diff --git a/platforms/windows/src/engine/Cargo.lock b/platforms/windows/src/engine/Cargo.lock
index afde3908..30f9c3c4 100644
--- a/platforms/windows/src/engine/Cargo.lock
+++ b/platforms/windows/src/engine/Cargo.lock
@@ -1963,9 +1963,9 @@ checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
 
 [[package]]
 name = "quick-xml"
-version = "0.41.0"
+version = "0.42.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
+checksum = "41b1177fdf999d2321d3fb46ff47159d9c1fb9ad66a4879f8c50a0b504615e9b"
 dependencies = [
  "memchr",
 ]
diff --git a/platforms/windows/src/engine/Cargo.toml b/platforms/windows/src/engine/Cargo.toml
index 8252a94a..20317d2f 100644
--- a/platforms/windows/src/engine/Cargo.toml
+++ b/platforms/windows/src/engine/Cargo.toml
@@ -114,7 +114,7 @@ zip = { version = "2", default-features = false, features = ["deflate"] }
 
 # Streaming XML pull-parser for Phase 4 OOXML text extraction. Pure-Rust,
 # tiny, MIT-licensed. The alternative (`xml-rs`) is heavier + DOM-oriented.
-quick-xml = "0.41"
+quick-xml = "0.42"
 
 # Phase 5: pure-Rust audio metadata + decode (no Java/ffmpeg system dep). Used
 # to read artist/album/title/genre/year tags from mp3/flac/wav/ogg/m4a/aac so