Skip to content

v0.12.2 — security patch (quick-xml 0.41, RUSTSEC-2026-0194/-0195)

Choose a tag to compare

View all tags
@fastrevmd-lab fastrevmd-lab released this 02 Jul 13:59
v0.12.2
9e353d1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security patch for all three crates — closes #31 (via PR #32). No API changes.

crates.io: rustnetconf 0.12.2 · rustnetconf-cli 0.3.2 · rustnetconf-yang 0.1.4

Changes

  • quick-xml 0.37 → 0.41 — clears two RUSTSEC advisories in the XML parser that handles device-returned NETCONF data:
    • RUSTSEC-2026-0194 — quadratic run time checking a start tag for duplicate attribute names
    • RUSTSEC-2026-0195 — unbounded namespace-declaration allocation (memory-exhaustion DoS)
  • Entity handling adapted to quick-xml 0.38+ semantics — entity references (&amp;, &#38;, …) now stream as separate GeneralRef events instead of arriving decoded inside text. All reader loops accumulate and resolve them, so element values containing &, <, > (Junos descriptions, URLs, error messages) round-trip whole instead of being silently truncated. Covered by new round-trip regression tests in every parser.
  • Dropped the unused serialize (serde) feature of quick-xml in rustnetconf-yang.

Downstream consumers (rustez, RustJunosMCP) should bump to these releases to pick up the transitive fix.

Assets 2
Loading