Summary

Release 0.2.1 — security hardening, panic elimination, and build hygiene on top of 0.2.0. No public API changes; patch-level bump.

• Cargo.toml, pyproject.toml, py_src/paperjam/__init__.py → 0.2.1
• Cargo.lock refreshed for the workspace version
• CHANGELOG.md: promote [Unreleased] → [0.2.1] — 2026-04-24, fold in the shared-SafeArchive (fix(zip): shared SafeArchive with four-axis decompression-bomb caps #72) and MSRV / cache / dep-dedup (chore: build hygiene — MSRV job, cache scoping, dep dedup #73) items

Contents of 0.2.1

Merged since 0.2.0:

• chore: audit-driven cleanup (stubs, metadata, docs, release profile) #68 — audit cleanup (stub drift, metadata, docs)
• Security hardening: ZIP entry caps + MCP path sandbox #69 — security hardening: ZIP entry caps + MCP path sandbox
• fix: eliminate panic surfaces on untrusted PDF input #70 — panic-surface elimination on untrusted PDF input
• chore: polish — tooling, rustdoc, CI, changelog #71 — polish: rustdoc, rust-toolchain, justfile, release profile, CI docs
• fix(zip): shared SafeArchive with four-axis decompression-bomb caps #72 — shared SafeArchive with four-axis decompression-bomb caps
• chore: build hygiene — MSRV job, cache scoping, dep dedup #73 — build hygiene: MSRV 1.88 job, cache scoping, md-5 dedup, committed Cargo.lock

No tags created — release will be cut from the GitHub UI.

Test plan

• CI green (lint, rust-test, MSRV, test matrix, accuracy)
• cargo build --workspace --locked locally
• uv run maturin develop --release && uv run pytest tests/python/ -v