Update all (major) - #114

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/major-all
Open

Update all (major)#114
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/major-all

Conversation

@renovate

@renovaterenovateBot commented Sep 4, 2023•
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

PackageTypeUpdateChange
actions/checkoutactionmajorv3 → v7
gotenberg/gotenbergmajor7.8.2 → 8.36.0

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

v7.0.0

Compare Source

v7

Compare Source

v6.1.0

Compare Source

v6.0.3

Compare Source

v6.0.2

Compare Source

v6.0.1

Compare Source

v6.0.0

Compare Source

v6

Compare Source

v5.1.0

Compare Source

v5.0.1

Compare Source

v5.0.0

Compare Source

v5

Compare Source

v4.4.0

Compare Source

v4.3.1

Compare Source

v4.3.0

Compare Source

v4.2.2

Compare Source

v4.2.1

Compare Source

v4.2.0

Compare Source

v4.1.7

Compare Source

v4.1.6

Compare Source

v4.1.5

Compare Source

v4.1.4

Compare Source

v4.1.3

Compare Source

v4.1.2

Compare Source

  • Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in #​1598

v4.1.1

Compare Source

v4.1.0

Compare Source

v4.0.0

Compare Source

v4

Compare Source

gotenberg/gotenberg (gotenberg/gotenberg)

v8.36.0: 8.36.0

Compare Source

Security Fixes ⚠️

  • Filter WebSocket handshakes against the outbound policy. Chromium could open WebSocket connections to hosts the SSRF policy otherwise blocks.

New Features

  • OIDC bearer token authentication. Opt-in via --api-enable-oidc-auth, mutually exclusive with basic auth (#​1341). Thanks @​mlgupta.
  • Optimize PDF images to reduce file size (#​359). A /forms/pdfengines/optimize route, plus an optimizeImages option on the Chromium, LibreOffice, merge, and split routes. Thanks @​spointecker.
  • Apply multiple stamps and watermarks in one request by repeating the fields, on every route that supports them (#​1601). Thanks @​Kobe-Kwanten.
  • Screenshot a single element via the selector form field (#​947). Thanks @​human211.
  • Table-of-contents bookmarks when merging.titleBookmarks adds one bookmark per input, labeled by its title (#​867). Thanks @​gnapse.
  • Clear storage between conversions with --chromium-clear-storage (#​919). Thanks @​befresh-mweimerskirch.
  • Await async waitForExpression. A Promise-returning expression is now awaited (#​1617). Thanks @​nhh.

Bug Fixes

  • Landscape single-page now fits the page to its content (#​1390). Thanks @​JhnBer.
  • Accept the OOXML PowerPoint show extensions.ppsx and .ppsm (#​1626). Thanks @​lyarov22.
  • Client-cancelled requests are classified as 499, not 500 (#​1627). Thanks @​yngvar.
  • Render scrolled workbooks in full for singlePageSheets.
  • Return 403 instead of 500 for an unresolvable outbound host.
  • Hint at --chromium-start-timeout when Chromium fails to start.

Chore

  • Updated pdfcpu to v0.15.0 (#​1628). Thanks @​doronbehar.
  • Bumped golangci-lint to v2.12.2.
  • Updated Go and npm dependencies.

v8.35.0: 8.35.0

Compare Source

Security Fixes ⚠️

  • Sanitize the Gotenberg-Output-Filename header.filepath.Base ignores \ on Linux, so a crafted header reached archive entry names on splitMode conversions, giving a Windows-side Zip Slip.
  • Bound scope matching per conversion. The extraHttpHeaders match timeout capped one match, not their number. Matching now shares a per-conversion budget, and extraHttpHeaders accepts at most 64 headers with a 1024-character scope.

New Features

  • Authenticated proxy from environment variables. Four opt-in flags route outbound traffic through HTTP_PROXY, HTTPS_PROXY, and NO_PROXY, credentials included: --chromium-enable-environment-proxy, --libreoffice-enable-environment-proxy, --api-download-from-enable-environment-proxy, and --webhook-enable-environment-proxy. All default to false. Breaking: the outbound client no longer inherits HTTP_PROXY and HTTPS_PROXY implicitly.

Bug Fixes

  • LibreOffice returned 400 for server-side failures (#​1588). 400 now requires an implicated client input, nativePageRanges, password, or an unreadable document; everything else is 500. Thanks @​ctunon-align.
  • generateDocumentOutline was a silent no-op (#​1579). It now enables generateTaggedPdf, which Chromium needs to build the outline. Thanks @​paradoxloop.
  • Pinning proxy latched after a Chromium start timeout. Starts are now serialized.
  • LibreOffice leaked a document after a failed export.unoconverter now releases it.

Chore

  • Updated Chromium to 151.0.7922.71.
  • Updated pdfcpu to v0.13.0.
  • Updated unoconverter to v0.4.0.
  • Bumped Go to 1.26.5.
  • Updated Go dependencies.

v8.34.0: 8.34.0

Compare Source

Security Fixes ⚠️
  • Block content linked from untrusted locations in LibreOffice. An uploaded document could reference external (http(s)://) or local (file:///…) resources that LibreOffice resolved during conversion, giving blind SSRF and a limited local-file read. The soffice profile now sets BlockUntrustedRefererLinks, so soffice refuses to load any content a document links. Embedded content is unaffected; documents relying on linked resources no longer render them.
New Features
  • Factur-X / ZUGFeRD metadata (#​1552). Conversions now inject the matching XMP metadata, and the API replaces the single facturx payload with dedicated form fields. Thanks @​fank.
  • Owner-only encryption and permissions. A new ownerPassword, independent of userPassword, plus permission controls restrict what a viewer may do without locking the document open.
  • log-std-level-case (#​1339). New flag to set the level field casing in standard output, lower (default) or upper. Thanks @​Jaben.
Observability
  • Trace enrichment. New process.exec client spans, supervisor queue-wait and launch sub-spans, a Chromium print_to_pdf sub-span, backing-binary versions (Chromium, LibreOffice, qpdf, …) recorded on spans and captured at build time, and per-conversion I/O, network, and size attributes on Chromium and LibreOffice spans.
  • Error classification. Chromium and LibreOffice failures set an error.type from a bounded enum.
  • Richer resource and metrics. Process, OS, host, and container resource detectors, semconv aligned to v1.41.0, a trace-based exemplar filter, and conversions-since-restart and queue-depth gauges.
Bug Fixes
  • CSV conversions leaked the upload's UUID filename as a page header (#​1568). Calc printed the sheet name, which was the UUID-based upload filename, as a centered page header. Now suppressed. Thanks @​vapranav.
  • Webhook async lost trace context. The async delivery goroutine detached from the request context and dropped the trace, breaking span continuity. It now preserves the context via context.WithoutCancel.
  • ca-certificates missing in the chromium-only image. Outbound TLS could fail in the chromium-only build. The package is now installed. Thanks @​osvein.
  • LibreOffice core-dump retries. Retries on ErrCoreDumped are now capped and observable, and the ErrRuntimeException message is corrected.
Chore
  • Updated Chromium to version 149.0.7827.102-1.
  • Updated Go dependencies.

v8.33.0: 8.33.0

Compare Source

Security Fixes ⚠️

  • Block IPv6 prefixes that tunnel to internal IPv4 in IsPublicIP.::ffff:10.0.0.1, 2002:c0a8:: (6to4), and 2001::/32 (Teredo) embed an internal IPv4 destination inside an IPv6 address. IsPublicIP evaluated only the outer IPv6 form, so --*-deny-private-ips filters let the embedded private IPv4 reach the dialer. The check now unwraps IPv4-mapped, IPv4-translated, 6to4, and Teredo addresses, and rejects them when the embedded IPv4 is non-public.
  • Strip backslash separators from supplied filenames. Linux treated a caller-supplied Gotenberg-Output-Filename header or filename form field containing ..\ or foo\bar as a single segment. The handler now strips both forward-slash and backslash path separators before composing the output path.

New Features

  • Device scale ratio for screenshots (#​1543). A new deviceScaleFactor form field on /forms/chromium/screenshot/{html,url,markdown} controls the screenshot pixel density. Defaults to 1. Thanks @​hovcharenko.

Bug Fixes

  • Pinning proxy outlived a failed Chromium start. When chromedp failed to start (port conflict, container OOM, sandbox denial), the loopback HTTP/CONNECT pinning proxy added in 8.32.0 stayed bound to its port and leaked across restart attempts. The browser now stops the pinning proxy on every start failure.
  • Lifecycle listener race on Navigate.chromedp.Navigate could fire Page.lifecycleEvent before Gotenberg's listener subscribed, so the converter occasionally waited the full network-idle timeout on otherwise fast pages. Listeners now register before navigation.
  • Supervisor flapped on transient CDP latency. A single slow CDP health probe marked the supervised process unhealthy and triggered a restart, even when the next probe succeeded. Probes now require N consecutive failures before reporting unhealthy.
  • downloadFrom concurrent map writes. Parallel downloadFrom entries merged results into a shared map without a lock. Under enough concurrency this raced and panicked the request goroutine. Result merging is now serialized.
  • Pinning-proxy noise on client cancellations.context canceled and connection reset by peer from the client side of the pinning proxy logged at error level, flooding logs whenever a caller aborted mid-render. Client-cancelled dial errors now log at debug.

Chore

  • Updated Chromium to version 148.0.7778.178-1.
  • Updated Go dependencies.

v8.32.0: 8.32.0

Compare Source

Security Fixes ⚠️

  • Reverted SSRF defaults (breaking vs 8.31.0). 8.31.0 blocked private-IP destinations by default, which broke deployments running Gotenberg inside a private network. 8.32.0 restores the 8.30.x permissive defaults. Operators with internet-facing APIs opt into the strict posture via the new flags below.

  • Rejected file:// at /forms/chromium/convert/url. Submitting url=file:///tmp/... used to let an unauthenticated caller enumerate the request working directory and read other in-flight uploads as rendered PDFs. The route now returns HTTP 400 for any file:// URL.

  • Required uploaded file for image / pdf stamp and watermark sources. Twelve callsites accepted stampSource=pdf or watermarkSource=pdf with an expression pointing at any path the Gotenberg process could open, even when no file was uploaded. Handlers now return HTTP 400 unless the caller uploaded a matching file.

  • Scoped file:// sub-resources to the request working directory. Crafted HTML could reference another request's file:///tmp/<reqdir>/.... The CDP request handler now restricts file:// sub-resources to the current request's directory. /convert/url and /screenshot/url reject every file:// sub-resource outright.

  • Hardened Chromium against DNS rebinding. A short-TTL DNS authority could return a public IP at validation and a private IP at connect. A loopback HTTP / CONNECT proxy now sits between Chromium and the network, resolves DNS once, and pins the dial to the resolved IP. Skipped when --chromium-proxy-server or --chromium-host-resolver-rules is set.

  • Filtered LibreOffice outbound fetches through a proxy. Uploaded OOXML, RTF, and ODF files can embed external URLs that LibreOffice's libcurl resolves below every Go-side SSRF filter. LibreOffice now routes every outbound fetch through an in-process forward proxy on the same gotenberg.DecideOutbound path Chromium and webhook delivery use. See the four new flags below.

  • Recovered webhook async panics. High-concurrency webhooks could panic the async goroutine and crash the whole process. The goroutine now snapshots the request context and recovers any future panic through the existing error path.

New Features

  • LibreOffice outbound URL filtering. Four flags mirror the Chromium and webhook layout: --libreoffice-allow-list, --libreoffice-deny-list, --libreoffice-deny-private-ips, --libreoffice-deny-public-ips. All default permissive.

  • IP-class filtering on four modules.chromium, webhook, api-download-from, and libreoffice each accept matching deny-private-ips and deny-public-ips flags. All default to false.

FlagWhat it does
--chromium-deny-private-ipsReject Chromium navigations and sub-resources resolving to a non-public IP.
--chromium-deny-public-ipsReject Chromium navigations and sub-resources resolving to a public IP.
--webhook-deny-private-ipsReject webhook URLs (success, error, events) resolving to a non-public IP.
--webhook-deny-public-ipsReject webhook URLs resolving to a public IP.
--api-download-from-deny-private-ipsReject downloadFrom URLs resolving to a non-public IP.
--api-download-from-deny-public-ipsReject downloadFrom URLs resolving to a public IP.
--libreoffice-deny-private-ipsReject LibreOffice outbound fetches resolving to a non-public IP.
--libreoffice-deny-public-ipsReject LibreOffice outbound fetches resolving to a public IP.

A URL matching --*-allow-list skips the IP-class check. A URL matching --*-deny-list is always rejected. Setting both deny-private-ips=true and deny-public-ips=true rejects every URL unless the allow-list matches.

Bug Fixes

  • Charts print as blank rectangles (#​1531, #​1532, #​1534, #​1535): chromedp v0.15.0 suspended the BeginFrame-driven callback dispatch loop under emulatedMediaType=print. requestAnimationFrame, ResizeObserver, IntersectionObserver, CSS transitionend, and CSS animationend all stopped firing. Pinning chromedp back to v0.14.2 restores native dispatch.

  • LibreOffice cached an unrecoverable first-start error (#​1538): A short --libreoffice-start-timeout timed out the first request, then every subsequent request returned the same cached error until the container restarted. The lazy-start path now retries on failure.

Chore

  • Updated pdfcpu to v0.12.0.
  • Switched metadata read/write to direct exiftool invocation. Removes the GPL-3.0 go-exiftool dependency.
  • Bumped Go to 1.26.2.
  • Updated Go dependencies.

Thanks

Thanks to @​Jalliuz (#​1527) for reporting the 8.31.0 sub-resource regression. @​notscottsmith (#​1531), @​spoltix (#​1532), @​rdelott-work (#​1534), and @​sillyas2010 (#​1535) narrowed down the chromedp print-mode regression. @​sillyas2010 also published the reproducer that pinned the bisect. @​JeremyReist2 (#​1536) flagged the go-exiftool GPL-3.0 license. @​doronbehar (#​1537) requested the pdfcpu upgrade. @​mlafon (#​1538) reported the LibreOffice supervisor cached-error bug.

v8.31.0: 8.31.0

Compare Source

Breaking Changes & Security Fixes ⚠️

  • Stopped publishing thecodingmachine/gotenberg images. Pull from gotenberg/gotenberg instead.
  • SSRF hardening (breaking). Resolves outbound URLs (Chromium asset fetches, webhook delivery, download-from) and rejects non-public addresses: loopback, RFC1918, link-local, unspecified, multicast, IPv6 unique-local, IPv4-mapped IPv6. Pins the dial to the validated IP to prevent DNS rebinding.
  • Defaulted webhook deny list (breaking).--webhook-deny-list now defaults to a regex blocking loopback, RFC1918, link-local, and IPv6 unique-local ranges. Override the flag to call internal hosts.
  • Sanitized ExifTool metadata (breaking for System: tags). Strips control characters and line breaks from /forms/pdfengines/metadata/write payloads. Drops System:-prefixed tags. Blocks argument smuggling and filesystem pseudo-tag abuse.

New Features

  • Embed files metadata. Adds embedsMetadata to every route accepting embeds (Chromium HTML/URL/Markdown, LibreOffice convert, PDF Engines merge/split/embed). Pass a JSON object keyed by filename with per-file fields (mimeType, relationship, etc.) - thanks @​Jean-Beru!

Bug Fixes

  • Pinned Chromium to v146 on ppc64le to work around an upstream regression.

Deprecated Flags

OldNew
--webhook-error-allow-list--webhook-allow-list
--webhook-error-deny-list--webhook-deny-list

Old flags still work.

Chore

  • Updated Go dependencies.

v8.30.1: 8.30.1

Compare Source

Another release, another bug fixes 🫥

Bug Fixes

v8.30.0: 8.30.0

Compare Source

New Features

Docker Image Variants
  • Chromium-Only Image (gotenberg/gotenberg:8.30.0-chromium): Drops LibreOffice, python3, and hyphenation packages. ~30% smaller than the full image.
  • LibreOffice-Only Image (gotenberg/gotenberg:8.30.0-libreoffice): Drops Chromium and its dependencies. ~38% smaller than the full image.

Pick the variant that matches your workload. The full image (gotenberg/gotenberg:8.30.0) still ships everything.

Leaner Docker Image

The full image is ~13% smaller than 8.29.0. The font stack was simplified from 30+ packages down to 8, covering Latin, Greek, Cyrillic, CJK, and most world scripts through Noto, plus color emoji.

PackageCoverage
fonts-noto-coreArabic, Bengali, Devanagari, Ethiopic, Georgian, Gujarati, Gurmukhi, Hebrew, Kannada, Khmer, Lao, Malayalam, Myanmar, Sinhala, Tamil, Telugu, Thai, and more
fonts-noto-cjkChinese, Japanese, Korean
fonts-noto-color-emojiColor emoji
fonts-dejavuLatin, Greek, Cyrillic
fonts-crosextra-carlitoMetric-compatible with Calibri
fonts-crosextra-caladeaMetric-compatible with Cambria
fonts-liberationMetric-compatible with Arial, Times New Roman, Courier New
fonts-liberation2Updated Liberation metrics

Microsoft Core Fonts (ttf-mscorefonts-installer) are not shipped due to licensing constraints. The image includes metric-compatible replacements instead: Carlito for Calibri, Caladea for Cambria, and Liberation for Arial, Times New Roman, and Courier New. These preserve document layout in most cases.

Installing Additional Fonts

Build a custom Dockerfile to add fonts. Common scenarios:

Microsoft Core Fonts (you accept the Microsoft EULA):

FROM gotenberg/gotenberg:8
USER root
RUN echo "deb http://deb.debian.org/debian trixie contrib non-free" \
> /etc/apt/sources.list.d/contrib.list \
&& echo "ttf-mscorefonts-installer msttcorefonts/accepted-mscorefonts-eula select true" \
| debconf-set-selections \
&& apt-get update -qq \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
ca-certificates \
wget \
ttf-mscorefonts-installer \
&& rm -rf /var/lib/apt/lists/*
USER gotenberg

Specialized script fonts for richer glyph sets, better hinting, or traditional typefaces beyond the basic Noto coverage:

ScriptPackage
Arabic (Naskh)fonts-hosny-amiri
Bengalifonts-beng
Devanagari (Hindi)fonts-sarai
Ethiopicfonts-sil-abyssinica
Gujaratifonts-samyak-gujr
Gurmukhi (Punjabi)fonts-lohit-guru
Hebrewculmus
Kannadafonts-lohit-knda
Malayalamfonts-samyak-mlym
Myanmarfonts-sil-padauk
Sinhalafonts-lklug-sinhala
Tamilfonts-samyak-taml
Telugufonts-telu
Thaifonts-thai-tlwg
FROM gotenberg/gotenberg:8
USER root
RUN apt-get update -qq \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
fonts-hosny-amiri \
fonts-thai-tlwg \
&& rm -rf /var/lib/apt/lists/*
USER gotenberg
Webhook
  • Gotenberg-Webhook-Error-Url Now Optional: When Gotenberg-Webhook-Events-Url is set, Gotenberg-Webhook-Error-Url is no longer required. Error handling flows through the events URL instead. Gotenberg-Webhook-Error-Url is deprecated but continues to work.

Bug Fixes

  • ExifTool Tag Filtering: Case-insensitive comparison and expanded blocklist for ExifTool metadata filtering. Excludes additional system tags while preserving safe derived tags.
  • Regex Timeout: Added timeout to regex evaluation to prevent ReDoS on malformed patterns.

Chore

  • Updated Go dependencies.

v8.29.1: 8.29.1

Compare Source

Bug Fix (Chromium)

Assets were no longer being correctly loaded in HTML files. This is now fixed. Thanks @​ARawles-GFSC for the heads up!

v8.29.0: 8.29.0

Compare Source

Security Fixes ⚠️

  • ExifTool Arbitrary File Write: The /forms/pdfengines/metadata/write endpoint allowed users to pass FileName and Directory pseudo-tags in the metadata JSON, enabling file rename/move to arbitrary paths. User-supplied metadata is now filtered through a blocklist before being passed to ExifTool.
  • Chromium file:// Sub-Resource Restriction: When converting HTML/Markdown via file://, sub-resources are now restricted to the request's working directory, preventing cross-request file access in /tmp.

New Features

OpenTelemetry
  • Full OpenTelemetry Support: Distributed tracing, metrics export, and structured logging: all configurable via standard OTEL environment variables (OTEL_TRACES_EXPORTER, OTEL_METRICS_EXPORTER, OTEL_LOGS_EXPORTER, OTEL_EXPORTER_OTLP_ENDPOINT, etc.). Every HTTP request gets a span. External tool calls (Chromium, LibreOffice, QPDF, pdfcpu, pdftk, ExifTool, webhook delivery, download-from) create child spans. Trace context is propagated to outbound HTTP calls via W3C headers.
  • Structured Logging Migration: Migrated from custom logging module to slog-based structured logging with OTEL log bridge. Supports auto/JSON/text formats with optional GCP-compatible field names.
  • Binary Path as Peer Service: server.address span attribute uses the actual binary path (e.g., /usr/bin/qpdf) instead of the software name.
  • Telemetry Control for System Routes: New flags to disable telemetry for noisy system routes, all defaulting to disabled: --api-disable-root-route-telemetry, --api-disable-debug-route-telemetry, --api-disable-version-route-telemetry, --prometheus-disable-route-telemetry. The existing --api-disable-health-check-route-telemetry default changed from false to true.
Chromium
  • Idle Shutdown: New --chromium-idle-shutdown-timeout flag (default: 0s, disabled) to automatically stop Chromium after a configurable idle period, reclaiming memory on low-traffic servers. The process re-launches lazily on the next request.
  • Network Almost Idle Event: New skipNetworkAlmostIdleEvent form field (default: true). When set to false, Gotenberg waits for a "network almost idle" event (at most 2 open connections for 500ms) before conversion. This provides a middle ground between the existing skipNetworkIdleEvent (strict, 0 connections) and no wait at all — useful for pages with long-polling or analytics connections that never fully close.
LibreOffice
  • PDF Viewer Preferences (#​1316): 15 new form fields for controlling PDF viewer behavior: initialView, initialPage, magnification, zoom, pageLayout, firstPageOnLeft, resizeWindowToInitialPage, centerWindow, openInFullScreenMode, displayPDFDocumentTitle, hideViewerMenubar, hideViewerToolbar, hideViewerWindowControls, useTransitionEffects, openBookmarkLevels.
  • Idle Shutdown: New --libreoffice-idle-shutdown-timeout flag (default: 0s, disabled), same behavior as Chromium.
Webhook
  • Event Callbacks (#​1473): New optional Gotenberg-Webhook-Events-Url header. When set, structured JSON events (webhook.success, webhook.error) are POSTed after each webhook operation, with correlationId and timestamp. Additive: existing Gotenberg-Webhook-Url and Gotenberg-Webhook-Error-Url continue to work unchanged.
Security & Networking
  • Multiple URL Patterns: All allow/deny list flags (--chromium-allow-list, --chromium-deny-list, --webhook-allow-list, --webhook-deny-list, --webhook-error-allow-list, --webhook-error-deny-list, --api-download-from-allow-list, --api-download-from-deny-list) now accept multiple regex patterns via string slices. Existing single-value configurations continue to work.

Bug Fixes

  • Chromium singlePage Margin Accounting (#​1046): The singlePage option now correctly accounts for top/bottom margins when calculating page height, fixing content overflow on tall pages.
  • Long Filename Support (#​1500): Files with long names (166+ chars, especially with multi-byte UTF-8) no longer cause "File name too long" errors. Files are now stored on disk with UUID-based names while preserving original filenames for HTTP responses, archive entries, and JSON keys.

Deprecated Flags

OldNew
--log-format--log-std-format
--log-enable-gcp-fields--log-std-enable-gcp-fields
--api-trace-header--api-correlation-id-header
--api-disable-health-check-logging--api-disable-health-check-route-telemetry
--prometheus-disable-route-logging--prometheus-disable-route-telemetry

All deprecated flags continue to work.

Chore

  • Replaced go.uber.org/multierr with stdlib errors.Join.
  • Added integration tests for Chromium screenshot routes (HTML, URL, Markdown).
  • Added long filename integration tests across all PDF engine and conversion routes.
  • Integration test retry mechanism: failed scenarios are automatically retried up to 3 times.
  • Bumped actions/checkout to v6 in all GitHub Actions.

Thanks

Thanks to @​dkrizic (#​814) and @​jbdelhommeau (#​1489) for requesting OpenTelemetry/tracing support, @​eht16 (#​1316), @​nh2 (#​1023), @​Frozen666 (#​1046), @​vofflan (#​1500), @​danxmoran (#​1394), and @​janaka (#​1473) for their issue reports and feature requests!

This release represents a significant amount of work: OpenTelemetry integration, security fixes, new features, and hundreds of integration tests. If Gotenberg is useful to you or your team, please consider sponsoring the project. Your support helps keep development going.

v8.28.0: 8.28.0

Compare Source

New Features

PDF Engines
  • Watermark: Added POST /forms/pdfengines/watermark route. Applies a watermark (behind page content) to one or more PDF files. Supports text, image, or pdf sources. Also available as optional form fields on Chromium, LibreOffice, merge, and split routes. Configurable via --pdfengines-watermark-engines (default: pdfcpu,pdftk).
  • Stamp: Added POST /forms/pdfengines/stamp route. Applies a stamp (on top of page content) to one or more PDF files. Same source types and integration points as watermark. Configurable via --pdfengines-stamp-engines (default: pdfcpu,pdftk).
  • Rotate: Added POST /forms/pdfengines/rotate route. Rotates pages by 90°, 180°, or 270° with optional page selection. Also available as optional form fields (rotateAngle, rotatePages) on all composite routes. Configurable via --pdfengines-rotate-engines (default: pdfcpu, pdftk).
  • Bookmarks (Read): Added POST /forms/pdfengines/bookmarks/read route. Returns the hierarchical bookmark outline from one or more PDF files as JSON. Configurable via --pdfengines-read-bookmarks-engines (default: pdfcpu).
  • Bookmarks (Write): Added POST /forms/pdfengines/bookmarks/write route. Accepts either a flat list (applied to all files) or a filename-keyed map. Configurable via --pdfengines-write-bookmarks-engines (default: pdfcpu, pdftk).
  • Merge Bookmark Management: The merge route now supports a bookmarks form field for custom bookmarks with automatic page-offset shifting, and an autoIndexBookmarks option to extract and reindex existing bookmarks from input files.
  • PDF/A & PDF/UA Compliance: Reordered the processing pipeline so that PDF/A and PDF/UA conversion runs after watermark, stamp, and flatten operations. Also reject incompatible combinations (e.g., PDF/A + encryption, PDF/A-1/2 + embeds) with a 400 Bad Request.
LibreOffice
  • Native Watermarks: Added support for LibreOffice's built-in watermark rendering during PDF export via new form fields: nativeWatermarkText, nativeWatermarkColor, nativeWatermarkFontHeight, nativeWatermarkRotateAngle, nativeWatermarkFontName, and nativeTiledWatermarkText.
API
  • Download From: Extended the downloadFrom JSON schema with a field property ("watermark", "stamp", "embedded", or "") to route downloaded files to the appropriate form field bucket. The existing embedded boolean is preserved for backward compatibility.

Chore

  • Updated Chromium to 146.0.7680.153-1.
  • Updated Go dependencies.

v8.27.0: 8.27.0

Compare Source

New Features

Chromium
  • Concurrency Support: Re-introduced support for simultaneous conversions (up to 6 by default). Configurable via CHROMIUM_MAX_CONCURRENCY. Thanks @​TomBrouws!
  • Restart Threshold: Updated the default value for CHROMIUM_RESTART_AFTER to 100.
  • Emulated Media Features: Added the emulatedMediaFeatures form field. This allows users to pass a JSON array to simulate specific CSS media features, such as prefers-color-scheme: dark or prefers-reduced-motion. Thanks @​danxmoran!
Misc
  • Timezone: The default timezone is now explicitly UTC and is visible in the debug route. This remains overridable via th

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovateBot enabled auto-merge (rebase) September 4, 2023 17:16
@renovaterenovateBot changed the title Update actions/checkout action to v4Update actions/checkout action to v4 - autoclosedOct 17, 2023
@renovaterenovateBot closed this Oct 17, 2023
auto-merge was automatically disabled October 17, 2023 18:45

