chore(deps): bump base64 from 0.22.1 to 0.23.1

[dependabot]

Bumps base64 from 0.22.1 to 0.23.1.

Changelog

Sourced from base64's changelog.

0.23.1

• Make the tests build again on non-SIMD architectures

0.23.0

• Added more consts for preconfigured configs and engines
• Make DecodeError::InvalidLastSymbol more clear by including the decoded value
• Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.
• Update MSRV to 1.71.0
• Add support for custom padding symbols

Commits

• 069bf70 v0.23.1
• 6ab1fb0 Merge pull request #310 from musicinmybrain/test-on-non-simd-arches
• 7cffce6 Fix testing on architectures without unsafe SIMD support
• e34f9a0 Merge pull request #308 from atouchet/com
• e9240c9 Remove outdated comment
• 9e9220a v0.23.0
• 870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
• fbec5f1 Document no trailing trailing bits
• 0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
• f10b7e2 Update deps & edition
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[tangletools]

⚠️ Review Interrupted — dd10a1dd

The review runner stopped before publishing a final verdict: webhook_restarted.

State	Detail
Interrupted	webhook restarted

No review verdict was produced for this run. Trigger a fresh review on the current PR head if the PR is still open.

_{tangletools · #35 · model: kimi-for-coding · updated 2026-08-18T03:25:08Z}

[tangletools]

🟢 Value Audit — sound

Verdict	sound
Coverage	2 of 2 lenses (value, usefulness)
Concerns	0 (none)
Heuristic	0.0s
Duplication	0.0s
Interrogation	656.4s (2 bridge agents)
Total	656.4s

💰 Value — sound

Routine minor-version bump of the base64 crate (0.22→0.23) used only through its stable Engine API, applied consistently to both dependency declarations and the lockfile; ship.

• What it does: Bumps the optional firecracker-gated base64 dependency and the Linux dev-dependency from 0.22 to 0.23 (Cargo.toml:33, Cargo.toml:60) and updates Cargo.lock accordingly. No source-code changes.
• Goals it achieves: Keeps the dependency tree current (pattern established by the two prior dep-bump commits #32/#33) and picks up base64 0.23's improvements (SIMD-capable engines, clearer InvalidLastSymbol errors, custom padding) for free. For the guest-metadata wire codec (src/guest_metadata.rs:503-513) the behavior is unchanged.
• Assessment: Good. The crate's entire usage surface is base64::Engine + general_purpose::STANDARD encode/decode (src/guest_metadata.rs:55-56, 503-513) — the API retained unchanged in 0.23. Both Cargo.toml entries were bumped together and the lockfile matches, so no drift. The 0.23 MSRV (1.71) is well under the repo's rust-version 1.91 (Cargo.toml:5). The new default-on simd-unsafe feature is not pulled i
• Better / existing approach: none — this is the right approach. Searched all .rs usage (git grep base64 across src/ and examples/): only the two wrapper fns base64_encode/base64_decode wrap the crate, so a version bump is the complete and minimal change; no alternative implementation or existing in-repo base64 code exists to reuse.
• Model: opencode/zai-coding-plan/glm-5.2
• Bridge attempts: 2
• Bridge warning: opencode/kimi-for-coding/k2p7: opencode: opencode error

🎯 Usefulness — sound

Routine, verified dependency bump of base64 0.22→0.23 that compiles clean and passes all wire-format tests, with the crate's only usage going through the version-stable Engine API.

• Integration: Fully reachable and heavily used: base64 is consumed exclusively through the crate-local wrappers base64_encode/base64_decode (src/guest_metadata.rs:503-514), which back the host→guest set_env/set_secret wire path (src/guest_metadata.rs:326, 397, 707) and the reference daemon example (examples/guest_metadata_daemon.rs:274). Cargo.toml:33-34 gates it on the 'firecracker' feature so the default buil
• Fit with existing patterns: Fits the established pattern exactly: the repo's recent history is a stream of dependency bumps (#32 serde_json, #33 libc, #27 userfaultfd), and this follows the same shape (Cargo.toml version pins for the optional dep and the linux dev-dep, plus the lockfile). The call sites use base64::engine::general_purpose::STANDARD via the Engine trait (src/guest_metadata.rs:55-56), an API unchanged in 0.23,
• Real-world viability: Holds up: keeping default-features = false with only "std" leaves the new default-on simd-unsafe engines disabled, so encode/decode behavior is byte-identical to 0.22 (scalar GeneralPurpose, standard alphabet, required padding) — confirmed by the RFC 4648 vector test. Error paths are exercised by tests and map to VmRuntimeError::GuestMetadata as before. MSRV 1.71 required by base64 0.23 is well be
• Model: opencode/zai-coding-plan/glm-5.2
• Bridge attempts: 1

No concerns — sound change, no better or existing approach found. ✅

---

What this audit checks

It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.

Pass	What it asks
Heuristic	Vague title? Whitespace-only or cruft-bearing diff? (content signals only)
Duplication	Do added function/class names already exist elsewhere in the repo?
Value Audit	What does it do? What goal does it achieve? Is it good? Better architecture or already-exists?
Usefulness Audit	Does it integrate and fit? Will it hold up in real use and actually get used?

Findings are concerns, not blocks — the human reviewer decides what to do with them.

_{value-audit · 20260818T033821Z}

[tangletools]

✅ No Blockers — dd10a1dd

Review health 100/100 · Reviewer score 92/100 · Confidence 70/100 · 1 finding (1 low)

	opencode GLM 5.2	opencode DeepSeek v4 Pro	opencode DeepSeek v4 Flash	aggregate
Readiness	92	95	95	92
Confidence	70	70	70	70
Correctness	92	95	95	92
Security	92	95	95	92
Testing	92	95	95	92
Architecture	92	95	95	92

Reviewer score is advisory once the run is complete and the verdict has no blockers.

Full multi-shot audit completed 2/2 planned shots over 2 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 2/2 planned shots over 2 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 2/2 planned shots over 2 changed files. Global verifier still owns final merge decision.

🟡 LOW Linux dev-dependency on base64 appears unused by dev targets — Cargo.toml

Repo-wide grep shows the only direct base64:: usage is src/guest_metadata.rs:55-56; examples/guest_metadata_daemon.rs consumes the crate's re-exported base64_decode (examples/guest_metadata_daemon.rs:66,274), and no test references base64:: directly. The dev-dep at Cargo.toml:60 therefore pulls base64 into dev builds without a direct consumer. Pre-existing before this PR (0.22 had the same shape); the bump itself is correct and keeps both declarations consistent. Optional cleanup: drop line 60 in a follow-up, or leave for future direct dev use — not blocking.

---

_{tangletools · 2026-08-18T03:41:59Z · trace}

[tangletools]

✅ Approved — 1 non-blocking finding — dd10a1dd

Full multi-shot audit completed 2/2 planned shots over 2 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 2/2 planned shots over 2 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 2/2 planned shots over 2 changed files. Global verifier still owns final merge decision.

Full immutable report for this review: trace

Summary comment for this run: full summary

---

_{tangletools · 2026-08-18T03:41:59Z · immutable trace}