Gotenberg Files

Security Fixes ⚠️

• Filter WebSocket handshakes against the outbound policy. Chromium could open WebSocket connections to hosts the SSRF policy otherwise blocks.

New Features

• OIDC bearer token authentication. Opt-in via --api-enable-oidc-auth, mutually exclusive with basic auth (#1341). Thanks @mlgupta.
• Optimize PDF images to reduce file size (#359). A /forms/pdfengines/optimize route, plus an optimizeImages option on the Chromium, LibreOffice, merge, and split routes. Thanks @spointecker.
• Apply multiple stamps and watermarks in one request by repeating the fields, on every route that supports them (#1601). Thanks @Kobe-Kwanten.
• Screenshot a single element via the selector form field (#947). Thanks @human211.
• Table-of-contents bookmarks when merging. titleBookmarks adds one bookmark per input, labeled by its title (#867). Thanks @gnapse.
• Clear storage between conversions with --chromium-clear-storage (#919). Thanks @befresh-mweimerskirch.
• Await async waitForExpression. A Promise-returning expression is now awaited (#1617). Thanks @nhh.

Bug Fixes

• Landscape single-page now fits the page to its content (#1390). Thanks @JhnBer.
• Accept the OOXML PowerPoint show extensions .ppsx and .ppsm (#1626). Thanks @lyarov22.
• Client-cancelled requests are classified as 499, not 500 (#1627). Thanks @yngvar.
• Render scrolled workbooks in full for singlePageSheets.
• Return 403 instead of 500 for an unresolvable outbound host.
• Hint at --chromium-start-timeout when Chromium fails to start.

Chore

• Updated pdfcpu to v0.15.0 (#1628). Thanks @doronbehar.
• Bumped golangci-lint to v2.12.2.
• Updated Go and npm dependencies.