Pull request was closed

@renovate
renovateBot deleted the renovate/major-all branch October 17, 2023 18:45
@renovaterenovateBot changed the title Update actions/checkout action to v4 - autoclosedUpdate actions/checkout action to v4Oct 19, 2023
@renovaterenovateBot reopened this Oct 19, 2023
@renovate
renovateBot restored the renovate/major-all branch October 19, 2023 10:11
@renovate
renovateBotforce-pushed the renovate/major-all branch from 60d859a to 9658d5dCompareOctober 19, 2023 10:11
@renovate
renovateBotforce-pushed the renovate/major-all branch from 9658d5d to 62a0b2dCompareJanuary 4, 2024 19:38
@renovaterenovateBot changed the title Update actions/checkout action to v4Update all (major)Jan 4, 2024
@renovate
renovateBotforce-pushed the renovate/major-all branch from 62a0b2d to 9498f21CompareJanuary 8, 2024 17:51
@renovate
renovateBotforce-pushed the renovate/major-all branch from 9498f21 to c86f4b8CompareJanuary 18, 2024 14:17
@renovate
renovateBotforce-pushed the renovate/major-all branch from c86f4b8 to 63de7e6CompareFebruary 7, 2024 15:34
@renovate
renovateBotforce-pushed the renovate/major-all branch 2 times, most recently from ea1d0ec to 8732cdaCompareFebruary 24, 2024 00:57
@renovate
renovateBotforce-pushed the renovate/major-all branch from 8732cda to de378adCompareMarch 4, 2024 13:39
@renovate
renovateBotforce-pushed the renovate/major-all branch from de378ad to c176512CompareMarch 15, 2024 19:50
@renovate
renovateBot enabled auto-merge (rebase) March 20, 2024 12:18
@renovate
renovateBotforce-pushed the renovate/major-all branch from c176512 to 4062b81CompareMarch 23, 2024 22:39
@renovate
renovateBotforce-pushed the renovate/major-all branch from 4062b81 to 5f3ebaeCompareApril 11, 2024 15:26
@renovate
renovateBotforce-pushed the renovate/major-all branch from 5f3ebae to 0e2d0c7CompareApril 25, 2024 17:30
@renovate
renovateBotforce-pushed the renovate/major-all branch from 0e2d0c7 to 6bdb4d1CompareMay 22, 2024 11:12
@renovate
renovateBotforce-pushed the renovate/major-all branch from 6bdb4d1 to c59cebcCompareJune 4, 2024 18:24
@renovate
renovateBotforce-pushed the renovate/major-all branch from c59cebc to 6db7d48CompareJune 13, 2024 11:36
@renovate
renovateBotforce-pushed the renovate/major-all branch from 6db7d48 to 3d6a8f6CompareJuly 3, 2024 19:48
@renovate
renovateBotforce-pushed the renovate/major-all branch from 3d6a8f6 to 6cbd611CompareJuly 18, 2024 15:25
@renovate
renovateBotforce-pushed the renovate/major-all branch from 6cbd611 to 9fca9f2CompareJuly 29, 2024 12:37
@renovate
renovateBotforce-pushed the renovate/major-all branch from 9fca9f2 to ba5e9a2CompareAugust 11, 2024 15:34
@renovate
renovateBotforce-pushed the renovate/major-all branch from ba5e9a2 to fcbc913CompareSeptember 3, 2024 13:59
@renovate
renovateBotforce-pushed the renovate/major-all branch from dbb0041 to 0bd35c8CompareJanuary 30, 2025 01:28
@renovate
renovateBotforce-pushed the renovate/major-all branch 2 times, most recently from 9298586 to 03a3172CompareFebruary 12, 2025 19:14
@renovate
renovateBotforce-pushed the renovate/major-all branch 2 times, most recently from 9f5c0c3 to cc92ec4CompareMarch 6, 2025 10:32
@renovate
renovateBotforce-pushed the renovate/major-all branch from cc92ec4 to 5c38fa1CompareMarch 17, 2025 17:33
@renovate
renovateBotforce-pushed the renovate/major-all branch 2 times, most recently from 9f81659 to 948c2cdCompareApril 2, 2025 14:08
@renovate
renovateBotforce-pushed the renovate/major-all branch 2 times, most recently from 8f953be to 42d11a4CompareApril 12, 2025 21:37
@renovate
renovateBotforce-pushed the renovate/major-all branch from 42d11a4 to 96dc4a9CompareMay 21, 2025 17:27
@renovate
renovateBotforce-pushed the renovate/major-all branch from 96dc4a9 to 5139460CompareJune 15, 2025 18:36
@renovate
renovateBotforce-pushed the renovate/major-all branch from 5139460 to 139894cCompareAugust 11, 2025 15:05
@renovate
renovateBotforce-pushed the renovate/major-all branch from 139894c to c9514e1CompareAugust 19, 2025 09:26
@renovate
renovateBotforce-pushed the renovate/major-all branch from c9514e1 to 8258850CompareAugust 31, 2025 17:57
@renovate
renovateBotforce-pushed the renovate/major-all branch from 4e91d49 to c92558bCompareOctober 9, 2025 13:32
@renovate
renovateBotforce-pushed the renovate/major-all branch 2 times, most recently from ae4c8d0 to 63e70feCompareNovember 20, 2025 20:54
@renovate
renovateBotforce-pushed the renovate/major-all branch from 63e70fe to 0588cc6CompareDecember 4, 2025 10:31
@renovate
renovateBotforce-pushed the renovate/major-all branch from 0588cc6 to 1d473f0CompareJanuary 27, 2026 15:13
@renovate
renovateBotforce-pushed the renovate/major-all branch from 1d473f0 to 62ee86aCompareFebruary 22, 2026 21:51
@renovate
renovateBotforce-pushed the renovate/major-all branch from 62ee86a to cc4d29fCompareMarch 20, 2026 16:56
@renovate
renovateBotforce-pushed the renovate/major-all branch 2 times, most recently from 5cf217d to 84667efCompareMarch 30, 2026 20:34
@renovate
renovateBotforce-pushed the renovate/major-all branch 2 times, most recently from e36f3c9 to 80be1f4CompareApril 6, 2026 17:52
@renovate
renovateBotforce-pushed the renovate/major-all branch from 80be1f4 to 4081637CompareApril 17, 2026 15:13
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Update all (major) - #114
Open
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/major-all
Open
Update all (major)#114
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/major-all
Conversation
@renovate
@renovaterenovateBot
commented
Sep 4, 2023•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageTypeUpdateChange
actions/checkoutactionmajorv3 → v7
gotenberg/gotenbergmajor7.8.2 → 8.36.0
Release Notes
actions/checkout (actions/checkout)
v7.0.1
Compare Source
v7.0.0
Compare Source
v7
Compare Source
v6.1.0
Compare Source
v6.0.3
Compare Source
v6.0.2
Compare Source
v6.0.1
Compare Source
v6.0.0
Compare Source
v6
Compare Source
v5.1.0
Compare Source
v5.0.1
Compare Source
v5.0.0
Compare Source
v5
Compare Source
v4.4.0
Compare Source
v4.3.1
Compare Source
v4.3.0
Compare Source
v4.2.2
Compare Source
v4.2.1
Compare Source
v4.2.0
Compare Source
v4.1.7
Compare Source
v4.1.6
Compare Source
v4.1.5
Compare Source
v4.1.4
Compare Source
v4.1.3
Compare Source
v4.1.2
Compare Source
  • Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in #​1598
v4.1.1
Compare Source
v4.1.0
Compare Source
v4.0.0
Compare Source
v4
Compare Source
gotenberg/gotenberg (gotenberg/gotenberg)
v8.36.0: 8.36.0
Compare Source
Security Fixes ⚠️
  • Filter WebSocket handshakes against the outbound policy. Chromium could open WebSocket connections to hosts the SSRF policy otherwise blocks.
New Features
  • OIDC bearer token authentication. Opt-in via --api-enable-oidc-auth, mutually exclusive with basic auth (#​1341). Thanks @​mlgupta.
  • Optimize PDF images to reduce file size (#​359). A /forms/pdfengines/optimize route, plus an optimizeImages option on the Chromium, LibreOffice, merge, and split routes. Thanks @​spointecker.
  • Apply multiple stamps and watermarks in one request by repeating the fields, on every route that supports them (#​1601). Thanks @​Kobe-Kwanten.
  • Screenshot a single element via the selector form field (#​947). Thanks @​human211.
  • Table-of-contents bookmarks when merging.titleBookmarks adds one bookmark per input, labeled by its title (#​867). Thanks @​gnapse.
  • Clear storage between conversions with --chromium-clear-storage (#​919). Thanks @​befresh-mweimerskirch.
  • Await async waitForExpression. A Promise-returning expression is now awaited (#​1617). Thanks @​nhh.
Bug Fixes
  • Landscape single-page now fits the page to its content (#​1390). Thanks @​JhnBer.
  • Accept the OOXML PowerPoint show extensions.ppsx and .ppsm (#​1626). Thanks @​lyarov22.
  • Client-cancelled requests are classified as 499, not 500 (#​1627). Thanks @​yngvar.
  • Render scrolled workbooks in full for singlePageSheets.
  • Return 403 instead of 500 for an unresolvable outbound host.
  • Hint at --chromium-start-timeout when Chromium fails to start.
Chore
  • Updated pdfcpu to v0.15.0 (#​1628). Thanks @​doronbehar.
  • Bumped golangci-lint to v2.12.2.
  • Updated Go and npm dependencies.
v8.35.0: 8.35.0
Compare Source
Security Fixes ⚠️
  • Sanitize the Gotenberg-Output-Filename header.filepath.Base ignores \ on Linux, so a crafted header reached archive entry names on splitMode conversions, giving a Windows-side Zip Slip.
  • Bound scope matching per conversion. The extraHttpHeaders match timeout capped one match, not their number. Matching now shares a per-conversion budget, and extraHttpHeaders accepts at most 64 headers with a 1024-character scope.
New Features
  • Authenticated proxy from environment variables. Four opt-in flags route outbound traffic through HTTP_PROXY, HTTPS_PROXY, and NO_PROXY, credentials included: --chromium-enable-environment-proxy, --libreoffice-enable-environment-proxy, --api-download-from-enable-environment-proxy, and --webhook-enable-environment-proxy. All default to false. Breaking: the outbound client no longer inherits HTTP_PROXY and HTTPS_PROXY implicitly.
Bug Fixes
  • LibreOffice returned 400 for server-side failures (#​1588). 400 now requires an implicated client input, nativePageRanges, password, or an unreadable document; everything else is 500. Thanks @​ctunon-align.
  • generateDocumentOutline was a silent no-op (#​1579). It now enables generateTaggedPdf, which Chromium needs to build the outline. Thanks @​paradoxloop.
  • Pinning proxy latched after a Chromium start timeout. Starts are now serialized.
  • LibreOffice leaked a document after a failed export.unoconverter now releases it.
Chore
  • Updated Chromium to 151.0.7922.71.
  • Updated pdfcpu to v0.13.0.
  • Updated unoconverter to v0.4.0.
  • Bumped Go to 1.26.5.
  • Updated Go dependencies.
v8.34.0: 8.34.0
Compare Source
Security Fixes ⚠️
  • Block content linked from untrusted locations in LibreOffice. An uploaded document could reference external (http(s)://) or local (file:///…) resources that LibreOffice resolved during conversion, giving blind SSRF and a limited local-file read. The soffice profile now sets BlockUntrustedRefererLinks, so soffice refuses to load any content a document links. Embedded content is unaffected; documents relying on linked resources no longer render them.
New Features
  • Factur-X / ZUGFeRD metadata (#​1552). Conversions now inject the matching XMP metadata, and the API replaces the single facturx payload with dedicated form fields. Thanks @​fank.
  • Owner-only encryption and permissions. A new ownerPassword, independent of userPassword, plus permission controls restrict what a viewer may do without locking the document open.
  • log-std-level-case (#​1339). New flag to set the level field casing in standard output, lower (default) or upper. Thanks @​Jaben.
Observability
  • Trace enrichment. New process.exec client spans, supervisor queue-wait and launch sub-spans, a Chromium print_to_pdf sub-span, backing-binary versions (Chromium, LibreOffice, qpdf, …) recorded on spans and captured at build time, and per-conversion I/O, network, and size attributes on Chromium and LibreOffice spans.
  • Error classification. Chromium and LibreOffice failures set an error.type from a bounded enum.
  • Richer resource and metrics. Process, OS, host, and container resource detectors, semconv aligned to v1.41.0, a trace-based exemplar filter, and conversions-since-restart and queue-depth gauges.
Bug Fixes
  • CSV conversions leaked the upload's UUID filename as a page header (#​1568). Calc printed the sheet name, which was the UUID-based upload filename, as a centered page header. Now suppressed. Thanks @​vapranav.
  • Webhook async lost trace context. The async delivery goroutine detached from the request context and dropped the trace, breaking span continuity. It now preserves the context via context.WithoutCancel.
  • ca-certificates missing in the chromium-only image. Outbound TLS could fail in the chromium-only build. The package is now installed. Thanks @​osvein.
  • LibreOffice core-dump retries. Retries on ErrCoreDumped are now capped and observable, and the ErrRuntimeException message is corrected.
Chore
  • Updated Chromium to version 149.0.7827.102-1.
  • Updated Go dependencies.
v8.33.0: 8.33.0
Compare Source
Security Fixes ⚠️
  • Block IPv6 prefixes that tunnel to internal IPv4 in IsPublicIP.::ffff:10.0.0.1, 2002:c0a8:: (6to4), and 2001::/32 (Teredo) embed an internal IPv4 destination inside an IPv6 address. IsPublicIP evaluated only the outer IPv6 form, so --*-deny-private-ips filters let the embedded private IPv4 reach the dialer. The check now unwraps IPv4-mapped, IPv4-translated, 6to4, and Teredo addresses, and rejects them when the embedded IPv4 is non-public.
  • Strip backslash separators from supplied filenames. Linux treated a caller-supplied Gotenberg-Output-Filename header or filename form field containing ..\ or foo\bar as a single segment. The handler now strips both forward-slash and backslash path separators before composing the output path.
New Features
  • Device scale ratio for screenshots (#​1543). A new deviceScaleFactor form field on /forms/chromium/screenshot/{html,url,markdown} controls the screenshot pixel density. Defaults to 1. Thanks @​hovcharenko.
Bug Fixes
  • Pinning proxy outlived a failed Chromium start. When chromedp failed to start (port conflict, container OOM, sandbox denial), the loopback HTTP/CONNECT pinning proxy added in 8.32.0 stayed bound to its port and leaked across restart attempts. The browser now stops the pinning proxy on every start failure.
  • Lifecycle listener race on Navigate.chromedp.Navigate could fire Page.lifecycleEvent before Gotenberg's listener subscribed, so the converter occasionally waited the full network-idle timeout on otherwise fast pages. Listeners now register before navigation.
  • Supervisor flapped on transient CDP latency. A single slow CDP health probe marked the supervised process unhealthy and triggered a restart, even when the next probe succeeded. Probes now require N consecutive failures before reporting unhealthy.
  • downloadFrom concurrent map writes. Parallel downloadFrom entries merged results into a shared map without a lock. Under enough concurrency this raced and panicked the request goroutine. Result merging is now serialized.
  • Pinning-proxy noise on client cancellations.context canceled and connection reset by peer from the client side of the pinning proxy logged at error level, flooding logs whenever a caller aborted mid-render. Client-cancelled dial errors now log at debug.
Chore
  • Updated Chromium to version 148.0.7778.178-1.
  • Updated Go dependencies.
v8.32.0: 8.32.0
Compare Source
Security Fixes ⚠️
  • Reverted SSRF defaults (breaking vs 8.31.0). 8.31.0 blocked private-IP destinations by default, which broke deployments running Gotenberg inside a private network. 8.32.0 restores the 8.30.x permissive defaults. Operators with internet-facing APIs opt into the strict posture via the new flags below.
  • Rejected file:// at /forms/chromium/convert/url. Submitting url=file:///tmp/... used to let an unauthenticated caller enumerate the request working directory and read other in-flight uploads as rendered PDFs. The route now returns HTTP 400 for any file:// URL.
  • Required uploaded file for image / pdf stamp and watermark sources. Twelve callsites accepted stampSource=pdf or watermarkSource=pdf with an expression pointing at any path the Gotenberg process could open, even when no file was uploaded. Handlers now return HTTP 400 unless the caller uploaded a matching file.
  • Scoped file:// sub-resources to the request working directory. Crafted HTML could reference another request's file:///tmp/<reqdir>/.... The CDP request handler now restricts file:// sub-resources to the current request's directory. /convert/url and /screenshot/url reject every file:// sub-resource outright.
  • Hardened Chromium against DNS rebinding. A short-TTL DNS authority could return a public IP at validation and a private IP at connect. A loopback HTTP / CONNECT proxy now sits between Chromium and the network, resolves DNS once, and pins the dial to the resolved IP. Skipped when --chromium-proxy-server or --chromium-host-resolver-rules is set.
  • Filtered LibreOffice outbound fetches through a proxy. Uploaded OOXML, RTF, and ODF files can embed external URLs that LibreOffice's libcurl resolves below every Go-side SSRF filter. LibreOffice now routes every outbound fetch through an in-process forward proxy on the same gotenberg.DecideOutbound path Chromium and webhook delivery use. See the four new flags below.
  • Recovered webhook async panics. High-concurrency webhooks could panic the async goroutine and crash the whole process. The goroutine now snapshots the request context and recovers any future panic through the existing error path.
New Features
  • LibreOffice outbound URL filtering. Four flags mirror the Chromium and webhook layout: --libreoffice-allow-list, --libreoffice-deny-list, --libreoffice-deny-private-ips, --libreoffice-deny-public-ips. All default permissive.
  • IP-class filtering on four modules.chromium, webhook, api-download-from, and libreoffice each accept matching deny-private-ips and deny-public-ips flags. All default to false.
FlagWhat it does
--chromium-deny-private-ipsReject Chromium navigations and sub-resources resolving to a non-public IP.
--chromium-deny-public-ipsReject Chromium navigations and sub-resources resolving to a public IP.
--webhook-deny-private-ipsReject webhook URLs (success, error, events) resolving to a non-public IP.
--webhook-deny-public-ipsReject webhook URLs resolving to a public IP.
--api-download-from-deny-private-ipsReject downloadFrom URLs resolving to a non-public IP.
--api-download-from-deny-public-ipsReject downloadFrom URLs resolving to a public IP.
--libreoffice-deny-private-ipsReject LibreOffice outbound fetches resolving to a non-public IP.
--libreoffice-deny-public-ipsReject LibreOffice outbound fetches resolving to a public IP.
A URL matching --*-allow-list skips the IP-class check. A URL matching --*-deny-list is always rejected. Setting both deny-private-ips=true and deny-public-ips=true rejects every URL unless the allow-list matches.
Bug Fixes
  • Charts print as blank rectangles (#​1531, #​1532, #​1534, #​1535): chromedp v0.15.0 suspended the BeginFrame-driven callback dispatch loop under emulatedMediaType=print. requestAnimationFrame, ResizeObserver, IntersectionObserver, CSS transitionend, and CSS animationend all stopped firing. Pinning chromedp back to v0.14.2 restores native dispatch.
  • LibreOffice cached an unrecoverable first-start error (#​1538): A short --libreoffice-start-timeout timed out the first request, then every subsequent request returned the same cached error until the container restarted. The lazy-start path now retries on failure.
Chore
  • Updated pdfcpu to v0.12.0.
  • Switched metadata read/write to direct exiftool invocation. Removes the GPL-3.0 go-exiftool dependency.
  • Bumped Go to 1.26.2.
  • Updated Go dependencies.
Thanks
Thanks to @​Jalliuz (#​1527) for reporting the 8.31.0 sub-resource regression. @​notscottsmith (#​1531), @​spoltix (#​1532), @​rdelott-work (#​1534), and @​sillyas2010 (#​1535) narrowed down the chromedp print-mode regression. @​sillyas2010 also published the reproducer that pinned the bisect. @​JeremyReist2 (#​1536) flagged the go-exiftool GPL-3.0 license. @​doronbehar (#​1537) requested the pdfcpu upgrade. @​mlafon (#​1538) reported the LibreOffice supervisor cached-error bug.
v8.31.0: 8.31.0
Compare Source
Breaking Changes & Security Fixes ⚠️
  • Stopped publishing thecodingmachine/gotenberg images. Pull from gotenberg/gotenberg instead.
  • SSRF hardening (breaking). Resolves outbound URLs (Chromium asset fetches, webhook delivery, download-from) and rejects non-public addresses: loopback, RFC1918, link-local, unspecified, multicast, IPv6 unique-local, IPv4-mapped IPv6. Pins the dial to the validated IP to prevent DNS rebinding.
  • Defaulted webhook deny list (breaking).--webhook-deny-list now defaults to a regex blocking loopback, RFC1918, link-local, and IPv6 unique-local ranges. Override the flag to call internal hosts.
  • Sanitized ExifTool metadata (breaking for System: tags). Strips control characters and line breaks from /forms/pdfengines/metadata/write payloads. Drops System:-prefixed tags. Blocks argument smuggling and filesystem pseudo-tag abuse.
New Features
  • Embed files metadata. Adds embedsMetadata to every route accepting embeds (Chromium HTML/URL/Markdown, LibreOffice convert, PDF Engines merge/split/embed). Pass a JSON object keyed by filename with per-file fields (mimeType, relationship, etc.) - thanks @​Jean-Beru!
Bug Fixes
  • Pinned Chromium to v146 on ppc64le to work around an upstream regression.
Deprecated Flags
OldNew
--webhook-error-allow-list--webhook-allow-list
--webhook-error-deny-list--webhook-deny-list
Old flags still work.
Chore
  • Updated Go dependencies.
v8.30.1: 8.30.1
Compare Source
Another release, another bug fixes 🫥
Bug Fixes
v8.30.0: 8.30.0
Compare Source
New Features
Docker Image Variants
  • Chromium-Only Image (gotenberg/gotenberg:8.30.0-chromium): Drops LibreOffice, python3, and hyphenation packages. ~30% smaller than the full image.
  • LibreOffice-Only Image (gotenberg/gotenberg:8.30.0-libreoffice): Drops Chromium and its dependencies. ~38% smaller than the full image.
Pick the variant that matches your workload. The full image (gotenberg/gotenberg:8.30.0) still ships everything.
Leaner Docker Image
The full image is ~13% smaller than 8.29.0. The font stack was simplified from 30+ packages down to 8, covering Latin, Greek, Cyrillic, CJK, and most world scripts through Noto, plus color emoji.
PackageCoverage
fonts-noto-coreArabic, Bengali, Devanagari, Ethiopic, Georgian, Gujarati, Gurmukhi, Hebrew, Kannada, Khmer, Lao, Malayalam, Myanmar, Sinhala, Tamil, Telugu, Thai, and more
fonts-noto-cjkChinese, Japanese, Korean
fonts-noto-color-emojiColor emoji
fonts-dejavuLatin, Greek, Cyrillic
fonts-crosextra-carlitoMetric-compatible with Calibri
fonts-crosextra-caladeaMetric-compatible with Cambria
fonts-liberationMetric-compatible with Arial, Times New Roman, Courier New
fonts-liberation2Updated Liberation metrics
Microsoft Core Fonts (ttf-mscorefonts-installer) are not shipped due to licensing constraints. The image includes metric-compatible replacements instead: Carlito for Calibri, Caladea for Cambria, and Liberation for Arial, Times New Roman, and Courier New. These preserve document layout in most cases.
Installing Additional Fonts
Build a custom Dockerfile to add fonts. Common scenarios:
Microsoft Core Fonts (you accept the Microsoft EULA):
FROM gotenberg/gotenberg:8
USER root
RUN echo "deb http://deb.debian.org/debian trixie contrib non-free" \
> /etc/apt/sources.list.d/contrib.list \
&& echo "ttf-mscorefonts-installer msttcorefonts/accepted-mscorefonts-eula select true" \
| debconf-set-selections \
&& apt-get update -qq \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
ca-certificates \
wget \
ttf-mscorefonts-installer \
&& rm -rf /var/lib/apt/lists/*
USER gotenberg

Specialized script fonts for richer glyph sets, better hinting, or traditional typefaces beyond the basic Noto coverage:
ScriptPackage
Arabic (Naskh)fonts-hosny-amiri
Bengalifonts-beng
Devanagari (Hindi)fonts-sarai
Ethiopicfonts-sil-abyssinica
Gujaratifonts-samyak-gujr
Gurmukhi (Punjabi)fonts-lohit-guru
Hebrewculmus
Kannadafonts-lohit-knda
Malayalamfonts-samyak-mlym
Myanmarfonts-sil-padauk
Sinhalafonts-lklug-sinhala
Tamilfonts-samyak-taml
Telugufonts-telu
Thaifonts-thai-tlwg
FROM gotenberg/gotenberg:8
USER root
RUN apt-get update -qq \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
fonts-hosny-amiri \
fonts-thai-tlwg \
&& rm -rf /var/lib/apt/lists/*
USER gotenberg

Webhook
  • Gotenberg-Webhook-Error-Url Now Optional: When Gotenberg-Webhook-Events-Url is set, Gotenberg-Webhook-Error-Url is no longer required. Error handling flows through the events URL instead. Gotenberg-Webhook-Error-Url is deprecated but continues to work.
Bug Fixes
  • ExifTool Tag Filtering: Case-insensitive comparison and expanded blocklist for ExifTool metadata filtering. Excludes additional system tags while preserving safe derived tags.
  • Regex Timeout: Added timeout to regex evaluation to prevent ReDoS on malformed patterns.
Chore
  • Updated Go dependencies.
v8.29.1: 8.29.1
Compare Source
Bug Fix (Chromium)
Assets were no longer being correctly loaded in HTML files. This is now fixed. Thanks @​ARawles-GFSC for the heads up!
v8.29.0: 8.29.0
Compare Source
Security Fixes ⚠️
  • ExifTool Arbitrary File Write: The /forms/pdfengines/metadata/write endpoint allowed users to pass FileName and Directory pseudo-tags in the metadata JSON, enabling file rename/move to arbitrary paths. User-supplied metadata is now filtered through a blocklist before being passed to ExifTool.
  • Chromium file:// Sub-Resource Restriction: When converting HTML/Markdown via file://, sub-resources are now restricted to the request's working directory, preventing cross-request file access in /tmp.
New Features
OpenTelemetry
  • Full OpenTelemetry Support: Distributed tracing, metrics export, and structured logging: all configurable via standard OTEL environment variables (OTEL_TRACES_EXPORTER, OTEL_METRICS_EXPORTER, OTEL_LOGS_EXPORTER, OTEL_EXPORTER_OTLP_ENDPOINT, etc.). Every HTTP request gets a span. External tool calls (Chromium, LibreOffice, QPDF, pdfcpu, pdftk, ExifTool, webhook delivery, download-from) create child spans. Trace context is propagated to outbound HTTP calls via W3C headers.
  • Structured Logging Migration: Migrated from custom logging module to slog-based structured logging with OTEL log bridge. Supports auto/JSON/text formats with optional GCP-compatible field names.
  • Binary Path as Peer Service: server.address span attribute uses the actual binary path (e.g., /usr/bin/qpdf) instead of the software name.
  • Telemetry Control for System Routes: New flags to disable telemetry for noisy system routes, all defaulting to disabled: --api-disable-root-route-telemetry, --api-disable-debug-route-telemetry, --api-disable-version-route-telemetry, --prometheus-disable-route-telemetry. The existing --api-disable-health-check-route-telemetry default changed from false to true.
Chromium
  • Idle Shutdown: New --chromium-idle-shutdown-timeout flag (default: 0s, disabled) to automatically stop Chromium after a configurable idle period, reclaiming memory on low-traffic servers. The process re-launches lazily on the next request.
  • Network Almost Idle Event: New skipNetworkAlmostIdleEvent form field (default: true). When set to false, Gotenberg waits for a "network almost idle" event (at most 2 open connections for 500ms) before conversion. This provides a middle ground between the existing skipNetworkIdleEvent (strict, 0 connections) and no wait at all — useful for pages with long-polling or analytics connections that never fully close.
LibreOffice
  • PDF Viewer Preferences (#​1316): 15 new form fields for controlling PDF viewer behavior: initialView, initialPage, magnification, zoom, pageLayout, firstPageOnLeft, resizeWindowToInitialPage, centerWindow, openInFullScreenMode, displayPDFDocumentTitle, hideViewerMenubar, hideViewerToolbar, hideViewerWindowControls, useTransitionEffects, openBookmarkLevels.
  • Idle Shutdown: New --libreoffice-idle-shutdown-timeout flag (default: 0s, disabled), same behavior as Chromium.
Webhook
  • Event Callbacks (#​1473): New optional Gotenberg-Webhook-Events-Url header. When set, structured JSON events (webhook.success, webhook.error) are POSTed after each webhook operation, with correlationId and timestamp. Additive: existing Gotenberg-Webhook-Url and Gotenberg-Webhook-Error-Url continue to work unchanged.
Security & Networking
  • Multiple URL Patterns: All allow/deny list flags (--chromium-allow-list, --chromium-deny-list, --webhook-allow-list, --webhook-deny-list, --webhook-error-allow-list, --webhook-error-deny-list, --api-download-from-allow-list, --api-download-from-deny-list) now accept multiple regex patterns via string slices. Existing single-value configurations continue to work.
Bug Fixes
  • Chromium singlePage Margin Accounting (#​1046): The singlePage option now correctly accounts for top/bottom margins when calculating page height, fixing content overflow on tall pages.
  • Long Filename Support (#​1500): Files with long names (166+ chars, especially with multi-byte UTF-8) no longer cause "File name too long" errors. Files are now stored on disk with UUID-based names while preserving original filenames for HTTP responses, archive entries, and JSON keys.
Deprecated Flags
OldNew
--log-format--log-std-format
--log-enable-gcp-fields--log-std-enable-gcp-fields
--api-trace-header--api-correlation-id-header
--api-disable-health-check-logging--api-disable-health-check-route-telemetry
--prometheus-disable-route-logging--prometheus-disable-route-telemetry
All deprecated flags continue to work.
Chore
  • Replaced go.uber.org/multierr with stdlib errors.Join.
  • Added integration tests for Chromium screenshot routes (HTML, URL, Markdown).
  • Added long filename integration tests across all PDF engine and conversion routes.
  • Integration test retry mechanism: failed scenarios are automatically retried up to 3 times.
  • Bumped actions/checkout to v6 in all GitHub Actions.
Thanks
Thanks to @​dkrizic (#​814) and @​jbdelhommeau (#​1489) for requesting OpenTelemetry/tracing support, @​eht16 (#​1316), @​nh2 (#​1023), @​Frozen666 (#​1046), @​vofflan (#​1500), @​danxmoran (#​1394), and @​janaka (#​1473) for their issue reports and feature requests!
This release represents a significant amount of work: OpenTelemetry integration, security fixes, new features, and hundreds of integration tests. If Gotenberg is useful to you or your team, please consider sponsoring the project. Your support helps keep development going.
v8.28.0: 8.28.0
Compare Source
New Features
PDF Engines
  • Watermark: Added POST /forms/pdfengines/watermark route. Applies a watermark (behind page content) to one or more PDF files. Supports text, image, or pdf sources. Also available as optional form fields on Chromium, LibreOffice, merge, and split routes. Configurable via --pdfengines-watermark-engines (default: pdfcpu,pdftk).
  • Stamp: Added POST /forms/pdfengines/stamp route. Applies a stamp (on top of page content) to one or more PDF files. Same source types and integration points as watermark. Configurable via --pdfengines-stamp-engines (default: pdfcpu,pdftk).
  • Rotate: Added POST /forms/pdfengines/rotate route. Rotates pages by 90°, 180°, or 270° with optional page selection. Also available as optional form fields (rotateAngle, rotatePages) on all composite routes. Configurable via --pdfengines-rotate-engines (default: pdfcpu, pdftk).
  • Bookmarks (Read): Added POST /forms/pdfengines/bookmarks/read route. Returns the hierarchical bookmark outline from one or more PDF files as JSON. Configurable via --pdfengines-read-bookmarks-engines (default: pdfcpu).
  • Bookmarks (Write): Added POST /forms/pdfengines/bookmarks/write route. Accepts either a flat list (applied to all files) or a filename-keyed map. Configurable via --pdfengines-write-bookmarks-engines (default: pdfcpu, pdftk).
  • Merge Bookmark Management: The merge route now supports a bookmarks form field for custom bookmarks with automatic page-offset shifting, and an autoIndexBookmarks option to extract and reindex existing bookmarks from input files.
  • PDF/A & PDF/UA Compliance: Reordered the processing pipeline so that PDF/A and PDF/UA conversion runs after watermark, stamp, and flatten operations. Also reject incompatible combinations (e.g., PDF/A + encryption, PDF/A-1/2 + embeds) with a 400 Bad Request.
LibreOffice
  • Native Watermarks: Added support for LibreOffice's built-in watermark rendering during PDF export via new form fields: nativeWatermarkText, nativeWatermarkColor, nativeWatermarkFontHeight, nativeWatermarkRotateAngle, nativeWatermarkFontName, and nativeTiledWatermarkText.
API
  • Download From: Extended the downloadFrom JSON schema with a field property ("watermark", "stamp", "embedded", or "") to route downloaded files to the appropriate form field bucket. The existing embedded boolean is preserved for backward compatibility.
Chore
  • Updated Chromium to 146.0.7680.153-1.
  • Updated Go dependencies.
v8.27.0: 8.27.0
Compare Source
New Features
Chromium
  • Concurrency Support: Re-introduced support for simultaneous conversions (up to 6 by default). Configurable via CHROMIUM_MAX_CONCURRENCY. Thanks @​TomBrouws!
  • Restart Threshold: Updated the default value for CHROMIUM_RESTART_AFTER to 100.
  • Emulated Media Features: Added the emulatedMediaFeatures form field. This allows users to pass a JSON array to simulate specific CSS media features, such as prefers-color-scheme: dark or prefers-reduced-motion. Thanks @​danxmoran!
Misc
  • Timezone: The default timezone is now explicitly UTC and is visible in the debug route. This remains overridable via th
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
enabled auto-merge (rebase)
September 4, 2023 17:16
@renovaterenovateBot
changed the title
Update actions/checkout action to v4Update actions/checkout action to v4 - autoclosedOct 17, 2023
@renovaterenovateBot
closed this
Oct 17, 2023

auto-merge was automatically disabled
October 17, 2023 18:45
Pull request was closed
@renovate
renovateBot
deleted the

renovate/major-all

branch
October 17, 2023 18:45
@renovaterenovateBot
changed the title
Update actions/checkout action to v4 - autoclosedUpdate actions/checkout action to v4Oct 19, 2023
@renovaterenovateBot
reopened this
Oct 19, 2023
@renovate
renovateBot
restored the

