security(deps): bump golang.org/x/text in kepubify to fix CVE-2026-56852

Browse Source

The bundled binaries embedded golang.org/x/text v0.37.0, where a norm.Iter can enter an
infinite loop on input containing invalid UTF-8 bytes. Trivy flags this as HIGH and fails
the PR image scan on every branch opened since the advisory was published.

Rebuild all six binaries from the pinned upstream commit with x/text v0.40.0. The Go
toolchain was already current at 1.26.5 and is unchanged, so a toolchain-only rebuild would
not have cleared the finding; the vulnerable code lives in a module dependency. x/sync moves
to v0.22.0 as a side effect of the same resolution.

Keep the reported version string at v4-dev so rendition hashes stay stable and existing
cached kepub conversions remain valid.

...

This commit is contained in:

neon

2026-07-30 17:59:59 +00:00

parent d6fad39edd

commit c425b7949e

6 changed files with 0 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

server/bin/kepubify/kepubify-linux-arm64

BIN

Binary file not shown.