Gotenberg Files

Security Fixes ⚠️

• Isolate each Chromium conversion in its own browser context. All conversions shared one cookie jar, so a cookie sent with one request authenticated later or concurrent conversions to the same origin. Each conversion now gets a private browser context, with its own cookies, cache, and storage, disposed when it ends. --chromium-clear-cookies only cleared the jar between sequential conversions and is no longer needed.
• Enforce --api-body-limit before parsing. The limit applied only after the whole multipart body was read and its files spooled to disk, so a request far above it consumed memory, disk, and I/O before the 413. Gotenberg now rejects an oversized Content-Length up front and stops reading at the limit otherwise.
• Filter loopback WebSockets against the allow-list and deny-list. With a list configured but --chromium-deny-private-ips and --chromium-deny-public-ips off, Chromium opened WebSockets to 127.0.0.1, ::1, or 169.254.169.254 directly, past the pinning proxy. They now go through the proxy whenever an outbound policy is set.
• Ignore IPv6 zone identifiers when classifying addresses. A zoned address such as http://[::%251]/ passed as public under the *_DENY_PRIVATE_IPS checks.

New Features

• --chromium-shared-browser-context. Restores the previous behavior, one browser context shared by every conversion, for deployments where all callers trust each other and want cookies, cache, and storage to carry over. --chromium-clear-cache, --chromium-clear-cookies, and --chromium-clear-storage now only apply with this flag.
• generateTaggedPdf for LibreOffice (#1676). Produces a tagged, accessible PDF without declaring PDF/UA conformance, like the Chromium field of the same name. pdfua still implies tagging (#1677). Thanks @joh-klein.

Behavior Changes

• Chromium cookies and storage no longer carry over between conversions. Set --chromium-shared-browser-context to keep them. Isolation adds a few dozen milliseconds per conversion.
• --api-body-limit counts the raw request body. Multipart boundaries and part headers now count toward the limit, so a request just under it may now get a 413.

Bug Fixes

• failOnResourceLoadingFailed missed unreachable resources behind the pinning proxy. The proxy answered 502, which Chromium treated as an ordinary response. It now resets the connection, and a failed HTTPS tunnel (net::ERR_TUNNEL_CONNECTION_FAILED) counts as a loading failure too.
• Intermittent 500 with a match timeout on the default deny-list (#1659). Since 8.37.0, a pattern match aborted by a process pause, such as container CPU throttling, failed the request. It is now retried, and a match that still cannot complete fails closed with a generic 403. Thanks @Patgoral.

Chore

• Updated Chromium to 155.0.8059.39, which fixes CVE-2026-87654 (#1666). Thanks @janpaepke.
• Updated LibreOffice to 26.8.1.
• Rebuilt on the latest Debian security updates (#1678). Thanks @pietrocosseddu-comand.
• Covered header and footer image deduplication with integration tests (#1675). Thanks @X-Coder264.
• Updated the AWS Lambda Web Adapter to 1.0.1.
• Migrated to Echo v5 and regexp2 v2.
• Updated OpenTelemetry to v1.47.0, where the Logs API is now stable.
• Updated Go and npm dependencies.