deps(cargo): bump quick-xml from 0.41.0 to 0.42.0 #435

2026-08-26T04:14:50Z

dependabot[bot] commented

2026-08-26 04:14:50 +00:00

(Migrated from github.com)

Bumps quick-xml from 0.41.0 to 0.42.0.

Release notes

v0.42.0 - String Ergonomics

What's Changed

0.42.0 -- 2026-08-22

This is a large release. The primary change is an ergonomic improvement across the entire API - quick_xml now makes use of &str and String types where possible instead of &[u8] and Vec<u8>. This requires significant refactoring of downstream code, but should result in a net simplification as well as potential performance improvements, and opens up additional opportunities in future releases.

The MSRV has been raised to 1.86. We now use Rust 2024 Edition.

Breaking Changes

#963: Reader now validates that input is valid UTF-8 when constructing events. Non-UTF-8 input passed to Reader::from_reader() without DecodingReader will now produce Error::Encoding instead of silently passing through invalid bytes. Use DecodingReader to transcode non-UTF-8 sources.

#963: Name types (QName, LocalName, Prefix, Namespace, PrefixDeclaration) now wrap &str instead of &[u8]. into_inner() returns &str, and AsRef<str> is implemented (AsRef<[u8]> has been removed). ResolveResult::Unknown now contains String instead of Vec<u8>, and NamespaceError variants contain String instead of Vec<u8>.

#963: Removed the decoder: Decoder field from event types (BytesStart, BytesText, BytesCData, BytesRef) and Attributes. The decoder() method is no longer available on these types. Decode methods on events now always assume UTF-8 input. Error::missed_end() no longer takes a Decoder parameter.

#963: Event types (BytesStart, BytesEnd, BytesText, BytesCData, BytesPI, BytesRef) now store Cow<str> internally instead of Cow<[u8]>. into_inner() on BytesText, BytesCData, BytesPI, and BytesRef now returns Cow<str>. BytesStart::set_name() now takes &str instead of &[u8].

#963: All event types and the Event enum now implement Deref<Target = str> instead of Deref<Target = [u8]>. Explicit AsRef<str> impls are provided to avoid ambiguity.

#963: Removed decode() methods from BytesText, BytesCData, and BytesRef. Content is already available as &str via Deref. The xml10_content(), xml11_content(), xml_content(), and html_content() methods now return Cow<str> directly instead of Result<Cow<str>, EncodingError>.

#963: Attribute::value is now Cow<'a, str> instead of Cow<'a, [u8]>. The From<(&[u8], &[u8])> impl has been removed.

#963: BytesDecl::version(), encoding(), and standalone() now return Cow<'_, str> instead of Cow<'_, [u8]>.

#963: Removed Reader::decoder() method. Use Reader::encoding() instead (available with the encoding feature). Removed decoder() from the XmlRead serde trait. Removed all methods from Decoder (the struct is kept only for backward compatibility with deprecated Attribute methods).

#980: NamespaceError::TooManyDeclarations has been renamed to TooManyBindings, and NamespaceResolver::set_max_declarations_per_element has been renamed to NamespaceResolver::set_max_namespace_bindings, and the semantic behavior has

... (truncated)

Changelog

Sourced from quick-xml's changelog.

0.42.0 -- 2026-08-22

This is a large release. The primary change is an ergonomic improvement across the entire API - quick_xml now makes use of &str and String types where possible instead of &[u8] and Vec<u8>. This requires significant refactoring of downstream code, but should result in a net simplification as well as potential performance improvements, and opens up additional opportunities in future releases.

The MSRV has been raised to 1.86. We now use Rust 2024 Edition.

Breaking Changes

#963: Reader now validates that input is valid UTF-8 when constructing events. Non-UTF-8 input passed to Reader::from_reader() without DecodingReader will now produce Error::Encoding instead of silently passing through invalid bytes. Use DecodingReader to transcode non-UTF-8 sources.

