shivering-isles/infrastructure-gitops
Watch
2
0
Fork
You've already forked infrastructure-gitops
 0
Code Issues 1 Pull requests 39 Releases Packages 7 Activity

chore(deps): update docker.io/gotenberg/gotenberg docker tag to v8.37.0 #305

Open
botaniker wants to merge 1 commit from renovate/docker.io-gotenberg-gotenberg-8.x into main
pull from: renovate/docker.io-gotenberg-gotenberg-8.x
merge into: shivering-isles:main
Conversation 0 Commits 1 Files changed 1 +1 -1
botaniker commented 2026-09-16 06:12:59 +00:00
Member
Copy link

This PR contains the following updates:

Package Type Update Change OpenSSF
docker.io/gotenberg/gotenberg Kustomization minor 8.36.0 → 8.37.0 OpenSSF Scorecard

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

gotenberg/gotenberg (docker.io/gotenberg/gotenberg)

v8.37.0: 8.37.0

Compare Source

Security Fixes ⚠️

  • Strip URL userinfo before allow-list and deny-list matching. The regexes saw the credentials, so http://trusted.example.com@10.0.0.1/ satisfied an allow-list anchored on trusted\.example\.com and skipped the IP checks, and http://a@127.0.0.1/ slipped past a deny-list anchored on 127\..
  • Treat CGNAT and benchmarking ranges as non-public. 100.64.0.0/10, where Alibaba Cloud serves instance metadata, and 198.18.0.0/15 passed the *_DENY_PRIVATE_IPS checks.
  • Reject metadata keys that collide with ExifTool options. An unprefixed key such as csv or o reached ExifTool as a command-line option, not a tag. Such keys now return 400; prefix them with a group, for example XMP:csv.
  • Validate qpdf split spans. qpdf read a span that is not a page range as another source file and appended its pages to the output. It now rejects such spans and the engine chain moves on.
  • Keep redirect verdicts generic. A downloadFrom redirect blocked by the outbound policy answered 400 with the allow-list, deny-list, or IP policy in the message. It now gets the same generic 403 as a blocked first hop.
  • Bound what a hostile page or origin can hold. Chromium's CONNECT tunnels close after 2 minutes of silence and cap at 512 in flight. downloadFrom fetches honor the request deadline, webhook deliveries get their own budget, retries included, and a remote Retry-After can no longer exceed the configured maximum wait.

New Features

  • Process a request's PDF files concurrently. --pdfengines-max-concurrency bounds how many files the per-file features (metadata, encryption, stamps, watermarks, flattening, and more) process at once, across all requests. The default 1 keeps the sequential behavior; raise it to trade memory for speed on multi-file requests. LibreOffice is not affected: scale containers instead.
  • downloadFrom limits. --api-download-from-max-concurrency bounds the fetches in flight per request, 10 by default (previously unbounded). --api-download-from-max-entries caps the array size, 0 (no limit) by default.
  • Startup warnings for risky configurations. Gotenberg now warns about allow-list patterns that match more than intended (unanchored, catch-all, or with an unterminated host), since a match skips the IP checks, and about --api-enable-debug-route without authentication. Nothing fails to start.

Bug Fixes

  • Health check failed during planned restarts (#​1648). A probe between two conversions got 503 while --chromium-restart-after or --libreoffice-restart-after recycled the process. Planned restarts now report healthy; unplanned ones still don't. Thanks @​adq-talbot.
  • DOCX math formulas were silently dropped (#​1644). The 8.30.0 image slimming removed libreoffice-math; it's back (#​1645). Thanks @​joh-klein.
  • Chromium crashes hung until the request timeout (#​1640). A renderer crash now fails fast with 503 (#​1641). Thanks @​cqjjjzr and @​Haseeb-1698.
  • About 75 MB extra per Chromium browser (#​1656). Recent Chromium builds preload the WebUI omnibox popup at start, headless included. Gotenberg now disables it. Thanks @​carma-codebase.
  • Telemetry exported without an exporter configured (#​1643). An unset OTEL_*_EXPORTER fell back to OTLP on localhost and kept retrying. Each signal now stays off until its variable is set, as documented. Thanks @​SuperSandro2000.
  • Encrypted .xlsb returned 500 (#​1655). It now returns 400 pointing at the password form field. Thanks @​MaxFreedomPollard.
  • Uploads sharing a filename lost all but one file. Duplicates are now kept as name (2).ext, in upload order. Very long extensions and a best-effort symlink step no longer fail the request with 500.
  • Async conversions could pick up another request's Gotenberg-Output-Filename. The header is now read before Echo recycles the request context.
  • Resource leaks. Webhook callbacks answering 4xx leaked a connection, a failed LibreOffice start leaked its outbound proxy, and Chromium's per-conversion network map kept every settled request.

Chore

  • Updated Chromium to 152.0.7977.82.
  • Updated LibreOffice to 26.8.0.
  • Updated unoconverter to v0.5.0, which drops the distutils dependency.
  • Bumped Go to 1.27.1.
  • Bumped golangci-lint to v2.13.2.
  • Minor performance improvements in outbound filtering, access logging, and Chromium event handling.
  • Updated Go dependencies.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot. The local configuration can be found in the SI Renovate Bot repository.

