build(deps): bump maxminddb from 0.27.3 to 0.28.1

[dependabot]

Bumps maxminddb from 0.27.3 to 0.28.1.

Release notes

Sourced from maxminddb's releases.

0.28.1

• Fixed: Databases with an impossible declared search tree size are now rejected during open/verify instead of causing runaway allocation during validation.
• Fixed: within() now rejects IPv6 CIDRs on IPv4-only databases instead of yielding unrelated networks.
• Fixed: Verification now rejects truncated scalar/string payloads instead of skipping past them and reporting the database as valid.
• Fixed: LookupResult::network() now uses the reader's measured IPv4 subtree depth instead of assuming it always begins at bit 96.

0.28.0

• Performance improvement: Faster search-tree traversal by dispatching on the database's record size to monomorphized node readers, replacing per-step branching on the record size.
• Performance improvement: Direct deserialization of scalars, sequences, maps, and structs through dedicated fast paths instead of routing through deserialize_any.
• Performance improvement: IPv4 and IPv6 lookups dispatch to dedicated paths, avoiding per-call address-kind checks on the hot path.
• Behavior change: Deserializing a database array into a tuple or tuple struct now returns a decoding error when the lengths do not match. Previously the mismatch was silently ignored.
• Fixed: A corrupt data pointer that would underflow during resolution now returns an InvalidDatabase error instead of panicking.

Changelog

Sourced from maxminddb's changelog.

0.28.1 - 2026-04-26

• Fixed: Databases with an impossible declared search tree size are now rejected during open/verify instead of causing runaway allocation during validation.
• Fixed: within() now rejects IPv6 CIDRs on IPv4-only databases instead of yielding unrelated networks.
• Fixed: Verification now rejects truncated scalar/string payloads instead of skipping past them and reporting the database as valid.
• Fixed: LookupResult::network() now uses the reader's measured IPv4 subtree depth instead of assuming it always begins at bit 96.

0.28.0 - 2026-04-25

• Performance improvement: Faster search-tree traversal by dispatching on the database's record size to monomorphized node readers, replacing per-step branching on the record size.
• Performance improvement: Direct deserialization of scalars, sequences, maps, and structs through dedicated fast paths instead of routing through deserialize_any.
• Performance improvement: IPv4 and IPv6 lookups dispatch to dedicated paths, avoiding per-call address-kind checks on the hot path.
• Behavior change: Deserializing a database array into a tuple or tuple struct now returns a decoding error when the lengths do not match. Previously the mismatch was silently ignored.
• Fixed: A corrupt data pointer that would underflow during resolution now returns an InvalidDatabase error instead of panicking.

Commits

• 8e86128 Prepare v0.28.1 release
• e762e0c Set release date
• b730a7c Merge pull request #113 from oschwald/greg/fixes
• 3ce5264 Use actual IPv4 subtree depth for network
• 6ce0c23 Tighten decoder verification bounds
• 536242a Reject IPv6 CIDRs in within() with IPv4 trees
• 6a74e9a Improve test coverage of bad-database handling
• 1cd81bb Validate search tree layout in reader
• df493e2 Update MaxMind-DB fixtures
• 429baa5 Prepare v0.28.0 release
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note

Bump maxminddb dependency from 0.27 to 0.28 in ffwd-transform

Updates the maxminddb crate in ffwd-transform/Cargo.toml from v0.27.3 to v0.28.1 to pick up upstream fixes and changes.

^{Macroscope summarized 619d6fa.}

[gitar-bot]

⚠️ Unable to process your request. The bot dependabot[bot] is not in the allowed bots list for this organization.

This can be changed in configuration.

[pr-rocket]

🟡 CI status is unknown with 0 passing, 0 failing, 0 pending — no checks have run yet, verify CI pipeline is configured before merging.

Last activity: Errors: panel

---

Advanced

Recent activity:

• Errors: panel
• Errors: panel
• Errors: panel
• Errors: panel
• Errors: panel
• Errors: panel
• Errors: panel
• Errors: panel

Configuration (5 of 9 enabled):

Auto-title · Auto-body · Auto-review · Auto-labels · Hide external comments

Per-repo settings:

• Extra instructions: (not set — /rocket set instructions <text>)
• Required checks: (all checks — /rocket set required-checks <name1,name2>)

/rocket enable auto-pilot · /rocket enable <feature> · /rocket disable <feature>

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

[macroscopeapp]

Approvability

Verdict: Approved

Automated dependency bump from Dependabot updating maxminddb from 0.27.3 to 0.28.1. Changes are limited to version numbers in Cargo.toml and Cargo.lock with no source code modifications.

^{You can customize Macroscope's approvability policy. Learn more.}