chore(deps): update golang to 1.26.2

This reverts commit 430f95f79f.

.bruno/Chromium/Convert/HTML to PDF.bru

@@ -11,7 +11,7 @@ post {
 }
 
 body:multipart-form {
-  files: @file(../../test/integration/testdata/page-1-html/index.html)
+  files: @file(../test/integration/testdata/page-1-html/index.html)
   ~landscape: false
   ~printBackground: false
   ~scale: 1.0
@@ -50,6 +50,9 @@ body:multipart-form {
   ~metadata: {"Author":"Bruno","Title":"Test"}
   ~userPassword:
   ~ownerPassword:
+  ~embeds: @file(../test/integration/testdata/embed_1.xml)
+  ~embeds: @file(../test/integration/testdata/embed_2.xml)
+  ~embedsMetadata: {"embed_1.xml":{"mimeType":"text/xml","relationship":"Data"}, "embed_2.xml":{"mimeType":"text/xml","relationship":"Data"}}
   ~watermarkSource: text
   ~watermarkExpression: CONFIDENTIAL
   ~watermarkPages:

.bruno/Chromium/Convert/Markdown to PDF.bru

@@ -51,6 +51,9 @@ body:multipart-form {
   ~metadata: {"Author":"Bruno","Title":"Test"}
   ~userPassword:
   ~ownerPassword:
+  ~embeds: @file(../test/integration/testdata/embed_1.xml)
+  ~embeds: @file(../test/integration/testdata/embed_2.xml)
+  ~embedsMetadata: {"embed_1.xml":{"mimeType":"text/xml","relationship":"Data"}, "embed_2.xml":{"mimeType":"text/xml","relationship":"Data"}}
   ~watermarkSource: text
   ~watermarkExpression: CONFIDENTIAL
   ~watermarkPages:

.bruno/Chromium/Convert/URL to PDF.bru

@@ -50,6 +50,9 @@ body:multipart-form {
   ~metadata: {"Author":"Bruno","Title":"Test"}
   ~userPassword:
   ~ownerPassword:
+  ~embeds: @file(../test/integration/testdata/embed_1.xml)
+  ~embeds: @file(../test/integration/testdata/embed_2.xml)
+  ~embedsMetadata: {"embed_1.xml":{"mimeType":"text/xml","relationship":"Data"}, "embed_2.xml":{"mimeType":"text/xml","relationship":"Data"}}
   ~watermarkSource: text
   ~watermarkExpression: CONFIDENTIAL
   ~watermarkPages:

.bruno/LibreOffice/Convert to PDF.bru

@@ -11,7 +11,7 @@ post {
 }
 
 body:multipart-form {
-  files: @file(../../test/integration/testdata/page_1.docx)
+  files: @file(../test/integration/testdata/page_1.docx)
   ~password:
   ~landscape: false
   ~nativePageRanges:
@@ -67,6 +67,9 @@ body:multipart-form {
   ~metadata: {"Author":"Bruno","Title":"Test"}
   ~userPassword:
   ~ownerPassword:
+  ~embeds: @file(../test/integration/testdata/embed_1.xml)
+  ~embeds: @file(../test/integration/testdata/embed_2.xml)
+  ~embedsMetadata: {"embed_1.xml":{"mimeType":"text/xml","relationship":"Data"}, "embed_2.xml":{"mimeType":"text/xml","relationship":"Data"}}
   ~watermarkSource: text
   ~watermarkExpression: CONFIDENTIAL
   ~watermarkPages:

.bruno/PDF Engines/Embed/Embed Files.bru

@@ -11,8 +11,10 @@ post {
 }
 
 body:multipart-form {
-  files: @file(../../test/integration/testdata/page_1.pdf)
-  embeds: @file(../../test/integration/testdata/page_1.pdf)
+  files: @file(../test/integration/testdata/page_1.pdf)
+  embeds: @file(../test/integration/testdata/embed_1.xml)
+  embeds: @file(../test/integration/testdata/embed_2.xml)
+  embedsMetadata: {"embed_1.xml":{"mimeType":"text/xml","relationship":"Data"}, "embed_2.xml":{"mimeType":"text/xml","relationship":"Data"}}
   ~downloadFrom: [{"url":"https://example.com/attachment.xml","embedded":true}]
 }
 

.bruno/README.md

@@ -1,24 +1,24 @@
 # Bruno API Collection
 
-A [Bruno](https://www.usebruno.com/) collection in `.bruno/` mirrors every Gotenberg route. Update the collection when adding or updating a route.
+[Bruno](https://www.usebruno.com/) collection mirroring every Gotenberg route. Update the collection when adding or modifying a route.
 
 ## Structure
 
 ```
 .bruno/
-├── bruno.json                     # Collection config
-├── collection.bru                 # Collection-level defaults (Gotenberg-Trace header)
+├── bruno.json                      # Collection config
+├── collection.bru                  # Collection-level defaults (Gotenberg-Trace header)
 ├── environments/
-│   ├── Local.bru                  # baseUrl: http://localhost:3000
-│   └── Demo.bru                   # baseUrl: https://demo.gotenberg.dev
-├── Health & Info/                  # GET routes
-├── Chromium/Convert/               # POST routes grouped by module
+│   ├── Local.bru                   # baseUrl: http://localhost:3000
+│   └── Demo.bru                    # baseUrl: https://demo.gotenberg.dev
+├── Health & Info/                   # GET routes
+├── Chromium/Convert/                # POST routes grouped by module
 ├── Chromium/Screenshot/
 ├── LibreOffice/
-└── PDF Engines/<Feature>/          # One folder per feature (Merge, Split, Rotate, …)
+└── PDF Engines/<Feature>/           # One folder per feature (Merge, Split, Rotate, ...)
 ```
 
-## `.bru` File Format
+## `.bru` file format
 
 ```bru
 meta {
@@ -51,12 +51,12 @@ headers {
 
 ## Conventions
 
-- **Mandatory fields** have no prefix; **optional fields** use the `~` prefix (disabled by default in Bruno).
-- **File references** use relative paths to `test/integration/testdata/`.
-- **Webhook and output filename headers** appear on every POST route as optional (`~`).
-- **One `.bru` file per request.** For routes with read/write variants (e.g., bookmarks, metadata), create separate files in the same folder.
+- Mandatory fields have no prefix. Optional fields use `~` (disabled by default in Bruno).
+- File references use relative paths to `test/integration/testdata/`.
+- Webhook and output filename headers appear on every POST route as optional (`~`).
+- One `.bru` file per request. For routes with read/write variants (e.g., bookmarks, metadata), create separate files in the same folder.
 
-## Checklist When Adding/Updating a Route
+## Checklist
 
 1. Create or update the `.bru` file in the matching folder under `.bruno/`.
 2. Include all form fields from the route handler. Check `FormData*` calls in the route function.

.github/dependabot.yml

@@ -16,3 +16,5 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/continuous-delivery.yml

@@ -162,7 +162,6 @@ jobs:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
           tags: "${{ needs.release_amd64.outputs.tags }},${{ needs.release_386.outputs.tags }},${{ needs.release_ppc64le.outputs.tags }},${{ needs.release_arm64.outputs.tags }},${{ needs.release_arm_v7.outputs.tags }}"
-          alternate_registry: thecodingmachine
 
       - name: Merge Chromium
         uses: ./.github/actions/merge
@@ -170,7 +169,6 @@ jobs:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
           tags: "${{ needs.release_amd64.outputs.tags_chromium }},${{ needs.release_386.outputs.tags_chromium }},${{ needs.release_ppc64le.outputs.tags_chromium }},${{ needs.release_arm64.outputs.tags_chromium }},${{ needs.release_arm_v7.outputs.tags_chromium }}"
-          alternate_registry: thecodingmachine
 
       - name: Merge LibreOffice
         uses: ./.github/actions/merge
@@ -178,7 +176,6 @@ jobs:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
           tags: "${{ needs.release_amd64.outputs.tags_libreoffice }},${{ needs.release_386.outputs.tags_libreoffice }},${{ needs.release_ppc64le.outputs.tags_libreoffice }},${{ needs.release_arm64.outputs.tags_libreoffice }},${{ needs.release_arm_v7.outputs.tags_libreoffice }}"
-          alternate_registry: thecodingmachine
 
       - name: Merge AWS Lambda
         uses: ./.github/actions/merge
@@ -186,7 +183,6 @@ jobs:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
           tags: "${{ needs.release_amd64.outputs.tags_aws_lambda }},${{ needs.release_arm64.outputs.tags_aws_lambda }}"
-          alternate_registry: thecodingmachine
 
       - name: Merge AWS Lambda Chromium
         uses: ./.github/actions/merge
@@ -194,7 +190,6 @@ jobs:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
           tags: "${{ needs.release_amd64.outputs.tags_aws_lambda_chromium }},${{ needs.release_arm64.outputs.tags_aws_lambda_chromium }}"
-          alternate_registry: thecodingmachine
 
       - name: Merge AWS Lambda LibreOffice
         uses: ./.github/actions/merge
@@ -202,7 +197,6 @@ jobs:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
           tags: "${{ needs.release_amd64.outputs.tags_aws_lambda_libreoffice }},${{ needs.release_arm64.outputs.tags_aws_lambda_libreoffice }}"
-          alternate_registry: thecodingmachine
 
       - name: Clean
         uses: ./.github/actions/clean

.github/workflows/continuous-integration.yml

@@ -46,7 +46,7 @@ jobs:
           node-version-file: .node-version
 
       - name: Install Dependencies
-        run: npm i
+        run: npm ci --ignore-scripts
 
       - name: Run linters
         run: make lint-prettier
@@ -468,7 +468,6 @@ jobs:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
           tags: "${{ needs.edge_amd64.outputs.tags }},${{ needs.edge_386.outputs.tags }},${{ needs.edge_ppc64le.outputs.tags }},${{ needs.edge_arm64.outputs.tags }},${{ needs.edge_arm_v7.outputs.tags }}"
-          alternate_registry: thecodingmachine
 
       - name: Merge Chromium
         uses: ./.github/actions/merge
@@ -476,7 +475,6 @@ jobs:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
           tags: "${{ needs.edge_amd64.outputs.tags_chromium }},${{ needs.edge_386.outputs.tags_chromium }},${{ needs.edge_ppc64le.outputs.tags_chromium }},${{ needs.edge_arm64.outputs.tags_chromium }},${{ needs.edge_arm_v7.outputs.tags_chromium }}"
-          alternate_registry: thecodingmachine
 
       - name: Merge LibreOffice
         uses: ./.github/actions/merge
@@ -484,7 +482,6 @@ jobs:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
           tags: "${{ needs.edge_amd64.outputs.tags_libreoffice }},${{ needs.edge_386.outputs.tags_libreoffice }},${{ needs.edge_ppc64le.outputs.tags_libreoffice }},${{ needs.edge_arm64.outputs.tags_libreoffice }},${{ needs.edge_arm_v7.outputs.tags_libreoffice }}"
-          alternate_registry: thecodingmachine
 
       - name: Merge AWS Lambda
         uses: ./.github/actions/merge
@@ -492,7 +489,6 @@ jobs:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
           tags: "${{ needs.edge_amd64.outputs.tags_aws_lambda }},${{ needs.edge_arm64.outputs.tags_aws_lambda }}"
-          alternate_registry: thecodingmachine
 
       - name: Merge AWS Lambda Chromium
         uses: ./.github/actions/merge
@@ -500,7 +496,6 @@ jobs:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
           tags: "${{ needs.edge_amd64.outputs.tags_aws_lambda_chromium }},${{ needs.edge_arm64.outputs.tags_aws_lambda_chromium }}"
-          alternate_registry: thecodingmachine
 
       - name: Merge AWS Lambda LibreOffice
         uses: ./.github/actions/merge
@@ -508,7 +503,6 @@ jobs:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
           tags: "${{ needs.edge_amd64.outputs.tags_aws_lambda_libreoffice }},${{ needs.edge_arm64.outputs.tags_aws_lambda_libreoffice }}"
-          alternate_registry: thecodingmachine
 
       - name: Clean
         uses: ./.github/actions/clean

.node-version

@@ -1 +1 @@
-24.11.0
+24.15.0

.npmrc

@@ -0,0 +1 @@
+min-release-age=7

CONTRIBUTING.md

@@ -1,39 +1,59 @@
 # Contributing to Gotenberg
 
-**Gotenberg** is a Docker-based API for converting documents to PDF. It is a widely used production dependency. Stability and backward compatibility are paramount. When in doubt about whether a change is breaking, flag it rather than assuming it's safe.
+Gotenberg is a Docker-based API for converting documents to PDF. Two rules override everything else:
 
-## Getting Started
+- **Backward compatibility.** Never rename or remove CLI flags, environment variables, API form fields, or HTTP endpoints without discussion.
+- **Defensive programming.** Assume input is malformed, handle errors explicitly, never panic.
 
-### Prerequisites
+## Toolchain
 
-- Go (see version in `go.mod`)
+- Module: `github.com/gotenberg/gotenberg/v8`
+- Go: see version in `go.mod`
 - Docker
-- Node.js (see version in `.node-version`), for Prettier linting
+- Node.js (see `.node-version`), for Prettier linting
 - [golangci-lint](https://golangci-lint.run/) v2+
 
-### Build and Run
+## Before you start
 
-```bash
-make build # Build the Docker image
-make run   # Run a local Gotenberg container
+For non-trivial changes, open an issue or a draft PR first. Describe what needs to change, the proposed solution (files to modify, interface changes, form fields), and which integration test tags are affected.
+
+One thing per PR. Keep features, bug fixes, and refactoring in separate PRs.
+
+When adding a feature or route, write the Gherkin scenario before the Go code, and plan to update the Bruno collection (`.bruno/`) if a route changes.
+
+## Project layout
+
+```
+cmd/gotenberg/       -> Entry point only (wiring/startup). No business logic.
+pkg/gotenberg/       -> Core module system, interfaces, utilities, mocks.
+pkg/modules/         -> Feature modules (api, chromium, libreoffice, pdfengines, etc.).
+pkg/standard/        -> Wires all standard modules together via imports.
+test/integration/    -> Gherkin feature files + Go test infrastructure.
+build/               -> Dockerfile, fonts, Chromium config.
+.bruno/              -> Bruno API collection (mirrors every route).
 ```
 
-### Development Loop
+Key interfaces live in `pkg/gotenberg/`: `Module`, `Provisioner`, `Validator`, `Debuggable`. Every module implements `Descriptor()` and self-registers via `init()`.
 
-```bash
-# Write your code, then:
-make fmt              # Format Go code
-make prettify         # Format non-Go files (Markdown, YAML, etc.)
-make lint             # Lint Go code (zero errors permitted)
-make lint-prettier    # Lint non-Go files
-make test-unit        # Run unit tests
-make build            # Build the Docker image (required before integration tests)
-make test-integration # Run all integration tests
-make telemetry        # Start OpenTelemetry collector and OpenObserve
-make down             # Stop all compose containers
-```
+## Setup and Makefile
 
-To run only the integration tests relevant to your change:
+All build and verification tasks go through the Makefile. Do not run `go` commands directly unless debugging a specific package.
+
+| Command                 | Purpose                                          | When to use                                                              |
+| ----------------------- | ------------------------------------------------ | ------------------------------------------------------------------------ |
+| `make build`            | Build the Gotenberg Docker image                 | Before integration tests or manual testing                               |
+| `make run`              | Run a Gotenberg container via `docker compose`   | Manual testing. Flags configured via Makefile variables and compose.yaml |
+| `make telemetry`        | Start an OpenTelemetry collector and OpenObserve | When testing telemetry locally                                           |
+| `make down`             | Stop all compose containers                      | After manual testing                                                     |
+| `make godoc`            | Serve GoDoc at `localhost:6060`                  | To verify documentation                                                  |
+| `make fmt`              | Format Go code                                   | Before committing                                                        |
+| `make lint`             | Lint Go code (zero errors permitted)             | Before committing                                                        |
+| `make prettify`         | Format non-Go files (Markdown, YAML, JSON)       | Before committing                                                        |
+| `make lint-prettier`    | Lint non-Go files                                | Before committing                                                        |
+| `make test-unit`        | Run unit tests                                   | Before committing                                                        |
+| `make test-integration` | Run all integration tests (40 min timeout)       | Before committing                                                        |
+
+Run only the integration test tag(s) relevant to your change rather than the full suite:
 
 ```bash
 make test-integration TAGS=health
@@ -41,117 +61,55 @@ make test-integration TAGS=chromium-convert-html
 make test-integration TAGS="merge,split"
 ```
 
-## Submitting a Pull Request
+## Code conventions
 
-For non-trivial changes, outline your approach before writing code. Open an issue or draft PR describing:
+### Module system
 
-- What needs to change and why.
-- The proposed solution, with enough detail to implement (files to modify, interface changes, form fields, etc.).
-- Which integration test tags will be affected and what new scenarios are needed.
+Gotenberg uses a self-registering module architecture inspired by CaddyServer. Each module lives in `pkg/modules/<name>/`, implements at minimum `gotenberg.Module` (`Descriptor()`), and self-registers via `init()`. Wiring happens through `pkg/standard/`.
 
-Before opening (or marking ready) a PR, verify:
+Determine if a feature belongs in an existing module before creating a new one. Only create a new module for a genuinely separate concern.
 
-1. Code compiles: `make build`
-2. Code is formatted: `make fmt` and `make prettify`
-3. All linters pass: `make lint` and `make lint-prettier`
-4. Integration tests pass: `make test-integration` (at minimum, the relevant tags)
-5. Unit tests pass: `make test-unit`
-6. All exported symbols and new packages have GoDoc comments
-7. Bruno collection is updated (if routes were added or modified)
+The `cmd/gotenberg/` package is strictly for wiring and startup. No business logic.
 
-Review your changes against the [Review Checklist](#review-checklist) before submitting.
+### Backward compatibility
 
-### Guidelines
+CLI flags, environment variables, API form fields, HTTP endpoints, and default values that alter existing behavior must not change without discussion. Deprecate old names with `fs.MarkDeprecated()` and register both the old and new names side by side.
 
-- **One thing per PR.** Keep features, bug fixes, and refactoring in separate PRs.
-- **Backward compatibility matters.** Do not rename or remove existing CLI flags, environment variables, or API form fields without discussion.
-- **Integration tests first.** When adding a feature or route, start by writing the Gherkin scenario in `test/integration/features/`. See [`test/integration/README.md`](test/integration/README.md) for the full reference.
-- **Unit tests** when applicable: table-driven tests in `*_test.go` files using mocks from `pkg/gotenberg/mocks.go`.
+If a change violates backward compatibility, flag it as a breaking change in the PR description.
 
-### Commit Conventions
+### Error handling
 
-If committing, follow the [Conventional Commits](https://www.conventionalcommits.org/) specification:
+- Wrap every error with context: `fmt.Errorf("description: %w", err)`.
+- Never swallow errors silently.
+- Match errors with `errors.Is`, never `strings.Contains`.
+- No panics in production code paths.
+- Validate input defensively.
 
-```
-<type>(<scope>): <description>
-```
+### Logging
 
-Common types: `feat`, `fix`, `refactor`, `test`, `docs`, `chore`, `ci`, `build`. The scope should match the module or area of the change (e.g., `chromium`, `pdfengines`, `api`).
+Use `gotenberg.Logger(mod)` to get the module's slog logger during `Provision()`. All log calls must be context-aware: `logger.DebugContext(ctx, msg)`, `logger.InfoContext(ctx, msg)`, `logger.ErrorContext(ctx, msg)`. This propagates trace/span IDs into structured logs when OpenTelemetry is active.
 
-Stage only the files related to the change. Do not use `git add -A` or `git add .`.
+### Telemetry
 
----
+External tool calls (Chromium, LibreOffice, PDF engines, webhooks, downloads) must create OTEL spans with `trace.SpanKindClient` and `semconv.ServerAddress("toolname")`. Use `gotenberg.Tracer()` and `gotenberg.Meter()` for traces and metrics.
 
-## Core Principles
+### Import ordering
 
-- **Backward compatibility is law.** See the [Review Checklist](#review-checklist) for the full list of what must not change.
-- **Defensive programming.** Assume input is malformed. Handle errors explicitly. Never panic.
-- **Atomic commits.** One feature or fix per PR. Isolate refactoring from feature work.
-- **Idiomatic Go.** Follow "Effective Go" principles. All exported symbols must have GoDoc comments starting with their name.
+Enforced by `gci`: standard library, then third-party, then `github.com/gotenberg/gotenberg/v8`. Three groups separated by blank lines.
 
