jlab-cluster/helm-charts
3
0 Fork 0
Code Issues 16 Pull Requests 3 Actions Packages Wiki Activity

Update gotenberg/gotenberg Docker tag to v8.38.1 #141

Merged
jlab-renovate-bot merged 1 commits from renovate/gotenberg-gotenberg-8.x into main 2026-10-19 15:01:59 +02:00
Conversation 1 Commits 1 Files Changed 1
+2 -2
jlab-renovate-bot commented 2026-10-18 18:04:25 +02:00
Member
Copy link
Copy source

This PR contains the following updates:

Package Type Update Change
gotenberg/gotenberg app-version minor 8.37.0 → 8.38.1

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

gotenberg/gotenberg

v8.38.1: 8.38.1

Compare Source

Bug Fixes

  • The v8.38.0 Go module lacks LibreOffice generateTaggedPdf. The v8.38.0 tag moved after the Go module proxy had cached it, so go get github.com/gotenberg/gotenberg/v8@v8.38.0 resolves to the previous commit, and a direct fetch from GitHub fails checksum verification. v8.38.1 ships the same code as the 8.38.0 Docker image. Use it if you build Gotenberg from source or import it as a Go module. Docker users have nothing to do.

See 8.38.0 for the full release notes.

v8.38.0: 8.38.0

Compare Source

Security Fixes ⚠️

  • Isolate each Chromium conversion in its own browser context. All conversions shared one cookie jar, so a cookie sent with one request authenticated later or concurrent conversions to the same origin. Each conversion now gets a private browser context, with its own cookies, cache, and storage, disposed when it ends. --chromium-clear-cookies only cleared the jar between sequential conversions and is no longer needed.
  • Enforce --api-body-limit before parsing. The limit applied only after the whole multipart body was read and its files spooled to disk, so a request far above it consumed memory, disk, and I/O before the 413. Gotenberg now rejects an oversized Content-Length up front and stops reading at the limit otherwise.
  • Filter loopback WebSockets against the allow-list and deny-list. With a list configured but --chromium-deny-private-ips and --chromium-deny-public-ips off, Chromium opened WebSockets to 127.0.0.1, ::1, or 169.254.169.254 directly, past the pinning proxy. They now go through the proxy whenever an outbound policy is set.
  • Ignore IPv6 zone identifiers when classifying addresses. A zoned address such as http://[::%251]/ passed as public under the *_DENY_PRIVATE_IPS checks.

New Features

  • --chromium-shared-browser-context. Restores the previous behavior, one browser context shared by every conversion, for deployments where all callers trust each other and want cookies, cache, and storage to carry over. --chromium-clear-cache, --chromium-clear-cookies, and --chromium-clear-storage now only apply with this flag.
  • generateTaggedPdf for LibreOffice (#​1676). Produces a tagged, accessible PDF without declaring PDF/UA conformance, like the Chromium field of the same name. pdfua still implies tagging (#​1677). Thanks @​joh-klein.

Behavior Changes

  • Chromium cookies and storage no longer carry over between conversions. Set --chromium-shared-browser-context to keep them. Isolation adds a few dozen milliseconds per conversion.
  • --api-body-limit counts the raw request body. Multipart boundaries and part headers now count toward the limit, so a request just under it may now get a 413.

Bug Fixes

  • failOnResourceLoadingFailed missed unreachable resources behind the pinning proxy. The proxy answered 502, which Chromium treated as an ordinary response. It now resets the connection, and a failed HTTPS tunnel (net::ERR_TUNNEL_CONNECTION_FAILED) counts as a loading failure too.
  • Intermittent 500 with a match timeout on the default deny-list (#​1659). Since 8.37.0, a pattern match aborted by a process pause, such as container CPU throttling, failed the request. It is now retried, and a match that still cannot complete fails closed with a generic 403. Thanks @​Patgoral.

