Prepare 1.3.1 release candidate

Author: eldryoth

CHANGELOG.md

@@ -1,16 +1,20 @@
 # Changelog
 
-## 1.3.1 - Unreleased
+## 1.3.1 - 2026-07-03
 
 - Added `base64-ng-tokio` `EncoderWriter` and `DecoderWriter` manual
   `AsyncWrite` streaming adapters with fixed internal queues, explicit
   shutdown finalization, short-write/backpressure handling, fail-closed error
   latching, and drop cleanup.
 - Added deterministic Tokio tests for split writes, pending shutdown drains,
-  malformed decode failure, unpadded decoder shutdown tails, and inner writer
-  errors.
+  malformed decode failure, unpadded decoder shutdown tails, inner writer
+  errors, large-input capacity clamps, and one-byte backpressure.
+- Extended panic-policy validation to companion crate production source and
+  added a permanent `security/pentest/v1.3.1.md` review artifact.
 - Updated async, dependency, trust, and README documentation so Tokio writer
   adapters are no longer described as deferred.
+- Synchronized all workspace crate package versions to `1.3.1` so the crate
+  family continues to publish under one visible version line.
 
 ## 1.3.0 - 2026-07-02
 

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "base64-ng"
-version = "1.3.0"
+version = "1.3.1"
 edition = "2024"
 rust-version = "1.90"
 license = "MIT OR Apache-2.0"

Cargo.toml

@@ -29,20 +29,26 @@ The crate starts conservative: a small scalar implementation, strict RFC 4648 be
 
 ## Current Status
 
-The current public release is `1.3.0`.
+The current public release is `1.3.1`.
 
-`1.3.0` is the implementation-completion release for the original full
-Base64 scope. It keeps the conservative `1.2.x` encode acceleration posture and
-adds admitted normal strict SIMD decode for Standard and URL-safe alphabet
-families on std `x86`/`x86_64` AVX-512 VBMI, AVX2, SSSE3/SSE4.1, and
-little-endian std `aarch64` NEON after whole-input scalar validation.
+`1.3.1` is a focused patch on top of the `1.3.0`
+implementation-completion release. It keeps the conservative `1.2.x` encode
+acceleration posture and the admitted `1.3.0` normal strict SIMD decode scope
+for Standard and URL-safe alphabet families on std `x86`/`x86_64` AVX-512
+VBMI, AVX2, SSSE3/SSE4.1, and little-endian std `aarch64` NEON after
+whole-input scalar validation.
 
 Encode acceleration remains active only for admitted Standard and URL-safe
 fixed-block surfaces. Decode acceleration remains limited to normal strict
 decode. Wrapped decode, legacy whitespace decode, custom alphabets,
 bcrypt-style and `crypt(3)` profiles, in-place decode, `no_std`, wasm runtime
 dispatch, and constant-time-oriented secret decode remain scalar.
 
+The latest companion-crate patch in this line is `base64-ng-tokio` `1.3.1`,
+which adds reviewed manual `AsyncWrite` streaming adapters. The core
+`base64-ng` crate is also `1.3.1` so the main crate version stays aligned with
+changed companion crates.
+
 Implemented on this branch now:
 
 - `no_std` core with optional `alloc` and `std` features.
@@ -150,7 +156,7 @@ The minimum supported Rust version is Rust `1.90.0`. New deployments should
 prefer the latest tested stable Rust; as of July 2, 2026, this project tests
 through Rust `1.96.1`.
 
