Bump the cargo-dependencies group with 2 updates

[dependabot]

Bumps the cargo-dependencies group with 2 updates: quick-xml and satkit.

Updates quick-xml from 0.41.0 to 0.42.0

Release notes

Sourced from quick-xml's releases.

v0.42.0 - String Ergonomics

What's Changed

0.42.0 -- 2026-08-22

This is a large release. The primary change is an ergonomic improvement across the entire API - quick_xml now makes use of &str and String types where possible instead of &[u8] and Vec<u8>. This requires significant refactoring of downstream code, but should result in a net simplification as well as potential performance improvements, and opens up additional opportunities in future releases.

The MSRV has been raised to 1.86. We now use Rust 2024 Edition.

Breaking Changes

• #963: Reader now validates that input is valid UTF-8 when constructing events. Non-UTF-8 input passed to Reader::from_reader() without DecodingReader will now produce Error::Encoding instead of silently passing through invalid bytes. Use DecodingReader to transcode non-UTF-8 sources.
• #963: Name types (QName, LocalName, Prefix, Namespace, PrefixDeclaration) now wrap &str instead of &[u8]. into_inner() returns &str, and AsRef<str> is implemented (AsRef<[u8]> has been removed). ResolveResult::Unknown now contains String instead of Vec<u8>, and NamespaceError variants contain String instead of Vec<u8>.
• #963: Removed the decoder: Decoder field from event types (BytesStart, BytesText, BytesCData, BytesRef) and Attributes. The decoder() method is no longer available on these types. Decode methods on events now always assume UTF-8 input. Error::missed_end() no longer takes a Decoder parameter.
• #963: Event types (BytesStart, BytesEnd, BytesText, BytesCData, BytesPI, BytesRef) now store Cow<str> internally instead of Cow<[u8]>. into_inner() on BytesText, BytesCData, BytesPI, and BytesRef now returns Cow<str>. BytesStart::set_name() now takes &str instead of &[u8].
• #963: All event types and the Event enum now implement Deref<Target = str> instead of Deref<Target = [u8]>. Explicit AsRef<str> impls are provided to avoid ambiguity.
• #963: Removed decode() methods from BytesText, BytesCData, and BytesRef. Content is already available as &str via Deref. The xml10_content(), xml11_content(), xml_content(), and html_content() methods now return Cow<str> directly instead of Result<Cow<str>, EncodingError>.
• #963: Attribute::value is now Cow<'a, str> instead of Cow<'a, [u8]>. The From<(&[u8], &[u8])> impl has been removed.
• #963: BytesDecl::version(), encoding(), and standalone() now return Cow<'_, str> instead of Cow<'_, [u8]>.
• #963: Removed Reader::decoder() method. Use Reader::encoding() instead (available with the encoding feature). Removed decoder() from the XmlRead serde trait. Removed all methods from Decoder (the struct is kept only for backward compatibility with deprecated Attribute methods).
• #980: NamespaceError::TooManyDeclarations has been renamed to TooManyBindings, and NamespaceResolver::set_max_declarations_per_element has been renamed to NamespaceResolver::set_max_namespace_bindings, and the semantic behavior has

... (truncated)

Changelog

Sourced from quick-xml's changelog.

0.42.0 -- 2026-08-22

This is a large release. The primary change is an ergonomic improvement across the entire API - quick_xml now makes use of &str and String types where possible instead of &[u8] and Vec<u8>. This requires significant refactoring of downstream code, but should result in a net simplification as well as potential performance improvements, and opens up additional opportunities in future releases.

The MSRV has been raised to 1.86. We now use Rust 2024 Edition.

Breaking Changes

• #963: Reader now validates that input is valid UTF-8 when constructing events. Non-UTF-8 input passed to Reader::from_reader() without DecodingReader will now produce Error::Encoding instead of silently passing through invalid bytes. Use DecodingReader to transcode non-UTF-8 sources.
• #963: Name types (QName, LocalName, Prefix, Namespace, PrefixDeclaration) now wrap &str instead of &[u8]. into_inner() returns &str, and AsRef<str> is implemented (AsRef<[u8]> has been removed). ResolveResult::Unknown now contains String instead of Vec<u8>, and NamespaceError variants contain String instead of Vec<u8>.
• #963: Removed the decoder: Decoder field from event types (BytesStart, BytesText, BytesCData, BytesRef) and Attributes. The decoder() method is no longer available on these types. Decode methods on events now always assume UTF-8 input. Error::missed_end() no longer takes a Decoder parameter.
• #963: Event types (BytesStart, BytesEnd, BytesText, BytesCData, BytesPI, BytesRef) now store Cow<str> internally instead of Cow<[u8]>. into_inner() on BytesText, BytesCData, BytesPI, and BytesRef now returns Cow<str>. BytesStart::set_name() now takes &str instead of &[u8].
• #963: All event types and the Event enum now implement Deref<Target = str> instead of Deref<Target = [u8]>. Explicit AsRef<str> impls are provided to avoid ambiguity.
• #963: Removed decode() methods from BytesText, BytesCData, and BytesRef. Content is already available as &str via Deref. The xml10_content(), xml11_content(), xml_content(), and html_content() methods now return Cow<str> directly instead of Result<Cow<str>, EncodingError>.
• #963: Attribute::value is now Cow<'a, str> instead of Cow<'a, [u8]>. The From<(&[u8], &[u8])> impl has been removed.
• #963: BytesDecl::version(), encoding(), and standalone() now return Cow<'_, str> instead of Cow<'_, [u8]>.
• #963: Removed Reader::decoder() method. Use Reader::encoding() instead (available with the encoding feature). Removed decoder() from the XmlRead serde trait. Removed all methods from Decoder (the struct is kept only for backward compatibility with deprecated Attribute methods).
• #980: NamespaceError::TooManyDeclarations has been renamed to TooManyBindings, and NamespaceResolver::set_max_declarations_per_element has been renamed to NamespaceResolver::set_max_namespace_bindings, and the semantic behavior has changed slightly. The default maximum has also been reduced from 256 to 128.
• #1000: DeError::UnexpectedStart renamed to DeError::MixedContent. That error is emitted when you try to deserialize boolean, number or string field from something like <field>text <tag/> another text</field>.

