From a96ff0c85a4c25e9126dfa4c71ea87537a3baf7a Mon Sep 17 00:00:00 2001 From: neon <18559658+neonsolstice@users.noreply.github.com> Date: Tue, 27 Oct 2026 23:55:58 +0000 Subject: [PATCH] security(deps): resolve container scan findings Upgrade fixable Node dependencies and rebuild the pinned kepubify binaries with Go 1.27.3 so multi-architecture image publication passes the security gate. --- pnpm-lock.yaml | 94 +++++++++++----------- pnpm-workspace.yaml | 4 + server/bin/kepubify/kepubify-darwin-64bit | Bin 4295584 -> 4295584 bytes server/bin/kepubify/kepubify-darwin-arm64 | Bin 4147522 -> 4147522 bytes server/bin/kepubify/kepubify-linux-32bit | Bin 3965088 -> 3965088 bytes server/bin/kepubify/kepubify-linux-64bit | Bin 4214944 -> 4214944 bytes server/bin/kepubify/kepubify-linux-arm | Bin 4194464 -> 4194464 bytes server/bin/kepubify/kepubify-linux-arm64 | Bin 4128928 -> 4128928 bytes server/package.json | 4 +- 9 files changed, 52 insertions(+), 50 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index dd508ae20..f82ac90f0 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -24,7 +24,11 @@ overrides: piscina: ^4.9.3 qs: ^6.15.2 typescript-eslint: ^8.71.1 + undici@>=6.0.0 <6.29.1: ^6.29.1 + undici@>=7.0.0 <7.30.1: ^7.30.1 + undici@>=8.0.0 <8.12.2: ^8.12.2 ws: ^8.21.3 + zod@>=4.0.0 <4.6.6: ^4.6.6 packageExtensionsChecksum: sha256-lYHZSbnY3HtmtA7cTNBaRHB7pR5jsVv2XAfakE6TS/A= @@ -494,14 +498,14 @@ importers: specifier: ^4.8.4 version: 4.8.4(supports-color@10.2.2) undici: - specifier: ^8.11.2 - version: 8.11.2 + specifier: ^8.12.2 + version: 8.12.3 unzipper: specifier: ^0.12.5 version: 0.12.5 zod: - specifier: ^4.6.5 - version: 4.6.5 + specifier: ^4.6.6 + version: 4.6.7 devDependencies: '@eslint/eslintrc': specifier: ^3.3.7 @@ -2281,7 +2285,7 @@ packages: resolution: {integrity: sha512-Io1B6d011Gj1KknV4rXYz4le5+5EubcWEU/speUjuw9XMMIaP3n78yXLhjd2A3PXaXaUwEAluOiAyLqhBEJgsw==} peerDependencies: hono: '>=3.9.0' - zod: ^3.25.0 || ^4.0.0 + zod: ^4.6.6 '@huggingface/jinja@0.5.10': resolution: {integrity: sha512-SgS1D1bglQ94ceD4ZCL6eayUDy9uV1xuyk61OjgSxU5GJh7upqZCKII0JoTYMc6wWsg3JUgaPRX0ElQzXPk3Cw==} @@ -3415,7 +3419,7 @@ packages: deprecated: Renamed to zodline - install zodline instead. hasBin: true peerDependencies: - zod: ^4.0.0 + zod: ^4.6.6 '@rolldown/binding-android-arm-eabi@1.2.13': resolution: {integrity: sha512-Vu/NICrgdRvUOeaJZIyB2FP63s6fO/4ud5l8dXmxDx9yDyn+mN0y+gsvsVviSli+T361Aqo0h46EuMoobrwawA==} @@ -6451,7 +6455,7 @@ packages: engines: {node: '>=20'} peerDependencies: hono: ^4.8.0 - zod: ^4.0.0 + zod: ^4.6.6 