docker

Update docker.io/gotenberg/gotenberg Docker tag to v8.35.0

No problems upgrading the Docker container with a Docker compose yaml file within Portainer and by means of Portainer DevOps resp. GitOps with dependency update facilitated by Mend's Renovate Bot.

This MR contains the following updates:

Package	Update	Change
docker.io/gotenberg/gotenberg	minor	`8.34.0` → `8.35.0`

Release Notes

gotenberg/gotenberg (docker.io/gotenberg/gotenberg)

`v8.35.0`: 8.35.0

Compare Source

Security Fixes ⚠️

Sanitize the Gotenberg-Output-Filename header. filepath.Base ignores \ on Linux, so a crafted header reached archive entry names on splitMode conversions, giving a Windows-side Zip Slip.
Bound scope matching per conversion. The extraHttpHeaders match timeout capped one match, not their number. Matching now shares a per-conversion budget, and extraHttpHeaders accepts at most 64 headers with a 1024-character scope.

New Features

Authenticated proxy from environment variables. Four opt-in flags route outbound traffic through HTTP_PROXY, HTTPS_PROXY, and NO_PROXY, credentials included: --chromium-enable-environment-proxy, --libreoffice-enable-environment-proxy, --api-download-from-enable-environment-proxy, and --webhook-enable-environment-proxy. All default to false. Breaking: the outbound client no longer inherits HTTP_PROXY and HTTPS_PROXY implicitly.

Bug Fixes

LibreOffice returned 400 for server-side failures (#1588). 400 now requires an implicated client input, nativePageRanges, password, or an unreadable document; everything else is 500. Thanks @ctunon-align.
generateDocumentOutline was a silent no-op (#1579). It now enables generateTaggedPdf, which Chromium needs to build the outline. Thanks @paradoxloop.
Pinning proxy latched after a Chromium start timeout. Starts are now serialized.
LibreOffice leaked a document after a failed export. unoconverter now releases it.

Chore

Updated Chromium to 151.0.7922.71.
Updated pdfcpu to v0.13.0.
Updated unoconverter to v0.4.0.
Bumped Go to 1.26.5.
Updated Go dependencies.

Update codeberg.org/forgejo/forgejo Docker tag to v16.0.3

No problems automatically updating Docker container on premisis and run the container by Watchtower with dependency update facilitated by Mend's Renovate Bot. Also the container in the Oracle cloud infrastructure spun up with Docker Compose was updated by Watchtower with dependency update facilitated by Mend's Renovate

Update docker.io/gitlab/gitlab-ce Docker tag to v19.2.4

No problems automatically updating the monolithic Docker image and run the container by Watchtower with dependency update facilitated by Mend's Renovate Bot. GitLab Critical Patch Release: 19.2.4, 19.1.6, 19.0.8, 18.11.11 This MR contains the following updates: Package Update Change docker.

Update docker.io/nextcloud Docker tag to v34.0.3

Fully automated major upgrade by means of Watchtower Docker container management with dependency update facilitated by Mend's Renovate Bot. This MR contains the following updates: Package Update Change docker.io/nextcloud (source) patch 34.0.2-apache → 34.0.3-apache Release Notes nextcloud/server (docker.io/nextcloud)

Update docker.io/moonrailgun/tianji Docker tag to v1.32.24

No problems upgrading the Docker container with a Docker compose yaml file within Portainer and by means of Portainer DevOps resp. GitOps with dependency update facilitated by Mend's Renovate Bot. This MR contains the following updates: Package Update Change docker.io/moonrailgun/tianji patch 1.32.22 → 1.