[chaliy]

Requested by Михайло · project thread

What changed

This is the dependency part of the maintenance pass. No extraction behavior changes.

• Removed unused dependencies. From core: async-trait, futures, regex, unicode-segmentation, encoding_rs, base64, mime, lol_html (it was on the html feature but nothing called it), and tracing-subscriber. Also unused deps of the CLI (serde), the Python binding (serde_json, tokio), the Node binding (tokio, serde, serde_json) and the stub bench/eval crates (instant, statrs, colored, tabled, reqwest, …). anyhow moves to dev-deps in core because only a doc example uses it.
• Major upgrades: scraper 0.29, html5ever 0.40, pyo3 / pyo3-async-runtimes 0.30, criterion 0.8. Also quick-xml 0.42: calamine already pulled 0.42, so there was a duplicate 0.41 + 0.42 before. markkit's XML walkers are ported to 0.42's &str names and attribute values.
• Supply-chain config: the stub bench deps were the only source of the instant/paste unmaintained advisories, so both deny.toml ignores are removed. So are four license allowances that nothing uses any more. NOTICE no longer lists lol_html or pdf-extract, which is not a dependency.
• The logging feature is kept so existing feature lists still build. It now enables only tracing, and the README calls it reserved because it emits nothing yet.

Why

Bashkit's maintenance checklist: latest majors, no unused deps, review duplicates.

Before / After

	Before	After
Cargo.lock	—	−461 lines
cargo audit	2 allowed unmaintained warnings	clean
cargo deny duplicate warnings	6 (base64, getrandom, quick-xml, rand_core, selectors, syn)	1 (syn 1/2)
deny.toml advisory ignores	2	0

just pre-pr passes locally (fmt, clippy -D warnings, all workspace tests including the document security suite, OKF check, script tests, examples, deny). XML entity tests (docx_billion_laughs_not_expanded, docx_external_entity_not_resolved) and ODS/XLS pre-scan tests pass on quick-xml 0.42.

Risk

• Low / Medium
• quick-xml 0.42 requires UTF-8 names and values. Non-UTF-8 office XML, which is rare, now fails as a parse error instead of being decoded lossily. Either way it's an error, never a panic.
• pyo3 0.30 is checked by the Python bindings CI job.

Checklist

• Tests added or updated (existing suites cover the ported XML code)
• Backward compatibility considered (logging feature kept)

---

Generated by Claude Code