hono@4.13.13: resolution: {integrity: sha512-CQ46U0ZkAGmbT/4UxdzzGJpacP2IeKgY4a5/tOI9AABbpOMfK739wfDXmv1usCk+3RkKj1hQy4/fjhiwa2xlrA==} @@ -9065,20 +9069,16 @@ packages: undici-types@8.9.0: resolution: {integrity: sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==} - undici@6.29.0: - resolution: {integrity: sha512-R+RODBqp6i2pPflGdq+xIOUkl+RNfGgHwoinecKu/JCuf2uO06cOKoDbI2P7Dn6KcswdKwrczbU6IYJ6K8X+wg==} + undici@6.29.1: + resolution: {integrity: sha512-EvRlUt/QqAEvXdQeRMYUfwOQsfzpDztykrG2owGEE/rBOBoYv9uF39ZzsNDh4lTFHhTr2XOZjKkYgueD12ZmGA==} engines: {node: '>=18.17'} - undici@7.14.0: - resolution: {integrity: sha512-Vqs8HTzjpQXZeXdpsfChQTlafcMQaaIwnGwLam1wudSSjlJeQ3bw1j+TLPePgrCnCpUXx7Ba5Pdpf5OBih62NQ==} + undici@7.30.1: + resolution: {integrity: sha512-03KrMbjIFDWQR5RNPrSw3bd1r12JpyFQl9/yxjUbJtqkjmllqC5lFjZh6ujeuJCKr8EOQvRW872Oy/az+nLYxg==} engines: {node: '>=20.18.1'} - undici@7.30.0: - resolution: {integrity: sha512-dkrQXeHSaoamnItlYbmzG0wFYrM0ZwDxCIg0A7aKjTyyhh9svRzCNFEzV+Vm05/yehjCzjDZ31KXfGEjYSztDQ==} - engines: {node: '>=20.18.1'} - - undici@8.11.2: - resolution: {integrity: sha512-u4UB2/IrKdU6lFxumHmmo1a3fCQO5tzQllRorfoRS63txhrB7xTpSn1PftwC4qEHkOaqP95fCWW4lJzwErwzhQ==} + undici@8.12.3: + resolution: {integrity: sha512-+fdndUTwBP86cVjihTp21hZHo7d6oj1c/47XPA3lL8mM0XHs+C4EkcjmgRsFnFk2f/UONGDy9ItBItmXsLOQHw==} engines: {node: '>=22.19.0'} unicode-canonical-property-names-ecmascript@2.0.1: @@ -9709,10 +9709,10 @@ packages: resolution: {integrity: sha512-P2jsOOBAq/6hCwUsMCjUATZ8szkMsV5VAwZENfyxp2Hc/XPJQpVwAgevWZc65xZauCwWB9LAn7zYeiCJFAEL+A==} engines: {node: '>=20'} peerDependencies: - zod: ^3.25.74 || ^4.0.0 + zod: ^4.6.6 - zod@4.6.5: - resolution: {integrity: sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==} + zod@4.6.7: + resolution: {integrity: sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==} zrender@6.1.0: resolution: {integrity: sha512-oEGMDB6pOP2S6OwRR4PdVv610zrjnA3Bh+JnSG12fYJlBKjtNAoEb5fSUoCOOINlH96I2fU38/A2UpRKs67xYQ==} @@ -9735,7 +9735,7 @@ snapshots: '@actions/http-client@4.0.1': dependencies: tunnel: 0.0.6 - undici: 6.29.0 + undici: 6.29.1 '@actions/io@3.0.2': {} @@ -11538,10 +11538,10 @@ snapshots: dependencies: hono: 4.13.13 - '@hono/zod-validator@0.7.6(hono@4.13.13)(zod@4.6.5)': + '@hono/zod-validator@0.7.6(hono@4.13.13)(zod@4.6.7)': dependencies: hono: 4.13.13 - zod: 4.6.5 + zod: 4.6.7 '@huggingface/jinja@0.5.10': {} @@ -12403,9 +12403,9 @@ snapshots: dependencies: '@readium/helpers': 1.2.1 - '@robingenz/zli@0.2.0(zod@4.6.5)': + '@robingenz/zli@0.2.0(zod@4.6.7)': dependencies: - zod: 4.6.5 + zod: 4.6.7 '@rolldown/binding-android-arm-eabi@1.2.13': optional: true @@ -12610,7 +12610,7 @@ snapshots: p-filter: 4.1.0 semantic-release: 25.0.9(supports-color@10.2.2)(typescript@6.0.3) tinyglobby: 0.2.17 - undici: 7.30.0 + undici: 7.30.1 url-join: 5.0.0 transitivePeerDependencies: - kerberos @@ -12766,9 +12766,9 @@ snapshots: '@aws-sdk/client-s3': 3.1152.0 '@aws-sdk/client-transcribe': 3.1152.0 '@hono/node-server': 2.1.5(hono@4.13.13) - '@hono/zod-validator': 0.7.6(hono@4.13.13)(zod@4.6.5) + '@hono/zod-validator': 0.7.6(hono@4.13.13)(zod@4.6.7) '@huggingface/transformers': 4.3.1(@types/node@26.6.5) - '@robingenz/zli': 0.2.0(zod@4.6.5) + '@robingenz/zli': 0.2.0(zod@4.6.7) '@storyteller-platform/fs': 0.3.1 '@storyteller-platform/media-types': 0.2.1 chalk: 5.6.2 @@ -12776,15 +12776,15 @@ snapshots: ffmpeg-stream: 1.0.1(supports-color@10.2.2) fs-extra: 11.3.1 hono: 4.13.13 - hono-zod-openapi: 1.1.1(hono@4.13.13)(zod@4.6.5) + hono-zod-openapi: 1.1.1(hono@4.13.13)(zod@4.6.7) lodash.merge: 4.6.2 microsoft-cognitiveservices-speech-sdk: 1.44.1(supports-color@10.2.2) onnxruntime-node: 1.30.0 - openai: 4.103.0(ws@8.22.0)(zod@4.6.5) + openai: 4.103.0(ws@8.22.0)(zod@4.6.7) p-queue: 9.3.5 tar: 7.5.22 - undici: 7.14.0 - zod: 4.6.5 + undici: 7.30.1 + zod: 4.6.7 optionalDependencies: '@storyteller-platform/mlx-audio': 0.1.2 transitivePeerDependencies: @@ -14318,7 +14318,7 @@ snapshots: parse5: 7.3.0 parse5-htmlparser2-tree-adapter: 7.1.0 parse5-parser-stream: 7.1.2 - undici: 7.30.0 + undici: 7.30.1 whatwg-mimetype: 4.0.0 chokidar@4.0.3: @@ -15652,12 +15652,12 @@ snapshots: highlight.js@10.7.3: {} - hono-zod-openapi@1.1.1(hono@4.13.13)(zod@4.6.5): + hono-zod-openapi@1.1.1(hono@4.13.13)(zod@4.6.7): dependencies: - '@hono/zod-validator': 0.7.6(hono@4.13.13)(zod@4.6.5) + '@hono/zod-validator': 0.7.6(hono@4.13.13)(zod@4.6.7) hono: 4.13.13 - zod: 4.6.5 - zod-openapi: 5.4.6(zod@4.6.5) + zod: 4.6.7 + zod-openapi: 5.4.6(zod@4.6.7) hono@4.13.13: {} @@ -16051,7 +16051,7 @@ snapshots: parse5: 8.0.1 saxes: 6.0.0 tough-cookie: 6.0.2 - undici: 8.11.2 + undici: 8.12.3 w3c-xmlserializer: 6.0.0 webidl-conversions: 8.0.1 whatwg-mimetype: 5.0.0 @@ -16684,7 +16684,7 @@ snapshots: powershell-utils: 0.2.1 wsl-utils: 1.0.1 - openai@4.103.0(ws@8.22.0)(zod@4.6.5): + openai@4.103.0(ws@8.22.0)(zod@4.6.7): dependencies: '@types/node': 18.19.130 '@types/node-fetch': 2.6.13 @@ -16695,7 +16695,7 @@ snapshots: node-fetch: 2.7.0 optionalDependencies: ws: 8.22.0 - zod: 4.6.5 + zod: 4.6.7 transitivePeerDependencies: - encoding @@ -18321,13 +18321,11 @@ snapshots: undici-types@8.9.0: {} - undici@6.29.0: {} + undici@6.29.1: {} - undici@7.14.0: {} + undici@7.30.1: {} - undici@7.30.0: {} - - undici@8.11.2: {} + undici@8.12.3: {} unicode-canonical-property-names-ecmascript@2.0.1: {} @@ -18971,11 +18969,11 @@ snapshots: zlibjs@0.3.1: {} - zod-openapi@5.4.6(zod@4.6.5): + zod-openapi@5.4.6(zod@4.6.7): dependencies: - zod: 4.6.5 + zod: 4.6.7 - zod@4.6.5: {} + zod@4.6.7: {} zrender@6.1.0: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index c7fd89a48..2a64ae3b7 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -23,7 +23,11 @@ overrides: piscina: ^4.9.3 qs: ^6.15.2 typescript-eslint: ^8.71.1 + "undici@>=6.0.0 <6.29.1": ^6.29.1 + "undici@>=7.0.0 <7.30.1": ^7.30.1 + "undici@>=8.0.0 <8.12.2": ^8.12.2 ws: ^8.21.3 + "zod@>=4.0.0 <4.6.6": ^4.6.6 packageExtensions: "@embedpdf/utils@2.15.1": dependencies: diff --git a/server/bin/kepubify/kepubify-darwin-64bit b/server/bin/kepubify/kepubify-darwin-64bit index 5fcd1f40c93a5ea62cc1b610f73dae67ec8e7f48..4c35da0f2cdacdf0edcda2fa8d7485cdfccf050a 100755 GIT binary patch delta 432 zcmXZTO-sUX0LO8rtCsfgx3XG~%bp*nn>trn8w({}X^{pZs1YGS7`ah&lA?C%QU~dj zhhBh}*sJKp1YJ7SPw4RZ-oB0cqoV=M2tyuza>=g`!Dv$Tr?b@lwN1IBPKQn0(QoR% z%4zVEdM4ypQg`%3Mw8;#$M+~ugDd~rrp7FW3-7~Q z=z?zOfnI3+9_WL97yvH}!VnDGHNw6nDbeEcER4V?jKMfez$9=m1wNRD8JLARn1=;e zge6#p6Mg9H(fVI4ML6QZyM+o0GAtro36 D+fssh delta 432 zcmXZTyH3Jj0EXcds#NOXM@6m2isu8?0#;DbA_jzp03wkn10Y0*LIN5*OhgmAqls~n z!Og|3lb7Ii=mj{q>1X2byxZG&xYae_)ya_h+vmaey_9${Y{oxIY+0jNw_c|a*8N5O zSI#=#sX8Hh0oS1z**(c-a*`A-7L-b;>=4QUB@xYR`L;`$o%5U`M*Xq85KMZMs;?3`tCj@6-CGF8Jf6$QMb#QF9Pc|_M;0UhbC))8H#MTx2n9OO0}V~k3sMX0+5JXQow|cEA!yunbOc!3wOx8n|H{HbB;7 I+LKa$0hk1X(f|Me diff --git a/server/bin/kepubify/kepubify-darwin-arm64 b/server/bin/kepubify/kepubify-darwin-arm64 index 3ee0043186faa3e3203ae47370759798523f4ad7..3e5b2d17545df3cea9c6d648fe36b6497fd2b23a 100755 GIT binary patch delta 542 zcmWm5ODx*~0LSqaUF$VvrG`-yo9Xlaujh0n9)Dqp`~^jpS?g7;dQ^^*#yUClgvR})?F5EQe=J(pUXG-?#|wFcEP>C6a3c&ns%&;Pao%G zEAuV;g2t4Xp#N;W9lyQL*H)g(dnHY()Z<{sV9 z+pgxmcY}S^mY#mAuCrHO-&RWx>6@fRTRmMz*ICsng=O3za2Ny}2!db;0WLfQ9`GR) z!XO+XAQB!y6x{#O5Ce}v2(b{y8U!Lq3x}9@S11!5E|Uo2;Rz(beM^F;kPImxhEzy{ zbdW#>WI`4^gXfS9FCYh`AOkt;GASl~!NdfgJ+q2pLmb*NC8&S^64a0jd5{kUPzXiv z5{g-EnMUu>UO0anTm9_fjy)}K_I-KHFY-ye`oCQ7m&GvQ!H3Jha>4trnyH2=PcHRu zbab3*9&}Z%o(i3m&9rbe!m#H@nlYK!wU-jQzIkF>I%a;h75c9K9A7%w&cmyC=3A?s xdGMLF2Q({$*nBgSe!I2*i~fYylQgd<`cA%QeV2PqtZ43L2w z6p#r=;TUAWaZtkHpA9*X3nxGYc_K%sORr0)$0=7;K`a?kg9fya4~MM~PC^l!0v()& zVkm)9C<8r|Lj|0Hvrq}=zyL-tiOCQ-_Bovzm5W>bYLzr*b5sEZG@OSEUMYIVNlFAqPy