Bump github.com/gotenberg/gotenberg/v8 from 8.31.0 to 8.32.0

[dependabot]

Bumps github.com/gotenberg/gotenberg/v8 from 8.31.0 to 8.32.0.

Release notes

Sourced from github.com/gotenberg/gotenberg/v8's releases.

8.32.0

Security Fixes ⚠️

• Reverted SSRF defaults (breaking vs 8.31.0). 8.31.0 blocked private-IP destinations by default, which broke deployments running Gotenberg inside a private network. 8.32.0 restores the 8.30.x permissive defaults. Operators with internet-facing APIs opt into the strict posture via the new flags below.

• Rejected file:// at /forms/chromium/convert/url. Submitting url=file:///tmp/... used to let an unauthenticated caller enumerate the request working directory and read other in-flight uploads as rendered PDFs. The route now returns HTTP 400 for any file:// URL.

• Required uploaded file for image / pdf stamp and watermark sources. Twelve callsites accepted stampSource=pdf or watermarkSource=pdf with an expression pointing at any path the Gotenberg process could open, even when no file was uploaded. Handlers now return HTTP 400 unless the caller uploaded a matching file.

• Scoped file:// sub-resources to the request working directory. Crafted HTML could reference another request's file:///tmp/<reqdir>/.... The CDP request handler now restricts file:// sub-resources to the current request's directory. /convert/url and /screenshot/url reject every file:// sub-resource outright.

• Hardened Chromium against DNS rebinding. A short-TTL DNS authority could return a public IP at validation and a private IP at connect. A loopback HTTP / CONNECT proxy now sits between Chromium and the network, resolves DNS once, and pins the dial to the resolved IP. Skipped when --chromium-proxy-server or --chromium-host-resolver-rules is set.

• Filtered LibreOffice outbound fetches through a proxy. Uploaded OOXML, RTF, and ODF files can embed external URLs that LibreOffice's libcurl resolves below every Go-side SSRF filter. LibreOffice now routes every outbound fetch through an in-process forward proxy on the same gotenberg.DecideOutbound path Chromium and webhook delivery use. See the four new flags below.

• Recovered webhook async panics. High-concurrency webhooks could panic the async goroutine and crash the whole process. The goroutine now snapshots the request context and recovers any future panic through the existing error path.

New Features

• LibreOffice outbound URL filtering. Four flags mirror the Chromium and webhook layout: --libreoffice-allow-list, --libreoffice-deny-list, --libreoffice-deny-private-ips, --libreoffice-deny-public-ips. All default permissive.

• IP-class filtering on four modules. chromium, webhook, api-download-from, and libreoffice each accept matching deny-private-ips and deny-public-ips flags. All default to false.

Flag	What it does
--chromium-deny-private-ips	Reject Chromium navigations and sub-resources resolving to a non-public IP.
--chromium-deny-public-ips	Reject Chromium navigations and sub-resources resolving to a public IP.
--webhook-deny-private-ips	Reject webhook URLs (success, error, events) resolving to a non-public IP.
--webhook-deny-public-ips	Reject webhook URLs resolving to a public IP.
--api-download-from-deny-private-ips	Reject downloadFrom URLs resolving to a non-public IP.
--api-download-from-deny-public-ips	Reject downloadFrom URLs resolving to a public IP.
--libreoffice-deny-private-ips	Reject LibreOffice outbound fetches resolving to a non-public IP.
--libreoffice-deny-public-ips	Reject LibreOffice outbound fetches resolving to a public IP.

A URL matching --*-allow-list skips the IP-class check. A URL matching --*-deny-list is always rejected. Setting both deny-private-ips=true and deny-public-ips=true rejects every URL unless the allow-list matches.

Bug Fixes

• Charts print as blank rectangles (#1531, #1532, #1534, #1535): chromedp v0.15.0 suspended the BeginFrame-driven callback dispatch loop under emulatedMediaType=print. requestAnimationFrame, ResizeObserver, IntersectionObserver, CSS transitionend, and CSS animationend all stopped firing. Pinning chromedp back to v0.14.2 restores native dispatch.

• LibreOffice cached an unrecoverable first-start error (#1538): A short --libreoffice-start-timeout timed out the first request, then every subsequent request returned the same cached error until the container restarted. The lazy-start path now retries on failure.

Chore

• Updated pdfcpu to v0.12.0.
• Switched metadata read/write to direct exiftool invocation. Removes the GPL-3.0 go-exiftool dependency.
• Bumped Go to 1.26.2.
• Updated Go dependencies.

Thanks

... (truncated)

Commits

• fe1b002 chore(deps): update golang to 1.26.2
• b47b9f4 docs(contributing): reorganize sections and slim PR checklist
• 8c0ad88 chore(deps): update pdfcpu to v0.12.0 (#1537)
• 45b9f32 refactor(chromium): drop paint-callback polyfill now that chromedp is pinned
• ace379a fix(deps): pin chromedp to v0.14.2 to restore print-mode paint pipeline
• 4998870 feat(libreoffice): SSRF guard for embedded external content
• 64c28dd fix(supervisor): retry first launch on failure (#1538)
• 68e0f88 refactor(exiftool): switch from go-exiftool library to direct CLI
• cc97cb7 docs(chromium): tighten paint-polyfill always-on godoc per CONTRIBUTING style
• 2003341 feat(chromium): always inject paint-callback polyfill to cover waitDelay users
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #12.