chore(deps): bump base64 from 0.22.1 to 0.23.1

[dependabot]

Bumps base64 from 0.22.1 to 0.23.1.

Changelog

Sourced from base64's changelog.

0.23.1

• Make the tests build again on non-SIMD architectures

0.23.0

• Added more consts for preconfigured configs and engines
• Make DecodeError::InvalidLastSymbol more clear by including the decoded value
• Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.
• Update MSRV to 1.71.0
• Add support for custom padding symbols

Commits

• 069bf70 v0.23.1
• 6ab1fb0 Merge pull request #310 from musicinmybrain/test-on-non-simd-arches
• 7cffce6 Fix testing on architectures without unsafe SIMD support
• e34f9a0 Merge pull request #308 from atouchet/com
• e9240c9 Remove outdated comment
• 9e9220a v0.23.0
• 870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
• fbec5f1 Document no trailing trailing bits
• 0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
• f10b7e2 Update deps & edition
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Thanks @dependabot[bot] for taking the time to contribute.

This repository is observing a maintainer-managed PR intake gate in dry-run mode, so this pull request is staying open. This note helps maintainers prepare the allowlist before any enforcement is considered.

Please read CONTRIBUTING.md for the expected contribution shape. A maintainer can grant recurring PR access by commenting /lgtm on a pull request.

[claude]

Claude finished @Hmbown's task in 1m 3s —— View job

---

Review: bump base64 0.22.1 → 0.23.1

Summary: Low-risk, mechanical dependency bump. base64 is declared only in crates/tui/Cargo.toml (not at the workspace level), and it's the only consumer in the repo. Diff is exactly the version bump in Cargo.toml + the corresponding Cargo.lock entry — no code changes.

Findings:

• Correctness: No issues. I checked all ~35 call sites across crates/tui/src/** (oauth.rs, chatgpt_oauth.rs, xai_oauth.rs, mcp/oauth.rs, image_attach.rs, client.rs, tools/shell.rs, tools/tool_result_retrieval.rs, tui/clipboard.rs, tui/mark.rs, remote_control.rs, vision/tools.rs, tools/read_media.rs, tools/speech.rs, commands/groups/core/voice.rs, tools/web/scrape.rs, test_support.rs). All use the stable Engine trait with general_purpose::STANDARD / URL_SAFE_NO_PAD and plain .encode()/.decode(). Per the 0.23.0 release notes, the 0.22→0.23 changes are additive (new consts, clearer DecodeError::InvalidLastSymbol, new opt-in SIMD engines, custom padding support) — nothing that touches the GeneralPurpose engine API these call sites use.
• MSRV: base64 0.23 raises MSRV to 1.71.0. Workspace rust-version is pinned at 1.88 (Cargo.toml:35), so this is not a constraint.
• Provider/model/route safety (EPIC v0.8.65 EPIC: Separate provider facts, model facts, offerings, and route resolution #2608): Not applicable — this change doesn't touch provider selection, model routing, or prompt-derived logic at all.
• Reuse/dead code: N/A, dependency-only change.
• Tests: Existing base64 round-trip tests (e.g. tui/mark.rs, image_attach/tests.rs, oauth.rs) exercise the same encode/decode paths and will validate the new version at CI time; no new tests needed for a dependency bump.
• Security: No secret-handling or exec-policy code is touched. The new default-on simd-unsafe feature adds unsafe SIMD code paths to the dependency tree, but the workspace code doesn't opt into the new Simd/Avx2/Neon engines, so it isn't exercised by this codebase.

Note on verification: I was not able to run cargo check/cargo test in this sandbox (the tool invocation required interactive approval I don't have in this context), so this review is based on static inspection of the diff, changelog, and all call sites rather than a compiled build. Given the change is a patch/minor version bump with no removed APIs relevant to this codebase's usage, and the Rust workspace tests already exercise these code paths, risk is low — but CI's own cargo test --workspace run is the authoritative check here.

Verdict: Safe to merge pending green CI.