renovate/major-all

branch
October 19, 2023 10:11
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
60d859a to
9658d5dCompareOctober 19, 2023 10:11
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
9658d5d to
62a0b2dCompareJanuary 4, 2024 19:38
@renovaterenovateBot
changed the title
Update actions/checkout action to v4Update all (major)Jan 4, 2024
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
62a0b2d to
9498f21CompareJanuary 8, 2024 17:51
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
9498f21 to
c86f4b8CompareJanuary 18, 2024 14:17
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c86f4b8 to
63de7e6CompareFebruary 7, 2024 15:34
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
ea1d0ec to
8732cdaCompareFebruary 24, 2024 00:57
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
8732cda to
de378adCompareMarch 4, 2024 13:39
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
de378ad to
c176512CompareMarch 15, 2024 19:50
@renovate
renovateBot
enabled auto-merge (rebase)
March 20, 2024 12:18
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c176512 to
4062b81CompareMarch 23, 2024 22:39
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
4062b81 to
5f3ebaeCompareApril 11, 2024 15:26
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
5f3ebae to
0e2d0c7CompareApril 25, 2024 17:30
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
0e2d0c7 to
6bdb4d1CompareMay 22, 2024 11:12
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
6bdb4d1 to
c59cebcCompareJune 4, 2024 18:24
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c59cebc to
6db7d48CompareJune 13, 2024 11:36
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
6db7d48 to
3d6a8f6CompareJuly 3, 2024 19:48
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
3d6a8f6 to
6cbd611CompareJuly 18, 2024 15:25
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
6cbd611 to
9fca9f2CompareJuly 29, 2024 12:37
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
9fca9f2 to
ba5e9a2CompareAugust 11, 2024 15:34
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
ba5e9a2 to
fcbc913CompareSeptember 3, 2024 13:59
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
dbb0041 to
0bd35c8CompareJanuary 30, 2025 01:28
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
9298586 to
03a3172CompareFebruary 12, 2025 19:14
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
9f5c0c3 to
cc92ec4CompareMarch 6, 2025 10:32
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
cc92ec4 to
5c38fa1CompareMarch 17, 2025 17:33
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
9f81659 to
948c2cdCompareApril 2, 2025 14:08
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
8f953be to
42d11a4CompareApril 12, 2025 21:37
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
42d11a4 to
96dc4a9CompareMay 21, 2025 17:27
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
96dc4a9 to
5139460CompareJune 15, 2025 18:36
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
5139460 to
139894cCompareAugust 11, 2025 15:05
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
139894c to
c9514e1CompareAugust 19, 2025 09:26
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c9514e1 to
8258850CompareAugust 31, 2025 17:57
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
4e91d49 to
c92558bCompareOctober 9, 2025 13:32
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
ae4c8d0 to
63e70feCompareNovember 20, 2025 20:54
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
63e70fe to
0588cc6CompareDecember 4, 2025 10:31
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
0588cc6 to
1d473f0CompareJanuary 27, 2026 15:13
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
1d473f0 to
62ee86aCompareFebruary 22, 2026 21:51
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
62ee86a to
cc4d29fCompareMarch 20, 2026 16:56
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
5cf217d to
84667efCompareMarch 30, 2026 20:34
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
e36f3c9 to
80be1f4CompareApril 6, 2026 17:52
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
80be1f4 to
4081637CompareApril 17, 2026 15:13
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Update all (major) - #114
Open
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/major-all
Open
Update all (major)#114
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/major-all
Conversation
@renovate
@renovaterenovateBot
commented
Sep 4, 2023•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageTypeUpdateChange
actions/checkoutactionmajorv3 → v7
gotenberg/gotenbergmajor7.8.2 → 8.36.0
Release Notes
actions/checkout (actions/checkout)
v7.0.1
Compare Source
v7.0.0
Compare Source
v7
Compare Source
v6.1.0
Compare Source
v6.0.3
Compare Source
v6.0.2
Compare Source
v6.0.1
Compare Source
v6.0.0
Compare Source
v6
Compare Source
v5.1.0
Compare Source
v5.0.1
Compare Source
v5.0.0
Compare Source
v5
Compare Source
v4.4.0
Compare Source
v4.3.1
Compare Source
v4.3.0
Compare Source
v4.2.2
Compare Source
v4.2.1
Compare Source
v4.2.0
Compare Source
v4.1.7
Compare Source
v4.1.6
Compare Source
v4.1.5
Compare Source
v4.1.4
Compare Source
v4.1.3
Compare Source
v4.1.2
Compare Source
  • Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in #​1598
v4.1.1
Compare Source
v4.1.0
Compare Source
v4.0.0
Compare Source
v4
Compare Source
gotenberg/gotenberg (gotenberg/gotenberg)
v8.36.0: 8.36.0
Compare Source
Security Fixes ⚠️
  • Filter WebSocket handshakes against the outbound policy. Chromium could open WebSocket connections to hosts the SSRF policy otherwise blocks.
New Features
  • OIDC bearer token authentication. Opt-in via --api-enable-oidc-auth, mutually exclusive with basic auth (#​1341). Thanks @​mlgupta.
  • Optimize PDF images to reduce file size (#​359). A /forms/pdfengines/optimize route, plus an optimizeImages option on the Chromium, LibreOffice, merge, and split routes. Thanks @​spointecker.
  • Apply multiple stamps and watermarks in one request by repeating the fields, on every route that supports them (#​1601). Thanks @​Kobe-Kwanten.
  • Screenshot a single element via the selector form field (#​947). Thanks @​human211.
  • Table-of-contents bookmarks when merging.titleBookmarks adds one bookmark per input, labeled by its title (#​867). Thanks @​gnapse.
  • Clear storage between conversions with --chromium-clear-storage (#​919). Thanks @​befresh-mweimerskirch.
  • Await async waitForExpression. A Promise-returning expression is now awaited (#​1617). Thanks @​nhh.
Bug Fixes
  • Landscape single-page now fits the page to its content (#​1390). Thanks @​JhnBer.
  • Accept the OOXML PowerPoint show extensions.ppsx and .ppsm (#​1626). Thanks @​lyarov22.
  • Client-cancelled requests are classified as 499, not 500 (#​1627). Thanks @​yngvar.
  • Render scrolled workbooks in full for singlePageSheets.
  • Return 403 instead of 500 for an unresolvable outbound host.
  • Hint at --chromium-start-timeout when Chromium fails to start.
Chore
  • Updated pdfcpu to v0.15.0 (#​1628). Thanks @​doronbehar.
  • Bumped golangci-lint to v2.12.2.
  • Updated Go and npm dependencies.
v8.35.0: 8.35.0
Compare Source
Security Fixes ⚠️
  • Sanitize the Gotenberg-Output-Filename header.filepath.Base ignores \ on Linux, so a crafted header reached archive entry names on splitMode conversions, giving a Windows-side Zip Slip.
  • Bound scope matching per conversion. The extraHttpHeaders match timeout capped one match, not their number. Matching now shares a per-conversion budget, and extraHttpHeaders accepts at most 64 headers with a 1024-character scope.
New Features
  • Authenticated proxy from environment variables. Four opt-in flags route outbound traffic through HTTP_PROXY, HTTPS_PROXY, and NO_PROXY, credentials included: --chromium-enable-environment-proxy, --libreoffice-enable-environment-proxy, --api-download-from-enable-environment-proxy, and --webhook-enable-environment-proxy. All default to false. Breaking: the outbound client no longer inherits HTTP_PROXY and HTTPS_PROXY implicitly.
Bug Fixes
  • LibreOffice returned 400 for server-side failures (#​1588). 400 now requires an implicated client input, nativePageRanges, password, or an unreadable document; everything else is 500. Thanks @​ctunon-align.
  • generateDocumentOutline was a silent no-op (#​1579). It now enables generateTaggedPdf, which Chromium needs to build the outline. Thanks @​paradoxloop.
  • Pinning proxy latched after a Chromium start timeout. Starts are now serialized.
  • LibreOffice leaked a document after a failed export.unoconverter now releases it.
Chore
  • Updated Chromium to 151.0.7922.71.
  • Updated pdfcpu to v0.13.0.
  • Updated unoconverter to v0.4.0.
  • Bumped Go to 1.26.5.
  • Updated Go dependencies.
v8.34.0: 8.34.0
Compare Source
Security Fixes ⚠️
  • Block content linked from untrusted locations in LibreOffice. An uploaded document could reference external (http(s)://) or local (file:///…) resources that LibreOffice resolved during conversion, giving blind SSRF and a limited local-file read. The soffice profile now sets BlockUntrustedRefererLinks, so soffice refuses to load any content a document links. Embedded content is unaffected; documents relying on linked resources no longer render them.
New Features
  • Factur-X / ZUGFeRD metadata (#​1552). Conversions now inject the matching XMP metadata, and the API replaces the single facturx payload with dedicated form fields. Thanks @​fank.
  • Owner-only encryption and permissions. A new ownerPassword, independent of userPassword, plus permission controls restrict what a viewer may do without locking the document open.
  • log-std-level-case (#​1339). New flag to set the level field casing in standard output, lower (default) or upper. Thanks @​Jaben.
Observability
  • Trace enrichment. New process.exec client spans, supervisor queue-wait and launch sub-spans, a Chromium print_to_pdf sub-span, backing-binary versions (Chromium, LibreOffice, qpdf, …) recorded on spans and captured at build time, and per-conversion I/O, network, and size attributes on Chromium and LibreOffice spans.
  • Error classification. Chromium and LibreOffice failures set an error.type from a bounded enum.
  • Richer resource and metrics. Process, OS, host, and container resource detectors, semconv aligned to v1.41.0, a trace-based exemplar filter, and conversions-since-restart and queue-depth gauges.
Bug Fixes
  • CSV conversions leaked the upload's UUID filename as a page header (#​1568). Calc printed the sheet name, which was the UUID-based upload filename, as a centered page header. Now suppressed. Thanks @​vapranav.
  • Webhook async lost trace context. The async delivery goroutine detached from the request context and dropped the trace, breaking span continuity. It now preserves the context via context.WithoutCancel.
  • ca-certificates missing in the chromium-only image. Outbound TLS could fail in the chromium-only build. The package is now installed. Thanks @​osvein.
  • LibreOffice core-dump retries. Retries on ErrCoreDumped are now capped and observable, and the ErrRuntimeException message is corrected.
Chore
  • Updated Chromium to version 149.0.7827.102-1.
  • Updated Go dependencies.
v8.33.0: 8.33.0
Compare Source
Security Fixes ⚠️
  • Block IPv6 prefixes that tunnel to internal IPv4 in IsPublicIP.::ffff:10.0.0.1, 2002:c0a8:: (6to4), and 2001::/32 (Teredo) embed an internal IPv4 destination inside an IPv6 address. IsPublicIP evaluated only the outer IPv6 form, so --*-deny-private-ips filters let the embedded private IPv4 reach the dialer. The check now unwraps IPv4-mapped, IPv4-translated, 6to4, and Teredo addresses, and rejects them when the embedded IPv4 is non-public.
  • Strip backslash separators from supplied filenames. Linux treated a caller-supplied Gotenberg-Output-Filename header or filename form field containing ..\ or foo\bar as a single segment. The handler now strips both forward-slash and backslash path separators before composing the output path.
New Features
  • Device scale ratio for screenshots (#​1543). A new deviceScaleFactor form field on /forms/chromium/screenshot/{html,url,markdown} controls the screenshot pixel density. Defaults to 1. Thanks @​hovcharenko.
Bug Fixes
  • Pinning proxy outlived a failed Chromium start. When chromedp failed to start (port conflict, container OOM, sandbox denial), the loopback HTTP/CONNECT pinning proxy added in 8.32.0 stayed bound to its port and leaked across restart attempts. The browser now stops the pinning proxy on every start failure.
  • Lifecycle listener race on Navigate.chromedp.Navigate could fire Page.lifecycleEvent before Gotenberg's listener subscribed, so the converter occasionally waited the full network-idle timeout on otherwise fast pages. Listeners now register before navigation.
  • Supervisor flapped on transient CDP latency. A single slow CDP health probe marked the supervised process unhealthy and triggered a restart, even when the next probe succeeded. Probes now require N consecutive failures before reporting unhealthy.
  • downloadFrom concurrent map writes. Parallel downloadFrom entries merged results into a shared map without a lock. Under enough concurrency this raced and panicked the request goroutine. Result merging is now serialized.
  • Pinning-proxy noise on client cancellations.context canceled and connection reset by peer from the client side of the pinning proxy logged at error level, flooding logs whenever a caller aborted mid-render. Client-cancelled dial errors now log at debug.
Chore
  • Updated Chromium to version 148.0.7778.178-1.
  • Updated Go dependencies.
v8.32.0: 8.32.0
Compare Source
Security Fixes ⚠️
  • Reverted SSRF defaults (breaking vs 8.31.0). 8.31.0 blocked private-IP destinations by default, which broke deployments running Gotenberg inside a private network. 8.32.0 restores the 8.30.x permissive defaults. Operators with internet-facing APIs opt into the strict posture via the new flags below.
  • Rejected file:// at /forms/chromium/convert/url. Submitting url=file:///tmp/... used to let an unauthenticated caller enumerate the request working directory and read other in-flight uploads as rendered PDFs. The route now returns HTTP 400 for any file:// URL.
  • Required uploaded file for image / pdf stamp and watermark sources. Twelve callsites accepted stampSource=pdf or watermarkSource=pdf with an expression pointing at any path the Gotenberg process could open, even when no file was uploaded. Handlers now return HTTP 400 unless the caller uploaded a matching file.
  • Scoped file:// sub-resources to the request working directory. Crafted HTML could reference another request's file:///tmp/<reqdir>/.... The CDP request handler now restricts file:// sub-resources to the current request's directory. /convert/url and /screenshot/url reject every file:// sub-resource outright.
  • Hardened Chromium against DNS rebinding. A short-TTL DNS authority could return a public IP at validation and a private IP at connect. A loopback HTTP / CONNECT proxy now sits between Chromium and the network, resolves DNS once, and pins the dial to the resolved IP. Skipped when --chromium-proxy-server or --chromium-host-resolver-rules is set.
  • Filtered LibreOffice outbound fetches through a proxy. Uploaded OOXML, RTF, and ODF files can embed external URLs that LibreOffice's libcurl resolves below every Go-side SSRF filter. LibreOffice now routes every outbound fetch through an in-process forward proxy on the same gotenberg.DecideOutbound path Chromium and webhook delivery use. See the four new flags below.
  • Recovered webhook async panics. High-concurrency webhooks could panic the async goroutine and crash the whole process. The goroutine now snapshots the request context and recovers any future panic through the existing error path.
New Features
  • LibreOffice outbound URL filtering. Four flags mirror the Chromium and webhook layout: --libreoffice-allow-list, --libreoffice-deny-list, --libreoffice-deny-private-ips, --libreoffice-deny-public-ips. All default permissive.
  • IP-class filtering on four modules.chromium, webhook, api-download-from, and libreoffice each accept matching deny-private-ips and deny-public-ips flags. All default to false.
FlagWhat it does
--chromium-deny-private-ipsReject Chromium navigations and sub-resources resolving to a non-public IP.
--chromium-deny-public-ipsReject Chromium navigations and sub-resources resolving to a public IP.
--webhook-deny-private-ipsReject webhook URLs (success, error, events) resolving to a non-public IP.
--webhook-deny-public-ipsReject webhook URLs resolving to a public IP.
--api-download-from-deny-private-ipsReject downloadFrom URLs resolving to a non-public IP.
--api-download-from-deny-public-ipsReject downloadFrom URLs resolving to a public IP.
--libreoffice-deny-private-ipsReject LibreOffice outbound fetches resolving to a non-public IP.
--libreoffice-deny-public-ipsReject LibreOffice outbound fetches resolving to a public IP.
A URL matching --*-allow-list skips the IP-class check. A URL matching --*-deny-list is always rejected. Setting both deny-private-ips=true and deny-public-ips=true rejects every URL unless the allow-list matches.
Bug Fixes
  • Charts print as blank rectangles (#​1531, #​1532, #​1534, #​1535): chromedp v0.15.0 suspended the BeginFrame-driven callback dispatch loop under emulatedMediaType=print. requestAnimationFrame, ResizeObserver, IntersectionObserver, CSS transitionend, and CSS animationend all stopped firing. Pinning chromedp back to v0.14.2 restores native dispatch.
  • LibreOffice cached an unrecoverable first-start error (#​1538): A short --libreoffice-start-timeout timed out the first request, then every subsequent request returned the same cached error until the container restarted. The lazy-start path now retries on failure.
Chore
  • Updated pdfcpu to v0.12.0.
  • Switched metadata read/write to direct exiftool invocation. Removes the GPL-3.0 go-exiftool dependency.
  • Bumped Go to 1.26.2.
  • Updated Go dependencies.
Thanks
Thanks to @​Jalliuz (#​1527) for reporting the 8.31.0 sub-resource regression. @​notscottsmith (#​1531), @​spoltix (#​1532), @​rdelott-work (#​1534), and @​sillyas2010 (#​1535) narrowed down the chromedp print-mode regression. @​sillyas2010 also published the reproducer that pinned the bisect. @​JeremyReist2 (#​1536) flagged the go-exiftool GPL-3.0 license. @​doronbehar (#​1537) requested the pdfcpu upgrade. @​mlafon (#​1538) reported the LibreOffice supervisor cached-error bug.
v8.31.0: 8.31.0
Compare Source
Breaking Changes & Security Fixes ⚠️
  • Stopped publishing thecodingmachine/gotenberg images. Pull from gotenberg/gotenberg instead.
  • SSRF hardening (breaking). Resolves outbound URLs (Chromium asset fetches, webhook delivery, download-from) and rejects non-public addresses: loopback, RFC1918, link-local, unspecified, multicast, IPv6 unique-local, IPv4-mapped IPv6. Pins the dial to the validated IP to prevent DNS rebinding.
  • Defaulted webhook deny list (breaking).--webhook-deny-list now defaults to a regex blocking loopback, RFC1918, link-local, and IPv6 unique-local ranges. Override the flag to call internal hosts.
  • Sanitized ExifTool metadata (breaking for System: tags). Strips control characters and line breaks from /forms/pdfengines/metadata/write payloads. Drops System:-prefixed tags. Blocks argument smuggling and filesystem pseudo-tag abuse.
New Features
  • Embed files metadata. Adds embedsMetadata to every route accepting embeds (Chromium HTML/URL/Markdown, LibreOffice convert, PDF Engines merge/split/embed). Pass a JSON object keyed by filename with per-file fields (mimeType, relationship, etc.) - thanks @​Jean-Beru!
Bug Fixes
  • Pinned Chromium to v146 on ppc64le to work around an upstream regression.
Deprecated Flags
OldNew
--webhook-error-allow-list--webhook-allow-list
--webhook-error-deny-list--webhook-deny-list
Old flags still work.
Chore
  • Updated Go dependencies.
v8.30.1: 8.30.1
Compare Source
Another release, another bug fixes 🫥
Bug Fixes
v8.30.0: 8.30.0
Compare Source
New Features
Docker Image Variants
  • Chromium-Only Image (gotenberg/gotenberg:8.30.0-chromium): Drops LibreOffice, python3, and hyphenation packages. ~30% smaller than the full image.
  • LibreOffice-Only Image (gotenberg/gotenberg:8.30.0-libreoffice): Drops Chromium and its dependencies. ~38% smaller than the full image.
Pick the variant that matches your workload. The full image (gotenberg/gotenberg:8.30.0) still ships everything.
Leaner Docker Image
The full image is ~13% smaller than 8.29.0. The font stack was simplified from 30+ packages down to 8, covering Latin, Greek, Cyrillic, CJK, and most world scripts through Noto, plus color emoji.
PackageCoverage
fonts-noto-coreArabic, Bengali, Devanagari, Ethiopic, Georgian, Gujarati, Gurmukhi, Hebrew, Kannada, Khmer, Lao, Malayalam, Myanmar, Sinhala, Tamil, Telugu, Thai, and more
fonts-noto-cjkChinese, Japanese, Korean
fonts-noto-color-emojiColor emoji
fonts-dejavuLatin, Greek, Cyrillic
fonts-crosextra-carlitoMetric-compatible with Calibri
fonts-crosextra-caladeaMetric-compatible with Cambria
fonts-liberationMetric-compatible with Arial, Times New Roman, Courier New
fonts-liberation2Updated Liberation metrics
Microsoft Core Fonts (ttf-mscorefonts-installer) are not shipped due to licensing constraints. The image includes metric-compatible replacements instead: Carlito for Calibri, Caladea for Cambria, and Liberation for Arial, Times New Roman, and Courier New. These preserve document layout in most cases.
Installing Additional Fonts
Build a custom Dockerfile to add fonts. Common scenarios:
Microsoft Core Fonts (you accept the Microsoft EULA):
FROM gotenberg/gotenberg:8
USER root
RUN echo "deb http://deb.debian.org/debian trixie contrib non-free" \
> /etc/apt/sources.list.d/contrib.list \
&& echo "ttf-mscorefonts-installer msttcorefonts/accepted-mscorefonts-eula select true" \
| debconf-set-selections \
&& apt-get update -qq \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
ca-certificates \
wget \
ttf-mscorefonts-installer \
&& rm -rf /var/lib/apt/lists/*
USER gotenberg

Specialized script fonts for richer glyph sets, better hinting, or traditional typefaces beyond the basic Noto coverage:
ScriptPackage
Arabic (Naskh)fonts-hosny-amiri
Bengalifonts-beng
Devanagari (Hindi)fonts-sarai
Ethiopicfonts-sil-abyssinica
Gujaratifonts-samyak-gujr
Gurmukhi (Punjabi)fonts-lohit-guru
Hebrewculmus
Kannadafonts-lohit-knda
Malayalamfonts-samyak-mlym
Myanmarfonts-sil-padauk
Sinhalafonts-lklug-sinhala
Tamilfonts-samyak-taml
Telugufonts-telu
Thaifonts-thai-tlwg
FROM gotenberg/gotenberg:8
USER root
RUN apt-get update -qq \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
fonts-hosny-amiri \
fonts-thai-tlwg \
&& rm -rf /var/lib/apt/lists/*
USER gotenberg

Webhook
  • Gotenberg-Webhook-Error-Url Now Optional: When Gotenberg-Webhook-Events-Url is set, Gotenberg-Webhook-Error-Url is no longer required. Error handling flows through the events URL instead. Gotenberg-Webhook-Error-Url is deprecated but continues to work.
Bug Fixes
  • ExifTool Tag Filtering: Case-insensitive comparison and expanded blocklist for ExifTool metadata filtering. Excludes additional system tags while preserving safe derived tags.
  • Regex Timeout: Added timeout to regex evaluation to prevent ReDoS on malformed patterns.
Chore
  • Updated Go dependencies.
v8.29.1: 8.29.1
Compare Source
Bug Fix (Chromium)
Assets were no longer being correctly loaded in HTML files. This is now fixed. Thanks @​ARawles-GFSC for the heads up!
v8.29.0: 8.29.0
Compare Source
Security Fixes ⚠️
  • ExifTool Arbitrary File Write: The /forms/pdfengines/metadata/write endpoint allowed users to pass FileName and Directory pseudo-tags in the metadata JSON, enabling file rename/move to arbitrary paths. User-supplied metadata is now filtered through a blocklist before being passed to ExifTool.
  • Chromium file:// Sub-Resource Restriction: When converting HTML/Markdown via file://, sub-resources are now restricted to the request's working directory, preventing cross-request file access in /tmp.
New Features
OpenTelemetry
  • Full OpenTelemetry Support: Distributed tracing, metrics export, and structured logging: all configurable via standard OTEL environment variables (OTEL_TRACES_EXPORTER, OTEL_METRICS_EXPORTER, OTEL_LOGS_EXPORTER, OTEL_EXPORTER_OTLP_ENDPOINT, etc.). Every HTTP request gets a span. External tool calls (Chromium, LibreOffice, QPDF, pdfcpu, pdftk, ExifTool, webhook delivery, download-from) create child spans. Trace context is propagated to outbound HTTP calls via W3C headers.
  • Structured Logging Migration: Migrated from custom logging module to slog-based structured logging with OTEL log bridge. Supports auto/JSON/text formats with optional GCP-compatible field names.
  • Binary Path as Peer Service: server.address span attribute uses the actual binary path (e.g., /usr/bin/qpdf) instead of the software name.
  • Telemetry Control for System Routes: New flags to disable telemetry for noisy system routes, all defaulting to disabled: --api-disable-root-route-telemetry, --api-disable-debug-route-telemetry, --api-disable-version-route-telemetry, --prometheus-disable-route-telemetry. The existing --api-disable-health-check-route-telemetry default changed from false to true.
Chromium
  • Idle Shutdown: New --chromium-idle-shutdown-timeout flag (default: 0s, disabled) to automatically stop Chromium after a configurable idle period, reclaiming memory on low-traffic servers. The process re-launches lazily on the next request.
  • Network Almost Idle Event: New skipNetworkAlmostIdleEvent form field (default: true). When set to false, Gotenberg waits for a "network almost idle" event (at most 2 open connections for 500ms) before conversion. This provides a middle ground between the existing skipNetworkIdleEvent (strict, 0 connections) and no wait at all — useful for pages with long-polling or analytics connections that never fully close.
LibreOffice
  • PDF Viewer Preferences (#​1316): 15 new form fields for controlling PDF viewer behavior: initialView, initialPage, magnification, zoom, pageLayout, firstPageOnLeft, resizeWindowToInitialPage, centerWindow, openInFullScreenMode, displayPDFDocumentTitle, hideViewerMenubar, hideViewerToolbar, hideViewerWindowControls, useTransitionEffects, openBookmarkLevels.
  • Idle Shutdown: New --libreoffice-idle-shutdown-timeout flag (default: 0s, disabled), same behavior as Chromium.
Webhook
  • Event Callbacks (#​1473): New optional Gotenberg-Webhook-Events-Url header. When set, structured JSON events (webhook.success, webhook.error) are POSTed after each webhook operation, with correlationId and timestamp. Additive: existing Gotenberg-Webhook-Url and Gotenberg-Webhook-Error-Url continue to work unchanged.
Security & Networking
  • Multiple URL Patterns: All allow/deny list flags (--chromium-allow-list, --chromium-deny-list, --webhook-allow-list, --webhook-deny-list, --webhook-error-allow-list, --webhook-error-deny-list, --api-download-from-allow-list, --api-download-from-deny-list) now accept multiple regex patterns via string slices. Existing single-value configurations continue to work.
Bug Fixes
  • Chromium singlePage Margin Accounting (#​1046): The singlePage option now correctly accounts for top/bottom margins when calculating page height, fixing content overflow on tall pages.
  • Long Filename Support (#​1500): Files with long names (166+ chars, especially with multi-byte UTF-8) no longer cause "File name too long" errors. Files are now stored on disk with UUID-based names while preserving original filenames for HTTP responses, archive entries, and JSON keys.
Deprecated Flags
OldNew
--log-format--log-std-format
--log-enable-gcp-fields--log-std-enable-gcp-fields
--api-trace-header--api-correlation-id-header
--api-disable-health-check-logging--api-disable-health-check-route-telemetry
--prometheus-disable-route-logging--prometheus-disable-route-telemetry
All deprecated flags continue to work.
Chore
  • Replaced go.uber.org/multierr with stdlib errors.Join.
  • Added integration tests for Chromium screenshot routes (HTML, URL, Markdown).
  • Added long filename integration tests across all PDF engine and conversion routes.
  • Integration test retry mechanism: failed scenarios are automatically retried up to 3 times.
  • Bumped actions/checkout to v6 in all GitHub Actions.
Thanks
Thanks to @​dkrizic (#​814) and @​jbdelhommeau (#​1489) for requesting OpenTelemetry/tracing support, @​eht16 (#​1316), @​nh2 (#​1023), @​Frozen666 (#​1046), @​vofflan (#​1500), @​danxmoran (#​1394), and @​janaka (#​1473) for their issue reports and feature requests!
This release represents a significant amount of work: OpenTelemetry integration, security fixes, new features, and hundreds of integration tests. If Gotenberg is useful to you or your team, please consider sponsoring the project. Your support helps keep development going.
v8.28.0: 8.28.0
Compare Source
New Features
PDF Engines
  • Watermark: Added POST /forms/pdfengines/watermark route. Applies a watermark (behind page content) to one or more PDF files. Supports text, image, or pdf sources. Also available as optional form fields on Chromium, LibreOffice, merge, and split routes. Configurable via --pdfengines-watermark-engines (default: pdfcpu,pdftk).
  • Stamp: Added POST /forms/pdfengines/stamp route. Applies a stamp (on top of page content) to one or more PDF files. Same source types and integration points as watermark. Configurable via --pdfengines-stamp-engines (default: pdfcpu,pdftk).
  • Rotate: Added POST /forms/pdfengines/rotate route. Rotates pages by 90°, 180°, or 270° with optional page selection. Also available as optional form fields (rotateAngle, rotatePages) on all composite routes. Configurable via --pdfengines-rotate-engines (default: pdfcpu, pdftk).
  • Bookmarks (Read): Added POST /forms/pdfengines/bookmarks/read route. Returns the hierarchical bookmark outline from one or more PDF files as JSON. Configurable via --pdfengines-read-bookmarks-engines (default: pdfcpu).
  • Bookmarks (Write): Added POST /forms/pdfengines/bookmarks/write route. Accepts either a flat list (applied to all files) or a filename-keyed map. Configurable via --pdfengines-write-bookmarks-engines (default: pdfcpu, pdftk).
  • Merge Bookmark Management: The merge route now supports a bookmarks form field for custom bookmarks with automatic page-offset shifting, and an autoIndexBookmarks option to extract and reindex existing bookmarks from input files.
  • PDF/A & PDF/UA Compliance: Reordered the processing pipeline so that PDF/A and PDF/UA conversion runs after watermark, stamp, and flatten operations. Also reject incompatible combinations (e.g., PDF/A + encryption, PDF/A-1/2 + embeds) with a 400 Bad Request.
LibreOffice
  • Native Watermarks: Added support for LibreOffice's built-in watermark rendering during PDF export via new form fields: nativeWatermarkText, nativeWatermarkColor, nativeWatermarkFontHeight, nativeWatermarkRotateAngle, nativeWatermarkFontName, and nativeTiledWatermarkText.
API
  • Download From: Extended the downloadFrom JSON schema with a field property ("watermark", "stamp", "embedded", or "") to route downloaded files to the appropriate form field bucket. The existing embedded boolean is preserved for backward compatibility.
Chore
  • Updated Chromium to 146.0.7680.153-1.
  • Updated Go dependencies.
v8.27.0: 8.27.0
Compare Source
New Features
Chromium
  • Concurrency Support: Re-introduced support for simultaneous conversions (up to 6 by default). Configurable via CHROMIUM_MAX_CONCURRENCY. Thanks @​TomBrouws!
  • Restart Threshold: Updated the default value for CHROMIUM_RESTART_AFTER to 100.
  • Emulated Media Features: Added the emulatedMediaFeatures form field. This allows users to pass a JSON array to simulate specific CSS media features, such as prefers-color-scheme: dark or prefers-reduced-motion. Thanks @​danxmoran!
Misc
  • Timezone: The default timezone is now explicitly UTC and is visible in the debug route. This remains overridable via th
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
enabled auto-merge (rebase)
September 4, 2023 17:16
@renovaterenovateBot
changed the title
Update actions/checkout action to v4Update actions/checkout action to v4 - autoclosedOct 17, 2023
@renovaterenovateBot
closed this
Oct 17, 2023

auto-merge was automatically disabled
October 17, 2023 18:45
Pull request was closed
@renovate
renovateBot
deleted the

renovate/major-all

branch
October 17, 2023 18:45
@renovaterenovateBot
changed the title
Update actions/checkout action to v4 - autoclosedUpdate actions/checkout action to v4Oct 19, 2023
@renovaterenovateBot
reopened this
Oct 19, 2023
@renovate
renovateBot
restored the

