fix(Dockerfile): re-add libreoffice-math so DOCX math formulas render - #1645

… 8.37.0) (#2080)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [docker.io/gotenberg/gotenberg](https://github.com/gotenberg/gotenberg) | minor | `8.36.0` → `8.37.0` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/567) for more information.

---

### Release Notes

<details>
<summary>gotenberg/gotenberg (docker.io/gotenberg/gotenberg)</summary>

### [`v8.37.0`](https://github.com/gotenberg/gotenberg/releases/tag/v8.37.0): 8.37.0

[Compare Source](gotenberg/gotenberg@v8.36.0...v8.37.0)

##### Security Fixes ⚠️

- **Strip URL userinfo before allow-list and deny-list matching.** The regexes saw the credentials, so `http://[email protected]/` satisfied an allow-list anchored on `trusted\.example\.com` and skipped the IP checks, and `http://[email protected]/` slipped past a deny-list anchored on `127\.`.
- **Treat CGNAT and benchmarking ranges as non-public.** `100.64.0.0/10`, where Alibaba Cloud serves instance metadata, and `198.18.0.0/15` passed the `*_DENY_PRIVATE_IPS` checks.
- **Reject metadata keys that collide with ExifTool options.** An unprefixed key such as `csv` or `o` reached ExifTool as a command-line option, not a tag. Such keys now return `400`; prefix them with a group, for example `XMP:csv`.
- **Validate qpdf split spans.** qpdf read a span that is not a page range as another source file and appended its pages to the output. It now rejects such spans and the engine chain moves on.
- **Keep redirect verdicts generic.** A `downloadFrom` redirect blocked by the outbound policy answered `400` with the allow-list, deny-list, or IP policy in the message. It now gets the same generic `403` as a blocked first hop.
- **Bound what a hostile page or origin can hold.** Chromium's CONNECT tunnels close after 2 minutes of silence and cap at 512 in flight. `downloadFrom` fetches honor the request deadline, webhook deliveries get their own budget, retries included, and a remote `Retry-After` can no longer exceed the configured maximum wait.

##### New Features

- **Process a request's PDF files concurrently.** `--pdfengines-max-concurrency` bounds how many files the per-file features (metadata, encryption, stamps, watermarks, flattening, and more) process at once, across all requests. The default `1` keeps the sequential behavior; raise it to trade memory for speed on multi-file requests. LibreOffice is not affected: scale containers instead.
- **`downloadFrom` limits.** `--api-download-from-max-concurrency` bounds the fetches in flight per request, `10` by default (previously unbounded). `--api-download-from-max-entries` caps the array size, `0` (no limit) by default.
- **Startup warnings for risky configurations.** Gotenberg now warns about allow-list patterns that match more than intended (unanchored, catch-all, or with an unterminated host), since a match skips the IP checks, and about `--api-enable-debug-route` without authentication. Nothing fails to start.

##### Bug Fixes

- **Health check failed during planned restarts** ([#&#8203;1648](gotenberg/gotenberg#1648)). A probe between two conversions got `503` while `--chromium-restart-after` or `--libreoffice-restart-after` recycled the process. Planned restarts now report healthy; unplanned ones still don't. Thanks [@&#8203;adq-talbot](https://github.com/adq-talbot).
- **DOCX math formulas were silently dropped** ([#&#8203;1644](gotenberg/gotenberg#1644)). The 8.30.0 image slimming removed `libreoffice-math`; it's back ([#&#8203;1645](gotenberg/gotenberg#1645)). Thanks [@&#8203;joh-klein](https://github.com/joh-klein).
- **Chromium crashes hung until the request timeout** ([#&#8203;1640](gotenberg/gotenberg#1640)). A renderer crash now fails fast with `503` ([#&#8203;1641](gotenberg/gotenberg#1641)). Thanks [@&#8203;cqjjjzr](https://github.com/cqjjjzr) and [@&#8203;Haseeb-1698](https://github.com/Haseeb-1698).
- **About 75 MB extra per Chromium browser** ([#&#8203;1656](gotenberg/gotenberg#1656)). Recent Chromium builds preload the WebUI omnibox popup at start, headless included. Gotenberg now disables it. Thanks [@&#8203;carma-codebase](https://github.com/carma-codebase).
- **Telemetry exported without an exporter configured** ([#&#8203;1643](gotenberg/gotenberg#1643)). An unset `OTEL_*_EXPORTER` fell back to OTLP on `localhost` and kept retrying. Each signal now stays off until its variable is set, as documented. Thanks [@&#8203;SuperSandro2000](https://github.com/SuperSandro2000).
- **Encrypted `.xlsb` returned `500`** ([#&#8203;1655](gotenberg/gotenberg#1655)). It now returns `400` pointing at the `password` form field. Thanks [@&#8203;MaxFreedomPollard](https://github.com/MaxFreedomPollard).
- **Uploads sharing a filename lost all but one file.** Duplicates are now kept as `name (2).ext`, in upload order. Very long extensions and a best-effort symlink step no longer fail the request with `500`.
- **Async conversions could pick up another request's `Gotenberg-Output-Filename`.** The header is now read before Echo recycles the request context.
- **Resource leaks.** Webhook callbacks answering `4xx` leaked a connection, a failed LibreOffice start leaked its outbound proxy, and Chromium's per-conversion network map kept every settled request.

