| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-05-15 | 851 Bytes | |
| v0.40.1 - Fix rarely possible serde deserialization panic source code.tar.gz | 2026-05-15 | 1.5 MB | |
| v0.40.1 - Fix rarely possible serde deserialization panic source code.zip | 2026-05-15 | 1.6 MB | |
| Totals: 3 Items | 3.1 MB | 2 | |
What's Changed
- #964: Fix
unreachable!()panic in the serde deserializer when a DOCTYPE declaration appears between two text runs inside an element (e.g.<a>x<!DOCTYPE y>z</a>). The DOCTYPE used to breakdrain_text's consecutive-text merge, so twoDeEvent::Textevents reachedread_textand tripped its "Cannot be two consequent Text events" invariant. DOCTYPE is now treated as transparent during text drain — it still goes through the entity resolver, but the surrounding text is merged into one run. Discovered via libFuzzer on a real-world SAML deserializer harness.
New Contributors
- @williamareynolds made their first contribution in https://github.com/tafia/quick-xml/pull/964
Full Changelog: https://github.com/tafia/quick-xml/compare/v0.40.0...v0.40.1