-## Project Layout and Navigation
+## Documentation conventions
 
-```
-cmd/gotenberg/       → Entry point only (wiring/startup). No business logic.
-pkg/gotenberg/       → Core module system, interfaces, utilities, mocks.
-pkg/modules/         → Feature modules (api, chromium, libreoffice, pdfengines, etc.).
-pkg/standard/        → Wires all standard modules together via imports.
-test/integration/    → Gherkin feature files + Go test infrastructure.
-build/               → Dockerfile, fonts, Chromium config.
-.bruno/              → Bruno API collection (mirrors every route).
-```
+### Tone
 
-Key interfaces live in `pkg/gotenberg/`: `Module`, `Provisioner`, `Validator`, `Debuggable`. Every module implements `Descriptor()` and self-registers. When adding features, determine if they belong in an existing module or require a new one.
-
-- The integration test infrastructure in `test/integration/scenario/` is well-structured. Read `scenario.go` and `containers.go` to understand the Gherkin step definitions before writing new tests.
-- Mocks for all major interfaces are in `pkg/gotenberg/mocks.go`. Use them for unit tests rather than creating new ones.
-- When making changes, run only the relevant integration test tag rather than the full suite (40min timeout).
-- Telemetry infrastructure lives in `pkg/gotenberg/telemetry.go` (global Logger, Tracer, Meter) and `pkg/gotenberg/internal/` (log handlers, OTEL SDK init). HTTP semantic conventions are in `pkg/gotenberg/semconv/`.
-
-## Makefile: the Only Build Interface
-
-All build and verification tasks go through the Makefile. Do not run `go` commands directly unless debugging a specific package. The [Development Loop](#development-loop) covers the commands used during daily work. Additional commands:
-
-| Command          | Purpose                                       | When to use                                                                  |
-| ---------------- | --------------------------------------------- | ---------------------------------------------------------------------------- |
-| `make run`       | Run Gotenberg container via `docker compose`  | Manual testing. Flags are configured via Makefile variables and compose.yaml |
-| `make telemetry` | Start OpenTelemetry collector and OpenObserve | When testing telemetry locally                                               |
-| `make down`      | Stop all compose containers                   | After manual testing                                                         |
-| `make godoc`     | Serve GoDoc at `localhost:6060`               | To verify documentation                                                      |
-
-## Module System
-
-Gotenberg uses a self-registering module architecture inspired by CaddyServer. Each module:
-
-- Lives in `pkg/modules/<name>/`
-- Implements the `gotenberg.Module` interface (at minimum `Descriptor()`)
-- May also implement `gotenberg.Provisioner`, `gotenberg.Validator`, or `gotenberg.Debuggable`
-- Self-registers via `init()` and is wired through `pkg/standard/`
-
-When adding a feature, first determine if it belongs in an existing module. Only create a new module if the feature represents a genuinely separate concern.
-
-## Coding Patterns
-
-- **Error handling:** Always wrap errors with context using `fmt.Errorf("description: %w", err)`. Never swallow errors silently.
-- **Import ordering:** Enforced by `gci`: standard library, then third-party, then `github.com/gotenberg/gotenberg/v8`. Three groups separated by blank lines.
-- **Mocks:** Comprehensive mock implementations for all major interfaces live in `pkg/gotenberg/mocks.go`. Use these for unit tests.
-- **Logging:** Use `gotenberg.Logger(mod)` to get the module's slog logger during `Provision()`. All log calls must be context-aware: `logger.DebugContext(ctx, msg)`, `logger.InfoContext(ctx, msg)`, `logger.ErrorContext(ctx, msg)`. This propagates trace/span IDs into structured logs when OpenTelemetry is active.
-- **Telemetry:** External tool calls (Chromium, LibreOffice, PDF engines, webhooks, downloads) must create OTEL spans with `trace.SpanKindClient` and `semconv.ServerAddress("toolname")`. Use `gotenberg.Tracer()` and `gotenberg.Meter()` for traces and metrics respectively.
-- **No business logic in `cmd/`:** The `cmd/gotenberg/` package is strictly for wiring and startup.
-
-## Documentation
-
-### Writing Style
-
-- **Short, declarative sentences.** Say what it does, then stop.
-- **Lead with the action.** "Validates font embedding" not "This function validates font embedding".
-- **Active voice.** "Gotenberg checks the profile" not "The profile is checked by Gotenberg".
-- **No em dashes.** Use a period, colon, or comma instead.
-- **No "we" hedging.** "Don't..." not "We do not recommend...".
+- Short, declarative sentences. Say what it does, then stop.
+- Lead with the action. "Validates font embedding", not "This function validates font embedding".
+- Active voice. "Gotenberg checks the profile", not "The profile is checked by Gotenberg".
+- No em dashes. Use a period, colon, or comma.
+- No "we" hedging. "Don't...", not "We do not recommend...".
 
 ### Godoc
 
-All exported types and functions require Godoc comments. Start with the identifier name:
+Every exported type and function has a Godoc comment starting with its identifier name:
 
 ```go
 // Violation records a single rule violation with context.
@@ -163,69 +121,58 @@ func ValidatePDFA(ctx context.Context, ...) ([]error, error)
 
 Each package should have a `doc.go` with a `// Package foo ...` comment.
 
-Reference other identifiers with square brackets so pkg.go.dev renders them as links:
+Reference identifiers with `[Name]` brackets for pkg.go.dev linking:
 
