w### Security - Refreshed `Cargo.lock` to clear **RUSTSEC-2026-0009** (`time` crate, DoS via stack exhaustion, medium severity 6.8). `time` upgraded from `0.3.44` to `0.3.49` transitively via `cyclonedx-bom`. `cargo audit` now reports zero hard vulnerabilities. Five pre-existing "unmaintained" warnings remain (`encoding`, `lzw`, `rusttype`, `stb_truetype`, `stdweb`); they all originate from the `genpdf → printpdf → lopdf` chain and cannot be cleared without replacing the PDF stack, which is out of scope for this release. - Fixed silent-success bug where per-file processing failures (e.g. CycloneDX parse errors) were logged but the process still exited with status `0`, causing calling scripts and CI pipelines to treat failed runs as successful. The tool now exits with a non-zero status whenever one or more input files fail to process. This was first observed with VDRs exported from OWASP Dependency-Track, which strips empty-string property values and produces spec non-compliant files (a component property with `name` but no `value`) that `vex2pdf` rightfully rejects.