please cut a patch release: lopdf 0.42.0 DoS fix (RUSTSEC-2026-0187) is on main but unreleased

## summary

the last published crates.io release (`0.1.7`, 2026-07-31) still depends on `lopdf 0.41.0`, which is affected by [RUSTSEC-2026-0187](https://rustsec.org/advisories/RUSTSEC-2026-0187.html) - a stack-overflow DoS via deeply nested PDF objects (CVSS 3.1: `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`). a ~21kb crafted PDF whose catalog contains a deeply nested array aborts the process with an uncatchable `SIGABRT` (not a `panic!`, so `catch_unwind` doesn't help). a public PoC ships with the advisory.

reachable through pdf-inspector's normal entry points (`process_pdf`, `process_pdf_mem`, `classify_pdf`) since they all bottom out in `lopdf::Document::load*`.

## the fix already exists on main

commit 1c32e4bd (`fix(deps): bump lopdf to 0.42.0 for nesting-depth DoS (#198)`, 2026-08-03) already bumps `lopdf` to the fixed `0.42.0` in both dependency blocks of `Cargo.toml`. it just hasn't shipped in a release yet - `Cargo.toml` on `main` is still at `version = "0.1.7"`, matching the last crates.io publish, so `cargo install`/`cargo add` still resolves to the vulnerable `lopdf 0.41.0` today.

## ask

could you cut a `0.1.8` (or similar patch) release from current main so downstream consumers pick up the fix? found this while auditing `firecrawl/anydoc`, which pins `pdf-inspector = "0.1.7"` and is transitively exposed until a new version publishes - opened firecrawl/anydoc#67 to track the consumer side.

no exploit details beyond what's already public on the RustSec advisory.

Start with Cargo.toml on current main and commit 1c32e4bd, verifying the package version remains 0.1.7 while both dependency blocks use lopdf 0.42.0. Check the project's release process, publish the next patch version, and confirm that cargo add or cargo install resolves the fixed dependency for downstream users.

Written by the indexing model from the issue text.