 ```go
-// ValidatePDFA returns violations as []error where each element is a
-// [Violation] value. See [Rule] for the structured rule fields.
-// The document must be opened via [pdf.Open] with an [io.ReaderAt].
+// ValidatePDFA returns violations as []error where each element
+// is a [Violation] value. See [Rule] for the structured fields.
 ```
 
-This works for same-package identifiers (`[Violation]`), other packages (`[io.Reader]`), and methods (`[Reader.Open]`).
+### Code comments
 
-### Code Comments
-
-- Explain _why_, not _what_. The code shows what; the comment explains the non-obvious reasoning.
+- Explain _why_, not _what_.
 - No numbered step comments (`// 1. Do X`, `// 2. Do Y`).
-- No section dividers with numbers (`// --- 8. Foo ---`). Plain dividers are fine for major boundaries (`// --- VeraPDF ---`).
+- No section dividers with numbers (`// --- 8. Foo ---`). Plain dividers are fine for major boundaries.
 - No noise comments that restate the code (`// Check if err is nil`, `// Return results`).
 - Reference spec clauses where relevant (`// Per ISO 32000-2, Table 116...`).
-- Mark technical debt with `// TODO: [context]`.
+- Mark debt with `// TODO: [context]`.
 
----
+## Testing
 
-## Review Checklist
+### Unit tests
 
-### Backward Compatibility
+Table-driven tests in `*_test.go` files. Use the comprehensive mock implementations in `pkg/gotenberg/mocks.go` rather than rolling new ones.
 
-- [ ] No existing CLI flags renamed or removed
-- [ ] No existing environment variables renamed or removed
-- [ ] No existing API form fields renamed or removed
-- [ ] No existing HTTP endpoints changed or removed
-- [ ] No changes to default values that alter existing behavior
-- [ ] Deprecated flags have both old and new names registered, with `fs.MarkDeprecated()`
+### Integration tests
 
-If any of these are violated, the change **must** be flagged as a breaking change.
+Gherkin (BDD) via Godog with `testcontainers-go` for Docker orchestration. Feature files live in `test/integration/features/`; step definitions live in `test/integration/scenario/`. Read `scenario.go` and `containers.go` before writing new tests.
 
-### Linting Standards
+`make build` is required before running integration tests. The full suite has a 40-minute timeout, so run only the tag(s) relevant to your change.
 
-The `.golangci.yml` enforces strict rules including: `gosec`, `govet`, `errcheck`, `staticcheck`, `dupl`, `bodyclose`, `exhaustive`, `errname`, `sloglint`, `gocritic`, and more. Zero linting errors are permitted.
+## Pull requests
 
-Formatters enforce `gci`, `gofmt`, `gofumpt`, `goimports` (see import ordering in [Coding Patterns](#coding-patterns)).
+### Commits
 
-### Code Quality
+[Conventional Commits](https://www.conventionalcommits.org/): `<type>(<scope>): <description>`.
 
-- Errors are wrapped with context: `fmt.Errorf("description: %w", err)`. No swallowed errors.
-- No business logic in `cmd/`.
-- No panics in production code paths.
-- Input is validated defensively.
-- New features belong in the correct module (or justify a new one).
+Common types: `feat`, `fix`, `refactor`, `test`, `docs`, `chore`, `ci`, `build`. The scope matches the module or area of the change (e.g., `chromium`, `pdfengines`, `api`).
 
-### Documentation
+Stage specific files. Never `git add -A` or `git add .`.
 
-- Every exported function, type, constant, and variable has a Godoc comment starting with its name (see [Godoc](#godoc)).
-- New packages include a `doc.go` file.
-- `README.md` is not modified unless explicitly requested.
-- All documentation follows the [Writing Style](#writing-style) and [Code Comments](#code-comments) guidelines.
+### Checklist
 
----
+Before opening the PR, confirm:
 
-## Scoped Guidelines
+- [ ] No backward-compatibility regression. See [Backward compatibility](#backward-compatibility).
+- [ ] Code conventions met (error wrapping, logging, telemetry, import ordering, no panics, no business logic in `cmd/`). See [Code conventions](#code-conventions).
+- [ ] Documentation conventions met (Godoc on every exported identifier, `doc.go` for new packages, tone). See [Documentation conventions](#documentation-conventions).
+- [ ] `make fmt && make lint && make prettify && make lint-prettier` pass with zero warnings.
+- [ ] `make test-unit` passes.
+- [ ] Relevant `make test-integration TAGS=...` passes.
+- [ ] Bruno collection updated if routes were added or modified.
 
-Some areas of the codebase have their own README with detailed instructions:
+## Further reading
 
-| Area              | README                                                                 | Covers                                                    |
-| ----------------- | ---------------------------------------------------------------------- | --------------------------------------------------------- |
-| Integration tests | [`test/integration/README.md`](test/integration/README.md)             | Gherkin step reference, available tags, writing new tests |
-| Bruno collection  | [`.bruno/README.md`](.bruno/README.md)                                 | `.bru` file format, conventions, route update checklist   |
-| PDF engines       | [`pkg/modules/pdfengines/README.md`](pkg/modules/pdfengines/README.md) | Adding new engine features (Makefile variable and flag)   |
+- [`test/integration/README.md`](test/integration/README.md) — Gherkin step reference, available tags, writing new tests.
+- [`.bruno/README.md`](.bruno/README.md) — `.bru` file format, conventions, route update checklist.
+- [`pkg/modules/pdfengines/README.md`](pkg/modules/pdfengines/README.md) — adding new engine features (Makefile variable and flag).

Makefile

@@ -27,7 +27,7 @@ API_ENABLE_BASIC_AUTH=false
 GOTENBERG_API_BASIC_AUTH_USERNAME=
 GOTENBERG_API_BASIC_AUTH_PASSWORD=
 API_DOWNLOAD_FROM_ALLOW_LIST=
-API_DOWNLOAD_FROM_DENY_LIST=
+API_DOWNLOAD_FROM_DENY_LIST=^https?://(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.|0\.0\.0\.0|127\.|localhost|\[::1\]|\[fd)
 API_DOWNLOAD_FROM_MAX_RETRY=4
 API_DISABLE_DOWNLOAD_FROM=false
 API_DISABLE_HEALTH_CHECK_ROUTE_TELEMETRY=true
@@ -58,6 +58,8 @@ LIBREOFFICE_MAX_QUEUE_SIZE=0
 LIBREOFFICE_IDLE_SHUTDOWN_TIMEOUT=0
 LIBREOFFICE_AUTO_START=false
 LIBREOFFICE_START_TIMEOUT=20s
+LIBREOFFICE_ALLOW_LIST=
+LIBREOFFICE_DENY_LIST=
 LIBREOFFICE_DISABLE_ROUTES=false
 LOG_LEVEL=info
 LOG_FIELDS_PREFIX=
@@ -76,7 +78,8 @@ PDFENGINES_WATERMARK_ENGINES=pdfcpu,pdftk
 PDFENGINES_STAMP_ENGINES=pdfcpu,pdftk
 PDFENGINES_ENCRYPT_ENGINES=qpdf,pdfcpu,pdftk
 PDFENGINES_ROTATE_ENGINES=pdfcpu,pdftk
-PDFENGINES_EMBED_ENGINES=pdfcpu
+PDFENGINES_EMBED_ENGINES=qpdf,pdfcpu
+PDFENGINES_EMBED_METADATA_ENGINES=qpdf
 PROMETHEUS_NAMESPACE=gotenberg
 PROMETHEUS_COLLECT_INTERVAL=1s
 PROMETHEUS_DISABLE_ROUTE_TELEMETRY=true
@@ -91,9 +94,7 @@ OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4317
 OTEL_EXPORTER_OTLP_INSECURE=true
 WEBHOOK_ENABLE_SYNC_MODE=false
 WEBHOOK_ALLOW_LIST=
-WEBHOOK_DENY_LIST=
-WEBHOOK_ERROR_ALLOW_LIST=
-WEBHOOK_ERROR_DENY_LIST=
+WEBHOOK_DENY_LIST=^https?://(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.|0\.0\.0\.0|127\.|localhost|\[::1\]|\[fd)
 WEBHOOK_MAX_RETRY=4
 WEBHOOK_RETRY_MIN_WAIT=1s
 WEBHOOK_RETRY_MAX_WAIT=30s

build/Dockerfile

@@ -1,7 +1,7 @@
 # ARG instructions do not create additional layers. Instead, next layers will
 # concatenate them. Also, we have to repeat ARG instructions in each build
 # stage that uses them.
-ARG GOLANG_VERSION=1.26.0
+ARG GOLANG_VERSION=1.26.2
 
 # ----------------------------------------------
 # pdfcpu binary build stage
@@ -11,7 +11,7 @@ ARG GOLANG_VERSION=1.26.0
 FROM golang:$GOLANG_VERSION AS pdfcpu-binary-stage
 
 # See https://github.com/pdfcpu/pdfcpu/releases.
-ARG PDFCPU_VERSION=v0.11.1
+ARG PDFCPU_VERSION=v0.12.0
 ENV CGO_ENABLED=0
 
 # Define the working directory outside of $GOPATH (we're using go modules).
@@ -24,7 +24,7 @@ RUN curl -Ls "https://github.com/pdfcpu/pdfcpu/archive/refs/tags/$PDFCPU_VERSION
 RUN go mod download \
     && go mod verify
 
-RUN go build -o pdfcpu -ldflags "-s -w -X 'main.version=$PDFCPU_VERSION' -X 'github.com/pdfcpu/pdfcpu/pkg/pdfcpu.VersionStr=$PDFCPU_VERSION' -X main.builtBy=gotenberg" ./cmd/pdfcpu \
+RUN go build -o pdfcpu -ldflags "-s -w -X 'main.version=$PDFCPU_VERSION' -X 'github.com/pdfcpu/pdfcpu/pkg/pdfcpu/model.VersionStr=$PDFCPU_VERSION' -X main.builtBy=gotenberg" ./cmd/pdfcpu \
     # Verify installation.
     && ./pdfcpu version
 
@@ -126,6 +126,8 @@ RUN apt-get update -qq \
     && apt-get upgrade -yqq \
     && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
         tini \
+        # Many users rely on curl for Docker health checks.
+        curl \
         # Install fonts.
         # Essential metric-compatible fonts for LibreOffice layout fidelity (replaces MS Fonts).
         fonts-crosextra-carlito \
@@ -200,6 +202,7 @@ FROM common-stage AS gotenberg
 ARG GOTENBERG_VERSION=snapshot
 ARG GOTENBERG_USER_GID=1001
 ARG GOTENBERG_USER_UID=1001
+ARG TMP_CHROMIUM_VERSION_PPC64EL="146.0.7680.80-1~deb13u1"
 
 LABEL org.opencontainers.image.title="Gotenberg" \
     org.opencontainers.image.description="A Docker-based API for converting documents to PDF." \
@@ -209,10 +212,23 @@ LABEL org.opencontainers.image.title="Gotenberg" \
     org.opencontainers.image.source="https://github.com/gotenberg/gotenberg"
 
 # Install Chromium.
-RUN apt-get update -qq \
-    && apt-get upgrade -yqq \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends chromium \
-    # Cleanup.
+# On ppc64el, the latest Chromium is broken, so we pin a known working
+# version from snapshot.debian.org via debsnap.
+RUN /bin/bash -c \
+    'set -e &&\
+    if [[ "$(dpkg --print-architecture)" == "ppc64el" ]]; then \
+      apt-get update -qq &&\
+      DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends devscripts &&\
+      debsnap chromium-common "$TMP_CHROMIUM_VERSION_PPC64EL" -v --force --binary --architecture ppc64el &&\
+      debsnap chromium "$TMP_CHROMIUM_VERSION_PPC64EL" -v --force --binary --architecture ppc64el &&\
+      DEBIAN_FRONTEND=noninteractive apt-get install --fix-broken -y -qq --no-install-recommends "./binary-chromium-common/chromium-common_${TMP_CHROMIUM_VERSION_PPC64EL}_ppc64el.deb" "./binary-chromium/chromium_${TMP_CHROMIUM_VERSION_PPC64EL}_ppc64el.deb" &&\
+      DEBIAN_FRONTEND=noninteractive apt-get purge -y -qq devscripts &&\
+      rm -rf ./binary-chromium-common/* ./binary-chromium/*; \
+    else \
+      apt-get update -qq &&\
+      apt-get upgrade -yqq &&\
+      DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends chromium; \
+    fi' \
     && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
 # Install LibreOffice & unoconverter.
@@ -269,6 +285,7 @@ FROM common-stage AS gotenberg-chromium
 ARG GOTENBERG_VERSION=snapshot
 ARG GOTENBERG_USER_GID=1001
 ARG GOTENBERG_USER_UID=1001
+ARG TMP_CHROMIUM_VERSION_PPC64EL="146.0.7680.80-1~deb13u1"
 
 LABEL org.opencontainers.image.title="Gotenberg (Chromium)" \
     org.opencontainers.image.description="A Docker-based API for converting documents to PDF — Chromium variant." \
@@ -278,10 +295,23 @@ LABEL org.opencontainers.image.title="Gotenberg (Chromium)" \
     org.opencontainers.image.source="https://github.com/gotenberg/gotenberg"
 
 # Install Chromium.
-RUN apt-get update -qq \
-    && apt-get upgrade -yqq \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends chromium \
-    # Cleanup.
+# On ppc64el, the latest Chromium is broken, so we pin a known working
+# version from snapshot.debian.org via debsnap.
+RUN /bin/bash -c \
+    'set -e &&\
+    if [[ "$(dpkg --print-architecture)" == "ppc64el" ]]; then \
+      apt-get update -qq &&\
+      DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends devscripts &&\
+      debsnap chromium-common "$TMP_CHROMIUM_VERSION_PPC64EL" -v --force --binary --architecture ppc64el &&\
+      debsnap chromium "$TMP_CHROMIUM_VERSION_PPC64EL" -v --force --binary --architecture ppc64el &&\
+      DEBIAN_FRONTEND=noninteractive apt-get install --fix-broken -y -qq --no-install-recommends "./binary-chromium-common/chromium-common_${TMP_CHROMIUM_VERSION_PPC64EL}_ppc64el.deb" "./binary-chromium/chromium_${TMP_CHROMIUM_VERSION_PPC64EL}_ppc64el.deb" &&\
+      DEBIAN_FRONTEND=noninteractive apt-get purge -y -qq devscripts &&\
+      rm -rf ./binary-chromium-common/* ./binary-chromium/*; \
+    else \
+      apt-get update -qq &&\
+      apt-get upgrade -yqq &&\
+      DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends chromium; \
+    fi' \
     && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
 # COPY instructions last to maximize cache reuse.
@@ -295,6 +325,8 @@ COPY --link --chown="$GOTENBERG_USER_UID:$GOTENBERG_USER_GID" build/chromium-hyp
 
 ENV CHROMIUM_BIN_PATH=/usr/bin/chromium
 ENV CHROMIUM_HYPHEN_DATA_DIR_PATH=/opt/gotenberg/chromium-hyphen-data
+# No LibreOffice in this variant; override the default to use all available engines.
+ENV PDFENGINES_CONVERT_ENGINES=
 
 USER gotenberg
 WORKDIR /home/gotenberg

compose.yaml

@@ -59,6 +59,8 @@ services:
       - "--libreoffice-idle-shutdown-timeout=${LIBREOFFICE_IDLE_SHUTDOWN_TIMEOUT}"
       - "--libreoffice-auto-start=${LIBREOFFICE_AUTO_START}"
       - "--libreoffice-start-timeout=${LIBREOFFICE_START_TIMEOUT}"
+      - "--libreoffice-allow-list=${LIBREOFFICE_ALLOW_LIST}"
+      - "--libreoffice-deny-list=${LIBREOFFICE_DENY_LIST}"
       - "--libreoffice-disable-routes=${LIBREOFFICE_DISABLE_ROUTES}"
       - "--log-level=${LOG_LEVEL}"
       - "--log-fields-prefix=${LOG_FIELDS_PREFIX}"
@@ -77,6 +79,7 @@ services:
       - "--pdfengines-encrypt-engines=${PDFENGINES_ENCRYPT_ENGINES}"
       - "--pdfengines-rotate-engines=${PDFENGINES_ROTATE_ENGINES}"
       - "--pdfengines-embed-engines=${PDFENGINES_EMBED_ENGINES}"
+      - "--pdfengines-embed-metadata-engines=${PDFENGINES_EMBED_METADATA_ENGINES}"
       - "--pdfengines-disable-routes=${PDFENGINES_DISABLE_ROUTES}"
       - "--prometheus-namespace=${PROMETHEUS_NAMESPACE}"
       - "--prometheus-collect-interval=${PROMETHEUS_COLLECT_INTERVAL}"
@@ -86,8 +89,6 @@ services:
       - "--webhook-enable-sync-mode=${WEBHOOK_ENABLE_SYNC_MODE}"
       - "--webhook-allow-list=${WEBHOOK_ALLOW_LIST}"
       - "--webhook-deny-list=${WEBHOOK_DENY_LIST}"
-      - "--webhook-error-allow-list=${WEBHOOK_ERROR_ALLOW_LIST}"
-      - "--webhook-error-deny-list=${WEBHOOK_ERROR_DENY_LIST}"
       - "--webhook-max-retry=${WEBHOOK_MAX_RETRY}"
       - "--webhook-retry-min-wait=${WEBHOOK_RETRY_MIN_WAIT}"
       - "--webhook-retry-max-wait=${WEBHOOK_RETRY_MAX_WAIT}"

go.mod

@@ -1,41 +1,39 @@
 module github.com/gotenberg/gotenberg/v8
 
-go 1.26.0
+go 1.26.2
 
 require (
 	github.com/alexliesenfeld/health v0.8.1
-	github.com/barasher/go-exiftool v1.10.0
-	github.com/chromedp/cdproto v0.0.0-20260321001828-e3e3800016bc
-	github.com/chromedp/chromedp v0.15.1
+	github.com/chromedp/cdproto v0.0.0-20250803210736-d308e07a266d
+	github.com/chromedp/chromedp v0.14.2
 	github.com/cucumber/godog v0.15.1
-	github.com/dlclark/regexp2 v1.11.5
-	github.com/docker/docker v28.5.2+incompatible
-	github.com/docker/go-connections v0.6.0
-	github.com/gomarkdown/markdown v0.0.0-20260217112301-37c66b85d6ab
+	github.com/dlclark/regexp2 v1.12.0
+	github.com/gomarkdown/markdown v0.0.0-20260412113850-134a5b2cce7f
 	github.com/google/uuid v1.6.0
 	github.com/hashicorp/go-retryablehttp v0.7.8
 	github.com/labstack/echo/v4 v4.15.1
-	github.com/labstack/gommon v0.4.2
+	github.com/labstack/gommon v0.5.0
 	github.com/mholt/archives v0.1.5
 	github.com/microcosm-cc/bluemonday v1.0.27
+	github.com/moby/moby/api v1.54.1
 	github.com/prometheus/client_golang v1.23.2
-	github.com/shirou/gopsutil/v4 v4.26.2
+	github.com/shirou/gopsutil/v4 v4.26.3
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
-	github.com/testcontainers/testcontainers-go v0.41.0
-	go.opentelemetry.io/contrib/bridges/otelslog v0.17.0
-	go.opentelemetry.io/contrib/exporters/autoexport v0.67.0
-	go.opentelemetry.io/otel v1.42.0
-	go.opentelemetry.io/otel/log v0.18.0
-	go.opentelemetry.io/otel/metric v1.42.0
-	go.opentelemetry.io/otel/sdk v1.42.0
-	go.opentelemetry.io/otel/sdk/log v0.18.0
-	go.opentelemetry.io/otel/sdk/metric v1.42.0
-	go.opentelemetry.io/otel/trace v1.42.0
-	golang.org/x/net v0.52.0
+	github.com/testcontainers/testcontainers-go v0.42.0
+	go.opentelemetry.io/contrib/bridges/otelslog v0.18.0
+	go.opentelemetry.io/contrib/exporters/autoexport v0.68.0
+	go.opentelemetry.io/otel v1.43.0
+	go.opentelemetry.io/otel/log v0.19.0
+	go.opentelemetry.io/otel/metric v1.43.0
+	go.opentelemetry.io/otel/sdk v1.43.0
+	go.opentelemetry.io/otel/sdk/log v0.19.0
+	go.opentelemetry.io/otel/sdk/metric v1.43.0
+	go.opentelemetry.io/otel/trace v1.43.0
+	golang.org/x/net v0.53.0
 	golang.org/x/sync v0.20.0
-	golang.org/x/term v0.41.0
-	golang.org/x/text v0.35.0
+	golang.org/x/term v0.42.0
+	golang.org/x/text v0.36.0
 )
 
 require (
@@ -43,7 +41,7 @@ require (
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/STARRY-S/zip v0.2.3 // indirect
-	github.com/andybalholm/brotli v1.2.0 // indirect
+	github.com/andybalholm/brotli v1.2.1 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bodgit/plumbing v1.3.0 // indirect
@@ -62,6 +60,7 @@ require (
 	github.com/cucumber/messages/go/v21 v21.0.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
 	github.com/ebitengine/purego v0.10.0 // indirect
@@ -83,26 +82,25 @@ require (
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/klauspost/compress v1.18.5 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
-	github.com/lufia/plan9stats v0.0.0-20260324052639-156f7da3f749 // indirect
+	github.com/lufia/plan9stats v0.0.0-20260330125221-c963978e514e // indirect
 	github.com/magiconair/properties v1.8.10 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.21 // indirect
 	github.com/mikelolasagasti/xz v1.0.1 // indirect
 	github.com/minio/minlz v1.1.0 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/go-archive v0.2.0 // indirect
+	github.com/moby/moby/client v0.4.0 // indirect
 	github.com/moby/patternmatcher v0.6.1 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/moby/term v0.5.2 // indirect
-	github.com/morikuni/aec v1.1.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/nwaples/rardecode/v2 v2.2.2 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/pierrec/lz4/v4 v4.1.26 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
@@ -119,28 +117,28 @@ require (
 	github.com/valyala/fasttemplate v1.2.2 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/bridges/prometheus v0.67.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.18.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.18.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.42.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.42.0 // indirect
-	go.opentelemetry.io/otel/exporters/prometheus v0.64.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.18.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.42.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0 // indirect
+	go.opentelemetry.io/contrib/bridges/prometheus v0.68.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/prometheus v0.65.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.19.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go4.org v0.0.0-20260112195520-a5071408f32f // indirect
-	golang.org/x/crypto v0.49.0 // indirect
-	golang.org/x/sys v0.42.0 // indirect
+	golang.org/x/crypto v0.50.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 // indirect
-	google.golang.org/grpc v1.79.3 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260406210006-6f92a3bedf2d // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d // indirect
+	google.golang.org/grpc v1.80.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -10,12 +10,10 @@ github.com/STARRY-S/zip v0.2.3 h1:luE4dMvRPDOWQdeDdUxUoZkzUIpTccdKdhHHsQJ1fm4=
 github.com/STARRY-S/zip v0.2.3/go.mod h1:lqJ9JdeRipyOQJrYSOtpNAiaesFO6zVDsE8GIGFaoSk=
 github.com/alexliesenfeld/health v0.8.1 h1:wdE3vt+cbJotiR8DGDBZPKHDFoJbAoWEfQTcqrmedUg=
 github.com/alexliesenfeld/health v0.8.1/go.mod h1:TfNP0f+9WQVWMQRzvMUjlws4ceXKEL3WR+6Hp95HUFc=
-github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
-github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
+github.com/andybalholm/brotli v1.2.1 h1:R+f5xP285VArJDRgowrfb9DqL18yVK0gKAW/F+eTWro=
+github.com/andybalholm/brotli v1.2.1/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
-github.com/barasher/go-exiftool v1.10.0 h1:f5JY5jc42M7tzR6tbL9508S2IXdIcG9QyieEXNMpIhs=
-github.com/barasher/go-exiftool v1.10.0/go.mod h1:F9s/a3uHSM8YniVfwF+sbQUtP8Gmh9nyzigNF+8vsWo=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bodgit/plumbing v1.3.0 h1:pf9Itz1JOQgn7vEOE7v7nlEfBykYqvUYioC61TwWCFU=
@@ -30,10 +28,10 @@ github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1x
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/chromedp/cdproto v0.0.0-20260321001828-e3e3800016bc h1:wkN/LMi5vc60pBRWx6qpbk/aEvq3/ZVNpnMvsw8PVVU=
-github.com/chromedp/cdproto v0.0.0-20260321001828-e3e3800016bc/go.mod h1:cbyjALe67vDvlvdiG9369P8w5U2w6IshwtyD2f2Tvag=
-github.com/chromedp/chromedp v0.15.1 h1:EJWiPm7BNqDqjYy6U0lTSL5wNH+iNt9GjC3a4gfjNyQ=
-github.com/chromedp/chromedp v0.15.1/go.mod h1:CdTHtUqD/dqaFw/cvFWtTydoEQS44wLBuwbMR9EkOY4=
+github.com/chromedp/cdproto v0.0.0-20250803210736-d308e07a266d h1:ZtA1sedVbEW7EW80Iz2GR3Ye6PwbJAJXjv7D74xG6HU=
+github.com/chromedp/cdproto v0.0.0-20250803210736-d308e07a266d/go.mod h1:NItd7aLkcfOA/dcMXvl8p1u+lQqioRMq/SqDp71Pb/k=
+github.com/chromedp/chromedp v0.14.2 h1:r3b/WtwM50RsBZHMUm9fsNhhzRStTHrKdr2zmwbZSzM=
+github.com/chromedp/chromedp v0.14.2/go.mod h1:rHzAv60xDE7VNy/MYtTUrYreSc0ujt2O1/C3bzctYBo=
 github.com/chromedp/sysutil v1.1.0 h1:PUFNv5EcprjqXZD9nJb9b/c9ibAbxiYo4exNWZyipwM=
 github.com/chromedp/sysutil v1.1.0/go.mod h1:WiThHUdltqCNKGc4gaU50XgYjwjYIhKWoHGPTUfWTJ8=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
@@ -47,8 +45,8 @@ github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7np
 github.com/cpuguy83/dockercfg v0.3.2 h1:DlJTyZGBDlXqUZ2Dk2Q3xHs/FtnooJJVaad2S9GKorA=
 github.com/cpuguy83/dockercfg v0.3.2/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
-github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
