neon c425b7949e security(deps): bump golang.org/x/text in kepubify to fix CVE-2026-56852 ...

The bundled binaries embedded golang.org/x/text v0.37.0, where a norm.Iter can enter an
infinite loop on input containing invalid UTF-8 bytes. Trivy flags this as HIGH and fails
the PR image scan on every branch opened since the advisory was published.

Rebuild all six binaries from the pinned upstream commit with x/text v0.40.0. The Go
toolchain was already current at 1.26.5 and is unchanged, so a toolchain-only rebuild would
not have cleared the finding; the vulnerable code lives in a module dependency. x/sync moves
to v0.22.0 as a side effect of the same resolution.

Keep the reported version string at v4-dev so rendition hashes stay stable and existing
cached kepub conversions remain valid.

2026-07-30 17:59:59 +00:00

3.9 MiB

Executable File

Raw History

View Raw