This PR contains the following updates: | Package | Type | Update | Change | OpenSSF | |---|---|---|---|---| | [docker.io/gotenberg/gotenberg](https://github.com/gotenberg/gotenberg) | Kustomization | minor | `8.36.0` → `8.37.0` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/gotenberg/gotenberg/badge)](https://securityscorecards.dev/viewer/?uri=github.com/gotenberg/gotenberg) | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/30) for more information. --- ### Release Notes <details> <summary>gotenberg/gotenberg (docker.io/gotenberg/gotenberg)</summary> ### [`v8.37.0`](https://github.com/gotenberg/gotenberg/releases/tag/v8.37.0): 8.37.0 [Compare Source](https://github.com/gotenberg/gotenberg/compare/v8.36.0...v8.37.0) #### Security Fixes ⚠️ - **Strip URL userinfo before allow-list and deny-list matching.** The regexes saw the credentials, so `http://trusted.example.com@10.0.0.1/` satisfied an allow-list anchored on `trusted\.example\.com` and skipped the IP checks, and `http://a@127.0.0.1/` slipped past a deny-list anchored on `127\.`. - **Treat CGNAT and benchmarking ranges as non-public.** `100.64.0.0/10`, where Alibaba Cloud serves instance metadata, and `198.18.0.0/15` passed the `*_DENY_PRIVATE_IPS` checks. - **Reject metadata keys that collide with ExifTool options.** An unprefixed key such as `csv` or `o` reached ExifTool as a command-line option, not a tag. Such keys now return `400`; prefix them with a group, for example `XMP:csv`. - **Validate qpdf split spans.** qpdf read a span that is not a page range as another source file and appended its pages to the output. It now rejects such spans and the engine chain moves on. - **Keep redirect verdicts generic.** A `downloadFrom` redirect blocked by the outbound policy answered `400` with the allow-list, deny-list, or IP policy in the message. It now gets the same generic `403` as a blocked first hop. - **Bound what a hostile page or origin can hold.** Chromium's CONNECT tunnels close after 2 minutes of silence and cap at 512 in flight. `downloadFrom` fetches honor the request deadline, webhook deliveries get their own budget, retries included, and a remote `Retry-After` can no longer exceed the configured maximum wait. #### New Features - **Process a request's PDF files concurrently.** `--pdfengines-max-concurrency` bounds how many files the per-file features (metadata, encryption, stamps, watermarks, flattening, and more) process at once, across all requests. The default `1` keeps the sequential behavior; raise it to trade memory for speed on multi-file requests. LibreOffice is not affected: scale containers instead. - **`downloadFrom` limits.** `--api-download-from-max-concurrency` bounds the fetches in flight per request, `10` by default (previously unbounded). `--api-download-from-max-entries` caps the array size, `0` (no limit) by default. - **Startup warnings for risky configurations.** Gotenberg now warns about allow-list patterns that match more than intended (unanchored, catch-all, or with an unterminated host), since a match skips the IP checks, and about `--api-enable-debug-route` without authentication. Nothing fails to start. #### Bug Fixes - **Health check failed during planned restarts** ([#&#8203;1648](https://github.com/gotenberg/gotenberg/issues/1648)). A probe between two conversions got `503` while `--chromium-restart-after` or `--libreoffice-restart-after` recycled the process. Planned restarts now report healthy; unplanned ones still don't. Thanks [@&#8203;adq-talbot](https://github.com/adq-talbot). - **DOCX math formulas were silently dropped** ([#&#8203;1644](https://github.com/gotenberg/gotenberg/issues/1644)). The 8.30.0 image slimming removed `libreoffice-math`; it's back ([#&#8203;1645](https://github.com/gotenberg/gotenberg/pull/1645)). Thanks [@&#8203;joh-klein](https://github.com/joh-klein). - **Chromium crashes hung until the request timeout** ([#&#8203;1640](https://github.com/gotenberg/gotenberg/issues/1640)). A renderer crash now fails fast with `503` ([#&#8203;1641](https://github.com/gotenberg/gotenberg/pull/1641)). Thanks [@&#8203;cqjjjzr](https://github.com/cqjjjzr) and [@&#8203;Haseeb-1698](https://github.com/Haseeb-1698). - **About 75 MB extra per Chromium browser** ([#&#8203;1656](https://github.com/gotenberg/gotenberg/issues/1656)). Recent Chromium builds preload the WebUI omnibox popup at start, headless included. Gotenberg now disables it. Thanks [@&#8203;carma-codebase](https://github.com/carma-codebase). - **Telemetry exported without an exporter configured** ([#&#8203;1643](https://github.com/gotenberg/gotenberg/issues/1643)). An unset `OTEL_*_EXPORTER` fell back to OTLP on `localhost` and kept retrying. Each signal now stays off until its variable is set, as documented. Thanks [@&#8203;SuperSandro2000](https://github.com/SuperSandro2000). - **Encrypted `.xlsb` returned `500`** ([#&#8203;1655](https://github.com/gotenberg/gotenberg/pull/1655)). It now returns `400` pointing at the `password` form field. Thanks [@&#8203;MaxFreedomPollard](https://github.com/MaxFreedomPollard). - **Uploads sharing a filename lost all but one file.