Bump base64-ng from 1.0.5 to 1.3.8

[dependabot]

Bumps base64-ng from 1.0.5 to 1.3.8.

Release notes

Sourced from base64-ng's releases.

base64-ng 1.3.8

1.3.8 is a security-hardening and crate-family synchronization patch for the base64-ng workspace.

Highlights

• Synchronized all workspace crate package versions to 1.3.8.
• Hardened base64-ng-tokio read-all helpers so vector growth copies into a guarded replacement and wipes the old allocation before deallocation.
• Applied guarded growth to bounded and unbounded helpers, with regression coverage above the 8 KiB eager capacity.
• Hardened Chromium-family wasm runtime evidence so success requires a runtime-created DOM attribute that is absent from the static HTML source.
• Made Alphabet::ENCODE the sole output definition used by Engine, so hand-written or stateful Alphabet::encode overrides cannot alter output; standard-family mapper selection is evaluated at compile time.
• Hardened the API-audit policy gate against harmless Markdown line wrapping.
• Added daily and manually dispatchable RustSec and cargo-deny monitoring for the workspace and isolated tool lockfiles.
• Updated async cleanup, release evidence, migration, and dependency examples.
• Moved the stronger RISC-V RVV proof and backend-admission review to 1.3.9.

Notes

Encoded output is unchanged for valid table-defined alphabets. Hand-written Alphabet::encode overrides no longer affect Engine output; callers that invoked those overrides directly retain their existing behavior. This patch does not change SIMD admission, unsafe boundaries, or the zero-runtime-dependency posture of base64-ng.

base64-ng 1.3.7

1.3.7 is a maintenance and crate-family version synchronization patch for the base64-ng crate family.

Highlights

• Synchronized all workspace crate package versions to 1.3.7.
• Updated public dependency examples, migration guidance, crate-family release metadata, and publishing order for the new patch version.
• Updated the active release toolchain to Rust 1.97.0 while continuing to test Rust 1.90.0 as the MSRV.
• Added a fail-closed CI assertion that the selected rustc exactly matches the release-toolchain pin.
• Updated test-only byte iteration syntax for Rust 1.97.0 Clippy.
• Updated the constant-time assembly evidence parser for Rust 1.97.0's v0 symbols while retaining compatibility with legacy Rust symbol mangling and requiring concrete text-section definitions for both formats.
• Updated the optional bytes and sanitization companions to bytes 1.12.1

... (truncated)

Changelog

Sourced from base64-ng's changelog.

1.3.8 - 2026-07-15

• Synchronized all workspace crate package versions to 1.3.8.
• Changed Tokio read-all helpers to grow through guarded replacement allocations, wiping each old allocation before deallocation.
• Applied the guarded-growth path to bounded and unbounded Tokio helpers and added regression coverage for inputs larger than the 8 KiB eager capacity.
• Hardened Chromium-family wasm runtime evidence by requiring a DOM success attribute created only after successful JavaScript and wasm execution.
• Added a fail-closed assertion that the browser success attribute is absent from the static smoke-test document.
• Made Alphabet::ENCODE the sole encoding definition used by Engine, so hand-written, inconsistent, or stateful Alphabet::encode overrides cannot produce API-, input-length-, or backend-dependent output. Standard-family mapper selection is an associated compile-time constant rather than a repeated scalar-call prefix scan.
• Made the API-audit policy gate check stable semantic fragments instead of a Markdown line-wrapping-sensitive sentence.
• Added daily and manually dispatchable RustSec and cargo-deny advisory checks for the workspace and isolated dudect, fuzz, and performance lockfiles.
• Updated async cleanup and release-evidence documentation.
• Moved the stronger RISC-V RVV proof and backend-admission review to 1.3.9.
• Preserved encoded output for valid table-defined alphabets and left SIMD admission scope, unsafe boundaries, and the core zero-dependency posture unchanged. Hand-written Alphabet::encode overrides no longer affect Engine output; Alphabet::ENCODE is authoritative.

1.3.7 - 2026-07-10

• Synchronized all workspace crate package versions to 1.3.7.
• Prepared release metadata, dependency examples, migration guidance, and crate-family publishing order for the 1.3.7 maintenance release.
• Moved the active release toolchain to Rust 1.97.0 while retaining Rust 1.90.0 as the separately checked MSRV.
• Made CI fail closed if the active rustc version differs from the exact release-toolchain pin.
• Updated test-only byte iteration syntax for the Rust 1.97.0 Clippy policy.
• Updated constant-time assembly evidence parsing for Rust 1.97.0's default v0 symbol mangling while preserving legacy-symbol compatibility and requiring concrete text-section definitions for both formats.
• Updated base64-ng-bytes to bytes 1.12.1 and base64-ng-sanitization to exact-pinned sanitization 1.2.4.
• Pinned GitHub Actions to the latest audited releases: checkout v6.0.2, rust-cache v2.9.1, and install-action v2.83.0.
• Added exact-version cargo-nextest installation and the 210-test nextest suite to GitHub CI, with install-action fallback disabled for supported binaries and cargo-deny installed through an exact-version locked Cargo command.
• Hardened Tokio companion cleanup with volatile wipes for fixed reader buffers and RAII-wiped read-all allocations that also cover cancellation.
• Bounded Tokio limited-helper over-read to one lookahead byte and documented

... (truncated)

Commits

• 5ba7d07 Finalize 1.3.8 release documentation
• a7872e7 Const-evaluate runtime alphabet mapping
• f50f567 Make encoding table authoritative
• 731b803 Enforce custom alphabet consistency
• d2e7804 Harden Tokio cleanup and wasm browser evidence
• 775037b Finalize 1.3.7 release documentation
• f75dfcb Bound Tokio limited-helper cleanup cost
• 7e6aa96 Harden Tokio cancellation cleanup
• 041d05f Fix cargo-deny installation in CI
• b3385cc Prepare 1.3.7 release on Rust 1.97
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)