deps: bump quick-xml to 0.41 to avoid RUSTSEC-2026-019{4,5}

[aznashwan]

This patch bumps the quick-xml crate dependency from a static 0.38 to 0.41 in both the aws-creds and s3 crates to avoid RUSTSEC-2026-0194 and RUSTSEC-2026-0195.

---

This change is 

Summary by CodeRabbit

• Chores
  • Updated an XML processing dependency to a newer version in multiple components.
  • This helps keep the app current with upstream improvements and may improve reliability when working with XML-based data.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1a62d76c-02a2-482e-82e5-05a959f98aad

📥 Commits

Reviewing files that changed from the base of the PR and between b584ce7 and 01b6ccb.

📒 Files selected for processing (2)

• aws-creds/Cargo.toml
• s3/Cargo.toml

---

📝 Walkthrough

Walkthrough

This PR updates the quick-xml dependency version from 0.38 to 0.41 in both aws-creds/Cargo.toml and s3/Cargo.toml, while retaining the serialize feature in each.

Changes

Dependency Version Update

Layer / File(s)	Summary
quick-xml version bump aws-creds/Cargo.toml, s3/Cargo.toml	Updated quick-xml from 0.38 to 0.41 in both crates, keeping the serialize feature enabled.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: upgrading quick-xml to 0.41 to address the referenced RUSTSEC advisories.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[brownian-motion-v0]

Brownian Motion (Brass)

Recommendation: Refactor

Summary: Dependency bump likely fixes advisories, but compatibility risk needs verification
Risk: Medium · Confidence: 82%

Highlights

• Minimal, focused change
• Security-motivated dependency update

Unknowns

• CI is unstable, so this may already be hiding a break
• No evidence the full workspace was built with all feature combinations
• No lockfile diff provided to confirm transitive resolution changes

Next actions

• Keep: the narrow scope and security-driven intent
• Add: lockfile/CI confirmation that all feature combos still build and tests pass
• Add: note any quick-xml API or behavior changes that were validated

Reflection questions

• What concrete failure are the advisories preventing in this codebase, and have you reproduced it here?
• Does quick-xml 0.41 change any serialization/deserialization behavior this repo depends on?
• Would a CI-verified lockfile update be enough, or do we need code changes to preserve behavior?

[araina-a11y]

any updates when this will be merged?