renovate/major-all

branch
October 19, 2023 10:11
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
60d859a to
9658d5dCompareOctober 19, 2023 10:11
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
9658d5d to
62a0b2dCompareJanuary 4, 2024 19:38
@renovaterenovateBot
changed the title
Update actions/checkout action to v4Update all (major)Jan 4, 2024
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
62a0b2d to
9498f21CompareJanuary 8, 2024 17:51
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
9498f21 to
c86f4b8CompareJanuary 18, 2024 14:17
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c86f4b8 to
63de7e6CompareFebruary 7, 2024 15:34
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
ea1d0ec to
8732cdaCompareFebruary 24, 2024 00:57
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
8732cda to
de378adCompareMarch 4, 2024 13:39
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
de378ad to
c176512CompareMarch 15, 2024 19:50
@renovate
renovateBot
enabled auto-merge (rebase)
March 20, 2024 12:18
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c176512 to
4062b81CompareMarch 23, 2024 22:39
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
4062b81 to
5f3ebaeCompareApril 11, 2024 15:26
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
5f3ebae to
0e2d0c7CompareApril 25, 2024 17:30
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
0e2d0c7 to
6bdb4d1CompareMay 22, 2024 11:12
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
6bdb4d1 to
c59cebcCompareJune 4, 2024 18:24
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c59cebc to
6db7d48CompareJune 13, 2024 11:36
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
6db7d48 to
3d6a8f6CompareJuly 3, 2024 19:48
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
3d6a8f6 to
6cbd611CompareJuly 18, 2024 15:25
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
6cbd611 to
9fca9f2CompareJuly 29, 2024 12:37
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
9fca9f2 to
ba5e9a2CompareAugust 11, 2024 15:34
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
ba5e9a2 to
fcbc913CompareSeptember 3, 2024 13:59
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
dbb0041 to
0bd35c8CompareJanuary 30, 2025 01:28
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
9298586 to
03a3172CompareFebruary 12, 2025 19:14
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
9f5c0c3 to
cc92ec4CompareMarch 6, 2025 10:32
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
cc92ec4 to
5c38fa1CompareMarch 17, 2025 17:33
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
9f81659 to
948c2cdCompareApril 2, 2025 14:08
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
8f953be to
42d11a4CompareApril 12, 2025 21:37
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
42d11a4 to
96dc4a9CompareMay 21, 2025 17:27
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
96dc4a9 to
5139460CompareJune 15, 2025 18:36
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
5139460 to
139894cCompareAugust 11, 2025 15:05
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
139894c to
c9514e1CompareAugust 19, 2025 09:26
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c9514e1 to
8258850CompareAugust 31, 2025 17:57
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
4e91d49 to
c92558bCompareOctober 9, 2025 13:32
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
ae4c8d0 to
63e70feCompareNovember 20, 2025 20:54
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
63e70fe to
0588cc6CompareDecember 4, 2025 10:31
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
0588cc6 to
1d473f0CompareJanuary 27, 2026 15:13
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
1d473f0 to
62ee86aCompareFebruary 22, 2026 21:51
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
62ee86a to
cc4d29fCompareMarch 20, 2026 16:56
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
5cf217d to
84667efCompareMarch 30, 2026 20:34
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
e36f3c9 to
80be1f4CompareApril 6, 2026 17:52
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
80be1f4 to
4081637CompareApril 17, 2026 15:13
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Update all (major) - #114
Open
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/major-all
Open
Update all (major)#114
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/major-all
Conversation
@renovate
@renovaterenovateBot
commented
Sep 4, 2023•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageTypeUpdateChange
actions/checkoutactionmajorv3 → v7
gotenberg/gotenbergmajor7.8.2 → 8.36.0
Release Notes
actions/checkout (actions/checkout)
v7.0.1
Compare Source
v7.0.0
Compare Source
v7
Compare Source
v6.1.0
Compare Source
v6.0.3
Compare Source
v6.0.2
Compare Source
v6.0.1
Compare Source
v6.0.0
Compare Source
v6
Compare Source
v5.1.0
Compare Source
v5.0.1
Compare Source
v5.0.0
Compare Source
v5
Compare Source
v4.4.0
Compare Source
v4.3.1
Compare Source
v4.3.0
Compare Source
v4.2.2
Compare Source
v4.2.1
Compare Source
v4.2.0
Compare Source
v4.1.7
Compare Source
v4.1.6
Compare Source
v4.1.5
Compare Source
v4.1.4
Compare Source
v4.1.3
Compare Source
v4.1.2
Compare Source
  • Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in #​1598
v4.1.1
Compare Source
v4.1.0
Compare Source
v4.0.0
Compare Source
v4
Compare Source
gotenberg/gotenberg (gotenberg/gotenberg)
v8.36.0: 8.36.0
Compare Source
Security Fixes ⚠️
  • Filter WebSocket handshakes against the outbound policy. Chromium could open WebSocket connections to hosts the SSRF policy otherwise blocks.
New Features
  • OIDC bearer token authentication. Opt-in via --api-enable-oidc-auth, mutually exclusive with basic auth (#​1341). Thanks @​mlgupta.
  • Optimize PDF images to reduce file size (#​359). A /forms/pdfengines/optimize route, plus an optimizeImages option on the Chromium, LibreOffice, merge, and split routes. Thanks @​spointecker.
  • Apply multiple stamps and watermarks in one request by repeating the fields, on every route that supports them (#​1601). Thanks @​Kobe-Kwanten.
  • Screenshot a single element via the selector form field (#​947). Thanks @​human211.
  • Table-of-contents bookmarks when merging.titleBookmarks adds one bookmark per input, labeled by its title (#​867). Thanks @​gnapse.
  • Clear storage between conversions with --chromium-clear-storage (#​919). Thanks @​befresh-mweimerskirch.
  • Await async waitForExpression. A Promise-returning expression is now awaited (#​1617). Thanks @​nhh.
Bug Fixes
  • Landscape single-page now fits the page to its content (#​1390). Thanks @​JhnBer.
  • Accept the OOXML PowerPoint show extensions.ppsx and .ppsm (#​1626). Thanks @​lyarov22.
  • Client-cancelled requests are classified as 499, not 500 (#​1627). Thanks @​yngvar.
  • Render scrolled workbooks in full for singlePageSheets.
  • Return 403 instead of 500 for an unresolvable outbound host.
  • Hint at --chromium-start-timeout when Chromium fails to start.
Chore
  • Updated pdfcpu to v0.15.0 (#​1628). Thanks @​doronbehar.
  • Bumped golangci-lint to v2.12.2.
  • Updated Go and npm dependencies.
v8.35.0: 8.35.0
Compare Source
Security Fixes ⚠️
  • Sanitize the Gotenberg-Output-Filename header.filepath.Base ignores \ on Linux, so a crafted header reached archive entry names on splitMode conversions, giving a Windows-side Zip Slip.
  • Bound scope matching per conversion. The extraHttpHeaders match timeout capped one match, not their number. Matching now shares a per-conversion budget, and extraHttpHeaders accepts at most 64 headers with a 1024-character scope.
New Features
  • Authenticated proxy from environment variables. Four opt-in flags route outbound traffic through HTTP_PROXY, HTTPS_PROXY, and NO_PROXY, credentials included: --chromium-enable-environment-proxy, --libreoffice-enable-environment-proxy, --api-download-from-enable-environment-proxy, and --webhook-enable-environment-proxy. All default to false. Breaking: the outbound client no longer inherits HTTP_PROXY and HTTPS_PROXY implicitly.
Bug Fixes
  • LibreOffice returned 400 for server-side failures (#​1588). 400 now requires an implicated client input, nativePageRanges, password, or an unreadable document; everything else is 500. Thanks @​ctunon-align.
  • generateDocumentOutline was a silent no-op (#​1579). It now enables generateTaggedPdf, which Chromium needs to build the outline. Thanks @​paradoxloop.
  • Pinning proxy latched after a Chromium start timeout. Starts are now serialized.
  • LibreOffice leaked a document after a failed export.unoconverter now releases it.
Chore
  • Updated Chromium to 151.0.7922.71.
  • Updated pdfcpu to v0.13.0.
  • Updated unoconverter to v0.4.0.
  • Bumped Go to 1.26.5.
  • Updated Go dependencies.
v8.34.0: 8.34.0
Compare Source
Security Fixes ⚠️
  • Block content linked from untrusted locations in LibreOffice. An uploaded document could reference external (http(s)://) or local (file:///…) resources that LibreOffice resolved during conversion, giving blind SSRF and a limited local-file read. The soffice profile now sets BlockUntrustedRefererLinks, so soffice refuses to load any content a document links. Embedded content is unaffected; documents relying on linked resources no longer render them.
New Features
  • Factur-X / ZUGFeRD metadata (#​1552). Conversions now inject the matching XMP metadata, and the API replaces the single facturx payload with dedicated form fields. Thanks @​fank.
  • Owner-only encryption and permissions. A new ownerPassword, independent of userPassword, plus permission controls restrict what a viewer may do without locking the document open.
  • log-std-level-case (#​1339). New flag to set the level field casing in standard output, lower (default) or upper. Thanks @​Jaben.
Observability
  • Trace enrichment. New process.exec client spans, supervisor queue-wait and launch sub-spans, a Chromium print_to_pdf sub-span, backing-binary versions (Chromium, LibreOffice, qpdf, …) recorded on spans and captured at build time, and per-conversion I/O, network, and size attributes on Chromium and LibreOffice spans.
  • Error classification. Chromium and LibreOffice failures set an error.type from a bounded enum.
  • Richer resource and metrics. Process, OS, host, and container resource detectors, semconv aligned to v1.41.0, a trace-based exemplar filter, and conversions-since-restart and queue-depth gauges.
Bug Fixes
  • CSV conversions leaked the upload's UUID filename as a page header (#​1568). Calc printed the sheet name, which was the UUID-based upload filename, as a centered page header. Now suppressed. Thanks @​vapranav.
  • Webhook async lost trace context. The async delivery goroutine detached from the request context and dropped the trace, breaking span continuity. It now preserves the context via context.WithoutCancel.
  • ca-certificates missing in the chromium-only image. Outbound TLS could fail in the chromium-only build. The package is now installed. Thanks @​osvein.
  • LibreOffice core-dump retries. Retries on ErrCoreDumped are now capped and observable, and the ErrRuntimeException message is corrected.
Chore
  • Updated Chromium to version 149.0.7827.102-1.
  • Updated Go dependencies.
v8.33.0: 8.33.0
Compare Source
Security Fixes ⚠️
  • Block IPv6 prefixes that tunnel to internal IPv4 in IsPublicIP.::ffff:10.0.0.1, 2002:c0a8:: (6to4), and 2001::/32 (Teredo) embed an internal IPv4 destination inside an IPv6 address. IsPublicIP evaluated only the outer IPv6 form, so --*-deny-private-ips filters let the embedded private IPv4 reach the dialer. The check now unwraps IPv4-mapped, IPv4-translated, 6to4, and Teredo addresses, and rejects them when the embedded IPv4 is non-public.
  • Strip backslash separators from supplied filenames. Linux treated a caller-supplied Gotenberg-Output-Filename header or filename form field containing ..\ or foo\bar as a single segment. The handler now strips both forward-slash and backslash path separators before composing the output path.
New Features
  • Device scale ratio for screenshots (#​1543). A new deviceScaleFactor form field on /forms/chromium/screenshot/{html,url,markdown} controls the screenshot pixel density. Defaults to 1. Thanks @​hovcharenko.
Bug Fixes
  • Pinning proxy outlived a failed Chromium start. When chromedp failed to start (port conflict, container OOM, sandbox denial), the loopback HTTP/CONNECT pinning proxy added in 8.32.0 stayed bound to its port and leaked across restart attempts. The browser now stops the pinning proxy on every start failure.
  • Lifecycle listener race on Navigate.chromedp.Navigate could fire Page.lifecycleEvent before Gotenberg's listener subscribed, so the converter occasionally waited the full network-idle timeout on otherwise fast pages. Listeners now register before navigation.
  • Supervisor flapped on transient CDP latency. A single slow CDP health probe marked the supervised process unhealthy and triggered a restart, even when the next probe succeeded. Probes now require N consecutive failures before reporting unhealthy.
  • downloadFrom concurrent map writes. Parallel downloadFrom entries merged results into a shared map without a lock. Under enough concurrency this raced and panicked the request goroutine. Result merging is now serialized.
  • Pinning-proxy noise on client cancellations.context canceled and connection reset by peer from the client side of the pinning proxy logged at error level, flooding logs whenever a caller aborted mid-render. Client-cancelled dial errors now log at debug.
Chore
  • Updated Chromium to version 148.0.7778.178-1.
  • Updated Go dependencies.
v8.32.0: 8.32.0
Compare Source
Security Fixes ⚠️
  • Reverted SSRF defaults (breaking vs 8.31.0). 8.31.0 blocked private-IP destinations by default, which broke deployments running Gotenberg inside a private network. 8.32.0 restores the 8.30.x permissive defaults. Operators with internet-facing APIs opt into the strict posture via the new flags below.
  • Rejected file:// at /forms/chromium/convert/url. Submitting url=file:///tmp/... used to let an unauthenticated caller enumerate the request working directory and read other in-flight uploads as rendered PDFs. The route now returns HTTP 400 for any file:// URL.
  • Required uploaded file for image / pdf stamp and watermark sources. Twelve callsites accepted stampSource=pdf or watermarkSource=pdf with an expression pointing at any path the Gotenberg process could open, even when no file was uploaded. Handlers now return HTTP 400 unless the caller uploaded a matching file.
  • Scoped file:// sub-resources to the request working directory. Crafted HTML could reference another request's file:///tmp/<reqdir>/.... The CDP request handler now restricts file:// sub-resources to the current request's directory. /convert/url and /screenshot/url reject every file:// sub-resource outright.
  • Hardened Chromium against DNS rebinding. A short-TTL DNS authority could return a public IP at validation and a private IP at connect. A loopback HTTP / CONNECT proxy now sits between Chromium and the network, resolves DNS once, and pins the dial to the resolved IP. Skipped when --chromium-proxy-server or --chromium-host-resolver-rules is set.
  • Filtered LibreOffice outbound fetches through a proxy. Uploaded OOXML, RTF, and ODF files can embed external URLs that LibreOffice's libcurl resolves below every Go-side SSRF filter. LibreOffice now routes every outbound fetch through an in-process forward proxy on the same gotenberg.DecideOutbound path Chromium and webhook delivery use. See the four new flags below.
  • Recovered webhook async panics. High-concurrency webhooks could panic the async goroutine and crash the whole process. The goroutine now snapshots the request context and recovers any future panic through the existing error path.
New Features
  • LibreOffice outbound URL filtering. Four flags mirror the Chromium and webhook layout: --libreoffice-allow-list, --libreoffice-deny-list, --libreoffice-deny-private-ips, --libreoffice-deny-public-ips. All default permissive.
  • IP-class filtering on four modules.chromium, webhook, api-download-from, and libreoffice each accept matching deny-private-ips and deny-public-ips flags. All default to false.
FlagWhat it does
--chromium-deny-private-ipsReject Chromium navigations and sub-resources resolving to a non-public IP.
--chromium-deny-public-ipsReject Chromium navigations and sub-resources resolving to a public IP.
--webhook-deny-private-ipsReject webhook URLs (success, error, events) resolving to a non-public IP.
--webhook-deny-public-ipsReject webhook URLs resolving to a public IP.
--api-download-from-deny-private-ipsReject downloadFrom URLs resolving to a non-public IP.
--api-download-from-deny-public-ipsReject downloadFrom URLs resolving to a public IP.
--libreoffice-deny-private-ipsReject LibreOffice outbound fetches resolving to a non-public IP.
--libreoffice-deny-public-ipsReject LibreOffice outbound fetches resolving to a public IP.
A URL matching --*-allow-list skips the IP-class check. A URL matching --*-deny-list is always rejected. Setting both deny-private-ips=true and deny-public-ips=true rejects every URL unless the allow-list matches.
Bug Fixes
  • Charts print as blank rectangles (#​1531, #​1532, #​1534, #​1535): chromedp v0.15.0 suspended the BeginFrame-driven callback dispatch loop under emulatedMediaType=print. requestAnimationFrame, ResizeObserver, IntersectionObserver, CSS transitionend, and CSS animationend all stopped firing. Pinning chromedp back to v0.14.2 restores native dispatch.
  • LibreOffice cached an unrecoverable first-start error (#​1538): A short --libreoffice-start-timeout timed out the first request, then every subsequent request returned the same cached error until the container restarted. The lazy-start path now retries on failure.
Chore
  • Updated pdfcpu to v0.12.0.
  • Switched metadata read/write to direct exiftool invocation. Removes the GPL-3.0 go-exiftool dependency.
  • Bumped Go to 1.26.2.
  • Updated Go dependencies.
Thanks
Thanks to @​Jalliuz (#​1527) for reporting the 8.31.0 sub-resource regression. @​notscottsmith (#​1531), @​spoltix (#​1532), @​rdelott-work (#​1534), and @​sillyas2010 (#​1535) narrowed down the chromedp print-mode regression. @​sillyas2010 also published the reproducer that pinned the bisect. @​JeremyReist2 (#​1536) flagged the go-exiftool GPL-3.0 license. @​doronbehar (#​1537) requested the pdfcpu upgrade. @​mlafon (#​1538) reported the LibreOffice supervisor cached-error bug.
v8.31.0: 8.31.0
Compare Source
Breaking Changes & Security Fixes ⚠️
  • Stopped publishing thecodingmachine/gotenberg images. Pull from gotenberg/gotenberg instead.
  • SSRF hardening (breaking). Resolves outbound URLs (Chromium asset fetches, webhook delivery, download-from) and rejects non-public addresses: loopback, RFC1918, link-local, unspecified, multicast, IPv6 unique-local, IPv4-mapped IPv6. Pins the dial to the validated IP to prevent DNS rebinding.
  • Defaulted webhook deny list (breaking).--webhook-deny-list now defaults to a regex blocking loopback, RFC1918, link-local, and IPv6 unique-local ranges. Override the flag to call internal hosts.
  • Sanitized ExifTool metadata (breaking for System: tags). Strips control characters and line breaks from /forms/pdfengines/metadata/write payloads. Drops System:-prefixed tags. Blocks argument smuggling and filesystem pseudo-tag abuse.
New Features
  • Embed files metadata. Adds embedsMetadata to every route accepting embeds (Chromium HTML/URL/Markdown, LibreOffice convert, PDF Engines merge/split/embed). Pass a JSON object keyed by filename with per-file fields (mimeType, relationship, etc.) - thanks @​Jean-Beru!
Bug Fixes
  • Pinned Chromium to v146 on ppc64le to work around an upstream regression.
Deprecated Flags
OldNew
--webhook-error-allow-list--webhook-allow-list
--webhook-error-deny-list--webhook-deny-list
Old flags still work.
Chore
  • Updated Go dependencies.
v8.30.1: 8.30.1
Compare Source
Another release, another bug fixes 🫥
Bug Fixes
v8.30.0: 8.30.0
Compare Source
New Features
Docker Image Variants
  • Chromium-Only Image (gotenberg/gotenberg:8.30.0-chromium): Drops LibreOffice, python3, and hyphenation packages. ~30% smaller than the full image.
  • LibreOffice-Only Image (gotenberg/gotenberg:8.30.0-libreoffice): Drops Chromium and its dependencies. ~38% smaller than the full image.
Pick the variant that matches your workload. The full image (gotenberg/gotenberg:8.30.0) still ships everything.
Leaner Docker Image
The full image is ~13% smaller than 8.29.0. The font stack was simplified from 30+ packages down to 8, covering Latin, Greek, Cyrillic, CJK, and most world scripts through Noto, plus color emoji.
PackageCoverage
fonts-noto-coreArabic, Bengali, Devanagari, Ethiopic, Georgian, Gujarati, Gurmukhi, Hebrew, Kannada, Khmer, Lao, Malayalam, Myanmar, Sinhala, Tamil, Telugu, Thai, and more
fonts-noto-cjkChinese, Japanese, Korean
fonts-noto-color-emojiColor emoji
fonts-dejavuLatin, Greek, Cyrillic
fonts-crosextra-carlitoMetric-compatible with Calibri
fonts-crosextra-caladeaMetric-compatible with Cambria
fonts-liberationMetric-compatible with Arial, Times New Roman, Courier New
fonts-liberation2Updated Liberation metrics
Microsoft Core Fonts (ttf-mscorefonts-installer) are not shipped due to licensing constraints. The image includes metric-compatible replacements instead: Carlito for Calibri, Caladea for Cambria, and Liberation for Arial, Times New Roman, and Courier New. These preserve document layout in most cases.
Installing Additional Fonts
Build a custom Dockerfile to add fonts. Common scenarios:
Microsoft Core Fonts (you accept the Microsoft EULA):
FROM gotenberg/gotenberg:8
USER root
RUN echo "deb http://deb.debian.org/debian trixie contrib non-free" \
> /etc/apt/sources.list.d/contrib.list \
&& echo "ttf-mscorefonts-installer msttcorefonts/accepted-mscorefonts-eula select true" \
| debconf-set-selections \
&& apt-get update -qq \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
ca-certificates \
wget \
ttf-mscorefonts-installer \
&& rm -rf /var/lib/apt/lists/*
USER gotenberg

Specialized script fonts for richer glyph sets, better hinting, or traditional typefaces beyond the basic Noto coverage:
ScriptPackage
Arabic (Naskh)fonts-hosny-amiri
Bengalifonts-beng
Devanagari (Hindi)fonts-sarai
Ethiopicfonts-sil-abyssinica
Gujaratifonts-samyak-gujr
Gurmukhi (Punjabi)fonts-lohit-guru
Hebrewculmus
Kannadafonts-lohit-knda
Malayalamfonts-samyak-mlym
Myanmarfonts-sil-padauk
Sinhalafonts-lklug-sinhala
Tamilfonts-samyak-taml
Telugufonts-telu
Thaifonts-thai-tlwg
FROM gotenberg/gotenberg:8
USER root
RUN apt-get update -qq \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
fonts-hosny-amiri \
fonts-thai-tlwg \
&& rm -rf /var/lib/apt/lists/*
USER gotenberg

Webhook
  • Gotenberg-Webhook-Error-Url Now Optional: When Gotenberg-Webhook-Events-Url is set, Gotenberg-Webhook-Error-Url is no longer required. Error handling flows through the events URL instead. Gotenberg-Webhook-Error-Url is deprecated but continues to work.
Bug Fixes
  • ExifTool Tag Filtering: Case-insensitive comparison and expanded blocklist for ExifTool metadata filtering. Excludes additional system tags while preserving safe derived tags.
  • Regex Timeout: Added timeout to regex evaluation to prevent ReDoS on malformed patterns.
Chore
  • Updated Go dependencies.
v8.29.1: 8.29.1
Compare Source
Bug Fix (Chromium)
Assets were no longer being correctly loaded in HTML files. This is now fixed. Thanks @​ARawles-GFSC for the heads up!
v8.29.0: 8.29.0
Compare Source
Security Fixes ⚠️
  • ExifTool Arbitrary File Write: The /forms/pdfengines/metadata/write endpoint allowed users to pass FileName and Directory pseudo-tags in the metadata JSON, enabling file rename/move to arbitrary paths. User-supplied metadata is now filtered through a blocklist before being passed to ExifTool.
  • Chromium file:// Sub-Resource Restriction: When converting HTML/Markdown via file://, sub-resources are now restricted to the request's working directory, preventing cross-request file access in /tmp.
New Features
OpenTelemetry
  • Full OpenTelemetry Support: Distributed tracing, metrics export, and structured logging: all configurable via standard OTEL environment variables (OTEL_TRACES_EXPORTER, OTEL_METRICS_EXPORTER, OTEL_LOGS_EXPORTER, OTEL_EXPORTER_OTLP_ENDPOINT, etc.). Every HTTP request gets a span. External tool calls (Chromium, LibreOffice, QPDF, pdfcpu, pdftk, ExifTool, webhook delivery, download-from) create child spans. Trace context is propagated to outbound HTTP calls via W3C headers.
  • Structured Logging Migration: Migrated from custom logging module to slog-based structured logging with OTEL log bridge. Supports auto/JSON/text formats with optional GCP-compatible field names.
  • Binary Path as Peer Service: server.address span attribute uses the actual binary path (e.g., /usr/bin/qpdf) instead of the software name.
  • Telemetry Control for System Routes: New flags to disable telemetry for noisy system routes, all defaulting to disabled: --api-disable-root-route-telemetry, --api-disable-debug-route-telemetry, --api-disable-version-route-telemetry, --prometheus-disable-route-telemetry. The existing --api-disable-health-check-route-telemetry default changed from false to true.
Chromium
  • Idle Shutdown: New --chromium-idle-shutdown-timeout flag (default: 0s, disabled) to automatically stop Chromium after a configurable idle period, reclaiming memory on low-traffic servers. The process re-launches lazily on the next request.
  • Network Almost Idle Event: New skipNetworkAlmostIdleEvent form field (default: true). When set to false, Gotenberg waits for a "network almost idle" event (at most 2 open connections for 500ms) before conversion. This provides a middle ground between the existing skipNetworkIdleEvent (strict, 0 connections) and no wait at all — useful for pages with long-polling or analytics connections that never fully close.
LibreOffice
  • PDF Viewer Preferences (#​1316): 15 new form fields for controlling PDF viewer behavior: initialView, initialPage, magnification, zoom, pageLayout, firstPageOnLeft, resizeWindowToInitialPage, centerWindow, openInFullScreenMode, displayPDFDocumentTitle, hideViewerMenubar, hideViewerToolbar, hideViewerWindowControls, useTransitionEffects, openBookmarkLevels.
  • Idle Shutdown: New --libreoffice-idle-shutdown-timeout flag (default: 0s, disabled), same behavior as Chromium.
Webhook
  • Event Callbacks (#​1473): New optional Gotenberg-Webhook-Events-Url header. When set, structured JSON events (webhook.success, webhook.error) are POSTed after each webhook operation, with correlationId and timestamp. Additive: existing Gotenberg-Webhook-Url and Gotenberg-Webhook-Error-Url continue to work unchanged.
Security & Networking
  • Multiple URL Patterns: All allow/deny list flags (--chromium-allow-list, --chromium-deny-list, --webhook-allow-list, --webhook-deny-list, --webhook-error-allow-list, --webhook-error-deny-list, --api-download-from-allow-list, --api-download-from-deny-list) now accept multiple regex patterns via string slices. Existing single-value configurations continue to work.
Bug Fixes
  • Chromium singlePage Margin Accounting (#​1046): The singlePage option now correctly accounts for top/bottom margins when calculating page height, fixing content overflow on tall pages.
  • Long Filename Support (#​1500): Files with long names (166+ chars, especially with multi-byte UTF-8) no longer cause "File name too long" errors. Files are now stored on disk with UUID-based names while preserving original filenames for HTTP responses, archive entries, and JSON keys.
Deprecated Flags
OldNew
--log-format--log-std-format
--log-enable-gcp-fields--log-std-enable-gcp-fields
--api-trace-header--api-correlation-id-header
--api-disable-health-check-logging--api-disable-health-check-route-telemetry
--prometheus-disable-route-logging--prometheus-disable-route-telemetry
All deprecated flags continue to work.
Chore
  • Replaced go.uber.org/multierr with stdlib errors.Join.
  • Added integration tests for Chromium screenshot routes (HTML, URL, Markdown).
  • Added long filename integration tests across all PDF engine and conversion routes.
  • Integration test retry mechanism: failed scenarios are automatically retried up to 3 times.
  • Bumped actions/checkout to v6 in all GitHub Actions.
Thanks
Thanks to @​dkrizic (#​814) and @​jbdelhommeau (#​1489) for requesting OpenTelemetry/tracing support, @​eht16 (#​1316), @​nh2 (#​1023), @​Frozen666 (#​1046), @​vofflan (#​1500), @​danxmoran (#​1394), and @​janaka (#​1473) for their issue reports and feature requests!
This release represents a significant amount of work: OpenTelemetry integration, security fixes, new features, and hundreds of integration tests. If Gotenberg is useful to you or your team, please consider sponsoring the project. Your support helps keep development going.
v8.28.0: 8.28.0
Compare Source
New Features
PDF Engines
  • Watermark: Added POST /forms/pdfengines/watermark route. Applies a watermark (behind page content) to one or more PDF files. Supports text, image, or pdf sources. Also available as optional form fields on Chromium, LibreOffice, merge, and split routes. Configurable via --pdfengines-watermark-engines (default: pdfcpu,pdftk).
  • Stamp: Added POST /forms/pdfengines/stamp route. Applies a stamp (on top of page content) to one or more PDF files. Same source types and integration points as watermark. Configurable via --pdfengines-stamp-engines (default: pdfcpu,pdftk).
  • Rotate: Added POST /forms/pdfengines/rotate route. Rotates pages by 90°, 180°, or 270° with optional page selection. Also available as optional form fields (rotateAngle, rotatePages) on all composite routes. Configurable via --pdfengines-rotate-engines (default: pdfcpu, pdftk).
  • Bookmarks (Read): Added POST /forms/pdfengines/bookmarks/read route. Returns the hierarchical bookmark outline from one or more PDF files as JSON. Configurable via --pdfengines-read-bookmarks-engines (default: pdfcpu).
  • Bookmarks (Write): Added POST /forms/pdfengines/bookmarks/write route. Accepts either a flat list (applied to all files) or a filename-keyed map. Configurable via --pdfengines-write-bookmarks-engines (default: pdfcpu, pdftk).
  • Merge Bookmark Management: The merge route now supports a bookmarks form field for custom bookmarks with automatic page-offset shifting, and an autoIndexBookmarks option to extract and reindex existing bookmarks from input files.
  • PDF/A & PDF/UA Compliance: Reordered the processing pipeline so that PDF/A and PDF/UA conversion runs after watermark, stamp, and flatten operations. Also reject incompatible combinations (e.g., PDF/A + encryption, PDF/A-1/2 + embeds) with a 400 Bad Request.
LibreOffice
  • Native Watermarks: Added support for LibreOffice's built-in watermark rendering during PDF export via new form fields: nativeWatermarkText, nativeWatermarkColor, nativeWatermarkFontHeight, nativeWatermarkRotateAngle, nativeWatermarkFontName, and nativeTiledWatermarkText.
API
  • Download From: Extended the downloadFrom JSON schema with a field property ("watermark", "stamp", "embedded", or "") to route downloaded files to the appropriate form field bucket. The existing embedded boolean is preserved for backward compatibility.
Chore
  • Updated Chromium to 146.0.7680.153-1.
  • Updated Go dependencies.
v8.27.0: 8.27.0
Compare Source
New Features
Chromium
  • Concurrency Support: Re-introduced support for simultaneous conversions (up to 6 by default). Configurable via CHROMIUM_MAX_CONCURRENCY. Thanks @​TomBrouws!
  • Restart Threshold: Updated the default value for CHROMIUM_RESTART_AFTER to 100.
  • Emulated Media Features: Added the emulatedMediaFeatures form field. This allows users to pass a JSON array to simulate specific CSS media features, such as prefers-color-scheme: dark or prefers-reduced-motion. Thanks @​danxmoran!
Misc
  • Timezone: The default timezone is now explicitly UTC and is visible in the debug route. This remains overridable via th
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
enabled auto-merge (rebase)
September 4, 2023 17:16
@renovaterenovateBot
changed the title
Update actions/checkout action to v4Update actions/checkout action to v4 - autoclosedOct 17, 2023
@renovaterenovateBot
closed this
Oct 17, 2023

auto-merge was automatically disabled
October 17, 2023 18:45
Pull request was closed
@renovate
renovateBot
deleted the

renovate/major-all

branch
October 17, 2023 18:45
@renovaterenovateBot
changed the title
Update actions/checkout action to v4 - autoclosedUpdate actions/checkout action to v4Oct 19, 2023
@renovaterenovateBot
reopened this
Oct 19, 2023
@renovate
renovateBot
restored the