-Compatibility evidence for the `1.3.0` workspace:
+Compatibility evidence for the `1.3.1` workspace:
 
 | Rust | Local Evidence |
 | --- | --- |
@@ -167,7 +173,7 @@ Compatibility evidence for the `1.3.0` workspace:
 
 ```toml
 [dependencies]
-base64-ng = "1.3.0"
+base64-ng = "1.3.1"
 ```
 
 The crate is dual-licensed:
@@ -228,8 +234,8 @@ decode directly into `sanitization::LockedSecretBytes` or
 
 ```toml
 [dependencies]
-base64-ng = { version = "1.3.0", default-features = false }
-base64-ng-sanitization = { version = "1.3.0", default-features = false }
+base64-ng = { version = "1.3.1", default-features = false }
+base64-ng-sanitization = { version = "1.3.1", default-features = false }
 ```
 
 ```rust
@@ -248,7 +254,7 @@ assert!(secret.sanitization_verify(
 
 ```toml
 [dependencies]
-base64-ng-sanitization = { version = "1.3.0", features = ["high-assurance"] }
+base64-ng-sanitization = { version = "1.3.1", features = ["high-assurance"] }
 ```
 
 ```rust
@@ -267,8 +273,8 @@ newtypes around fixed byte arrays:
 
 ```toml
 [dependencies]
-base64-ng = { version = "1.3.0", default-features = false }
-base64-ng-derive = "1.3.0"
+base64-ng = { version = "1.3.1", default-features = false }
+base64-ng-derive = "1.3.1"
 ```
 
 ```rust
@@ -287,7 +293,7 @@ assert_eq!(key.encode_base64::<8>().unwrap().as_str(), "aGVsbG8=");
 
 ```toml
 [dependencies]
-base64-ng-serde = "1.3.0"
+base64-ng-serde = "1.3.1"
 serde = { version = "1.0.228", features = ["derive"] }
 ```
 
@@ -306,8 +312,8 @@ Field-level modules are available for `standard`, `standard_no_pad`,
 
 ```toml
 [dependencies]
-base64-ng = "1.3.0"
-base64-ng-bytes = "1.3.0"
+base64-ng = "1.3.1"
+base64-ng-bytes = "1.3.1"
 bytes = "1.12.0"
 ```
 
@@ -324,8 +330,8 @@ projects that already admit `subtle`:
 
 ```toml
 [dependencies]
-base64-ng = "1.3.0"
-base64-ng-subtle = "1.3.0"
+base64-ng = "1.3.1"
+base64-ng-subtle = "1.3.1"
 ```
 
 ```rust
@@ -343,8 +349,8 @@ controlled by a peer:
 
 ```toml
 [dependencies]
-base64-ng = "1.3.0"
-base64-ng-tokio = "1.3.0"
+base64-ng = "1.3.1"
+base64-ng-tokio = "1.3.1"
 tokio = { version = "1.52.3", features = ["io-util"] }
 ```
 
@@ -377,7 +383,7 @@ Disable defaults for embedded or freestanding use:
 
 ```toml
 [dependencies]
-base64-ng = { version = "1.3.0", default-features = false }
+base64-ng = { version = "1.3.1", default-features = false }
 ```
 
 Enable admitted encode acceleration on supported `std` targets with the
@@ -389,7 +395,7 @@ and URL-safe alphabets after whole-input scalar validation:
 
 ```toml
 [dependencies]
-base64-ng = { version = "1.3.0", features = ["simd"] }
+base64-ng = { version = "1.3.1", features = ["simd"] }
 ```
 
 ```rust

README.md

@@ -1,6 +1,6 @@
 [package]
 name = "base64-ng-bytes"
-version = "1.3.0"
+version = "1.3.1"
 edition = "2024"
 rust-version = "1.90"
 license = "MIT OR Apache-2.0"
@@ -23,7 +23,7 @@ default = ["std"]
 std = ["base64-ng/std", "bytes/std"]
 
 [dependencies]
-base64-ng = { version = "1.3.0", path = "../..", default-features = false, features = ["alloc"] }
+base64-ng = { version = "1.3.1", path = "../..", default-features = false, features = ["alloc"] }
 bytes = { version = "1.12.0", default-features = false }
 
 [lints.rust]

crates/base64-ng-bytes/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "base64-ng-derive"
-version = "1.3.0"
+version = "1.3.1"
 edition = "2024"
 rust-version = "1.90"
 license = "MIT OR Apache-2.0"
@@ -27,7 +27,7 @@ default = []
 [dependencies]
 
 [dev-dependencies]
-base64-ng = { version = "1.3.0", path = "../..", default-features = false }
+base64-ng = { version = "1.3.1", path = "../..", default-features = false }
 
 [lints.rust]
 unsafe_code = "deny"

crates/base64-ng-derive/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "base64-ng-sanitization"
-version = "1.3.0"
+version = "1.3.1"
 edition = "2024"
 rust-version = "1.90"
 license = "MIT OR Apache-2.0"
@@ -31,7 +31,7 @@ strict-ct = ["sanitization/strict-ct"]
 wasm-compat = ["sanitization/wasm-compat"]
 
 [dependencies]
-base64-ng = { version = "1.3.0", path = "../..", default-features = false }
+base64-ng = { version = "1.3.1", path = "../..", default-features = false }
 sanitization = { version = "=1.2.2", default-features = false }
 
 [lints.rust]

crates/base64-ng-sanitization/Cargo.toml

@@ -8,8 +8,8 @@ constant-time-oriented Base64 decode into clear-on-drop secret containers.
 
