shivering-isles/infrastructure-gitops
Watch
2
0
Fork
You've already forked infrastructure-gitops
 0
Code Issues 1 Pull requests 39 Releases Packages 7 Activity

chore(deps): update docker.io/gotenberg/gotenberg docker tag to v9 #507

Open
botaniker wants to merge 1 commit from renovate/docker.io-gotenberg-gotenberg-9.x into main
pull from: renovate/docker.io-gotenberg-gotenberg-9.x
merge into: shivering-isles:main
Conversation 0 Commits 1 Files changed 1 +1 -1
botaniker commented 2026-11-06 06:14:13 +00:00
Member

This PR contains the following updates:

Package Type Update Change OpenSSF
docker.io/gotenberg/gotenberg Kustomization major 8.40.0 → 9.1.0 OpenSSF Scorecard

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

gotenberg/gotenberg (docker.io/gotenberg/gotenberg)

v9.1.0: 9.1.0

Compare Source

New Features

  • extract-attachments (#​1718). /forms/pdf/extract-attachments returns the files a PDF embeds, every one or the one name gives, as <pdf>_<attachment>: invoice.pdf gives invoice_factur-x.xml. Several files come back in a ZIP. A PDF without attachments, or without the named one, answers 400. Thanks @​Betelgeuse1.
  • extract-text. /forms/pdf/extract-text returns the text of each PDF as a .txt file, pages joined by a form feed. pages selects pages; invisible, artifacts and annotations add invisible text, artifacts such as headers and stamps, and annotation text. Gotenberg does no OCR: a scanned page reads as empty.

Both are stages too: they come last in a stages list, after encrypt, sign or timestamp if any, and the response holds the PDFs and the extracted files.

Bug Fixes

  • backdrop-filter: blur() rendered blank on linux/ppc64le (#​1491). The ppc64le image pinned Chromium 146, which has the bug; it now installs the same Chromium as the other platforms. Thanks @​florianaiautomation.
  • Data race on concurrent stages. Stages that write many files at once, such as split or render on several PDFs, could register their output names concurrently.

Chore

  • linux/ppc64le moves from Chromium 146 to 156, from Debian's security updates.
  • Updated Go dependencies.

v9.0.0: 9.0.0

Compare Source

Gotenberg 9 is out 🎉

[!IMPORTANT]
latest now points to Gotenberg 9. Pin gotenberg/gotenberg:8 until you have upgraded. The upgrade guide maps every Gotenberg 8 route, field, flag, metric and span to its Gotenberg 9 counterpart.

One PDF engine

pdfcpu, QPDF, pdftk and ExifTool are replaced by litho, a PDF engine written in Go for Gotenberg, running in-process.

remediate repairs a PDF until it conforms to one of the eleven PDF/A levels, to PDF/UA-1 or PDF/UA-2, to both together, or to Factur-X, then checks its own result: Gotenberg-Remediation-Residual counts the violations left, Gotenberg-Remediation-Rolled-Back the fixes undone to keep pages, text and images. /forms/pdf/validate runs the same checks on any PDF.

litho also signs and timestamps, redacts from the file rather than from view, infers a structure tree, renders pages as images, fills and flattens forms in the scripts the image's fonts cover, and shrinks a PDF without touching image quality. A stage that would drop the signatures of a signed PDF answers 400, as does text no font can draw.

Stages, in your order

Post-processing is no longer flat fields in a fixed order. A stages list runs as written, on every route that makes a PDF and on /forms/pdf/pipe for PDFs you already have:

[{"op": "merge"}, {"op": "stamp-text", "text": "DRAFT"}, {"op": "remediate", "profile": "PDF/A-2b"}]

26 stages, each also a /forms/pdf/<op> route with form fields, plus six JSON read routes: info, validation, metadata, bookmarks, attachments and form fields. A broken order answers 400 before anything runs.

LibreOffice through lok

unoconverter, Python and the soffice listener are replaced by lok, a long-running LibreOfficeKit process that Gotenberg supervises and restarts after a crash. Macros stay off; --libreoffice-enable-macros runs them.

Fewer dependencies, less CVE surface

Java, Python, unoconverter, pdfcpu, QPDF, pdftk and ExifTool leave the image: fewer packages to patch, and no more CVE reports about tools Gotenberg does not ship. Variants, architectures, user, port and command don't change.