Chore

  • Updated Chromium to 155.0.8059.39, which fixes CVE-2026-87654 (#​1666). Thanks @​janpaepke.
  • Updated LibreOffice to 26.8.1.
  • Rebuilt on the latest Debian security updates (#​1678). Thanks @​pietrocosseddu-comand.
  • Covered header and footer image deduplication with integration tests (#​1675). Thanks @​X-Coder264.
  • Updated the AWS Lambda Web Adapter to 1.0.1.
  • Migrated to Echo v5 and regexp2 v2.
  • Updated OpenTelemetry to v1.47.0, where the Logs API is now stable.
  • Updated Go and npm dependencies.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [gotenberg/gotenberg](https://github.com/gotenberg/gotenberg) | app-version | minor | `8.37.0` → `8.38.1` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/4) for more information. --- ### Release Notes <details> <summary>gotenberg/gotenberg</summary> ### [`v8.38.1`](https://github.com/gotenberg/gotenberg/releases/tag/v8.38.1): 8.38.1 [Compare Source](https://github.com/gotenberg/gotenberg/compare/v8.38.0...v8.38.1) #### Bug Fixes - **The `v8.38.0` Go module lacks LibreOffice `generateTaggedPdf`.** The `v8.38.0` tag moved after the Go module proxy had cached it, so `go get github.com/gotenberg/gotenberg/v8@v8.38.0` resolves to the previous commit, and a direct fetch from GitHub fails checksum verification. `v8.38.1` ships the same code as the `8.38.0` Docker image. Use it if you build Gotenberg from source or import it as a Go module. Docker users have nothing to do. See [8.38.0](https://github.com/gotenberg/gotenberg/releases/tag/v8.38.0) for the full release notes. ### [`v8.38.0`](https://github.com/gotenberg/gotenberg/releases/tag/v8.38.0): 8.38.0 [Compare Source](https://github.com/gotenberg/gotenberg/compare/v8.37.0...v8.38.0) #### Security Fixes ⚠️ - **Isolate each Chromium conversion in its own browser context.** All conversions shared one cookie jar, so a cookie sent with one request authenticated later or concurrent conversions to the same origin. Each conversion now gets a private browser context, with its own cookies, cache, and storage, disposed when it ends. `--chromium-clear-cookies` only cleared the jar between sequential conversions and is no longer needed. - **Enforce `--api-body-limit` before parsing.** The limit applied only after the whole multipart body was read and its files spooled to disk, so a request far above it consumed memory, disk, and I/O before the `413`. Gotenberg now rejects an oversized `Content-Length` up front and stops reading at the limit otherwise. - **Filter loopback WebSockets against the allow-list and deny-list.** With a list configured but `--chromium-deny-private-ips` and `--chromium-deny-public-ips` off, Chromium opened WebSockets to `127.0.0.1`, `::1`, or `169.254.169.254` directly, past the pinning proxy. They now go through the proxy whenever an outbound policy is set. - **Ignore IPv6 zone identifiers when classifying addresses.** A zoned address such as `http://[::%251]/` passed as public under the `*_DENY_PRIVATE_IPS` checks. #### New Features - **`--chromium-shared-browser-context`.** Restores the previous behavior, one browser context shared by every conversion, for deployments where all callers trust each other and want cookies, cache, and storage to carry over. `--chromium-clear-cache`, `--chromium-clear-cookies`, and `--chromium-clear-storage` now only apply with this flag. - **`generateTaggedPdf` for LibreOffice** ([#&#8203;1676](https://github.com/gotenberg/gotenberg/issues/1676)). Produces a tagged, accessible PDF without declaring PDF/UA conformance, like the Chromium field of the same name. `pdfua` still implies tagging ([#&#8203;1677](https://github.com/gotenberg/gotenberg/pull/1677)). Thanks [@&#8203;joh-klein](https://github.com/joh-klein). #### Behavior Changes - **Chromium cookies and storage no longer carry over between conversions.