Bump every direct dependency to its newest same-major release and move the
node base image to 26.11.1, which invalidates the cached apk layer and picks
up tiff 4.7.2 for CVE-2026-4775. Rebuild all six kepubify binaries from the
pinned upstream commit with Go 1.27.2 for CVE-2026-78667, CVE-2026-78669 and
CVE-2026-97031, keeping v4-dev so rendition hashes stay stable.
Allow native and host-network deployments to select an IPv4 or IPv6 bind
address through HOST while preserving the existing wildcard default.
Keep Docker health checks aligned with the configured listener and document
how to restrict host port publishing independently of the container address.
Cover validation, real bootstrap sockets, and health-check commands with tests.
Closes#1315
Use the supported Alpine 3.23 Node image to avoid vulnerable util-linux packages in Alpine 3.24. Force fast-uri 3.1.6 to resolve the SSRF advisories reported by the image scan.
Avoid launching a full Node runtime every 30 seconds so idle containers do not create unnecessary CPU, memory, and disk pressure. Let Compose inherit the image probe to keep one source of truth.
Closes#1129
Day keys are written per reader but read back using UTC, the database server's CURRENT_DATE, or
the server process's local year, so streaks and day-based achievements were evaluated against the
wrong day. Route every lookup through one resolved timezone on the evaluation context.
Install tzdata so the container honours TZ for date and subprocesses. Node already resolved TZ
through ICU, so no reading data was affected by the missing package.
Closes#1084
pnpm 11 changed the default of verifyDepsBeforeRun to "install", so `pnpm run` now
resolves and installs before executing a script. Each builder stage already installs its
own filtered subset with a frozen lockfile two steps earlier, so that install is redundant
work at best.
At worst it is fatal. No builder stage carries the whole workspace: the server stage never
copies client/, so the re-install resolves against a workspace with no client, finds
nothing depending on @embedpdf, and rejects the workspace-level patches for it with
ERR_PNPM_UNUSED_PATCH. The image has not built since the pnpm 11 upgrade.
Turn the check off for both build steps rather than widen the patch allowance, because the
dependencies genuinely are already installed and correct at that point; verifying them
against a workspace that was deliberately narrowed can only produce a wrong answer.
pip is only needed to install the Kobo cloudscraper requirements. Leaving it
in the final image also leaves pip/_vendor/vendor.txt, which Trivy reads as
installed msgpack 1.1.2 and setuptools 70.3.0 and fails the CRITICAL,HIGH
gate. Neither is an application dependency, and setuptools is not present in
the image as code at all.
Verify by building both variants for linux/amd64 and scanning with Trivy
0.70.0 at the workflow's settings: the current layer exits 1 with exactly
those two findings, the stripped layer exits 0. cloudscraper still imports
and creates a scraper, and removing py3-pip orphans no runtime tooling.
The setup:kobo-cloudscraper script still shells out to pip, but it needs tsx
and only ever runs in local development, never in the image.
Copy workspace patch files before frozen installs so pnpm can validate patched dependencies. Permit unused client patches only while deploying the server production bundle.
Emit transfer events when watcher reconciliation moves a book between libraries. Keep file-as-book and folder-as-book watcher paths consistent across Docker, direct runs, and delayed copy-delete moves.
Closes#386
Add Kobo as a first-class metadata source so books can keep Kobo IDs across fetch, edit, import, scoring, and file-write flows. Provide the Python cloudscraper setup needed for production fetches while keeping local setup explicit.
Closes#247
Replaced pre-compiled kepubify binaries (built with Go 1.17.8, 53
HIGH/CRITICAL CVEs) with binaries rebuilt from source using Go 1.26.3
and golang.org/x/text upgraded to v0.3.8, resolving all fixable CVEs.
Also fixed KepubifyBinaryService incorrectly falling back to downloading
the binary on every startup in read-only containers. chmod() was throwing
EROFS, and the single catch block treated it as a missing file. Split
stat and chmod into separate try/catch so only a missing-file error
triggers the download fallback.
- download correct arch binary from projectx-tools during image build
- use system binary at /usr/local/bin/kepubify when available, fall back to runtime download for local dev
- apk upgrade in runtime stage to fix OpenSSL CVEs (CVE-2025-15467 CRITICAL, CVE-2025-69419 HIGH)
- remove npm from runtime image to eliminate npm-bundled CVEs
- update fastify to 5.8.5 and force via pnpm override (CVE-2026-33806 HIGH)
- switch vitest pool to threads to fix flaky audio extractor tests
- simplify unit test setup with direct instantiation
- resolve all 69 client type-checking errors for stricter TS compliance
- remove obsolete type-check baseline scripts and files
- overhaul project root with updated README.md and new DEVELOPMENT.md
- migrate to unified baseline migration strategy and cleanup docker configs
- remove redundant production and dev-specific shell scripts
- add CODEOWNERS assigning .github/ to @neonsolstice
- configure automated updates for npm, docker, and github-actions ecosystems
- replace custom change-detection bash script with dorny/paths-filter@v4
- consolidate lint, typecheck, and test into a single checks matrix job
- gate per-package change detection via has-changes step (matrix unavailable in job-level if)
- fix duplicate actions/setup-node call in setup-node-pnpm composite action
- scope pnpm store cache key by pnpm version to prevent stale cross-version cache hits
- pin all action references to commit SHAs
- fix container-image concurrency group to use commit SHA across all trigger types
- add timeout-minutes to all jobs
- document fail-fast: false rationale and checks: write trade-off
neon
Jadehawk