From 185beea9067892db20a79b53af22b95d09c10736 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 1 Sep 2026 15:58:26 +0000
Subject: [PATCH] build(deps): bump base64 from 0.22.1 to 0.23.1

Bumps [base64](https://github.com/marshallpierce/rust-base64) from 0.22.1 to 0.23.1.
- [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md)
- [Commits](https://github.com/marshallpierce/rust-base64/compare/v0.22.1...v0.23.1)

---
updated-dependencies:
- dependency-name: base64
  dependency-version: 0.23.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock                                   | 6 +++---
 builtins/plugins/delegator-oauth/Cargo.toml  | 2 +-
 builtins/plugins/elicitation-ciba/Cargo.toml | 2 +-
 builtins/plugins/identity-jwt/Cargo.toml     | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 670fa19..15e6547 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2536,7 +2536,7 @@ name = "praxis-policy-plugin-delegator-oauth"
 version = "0.1.0"
 dependencies = [
  "async-trait",
- "base64 0.22.1",
+ "base64 0.23.1",
  "bytes",
  "chrono",
  "getrandom 0.4.3",
@@ -2556,7 +2556,7 @@ name = "praxis-policy-plugin-elicitation-ciba"
 version = "0.1.0"
 dependencies = [
  "async-trait",
- "base64 0.22.1",
+ "base64 0.23.1",
  "chrono",
  "praxis-policy-core",
  "serde",
@@ -2570,7 +2570,7 @@ name = "praxis-policy-plugin-identity-jwt"
 version = "0.1.0"
 dependencies = [
  "async-trait",
- "base64 0.22.1",
+ "base64 0.23.1",
  "chrono",
  "futures",
  "jsonwebtoken",
diff --git a/builtins/plugins/delegator-oauth/Cargo.toml b/builtins/plugins/delegator-oauth/Cargo.toml
index da6773b..3818729 100644
--- a/builtins/plugins/delegator-oauth/Cargo.toml
+++ b/builtins/plugins/delegator-oauth/Cargo.toml
@@ -54,7 +54,7 @@ tracing = { workspace = true }
 # read-only interop check (did the IdP honor the RFC 8693 `actor_token`
 # and emit an `act` claim). We never verify the signature here — the
 # token is already trusted, having just come from our own IdP roundtrip.
-base64 = "0.22"
+base64 = "0.23"
 
 # Secret-clearing wrapper for client credentials in memory.
 zeroize = { version = "1.9", features = ["zeroize_derive"] }
diff --git a/builtins/plugins/elicitation-ciba/Cargo.toml b/builtins/plugins/elicitation-ciba/Cargo.toml
index 19768cb..75ecbb9 100644
--- a/builtins/plugins/elicitation-ciba/Cargo.toml
+++ b/builtins/plugins/elicitation-ciba/Cargo.toml
@@ -43,7 +43,7 @@ praxis-policy-core = { workspace = true }
 
 # `base64` to decode the JWT payload segment for the approver claim
 # (claims extraction only — see the validate notes in approver.rs).
-base64 = "0.22"
+base64 = "0.23"
 
 async-trait = { workspace = true }
 serde = { workspace = true }
diff --git a/builtins/plugins/identity-jwt/Cargo.toml b/builtins/plugins/identity-jwt/Cargo.toml
index 07d25ca..4ec9e20 100644
--- a/builtins/plugins/identity-jwt/Cargo.toml
+++ b/builtins/plugins/identity-jwt/Cargo.toml
@@ -45,7 +45,7 @@ jsonwebtoken = { version = "11", features = ["aws_lc_rs"] }
 # `base64` for the peek-at-iss helper (split + URL_SAFE_NO_PAD decode
 # of the middle JWT segment). Pinned to 0.22 to match what
 # jsonwebtoken pulls — Cargo dedups to a single version.
-base64 = "0.22"
+base64 = "0.23"
 
 # `chrono` for the `resolved_at` timestamp on IdentityPayload. Comes
 # in transitively via praxis-policy-core already; redeclaring keeps the