#969: Attributes (and anything that iterates BytesStart::attributes()
with the default with_checks(true)) no longer takes O(N²) time on a start
tag with a large number of attributes. Small tags keep the previous linear
scan; larger ones switch to a 64-bit hash pre-filter, so the whole tag is
O(N). The exact AttrError::Duplicated(new, prev) positions are unchanged.
#970: NamespaceResolver::push (and hence every NsReader Start/Empty
event) now rejects a start tag that declares more than
DEFAULT_MAX_DECLARATIONS_PER_ELEMENT (256) xmlns / xmlns:* namespace
bindings, returning the new NamespaceError::TooManyDeclarations. Previously
push allocated one NamespaceBinding per declaration with no upper bound,
before the event was returned to the caller, so an NsReader consumer could
not bound its memory exposure on untrusted input. The limit is configurable
via NamespaceResolver::set_max_declarations_per_element (use usize::MAX
to disable).

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [quick-xml](https://github.com/tafia/quick-xml) | dependencies | minor | `0.40.0` → `0.41.0` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/14) for more information. --- ### Release Notes <details> <summary>tafia/quick-xml (quick-xml)</summary> ### [`v0.41.0`](https://github.com/tafia/quick-xml/blob/HEAD/Changelog.md#0410----2026-06-29) [Compare Source](https://github.com/tafia/quick-xml/compare/v0.40.1...v0.41.0) ##### New Features - [#970]: Add `NsReader::resolver_mut()` and `NamespaceResolver::{max_declarations_per_element, set_max_declarations_per_element}`. ##### Bug Fixes - [#969]: `Attributes` (and anything that iterates `BytesStart::attributes()` with the default `with_checks(true)`) no longer takes O(N²) time on a start tag with a large number of attributes. Small tags keep the previous linear scan; larger ones switch to a 64-bit hash pre-filter, so the whole tag is O(N). The exact `AttrError::Duplicated(new, prev)` positions are unchanged. - [#970]: `NamespaceResolver::push` (and hence every `NsReader` `Start`/`Empty` event) now rejects a start tag that declares more than `DEFAULT_MAX_DECLARATIONS_PER_ELEMENT` (256) `xmlns` / `xmlns:*` namespace bindings, returning the new `NamespaceError::TooManyDeclarations`. Previously `push` allocated one `NamespaceBinding` per declaration with no upper bound, before the event was returned to the caller, so an `NsReader` consumer could not bound its memory exposure on untrusted input. The limit is configurable via `NamespaceResolver::set_max_declarations_per_element` (use `usize::MAX` to disable). [#969]: https://github.com/tafia/quick-xml/issues/969 [#970]: https://github.com/tafia/quick-xml/issues/970 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

spacebot added 1 commit

2026-06-29 20:30:32 +02:00

Update Rust crate quick-xml to 0.41.0

Build and Test / account (push) Successful in 3m15s

Details

fc3000cec9

spacebot force-pushed renovate/quick-xml-0.x from fc3000cec9

Build and Test / account (push) Successful in 3m15s

Details

to 35a3e27591

Build and Test / account (push) Successful in 28m55s

Details