##### Chore

- Updated Chromium to `152.0.7977.82`.
- Updated LibreOffice to `26.8.0`.
- Updated `unoconverter` to `v0.5.0`, which drops the `distutils` dependency.
- Bumped Go to `1.27.1`.
- Bumped golangci-lint to `v2.13.2`.
- Minor performance improvements in outbound filtering, access logging, and Chromium event handling.
- Updated Go dependencies.

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Paris)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC42NS41IiwidXBkYXRlZEluVmVyIjoiNDQuNjUuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUvY29udGFpbmVyIiwidHlwZS9taW5vciJdfQ==-->

Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/2080

##### [\`8.37.0\`](https://github.com/gotenberg/gotenberg/releases/tag/v8.37.0)

#### Security Fixes ⚠️

- **Strip URL userinfo before allow-list and deny-list matching.** The regexes saw the credentials, so `http://[email protected]/` satisfied an allow-list anchored on `trusted\.example\.com` and skipped the IP checks, and `http://[email protected]/` slipped past a deny-list anchored on `127\.`.
- **Treat CGNAT and benchmarking ranges as non-public.** `100.64.0.0/10`, where Alibaba Cloud serves instance metadata, and `198.18.0.0/15` passed the `*_DENY_PRIVATE_IPS` checks.
- **Reject metadata keys that collide with ExifTool options.** An unprefixed key such as `csv` or `o` reached ExifTool as a command-line option, not a tag. Such keys now return `400`; prefix them with a group, for example `XMP:csv`.
- **Validate qpdf split spans.** qpdf read a span that is not a page range as another source file and appended its pages to the output. It now rejects such spans and the engine chain moves on.
- **Keep redirect verdicts generic.** A `downloadFrom` redirect blocked by the outbound policy answered `400` with the allow-list, deny-list, or IP policy in the message. It now gets the same generic `403` as a blocked first hop.
- **Bound what a hostile page or origin can hold.** Chromium's CONNECT tunnels close after 2 minutes of silence and cap at 512 in flight. `downloadFrom` fetches honor the request deadline, webhook deliveries get their own budget, retries included, and a remote `Retry-After` can no longer exceed the configured maximum wait.

#### New Features

- **Process a request's PDF files concurrently.** `--pdfengines-max-concurrency` bounds how many files the per-file features (metadata, encryption, stamps, watermarks, flattening, and more) process at once, across all requests. The default `1` keeps the sequential behavior; raise it to trade memory for speed on multi-file requests. LibreOffice is not affected: scale containers instead.
- **`downloadFrom` limits.** `--api-download-from-max-concurrency` bounds the fetches in flight per request, `10` by default (previously unbounded). `--api-download-from-max-entries` caps the array size, `0` (no limit) by default.
- **Startup warnings for risky configurations.** Gotenberg now warns about allow-list patterns that match more than intended (unanchored, catch-all, or with an unterminated host), since a match skips the IP checks, and about `--api-enable-debug-route` without authentication. Nothing fails to start.

