Gotenberg Files

Security Fixes ⚠️

• Sanitize the Gotenberg-Output-Filename header. filepath.Base ignores \ on Linux, so a crafted header reached archive entry names on splitMode conversions, giving a Windows-side Zip Slip.
• Bound scope matching per conversion. The extraHttpHeaders match timeout capped one match, not their number. Matching now shares a per-conversion budget, and extraHttpHeaders accepts at most 64 headers with a 1024-character scope.

New Features

• Authenticated proxy from environment variables. Four opt-in flags route outbound traffic through HTTP_PROXY, HTTPS_PROXY, and NO_PROXY, credentials included: --chromium-enable-environment-proxy, --libreoffice-enable-environment-proxy, --api-download-from-enable-environment-proxy, and --webhook-enable-environment-proxy. All default to false. Breaking: the outbound client no longer inherits HTTP_PROXY and HTTPS_PROXY implicitly.

Bug Fixes

• LibreOffice returned 400 for server-side failures (#1588). 400 now requires an implicated client input, nativePageRanges, password, or an unreadable document; everything else is 500. Thanks @ctunon-align.
• generateDocumentOutline was a silent no-op (#1579). It now enables generateTaggedPdf, which Chromium needs to build the outline. Thanks @paradoxloop.
• Pinning proxy latched after a Chromium start timeout. Starts are now serialized.
• LibreOffice leaked a document after a failed export. unoconverter now releases it.

Chore

• Updated Chromium to 151.0.7922.71.
• Updated pdfcpu to v0.13.0.
• Updated unoconverter to v0.4.0.
• Bumped Go to 1.26.5.
• Updated Go dependencies.