Download Latest Version v0.40.1 - Fix rarely possible serde deserialization panic source code.tar.gz (1.5 MB)
Email in envelope

Get an email when there's a new version of quick-xml

Home / v0.40.1
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2026-05-15 851 Bytes
v0.40.1 - Fix rarely possible serde deserialization panic source code.tar.gz 2026-05-15 1.5 MB
v0.40.1 - Fix rarely possible serde deserialization panic source code.zip 2026-05-15 1.6 MB
Totals: 3 Items   3.1 MB 2

What's Changed

  • #964: Fix unreachable!() panic in the serde deserializer when a DOCTYPE declaration appears between two text runs inside an element (e.g. <a>x<!DOCTYPE y>z</a>). The DOCTYPE used to break drain_text's consecutive-text merge, so two DeEvent::Text events reached read_text and tripped its "Cannot be two consequent Text events" invariant. DOCTYPE is now treated as transparent during text drain — it still goes through the entity resolver, but the surrounding text is merged into one run. Discovered via libFuzzer on a real-world SAML deserializer harness.

New Contributors

Full Changelog: https://github.com/tafia/quick-xml/compare/v0.40.0...v0.40.1

Source: README.md, updated 2026-05-15