chore(deps): update unoconverter to v0.5.0

.github/workflows/continuous-integration.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Run linters
         uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.12.2
+          version: v2.13.2
 
   lint-prettier:
     name: Lint non-Golang codebase

build/Dockerfile

@@ -1,7 +1,7 @@
 # ARG instructions do not create additional layers. Instead, next layers will
 # concatenate them. Also, we have to repeat ARG instructions in each build
 # stage that uses them.
-ARG GOLANG_VERSION=1.26.5
+ARG GOLANG_VERSION=1.27.0
 
 # ----------------------------------------------
 # pdfcpu binary build stage
@@ -88,7 +88,7 @@ RUN apt-get update -qq \
 
 WORKDIR /downloads
 
-RUN curl -Ls https://raw.githubusercontent.com/gotenberg/unoconverter/v0.4.0/unoconv -o unoconverter \
+RUN curl -Ls https://raw.githubusercontent.com/gotenberg/unoconverter/v0.5.0/unoconv -o unoconverter \
     && chmod +x unoconverter
 
 RUN curl -o pdftk-all.jar "https://gitlab.com/api/v4/projects/5024297/packages/generic/pdftk-java/$PDFTK_VERSION/pdftk-all.jar" \

go.mod

@@ -1,11 +1,12 @@
 module github.com/gotenberg/gotenberg/v8
 
-go 1.26.5
+go 1.27.0
 
 require (
 	github.com/alexliesenfeld/health v0.8.1
 	github.com/chromedp/cdproto v0.0.0-20250803210736-d308e07a266d // pinned with chromedp v0.14.2, see below
 	github.com/chromedp/chromedp v0.14.2 // pinned: v0.15.x breaks the headless print-mode paint pipeline (rAF / ResizeObserver / IntersectionObserver stop firing, blank charts). See https://github.com/gotenberg/gotenberg/issues/1535.
+	github.com/coreos/go-oidc/v3 v3.20.0
 	github.com/cucumber/godog v0.16.0
 	github.com/dlclark/regexp2 v1.12.0
 	github.com/gomarkdown/markdown v0.0.0-20260725000948-8435af3f5984
@@ -24,6 +25,7 @@ require (
 	github.com/testcontainers/testcontainers-go v0.44.0
 	go.opentelemetry.io/contrib/bridges/otelslog v0.20.0
 	go.opentelemetry.io/contrib/exporters/autoexport v0.70.0
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0
 	go.opentelemetry.io/otel v1.45.0
 	go.opentelemetry.io/otel/log v0.21.0
 	go.opentelemetry.io/otel/metric v1.45.0
@@ -37,11 +39,6 @@ require (
 	golang.org/x/text v0.41.0
 )
 
-require (
-	github.com/coreos/go-oidc/v3 v3.20.0
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0
-)
-
 require (
 	dario.cat/mergo v1.0.2 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect

pkg/gotenberg/internal/otel/otel.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"log/slog"
 	"os"
+	"strings"
 	"sync/atomic"
 
 	"go.opentelemetry.io/contrib/bridges/otelslog"
@@ -74,6 +75,24 @@ func buildResource(ctx context.Context, logger *slog.Logger, serviceName, servic
 	return merged
 }
 
