Upgrade fixable Node dependencies and rebuild the pinned kepubify binaries with Go 1.27.3 so multi-architecture image publication passes the security gate.
Generate a synced read-aloud EPUB from a book's EPUB and audiobook through an
optional STAlign worker (Docker on CPU, or native with MLX on Apple Silicon),
with review, re-sync, replace in place, restart recovery and live progress on
the Files tab. Book details also stack the ebook and audiobook covers when
both exist. See docs/READ_ALOUD.md.
Bump every direct dependency to its newest same-major release and move the
node base image to 26.11.1, which invalidates the cached apk layer and picks
up tiff 4.7.2 for CVE-2026-4775. Rebuild all six kepubify binaries from the
pinned upstream commit with Go 1.27.2 for CVE-2026-78667, CVE-2026-78669 and
CVE-2026-97031, keeping v4-dev so rendition hashes stay stable.
Keep TypeScript at 6.0.3 while moving the remaining server and client packages onto their current supported releases.
Allow the PWA asset generator 2 peer range because vite-plugin-pwa still declares the compatible version 1 range.
Bump every direct dependency to its newest same-major release, moving the
embedpdf patches and packageExtensions to 2.15.1 and deduping the lockfile.
Hold jsdom at 30.0 because 30.1 breaks vitest's URL.createObjectURL shim,
and skip releases still inside pnpm's minimum release age.
Use the supported Alpine 3.23 Node image to avoid vulnerable util-linux packages in Alpine 3.24. Force fast-uri 3.1.6 to resolve the SSRF advisories reported by the image scan.
Apply a patch to @embedpdf/plugin-zoom@2.15.0 so numeric default zoom levels release the startup
viewport gate once resize metrics are measured.
Add unit test to verify custom zoom initialization and scale calculation under EmbedPDF.
Closes#1126
neon