** Duplicates are now kept as `name (2).ext`, in upload order. Very long extensions and a best-effort symlink step no longer fail the request with `500`. - **Async conversions could pick up another request's `Gotenberg-Output-Filename`.** The header is now read before Echo recycles the request context. - **Resource leaks.** Webhook callbacks answering `4xx` leaked a connection, a failed LibreOffice start leaked its outbound proxy, and Chromium's per-conversion network map kept every settled request. #### Chore - Updated Chromium to `152.0.7977.82`. - Updated LibreOffice to `26.8.0`. - Updated `unoconverter` to `v0.5.0`, which drops the `distutils` dependency. - Bumped Go to `1.27.1`. - Bumped golangci-lint to `v2.13.2`. - Minor performance improvements in outbound filtering, access logging, and Chromium event handling. - Updated Go dependencies. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). The local configuration can be found in the [SI Renovate Bot repository](https://git.shivering-isles.com/shivering-isles/infrastructure-gitops/src/branch/main/apps/k8s01/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC41MC4yIiwidXBkYXRlZEluVmVyIjoiNDQuNTAuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
botaniker force-pushed renovate/docker.io-gotenberg-gotenberg-8.x from bfe3ab5dd2 to 5f545e72d5
Some checks are pending
gitops-pr-validation Pipeline started
Details
go-lint Go pipeline started
Details
2026-09-16 22:34:43 +00:00 Compare
botaniker force-pushed renovate/docker.io-gotenberg-gotenberg-8.x from 5f545e72d5
Some checks are pending
gitops-pr-validation Pipeline started
Details
go-lint Go pipeline started
Details
to a5b552eec0 2026-09-17 00:27:50 +00:00 Compare
botaniker force-pushed renovate/docker.io-gotenberg-gotenberg-8.x from a5b552eec0 to babb752dc7 2026-09-18 06:10:51 +00:00 Compare
botaniker force-pushed renovate/docker.io-gotenberg-gotenberg-8.x from babb752dc7 to e76cdb6dcb 2026-09-19 06:24:34 +00:00 Compare
botaniker force-pushed renovate/docker.io-gotenberg-gotenberg-8.x from e76cdb6dcb to 0392f3018e 2026-09-20 06:10:46 +00:00 Compare
botaniker force-pushed renovate/docker.io-gotenberg-gotenberg-8.x from 0392f3018e to 203182048d 2026-09-20 06:27:19 +00:00 Compare
botaniker force-pushed renovate/docker.io-gotenberg-gotenberg-8.x from 203182048d to ab14ef9cb1 2026-09-21 06:10:52 +00:00 Compare
botaniker force-pushed renovate/docker.io-gotenberg-gotenberg-8.x from ab14ef9cb1 to c10ac74e7a 2026-09-21 07:57:04 +00:00 Compare
botaniker force-pushed renovate/docker.io-gotenberg-gotenberg-8.x from c10ac74e7a to ba6cc7cb5f
Some checks are pending
gitops-pr-validation Pipeline started
Details
2026-09-22 06:12:20 +00:00 Compare
botaniker force-pushed renovate/docker.io-gotenberg-gotenberg-8.x from ba6cc7cb5f
Some checks are pending
gitops-pr-validation Pipeline started
Details
to 456a00b016 2026-09-22 07:42:58 +00:00 Compare
botaniker force-pushed renovate/docker.io-gotenberg-gotenberg-8.x from 456a00b016 to 9b4788376f 2026-09-23 06:09:48 +00:00 Compare
botaniker force-pushed renovate/docker.io-gotenberg-gotenberg-8.x from 9b4788376f to deedb4c6dc 2026-09-24 07:27:02 +00:00 Compare
botaniker force-pushed renovate/docker.io-gotenberg-gotenberg-8.x from deedb4c6dc to 55e63fa985 2026-09-25 06:09:46 +00:00 Compare
botaniker force-pushed renovate/docker.io-gotenberg-gotenberg-8.x from 55e63fa985 to 41b79ece06 2026-09-26 07:40:08 +00:00 Compare
botaniker force-pushed renovate/docker.io-gotenberg-gotenberg-8.x from 41b79ece06 to 6a74a56370 2026-09-27 06:07:46 +00:00 Compare
botaniker force-pushed renovate/docker.io-gotenberg-gotenberg-8.x from 6a74a56370 to 9d6dd55d81 2026-09-27 06:22:45 +00:00 Compare
botaniker force-pushed renovate/docker.io-gotenberg-gotenberg-8.x from 9d6dd55d81 to fa3a440097 2026-09-28 06:08:55 +00:00 Compare
Some required checks are missing.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/docker.io-gotenberg-gotenberg-8.x:renovate/docker.io-gotenberg-gotenberg-8.x
git switch renovate/docker.io-gotenberg-gotenberg-8.x
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
shivering-isles/infrastructure-gitops!305
No description provided.