+// OTEL_*_EXPORTER select the exporter for each signal. autoexport treats an
+// unset or empty value as a request for the OTLP exporter, which then fails
+// against the default localhost:4318 endpoint when nothing listens there and,
+// for metrics, keeps retrying on the periodic reader's timer. Gotenberg keeps
+// telemetry opt-in: a signal with no exporter configured is built without one
+// and stays inert. See https://github.com/gotenberg/gotenberg/issues/1643.
+const (
+	tracesExporterEnvKey  = "OTEL_TRACES_EXPORTER"
+	metricsExporterEnvKey = "OTEL_METRICS_EXPORTER"
+	logsExporterEnvKey    = "OTEL_LOGS_EXPORTER"
+)
+
+// exporterConfigured reports whether the operator selected an exporter for the
+// signal owning envKey. An unset or blank value keeps that signal off.
+func exporterConfigured(envKey string) bool {
+	return strings.TrimSpace(os.Getenv(envKey)) != ""
+}
+
 // InitTracerProvider initializes the OpenTelemetry tracer provider.
 func InitTracerProvider(logger *slog.Logger, serviceName, serviceVersion string) (shutdown func(context.Context) error, err error) {
 	initOtelLogger(logger)
@@ -86,13 +105,14 @@ func InitTracerProvider(logger *slog.Logger, serviceName, serviceVersion string)
 		trace.WithResource(res),
 	}
 
-	traceExporter, err := autoexport.NewSpanExporter(ctx)
-	if err != nil {
-		return nil, err
-	}
-
-	if !autoexport.IsNoneSpanExporter(traceExporter) {
-		traceOpts = append(traceOpts, trace.WithBatcher(traceExporter))
+	if exporterConfigured(tracesExporterEnvKey) {
+		traceExporter, err := autoexport.NewSpanExporter(ctx)
+		if err != nil {
+			return nil, err
+		}
+		if !autoexport.IsNoneSpanExporter(traceExporter) {
+			traceOpts = append(traceOpts, trace.WithBatcher(traceExporter))
+		}
 	}
 
 	traceProvider := trace.NewTracerProvider(traceOpts...)
@@ -119,13 +139,14 @@ func InitMeterProvider(logger *slog.Logger, serviceName, serviceVersion string)
 	}
 	metricOpts = append(metricOpts, exemplarFilterOptions()...)
 
-	metricReader, err := autoexport.NewMetricReader(ctx)
-	if err != nil {
-		return nil, err
-	}
-
-	if !autoexport.IsNoneMetricReader(metricReader) {
-		metricOpts = append(metricOpts, metric.WithReader(metricReader))
+	if exporterConfigured(metricsExporterEnvKey) {
+		metricReader, err := autoexport.NewMetricReader(ctx)
+		if err != nil {
+			return nil, err
+		}
+		if !autoexport.IsNoneMetricReader(metricReader) {
+			metricOpts = append(metricOpts, metric.WithReader(metricReader))
+		}
 	}
 
 	meterProvider := metric.NewMeterProvider(metricOpts...)
@@ -157,13 +178,14 @@ func InitLoggerProvider(logger *slog.Logger, serviceName, serviceVersion string)
 		log.WithResource(res),
 	}
 
-	logExporter, err := autoexport.NewLogExporter(ctx)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	if !autoexport.IsNoneLogExporter(logExporter) {
-		logOpts = append(logOpts, log.WithProcessor(log.NewBatchProcessor(logExporter)))
+	if exporterConfigured(logsExporterEnvKey) {
+		logExporter, err := autoexport.NewLogExporter(ctx)
+		if err != nil {
+			return nil, nil, err
+		}
+		if !autoexport.IsNoneLogExporter(logExporter) {
+			logOpts = append(logOpts, log.WithProcessor(log.NewBatchProcessor(logExporter)))
+		}
 	}
 
 	loggerProvider := log.NewLoggerProvider(logOpts...)

pkg/gotenberg/internal/otel/otel_test.go

@@ -89,6 +89,49 @@ func TestInitTracerProvider_HonorsSamplerEnv(t *testing.T) {
 	}
 }
 
