Changelog

0.2.0 - 2026-09-19

Verify downloaded AppImages against pinned or explicitly supplied SHA-256 checksums before execution.
Return filesystem, command startup, and automatic installation failures as error tuples from PDF operations.
Stage file output beside the destination for atomic replacement, including attachments and cross-device split output.
Validate page selections and encryption permissions; preserve descending ranges and full-document reversal.
Support zero-page counts, reject unknown linearization output, and decrypt attachment extraction consistently.
Bound page-tree inheritance, inherit crop boxes, and use relative paper-size tolerance.
Add a configurable versioned storage directory and remove the runtime test-only Mix override.
Simplify destination resolution and shared CLI flags; discover system qpdf directly on unsupported AppImage platforms.
Return an explicit error when attachment stdout capture requires an unavailable POSIX shell.

Prevent stderr from mixing into PDF and attachment binary outputs.
Only fall back to priv/native/AppRun for the default version.
Clarify zero-RAM pipeline and binary input staging in README documentation.
Documentation and test suite fixes.
Reduce nesting depth in Qpdf.CLI.run_stdout/1 and refactor staged command execution.