#### Bug Fixes

- **Health check failed during planned restarts** ([#1648](gotenberg/gotenberg#1648)). A probe between two conversions got `503` while `--chromium-restart-after` or `--libreoffice-restart-after` recycled the process. Planned restarts now report healthy; unplanned ones still don't. Thanks [@adq-talbot](https://github.com/adq-talbot).
- **DOCX math formulas were silently dropped** ([#1644](gotenberg/gotenberg#1644)). The 8.30.0 image slimming removed `libreoffice-math`; it's back ([#1645](gotenberg/gotenberg#1645)). Thanks [@joh-klein](https://github.com/joh-klein).
- **Chromium crashes hung until the request timeout** ([#1640](gotenberg/gotenberg#1640)). A renderer crash now fails fast with `503` ([#1641](gotenberg/gotenberg#1641)). Thanks [@cqjjjzr](https://github.com/cqjjjzr) and [@Haseeb-1698](https://github.com/Haseeb-1698).
- **About 75 MB extra per Chromium browser** ([#1656](gotenberg/gotenberg#1656)). Recent Chromium builds preload the WebUI omnibox popup at start, headless included. Gotenberg now disables it. Thanks [@carma-codebase](https://github.com/carma-codebase).
- **Telemetry exported without an exporter configured** ([#1643](gotenberg/gotenberg#1643)). An unset `OTEL_*_EXPORTER` fell back to OTLP on `localhost` and kept retrying. Each signal now stays off until its variable is set, as documented. Thanks [@SuperSandro2000](https://github.com/SuperSandro2000).
- **Encrypted `.xlsb` returned `500`** ([#1655](gotenberg/gotenberg#1655)). It now returns `400` pointing at the `password` form field. Thanks [@MaxFreedomPollard](https://github.com/MaxFreedomPollard).
- **Uploads sharing a filename lost all but one file.** Duplicates are now kept as `name (2).ext`, in upload order. Very long extensions and a best-effort symlink step no longer fail the request with `500`.
- **Async conversions could pick up another request's `Gotenberg-Output-Filename`.** The header is now read before Echo recycles the request context.
- **Resource leaks.** Webhook callbacks answering `4xx` leaked a connection, a failed LibreOffice start leaked its outbound proxy, and Chromium's per-conversion network map kept every settled request.

#### Chore

- Updated Chromium to `152.0.7977.82`.
- Updated LibreOffice to `26.8.0`.
- Updated `unoconverter` to `v0.5.0`, which drops the `distutils` dependency.
- Bumped Go to `1.27.1`.
- Bumped golangci-lint to `v2.13.2`.
- Minor performance improvements in outbound filtering, access logging, and Chromium event handling.
- Updated Go dependencies.

##### [\`8.37.0\`](https://github.com/gotenberg/gotenberg/releases/tag/v8.37.0)

#### Security Fixes ⚠️

- **Strip URL userinfo before allow-list and deny-list matching.** The regexes saw the credentials, so `http://[email protected]/` satisfied an allow-list anchored on `trusted\.example\.com` and skipped the IP checks, and `http://[email protected]/` slipped past a deny-list anchored on `127\.`.
- **Treat CGNAT and benchmarking ranges as non-public.** `100.64.0.0/10`, where Alibaba Cloud serves instance metadata, and `198.18.0.0/15` passed the `*_DENY_PRIVATE_IPS` checks.
- **Reject metadata keys that collide with ExifTool options.** An unprefixed key such as `csv` or `o` reached ExifTool as a command-line option, not a tag. Such keys now return `400`; prefix them with a group, for example `XMP:csv`.
- **Validate qpdf split spans.** qpdf read a span that is not a page range as another source file and appended its pages to the output. It now rejects such spans and the engine chain moves on.
- **Keep redirect verdicts generic.** A `downloadFrom` redirect blocked by the outbound policy answered `400` with the allow-list, deny-list, or IP policy in the message. It now gets the same generic `403` as a blocked first hop.
- **Bound what a hostile page or origin can hold.** Chromium's CONNECT tunnels close after 2 minutes of silence and cap at 512 in flight. `downloadFrom` fetches honor the request deadline, webhook deliveries get their own budget, retries included, and a remote `Retry-After` can no longer exceed the configured maximum wait.

#### New Features

- **Process a request's PDF files concurrently.** `--pdfengines-max-concurrency` bounds how many files the per-file features (metadata, encryption, stamps, watermarks, flattening, and more) process at once, across all requests. The default `1` keeps the sequential behavior; raise it to trade memory for speed on multi-file requests. LibreOffice is not affected: scale containers instead.
- **`downloadFrom` limits.** `--api-download-from-max-concurrency` bounds the fetches in flight per request, `10` by default (previously unbounded). `--api-download-from-max-entries` caps the array size, `0` (no limit) by default.
- **Startup warnings for risky configurations.** Gotenberg now warns about allow-list patterns that match more than intended (unanchored, catch-all, or with an unterminated host), since a match skips the IP checks, and about `--api-enable-debug-route` without authentication. Nothing fails to start.

