fix(chromium): fail fast with 503 when Chromium crashes by Haseeb-1698 · Pull Request #1641 · gotenberg/gotenberg

Haseeb-1698 · 2026-08-28T06:36:53Z

When the renderer crashes mid-conversion, the in-flight CDP command never receives a response, so the request hangs until the API deadline and surfaces as a generic timeout. This listens for Inspector.targetCrashed and maps it to an explicit 503 through the existing sentinel-error path.

A dead browser context after a failed run is treated the same way. That check is gated on runErr != nil, so a successful conversion is never discarded by a browser death landing just after it.

Verification

Same request (url=chrome://crash, CHROMIUM_ALLOW_LIST='.+'), before and after:

Build	Result
`main`	30.01s — 503, generic request-timeout body
This PR	0.56s — 503, crash body

The service recovers normally: the next conversion returns 200 with a valid PDF in 0.12s.

chrome://crash is a deterministic renderer-crash simulation on x86_64. I could not reproduce the reporter's arm64/AVIF trigger, but Inspector.targetCrashed is trigger-agnostic, so the detection path is the same.

Tests

routes_test.go — 503 mapping for the new sentinel error
errortype_test.go — added the taxonomy case
Integration scenario driving a real renderer crash and asserting the 503 and the crash body

make fmt, golangci-lint v2.12.2 (0 issues), go test -race ./pkg/modules/chromium/..., and the integration scenario all pass locally. No API routes were added or changed — only error mapping inside the existing handler — so the Bruno collection is unchanged.

Notes

This targets main (v8). I noticed #1487 reworks this module for Gotenberg 9 — happy to port the same change there as well if that would be useful.

It also touches chromium.go and routes.go, which #1639 modifies; glad to rebase if that lands first.

When the Chromium renderer crashes mid-conversion, the in-flight CDP command never receives a response and the request hangs until the API timeout, surfacing as a generic timeout 503. Listen for the Inspector.targetCrashed event (chromedp enables the Inspector domain on every target but does not handle this event), record the crash, and cancel the task context so the conversion aborts immediately. Also treat a dead browser context after a failed run as a crash. Map the crash to a 503 with a dedicated message. See gotenberg#1640.

Haseeb-1698 · 2026-08-28T13:45:39Z

CI caught a flaky assertion of mine on linux/ppc64le. I had asserted the response completes within 10s; under QEMU emulation Chromium's cold start alone pushes the request to ~13s, so it failed there. Every functional assertion passed on that architecture — 503, Content-Type, and the crash body — and all other jobs were green, including lint and unit tests.

I've removed the wall-clock assertion and the scenario.go step that backed it. The body assertion already proves the behaviour: Chromium crashed while processing the request can only come from the new path, since before this change the request fell through to the API timeout and returned a different message. That also takes scenario.go out of the diff entirely — now 7 files, +154/−0.

The before/after timing evidence stays in the description above.

gulien · 2026-08-31T14:48:29Z

Thanks!

… 8.37.0) (#2080) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [docker.io/gotenberg/gotenberg](https://github.com/gotenberg/gotenberg) | minor | `8.36.0` → `8.37.0` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/567) for more information. --- ### Release Notes <details> <summary>gotenberg/gotenberg (docker.io/gotenberg/gotenberg)</summary> ### [`v8.37.0`](https://github.com/gotenberg/gotenberg/releases/tag/v8.37.0): 8.37.0 [Compare Source](gotenberg/gotenberg@v8.36.0...v8.37.0) ##### Security Fixes ⚠️ - **Strip URL userinfo before allow-list and deny-list matching.** The regexes saw the credentials, so `http://[email protected]/` satisfied an allow-list anchored on `trusted\.example\.com` and skipped the IP checks, and `http://[email protected]/` slipped past a deny-list anchored on `127\.`. - **Treat CGNAT and benchmarking ranges as non-public.** `100.64.0.0/10`, where Alibaba Cloud serves instance metadata, and `198.18.0.0/15` passed the `*_DENY_PRIVATE_IPS` checks. - **Reject metadata keys that collide with ExifTool options.** An unprefixed key such as `csv` or `o` reached ExifTool as a command-line option, not a tag. Such keys now return `400`; prefix them with a group, for example `XMP:csv`. - **Validate qpdf split spans.** qpdf read a span that is not a page range as another source file and appended its pages to the output. It now rejects such spans and the engine chain moves on. - **Keep redirect verdicts generic.** A `downloadFrom` redirect blocked by the outbound policy answered `400` with the allow-list, deny-list, or IP policy in the message. It now gets the same generic `403` as a blocked first hop. - **Bound what a hostile page or origin can hold.** Chromium's CONNECT tunnels close after 2 minutes of silence and cap at 512 in flight. `downloadFrom` fetches honor the request deadline, webhook deliveries get their own budget, retries included, and a remote `Retry-After` can no longer exceed the configured maximum wait. ##### New Features - **Process a request's PDF files concurrently.** `--pdfengines-max-concurrency` bounds how many files the per-file features (metadata, encryption, stamps, watermarks, flattening, and more) process at once, across all requests. The default `1` keeps the sequential behavior; raise it to trade memory for speed on multi-file requests. LibreOffice is not affected: scale containers instead. - **`downloadFrom` limits.** `--api-download-from-max-concurrency` bounds the fetches in flight per request, `10` by default (previously unbounded). `--api-download-from-max-entries` caps the array size, `0` (no limit) by default. - **Startup warnings for risky configurations.** Gotenberg now warns about allow-list patterns that match more than intended (unanchored, catch-all, or with an unterminated host), since a match skips the IP checks, and about `--api-enable-debug-route` without authentication. Nothing fails to start. ##### Bug Fixes - **Health check failed during planned restarts** ([#1648](gotenberg/gotenberg#1648)). A probe between two conversions got `503` while `--chromium-restart-after` or `--libreoffice-restart-after` recycled the process. Planned restarts now report healthy; unplanned ones still don't. Thanks [@adq-talbot](https://github.com/adq-talbot). - **DOCX math formulas were silently dropped** ([#1644](gotenberg/gotenberg#1644)). The 8.30.0 image slimming removed `libreoffice-math`; it's back ([#1645](gotenberg/gotenberg#1645)). Thanks [@joh-klein](https://github.com/joh-klein). - **Chromium crashes hung until the request timeout** ([#1640](gotenberg/gotenberg#1640)). A renderer crash now fails fast with `503` ([#1641](gotenberg/gotenberg#1641)). Thanks [@cqjjjzr](https://github.com/cqjjjzr) and [@Haseeb-1698](https://github.com/Haseeb-1698). - **About 75 MB extra per Chromium browser** ([#1656](gotenberg/gotenberg#1656)). Recent Chromium builds preload the WebUI omnibox popup at start, headless included. Gotenberg now disables it. Thanks [@carma-codebase](https://github.com/carma-codebase). - **Telemetry exported without an exporter configured** ([#1643](gotenberg/gotenberg#1643)). An unset `OTEL_*_EXPORTER` fell back to OTLP on `localhost` and kept retrying. Each signal now stays off until its variable is set, as documented. Thanks [@SuperSandro2000](https://github.com/SuperSandro2000). - **Encrypted `.xlsb` returned `500`** ([#1655](gotenberg/gotenberg#1655)). It now returns `400` pointing at the `password` form field. Thanks [@MaxFreedomPollard](https://github.com/MaxFreedomPollard). - **Uploads sharing a filename lost all but one file.** Duplicates are now kept as `name (2).ext`, in upload order. Very long extensions and a best-effort symlink step no longer fail the request with `500`. - **Async conversions could pick up another request's `Gotenberg-Output-Filename`.** The header is now read before Echo recycles the request context. - **Resource leaks.** Webhook callbacks answering `4xx` leaked a connection, a failed LibreOffice start leaked its outbound proxy, and Chromium's per-conversion network map kept every settled request. ##### Chore - Updated Chromium to `152.0.7977.82`. - Updated LibreOffice to `26.8.0`. - Updated `unoconverter` to `v0.5.0`, which drops the `distutils` dependency. - Bumped Go to `1.27.1`. - Bumped golangci-lint to `v2.13.2`. - Minor performance improvements in outbound filtering, access logging, and Chromium event handling. - Updated Go dependencies. </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/2080

