Detect the OPF rendition:layout declaration and announce pre-paginated books
as EPUB3FL instead of KEPUB, which is what selects the device's fixed-layout
renderer. Kepub conversion is left alone so KoboSpan progress sync still works.
The flag is stored per file and backfilled during the sync reconcile pass, so
existing libraries converge without a rescan.
Closes#1044
Use the patched Go standard library to address CVE-2026-39821 and CVE-2026-46600 in the bundled binaries. Keep the reported v4-dev version unchanged so existing rendition hashes remain stable.
The bundled binaries embedded golang.org/x/text v0.37.0, where a norm.Iter can enter an
infinite loop on input containing invalid UTF-8 bytes. Trivy flags this as HIGH and fails
the PR image scan on every branch opened since the advisory was published.
Rebuild all six binaries from the pinned upstream commit with x/text v0.40.0. The Go
toolchain was already current at 1.26.5 and is unchanged, so a toolchain-only rebuild would
not have cleared the finding; the vulnerable code lives in a module dependency. x/sync moves
to v0.22.0 as a side effect of the same resolution.
Keep the reported version string at v4-dev so rendition hashes stay stable and existing
cached kepub conversions remain valid.
The kepubify binaries contained golang.org/x/text v0.3.6 which
triggers CVE-2021-38561 and CVE-2022-32149 in Trivy. This commit
updates the module to the latest version and rebuilds the binaries.
The previous kepubify binaries were built with an older Go version
that triggered Trivy's CVE-2026-42504 vulnerability in the standard
library. This updates the binaries to the latest Go version to resolve
the CI pipeline failure.
Rebuild all 6 kepubify binaries (linux-64bit, linux-arm64, linux-arm,
linux-32bit, darwin-64bit, darwin-arm64) from source using Go 1.26.3.
Remove the download fallback in KepubifyBinaryService - all platforms
are now bundled so there is no need to fetch from bookorbit/bookorbit-tools.
neon