quick-xml 0.39.4 is a pull-based XML reader/writer with optional serde and tokio support. The crate uses #![forbid(unsafe_code)], has no network access, and does not resolve external entities or expand DTD-declared entities, eliminating XXE and billion-laughs risks at the library level. No findings were recorded.