guidance, and crate-family publishing order for the 1.3.7 maintenance release.
• Moved the active release toolchain to Rust 1.97.0 while retaining Rust 1.90.0 as the separately checked MSRV.
• Made CI fail closed if the active rustc version differs from the exact release-toolchain pin.
• Updated test-only byte iteration syntax for the Rust 1.97.0 Clippy policy.
• Updated constant-time assembly evidence parsing for Rust 1.97.0's default v0 symbol mangling while preserving legacy-symbol compatibility and requiring concrete text-section definitions for both formats.
• Updated base64-ng-bytes to bytes 1.12.1 and base64-ng-sanitization to exact-pinned sanitization 1.2.4.
• Pinned GitHub Actions to the latest audited releases: checkout v6.0.2, rust-cache v2.9.1, and install-action v2.83.0.
• Added exact-version cargo-nextest installation and the 210-test nextest suite to GitHub CI, with install-action fallback disabled for supported binaries and cargo-deny installed through an exact-version locked Cargo command.
• Hardened Tokio companion cleanup with volatile wipes for fixed reader buffers and RAII-wiped read-all allocations that also cover cancellation.
• Bounded Tokio limited-helper over-read to one lookahead byte and documented the adjacent-frame contract.
• Capped Tokio limited-helper eager allocation at 8 KiB and made per-read staging cleanup proportional to bytes received while retaining full RAII cleanup on cancellation and drop.
• Pinned documented release-tool installs to the audited current versions, including cargo-nextest 0.9.140 and cargo-fuzz 0.13.2.
• Deferred the stronger RISC-V RVV proof and backend-admission review to 1.3.8; the existing RISC-V posture remains QEMU-tested scalar/fallback-only.
• No core encode/decode logic, SIMD admission scope, unsafe boundary, or core zero-dependency posture changes.

1.3.6 - 2026-07-09

• Synchronized all workspace crate package versions to 1.3.6.
• Added consistent companion-crate README headers with the shared project image, core documentation links, and crate-specific one-line summaries.
• Moved the top constant-time guide example to decode_slice_staged_clear_tail so shared-memory and HSM-adjacent users see the safer staged pattern first.
• Added the custom base64_ng_require_high_assurance cfg. When set, builds that also enable simd fail at compile time.
• No encode/decode logic, SIMD admission scope, or runtime dependency posture changes.

1.3.5 - 2026-07-04

... (truncated)

Commits

• 775037b Finalize 1.3.7 release documentation
• f75dfcb Bound Tokio limited-helper cleanup cost
• 7e6aa96 Harden Tokio cancellation cleanup
• 041d05f Fix cargo-deny installation in CI
• b3385cc Prepare 1.3.7 release on Rust 1.97
• dd761fb Refresh 1.3.6 pentest report
• caf6439 Support cargo-deny CLI variants
• 6de5f6c Record 1.3.6 pentest pass
• ff22501 Update cargo-deny release checks
• f9f88fc Harden high-assurance CT guidance
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #18.