From 7a90a9e2c274e850bcf816d8e81e8bf754b3c4ef Mon Sep 17 00:00:00 2001
From: natocool2 <natocool@gmail.com>
Date: Tue, 13 Oct 2026 09:07:49 +0100
Subject: [PATCH] Bump quick-xml to 0.41 (RUSTSEC-2026-0194, RUSTSEC-2026-0195)

RUSTSEC-2026-0194 (quadratic duplicate-attribute check) and RUSTSEC-2026-0195 (unbounded NsReader
namespace allocation) are fixed in quick-xml 0.41. lightcraft-meta and lightcraft-lensdb already read
attributes with with_checks(false) (and #687 keeps xmp_merge strict in linear time) and do not use
NsReader, so neither is reachable today; the bump clears the advisories and leaves one copy
(wayland-scanner already locks 0.41.0). No source changes needed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 Cargo.lock | 15 +++------------
 Cargo.toml |  2 +-
 2 files changed, 4 insertions(+), 13 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index bf2ac824f..6140c33f3 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3330,7 +3330,7 @@ version = "0.7.1"
 dependencies = [
  "lightcraft-develop",
  "lightcraft-geom",
- "quick-xml 0.38.4",
+ "quick-xml",
 ]
 
 [[package]]
@@ -3367,7 +3367,7 @@ dependencies = [
  "lightcraft-geom",
  "lightcraft-tiff",
  "proptest",
- "quick-xml 0.38.4",
+ "quick-xml",
  "serde",
  "serde_json",
 ]
@@ -4803,15 +4803,6 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
 
-[[package]]
-name = "quick-xml"
-version = "0.38.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b66c2058c55a409d601666cffe35f04333cf1013010882cec174a7467cd4e21c"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "quick-xml"
 version = "0.41.0"
@@ -6302,7 +6293,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "338e30461b3a2b67d70eb30a6d89f8e0c93a833e07d2ae89085cd070c4a00ac0"
 dependencies = [
  "proc-macro2",
- "quick-xml 0.41.0",
+ "quick-xml",
  "quote",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index 7effbe0d9..927a6035a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -55,7 +55,7 @@ libc = "0.2" # dev-only: process CPU time in benches
 dhat = "0.3" # opt-in heap profiling (lightcraft-cli --features dhat-heap); never in default builds
 
 # formats
-quick-xml = "0.38"
+quick-xml = "0.41"
 miniz_oxide = "0.8"
 
 # codecs