What gotenberg/gotenberg shipped
Written by FoxPlug from the repository's own releases; not affiliated with Gotenberg. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/gotenberg/gotenberg; Gotenberg did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Gotenberg 9.2.0 adds a compose route that draws pages of uploaded PDFs onto new pages of a chosen size. Release
- Gotenberg 9.1.0 adds an extract-attachments route that returns embedded files from a PDF, named or all, as a ZIP when there are several. Release
- Gotenberg 9.0.0 is released, replacing pdfcpu, QPDF, pdftk and ExifTool with litho as the single PDF engine, and includes an upgrade guide mapping every version 8 route, field, flag, metric and span. Release
- Gotenberg 8.40.0 is the final version 8 release and fixes passing encryption passwords to QPDF as option values. Release
- Gotenberg 8.39.0 rejects ExifTool's j option alias and stops loading ExifTool config files. Release
- A change makes image optimization keep only replacements that shrink the PDF, after charts came back larger with optimizeImages=true. Pull request #1714
- The Docker image drops python3-distutils-extra and 45 dependencies it brought in. Pull request #1710
Why it matters
Version 9 is now the latest release and replaces four PDF tools with a single engine, with an upgrade guide for every route, field, flag, metric and span from version 8. Version 8 users should stay pinned to version 8 until they upgrade, and version 8.40.0 is its final release. The new compose and extract-attachments routes add page composition and attachment extraction, and several security fixes harden how ExifTool and QPDF handle input.
Changelog entry
- 9.2.0: new compose route draws pages of uploaded PDFs on new pages sized by paperSize or paperWidth and paperHeight. Release
- 9.1.0: new extract-attachments route returns a PDF's embedded files, named or all, as a ZIP when several. Release
- 9.0.0: litho replaces pdfcpu, QPDF, pdftk and ExifTool; upgrade guide maps every version 8 route, field, flag, metric and span. Release
- 8.40.0: final version 8 release; encryption passwords passed to QPDF as option values. Release
- 8.39.0: reject ExifTool j option alias and stop loading ExifTool config files. Release
- Image optimization keeps only replacements that shrink the PDF. Pull request #1714
- Docker image drops python3-distutils-extra and 45 dependencies. Pull request #1710
Gotenberg 9 is released: litho replaces pdfcpu, QPDF, pdftk and ExifTool, with an upgrade guide mapping every version 8 route, field, flag, metric and span. Version 8.40.0 is the final version 8 release; pin version 8 until you upgrade. New: compose and extract-attachments routes
Gotenberg 9 is now the latest release. It replaces pdfcpu, QPDF, pdftk and ExifTool with litho as the single PDF engine, and includes an upgrade guide that maps every Gotenberg 8 route, field, flag, metric and span to its version 9 counterpart. Version 8.40.0 is the final version 8 release, so pin gotenberg/gotenberg:8 until you have upgraded. Version 9 also adds a compose route for drawing pages of uploaded PDFs onto new pages of a chosen size, and an extract-attachments route for returning files embedded in a PDF. Version 8 releases this week fixed passing encryption passwords to QPDF as option values and rejected ExifTool's j option alias and config file loading.
Week of October 26, 2026
What shipped
- Released 8.39.0 with a security fix that rejects ExifTool's j option alias and stops loading ExifTool config files. Release
- Fixed image optimization in pdfcpu so extracted images are matched by page when optimizeImages is enabled. Pull request #1708
- Fixed Chromium print parameter handling so every InvalidParams error returns 400 instead of 500. Pull request #1707
- Fixed LibreOffice conversion so PDF formats are applied after merging documents, preserving PDF/A output. Pull request #1705
- Added PDF/A-4 support to the pdfa form field for LibreOffice conversions. Pull request #1703
Why it matters
This week closes a security gap in ExifTool handling and fixes three conversion problems that affected merged PDFs and error responses. Users merging documents with images or with PDF/A, and users sending print parameters that Chromium rejects, get correct output and clearer failures.
