Upgrade quick-xml to resolve RUSTSEC-2026-0194 and RUSTSEC-2026-0195 #786

Activity

1. cemoktra

   added

   bugSomething isn't workingSomething isn't working

   on Jul 2, 2026
2. Jefffrey commented on Jul 2, 2026

   

   Jefffrey

   on Jul 2, 2026

   Contributor

   More actions

   • resolved by build(deps): update quick-xml requirement from 0.40.1 to 0.41.0 #785
3. Jefffrey

   closed this as completedon Jul 2, 2026
4. ivandasch commented on Jul 6, 2026

   

   ivandasch

   on Jul 6, 2026

   Last edited by ivandasch

   More actions

   @Jefffrey @alamb Hi, do you know when it will be released? Will it be in August according to the schedule or earlier?
5. alamb commented on Jul 6, 2026

   

   alamb

   on Jul 6, 2026

   Contributor

   More actions

   I had planned one in August. How I could potentially make one sooner (e.g. in July)

   critical security advisories:

   FWIW my reading of this advisory is that it takes a while to parse pathalogically formed XML documents. quick-xml is used by these crates to parse responses from the cloud providers, and I don't expect them to be sending malformed responses

   In other words, I personally would not rate the RUSTSEC vulnerability as critical; See also

   • Discussion: signal/noise ratio too low? rustsec/advisory-db#2572

   (but that is just me venting, I know the ecosystem uses this advisory DB and I will endeavor to get a new release out shortly)

   👍React with 👍2Reacted by Ivan Daschinskiy and Adrian Gallus
6. alamb

   changed the title [-]RUSTSEC-2026-0194 and RUSTSEC-2026-0195[/-] [+]Upgrade quick-xml to resolve RUSTSEC-2026-0194 and RUSTSEC-2026-0195[/+] on Jul 9, 2026