Skip to content

3.0.1

Choose a tag to compare

View all tags
@swayinfo swayinfo released this 23 Aug 21:41
· 5 commits to main since this release
3.0.1
ba90389

Book Reader 3.0.1 - automated review fixes.

  • LICENSE is plain MIT again so it is recognised; third-party attribution moved to NOTICE.md
  • The build no longer contains dead library paths that create <script> elements: pdf.js loading its worker over the network (ours is embedded), epub.js injecting scripts into an iframe (the plugin never renders one) and jszip's IE timer polyfill. The patch happens at build time and stays verifiable - the catalogue rebuilds the plugin from source and compares the bytes.
  • Node modules (fs, http, zlib and friends) and epub.js's optional storage are stubbed out, so pdf.js's server-side code no longer ships.
  • PDFs are opened with isEvalSupported: false, the documented mitigation for CVE-2024-4367, where a crafted font runs its own code.
  • The builtin-modules package is gone; the list of Node modules is spelled out in the build config.
  • README no longer carries template comments; the stylesheet lost a duplicate declaration and three !important rules.

Verified on real books: EPUB (1466 paragraphs, 8 images) and PDF (1682 paragraphs) both open. Dynamic <script> creations in the build: 0. Filesystem calls: 0.

Assets 5
Loading