deps(deps): bump base64 from 0.22.1 to 0.23.1

[dependabot]

Bumps base64 from 0.22.1 to 0.23.1.

Changelog

Sourced from base64's changelog.

0.23.1

• Make the tests build again on non-SIMD architectures

0.23.0

• Added more consts for preconfigured configs and engines
• Make DecodeError::InvalidLastSymbol more clear by including the decoded value
• Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.
• Update MSRV to 1.71.0
• Add support for custom padding symbols

Commits

• 069bf70 v0.23.1
• 6ab1fb0 Merge pull request #310 from musicinmybrain/test-on-non-simd-arches
• 7cffce6 Fix testing on architectures without unsafe SIMD support
• e34f9a0 Merge pull request #308 from atouchet/com
• e9240c9 Remove outdated comment
• 9e9220a v0.23.0
• 870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
• fbec5f1 Document no trailing trailing bits
• 0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
• f10b7e2 Update deps & edition
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: e20a75a3-e108-4fe5-b7e4-6ee4a1d73229

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[proggeramlug]

Holding this out of the merge trains for one reason, and it is worth stating precisely because three other PRs share it.

benchmarks/public_baseline.py fingerprints the root Cargo.toml as a SOURCE_PATHS input, and _fingerprint_bytes hashes the whole file after normalizing only the workspace version. So a dependency line change invalidates the published benchmark artifact and hard-fails the required step:

lint :: Public benchmark evidence freshness
public artifact benchmark inputs changed; regenerate it with ./benchmarks/run_public_baseline.sh

This is not the three-week-old known-red that most open PRs were carrying — that one is fixed; main is green on this step since 2f854511e9, and train 258's CI was 22/22.

I checked which of the five open cargo bumps actually trip it, by diffing each one's root Cargo.toml against main excluding the version line:

• deps(deps): bump base64 from 0.22.1 to 0.23.1 #11062 (base64 = "0.22" → "0.23") — trips it
• deps(deps): bump env_logger from 0.10.2 to 0.11.11 #11063 (env_logger = "0.10" → "0.11") — trips it
• deps(deps): bump ed25519-dalek from 2.2.0 to 3.0.0 #11064, deps(deps): bump tungstenite from 0.24.0 to 0.30.0 #11065, deps(deps): bump the cargo-minor-and-patch group across 1 directory with 8 updates #11067 — do not: their manifest edits are in crate-level Cargo.tomls and Cargo.lock, neither of which is fingerprinted. Those three can land normally and I am taking them in the next train.

Regenerating the artifact is ./benchmarks/run_public_baseline.sh — roughly two hours, pinned to Node v22.23.1 and Bun 1.3.14, and it additionally requires a quiet host (CPU ≤ 25% for 60 consecutive seconds). The pin and the measurement are atomic by design.

So the plan for this PR: batch it with #11063 and #11083 (turnloop → alpha.8, same blocker) and pay for one regeneration covering all three, rather than three. I'll pick that up as a dedicated PR. Nothing is wrong with the bump itself.

[proggeramlug]

Landed on main in merge train 270 (#11132, v0.5.1653). The train rebase gives commits new SHAs, so GitHub cannot close this automatically.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.