** Set `--chromium-shared-browser-context` to keep them. Isolation adds a few dozen milliseconds per conversion. - **`--api-body-limit` counts the raw request body.** Multipart boundaries and part headers now count toward the limit, so a request just under it may now get a `413`. #### Bug Fixes - **`failOnResourceLoadingFailed` missed unreachable resources behind the pinning proxy.** The proxy answered `502`, which Chromium treated as an ordinary response. It now resets the connection, and a failed HTTPS tunnel (`net::ERR_TUNNEL_CONNECTION_FAILED`) counts as a loading failure too. - **Intermittent `500` with a match timeout on the default deny-list** ([#&#8203;1659](https://github.com/gotenberg/gotenberg/issues/1659)). Since 8.37.0, a pattern match aborted by a process pause, such as container CPU throttling, failed the request. It is now retried, and a match that still cannot complete fails closed with a generic `403`. Thanks [@&#8203;Patgoral](https://github.com/Patgoral). #### Chore - Updated Chromium to `155.0.8059.39`, which fixes CVE-2026-87654 ([#&#8203;1666](https://github.com/gotenberg/gotenberg/issues/1666)). Thanks [@&#8203;janpaepke](https://github.com/janpaepke). - Updated LibreOffice to `26.8.1`. - Rebuilt on the latest Debian security updates ([#&#8203;1678](https://github.com/gotenberg/gotenberg/issues/1678)). Thanks [@&#8203;pietrocosseddu-comand](https://github.com/pietrocosseddu-comand). - Covered header and footer image deduplication with integration tests ([#&#8203;1675](https://github.com/gotenberg/gotenberg/pull/1675)). Thanks [@&#8203;X-Coder264](https://github.com/X-Coder264). - Updated the AWS Lambda Web Adapter to `1.0.1`. - Migrated to Echo `v5` and regexp2 `v2`. - Updated OpenTelemetry to `v1.47.0`, where the Logs API is now stable. - Updated Go and npm dependencies. </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjYuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE2Ni4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJhcHAtdmVyc2lvbiIsInJlbm92YXRlIl19-->
jlab-renovate-bot added the renovate label 2026-10-18 18:04:25 +02:00
jlab-renovate-bot added 1 commit 2026-10-18 18:04:25 +02:00
Update gotenberg/gotenberg Docker tag to v8.38.1
renovate/stability-days Updates have met minimum release age requirement
Details
Validate Helm Charts / Detect changed charts (pull_request) Successful in 2s
Details
Validate Helm Charts / Resource quantities (pull_request) Successful in 10s
Details
Validate Helm Charts / Selector match (pull_request) Successful in 10s
Details
Validate Helm Charts / HTTPRoute match (pull_request) Successful in 9s
Details
Validate Helm Charts / Bump level (pull_request) Successful in 4s
Details
Validate Helm Charts / YAML scalars (pull_request) Successful in 10s
Details
Validate Helm Charts / NetworkPolicy (pull_request) Successful in 10s
Details
Validate Helm Charts / Build gotenberg (pull_request) Successful in 6s
Details
Validate Helm Charts / Trivy config gotenberg (pull_request) Successful in 12s
Details
Install-test / Install-test gotenberg (pull_request) Successful in 1m43s
Details
Validate Helm Charts / Install-test (pull_request) Successful in 1m44s
Details
474de36082
jlab-renovate-bot scheduled this pull request to auto merge when all checks succeed 2026-10-18 18:04:27 +02:00
jklein approved these changes 2026-10-19 15:01:58 +02:00
jlab-renovate-bot merged commit 79aa97475e into main 2026-10-19 15:01:59 +02:00
jlab-renovate-bot deleted branch renovate/gotenberg-gotenberg-8.x 2026-10-19 15:02:00 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
jklein
Labels
Clear labels
inhouse-chart
Inhouse-Chart aus der JLab-Git-Paketregistry
 renovate
Von Renovate angelegt
No labels renovate
Milestone
No items
No Milestone
Assignees
Clear assignees
jklein (Justin Klein) jlab-bot (jlab-git-bot) jlab-renovate-bot (jlab-renovate-bot)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: jlab-cluster/helm-charts#141