#### Bug Fixes

- **Health check failed during planned restarts** ([#1648](gotenberg/gotenberg#1648)). A probe between two conversions got `503` while `--chromium-restart-after` or `--libreoffice-restart-after` recycled the process. Planned restarts now report healthy; unplanned ones still don't. Thanks [@adq-talbot](https://github.com/adq-talbot).
- **DOCX math formulas were silently dropped** ([#1644](gotenberg/gotenberg#1644)). The 8.30.0 image slimming removed `libreoffice-math`; it's back ([#1645](gotenberg/gotenberg#1645)). Thanks [@joh-klein](https://github.com/joh-klein).
- **Chromium crashes hung until the request timeout** ([#1640](gotenberg/gotenberg#1640)). A renderer crash now fails fast with `503` ([#1641](gotenberg/gotenberg#1641)). Thanks [@cqjjjzr](https://github.com/cqjjjzr) and [@Haseeb-1698](https://github.com/Haseeb-1698).
- **About 75 MB extra per Chromium browser** ([#1656](gotenberg/gotenberg#1656)). Recent Chromium builds preload the WebUI omnibox popup at start, headless included. Gotenberg now disables it. Thanks [@carma-codebase](https://github.com/carma-codebase).
- **Telemetry exported without an exporter configured** ([#1643](gotenberg/gotenberg#1643)). An unset `OTEL_*_EXPORTER` fell back to OTLP on `localhost` and kept retrying. Each signal now stays off until its variable is set, as documented. Thanks [@SuperSandro2000](https://github.com/SuperSandro2000).
- **Encrypted `.xlsb` returned `500`** ([#1655](gotenberg/gotenberg#1655)). It now returns `400` pointing at the `password` form field. Thanks [@MaxFreedomPollard](https://github.com/MaxFreedomPollard).
- **Uploads sharing a filename lost all but one file.** Duplicates are now kept as `name (2).ext`, in upload order. Very long extensions and a best-effort symlink step no longer fail the request with `500`.
- **Async conversions could pick up another request's `Gotenberg-Output-Filename`.** The header is now read before Echo recycles the request context.
- **Resource leaks.** Webhook callbacks answering `4xx` leaked a connection, a failed LibreOffice start leaked its outbound proxy, and Chromium's per-conversion network map kept every settled request.

#### Chore

- Updated Chromium to `152.0.7977.82`.
- Updated LibreOffice to `26.8.0`.
- Updated `unoconverter` to `v0.5.0`, which drops the `distutils` dependency.
- Bumped Go to `1.27.1`.
- Bumped golangci-lint to `v2.13.2`.
- Minor performance improvements in outbound filtering, access logging, and Chromium event handling.
- Updated Go dependencies.

##### [\`8.37.0\`](https://github.com/gotenberg/gotenberg/releases/tag/v8.37.0)

#### Security Fixes ⚠️

- **Strip URL userinfo before allow-list and deny-list matching.** The regexes saw the credentials, so `http://[email protected]/` satisfied an allow-list anchored on `trusted\.example\.com` and skipped the IP checks, and `http://[email protected]/` slipped past a deny-list anchored on `127\.`.
- **Treat CGNAT and benchmarking ranges as non-public.** `100.64.0.0/10`, where Alibaba Cloud serves instance metadata, and `198.18.0.0/15` passed the `*_DENY_PRIVATE_IPS` checks.
- **Reject metadata keys that collide with ExifTool options.** An unprefixed key such as `csv` or `o` reached ExifTool as a command-line option, not a tag. Such keys now return `400`; prefix them with a group, for example `XMP:csv`.
- **Validate qpdf split spans.** qpdf read a span that is not a page range as another source file and appended its pages to the output. It now rejects such spans and the engine chain moves on.
- **Keep redirect verdicts generic.** A `downloadFrom` redirect blocked by the outbound policy answered `400` with the allow-list, deny-list, or IP policy in the message. It now gets the same generic `403` as a blocked first hop.
- **Bound what a hostile page or origin can hold.** Chromium's CONNECT tunnels close after 2 minutes of silence and cap at 512 in flight. `downloadFrom` fetches honor the request deadline, webhook deliveries get their own budget, retries included, and a remote `Retry-After` can no longer exceed the configured maximum wait.

