Update docker.io/gotenberg/gotenberg Docker tag to v8.39.0

v8.39.0: 8.39.0

Compare Source

Security Fixes ⚠️

• Reject ExifTool's j option alias and stop loading ExifTool config files. The metadata check blocked json but not its alias j. A metadata key could import a JSON file carrying a HardLink pseudo-tag, plant ~/.ExifTool_config, and have the next ExifTool run execute it as Perl. The keys j, addtagsfromfile, and alltagsfromfile now return 400, and Gotenberg always runs ExifTool with -config "".
• Accept only http:// and https:// URLs on the URL routes. The default deny-list only covered file://, so devtools://devtools/bundled/devtools_app.html loaded Chromium's privileged DevTools page, and waitForExpression ran there with access to local files. /forms/chromium/convert/url and /forms/chromium/screenshot/url now return 400 for any other scheme.
• Apply path and wss:// deny rules to WebSocket handshakes. The pinning proxy matched CONNECT tunnels against https://host:port, so a deny rule anchored on a path, such as ^https?://host/, or on wss:// refused the plain request but let the handshake through. The proxy now matches tunnels against each scheme's root URL, and a handshake whose full URL is denied fails the conversion with a generic 403.
• Drop the compromised eMudhra roots (#​1699). The images trusted emSign ECC Root CA - G3 and AAA Certificate Services, whose intermediates have recoverable private keys. The OS bundle now comes from ca-certificates 20250419+deb13u1, the Java trust store used by PDFtk drops both roots, and Chromium 156 rejects them. Thanks @​hrueger.

New Features

• failOnConsoleMessageTypes for Chromium (#​1667). Fails the conversion with 409 when the page logs a console message of one of the given types (log, debug, info, warning, error, assert). The response lists the messages. Thanks @​jschneider.
• PDF/A-4 (#​1703). The pdfa form field now accepts PDF/A-4 on every route that supports it, through the LibreOffice PDF engine. Thanks @​henningda.
• Gotenberg-Version response header (#​1693). Set on every authenticated route, error responses included, and on webhook deliveries. It is not set on 401 responses or /health (#​1694). Thanks @​fragkakis.

Behavior Changes

• The URL routes reject non-HTTP schemes. chrome://, devtools://, data:, and any other scheme besides http and https now return 400.
• ExifTool ignores ~/.ExifTool_config. The metadata keys j, addtagsfromfile, and alltagsfromfile now return 400. Prefix them with a group, for example XMP:j, to write a tag of that name.
• The XRECHNUNG Factur-X profile embeds xrechnung.xml. See the bug fix below.

Bug Fixes

• Sporadic 502 on uploads behind HTTP/2 proxies (#​1112). Behind Cloud Run with an h2c port, the proxy sent large DATA frames, Go answered with a flood of WINDOW_UPDATE frames, and the proxy dropped the connection mid-upload. Gotenberg now advertises the 16 KiB HTTP/2 default frame size (#​1700). Thanks @​TessilimiTheo and @​geoherna.
• No listener with absolute TLS paths (#​1690). Since 8.38.0, --api-tls-cert-file and --api-tls-key-file with absolute paths left Gotenberg running without accepting connections. Both paths work again, and a missing or unreadable file now fails the startup (#​1691). Thanks @​n-rodriguez.
• Empty stampSource or watermarkSource returned 400 (#​1692). Since 8.36.0, a blank source failed the merge, split, Chromium, and LibreOffice routes. An empty source is skipped again. Thanks @​APX403.
• OIDC rejected bearer in lower case (#​1696). The Authorization scheme is now matched case-insensitively, as RFC 9110 requires. Thanks @​MaxFreedomPollard.
• The XRECHNUNG Factur-X profile embedded factur-x.xml (#​1701). The spec requires xrechnung.xml for this profile, both as the embedded file and in fx:DocumentFileName. Other levels keep factur-x.xml. Thanks @​nhh.

Chore

• Updated Chromium to 156.0.8078.47.
• Updated pdfcpu to v0.16.3 and bumped Go to 1.27.3, which fix several HIGH CVEs in the Go standard library and golang.org/x modules (#​1695). Thanks @​sergeykad.
• Updated the AWS Lambda Web Adapter to 1.1.0, which supports Lambda SnapStart (#​1704). Thanks @​michael-follmann.
• Bumped golangci-lint to v2.15.0.
• Updated Go dependencies.