renovate/major-all

branch
October 19, 2023 10:11
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
60d859a to
9658d5dCompareOctober 19, 2023 10:11
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
9658d5d to
62a0b2dCompareJanuary 4, 2024 19:38
@renovaterenovateBot
changed the title
Update actions/checkout action to v4Update all (major)Jan 4, 2024
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
62a0b2d to
9498f21CompareJanuary 8, 2024 17:51
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
9498f21 to
c86f4b8CompareJanuary 18, 2024 14:17
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c86f4b8 to
63de7e6CompareFebruary 7, 2024 15:34
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
ea1d0ec to
8732cdaCompareFebruary 24, 2024 00:57
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
8732cda to
de378adCompareMarch 4, 2024 13:39
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
de378ad to
c176512CompareMarch 15, 2024 19:50
@renovate
renovateBot
enabled auto-merge (rebase)
March 20, 2024 12:18
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c176512 to
4062b81CompareMarch 23, 2024 22:39
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
4062b81 to
5f3ebaeCompareApril 11, 2024 15:26
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
5f3ebae to
0e2d0c7CompareApril 25, 2024 17:30
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
0e2d0c7 to
6bdb4d1CompareMay 22, 2024 11:12
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
6bdb4d1 to
c59cebcCompareJune 4, 2024 18:24
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c59cebc to
6db7d48CompareJune 13, 2024 11:36
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
6db7d48 to
3d6a8f6CompareJuly 3, 2024 19:48
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
3d6a8f6 to
6cbd611CompareJuly 18, 2024 15:25
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
6cbd611 to
9fca9f2CompareJuly 29, 2024 12:37
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
9fca9f2 to
ba5e9a2CompareAugust 11, 2024 15:34
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
ba5e9a2 to
fcbc913CompareSeptember 3, 2024 13:59
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
dbb0041 to
0bd35c8CompareJanuary 30, 2025 01:28
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
9298586 to
03a3172CompareFebruary 12, 2025 19:14
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
9f5c0c3 to
cc92ec4CompareMarch 6, 2025 10:32
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
cc92ec4 to
5c38fa1CompareMarch 17, 2025 17:33
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
9f81659 to
948c2cdCompareApril 2, 2025 14:08
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
8f953be to
42d11a4CompareApril 12, 2025 21:37
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
42d11a4 to
96dc4a9CompareMay 21, 2025 17:27
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
96dc4a9 to
5139460CompareJune 15, 2025 18:36
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
5139460 to
139894cCompareAugust 11, 2025 15:05
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
139894c to
c9514e1CompareAugust 19, 2025 09:26
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c9514e1 to
8258850CompareAugust 31, 2025 17:57
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
4e91d49 to
c92558bCompareOctober 9, 2025 13:32
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
ae4c8d0 to
63e70feCompareNovember 20, 2025 20:54
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
63e70fe to
0588cc6CompareDecember 4, 2025 10:31
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
0588cc6 to
1d473f0CompareJanuary 27, 2026 15:13
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
1d473f0 to
62ee86aCompareFebruary 22, 2026 21:51
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
62ee86a to
cc4d29fCompareMarch 20, 2026 16:56
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
5cf217d to
84667efCompareMarch 30, 2026 20:34
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
e36f3c9 to
80be1f4CompareApril 6, 2026 17:52
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
80be1f4 to
4081637CompareApril 17, 2026 15:13
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Update all (major) - #114
Open
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/major-all
Open
Update all (major)#114
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/major-all
Conversation
@renovate
@renovaterenovateBot
commented
Sep 4, 2023•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageTypeUpdateChange
actions/checkoutactionmajorv3 → v7
gotenberg/gotenbergmajor7.8.2 → 8.36.0
Release Notes
actions/checkout (actions/checkout)
v7.0.1
Compare Source
v7.0.0
Compare Source
v7
Compare Source
v6.1.0
Compare Source
v6.0.3
Compare Source
v6.0.2
Compare Source
v6.0.1
Compare Source
v6.0.0
Compare Source
v6
Compare Source
v5.1.0
Compare Source
v5.0.1
Compare Source
v5.0.0
Compare Source
v5
Compare Source
v4.4.0
Compare Source
v4.3.1
Compare Source
v4.3.0
Compare Source
v4.2.2
Compare Source
v4.2.1
Compare Source
v4.2.0
Compare Source
v4.1.7
Compare Source
v4.1.6
Compare Source
v4.1.5
Compare Source
v4.1.4
Compare Source
v4.1.3
Compare Source
v4.1.2
Compare Source
  • Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in #​1598
v4.1.1
Compare Source
v4.1.0
Compare Source
v4.0.0
Compare Source
v4
Compare Source
gotenberg/gotenberg (gotenberg/gotenberg)
v8.36.0: 8.36.0
Compare Source
Security Fixes ⚠️
  • Filter WebSocket handshakes against the outbound policy. Chromium could open WebSocket connections to hosts the SSRF policy otherwise blocks.
New Features
  • OIDC bearer token authentication. Opt-in via --api-enable-oidc-auth, mutually exclusive with basic auth (#​1341). Thanks @​mlgupta.
  • Optimize PDF images to reduce file size (#​359). A /forms/pdfengines/optimize route, plus an optimizeImages option on the Chromium, LibreOffice, merge, and split routes. Thanks @​spointecker.
  • Apply multiple stamps and watermarks in one request by repeating the fields, on every route that supports them (#​1601). Thanks @​Kobe-Kwanten.
  • Screenshot a single element via the selector form field (#​947). Thanks @​human211.
  • Table-of-contents bookmarks when merging.titleBookmarks adds one bookmark per input, labeled by its title (#​867). Thanks @​gnapse.
  • Clear storage between conversions with --chromium-clear-storage (#​919). Thanks @​befresh-mweimerskirch.
  • Await async waitForExpression. A Promise-returning expression is now awaited (#​1617). Thanks @​nhh.
Bug Fixes
  • Landscape single-page now fits the page to its content (#​1390). Thanks @​JhnBer.
  • Accept the OOXML PowerPoint show extensions.ppsx and .ppsm (#​1626). Thanks @​lyarov22.
  • Client-cancelled requests are classified as 499, not 500 (#​1627). Thanks @​yngvar.
  • Render scrolled workbooks in full for singlePageSheets.
  • Return 403 instead of 500 for an unresolvable outbound host.
  • Hint at --chromium-start-timeout when Chromium fails to start.
Chore
  • Updated pdfcpu to v0.15.0 (#​1628). Thanks @​doronbehar.
  • Bumped golangci-lint to v2.12.2.
  • Updated Go and npm dependencies.
v8.35.0: 8.35.0
Compare Source
Security Fixes ⚠️
  • Sanitize the Gotenberg-Output-Filename header.filepath.Base ignores \ on Linux, so a crafted header reached archive entry names on splitMode conversions, giving a Windows-side Zip Slip.
  • Bound scope matching per conversion. The extraHttpHeaders match timeout capped one match, not their number. Matching now shares a per-conversion budget, and extraHttpHeaders accepts at most 64 headers with a 1024-character scope.
New Features
  • Authenticated proxy from environment variables. Four opt-in flags route outbound traffic through HTTP_PROXY, HTTPS_PROXY, and NO_PROXY, credentials included: --chromium-enable-environment-proxy, --libreoffice-enable-environment-proxy, --api-download-from-enable-environment-proxy, and --webhook-enable-environment-proxy. All default to false. Breaking: the outbound client no longer inherits HTTP_PROXY and HTTPS_PROXY implicitly.
Bug Fixes
  • LibreOffice returned 400 for server-side failures (#​1588). 400 now requires an implicated client input, nativePageRanges, password, or an unreadable document; everything else is 500. Thanks @​ctunon-align.
  • generateDocumentOutline was a silent no-op (#​1579). It now enables generateTaggedPdf, which Chromium needs to build the outline. Thanks @​paradoxloop.
  • Pinning proxy latched after a Chromium start timeout. Starts are now serialized.
  • LibreOffice leaked a document after a failed export.unoconverter now releases it.
Chore
  • Updated Chromium to 151.0.7922.71.
  • Updated pdfcpu to v0.13.0.
  • Updated unoconverter to v0.4.0.
  • Bumped Go to 1.26.5.
  • Updated Go dependencies.
v8.34.0: 8.34.0
Compare Source
Security Fixes ⚠️
  • Block content linked from untrusted locations in LibreOffice. An uploaded document could reference external (http(s)://) or local (file:///…) resources that LibreOffice resolved during conversion, giving blind SSRF and a limited local-file read. The soffice profile now sets BlockUntrustedRefererLinks, so soffice refuses to load any content a document links. Embedded content is unaffected; documents relying on linked resources no longer render them.
New Features
  • Factur-X / ZUGFeRD metadata (#​1552). Conversions now inject the matching XMP metadata, and the API replaces the single facturx payload with dedicated form fields. Thanks @​fank.
  • Owner-only encryption and permissions. A new ownerPassword, independent of userPassword, plus permission controls restrict what a viewer may do without locking the document open.
  • log-std-level-case (#​1339). New flag to set the level field casing in standard output, lower (default) or upper. Thanks @​Jaben.
Observability
  • Trace enrichment. New process.exec client spans, supervisor queue-wait and launch sub-spans, a Chromium print_to_pdf sub-span, backing-binary versions (Chromium, LibreOffice, qpdf, …) recorded on spans and captured at build time, and per-conversion I/O, network, and size attributes on Chromium and LibreOffice spans.
  • Error classification. Chromium and LibreOffice failures set an error.type from a bounded enum.
  • Richer resource and metrics. Process, OS, host, and container resource detectors, semconv aligned to v1.41.0, a trace-based exemplar filter, and conversions-since-restart and queue-depth gauges.
Bug Fixes
  • CSV conversions leaked the upload's UUID filename as a page header (#​1568). Calc printed the sheet name, which was the UUID-based upload filename, as a centered page header. Now suppressed. Thanks @​vapranav.
  • Webhook async lost trace context. The async delivery goroutine detached from the request context and dropped the trace, breaking span continuity. It now preserves the context via context.WithoutCancel.
  • ca-certificates missing in the chromium-only image. Outbound TLS could fail in the chromium-only build. The package is now installed. Thanks @​osvein.
  • LibreOffice core-dump retries. Retries on ErrCoreDumped are now capped and observable, and the ErrRuntimeException message is corrected.
Chore
  • Updated Chromium to version 149.0.7827.102-1.
  • Updated Go dependencies.
v8.33.0: 8.33.0
Compare Source
Security Fixes ⚠️
  • Block IPv6 prefixes that tunnel to internal IPv4 in IsPublicIP.::ffff:10.0.0.1, 2002:c0a8:: (6to4), and 2001::/32 (Teredo) embed an internal IPv4 destination inside an IPv6 address. IsPublicIP evaluated only the outer IPv6 form, so --*-deny-private-ips filters let the embedded private IPv4 reach the dialer. The check now unwraps IPv4-mapped, IPv4-translated, 6to4, and Teredo addresses, and rejects them when the embedded IPv4 is non-public.
  • Strip backslash separators from supplied filenames. Linux treated a caller-supplied Gotenberg-Output-Filename header or filename form field containing ..\ or foo\bar as a single segment. The handler now strips both forward-slash and backslash path separators before composing the output path.
New Features
  • Device scale ratio for screenshots (#​1543). A new deviceScaleFactor form field on /forms/chromium/screenshot/{html,url,markdown} controls the screenshot pixel density. Defaults to 1. Thanks @​hovcharenko.
Bug Fixes
  • Pinning proxy outlived a failed Chromium start. When chromedp failed to start (port conflict, container OOM, sandbox denial), the loopback HTTP/CONNECT pinning proxy added in 8.32.0 stayed bound to its port and leaked across restart attempts. The browser now stops the pinning proxy on every start failure.
  • Lifecycle listener race on Navigate.chromedp.Navigate could fire Page.lifecycleEvent before Gotenberg's listener subscribed, so the converter occasionally waited the full network-idle timeout on otherwise fast pages. Listeners now register before navigation.
  • Supervisor flapped on transient CDP latency. A single slow CDP health probe marked the supervised process unhealthy and triggered a restart, even when the next probe succeeded. Probes now require N consecutive failures before reporting unhealthy.
  • downloadFrom concurrent map writes. Parallel downloadFrom entries merged results into a shared map without a lock. Under enough concurrency this raced and panicked the request goroutine. Result merging is now serialized.
  • Pinning-proxy noise on client cancellations.context canceled and connection reset by peer from the client side of the pinning proxy logged at error level, flooding logs whenever a caller aborted mid-render. Client-cancelled dial errors now log at debug.
Chore
  • Updated Chromium to version 148.0.7778.178-1.
  • Updated Go dependencies.
v8.32.0: 8.32.0
Compare Source
Security Fixes ⚠️
  • Reverted SSRF defaults (breaking vs 8.31.0). 8.31.0 blocked private-IP destinations by default, which broke deployments running Gotenberg inside a private network. 8.32.0 restores the 8.30.x permissive defaults. Operators with internet-facing APIs opt into the strict posture via the new flags below.
  • Rejected file:// at /forms/chromium/convert/url. Submitting url=file:///tmp/... used to let an unauthenticated caller enumerate the request working directory and read other in-flight uploads as rendered PDFs. The route now returns HTTP 400 for any file:// URL.
  • Required uploaded file for image / pdf stamp and watermark sources. Twelve callsites accepted stampSource=pdf or watermarkSource=pdf with an expression pointing at any path the Gotenberg process could open, even when no file was uploaded. Handlers now return HTTP 400 unless the caller uploaded a matching file.
  • Scoped file:// sub-resources to the request working directory. Crafted HTML could reference another request's file:///tmp/<reqdir>/.... The CDP request handler now restricts file:// sub-resources to the current request's directory. /convert/url and /screenshot/url reject every file:// sub-resource outright.
  • Hardened Chromium against DNS rebinding. A short-TTL DNS authority could return a public IP at validation and a private IP at connect. A loopback HTTP / CONNECT proxy now sits between Chromium and the network, resolves DNS once, and pins the dial to the resolved IP. Skipped when --chromium-proxy-server or --chromium-host-resolver-rules is set.
  • Filtered LibreOffice outbound fetches through a proxy. Uploaded OOXML, RTF, and ODF files can embed external URLs that LibreOffice's libcurl resolves below every Go-side SSRF filter. LibreOffice now routes every outbound fetch through an in-process forward proxy on the same gotenberg.DecideOutbound path Chromium and webhook delivery use. See the four new flags below.
  • Recovered webhook async panics. High-concurrency webhooks could panic the async goroutine and crash the whole process. The goroutine now snapshots the request context and recovers any future panic through the existing error path.
New Features
  • LibreOffice outbound URL filtering. Four flags mirror the Chromium and webhook layout: --libreoffice-allow-list, --libreoffice-deny-list, --libreoffice-deny-private-ips, --libreoffice-deny-public-ips. All default permissive.
  • IP-class filtering on four modules.chromium, webhook, api-download-from, and libreoffice each accept matching deny-private-ips and deny-public-ips flags. All default to false.
FlagWhat it does
--chromium-deny-private-ipsReject Chromium navigations and sub-resources resolving to a non-public IP.
--chromium-deny-public-ipsReject Chromium navigations and sub-resources resolving to a public IP.
--webhook-deny-private-ipsReject webhook URLs (success, error, events) resolving to a non-public IP.
--webhook-deny-public-ipsReject webhook URLs resolving to a public IP.
--api-download-from-deny-private-ipsReject downloadFrom URLs resolving to a non-public IP.
--api-download-from-deny-public-ipsReject downloadFrom URLs resolving to a public IP.
--libreoffice-deny-private-ipsReject LibreOffice outbound fetches resolving to a non-public IP.
--libreoffice-deny-public-ipsReject LibreOffice outbound fetches resolving to a public IP.
A URL matching --*-allow-list skips the IP-class check. A URL matching --*-deny-list is always rejected. Setting both deny-private-ips=true and deny-public-ips=true rejects every URL unless the allow-list matches.
Bug Fixes
  • Charts print as blank rectangles (#​1531, #​1532, #​1534, #​1535): chromedp v0.15.0 suspended the BeginFrame-driven callback dispatch loop under emulatedMediaType=print. requestAnimationFrame, ResizeObserver, IntersectionObserver, CSS transitionend, and CSS animationend all stopped firing. Pinning chromedp back to v0.14.2 restores native dispatch.
  • LibreOffice cached an unrecoverable first-start error (#​1538): A short --libreoffice-start-timeout timed out the first request, then every subsequent request returned the same cached error until the container restarted. The lazy-start path now retries on failure.
Chore
  • Updated pdfcpu to v0.12.0.
  • Switched metadata read/write to direct exiftool invocation. Removes the GPL-3.0 go-exiftool dependency.
  • Bumped Go to 1.26.2.
  • Updated Go dependencies.
Thanks
Thanks to @​Jalliuz (#​1527) for reporting the 8.31.0 sub-resource regression. @​notscottsmith (#​1531), @​spoltix (#​1532), @​rdelott-work (#​1534), and @​sillyas2010 (#​1535) narrowed down the chromedp print-mode regression. @​sillyas2010 also published the reproducer that pinned the bisect. @​JeremyReist2 (#​1536) flagged the go-exiftool GPL-3.0 license. @​doronbehar (#​1537) requested the pdfcpu upgrade. @​mlafon (#​1538) reported the LibreOffice supervisor cached-error bug.
v8.31.0: 8.31.0
Compare Source
Breaking Changes & Security Fixes ⚠️
  • Stopped publishing thecodingmachine/gotenberg images. Pull from gotenberg/gotenberg instead.
  • SSRF hardening (breaking). Resolves outbound URLs (Chromium asset fetches, webhook delivery, download-from) and rejects non-public addresses: loopback, RFC1918, link-local, unspecified, multicast, IPv6 unique-local, IPv4-mapped IPv6. Pins the dial to the validated IP to prevent DNS rebinding.
  • Defaulted webhook deny list (breaking).--webhook-deny-list now defaults to a regex blocking loopback, RFC1918, link-local, and IPv6 unique-local ranges. Override the flag to call internal hosts.
  • Sanitized ExifTool metadata (breaking for System: tags). Strips control characters and line breaks from /forms/pdfengines/metadata/write payloads. Drops System:-prefixed tags. Blocks argument smuggling and filesystem pseudo-tag abuse.
New Features
  • Embed files metadata. Adds embedsMetadata to every route accepting embeds (Chromium HTML/URL/Markdown, LibreOffice convert, PDF Engines merge/split/embed). Pass a JSON object keyed by filename with per-file fields (mimeType, relationship, etc.) - thanks @​Jean-Beru!
Bug Fixes
  • Pinned Chromium to v146 on ppc64le to work around an upstream regression.
Deprecated Flags
OldNew
--webhook-error-allow-list--webhook-allow-list
--webhook-error-deny-list--webhook-deny-list
Old flags still work.
Chore
  • Updated Go dependencies.
v8.30.1: 8.30.1
Compare Source
Another release, another bug fixes 🫥
Bug Fixes
v8.30.0: 8.30.0
Compare Source
New Features
Docker Image Variants
  • Chromium-Only Image (gotenberg/gotenberg:8.30.0-chromium): Drops LibreOffice, python3, and hyphenation packages. ~30% smaller than the full image.
  • LibreOffice-Only Image (gotenberg/gotenberg:8.30.0-libreoffice): Drops Chromium and its dependencies. ~38% smaller than the full image.
Pick the variant that matches your workload. The full image (gotenberg/gotenberg:8.30.0) still ships everything.
Leaner Docker Image
The full image is ~13% smaller than 8.29.0. The font stack was simplified from 30+ packages down to 8, covering Latin, Greek, Cyrillic, CJK, and most world scripts through Noto, plus color emoji.
PackageCoverage
fonts-noto-coreArabic, Bengali, Devanagari, Ethiopic, Georgian, Gujarati, Gurmukhi, Hebrew, Kannada, Khmer, Lao, Malayalam, Myanmar, Sinhala, Tamil, Telugu, Thai, and more
fonts-noto-cjkChinese, Japanese, Korean
fonts-noto-color-emojiColor emoji
fonts-dejavuLatin, Greek, Cyrillic
fonts-crosextra-carlitoMetric-compatible with Calibri
fonts-crosextra-caladeaMetric-compatible with Cambria
fonts-liberationMetric-compatible with Arial, Times New Roman, Courier New
fonts-liberation2Updated Liberation metrics
Microsoft Core Fonts (ttf-mscorefonts-installer) are not shipped due to licensing constraints. The image includes metric-compatible replacements instead: Carlito for Calibri, Caladea for Cambria, and Liberation for Arial, Times New Roman, and Courier New. These preserve document layout in most cases.
Installing Additional Fonts
Build a custom Dockerfile to add fonts. Common scenarios:
Microsoft Core Fonts (you accept the Microsoft EULA):
FROM gotenberg/gotenberg:8
USER root
RUN echo "deb http://deb.debian.org/debian trixie contrib non-free" \
> /etc/apt/sources.list.d/contrib.list \
&& echo "ttf-mscorefonts-installer msttcorefonts/accepted-mscorefonts-eula select true" \
| debconf-set-selections \
&& apt-get update -qq \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
ca-certificates \
wget \
ttf-mscorefonts-installer \
&& rm -rf /var/lib/apt/lists/*
USER gotenberg

Specialized script fonts for richer glyph sets, better hinting, or traditional typefaces beyond the basic Noto coverage:
ScriptPackage
Arabic (Naskh)fonts-hosny-amiri
Bengalifonts-beng
Devanagari (Hindi)fonts-sarai
Ethiopicfonts-sil-abyssinica
Gujaratifonts-samyak-gujr
Gurmukhi (Punjabi)fonts-lohit-guru
Hebrewculmus
Kannadafonts-lohit-knda
Malayalamfonts-samyak-mlym
Myanmarfonts-sil-padauk
Sinhalafonts-lklug-sinhala
Tamilfonts-samyak-taml
Telugufonts-telu
Thaifonts-thai-tlwg
FROM gotenberg/gotenberg:8
USER root
RUN apt-get update -qq \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
fonts-hosny-amiri \
fonts-thai-tlwg \
&& rm -rf /var/lib/apt/lists/*
USER gotenberg

Webhook
  • Gotenberg-Webhook-Error-Url Now Optional: When Gotenberg-Webhook-Events-Url is set, Gotenberg-Webhook-Error-Url is no longer required. Error handling flows through the events URL instead. Gotenberg-Webhook-Error-Url is deprecated but continues to work.
Bug Fixes
  • ExifTool Tag Filtering: Case-insensitive comparison and expanded blocklist for ExifTool metadata filtering. Excludes additional system tags while preserving safe derived tags.
  • Regex Timeout: Added timeout to regex evaluation to prevent ReDoS on malformed patterns.
Chore
  • Updated Go dependencies.
v8.29.1: 8.29.1
Compare Source
Bug Fix (Chromium)
Assets were no longer being correctly loaded in HTML files. This is now fixed. Thanks @​ARawles-GFSC for the heads up!
v8.29.0: 8.29.0
Compare Source
Security Fixes ⚠️
  • ExifTool Arbitrary File Write: The /forms/pdfengines/metadata/write endpoint allowed users to pass FileName and Directory pseudo-tags in the metadata JSON, enabling file rename/move to arbitrary paths. User-supplied metadata is now filtered through a blocklist before being passed to ExifTool.
  • Chromium file:// Sub-Resource Restriction: When converting HTML/Markdown via file://, sub-resources are now restricted to the request's working directory, preventing cross-request file access in /tmp.
New Features
OpenTelemetry
  • Full OpenTelemetry Support: Distributed tracing, metrics export, and structured logging: all configurable via standard OTEL environment variables (OTEL_TRACES_EXPORTER, OTEL_METRICS_EXPORTER, OTEL_LOGS_EXPORTER, OTEL_EXPORTER_OTLP_ENDPOINT, etc.). Every HTTP request gets a span. External tool calls (Chromium, LibreOffice, QPDF, pdfcpu, pdftk, ExifTool, webhook delivery, download-from) create child spans. Trace context is propagated to outbound HTTP calls via W3C headers.
  • Structured Logging Migration: Migrated from custom logging module to slog-based structured logging with OTEL log bridge. Supports auto/JSON/text formats with optional GCP-compatible field names.
  • Binary Path as Peer Service: server.address span attribute uses the actual binary path (e.g., /usr/bin/qpdf) instead of the software name.
  • Telemetry Control for System Routes: New flags to disable telemetry for noisy system routes, all defaulting to disabled: --api-disable-root-route-telemetry, --api-disable-debug-route-telemetry, --api-disable-version-route-telemetry, --prometheus-disable-route-telemetry. The existing --api-disable-health-check-route-telemetry default changed from false to true.
Chromium
  • Idle Shutdown: New --chromium-idle-shutdown-timeout flag (default: 0s, disabled) to automatically stop Chromium after a configurable idle period, reclaiming memory on low-traffic servers. The process re-launches lazily on the next request.
  • Network Almost Idle Event: New skipNetworkAlmostIdleEvent form field (default: true). When set to false, Gotenberg waits for a "network almost idle" event (at most 2 open connections for 500ms) before conversion. This provides a middle ground between the existing skipNetworkIdleEvent (strict, 0 connections) and no wait at all — useful for pages with long-polling or analytics connections that never fully close.
LibreOffice
  • PDF Viewer Preferences (#​1316): 15 new form fields for controlling PDF viewer behavior: initialView, initialPage, magnification, zoom, pageLayout, firstPageOnLeft, resizeWindowToInitialPage, centerWindow, openInFullScreenMode, displayPDFDocumentTitle, hideViewerMenubar, hideViewerToolbar, hideViewerWindowControls, useTransitionEffects, openBookmarkLevels.
  • Idle Shutdown: New --libreoffice-idle-shutdown-timeout flag (default: 0s, disabled), same behavior as Chromium.
Webhook
  • Event Callbacks (#​1473): New optional Gotenberg-Webhook-Events-Url header. When set, structured JSON events (webhook.success, webhook.error) are POSTed after each webhook operation, with correlationId and timestamp. Additive: existing Gotenberg-Webhook-Url and Gotenberg-Webhook-Error-Url continue to work unchanged.
Security & Networking
  • Multiple URL Patterns: All allow/deny list flags (--chromium-allow-list, --chromium-deny-list, --webhook-allow-list, --webhook-deny-list, --webhook-error-allow-list, --webhook-error-deny-list, --api-download-from-allow-list, --api-download-from-deny-list) now accept multiple regex patterns via string slices. Existing single-value configurations continue to work.
Bug Fixes
  • Chromium singlePage Margin Accounting (#​1046): The singlePage option now correctly accounts for top/bottom margins when calculating page height, fixing content overflow on tall pages.
  • Long Filename Support (#​1500): Files with long names (166+ chars, especially with multi-byte UTF-8) no longer cause "File name too long" errors. Files are now stored on disk with UUID-based names while preserving original filenames for HTTP responses, archive entries, and JSON keys.
Deprecated Flags
OldNew
--log-format--log-std-format
--log-enable-gcp-fields--log-std-enable-gcp-fields
--api-trace-header--api-correlation-id-header
--api-disable-health-check-logging--api-disable-health-check-route-telemetry
--prometheus-disable-route-logging--prometheus-disable-route-telemetry
All deprecated flags continue to work.
Chore
  • Replaced go.uber.org/multierr with stdlib errors.Join.
  • Added integration tests for Chromium screenshot routes (HTML, URL, Markdown).
  • Added long filename integration tests across all PDF engine and conversion routes.
  • Integration test retry mechanism: failed scenarios are automatically retried up to 3 times.
  • Bumped actions/checkout to v6 in all GitHub Actions.
Thanks
Thanks to @​dkrizic (#​814) and @​jbdelhommeau (#​1489) for requesting OpenTelemetry/tracing support, @​eht16 (#​1316), @​nh2 (#​1023), @​Frozen666 (#​1046), @​vofflan (#​1500), @​danxmoran (#​1394), and @​janaka (#​1473) for their issue reports and feature requests!
This release represents a significant amount of work: OpenTelemetry integration, security fixes, new features, and hundreds of integration tests. If Gotenberg is useful to you or your team, please consider sponsoring the project. Your support helps keep development going.
v8.28.0: 8.28.0
Compare Source
New Features
PDF Engines
  • Watermark: Added POST /forms/pdfengines/watermark route. Applies a watermark (behind page content) to one or more PDF files. Supports text, image, or pdf sources. Also available as optional form fields on Chromium, LibreOffice, merge, and split routes. Configurable via --pdfengines-watermark-engines (default: pdfcpu,pdftk).
  • Stamp: Added POST /forms/pdfengines/stamp route. Applies a stamp (on top of page content) to one or more PDF files. Same source types and integration points as watermark. Configurable via --pdfengines-stamp-engines (default: pdfcpu,pdftk).
  • Rotate: Added POST /forms/pdfengines/rotate route. Rotates pages by 90°, 180°, or 270° with optional page selection. Also available as optional form fields (rotateAngle, rotatePages) on all composite routes. Configurable via --pdfengines-rotate-engines (default: pdfcpu, pdftk).
  • Bookmarks (Read): Added POST /forms/pdfengines/bookmarks/read route. Returns the hierarchical bookmark outline from one or more PDF files as JSON. Configurable via --pdfengines-read-bookmarks-engines (default: pdfcpu).
  • Bookmarks (Write): Added POST /forms/pdfengines/bookmarks/write route. Accepts either a flat list (applied to all files) or a filename-keyed map. Configurable via --pdfengines-write-bookmarks-engines (default: pdfcpu, pdftk).
  • Merge Bookmark Management: The merge route now supports a bookmarks form field for custom bookmarks with automatic page-offset shifting, and an autoIndexBookmarks option to extract and reindex existing bookmarks from input files.
  • PDF/A & PDF/UA Compliance: Reordered the processing pipeline so that PDF/A and PDF/UA conversion runs after watermark, stamp, and flatten operations. Also reject incompatible combinations (e.g., PDF/A + encryption, PDF/A-1/2 + embeds) with a 400 Bad Request.
LibreOffice
  • Native Watermarks: Added support for LibreOffice's built-in watermark rendering during PDF export via new form fields: nativeWatermarkText, nativeWatermarkColor, nativeWatermarkFontHeight, nativeWatermarkRotateAngle, nativeWatermarkFontName, and nativeTiledWatermarkText.
API
  • Download From: Extended the downloadFrom JSON schema with a field property ("watermark", "stamp", "embedded", or "") to route downloaded files to the appropriate form field bucket. The existing embedded boolean is preserved for backward compatibility.
Chore
  • Updated Chromium to 146.0.7680.153-1.
  • Updated Go dependencies.
v8.27.0: 8.27.0
Compare Source
New Features
Chromium
  • Concurrency Support: Re-introduced support for simultaneous conversions (up to 6 by default). Configurable via CHROMIUM_MAX_CONCURRENCY. Thanks @​TomBrouws!
  • Restart Threshold: Updated the default value for CHROMIUM_RESTART_AFTER to 100.
  • Emulated Media Features: Added the emulatedMediaFeatures form field. This allows users to pass a JSON array to simulate specific CSS media features, such as prefers-color-scheme: dark or prefers-reduced-motion. Thanks @​danxmoran!
Misc
  • Timezone: The default timezone is now explicitly UTC and is visible in the debug route. This remains overridable via th
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
enabled auto-merge (rebase)
September 4, 2023 17:16
@renovaterenovateBot
changed the title
Update actions/checkout action to v4Update actions/checkout action to v4 - autoclosedOct 17, 2023
@renovaterenovateBot
closed this
Oct 17, 2023

auto-merge was automatically disabled
October 17, 2023 18:45
Pull request was closed
@renovate
renovateBot
deleted the

renovate/major-all

branch
October 17, 2023 18:45
@renovaterenovateBot
changed the title
Update actions/checkout action to v4 - autoclosedUpdate actions/checkout action to v4Oct 19, 2023
@renovaterenovateBot
reopened this
Oct 19, 2023
@renovate
renovateBot
restored the