+// TestExporterConfigured pins the opt-in gate: an unset or blank
+// OTEL_*_EXPORTER keeps the signal off, so Gotenberg never wires the OTLP
+// exporter that autoexport would otherwise default to and fail to reach at
+// localhost:4318. See https://github.com/gotenberg/gotenberg/issues/1643.
+func TestExporterConfigured(t *testing.T) {
+	const key = "OTEL_METRICS_EXPORTER"
+
+	orig, had := os.LookupEnv(key)
+	t.Cleanup(func() {
+		if had {
+			os.Setenv(key, orig)
+			return
+		}
+		os.Unsetenv(key)
+	})
+
+	for _, tc := range []struct {
+		scenario string
+		unset    bool
+		value    string
+		want     bool
+	}{
+		{"unset", true, "", false},
+		{"empty", false, "", false},
+		{"whitespace only", false, "   ", false},
+		{"none", false, "none", true},
+		{"otlp", false, "otlp", true},
+		{"padded value", false, "  otlp  ", true},
+	} {
+		t.Run(tc.scenario, func(t *testing.T) {
+			if tc.unset {
+				os.Unsetenv(key)
+			} else {
+				os.Setenv(key, tc.value)
+			}
+
+			if got := exporterConfigured(key); got != tc.want {
+				t.Errorf("exporterConfigured(%q) = %v, want %v", key, got, tc.want)
+			}
+		})
+	}
+}
+
 func TestExemplarFilterOptions(t *testing.T) {
 	t.Run("default pins trace-based", func(t *testing.T) {
 		if v, ok := os.LookupEnv("OTEL_METRICS_EXEMPLAR_FILTER"); ok {

pkg/modules/api/formdata.go

@@ -612,7 +612,7 @@ func (form *FormData) mustValue(key string, target any, defaultValue any) *FormD
 	val, ok := form.values[key]
 
 	if !ok || val[0] == "" {
-		switch t := (target).(type) {
+		switch t := target.(type) {
 		case *string:
 			*t = defaultValue.(string)
 		case *bool:
@@ -659,7 +659,7 @@ func (form *FormData) mustMandatoryField(key string, target any) *FormData {
 func (form *FormData) mustAssign(key, value string, target any) *FormData {
 	var err error
 
-	switch t := (target).(type) {
+	switch t := target.(type) {
 	case *string:
 		*t = value
 	case *bool:

pkg/modules/chromium/browser.go

@@ -523,8 +523,45 @@ func (b *chromiumBrowser) do(ctx context.Context, logger *slog.Logger, url strin
 		cancelOnMainPageError:   taskCancel,
 	})
 
+	var (
+		crashed   error
+		crashedMu sync.RWMutex
+	)
+
+	// See https://github.com/gotenberg/gotenberg/issues/1640.
+	listenForEventTargetCrashed(taskCtx, logger, eventTargetCrashedOptions{
+		crashed:   &crashed,
+		crashedMu: &crashedMu,
+		cancel:    taskCancel,
+	})
+
 	runErr := chromedp.Run(taskCtx, tasks...)
 
+	// A crashed renderer is the root cause of every other failure this
+	// conversion may have recorded, so check it first.
+	// See https://github.com/gotenberg/gotenberg/issues/1640.
+	crashedMu.RLock()
+	defer crashedMu.RUnlock()
+
+	if crashed != nil {
+		return fmt.Errorf("handle tasks: %w", crashed)
+	}
+
+	// The browser context is only ever canceled when the browser process
+	// dies or is stopped, never on a request timeout. If the run failed
+	// and the browser context is done, the conversion failed because the
+	// browser went away mid-flight; fail fast with the same crash error
+	// instead of letting the error fall through as a generic context
+	// cancellation. The check is gated on runErr so a successful
+	// conversion is never discarded by a browser death that lands right
+	// after it.
+	// See https://github.com/gotenberg/gotenberg/issues/1640.
+	if runErr != nil {
+		if err := b.ctx.Err(); err != nil {
+			return fmt.Errorf("handle tasks: %w", ErrChromiumCrashed)
+		}
+	}
+
 	// Check event-driven errors first — they take priority over chromedp.Run
 	// errors because they carry the actual root cause (e.g., HTTP 500 from
 	// the main page). When we cancel taskCtx on a main page error,

pkg/modules/chromium/chromium.go

@@ -71,6 +71,10 @@ var (
 	// ErrResourceLoadingFailed happens when one or more resources failed to load.
 	ErrResourceLoadingFailed = errors.New("resource loading failed")
 
+	// ErrChromiumCrashed happens when the Chromium renderer crashes during a
+	// conversion.
+	ErrChromiumCrashed = errors.New("chromium crashed")
+
 	// PDF specific.
 
