deps: bump quick-xml to 0.41 to avoid RUSTSEC-2026-019{4,5} - #468

Brownian Motion (Brass)

Recommendation: Refactor

Summary: Dependency bump likely fixes advisories, but compatibility risk needs verification
Risk: Medium · Confidence: 82%

Highlights

• Minimal, focused change
• Security-motivated dependency update

Unknowns

• CI is unstable, so this may already be hiding a break
• No evidence the full workspace was built with all feature combinations
• No lockfile diff provided to confirm transitive resolution changes

Next actions

• Keep: the narrow scope and security-driven intent
• Add: lockfile/CI confirmation that all feature combos still build and tests pass
• Add: note any quick-xml API or behavior changes that were validated

Reflection questions

• What concrete failure are the advisories preventing in this codebase, and have you reproduced it here?
• Does quick-xml 0.41 change any serialization/deserialization behavior this repo depends on?
• Would a CI-verified lockfile update be enough, or do we need code changes to preserve behavior?