chore(deps): bump quick-xml from 0.37.5 to 0.41.0

[dependabot]

Bumps quick-xml from 0.37.5 to 0.41.0.

Release notes

Sourced from quick-xml's releases.

v0.41.0 - Secuirity fixes

What's Changed

New Features

• #970: Add NsReader::resolver_mut() and NamespaceResolver::{max_declarations_per_element, set_max_declarations_per_element}.

Bug Fixes

• #969: Attributes (and anything that iterates BytesStart::attributes() with the default with_checks(true)) no longer takes O(N²) time on a start tag with a large number of attributes. Small tags keep the previous linear scan; larger ones switch to a 64-bit hash pre-filter, so the whole tag is O(N). The exact AttrError::Duplicated(new, prev) positions are unchanged.
• #970: NamespaceResolver::push (and hence every NsReader Start/Empty event) now rejects a start tag that declares more than DEFAULT_MAX_DECLARATIONS_PER_ELEMENT (256) xmlns / xmlns:* namespace bindings, returning the new NamespaceError::TooManyDeclarations. Previously push allocated one NamespaceBinding per declaration with no upper bound, before the event was returned to the caller, so an NsReader consumer could not bound its memory exposure on untrusted input. The limit is configurable via NamespaceResolver::set_max_declarations_per_element (use usize::MAX to disable).

#969: tafia/quick-xml#969 #970: tafia/quick-xml#970

New Contributors

• @​qifan-sailboat made their first contribution in tafia/quick-xml#972

Full Changelog: tafia/quick-xml@v0.40.1...v0.41.0

v0.40.1 - Fix rarely possible serde deserialization panic

What's Changed

• #964: Fix unreachable!() panic in the serde deserializer when a DOCTYPE declaration appears between two text runs inside an element (e.g. <a>x<!DOCTYPE y>z</a>). The DOCTYPE used to break drain_text's consecutive-text merge, so two DeEvent::Text events reached read_text and tripped its "Cannot be two consequent Text events" invariant. DOCTYPE is now treated as transparent during text drain — it still goes through the entity resolver, but the surrounding text is merged into one run. Discovered via libFuzzer on a real-world SAML deserializer harness.

#964: tafia/quick-xml#964

New Contributors

• @​williamareynolds made their first contribution in tafia/quick-xml#964

Full Changelog: tafia/quick-xml@v0.40.0...v0.40.1

v0.40.0 - UTF-16 and ISO-2022-JP encodings supported

What's Changed

MSRV bumped to 1.79.

Now quick-xml supports the UTF-16 and ISO-2022-JP encoded documents. See the new DecodingReader type.

New Features

• #956: Add DecodingReader, a BufRead adapter that auto-detects encoding from BOM or XML declaration and transcodes to UTF-8. Enabled by the encoding feature.
• #938: Add new enumeration XmlVersion and typified getter BytesDecl::xml_version().
• #938: Add new error variant IllFormedError::UnknownVersion.
• #371: Add new error variant EscapeError::TooManyNestedEntities.
• #371: Improved compliance with the XML attribute value normalization process by adding
  • Attribute::normalized_value()
  • Attribute::normalized_value_with()
  • Attribute::decoded_and_normalized_value()
  • Attribute::decoded_and_normalized_value_with()

... (truncated)

Changelog

Sourced from quick-xml's changelog.

0.41.0 -- 2026-06-29

New Features

• #970: Add NsReader::resolver_mut() and NamespaceResolver::{max_declarations_per_element, set_max_declarations_per_element}.

Bug Fixes

• #969: Attributes (and anything that iterates BytesStart::attributes() with the default with_checks(true)) no longer takes O(N²) time on a start tag with a large number of attributes. Small tags keep the previous linear scan; larger ones switch to a 64-bit hash pre-filter, so the whole tag is O(N). The exact AttrError::Duplicated(new, prev) positions are unchanged.
• #970: NamespaceResolver::push (and hence every NsReader Start/Empty event) now rejects a start tag that declares more than DEFAULT_MAX_DECLARATIONS_PER_ELEMENT (256) xmlns / xmlns:* namespace bindings, returning the new NamespaceError::TooManyDeclarations. Previously push allocated one NamespaceBinding per declaration with no upper bound, before the event was returned to the caller, so an NsReader consumer could not bound its memory exposure on untrusted input. The limit is configurable via NamespaceResolver::set_max_declarations_per_element (use usize::MAX to disable).

#969: tafia/quick-xml#969 #970: tafia/quick-xml#970

0.40.1 -- 2026-05-15

Bug Fixes

• #964: Fix unreachable!() panic in the serde deserializer when a DOCTYPE declaration appears between two text runs inside an element (e.g. <a>x<!DOCTYPE y>z</a>). The DOCTYPE used to break drain_text's consecutive-text merge, so two DeEvent::Text events reached read_text and tripped its "Cannot be two consequent Text events" invariant. DOCTYPE is now treated as transparent during text drain — it still goes through the entity resolver, but the surrounding text is merged into one run. Discovered via libFuzzer on a real-world SAML deserializer harness.

#964: tafia/quick-xml#964

Misc Changes

0.40.0 -- 2026-05-11

MSRV bumped to 1.79.

... (truncated)

Commits

• 4deda08 Release 0.41.0
• 1b3b73b Remove unused argument to check!
• 07f3db8 Fix O(N²) duplicate-attribute check in Attributes iterator
• 7ca2526 Cap namespace declarations per element in NamespaceResolver::push
• 9aaea92 Release 0.40.1
• ce488bc Merge pull request #964 from williamareynolds/fix/de-doctype-in-text-unreachable
• e00ae5c Fix unreachable!() panic when DOCTYPE appears between text runs in element co...
• 2778564 Release 0.40.0
• 393db03 Merge pull request #962 from Mingun/prepare-0.40
• a27709a Fix misprint in code example
• Additional commits viewable in compare view

[dependabot]

Superseded by #162.