renovate/major-all

branch
October 19, 2023 10:11
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
60d859a to
9658d5dCompareOctober 19, 2023 10:11
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
9658d5d to
62a0b2dCompareJanuary 4, 2024 19:38
@renovaterenovateBot
changed the title
Update actions/checkout action to v4Update all (major)Jan 4, 2024
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
62a0b2d to
9498f21CompareJanuary 8, 2024 17:51
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
9498f21 to
c86f4b8CompareJanuary 18, 2024 14:17
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c86f4b8 to
63de7e6CompareFebruary 7, 2024 15:34
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
ea1d0ec to
8732cdaCompareFebruary 24, 2024 00:57
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
8732cda to
de378adCompareMarch 4, 2024 13:39
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
de378ad to
c176512CompareMarch 15, 2024 19:50
@renovate
renovateBot
enabled auto-merge (rebase)
March 20, 2024 12:18
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c176512 to
4062b81CompareMarch 23, 2024 22:39
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
4062b81 to
5f3ebaeCompareApril 11, 2024 15:26
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
5f3ebae to
0e2d0c7CompareApril 25, 2024 17:30
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
0e2d0c7 to
6bdb4d1CompareMay 22, 2024 11:12
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
6bdb4d1 to
c59cebcCompareJune 4, 2024 18:24
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c59cebc to
6db7d48CompareJune 13, 2024 11:36
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
6db7d48 to
3d6a8f6CompareJuly 3, 2024 19:48
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
3d6a8f6 to
6cbd611CompareJuly 18, 2024 15:25
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
6cbd611 to
9fca9f2CompareJuly 29, 2024 12:37
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
9fca9f2 to
ba5e9a2CompareAugust 11, 2024 15:34
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
ba5e9a2 to
fcbc913CompareSeptember 3, 2024 13:59
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
dbb0041 to
0bd35c8CompareJanuary 30, 2025 01:28
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
9298586 to
03a3172CompareFebruary 12, 2025 19:14
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
9f5c0c3 to
cc92ec4CompareMarch 6, 2025 10:32
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
cc92ec4 to
5c38fa1CompareMarch 17, 2025 17:33
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
9f81659 to
948c2cdCompareApril 2, 2025 14:08
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
8f953be to
42d11a4CompareApril 12, 2025 21:37
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
42d11a4 to
96dc4a9CompareMay 21, 2025 17:27
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
96dc4a9 to
5139460CompareJune 15, 2025 18:36
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
5139460 to
139894cCompareAugust 11, 2025 15:05
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
139894c to
c9514e1CompareAugust 19, 2025 09:26
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c9514e1 to
8258850CompareAugust 31, 2025 17:57
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
4e91d49 to
c92558bCompareOctober 9, 2025 13:32
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
ae4c8d0 to
63e70feCompareNovember 20, 2025 20:54
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
63e70fe to
0588cc6CompareDecember 4, 2025 10:31
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
0588cc6 to
1d473f0CompareJanuary 27, 2026 15:13
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
1d473f0 to
62ee86aCompareFebruary 22, 2026 21:51
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
62ee86a to
cc4d29fCompareMarch 20, 2026 16:56
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
5cf217d to
84667efCompareMarch 30, 2026 20:34
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
e36f3c9 to
80be1f4CompareApril 6, 2026 17:52
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
80be1f4 to
4081637CompareApril 17, 2026 15:13
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Update all (major) - #114
Open
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/major-all
Open
Update all (major)#114
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/major-all
Conversation
@renovate
@renovaterenovateBot
commented
Sep 4, 2023•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageTypeUpdateChange
actions/checkoutactionmajorv3 → v7
gotenberg/gotenbergmajor7.8.2 → 8.36.0
Release Notes
actions/checkout (actions/checkout)
v7.0.1
Compare Source
v7.0.0
Compare Source
v7
Compare Source
v6.1.0
Compare Source
v6.0.3
Compare Source
v6.0.2
Compare Source
v6.0.1
Compare Source
v6.0.0
Compare Source
v6
Compare Source
v5.1.0
Compare Source
v5.0.1
Compare Source
v5.0.0
Compare Source
v5
Compare Source
v4.4.0
Compare Source
v4.3.1
Compare Source
v4.3.0
Compare Source
v4.2.2
Compare Source
v4.2.1
Compare Source
v4.2.0
Compare Source
v4.1.7
Compare Source
v4.1.6
Compare Source
v4.1.5
Compare Source
v4.1.4
Compare Source
v4.1.3
Compare Source
v4.1.2
Compare Source
  • Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in #​1598
v4.1.1
Compare Source
v4.1.0
Compare Source
v4.0.0
Compare Source
v4
Compare Source
gotenberg/gotenberg (gotenberg/gotenberg)
v8.36.0: 8.36.0
Compare Source
Security Fixes ⚠️
  • Filter WebSocket handshakes against the outbound policy. Chromium could open WebSocket connections to hosts the SSRF policy otherwise blocks.
New Features
  • OIDC bearer token authentication. Opt-in via --api-enable-oidc-auth, mutually exclusive with basic auth (#​1341). Thanks @​mlgupta.
  • Optimize PDF images to reduce file size (#​359). A /forms/pdfengines/optimize route, plus an optimizeImages option on the Chromium, LibreOffice, merge, and split routes. Thanks @​spointecker.
  • Apply multiple stamps and watermarks in one request by repeating the fields, on every route that supports them (#​1601). Thanks @​Kobe-Kwanten.
  • Screenshot a single element via the selector form field (#​947). Thanks @​human211.
  • Table-of-contents bookmarks when merging.titleBookmarks adds one bookmark per input, labeled by its title (#​867). Thanks @​gnapse.
  • Clear storage between conversions with --chromium-clear-storage (#​919). Thanks @​befresh-mweimerskirch.
  • Await async waitForExpression. A Promise-returning expression is now awaited (#​1617). Thanks @​nhh.
Bug Fixes
  • Landscape single-page now fits the page to its content (#​1390). Thanks @​JhnBer.
  • Accept the OOXML PowerPoint show extensions.ppsx and .ppsm (#​1626). Thanks @​lyarov22.
  • Client-cancelled requests are classified as 499, not 500 (#​1627). Thanks @​yngvar.
  • Render scrolled workbooks in full for singlePageSheets.
  • Return 403 instead of 500 for an unresolvable outbound host.
  • Hint at --chromium-start-timeout when Chromium fails to start.
Chore
  • Updated pdfcpu to v0.15.0 (#​1628). Thanks @​doronbehar.
  • Bumped golangci-lint to v2.12.2.
  • Updated Go and npm dependencies.
v8.35.0: 8.35.0
Compare Source
Security Fixes ⚠️
  • Sanitize the Gotenberg-Output-Filename header.filepath.Base ignores \ on Linux, so a crafted header reached archive entry names on splitMode conversions, giving a Windows-side Zip Slip.
  • Bound scope matching per conversion. The extraHttpHeaders match timeout capped one match, not their number. Matching now shares a per-conversion budget, and extraHttpHeaders accepts at most 64 headers with a 1024-character scope.
New Features
  • Authenticated proxy from environment variables. Four opt-in flags route outbound traffic through HTTP_PROXY, HTTPS_PROXY, and NO_PROXY, credentials included: --chromium-enable-environment-proxy, --libreoffice-enable-environment-proxy, --api-download-from-enable-environment-proxy, and --webhook-enable-environment-proxy. All default to false. Breaking: the outbound client no longer inherits HTTP_PROXY and HTTPS_PROXY implicitly.
Bug Fixes
  • LibreOffice returned 400 for server-side failures (#​1588). 400 now requires an implicated client input, nativePageRanges, password, or an unreadable document; everything else is 500. Thanks @​ctunon-align.
  • generateDocumentOutline was a silent no-op (#​1579). It now enables generateTaggedPdf, which Chromium needs to build the outline. Thanks @​paradoxloop.
  • Pinning proxy latched after a Chromium start timeout. Starts are now serialized.
  • LibreOffice leaked a document after a failed export.unoconverter now releases it.
Chore
  • Updated Chromium to 151.0.7922.71.
  • Updated pdfcpu to v0.13.0.
  • Updated unoconverter to v0.4.0.
  • Bumped Go to 1.26.5.
  • Updated Go dependencies.
v8.34.0: 8.34.0
Compare Source
Security Fixes ⚠️
  • Block content linked from untrusted locations in LibreOffice. An uploaded document could reference external (http(s)://) or local (file:///…) resources that LibreOffice resolved during conversion, giving blind SSRF and a limited local-file read. The soffice profile now sets BlockUntrustedRefererLinks, so soffice refuses to load any content a document links. Embedded content is unaffected; documents relying on linked resources no longer render them.
New Features
  • Factur-X / ZUGFeRD metadata (#​1552). Conversions now inject the matching XMP metadata, and the API replaces the single facturx payload with dedicated form fields. Thanks @​fank.
  • Owner-only encryption and permissions. A new ownerPassword, independent of userPassword, plus permission controls restrict what a viewer may do without locking the document open.
  • log-std-level-case (#​1339). New flag to set the level field casing in standard output, lower (default) or upper. Thanks @​Jaben.
Observability
  • Trace enrichment. New process.exec client spans, supervisor queue-wait and launch sub-spans, a Chromium print_to_pdf sub-span, backing-binary versions (Chromium, LibreOffice, qpdf, …) recorded on spans and captured at build time, and per-conversion I/O, network, and size attributes on Chromium and LibreOffice spans.
  • Error classification. Chromium and LibreOffice failures set an error.type from a bounded enum.
  • Richer resource and metrics. Process, OS, host, and container resource detectors, semconv aligned to v1.41.0, a trace-based exemplar filter, and conversions-since-restart and queue-depth gauges.
Bug Fixes
  • CSV conversions leaked the upload's UUID filename as a page header (#​1568). Calc printed the sheet name, which was the UUID-based upload filename, as a centered page header. Now suppressed. Thanks @​vapranav.
  • Webhook async lost trace context. The async delivery goroutine detached from the request context and dropped the trace, breaking span continuity. It now preserves the context via context.WithoutCancel.
  • ca-certificates missing in the chromium-only image. Outbound TLS could fail in the chromium-only build. The package is now installed. Thanks @​osvein.
  • LibreOffice core-dump retries. Retries on ErrCoreDumped are now capped and observable, and the ErrRuntimeException message is corrected.
Chore
  • Updated Chromium to version 149.0.7827.102-1.
  • Updated Go dependencies.
v8.33.0: 8.33.0
Compare Source
Security Fixes ⚠️
  • Block IPv6 prefixes that tunnel to internal IPv4 in IsPublicIP.::ffff:10.0.0.1, 2002:c0a8:: (6to4), and 2001::/32 (Teredo) embed an internal IPv4 destination inside an IPv6 address. IsPublicIP evaluated only the outer IPv6 form, so --*-deny-private-ips filters let the embedded private IPv4 reach the dialer. The check now unwraps IPv4-mapped, IPv4-translated, 6to4, and Teredo addresses, and rejects them when the embedded IPv4 is non-public.
  • Strip backslash separators from supplied filenames. Linux treated a caller-supplied Gotenberg-Output-Filename header or filename form field containing ..\ or foo\bar as a single segment. The handler now strips both forward-slash and backslash path separators before composing the output path.
New Features
  • Device scale ratio for screenshots (#​1543). A new deviceScaleFactor form field on /forms/chromium/screenshot/{html,url,markdown} controls the screenshot pixel density. Defaults to 1. Thanks @​hovcharenko.
Bug Fixes
  • Pinning proxy outlived a failed Chromium start. When chromedp failed to start (port conflict, container OOM, sandbox denial), the loopback HTTP/CONNECT pinning proxy added in 8.32.0 stayed bound to its port and leaked across restart attempts. The browser now stops the pinning proxy on every start failure.
  • Lifecycle listener race on Navigate.chromedp.Navigate could fire Page.lifecycleEvent before Gotenberg's listener subscribed, so the converter occasionally waited the full network-idle timeout on otherwise fast pages. Listeners now register before navigation.
  • Supervisor flapped on transient CDP latency. A single slow CDP health probe marked the supervised process unhealthy and triggered a restart, even when the next probe succeeded. Probes now require N consecutive failures before reporting unhealthy.
  • downloadFrom concurrent map writes. Parallel downloadFrom entries merged results into a shared map without a lock. Under enough concurrency this raced and panicked the request goroutine. Result merging is now serialized.
  • Pinning-proxy noise on client cancellations.context canceled and connection reset by peer from the client side of the pinning proxy logged at error level, flooding logs whenever a caller aborted mid-render. Client-cancelled dial errors now log at debug.
Chore
  • Updated Chromium to version 148.0.7778.178-1.
  • Updated Go dependencies.
v8.32.0: 8.32.0
Compare Source
Security Fixes ⚠️
  • Reverted SSRF defaults (breaking vs 8.31.0). 8.31.0 blocked private-IP destinations by default, which broke deployments running Gotenberg inside a private network. 8.32.0 restores the 8.30.x permissive defaults. Operators with internet-facing APIs opt into the strict posture via the new flags below.
  • Rejected file:// at /forms/chromium/convert/url. Submitting url=file:///tmp/... used to let an unauthenticated caller enumerate the request working directory and read other in-flight uploads as rendered PDFs. The route now returns HTTP 400 for any file:// URL.
  • Required uploaded file for image / pdf stamp and watermark sources. Twelve callsites accepted stampSource=pdf or watermarkSource=pdf with an expression pointing at any path the Gotenberg process could open, even when no file was uploaded. Handlers now return HTTP 400 unless the caller uploaded a matching file.
  • Scoped file:// sub-resources to the request working directory. Crafted HTML could reference another request's file:///tmp/<reqdir>/.... The CDP request handler now restricts file:// sub-resources to the current request's directory. /convert/url and /screenshot/url reject every file:// sub-resource outright.
  • Hardened Chromium against DNS rebinding. A short-TTL DNS authority could return a public IP at validation and a private IP at connect. A loopback HTTP / CONNECT proxy now sits between Chromium and the network, resolves DNS once, and pins the dial to the resolved IP. Skipped when --chromium-proxy-server or --chromium-host-resolver-rules is set.
  • Filtered LibreOffice outbound fetches through a proxy. Uploaded OOXML, RTF, and ODF files can embed external URLs that LibreOffice's libcurl resolves below every Go-side SSRF filter. LibreOffice now routes every outbound fetch through an in-process forward proxy on the same gotenberg.DecideOutbound path Chromium and webhook delivery use. See the four new flags below.
  • Recovered webhook async panics. High-concurrency webhooks could panic the async goroutine and crash the whole process. The goroutine now snapshots the request context and recovers any future panic through the existing error path.
New Features
  • LibreOffice outbound URL filtering. Four flags mirror the Chromium and webhook layout: --libreoffice-allow-list, --libreoffice-deny-list, --libreoffice-deny-private-ips, --libreoffice-deny-public-ips. All default permissive.
  • IP-class filtering on four modules.chromium, webhook, api-download-from, and libreoffice each accept matching deny-private-ips and deny-public-ips flags. All default to false.
FlagWhat it does
--chromium-deny-private-ipsReject Chromium navigations and sub-resources resolving to a non-public IP.
--chromium-deny-public-ipsReject Chromium navigations and sub-resources resolving to a public IP.
--webhook-deny-private-ipsReject webhook URLs (success, error, events) resolving to a non-public IP.
--webhook-deny-public-ipsReject webhook URLs resolving to a public IP.
--api-download-from-deny-private-ipsReject downloadFrom URLs resolving to a non-public IP.
--api-download-from-deny-public-ipsReject downloadFrom URLs resolving to a public IP.
--libreoffice-deny-private-ipsReject LibreOffice outbound fetches resolving to a non-public IP.
--libreoffice-deny-public-ipsReject LibreOffice outbound fetches resolving to a public IP.
A URL matching --*-allow-list skips the IP-class check. A URL matching --*-deny-list is always rejected. Setting both deny-private-ips=true and deny-public-ips=true rejects every URL unless the allow-list matches.
Bug Fixes
  • Charts print as blank rectangles (#​1531, #​1532, #​1534, #​1535): chromedp v0.15.0 suspended the BeginFrame-driven callback dispatch loop under emulatedMediaType=print. requestAnimationFrame, ResizeObserver, IntersectionObserver, CSS transitionend, and CSS animationend all stopped firing. Pinning chromedp back to v0.14.2 restores native dispatch.
  • LibreOffice cached an unrecoverable first-start error (#​1538): A short --libreoffice-start-timeout timed out the first request, then every subsequent request returned the same cached error until the container restarted. The lazy-start path now retries on failure.
Chore
  • Updated pdfcpu to v0.12.0.
  • Switched metadata read/write to direct exiftool invocation. Removes the GPL-3.0 go-exiftool dependency.
  • Bumped Go to 1.26.2.
  • Updated Go dependencies.
Thanks
Thanks to @​Jalliuz (#​1527) for reporting the 8.31.0 sub-resource regression. @​notscottsmith (#​1531), @​spoltix (#​1532), @​rdelott-work (#​1534), and @​sillyas2010 (#​1535) narrowed down the chromedp print-mode regression. @​sillyas2010 also published the reproducer that pinned the bisect. @​JeremyReist2 (#​1536) flagged the go-exiftool GPL-3.0 license. @​doronbehar (#​1537) requested the pdfcpu upgrade. @​mlafon (#​1538) reported the LibreOffice supervisor cached-error bug.
v8.31.0: 8.31.0
Compare Source
Breaking Changes & Security Fixes ⚠️
  • Stopped publishing thecodingmachine/gotenberg images. Pull from gotenberg/gotenberg instead.
  • SSRF hardening (breaking). Resolves outbound URLs (Chromium asset fetches, webhook delivery, download-from) and rejects non-public addresses: loopback, RFC1918, link-local, unspecified, multicast, IPv6 unique-local, IPv4-mapped IPv6. Pins the dial to the validated IP to prevent DNS rebinding.
  • Defaulted webhook deny list (breaking).--webhook-deny-list now defaults to a regex blocking loopback, RFC1918, link-local, and IPv6 unique-local ranges. Override the flag to call internal hosts.
  • Sanitized ExifTool metadata (breaking for System: tags). Strips control characters and line breaks from /forms/pdfengines/metadata/write payloads. Drops System:-prefixed tags. Blocks argument smuggling and filesystem pseudo-tag abuse.
New Features
  • Embed files metadata. Adds embedsMetadata to every route accepting embeds (Chromium HTML/URL/Markdown, LibreOffice convert, PDF Engines merge/split/embed). Pass a JSON object keyed by filename with per-file fields (mimeType, relationship, etc.) - thanks @​Jean-Beru!
Bug Fixes
  • Pinned Chromium to v146 on ppc64le to work around an upstream regression.
Deprecated Flags
OldNew
--webhook-error-allow-list--webhook-allow-list
--webhook-error-deny-list--webhook-deny-list
Old flags still work.
Chore
  • Updated Go dependencies.
v8.30.1: 8.30.1
Compare Source
Another release, another bug fixes 🫥
Bug Fixes
v8.30.0: 8.30.0
Compare Source
New Features
Docker Image Variants
  • Chromium-Only Image (gotenberg/gotenberg:8.30.0-chromium): Drops LibreOffice, python3, and hyphenation packages. ~30% smaller than the full image.
  • LibreOffice-Only Image (gotenberg/gotenberg:8.30.0-libreoffice): Drops Chromium and its dependencies. ~38% smaller than the full image.
Pick the variant that matches your workload. The full image (gotenberg/gotenberg:8.30.0) still ships everything.
Leaner Docker Image
The full image is ~13% smaller than 8.29.0. The font stack was simplified from 30+ packages down to 8, covering Latin, Greek, Cyrillic, CJK, and most world scripts through Noto, plus color emoji.
PackageCoverage
fonts-noto-coreArabic, Bengali, Devanagari, Ethiopic, Georgian, Gujarati, Gurmukhi, Hebrew, Kannada, Khmer, Lao, Malayalam, Myanmar, Sinhala, Tamil, Telugu, Thai, and more
fonts-noto-cjkChinese, Japanese, Korean
fonts-noto-color-emojiColor emoji
fonts-dejavuLatin, Greek, Cyrillic
fonts-crosextra-carlitoMetric-compatible with Calibri
fonts-crosextra-caladeaMetric-compatible with Cambria
fonts-liberationMetric-compatible with Arial, Times New Roman, Courier New
fonts-liberation2Updated Liberation metrics
Microsoft Core Fonts (ttf-mscorefonts-installer) are not shipped due to licensing constraints. The image includes metric-compatible replacements instead: Carlito for Calibri, Caladea for Cambria, and Liberation for Arial, Times New Roman, and Courier New. These preserve document layout in most cases.
Installing Additional Fonts
Build a custom Dockerfile to add fonts. Common scenarios:
Microsoft Core Fonts (you accept the Microsoft EULA):
FROM gotenberg/gotenberg:8
USER root
RUN echo "deb http://deb.debian.org/debian trixie contrib non-free" \
> /etc/apt/sources.list.d/contrib.list \
&& echo "ttf-mscorefonts-installer msttcorefonts/accepted-mscorefonts-eula select true" \
| debconf-set-selections \
&& apt-get update -qq \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
ca-certificates \
wget \
ttf-mscorefonts-installer \
&& rm -rf /var/lib/apt/lists/*
USER gotenberg

Specialized script fonts for richer glyph sets, better hinting, or traditional typefaces beyond the basic Noto coverage:
ScriptPackage
Arabic (Naskh)fonts-hosny-amiri
Bengalifonts-beng
Devanagari (Hindi)fonts-sarai
Ethiopicfonts-sil-abyssinica
Gujaratifonts-samyak-gujr
Gurmukhi (Punjabi)fonts-lohit-guru
Hebrewculmus
Kannadafonts-lohit-knda
Malayalamfonts-samyak-mlym
Myanmarfonts-sil-padauk
Sinhalafonts-lklug-sinhala
Tamilfonts-samyak-taml
Telugufonts-telu
Thaifonts-thai-tlwg
FROM gotenberg/gotenberg:8
USER root
RUN apt-get update -qq \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
fonts-hosny-amiri \
fonts-thai-tlwg \
&& rm -rf /var/lib/apt/lists/*
USER gotenberg

Webhook
  • Gotenberg-Webhook-Error-Url Now Optional: When Gotenberg-Webhook-Events-Url is set, Gotenberg-Webhook-Error-Url is no longer required. Error handling flows through the events URL instead. Gotenberg-Webhook-Error-Url is deprecated but continues to work.
Bug Fixes
  • ExifTool Tag Filtering: Case-insensitive comparison and expanded blocklist for ExifTool metadata filtering. Excludes additional system tags while preserving safe derived tags.
  • Regex Timeout: Added timeout to regex evaluation to prevent ReDoS on malformed patterns.
Chore
  • Updated Go dependencies.
v8.29.1: 8.29.1
Compare Source
Bug Fix (Chromium)
Assets were no longer being correctly loaded in HTML files. This is now fixed. Thanks @​ARawles-GFSC for the heads up!
v8.29.0: 8.29.0
Compare Source
Security Fixes ⚠️
  • ExifTool Arbitrary File Write: The /forms/pdfengines/metadata/write endpoint allowed users to pass FileName and Directory pseudo-tags in the metadata JSON, enabling file rename/move to arbitrary paths. User-supplied metadata is now filtered through a blocklist before being passed to ExifTool.
  • Chromium file:// Sub-Resource Restriction: When converting HTML/Markdown via file://, sub-resources are now restricted to the request's working directory, preventing cross-request file access in /tmp.
New Features
OpenTelemetry
  • Full OpenTelemetry Support: Distributed tracing, metrics export, and structured logging: all configurable via standard OTEL environment variables (OTEL_TRACES_EXPORTER, OTEL_METRICS_EXPORTER, OTEL_LOGS_EXPORTER, OTEL_EXPORTER_OTLP_ENDPOINT, etc.). Every HTTP request gets a span. External tool calls (Chromium, LibreOffice, QPDF, pdfcpu, pdftk, ExifTool, webhook delivery, download-from) create child spans. Trace context is propagated to outbound HTTP calls via W3C headers.
  • Structured Logging Migration: Migrated from custom logging module to slog-based structured logging with OTEL log bridge. Supports auto/JSON/text formats with optional GCP-compatible field names.
  • Binary Path as Peer Service: server.address span attribute uses the actual binary path (e.g., /usr/bin/qpdf) instead of the software name.
  • Telemetry Control for System Routes: New flags to disable telemetry for noisy system routes, all defaulting to disabled: --api-disable-root-route-telemetry, --api-disable-debug-route-telemetry, --api-disable-version-route-telemetry, --prometheus-disable-route-telemetry. The existing --api-disable-health-check-route-telemetry default changed from false to true.
Chromium
  • Idle Shutdown: New --chromium-idle-shutdown-timeout flag (default: 0s, disabled) to automatically stop Chromium after a configurable idle period, reclaiming memory on low-traffic servers. The process re-launches lazily on the next request.
  • Network Almost Idle Event: New skipNetworkAlmostIdleEvent form field (default: true). When set to false, Gotenberg waits for a "network almost idle" event (at most 2 open connections for 500ms) before conversion. This provides a middle ground between the existing skipNetworkIdleEvent (strict, 0 connections) and no wait at all — useful for pages with long-polling or analytics connections that never fully close.
LibreOffice
  • PDF Viewer Preferences (#​1316): 15 new form fields for controlling PDF viewer behavior: initialView, initialPage, magnification, zoom, pageLayout, firstPageOnLeft, resizeWindowToInitialPage, centerWindow, openInFullScreenMode, displayPDFDocumentTitle, hideViewerMenubar, hideViewerToolbar, hideViewerWindowControls, useTransitionEffects, openBookmarkLevels.
  • Idle Shutdown: New --libreoffice-idle-shutdown-timeout flag (default: 0s, disabled), same behavior as Chromium.
Webhook
  • Event Callbacks (#​1473): New optional Gotenberg-Webhook-Events-Url header. When set, structured JSON events (webhook.success, webhook.error) are POSTed after each webhook operation, with correlationId and timestamp. Additive: existing Gotenberg-Webhook-Url and Gotenberg-Webhook-Error-Url continue to work unchanged.
Security & Networking
  • Multiple URL Patterns: All allow/deny list flags (--chromium-allow-list, --chromium-deny-list, --webhook-allow-list, --webhook-deny-list, --webhook-error-allow-list, --webhook-error-deny-list, --api-download-from-allow-list, --api-download-from-deny-list) now accept multiple regex patterns via string slices. Existing single-value configurations continue to work.
Bug Fixes
  • Chromium singlePage Margin Accounting (#​1046): The singlePage option now correctly accounts for top/bottom margins when calculating page height, fixing content overflow on tall pages.
  • Long Filename Support (#​1500): Files with long names (166+ chars, especially with multi-byte UTF-8) no longer cause "File name too long" errors. Files are now stored on disk with UUID-based names while preserving original filenames for HTTP responses, archive entries, and JSON keys.
Deprecated Flags
OldNew
--log-format--log-std-format
--log-enable-gcp-fields--log-std-enable-gcp-fields
--api-trace-header--api-correlation-id-header
--api-disable-health-check-logging--api-disable-health-check-route-telemetry
--prometheus-disable-route-logging--prometheus-disable-route-telemetry
All deprecated flags continue to work.
Chore
  • Replaced go.uber.org/multierr with stdlib errors.Join.
  • Added integration tests for Chromium screenshot routes (HTML, URL, Markdown).
  • Added long filename integration tests across all PDF engine and conversion routes.
  • Integration test retry mechanism: failed scenarios are automatically retried up to 3 times.
  • Bumped actions/checkout to v6 in all GitHub Actions.
Thanks
Thanks to @​dkrizic (#​814) and @​jbdelhommeau (#​1489) for requesting OpenTelemetry/tracing support, @​eht16 (#​1316), @​nh2 (#​1023), @​Frozen666 (#​1046), @​vofflan (#​1500), @​danxmoran (#​1394), and @​janaka (#​1473) for their issue reports and feature requests!
This release represents a significant amount of work: OpenTelemetry integration, security fixes, new features, and hundreds of integration tests. If Gotenberg is useful to you or your team, please consider sponsoring the project. Your support helps keep development going.
v8.28.0: 8.28.0
Compare Source
New Features
PDF Engines
  • Watermark: Added POST /forms/pdfengines/watermark route. Applies a watermark (behind page content) to one or more PDF files. Supports text, image, or pdf sources. Also available as optional form fields on Chromium, LibreOffice, merge, and split routes. Configurable via --pdfengines-watermark-engines (default: pdfcpu,pdftk).
  • Stamp: Added POST /forms/pdfengines/stamp route. Applies a stamp (on top of page content) to one or more PDF files. Same source types and integration points as watermark. Configurable via --pdfengines-stamp-engines (default: pdfcpu,pdftk).
  • Rotate: Added POST /forms/pdfengines/rotate route. Rotates pages by 90°, 180°, or 270° with optional page selection. Also available as optional form fields (rotateAngle, rotatePages) on all composite routes. Configurable via --pdfengines-rotate-engines (default: pdfcpu, pdftk).
  • Bookmarks (Read): Added POST /forms/pdfengines/bookmarks/read route. Returns the hierarchical bookmark outline from one or more PDF files as JSON. Configurable via --pdfengines-read-bookmarks-engines (default: pdfcpu).
  • Bookmarks (Write): Added POST /forms/pdfengines/bookmarks/write route. Accepts either a flat list (applied to all files) or a filename-keyed map. Configurable via --pdfengines-write-bookmarks-engines (default: pdfcpu, pdftk).
  • Merge Bookmark Management: The merge route now supports a bookmarks form field for custom bookmarks with automatic page-offset shifting, and an autoIndexBookmarks option to extract and reindex existing bookmarks from input files.
  • PDF/A & PDF/UA Compliance: Reordered the processing pipeline so that PDF/A and PDF/UA conversion runs after watermark, stamp, and flatten operations. Also reject incompatible combinations (e.g., PDF/A + encryption, PDF/A-1/2 + embeds) with a 400 Bad Request.
LibreOffice
  • Native Watermarks: Added support for LibreOffice's built-in watermark rendering during PDF export via new form fields: nativeWatermarkText, nativeWatermarkColor, nativeWatermarkFontHeight, nativeWatermarkRotateAngle, nativeWatermarkFontName, and nativeTiledWatermarkText.
API
  • Download From: Extended the downloadFrom JSON schema with a field property ("watermark", "stamp", "embedded", or "") to route downloaded files to the appropriate form field bucket. The existing embedded boolean is preserved for backward compatibility.
Chore
  • Updated Chromium to 146.0.7680.153-1.
  • Updated Go dependencies.
v8.27.0: 8.27.0
Compare Source
New Features
Chromium
  • Concurrency Support: Re-introduced support for simultaneous conversions (up to 6 by default). Configurable via CHROMIUM_MAX_CONCURRENCY. Thanks @​TomBrouws!
  • Restart Threshold: Updated the default value for CHROMIUM_RESTART_AFTER to 100.
  • Emulated Media Features: Added the emulatedMediaFeatures form field. This allows users to pass a JSON array to simulate specific CSS media features, such as prefers-color-scheme: dark or prefers-reduced-motion. Thanks @​danxmoran!
Misc
  • Timezone: The default timezone is now explicitly UTC and is visible in the debug route. This remains overridable via th
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
enabled auto-merge (rebase)
September 4, 2023 17:16
@renovaterenovateBot
changed the title
Update actions/checkout action to v4Update actions/checkout action to v4 - autoclosedOct 17, 2023
@renovaterenovateBot
closed this
Oct 17, 2023

auto-merge was automatically disabled
October 17, 2023 18:45
Pull request was closed
@renovate
renovateBot
deleted the

renovate/major-all

branch
October 17, 2023 18:45
@renovaterenovateBot
changed the title
Update actions/checkout action to v4 - autoclosedUpdate actions/checkout action to v4Oct 19, 2023
@renovaterenovateBot
reopened this
Oct 19, 2023
@renovate
renovateBot
restored the

