#969: Attributes (and anything that iterates BytesStart::attributes()
with the default with_checks(true)) no longer takes O(N²) time on a start
tag with a large number of attributes. Small tags keep the previous linear
scan; larger ones switch to a 64-bit hash pre-filter, so the whole tag is
O(N). The exact AttrError::Duplicated(new, prev) positions are unchanged.
#970: NamespaceResolver::push (and hence every NsReader Start/Empty
event) now rejects a start tag that declares more than
DEFAULT_MAX_DECLARATIONS_PER_ELEMENT (256) xmlns / xmlns:* namespace
bindings, returning the new NamespaceError::TooManyDeclarations. Previously
push allocated one NamespaceBinding per declaration with no upper bound,
before the event was returned to the caller, so an NsReader consumer could
not bound its memory exposure on untrusted input. The limit is configurable
via NamespaceResolver::set_max_declarations_per_element (use usize::MAX
to disable).

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [quick-xml](https://github.com/tafia/quick-xml) | dependencies | minor | `0.40` → `0.41` | --- ### Release Notes <details> <summary>tafia/quick-xml (quick-xml)</summary> ### [`v0.41.0`](https://github.com/tafia/quick-xml/blob/HEAD/Changelog.md#0410----2026-06-29) [Compare Source](https://github.com/tafia/quick-xml/compare/v0.40.1...v0.41.0) ##### New Features - [#970]: Add `NsReader::resolver_mut()` and `NamespaceResolver::{max_declarations_per_element, set_max_declarations_per_element}`. ##### Bug Fixes - [#969]: `Attributes` (and anything that iterates `BytesStart::attributes()` with the default `with_checks(true)`) no longer takes O(N²) time on a start tag with a large number of attributes. Small tags keep the previous linear scan; larger ones switch to a 64-bit hash pre-filter, so the whole tag is O(N). The exact `AttrError::Duplicated(new, prev)` positions are unchanged. - [#970]: `NamespaceResolver::push` (and hence every `NsReader` `Start`/`Empty` event) now rejects a start tag that declares more than `DEFAULT_MAX_DECLARATIONS_PER_ELEMENT` (256) `xmlns` / `xmlns:*` namespace bindings, returning the new `NamespaceError::TooManyDeclarations`. Previously `push` allocated one `NamespaceBinding` per declaration with no upper bound, before the event was returned to the caller, so an `NsReader` consumer could not bound its memory exposure on untrusted input. The limit is configurable via `NamespaceResolver::set_max_declarations_per_element` (use `usize::MAX` to disable). [#969]: https://github.com/tafia/quick-xml/issues/969 [#970]: https://github.com/tafia/quick-xml/issues/970 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

spacebot added 1 commit

2026-06-29 20:16:39 +02:00

Update Rust crate quick-xml to 0.41

Build and Test / rust-boss (push) Successful in 6m19s

Details

1f27b24f1e