chore(deps): update rust crate base64 to 0.23.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
base64	workspace.dependencies	minor	0.22.1 → 0.23.0

---

Release Notes

marshallpierce/rust-base64 (base64)

v0.23.1

Compare Source

• Make the tests build again on non-SIMD architectures

v0.23.0

Compare Source

• Added more consts for preconfigured configs and engines
• Make DecodeError::InvalidLastSymbol more clear by including the decoded value
• Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best
  instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar
  GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime
  detection and work in no_std. The engines support the standard and URL-safe alphabets.
• Update MSRV to 1.71.0
• Add support for custom padding symbols

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

Review: chore(deps): update rust crate base64 to 0.23.0

Overview

Routine Renovate-generated dependency bump. Only Cargo.toml and Cargo.lock are touched — no source files changed. The workspace's direct base64 dependency moves from 0.22.1 → 0.23.0.

Code quality / correctness

• Direct usages of base64 in this repo (scotty/src/oauth/device_flow.rs, scotty/src/api/rest/handlers/apps/create.rs, scottyctl/src/commands/apps/management.rs) only use base64::prelude::*, BASE64_STANDARD, and engine::general_purpose — all stable, unchanged APIs per the 0.23.0 release notes. No source changes were needed, which matches what's in the diff.
• Workspace MSRV is pinned to 1.86 (Cargo.toml:8), comfortably above base64's new 1.71.0 MSRV requirement, so no toolchain conflict.

Potential issues

• Duplicate base64 versions in the lockfile: only scotty and scottyctl (the two workspace crates using base64 directly) moved to 0.23.0; transitive dependents (axum-extra, bcrypt, bollard, reqwest, oauth2, rust-embed, wiremock, etc.) are still pinned to base64 0.22.1. This is expected/unavoidable for a Renovate-only bump but does mean two copies of the crate are compiled — minor build-time/binary-size cost until those transitive deps also update upstream. Not blocking.
• New default-on SIMD feature: 0.23.0 introduces SIMD-accelerated engines (AVX2/NEON) behind a simd-unsafe feature that's on by default per the release notes. That pulls in additional unsafe code paths transitively. Worth a quick check on whether the project has a policy against enabling unsafe-implying features by default — if so, consider base64 = { version = "0.23.0", default-features = false, features = [...] }. Otherwise this is likely fine, since it comes from a well-maintained, widely-used crate.
• Unrelated transitive bumps riding along: the lockfile diff also bumps windows-sys (0.52.0 → 0.59.0/0.61.1), socket2 (0.5.10 → 0.6.3), and getrandom (0.3.1 → 0.4.1). These look like side effects of lockfile regeneration rather than something caused by the base64 bump itself. Worth confirming CI is green given these are Windows-syscall/socket-level crates, even though none of this is Windows-relevant for scotty's typical Linux deployment target.

Test coverage

No test changes needed/expected for a pure dependency bump. Recommend relying on CI (build + existing test suite) rather than adding new tests here.

Security

No CVE or security fix called out in the linked release notes; this is a routine feature/maintenance release. No concerns from a security standpoint.

Recommendation

Safe to merge once CI is green. No source changes required and no compatibility issues found in current usage patterns.

[claude]

Review

This is an automated Renovate dependency bump: base64 0.22.1 → 0.23.0 (only Cargo.toml + Cargo.lock touched, no source changes).

Compatibility check: I grepped the codebase for base64 usage:

• scotty/src/api/rest/handlers/apps/create.rs — base64::prelude::*
• scotty/src/oauth/device_flow.rs — base64::{engine::general_purpose, Engine as _}
• scotty-core/src/apps/file_list.rs — base64::prelude::*, base64::DecodeError

All of these APIs are stable across the 0.22 → 0.23 bump. The one behavioral change in the release notes (DecodeError::InvalidLastSymbol now carries the decoded value) doesn't affect this repo since no code pattern-matches on that variant's fields.

Lockfile diff: Several transitive dependencies (base64 itself remains dual-versioned at 0.22.1/0.23.1 since some deps like axum, bollard, reqwest, oauth2 still pin 0.22.1), plus some unrelated windows-sys/socket2/getrandom transitive bumps pulled in by the lockfile resolution. These are expected side effects of cargo update and not something this PR controls.

Code quality / bugs / security / tests: N/A — no application code changed. base64 is a widely-used, well-audited crate; this is a minor version bump with no reported security advisories driving it, just a routine update (SIMD-accelerated engines added behind a default-on simd-unsafe feature — worth being aware this pulls in cpufeatures/SIMD codegen, but not a concern for a server/CLI app like this).

Verdict: Safe to merge pending CI (build + cargo test) passing. No manual review of application logic needed.