renovate/major-all

branch
October 19, 2023 10:11
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
60d859a to
9658d5dCompareOctober 19, 2023 10:11
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
9658d5d to
62a0b2dCompareJanuary 4, 2024 19:38
@renovaterenovateBot
changed the title
Update actions/checkout action to v4Update all (major)Jan 4, 2024
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
62a0b2d to
9498f21CompareJanuary 8, 2024 17:51
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
9498f21 to
c86f4b8CompareJanuary 18, 2024 14:17
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c86f4b8 to
63de7e6CompareFebruary 7, 2024 15:34
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
ea1d0ec to
8732cdaCompareFebruary 24, 2024 00:57
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
8732cda to
de378adCompareMarch 4, 2024 13:39
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
de378ad to
c176512CompareMarch 15, 2024 19:50
@renovate
renovateBot
enabled auto-merge (rebase)
March 20, 2024 12:18
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c176512 to
4062b81CompareMarch 23, 2024 22:39
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
4062b81 to
5f3ebaeCompareApril 11, 2024 15:26
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
5f3ebae to
0e2d0c7CompareApril 25, 2024 17:30
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
0e2d0c7 to
6bdb4d1CompareMay 22, 2024 11:12
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
6bdb4d1 to
c59cebcCompareJune 4, 2024 18:24
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c59cebc to
6db7d48CompareJune 13, 2024 11:36
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
6db7d48 to
3d6a8f6CompareJuly 3, 2024 19:48
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
3d6a8f6 to
6cbd611CompareJuly 18, 2024 15:25
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
6cbd611 to
9fca9f2CompareJuly 29, 2024 12:37
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
9fca9f2 to
ba5e9a2CompareAugust 11, 2024 15:34
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
ba5e9a2 to
fcbc913CompareSeptember 3, 2024 13:59
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
dbb0041 to
0bd35c8CompareJanuary 30, 2025 01:28
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
9298586 to
03a3172CompareFebruary 12, 2025 19:14
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
9f5c0c3 to
cc92ec4CompareMarch 6, 2025 10:32
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
cc92ec4 to
5c38fa1CompareMarch 17, 2025 17:33
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
9f81659 to
948c2cdCompareApril 2, 2025 14:08
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
8f953be to
42d11a4CompareApril 12, 2025 21:37
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
42d11a4 to
96dc4a9CompareMay 21, 2025 17:27
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
96dc4a9 to
5139460CompareJune 15, 2025 18:36
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
5139460 to
139894cCompareAugust 11, 2025 15:05
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
139894c to
c9514e1CompareAugust 19, 2025 09:26
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c9514e1 to
8258850CompareAugust 31, 2025 17:57
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
4e91d49 to
c92558bCompareOctober 9, 2025 13:32
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
ae4c8d0 to
63e70feCompareNovember 20, 2025 20:54
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
63e70fe to
0588cc6CompareDecember 4, 2025 10:31
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
0588cc6 to
1d473f0CompareJanuary 27, 2026 15:13
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
1d473f0 to
62ee86aCompareFebruary 22, 2026 21:51
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
62ee86a to
cc4d29fCompareMarch 20, 2026 16:56
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
5cf217d to
84667efCompareMarch 30, 2026 20:34
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
e36f3c9 to
80be1f4CompareApril 6, 2026 17:52
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
80be1f4 to
4081637CompareApril 17, 2026 15:13
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Update all (major) - #114
Open
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/major-all
Open
Update all (major)#114
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/major-all
Conversation
@renovate
@renovaterenovateBot
commented
Sep 4, 2023•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageTypeUpdateChange
actions/checkoutactionmajorv3 → v7
gotenberg/gotenbergmajor7.8.2 → 8.36.0
Release Notes
actions/checkout (actions/checkout)
v7.0.1
Compare Source
v7.0.0
Compare Source
v7
Compare Source
v6.1.0
Compare Source
v6.0.3
Compare Source
v6.0.2
Compare Source
v6.0.1
Compare Source
v6.0.0
Compare Source
v6
Compare Source
v5.1.0
Compare Source
v5.0.1
Compare Source
v5.0.0
Compare Source
v5
Compare Source
v4.4.0
Compare Source
v4.3.1
Compare Source
v4.3.0
Compare Source
v4.2.2
Compare Source
v4.2.1
Compare Source
v4.2.0
Compare Source
v4.1.7
Compare Source
v4.1.6
Compare Source
v4.1.5
Compare Source
v4.1.4
Compare Source
v4.1.3
Compare Source
v4.1.2
Compare Source
  • Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in #​1598
v4.1.1
Compare Source
v4.1.0
Compare Source
v4.0.0
Compare Source
v4
Compare Source
gotenberg/gotenberg (gotenberg/gotenberg)
v8.36.0: 8.36.0
Compare Source
Security Fixes ⚠️
  • Filter WebSocket handshakes against the outbound policy. Chromium could open WebSocket connections to hosts the SSRF policy otherwise blocks.
New Features
  • OIDC bearer token authentication. Opt-in via --api-enable-oidc-auth, mutually exclusive with basic auth (#​1341). Thanks @​mlgupta.
  • Optimize PDF images to reduce file size (#​359). A /forms/pdfengines/optimize route, plus an optimizeImages option on the Chromium, LibreOffice, merge, and split routes. Thanks @​spointecker.
  • Apply multiple stamps and watermarks in one request by repeating the fields, on every route that supports them (#​1601). Thanks @​Kobe-Kwanten.
  • Screenshot a single element via the selector form field (#​947). Thanks @​human211.
  • Table-of-contents bookmarks when merging.titleBookmarks adds one bookmark per input, labeled by its title (#​867). Thanks @​gnapse.
  • Clear storage between conversions with --chromium-clear-storage (#​919). Thanks @​befresh-mweimerskirch.
  • Await async waitForExpression. A Promise-returning expression is now awaited (#​1617). Thanks @​nhh.
Bug Fixes
  • Landscape single-page now fits the page to its content (#​1390). Thanks @​JhnBer.
  • Accept the OOXML PowerPoint show extensions.ppsx and .ppsm (#​1626). Thanks @​lyarov22.
  • Client-cancelled requests are classified as 499, not 500 (#​1627). Thanks @​yngvar.
  • Render scrolled workbooks in full for singlePageSheets.
  • Return 403 instead of 500 for an unresolvable outbound host.
  • Hint at --chromium-start-timeout when Chromium fails to start.
Chore
  • Updated pdfcpu to v0.15.0 (#​1628). Thanks @​doronbehar.
  • Bumped golangci-lint to v2.12.2.
  • Updated Go and npm dependencies.
v8.35.0: 8.35.0
Compare Source
Security Fixes ⚠️
  • Sanitize the Gotenberg-Output-Filename header.filepath.Base ignores \ on Linux, so a crafted header reached archive entry names on splitMode conversions, giving a Windows-side Zip Slip.
  • Bound scope matching per conversion. The extraHttpHeaders match timeout capped one match, not their number. Matching now shares a per-conversion budget, and extraHttpHeaders accepts at most 64 headers with a 1024-character scope.
New Features
  • Authenticated proxy from environment variables. Four opt-in flags route outbound traffic through HTTP_PROXY, HTTPS_PROXY, and NO_PROXY, credentials included: --chromium-enable-environment-proxy, --libreoffice-enable-environment-proxy, --api-download-from-enable-environment-proxy, and --webhook-enable-environment-proxy. All default to false. Breaking: the outbound client no longer inherits HTTP_PROXY and HTTPS_PROXY implicitly.
Bug Fixes
  • LibreOffice returned 400 for server-side failures (#​1588). 400 now requires an implicated client input, nativePageRanges, password, or an unreadable document; everything else is 500. Thanks @​ctunon-align.
  • generateDocumentOutline was a silent no-op (#​1579). It now enables generateTaggedPdf, which Chromium needs to build the outline. Thanks @​paradoxloop.
  • Pinning proxy latched after a Chromium start timeout. Starts are now serialized.
  • LibreOffice leaked a document after a failed export.unoconverter now releases it.
Chore
  • Updated Chromium to 151.0.7922.71.
  • Updated pdfcpu to v0.13.0.
  • Updated unoconverter to v0.4.0.
  • Bumped Go to 1.26.5.
  • Updated Go dependencies.
v8.34.0: 8.34.0
Compare Source
Security Fixes ⚠️
  • Block content linked from untrusted locations in LibreOffice. An uploaded document could reference external (http(s)://) or local (file:///…) resources that LibreOffice resolved during conversion, giving blind SSRF and a limited local-file read. The soffice profile now sets BlockUntrustedRefererLinks, so soffice refuses to load any content a document links. Embedded content is unaffected; documents relying on linked resources no longer render them.
New Features
  • Factur-X / ZUGFeRD metadata (#​1552). Conversions now inject the matching XMP metadata, and the API replaces the single facturx payload with dedicated form fields. Thanks @​fank.
  • Owner-only encryption and permissions. A new ownerPassword, independent of userPassword, plus permission controls restrict what a viewer may do without locking the document open.
  • log-std-level-case (#​1339). New flag to set the level field casing in standard output, lower (default) or upper. Thanks @​Jaben.
Observability
  • Trace enrichment. New process.exec client spans, supervisor queue-wait and launch sub-spans, a Chromium print_to_pdf sub-span, backing-binary versions (Chromium, LibreOffice, qpdf, …) recorded on spans and captured at build time, and per-conversion I/O, network, and size attributes on Chromium and LibreOffice spans.
  • Error classification. Chromium and LibreOffice failures set an error.type from a bounded enum.
  • Richer resource and metrics. Process, OS, host, and container resource detectors, semconv aligned to v1.41.0, a trace-based exemplar filter, and conversions-since-restart and queue-depth gauges.
Bug Fixes
  • CSV conversions leaked the upload's UUID filename as a page header (#​1568). Calc printed the sheet name, which was the UUID-based upload filename, as a centered page header. Now suppressed. Thanks @​vapranav.
  • Webhook async lost trace context. The async delivery goroutine detached from the request context and dropped the trace, breaking span continuity. It now preserves the context via context.WithoutCancel.
  • ca-certificates missing in the chromium-only image. Outbound TLS could fail in the chromium-only build. The package is now installed. Thanks @​osvein.
  • LibreOffice core-dump retries. Retries on ErrCoreDumped are now capped and observable, and the ErrRuntimeException message is corrected.
Chore
  • Updated Chromium to version 149.0.7827.102-1.
  • Updated Go dependencies.
v8.33.0: 8.33.0
Compare Source
Security Fixes ⚠️
  • Block IPv6 prefixes that tunnel to internal IPv4 in IsPublicIP.::ffff:10.0.0.1, 2002:c0a8:: (6to4), and 2001::/32 (Teredo) embed an internal IPv4 destination inside an IPv6 address. IsPublicIP evaluated only the outer IPv6 form, so --*-deny-private-ips filters let the embedded private IPv4 reach the dialer. The check now unwraps IPv4-mapped, IPv4-translated, 6to4, and Teredo addresses, and rejects them when the embedded IPv4 is non-public.
  • Strip backslash separators from supplied filenames. Linux treated a caller-supplied Gotenberg-Output-Filename header or filename form field containing ..\ or foo\bar as a single segment. The handler now strips both forward-slash and backslash path separators before composing the output path.
New Features
  • Device scale ratio for screenshots (#​1543). A new deviceScaleFactor form field on /forms/chromium/screenshot/{html,url,markdown} controls the screenshot pixel density. Defaults to 1. Thanks @​hovcharenko.
Bug Fixes
  • Pinning proxy outlived a failed Chromium start. When chromedp failed to start (port conflict, container OOM, sandbox denial), the loopback HTTP/CONNECT pinning proxy added in 8.32.0 stayed bound to its port and leaked across restart attempts. The browser now stops the pinning proxy on every start failure.
  • Lifecycle listener race on Navigate.chromedp.Navigate could fire Page.lifecycleEvent before Gotenberg's listener subscribed, so the converter occasionally waited the full network-idle timeout on otherwise fast pages. Listeners now register before navigation.
  • Supervisor flapped on transient CDP latency. A single slow CDP health probe marked the supervised process unhealthy and triggered a restart, even when the next probe succeeded. Probes now require N consecutive failures before reporting unhealthy.
  • downloadFrom concurrent map writes. Parallel downloadFrom entries merged results into a shared map without a lock. Under enough concurrency this raced and panicked the request goroutine. Result merging is now serialized.
  • Pinning-proxy noise on client cancellations.context canceled and connection reset by peer from the client side of the pinning proxy logged at error level, flooding logs whenever a caller aborted mid-render. Client-cancelled dial errors now log at debug.
Chore
  • Updated Chromium to version 148.0.7778.178-1.
  • Updated Go dependencies.
v8.32.0: 8.32.0
Compare Source
Security Fixes ⚠️
  • Reverted SSRF defaults (breaking vs 8.31.0). 8.31.0 blocked private-IP destinations by default, which broke deployments running Gotenberg inside a private network. 8.32.0 restores the 8.30.x permissive defaults. Operators with internet-facing APIs opt into the strict posture via the new flags below.
  • Rejected file:// at /forms/chromium/convert/url. Submitting url=file:///tmp/... used to let an unauthenticated caller enumerate the request working directory and read other in-flight uploads as rendered PDFs. The route now returns HTTP 400 for any file:// URL.
  • Required uploaded file for image / pdf stamp and watermark sources. Twelve callsites accepted stampSource=pdf or watermarkSource=pdf with an expression pointing at any path the Gotenberg process could open, even when no file was uploaded. Handlers now return HTTP 400 unless the caller uploaded a matching file.
  • Scoped file:// sub-resources to the request working directory. Crafted HTML could reference another request's file:///tmp/<reqdir>/.... The CDP request handler now restricts file:// sub-resources to the current request's directory. /convert/url and /screenshot/url reject every file:// sub-resource outright.
  • Hardened Chromium against DNS rebinding. A short-TTL DNS authority could return a public IP at validation and a private IP at connect. A loopback HTTP / CONNECT proxy now sits between Chromium and the network, resolves DNS once, and pins the dial to the resolved IP. Skipped when --chromium-proxy-server or --chromium-host-resolver-rules is set.
  • Filtered LibreOffice outbound fetches through a proxy. Uploaded OOXML, RTF, and ODF files can embed external URLs that LibreOffice's libcurl resolves below every Go-side SSRF filter. LibreOffice now routes every outbound fetch through an in-process forward proxy on the same gotenberg.DecideOutbound path Chromium and webhook delivery use. See the four new flags below.
  • Recovered webhook async panics. High-concurrency webhooks could panic the async goroutine and crash the whole process. The goroutine now snapshots the request context and recovers any future panic through the existing error path.
New Features
  • LibreOffice outbound URL filtering. Four flags mirror the Chromium and webhook layout: --libreoffice-allow-list, --libreoffice-deny-list, --libreoffice-deny-private-ips, --libreoffice-deny-public-ips. All default permissive.
  • IP-class filtering on four modules.chromium, webhook, api-download-from, and libreoffice each accept matching deny-private-ips and deny-public-ips flags. All default to false.
FlagWhat it does
--chromium-deny-private-ipsReject Chromium navigations and sub-resources resolving to a non-public IP.
--chromium-deny-public-ipsReject Chromium navigations and sub-resources resolving to a public IP.
--webhook-deny-private-ipsReject webhook URLs (success, error, events) resolving to a non-public IP.
--webhook-deny-public-ipsReject webhook URLs resolving to a public IP.
--api-download-from-deny-private-ipsReject downloadFrom URLs resolving to a non-public IP.
--api-download-from-deny-public-ipsReject downloadFrom URLs resolving to a public IP.
--libreoffice-deny-private-ipsReject LibreOffice outbound fetches resolving to a non-public IP.
--libreoffice-deny-public-ipsReject LibreOffice outbound fetches resolving to a public IP.
A URL matching --*-allow-list skips the IP-class check. A URL matching --*-deny-list is always rejected. Setting both deny-private-ips=true and deny-public-ips=true rejects every URL unless the allow-list matches.
Bug Fixes
  • Charts print as blank rectangles (#​1531, #​1532, #​1534, #​1535): chromedp v0.15.0 suspended the BeginFrame-driven callback dispatch loop under emulatedMediaType=print. requestAnimationFrame, ResizeObserver, IntersectionObserver, CSS transitionend, and CSS animationend all stopped firing. Pinning chromedp back to v0.14.2 restores native dispatch.
  • LibreOffice cached an unrecoverable first-start error (#​1538): A short --libreoffice-start-timeout timed out the first request, then every subsequent request returned the same cached error until the container restarted. The lazy-start path now retries on failure.
Chore
  • Updated pdfcpu to v0.12.0.
  • Switched metadata read/write to direct exiftool invocation. Removes the GPL-3.0 go-exiftool dependency.
  • Bumped Go to 1.26.2.
  • Updated Go dependencies.
Thanks
Thanks to @​Jalliuz (#​1527) for reporting the 8.31.0 sub-resource regression. @​notscottsmith (#​1531), @​spoltix (#​1532), @​rdelott-work (#​1534), and @​sillyas2010 (#​1535) narrowed down the chromedp print-mode regression. @​sillyas2010 also published the reproducer that pinned the bisect. @​JeremyReist2 (#​1536) flagged the go-exiftool GPL-3.0 license. @​doronbehar (#​1537) requested the pdfcpu upgrade. @​mlafon (#​1538) reported the LibreOffice supervisor cached-error bug.
v8.31.0: 8.31.0
Compare Source
Breaking Changes & Security Fixes ⚠️
  • Stopped publishing thecodingmachine/gotenberg images. Pull from gotenberg/gotenberg instead.
  • SSRF hardening (breaking). Resolves outbound URLs (Chromium asset fetches, webhook delivery, download-from) and rejects non-public addresses: loopback, RFC1918, link-local, unspecified, multicast, IPv6 unique-local, IPv4-mapped IPv6. Pins the dial to the validated IP to prevent DNS rebinding.
  • Defaulted webhook deny list (breaking).--webhook-deny-list now defaults to a regex blocking loopback, RFC1918, link-local, and IPv6 unique-local ranges. Override the flag to call internal hosts.
  • Sanitized ExifTool metadata (breaking for System: tags). Strips control characters and line breaks from /forms/pdfengines/metadata/write payloads. Drops System:-prefixed tags. Blocks argument smuggling and filesystem pseudo-tag abuse.
New Features
  • Embed files metadata. Adds embedsMetadata to every route accepting embeds (Chromium HTML/URL/Markdown, LibreOffice convert, PDF Engines merge/split/embed). Pass a JSON object keyed by filename with per-file fields (mimeType, relationship, etc.) - thanks @​Jean-Beru!
Bug Fixes
  • Pinned Chromium to v146 on ppc64le to work around an upstream regression.
Deprecated Flags
OldNew
--webhook-error-allow-list--webhook-allow-list
--webhook-error-deny-list--webhook-deny-list
Old flags still work.
Chore
  • Updated Go dependencies.
v8.30.1: 8.30.1
Compare Source
Another release, another bug fixes 🫥
Bug Fixes
v8.30.0: 8.30.0
Compare Source
New Features
Docker Image Variants
  • Chromium-Only Image (gotenberg/gotenberg:8.30.0-chromium): Drops LibreOffice, python3, and hyphenation packages. ~30% smaller than the full image.
  • LibreOffice-Only Image (gotenberg/gotenberg:8.30.0-libreoffice): Drops Chromium and its dependencies. ~38% smaller than the full image.
Pick the variant that matches your workload. The full image (gotenberg/gotenberg:8.30.0) still ships everything.
Leaner Docker Image
The full image is ~13% smaller than 8.29.0. The font stack was simplified from 30+ packages down to 8, covering Latin, Greek, Cyrillic, CJK, and most world scripts through Noto, plus color emoji.
PackageCoverage
fonts-noto-coreArabic, Bengali, Devanagari, Ethiopic, Georgian, Gujarati, Gurmukhi, Hebrew, Kannada, Khmer, Lao, Malayalam, Myanmar, Sinhala, Tamil, Telugu, Thai, and more
fonts-noto-cjkChinese, Japanese, Korean
fonts-noto-color-emojiColor emoji
fonts-dejavuLatin, Greek, Cyrillic
fonts-crosextra-carlitoMetric-compatible with Calibri
fonts-crosextra-caladeaMetric-compatible with Cambria
fonts-liberationMetric-compatible with Arial, Times New Roman, Courier New
fonts-liberation2Updated Liberation metrics
Microsoft Core Fonts (ttf-mscorefonts-installer) are not shipped due to licensing constraints. The image includes metric-compatible replacements instead: Carlito for Calibri, Caladea for Cambria, and Liberation for Arial, Times New Roman, and Courier New. These preserve document layout in most cases.
Installing Additional Fonts
Build a custom Dockerfile to add fonts. Common scenarios:
Microsoft Core Fonts (you accept the Microsoft EULA):
FROM gotenberg/gotenberg:8
USER root
RUN echo "deb http://deb.debian.org/debian trixie contrib non-free" \
> /etc/apt/sources.list.d/contrib.list \
&& echo "ttf-mscorefonts-installer msttcorefonts/accepted-mscorefonts-eula select true" \
| debconf-set-selections \
&& apt-get update -qq \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
ca-certificates \
wget \
ttf-mscorefonts-installer \
&& rm -rf /var/lib/apt/lists/*
USER gotenberg

Specialized script fonts for richer glyph sets, better hinting, or traditional typefaces beyond the basic Noto coverage:
ScriptPackage
Arabic (Naskh)fonts-hosny-amiri
Bengalifonts-beng
Devanagari (Hindi)fonts-sarai
Ethiopicfonts-sil-abyssinica
Gujaratifonts-samyak-gujr
Gurmukhi (Punjabi)fonts-lohit-guru
Hebrewculmus
Kannadafonts-lohit-knda
Malayalamfonts-samyak-mlym
Myanmarfonts-sil-padauk
Sinhalafonts-lklug-sinhala
Tamilfonts-samyak-taml
Telugufonts-telu
Thaifonts-thai-tlwg
FROM gotenberg/gotenberg:8
USER root
RUN apt-get update -qq \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
fonts-hosny-amiri \
fonts-thai-tlwg \
&& rm -rf /var/lib/apt/lists/*
USER gotenberg

Webhook
  • Gotenberg-Webhook-Error-Url Now Optional: When Gotenberg-Webhook-Events-Url is set, Gotenberg-Webhook-Error-Url is no longer required. Error handling flows through the events URL instead. Gotenberg-Webhook-Error-Url is deprecated but continues to work.
Bug Fixes
  • ExifTool Tag Filtering: Case-insensitive comparison and expanded blocklist for ExifTool metadata filtering. Excludes additional system tags while preserving safe derived tags.
  • Regex Timeout: Added timeout to regex evaluation to prevent ReDoS on malformed patterns.
Chore
  • Updated Go dependencies.
v8.29.1: 8.29.1
Compare Source
Bug Fix (Chromium)
Assets were no longer being correctly loaded in HTML files. This is now fixed. Thanks @​ARawles-GFSC for the heads up!
v8.29.0: 8.29.0
Compare Source
Security Fixes ⚠️
  • ExifTool Arbitrary File Write: The /forms/pdfengines/metadata/write endpoint allowed users to pass FileName and Directory pseudo-tags in the metadata JSON, enabling file rename/move to arbitrary paths. User-supplied metadata is now filtered through a blocklist before being passed to ExifTool.
  • Chromium file:// Sub-Resource Restriction: When converting HTML/Markdown via file://, sub-resources are now restricted to the request's working directory, preventing cross-request file access in /tmp.
New Features
OpenTelemetry
  • Full OpenTelemetry Support: Distributed tracing, metrics export, and structured logging: all configurable via standard OTEL environment variables (OTEL_TRACES_EXPORTER, OTEL_METRICS_EXPORTER, OTEL_LOGS_EXPORTER, OTEL_EXPORTER_OTLP_ENDPOINT, etc.). Every HTTP request gets a span. External tool calls (Chromium, LibreOffice, QPDF, pdfcpu, pdftk, ExifTool, webhook delivery, download-from) create child spans. Trace context is propagated to outbound HTTP calls via W3C headers.
  • Structured Logging Migration: Migrated from custom logging module to slog-based structured logging with OTEL log bridge. Supports auto/JSON/text formats with optional GCP-compatible field names.
  • Binary Path as Peer Service: server.address span attribute uses the actual binary path (e.g., /usr/bin/qpdf) instead of the software name.
  • Telemetry Control for System Routes: New flags to disable telemetry for noisy system routes, all defaulting to disabled: --api-disable-root-route-telemetry, --api-disable-debug-route-telemetry, --api-disable-version-route-telemetry, --prometheus-disable-route-telemetry. The existing --api-disable-health-check-route-telemetry default changed from false to true.
Chromium
  • Idle Shutdown: New --chromium-idle-shutdown-timeout flag (default: 0s, disabled) to automatically stop Chromium after a configurable idle period, reclaiming memory on low-traffic servers. The process re-launches lazily on the next request.
  • Network Almost Idle Event: New skipNetworkAlmostIdleEvent form field (default: true). When set to false, Gotenberg waits for a "network almost idle" event (at most 2 open connections for 500ms) before conversion. This provides a middle ground between the existing skipNetworkIdleEvent (strict, 0 connections) and no wait at all — useful for pages with long-polling or analytics connections that never fully close.
LibreOffice
  • PDF Viewer Preferences (#​1316): 15 new form fields for controlling PDF viewer behavior: initialView, initialPage, magnification, zoom, pageLayout, firstPageOnLeft, resizeWindowToInitialPage, centerWindow, openInFullScreenMode, displayPDFDocumentTitle, hideViewerMenubar, hideViewerToolbar, hideViewerWindowControls, useTransitionEffects, openBookmarkLevels.
  • Idle Shutdown: New --libreoffice-idle-shutdown-timeout flag (default: 0s, disabled), same behavior as Chromium.
Webhook
  • Event Callbacks (#​1473): New optional Gotenberg-Webhook-Events-Url header. When set, structured JSON events (webhook.success, webhook.error) are POSTed after each webhook operation, with correlationId and timestamp. Additive: existing Gotenberg-Webhook-Url and Gotenberg-Webhook-Error-Url continue to work unchanged.
Security & Networking
  • Multiple URL Patterns: All allow/deny list flags (--chromium-allow-list, --chromium-deny-list, --webhook-allow-list, --webhook-deny-list, --webhook-error-allow-list, --webhook-error-deny-list, --api-download-from-allow-list, --api-download-from-deny-list) now accept multiple regex patterns via string slices. Existing single-value configurations continue to work.
Bug Fixes
  • Chromium singlePage Margin Accounting (#​1046): The singlePage option now correctly accounts for top/bottom margins when calculating page height, fixing content overflow on tall pages.
  • Long Filename Support (#​1500): Files with long names (166+ chars, especially with multi-byte UTF-8) no longer cause "File name too long" errors. Files are now stored on disk with UUID-based names while preserving original filenames for HTTP responses, archive entries, and JSON keys.
Deprecated Flags
OldNew
--log-format--log-std-format
--log-enable-gcp-fields--log-std-enable-gcp-fields
--api-trace-header--api-correlation-id-header
--api-disable-health-check-logging--api-disable-health-check-route-telemetry
--prometheus-disable-route-logging--prometheus-disable-route-telemetry
All deprecated flags continue to work.
Chore
  • Replaced go.uber.org/multierr with stdlib errors.Join.
  • Added integration tests for Chromium screenshot routes (HTML, URL, Markdown).
  • Added long filename integration tests across all PDF engine and conversion routes.
  • Integration test retry mechanism: failed scenarios are automatically retried up to 3 times.
  • Bumped actions/checkout to v6 in all GitHub Actions.
Thanks
Thanks to @​dkrizic (#​814) and @​jbdelhommeau (#​1489) for requesting OpenTelemetry/tracing support, @​eht16 (#​1316), @​nh2 (#​1023), @​Frozen666 (#​1046), @​vofflan (#​1500), @​danxmoran (#​1394), and @​janaka (#​1473) for their issue reports and feature requests!
This release represents a significant amount of work: OpenTelemetry integration, security fixes, new features, and hundreds of integration tests. If Gotenberg is useful to you or your team, please consider sponsoring the project. Your support helps keep development going.
v8.28.0: 8.28.0
Compare Source
New Features
PDF Engines
  • Watermark: Added POST /forms/pdfengines/watermark route. Applies a watermark (behind page content) to one or more PDF files. Supports text, image, or pdf sources. Also available as optional form fields on Chromium, LibreOffice, merge, and split routes. Configurable via --pdfengines-watermark-engines (default: pdfcpu,pdftk).
  • Stamp: Added POST /forms/pdfengines/stamp route. Applies a stamp (on top of page content) to one or more PDF files. Same source types and integration points as watermark. Configurable via --pdfengines-stamp-engines (default: pdfcpu,pdftk).
  • Rotate: Added POST /forms/pdfengines/rotate route. Rotates pages by 90°, 180°, or 270° with optional page selection. Also available as optional form fields (rotateAngle, rotatePages) on all composite routes. Configurable via --pdfengines-rotate-engines (default: pdfcpu, pdftk).
  • Bookmarks (Read): Added POST /forms/pdfengines/bookmarks/read route. Returns the hierarchical bookmark outline from one or more PDF files as JSON. Configurable via --pdfengines-read-bookmarks-engines (default: pdfcpu).
  • Bookmarks (Write): Added POST /forms/pdfengines/bookmarks/write route. Accepts either a flat list (applied to all files) or a filename-keyed map. Configurable via --pdfengines-write-bookmarks-engines (default: pdfcpu, pdftk).
  • Merge Bookmark Management: The merge route now supports a bookmarks form field for custom bookmarks with automatic page-offset shifting, and an autoIndexBookmarks option to extract and reindex existing bookmarks from input files.
  • PDF/A & PDF/UA Compliance: Reordered the processing pipeline so that PDF/A and PDF/UA conversion runs after watermark, stamp, and flatten operations. Also reject incompatible combinations (e.g., PDF/A + encryption, PDF/A-1/2 + embeds) with a 400 Bad Request.
LibreOffice
  • Native Watermarks: Added support for LibreOffice's built-in watermark rendering during PDF export via new form fields: nativeWatermarkText, nativeWatermarkColor, nativeWatermarkFontHeight, nativeWatermarkRotateAngle, nativeWatermarkFontName, and nativeTiledWatermarkText.
API
  • Download From: Extended the downloadFrom JSON schema with a field property ("watermark", "stamp", "embedded", or "") to route downloaded files to the appropriate form field bucket. The existing embedded boolean is preserved for backward compatibility.
Chore
  • Updated Chromium to 146.0.7680.153-1.
  • Updated Go dependencies.
v8.27.0: 8.27.0
Compare Source
New Features
Chromium
  • Concurrency Support: Re-introduced support for simultaneous conversions (up to 6 by default). Configurable via CHROMIUM_MAX_CONCURRENCY. Thanks @​TomBrouws!
  • Restart Threshold: Updated the default value for CHROMIUM_RESTART_AFTER to 100.
  • Emulated Media Features: Added the emulatedMediaFeatures form field. This allows users to pass a JSON array to simulate specific CSS media features, such as prefers-color-scheme: dark or prefers-reduced-motion. Thanks @​danxmoran!
Misc
  • Timezone: The default timezone is now explicitly UTC and is visible in the debug route. This remains overridable via th
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
enabled auto-merge (rebase)
September 4, 2023 17:16
@renovaterenovateBot
changed the title
Update actions/checkout action to v4Update actions/checkout action to v4 - autoclosedOct 17, 2023
@renovaterenovateBot
closed this
Oct 17, 2023

auto-merge was automatically disabled
October 17, 2023 18:45
Pull request was closed
@renovate
renovateBot
deleted the

renovate/major-all

branch
October 17, 2023 18:45
@renovaterenovateBot
changed the title
Update actions/checkout action to v4 - autoclosedUpdate actions/checkout action to v4Oct 19, 2023
@renovaterenovateBot
reopened this
Oct 19, 2023
@renovate
renovateBot
restored the

