Skip to content

chore(deps): update rust crate base64 to 0.23 #38

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update rust crate base64 to 0.23 #38

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion sdk/rust/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ categories = ["api-bindings"]
[dependencies]
ureq = "2"
serde_json = "1"
base64 = "0.22" # 0.5.1 — wallet_hook(privy) needs Basic auth encoding
base64 = "0.23" # 0.5.1 — wallet_hook(privy) needs Basic auth encoding

@devin-ai-integration devin-ai-integration Bot Aug 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 Info: APIs used by the SDK are unaffected by the 0.22→0.23 bump; MSRV not pinned in-repo

Only two base64 usages exist in the Rust SDK — base64::engine::general_purpose::URL_SAFE_NO_PAD.encode (sdk/rust/src/lib.rs:30) and general_purpose::STANDARD.encode (sdk/rust/src/lib.rs:234) — both engine-API calls introduced in 0.21 and retained in 0.23; the 0.23 breaking notes concern DecodeError::InvalidLastSymbol and new consts/features, none of which are used (no decoding anywhere in the SDK). The new MSRV of 1.71.0 is also not a conflict: neither sdk/rust/Cargo.toml nor any workflow pins a rust-version/toolchain. Existing precedent in git history also shows dependency bumps not being recorded in CHANGELOG.md, so the missing Unreleased entry matches convention for non-user-facing chores.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@devin-ai-integration devin-ai-integration Bot Aug 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 New default-on SIMD engine feature ships unsafe code into the SDK

Per the release notes quoted in the PR, base64 0.23 adds SIMD-accelerated engines behind a default-on simd-unsafe feature. The dependency here is declared without default-features = false, so the SDK will now pull in runtime-detected unsafe SIMD code paths for the two call sites (sdk/rust/src/lib.rs:30 for the CDP-JWT base64url encoding and sdk/rust/src/lib.rs:234 for the Privy Basic auth header). These call sites encode tiny payloads where SIMD gives no meaningful benefit, so for a crypto-adjacent client SDK it may be preferable to opt out of the unsafe feature (base64 = { version = "0.23", default-features = false, features = ["std"] }). Worth confirming whether the repo has a policy on transitive unsafe code.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

urlencoding = "2" # 0.5.1 — wallet_hook(privy) URL-encodes the wallet_id path segment
p256 = { version = "0.13", features = ["pkcs8", "ecdsa"] } # 0.6.2 — CDP-JWT (ES256) signing
rand_core = "0.6" # 0.6.2 — nonce randomness for CDP-JWT
Loading