@adq-talbot

##### [\`8.37.0\`](https://github.com/gotenberg/gotenberg/releases/tag/v8.37.0) #### Security Fixes ⚠️ - **Strip URL userinfo before allow-list and deny-list matching.** The regexes saw the credentials, so `http://[email protected]/` satisfied an allow-list anchored on `trusted\.example\.com` and skipped the IP checks, and `http://[email protected]/` slipped past a deny-list anchored on `127\.`. - **Treat CGNAT and benchmarking ranges as non-public.** `100.64.0.0/10`, where Alibaba Cloud serves instance metadata, and `198.18.0.0/15` passed the `*_DENY_PRIVATE_IPS` checks. - **Reject metadata keys that collide with ExifTool options.** An unprefixed key such as `csv` or `o` reached ExifTool as a command-line option, not a tag. Such keys now return `400`; prefix them with a group, for example `XMP:csv`. - **Validate qpdf split spans.** qpdf read a span that is not a page range as another source file and appended its pages to the output. It now rejects such spans and the engine chain moves on. - **Keep redirect verdicts generic.** A `downloadFrom` redirect blocked by the outbound policy answered `400` with the allow-list, deny-list, or IP policy in the message. It now gets the same generic `403` as a blocked first hop. - **Bound what a hostile page or origin can hold.** Chromium's CONNECT tunnels close after 2 minutes of silence and cap at 512 in flight. `downloadFrom` fetches honor the request deadline, webhook deliveries get their own budget, retries included, and a remote `Retry-After` can no longer exceed the configured maximum wait. #### New Features - **Process a request's PDF files concurrently.** `--pdfengines-max-concurrency` bounds how many files the per-file features (metadata, encryption, stamps, watermarks, flattening, and more) process at once, across all requests. The default `1` keeps the sequential behavior; raise it to trade memory for speed on multi-file requests. LibreOffice is not affected: scale containers instead. - **`downloadFrom` limits.** `--api-download-from-max-concurrency` bounds the fetches in flight per request, `10` by default (previously unbounded). `--api-download-from-max-entries` caps the array size, `0` (no limit) by default. - **Startup warnings for risky configurations.** Gotenberg now warns about allow-list patterns that match more than intended (unanchored, catch-all, or with an unterminated host), since a match skips the IP checks, and about `--api-enable-debug-route` without authentication. Nothing fails to start. #### Bug Fixes - **Health check failed during planned restarts** ([#1648](gotenberg/gotenberg#1648)). A probe between two conversions got `503` while `--chromium-restart-after` or `--libreoffice-restart-after` recycled the process. Planned restarts now report healthy; unplanned ones still don't. Thanks [@adq-talbot](https://github.com/adq-talbot). - **DOCX math formulas were silently dropped** ([#1644](gotenberg/gotenberg#1644)). The 8.30.0 image slimming removed `libreoffice-math`; it's back ([#1645](gotenberg/gotenberg#1645)). Thanks [@joh-klein](https://github.com/joh-klein). - **Chromium crashes hung until the request timeout** ([#1640](gotenberg/gotenberg#1640)). A renderer crash now fails fast with `503` ([#1641](gotenberg/gotenberg#1641)). Thanks [@cqjjjzr](https://github.com/cqjjjzr) and [@Haseeb-1698](https://github.com/Haseeb-1698). - **About 75 MB extra per Chromium browser** ([#1656](gotenberg/gotenberg#1656)). Recent Chromium builds preload the WebUI omnibox popup at start, headless included. Gotenberg now disables it. Thanks [@carma-codebase](https://github.com/carma-codebase). - **Telemetry exported without an exporter configured** ([#1643](gotenberg/gotenberg#1643)). An unset `OTEL_*_EXPORTER` fell back to OTLP on `localhost` and kept retrying. Each signal now stays off until its variable is set, as documented. Thanks [@SuperSandro2000](https://github.com/SuperSandro2000). - **Encrypted `.xlsb` returned `500`** ([#1655](gotenberg/gotenberg#1655)). It now returns `400` pointing at the `password` form field. Thanks [@MaxFreedomPollard](https://github.com/MaxFreedomPollard). - **Uploads sharing a filename lost all but one file.** Duplicates are now kept as `name (2).ext`, in upload order. Very long extensions and a best-effort symlink step no longer fail the request with `500`. - **Async conversions could pick up another request's `Gotenberg-Output-Filename`.** The header is now read before Echo recycles the request context. - **Resource leaks.** Webhook callbacks answering `4xx` leaked a connection, a failed LibreOffice start leaked its outbound proxy, and Chromium's per-conversion network map kept every settled request. #### Chore - Updated Chromium to `152.0.7977.82`. - Updated LibreOffice to `26.8.0`. - Updated `unoconverter` to `v0.5.0`, which drops the `distutils` dependency. - Bumped Go to `1.27.1`. - Bumped golangci-lint to `v2.13.2`. - Minor performance improvements in outbound filtering, access logging, and Chromium event handling. - Updated Go dependencies.