renovate/major-all

branch
October 19, 2023 10:11
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
60d859a to
9658d5dCompareOctober 19, 2023 10:11
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
9658d5d to
62a0b2dCompareJanuary 4, 2024 19:38
@renovaterenovateBot
changed the title
Update actions/checkout action to v4Update all (major)Jan 4, 2024
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
62a0b2d to
9498f21CompareJanuary 8, 2024 17:51
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
9498f21 to
c86f4b8CompareJanuary 18, 2024 14:17
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c86f4b8 to
63de7e6CompareFebruary 7, 2024 15:34
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
ea1d0ec to
8732cdaCompareFebruary 24, 2024 00:57
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
8732cda to
de378adCompareMarch 4, 2024 13:39
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
de378ad to
c176512CompareMarch 15, 2024 19:50
@renovate
renovateBot
enabled auto-merge (rebase)
March 20, 2024 12:18
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c176512 to
4062b81CompareMarch 23, 2024 22:39
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
4062b81 to
5f3ebaeCompareApril 11, 2024 15:26
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
5f3ebae to
0e2d0c7CompareApril 25, 2024 17:30
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
0e2d0c7 to
6bdb4d1CompareMay 22, 2024 11:12
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
6bdb4d1 to
c59cebcCompareJune 4, 2024 18:24
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c59cebc to
6db7d48CompareJune 13, 2024 11:36
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
6db7d48 to
3d6a8f6CompareJuly 3, 2024 19:48
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
3d6a8f6 to
6cbd611CompareJuly 18, 2024 15:25
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
6cbd611 to
9fca9f2CompareJuly 29, 2024 12:37
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
9fca9f2 to
ba5e9a2CompareAugust 11, 2024 15:34
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
ba5e9a2 to
fcbc913CompareSeptember 3, 2024 13:59
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
dbb0041 to
0bd35c8CompareJanuary 30, 2025 01:28
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
9298586 to
03a3172CompareFebruary 12, 2025 19:14
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
9f5c0c3 to
cc92ec4CompareMarch 6, 2025 10:32
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
cc92ec4 to
5c38fa1CompareMarch 17, 2025 17:33
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
9f81659 to
948c2cdCompareApril 2, 2025 14:08
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
8f953be to
42d11a4CompareApril 12, 2025 21:37
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
42d11a4 to
96dc4a9CompareMay 21, 2025 17:27
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
96dc4a9 to
5139460CompareJune 15, 2025 18:36
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
5139460 to
139894cCompareAugust 11, 2025 15:05
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
139894c to
c9514e1CompareAugust 19, 2025 09:26
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c9514e1 to
8258850CompareAugust 31, 2025 17:57
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
4e91d49 to
c92558bCompareOctober 9, 2025 13:32
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
ae4c8d0 to
63e70feCompareNovember 20, 2025 20:54
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
63e70fe to
0588cc6CompareDecember 4, 2025 10:31
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
0588cc6 to
1d473f0CompareJanuary 27, 2026 15:13
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
1d473f0 to
62ee86aCompareFebruary 22, 2026 21:51
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
62ee86a to
cc4d29fCompareMarch 20, 2026 16:56
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
5cf217d to
84667efCompareMarch 30, 2026 20:34
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
e36f3c9 to
80be1f4CompareApril 6, 2026 17:52
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
80be1f4 to
4081637CompareApril 17, 2026 15:13
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Update all (major) - #114
Open
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/major-all
Open
Update all (major)#114
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/major-all
Conversation
@renovate
@renovaterenovateBot
commented
Sep 4, 2023•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageTypeUpdateChange
actions/checkoutactionmajorv3 → v7
gotenberg/gotenbergmajor7.8.2 → 8.36.0
Release Notes
actions/checkout (actions/checkout)
v7.0.1
Compare Source
v7.0.0
Compare Source
v7
Compare Source
v6.1.0
Compare Source
v6.0.3
Compare Source
v6.0.2
Compare Source
v6.0.1
Compare Source
v6.0.0
Compare Source
v6
Compare Source
v5.1.0
Compare Source
v5.0.1
Compare Source
v5.0.0
Compare Source
v5
Compare Source
v4.4.0
Compare Source
v4.3.1
Compare Source
v4.3.0
Compare Source
v4.2.2
Compare Source
v4.2.1
Compare Source
v4.2.0
Compare Source
v4.1.7
Compare Source
v4.1.6
Compare Source
v4.1.5
Compare Source
v4.1.4
Compare Source
v4.1.3
Compare Source
v4.1.2
Compare Source
  • Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in #​1598
v4.1.1
Compare Source
v4.1.0
Compare Source
v4.0.0
Compare Source
v4
Compare Source
gotenberg/gotenberg (gotenberg/gotenberg)
v8.36.0: 8.36.0
Compare Source
Security Fixes ⚠️
  • Filter WebSocket handshakes against the outbound policy. Chromium could open WebSocket connections to hosts the SSRF policy otherwise blocks.
New Features
  • OIDC bearer token authentication. Opt-in via --api-enable-oidc-auth, mutually exclusive with basic auth (#​1341). Thanks @​mlgupta.
  • Optimize PDF images to reduce file size (#​359). A /forms/pdfengines/optimize route, plus an optimizeImages option on the Chromium, LibreOffice, merge, and split routes. Thanks @​spointecker.
  • Apply multiple stamps and watermarks in one request by repeating the fields, on every route that supports them (#​1601). Thanks @​Kobe-Kwanten.
  • Screenshot a single element via the selector form field (#​947). Thanks @​human211.
  • Table-of-contents bookmarks when merging.titleBookmarks adds one bookmark per input, labeled by its title (#​867). Thanks @​gnapse.
  • Clear storage between conversions with --chromium-clear-storage (#​919). Thanks @​befresh-mweimerskirch.
  • Await async waitForExpression. A Promise-returning expression is now awaited (#​1617). Thanks @​nhh.
Bug Fixes
  • Landscape single-page now fits the page to its content (#​1390). Thanks @​JhnBer.
  • Accept the OOXML PowerPoint show extensions.ppsx and .ppsm (#​1626). Thanks @​lyarov22.
  • Client-cancelled requests are classified as 499, not 500 (#​1627). Thanks @​yngvar.
  • Render scrolled workbooks in full for singlePageSheets.
  • Return 403 instead of 500 for an unresolvable outbound host.
  • Hint at --chromium-start-timeout when Chromium fails to start.
Chore
  • Updated pdfcpu to v0.15.0 (#​1628). Thanks @​doronbehar.
  • Bumped golangci-lint to v2.12.2.
  • Updated Go and npm dependencies.
v8.35.0: 8.35.0
Compare Source
Security Fixes ⚠️
  • Sanitize the Gotenberg-Output-Filename header.filepath.Base ignores \ on Linux, so a crafted header reached archive entry names on splitMode conversions, giving a Windows-side Zip Slip.
  • Bound scope matching per conversion. The extraHttpHeaders match timeout capped one match, not their number. Matching now shares a per-conversion budget, and extraHttpHeaders accepts at most 64 headers with a 1024-character scope.
New Features
  • Authenticated proxy from environment variables. Four opt-in flags route outbound traffic through HTTP_PROXY, HTTPS_PROXY, and NO_PROXY, credentials included: --chromium-enable-environment-proxy, --libreoffice-enable-environment-proxy, --api-download-from-enable-environment-proxy, and --webhook-enable-environment-proxy. All default to false. Breaking: the outbound client no longer inherits HTTP_PROXY and HTTPS_PROXY implicitly.
Bug Fixes
  • LibreOffice returned 400 for server-side failures (#​1588). 400 now requires an implicated client input, nativePageRanges, password, or an unreadable document; everything else is 500. Thanks @​ctunon-align.
  • generateDocumentOutline was a silent no-op (#​1579). It now enables generateTaggedPdf, which Chromium needs to build the outline. Thanks @​paradoxloop.
  • Pinning proxy latched after a Chromium start timeout. Starts are now serialized.
  • LibreOffice leaked a document after a failed export.unoconverter now releases it.
Chore
  • Updated Chromium to 151.0.7922.71.
  • Updated pdfcpu to v0.13.0.
  • Updated unoconverter to v0.4.0.
  • Bumped Go to 1.26.5.
  • Updated Go dependencies.
v8.34.0: 8.34.0
Compare Source
Security Fixes ⚠️
  • Block content linked from untrusted locations in LibreOffice. An uploaded document could reference external (http(s)://) or local (file:///…) resources that LibreOffice resolved during conversion, giving blind SSRF and a limited local-file read. The soffice profile now sets BlockUntrustedRefererLinks, so soffice refuses to load any content a document links. Embedded content is unaffected; documents relying on linked resources no longer render them.
New Features
  • Factur-X / ZUGFeRD metadata (#​1552). Conversions now inject the matching XMP metadata, and the API replaces the single facturx payload with dedicated form fields. Thanks @​fank.
  • Owner-only encryption and permissions. A new ownerPassword, independent of userPassword, plus permission controls restrict what a viewer may do without locking the document open.
  • log-std-level-case (#​1339). New flag to set the level field casing in standard output, lower (default) or upper. Thanks @​Jaben.
Observability
  • Trace enrichment. New process.exec client spans, supervisor queue-wait and launch sub-spans, a Chromium print_to_pdf sub-span, backing-binary versions (Chromium, LibreOffice, qpdf, …) recorded on spans and captured at build time, and per-conversion I/O, network, and size attributes on Chromium and LibreOffice spans.
  • Error classification. Chromium and LibreOffice failures set an error.type from a bounded enum.
  • Richer resource and metrics. Process, OS, host, and container resource detectors, semconv aligned to v1.41.0, a trace-based exemplar filter, and conversions-since-restart and queue-depth gauges.
Bug Fixes
  • CSV conversions leaked the upload's UUID filename as a page header (#​1568). Calc printed the sheet name, which was the UUID-based upload filename, as a centered page header. Now suppressed. Thanks @​vapranav.
  • Webhook async lost trace context. The async delivery goroutine detached from the request context and dropped the trace, breaking span continuity. It now preserves the context via context.WithoutCancel.
  • ca-certificates missing in the chromium-only image. Outbound TLS could fail in the chromium-only build. The package is now installed. Thanks @​osvein.
  • LibreOffice core-dump retries. Retries on ErrCoreDumped are now capped and observable, and the ErrRuntimeException message is corrected.
Chore
  • Updated Chromium to version 149.0.7827.102-1.
  • Updated Go dependencies.
v8.33.0: 8.33.0
Compare Source
Security Fixes ⚠️
  • Block IPv6 prefixes that tunnel to internal IPv4 in IsPublicIP.::ffff:10.0.0.1, 2002:c0a8:: (6to4), and 2001::/32 (Teredo) embed an internal IPv4 destination inside an IPv6 address. IsPublicIP evaluated only the outer IPv6 form, so --*-deny-private-ips filters let the embedded private IPv4 reach the dialer. The check now unwraps IPv4-mapped, IPv4-translated, 6to4, and Teredo addresses, and rejects them when the embedded IPv4 is non-public.
  • Strip backslash separators from supplied filenames. Linux treated a caller-supplied Gotenberg-Output-Filename header or filename form field containing ..\ or foo\bar as a single segment. The handler now strips both forward-slash and backslash path separators before composing the output path.
New Features
  • Device scale ratio for screenshots (#​1543). A new deviceScaleFactor form field on /forms/chromium/screenshot/{html,url,markdown} controls the screenshot pixel density. Defaults to 1. Thanks @​hovcharenko.
Bug Fixes
  • Pinning proxy outlived a failed Chromium start. When chromedp failed to start (port conflict, container OOM, sandbox denial), the loopback HTTP/CONNECT pinning proxy added in 8.32.0 stayed bound to its port and leaked across restart attempts. The browser now stops the pinning proxy on every start failure.
  • Lifecycle listener race on Navigate.chromedp.Navigate could fire Page.lifecycleEvent before Gotenberg's listener subscribed, so the converter occasionally waited the full network-idle timeout on otherwise fast pages. Listeners now register before navigation.
  • Supervisor flapped on transient CDP latency. A single slow CDP health probe marked the supervised process unhealthy and triggered a restart, even when the next probe succeeded. Probes now require N consecutive failures before reporting unhealthy.
  • downloadFrom concurrent map writes. Parallel downloadFrom entries merged results into a shared map without a lock. Under enough concurrency this raced and panicked the request goroutine. Result merging is now serialized.
  • Pinning-proxy noise on client cancellations.context canceled and connection reset by peer from the client side of the pinning proxy logged at error level, flooding logs whenever a caller aborted mid-render. Client-cancelled dial errors now log at debug.
Chore
  • Updated Chromium to version 148.0.7778.178-1.
  • Updated Go dependencies.
v8.32.0: 8.32.0
Compare Source
Security Fixes ⚠️
  • Reverted SSRF defaults (breaking vs 8.31.0). 8.31.0 blocked private-IP destinations by default, which broke deployments running Gotenberg inside a private network. 8.32.0 restores the 8.30.x permissive defaults. Operators with internet-facing APIs opt into the strict posture via the new flags below.
  • Rejected file:// at /forms/chromium/convert/url. Submitting url=file:///tmp/... used to let an unauthenticated caller enumerate the request working directory and read other in-flight uploads as rendered PDFs. The route now returns HTTP 400 for any file:// URL.
  • Required uploaded file for image / pdf stamp and watermark sources. Twelve callsites accepted stampSource=pdf or watermarkSource=pdf with an expression pointing at any path the Gotenberg process could open, even when no file was uploaded. Handlers now return HTTP 400 unless the caller uploaded a matching file.
  • Scoped file:// sub-resources to the request working directory. Crafted HTML could reference another request's file:///tmp/<reqdir>/.... The CDP request handler now restricts file:// sub-resources to the current request's directory. /convert/url and /screenshot/url reject every file:// sub-resource outright.
  • Hardened Chromium against DNS rebinding. A short-TTL DNS authority could return a public IP at validation and a private IP at connect. A loopback HTTP / CONNECT proxy now sits between Chromium and the network, resolves DNS once, and pins the dial to the resolved IP. Skipped when --chromium-proxy-server or --chromium-host-resolver-rules is set.
  • Filtered LibreOffice outbound fetches through a proxy. Uploaded OOXML, RTF, and ODF files can embed external URLs that LibreOffice's libcurl resolves below every Go-side SSRF filter. LibreOffice now routes every outbound fetch through an in-process forward proxy on the same gotenberg.DecideOutbound path Chromium and webhook delivery use. See the four new flags below.
  • Recovered webhook async panics. High-concurrency webhooks could panic the async goroutine and crash the whole process. The goroutine now snapshots the request context and recovers any future panic through the existing error path.
New Features
  • LibreOffice outbound URL filtering. Four flags mirror the Chromium and webhook layout: --libreoffice-allow-list, --libreoffice-deny-list, --libreoffice-deny-private-ips, --libreoffice-deny-public-ips. All default permissive.
  • IP-class filtering on four modules.chromium, webhook, api-download-from, and libreoffice each accept matching deny-private-ips and deny-public-ips flags. All default to false.
FlagWhat it does
--chromium-deny-private-ipsReject Chromium navigations and sub-resources resolving to a non-public IP.
--chromium-deny-public-ipsReject Chromium navigations and sub-resources resolving to a public IP.
--webhook-deny-private-ipsReject webhook URLs (success, error, events) resolving to a non-public IP.
--webhook-deny-public-ipsReject webhook URLs resolving to a public IP.
--api-download-from-deny-private-ipsReject downloadFrom URLs resolving to a non-public IP.
--api-download-from-deny-public-ipsReject downloadFrom URLs resolving to a public IP.
--libreoffice-deny-private-ipsReject LibreOffice outbound fetches resolving to a non-public IP.
--libreoffice-deny-public-ipsReject LibreOffice outbound fetches resolving to a public IP.
A URL matching --*-allow-list skips the IP-class check. A URL matching --*-deny-list is always rejected. Setting both deny-private-ips=true and deny-public-ips=true rejects every URL unless the allow-list matches.
Bug Fixes
  • Charts print as blank rectangles (#​1531, #​1532, #​1534, #​1535): chromedp v0.15.0 suspended the BeginFrame-driven callback dispatch loop under emulatedMediaType=print. requestAnimationFrame, ResizeObserver, IntersectionObserver, CSS transitionend, and CSS animationend all stopped firing. Pinning chromedp back to v0.14.2 restores native dispatch.
  • LibreOffice cached an unrecoverable first-start error (#​1538): A short --libreoffice-start-timeout timed out the first request, then every subsequent request returned the same cached error until the container restarted. The lazy-start path now retries on failure.
Chore
  • Updated pdfcpu to v0.12.0.
  • Switched metadata read/write to direct exiftool invocation. Removes the GPL-3.0 go-exiftool dependency.
  • Bumped Go to 1.26.2.
  • Updated Go dependencies.
Thanks
Thanks to @​Jalliuz (#​1527) for reporting the 8.31.0 sub-resource regression. @​notscottsmith (#​1531), @​spoltix (#​1532), @​rdelott-work (#​1534), and @​sillyas2010 (#​1535) narrowed down the chromedp print-mode regression. @​sillyas2010 also published the reproducer that pinned the bisect. @​JeremyReist2 (#​1536) flagged the go-exiftool GPL-3.0 license. @​doronbehar (#​1537) requested the pdfcpu upgrade. @​mlafon (#​1538) reported the LibreOffice supervisor cached-error bug.
v8.31.0: 8.31.0
Compare Source
Breaking Changes & Security Fixes ⚠️
  • Stopped publishing thecodingmachine/gotenberg images. Pull from gotenberg/gotenberg instead.
  • SSRF hardening (breaking). Resolves outbound URLs (Chromium asset fetches, webhook delivery, download-from) and rejects non-public addresses: loopback, RFC1918, link-local, unspecified, multicast, IPv6 unique-local, IPv4-mapped IPv6. Pins the dial to the validated IP to prevent DNS rebinding.
  • Defaulted webhook deny list (breaking).--webhook-deny-list now defaults to a regex blocking loopback, RFC1918, link-local, and IPv6 unique-local ranges. Override the flag to call internal hosts.
  • Sanitized ExifTool metadata (breaking for System: tags). Strips control characters and line breaks from /forms/pdfengines/metadata/write payloads. Drops System:-prefixed tags. Blocks argument smuggling and filesystem pseudo-tag abuse.
New Features
  • Embed files metadata. Adds embedsMetadata to every route accepting embeds (Chromium HTML/URL/Markdown, LibreOffice convert, PDF Engines merge/split/embed). Pass a JSON object keyed by filename with per-file fields (mimeType, relationship, etc.) - thanks @​Jean-Beru!
Bug Fixes
  • Pinned Chromium to v146 on ppc64le to work around an upstream regression.
Deprecated Flags
OldNew
--webhook-error-allow-list--webhook-allow-list
--webhook-error-deny-list--webhook-deny-list
Old flags still work.
Chore
  • Updated Go dependencies.
v8.30.1: 8.30.1
Compare Source
Another release, another bug fixes 🫥
Bug Fixes
v8.30.0: 8.30.0
Compare Source
New Features
Docker Image Variants
  • Chromium-Only Image (gotenberg/gotenberg:8.30.0-chromium): Drops LibreOffice, python3, and hyphenation packages. ~30% smaller than the full image.
  • LibreOffice-Only Image (gotenberg/gotenberg:8.30.0-libreoffice): Drops Chromium and its dependencies. ~38% smaller than the full image.
Pick the variant that matches your workload. The full image (gotenberg/gotenberg:8.30.0) still ships everything.
Leaner Docker Image
The full image is ~13% smaller than 8.29.0. The font stack was simplified from 30+ packages down to 8, covering Latin, Greek, Cyrillic, CJK, and most world scripts through Noto, plus color emoji.
PackageCoverage
fonts-noto-coreArabic, Bengali, Devanagari, Ethiopic, Georgian, Gujarati, Gurmukhi, Hebrew, Kannada, Khmer, Lao, Malayalam, Myanmar, Sinhala, Tamil, Telugu, Thai, and more
fonts-noto-cjkChinese, Japanese, Korean
fonts-noto-color-emojiColor emoji
fonts-dejavuLatin, Greek, Cyrillic
fonts-crosextra-carlitoMetric-compatible with Calibri
fonts-crosextra-caladeaMetric-compatible with Cambria
fonts-liberationMetric-compatible with Arial, Times New Roman, Courier New
fonts-liberation2Updated Liberation metrics
Microsoft Core Fonts (ttf-mscorefonts-installer) are not shipped due to licensing constraints. The image includes metric-compatible replacements instead: Carlito for Calibri, Caladea for Cambria, and Liberation for Arial, Times New Roman, and Courier New. These preserve document layout in most cases.
Installing Additional Fonts
Build a custom Dockerfile to add fonts. Common scenarios:
Microsoft Core Fonts (you accept the Microsoft EULA):
FROM gotenberg/gotenberg:8
USER root
RUN echo "deb http://deb.debian.org/debian trixie contrib non-free" \
> /etc/apt/sources.list.d/contrib.list \
&& echo "ttf-mscorefonts-installer msttcorefonts/accepted-mscorefonts-eula select true" \
| debconf-set-selections \
&& apt-get update -qq \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
ca-certificates \
wget \
ttf-mscorefonts-installer \
&& rm -rf /var/lib/apt/lists/*
USER gotenberg

Specialized script fonts for richer glyph sets, better hinting, or traditional typefaces beyond the basic Noto coverage:
ScriptPackage
Arabic (Naskh)fonts-hosny-amiri
Bengalifonts-beng
Devanagari (Hindi)fonts-sarai
Ethiopicfonts-sil-abyssinica
Gujaratifonts-samyak-gujr
Gurmukhi (Punjabi)fonts-lohit-guru
Hebrewculmus
Kannadafonts-lohit-knda
Malayalamfonts-samyak-mlym
Myanmarfonts-sil-padauk
Sinhalafonts-lklug-sinhala
Tamilfonts-samyak-taml
Telugufonts-telu
Thaifonts-thai-tlwg
FROM gotenberg/gotenberg:8
USER root
RUN apt-get update -qq \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
fonts-hosny-amiri \
fonts-thai-tlwg \
&& rm -rf /var/lib/apt/lists/*
USER gotenberg

Webhook
  • Gotenberg-Webhook-Error-Url Now Optional: When Gotenberg-Webhook-Events-Url is set, Gotenberg-Webhook-Error-Url is no longer required. Error handling flows through the events URL instead. Gotenberg-Webhook-Error-Url is deprecated but continues to work.
Bug Fixes
  • ExifTool Tag Filtering: Case-insensitive comparison and expanded blocklist for ExifTool metadata filtering. Excludes additional system tags while preserving safe derived tags.
  • Regex Timeout: Added timeout to regex evaluation to prevent ReDoS on malformed patterns.
Chore
  • Updated Go dependencies.
v8.29.1: 8.29.1
Compare Source
Bug Fix (Chromium)
Assets were no longer being correctly loaded in HTML files. This is now fixed. Thanks @​ARawles-GFSC for the heads up!
v8.29.0: 8.29.0
Compare Source
Security Fixes ⚠️
  • ExifTool Arbitrary File Write: The /forms/pdfengines/metadata/write endpoint allowed users to pass FileName and Directory pseudo-tags in the metadata JSON, enabling file rename/move to arbitrary paths. User-supplied metadata is now filtered through a blocklist before being passed to ExifTool.
  • Chromium file:// Sub-Resource Restriction: When converting HTML/Markdown via file://, sub-resources are now restricted to the request's working directory, preventing cross-request file access in /tmp.
New Features
OpenTelemetry
  • Full OpenTelemetry Support: Distributed tracing, metrics export, and structured logging: all configurable via standard OTEL environment variables (OTEL_TRACES_EXPORTER, OTEL_METRICS_EXPORTER, OTEL_LOGS_EXPORTER, OTEL_EXPORTER_OTLP_ENDPOINT, etc.). Every HTTP request gets a span. External tool calls (Chromium, LibreOffice, QPDF, pdfcpu, pdftk, ExifTool, webhook delivery, download-from) create child spans. Trace context is propagated to outbound HTTP calls via W3C headers.
  • Structured Logging Migration: Migrated from custom logging module to slog-based structured logging with OTEL log bridge. Supports auto/JSON/text formats with optional GCP-compatible field names.
  • Binary Path as Peer Service: server.address span attribute uses the actual binary path (e.g., /usr/bin/qpdf) instead of the software name.
  • Telemetry Control for System Routes: New flags to disable telemetry for noisy system routes, all defaulting to disabled: --api-disable-root-route-telemetry, --api-disable-debug-route-telemetry, --api-disable-version-route-telemetry, --prometheus-disable-route-telemetry. The existing --api-disable-health-check-route-telemetry default changed from false to true.
Chromium
  • Idle Shutdown: New --chromium-idle-shutdown-timeout flag (default: 0s, disabled) to automatically stop Chromium after a configurable idle period, reclaiming memory on low-traffic servers. The process re-launches lazily on the next request.
  • Network Almost Idle Event: New skipNetworkAlmostIdleEvent form field (default: true). When set to false, Gotenberg waits for a "network almost idle" event (at most 2 open connections for 500ms) before conversion. This provides a middle ground between the existing skipNetworkIdleEvent (strict, 0 connections) and no wait at all — useful for pages with long-polling or analytics connections that never fully close.
LibreOffice
  • PDF Viewer Preferences (#​1316): 15 new form fields for controlling PDF viewer behavior: initialView, initialPage, magnification, zoom, pageLayout, firstPageOnLeft, resizeWindowToInitialPage, centerWindow, openInFullScreenMode, displayPDFDocumentTitle, hideViewerMenubar, hideViewerToolbar, hideViewerWindowControls, useTransitionEffects, openBookmarkLevels.
  • Idle Shutdown: New --libreoffice-idle-shutdown-timeout flag (default: 0s, disabled), same behavior as Chromium.
Webhook
  • Event Callbacks (#​1473): New optional Gotenberg-Webhook-Events-Url header. When set, structured JSON events (webhook.success, webhook.error) are POSTed after each webhook operation, with correlationId and timestamp. Additive: existing Gotenberg-Webhook-Url and Gotenberg-Webhook-Error-Url continue to work unchanged.
Security & Networking
  • Multiple URL Patterns: All allow/deny list flags (--chromium-allow-list, --chromium-deny-list, --webhook-allow-list, --webhook-deny-list, --webhook-error-allow-list, --webhook-error-deny-list, --api-download-from-allow-list, --api-download-from-deny-list) now accept multiple regex patterns via string slices. Existing single-value configurations continue to work.
Bug Fixes
  • Chromium singlePage Margin Accounting (#​1046): The singlePage option now correctly accounts for top/bottom margins when calculating page height, fixing content overflow on tall pages.
  • Long Filename Support (#​1500): Files with long names (166+ chars, especially with multi-byte UTF-8) no longer cause "File name too long" errors. Files are now stored on disk with UUID-based names while preserving original filenames for HTTP responses, archive entries, and JSON keys.
Deprecated Flags
OldNew
--log-format--log-std-format
--log-enable-gcp-fields--log-std-enable-gcp-fields
--api-trace-header--api-correlation-id-header
--api-disable-health-check-logging--api-disable-health-check-route-telemetry
--prometheus-disable-route-logging--prometheus-disable-route-telemetry
All deprecated flags continue to work.
Chore
  • Replaced go.uber.org/multierr with stdlib errors.Join.
  • Added integration tests for Chromium screenshot routes (HTML, URL, Markdown).
  • Added long filename integration tests across all PDF engine and conversion routes.
  • Integration test retry mechanism: failed scenarios are automatically retried up to 3 times.
  • Bumped actions/checkout to v6 in all GitHub Actions.
Thanks
Thanks to @​dkrizic (#​814) and @​jbdelhommeau (#​1489) for requesting OpenTelemetry/tracing support, @​eht16 (#​1316), @​nh2 (#​1023), @​Frozen666 (#​1046), @​vofflan (#​1500), @​danxmoran (#​1394), and @​janaka (#​1473) for their issue reports and feature requests!
This release represents a significant amount of work: OpenTelemetry integration, security fixes, new features, and hundreds of integration tests. If Gotenberg is useful to you or your team, please consider sponsoring the project. Your support helps keep development going.
v8.28.0: 8.28.0
Compare Source
New Features
PDF Engines
  • Watermark: Added POST /forms/pdfengines/watermark route. Applies a watermark (behind page content) to one or more PDF files. Supports text, image, or pdf sources. Also available as optional form fields on Chromium, LibreOffice, merge, and split routes. Configurable via --pdfengines-watermark-engines (default: pdfcpu,pdftk).
  • Stamp: Added POST /forms/pdfengines/stamp route. Applies a stamp (on top of page content) to one or more PDF files. Same source types and integration points as watermark. Configurable via --pdfengines-stamp-engines (default: pdfcpu,pdftk).
  • Rotate: Added POST /forms/pdfengines/rotate route. Rotates pages by 90°, 180°, or 270° with optional page selection. Also available as optional form fields (rotateAngle, rotatePages) on all composite routes. Configurable via --pdfengines-rotate-engines (default: pdfcpu, pdftk).
  • Bookmarks (Read): Added POST /forms/pdfengines/bookmarks/read route. Returns the hierarchical bookmark outline from one or more PDF files as JSON. Configurable via --pdfengines-read-bookmarks-engines (default: pdfcpu).
  • Bookmarks (Write): Added POST /forms/pdfengines/bookmarks/write route. Accepts either a flat list (applied to all files) or a filename-keyed map. Configurable via --pdfengines-write-bookmarks-engines (default: pdfcpu, pdftk).
  • Merge Bookmark Management: The merge route now supports a bookmarks form field for custom bookmarks with automatic page-offset shifting, and an autoIndexBookmarks option to extract and reindex existing bookmarks from input files.
  • PDF/A & PDF/UA Compliance: Reordered the processing pipeline so that PDF/A and PDF/UA conversion runs after watermark, stamp, and flatten operations. Also reject incompatible combinations (e.g., PDF/A + encryption, PDF/A-1/2 + embeds) with a 400 Bad Request.
LibreOffice
  • Native Watermarks: Added support for LibreOffice's built-in watermark rendering during PDF export via new form fields: nativeWatermarkText, nativeWatermarkColor, nativeWatermarkFontHeight, nativeWatermarkRotateAngle, nativeWatermarkFontName, and nativeTiledWatermarkText.
API
  • Download From: Extended the downloadFrom JSON schema with a field property ("watermark", "stamp", "embedded", or "") to route downloaded files to the appropriate form field bucket. The existing embedded boolean is preserved for backward compatibility.
Chore
  • Updated Chromium to 146.0.7680.153-1.
  • Updated Go dependencies.
v8.27.0: 8.27.0
Compare Source
New Features
Chromium
  • Concurrency Support: Re-introduced support for simultaneous conversions (up to 6 by default). Configurable via CHROMIUM_MAX_CONCURRENCY. Thanks @​TomBrouws!
  • Restart Threshold: Updated the default value for CHROMIUM_RESTART_AFTER to 100.
  • Emulated Media Features: Added the emulatedMediaFeatures form field. This allows users to pass a JSON array to simulate specific CSS media features, such as prefers-color-scheme: dark or prefers-reduced-motion. Thanks @​danxmoran!
Misc
  • Timezone: The default timezone is now explicitly UTC and is visible in the debug route. This remains overridable via th
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
enabled auto-merge (rebase)
September 4, 2023 17:16
@renovaterenovateBot
changed the title
Update actions/checkout action to v4Update actions/checkout action to v4 - autoclosedOct 17, 2023
@renovaterenovateBot
closed this
Oct 17, 2023

auto-merge was automatically disabled
October 17, 2023 18:45
Pull request was closed
@renovate
renovateBot
deleted the

renovate/major-all

branch
October 17, 2023 18:45
@renovaterenovateBot
changed the title
Update actions/checkout action to v4 - autoclosedUpdate actions/checkout action to v4Oct 19, 2023
@renovaterenovateBot
reopened this
Oct 19, 2023
@renovate
renovateBot
restored the

renovate/major-all

branch
October 19, 2023 10:11
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
60d859a to
9658d5dCompareOctober 19, 2023 10:11
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
9658d5d to
62a0b2dCompareJanuary 4, 2024 19:38
@renovaterenovateBot
changed the title
Update actions/checkout action to v4Update all (major)Jan 4, 2024
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
62a0b2d to
9498f21CompareJanuary 8, 2024 17:51
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
9498f21 to
c86f4b8CompareJanuary 18, 2024 14:17
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c86f4b8 to
63de7e6CompareFebruary 7, 2024 15:34
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
ea1d0ec to
8732cdaCompareFebruary 24, 2024 00:57
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
8732cda to
de378adCompareMarch 4, 2024 13:39
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
de378ad to
c176512CompareMarch 15, 2024 19:50
@renovate
renovateBot
enabled auto-merge (rebase)
March 20, 2024 12:18
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c176512 to
4062b81CompareMarch 23, 2024 22:39
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
4062b81 to
5f3ebaeCompareApril 11, 2024 15:26
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
5f3ebae to
0e2d0c7CompareApril 25, 2024 17:30
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
0e2d0c7 to
6bdb4d1CompareMay 22, 2024 11:12
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
6bdb4d1 to
c59cebcCompareJune 4, 2024 18:24
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c59cebc to
6db7d48CompareJune 13, 2024 11:36
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
6db7d48 to
3d6a8f6CompareJuly 3, 2024 19:48
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
3d6a8f6 to
6cbd611CompareJuly 18, 2024 15:25
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
6cbd611 to
9fca9f2CompareJuly 29, 2024 12:37
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
9fca9f2 to
ba5e9a2CompareAugust 11, 2024 15:34
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
ba5e9a2 to
fcbc913CompareSeptember 3, 2024 13:59
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
dbb0041 to
0bd35c8CompareJanuary 30, 2025 01:28
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
9298586 to
03a3172CompareFebruary 12, 2025 19:14
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
9f5c0c3 to
cc92ec4CompareMarch 6, 2025 10:32
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
cc92ec4 to
5c38fa1CompareMarch 17, 2025 17:33
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
9f81659 to
948c2cdCompareApril 2, 2025 14:08
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
8f953be to
42d11a4CompareApril 12, 2025 21:37
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
42d11a4 to
96dc4a9CompareMay 21, 2025 17:27
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
96dc4a9 to
5139460CompareJune 15, 2025 18:36
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
5139460 to
139894cCompareAugust 11, 2025 15:05
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
139894c to
c9514e1CompareAugust 19, 2025 09:26
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
c9514e1 to
8258850CompareAugust 31, 2025 17:57
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
4e91d49 to
c92558bCompareOctober 9, 2025 13:32
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
ae4c8d0 to
63e70feCompareNovember 20, 2025 20:54
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
63e70fe to
0588cc6CompareDecember 4, 2025 10:31
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
0588cc6 to
1d473f0CompareJanuary 27, 2026 15:13
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
1d473f0 to
62ee86aCompareFebruary 22, 2026 21:51
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
62ee86a to
cc4d29fCompareMarch 20, 2026 16:56
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
5cf217d to
84667efCompareMarch 30, 2026 20:34
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
2 times, most recently
from
e36f3c9 to
80be1f4CompareApril 6, 2026 17:52
@renovate
renovateBotforce-pushed
the
renovate/major-all
branch
from
80be1f4 to
4081637CompareApril 17, 2026 15:13
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants