diff --git a/Cargo.lock b/Cargo.lock
index b98da53b..9da7168b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3965,7 +3965,7 @@ checksum = "7da1d65da6dd5d1e44199ac0f58712d241c0f439f80adea8924d832384087f85"
 dependencies = [
  "base64 0.22.1",
  "indexmap 2.14.0",
- "quick-xml 0.41.0",
+ "quick-xml",
  "serde",
  "time",
 ]
@@ -4158,15 +4158,6 @@ version = "0.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e0c5ccf5294c6ccd63a74f1565028353830a9c2f5eb0c682c355c471726a6e3f"
 
-[[package]]
-name = "quick-xml"
-version = "0.37.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "331e97a1af0bf59823e6eadffe373d7b27f485be8748f71471c662c1f269b7fb"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "quick-xml"
 version = "0.41.0"
@@ -6025,11 +6016,10 @@ dependencies = [
 
 [[package]]
 name = "tauri-winrt-notification"
-version = "0.7.2"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b1e66e07de489fe43a46678dd0b8df65e0c973909df1b60ba33874e297ba9b9"
+checksum = "9ed071c670382e85fc2f48ae706492d8c338f4f89bf72520d32f8abfe880aade"
 dependencies = [
- "quick-xml 0.37.5",
  "thiserror 2.0.19",
  "windows 0.61.3",
  "windows-version",
diff --git a/deny.toml b/deny.toml
index c1e618ed..133de744 100644
--- a/deny.toml
+++ b/deny.toml
@@ -32,27 +32,6 @@ ignore = [
     "RUSTSEC-2025-0081",
     "RUSTSEC-2025-0098",
     "RUSTSEC-2025-0100",
-    # quick-xml DoS advisories, both fixed in quick-xml >=0.41.0:
-    #   RUSTSEC-2026-0194 - quadratic run time when checking a start tag for
-    #     duplicate attribute names.
-    #   RUSTSEC-2026-0195 - unbounded namespace-declaration allocation in
-    #     `NsReader` enables a memory-exhaustion denial of service.
-    # We carry two vulnerable copies, each transitively pinned via an
-    # intermediate that is ALREADY at its latest published crates.io version and
-    # has not yet bumped its quick-xml requirement to >=0.41:
-    #   quick-xml 0.37.5 <- tauri-winrt-notification 0.7.2 <- notify-rust
-    #     <- tauri-plugin-notification <- driven-app
-    # (The second vulnerable copy, via plist <- tauri-utils, was resolved
-    # 2026-07-19: plist 1.10.0 requires quick-xml ^0.41. The winrt chain is
-    # still pinned: tauri-winrt-notification 0.8.x dropped quick-xml entirely,
-    # but notify-rust 4.18 still requires ^0.7, so notify-rust must move.)
-    # No bump path exists at our layer: quick-xml >=0.41 crosses 0.x incompat
-    # boundaries upstream, so notify-rust must move first.
-    # Exposure is low - these paths only parse local / OS-generated XML (Windows
-    # toast notifications, macOS plists), never untrusted network input.
-    # Added 2026-07-03; remove when #89 closes.
-    "RUSTSEC-2026-0194",
-    "RUSTSEC-2026-0195",
 ]
 
 [licenses]