build(deps): bump base64 from 0.22.1 to 0.23.1

[dependabot]

Bumps base64 from 0.22.1 to 0.23.1.

Changelog

Sourced from base64's changelog.

0.23.1

• Make the tests build again on non-SIMD architectures

0.23.0

• Added more consts for preconfigured configs and engines
• Make DecodeError::InvalidLastSymbol more clear by including the decoded value
• Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.
• Update MSRV to 1.71.0
• Add support for custom padding symbols

Commits

• 069bf70 v0.23.1
• 6ab1fb0 Merge pull request #310 from musicinmybrain/test-on-non-simd-arches
• 7cffce6 Fix testing on architectures without unsafe SIMD support
• e34f9a0 Merge pull request #308 from atouchet/com
• e9240c9 Remove outdated comment
• 9e9220a v0.23.0
• 870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
• fbec5f1 Document no trailing trailing bits
• 0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
• f10b7e2 Update deps & edition
• Additional commits viewable in compare view

[araujof]

Holding this open rather than merging or closing it.

base64 is pinned to 0.22 on purpose, so our code and jsonwebtoken share one copy. The reason is written down in builtins/plugins/identity-jwt/Cargo.toml: "Pinned to 0.22 to match what jsonwebtoken pulls — Cargo dedups to a single version."

Merging now would split that. jsonwebtoken 11.0.0 (the latest) still depends on base64 0.22, so the production graph would go from one copy to two: 0.22 for jsonwebtoken and pem, 0.23 for our three plugins. Not a correctness problem, since no base64 types cross an API boundary and we only decode locally, but it undoes the dedup the pin exists for. The 0.23 already in Cargo.lock today is dev-only, via bollard -> testcontainers.

This becomes a clean merge as soon as jsonwebtoken releases on base64 0.23. Leaving it open as the reminder to do it then.

[praxis-bot]

praxis-bot review — base64 0.22.1 → 0.23.1

No findings.

Checked:

• All three consumers (delegator-oauth, elicitation-ciba, identity-jwt) use only stable API surface: Engine trait import, general_purpose::STANDARD / URL_SAFE_NO_PAD with .encode() / .decode(). All remain in 0.23.
• DecodeError::InvalidLastSymbol gained a field, but no consumer pattern-matches on it (all use let Ok(..) = .. else).
• MSRV 1.96 exceeds base64 0.23’s requirement of 1.71.
• CI: 7/7 checks pass.
• The default-on simd-unsafe feature adds SIMD acceleration inside the dependency; it does not affect deny(unsafe_code) in the policy crates themselves.

Clean bump. No action required.

[maleck13]

/lgtm

[praxis-bot]

PR Review

Summary: Rebased since last review. No functional diff change. One stale comment found.

Severity	Count
Critical	0
Large	0
Medium	1

[praxis-bot]

[Medium] This comment still says "Pinned to 0.22 to match what jsonwebtoken pulls" but the version is now 0.23. The comment should be updated to reflect the new version, or rephrased to drop the specific version reference since base64 and jsonwebtoken may diverge independently.