Lower MSRV to Rust 1.90

Author: eldryoth

CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 1.0.1 - 2026-05-29
+
+- Lowered the documented MSRV from Rust `1.95.0` to Rust `1.90.0` after
+  confirming the current code builds, tests, lints, and documents cleanly on
+  Rust `1.90.0` without code changes.
+- Added README compiler-compatibility evidence for Rust `1.90.0` through
+  Rust `1.96.0`, while continuing to recommend the latest stable Rust for new
+  deployments.
+
 ## 1.0.0 - 2026-05-19
 
 - Started the stable API and security-contract freeze candidate after the

Cargo.lock

@@ -1,8 +1,8 @@
 [package]
 name = "base64-ng"
-version = "1.0.0"
+version = "1.0.1"
 edition = "2024"
-rust-version = "1.95"
+rust-version = "1.90"
 license = "MIT OR Apache-2.0"
 description = "no_std-first Base64 encoding and decoding with strict APIs and a security-heavy release process"
 repository = "https://github.com/valkyoth/base64-ng"

Cargo.toml

@@ -6,7 +6,7 @@ The crate starts conservative: a small scalar implementation, strict RFC 4648 be
 
 ## Current Status
 
-The current public release is `1.0.0`.
+The current public release is `1.0.1`.
 
 Implemented now:
 
@@ -47,7 +47,7 @@ Implemented now:
 Planned behind admission evidence:
 
 - Admitted AVX2, AVX-512, SSSE3/SSE4.1, ARM NEON, and wasm `simd128`
-  fast paths after the SIMD admission evidence is complete. The `1.0.0`
+  fast paths after the SIMD admission evidence is complete. The `1.0.1`
   release remains scalar-only.
 - Async streaming wrappers only after the `tokio` feature passes the
   dependency and cancellation-safety admission bar in [docs/ASYNC.md](docs/ASYNC.md).
@@ -63,7 +63,7 @@ Planned behind admission evidence:
 | Area | Status |
 | --- | --- |
 | License | `MIT OR Apache-2.0` |
-| MSRV | Rust `1.95.0` |
+| MSRV | Rust `1.90.0` |
 | Runtime dependencies | Zero external crates |
 | Unsafe policy | Scalar encode/decode remains safe Rust; audited unsafe is limited to volatile wiping, CT barriers, validated secret UTF-8 conversion, and test-only SIMD prototypes |
 | Active backend | Scalar only |
@@ -77,11 +77,28 @@ Planned behind admission evidence:
 Full adoption details live in [docs/TRUST.md](docs/TRUST.md). Security-control
 and CWE mapping lives in [docs/SECURITY_CONTROLS.md](docs/SECURITY_CONTROLS.md).
 
+## Rust Version Support
+
+The minimum supported Rust version is Rust `1.90.0`. New deployments should
+prefer the latest stable Rust; as of May 29, 2026, that is Rust `1.96.0`.
+
+Compatibility evidence for `1.0.1`:
+
+| Rust | Local Evidence |
+| --- | --- |
+| `1.90.0` | ✓ full release gate |
+| `1.91.0` | ✓ `cargo check --all-features` |
+| `1.92.0` | ✓ `cargo check --all-features` |
+| `1.93.0` | ✓ `cargo check --all-features` |
+| `1.94.0` | ✓ `cargo check --all-features` |
+| `1.95.0` | ✓ `cargo check --all-features` |
+| `1.96.0` | ✓ `cargo check --all-features` |
+
 ## Install
 
 ```toml
 [dependencies]
-base64-ng = "1.0.0"
+base64-ng = "1.0.1"
 ```
 
 The crate is dual-licensed:
@@ -108,7 +125,7 @@ Disable defaults for embedded or freestanding use:
 
 ```toml
 [dependencies]
-base64-ng = { version = "1.0.0", default-features = false }
+base64-ng = { version = "1.0.1", default-features = false }
 ```
 
 ## Example
@@ -694,7 +711,8 @@ assert_eq!(&encoded[..written], b"aGVsbG8");
 
 Security commitments:
 
-- Stable Rust first. Current toolchain pin: Rust `1.95.0`.
+- Stable Rust first. Current MSRV toolchain pin: Rust `1.90.0`. New deployments
+  should prefer the latest stable Rust, currently Rust `1.96.0`.
 - `no_std` core by default.
 - Scalar encode/decode remains safe Rust.
 - Audited unsafe helpers in `src/lib.rs` perform volatile best-effort wiping

README.md

@@ -5,13 +5,13 @@ on the compiler bundled with the installed `cargo-kani` release.
 
