📣 Update ghcr.io/readium/readium Docker tag to v0.9.1

[spanky-the-elfbot]

This PR contains the following updates:

Package	Type	Update	Change
ghcr.io/readium/readium	stage	minor	0.6.5 → 0.9.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

readium/cli (ghcr.io/readium/readium)

v0.9.1

Compare Source

Changed

• Docker builds use a local mime.types and pinned container hash for better security

Fixed

• Fixed session: scheme URLs for the web server not passing on query parameters to the session's HTTP request. Session URLs like session:https://example.com/data.json?t=abc will work now
• Hash list for manifest command is now validated
• This has probably never shown up in the real world, but requesting the byte range bytes=0-0 for a resource would have caused issues in the web server
• Further confine local FS reads on Windows. The long term solution is to is os.Root or such, but that requires go-toolkit changes
• Improved bonding reliability to deal with edge cases
• Improved open publication cache logic to deal with rare edge cases

v0.9.0

Compare Source

Added

• Standalone Readium Web Publication Manifests (e.g. a bare manifest.json, .audiobook or .divina file) can now be served. The publication's resources are resolved relative to the manifest's location, whether it lives on the local file system or on a remote source (http(s), s3, gs), and absolute HTTP(S) links in a manifest are fetched as-is. Previously, trying to open one would fail
• Added the --audio-parsing-cache-retain flag (enabled by default): the data fetched while parsing a remote audiobook (the container header and embedded chapter titles) is kept in memory, and requests for those byte ranges are served from it. Browsers request exactly these ranges before starting playback of e.g. an M4B, so with a many-chapter audiobook on a remote source, playback now starts several times faster. Disable the flag to save memory (it costs roughly one cache block per chapter plus the file headers, so a few MB per audiobook). Or just use a better audio format...
• Publications opened from a WebPub manifest now get a positions service, and a guided navigation service (MVP) when they contain HTML content

Changed

• The go-toolkit has been updated to v0.15.1. Together with changes to the webserver, this dramatically reduces the latency and excess data transfer of streaming publications from remote (http(s), s3, gs) sources. For the detailed list, refer to the go-toolkit's changelog; the highlights as they apply to the CLI:
  • The webserver now streams remote media to the client as it arrives whenever the range can be fetched efficiently (bare files and uncompressed archive entries), instead of buffering the entire requested range in memory first. Time to first byte no longer depends on the size of the requested range, memory use is bounded, and a client disconnecting cancels the remote transfer
  • Streaming has been optimized to unlock the ability for data transfers from a local filesystem source to the network to happen in-kernel with sendfile
  • Seeking through media inside a remote archive no longer re-downloads parts of the archive over and over (in the worst case, the whole archive tail on every request), and data is fetched in far fewer, larger range requests
  • Opening the same publication only queries the remote source for a file's size once, instead of once per request while streaming. For audiobooks in particular, this removes a remote round trip from every range request a browser makes
  • Fixed ranged reads of S3 resources downloading the entire object
  • Fixed a path traversal issue: a crafted link inside a publication could address content outside the publication's own location (e.g. a sibling S3 key or URL path) on the remote source it is served from

Fixed

• Clients disconnecting over HTTP/2 mid-response (e.g. a browser aborting range requests while probing or seeking media, which is routine) were logged as streaming errors such as http2: stream closed, polluting the logs. They are now ignored like their HTTP/1 counterparts (broken pipe, connection reset)

v0.8.0

Compare Source

Added

• Added the --audio-embedded-chapters, --audio-parsing-concurrency, --audio-parsing-cache-block-size flags for more control over audiobook parsing with regards to speed/latency/memory tradeoffs

Changed

• The go-toolkit has been updated to v0.14.0. This adds improved audiobook parsing. For a more detailed list of changed, refer to the go-toolkit's changelog. While best effort is made to minimize the latency when reading audiobooks from remote sources, there can still be an excess of reads that are necessary to fully parse metadata. The new settings provide a way to make tradeoffs depending on the situation

v0.7.1

Compare Source

Fixed

• v0.7.0 was tagged to the wrong commit, this is otherwise identical to v0.7.0 in terms of changes.

v0.6.6

Compare Source

Fixed

• Updated the go-toolkit, which fixes a race condition (error) that could occur reading local files

Changed

• Now, OPUS files has the mimetype audio/opus in manifests, but remain audio/ogg; codecs=opus in webserver responses for better compatibility

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.