Prepare 1.3.7 release on Rust 1.97

Author: eldryoth

.github/workflows/ci.yml

@@ -23,28 +23,34 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust toolchain
         shell: bash
         run: scripts/ci_install_rust.sh
 
       - name: Cache Rust build output
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           cache-on-failure: true
 
-      - name: Install security tools
-        uses: taiki-e/install-action@v2
+      - name: Install security and test tools
+        uses: taiki-e/install-action@c7eb1735f09259a5035e8e5d44b1406b1cddc0fb # v2.83.0
         with:
-          tool: cargo-deny,cargo-audit,cargo-sbom
+          tool: cargo-deny@0.20.2,cargo-audit@0.22.2,cargo-nextest@0.9.140
+          fallback: none
 
-      - name: Install cargo-license
-        run: cargo install --locked cargo-license --version 0.7.0
+      - name: Install crates.io release tools
+        run: |
+          cargo install --locked cargo-license --version 0.7.0
+          cargo install --locked cargo-sbom --version 0.10.0
 
       - name: Run checks
         run: scripts/checks.sh
 
+      - name: Run nextest
+        run: cargo nextest run --all-features
+
       - name: Check fuzz-only dependencies
         run: scripts/check_fuzz.sh
 
@@ -85,16 +91,17 @@ jobs:
           - 1.95.0
           - 1.96.0
           - 1.96.1
+          - 1.97.0
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust toolchain
         run: rustup toolchain install ${{ matrix.toolchain }}
 
       - name: Cache Rust build output
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           cache-on-failure: true
           key: rust-${{ matrix.toolchain }}
@@ -122,14 +129,14 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust toolchain
         shell: bash
         run: scripts/ci_install_rust.sh
 
       - name: Cache Rust build output
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           cache-on-failure: true
 
@@ -169,7 +176,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust toolchain
         shell: bash
@@ -179,7 +186,7 @@ jobs:
         run: rustup target add ${{ matrix.target }}
 
       - name: Cache Rust build output
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           cache-on-failure: true
 
@@ -196,7 +203,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust toolchain
         shell: bash

CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 1.3.7 - 2026-07-10
+
+- Synchronized all workspace crate package versions to `1.3.7`.
+- Prepared release metadata, dependency examples, migration guidance, and
+  crate-family publishing order for the `1.3.7` maintenance release.
+- Moved the active release toolchain to Rust `1.97.0` while retaining Rust
+  `1.90.0` as the separately checked MSRV.
+- Made CI fail closed if the active `rustc` version differs from the exact
+  release-toolchain pin.
+- Updated test-only byte iteration syntax for the Rust `1.97.0` Clippy policy.
+- Updated constant-time assembly evidence parsing for Rust `1.97.0`'s default
+  v0 symbol mangling while preserving legacy-symbol compatibility.
+- Updated `base64-ng-bytes` to `bytes` `1.12.1` and
+  `base64-ng-sanitization` to exact-pinned `sanitization` `1.2.4`.
+- Pinned GitHub Actions to the latest audited releases: checkout `v6.0.2`,
+  rust-cache `v2.9.1`, and install-action `v2.83.0`.
+- Added exact-version cargo-nextest installation and the 210-test nextest suite
+  to GitHub CI, with install-action fallback disabled.
+- Pinned documented release-tool installs to the audited current versions,
+  including cargo-nextest `0.9.140` and cargo-fuzz `0.13.2`.
+- Deferred the stronger RISC-V RVV proof and backend-admission review to
+  `1.3.8`; the existing RISC-V posture remains QEMU-tested
+  scalar/fallback-only.
+- No core encode/decode logic, SIMD admission scope, unsafe boundary, or core
+  zero-dependency posture changes.
+
 ## 1.3.6 - 2026-07-09
 
 - Synchronized all workspace crate package versions to `1.3.6`.

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "base64-ng"
-version = "1.3.6"
+version = "1.3.7"
 edition = "2024"
 rust-version = "1.90"
 license = "MIT OR Apache-2.0"