diff --git a/Cargo.lock b/Cargo.lock
index 0aacdca..97b788a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1963,7 +1963,7 @@ dependencies = [
  "pdf-extract",
  "png 0.17.16",
  "ppt-rs",
- "quick-xml 0.41.0",
+ "quick-xml 0.42.0",
  "serde_json",
  "tinydocs-bus",
  "zip 8.6.0",
diff --git a/Cargo.toml b/Cargo.toml
index fdc45cd..baf3ad9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -62,7 +62,7 @@ pdf-extract = { version = "0.12", optional = true }
 # Bounded OOXML intake reads only selected XML parts, never extracts files.
 zip = { version = "8", default-features = false, features = ["deflate"], optional = true }
 # Streaming XML events avoid building attacker-controlled DOM trees.
-quick-xml = { version = "0.41", optional = true }
+quick-xml = { version = "0.42", optional = true }
 # Workbook row conversion for document-memory Markdown; implementation only.
 calamine = { version = "0.36", optional = true }
 # Pure Rust PDF rasterization, isolated from the default extraction build.