Skip to content

v0.4.2

Choose a tag to compare

View all tags
@joaquinbejar joaquinbejar released this 05 Jul 07:20
· 35 commits to main since this release
v0.4.2
1f5a2d4
This commit was signed with the committer’s verified signature.
joaquinbejar Joaquin Bejar Garcia
GPG key ID: 5782A6A9361489B6
Verified
Learn about vigilant mode.

Security

  • deps: bump quick-xml 0.40 -> 0.41 to clear two advisories published 2026-07-03, both patched only in >= 0.41.0 (#57, #58):

    • RUSTSEC-2026-0194 — quadratic run time when checking a start tag for duplicate attribute names.
    • RUSTSEC-2026-0195 — unbounded namespace-declaration allocation in NsReader (memory-exhaustion DoS).

    quick-xml is only used by ironsbe-schema (build-time SBE schema parsing); no API changes were needed and generated SBE output is unchanged. Practical exposure was low (schemas are vendored and trusted), but the advisories reddened cargo audit / cargo deny in downstream consumers.

Full changelog: v0.4.1...v0.4.2

Assets 2
Loading