Bump github.com/gotenberg/gotenberg/v8 from 8.31.0 to 8.33.0 in the go_modules group across 1 directory

[dependabot]

Bumps the go_modules group with 1 update in the / directory: github.com/gotenberg/gotenberg/v8.

Updates github.com/gotenberg/gotenberg/v8 from 8.31.0 to 8.33.0

Release notes

Sourced from github.com/gotenberg/gotenberg/v8's releases.

8.33.0

Security Fixes ⚠️

• Block IPv6 prefixes that tunnel to internal IPv4 in IsPublicIP. ::ffff:10.0.0.1, 2002:c0a8:: (6to4), and 2001::/32 (Teredo) embed an internal IPv4 destination inside an IPv6 address. IsPublicIP evaluated only the outer IPv6 form, so --*-deny-private-ips filters let the embedded private IPv4 reach the dialer. The check now unwraps IPv4-mapped, IPv4-translated, 6to4, and Teredo addresses, and rejects them when the embedded IPv4 is non-public.
• Strip backslash separators from supplied filenames. Linux treated a caller-supplied Gotenberg-Output-Filename header or filename form field containing ..\ or foo\bar as a single segment. The handler now strips both forward-slash and backslash path separators before composing the output path.

New Features

• Device scale ratio for screenshots (#1543). A new deviceScaleFactor form field on /forms/chromium/screenshot/{html,url,markdown} controls the screenshot pixel density. Defaults to 1. Thanks @​hovcharenko.

Bug Fixes

• Pinning proxy outlived a failed Chromium start. When chromedp failed to start (port conflict, container OOM, sandbox denial), the loopback HTTP/CONNECT pinning proxy added in 8.32.0 stayed bound to its port and leaked across restart attempts. The browser now stops the pinning proxy on every start failure.
• Lifecycle listener race on Navigate. chromedp.Navigate could fire Page.lifecycleEvent before Gotenberg's listener subscribed, so the converter occasionally waited the full network-idle timeout on otherwise fast pages. Listeners now register before navigation.
• Supervisor flapped on transient CDP latency. A single slow CDP health probe marked the supervised process unhealthy and triggered a restart, even when the next probe succeeded. Probes now require N consecutive failures before reporting unhealthy.
• downloadFrom concurrent map writes. Parallel downloadFrom entries merged results into a shared map without a lock. Under enough concurrency this raced and panicked the request goroutine. Result merging is now serialized.
• Pinning-proxy noise on client cancellations. context canceled and connection reset by peer from the client side of the pinning proxy logged at error level, flooding logs whenever a caller aborted mid-render. Client-cancelled dial errors now log at debug.

Chore

• Updated Chromium to version 148.0.7778.178-1.
• Updated Go dependencies.

8.32.0

Security Fixes ⚠️

• Reverted SSRF defaults (breaking vs 8.31.0). 8.31.0 blocked private-IP destinations by default, which broke deployments running Gotenberg inside a private network. 8.32.0 restores the 8.30.x permissive defaults. Operators with internet-facing APIs opt into the strict posture via the new flags below.

• Rejected file:// at /forms/chromium/convert/url. Submitting url=file:///tmp/... used to let an unauthenticated caller enumerate the request working directory and read other in-flight uploads as rendered PDFs. The route now returns HTTP 400 for any file:// URL.

• Required uploaded file for image / pdf stamp and watermark sources. Twelve callsites accepted stampSource=pdf or watermarkSource=pdf with an expression pointing at any path the Gotenberg process could open, even when no file was uploaded. Handlers now return HTTP 400 unless the caller uploaded a matching file.

• Scoped file:// sub-resources to the request working directory. Crafted HTML could reference another request's file:///tmp/<reqdir>/.... The CDP request handler now restricts file:// sub-resources to the current request's directory. /convert/url and /screenshot/url reject every file:// sub-resource outright.

• Hardened Chromium against DNS rebinding. A short-TTL DNS authority could return a public IP at validation and a private IP at connect. A loopback HTTP / CONNECT proxy now sits between Chromium and the network, resolves DNS once, and pins the dial to the resolved IP. Skipped when --chromium-proxy-server or --chromium-host-resolver-rules is set.

• Filtered LibreOffice outbound fetches through a proxy. Uploaded OOXML, RTF, and ODF files can embed external URLs that LibreOffice's libcurl resolves below every Go-side SSRF filter. LibreOffice now routes every outbound fetch through an in-process forward proxy on the same gotenberg.DecideOutbound path Chromium and webhook delivery use. See the four new flags below.

• Recovered webhook async panics. High-concurrency webhooks could panic the async goroutine and crash the whole process. The goroutine now snapshots the request context and recovers any future panic through the existing error path.

New Features

... (truncated)

Commits

• 190cad0 test(integration): surface container logs on failed startup
• 1d0c9ac fix(otel): align resource semconv to v1.41.0 to match SDK default
• 08181f8 test(integration): prune orphaned networks to avoid subnet exhaustion
• 9ea0e82 chore(deps): update Go dependencies
• 7967035 fix(chromium): downgrade pinning-proxy dial logs for client-cancelled requests
• 3d891ed fix(gotenberg): debounce supervisor health probes to absorb transient CDP lat...
• 320ad62 docs(README): add FileToPDF.dev sponsor
• 27e70fd fix(chromium): stop pinning proxy when chromedp start fails
• 2a9bf6b fix(chromium): register lifecycle listeners before navigate to close race
• 7f9c3e1 fix(chromium): downgrade pinning-proxy logs for client-cancelled requests
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.