Upgrading

Start from the upgrade guide. /forms/pdfengines routes become /forms/pdf routes, post-processing fields become stages, and a field with a stage twin now starts with native. A removed route answers 404 naming its replacement, a Gotenberg 8 field 400 saying where it went:

Invalid form data: form field 'merge' is unknown to this route; Gotenberg 9 moved it to a stage: add {"op":"merge"} to 'stages'

Custom builds import github.com/gotenberg/gotenberg/v9. The PdfEngine, PdfEngineProvider and MetricsProvider interfaces and the Prometheus module are gone: OTEL_METRICS_EXPORTER=prometheus serves the same.

Everything else

PDF
  • set-form selects several list items, refuses a value a field cannot hold, and lists the PDF's fields when you name a missing one. flatten-form draws a value without appearance over the field's own background and border.
  • Flattened values and text stamps beyond Western European text use an installed font, embedded and subset. Uncovered text answers 400 naming the characters.
  • optimize packs objects into compressed streams, stores identical streams once, recompresses images losslessly and subsets fonts. Every pass runs unless turned off. An encrypted input needs a decrypt or encrypt stage first.
  • merge keeps each file's bookmarks, remapped, and names the result after the first file in alphanumeric order.
  • render draws pages as PNG or JPEG at the resolution you ask.
  • --pdf-max-stream-bytes, --pdf-max-embedded-file-bytes and --pdf-max-image-pixels bound what litho reads. --pdf-allow-list, --pdf-deny-list and their siblings filter the timestamp authorities it calls.
LibreOffice
  • nativePdfa takes PDF/A-1b, PDF/A-2b, PDF/A-3b or PDF/A-4; nativePdfua takes PDF/UA-1. The PDF/A export is no longer redone after the other steps: end the stages with remediate when they may break conformance.
  • initialView, magnification and pageLayout take names such as outline or fitWidth, not numbers. firstPageOnLeft, which LibreOffice ignored, and nativePdfFormats are gone.
  • nativeWatermarkColor takes #rrggbb, nativeWatermarkRotation degrees counter-clockwise, 0 being horizontal. A plain and a tiled watermark together answer 400.
  • CSV files split into columns. .epub is no longer accepted.
  • PDFs are named after their documents, report.docx.pdf, even for a single one. Gotenberg-Output-Filename still overrides.
Chromium
  • paperSize names a format, for LibreOffice too: A3, A4, A5, B4, B5, Letter, Legal or Tabloid.
  • waitForWindowStatus, renamed from waitWindowStatus, now waits as documented. skipNetworkAlmostIdleEvent=false now really waits for networkAlmostIdle.
  • The page sent to the HTML and Markdown routes passes the allow and deny lists, which keep governing what it loads.
  • Print settings Chromium rejects answer 400: a scale out of range, a negative length, a waitDelay longer than the API timeout. A wait that outlasts the request answers 503 naming the field and its value.
  • failOnHttpStatusCodes judges the main page by its frame, not its URL. Screenshot quality goes from 1 to 100.
  • DevTools messages leave the debug logs unless --chromium-debug-protocol is set. URL queries and extra header values stay out too.
API
  • archives unpacks uploaded ZIPs, bounded by --api-archive-max-entries and --api-archive-max-ratio.
  • Errors say what to send: the value sent and the one wanted, a stage option's expected value instead of a Go type, the host that does not resolve. NaN and infinities are refused.
  • Webhook and downloadFrom URLs must be absolute http or https URLs with a host. Gotenberg-Webhook-Events-Url is required with Gotenberg-Webhook-Url and receives errors as webhook.error events: the error URL, method and lists are gone. A failed upload says what the webhook answered, or why it was unreachable.
  • A non-ASCII Gotenberg-Output-Filename is encoded per RFC 6266. Every answer carries the trace header, 404 and 405 included; the version header too, without authentication.
  • The banner is an aligned startup summary, one log record outside a terminal. --api-bind-ip takes IPv6, --api-start-timeout bounds module readiness, /debug reports the lok and litho versions.
  • Debug logs mask form values, extra header values and document passwords.
Telemetry
  • Names follow the OpenTelemetry rules: gotenberg.chromium.requests, gotenberg.<engine>.queue.size, chromium.pdf, webhook.send. A failed request carries error.type; the status attribute and the errors counter are gone.
  • Each webhook and download attempt is an HTTP client span under the whole call's span, with server.address and a url.full stripped of credentials, query and fragment. Outbound URLs lose their query in errors and logs too.
  • The server span stays unset on success and 4xx, and sets Error on 5xx with the status code as error.type. OTEL_PROPAGATORS selects the propagators. Each written document is traced, its editing stages as child spans.
Security
  • The 8.40.0 fixes are in: IANA non-globally-reachable ranges are private for the *_DENY_PRIVATE_IPS checks, Chromium distrusts the compromised eMudhra roots from the first request, and the pinning proxy stays on with --chromium-host-resolver-rules.
  • Pinning proxy tunnels are bound to the server that accepted them. Refused outbound requests are logged with their context, redacted URL and rule.
  • Engine temporary files are collected by exact pattern, Chromium's profile directory is removed after a failed start, and handler panics answer 500 at once.
Removed
  • The deprecated --log-format, --log-enable-gcp-fields, --api-trace-header, --api-disable-health-check-logging, --chromium-incognito, --webhook-error-allow-list and --webhook-error-deny-list flags, and the --pdfengines-* and --prometheus-* ones.
  • UNOCONVERTER_BIN_PATH, replaced by LOK_BIN_PATH, and the pdfcpu, QPDF, pdftk and ExifTool paths.
  • downloadFrom[].embedded, facturxVersion and the merge bookmark options: the guide names their replacements.