 ```toml
 [dependencies]
-base64-ng = { version = "1.3.0", default-features = false }
-base64-ng-sanitization = { version = "1.3.0", default-features = false }
+base64-ng = { version = "1.3.1", default-features = false }
+base64-ng-sanitization = { version = "1.3.1", default-features = false }
 ```
 
 ```rust
@@ -29,15 +29,15 @@ assert!(secret.sanitization_verify(
 Enable `alloc` for heap-backed `sanitization::SecretVec` helpers:
 
 ```toml
-base64-ng-sanitization = { version = "1.3.0", features = ["alloc"] }
+base64-ng-sanitization = { version = "1.3.1", features = ["alloc"] }
 ```
 
 For high-assurance native deployments, enable locked storage helpers. This
 uses `sanitization` 1.2.2's `memory-lock`, `canary-check`, and
 `random-canary` features and decodes directly into locked memory:
 
 ```toml
-base64-ng-sanitization = { version = "1.3.0", features = ["high-assurance"] }
+base64-ng-sanitization = { version = "1.3.1", features = ["high-assurance"] }
 ```
 
 ```rust
@@ -90,5 +90,5 @@ For deployments that want `sanitization`'s assembly-backed comparison checks,
 enable the passthrough features:
 
 ```toml
-base64-ng-sanitization = { version = "1.3.0", features = ["strict-ct"] }
+base64-ng-sanitization = { version = "1.3.1", features = ["strict-ct"] }
 ```

crates/base64-ng-sanitization/README.md

@@ -1,6 +1,6 @@
 [package]
 name = "base64-ng-serde"
-version = "1.3.0"
+version = "1.3.1"
 edition = "2024"
 rust-version = "1.90"
 license = "MIT OR Apache-2.0"
@@ -24,7 +24,7 @@ alloc = ["base64-ng/alloc", "serde/alloc"]
 std = ["alloc", "base64-ng/std", "serde/std"]
 
 [dependencies]
-base64-ng = { version = "1.3.0", path = "../..", default-features = false }
+base64-ng = { version = "1.3.1", path = "../..", default-features = false }
 serde = { version = "1.0.228", default-features = false }
 
 [dev-dependencies]

crates/base64-ng-serde/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "base64-ng-subtle"
-version = "1.3.0"
+version = "1.3.1"
 edition = "2024"
 rust-version = "1.90"
 license = "MIT OR Apache-2.0"
@@ -24,7 +24,7 @@ alloc = ["base64-ng/alloc"]
 std = ["alloc", "base64-ng/std", "subtle/std"]
 
 [dependencies]
-base64-ng = { version = "1.3.0", path = "../..", default-features = false }
+base64-ng = { version = "1.3.1", path = "../..", default-features = false }
 subtle = { version = "2.6.1", default-features = false }
 
 [lints.rust]