@adq-talbot

##### [\`8.37.0\`](https://github.com/gotenberg/gotenberg/releases/tag/v8.37.0) #### Security Fixes ⚠️ - **Strip URL userinfo before allow-list and deny-list matching.** The regexes saw the credentials, so `http://[email protected]/` satisfied an allow-list anchored on `trusted\.example\.com` and skipped the IP checks, and `http://[email protected]/` slipped past a deny-list anchored on `127\.`. - **Treat CGNAT and benchmarking ranges as non-public.** `100.64.0.0/10`, where Alibaba Cloud serves instance metadata, and `198.18.0.0/15` passed the `*_DENY_PRIVATE_IPS` checks. - **Reject metadata keys that collide with ExifTool options.** An unprefixed key such as `csv` or `o` reached ExifTool as a command-line option, not a tag. Such keys now return `400`; prefix them with a group, for example `XMP:csv`. - **Validate qpdf split spans.** qpdf read a span that is not a page range as another source file and appended its pages to the output. It now rejects such spans and the engine chain moves on. - **Keep redirect verdicts generic.** A `downloadFrom` redirect blocked by the outbound policy answered `400` with the allow-list, deny-list, or IP policy in the message. It now gets the same generic `403` as a blocked first hop. - **Bound what a hostile page or origin can hold.** Chromium's CONNECT tunnels close after 2 minutes of silence and cap at 512 in flight. `downloadFrom` fetches honor the request deadline, webhook deliveries get their own budget, retries included, and a remote `Retry-After` can no longer exceed the configured maximum wait. #### New Features - **Process a request's PDF files concurrently.** `--pdfengines-max-concurrency` bounds how many files the per-file features (metadata, encryption, stamps, watermarks, flattening, and more) process at once, across all requests. The default `1` keeps the sequential behavior; raise it to trade memory for speed on multi-file requests. LibreOffice is not affected: scale containers instead. - **`downloadFrom` limits.** `--api-download-from-max-concurrency` bounds the fetches in flight per request, `10` by default (previously unbounded). `--api-download-from-max-entries` caps the array size, `0` (no limit) by default. - **Startup warnings for risky configurations.** Gotenberg now warns about allow-list patterns that match more than intended (unanchored, catch-all, or with an unterminated host), since a match skips the IP checks, and about `--api-enable-debug-route` without authentication. Nothing fails to start. #### Bug Fixes - **Health check failed during planned restarts** ([#1648](gotenberg/gotenberg#1648)). A probe between two conversions got `503` while `--chromium-restart-after` or `--libreoffice-restart-after` recycled the process. Planned restarts now report healthy; unplanned ones still don't. Thanks [@adq-talbot](https://github.com/adq-talbot). - **DOCX math formulas were silently dropped** ([#1644](gotenberg/gotenberg#1644)). The 8.30.0 image slimming removed `libreoffice-math`; it's back ([#1645](gotenberg/gotenberg#1645)). Thanks [@joh-klein](https://github.com/joh-klein). - **Chromium crashes hung until the request timeout** ([#1640](gotenberg/gotenberg#1640)). A renderer crash now fails fast with `503` ([#1641](gotenberg/gotenberg#1641)). Thanks [@cqjjjzr](https://github.com/cqjjjzr) and [@Haseeb-1698](https://github.com/Haseeb-1698). - **About 75 MB extra per Chromium browser** ([#1656](gotenberg/gotenberg#1656)). Recent Chromium builds preload the WebUI omnibox popup at start, headless included. Gotenberg now disables it. Thanks [@carma-codebase](https://github.com/carma-codebase). - **Telemetry exported without an exporter configured** ([#1643](gotenberg/gotenberg#1643)). An unset `OTEL_*_EXPORTER` fell back to OTLP on `localhost` and kept retrying. Each signal now stays off until its variable is set, as documented. Thanks [@SuperSandro2000](https://github.com/SuperSandro2000). - **Encrypted `.xlsb` returned `500`** ([#1655](gotenberg/gotenberg#1655)). It now returns `400` pointing at the `password` form field. Thanks [@MaxFreedomPollard](https://github.com/MaxFreedomPollard). - **Uploads sharing a filename lost all but one file.** Duplicates are now kept as `name (2).ext`, in upload order. Very long extensions and a best-effort symlink step no longer fail the request with `500`. - **Async conversions could pick up another request's `Gotenberg-Output-Filename`.** The header is now read before Echo recycles the request context. - **Resource leaks.** Webhook callbacks answering `4xx` leaked a connection, a failed LibreOffice start leaked its outbound proxy, and Chromium's per-conversion network map kept every settled request. #### Chore - Updated Chromium to `152.0.7977.82`. - Updated LibreOffice to `26.8.0`. - Updated `unoconverter` to `v0.5.0`, which drops the `distutils` dependency. - Bumped Go to `1.27.1`. - Bumped golangci-lint to `v2.13.2`. - Minor performance improvements in outbound filtering, access logging, and Chromium event handling. - Updated Go dependencies.

@adq-talbot

##### [\`8.37.0\`](https://github.com/gotenberg/gotenberg/releases/tag/v8.37.0) #### Security Fixes ⚠️ - **Strip URL userinfo before allow-list and deny-list matching.** The regexes saw the credentials, so `http://[email protected]/` satisfied an allow-list anchored on `trusted\.example\.com` and skipped the IP checks, and `http://[email protected]/` slipped past a deny-list anchored on `127\.`. - **Treat CGNAT and benchmarking ranges as non-public.** `100.64.0.0/10`, where Alibaba Cloud serves instance metadata, and `198.18.0.0/15` passed the `*_DENY_PRIVATE_IPS` checks. - **Reject metadata keys that collide with ExifTool options.** An unprefixed key such as `csv` or `o` reached ExifTool as a command-line option, not a tag. Such keys now return `400`; prefix them with a group, for example `XMP:csv`. - **Validate qpdf split spans.** qpdf read a span that is not a page range as another source file and appended its pages to the output. It now rejects such spans and the engine chain moves on. - **Keep redirect verdicts generic.** A `downloadFrom` redirect blocked by the outbound policy answered `400` with the allow-list, deny-list, or IP policy in the message. It now gets the same generic `403` as a blocked first hop. - **Bound what a hostile page or origin can hold.** Chromium's CONNECT tunnels close after 2 minutes of silence and cap at 512 in flight. `downloadFrom` fetches honor the request deadline, webhook deliveries get their own budget, retries included, and a remote `Retry-After` can no longer exceed the configured maximum wait. #### New Features - **Process a request's PDF files concurrently.** `--pdfengines-max-concurrency` bounds how many files the per-file features (metadata, encryption, stamps, watermarks, flattening, and more) process at once, across all requests. The default `1` keeps the sequential behavior; raise it to trade memory for speed on multi-file requests. LibreOffice is not affected: scale containers instead. - **`downloadFrom` limits.** `--api-download-from-max-concurrency` bounds the fetches in flight per request, `10` by default (previously unbounded). `--api-download-from-max-entries` caps the array size, `0` (no limit) by default. - **Startup warnings for risky configurations.** Gotenberg now warns about allow-list patterns that match more than intended (unanchored, catch-all, or with an unterminated host), since a match skips the IP checks, and about `--api-enable-debug-route` without authentication. Nothing fails to start. #### Bug Fixes - **Health check failed during planned restarts** ([#1648](gotenberg/gotenberg#1648)). A probe between two conversions got `503` while `--chromium-restart-after` or `--libreoffice-restart-after` recycled the process. Planned restarts now report healthy; unplanned ones still don't. Thanks [@adq-talbot](https://github.com/adq-talbot). - **DOCX math formulas were silently dropped** ([#1644](gotenberg/gotenberg#1644)). The 8.30.0 image slimming removed `libreoffice-math`; it's back ([#1645](gotenberg/gotenberg#1645)). Thanks [@joh-klein](https://github.com/joh-klein). - **Chromium crashes hung until the request timeout** ([#1640](gotenberg/gotenberg#1640)). A renderer crash now fails fast with `503` ([#1641](gotenberg/gotenberg#1641)). Thanks [@cqjjjzr](https://github.com/cqjjjzr) and [@Haseeb-1698](https://github.com/Haseeb-1698). - **About 75 MB extra per Chromium browser** ([#1656](gotenberg/gotenberg#1656)). Recent Chromium builds preload the WebUI omnibox popup at start, headless included. Gotenberg now disables it. Thanks [@carma-codebase](https://github.com/carma-codebase). - **Telemetry exported without an exporter configured** ([#1643](gotenberg/gotenberg#1643)). An unset `OTEL_*_EXPORTER` fell back to OTLP on `localhost` and kept retrying. Each signal now stays off until its variable is set, as documented. Thanks [@SuperSandro2000](https://github.com/SuperSandro2000). - **Encrypted `.xlsb` returned `500`** ([#1655](gotenberg/gotenberg#1655)). It now returns `400` pointing at the `password` form field. Thanks [@MaxFreedomPollard](https://github.com/MaxFreedomPollard). - **Uploads sharing a filename lost all but one file.** Duplicates are now kept as `name (2).ext`, in upload order. Very long extensions and a best-effort symlink step no longer fail the request with `500`. - **Async conversions could pick up another request's `Gotenberg-Output-Filename`.** The header is now read before Echo recycles the request context. - **Resource leaks.** Webhook callbacks answering `4xx` leaked a connection, a failed LibreOffice start leaked its outbound proxy, and Chromium's per-conversion network map kept every settled request. #### Chore - Updated Chromium to `152.0.7977.82`. - Updated LibreOffice to `26.8.0`. - Updated `unoconverter` to `v0.5.0`, which drops the `distutils` dependency. - Bumped Go to `1.27.1`. - Bumped golangci-lint to `v2.13.2`. - Minor performance improvements in outbound filtering, access logging, and Chromium event handling. - Updated Go dependencies.

