Bump base64-ng from 1.0.5 to 1.3.9

[dependabot]

Bumps base64-ng from 1.0.5 to 1.3.9.

Release notes

Sourced from base64-ng's releases.

base64-ng 1.3.9

1.3.9 migrates the optional sanitization companion to the security-boundary changes in sanitization 2.0.3 and keeps the workspace crate family version aligned.

Highlights

• Synchronized all workspace crate versions to 1.3.9.
• Exact-pinned base64-ng-sanitization to sanitization 2.0.3.
• Preserved the existing fixed locked decode return type and added a separate fill-error method for sanitization 2.0 integrity-aware initialization.
• Added a direct return-type regression test because trait-method signature changes are not reliably detected by ordinary semver tooling.
• Added fallible integrity-checked comparison helpers for locked fixed and dynamic containers.
• Ensured locked compatibility comparisons panic on canary corruption instead of silently converting the integrity event to Choice::FALSE; fallible comparison remains the recommended operator-controlled path.
• Made checked fixed-size locked decode establish required memory-lock, dump, and fork controls before plaintext materialization.
• Made built-in checked dynamic decode use the protected-capacity constructor, which establishes required controls before invoking the decode closure.
• Added a protected extension API that preserves distinct protection and canary-integrity failures for operator alerting.
• Added bounded checked dynamic decode that rejects decoded capacities above a const-generic application limit before allocation.
• Rejects malformed or wrong-length fixed input before protected mapping allocation and checks the final decoded length in release builds before initializing locked storage.
• Adds counter-backed allocation-boundary tests proving rejected fixed and dynamic inputs cannot invoke protected allocation.
• Added deterministic admission tests proving degraded dynamic containers are dropped instead of returned.
• Updated the active release toolchain to Rust 1.97.1, Serde to 1.0.229, Tokio to 1.53.1, and immutable GitHub Action pins to current releases.
• Updated locked-container examples to use checked exposure APIs.
• Strengthened high-assurance with strict random canaries and strict assembly comparison.
• Added the new strict-compare feature name while retaining strict-ct as a migration alias.
• Moved the RISC-V RVV proof and backend-admission review to 1.3.10.

Compatibility

The core base64-ng API and encoded/decoded output are unchanged. The existing base64-ng-sanitization fixed locked decode method retains its generation error type; callers can opt into the additive _fill method for sanitization 2.0's fill-error model. Existing non-locked comparison helpers remain unchanged. Existing locked comparison helpers remain available as a fail-stop

... (truncated)

Changelog

Sourced from base64-ng's changelog.

1.3.9 - 2026-07-21

• Synchronized all workspace crate package versions to 1.3.9.
• Updated base64-ng-sanitization to exact-pinned sanitization 2.0.3.
• Updated the active release toolchain to Rust 1.97.1, Serde to 1.0.229, Tokio to 1.53.1, actions/checkout to v7.0.1, and taiki-e/install-action to v2.83.4 after an upstream release audit.
• Preserved the fixed locked decode generation-error signature and added an explicit fill-error method for sanitization 2.0 integrity-aware callers.
• Added an explicit public return-type regression test for the compatibility and integrity-aware fixed locked decode methods.
• Added LockedSanitizationCtEqExt so locked fixed and dynamic containers can return canary-integrity failures while retaining Choice composition and reason-bearing declassification.
• Corrected locked compatibility comparison after sanitization 2.0.3 changed its ConstantTimeEq failure behavior: checked exposure now reaches an explicit reviewed panic boundary instead of turning canary corruption into an ordinary Choice::FALSE mismatch.
• Made checked fixed locked decode establish required memory-lock, dump, and fork controls before plaintext materialization.
• Made the built-in checked dynamic locked decode use sanitization 2.0.3's protected-capacity constructor, so required controls are established before its decode closure runs; retained the documented post-fill compatibility default for external extension-trait implementations.
• Added CtDecodeSanitizationProtectedExt to preserve distinct protection and canary-integrity failure classes for high-assurance incident handling.
• Added bounded checked dynamic decode that rejects decoded capacities above a const-generic application limit before mapping allocation or decoder entry.
• Validated malformed and wrong-length fixed inputs before protected mapping allocation, and replaced a release-only decoded-length assertion with a fail-closed runtime check and temporary-buffer wipe.
• Added an injectable internal allocation boundary with deterministic tests proving invalid fixed or dynamic inputs cannot invoke protected allocation.
• Strengthened the companion high-assurance feature with strict random canaries and strict assembly comparison.
• Added strict-compare and retained strict-ct as a compatibility alias for the sanitization 2.0 feature rename.
• Preserved core encode/decode behavior, SIMD admission, unsafe boundaries, and the core zero-runtime-dependency posture.
• Documented vendored-source review as an additional control for hermetic deployments that admit the optional sanitization companion.
• Moved the stronger RISC-V RVV proof and backend-admission review to 1.3.10.

1.3.8 - 2026-07-15

• Synchronized all workspace crate package versions to 1.3.8.
• Changed Tokio read-all helpers to grow through guarded replacement allocations, wiping each old allocation before deallocation.
• Applied the guarded-growth path to bounded and unbounded Tokio helpers and added regression coverage for inputs larger than the 8 KiB eager capacity.

... (truncated)

Commits

• 5af9802 Record 1.3.9 pentest evidence
• f5e1a74 Fail loudly on locked comparison corruption
• 10f471d Expose bounded detailed locked decode
• 2af3800 Close dynamic locked decode protection gap
• 14341a1 Prove locked decode validation ordering
• af69050 Harden locked decode validation ordering
• 54e68d8 Guard sanitization decode API compatibility
• 8ec5e3b Update sanitization and audited tooling pins
• ddd280d Fail closed on degraded locked protection
• 31caed1 Migrate sanitization companion to 2.0.1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)