The kepubify binaries contained golang.org/x/text v0.3.6 which
triggers CVE-2021-38561 and CVE-2022-32149 in Trivy. This commit
updates the module to the latest version and rebuilds the binaries.
The previous kepubify binaries were built with an older Go version
that triggered Trivy's CVE-2026-42504 vulnerability in the standard
library. This updates the binaries to the latest Go version to resolve
the CI pipeline failure.
Rebuild all 6 kepubify binaries (linux-64bit, linux-arm64, linux-arm,
linux-32bit, darwin-64bit, darwin-arm64) from source using Go 1.26.3.
Remove the download fallback in KepubifyBinaryService - all platforms
are now bundled so there is no need to fetch from bookorbit/bookorbit-tools.
Replaced pre-compiled kepubify binaries (built with Go 1.17.8, 53
HIGH/CRITICAL CVEs) with binaries rebuilt from source using Go 1.26.3
and golang.org/x/text upgraded to v0.3.8, resolving all fixable CVEs.
Also fixed KepubifyBinaryService incorrectly falling back to downloading
the binary on every startup in read-only containers. chmod() was throwing
EROFS, and the single catch block treated it as a missing file. Split
stat and chmod into separate try/catch so only a missing-file error
triggers the download fallback.
neon