fix(ci): restore failing checks

[salasebas]

Summary

• fix the Rust 1.97 Clippy regression without suppressing the lint
• repair the invalid integration workflow by removing the duplicate workflow_dispatch key
• update crossbeam-epoch, quick-xml, and the pinned opensaml revision to remove the active RustSec findings
• adapt RustAuth's SAML integration to the updated opensaml/quick-xml APIs while preserving logout correlation behavior and configured encrypted-assertion compatibility
• add regression coverage for named and numeric XML entity references

Root cause

CI had three independent failures:

1. The floating stable toolchain on GitHub moved to Rust/Clippy 1.97, where clippy::question_mark became a denied warning in the IPv6 host/port parser.
2. .github/workflows/integration.yml contained workflow_dispatch twice, so GitHub rejected the workflow before creating any jobs.
3. The scheduled security audit found RUSTSEC-2026-0204 in crossbeam-epoch 0.9.18 and RUSTSEC-2026-0194/RUSTSEC-2026-0195 in quick-xml 0.37.5. The vulnerable quick-xml paths are reachable from SAML processing, so the findings are fixed through upgrades rather than ignored.

Impact

The primary CI, integration workflow, and scheduled dependency audit can run successfully again. SAML parsing retains its existing behavior on the upgraded XML stack, including entity decoding, signature checks, logout responses, and encrypted assertions configured with a PEM decryption key.

Validation

• cargo fmt --all --check
• cargo +1.97.0 clippy --workspace --all-targets --all-features -- -D warnings
• cargo deny check
• cargo nextest run -p rustauth-core --all-features — 630 passed
• cargo nextest run -p rustauth-saml --all-features — 36 passed
• cargo nextest run -p rustauth-sso --all-features — 348 passed
• strict YAML duplicate-key validation
• git diff --check

cargo deny still reports the pre-existing non-blocking spin 0.9.8 yanked warning and unmatched license allowances; advisories, bans, licenses, and sources all pass.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
rustauth-docs-site	Ignored		Jul 20, 2026 6:01pm