+github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
+github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
 github.com/cucumber/gherkin/go/v26 v26.2.0 h1:EgIjePLWiPeslwIWmNQ3XHcypPsWAHoMCz/YEBKP4GI=
 github.com/cucumber/gherkin/go/v26 v26.2.0/go.mod h1:t2GAPnB8maCT4lkHL99BDCVNzCh1d7dBhCLt150Nr/0=
 github.com/cucumber/godog v0.15.1 h1:rb/6oHDdvVZKS66hrhpjFQFHjthFSrQBCOI1LwshNTI=
@@ -61,10 +59,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ=
-github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/docker/docker v28.5.2+incompatible h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM=
-github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
+github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
 github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
@@ -100,8 +96,8 @@ github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1
 github.com/gofrs/uuid v4.4.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/gomarkdown/markdown v0.0.0-20260217112301-37c66b85d6ab h1:VYNivV7P8IRHUam2swVUNkhIdp0LRRFKe4hXNnoZKTc=
-github.com/gomarkdown/markdown v0.0.0-20260217112301-37c66b85d6ab/go.mod h1:JDGcbDT52eL4fju3sZ4TeHGsQwhG9nbDV21aMyhwPoA=
+github.com/gomarkdown/markdown v0.0.0-20260412113850-134a5b2cce7f h1:C5vKBogs/Qf5ID8F8XuRO8SFL+5SH7JMJrAfdLAZ2iA=
+github.com/gomarkdown/markdown v0.0.0-20260412113850-134a5b2cce7f/go.mod h1:JDGcbDT52eL4fju3sZ4TeHGsQwhG9nbDV21aMyhwPoA=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
@@ -150,18 +146,18 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/labstack/echo/v4 v4.15.1 h1:S9keusg26gZpjMmPqB5hOEvNKnmd1lNmcHrbbH2lnFs=
 github.com/labstack/echo/v4 v4.15.1/go.mod h1:xmw1clThob0BSVRX1CRQkGQ/vjwcpOMjQZSZa9fKA/c=
-github.com/labstack/gommon v0.4.2 h1:F8qTUNXgG1+6WQmqoUWnz8WiEU60mXVVw0P4ht1WRA0=
-github.com/labstack/gommon v0.4.2/go.mod h1:QlUFxVM+SNXhDL/Z7YhocGIBYOiwB0mXm1+1bAPHPyU=
+github.com/labstack/gommon v0.5.0 h1:6VSQ2NOzsnEJ5W6+84E0RbcaDDmgB6NIAzWCczTEe6c=
+github.com/labstack/gommon v0.5.0/go.mod h1:Rzlg7HHy1maLfzBYGg9NZcVuz1sA68HHhLjhcEllYE0=
 github.com/ledongthuc/pdf v0.0.0-20220302134840-0c2507a12d80 h1:6Yzfa6GP0rIo/kULo2bwGEkFvCePZ3qHDDTC3/J9Swo=
 github.com/ledongthuc/pdf v0.0.0-20220302134840-0c2507a12d80/go.mod h1:imJHygn/1yfhB7XSJJKlFZKl/J+dCPAknuiaGOshXAs=
-github.com/lufia/plan9stats v0.0.0-20260324052639-156f7da3f749 h1:Qj3hTcdWH8uMZDI41HNuTuJN525C7NBrbtH5kSO6fPk=
-github.com/lufia/plan9stats v0.0.0-20260324052639-156f7da3f749/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
+github.com/lufia/plan9stats v0.0.0-20260330125221-c963978e514e h1:Q6MvJtQK/iRcRtzAscm/zF23XxJlbECiGPyRicsX+Ak=
+github.com/lufia/plan9stats v0.0.0-20260330125221-c963978e514e/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
 github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
 github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.21 h1:xYae+lCNBP7QuW4PUnNG61ffM4hVIfm+zUzDuSzYLGs=
+github.com/mattn/go-isatty v0.0.21/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
 github.com/mholt/archives v0.1.5 h1:Fh2hl1j7VEhc6DZs2DLMgiBNChUux154a1G+2esNvzQ=
 github.com/mholt/archives v0.1.5/go.mod h1:3TPMmBLPsgszL+1As5zECTuKwKvIfj6YcwWPpeTAXF4=
 github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
@@ -174,10 +170,12 @@ github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3N
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/go-archive v0.2.0 h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8=
 github.com/moby/go-archive v0.2.0/go.mod h1:mNeivT14o8xU+5q1YnNrkQVpK+dnNe/K6fHqnTg4qPU=
+github.com/moby/moby/api v1.54.1 h1:TqVzuJkOLsgLDDwNLmYqACUuTehOHRGKiPhvH8V3Nn4=
+github.com/moby/moby/api v1.54.1/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
+github.com/moby/moby/client v0.4.0 h1:S+2XegzHQrrvTCvF6s5HFzcrywWQmuVnhOXe2kiWjIw=
+github.com/moby/moby/client v0.4.0/go.mod h1:QWPbvWchQbxBNdaLSpoKpCdf5E+WxFAgNHogCWDoa7g=
 github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U=
 github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
-github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
-github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
 github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
 github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
 github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
@@ -186,8 +184,6 @@ github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g
 github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
 github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
-github.com/morikuni/aec v1.1.0 h1:vBBl0pUnvi/Je71dsRrhMBtreIqNMYErSAbEeb8jrXQ=
-github.com/morikuni/aec v1.1.0/go.mod h1:xDRgiq/iw5l+zkao76YTKzKttOp2cwPEne25HDkJnBw=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/nwaples/rardecode/v2 v2.2.2 h1:/5oL8dzYivRM/tqX9VcTSWfbpwcbwKG1QtSJr3b3KcU=
@@ -200,8 +196,6 @@ github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde h1:x0TT0RDC7UhA
 github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0=
 github.com/pierrec/lz4/v4 v4.1.26 h1:GrpZw1gZttORinvzBdXPUXATeqlJjqUG/D87TKMnhjY=
 github.com/pierrec/lz4/v4 v4.1.26/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
@@ -219,8 +213,8 @@ github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4Ul
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/shirou/gopsutil/v4 v4.26.2 h1:X8i6sicvUFih4BmYIGT1m2wwgw2VG9YgrDTi7cIRGUI=
-github.com/shirou/gopsutil/v4 v4.26.2/go.mod h1:LZ6ewCSkBqUpvSOf+LsTGnRinC6iaNUNMGBtDkJBaLQ=
+github.com/shirou/gopsutil/v4 v4.26.3 h1:2ESdQt90yU3oXF/CdOlRCJxrP+Am1aBYubTMTfxJ1qc=
+github.com/shirou/gopsutil/v4 v4.26.3/go.mod h1:LZ6ewCSkBqUpvSOf+LsTGnRinC6iaNUNMGBtDkJBaLQ=
 github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
 github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
 github.com/sorairolake/lzip-go v0.3.8 h1:j5Q2313INdTA80ureWYRhX+1K78mUXfMoPZCw/ivWik=
@@ -235,17 +229,16 @@ github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3A
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
+github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/testcontainers/testcontainers-go v0.41.0 h1:mfpsD0D36YgkxGj2LrIyxuwQ9i2wCKAD+ESsYM1wais=
-github.com/testcontainers/testcontainers-go v0.41.0/go.mod h1:pdFrEIfaPl24zmBjerWTTYaY0M6UHsqA1YSvsoU40MI=
+github.com/testcontainers/testcontainers-go v0.42.0 h1:He3IhTzTZOygSXLJPMX7n44XtK+qhjat1nI9cneBbUY=
+github.com/testcontainers/testcontainers-go v0.42.0/go.mod h1:vZjdY1YmUA1qEForxOIOazfsrdyORJAbhi0bp8plN30=
 github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA=
 github.com/tklauser/go-sysconf v0.3.16/go.mod h1:/qNL9xxDhc7tx3HSRsLWNnuzbVfh3e7gh/BmM179nYI=
 github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw=
@@ -263,52 +256,52 @@ github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/bridges/otelslog v0.17.0 h1:NFIS6x7wyObQ7cR84x7bt1sr8nYBx89s3x3GwRjw40k=
-go.opentelemetry.io/contrib/bridges/otelslog v0.17.0/go.mod h1:39SaByOyDMRMe872AE7uelMuQZidIw7LLFAnQi0FWTE=
-go.opentelemetry.io/contrib/bridges/prometheus v0.67.0 h1:dkBzNEAIKADEaFnuESzcXvpd09vxvDZsOjx11gjUqLk=
-go.opentelemetry.io/contrib/bridges/prometheus v0.67.0/go.mod h1:Z5RIwRkZgauOIfnG5IpidvLpERjhTninpP1dTG2jTl4=
-go.opentelemetry.io/contrib/exporters/autoexport v0.67.0 h1:4fnRcNpc6YFtG3zsFw9achKn3XgmxPxuMuqIL5rE8e8=
-go.opentelemetry.io/contrib/exporters/autoexport v0.67.0/go.mod h1:qTvIHMFKoxW7HXg02gm6/Wofhq5p3Ib/A/NNt1EoBSQ=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=
-go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho=
-go.opentelemetry.io/otel v1.42.0/go.mod h1:lJNsdRMxCUIWuMlVJWzecSMuNjE7dOYyWlqOXWkdqCc=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.18.0 h1:deI9UQMoGFgrg5iLPgzueqFPHevDl+28YKfSpPTI6rY=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.18.0/go.mod h1:PFx9NgpNUKXdf7J4Q3agRxMs3Y07QhTCVipKmLsMKnU=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.18.0 h1:icqq3Z34UrEFk2u+HMhTtRsvo7Ues+eiJVjaJt62njs=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.18.0/go.mod h1:W2m8P+d5Wn5kipj4/xmbt9uMqezEKfBjzVJadfABSBE=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 h1:MdKucPl/HbzckWWEisiNqMPhRrAOQX8r4jTuGr636gk=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0/go.mod h1:RolT8tWtfHcjajEH5wFIZ4Dgh5jpPdFXYV9pTAk/qjc=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.42.0 h1:H7O6RlGOMTizyl3R08Kn5pdM06bnH8oscSj7o11tmLA=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.42.0/go.mod h1:mBFWu/WOVDkWWsR7Tx7h6EpQB8wsv7P0Yrh0Pb7othc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 h1:THuZiwpQZuHPul65w4WcwEnkX2QIuMT+UFoOrygtoJw=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0/go.mod h1:J2pvYM5NGHofZ2/Ru6zw/TNWnEQp5crgyDeSrYpXkAw=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 h1:zWWrB1U6nqhS/k6zYB74CjRpuiitRtLLi68VcgmOEto=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0/go.mod h1:2qXPNBX1OVRC0IwOnfo1ljoid+RD0QK3443EaqVlsOU=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.42.0 h1:uLXP+3mghfMf7XmV4PkGfFhFKuNWoCvvx5wP/wOXo0o=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.42.0/go.mod h1:v0Tj04armyT59mnURNUJf7RCKcKzq+lgJs6QSjHjaTc=
-go.opentelemetry.io/otel/exporters/prometheus v0.64.0 h1:g0LRDXMX/G1SEZtK8zl8Chm4K6GBwRkjPKE36LxiTYs=
-go.opentelemetry.io/otel/exporters/prometheus v0.64.0/go.mod h1:UrgcjnarfdlBDP3GjDIJWe6HTprwSazNjwsI+Ru6hro=
-go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.18.0 h1:KJVjPD3rcPb98rIs3HznyJlrfx9ge5oJvxxlGR+P/7s=
-go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.18.0/go.mod h1:K3kRa2ckmHWQaTWQdPRHc7qGXASuVuoEQXzrvlA98Ws=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.42.0 h1:lSZHgNHfbmQTPfuTmWVkEu8J8qXaQwuV30pjCcAUvP8=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.42.0/go.mod h1:so9ounLcuoRDu033MW/E0AD4hhUjVqswrMF5FoZlBcw=
-go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0 h1:s/1iRkCKDfhlh1JF26knRneorus8aOwVIDhvYx9WoDw=
-go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0/go.mod h1:UI3wi0FXg1Pofb8ZBiBLhtMzgoTm1TYkMvn71fAqDzs=
-go.opentelemetry.io/otel/log v0.18.0 h1:XgeQIIBjZZrliksMEbcwMZefoOSMI1hdjiLEiiB0bAg=
-go.opentelemetry.io/otel/log v0.18.0/go.mod h1:KEV1kad0NofR3ycsiDH4Yjcoj0+8206I6Ox2QYFSNgI=
-go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4=
-go.opentelemetry.io/otel/metric v1.42.0/go.mod h1:RlUN/7vTU7Ao/diDkEpQpnz3/92J9ko05BIwxYa2SSI=
-go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=
-go.opentelemetry.io/otel/sdk v1.42.0/go.mod h1:rGHCAxd9DAph0joO4W6OPwxjNTYWghRWmkHuGbayMts=
-go.opentelemetry.io/otel/sdk/log v0.18.0 h1:n8OyZr7t7otkeTnPTbDNom6rW16TBYGtvyy2Gk6buQw=
-go.opentelemetry.io/otel/sdk/log v0.18.0/go.mod h1:C0+wxkTwKpOCZLrlJ3pewPiiQwpzycPI/u6W0Z9fuYk=
-go.opentelemetry.io/otel/sdk/log/logtest v0.18.0 h1:l3mYuPsuBx6UKE47BVcPrZoZ0q/KER57vbj2qkgDLXA=
-go.opentelemetry.io/otel/sdk/log/logtest v0.18.0/go.mod h1:7cHtiVJpZebB3wybTa4NG+FUo5NPe3PROz1FqB0+qdw=
-go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9RKCAZ3YGuA=
-go.opentelemetry.io/otel/sdk/metric v1.42.0/go.mod h1:Ua6AAlDKdZ7tdvaQKfSmnFTdHx37+J4ba8MwVCYM5hc=
-go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=
-go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc=
+go.opentelemetry.io/contrib/bridges/otelslog v0.18.0 h1:hhPGP3zvvy1xWT9RTy970wlniSxFttBIsAK1gvMguJM=
+go.opentelemetry.io/contrib/bridges/otelslog v0.18.0/go.mod h1:twJF7inoMza6kxMcF8JOdL3mPmtOZu7GEr34CUNE6Dg=
+go.opentelemetry.io/contrib/bridges/prometheus v0.68.0 h1:w3zlHYETbDwXyWHZlyyR58ZC39XGi8rAhkBgUgJ9d5w=
+go.opentelemetry.io/contrib/bridges/prometheus v0.68.0/go.mod h1:GR/mClR2nn7vE8RLwxKjoBNg+QtgdDhRzxVa93koy5o=
+go.opentelemetry.io/contrib/exporters/autoexport v0.68.0 h1:0D3GFvELGIwQGfC6agLsbrEYSGWZTRTxIXxcQUqrOuk=
+go.opentelemetry.io/contrib/exporters/autoexport v0.68.0/go.mod h1:DM2NV7Zb8CcGeVPt6glouY0FAiwZQ/iqgcWExhgWeN8=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo=
+go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
+go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 h1:Dn8rkudDzY6KV9dr/D/bTUuWgqDf9xe0rr4G2elrn0Y=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0/go.mod h1:gMk9F0xDgyN9M/3Ed5Y1wKcx/9mlU91NXY2SNq7RQuU=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0 h1:HIBTQ3VO5aupLKjC90JgMqpezVXwFuq6Ryjn0/izoag=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0/go.mod h1:ji9vId85hMxqfvICA0Jt8JqEdrXaAkcpkI9HPXya0ro=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 h1:8UQVDcZxOJLtX6gxtDt3vY2WTgvZqMQRzjsqiIHQdkc=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0/go.mod h1:2lmweYCiHYpEjQ/lSJBYhj9jP1zvCvQW4BqL9dnT7FQ=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 h1:w1K+pCJoPpQifuVpsKamUdn9U0zM3xUziVOqsGksUrY=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0/go.mod h1:HBy4BjzgVE8139ieRI75oXm3EcDN+6GhD88JT1Kjvxg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 h1:RAE+JPfvEmvy+0LzyUA25/SGawPwIUbZ6u0Wug54sLc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0/go.mod h1:AGmbycVGEsRx9mXMZ75CsOyhSP6MFIcj/6dnG+vhVjk=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak=
+go.opentelemetry.io/otel/exporters/prometheus v0.65.0 h1:jOveH/b4lU9HT7y+Gfamf18BqlOuz2PWEvs8yM7Q6XE=
+go.opentelemetry.io/otel/exporters/prometheus v0.65.0/go.mod h1:i1P8pcumauPtUI4YNopea1dhzEMuEqWP1xoUZDylLHo=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.19.0 h1:GJkybS+crDMdExT/BUNCEgfrmfboztcS6PhvSo88HKM=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.19.0/go.mod h1:NuAyxRYIG2lKX3YQkB+83StTxM7s52PUUkRRiC0wnYI=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0 h1:TC+BewnDpeiAmcscXbGMfxkO+mwYUwE/VySwvw88PfA=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0/go.mod h1:J/ZyF4vfPwsSr9xJSPyQ4LqtcTPULFR64KwTikGLe+A=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0 h1:mS47AX77OtFfKG4vtp+84kuGSFZHTyxtXIN269vChY0=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0/go.mod h1:PJnsC41lAGncJlPUniSwM81gc80GkgWJWr3cu2nKEtU=
+go.opentelemetry.io/otel/log v0.19.0 h1:KUZs/GOsw79TBBMfDWsXS+KZ4g2Ckzksd1ymzsIEbo4=
+go.opentelemetry.io/otel/log v0.19.0/go.mod h1:5DQYeGmxVIr4n0/BcJvF4upsraHjg6vudJJpnkL6Ipk=
+go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
+go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
+go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
+go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
+go.opentelemetry.io/otel/sdk/log v0.19.0 h1:scYVLqT22D2gqXItnWiocLUKGH9yvkkeql5dBDiXyko=
+go.opentelemetry.io/otel/sdk/log v0.19.0/go.mod h1:vFBowwXGLlW9AvpuF7bMgnNI95LiW10szrOdvzBHlAg=
+go.opentelemetry.io/otel/sdk/log/logtest v0.19.0 h1:BEbF7ZBB6qQloV/Ub1+3NQoOUnVtcGkU3XX4Ws3GQfk=
+go.opentelemetry.io/otel/sdk/log/logtest v0.19.0/go.mod h1:Lua81/3yM0wOmoHTokLj9y9ADeA02v1naRrVrkAZuKk=
+go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
+go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
+go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
+go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
 go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
 go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
@@ -317,10 +310,10 @@ go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go4.org v0.0.0-20260112195520-a5071408f32f h1:ziUVAjmTPwQMBmYR1tbdRFJPtTcQUI12fH9QQjfb0Sw=
 go4.org v0.0.0-20260112195520-a5071408f32f/go.mod h1:ZRJnO5ZI4zAwMFp+dS1+V6J6MSyAowhRqAE+DPa1Xp0=
-golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
-golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
+golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
+golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -328,23 +321,23 @@ golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
-golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
+golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
-gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
-google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 h1:41r6JMbpzBMen0R/4TZeeAmGXSJC7DftGINUodzTkPI=
-google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:EIQZ5bFCfRQDV4MhRle7+OgjNtZ6P1PiZBgAKuxXu/Y=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 h1:ndE4FoJqsIceKP2oYSnUZqhTdYufCYYkqwtFzfrhI7w=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
-google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
+google.golang.org/genproto/googleapis/api v0.0.0-20260406210006-6f92a3bedf2d h1:/aDRtSZJjyLQzm75d+a1wOJaqyKBMvIAfeQmoa3ORiI=
+google.golang.org/genproto/googleapis/api v0.0.0-20260406210006-6f92a3bedf2d/go.mod h1:etfGUgejTiadZAUaEP14NP97xi1RGeawqkjDARA/UOs=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d h1:wT2n40TBqFY6wiwazVK9/iTWbsQrgk5ZfCSVFLO9LQA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
+google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -355,3 +348,5 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
+pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk=
+pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=

package-lock.json

@@ -5,7 +5,7 @@
   "packages": {
     "": {
       "devDependencies": {
-        "prettier": "3.8.1",
+        "prettier": "3.8.3",
         "prettier-plugin-gherkin": "^3.1.3",
         "prettier-plugin-sh": "^0.18.0"
       }
@@ -34,9 +34,9 @@
       }
     },
     "node_modules/@reteps/dockerfmt": {
-      "version": "0.3.6",
-      "resolved": "https://registry.npmjs.org/@reteps/dockerfmt/-/dockerfmt-0.3.6.tgz",
-      "integrity": "sha512-Tb5wIMvBf/nLejTQ61krK644/CEMB/cpiaIFXqGApfGqO3GwcR3qnI0DbmkFVCl2OyEp8LnLX3EkucoL0+tbFg==",
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/@reteps/dockerfmt/-/dockerfmt-0.5.2.tgz",
+      "integrity": "sha512-Hbr7yen4fP5TxGM54ucXa4o5NwWXatJ6Bd9I8gp0PValYbI4Rug2Gu+rVv7K7o/efQc3F5ctqWJz47rYaa8zBw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -58,9 +58,9 @@
       "license": "MIT"
     },
     "node_modules/prettier": {
-      "version": "3.8.1",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.8.1.tgz",
-      "integrity": "sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg==",
+      "version": "3.8.3",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.8.3.tgz",
+      "integrity": "sha512-7igPTM53cGHMW8xWuVTydi2KO233VFiTNyF5hLJqpilHfmn8C8gPf+PS7dUT64YcXFbiMGZxS9pCSxL/Dxm/Jw==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -86,13 +86,13 @@
       }
     },
     "node_modules/prettier-plugin-sh": {
-      "version": "0.18.0",
-      "resolved": "https://registry.npmjs.org/prettier-plugin-sh/-/prettier-plugin-sh-0.18.0.tgz",
-      "integrity": "sha512-cW1XL27FOJQ/qGHOW6IHwdCiNWQsAgK+feA8V6+xUTaH0cD3Mh+tFAtBvEEWvuY6hTDzRV943Fzeii+qMOh7nQ==",
+      "version": "0.18.1",
+      "resolved": "https://registry.npmjs.org/prettier-plugin-sh/-/prettier-plugin-sh-0.18.1.tgz",
+      "integrity": "sha512-uZmU22wBMevjh3rmCatNQqiEer2+5KLa0xYCBX6zQQUQkcNzVL+s6FbPKK6ZSUNUbQk6jMAcQHrYPvuL2W6ihQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@reteps/dockerfmt": "^0.3.6",
+        "@reteps/dockerfmt": "^0.5.1",
         "sh-syntax": "^0.5.8"
       },
       "engines": {

package.json

@@ -1,6 +1,6 @@
 {
   "devDependencies": {
-    "prettier": "3.8.1",
+    "prettier": "3.8.3",
     "prettier-plugin-gherkin": "^3.1.3",
     "prettier-plugin-sh": "^0.18.0"
   }

pkg/gotenberg/cmd.go

@@ -55,6 +55,13 @@ func CommandContext(ctx context.Context, logger *slog.Logger, binPath string, ar
 	}, nil
 }
 
+// SetEnv replaces the environment variables passed to the underlying
+// process. When SetEnv is not called, the process inherits the parent's
+// environment.
+func (cmd *Cmd) SetEnv(env []string) {
+	cmd.process.Env = env
+}
+
 // Start starts the command but does not wait for its completion.
 func (cmd *Cmd) Start() error {
 	err := cmd.pipeOutput()

pkg/gotenberg/mocks.go

@@ -45,20 +45,21 @@ func (mod *DebuggableMock) Debug() map[string]any {
 //
 //nolint:dupl
 type PdfEngineMock struct {
-	MergeMock          func(ctx context.Context, logger *slog.Logger, inputPaths []string, outputPath string) error
-	SplitMock          func(ctx context.Context, logger *slog.Logger, mode SplitMode, inputPath, outputDirPath string) ([]string, error)
-	FlattenMock        func(ctx context.Context, logger *slog.Logger, inputPath string) error
-	ConvertMock        func(ctx context.Context, logger *slog.Logger, formats PdfFormats, inputPath, outputPath string) error
-	ReadMetadataMock   func(ctx context.Context, logger *slog.Logger, inputPath string) (map[string]any, error)
-	PageCountMock      func(ctx context.Context, logger *slog.Logger, inputPath string) (int, error)
-	WriteMetadataMock  func(ctx context.Context, logger *slog.Logger, metadata map[string]any, inputPath string) error
-	ReadBookmarksMock  func(ctx context.Context, logger *slog.Logger, inputPath string) ([]Bookmark, error)
-	EncryptMock        func(ctx context.Context, logger *slog.Logger, inputPath, userPassword, ownerPassword string) error
-	EmbedFilesMock     func(ctx context.Context, logger *slog.Logger, filePaths []string, inputPath string) error
-	WriteBookmarksMock func(ctx context.Context, logger *slog.Logger, inputPath string, bookmarks []Bookmark) error
-	WatermarkMock      func(ctx context.Context, logger *slog.Logger, inputPath string, stamp Stamp) error
-	StampMock          func(ctx context.Context, logger *slog.Logger, inputPath string, stamp Stamp) error
-	RotateMock         func(ctx context.Context, logger *slog.Logger, inputPath string, angle int, pages string) error
+	MergeMock              func(ctx context.Context, logger *slog.Logger, inputPaths []string, outputPath string) error
+	SplitMock              func(ctx context.Context, logger *slog.Logger, mode SplitMode, inputPath, outputDirPath string) ([]string, error)
+	FlattenMock            func(ctx context.Context, logger *slog.Logger, inputPath string) error
+	ConvertMock            func(ctx context.Context, logger *slog.Logger, formats PdfFormats, inputPath, outputPath string) error
+	ReadMetadataMock       func(ctx context.Context, logger *slog.Logger, inputPath string) (map[string]any, error)
+	PageCountMock          func(ctx context.Context, logger *slog.Logger, inputPath string) (int, error)
+	WriteMetadataMock      func(ctx context.Context, logger *slog.Logger, metadata map[string]any, inputPath string) error
+	ReadBookmarksMock      func(ctx context.Context, logger *slog.Logger, inputPath string) ([]Bookmark, error)