…598) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [gotenberg/gotenberg](https://github.com/gotenberg/gotenberg) | minor | `8.36.0` → `8.37.0` | --- ### Release Notes <details> <summary>gotenberg/gotenberg (gotenberg/gotenberg)</summary> ### [`v8.37.0`](https://github.com/gotenberg/gotenberg/releases/tag/v8.37.0): 8.37.0 [Compare Source](gotenberg/gotenberg@v8.36.0...v8.37.0) ##### Security Fixes ⚠️ - **Strip URL userinfo before allow-list and deny-list matching.** The regexes saw the credentials, so `http://[email protected]/` satisfied an allow-list anchored on `trusted\.example\.com` and skipped the IP checks, and `http://[email protected]/` slipped past a deny-list anchored on `127\.`. - **Treat CGNAT and benchmarking ranges as non-public.** `100.64.0.0/10`, where Alibaba Cloud serves instance metadata, and `198.18.0.0/15` passed the `*_DENY_PRIVATE_IPS` checks. - **Reject metadata keys that collide with ExifTool options.** An unprefixed key such as `csv` or `o` reached ExifTool as a command-line option, not a tag. Such keys now return `400`; prefix them with a group, for example `XMP:csv`. - **Validate qpdf split spans.** qpdf read a span that is not a page range as another source file and appended its pages to the output. It now rejects such spans and the engine chain moves on. - **Keep redirect verdicts generic.** A `downloadFrom` redirect blocked by the outbound policy answered `400` with the allow-list, deny-list, or IP policy in the message. It now gets the same generic `403` as a blocked first hop. - **Bound what a hostile page or origin can hold.** Chromium's CONNECT tunnels close after 2 minutes of silence and cap at 512 in flight. `downloadFrom` fetches honor the request deadline, webhook deliveries get their own budget, retries included, and a remote `Retry-After` can no longer exceed the configured maximum wait. ##### New Features - **Process a request's PDF files concurrently.** `--pdfengines-max-concurrency` bounds how many files the per-file features (metadata, encryption, stamps, watermarks, flattening, and more) process at once, across all requests. The default `1` keeps the sequential behavior; raise it to trade memory for speed on multi-file requests. LibreOffice is not affected: scale containers instead. - **`downloadFrom` limits.** `--api-download-from-max-concurrency` bounds the fetches in flight per request, `10` by default (previously unbounded). `--api-download-from-max-entries` caps the array size, `0` (no limit) by default. - **Startup warnings for risky configurations.** Gotenberg now warns about allow-list patterns that match more than intended (unanchored, catch-all, or with an unterminated host), since a match skips the IP checks, and about `--api-enable-debug-route` without authentication. Nothing fails to start. ##### Bug Fixes - **Health check failed during planned restarts** ([#1648](gotenberg/gotenberg#1648)). A probe between two conversions got `503` while `--chromium-restart-after` or `--libreoffice-restart-after` recycled the process. Planned restarts now report healthy; unplanned ones still don't. Thanks [@adq-talbot](https://github.com/adq-talbot). - **DOCX math formulas were silently dropped** ([#1644](gotenberg/gotenberg#1644)). The 8.30.0 image slimming removed `libreoffice-math`; it's back ([#1645](gotenberg/gotenberg#1645)). Thanks [@joh-klein](https://github.com/joh-klein). - **Chromium crashes hung until the request timeout** ([#1640](gotenberg/gotenberg#1640)). A renderer crash now fails fast with `503` ([#1641](gotenberg/gotenberg#1641)). Thanks [@cqjjjzr](https://github.com/cqjjjzr) and [@Haseeb-1698](https://github.com/Haseeb-1698). - **About 75 MB extra per Chromium browser** ([#1656](gotenberg/gotenberg#1656)). Recent Chromium builds preload the WebUI omnibox popup at start, headless included. Gotenberg now disables it. Thanks [@carma-codebase](https://github.com/carma-codebase). - **Telemetry exported without an exporter configured** ([#1643](gotenberg/gotenberg#1643)). An unset `OTEL_*_EXPORTER` fell back to OTLP on `localhost` and kept retrying. Each signal now stays off until its variable is set, as documented. Thanks [@SuperSandro2000](https://github.com/SuperSandro2000). - **Encrypted `.xlsb` returned `500`** ([#1655](gotenberg/gotenberg#1655)). It now returns `400` pointing at the `password` form field. Thanks [@MaxFreedomPollard](https://github.com/MaxFreedomPollard). - **Uploads sharing a filename lost all but one file.** Duplicates are now kept as `name (2).ext`, in upload order. Very long extensions and a best-effort symlink step no longer fail the request with `500`. - **Async conversions could pick up another request's `Gotenberg-Output-Filename`.** The header is now read before Echo recycles the request context. - **Resource leaks.** Webhook callbacks answering `4xx` leaked a connection, a failed LibreOffice start leaked its outbound proxy, and Chromium's per-conversion network map kept every settled request. ##### Chore - Updated Chromium to `152.0.7977.82`. - Updated LibreOffice to `26.8.0`. - Updated `unoconverter` to `v0.5.0`, which drops the `distutils` dependency. - Bumped Go to `1.27.1`. - Bumped golangci-lint to `v2.13.2`. - Minor performance improvements in outbound filtering, access logging, and Chromium event handling. - Updated Go dependencies. </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.hayden.moe/hayden/phoebe/pulls/598