 ## Current Status
 
-- Local Rust toolchain: Rust `1.95.0`.
+- Local Rust toolchain: Rust `1.90.0`.
 - Locally tested Kani: `cargo-kani 0.67.0`.
 - Current result: `scripts/check_kani.sh` records an explicit skip because the
   installed Kani compiler is older than this crate's `rust-version`.
 
 This is not a normal Cargo dependency-resolution issue. Kani runs are compiler-integration-sensitive because Kani is a verifier with its own compiler integration.
-Updating the project to Rust `1.95` does not make an older Kani release
+Updating the project to Rust `1.90` does not make an older Kani release
 understand that toolchain automatically.
 
 ## How To Check

docs/KANI.md

@@ -29,14 +29,14 @@ After:
 
 ```toml
 [dependencies]
-base64-ng = "1.0.0"
+base64-ng = "1.0.1"
 ```
 
 For embedded or freestanding use:
 
 ```toml
 [dependencies]
-base64-ng = { version = "1.0.0", default-features = false }
+base64-ng = { version = "1.0.1", default-features = false }
 ```
 
 ## Engine Mapping
@@ -168,7 +168,7 @@ Enable the `stream` feature for `std::io` wrappers:
 
 ```toml
 [dependencies]
-base64-ng = { version = "1.0.0", features = ["stream"] }
+base64-ng = { version = "1.0.1", features = ["stream"] }
 ```
 
 ```rust

docs/MIGRATION.md

@@ -8,7 +8,7 @@ Build `base64-ng` as a modern, secure, `no_std`-first Base64 implementation for
 
 ## Current Baseline
 
-- Rust stable: `1.95.0`.
+- Rust stable/MSRV: `1.90.0`.
 - License: `MIT OR Apache-2.0`.
 - Project name: `base64-ng`.
 - Runtime and dev dependency graph: zero external crates.
@@ -498,7 +498,7 @@ cryptographic behavior until compatible verifier evidence exists.
   workflow, or document through [KANI.md](KANI.md) why Kani remains unavailable
   and what evidence replaces it for `v1.0`.
   Completed direction: keep the Kani harnesses in-tree, document an explicit
-  verifier exception while local Kani is behind Rust `1.95`, and require Miri,
+  verifier exception while local Kani is behind Rust `1.90`, and require Miri,
   bounded fuzz smoke, generated-code evidence, panic-policy checks,
   deterministic tests, release-policy validators, and invariant documentation
   as replacement release evidence for the initial `1.0.0` contract.

docs/PLAN.md

@@ -1,6 +1,6 @@
 # SIMD Admission Policy
 
-`base64-ng` is intentionally scalar-only in the `1.0.0` release. Future SIMD
+`base64-ng` is intentionally scalar-only in the `1.0.1` release. Future SIMD
 dispatch remains gated unless a complete SIMD admission evidence package lands
 in a later release series. The crate uses `#![deny(unsafe_code)]` and permits reviewed
 `allow(unsafe_code)` exceptions only for audited cleanup, CT barrier, validated

docs/SIMD.md

@@ -10,7 +10,7 @@ the admitted implementation.
 - Admitted backends: none.
 - Active backend: scalar only.
 - Public performance claims: none.
-- Release status: `1.0.0` remains scalar-only. Future releases may admit an
+- Release status: `1.0.1` remains scalar-only. Future releases may admit an
   accelerated backend only when this manifest is updated with a complete
   backend admission evidence package in the same release series.
 

docs/SIMD_ADMISSION.md

@@ -7,7 +7,7 @@ stable release.
 | Area | Current Status | Evidence |
 | --- | --- | --- |
 | License | `MIT OR Apache-2.0` | `Cargo.toml`, `LICENSE-MIT`, `LICENSE-APACHE` |
-| MSRV | Rust `1.95.0` | `Cargo.toml`, `rust-toolchain.toml` |
+| MSRV | Rust `1.90.0` | `Cargo.toml`, `rust-toolchain.toml` |
 | Runtime dependencies | Zero external crates | `scripts/validate-dependencies.sh` |
 | Default dev dependencies | Zero external crates | `Cargo.toml` |
 | Optional runtime features | `alloc`, `std`, `stream`; `allow-wasm32-best-effort-wipe` explicit wasm cleanup-limit acceptance; `allow-compiler-fence-only-wipe` explicit unsupported-native cleanup-limit acceptance; reserved `simd`, `tokio`, `kani`, `fuzzing` | `Cargo.toml`, `scripts/check_reserved_features.sh`, `scripts/check_wasm_wipe_policy.sh` |