+	EncryptMock            func(ctx context.Context, logger *slog.Logger, inputPath, userPassword, ownerPassword string) error
+	EmbedFilesMock         func(ctx context.Context, logger *slog.Logger, filePaths []string, inputPath string) error
+	EmbedFilesMetadataMock func(ctx context.Context, logger *slog.Logger, metadata map[string]map[string]string, inputPath string) error
+	WriteBookmarksMock     func(ctx context.Context, logger *slog.Logger, inputPath string, bookmarks []Bookmark) error
+	WatermarkMock          func(ctx context.Context, logger *slog.Logger, inputPath string, stamp Stamp) error
+	StampMock              func(ctx context.Context, logger *slog.Logger, inputPath string, stamp Stamp) error
+	RotateMock             func(ctx context.Context, logger *slog.Logger, inputPath string, angle int, pages string) error
 }
 
 func (engine *PdfEngineMock) Merge(ctx context.Context, logger *slog.Logger, inputPaths []string, outputPath string) error {
@@ -101,6 +102,10 @@ func (engine *PdfEngineMock) EmbedFiles(ctx context.Context, logger *slog.Logger
 	return engine.EmbedFilesMock(ctx, logger, filePaths, inputPath)
 }
 
+func (engine *PdfEngineMock) EmbedFilesMetadata(ctx context.Context, logger *slog.Logger, metadata map[string]map[string]string, inputPath string) error {
+	return engine.EmbedFilesMetadataMock(ctx, logger, metadata, inputPath)
+}
+
 func (engine *PdfEngineMock) WriteBookmarks(ctx context.Context, logger *slog.Logger, inputPath string, bookmarks []Bookmark) error {
 	return engine.WriteBookmarksMock(ctx, logger, inputPath, bookmarks)
 }

pkg/gotenberg/outbound.go

@@ -0,0 +1,413 @@
+package gotenberg
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/dlclark/regexp2"
+)
+
+// ErrNonPublicIP indicates that an outbound URL targets an IP address that
+// is not reachable on the public internet. This covers loopback, RFC1918
+// private, link-local, unspecified, multicast, and IPv6 unique-local
+// (fc00::/7) addresses, as well as their IPv4-mapped IPv6 wrappers (for
+// example [::ffff:127.0.0.1]).
+var ErrNonPublicIP = errors.New("non-public IP")
+
+// ErrPublicIP indicates that an outbound URL targets an IP address that is
+// reachable on the public internet. It is returned when a caller opts
+// into denying public destinations via [WithDenyPublicIPs]; typical use
+// cases are air-gapped or data-governed deployments where Gotenberg must
+// only talk to hosts on a private network.
+var ErrPublicIP = errors.New("public IP")
+
+// netipResolver is the subset of [net.Resolver] used by [resolveHost].
+// Defining it as an interface allows tests to substitute a stub resolver.
+type netipResolver interface {
+	LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error)
+}
+
+// outboundResolver is the resolver used by [resolveHost]. It is a
+// package-level variable so that tests can substitute a stub resolver.
+var outboundResolver netipResolver = net.DefaultResolver
+
+// outboundDialer is the underlying dialer used by [secureDialContext]. It is
+// a package-level variable so that tests can replace it.
+var outboundDialer = &net.Dialer{
+	Timeout:   30 * time.Second,
+	KeepAlive: 30 * time.Second,
+}
+
+// IsPublicIP reports whether addr is reachable on the public internet. It
+// returns false for loopback, private (RFC1918), link-local, unspecified,
+// multicast, and unique-local addresses. IPv4-mapped IPv6 addresses are
+// unmapped before evaluation so that [::ffff:127.0.0.1] is correctly
+// identified as loopback.
+func IsPublicIP(addr netip.Addr) bool {
+	if !addr.IsValid() {
+		return false
+	}
+	addr = addr.Unmap()
+	switch {
+	case addr.IsLoopback(),
+		addr.IsPrivate(),
+		addr.IsLinkLocalUnicast(),
+		addr.IsLinkLocalMulticast(),
+		addr.IsMulticast(),
+		addr.IsUnspecified(),
+		addr.IsInterfaceLocalMulticast():
+		return false
+	}
+	return true
+}
+
+// ResolveAndCheckPublic resolves host and rejects any resolved address
+// that fails [IsPublicIP] with [ErrNonPublicIP]. It is the strict
+// equivalent of [DecideOutbound] with [WithDenyPrivateIPs] true for a
+// bare host. Callers that need a different policy should use
+// [DecideOutbound] directly.
+func ResolveAndCheckPublic(ctx context.Context, host string) ([]netip.Addr, error) {
+	return resolveHost(ctx, host, true, false)
+}
+
+// resolveHost resolves host and returns the addresses. When denyPrivate
+// is true, a non-public address is rejected with [ErrNonPublicIP]. When
+// denyPublic is true, a public address is rejected with [ErrPublicIP].
+// Both checks may be active at the same time, in which case any
+// resolved address fails and the caller must rely on an allow-list
+// bypass.
+func resolveHost(ctx context.Context, host string, denyPrivate, denyPublic bool) ([]netip.Addr, error) {
+	if host == "" {
+		return nil, errors.New("empty host")
+	}
+
+	check := func(a netip.Addr) error {
+		public := IsPublicIP(a)
+		if denyPublic && public {
+			return fmt.Errorf("%q: %w", a, ErrPublicIP)
+		}
+		if denyPrivate && !public {
+			return fmt.Errorf("%q: %w", a, ErrNonPublicIP)
+		}
+		return nil
+	}
+
+	if addr, err := netip.ParseAddr(host); err == nil {
+		if err := check(addr); err != nil {
+			return nil, err
+		}
+		return []netip.Addr{addr}, nil
+	}
+	addrs, err := outboundResolver.LookupNetIP(ctx, "ip", host)
+	if err != nil {
+		return nil, fmt.Errorf("resolve %q: %w", host, err)
+	}
+	if len(addrs) == 0 {
+		return nil, fmt.Errorf("resolve %q: no addresses returned", host)
+	}
+	for _, a := range addrs {
+		if err := check(a); err != nil {
+			return nil, fmt.Errorf("%q resolves to rejected address %w", host, err)
+		}
+	}
+	return addrs, nil
+}
+
+// OutboundDecision is the result of validating an outbound URL via
+// [DecideOutbound]. Callers use it to dial the destination either directly
+// (operator-approved allow-list match, Bypass true) or via [DialPinned] so
+// that the connect targets the IPs resolved at validation time. Passing
+// the decision to the dialer closes the window between validation and
+// connect that DNS rebinding exploits.
+type OutboundDecision struct {
+	// Bypass is true when an allow-list pattern matched the URL. The
+	// operator has explicitly opted into the destination; the caller
+	// should dial directly without an additional IP check.
+	Bypass bool
+
+	// Pinned holds the IPs resolved for the URL host. The caller should
+	// dial one of these via [DialPinned] to prevent DNS rebinding between
+	// validation and connect.
+	Pinned []netip.Addr
+}
+
+// outboundDecisionKey is the context key under which an [OutboundDecision]
+// is stored.
+type outboundDecisionKey struct{}
+
+// decideConfig carries optional settings for [DecideOutbound] and
+// [FilterOutboundURL]. See [DecideOption] for how callers configure it.
+type decideConfig struct {
+	denyPrivateIPs bool
+	denyPublicIPs  bool
+}
+
+// DecideOption customizes how [DecideOutbound] and [FilterOutboundURL]
+// validate a URL. Options are applied in order on top of the permissive
+// defaults (no IP-class rejection).
+type DecideOption func(*decideConfig)
+
+// WithDenyPrivateIPs rejects URLs whose host resolves to a non-public IP
+// address (loopback, RFC1918, link-local, unique-local, multicast,
+// unspecified). DNS still runs and the returned [OutboundDecision] still
+// carries the resolved IPs for dial pinning, so enabling or disabling
+// this option does not affect DNS-rebinding protection. Use it on
+// internet-exposed deployments to mitigate SSRF against internal
+// services.
+func WithDenyPrivateIPs(deny bool) DecideOption {
+	return func(c *decideConfig) { c.denyPrivateIPs = deny }
+}
+
+// WithDenyPublicIPs rejects URLs whose host resolves to a public IP
+// address. Use it on air-gapped or data-governed deployments where
+// Gotenberg must only reach hosts on a private network; the option
+// prevents data exfiltration to attacker-controlled public servers via
+// webhook callbacks, downloadFrom URLs, or user-supplied stamp sources.
+// May be combined with [WithDenyPrivateIPs]; in that case every resolved
+// address fails and only an allow-list bypass permits a destination.
+func WithDenyPublicIPs(deny bool) DecideOption {
+	return func(c *decideConfig) { c.denyPublicIPs = deny }
+}
+
+// httpLikeScheme reports whether scheme is one of http, https, ws, or wss.
+// Only these schemes go through the IP-based address check; data, blob,
+// file, and other schemes are filtered by the regex layer alone.
+func httpLikeScheme(scheme string) bool {
+	switch scheme {
+	case "http", "https", "ws", "wss":
+		return true
+	}
+	return false
+}
+
+// DecideOutbound parses rawURL, runs the regex allow/deny lists against
+// the normalized form, and (when no allow-list match) resolves the host
+// and applies the IP-class checks selected by opts. It returns the
+// resulting [OutboundDecision] so the caller can pin the dial to the IPs
+// that were resolved here and skip a second DNS lookup later, which
+// closes the DNS rebinding window that affects callers that only receive
+// an error from [FilterOutboundURL].
+//
+// The semantics:
+//
+//  1. The URL is parsed and its scheme and host lowercased.
+//  2. allowList and denyList apply against the normalized form with OR
+//     semantics. The deny-list always applies.
+//  3. For http, https, ws, and wss, the host is resolved and every
+//     resolved address must satisfy the enabled IP-class checks
+//     ([WithDenyPrivateIPs], [WithDenyPublicIPs]). An allow-list match
+//     bypasses the IP-class checks and the returned decision carries
+//     Bypass true. Otherwise the decision carries Pinned with the
+//     resolved addresses.
+//
+// Callers that dial the destination themselves must honor Bypass and
+// Pinned: bypassed URLs dial the hostname directly (operator opt-in);
+// pinned URLs must dial one of Pinned via [DialPinned].
+func DecideOutbound(ctx context.Context, rawURL string, allowList, denyList []*regexp2.Regexp, deadline time.Time, opts ...DecideOption) (OutboundDecision, error) {
+	cfg := decideConfig{}
+	for _, opt := range opts {
+		opt(&cfg)
+	}
+
+	parsed, err := url.Parse(rawURL)
+	if err != nil {
+		return OutboundDecision{}, fmt.Errorf("parse URL %q: %w", rawURL, ErrFiltered)
+	}
+	parsed.Scheme = strings.ToLower(parsed.Scheme)
+	parsed.Host = strings.ToLower(parsed.Host)
+	normalized := parsed.String()
+
+	allowMatched := false
+	if len(allowList) > 0 {
+		for _, pattern := range allowList {
+			clone := regexp2.MustCompile(pattern.String(), 0)
+			clone.MatchTimeout = time.Until(deadline)
+
+			ok, err := clone.MatchString(normalized)
+			if err != nil {
+				if time.Now().After(deadline) {
+					return OutboundDecision{}, context.DeadlineExceeded
+				}
+				return OutboundDecision{}, fmt.Errorf("'%s' cannot handle '%s': %w", clone.String(), normalized, err)
+			}
+
+			if ok {
+				allowMatched = true
+				break
+			}
+		}
+
+		if !allowMatched {
+			return OutboundDecision{}, fmt.Errorf("'%s' does not match any expression from the allowed list: %w", normalized, ErrFiltered)
+		}
+	}
+
+	for _, pattern := range denyList {
+		clone := regexp2.MustCompile(pattern.String(), 0)
+		clone.MatchTimeout = time.Until(deadline)
+
+		ok, err := clone.MatchString(normalized)
+		if err != nil {
+			if time.Now().After(deadline) {
+				return OutboundDecision{}, context.DeadlineExceeded
+			}
+			return OutboundDecision{}, fmt.Errorf("'%s' cannot handle '%s': %w", clone.String(), normalized, err)
+		}
+
+		if ok {
+			return OutboundDecision{}, fmt.Errorf("'%s' matches the expression from the denied list: %w", normalized, ErrFiltered)
+		}
+	}
+
+	if allowMatched {
+		return OutboundDecision{Bypass: true}, nil
+	}
+
+	if !httpLikeScheme(parsed.Scheme) {
+		return OutboundDecision{}, nil
+	}
+
+	host := parsed.Hostname()
+	if host == "" {
+		return OutboundDecision{}, fmt.Errorf("URL %q has no host: %w", rawURL, ErrFiltered)
+	}
+
+	addrs, err := resolveHost(ctx, host, cfg.denyPrivateIPs, cfg.denyPublicIPs)
+	if err != nil {
+		switch {
+		case errors.Is(err, ErrNonPublicIP):
+			return OutboundDecision{}, fmt.Errorf("'%s' targets a non-public address: %w", normalized, ErrFiltered)
+		case errors.Is(err, ErrPublicIP):
+			return OutboundDecision{}, fmt.Errorf("'%s' targets a public address: %w", normalized, ErrFiltered)
+		default:
+			return OutboundDecision{}, fmt.Errorf("validate '%s' host: %w", normalized, err)
+		}
+	}
+
+	return OutboundDecision{Pinned: addrs}, nil
+}
+
+// FilterOutboundURL validates that rawURL is acceptable for an outbound
+// request from Gotenberg. It is the URL-aware replacement for
+// [FilterDeadline] and should be preferred for any new code that filters
+// a URL before issuing or instructing an outbound request.
+//
+// The default behavior is permissive: the URL passes as long as it clears
+// the regex allow-list and deny-list. Callers that need IP-class checks
+// opt in via [WithDenyPrivateIPs] or [WithDenyPublicIPs]. The deny-list
+// always applies and cannot be bypassed by an allow-list match.
+func FilterOutboundURL(ctx context.Context, rawURL string, allowList, denyList []*regexp2.Regexp, deadline time.Time, opts ...DecideOption) error {
+	_, err := DecideOutbound(ctx, rawURL, allowList, denyList, deadline, opts...)
+	return err
+}
+
+// outboundRoundTripper is an [http.RoundTripper] that validates each
+// request URL via [DecideOutbound] and stashes the resulting
+// [OutboundDecision] in the request context so that [secureDialContext]
+// can pin the dial or bypass the IP check as appropriate. Because the
+// http.Client invokes RoundTrip again for each redirect hop, this also
+// re-validates redirect targets without a separate CheckRedirect.
+type outboundRoundTripper struct {
+	base      http.RoundTripper
+	allowList []*regexp2.Regexp
+	denyList  []*regexp2.Regexp
+	opts      []DecideOption
+}
+
+// RoundTrip validates req.URL and delegates to the base transport.
+func (rt *outboundRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	deadline, ok := req.Context().Deadline()
+	if !ok {
+		deadline = time.Now().Add(30 * time.Second)
+	}
+
+	decision, err := DecideOutbound(req.Context(), req.URL.String(), rt.allowList, rt.denyList, deadline, rt.opts...)
+	if err != nil {
+		return nil, err
+	}
+
+	ctx := context.WithValue(req.Context(), outboundDecisionKey{}, decision)
+	return rt.base.RoundTrip(req.WithContext(ctx))
+}
+
+// NewOutboundHttpClient returns an [http.Client] that validates every
+// outbound request URL via the same logic as [FilterOutboundURL] and
+// pins the resulting dial to the resolved IPs.
+//
+// The client re-validates redirect targets automatically because the
+// underlying [http.Client] invokes the wrapping [http.RoundTripper] once
+// per hop. This closes the redirect-based SSRF bypass that affects raw
+// [http.Client] usage when no CheckRedirect is set.
+//
+// The default posture is permissive; callers pass [WithDenyPrivateIPs]
+// or [WithDenyPublicIPs] to opt into IP-class rejection.
+func NewOutboundHttpClient(timeout time.Duration, allowList, denyList []*regexp2.Regexp, opts ...DecideOption) *http.Client {
+	base := http.DefaultTransport.(*http.Transport).Clone()
+	base.DialContext = secureDialContext
+	return &http.Client{
+		Timeout: timeout,
+		Transport: &outboundRoundTripper{
+			base:      base,
+			allowList: allowList,
+			denyList:  denyList,
+			opts:      opts,
+		},
+	}
+}
+
+// secureDialContext consumes the [OutboundDecision] stashed in ctx by
+// [outboundRoundTripper]. When the decision is to bypass (allow-list
+// match), it dials directly. When the decision contains pinned IPs, it
+// dials each in turn until one connects. When no decision is present
+// (the dialer was used outside of [outboundRoundTripper]), it falls back
+// to resolving the destination without IP-class checks so that the
+// fallback matches the permissive default and operators who need
+// restrictions configure them at the caller.
+func secureDialContext(ctx context.Context, network, addr string) (net.Conn, error) {
+	host, port, err := net.SplitHostPort(addr)
+	if err != nil {
+		return nil, fmt.Errorf("split host:port %q: %w", addr, err)
+	}
+
+	if decision, ok := ctx.Value(outboundDecisionKey{}).(OutboundDecision); ok {
+		if decision.Bypass {
+			return outboundDialer.DialContext(ctx, network, addr)
+		}
+		if len(decision.Pinned) > 0 {
+			return DialPinned(ctx, network, decision.Pinned, port)
+		}
+	}
+
+	addrs, err := resolveHost(ctx, host, false, false)
+	if err != nil {
+		return nil, err
+	}
+	return DialPinned(ctx, network, addrs, port)
+}
+
+// DialPinned dials each addr in turn until one connects, returning the
+// first successful connection or the last error. Callers pass the Pinned
+// slice from [OutboundDecision] so that the dial targets exactly the IPs
+// that [DecideOutbound] resolved, preventing DNS rebinding between
+// validation and connect.
+func DialPinned(ctx context.Context, network string, addrs []netip.Addr, port string) (net.Conn, error) {
+	var lastErr error
+	for _, a := range addrs {
+		conn, err := outboundDialer.DialContext(ctx, network, net.JoinHostPort(a.String(), port))
+		if err == nil {
+			return conn, nil
+		}
+		lastErr = err
+	}
+	if lastErr == nil {
+		return nil, errors.New("no addresses to dial")
+	}
+	return nil, lastErr
+}

pkg/gotenberg/outbound_test.go

@@ -0,0 +1,457 @@
+package gotenberg
+
+import (
+	"context"
+	"errors"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/dlclark/regexp2"
+)
+
+func TestIsPublicIP(t *testing.T) {
+	for _, tc := range []struct {
+		addr   string
+		public bool
+	}{
+		// Public.
+		{"1.1.1.1", true},
+		{"8.8.8.8", true},
+		{"2606:4700:4700::1111", true},
+
+		// Loopback.
+		{"127.0.0.1", false},
+		{"127.255.255.254", false},
+		{"::1", false},
+
+		// IPv4-mapped IPv6 (Issue 2).
+		{"::ffff:127.0.0.1", false},
+		{"::ffff:10.0.0.1", false},
+		{"::ffff:169.254.169.254", false},
+
+		// RFC1918.
+		{"10.0.0.1", false},
+		{"172.16.0.1", false},
+		{"172.31.255.254", false},
+		{"192.168.1.1", false},
+
+		// Link-local.
+		{"169.254.169.254", false},
+		{"fe80::1", false},
+
+		// Unique-local.
+		{"fc00::1", false},
+		{"fd12:3456:789a::1", false},
+
+		// Unspecified.
+		{"0.0.0.0", false},
+		{"::", false},
+
+		// Multicast.
+		{"224.0.0.1", false},
+		{"ff02::1", false},
+	} {
+		t.Run(tc.addr, func(t *testing.T) {
+			addr, err := netip.ParseAddr(tc.addr)
+			if err != nil {
+				t.Fatalf("parse %q: %v", tc.addr, err)
+			}
+			if got := IsPublicIP(addr); got != tc.public {
+				t.Fatalf("IsPublicIP(%q) = %v, want %v", tc.addr, got, tc.public)
+			}
+		})
+	}
+}
+
+// stubResolver lets tests fake DNS lookups in [ResolveAndCheckPublic].
+type stubResolver struct {
+	lookup func(host string) ([]netip.Addr, error)
+}
+
+func (s stubResolver) LookupNetIP(_ context.Context, _, host string) ([]netip.Addr, error) {
+	return s.lookup(host)
+}
+
+func withStubResolver(t *testing.T, fn func(host string) ([]netip.Addr, error)) {
+	t.Helper()
+	prev := outboundResolver
+	outboundResolver = stubResolver{lookup: fn}
+	t.Cleanup(func() { outboundResolver = prev })
+}
+
+func mustAddrs(t *testing.T, ss ...string) []netip.Addr {
+	t.Helper()
+	out := make([]netip.Addr, 0, len(ss))
+	for _, s := range ss {
+		a, err := netip.ParseAddr(s)
+		if err != nil {
+			t.Fatalf("parse %q: %v", s, err)
+		}
+		out = append(out, a)
+	}
+	return out
+}
+
+func TestFilterOutboundURL(t *testing.T) {
+	defaultDeny := []*regexp2.Regexp{
+		regexp2.MustCompile(`^https?://(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.|0\.0\.0\.0|127\.|localhost|\[::1\]|\[fd)`, 0),
+	}
+	chromiumDeny := []*regexp2.Regexp{
+		regexp2.MustCompile(`^file:(?!//\/tmp/).*`, 0),
+	}
+
+	for _, tc := range []struct {
+		scenario     string
+		rawURL       string
+		allow        []*regexp2.Regexp
+		deny         []*regexp2.Regexp
+		opts         []DecideOption
+		stub         func(host string) ([]netip.Addr, error)
+		expectErr    bool
+		expectIs     error
+		expectErrMsg string
+	}{
+		{
+			scenario:  "public IP literal passes",
+			rawURL:    "https://1.1.1.1/",
+			deny:      defaultDeny,
+			expectErr: false,
+		},
+		{
+			scenario:  "loopback IP literal blocked by default deny-list",
+			rawURL:    "http://127.0.0.1:8080/",
+			deny:      defaultDeny,
+			expectErr: true,
+			expectIs:  ErrFiltered,
+		},
+		{
+			scenario:  "Issue 4: uppercase scheme normalized then blocked by deny-list",
+			rawURL:    "HTTP://127.0.0.1:8080/",
+			deny:      defaultDeny,
+			expectErr: true,
+			expectIs:  ErrFiltered,
+		},
+		{
+			scenario:  "Issue 2: IPv4-mapped IPv6 evades deny-list but blocked by IP check",
+			rawURL:    "http://[::ffff:127.0.0.1]:8080/page.pdf",
+			deny:      defaultDeny,
+			opts:      []DecideOption{WithDenyPrivateIPs(true)},
+			expectErr: true,
+			expectIs:  ErrFiltered,
+		},
+		{
+			scenario:  "Issue 2: IPv4-mapped IPv6 to RFC1918 blocked by IP check",
+			rawURL:    "http://[::ffff:10.0.0.1]/",
+			deny:      defaultDeny,
+			opts:      []DecideOption{WithDenyPrivateIPs(true)},
+			expectErr: true,
+			expectIs:  ErrFiltered,
+		},
+		{
+			scenario:  "hostname resolving to public IP passes with deny-private-ips",
+			rawURL:    "https://example.com/",
+			deny:      defaultDeny,
+			opts:      []DecideOption{WithDenyPrivateIPs(true)},
+			stub:      func(string) ([]netip.Addr, error) { return mustAddrs(t, "93.184.216.34"), nil },
+			expectErr: false,
+		},
+		{
+			scenario:  "hostname resolving to loopback blocked with deny-private-ips",
+			rawURL:    "https://rebind.example/",
+			deny:      defaultDeny,
+			opts:      []DecideOption{WithDenyPrivateIPs(true)},
+			stub:      func(string) ([]netip.Addr, error) { return mustAddrs(t, "127.0.0.1"), nil },
+			expectErr: true,
+			expectIs:  ErrFiltered,
+		},
+		{
+			scenario:  "hostname resolving to mixed public+private blocked with deny-private-ips",
+			rawURL:    "https://mixed.example/",
+			deny:      defaultDeny,
+			opts:      []DecideOption{WithDenyPrivateIPs(true)},
+			stub:      func(string) ([]netip.Addr, error) { return mustAddrs(t, "1.1.1.1", "10.0.0.1"), nil },
+			expectErr: true,
+			expectIs:  ErrFiltered,
+		},