 	// ErrOmitBackgroundWithoutPrintBackground happens if
@@ -1106,6 +1110,8 @@ func chromiumErrorType(err error, queueReason string) string {
 		errors.Is(err, ErrInvalidEvaluationExpression),
 		errors.Is(err, ErrInvalidSelectorQuery):
 		return gotenberg.ErrorTypeInvalidInput
+	case errors.Is(err, ErrChromiumCrashed):
+		return "chromium_unavailable"
 	case errors.Is(err, gotenberg.ErrMaximumQueueSizeExceeded):
 		return queueReason
 	case errors.Is(err, gotenberg.ErrProcessAlreadyRestarting):

pkg/modules/chromium/errortype_test.go

@@ -21,6 +21,7 @@ func TestChromiumErrorType(t *testing.T) {
 		{"invalid resource http status", ErrInvalidResourceHttpStatusCode, "chromium_unavailable", "invalid_input"},
 		{"loading failed", ErrLoadingFailed, "chromium_unavailable", "invalid_input"},
 		{"resource loading failed", ErrResourceLoadingFailed, "chromium_unavailable", "invalid_input"},
+		{"crashed", ErrChromiumCrashed, "chromium_unavailable", "chromium_unavailable"},
 		{"invalid evaluation expression", ErrInvalidEvaluationExpression, "chromium_unavailable", "invalid_input"},
 		{"invalid selector query", ErrInvalidSelectorQuery, "chromium_unavailable", "invalid_input"},
 		{"pdf queue", gotenberg.ErrMaximumQueueSizeExceeded, "chromium_unavailable", "chromium_unavailable"},

pkg/modules/chromium/events.go

@@ -14,6 +14,7 @@ import (
 
 	"github.com/chromedp/cdproto/cdp"
 	"github.com/chromedp/cdproto/fetch"
+	"github.com/chromedp/cdproto/inspector"
 	"github.com/chromedp/cdproto/network"
 	"github.com/chromedp/cdproto/page"
 	"github.com/chromedp/cdproto/runtime"
@@ -521,6 +522,38 @@ func listenForEventExceptionThrown(ctx context.Context, logger *slog.Logger, con
 	})
 }
 
+type eventTargetCrashedOptions struct {
+	crashed   *error
+	crashedMu *sync.RWMutex
+	cancel    context.CancelFunc
+}
+
+// listenForEventTargetCrashed listens for the Inspector.targetCrashed event,
+// which Chromium sends when the renderer serving the conversion's tab
+// crashes. chromedp enables the Inspector domain on every target but does
+// not handle this event: left alone, the in-flight CDP command never
+// receives a response and the conversion blocks until the request deadline.
+// Record the crash and cancel the task context so the conversion fails fast
+// instead.
+// See https://github.com/gotenberg/gotenberg/issues/1640.
+func listenForEventTargetCrashed(ctx context.Context, logger *slog.Logger, options eventTargetCrashedOptions) {
+	chromedp.ListenTarget(ctx, func(ev any) {
+		if _, ok := ev.(*inspector.EventTargetCrashed); ok {
+			logger.DebugContext(ctx, "event EventTargetCrashed fired")
+
+			options.crashedMu.Lock()
+			defer options.crashedMu.Unlock()
+
+			*options.crashed = ErrChromiumCrashed
+
+			// Cancel the task context so the in-flight CDP command aborts
+			// immediately instead of waiting for a response the crashed
+			// renderer can never send.
+			options.cancel()
+		}
+	})
+}
+
 // waitForEventDomContentEventFired registers a listener for the
 // DomContentEventFired event and returns a waiter that blocks until the
 // event fires or ctx is done. The listener registers at call time, not

pkg/modules/chromium/routes.go

@@ -1020,6 +1020,16 @@ func handleChromiumError(err error, options Options) error {
 		return nil
 	}
 