* fix(Dockerfile): reposition COPY intructions to prevent cache invalidation * fix(regex): add timeout * docs(test/integration/README.md): add missing scenarios * docs: improve godoc and documentation [skip ci] * docs(README): add PDFBolt as sponsor [ci skip] * fix(Dockerfile): re-add cURL * fix(chromium): set PDFENGINES_CONVERT_ENGINES to empty on chromium only variants * test(integration): increase timeout to 90min * fix(exitool): prevent control characters * fix: better denied list * chore(deps): update Go dependencies * Revert "test(integration): increase timeout to 90min" This reverts commit f1d1215. * ci(ppc64le): switch to ubuntu-24.04-ppc64le-p10 * Revert "ci(ppc64le): switch to ubuntu-24.04-ppc64le-p10" This reverts commit 866ae53. * chore(deps): update Go dependencies * chore(deps-dev): update package-lock.json * fix(outboundURLs): better detaults * fix(exiftool): prevent line breaks * fix(exiftool): remove System: prefixes * chore(deps): update Go dependencies * docs: more succint [skip ci] * fix(Dockefile): pin Chromium to version 146 on ppc64le arch * ci: remove thecodingmachine registry * chore(deps-dev): bump prettier from 3.8.1 to 3.8.2 Bumps [prettier](https://github.com/prettier/prettier) from 3.8.1 to 3.8.2. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.8.1...3.8.2) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.8.2 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * feat: add embeds metadata * docs(CONTRIBUTING.md): remove do not push instruction [skip ci] * chore(deps-dev): bump prettier from 3.8.2 to 3.8.3 Bumps [prettier](https://github.com/prettier/prettier) from 3.8.2 to 3.8.3. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.8.2...3.8.3) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.8.3 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github.com/dlclark/regexp2 from 1.11.5 to 1.12.0 Bumps [github.com/dlclark/regexp2](https://github.com/dlclark/regexp2) from 1.11.5 to 1.12.0. - [Commits](dlclark/regexp2@v1.11.5...v1.12.0) --- updated-dependencies: - dependency-name: github.com/dlclark/regexp2 dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github.com/labstack/gommon from 0.4.2 to 0.5.0 Bumps [github.com/labstack/gommon](https://github.com/labstack/gommon) from 0.4.2 to 0.5.0. - [Release notes](https://github.com/labstack/gommon/releases) - [Commits](labstack/gommon@v0.4.2...v0.5.0) --- updated-dependencies: - dependency-name: github.com/labstack/gommon dependency-version: 0.5.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(npm): restrict npm installs + package bumps for a week (try to prevent 0-days from upstream dependency changes) * fix(chromium): harden outbound URL handling * fix(pdfengines): require uploaded stamp/watermark file for image or pdf source * fix(webhook): detach async goroutine from pooled echo.Context * fix(chromium): default-deny file:// sub-resources when no prefix is allowed * fix(outbound)!: per-module deny-private-ips and deny-public-ips, permissive defaults * fix(test): deny-private-ips on scenario now uses http://127.0.0.1/ as the URL * feat(chromium): skip lifecycle waits when waitForExpression or waitForSelector is set * Revert "feat(chromium): skip lifecycle waits when waitForExpression or waitForSelector is set" This reverts commit 430f95f. * feat(chromium): inject paint-callback polyfill when waitForExpression or waitForSelector is set * docs(chromium): tighten paint-polyfill godoc per CONTRIBUTING style [skip ci] * fix(testdata): prettify * feat(chromium): always inject paint-callback polyfill to cover waitDelay users * docs(chromium): tighten paint-polyfill always-on godoc per CONTRIBUTING style * refactor(exiftool): switch from go-exiftool library to direct CLI * fix(supervisor): retry first launch on failure (gotenberg#1538) * feat(libreoffice): SSRF guard for embedded external content * fix(deps): pin chromedp to v0.14.2 to restore print-mode paint pipeline * refactor(chromium): drop paint-callback polyfill now that chromedp is pinned * chore(deps): update pdfcpu to v0.12.0 (gotenberg#1537) * docs(contributing): reorganize sections and slim PR checklist * chore(deps): update golang to 1.26.2 * feat(chromium): allow to specify device scale ratio for screenshots (gotenberg#1543) * fix(api): strip backslash separators from supplied filenames * chore(deps): bump github.com/labstack/echo/v4 from 4.15.1 to 4.15.2 Bumps [github.com/labstack/echo/v4](https://github.com/labstack/echo) from 4.15.1 to 4.15.2. - [Release notes](https://github.com/labstack/echo/releases) - [Changelog](https://github.com/labstack/echo/blob/v4.15.2/CHANGELOG.md) - [Commits](labstack/echo@v4.15.1...v4.15.2) --- updated-dependencies: - dependency-name: github.com/labstack/echo/v4 dependency-version: 4.15.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * fix(gotenberg): block IPv6 prefixes that tunnel to internal IPv4 in IsPublicIP * fix(api): serialize downloadFrom result merging to avoid concurrent map writes * docs(README): switch logo URL [skip ci] * fix(chromium): downgrade pinning-proxy logs for client-cancelled requests * fix(chromium): register lifecycle listeners before navigate to close race * fix(chromium): stop pinning proxy when chromedp start fails * docs(README): add FileToPDF.dev sponsor * fix(gotenberg): debounce supervisor health probes to absorb transient CDP latency * fix(chromium): downgrade pinning-proxy dial logs for client-cancelled requests * chore(deps): update Go dependencies * test(integration): prune orphaned networks to avoid subnet exhaustion * fix(otel): align resource semconv to v1.41.0 to match SDK default * test(integration): surface container logs on failed startup * refactor(webhook): extract async context detach into a helper * fix(webhook): preserve trace context across async detach via WithoutCancel * feat(webhook): link async worker span to the originating request span * test(webhook): assert async conversion span shares server trace id * test(webhook): integration smoke for async webhook traceparent continuity * feat(gotenberg): wrap Cmd.Exec in a process.exec client span * feat(gotenberg): add ClassifyError with bounded error.type enum * refactor(chromium): classify Pdf and Screenshot errors and set span error.type * refactor(libreoffice): classify Pdf errors and set span error.type * test(otel): guard OTEL_TRACES_SAMPLER is honored * feat(otel): pin trace-based exemplar filter on the meter provider * feat(gotenberg): add telemetry attribute helpers for redaction and capping * docs(otel): document sampling configuration and tail-sampling guidance * refactor(otel): extract shared buildResource helper * feat(otel): enrich resource with process, os, host, and container detectors * feat(otel): emit gotenberg.startup span with engine versions * feat(gotenberg): add ConversionsSinceRestart accessor to ProcessSupervisor * refactor(gotenberg): thread engine label into NewProcessSupervisor * feat(gotenberg): emit queue-wait and launch sub-spans in supervisor Run * feat(chromium): lift conversions-since-restart and queue depth onto chromium spans * feat(libreoffice): lift conversions-since-restart and queue depth onto libreoffice span * feat(api): add FileCount accessor to request Context * feat(chromium): add conversion I/O attributes to chromium.Pdf span * feat(chromium): add print_to_pdf sub-span with bounded option attrs * feat(chromium): add per-conversion network observability with metrics and exemplars * feat(libreoffice): add conversion size and requested pdf-format span attributes * feat(libreoffice): cap ErrCoreDumped retries and make them observable * refactor(pdfengines): route fallback ops through a generic runWithFallback helper * style: apply gofmt modernization fixes * fix(libreoffice): correct ErrRuntimeException message * docs(bruno): prettify * feat(log): add log-std-level-case to control standard output level casing * chore: expose log-std-level-case in Makefile and Compose * fix(Dockerfile): add ca-certificates, missing in chromium-only image The gotenberg and gotenberg-libreoffice images pull in ca-certificates as a dependency of python3-distutils-extra, but it's missing from the gotenberg-chromium image. The issue only affects webhooks, as Chromium itself uses bundled certificates. * feat(pdfengines): inject Factur-X/ZUGFeRD XMP metadata * fix(libreoffice): suppress auto-generated page header for CSV conversions * feat(pdfengines): redesign Factur-X API with dedicated form fields * feat(pdfengines): support owner-only encryption and document permissions * refactor: make client- and operator-facing error messages clearer and actionable * feat(qpdf): record Factur-X and PDF/A attributes on traces * chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.4 to 4.26.5 Bumps [github.com/shirou/gopsutil/v4](https://github.com/shirou/gopsutil) from 4.26.4 to 4.26.5. - [Release notes](https://github.com/shirou/gopsutil/releases) - [Commits](shirou/gopsutil@v4.26.4...v4.26.5) --- updated-dependencies: - dependency-name: github.com/shirou/gopsutil/v4 dependency-version: 4.26.