#### New Features

- **Process a request's PDF files concurrently.** `--pdfengines-max-concurrency` bounds how many files the per-file features (metadata, encryption, stamps, watermarks, flattening, and more) process at once, across all requests. The default `1` keeps the sequential behavior; raise it to trade memory for speed on multi-file requests. LibreOffice is not affected: scale containers instead.
- **`downloadFrom` limits.** `--api-download-from-max-concurrency` bounds the fetches in flight per request, `10` by default (previously unbounded). `--api-download-from-max-entries` caps the array size, `0` (no limit) by default.
- **Startup warnings for risky configurations.** Gotenberg now warns about allow-list patterns that match more than intended (unanchored, catch-all, or with an unterminated host), since a match skips the IP checks, and about `--api-enable-debug-route` without authentication. Nothing fails to start.

#### Bug Fixes

- **Health check failed during planned restarts** ([#1648](gotenberg/gotenberg#1648)). A probe between two conversions got `503` while `--chromium-restart-after` or `--libreoffice-restart-after` recycled the process. Planned restarts now report healthy; unplanned ones still don't. Thanks [@adq-talbot](https://github.com/adq-talbot).
- **DOCX math formulas were silently dropped** ([#1644](gotenberg/gotenberg#1644)). The 8.30.0 image slimming removed `libreoffice-math`; it's back ([#1645](gotenberg/gotenberg#1645)). Thanks [@joh-klein](https://github.com/joh-klein).
- **Chromium crashes hung until the request timeout** ([#1640](gotenberg/gotenberg#1640)). A renderer crash now fails fast with `503` ([#1641](gotenberg/gotenberg#1641)). Thanks [@cqjjjzr](https://github.com/cqjjjzr) and [@Haseeb-1698](https://github.com/Haseeb-1698).
- **About 75 MB extra per Chromium browser** ([#1656](gotenberg/gotenberg#1656)). Recent Chromium builds preload the WebUI omnibox popup at start, headless included. Gotenberg now disables it. Thanks [@carma-codebase](https://github.com/carma-codebase).
- **Telemetry exported without an exporter configured** ([#1643](gotenberg/gotenberg#1643)). An unset `OTEL_*_EXPORTER` fell back to OTLP on `localhost` and kept retrying. Each signal now stays off until its variable is set, as documented. Thanks [@SuperSandro2000](https://github.com/SuperSandro2000).
- **Encrypted `.xlsb` returned `500`** ([#1655](gotenberg/gotenberg#1655)). It now returns `400` pointing at the `password` form field. Thanks [@MaxFreedomPollard](https://github.com/MaxFreedomPollard).
- **Uploads sharing a filename lost all but one file.** Duplicates are now kept as `name (2).ext`, in upload order. Very long extensions and a best-effort symlink step no longer fail the request with `500`.
- **Async conversions could pick up another request's `Gotenberg-Output-Filename`.** The header is now read before Echo recycles the request context.
- **Resource leaks.** Webhook callbacks answering `4xx` leaked a connection, a failed LibreOffice start leaked its outbound proxy, and Chromium's per-conversion network map kept every settled request.

#### Chore

- Updated Chromium to `152.0.7977.82`.
- Updated LibreOffice to `26.8.0`.
- Updated `unoconverter` to `v0.5.0`, which drops the `distutils` dependency.
- Bumped Go to `1.27.1`.
- Bumped golangci-lint to `v2.13.2`.
- Minor performance improvements in outbound filtering, access logging, and Chromium event handling.
- Updated Go dependencies.

…598)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [gotenberg/gotenberg](https://github.com/gotenberg/gotenberg) | minor | `8.36.0` → `8.37.0` |

---

### Release Notes

<details>
<summary>gotenberg/gotenberg (gotenberg/gotenberg)</summary>

### [`v8.37.0`](https://github.com/gotenberg/gotenberg/releases/tag/v8.37.0): 8.37.0

[Compare Source](gotenberg/gotenberg@v8.36.0...v8.37.0)

##### Security Fixes ⚠️

- **Strip URL userinfo before allow-list and deny-list matching.** The regexes saw the credentials, so `http://[email protected]/` satisfied an allow-list anchored on `trusted\.example\.com` and skipped the IP checks, and `http://[email protected]/` slipped past a deny-list anchored on `127\.`.
- **Treat CGNAT and benchmarking ranges as non-public.** `100.64.0.0/10`, where Alibaba Cloud serves instance metadata, and `198.18.0.0/15` passed the `*_DENY_PRIVATE_IPS` checks.
- **Reject metadata keys that collide with ExifTool options.** An unprefixed key such as `csv` or `o` reached ExifTool as a command-line option, not a tag. Such keys now return `400`; prefix them with a group, for example `XMP:csv`.
- **Validate qpdf split spans.** qpdf read a span that is not a page range as another source file and appended its pages to the output. It now rejects such spans and the engine chain moves on.
- **Keep redirect verdicts generic.** A `downloadFrom` redirect blocked by the outbound policy answered `400` with the allow-list, deny-list, or IP policy in the message. It now gets the same generic `403` as a blocked first hop.
- **Bound what a hostile page or origin can hold.** Chromium's CONNECT tunnels close after 2 minutes of silence and cap at 512 in flight. `downloadFrom` fetches honor the request deadline, webhook deliveries get their own budget, retries included, and a remote `Retry-After` can no longer exceed the configured maximum wait.

