chore(deps): bump base64 from 0.22.1 to 0.23.0

[dependabot]

Bumps base64 from 0.22.1 to 0.23.0.

Changelog

Sourced from base64's changelog.

0.23.0

• Added more consts for preconfigured configs and engines
• Make DecodeError::InvalidLastSymbol more clear by including the decoded value
• Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.
• Update MSRV to 1.71.0
• Add support for custom padding symbols

Commits

• 9e9220a v0.23.0
• 870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
• fbec5f1 Document no trailing trailing bits
• 0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
• f10b7e2 Update deps & edition
• 9d21a59 Merge pull request #304 from marshallpierce/mp/custom-padding-rebase
• f70bad2 Support custom padding symbols
• 684d79c Merge pull request #301 from marshallpierce/mp/simd-gardening
• 5bf66f2 Merge pull request #284 from AbeZbm/add-tests
• d3831cf Followups to SIMD work
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[tangletools]

⚠️ Review Interrupted — 3a6590ff

The review runner stopped before publishing a final verdict: webhook_restarted.

State	Detail
Interrupted	webhook restarted

No review verdict was produced for this run. Trigger a fresh review on the current PR head if the PR is still open.

_{tangletools · #34 · model: kimi-for-coding · updated 2026-07-24T03:20:03Z}

[tangletools]

🟢 Value Audit — sound

Verdict	sound
Concerns	0 (none)
Heuristic	0.0s
Duplication	0.0s
Interrogation	53.1s (2 bridge agents)
Total	53.1s

💰 Value — sound

Routine minor-version bump of base64 (0.22→0.23); used narrowly for the guest-metadata wire encoding and unaffected by the new SIMD/MSRV surface.

• What it does: Bumps the base64 crate from 0.22.1 to 0.23.0 in both the optional firecracker-gated dependency (Cargo.toml:33) and the Linux dev-dependency (Cargo.toml:60), with the corresponding Cargo.lock checksum update. The crate is used only via Engine + general_purpose::STANDARD (src/guest_metadata.rs:55-56, 503-514) to encode/decode secret bytes on the newline-delimited JSON wire to the in-guest da
• Goals it achieves: Keep the supply chain current. base64 0.23 adds SIMD-accelerated engines (default-on simd-unsafe), preconfigured config consts, custom padding, and a clearer InvalidLastSymbol. This repo already shows a recurring chore(deps): bump ... cadence (nix 0.31, sha2 0.11, userfaultfd 0.9), so this is the next step in that routine.
• Assessment: Sound and in-grain. The only API surface this crate touches (engine::general_purpose::STANDARD + Engine::{encode,decode}) is unchanged across 0.22→0.23, so the bump is behavior-preserving for the actual call sites. The dep is correctly kept optional + gated on firecracker so the default no-feature build pulls nothing extra, matching the documented intent at Cargo.toml:29-32. Follows the esta
• Better / existing approach: none — this is the right approach. Searched for any alternative base64/encoding path (git grep base64, encode, Engine): the crate is the single source of encoding, wrapped once in base64_encode/base64_decode (src/guest_metadata.rs:503-514) and reused by both host code and the example daemon. No duplicate or partial implementation to consolidate.
• Model: opencode/zai-coding-plan/glm-5.2
• Bridge attempts: 2
• Bridge warning: opencode/kimi-for-coding/k2p7: bridge stream ended without value-audit content

🎯 Usefulness — sound

Straightforward, API-compatible base64 0.22→0.23 bump; the only consumed surface (Engine trait + general_purpose::STANDARD) is unchanged and fully reachable via the guest-metadata wire path.

• Integration: Fully wired and reachable. base64 is consumed exclusively through the public base64_encode/base64_decode wrappers in src/guest_metadata.rs:503-514, invoked by the secret-write path (src/guest_metadata.rs:326,707) and the guest_metadata_daemon example (examples/guest_metadata_daemon.rs:274). Gated correctly behind the firecracker feature (Cargo.toml:33,66).
• Fit with existing patterns: Matches the established single-dependency pattern. The crate uses base64's canonical Engine/general_purpose::STANDARD API (the pattern base64 itself introduced in 0.21 and retains in 0.23); no duplicate or competing encoding in the repo.
• Real-world viability: Holds up. Encode/decode are stateless (no concurrency concerns), errors are mapped to VmRuntimeError::GuestMetadata. The 0.23 DecodeError change (InvalidLastSymbol now includes the decoded value) is additive and flows through the existing Display-based mapping unchanged.
• Model: opencode/zai-coding-plan/glm-5.2
• Bridge attempts: 1

No concerns — sound change, no better or existing approach found. ✅

---

What this audit checks

It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.

Pass	What it asks
Heuristic	Vague title? Whitespace-only or cruft-bearing diff? (content signals only)
Duplication	Do added function/class names already exist elsewhere in the repo?
Value Audit	What does it do? What goal does it achieve? Is it good? Better architecture or already-exists?
Usefulness Audit	Does it integrate and fit? Will it hold up in real use and actually get used?

Findings are concerns, not blocks — the human reviewer decides what to do with them.

_{value-audit · 20260724T032816Z}

[tangletools]

✅ No Blockers — 3a6590ff

Review health 100/100 · Reviewer score 92/100 · Confidence 70/100 · 1 finding (1 low)

glm: Correctness 92 · Security 92 · Testing 92 · Architecture 92

Reviewer score is advisory once the run is complete and the verdict has no blockers.

Full multi-shot audit completed 2/2 planned shots over 2 changed files. Global verifier still owns final merge decision.

🟡 LOW base64 0.23.0 published same day as PR (informational) — Cargo.lock

crates.io metadata shows base64 0.23.0 created_at 2026-07-23T13:57:30Z, the same day as this bump. Not a defect: checksum b25655df... matches crates.io, not yanked, published by the crate's long-term maintainer marshallpierce (user id 5563). Noted only because zero-day releases carry latent regression risk that a fresh re-test of base64_encode/base64_decode would mitigate; the existing RFC4648 + invalid-input tests already exercise the affected paths.

---

_{tangletools · 2026-07-24T03:30:12Z · trace}

[tangletools]

✅ Approved — 1 non-blocking finding — 3a6590ff

Full multi-shot audit completed 2/2 planned shots over 2 changed files. Global verifier still owns final merge decision.

Full immutable report for this review: trace

Summary comment for this run: full summary

---

_{tangletools · 2026-07-24T03:30:12Z · immutable trace}