Changelog entry
- Security: reject ExifTool's j option alias and stop loading ExifTool config files. Release
- Fix pdfcpu image optimization to match extracted images by page. Pull request #1708
- Return 400 for every Chromium print parameter rejection. Pull request #1707
- Apply PDF formats after merging LibreOffice documents. Pull request #1705
- Add PDF/A-4 to the pdfa form field for LibreOffice. Pull request #1703
Gotenberg 8.39.0 is out: security fix for ExifTool config loading and its j alias. Also fixed image matching in pdfcpu optimization, 400 responses for all Chromium print parameter errors, PDF formats applied after LibreOffice merges, and PDF/A-4 support.
Gotenberg 8.39.0 is available. This release includes a security fix that rejects ExifTool's j option alias and stops loading ExifTool config files. It also fixes image optimization so extracted images are matched by page, returns 400 for every Chromium print parameter it rejects, applies PDF formats after merging LibreOffice documents so PDF/A output is preserved, and adds PDF/A-4 support to the pdfa form field.
Week of October 19, 2026
What shipped
- Every authenticated API route, including error responses, now sets a Gotenberg-Version response header so clients can record which version produced a result without polling the version endpoint. Pull request #1694
- The TLS certificate and key are now read before the server starts, so absolute paths passed to the API TLS cert and key flags no longer leave Gotenberg running with no listener. Pull request #1691
- An empty stampSource or watermarkSource is now treated as no entry, so requests that previously failed with a 400 invalid form data error succeed again. Pull request #1692
- The OIDC Bearer scheme is now matched case-insensitively, so Authorization headers spelled bearer or BEARER with a valid token no longer get a 401. Pull request #1696
- The HTTP/2 server now advertises the protocol default 16 KiB maximum frame size instead of Go's 1 MiB default, which stops a class of sporadic connection resets. Pull request #1700
Why it matters
This week fixes several regressions that broke working configurations: absolute TLS paths that left the server with no listener, and empty stamp or watermark sources that started failing requests. It also makes OIDC auth accept valid tokens regardless of how the Bearer scheme is capitalized. Clients get a new way to record the version behind a result, and HTTP/2 connections should reset less often.
Changelog entry
- Feat(api): add Gotenberg-Version response header on every authenticated route, error responses included; not set on 401s or the health endpoint. Pull request #1694
- Fix(api): read the TLS certificate and key before starting the server so absolute paths no longer leave Gotenberg with no listener. Pull request #1691
- Fix(pdfengines): treat an empty stamp or watermark source as no entry instead of failing the request. Pull request #1692
- Fix(api): match the OIDC Bearer scheme case-insensitively in the Authorization header. Pull request #1696
- Fix(api): advertise a 16 KiB HTTP/2 max frame size instead of Go's 1 MiB default. Pull request #1700
This week: a Gotenberg-Version header on authenticated responses, absolute TLS cert paths fixed, empty stamp and watermark sources treated as no entry, case-insensitive Bearer scheme for OIDC, and a 16 KiB HTTP/2 max frame size.
This week's changes to Gotenberg: authenticated API routes now set a Gotenberg-Version response header so clients can record which version produced a result without polling the version endpoint. TLS certificate and key files are read before the server starts, so absolute paths no longer leave Gotenberg running with no listener. An empty stampSource or watermarkSource is treated as no entry again. The OIDC Bearer scheme is matched case-insensitively, so valid tokens pass regardless of capitalization. The HTTP/2 server now advertises the protocol default 16 KiB maximum frame size instead of Go's 1 MiB default, which stops a class of sporadic connection resets.
More from gotenberg/gotenberg on GitHub
Merged pull requests
- fix(libreoffice): report an encrypted .xlsb as password-protected (#1655, merged September 6, 2026 by MaxFreedomPollard) (source)
- fix(Dockerfile): re-add libreoffice-math so DOCX math formulas render (#1645, merged September 2, 2026 by joh-klein) (source)
- fix(chromium): fail fast with 503 when Chromium crashes (#1641, merged August 31, 2026 by Haseeb-1698) (source)
- Await thenable js expression (#1617, merged August 14, 2026 by nhh) (source)
- fix(libreoffice): accept the OOXML PowerPoint show extensions (#1626, merged August 14, 2026 by lyarov22) (source)