#963: Name types (QName, LocalName, Prefix, Namespace, PrefixDeclaration) now wrap &str instead of &[u8]. into_inner() returns &str, and AsRef<str> is implemented (AsRef<[u8]> has been removed). ResolveResult::Unknown now contains String instead of Vec<u8>, and NamespaceError variants contain String instead of Vec<u8>.

#963: Removed the decoder: Decoder field from event types (BytesStart, BytesText, BytesCData, BytesRef) and Attributes. The decoder() method is no longer available on these types. Decode methods on events now always assume UTF-8 input. Error::missed_end() no longer takes a Decoder parameter.

#963: Event types (BytesStart, BytesEnd, BytesText, BytesCData, BytesPI, BytesRef) now store Cow<str> internally instead of Cow<[u8]>. into_inner() on BytesText, BytesCData, BytesPI, and BytesRef now returns Cow<str>. BytesStart::set_name() now takes &str instead of &[u8].

#963: All event types and the Event enum now implement Deref<Target = str> instead of Deref<Target = [u8]>. Explicit AsRef<str> impls are provided to avoid ambiguity.

#963: Removed decode() methods from BytesText, BytesCData, and BytesRef. Content is already available as &str via Deref. The xml10_content(), xml11_content(), xml_content(), and html_content() methods now return Cow<str> directly instead of Result<Cow<str>, EncodingError>.

#963: Attribute::value is now Cow<'a, str> instead of Cow<'a, [u8]>. The From<(&[u8], &[u8])> impl has been removed.

#963: BytesDecl::version(), encoding(), and standalone() now return Cow<'_, str> instead of Cow<'_, [u8]>.

#963: Removed Reader::decoder() method. Use Reader::encoding() instead (available with the encoding feature). Removed decoder() from the XmlRead serde trait. Removed all methods from Decoder (the struct is kept only for backward compatibility with deprecated Attribute methods).

#980: NamespaceError::TooManyDeclarations has been renamed to TooManyBindings, and NamespaceResolver::set_max_declarations_per_element has been renamed to NamespaceResolver::set_max_namespace_bindings, and the semantic behavior has changed slightly. The default maximum has also been reduced from 256 to 128.

#1000: DeError::UnexpectedStart renamed to DeError::MixedContent. That error is emitted when you try to deserialize boolean, number or string field from something like <field>text <tag/> another text</field>.

... (truncated)

