fix(deps): update rust crate quick-xml to 0.41.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
quick-xml	dependencies	minor	0.39.2 → 0.41.0

---

Release Notes

tafia/quick-xml (quick-xml)

v0.41.0

Compare Source

New Features

• #​970: Add NsReader::resolver_mut() and
  NamespaceResolver::{max_declarations_per_element, set_max_declarations_per_element}.

Bug Fixes

• #​969: Attributes (and anything that iterates BytesStart::attributes()
  with the default with_checks(true)) no longer takes O(N²) time on a start
  tag with a large number of attributes. Small tags keep the previous linear
  scan; larger ones switch to a 64-bit hash pre-filter, so the whole tag is
  O(N). The exact AttrError::Duplicated(new, prev) positions are unchanged.
• #​970: NamespaceResolver::push (and hence every NsReader Start/Empty
  event) now rejects a start tag that declares more than
  DEFAULT_MAX_DECLARATIONS_PER_ELEMENT (256) xmlns / xmlns:* namespace
  bindings, returning the new NamespaceError::TooManyDeclarations. Previously
  push allocated one NamespaceBinding per declaration with no upper bound,
  before the event was returned to the caller, so an NsReader consumer could
  not bound its memory exposure on untrusted input. The limit is configurable
  via NamespaceResolver::set_max_declarations_per_element (use usize::MAX
  to disable).

v0.40.1

Compare Source

Bug Fixes

• #​964: Fix unreachable!() panic in the serde deserializer when a DOCTYPE
  declaration appears between two text runs inside an element (e.g.
  <a>x<!DOCTYPE y>z</a>). The DOCTYPE used to break drain_text's
  consecutive-text merge, so two DeEvent::Text events reached
  read_text and tripped its "Cannot be two consequent Text events"
  invariant. DOCTYPE is now treated as transparent during text drain —
  it still goes through the entity resolver, but the surrounding text
  is merged into one run. Discovered via libFuzzer on a real-world
  SAML deserializer harness.

Misc Changes

v0.40.0

Compare Source

MSRV bumped to 1.79.

Now quick-xml supports the UTF-16 encoded documents. See the new DecodingReader type.

New Features

• #​956: Add DecodingReader, a BufRead adapter that auto-detects encoding
  from BOM or XML declaration and transcodes to UTF-8. Enabled by the encoding feature.

• #​938: Add new enumeration XmlVersion and typified getter BytesDecl::xml_version().

• #​938: Add new error variant IllFormedError::UnknownVersion.

• #​371: Add new error variant EscapeError::TooManyNestedEntities.

• #​371: Improved compliance with the XML attribute value normalization process by adding

  • Attribute::normalized_value()
  • Attribute::normalized_value_with()
  • Attribute::decoded_and_normalized_value()
  • Attribute::decoded_and_normalized_value_with()

  which ought to be used in place of deprecated

  • Attribute::unescape_value()
  • Attribute::unescape_value_with()
  • Attribute::decode_and_unescape_value()
  • Attribute::decode_and_unescape_value_with()

  Deprecated functions now behaves the same as newly added.

Bug Fixes

• #​938: Use correct rules for EOL normalization in Deserializer when parse XML 1.0 documents.
  Previously XML 1.1. rules was applied.

Misc Changes

• #​914: Remove deprecated .prefixes(), .resolve(), .resolve_attribute(), and .resolve_element()
  of NsReader. Use .resolver().<...> methods instead.
• #​938: Now BytesText::xml_content, BytesCData::xml_content and BytesRef::xml_content
  accepts XmlVersion parameter to apply correct EOL normalization rules.
• #​944: read_text() now returns BytesText which allows you to get the content with
  properly normalized EOLs. To get the previous behavior use .read_text().decode()?.
• #​956: Bumped MSRV from 1.59 (Feb 2022) to 1.79 (June 2024)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.