Bump quick-xml to 0.41

[mdorman]

Bump quick-xml to 0.41

quick-xml < 0.41 is affected by two RustSec advisories (both DoS on crafted XML,
reachable through RSS/atom parsing):

• RUSTSEC-2026-0194 — O(N²) duplicate-attribute check in BytesStart::attributes()
• RUSTSEC-2026-0195 — unbounded namespace-declaration allocation in NsReader

Both are fixed in quick-xml >= 0.41.0.

Change

Raise the quick-xml dependency from 0.39 to 0.41 (keeping features = ["encoding"]).

The public quick-xml API used by this crate is unchanged across 0.39 → 0.41
(Reader, Writer, events::*, Attributes, escape::resolve_predefined_entity) —
the crate uses the plain Reader, not NsReader, and wraps quick-xml errors rather than
matching the enum exhaustively. The full --all-features test suite passes unmodified.

Attribute::decode_and_unescape_value is deprecated in 0.40 in favour of
decoded_and_normalized_value but retains identical behaviour, so it's left as-is here
to keep this change minimal.

Note on atom_syndication

With the atom feature enabled, this crate depends on atom_syndication, which still
pins quick-xml ^0.39. A companion PR raising atom_syndication to quick-xml 0.41 is
open at rust-syndication/atom#96; merging/releasing that first avoids a transient
quick-xml version split for rss builds using the atom feature.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.98%. Comparing base (8598600) to head (60b2a81).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #190   +/-   ##
=======================================
  Coverage   80.98%   80.98%           
=======================================
  Files          23       23           
  Lines        1530     1530           
=======================================
  Hits         1239     1239           
  Misses        291      291           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[DCjanus]

Thanks for the quick-xml update! This has been merged and included in the upcoming 2.1.0 release (#192).