Bump maxminddb from 0.27.3 to 0.28.1

[dependabot]

Bumps maxminddb from 0.27.3 to 0.28.1.

Release notes

Sourced from maxminddb's releases.

0.28.1

• Fixed: Databases with an impossible declared search tree size are now rejected during open/verify instead of causing runaway allocation during validation.
• Fixed: within() now rejects IPv6 CIDRs on IPv4-only databases instead of yielding unrelated networks.
• Fixed: Verification now rejects truncated scalar/string payloads instead of skipping past them and reporting the database as valid.
• Fixed: LookupResult::network() now uses the reader's measured IPv4 subtree depth instead of assuming it always begins at bit 96.

0.28.0

• Performance improvement: Faster search-tree traversal by dispatching on the database's record size to monomorphized node readers, replacing per-step branching on the record size.
• Performance improvement: Direct deserialization of scalars, sequences, maps, and structs through dedicated fast paths instead of routing through deserialize_any.
• Performance improvement: IPv4 and IPv6 lookups dispatch to dedicated paths, avoiding per-call address-kind checks on the hot path.
• Behavior change: Deserializing a database array into a tuple or tuple struct now returns a decoding error when the lengths do not match. Previously the mismatch was silently ignored.
• Fixed: A corrupt data pointer that would underflow during resolution now returns an InvalidDatabase error instead of panicking.

Changelog

Sourced from maxminddb's changelog.

0.28.1 - 2026-04-26

• Fixed: Databases with an impossible declared search tree size are now rejected during open/verify instead of causing runaway allocation during validation.
• Fixed: within() now rejects IPv6 CIDRs on IPv4-only databases instead of yielding unrelated networks.
• Fixed: Verification now rejects truncated scalar/string payloads instead of skipping past them and reporting the database as valid.
• Fixed: LookupResult::network() now uses the reader's measured IPv4 subtree depth instead of assuming it always begins at bit 96.

0.28.0 - 2026-04-25

• Performance improvement: Faster search-tree traversal by dispatching on the database's record size to monomorphized node readers, replacing per-step branching on the record size.
• Performance improvement: Direct deserialization of scalars, sequences, maps, and structs through dedicated fast paths instead of routing through deserialize_any.
• Performance improvement: IPv4 and IPv6 lookups dispatch to dedicated paths, avoiding per-call address-kind checks on the hot path.
• Behavior change: Deserializing a database array into a tuple or tuple struct now returns a decoding error when the lengths do not match. Previously the mismatch was silently ignored.
• Fixed: A corrupt data pointer that would underflow during resolution now returns an InvalidDatabase error instead of panicking.

Commits

• 8e86128 Prepare v0.28.1 release
• e762e0c Set release date
• b730a7c Merge pull request #113 from oschwald/greg/fixes
• 3ce5264 Use actual IPv4 subtree depth for network
• 6ce0c23 Tighten decoder verification bounds
• 536242a Reject IPv6 CIDRs in within() with IPv4 trees
• 6a74e9a Improve test coverage of bad-database handling
• 1cd81bb Validate search tree layout in reader
• df493e2 Update MaxMind-DB fixtures
• 429baa5 Prepare v0.28.0 release
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Looks like maxminddb is up-to-date now, so this is no longer needed.