Replace base64-compat dependency

[tcharding]

Now that we have MSRV 1.41.1 we can use the more modern base64 instead of the compat crate. Requires no changes other than changing the dependency.

[elichai]

ACK 38c41e4

[apoelstra]

I'm a little wary of doing this. The technical problem with base64 is solved but AFAIK not the social one, which is that the maintainer of base64 feels it's reasonable for a low-level widely-used crate to impose new MSRV requirements on its users in minor releases.

OTOH, since we blacklisted base64 we later discovered the cargo update --precise trick, so I suppose if this happens again we can just update our own README.

[apoelstra]

ACK 38c41e4

I think, since serde broke MSRV way back when, we need to accept that we're unable to NIH everything that annoys us, and the cargo update -p is honestly not that bad.

[tcharding]

OTOH, since we blacklisted base64 we later discovered the cargo update --precise trick, so I suppose if this happens again we can just update our own README.

Anything can break at anytime, right? Perhaps what we need is to defend against it by making sure our CI build/test against explicit versions so we know what works? This seems to be a recurring theme at the moment, I don't personally know an easy way to fix it? While we are at it I suppose we should discuss auditing specific dependency versions, has that been discussed/proposed before?

A testing epic is probably in order, I'm happy to work on it but probably after crate-smashing is done would be best?

[apoelstra]

I think it's reasonable to assume that every minor dependency will work, until it doesn't (in which case we'll need to add a pin and update our CI).

Pre-emptively pinning means that we're no longer testing the latest versions of dependencies, which are what our users are most likely to be using.

[sanket1729]

ACK 38c41e4

[Kixunil]

Noticed this comment while doing pre-release check of PRs:

but AFAIK not the social one, which is that the maintainer of base64 feels it's reasonable for a low-level widely-used crate to impose new MSRV requirements on its users in minor releases.

Doing MSRV bumps in minor releases is actually correct because forcing people to do cargo update -p is less bad than causing ecosystem breakage with major versions. I even believe it's OK to do in patch releases (as long as there's no new API ofc).