Skip to content

Bump quick-xml to 0.41.0 to remediate high-severity RustSec DoS advisories#282

Merged
Bergmann89 merged 3 commits into
masterfrom
copilot/bump-quick-xml-to-0-41
Jul 2, 2026
Merged

Bump quick-xml to 0.41.0 to remediate high-severity RustSec DoS advisories#282
Bergmann89 merged 3 commits into
masterfrom
copilot/bump-quick-xml-to-0-41

Conversation

Copilot AI commented Jul 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

quick-xml was pinned to 0.38.4, which is affected by two high-severity RustSec advisories (quadratic duplicate-attribute checks and unbounded namespace allocation). This PR updates the workspace to the fixed line (0.41.x) and refreshes the lockfile accordingly.

  • Dependency remediation

    • Updated workspace dependency in Cargo.toml:
      • quick-xml = "0.38" → quick-xml = "0.41"
    • Regenerated lockfile entry in Cargo.lock:
      • quick-xml 0.38.4 → quick-xml 0.41.0

  • Scope

    • No functional code changes.
    • No API or feature-surface changes beyond the dependency upgrade.
# Cargo.toml (workspace dependencies)
-quick-xml = "0.38"
+quick-xml = "0.41"

Copilot AI linked an issue Jul 2, 2026 that may be closed by this pull request
Vulnerable quick-xml 0.38 — two HIGH RustSec advisories #281
Closed
Copilot AI changed the title [WIP] Update quick-xml to version 0.41 due to security advisories Bump quick-xml to 0.41.0 to remediate high-severity RustSec DoS advisories Jul 2, 2026
Copilot AI requested a review from Bergmann89 July 2, 2026 18:48
@Bergmann89
Bergmann89 marked this pull request as ready for review July 2, 2026 18:53
@Bergmann89

Bergmann89 commented Jul 2, 2026

Copy link
Copy Markdown
Owner

@copilot Pipeline is failing. Fix it.

Copilot AI commented Jul 2, 2026

Copy link
Copy Markdown
Contributor Author

@copilot Pipeline is failing. Fix it.

Fixed in commit 3705da9. I investigated the failing workflow run and updated a broken rustdoc intra-doc link introduced by the quick-xml 0.41 API docs change (quick_xml::NsReader::resolve -> quick_xml::name::NamespaceResolver::resolve). I also verified with RUSTDOCFLAGS='-D warnings' cargo doc --no-deps and targeted tests.

@Bergmann89
Bergmann89 merged commit eb356b2 into master Jul 2, 2026
2 checks passed
@Bergmann89
Bergmann89 deleted the copilot/bump-quick-xml-to-0-41 branch July 2, 2026 20:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@Bergmann89 Bergmann89 Bergmann89 approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@Bergmann89 Bergmann89

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Vulnerable quick-xml 0.38 — two HIGH RustSec advisories

2 participants

@Bergmann89