Use the patched Go standard library to address CVE-2026-39821 and CVE-2026-46600 in the bundled binaries. Keep the reported v4-dev version unchanged so existing rendition hashes remain stable.
The bundled binaries embedded golang.org/x/text v0.37.0, where a norm.Iter can enter an
infinite loop on input containing invalid UTF-8 bytes. Trivy flags this as HIGH and fails
the PR image scan on every branch opened since the advisory was published.
Rebuild all six binaries from the pinned upstream commit with x/text v0.40.0. The Go
toolchain was already current at 1.26.5 and is unchanged, so a toolchain-only rebuild would
not have cleared the finding; the vulnerable code lives in a module dependency. x/sync moves
to v0.22.0 as a side effect of the same resolution.
Keep the reported version string at v4-dev so rendition hashes stay stable and existing
cached kepub conversions remain valid.
The kepubify binaries contained golang.org/x/text v0.3.6 which
triggers CVE-2021-38561 and CVE-2022-32149 in Trivy. This commit
updates the module to the latest version and rebuilds the binaries.
The previous kepubify binaries were built with an older Go version
that triggered Trivy's CVE-2026-42504 vulnerability in the standard
library. This updates the binaries to the latest Go version to resolve
the CI pipeline failure.
Rebuild all 6 kepubify binaries (linux-64bit, linux-arm64, linux-arm,
linux-32bit, darwin-64bit, darwin-arm64) from source using Go 1.26.3.
Remove the download fallback in KepubifyBinaryService - all platforms
are now bundled so there is no need to fetch from bookorbit/bookorbit-tools.
Replaced pre-compiled kepubify binaries (built with Go 1.17.8, 53
HIGH/CRITICAL CVEs) with binaries rebuilt from source using Go 1.26.3
and golang.org/x/text upgraded to v0.3.8, resolving all fixable CVEs.
Also fixed KepubifyBinaryService incorrectly falling back to downloading
the binary on every startup in read-only containers. chmod() was throwing
EROFS, and the single catch block treated it as a missing file. Split
stat and chmod into separate try/catch so only a missing-file error
triggers the download fallback.
neon