From 60b2a81445160af85ab94a23774c74e6616decfe Mon Sep 17 00:00:00 2001
From: Michael Alan Dorman <mdorman@ironicdesign.com>
Date: Thu, 2 Jul 2026 10:08:15 -0400
Subject: [PATCH] Bump quick-xml to 0.41

Clears RUSTSEC-2026-0194 (O(N^2) duplicate-attribute check) and
RUSTSEC-2026-0195 (unbounded namespace-declaration allocation), DoS
advisories against quick-xml < 0.41.

The public quick-xml API used here is unchanged across 0.39 -> 0.41 and the
full --all-features test suite passes. Attribute::decode_and_unescape_value is
deprecated in 0.40 in favour of decoded_and_normalized_value but retains
identical behaviour, so it is left unchanged to keep this bump minimal.
---
 Cargo.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Cargo.toml b/Cargo.toml
index 976fbb7b52..a3056bba46 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -21,7 +21,7 @@ validation = ["chrono", "chrono/std", "url", "mime"]
 with-serde = ["serde", "atom_syndication/with-serde"]
 
 [dependencies]
-quick-xml = { version = "0.39", features = ["encoding"] }
+quick-xml = { version = "0.41", features = ["encoding"] }
 atom_syndication = { version = "0.12.8", optional = true }
 chrono = { version = "0.4.31", optional = true, default-features = false, features = ["alloc"] }
 derive_builder = { version = "0.20", optional = true }