fix: clear dependency security advisories

2026-07-10 18:59:03 +08:00
parent d730e51c3d
commit e049cb6880
11 changed files with 242 additions and 41 deletions
@@ -21,3 +21,8 @@ serde = { version = "1", features = ["derive"] }
 toml = "0.8"
 cph-diag = { path = "crates/cph-diag" }
 cph-model = { path = "crates/cph-model" }
+
+# citationberg 0.7.0 on crates.io pins vulnerable quick-xml 0.38. Upstream has
+# adopted quick-xml 0.41 but has not published a replacement release yet.
+[patch.crates-io]
+citationberg = { git = "https://github.com/typst/citationberg", rev = "06a591e2f237d25e1dfdedac3f3d1494c496c52d" }