Security release for untrusted PDF parsing.
- Rejects cyclic page Parent chains instead of looping indefinitely (GHSA-vw8m-3www-6767).
- Prevalidates Form XObject traversal and contains direct and indirect cycles before downstream parsing (GHSA-vwg8-g6h6-64rp).
- Bounds Form nesting and per-page XObject expansion to prevent recursive resource exhaustion.
- Refreshes compatible dependency versions and keeps Rust 1.88 compatibility.
Upgrade with: cargo update -p pdfsink-rs --precise 0.2.10