Commits

36a2c52 Release 0.42.0
a4b9fca cargo fmt
22c99f5 Update Rust Edition to 2024
83351fb Add rename = $value to a table in serde example comments
f4db767 Clarify documentation about lifetimes of the events and attributes
9f4c66a Fix formatting for correct assertions in read_nodes_serde
6950ef7 Add GHA job to execute examples
dbf9e3f Show XML Decl tracking in examples
aab9452 Add writing a Decl event to the writer example
1573e05 Avoid trim_text(true) in the in-depth examples
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [quick-xml](https://github.com/tafia/quick-xml) from 0.41.0 to 0.42.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tafia/quick-xml/releases">quick-xml's releases</a>.</em></p> <blockquote> <h2>v0.42.0 - String Ergonomics</h2> <h2>What's Changed</h2> <h2>0.42.0 -- 2026-08-22</h2> <p>This is a large release. The primary change is an ergonomic improvement across the entire API - quick_xml now makes use of <code>&str</code> and <code>String</code> types where possible instead of <code>&[u8]</code> and <code>Vec<u8></code>. This requires significant refactoring of downstream code, but should result in a net simplification as well as potential performance improvements, and opens up additional opportunities in future releases.</p> <p>The MSRV has been raised to 1.86. We now use Rust 2024 Edition.</p> <h3>Breaking Changes</h3> <ul> <li><a href="https://redirect.github.com/tafia/quick-xml/issues/963">#963</a>: Reader now validates that input is valid UTF-8 when constructing events. Non-UTF-8 input passed to <code>Reader::from_reader()</code> without <code>DecodingReader</code> will now produce <code>Error::Encoding</code> instead of silently passing through invalid bytes. Use <code>DecodingReader</code> to transcode non-UTF-8 sources.</li> <li><a href="https://redirect.github.com/tafia/quick-xml/issues/963">#963</a>: Name types (<code>QName</code>, <code>LocalName</code>, <code>Prefix</code>, <code>Namespace</code>, <code>PrefixDeclaration</code>) now wrap <code>&str</code> instead of <code>&[u8]</code>. <code>into_inner()</code> returns <code>&str</code>, and <code>AsRef<str></code> is implemented (<code>AsRef<[u8]></code> has been removed). <code>ResolveResult::Unknown</code> now contains <code>String</code> instead of <code>Vec<u8></code>, and <code>NamespaceError</code> variants contain <code>String</code> instead of <code>Vec<u8></code>.</li> <li><a href="https://redirect.github.com/tafia/quick-xml/issues/963">#963</a>: Removed the <code>decoder: Decoder</code> field from event types (<code>BytesStart</code>, <code>BytesText</code>, <code>BytesCData</code>, <code>BytesRef</code>) and <code>Attributes</code>. The <code>decoder()</code> method is no longer available on these types. Decode methods on events now always assume UTF-8 input. <code>Error::missed_end()</code> no longer takes a <code>Decoder</code> parameter.</li> <li><a href="https://redirect.github.com/tafia/quick-xml/issues/963">#963</a>: Event types (<code>BytesStart</code>, <code>BytesEnd</code>, <code>BytesText</code>, <code>BytesCData</code>, <code>BytesPI</code>, <code>BytesRef</code>) now store <code>Cow<str></code> internally instead of <code>Cow<[u8]></code>. <code>into_inner()</code> on <code>BytesText</code>, <code>BytesCData</code>, <code>BytesPI</code>, and <code>BytesRef</code> now returns <code>Cow<str></code>. <code>BytesStart::set_name()</code> now takes <code>&str</code> instead of <code>&[u8]</code>.</li> <li><a href="https://redirect.github.com/tafia/quick-xml/issues/963">#963</a>: All event types and the <code>Event</code> enum now implement <code>Deref<Target = str></code> instead of <code>Deref<Target = [u8]></code>. Explicit <code>AsRef<str></code> impls are provided to avoid ambiguity.</li> <li><a href="https://redirect.github.com/tafia/quick-xml/issues/963">#963</a>: Removed <code>decode()</code> methods from <code>BytesText</code>, <code>BytesCData</code>, and <code>BytesRef</code>. Content is already available as <code>&str</code> via <code>Deref</code>. The <code>xml10_content()</code>, <code>xml11_content()</code>, <code>xml_content()</code>, and <code>html_content()</code> methods now return <code>Cow<str></code> directly instead of <code>Result<Cow<str>, EncodingError></code>.