##### New Features

- **Process a request's PDF files concurrently.** `--pdfengines-max-concurrency` bounds how many files the per-file features (metadata, encryption, stamps, watermarks, flattening, and more) process at once, across all requests. The default `1` keeps the sequential behavior; raise it to trade memory for speed on multi-file requests. LibreOffice is not affected: scale containers instead.
- **`downloadFrom` limits.** `--api-download-from-max-concurrency` bounds the fetches in flight per request, `10` by default (previously unbounded). `--api-download-from-max-entries` caps the array size, `0` (no limit) by default.
- **Startup warnings for risky configurations.** Gotenberg now warns about allow-list patterns that match more than intended (unanchored, catch-all, or with an unterminated host), since a match skips the IP checks, and about `--api-enable-debug-route` without authentication. Nothing fails to start.

##### Bug Fixes

- **Health check failed during planned restarts** ([#&#8203;1648](gotenberg/gotenberg#1648)). A probe between two conversions got `503` while `--chromium-restart-after` or `--libreoffice-restart-after` recycled the process. Planned restarts now report healthy; unplanned ones still don't. Thanks [@&#8203;adq-talbot](https://github.com/adq-talbot).
- **DOCX math formulas were silently dropped** ([#&#8203;1644](gotenberg/gotenberg#1644)). The 8.30.0 image slimming removed `libreoffice-math`; it's back ([#&#8203;1645](gotenberg/gotenberg#1645)). Thanks [@&#8203;joh-klein](https://github.com/joh-klein).
- **Chromium crashes hung until the request timeout** ([#&#8203;1640](gotenberg/gotenberg#1640)). A renderer crash now fails fast with `503` ([#&#8203;1641](gotenberg/gotenberg#1641)). Thanks [@&#8203;cqjjjzr](https://github.com/cqjjjzr) and [@&#8203;Haseeb-1698](https://github.com/Haseeb-1698).
- **About 75 MB extra per Chromium browser** ([#&#8203;1656](gotenberg/gotenberg#1656)). Recent Chromium builds preload the WebUI omnibox popup at start, headless included. Gotenberg now disables it. Thanks [@&#8203;carma-codebase](https://github.com/carma-codebase).
- **Telemetry exported without an exporter configured** ([#&#8203;1643](gotenberg/gotenberg#1643)). An unset `OTEL_*_EXPORTER` fell back to OTLP on `localhost` and kept retrying. Each signal now stays off until its variable is set, as documented. Thanks [@&#8203;SuperSandro2000](https://github.com/SuperSandro2000).
- **Encrypted `.xlsb` returned `500`** ([#&#8203;1655](gotenberg/gotenberg#1655)). It now returns `400` pointing at the `password` form field. Thanks [@&#8203;MaxFreedomPollard](https://github.com/MaxFreedomPollard).
- **Uploads sharing a filename lost all but one file.** Duplicates are now kept as `name (2).ext`, in upload order. Very long extensions and a best-effort symlink step no longer fail the request with `500`.
- **Async conversions could pick up another request's `Gotenberg-Output-Filename`.** The header is now read before Echo recycles the request context.
- **Resource leaks.** Webhook callbacks answering `4xx` leaked a connection, a failed LibreOffice start leaked its outbound proxy, and Chromium's per-conversion network map kept every settled request.

##### Chore

- Updated Chromium to `152.0.7977.82`.
- Updated LibreOffice to `26.8.0`.
- Updated `unoconverter` to `v0.5.0`, which drops the `distutils` dependency.
- Bumped Go to `1.27.1`.
- Bumped golangci-lint to `v2.13.2`.
- Minor performance improvements in outbound filtering, access logging, and Chromium event handling.
- Updated Go dependencies.

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/London)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43OS42IiwidXBkYXRlZEluVmVyIjoiNDQuODMuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUvY29udGFpbmVyIiwidHlwZS9taW5vciJdfQ==-->

Reviewed-on: https://git.hayden.moe/hayden/phoebe/pulls/598