fix: remediate dependency audit failures

[GeorgeLeePatterson]

What changed

• upgrade crossbeam-epoch from 0.9.18 to 0.9.20, resolving RUSTSEC-2026-0204
• upgrade quick-xml from 0.37.5 to 0.41.0, resolving RUSTSEC-2026-0194 and RUSTSEC-2026-0195
• document and narrowly ignore RUSTSEC-2026-0176 and RUSTSEC-2026-0177 until the coordinated Arrow 59 / ndarrow upgrade permits PyO3 0.29

Root cause and impact

The scheduled Security Audit ran against a newly updated RustSec database and found vulnerable versions already present in Cargo.lock. The two PyO3 advisories cannot currently be upgraded independently because arrow-pyarrow 58 requires PyO3 0.28 and ndarrow 0.0.4 requires Arrow 58. pynabled does not call the affected PyList/PyTuple iterator or PyCFunction::new_closure APIs.

Validation

• exact workflow cargo audit command passes with no unignored vulnerabilities
• nightly and stable clippy/feature matrices passed, including Arrow, Rayon, WGPU, OpenBLAS compile checks, and Quick XML 0.41
• focused nabled-model URDF suite: 8 passed
• full local just checks reached provider-linked tests but could not link because this Mac lacks /opt/homebrew/opt/openblas; GitHub CI supplies the provider environment
• no Rust source lines changed, so line-coverage scope is unchanged

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!