Chore

  • Debian 13, Chromium 156 (146 on ppc64le), LibreOffice 26.8 from Debian's backports, Go 1.27, lok v0.0.6, litho v0.0.7.
  • CI runs the integration suite on every push to main and tests the Chromium and LibreOffice variants.
  • The Bruno collection mirrors every route.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot. The local configuration can be found in the SI Renovate Bot repository.

This PR contains the following updates: | Package | Type | Update | Change | OpenSSF | |---|---|---|---|---| | [docker.io/gotenberg/gotenberg](https://github.com/gotenberg/gotenberg) | Kustomization | major | `8.40.0` → `9.1.0` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/gotenberg/gotenberg/badge)](https://securityscorecards.dev/viewer/?uri=github.com/gotenberg/gotenberg) | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/30) for more information. --- ### Release Notes <details> <summary>gotenberg/gotenberg (docker.io/gotenberg/gotenberg)</summary> ### [`v9.1.0`](https://github.com/gotenberg/gotenberg/releases/tag/v9.1.0): 9.1.0 [Compare Source](https://github.com/gotenberg/gotenberg/compare/v9.0.0...v9.1.0) #### New Features - **`extract-attachments`** ([#&#8203;1718](https://github.com/gotenberg/gotenberg/issues/1718)). `/forms/pdf/extract-attachments` returns the files a PDF embeds, every one or the one `name` gives, as `<pdf>_<attachment>`: `invoice.pdf` gives `invoice_factur-x.xml`. Several files come back in a ZIP. A PDF without attachments, or without the named one, answers `400`. Thanks [@&#8203;Betelgeuse1](https://github.com/Betelgeuse1). - **`extract-text`**. `/forms/pdf/extract-text` returns the text of each PDF as a `.txt` file, pages joined by a form feed. `pages` selects pages; `invisible`, `artifacts` and `annotations` add invisible text, artifacts such as headers and stamps, and annotation text. Gotenberg does no OCR: a scanned page reads as empty. Both are stages too: they come last in a `stages` list, after `encrypt`, `sign` or `timestamp` if any, and the response holds the PDFs and the extracted files. #### Bug Fixes - **`backdrop-filter: blur()` rendered blank on linux/ppc64le** ([#&#8203;1491](https://github.com/gotenberg/gotenberg/issues/1491)). The ppc64le image pinned Chromium 146, which has the bug; it now installs the same Chromium as the other platforms. Thanks [@&#8203;florianaiautomation](https://github.com/florianaiautomation). - **Data race on concurrent stages.** Stages that write many files at once, such as `split` or `render` on several PDFs, could register their output names concurrently. #### Chore - linux/ppc64le moves from Chromium 146 to 156, from Debian's security updates. - Updated Go dependencies. ### [`v9.0.0`](https://github.com/gotenberg/gotenberg/releases/tag/v9.0.0): 9.0.0 [Compare Source](https://github.com/gotenberg/gotenberg/compare/v8.40.0...v9.0.0) Gotenberg 9 is out 🎉 > \[!IMPORTANT] > `latest` now points to Gotenberg 9. Pin `gotenberg/gotenberg:8` until you have upgraded. The [upgrade guide](https://gotenberg.dev/docs/getting-started/upgrade) maps every Gotenberg 8 route, field, flag, metric and span to its Gotenberg 9 counterpart. #### One PDF engine pdfcpu, QPDF, pdftk and ExifTool are replaced by [litho](https://github.com/gotenberg/litho), a PDF engine written in Go for Gotenberg, running in-process. `remediate` repairs a PDF until it conforms to one of the eleven PDF/A levels, to PDF/UA-1 or PDF/UA-2, to both together, or to Factur-X, then checks its own result: `Gotenberg-Remediation-Residual` counts the violations left, `Gotenberg-Remediation-Rolled-Back` the fixes undone to keep pages, text and images. `/forms/pdf/validate` runs the same checks on any PDF. litho also signs and timestamps, redacts from the file rather than from view, infers a structure tree, renders pages as images, fills and flattens forms in the scripts the image's fonts cover, and shrinks a PDF without touching image quality. A stage that would drop the signatures of a signed PDF answers `400`, as does text no font can draw. #### Stages, in your order Post-processing is no longer flat fields in a fixed order. A `stages` list runs as written, on every route that makes a PDF and on `/forms/pdf/pipe` for PDFs you already have: ```json [{"op": "merge"}, {"op": "stamp-text", "text": "DRAFT"}, {"op": "remediate", "profile": "PDF/A-2b"}] ``` 26 stages, each also a `/forms/pdf/<op>` route with form fields, plus six JSON read routes: info, validation, metadata, bookmarks, attachments and form fields. A broken order answers `400` before anything runs. #### LibreOffice through lok unoconverter, Python and the `soffice` listener are replaced by [lok](https://github.com/gotenberg/lok), a long-running LibreOfficeKit process that Gotenberg supervises and restarts after a crash. Macros stay off; `--libreoffice-enable-macros` runs them. #### Fewer dependencies, less CVE surface Java, Python, unoconverter, pdfcpu, QPDF, pdftk and ExifTool leave the image: fewer packages to patch, and no more CVE reports about tools Gotenberg does not ship. Variants, architectures, user, port and command don't change. #### Upgrading Start from the [upgrade guide](https://gotenberg.dev/docs/getting-started/upgrade). `/forms/pdfengines` routes become `/forms/pdf` routes, post-processing fields become stages, and a field with a stage twin now starts with `native`. A removed route answers `404` naming its replacement, a Gotenberg 8 field `400` saying where it went: ```text Invalid form data: form field 'merge' is unknown to this route; Gotenberg 9 moved it to a stage: add {"op":"merge"} to 'stages' ``` Custom builds import `github.com/gotenberg/gotenberg/v9`. The `PdfEngine`, `PdfEngineProvider` and `MetricsProvider` interfaces and the Prometheus module are gone: `OTEL_METRICS_EXPORTER=prometheus` serves the same. #### Everything else ##### PDF - `set-form` selects several list items, refuses a value a field cannot hold, and lists the PDF's fields when you name a missing one. `flatten-form` draws a value without appearance over the field's own background and border. - Flattened values and text stamps beyond Western European text use an installed font, embedded and subset. Uncovered text answers `400` naming the characters. - `optimize` packs objects into compressed streams, stores identical streams once, recompresses images losslessly and subsets fonts. Every pass runs unless turned off. An encrypted input needs a `decrypt` or `encrypt` stage first. - `merge` keeps each file's bookmarks, remapped, and names the result after the first file in alphanumeric order. - `render` draws pages as PNG or JPEG at the resolution you ask. - `--pdf-max-stream-bytes`, `--pdf-max-embedded-file-bytes` and `--pdf-max-image-pixels` bound what litho reads. `--pdf-allow-list`, `--pdf-deny-list` and their siblings filter the timestamp authorities it calls. ##### LibreOffice - `nativePdfa` takes `PDF/A-1b`, `PDF/A-2b`, `PDF/A-3b` or `PDF/A-4`; `nativePdfua` takes `PDF/UA-1`. The PDF/A export is no longer redone after the other steps: end the stages with `remediate` when they may break conformance. - `initialView`, `magnification` and `pageLayout` take names such as `outline` or `fitWidth`, not numbers. `firstPageOnLeft`, which LibreOffice ignored, and `nativePdfFormats` are gone. - `nativeWatermarkColor` takes `#rrggbb`, `nativeWatermarkRotation` degrees counter-clockwise, `0` being horizontal. A plain and a tiled watermark together answer `400`. - CSV files split into columns. `.epub` is no longer accepted. - PDFs are named after their documents, `report.docx.pdf`, even for a single one. `Gotenberg-Output-Filename` still overrides. ##### Chromium - `paperSize` names a format, for LibreOffice too: `A3`, `A4`, `A5`, `B4`, `B5`, `Letter`, `Legal` or `Tabloid`. - `waitForWindowStatus`, renamed from `waitWindowStatus`, now waits as documented. `skipNetworkAlmostIdleEvent=false` now really waits for `networkAlmostIdle`. - The page sent to the HTML and Markdown routes passes the allow and deny lists, which keep governing what it loads. - Print settings Chromium rejects answer `400`: a `scale` out of range, a negative length, a `waitDelay` longer than the API timeout. A wait that outlasts the request answers `503` naming the field and its value. - `failOnHttpStatusCodes` judges the main page by its frame, not its URL. Screenshot `quality` goes from 1 to 100. - DevTools messages leave the debug logs unless `--chromium-debug-protocol` is set. URL queries and extra header values stay out too. ##### API - `archives` unpacks