base64-ng 0.11.0

[eldryoth]

base64-ng 0.11.0

Security and verification hardening

• Hardened dependency-free equal-length buffer comparisons with an optimizer barrier in the byte-difference fold.
• Documented the v0.11 Kani verifier exception and replacement release evidence while local Kani remains behind Rust 1.95.
• Added internal bounds invariant documentation for remaining audited indexing assumptions.
• Refreshed constant-time assembly review documentation and release evidence expectations.

Fuzzing and release evidence

• Added an opt-in bounded fuzz smoke gate for release evidence.
• Added dedicated profile/custom-alphabet fuzz coverage for MIME, PEM, bcrypt-style, crypt(3)-style, and caller-defined alphabets.
• Fixed strict in-place decode prevalidation so malformed padding reports consistently with slice/vector decode.

Release posture

• 0.11.0 remains scalar-only; SIMD backends are still admission-gated.
• Runtime crate remains zero external dependencies.
• Standard local release checks passed before tagging.

---

This discussion was created from the release base64-ng 0.11.0.