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * feat(telemetry): record backing-binary versions on spans, captured at build time * chore: rename factur x engine * feat(libreoffice): block linked content from untrusted locations * fix(chromium): generateDocumentOutline now implies generateTaggedPdf * chore(deps): update Go dependencies, keep chromedp pinned to v0.14.2 * chore(deps-dev): bump prettier from 3.8.3 to 3.8.4 Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.8.4. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.8.3...3.8.4) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.8.4 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump actions/checkout from 6 to 7 Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github.com/moby/moby/api from 1.54.2 to 1.55.0 Bumps [github.com/moby/moby/api](https://github.com/moby/moby) from 1.54.2 to 1.55.0. - [Release notes](https://github.com/moby/moby/releases) - [Commits](moby/moby@api/v1.54.2...api/v1.55.0) --- updated-dependencies: - dependency-name: github.com/moby/moby/api dependency-version: 1.55.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github.com/moby/moby/client from 0.4.1 to 0.5.0 Bumps [github.com/moby/moby/client](https://github.com/moby/moby) from 0.4.1 to 0.5.0. - [Release notes](https://github.com/moby/moby/releases) - [Changelog](https://github.com/moby/moby/blob/v0.5.0/CHANGELOG.md) - [Commits](moby/moby@v0.4.1...v0.5.0) --- updated-dependencies: - dependency-name: github.com/moby/moby/client dependency-version: 0.5.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github.com/testcontainers/testcontainers-go Bumps [github.com/testcontainers/testcontainers-go](https://github.com/testcontainers/testcontainers-go) from 0.42.0 to 0.43.0. - [Release notes](https://github.com/testcontainers/testcontainers-go/releases) - [Commits](testcontainers/testcontainers-go@v0.42.0...v0.43.0) --- updated-dependencies: - dependency-name: github.com/testcontainers/testcontainers-go dependency-version: 0.43.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.5 to 4.26.6 Bumps [github.com/shirou/gopsutil/v4](https://github.com/shirou/gopsutil) from 4.26.5 to 4.26.6. - [Release notes](https://github.com/shirou/gopsutil/releases) - [Commits](shirou/gopsutil@v4.26.5...v4.26.6) --- updated-dependencies: - dependency-name: github.com/shirou/gopsutil/v4 dependency-version: 4.26.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps-dev): bump prettier from 3.8.4 to 3.9.4 Bumps [prettier](https://github.com/prettier/prettier) from 3.8.4 to 3.9.4. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.8.4...3.9.4) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.4 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump golang.org/x/text from 0.38.0 to 0.40.0 Bumps [golang.org/x/text](https://github.com/golang/text) from 0.38.0 to 0.40.0. - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.38.0...v0.40.0) --- updated-dependencies: - dependency-name: golang.org/x/text dependency-version: 0.40.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 Bumps [golang.org/x/net](https://github.com/golang/net) from 0.56.0 to 0.57.0. - [Commits](golang/net@v0.56.0...v0.57.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.57.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * fix(chromium): serialize browser starts to prevent pinning proxy latch after a start timeout * feat(outbound): support authenticated proxy from environment variables * chore(deps-dev): bump prettier from 3.9.4 to 3.9.5 Bumps [prettier](https://github.com/prettier/prettier) from 3.9.4 to 3.9.5. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.4...3.9.5) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.5 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump actions/setup-node from 6 to 7 Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump actions/setup-go from 6 to 7 Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6 to 7. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps-dev): bump prettier-plugin-sh from 0.18.1 to 0.19.0 Bumps [prettier-plugin-sh](https://github.com/un-ts/prettier) from 0.18.1 to 0.19.0. - [Release notes](https://github.com/un-ts/prettier/releases) - [Changelog](https://github.com/un-ts/prettier/blob/master/CHANGELOG.md) - [Commits](https://github.com/un-ts/prettier/compare/[email protected]@0.19.0) --- updated-dependencies: - dependency-name: prettier-plugin-sh dependency-version: 0.19.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github.com/prometheus/client_golang Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.23.2 to 1.24.0. - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/v1.24.0/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.23.2...v1.24.0) --- updated-dependencies: - dependency-name: github.com/prometheus/client_golang dependency-version: 1.24.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.81.1...v1.82.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github.com/prometheus/client_golang Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.24.0 to 1.24.1. - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/v1.24.1/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.24.0...v1.24.1) --- updated-dependencies: - dependency-name: github.com/prometheus/client_golang dependency-version: 1.24.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps-dev): bump prettier from 3.9.5 to 3.9.6 Bumps [prettier](https://github.com/prettier/prettier) from 3.9.5 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.5...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github.com/moby/moby/client from 0.5.0 to 0.5.1 Bumps [github.com/moby/moby/client](https://github.com/moby/moby) from 0.5.0 to 0.5.1. - [Release notes](https://github.com/moby/moby/releases) - [Changelog](https://github.com/moby/moby/blob/v0.5.1/CHANGELOG.md) - [Commits](moby/moby@v0.5.0...v0.5.1) --- updated-dependencies: - dependency-name: github.com/moby/moby/client dependency-version: 0.5.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump go.opentelemetry.io/otel from 1.44.0 to 1.45.0 Bumps [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) from 1.44.0 to 1.45.0. - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0) --- updated-dependencies: - dependency-name: go.opentelemetry.io/otel dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github.com/cucumber/godog from 0.15.1 to 0.16.0 Bumps [github.com/cucumber/godog](https://github.com/cucumber/godog) from 0.15.1 to 0.16.0. - [Release notes](https://github.com/cucumber/godog/releases) - [Changelog](https://github.com/cucumber/godog/blob/main/CHANGELOG.md) - [Commits](cucumber/godog@v0.15.1...v0.16.0) --- updated-dependencies: - dependency-name: github.com/cucumber/godog dependency-version: 0.16.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.6 to 4.26.7 Bumps [github.com/shirou/gopsutil/v4](https://github.com/shirou/gopsutil) from 4.26.6 to 4.26.7. - [Release notes](https://github.com/shirou/gopsutil/releases) - [Commits](shirou/gopsutil@v4.26.6...v4.26.7) --- updated-dependencies: - dependency-name: github.com/shirou/gopsutil/v4 dependency-version: 4.26.