RUSTSEC-2026-0194 (quadratic duplicate-attribute check) and RUSTSEC-2026-0195 (unbounded NsReader
namespace allocation) are fixed in quick-xml 0.41. deckcraft-pptx already reads attributes with
with_checks(false) and does not use NsReader, so neither is reachable today; the bump keeps the
workspace on a supported quick-xml and leaves one copy (wayland-scanner already locks 0.41.0).
decode_and_unescape_value() is deprecated in 0.41 (clippy -D warnings); decoded_and_normalized_value
(Implicit1_0, ...) is what the deprecated method now does.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
