chore(deps): Bump base64 from 0.22.1 to 0.23.0

[dependabot]

Bumps base64 from 0.22.1 to 0.23.0.

Changelog

Sourced from base64's changelog.

0.23.0

• Added more consts for preconfigured configs and engines
• Make DecodeError::InvalidLastSymbol more clear by including the decoded value
• Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.
• Update MSRV to 1.71.0
• Add support for custom padding symbols

Commits

• 9e9220a v0.23.0
• 870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
• fbec5f1 Document no trailing trailing bits
• 0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
• f10b7e2 Update deps & edition
• 9d21a59 Merge pull request #304 from marshallpierce/mp/custom-padding-rebase
• f70bad2 Support custom padding symbols
• 684d79c Merge pull request #301 from marshallpierce/mp/simd-gardening
• 5bf66f2 Merge pull request #284 from AbeZbm/add-tests
• d3831cf Followups to SIMD work
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​base64@​0.23.0

View full report

[msalvatti]

Status: blocked on the supply-chain policy, not on anything wrong with this bump.

cargo deny and cargo audit pass here — no known advisory, no license or ban issue. The only failing step is cargo vet, and it is failing because the new version has no audit yet from any source this repository imports.

#117 has landed and separates the two causes that were tangled together. It refreshed supply-chain/imports.lock, which was five dependencies behind and was making every PR fail for reasons that had nothing to do with the PR, and it pinned CI to cargo vet --locked so the gate answers from what the repository recorded rather than from whatever upstream published that minute. What is left here is genuinely this bump:

$ cargo vet          # with the imports refreshed
Vetting Failed!

(the exact crate is listed in the job log)

Three ways forward, and the right one is a call for the maintainer rather than something to route around:

1. Wait. This is what just happened for anyhow, serde_json, syn and thiserror: Mozilla, Bytecode Alliance and Google published audits between 18 and 22 July, and the versions became vetted with no decision from us. There is no advisory here, so waiting costs nothing.
2. Audit the diff with cargo vet diff, and record it with cargo vet certify. Honest, and real work — the redis 1.3 → 1.5 diff alone is 2377 insertions.
3. Exempt it — record that we accept the version without auditing it. Fastest, and the only one that puts a trust claim in the repository that nobody earned.

Leaving this open rather than forcing it through: a gate that gets bypassed whenever it is inconvenient is not a gate.