+		{
+			scenario:  "allow-list match bypasses IP check",
+			rawURL:    "http://internal.service/api",
+			allow:     []*regexp2.Regexp{regexp2.MustCompile(`^http://internal\.service`, 0)},
+			deny:      defaultDeny,
+			opts:      []DecideOption{WithDenyPrivateIPs(true)},
+			expectErr: false,
+		},
+		{
+			scenario:  "deny-list still wins over allow-list match",
+			rawURL:    "http://internal.service/api",
+			allow:     []*regexp2.Regexp{regexp2.MustCompile(`^http://internal`, 0)},
+			deny:      []*regexp2.Regexp{regexp2.MustCompile(`/api$`, 0)},
+			expectErr: true,
+			expectIs:  ErrFiltered,
+		},
+		{
+			scenario:  "allow-list non-empty and no match rejects",
+			rawURL:    "https://other.example/",
+			allow:     []*regexp2.Regexp{regexp2.MustCompile(`^https://allowed\.example`, 0)},
+			expectErr: true,
+			expectIs:  ErrFiltered,
+		},
+		{
+			scenario:  "file:// allowed under tmp passes Chromium default",
+			rawURL:    "file:///tmp/index.html",
+			deny:      chromiumDeny,
+			expectErr: false,
+		},
+		{
+			scenario:  "file:// outside tmp blocked by Chromium default",
+			rawURL:    "file:///etc/passwd",
+			deny:      chromiumDeny,
+			expectErr: true,
+			expectIs:  ErrFiltered,
+		},
+		{
+			scenario:  "Chromium default permissive passes http to public host",
+			rawURL:    "https://example.com/",
+			deny:      chromiumDeny,
+			stub:      func(string) ([]netip.Addr, error) { return mustAddrs(t, "93.184.216.34"), nil },
+			expectErr: false,
+		},
+		{
+			scenario:  "Chromium with deny-private-ips blocks http to loopback",
+			rawURL:    "http://127.0.0.1:3000/health",
+			deny:      chromiumDeny,
+			opts:      []DecideOption{WithDenyPrivateIPs(true)},
+			expectErr: true,
+			expectIs:  ErrFiltered,
+		},
+		{
+			scenario:  "Chromium with deny-private-ips blocks cloud metadata",
+			rawURL:    "http://169.254.169.254/latest/meta-data/",
+			deny:      chromiumDeny,
+			opts:      []DecideOption{WithDenyPrivateIPs(true)},
+			expectErr: true,
+			expectIs:  ErrFiltered,
+		},
+		{
+			scenario:  "data: URL passes (non-network scheme)",
+			rawURL:    "data:text/html;base64,PGgxPmhpPC9oMT4=",
+			expectErr: false,
+		},
+		{
+			scenario:  "URL with no host rejected",
+			rawURL:    "http:///path",
+			expectErr: true,
+			expectIs:  ErrFiltered,
+		},
+		{
+			scenario:  "userinfo cannot mask host when deny-private-ips enabled",
+			rawURL:    "http://example.com@127.0.0.1/",
+			deny:      defaultDeny,
+			opts:      []DecideOption{WithDenyPrivateIPs(true)},
+			expectErr: true,
+			expectIs:  ErrFiltered,
+		},
+	} {
+		t.Run(tc.scenario, func(t *testing.T) {
+			if tc.stub != nil {
+				withStubResolver(t, tc.stub)
+			} else {
+				// Default: any DNS lookup in a non-stubbed test is a bug.
+				withStubResolver(t, func(host string) ([]netip.Addr, error) {
+					t.Fatalf("unexpected DNS lookup for %q", host)
+					return nil, nil
+				})
+			}
+
+			err := FilterOutboundURL(context.Background(), tc.rawURL, tc.allow, tc.deny, time.Now().Add(5*time.Second), tc.opts...)
+
+			if tc.expectErr && err == nil {
+				t.Fatalf("expected error, got nil")
+			}
+			if !tc.expectErr && err != nil {
+				t.Fatalf("expected no error, got: %v", err)
+			}
+			if tc.expectIs != nil && !errors.Is(err, tc.expectIs) {
+				t.Fatalf("expected error to wrap %v, got: %v", tc.expectIs, err)
+			}
+		})
+	}
+}
+
+func TestResolveAndCheckPublic_IPLiteralLoopback(t *testing.T) {
+	withStubResolver(t, func(host string) ([]netip.Addr, error) {
+		t.Fatalf("unexpected DNS lookup for %q", host)
+		return nil, nil
+	})
+
+	_, err := ResolveAndCheckPublic(context.Background(), "127.0.0.1")
+	if !errors.Is(err, ErrNonPublicIP) {
+		t.Fatalf("expected ErrNonPublicIP, got: %v", err)
+	}
+}
+
+func TestResolveAndCheckPublic_HostResolvesToLoopback(t *testing.T) {
+	withStubResolver(t, func(host string) ([]netip.Addr, error) {
+		return mustAddrs(t, "127.0.0.1"), nil
+	})
+
+	_, err := ResolveAndCheckPublic(context.Background(), "rebind.example")
+	if !errors.Is(err, ErrNonPublicIP) {
+		t.Fatalf("expected ErrNonPublicIP, got: %v", err)
+	}
+}
+
+func TestResolveAndCheckPublic_HostResolvesToPublic(t *testing.T) {
+	withStubResolver(t, func(host string) ([]netip.Addr, error) {
+		return mustAddrs(t, "1.1.1.1"), nil
+	})
+
+	addrs, err := ResolveAndCheckPublic(context.Background(), "example.com")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(addrs) != 1 || addrs[0].String() != "1.1.1.1" {
+		t.Fatalf("expected [1.1.1.1], got: %v", addrs)
+	}
+}
+
+func TestDecideOutbound_DenyPrivateIPs_RejectsLoopbackLiteral(t *testing.T) {
+	withStubResolver(t, func(host string) ([]netip.Addr, error) {
+		t.Fatalf("unexpected DNS lookup for %q", host)
+		return nil, nil
+	})
+
+	_, err := DecideOutbound(
+		context.Background(),
+		"http://127.0.0.1:8080/",
+		nil, nil,
+		time.Now().Add(5*time.Second),
+		WithDenyPrivateIPs(true),
+	)
+	if !errors.Is(err, ErrFiltered) {
+		t.Fatalf("WithDenyPrivateIPs(true) must reject loopback literal, got: %v", err)
+	}
+}
+
+func TestDecideOutbound_DenyPrivateIPs_AllowsPublic(t *testing.T) {
+	withStubResolver(t, func(host string) ([]netip.Addr, error) {
+		return mustAddrs(t, "93.184.216.34"), nil
+	})
+
+	decision, err := DecideOutbound(
+		context.Background(),
+		"http://example.com/",
+		nil, nil,
+		time.Now().Add(5*time.Second),
+		WithDenyPrivateIPs(true),
+	)
+	if err != nil {
+		t.Fatalf("expected no error for public host, got: %v", err)
+	}
+	if len(decision.Pinned) != 1 || decision.Pinned[0].String() != "93.184.216.34" {
+		t.Fatalf("decision.Pinned = %v, want [93.184.216.34]", decision.Pinned)
+	}
+}
+
+func TestDecideOutbound_DenyPublicIPs_RejectsPublic(t *testing.T) {
+	withStubResolver(t, func(host string) ([]netip.Addr, error) {
+		return mustAddrs(t, "1.1.1.1"), nil
+	})
+
+	_, err := DecideOutbound(
+		context.Background(),
+		"http://example.com/",
+		nil, nil,
+		time.Now().Add(5*time.Second),
+		WithDenyPublicIPs(true),
+	)
+	if !errors.Is(err, ErrFiltered) {
+		t.Fatalf("WithDenyPublicIPs(true) must reject public host, got: %v", err)
+	}
+}
+
+func TestDecideOutbound_DenyPublicIPs_AllowsPrivate(t *testing.T) {
+	withStubResolver(t, func(host string) ([]netip.Addr, error) {
+		return mustAddrs(t, "10.0.0.5"), nil
+	})
+
+	decision, err := DecideOutbound(
+		context.Background(),
+		"http://internal.svc/",
+		nil, nil,
+		time.Now().Add(5*time.Second),
+		WithDenyPublicIPs(true),
+	)
+	if err != nil {
+		t.Fatalf("expected no error for private host, got: %v", err)
+	}
+	if len(decision.Pinned) != 1 || decision.Pinned[0].String() != "10.0.0.5" {
+		t.Fatalf("decision.Pinned = %v, want [10.0.0.5]", decision.Pinned)
+	}
+}
+
+func TestDecideOutbound_DenyBoth_WhitelistOnly(t *testing.T) {
+	withStubResolver(t, func(host string) ([]netip.Addr, error) {
+		return mustAddrs(t, "1.1.1.1"), nil
+	})
+
+	// Both denies active and no allow-list match: every resolved address
+	// fails. Only an allow-list match can permit a destination under
+	// this posture.
+	_, err := DecideOutbound(
+		context.Background(),
+		"http://example.com/",
+		nil, nil,
+		time.Now().Add(5*time.Second),
+		WithDenyPrivateIPs(true),
+		WithDenyPublicIPs(true),
+	)
+	if !errors.Is(err, ErrFiltered) {
+		t.Fatalf("expected ErrFiltered with both denies enabled, got: %v", err)
+	}
+}
+
+func TestDecideOutbound_DenyLists_WinOverDenyPrivateIPs(t *testing.T) {
+	withStubResolver(t, func(host string) ([]netip.Addr, error) {
+		t.Fatalf("unexpected DNS lookup for %q", host)
+		return nil, nil
+	})
+
+	// The regex deny-list fires before any resolution; verifies that
+	// operator-supplied deny patterns remain effective regardless of
+	// IP-class options.
+	deny := []*regexp2.Regexp{regexp2.MustCompile(`^http://evil\.`, 0)}
+
+	_, err := DecideOutbound(
+		context.Background(),
+		"http://evil.local/",
+		nil, deny,
+		time.Now().Add(5*time.Second),
+		WithDenyPrivateIPs(true),
+	)
+	if !errors.Is(err, ErrFiltered) {
+		t.Fatalf("deny-list must still reject, got: %v", err)
+	}
+}
+
+func TestDecideOutbound_Permissive_AllowsPrivate(t *testing.T) {
+	withStubResolver(t, func(host string) ([]netip.Addr, error) {
+		return mustAddrs(t, "10.0.0.5"), nil
+	})
+
+	// No options passed: default posture is permissive across both
+	// IP classes. The caller still gets pinned IPs for dial safety.
+	decision, err := DecideOutbound(
+		context.Background(),
+		"http://internal.svc/",
+		nil, nil,
+		time.Now().Add(5*time.Second),
+	)
+	if err != nil {
+		t.Fatalf("permissive default must allow private host, got: %v", err)
+	}
+	if len(decision.Pinned) != 1 || decision.Pinned[0].String() != "10.0.0.5" {
+		t.Fatalf("decision.Pinned = %v, want [10.0.0.5]", decision.Pinned)
+	}
+}

pkg/gotenberg/pdfengine.go

@@ -201,6 +201,12 @@ type PdfEngine interface {
 	// TODO: attachments instead? Rename the route?
 	EmbedFiles(ctx context.Context, logger *slog.Logger, filePaths []string, inputPath string) error
 
+	// EmbedFilesMetadata sets metadata (such as MIME type and AFRelationship)
+	// on already-embedded files in a PDF. The metadata map is keyed by
+	// filename, with each value being a map of property names to values
+	// (e.g., "mimeType" and "relationship").
+	EmbedFilesMetadata(ctx context.Context, logger *slog.Logger, metadata map[string]map[string]string, inputPath string) error
+
 	// Watermark applies a watermark (behind page content) to a PDF file.
 	Watermark(ctx context.Context, logger *slog.Logger, inputPath string, stamp Stamp) error
 

pkg/gotenberg/supervisor.go

@@ -86,12 +86,13 @@ type processSupervisor struct {
 	maxConcurrency int64
 	semaphore      chan struct{}
 	firstStart     atomic.Bool
-	firstStartOnce sync.Once
-	// firstStartErr stores the error from the first Launch attempt executed
-	// via firstStartOnce. Subsequent callers that enter the !firstStart block
-	// need to observe this value after the Once has completed, without
-	// re-executing the closure.
-	firstStartErr       error
+	// firstStartMu serializes lazy-launch attempts so concurrent callers do
+	// not all spawn Launch() simultaneously. Using a mutex (instead of
+	// sync.Once) lets a failed launch be retried by the next caller, since a
+	// transient failure (such as a cold-start timeout) must not poison the
+	// supervisor for the rest of the container's lifetime. See
+	// https://github.com/gotenberg/gotenberg/issues/1538.
+	firstStartMu        sync.Mutex
 	reqCounter          atomic.Int64
 	reqQueueSize        atomic.Int64
 	restartsCounter     atomic.Int64
@@ -346,8 +347,6 @@ func (s *processSupervisor) maybeIdleShutdown() {
 
 	// Reset state so ensureStarted() re-launches on next request.
 	s.firstStart.Store(false)
-	s.firstStartOnce = sync.Once{}
-	s.firstStartErr = nil
 	s.reqCounter.Store(0)
 
 	s.logger.DebugContext(context.Background(), "process stopped due to idle timeout")
@@ -375,21 +374,27 @@ func (s *processSupervisor) acquireSlot(ctx context.Context, logger *slog.Logger
 	}
 }
 
-// ensureStarted performs a one-time lazy launch of the process on its first
-// use. Subsequent calls are no-ops.
+// ensureStarted performs a lazy launch of the process on its first use.
+// Concurrent callers serialize on firstStartMu; once the launch succeeds,
+// subsequent calls short-circuit on the firstStart flag. A failed launch
+// leaves firstStart unset, so the next caller retries the launch.
 func (s *processSupervisor) ensureStarted(ctx context.Context) error {
 	if s.firstStart.Load() {
 		return nil
 	}
 
-	s.firstStartOnce.Do(func() {
-		s.firstStartErr = s.runWithDeadline(ctx, func() error {
-			return s.Launch()
-		})
-	})
+	s.firstStartMu.Lock()
+	defer s.firstStartMu.Unlock()
 
-	if s.firstStartErr != nil {
-		return fmt.Errorf("process first start: %w", s.firstStartErr)
+	if s.firstStart.Load() {
+		return nil
+	}
+
+	err := s.runWithDeadline(ctx, func() error {
+		return s.Launch()
+	})
+	if err != nil {
+		return fmt.Errorf("process first start: %w", err)
 	}
 
 	return nil

pkg/gotenberg/supervisor_test.go

@@ -898,6 +898,53 @@ func TestProcessSupervisor_IdleShutdown(t *testing.T) {
 	}
 }
 
+func TestProcessSupervisor_RetryAfterFailedFirstStart(t *testing.T) {
+	// Regression test for https://github.com/gotenberg/gotenberg/issues/1538:
+	// a failed first launch must not poison the supervisor; the next request
+	// must retry Launch() instead of returning the cached error forever.
+	logger := slog.New(slog.DiscardHandler)
+
+	var startCalls atomic.Int64
+	process := &ProcessMock{
+		StartMock: func(logger *slog.Logger) error {
+			if startCalls.Add(1) == 1 {
+				return errors.New("first start failed")
+			}
+			return nil
+		},
+		StopMock: func(logger *slog.Logger) error {
+			return nil
+		},
+		HealthyMock: func(logger *slog.Logger) bool {
+			return true
+		},
+	}
+
+	ps := NewProcessSupervisor(logger, process, 0, 0, 1, 0).(*processSupervisor)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	err := ps.Run(ctx, logger, func() error { return nil })
+	if err == nil {
+		t.Fatal("expected first Run to fail because Launch failed")
+	}
+	if ps.firstStart.Load() {
+		t.Fatal("firstStart must remain false after a failed Launch")
+	}
+
+	err = ps.Run(ctx, logger, func() error { return nil })
+	if err != nil {
+		t.Fatalf("expected second Run to succeed after the supervisor retries Launch, got: %v", err)
+	}
+	if !ps.firstStart.Load() {
+		t.Fatal("expected firstStart to be set after the second Launch succeeds")
+	}
+	if got := startCalls.Load(); got != 2 {
+		t.Fatalf("expected exactly 2 Start calls, got %d", got)
+	}
+}
+
 func TestProcessSupervisor_IdleShutdownSkippedWhenActive(t *testing.T) {
 	logger := slog.New(slog.DiscardHandler)
 

pkg/modules/api/api.go

@@ -57,10 +57,12 @@ type Api struct {
 }
 
 type downloadFromConfig struct {
-	allowList []*regexp2.Regexp
-	denyList  []*regexp2.Regexp
-	maxRetry  int
-	disable   bool
+	allowList      []*regexp2.Regexp
+	denyList       []*regexp2.Regexp
+	denyPrivateIPs bool
+	denyPublicIPs  bool
+	maxRetry       int
+	disable        bool
 }
 
 // Router is a module interface that adds routes to the [Api].
@@ -197,6 +199,8 @@ func (a *Api) Descriptor() gotenberg.ModuleDescriptor {
 			fs.Bool("api-enable-basic-auth", false, "Enable basic authentication - will look for the GOTENBERG_API_BASIC_AUTH_USERNAME and GOTENBERG_API_BASIC_AUTH_PASSWORD environment variables")
 			fs.StringSlice("api-download-from-allow-list", []string{}, "Set the allowed URLs for the download from feature using regular expressions - supports multiple values")
 			fs.StringSlice("api-download-from-deny-list", []string{}, "Set the denied URLs for the download from feature using regular expressions - supports multiple values")
+			fs.Bool("api-download-from-deny-private-ips", false, "Reject downloadFrom URLs whose host resolves to a non-public IP address (loopback, RFC1918, link-local, unique-local). Enable on deployments that accept untrusted downloadFrom sources to mitigate SSRF against internal services")
+			fs.Bool("api-download-from-deny-public-ips", false, "Reject downloadFrom URLs whose host resolves to a public IP address. Enable on air-gapped or data-governed deployments to prevent downloads from reaching the public internet")
 			fs.Int("api-download-from-max-retry", 4, "Set the maximum number of retries for the download from feature")
 			fs.Bool("api-disable-download-from", false, "Disable the download from feature")
 			fs.Bool("api-disable-health-check-route-telemetry", true, "Disable telemetry for health check route")
@@ -235,10 +239,12 @@ func (a *Api) Provision(ctx *gotenberg.Context) error {
 	a.rootPath = flags.MustString("api-root-path")
 	a.correlationIdHeader = flags.MustDeprecatedString("api-trace-header", "api-correlation-id-header")
 	a.downloadFromCfg = downloadFromConfig{
-		allowList: flags.MustRegexpSlice("api-download-from-allow-list"),
-		denyList:  flags.MustRegexpSlice("api-download-from-deny-list"),
-		maxRetry:  flags.MustInt("api-download-from-max-retry"),
-		disable:   flags.MustBool("api-disable-download-from"),
+		allowList:      flags.MustRegexpSlice("api-download-from-allow-list"),
+		denyList:       flags.MustRegexpSlice("api-download-from-deny-list"),
+		denyPrivateIPs: flags.MustBool("api-download-from-deny-private-ips"),
+		denyPublicIPs:  flags.MustBool("api-download-from-deny-public-ips"),
+		maxRetry:       flags.MustInt("api-download-from-max-retry"),
+		disable:        flags.MustBool("api-disable-download-from"),
 	}
 	a.disableHealthCheckRouteTelemetry = flags.MustDeprecatedBool("api-disable-health-check-logging", "api-disable-health-check-route-telemetry")
 	a.disableRootRouteTelemetry = flags.MustBool("api-disable-root-route-telemetry")

pkg/modules/api/context.go

@@ -232,7 +232,11 @@ func newContext(echoCtx echo.Context, logger *slog.Logger, fs *gotenberg.FileSys
 					)
 				}
 
-				err := gotenberg.FilterDeadline(downloadFromCfg.allowList, downloadFromCfg.denyList, dl.Url, deadline)
+				ipOpts := []gotenberg.DecideOption{
+					gotenberg.WithDenyPrivateIPs(downloadFromCfg.denyPrivateIPs),
+					gotenberg.WithDenyPublicIPs(downloadFromCfg.denyPublicIPs),
+				}
+				err := gotenberg.FilterOutboundURL(ctx, dl.Url, downloadFromCfg.allowList, downloadFromCfg.denyList, deadline, ipOpts...)
 				if err != nil {
 					return fmt.Errorf("filter URL: %w", err)
 				}
@@ -268,9 +272,7 @@ func newContext(echoCtx echo.Context, logger *slog.Logger, fs *gotenberg.FileSys
 				}
 
 				client := &retryablehttp.Client{
-					HTTPClient: &http.Client{
-						Timeout: time.Until(deadline),
-					},
+					HTTPClient:   gotenberg.NewOutboundHttpClient(time.Until(deadline), downloadFromCfg.allowList, downloadFromCfg.denyList, ipOpts...),
 					RetryMax:     downloadFromCfg.maxRetry,
 					RetryWaitMin: time.Duration(1) * time.Second,
 					RetryWaitMax: time.Until(deadline),

pkg/modules/api/formdata.go

@@ -1,6 +1,7 @@
 package api
 
 import (
+	"encoding/json"
 	"errors"
 	"fmt"
 	"math"
@@ -391,6 +392,38 @@ func (form *FormData) Embeds(target *[]string) *FormData {
 	return form
 }
 
+// EmbedsMetadata parses the "embedsMetadata" form field (a JSON string) into
+// a map keyed by filename. Each value is a map of property names to values
+// (e.g., "mimeType" and "relationship").
+//
+//	var metadata map[string]map[string]string
+//
+//	ctx.FormData().EmbedsMetadata(&metadata)
+func (form *FormData) EmbedsMetadata(target *map[string]map[string]string) *FormData {
+	if form.errors != nil {
+		return form
+	}
+
+	val, ok := form.values["embedsMetadata"]
+	if !ok || len(val) == 0 || val[0] == "" {
+		return form
+	}
+
+	raw := val[0]
+	parsed := make(map[string]map[string]string)
+
+	err := json.Unmarshal([]byte(raw), &parsed)
+	if err != nil {
+		form.append(
+			fmt.Errorf("form field 'embedsMetadata' is invalid: %w", err),
+		)
+		return form
+	}
+
+	*target = parsed
+	return form
+}
+
 // MandatoryPaths binds the absolute paths of form data files, according to a
 // list of file extensions, to a string slice variable. It populates an error
 // if there is no file for given file extensions.

pkg/modules/api/middlewares.go

@@ -337,7 +337,10 @@ func basicAuthMiddleware(username, password string) echo.MiddlewareFunc {
 func contextMiddleware(fs *gotenberg.FileSystem, timeout time.Duration, bodyLimit int64, downloadFromCfg downloadFromConfig) echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
-			logger := c.Get("logger").(*slog.Logger)
+			logger, _ := c.Get("logger").(*slog.Logger)
+			if logger == nil {
+				return errors.New("no logger in context (possible pool reuse)")
+			}
 
 			// We create a context with a timeout so that underlying processes are
 			// able to stop early and correctly handle a timeout scenario.
@@ -395,7 +398,14 @@ func contextMiddleware(fs *gotenberg.FileSystem, timeout time.Duration, bodyLimi
 func hardTimeoutMiddleware(hardTimeout time.Duration) echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
-			logger := c.Get("logger").(*slog.Logger)
+			// Guard the type assertion so a pooled [echo.Context] whose
+			// store has been recycled under us does not crash the process.
+			// See the webhook async handler for the race this protects
+			// against.
+			logger, _ := c.Get("logger").(*slog.Logger)
+			if logger == nil {
+				return errors.New("no logger in context (possible pool reuse)")
+			}
 
 			// Define a hard timeout if the route handler fails to timeout as
 			// expected.

pkg/modules/api/middlewares_test.go

@@ -0,0 +1,39 @@
+package api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/labstack/echo/v4"
+)
+
+func TestHardTimeoutMiddleware_MissingLoggerReturnsErrorInsteadOfPanicking(t *testing.T) {
+	mw := hardTimeoutMiddleware(100 * time.Millisecond)
+	handler := mw(func(c echo.Context) error { return nil })
+
+	e := echo.New()
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+
+	// c has no "logger" key, mimicking a pooled context whose store was
+	// recycled under a concurrently running webhook goroutine. The
+	// middleware must surface an error instead of panicking on the
+	// unchecked type assertion the pre-fix code relied on.
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("hardTimeoutMiddleware panicked: %v", r)
+		}
+	}()
+
+	err := handler(c)
+	if err == nil {
+		t.Fatal("expected an error for missing logger, got nil")
+	}
+	if !strings.Contains(err.Error(), "logger") {
+		t.Fatalf("error = %q, want a message mentioning logger", err)
+	}
+}

pkg/modules/chromium/browser.go

@@ -44,6 +44,8 @@ type browserArguments struct {
 	// Tasks specific.
 	allowList         []*regexp2.Regexp
 	denyList          []*regexp2.Regexp
+	denyPrivateIPs    bool
+	denyPublicIPs     bool
 	clearCache        bool
 	clearCookies      bool
 	disableJavaScript bool
@@ -57,15 +59,17 @@ type chromiumBrowser struct {
 	ctxMu              sync.RWMutex
 	isStarted          atomic.Bool
 
-	arguments browserArguments
-	fs        *gotenberg.FileSystem
+	arguments    browserArguments
+	fs           *gotenberg.FileSystem
+	pinningProxy *pinningProxy
 }
 
 func newChromiumBrowser(arguments browserArguments) browser {
 	b := &chromiumBrowser{
-		initialCtx: context.Background(),
-		arguments:  arguments,
