Bump vulnerable transitive parsers (lopdf, quick-xml, calamine, pdf-extract) — 6 open RUSTSEC advisories

memvid-core 2.0.140 (latest on crates.io, 2026-05-27) pins several parser crates below their patched releases, which pulls 6 RUSTSEC advisories into every downstream consumer. cargo audit fails on them for anyone depending on memvid-core.

Advisories

Advisory	Crate	Version pulled	Path (via memvid-core)	Patched
RUSTSEC-2026-0187	lopdf	0.39.0	lopdf ^0.39 (direct)	≥0.42
RUSTSEC-2026-0187	lopdf	0.38.0	pdf-extract ^0.10 → lopdf	≥0.42
RUSTSEC-2026-0194	quick-xml	0.31.0	quick-xml ^0.31 (direct)	≥0.41
RUSTSEC-2026-0195	quick-xml	0.31.0	quick-xml ^0.31 (direct)	≥0.41
RUSTSEC-2026-0194	quick-xml	0.30.0	calamine ^0.22 → quick-xml	≥0.41
RUSTSEC-2026-0195	quick-xml	0.30.0	calamine ^0.22 → quick-xml	≥0.41

• RUSTSEC-2026-0187: stack overflow in lopdf via deeply nested PDF objects
• RUSTSEC-2026-0194: quadratic run time checking a start tag for duplicate attribute names
• RUSTSEC-2026-0195: unbounded namespace-declaration allocation in NsReader (memory-exhaustion DoS)

Suggested fix

Patched releases already exist on crates.io:

• lopdf 0.44.0
• quick-xml 0.41.0
• pdf-extract 0.12.0
• calamine 0.36.0

Would it be possible to bump memvid-core's constraints to lopdf = "^0.44", quick-xml = "^0.41", calamine = "^0.36", pdf-extract = "^0.12" (adjusting for any API changes) and cut a release? Happy to send a PR if that would help.

Context

Reported from a downstream project that consumes memvid-core as a read-only retrieval library. In our case the parser code paths aren't reached at serving time (we open a pre-built .mv2 read-only), so we're suppressing these locally with justification — but a patched release would let us and other consumers drop the suppression.