diff --git a/Cargo.lock b/Cargo.lock
index c8d9414..5ada129 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -717,9 +717,9 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "html-escape"
-version = "0.2.15"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9356095b4b41197bba32173600e1582792cda618f65d12f68e2e77d273413c5"
+checksum = "491194d601b4fa9fac3c9571e014070a0ad1bc3392d1bc10419695196a8b3cc3"
 
 [[package]]
 name = "http"
diff --git a/crates/x-media/Cargo.toml b/crates/x-media/Cargo.toml
index 19761ac..ecca9f8 100644
--- a/crates/x-media/Cargo.toml
+++ b/crates/x-media/Cargo.toml
@@ -8,7 +8,7 @@ reqwest = { version = "0.12", default-features = false, features = ["json", "rus
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 regex = "1.12"
-html-escape = "0.2"
+html-escape = "0.3"
 url = "2.5.2"
 bytes = "1"
 # ugoira frame zips are stored/deflate only; everything in zip's default
diff --git a/crates/xmedia-bot/Cargo.toml b/crates/xmedia-bot/Cargo.toml
index 85eff33..5f3bb57 100644
--- a/crates/xmedia-bot/Cargo.toml
+++ b/crates/xmedia-bot/Cargo.toml
@@ -12,7 +12,7 @@ log = "0.4"
 pretty_env_logger = "0.5"
 dotenv = "0.15"
 url = "2.5.2"
-html-escape = "0.2"
+html-escape = "0.3"
 rusqlite = { version = "0.40", features = ["bundled"] }
 rand = "0.10"
 tempfile = "3"