[codewhale-agent]

Codewhale review

Dependabot bumps base64 from 0.22.1 to 0.23.1 in crates/tui/Cargo.toml and updates Cargo.lock. This is a breaking 0.x semver update that raises MSRV to 1.71.0 and changes DecodeError::InvalidLastSymbol; no source or test updates are included.

Findings

• [WARNING] MSRV raised to 1.71.0 (crates/tui/Cargo.toml:50)
  base64 0.23.0 raises the minimum supported Rust version to 1.71.0. If this repository targets an earlier Rust version, CI or downstream builds will fail. Verify the workspace MSRV policy before merging.
• [WARNING] Potential breaking change in DecodeError::InvalidLastSymbol (crates/tui/Cargo.toml:50)
  base64 0.23.0 changed DecodeError::InvalidLastSymbol to include the decoded value. Any exhaustive pattern match on DecodeError variants in the tui crate will need updating. The PR contains only manifest changes, so this was not verified by source edits; run cargo test -p codewhale-tui after merging/rebase.
• [INFO] Default simd-unsafe feature now enabled (crates/tui/Cargo.toml:50)
  base64 0.23.0 adds SIMD-accelerated engines behind a default-on simd-unsafe feature. If dependency policy restricts unsafe code or default features are expected to be minimal, evaluate setting default-features = false and choosing an explicit engine.
• [INFO] No test/CI results for breaking dependency bump (Cargo.lock:1058)
  For a 0.x dependency bump, the PR should be validated by running the crate's test suite (cargo test -p codewhale-tui) and ideally cargo check --workspace. The diff does not include any accompanying test or CI outcome.

Assessment

The dependency bump is straightforward but carries semver-breaking changes and an MSRV rise. It should only be merged after CI confirms compatibility with the workspace MSRV and source code compiles and tests successfully.

---

Advisory review by Codewhale (codewhale review --pr 5875 --post, head 23a7014355548ee096544a25adaeb4b57ed71eb8). Line-specific findings are also posted as inline review comments; mechanical fixes arrive as committable suggestions you can apply from the Files tab. CODEOWNERS approval still governs merge.

[codewhale-agent]

[WARNING] MSRV raised to 1.71.0

base64 0.23.0 raises the minimum supported Rust version to 1.71.0. If this repository targets an earlier Rust version, CI or downstream builds will fail. Verify the workspace MSRV policy before merging.

[codewhale-agent]

[WARNING] Potential breaking change in DecodeError::InvalidLastSymbol

base64 0.23.0 changed DecodeError::InvalidLastSymbol to include the decoded value. Any exhaustive pattern match on DecodeError variants in the tui crate will need updating. The PR contains only manifest changes, so this was not verified by source edits; run cargo test -p codewhale-tui after merging/rebase.

[codewhale-agent]

[INFO] Default simd-unsafe feature now enabled

base64 0.23.0 adds SIMD-accelerated engines behind a default-on simd-unsafe feature. If dependency policy restricts unsafe code or default features are expected to be minimal, evaluate setting default-features = false and choosing an explicit engine.

[codewhale-agent]

[INFO] No test/CI results for breaking dependency bump

For a 0.x dependency bump, the PR should be validated by running the crate's test suite (cargo test -p codewhale-tui) and ideally cargo check --workspace. The diff does not include any accompanying test or CI outcome.

[claude]

Claude finished @Hmbown's task in 1m 11s —— View job

---

Review: bump base64 0.22.1 → 0.23.1

• Gather context (diff, prior reviews, PR description)
• Verify MSRV claim against workspace policy
• Check for exhaustive DecodeError matches in crates/tui
• Check default-features usage for base64 dep
• Verify compile / build health for codewhale-tui (partial — see note)
• Post final review

Summary: Mechanical dependency bump, diff limited to crates/tui/Cargo.toml:50 (base64 = "0.22.1" → "0.23.1") and the corresponding Cargo.lock entry. No source changes.