</li> <li><a href="https://redirect.github.com/tafia/quick-xml/issues/963">#963</a>: <code>Attribute::value</code> is now <code>Cow<'a, str></code> instead of <code>Cow<'a, [u8]></code>. The <code>From<(&[u8], &[u8])></code> impl has been removed.</li> <li><a href="https://redirect.github.com/tafia/quick-xml/issues/963">#963</a>: <code>BytesDecl::version()</code>, <code>encoding()</code>, and <code>standalone()</code> now return <code>Cow<'_, str></code> instead of <code>Cow<'_, [u8]></code>.</li> <li><a href="https://redirect.github.com/tafia/quick-xml/issues/963">#963</a>: Removed <code>Reader::decoder()</code> method. Use <code>Reader::encoding()</code> instead (available with the <code>encoding</code> feature). Removed <code>decoder()</code> from the <code>XmlRead</code> serde trait. Removed all methods from <code>Decoder</code> (the struct is kept only for backward compatibility with deprecated <code>Attribute</code> methods).</li> <li><a href="https://redirect.github.com/tafia/quick-xml/issues/980">#980</a>: <code>NamespaceError::TooManyDeclarations</code> has been renamed to <code>TooManyBindings</code>, and <code>NamespaceResolver::set_max_declarations_per_element</code> has been renamed to <code>NamespaceResolver::set_max_namespace_bindings</code>, and the semantic behavior has</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tafia/quick-xml/blob/master/Changelog.md">quick-xml's changelog</a>.</em></p> <blockquote> <h2>0.42.0 -- 2026-08-22</h2> <p>This is a large release. The primary change is an ergonomic improvement across the entire API - quick_xml now makes use of <code>&str</code> and <code>String</code> types where possible instead of <code>&[u8]</code> and <code>Vec<u8></code>. This requires significant refactoring of downstream code, but should result in a net simplification as well as potential performance improvements, and opens up additional opportunities in future releases.</p> <p>The MSRV has been raised to 1.86. We now use Rust 2024 Edition.</p> <h3>Breaking Changes</h3> <ul> <li><a href="https://redirect.github.com/tafia/quick-xml/issues/963">#963</a>: Reader now validates that input is valid UTF-8 when constructing events. Non-UTF-8 input passed to <code>Reader::from_reader()</code> without <code>DecodingReader</code> will now produce <code>Error::Encoding</code> instead of silently passing through invalid bytes. Use <code>DecodingReader</code> to transcode non-UTF-8 sources.</li> <li><a href="https://redirect.github.com/tafia/quick-xml/issues/963">#963</a>: Name types (<code>QName</code>, <code>LocalName</code>, <code>Prefix</code>, <code>Namespace</code>, <code>PrefixDeclaration</code>) now wrap <code>&str</code> instead of <code>&[u8]</code>. <code>into_inner()</code> returns <code>&str</code>, and <code>AsRef<str></code> is implemented (<code>AsRef<[u8]></code> has been removed). <code>ResolveResult::Unknown</code> now contains <code>String</code> instead of <code>Vec<u8></code>, and <code>NamespaceError</code> variants contain <code>String</code> instead of <code>Vec<u8></code>.</li> <li><a href="https://redirect.github.com/tafia/quick-xml/issues/963">#963</a>: Removed the <code>decoder: Decoder</code> field from event types (<code>BytesStart</code>, <code>BytesText</code>, <code>BytesCData</code>, <code>BytesRef</code>) and <code>Attributes</code>. The <code>decoder()</code> method is no longer available on these types. Decode methods on events now always assume UTF-8 input. <code>Error::missed_end()</code> no longer takes a <code>Decoder</code> parameter.</li> <li><a href="https://redirect.github.com/tafia/quick-xml/issues/963">#963</a>: Event types (<code>BytesStart</code>, <code>BytesEnd</code>, <code>BytesText</code>, <code>BytesCData</code>, <code>BytesPI</code>, <code>BytesRef</code>) now store <code>Cow<str></code> internally instead of <code>Cow<[u8]></code>. <code>into_inner()</code> on <code>BytesText</code>, <code>BytesCData</code>, <code>BytesPI</code>, and <code>BytesRef</code> now returns <code>Cow<str></code>. <code>BytesStart::set_name()</code> now takes <code>&str</code> instead of <code>&[u8]</code>.</li> <li><a href="https://redirect.github.com/tafia/quick-xml/issues/963">#963</a>: All event types and the <code>Event</code> enum now implement <code>Deref<Target = str></code> instead of <code>Deref<Target = [u8]></code>. Explicit <code>AsRef<str></code> impls are provided to avoid ambiguity.