Drop the version number from the creator/producer properties in metadata.

[Jogai]

The preview of v7 at least shows it version number, which is not really needed I would think. It would even open up the possibility of unwanted attention would this library ever have a vulnerability. I'm fine with not being able to set it to any string, but just a name should be enough.

[ThomasHoevel]

What a "vulnerability" could that be? It would be a vulnerability of the PDF file.

If such a "vulnerability" could exist, what good would it do if PDF files only showed "Producer XYZ"? Seeing "Producer XYZ" in the file would give no hint whether the "vulnerability" could apply.
Producer can be faked anyway. Some apps modify PDF files without updating the Producer.

[Jogai]

In the sense when running some service that creates a pdf. A malicious party could then manipulate the input to trigger a potential vulnerable path in the code.