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 Bumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) from 1.44.0 to 1.45.0. - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0) --- updated-dependencies: - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): update Golang and pdfcpu version * chore(deps): update go version in go.mod * fix(telemetry): align resource semconv with otel sdk 1.45 detectors * fix(libreoffice)!: return 500 when a failure is not the client's fault * chore(deps): update unoconverter to v0.4.0 * fix(pdfcpu): pass --force when writing over the input file * fix(api): sanitize the output filename header * fix(chromium): bound the total scope matching time per conversion * fix(outbound): keep dial pinning for hops the environment proxy declines * docs: use real identifiers in the Godoc examples * Merge commit from fork Co-authored-by: Jacob Brackett <[email protected]> * fix(outbound): return 403 instead of 500 for an unresolvable outbound host * fix(chromium): filter WebSocket handshakes against the outbound policy * test(libreoffice): rename the linked-content tag to libreoffice-ssrf * fix(libreoffice): render scrolled workbooks in full for SinglePageSheets * fix(api): classify client-cancelled requests as 499 instead of 500 * refactor(qpdf): make embed-metadata logging context-aware * chore(libreoffice): silence a gosec G703 false positive on temp-file cleanup * ci: bump golangci-lint to v2.12.2 * chore(libreoffice): drop the now-unneeded gosec nolint * fix(chromium): hint at --chromium-start-timeout when Chromium fails to start * feat(chromium): screenshot a single element via the selector form field (gotenberg#947) * fix(chromium): fit the page to content for landscape single-page (gotenberg#1390) * feat(chromium): add --chromium-clear-storage to clear local storage between conversions (gotenberg#919) * feat(pdfengines): optimize PDF images to reduce file size (gotenberg#359) * chore(deps): update pdfcpu to v0.15.0 (gotenberg#1628) * refactor(pdfengines): remove qpdf embed fallback (gotenberg#1628) * chore(deps): update Go and npm dependencies * chore(test): format optimize-images testdata and integration README * fix(libreoffice): accept the OOXML PowerPoint show extensions (gotenberg#1626) * test(libreoffice): cover OOXML PowerPoint show conversion (gotenberg#1626) * feat(chromium): await thenable waitForExpression (gotenberg#1617) * fix(chromium): add missing import for awaited waitForExpression * test(chromium): cover thenable waitForExpression * feat(pdfengines): generate document-title bookmarks when merging (gotenberg#867) * test(libreoffice): add .ppsm and .ppsx to the Bad Request extension list * test(integration): allow repeated form fields in requests * feat(pdfengines): apply multiple stamps in one request (gotenberg#1601) * feat(pdfengines): apply multiple stamps and watermarks on every route * feat(api): add OIDC bearer token authentication * chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 (gotenberg#1636) Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.11.1 to 1.12.1. - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.11.1...v1.12.1) --- updated-dependencies: - dependency-name: github.com/stretchr/testify dependency-version: 1.12.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(otel): keep telemetry off unless an exporter is configured * chore(deps): update Go to 1.27.0 * chore(deps): update golangci-lint to v2.13.2 * style(api): remove redundant parentheses in type switch * fix(chromium): fail fast with 503 when Chromium crashes (gotenberg#1641) * chore(deps): update unoconverter to v0.5.0 * chore(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 (gotenberg#1646) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.83.0 to 1.83.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.83.0...v1.83.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.83.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(Dockerfile): re-add libreoffice-math so DOCX math formulas render The v8.30.0 image slimming replaced the libreoffice metapackage with an explicit component list that omits libreoffice-math. Writer imports OMML equations as Math objects, so without the component every formula is silently dropped from converted PDFs. Fixes gotenberg#1644 * fix(api): bound downloadFrom concurrency and entry count * fix(supervisor): report healthy during planned process restarts The eager restart fired after --chromium-restart-after or --libreoffice-restart-after conversions made Healthy() report false, so a client probing /health between two conversions got a 503 from an otherwise serving node. Tasks arriving during that window are requeued by acquireSlot, not rejected. Track whether the in-flight restart is planned and keep reporting healthy for those. Unplanned restarts still report unhealthy so load balancers get honest information. Closes gotenberg#1648 * fix(supervisor): bound the eager restart with a deadline maybeRestartAfterTask ran its restart on a bare background context while the drain loop in doRestartLocked selects only on ctx.Done(). A task that never completed blocked the drain forever, pinning isRestarting. Since a planned restart now reports healthy, that left the node claiming health for good. LibreOffice escaped it because its concurrency of 1 drains no slots, but Chromium defaults to 6. Give that restart its own deadline. On expiry it aborts and the next task retries it. * fix(supervisor): reset the request counter on a failed relaunch restart() reset reqCounter only after a successful Launch, so a failed one left it at the limit. maybeRestartAfterTask then re-fired on every subsequent task, producing back-to-back restarts and, with planned restarts now reporting healthy, a node that keeps restarting while claiming health. Reset on the attempt instead. A process that will not start is recovered by ensureHealthy, which restarts synchronously and reports the failure. * docs(supervisor): point maybeRestartAfterTask at the timeout constant * test(health): assert conversions succeed across a planned restart * build(makefile): disable two go fix modernizers that emit broken code go fix runs the modernize suite since Go 1.26, and two of its analyzers rewrite this codebase into code that does not compile, so make fmt broke the build and then make lint. CONTRIBUTING tells every contributor to run both before opening a PR. embedlit folded telemetryCfg.LogLevel into a literal that already set that key, and errorsastype rewrote errors.As to errors.AsType[HttpError] even though HttpError does not embed error. Disable both, with a TODO covering when each can come back. * refactor: adopt strings.Cut and strings.SplitSeq Applies what go fix now proposes, so make fmt is a no-op on a clean tree instead of dirtying these two files on every run. Both rewrites are equivalent: Cut's first result matches SplitN(s, sep, 2)[0], and SplitSeq iterates the same substrings without building the intermediate slice. * build(makefile): fix lint-todo for golangci-lint v2 * chore(deps): update Go dependencies * fix(outbound): strip URL userinfo before allow and deny list matching * feat(outbound): warn at startup about allow-list patterns that grant more than intended * docs(outbound): document the allow-list bypass on every allow-list flag and terminate the example patterns * style: escape backslashes in the Chromium allow-list scenario table * fix(api): bound downloadFrom requests by the request deadline * fix(webhook): bound webhook delivery with its own retry budget * fix(api): bound downloadFrom decoding by the entry limit * fix(api): snapshot the output filename before echo recycles its context * fix(api): stop upload filenames from failing or silently dropping a request * fix(api): keep upload order when de-duplicating repeated filenames * fix(outbound): treat CGNAT and benchmarking ranges as non-public * fix(api): keep the filter verdict generic when a redirect is blocked * fix(exiftool): reject metadata keys that collide with ExifTool options * feat(api): warn at startup when the debug route has no authentication * fix(libreoffice): report an encrypted .xlsb as password-protected (gotenberg#1655) Uploading a password-protected .xlsb workbook without its password answered 500 with the unattributable-failure message instead of 400 with the remedy. DetectPasswordProtection in pkg/modules/libreoffice/api/protection.go infers encryption from a compound-file header carried by an extension whose unencrypted form is always a ZIP package. The ooxmlExtensions map listed .xlsx, .xlsm, .xltx and .xltm but not .xlsb, so an encrypted workbook under that extension fell through to PasswordProtectionUnknown. The convert route in pkg/modules/libreoffice/routes.go then matched neither password branch of its exit-code switch and returned