-		fs:         gotenberg.NewFileSystem(new(gotenberg.OsMkdirAll)),
+		initialCtx:   context.Background(),
+		arguments:    arguments,
+		fs:           gotenberg.NewFileSystem(new(gotenberg.OsMkdirAll)),
+		pinningProxy: newPinningProxy(arguments.allowList, arguments.denyList, arguments.denyPrivateIPs, arguments.denyPublicIPs),
 	}
 	b.isStarted.Store(false)
 
@@ -136,6 +140,25 @@ func (b *chromiumBrowser) Start(logger *slog.Logger) error {
 		opts = append(opts, chromedp.ProxyServer(b.arguments.proxyServer))
 	}
 
+	// Default: route Chromium through the internal pinning proxy so that
+	// Chromium never performs its own DNS lookup for the navigation URL
+	// or any sub-resource. The proxy resolves and validates each URL
+	// once per request and dials the pinned IP, closing the DNS
+	// rebinding window between Gotenberg's validation and Chromium's
+	// connect.
+	//
+	// Skip when the operator has configured their own egress proxy or
+	// custom host-resolver mappings: those deployments take
+	// responsibility for outbound safety themselves and routing through
+	// an internal proxy would override their configuration.
+	if b.arguments.proxyServer == "" && b.arguments.hostResolverRules == "" {
+		err = b.pinningProxy.Start(logger)
+		if err != nil {
+			return fmt.Errorf("start pinning proxy: %w", err)
+		}
+		opts = append(opts, chromedp.ProxyServer(b.pinningProxy.URL()))
+	}
+
 	// See https://github.com/gotenberg/gotenberg/issues/524.
 	opts = append(opts, chromedp.WSURLReadTimeout(b.arguments.wsUrlReadTimeout))
 
@@ -236,6 +259,15 @@ func (b *chromiumBrowser) Stop(logger *slog.Logger) error {
 	b.userProfileDirPath = ""
 	b.isStarted.Store(false)
 
+	// Stop the pinning proxy after Chromium shutdown so that any
+	// in-flight requests Chromium issues during teardown complete. The
+	// Stop call is a no-op when the proxy was not started (operator
+	// configured --chromium-proxy-server or --chromium-host-resolver-rules).
+	err := b.pinningProxy.Stop(logger)
+	if err != nil {
+		logger.ErrorContext(context.Background(), fmt.Sprintf("stop pinning proxy: %s", err))
+	}
+
 	return nil
 }
 
@@ -336,8 +368,12 @@ func (b *chromiumBrowser) do(ctx context.Context, logger *slog.Logger, url strin
 		return errors.New("context has no deadline")
 	}
 
-	// We validate the "main" URL against our allowed / deny lists.
-	err := gotenberg.FilterDeadline(b.arguments.allowList, b.arguments.denyList, url, deadline)
+	// We validate the "main" URL against our allowed / deny lists, and
+	// against the IP-based outbound URL guard. See [gotenberg.FilterOutboundURL].
+	err := gotenberg.FilterOutboundURL(ctx, url, b.arguments.allowList, b.arguments.denyList, deadline,
+		gotenberg.WithDenyPrivateIPs(b.arguments.denyPrivateIPs),
+		gotenberg.WithDenyPublicIPs(b.arguments.denyPublicIPs),
+	)
 	if err != nil {
 		return fmt.Errorf("filter URL: %w", err)
 	}
@@ -358,6 +394,8 @@ func (b *chromiumBrowser) do(ctx context.Context, logger *slog.Logger, url strin
 	listenForEventRequestPaused(taskCtx, logger, eventRequestPausedOptions{
 		allowList:           b.arguments.allowList,
 		denyList:            b.arguments.denyList,
+		denyPrivateIPs:      b.arguments.denyPrivateIPs,
+		denyPublicIPs:       b.arguments.denyPublicIPs,
 		allowedFilePrefixes: options.AllowedFilePrefixes,
 		extraHttpHeaders:    options.ExtraHttpHeaders,
 	})

pkg/modules/chromium/chromium.go

@@ -189,10 +189,13 @@ type Options struct {
 	// PDFs with transparency.
 	OmitBackground bool
 
-	// AllowedFilePrefixes restricts file:// sub-resource access to only these
-	// directory prefixes. Applied in listenForEventRequestPaused in addition
-	// to the global allow/deny lists. Set internally by route handlers, not
-	// via form data.
+	// AllowedFilePrefixes restricts file:// sub-resource access to only
+	// these directory prefixes. Applied in listenForEventRequestPaused in
+	// addition to the global allow/deny lists. An empty slice
+	// default-denies every file:// sub-resource, so routes that legitimately
+	// render local files (HTML, Markdown) must populate this with the
+	// request working directory while routes that navigate remote URLs
+	// leave it empty. Set internally by route handlers, not via form data.
 	AllowedFilePrefixes []string
 }
 
@@ -447,6 +450,8 @@ func (mod *Chromium) Descriptor() gotenberg.ModuleDescriptor {
 			fs.String("chromium-proxy-server", "", "Set the outbound proxy server; this switch only affects HTTP and HTTPS requests")
 			fs.StringSlice("chromium-allow-list", []string{}, "Set the allowed URLs for Chromium using regular expressions - supports multiple values")
 			fs.StringSlice("chromium-deny-list", []string{`^file:(?!//\/tmp/).*`}, "Set the denied URLs for Chromium using regular expressions - supports multiple values")
+			fs.Bool("chromium-deny-private-ips", false, "Reject URLs whose host resolves to a non-public IP address (loopback, RFC1918, link-local, unique-local). Enable on deployments that accept untrusted form input to mitigate SSRF against internal services")
+			fs.Bool("chromium-deny-public-ips", false, "Reject URLs whose host resolves to a public IP address. Enable on air-gapped or data-governed deployments to prevent outbound traffic from leaving a private network")
 			fs.Bool("chromium-clear-cache", false, "Clear Chromium cache between each conversion")
 			fs.Bool("chromium-clear-cookies", false, "Clear Chromium cookies between each conversion")
 			fs.Bool("chromium-disable-javascript", false, "Disable JavaScript")
@@ -495,6 +500,8 @@ func (mod *Chromium) Provision(ctx *gotenberg.Context) error {
 
 		allowList:         flags.MustRegexpSlice("chromium-allow-list"),
 		denyList:          flags.MustRegexpSlice("chromium-deny-list"),
+		denyPrivateIPs:    flags.MustBool("chromium-deny-private-ips"),
+		denyPublicIPs:     flags.MustBool("chromium-deny-public-ips"),
 		clearCache:        flags.MustBool("chromium-clear-cache"),
 		clearCookies:      flags.MustBool("chromium-clear-cookies"),
 		disableJavaScript: flags.MustBool("chromium-disable-javascript"),

pkg/modules/chromium/events.go

@@ -25,6 +25,8 @@ import (
 
 type eventRequestPausedOptions struct {
 	allowList, denyList []*regexp2.Regexp
+	denyPrivateIPs      bool
+	denyPublicIPs       bool
 	allowedFilePrefixes []string
 	extraHttpHeaders    []ExtraHttpHeader
 }
@@ -52,35 +54,42 @@ func listenForEventRequestPaused(ctx context.Context, logger *slog.Logger, optio
 					return
 				}
 
-				err := gotenberg.FilterDeadline(options.allowList, options.denyList, e.Request.URL, deadline)
+				err := gotenberg.FilterOutboundURL(ctx, e.Request.URL, options.allowList, options.denyList, deadline,
+					gotenberg.WithDenyPrivateIPs(options.denyPrivateIPs),
+					gotenberg.WithDenyPublicIPs(options.denyPublicIPs),
+				)
 				if err != nil {
 					logger.WarnContext(ctx, err.Error())
 					allow = false
 				}
 
-				// Additional restriction: if the sub-resource is a file:// URL
-				// and we have allowed file prefixes, restrict access to only
-				// those directories. This prevents cross-request file access
-				// in /tmp.
-				if allow && strings.HasPrefix(e.Request.URL, "file://") && len(options.allowedFilePrefixes) > 0 {
-					prefixMatch := false
-					for _, prefix := range options.allowedFilePrefixes {
-						if strings.HasPrefix(e.Request.URL, "file://"+prefix) {
-							prefixMatch = true
-							break
-						}
-					}
-
-					if !prefixMatch {
-						logger.WarnContext(ctx, fmt.Sprintf("'%s' is not within any allowed file prefix", e.Request.URL))
-						allow = false
-					}
+				// Sub-resource file:// URLs are opt-in per route. A route
+				// that renders local files (HTML, Markdown) populates
+				// allowedFilePrefixes with the request working directory
+				// so its own assets load while sibling requests' /tmp
+				// paths stay out of reach. Every other route leaves the
+				// slice empty; treat that as default-deny so a file://
+				// sub-resource that slips past the deny-list (which
+				// exempts /tmp/) still cannot read the working
+				// directories of other in-flight conversions.
+				if allow && strings.HasPrefix(e.Request.URL, "file://") && !isAllowedFileSubResource(e.Request.URL, options.allowedFilePrefixes) {
+					logger.WarnContext(ctx, fmt.Sprintf("'%s' is not within any allowed file prefix", e.Request.URL))
+					allow = false
 				}
 
 				cctx := chromedp.FromContext(ctx)
 				executorCtx := cdp.WithExecutor(ctx, cctx.Target)
 
 				if !allow {
+					// Use AccessDenied so Chromium emits net::ERR_ACCESS_DENIED,
+					// which is intentionally absent from the EventLoadingFailed
+					// known-errors list. Routing through BlockedByClient would
+					// surface the failure, but the Document-type dispatcher in
+					// listenForEventLoadingFailed cannot distinguish a blocked
+					// iframe (sub-frame Document) from a main-page Document, and
+					// would attribute the iframe failure to the main page.
+					// Filter-block observability is provided by the warn log
+					// above instead.
 					req := fetch.FailRequest(e.RequestID, network.ErrorReasonAccessDenied)
 					err = req.Do(executorCtx)
 					if err != nil {
@@ -240,6 +249,23 @@ func listenForEventResponseReceived(
 	})
 }
 
+// isAllowedFileSubResource reports whether a file:// sub-resource URL is
+// within at least one prefix. An empty prefix list rejects every
+// file:// URL so routes that never populate the list (for example
+// /forms/chromium/convert/url) default-deny reads from /tmp/, blocking
+// cross-request enumeration.
+func isAllowedFileSubResource(rawURL string, allowedFilePrefixes []string) bool {
+	if len(allowedFilePrefixes) == 0 {
+		return false
+	}
+	for _, prefix := range allowedFilePrefixes {
+		if strings.HasPrefix(rawURL, "file://"+prefix) {
+			return true
+		}
+	}
+	return false
+}
+
 func shouldCheckResourceHttpStatusCode(rawURL string, ignoreDomains []string) bool {
 	host := hostnameFromURL(rawURL)
 

pkg/modules/chromium/events_test.go

@@ -61,3 +61,49 @@ func TestShouldCheckResourceHttpStatusCode_NonHTTPURL(t *testing.T) {
 		t.Fatalf("expected data: URL to be checked (no host filtering possible)")
 	}
 }
+
+func TestIsAllowedFileSubResource(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		rawURL   string
+		prefixes []string
+		want     bool
+	}{
+		{
+			name:     "empty prefix list default denies",
+			rawURL:   "file:///tmp/work-uuid/request-uuid/index.html",
+			prefixes: nil,
+			want:     false,
+		},
+		{
+			name:     "match within the sole prefix",
+			rawURL:   "file:///tmp/work-uuid/request-uuid/index.html",
+			prefixes: []string{"/tmp/work-uuid/request-uuid"},
+			want:     true,
+		},
+		{
+			name:     "sibling request directory rejected",
+			rawURL:   "file:///tmp/work-uuid/other-request-uuid/secret.html",
+			prefixes: []string{"/tmp/work-uuid/request-uuid"},
+			want:     false,
+		},
+		{
+			name:     "parent tmp directory rejected",
+			rawURL:   "file:///tmp/",
+			prefixes: []string{"/tmp/work-uuid/request-uuid"},
+			want:     false,
+		},
+		{
+			name:     "match among several prefixes",
+			rawURL:   "file:///tmp/work-uuid/request-b/asset.css",
+			prefixes: []string{"/tmp/work-uuid/request-a", "/tmp/work-uuid/request-b"},
+			want:     true,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := isAllowedFileSubResource(tc.rawURL, tc.prefixes); got != tc.want {
+				t.Fatalf("isAllowedFileSubResource(%q, %v) = %v, want %v", tc.rawURL, tc.prefixes, got, tc.want)
+			}
+		})
+	}
+}

pkg/modules/chromium/pinning_proxy.go

@@ -0,0 +1,328 @@
+package chromium
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/netip"
+	"sync"
+	"time"
+
+	"github.com/dlclark/regexp2"
+
+	"github.com/gotenberg/gotenberg/v8/pkg/gotenberg"
+)
+
+// pinningProxy is a loopback-bound HTTP/1.1 forward and CONNECT proxy
+// placed between Chromium and the outbound network. It runs the same
+// allow/deny/IP-public validation as [gotenberg.FilterOutboundURL] on
+// every request and dials the destination using the IPs resolved at that
+// moment. Routing Chromium through this proxy eliminates the Chromium-side
+// DNS lookup that otherwise opens a DNS rebinding window between
+// Gotenberg's validation and Chromium's TCP connect.
+//
+// The proxy is transparent to the caller. HTTPS sub-resources tunnel
+// through CONNECT with Chromium performing its own TLS handshake using
+// the original hostname, preserving SNI and certificate validation.
+type pinningProxy struct {
+	allowList []*regexp2.Regexp
+	denyList  []*regexp2.Regexp
+
+	// decide resolves and validates a URL. Tests may override it.
+	decide func(ctx context.Context, rawURL string, allowList, denyList []*regexp2.Regexp, deadline time.Time) (gotenberg.OutboundDecision, error)
+
+	// dialPinned dials the pinned IPs for a decision. Tests may override
+	// it to connect to a stub upstream regardless of decision.
+	dialPinned func(ctx context.Context, network string, addrs []netip.Addr, port string) (net.Conn, error)
+
+	// dialBypass dials the destination hostname directly (operator
+	// allow-list opt-in). Tests may override it.
+	dialBypass func(ctx context.Context, network, addr string) (net.Conn, error)
+
+	listener net.Listener
+	server   *http.Server
+	wg       sync.WaitGroup
+
+	logger  *slog.Logger
+	started bool
+	mu      sync.Mutex
+}
+
+// newPinningProxy returns a pinning proxy configured with the given
+// allow/deny lists and IP-class policy. The policy bools are applied via
+// [gotenberg.DecideOutbound] on every request the proxy sees, so
+// Chromium inherits whatever posture the operator selected. The
+// returned proxy is not yet listening; call Start.
+func newPinningProxy(allowList, denyList []*regexp2.Regexp, denyPrivateIPs, denyPublicIPs bool) *pinningProxy {
+	return &pinningProxy{
+		allowList: allowList,
+		denyList:  denyList,
+		decide: func(ctx context.Context, rawURL string, allow, deny []*regexp2.Regexp, deadline time.Time) (gotenberg.OutboundDecision, error) {
+			return gotenberg.DecideOutbound(ctx, rawURL, allow, deny, deadline,
+				gotenberg.WithDenyPrivateIPs(denyPrivateIPs),
+				gotenberg.WithDenyPublicIPs(denyPublicIPs),
+			)
+		},
+		dialPinned: gotenberg.DialPinned,
+		dialBypass: func(ctx context.Context, network, addr string) (net.Conn, error) {
+			dialer := &net.Dialer{Timeout: 10 * time.Second}
+			return dialer.DialContext(ctx, network, addr)
+		},
+	}
+}
+
+// Start binds the proxy to 127.0.0.1 on an ephemeral port and serves in a
+// background goroutine. Bind failures return an error; the caller must
+// not proceed to start Chromium with --proxy-server.
+func (p *pinningProxy) Start(logger *slog.Logger) error {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	if p.started {
+		return errors.New("pinning proxy already started")
+	}
+
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		return fmt.Errorf("bind pinning proxy: %w", err)
+	}
+
+	p.listener = l
+	p.logger = logger.With(slog.String("logger", "pinning-proxy"))
+	p.server = &http.Server{
+		Handler: http.HandlerFunc(p.serveHTTP),
+		// Guard against slow header attacks. Body reads are controlled
+		// per-handler.
+		ReadHeaderTimeout: 15 * time.Second,
+		ErrorLog:          slog.NewLogLogger(p.logger.Handler(), slog.LevelWarn),
+	}
+
+	p.wg.Go(func() {
+		serveErr := p.server.Serve(l)
+		if serveErr != nil && !errors.Is(serveErr, http.ErrServerClosed) {
+			p.logger.ErrorContext(context.Background(), fmt.Sprintf("pinning proxy serve: %s", serveErr))
+		}
+	})
+
+	p.started = true
+	p.logger.DebugContext(context.Background(), fmt.Sprintf("pinning proxy listening on %s", l.Addr()))
+	return nil
+}
+
+// Stop shuts the proxy down and waits for in-flight handlers to complete.
+// Safe to call on a non-started proxy.
+func (p *pinningProxy) Stop(logger *slog.Logger) error {
+	p.mu.Lock()
+	if !p.started {
+		p.mu.Unlock()
+		return nil
+	}
+	srv := p.server
+	p.started = false
+	p.mu.Unlock()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	shutdownErr := srv.Shutdown(ctx)
+	p.wg.Wait()
+
+	if shutdownErr != nil {
+		return fmt.Errorf("shutdown pinning proxy: %w", shutdownErr)
+	}
+	logger.DebugContext(context.Background(), "pinning proxy stopped")
+	return nil
+}
+
+// URL returns the proxy URL suitable for Chromium's --proxy-server flag.
+// Returns an empty string when the proxy is not listening.
+func (p *pinningProxy) URL() string {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if p.listener == nil {
+		return ""
+	}
+	return "http://" + p.listener.Addr().String()
+}
+
+func (p *pinningProxy) serveHTTP(w http.ResponseWriter, req *http.Request) {
+	if req.Method == http.MethodConnect {
+		p.handleConnect(w, req)
+		return
+	}
+	p.handleForward(w, req)
+}
+
+// handleConnect handles HTTPS (and any other CONNECT) tunnels. Chromium
+// issues CONNECT host:port; the proxy validates the host, dials the
+// pinned IP, and splices the client socket with the upstream socket.
+// Chromium then negotiates TLS end-to-end with the original hostname in
+// SNI.
+func (p *pinningProxy) handleConnect(w http.ResponseWriter, req *http.Request) {
+	_, port, err := net.SplitHostPort(req.Host)
+	if err != nil {
+		http.Error(w, "bad CONNECT target", http.StatusBadRequest)
+		return
+	}
+
+	deadline, ok := req.Context().Deadline()
+	if !ok {
+		deadline = time.Now().Add(30 * time.Second)
+	}
+
+	// The validation URL uses https:// so that http-like scheme checks
+	// apply in [gotenberg.DecideOutbound]. The scheme does not influence
+	// the CONNECT handling beyond filtering.
+	decision, err := p.decide(req.Context(), "https://"+req.Host, p.allowList, p.denyList, deadline)
+	if err != nil {
+		p.logger.WarnContext(req.Context(), fmt.Sprintf("CONNECT blocked for '%s': %s", req.Host, err))
+		http.Error(w, "CONNECT blocked", http.StatusForbidden)
+		return
+	}
+
+	var upstream net.Conn
+	switch {
+	case decision.Bypass:
+		upstream, err = p.dialBypass(req.Context(), "tcp", req.Host)
+	case len(decision.Pinned) > 0:
+		upstream, err = p.dialPinned(req.Context(), "tcp", decision.Pinned, port)
+	default:
+		err = errors.New("no pinned addresses and not bypassed")
+	}
+	if err != nil {
+		p.logger.WarnContext(req.Context(), fmt.Sprintf("CONNECT dial failed for '%s': %s", req.Host, err))
+		http.Error(w, "upstream dial failed", http.StatusBadGateway)
+		return
+	}
+	defer upstream.Close()
+
+	hj, ok := w.(http.Hijacker)
+	if !ok {
+		http.Error(w, "hijack unsupported", http.StatusInternalServerError)
+		return
+	}
+	client, _, err := hj.Hijack()
+	if err != nil {
+		p.logger.ErrorContext(req.Context(), fmt.Sprintf("hijack CONNECT: %s", err))
+		return
+	}
+	defer client.Close()
+
+	_, err = client.Write([]byte("HTTP/1.1 200 OK\r\n\r\n"))
+	if err != nil {
+		p.logger.WarnContext(req.Context(), fmt.Sprintf("write CONNECT ack: %s", err))
+		return
+	}
+
+	// Splice bytes in both directions until either side closes.
+	var splice sync.WaitGroup
+	splice.Add(2)
+	go func() {
+		defer splice.Done()
+		_, _ = io.Copy(upstream, client)
+		if cw, ok := upstream.(interface{ CloseWrite() error }); ok {
+			_ = cw.CloseWrite()
+		}
+	}()
+	go func() {
+		defer splice.Done()
+		_, _ = io.Copy(client, upstream)
+		if cw, ok := client.(interface{ CloseWrite() error }); ok {
+			_ = cw.CloseWrite()
+		}
+	}()
+	splice.Wait()
+}
+
+// handleForward handles plain HTTP requests sent to the proxy as absolute
+// URIs (GET http://host/path). The proxy revalidates the URL, then
+// forwards the request via a transport that dials the pinned IP.
+func (p *pinningProxy) handleForward(w http.ResponseWriter, req *http.Request) {
+	if req.URL == nil || req.URL.Scheme == "" || req.URL.Host == "" {
+		http.Error(w, "absolute URL required", http.StatusBadRequest)
+		return
+	}
+
+	deadline, ok := req.Context().Deadline()
+	if !ok {
+		deadline = time.Now().Add(30 * time.Second)
+	}
+
+	decision, err := p.decide(req.Context(), req.URL.String(), p.allowList, p.denyList, deadline)
+	if err != nil {
+		p.logger.WarnContext(req.Context(), fmt.Sprintf("forward blocked for '%s': %s", req.URL, err))
+		http.Error(w, "request blocked", http.StatusForbidden)
+		return
+	}
+
+	outReq := req.Clone(req.Context())
+	outReq.RequestURI = ""
+	stripHopByHopHeaders(outReq.Header)
+
+	transport := &http.Transport{
+		// Build a fresh transport per request. The decision contains the
+		// pinned IPs to dial; reusing a transport across requests would
+		// leak the decision's closure across unrelated targets.
+		DisableKeepAlives: true,
+		Proxy:             nil,
+		DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
+			_, port, splitErr := net.SplitHostPort(addr)
+			if splitErr != nil {
+				return nil, fmt.Errorf("split forward addr %q: %w", addr, splitErr)
+			}
+			switch {
+			case decision.Bypass:
+				return p.dialBypass(ctx, network, addr)
+			case len(decision.Pinned) > 0:
+				return p.dialPinned(ctx, network, decision.Pinned, port)
+			default:
+				return nil, errors.New("no pinned addresses and not bypassed")
+			}
+		},
+	}
+	defer transport.CloseIdleConnections()
+
+	resp, err := transport.RoundTrip(outReq)
+	if err != nil {
+		p.logger.WarnContext(req.Context(), fmt.Sprintf("forward RoundTrip failed for '%s': %s", req.URL, err))
+		http.Error(w, "upstream error", http.StatusBadGateway)
+		return
+	}
+	defer resp.Body.Close()
+
+	copyHeaders(w.Header(), resp.Header)
+	stripHopByHopHeaders(w.Header())
+	w.WriteHeader(resp.StatusCode)
+	_, _ = io.Copy(w, resp.Body)
+}
+
+// Per RFC 7230 section 6.1.
+var hopByHopHeaders = []string{
+	"Connection",
+	"Keep-Alive",
+	"Proxy-Authenticate",
+	"Proxy-Authorization",
+	"Proxy-Connection",
+	"Te",
+	"Trailer",
+	"Transfer-Encoding",
+	"Upgrade",
+}
+
+func stripHopByHopHeaders(h http.Header) {
+	for _, name := range hopByHopHeaders {
+		h.Del(name)
+	}
+}
+
+func copyHeaders(dst, src http.Header) {
+	for k, vs := range src {
+		for _, v := range vs {
+			dst.Add(k, v)
+		}
+	}
+}

pkg/modules/chromium/pinning_proxy_test.go

@@ -0,0 +1,485 @@
+package chromium
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"net/url"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/dlclark/regexp2"
+
+	"github.com/gotenberg/gotenberg/v8/pkg/gotenberg"
+)
+
