diff --git a/services/differ/Cargo.lock b/services/differ/Cargo.lock
index 199dcd6..0e76d40 100644
--- a/services/differ/Cargo.lock
+++ b/services/differ/Cargo.lock
@@ -502,9 +502,9 @@ dependencies = [
 
 [[package]]
 name = "quick-xml"
-version = "0.40.1"
+version = "0.41.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2474bd2e5029e7ccb6abb2ba48cf2383a333851dedf495901544281590c7da7f"
+checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
 dependencies = [
  "memchr",
 ]
@@ -717,6 +717,7 @@ version = "1.52.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
 dependencies = [
+ "bytes",
  "libc",
  "mio",
  "pin-project-lite",
diff --git a/services/differ/Cargo.toml b/services/differ/Cargo.toml
index 3743120..d695368 100644
--- a/services/differ/Cargo.toml
+++ b/services/differ/Cargo.toml
@@ -18,7 +18,7 @@ tokio = { version = "1", features = ["rt-multi-thread", "macros", "net", "signal
 # Already in the tree via axum; the direct dep only enables the `limit` feature.
 tower = { version = "0.5", features = ["limit"] }
 prost = "0.14"
-quick-xml = "0.40"
+quick-xml = "0.41"
 bytes = "1"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"