+	if errors.Is(err, ErrChromiumCrashed) {
+		return api.WrapError(
+			err,
+			api.NewSentinelHttpError(
+				http.StatusServiceUnavailable,
+				"Chromium crashed while processing the request. Retry, or reduce the workload if the problem persists.",
+			),
+		)
+	}
+
 	if errors.Is(err, ErrInvalidEvaluationExpression) {
 		if options.WaitForExpression == "" {
 			// We do not expect the 'waitWindowStatus' form field to return

pkg/modules/chromium/routes_test.go

@@ -0,0 +1,51 @@
+package chromium
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/gotenberg/gotenberg/v8/pkg/modules/api"
+)
+
+// TestHandleChromiumError_Crashed pins the mapping of a Chromium renderer
+// crash to a 503 Service Unavailable. When the renderer crashes mid-conversion,
+// the request must fail fast with 503 rather than hang until the deadline and
+// surface as a generic timeout.
+// See https://github.com/gotenberg/gotenberg/issues/1640.
+func TestHandleChromiumError_Crashed(t *testing.T) {
+	// Mirror the wrapping done by [chromiumBrowser.do].
+	err := handleChromiumError(fmt.Errorf("handle tasks: %w", ErrChromiumCrashed), Options{})
+	if err == nil {
+		t.Fatal("expected an error, got none")
+	}
+
+	status, message := api.ParseError(err)
+	if status != http.StatusServiceUnavailable {
+		t.Errorf("status = %d, want %d (message: %s)", status, http.StatusServiceUnavailable, message)
+	}
+
+	want := "Chromium crashed while processing the request. Retry, or reduce the workload if the problem persists."
+	if message != want {
+		t.Errorf("message = %q, want %q", message, want)
+	}
+}
+
+// TestHandleChromiumError_CrashedTakesPrecedence guards the ordering in
+// [handleChromiumError]: a crash is a server-side failure and must map to 503
+// even when the error chain also carries a marker that another branch would
+// map to a client-error status.
+func TestHandleChromiumError_CrashedTakesPrecedence(t *testing.T) {
+	err := handleChromiumError(
+		fmt.Errorf("handle tasks: %w; %w", ErrChromiumCrashed, ErrInvalidHttpStatusCode),
+		Options{},
+	)
+	if err == nil {
+		t.Fatal("expected an error, got none")
+	}
+
+	status, _ := api.ParseError(err)
+	if status != http.StatusServiceUnavailable {
+		t.Errorf("status = %d, want %d", status, http.StatusServiceUnavailable)
+	}
+}

test/integration/features/chromium_convert_url.feature

@@ -1401,3 +1401,19 @@ Feature: /forms/chromium/convert/url
     Then the response header "Content-Type" should be "application/pdf"
     Then there should be 1 PDF(s) in the response
     Then the "foo.pdf" PDF should have 1 page(s)
+
+  # chrome://crash makes the renderer crash deterministically, the same
+  # failure class as a renderer crash triggered by the page content. The
+  # request must fail fast with a 503 instead of hanging until the API
+  # timeout.
+  # See https://github.com/gotenberg/gotenberg/issues/1640.
+  Scenario: POST /forms/chromium/convert/url (Chromium crash fails fast with 503)
+    Given I have a default Gotenberg container
+    When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/url" endpoint with the following form data and header(s):
+      | url | chrome://crash | field |
+    Then the response status code should be 503
+    Then the response header "Content-Type" should be "text/plain; charset=UTF-8"
+    Then the response body should contain string:
+      """
+      Chromium crashed while processing the request
+      """