uploaded ZIPs, bounded by `--api-archive-max-entries` and `--api-archive-max-ratio`. - Errors say what to send: the value sent and the one wanted, a stage option's expected value instead of a Go type, the host that does not resolve. `NaN` and infinities are refused. - Webhook and `downloadFrom` URLs must be absolute `http` or `https` URLs with a host. `Gotenberg-Webhook-Events-Url` is required with `Gotenberg-Webhook-Url` and receives errors as `webhook.error` events: the error URL, method and lists are gone. A failed upload says what the webhook answered, or why it was unreachable. - A non-ASCII `Gotenberg-Output-Filename` is encoded per RFC 6266. Every answer carries the trace header, 404 and 405 included; the version header too, without authentication. - The banner is an aligned startup summary, one log record outside a terminal. `--api-bind-ip` takes IPv6, `--api-start-timeout` bounds module readiness, `/debug` reports the lok and litho versions. - Debug logs mask form values, extra header values and document passwords. ##### Telemetry - Names follow the OpenTelemetry rules: `gotenberg.chromium.requests`, `gotenberg.<engine>.queue.size`, `chromium.pdf`, `webhook.send`. A failed request carries `error.type`; the `status` attribute and the errors counter are gone. - Each webhook and download attempt is an HTTP client span under the whole call's span, with `server.address` and a `url.full` stripped of credentials, query and fragment. Outbound URLs lose their query in errors and logs too. - The server span stays unset on success and `4xx`, and sets Error on `5xx` with the status code as `error.type`. `OTEL_PROPAGATORS` selects the propagators. Each written document is traced, its editing stages as child spans. ##### Security - The 8.40.0 fixes are in: IANA non-globally-reachable ranges are private for the `*_DENY_PRIVATE_IPS` checks, Chromium distrusts the compromised eMudhra roots from the first request, and the pinning proxy stays on with `--chromium-host-resolver-rules`. - Pinning proxy tunnels are bound to the server that accepted them. Refused outbound requests are logged with their context, redacted URL and rule. - Engine temporary files are collected by exact pattern, Chromium's profile directory is removed after a failed start, and handler panics answer `500` at once. ##### Removed - The deprecated `--log-format`, `--log-enable-gcp-fields`, `--api-trace-header`, `--api-disable-health-check-logging`, `--chromium-incognito`, `--webhook-error-allow-list` and `--webhook-error-deny-list` flags, and the `--pdfengines-*` and `--prometheus-*` ones. - `UNOCONVERTER_BIN_PATH`, replaced by `LOK_BIN_PATH`, and the pdfcpu, QPDF, pdftk and ExifTool paths. - `downloadFrom[].embedded`, `facturxVersion` and the merge bookmark options: the guide names their replacements. #### Chore - Debian 13, Chromium 156 (146 on ppc64le), LibreOffice 26.8 from Debian's backports, Go 1.27, lok v0.0.6, litho v0.0.7. - CI runs the integration suite on every push to `main` and tests the Chromium and LibreOffice variants. - The Bruno collection mirrors every route. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). The local configuration can be found in the [SI Renovate Bot repository](https://git.shivering-isles.com/shivering-isles/infrastructure-gitops/src/branch/main/apps/k8s01/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xOTguMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE5OC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
chore(deps): update docker.io/gotenberg/gotenberg docker tag to v9
All checks were successful
gitops-images Pipeline completed successfully
Details
6b189ff7ba
botaniker force-pushed renovate/docker.io-gotenberg-gotenberg-9.x from 6b189ff7ba
All checks were successful
gitops-images Pipeline completed successfully
Details
to 8988db67d2 2026-11-07 06:17:40 +00:00 Compare
Some required checks are missing.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin 'renovate/docker.io-gotenberg-gotenberg-9.x:renovate/docker.io-gotenberg-gotenberg-9.x'
git switch 'renovate/docker.io-gotenberg-gotenberg-9.x'
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
sheogorath
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
shivering-isles/infrastructure-gitops!507
No description provided.