base64-ng 1.3.8

[eldryoth]

base64-ng 1.3.8

1.3.8 is a security-hardening and crate-family synchronization patch for
the base64-ng workspace.

Highlights

• Synchronized all workspace crate package versions to 1.3.8.
• Hardened base64-ng-tokio read-all helpers so vector growth copies into a
  guarded replacement and wipes the old allocation before deallocation.
• Applied guarded growth to bounded and unbounded helpers, with regression
  coverage above the 8 KiB eager capacity.
• Hardened Chromium-family wasm runtime evidence so success requires a
  runtime-created DOM attribute that is absent from the static HTML source.
• Made Alphabet::ENCODE the sole output definition used by Engine, so
  hand-written or stateful Alphabet::encode overrides cannot alter output;
  standard-family mapper selection is evaluated at compile time.
• Hardened the API-audit policy gate against harmless Markdown line wrapping.
• Added daily and manually dispatchable RustSec and cargo-deny monitoring for
  the workspace and isolated tool lockfiles.
• Updated async cleanup, release evidence, migration, and dependency examples.
• Moved the stronger RISC-V RVV proof and backend-admission review to 1.3.9.

Notes

Encoded output is unchanged for valid table-defined alphabets. Hand-written
Alphabet::encode overrides no longer affect Engine output; callers that
invoked those overrides directly retain their existing behavior. This patch
does not change SIMD admission, unsafe boundaries, or the
zero-runtime-dependency posture of base64-ng.

---

This discussion was created from the release base64-ng 1.3.8.