</li> <li><a href="https://redirect.github.com/tafia/quick-xml/issues/963">#963</a>: Removed <code>decode()</code> methods from <code>BytesText</code>, <code>BytesCData</code>, and <code>BytesRef</code>. Content is already available as <code>&str</code> via <code>Deref</code>. The <code>xml10_content()</code>, <code>xml11_content()</code>, <code>xml_content()</code>, and <code>html_content()</code> methods now return <code>Cow<str></code> directly instead of <code>Result<Cow<str>, EncodingError></code>.</li> <li><a href="https://redirect.github.com/tafia/quick-xml/issues/963">#963</a>: <code>Attribute::value</code> is now <code>Cow<'a, str></code> instead of <code>Cow<'a, [u8]></code>. The <code>From<(&[u8], &[u8])></code> impl has been removed.</li> <li><a href="https://redirect.github.com/tafia/quick-xml/issues/963">#963</a>: <code>BytesDecl::version()</code>, <code>encoding()</code>, and <code>standalone()</code> now return <code>Cow<'_, str></code> instead of <code>Cow<'_, [u8]></code>.</li> <li><a href="https://redirect.github.com/tafia/quick-xml/issues/963">#963</a>: Removed <code>Reader::decoder()</code> method. Use <code>Reader::encoding()</code> instead (available with the <code>encoding</code> feature). Removed <code>decoder()</code> from the <code>XmlRead</code> serde trait. Removed all methods from <code>Decoder</code> (the struct is kept only for backward compatibility with deprecated <code>Attribute</code> methods).</li> <li><a href="https://redirect.github.com/tafia/quick-xml/issues/980">#980</a>: <code>NamespaceError::TooManyDeclarations</code> has been renamed to <code>TooManyBindings</code>, and <code>NamespaceResolver::set_max_declarations_per_element</code> has been renamed to <code>NamespaceResolver::set_max_namespace_bindings</code>, and the semantic behavior has changed slightly. The default maximum has also been reduced from 256 to 128.</li> <li><a href="https://redirect.github.com/tafia/quick-xml/issues/1000">#1000</a>: <code>DeError::UnexpectedStart</code> renamed to <code>DeError::MixedContent</code>. That error is emitted when you try to deserialize boolean, number or string <code>field</code> from something like <code><field>text <tag/> another text</field></code>.</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tafia/quick-xml/commit/36a2c52a4f6c90878c3f60c3c3b5c62efaef28a9"><code>36a2c52</code></a> Release 0.42.0</li> <li><a href="https://github.com/tafia/quick-xml/commit/a4b9fca2be8a59f9cfb213a0aa5e158f9a9590c4"><code>a4b9fca</code></a> cargo fmt</li> <li><a href="https://github.com/tafia/quick-xml/commit/22c99f516c35796c13dbe1e560068d37e4ef282c"><code>22c99f5</code></a> Update Rust Edition to 2024</li> <li><a href="https://github.com/tafia/quick-xml/commit/83351fbe060496af7cd8ba8324dc99025e74abba"><code>83351fb</code></a> Add rename = $value to a table in serde example comments</li> <li><a href="https://github.com/tafia/quick-xml/commit/f4db767086ea81f6fd869323a7e912cafdc97bd4"><code>f4db767</code></a> Clarify documentation about lifetimes of the events and attributes</li> <li><a href="https://github.com/tafia/quick-xml/commit/9f4c66aa6db6abf7447f4c37fc3de2bccb510fb5"><code>9f4c66a</code></a> Fix formatting for correct assertions in read_nodes_serde</li> <li><a href="https://github.com/tafia/quick-xml/commit/6950ef7830ada479f01185e80d70eb57331fd423"><code>6950ef7</code></a> Add GHA job to execute examples</li> <li><a href="https://github.com/tafia/quick-xml/commit/dbf9e3fa4945de0b2c77220c0609c262251eed43"><code>dbf9e3f</code></a> Show XML Decl tracking in examples</li> <li><a href="https://github.com/tafia/quick-xml/commit/aab9452dcb485ec00e8c6eb51a5e6a7002fcff74"><code>aab9452</code></a> Add writing a Decl event to the writer example</li> <li><a href="https://github.com/tafia/quick-xml/commit/1573e058ef1b2412a5f24e1c0ca46be540591f8d"><code>1573e05</code></a> Avoid trim_text(true) in the in-depth examples</li> <li>Additional commits viewable in <a href="https://github.com/tafia/quick-xml/compare/v0.41.0...v0.42.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=quick-xml&package-manager=cargo&previous-version=0.41.0&new-version=0.42.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin dependabot/cargo/quick-xml-0.42.0:dependabot/cargo/quick-xml-0.42.0

git checkout dependabot/cargo/quick-xml-0.42.0

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/nuncio#435