Response to the earlier codewhale-agent findings

The automated codewhale review bot flagged two WARNINGs on this PR; I verified both directly against the checked-out source:

• MSRV raised to 1.71.0 — confirmed the change exists upstream, but not a real risk here: workspace rust-version = "1.88" (Cargo.toml:35), well above 1.71.0.
• Potential breaking DecodeError::InvalidLastSymbol match — checked this exhaustively: grep -rn "DecodeError" crates/tui/src/ returns zero matches. No code in this crate pattern-matches on base64::DecodeError variants (all ~25 call sites across oauth.rs, chatgpt_oauth.rs, xai_oauth.rs, mcp/oauth.rs, client.rs, image_attach.rs, remote_control.rs, tools/shell.rs, tools/read_media.rs, tools/tool_result_retrieval.rs, tools/web/scrape.rs, tui/mark.rs, tui/clipboard.rs, commands/groups/core/voice.rs, test_support.rs use .ok(), .is_ok(), if let Ok(...), .expect(), or .unwrap() — none inspect the error variant). This finding does not apply to this codebase.
• Default simd-unsafe feature — accurate that 0.23 turns this on by default, but the workspace has no forbid(unsafe_code) lint or deny.toml policy that this would violate, and the crate doesn't opt into the new Simd/Avx2/Neon engines, so the added unsafe code isn't exercised by CodeWhale's own call paths. Informational only, no action needed.
• No test/CI results — accurate as a general request but not a compile risk given the two points above.

Verdict

Safe, low-risk bump. cargo check -p codewhale-tui was not runnable in this sandbox (tool approval required and not granted here), so final confirmation should come from CI's own cargo test --workspace run — but static verification of every call site plus the MSRV numbers gives high confidence this bump is a no-op for source compatibility. No code changes needed.

[codewhale-agent]

Codewhale review

Dependabot bump of base64 from 0.22.1 to 0.23.1 in crates/tui/Cargo.toml, with matching Cargo.lock dependency reference. No application code changes are included.

Findings

• [WARNING] base64 0.23 raises MSRV to 1.71.0 (crates/tui/Cargo.toml:51)
  The 0.23.0 release explicitly updates the minimum supported Rust version to 1.71.0. If this workspace supports older toolchains or has an MSRV policy below 1.71, this bump will break builds for those users/CI jobs. Confirm the workspace MSRV before merging.
• [INFO] DecodeError::InvalidLastSymbol payload may have changed
  Release notes state that DecodeError::InvalidLastSymbol now includes the decoded value. If any base64 decoding code in crates/tui matches exhaustively on DecodeError variants, it may fail to compile after this bump. A quick grep for InvalidLastSymbol or DecodeError is warranted.
• [INFO] New default simd-unsafe feature (crates/tui/Cargo.toml:51)
  base64 0.23 introduces SIMD-accelerated engines behind the default-on simd-unsafe feature. This is generally fine, but it is a new default feature with unsafe code; if the project has strict safety/audit or no_std constraints, confirm it is acceptable.

Assessment

The dependency bump is likely safe and should be mergeable after verifying MSRV compatibility and checking for exhaustive DecodeError matching. Running the existing test suite for crates/tui is important because no source changes are included.

---

Advisory review by Codewhale (codewhale review --pr 5875 --post, head 677b7fc924e3149e708b10078a0b8fb652ff2b92). Line-specific findings are also posted as inline review comments; mechanical fixes arrive as committable suggestions you can apply from the Files tab. CODEOWNERS approval still governs merge.

[codewhale-agent]

[WARNING] base64 0.23 raises MSRV to 1.71.0

The 0.23.0 release explicitly updates the minimum supported Rust version to 1.71.0. If this workspace supports older toolchains or has an MSRV policy below 1.71, this bump will break builds for those users/CI jobs. Confirm the workspace MSRV before merging.

[codewhale-agent]

[INFO] New default simd-unsafe feature

base64 0.23 introduces SIMD-accelerated engines behind the default-on simd-unsafe feature. This is generally fine, but it is a new default feature with unsafe code; if the project has strict safety/audit or no_std constraints, confirm it is acceptable.