... (truncated)

Commits

• 36a2c52 Release 0.42.0
• a4b9fca cargo fmt
• 22c99f5 Update Rust Edition to 2024
• 83351fb Add rename = $value to a table in serde example comments
• f4db767 Clarify documentation about lifetimes of the events and attributes
• 9f4c66a Fix formatting for correct assertions in read_nodes_serde
• 6950ef7 Add GHA job to execute examples
• dbf9e3f Show XML Decl tracking in examples
• aab9452 Add writing a Decl event to the writer example
• 1573e05 Avoid trim_text(true) in the in-depth examples
• Additional commits viewable in compare view

Updates satkit from 0.20.2 to 0.20.3

Changelog

Sourced from satkit's changelog.

Changelog

Unreleased

Added

• scale= keyword on the time(...) constructor (Python): Gregorian date/time components passed to satkit.time(year, month, day[, hour, minute, second]) can now be interpreted in an explicit time scale, e.g. satkit.time(2020, 1, 1, scale=satkit.timescale.TAI), mirroring the existing time.from_mjd(..., scale=...) / time.from_jd(..., scale=...) API. The keyword defaults to satkit.timescale.UTC, so all existing calls are unchanged. Backed by a new scale-aware core constructor Instant::from_datetime_with_scale.
• SGP4InitArgs::from_mean_elements — a constructor that performs the rev/day → rad/min and degree → radian conversions from catalog units. Both the TLE and CCSDS OMM SGP4 sources now build their init args through it, so the conversion factors are defined in one place.
• time and duration are now hashable. Both define __eq__ but previously lacked __hash__, which made them unhashable (unusable as dict keys or set members). The hash is derived from the underlying microsecond count, so it is consistent with equality.
• Equality and repr on more value types. TLE, kepler, and itrfcoord now implement __eq__; TLE, kepler, satstate, and propsettings now implement __repr__ (delegating to their str form). The three float-backed types that gained __eq__ are intentionally left unhashable — a failed hash() is clearer than silently-wrong float-keyed lookups.
• mypy.stubtest in CI. The python bindings test job now verifies that the hand-written .pyi type stubs match the compiled PyO3 bindings. Two CLI flags (--ignore-positional-only, --ignore-disjoint-bases) plus python/stubtest_allowlist.txt suppress systematic PyO3 idioms (constructors, final classes, native submodules); everything else must agree.

Fixed

• Type stubs now type-check and match the runtime. The .pyi files had never been checked and contained illegal overload-implementation blocks, a time.__add__ overload group split by other methods, and time-as-annotation shadowing. Filled in stub gaps (itrfcoord.height, time.add_utc_days, weekday.Invalid) and removed/fixed a phantom time.as_gregorian(scale=) parameter and a mis-declared sgp4_opsmode.improved property.
• Panic hardening: malformed and edge-case input now returns errors instead of panicking (PR #124), following a codebase-wide audit:
  • TLE parsing: day-of-year is range-checked, negative satellite numbers are rejected, and non-finite implied-exponent fields (bstar, nddot) error at parse time instead of overflowing later in epoch math, Display, or to_2line. Display also falls back to the raw satellite number rather than unwrapping a failed alpha5 conversion.
  • Time: from_rfc3339 no longer panics on non-ASCII input while scanning

... (truncated)

Commits

• 901c29c Merge pull request #124 from ssmichael1/fix/panic-hardening
• ab78cc3 chore: fix clippy 1.98 lints in bindings (map_or_identity, as_chunks)
• 3ee57be chore: changelog entries for panic hardening; bump version to 0.20.3
• b22afcb fix: harden medium-severity panic and overflow paths
• d5b7c67 fix: eliminate high-severity panics on malformed/edge input
• 42b4247 Merge pull request #123 from ssmichael1/api-0.21-breaking
• fc980b3 Merge pull request #122 from ssmichael1/ci-stubtest
• 9205c45 refactor(lambert)!: rename LambertError to lambert::Error
• bfa901a feat(python): time(scale=) constructor keyword
• cc72ba4 feat(sgp4)!: make Error::SatRecInit carry typed SGP4Error
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions