Merge PR #1464: Bump quick-xml to 0.41 (RUSTSEC-2026-0194, RUSTSEC-2026-0195

Cargo.lock

@@ -3356,7 +3356,7 @@ version = "0.11.0"
 dependencies = [
  "lightcraft-develop",
  "lightcraft-geom",
- "quick-xml 0.38.4",
+ "quick-xml",
 ]
 
 [[package]]
@@ -3394,7 +3394,7 @@ dependencies = [
  "lightcraft-geom",
  "lightcraft-tiff",
  "proptest",
- "quick-xml 0.38.4",
+ "quick-xml",
  "serde",
  "serde_json",
 ]
@@ -4849,15 +4849,6 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
 
-[[package]]
-name = "quick-xml"
-version = "0.38.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b66c2058c55a409d601666cffe35f04333cf1013010882cec174a7467cd4e21c"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "quick-xml"
 version = "0.41.0"
@@ -6348,7 +6339,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "338e30461b3a2b67d70eb30a6d89f8e0c93a833e07d2ae89085cd070c4a00ac0"
 dependencies = [
  "proc-macro2",
- "quick-xml 0.41.0",
+ "quick-xml",
  "quote",
 ]
 

Cargo.toml

@@ -60,7 +60,7 @@ libc = "0.2" # dev-only: process CPU time in benches
 dhat = "0.3" # opt-in heap profiling (lightcraft-cli --features dhat-heap) and heap tests; never in product builds
 
 # formats
-quick-xml = "0.38"
+quick-xml = "0.41"
 miniz_oxide = "0.8"
 
 # codecs