the 500 default. An Excel Binary Workbook is an Open Packaging Conventions ZIP holding binary parts, so a compound file under that extension is encrypted for the same reason .xlsx is. Adding .xlsb to the map restores the 400 that names the 'password' form field. * fix(webhook): close the response body when the callback returns an error status * fix(chromium): bound CONNECT tunnels so a silent upstream cannot pin them forever * fix(libreoffice): stop the outbound proxy when the daemon fails to start * fix(chromium): drop settled requests from the per-conversion network map * fix(chromium): ceiling the CONNECT tunnels in flight and bound tunnel writes * test(integration): drop the per-scenario Docker network * perf(pdfengines): process a request's files concurrently behind an opt-in ceiling * ci(build): reuse the Docker build cache across runs * perf(gotenberg): match allow and deny patterns without recompiling them * perf(api): build the access log with a single record * perf(chromium): skip formatting a discarded debug message per response * fix(chromium): disable the WebUI omnibox popup preloaded at browser start * chore(deps): bump golang.org/x/sync from 0.22.0 to 0.23.0 (gotenberg#1658) Bumps [golang.org/x/sync](https://github.com/golang/sync) from 0.22.0 to 0.23.0. - [Commits](golang/sync@v0.22.0...v0.23.0) --- updated-dependencies: - dependency-name: golang.org/x/sync dependency-version: 0.23.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): update Go to 1.27.1 * build(makefile): re-enable the embedlit go fix modernizer * fix(outbound): ignore IPv6 zone identifiers when classifying addresses * chore(deps)!: migrate from echo v4 to echo v5 * fix(gotenberg): retry pattern matches aborted by a process pause * build(dockerfile): update AWS Lambda Web Adapter to 1.0.1 * chore(deps)!: migrate from regexp2 v1 to regexp2 v2 * chore(deps): bump golang.org/x/text from 0.41.0 to 0.42.0 Bumps [golang.org/x/text](https://github.com/golang/text) from 0.41.0 to 0.42.0. - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.41.0...v0.42.0) --- updated-dependencies: - dependency-name: golang.org/x/text dependency-version: 0.42.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump golang.org/x/net from 0.58.0 to 0.59.0 Bumps [golang.org/x/net](https://github.com/golang/net) from 0.58.0 to 0.59.0. - [Commits](golang/net@v0.58.0...v0.59.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.59.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps-dev): bump prettier from 3.9.6 to 3.9.8 Bumps [prettier](https://github.com/prettier/prettier) from 3.9.6 to 3.9.8. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.6...3.9.8) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.8 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps-dev): bump prettier from 3.9.8 to 3.9.9 Bumps [prettier](https://github.com/prettier/prettier) from 3.9.8 to 3.9.9. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.8...3.9.9) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.9 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps-dev): bump prettier-plugin-sh from 0.19.0 to 0.20.2 Bumps [prettier-plugin-sh](https://github.com/un-ts/prettier) from 0.19.0 to 0.20.2. - [Release notes](https://github.com/un-ts/prettier/releases) - [Changelog](https://github.com/un-ts/prettier/blob/master/CHANGELOG.md) - [Commits](https://github.com/un-ts/prettier/compare/[email protected]@0.20.2) --- updated-dependencies: - dependency-name: prettier-plugin-sh dependency-version: 0.20.2 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github.com/labstack/echo/v5 from 5.3.1 to 5.4.0 Bumps [github.com/labstack/echo/v5](https://github.com/labstack/echo) from 5.3.1 to 5.4.0. - [Release notes](https://github.com/labstack/echo/releases) - [Changelog](https://github.com/labstack/echo/blob/master/CHANGELOG.md) - [Commits](labstack/echo@v5.3.1...v5.4.0) --- updated-dependencies: - dependency-name: github.com/labstack/echo/v5 dependency-version: 5.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.8 to 4.26.9 Bumps [github.com/shirou/gopsutil/v4](https://github.com/shirou/gopsutil) from 4.26.8 to 4.26.9. - [Release notes](https://github.com/shirou/gopsutil/releases) - [Commits](shirou/gopsutil@v4.26.8...v4.26.9) --- updated-dependencies: - dependency-name: github.com/shirou/gopsutil/v4 dependency-version: 4.26.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * test(chromium): cover header and footer image deduplication * chore(deps): bump github.com/moby/moby/api from 1.56.0 to 1.56.1 Bumps [github.com/moby/moby/api](https://github.com/moby/moby) from 1.56.0 to 1.56.1. - [Release notes](https://github.com/moby/moby/releases) - [Commits](moby/moby@api/v1.56.0...api/v1.56.1) --- updated-dependencies: - dependency-name: github.com/moby/moby/api dependency-version: 1.56.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump OpenTelemetry to v1.47.0 and contrib to v0.72.0 The Logs API is now stable (go.opentelemetry.io/otel/log v1.47.0) and go.opentelemetry.io/otel/log/global is deprecated. Register the logger provider via otel.SetLoggerProvider instead. Supersedes gotenberg#1680, gotenberg#1681 and gotenberg#1683. * chore(deps): bump github.com/moby/moby/client from 0.6.0 to 0.6.2 Bumps [github.com/moby/moby/client](https://github.com/moby/moby) from 0.6.0 to 0.6.2. - [Release notes](https://github.com/moby/moby/releases) - [Changelog](https://github.com/moby/moby/blob/v0.6.2/CHANGELOG.md) - [Commits](moby/moby@v0.6.0...v0.6.2) --- updated-dependencies: - dependency-name: github.com/moby/moby/client dependency-version: 0.6.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * fix(api): enforce api-body-limit before parsing multipart requests * test(chromium): wait for network idle in resource status code scenarios * fix(chromium)!: isolate each conversion in its own browser context * fix(chromium): route loopback WebSockets through the pinning proxy when an outbound policy is set * fix(chromium): report unreachable resources behind the pinning proxy as loading failures * feat(libreoffice): add generateTaggedPdf form field Tags the PDF without declaring PDF/UA conformance. Today tagging is only available through pdfua, which also writes pdfuaid:part=1 into the XMP metadata. Mirrors the Chromium routes, where generateTaggedPdf and pdfua are separate fields. Defaults to false, so existing requests are unchanged. Closes gotenberg#1676 * fix Dockerfile --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Julien Neuhart <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: hubert.lenoir <[email protected]> Co-authored-by: Pieter Oliver <[email protected]> Co-authored-by: Heorhii Ovcharenko <[email protected]> Co-authored-by: Oskar Sveinsen <[email protected]> Co-authored-by: Effy Teva <[email protected]> Co-authored-by: Jacob Brackett <[email protected]> Co-authored-by: Ilya Fedorov <[email protected]> Co-authored-by: Niklas <[email protected]> Co-authored-by: Muhammad Haseeb <[email protected]> Co-authored-by: Johannes Klein <[email protected]> Co-authored-by: Max Freedom Pollard <[email protected]> Co-authored-by: Antonio Pauletich <[email protected]> Co-authored-by: Johannes Klein <[email protected]>

gulien added enhancement New feature or request chromium labels Aug 28, 2026

Haseeb-1698 force-pushed the fix/1640-fail-fast-chromium-crash branch from 565a169 to a65b9d6 Compare August 28, 2026 13:45

gulien merged commit 7dbff18 into gotenberg:main Aug 31, 2026
16 checks passed

github-actions Bot mentioned this pull request Oct 19, 2026

Bump Gotenberg to 8.38.1 teknatha136/helm-charts#4

Open

4 tasks

Navigation Menu

Repository navigation

fix(chromium): fail fast with 503 when Chromium crashes - #1641

fix(chromium): fail fast with 503 when Chromium crashes#1641
gulien merged 1 commit into
gotenberg:mainfrom
Haseeb-1698:fix/1640-fail-fast-chromium-crash

Haseeb-1698 commented Aug 28, 2026 •

edited

Loading

Uh oh!

Haseeb-1698 commented Aug 28, 2026

Uh oh!

Uh oh!

gulien commented Aug 31, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Haseeb-1698 commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Verification

Tests

Notes

Uh oh!

Haseeb-1698 commented Aug 28, 2026

Uh oh!

Uh oh!

gulien commented Aug 31, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Haseeb-1698 commented Aug 28, 2026 •

edited

Loading