z-}$j5?1;nr)@QUX{Iz+;eRI3doL}DlDsOt!Xo@Y_WY+%WTxit>qx7iNqAuDBdJALs~GkU|ymkc#Zl1T?)Jf zojT>APtdXN;3w!1-Rj@rcY1hg*I&9Cyxy8Fi-}k+96pYDwUk#oQUXd=^-00g-OXey zT~g2eduNeQsj^?rN;~07bgSS}5=vT*Y-_%J@gynvy{_<9XY-HD?VpltcI$y;RX+QL53ypfgb`8gb*y(osE^s F;~$4Fbv6J1 delta 379 zcmWm5OEW?N7>Dtb;s_~(a><=2I>o85ibhmp(M6X{PUB3b+>OD!3xkb-{QA==BZwPX{zvYXS|ZO)KomYcJ4cl7B({B$iby2@5=0kqS4h* z>?pWW%b(I~xD`!h(WHR}(1H#cp$SB220gSuE3|^CwVq$`ar?=tD?92ExWNPSumCc6!3Ta=gr%CJzI;~s E1MYEkng9R* diff --git a/server/bin/kepubify/kepubify-linux-64bit b/server/bin/kepubify/kepubify-linux-64bit index 5f764dbb5da8446dfcd60211455894f40ba349a3..9621a7d4c9333499c78eb67936fefedb05b585cd 100755 GIT binary patch delta 415 zcmWm5xlY1x00-c5XzSUkpn_LbL`AWda)>ApqaaB!QTP|!OhfDd1QNU#LrkoRgKlgF z7aeqPYut#NZ{Z902FCbv_{OjKST{G}?S{Qna`L86D-aUMidv?UKh?G?f+8mO%GFRU z?=SBMHF93epHu}xN=i~rr8mMQRV>O!HF72ixwNWoU8qt*P84>JD{9S4s+5(YC>vNH zxkIRL<2L&6@%nPF-~F~cuFuRD^^}Sna_n{Misp2hGl3Z_V1+hl2O1dYfKKRwZs>tt zVB!DwK|c(D4eT%oLoobIa}M1k=}f}`P8fkv7=v+`03Ie`3Z}sYGvJ0+G`EoLt=+ zH($cXaBy*Q@OStfe~p)#z5#Dfru&qzzAL!pL?Dtn=eKg#xy|q?cjwv>AM2*Lseh$i+3 zbLi{Ad-Hs>Pu8pAx1{~pjGtoggfTsS)G0=#7#--r03@_PD^Nf~8?=KFI-nD}zy$xl z8+yPD7O+Au^g;hC#n@DxN2N6z*kJ$$VF-p{1RO95V=xXAFbPhWf@zq6S(t-)U||6` taDf{2@q!NS0Wa?%R ziAg_;&Eiuq_#1xXuU5G+*6@CBy$-2y-S1UH2_?86R}PBhoF4J$g?yx>?VZLh(veFg zRoaP0b&u`~Y9~teTq~5rhiWvF-|}sGyhpKO)~l3~Zgn@EDd?JB$Oxh!2sW6ook$69 zxmUAO{oF`e?;ho!r@qSbmBS)Ge;b73TS=};vH?bzAff?gNU)$0O=w07TG0k8{(n0< z&)J!${oEAzm0rF+>|)g=1`)zM77)fFmavQ!tYWS164x(&{{X{Ad!7IQ delta 415 zcmWm5Ni#wL0KoBAJzlnC%a$cOd7|=?bqq?wM7A(v%vegPVNgR37>A6$fm1iv#z6-k zz|qmg!GWW1&=`M*-|?5exmKr44&sJ@H`Jy%yZx2szz?C(6iEZRaC0ri+64OP1vNAfk%xRp(4qi^C_*tx zphGGCe;LYAfl5@tfNIpB7Imo4N_yk*rOKK-PZ`mGMl_)rCbXaxZD>aaI?;u0^uUZ> v$moLw{TP5Xd!Djo&NSAX^!WK~6q9DrjzK7JU8)*Ew&gOeFSzFH&$F6 z+}xae4-*sp9lr4^-u`HcczHBldpsGRdXQUD*#ml@}aJC?TmQk?j>VX$!-)TH zMgtmQffY??F6m9SP+lV!!VfmIpcQRsM+Z95g>Lkq7k2ca9|IV~5QZ^=QH)_66L7!@ psT6*2eX3gd-cTxk*{ov0FUoLZ5*~Ol1s|p{gIUa#{Nnu1&mX#Zdq)5O delta 412 zcmWm5IZJ{80D$4o{7O5u(z5%$59`y^PK>4pv=>41yK+L4dih8_l4-E z-Tu+TA{8e)H2jT4iWWefC5T1q6y7tK`Yvz!vAka z2RfmF7G3DBDbzYwRwh+~H#+p77k%i*00uFHVT@oDV;IK-CNYI+%wQICn8yMZp~n)I pYrz}ott6MOm9^IoomQ+^MFWgjfeB_ diff --git a/server/package.json b/server/package.json index 03045053d..7eb5d6e0e 100644 --- a/server/package.json +++ b/server/package.json @@ -106,9 +106,9 @@ "rxjs": "^7.8.2", "sharp": "^0.35.5", "socket.io": "^4.8.4", - "undici": "^8.11.2", + "undici": "^8.12.2", "unzipper": "^0.12.5", - "zod": "^4.6.5" + "zod": "^4.6.6" }, "devDependencies": { "@eslint/eslintrc": "^3.3.7",