+func testLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+func mustParseURL(t *testing.T, raw string) *url.URL {
+	t.Helper()
+	u, err := url.Parse(raw)
+	if err != nil {
+		t.Fatalf("parse %q: %v", raw, err)
+	}
+	return u
+}
+
+// newRawTCPServer starts a TCP server on 127.0.0.1:0 that calls handle for
+// every accepted connection. It returns the listener address and a cleanup
+// function.
+func newRawTCPServer(t *testing.T, handle func(net.Conn)) (string, func()) {
+	t.Helper()
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+
+	go func() {
+		for {
+			conn, err := l.Accept()
+			if err != nil {
+				return
+			}
+			go handle(conn)
+		}
+	}()
+
+	return l.Addr().String(), func() { _ = l.Close() }
+}
+
+// newProxyForTest returns a pinning proxy whose decide and dial functions
+// are set to test stubs. The proxy is started on a loopback ephemeral
+// port and stopped during test cleanup.
+func newProxyForTest(t *testing.T, p *pinningProxy) string {
+	t.Helper()
+	err := p.Start(testLogger())
+	if err != nil {
+		t.Fatalf("start pinning proxy: %v", err)
+	}
+	t.Cleanup(func() {
+		_ = p.Stop(testLogger())
+	})
+	return p.URL()
+}
+
+func TestPinningProxy_Forward_Pinned_Success(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Host != "example.com" {
+			t.Errorf("upstream expected Host=example.com, got %q", r.Host)
+		}
+		_, _ = fmt.Fprint(w, "hello-from-upstream")
+	}))
+	t.Cleanup(upstream.Close)
+	upstreamURL := mustParseURL(t, upstream.URL)
+
+	var decideCalls atomic.Int32
+	p := newPinningProxy(nil, nil, false, false)
+	p.decide = func(_ context.Context, _ string, _, _ []*regexp2.Regexp, _ time.Time) (gotenberg.OutboundDecision, error) {
+		decideCalls.Add(1)
+		return gotenberg.OutboundDecision{Pinned: []netip.Addr{netip.MustParseAddr("127.0.0.1")}}, nil
+	}
+	p.dialPinned = func(ctx context.Context, network string, _ []netip.Addr, _ string) (net.Conn, error) {
+		return net.Dial(network, upstreamURL.Host)
+	}
+	proxyURL := newProxyForTest(t, p)
+
+	client := &http.Client{
+		Transport: &http.Transport{
+			Proxy: http.ProxyURL(mustParseURL(t, proxyURL)),
+		},
+		Timeout: 5 * time.Second,
+	}
+
+	resp, err := client.Get("http://example.com/")
+	if err != nil {
+		t.Fatalf("GET via proxy: %v", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatalf("read body: %v", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("status = %d, want 200", resp.StatusCode)
+	}
+	if string(body) != "hello-from-upstream" {
+		t.Fatalf("body = %q, want %q", body, "hello-from-upstream")
+	}
+	if got := decideCalls.Load(); got != 1 {
+		t.Fatalf("decide called %d times, want 1", got)
+	}
+}
+
+func TestPinningProxy_Forward_BlockedByDecide(t *testing.T) {
+	p := newPinningProxy(nil, nil, false, false)
+	p.decide = func(_ context.Context, _ string, _, _ []*regexp2.Regexp, _ time.Time) (gotenberg.OutboundDecision, error) {
+		return gotenberg.OutboundDecision{}, fmt.Errorf("nope: %w", gotenberg.ErrFiltered)
+	}
+	p.dialPinned = func(_ context.Context, _ string, _ []netip.Addr, _ string) (net.Conn, error) {
+		t.Fatal("dialPinned must not be called when decide returns an error")
+		return nil, errors.New("unreachable")
+	}
+	proxyURL := newProxyForTest(t, p)
+
+	client := &http.Client{
+		Transport: &http.Transport{
+			Proxy: http.ProxyURL(mustParseURL(t, proxyURL)),
+		},
+		Timeout: 5 * time.Second,
+	}
+
+	resp, err := client.Get("http://blocked.example/")
+	if err != nil {
+		t.Fatalf("GET via proxy: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403", resp.StatusCode)
+	}
+}
+
+func TestPinningProxy_Forward_Bypass(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = fmt.Fprint(w, "bypassed")
+	}))
+	t.Cleanup(upstream.Close)
+	upstreamURL := mustParseURL(t, upstream.URL)
+
+	var bypassCalls atomic.Int32
+	p := newPinningProxy(nil, nil, false, false)
+	p.decide = func(_ context.Context, _ string, _, _ []*regexp2.Regexp, _ time.Time) (gotenberg.OutboundDecision, error) {
+		return gotenberg.OutboundDecision{Bypass: true}, nil
+	}
+	p.dialBypass = func(_ context.Context, network, _ string) (net.Conn, error) {
+		bypassCalls.Add(1)
+		return net.Dial(network, upstreamURL.Host)
+	}
+	p.dialPinned = func(_ context.Context, _ string, _ []netip.Addr, _ string) (net.Conn, error) {
+		t.Fatal("dialPinned must not be called on bypass")
+		return nil, errors.New("unreachable")
+	}
+	proxyURL := newProxyForTest(t, p)
+
+	client := &http.Client{
+		Transport: &http.Transport{
+			Proxy: http.ProxyURL(mustParseURL(t, proxyURL)),
+		},
+		Timeout: 5 * time.Second,
+	}
+
+	resp, err := client.Get("http://internal.example/")
+	if err != nil {
+		t.Fatalf("GET via proxy: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("status = %d, want 200", resp.StatusCode)
+	}
+	if got := bypassCalls.Load(); got != 1 {
+		t.Fatalf("dialBypass called %d times, want 1", got)
+	}
+}
+
+func TestPinningProxy_Forward_StripsHopByHopHeaders(t *testing.T) {
+	var upstreamSawProxyAuth bool
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Proxy-Authorization") != "" {
+			upstreamSawProxyAuth = true
+		}
+		w.Header().Set("Connection", "close")
+		w.Header().Set("Proxy-Connection", "close")
+		w.Header().Set("X-Downstream", "ok")
+		w.WriteHeader(http.StatusOK)
+	}))
+	t.Cleanup(upstream.Close)
+	upstreamURL := mustParseURL(t, upstream.URL)
+
+	p := newPinningProxy(nil, nil, false, false)
+	p.decide = func(_ context.Context, _ string, _, _ []*regexp2.Regexp, _ time.Time) (gotenberg.OutboundDecision, error) {
+		return gotenberg.OutboundDecision{Pinned: []netip.Addr{netip.MustParseAddr("127.0.0.1")}}, nil
+	}
+	p.dialPinned = func(ctx context.Context, network string, _ []netip.Addr, _ string) (net.Conn, error) {
+		return net.Dial(network, upstreamURL.Host)
+	}
+	proxyURL := newProxyForTest(t, p)
+
+	req, err := http.NewRequest(http.MethodGet, "http://example.com/", nil)
+	if err != nil {
+		t.Fatalf("new request: %v", err)
+	}
+	req.Header.Set("Proxy-Authorization", "Basic Zm9vOmJhcg==")
+
+	client := &http.Client{
+		Transport: &http.Transport{
+			Proxy: http.ProxyURL(mustParseURL(t, proxyURL)),
+		},
+		Timeout: 5 * time.Second,
+	}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatalf("GET via proxy: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if upstreamSawProxyAuth {
+		t.Fatalf("upstream received Proxy-Authorization, proxy did not strip it")
+	}
+	if resp.Header.Get("Proxy-Connection") != "" {
+		t.Fatalf("response retained Proxy-Connection, proxy did not strip it")
+	}
+	if resp.Header.Get("X-Downstream") != "ok" {
+		t.Fatalf("response missing X-Downstream header")
+	}
+}
+
+func TestPinningProxy_Forward_RejectsNonAbsoluteURL(t *testing.T) {
+	p := newPinningProxy(nil, nil, false, false)
+	p.decide = func(_ context.Context, _ string, _, _ []*regexp2.Regexp, _ time.Time) (gotenberg.OutboundDecision, error) {
+		t.Fatal("decide must not be called for malformed proxy request")
+		return gotenberg.OutboundDecision{}, nil
+	}
+	proxyURL := newProxyForTest(t, p)
+
+	conn, err := net.Dial("tcp", strings.TrimPrefix(proxyURL, "http://"))
+	if err != nil {
+		t.Fatalf("dial proxy: %v", err)
+	}
+	defer conn.Close()
+
+	// Send a request with a path-only target, not an absolute URI, which
+	// the proxy should reject with 400.
+	_, err = fmt.Fprint(conn, "GET /path HTTP/1.1\r\nHost: example.com\r\n\r\n")
+	if err != nil {
+		t.Fatalf("write request: %v", err)
+	}
+	resp, err := http.ReadResponse(bufio.NewReader(conn), nil)
+	if err != nil {
+		t.Fatalf("read response: %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400", resp.StatusCode)
+	}
+}
+
+func TestPinningProxy_CONNECT_Pinned_Success(t *testing.T) {
+	upstreamAddr, stop := newRawTCPServer(t, func(c net.Conn) {
+		defer c.Close()
+		_, _ = c.Write([]byte("HI"))
+		buf := make([]byte, 4)
+		n, _ := io.ReadFull(c, buf)
+		_, _ = c.Write(buf[:n])
+	})
+	t.Cleanup(stop)
+
+	var decideCalls atomic.Int32
+	p := newPinningProxy(nil, nil, false, false)
+	p.decide = func(_ context.Context, _ string, _, _ []*regexp2.Regexp, _ time.Time) (gotenberg.OutboundDecision, error) {
+		decideCalls.Add(1)
+		return gotenberg.OutboundDecision{Pinned: []netip.Addr{netip.MustParseAddr("127.0.0.1")}}, nil
+	}
+	p.dialPinned = func(_ context.Context, network string, _ []netip.Addr, _ string) (net.Conn, error) {
+		return net.Dial(network, upstreamAddr)
+	}
+	proxyURL := newProxyForTest(t, p)
+
+	// Connect to the proxy, send CONNECT, splice raw bytes.
+	conn, err := net.Dial("tcp", strings.TrimPrefix(proxyURL, "http://"))
+	if err != nil {
+		t.Fatalf("dial proxy: %v", err)
+	}
+	defer conn.Close()
+
+	_ = conn.SetDeadline(time.Now().Add(5 * time.Second))
+
+	_, err = fmt.Fprintf(conn, "CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\n\r\n")
+	if err != nil {
+		t.Fatalf("write CONNECT: %v", err)
+	}
+
+	br := bufio.NewReader(conn)
+	statusLine, err := br.ReadString('\n')
+	if err != nil {
+		t.Fatalf("read status: %v", err)
+	}
+	if !strings.Contains(statusLine, " 200 ") {
+		t.Fatalf("CONNECT status = %q, want 200", statusLine)
+	}
+	// Consume the blank line after headers.
+	for {
+		line, err := br.ReadString('\n')
+		if err != nil {
+			t.Fatalf("read headers: %v", err)
+		}
+		if line == "\r\n" || line == "\n" {
+			break
+		}
+	}
+
+	hi := make([]byte, 2)
+	_, err = io.ReadFull(br, hi)
+	if err != nil {
+		t.Fatalf("read greeting: %v", err)
+	}
+	if string(hi) != "HI" {
+		t.Fatalf("greeting = %q, want HI", hi)
+	}
+
+	_, err = conn.Write([]byte("PONG"))
+	if err != nil {
+		t.Fatalf("write PONG: %v", err)
+	}
+	echo := make([]byte, 4)
+	_, err = io.ReadFull(br, echo)
+	if err != nil {
+		t.Fatalf("read echo: %v", err)
+	}
+	if string(echo) != "PONG" {
+		t.Fatalf("echo = %q, want PONG", echo)
+	}
+	if got := decideCalls.Load(); got != 1 {
+		t.Fatalf("decide called %d times, want 1", got)
+	}
+}
+
+func TestPinningProxy_CONNECT_BlockedByDecide(t *testing.T) {
+	p := newPinningProxy(nil, nil, false, false)
+	p.decide = func(_ context.Context, _ string, _, _ []*regexp2.Regexp, _ time.Time) (gotenberg.OutboundDecision, error) {
+		return gotenberg.OutboundDecision{}, fmt.Errorf("nope: %w", gotenberg.ErrFiltered)
+	}
+	p.dialPinned = func(_ context.Context, _ string, _ []netip.Addr, _ string) (net.Conn, error) {
+		t.Fatal("dialPinned must not be called when decide returns an error")
+		return nil, errors.New("unreachable")
+	}
+	proxyURL := newProxyForTest(t, p)
+
+	conn, err := net.Dial("tcp", strings.TrimPrefix(proxyURL, "http://"))
+	if err != nil {
+		t.Fatalf("dial proxy: %v", err)
+	}
+	defer conn.Close()
+	_ = conn.SetDeadline(time.Now().Add(5 * time.Second))
+
+	_, err = fmt.Fprintf(conn, "CONNECT rebind.example:443 HTTP/1.1\r\nHost: rebind.example:443\r\n\r\n")
+	if err != nil {
+		t.Fatalf("write CONNECT: %v", err)
+	}
+
+	resp, err := http.ReadResponse(bufio.NewReader(conn), nil)
+	if err != nil {
+		t.Fatalf("read response: %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusForbidden {
+		t.Fatalf("CONNECT status = %d, want 403", resp.StatusCode)
+	}
+}
+
+// TestPinningProxy_DNSRebind_SingleResolution is the regression test for
+// the DNS rebinding window. It simulates a DNS authority that returns a
+// public IP on the first lookup and a loopback IP on subsequent lookups.
+// The proxy must resolve the host exactly once per request and dial the
+// IP validated at that moment, so that a second resolution by any later
+// layer cannot pivot the connection to an internal target.
+func TestPinningProxy_DNSRebind_SingleResolution(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = fmt.Fprint(w, "public-upstream")
+	}))
+	t.Cleanup(upstream.Close)
+	upstreamURL := mustParseURL(t, upstream.URL)
+
+	var lookupCount atomic.Int32
+	stubDecide := func(_ context.Context, _ string, _, _ []*regexp2.Regexp, _ time.Time) (gotenberg.OutboundDecision, error) {
+		n := lookupCount.Add(1)
+		if n == 1 {
+			// First lookup: returns a public IP, validation passes, the
+			// proxy pins it for the dial.
+			return gotenberg.OutboundDecision{Pinned: []netip.Addr{netip.MustParseAddr("93.184.216.34")}}, nil
+		}
+		// Any subsequent lookup for the same host would return a
+		// loopback IP. This return value must not influence the dial
+		// because the proxy must not call decide again for this request.
+		return gotenberg.OutboundDecision{}, fmt.Errorf("rebind lookup: %w", gotenberg.ErrFiltered)
+	}
+
+	p := newPinningProxy(nil, nil, false, false)
+	p.decide = stubDecide
+	p.dialPinned = func(_ context.Context, network string, addrs []netip.Addr, _ string) (net.Conn, error) {
+		if len(addrs) != 1 || addrs[0].String() != "93.184.216.34" {
+			t.Errorf("dialPinned got addrs %v, want [93.184.216.34]", addrs)
+		}
+		return net.Dial(network, upstreamURL.Host)
+	}
+	proxyURL := newProxyForTest(t, p)
+
+	client := &http.Client{
+		Transport: &http.Transport{
+			Proxy: http.ProxyURL(mustParseURL(t, proxyURL)),
+		},
+		Timeout: 5 * time.Second,
+	}
+
+	resp, err := client.Get("http://rebind.example/")
+	if err != nil {
+		t.Fatalf("GET via proxy: %v", err)
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("status = %d, want 200", resp.StatusCode)
+	}
+	if string(body) != "public-upstream" {
+		t.Fatalf("body = %q, want %q", body, "public-upstream")
+	}
+	if got := lookupCount.Load(); got != 1 {
+		t.Fatalf("decide called %d times, want exactly 1 (rebind protection)", got)
+	}
+}
+
+func TestPinningProxy_StartTwice(t *testing.T) {
+	p := newPinningProxy(nil, nil, false, false)
+	err := p.Start(testLogger())
+	if err != nil {
+		t.Fatalf("first Start: %v", err)
+	}
+	t.Cleanup(func() { _ = p.Stop(testLogger()) })
+
+	err = p.Start(testLogger())
+	if err == nil {
+		t.Fatal("second Start: expected error, got nil")
+	}
+}
+
+func TestPinningProxy_StopIdempotent(t *testing.T) {
+	p := newPinningProxy(nil, nil, false, false)
+	// Stop on a never-started proxy is a no-op.
+	if err := p.Stop(testLogger()); err != nil {
+		t.Fatalf("Stop on never-started proxy: %v", err)
+	}
+
+	if err := p.Start(testLogger()); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	if err := p.Stop(testLogger()); err != nil {
+		t.Fatalf("first Stop: %v", err)
+	}
+	if err := p.Stop(testLogger()); err != nil {
+		t.Fatalf("second Stop on stopped proxy: %v", err)
+	}
+}

pkg/modules/chromium/routes.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"html/template"
 	"net/http"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -402,6 +403,34 @@ func FormDataChromiumScreenshotOptions(ctx *api.Context) (*api.FormData, Screens
 	return form, screenshotOptions
 }
 
+// rejectFileScheme returns an HTTP 400 [api] error when rawURL uses the
+// file:// scheme. /forms/chromium/convert/url and
+// /forms/chromium/screenshot/url accept user-supplied URLs and are
+// intended for navigating to remote HTTP(S) resources; allowing file://
+// lets a caller reach Chromium's working directory through the default
+// deny-list's /tmp/ allowance, which exists only to serve main-page
+// HTML/Markdown that the other routes generate. Filter the scheme at the
+// route layer where no request-scoped allowedFilePrefixes exists.
+func rejectFileScheme(rawURL string) error {
+	parsed, err := url.Parse(rawURL)
+	if err != nil {
+		return api.WrapError(
+			fmt.Errorf("parse URL: %w", err),
+			api.NewSentinelHttpError(http.StatusBadRequest, fmt.Sprintf("Invalid URL: %s", err)),
+		)
+	}
+	if strings.EqualFold(parsed.Scheme, "file") {
+		return api.WrapError(
+			fmt.Errorf("file:// scheme not allowed on URL route"),
+			api.NewSentinelHttpError(
+				http.StatusBadRequest,
+				"file:// URLs are not accepted on this route. Use the /convert/html or /convert/markdown routes to render local HTML",
+			),
+		)
+	}
+	return nil
+}
+
 // convertUrlRoute returns an [api.Route] which can convert a URL to PDF.
 func convertUrlRoute(chromium Api, engine gotenberg.PdfEngine) api.Route {
 	return api.Route{
@@ -421,6 +450,7 @@ func convertUrlRoute(chromium Api, engine gotenberg.PdfEngine) api.Route {
 			stamp := pdfengines.FormDataPdfStamp(form, false)
 			stampFile := pdfengines.FormDataPdfStampFile(form)
 			rotateAngle, rotatePages := pdfengines.FormDataPdfRotate(form, false)
+			embedsMetadata := pdfengines.FormDataPdfEmbedsMetadata(form)
 
 			var url string
 			err := form.
@@ -430,14 +460,21 @@ func convertUrlRoute(chromium Api, engine gotenberg.PdfEngine) api.Route {
 				return fmt.Errorf("validate form data: %w", err)
 			}
 
-			if (watermark.Source == gotenberg.StampSourceImage || watermark.Source == gotenberg.StampSourcePDF) && watermarkFile != "" {
-				watermark.Expression = watermarkFile
-			}
-			if (stamp.Source == gotenberg.StampSourceImage || stamp.Source == gotenberg.StampSourcePDF) && stampFile != "" {
-				stamp.Expression = stampFile
+			err = rejectFileScheme(url)
+			if err != nil {
+				return fmt.Errorf("reject URL scheme: %w", err)
 			}
 
-			err = convertUrl(ctx, chromium, engine, url, options, mode, pdfFormats, metadata, userPassword, ownerPassword, embedPaths, watermark, stamp, rotateAngle, rotatePages)
+			err = pdfengines.EnsureWatermarkFile(&watermark, watermarkFile)
+			if err != nil {
+				return fmt.Errorf("validate watermark: %w", err)
+			}
+			err = pdfengines.EnsureStampFile(&stamp, stampFile)
+			if err != nil {
+				return fmt.Errorf("validate stamp: %w", err)
+			}
+
+			err = convertUrl(ctx, chromium, engine, url, options, mode, pdfFormats, metadata, userPassword, ownerPassword, embedPaths, embedsMetadata, watermark, stamp, rotateAngle, rotatePages)
 			if err != nil {
 				return fmt.Errorf("convert URL to PDF: %w", err)
 			}
@@ -466,6 +503,11 @@ func screenshotUrlRoute(chromium Api) api.Route {
 				return fmt.Errorf("validate form data: %w", err)
 			}
 
+			err = rejectFileScheme(url)
+			if err != nil {
+				return fmt.Errorf("reject URL scheme: %w", err)
+			}
+
 			err = screenshotUrl(ctx, chromium, url, options)
 			if err != nil {
 				return fmt.Errorf("URL screenshot: %w", err)
@@ -496,6 +538,7 @@ func convertHtmlRoute(chromium Api, engine gotenberg.PdfEngine) api.Route {
 			stamp := pdfengines.FormDataPdfStamp(form, false)
 			stampFile := pdfengines.FormDataPdfStampFile(form)
 			rotateAngle, rotatePages := pdfengines.FormDataPdfRotate(form, false)
+			embedsMetadata := pdfengines.FormDataPdfEmbedsMetadata(form)
 
 			var inputPath string
 			err := form.
@@ -505,16 +548,18 @@ func convertHtmlRoute(chromium Api, engine gotenberg.PdfEngine) api.Route {
 				return fmt.Errorf("validate form data: %w", err)
 			}
 
-			if (watermark.Source == gotenberg.StampSourceImage || watermark.Source == gotenberg.StampSourcePDF) && watermarkFile != "" {
-				watermark.Expression = watermarkFile
+			err = pdfengines.EnsureWatermarkFile(&watermark, watermarkFile)
+			if err != nil {
+				return fmt.Errorf("validate watermark: %w", err)
 			}
-			if (stamp.Source == gotenberg.StampSourceImage || stamp.Source == gotenberg.StampSourcePDF) && stampFile != "" {
-				stamp.Expression = stampFile
+			err = pdfengines.EnsureStampFile(&stamp, stampFile)
+			if err != nil {
+				return fmt.Errorf("validate stamp: %w", err)
 			}
 
 			url := fmt.Sprintf("file://%s", inputPath)
 			options.AllowedFilePrefixes = []string{ctx.DirPath()}
-			err = convertUrl(ctx, chromium, engine, url, options, mode, pdfFormats, metadata, userPassword, ownerPassword, embedPaths, watermark, stamp, rotateAngle, rotatePages)
+			err = convertUrl(ctx, chromium, engine, url, options, mode, pdfFormats, metadata, userPassword, ownerPassword, embedPaths, embedsMetadata, watermark, stamp, rotateAngle, rotatePages)
 			if err != nil {
 				return fmt.Errorf("convert HTML to PDF: %w", err)
 			}
@@ -575,6 +620,7 @@ func convertMarkdownRoute(chromium Api, engine gotenberg.PdfEngine) api.Route {
 			stamp := pdfengines.FormDataPdfStamp(form, false)
 			stampFile := pdfengines.FormDataPdfStampFile(form)
 			rotateAngle, rotatePages := pdfengines.FormDataPdfRotate(form, false)
+			embedsMetadata := pdfengines.FormDataPdfEmbedsMetadata(form)
 
 			var (
 				inputPath     string
@@ -589,11 +635,13 @@ func convertMarkdownRoute(chromium Api, engine gotenberg.PdfEngine) api.Route {
 				return fmt.Errorf("validate form data: %w", err)
 			}
 
-			if (watermark.Source == gotenberg.StampSourceImage || watermark.Source == gotenberg.StampSourcePDF) && watermarkFile != "" {
-				watermark.Expression = watermarkFile
+			err = pdfengines.EnsureWatermarkFile(&watermark, watermarkFile)
+			if err != nil {
+				return fmt.Errorf("validate watermark: %w", err)
 			}
-			if (stamp.Source == gotenberg.StampSourceImage || stamp.Source == gotenberg.StampSourcePDF) && stampFile != "" {
-				stamp.Expression = stampFile
+			err = pdfengines.EnsureStampFile(&stamp, stampFile)
+			if err != nil {
+				return fmt.Errorf("validate stamp: %w", err)
 			}
 
 			url, err := markdownToHtml(ctx, inputPath, markdownPaths)
@@ -602,7 +650,7 @@ func convertMarkdownRoute(chromium Api, engine gotenberg.PdfEngine) api.Route {
 			}
 
 			options.AllowedFilePrefixes = []string{ctx.DirPath()}
-			err = convertUrl(ctx, chromium, engine, url, options, mode, pdfFormats, metadata, userPassword, ownerPassword, embedPaths, watermark, stamp, rotateAngle, rotatePages)
+			err = convertUrl(ctx, chromium, engine, url, options, mode, pdfFormats, metadata, userPassword, ownerPassword, embedPaths, embedsMetadata, watermark, stamp, rotateAngle, rotatePages)
 			if err != nil {
 				return fmt.Errorf("convert markdown to PDF: %w", err)
 			}
@@ -727,7 +775,7 @@ func markdownToHtml(ctx *api.Context, inputPath string, markdownPaths []string)
 	return fmt.Sprintf("file://%s", inputPath), nil
 }
 
-func convertUrl(ctx *api.Context, chromium Api, engine gotenberg.PdfEngine, url string, options PdfOptions, mode gotenberg.SplitMode, pdfFormats gotenberg.PdfFormats, metadata map[string]any, userPassword, ownerPassword string, embedPaths []string, watermark, stamp gotenberg.Stamp, rotateAngle int, rotatePages string) error {
+func convertUrl(ctx *api.Context, chromium Api, engine gotenberg.PdfEngine, url string, options PdfOptions, mode gotenberg.SplitMode, pdfFormats gotenberg.PdfFormats, metadata map[string]any, userPassword, ownerPassword string, embedPaths []string, embedsMetadata map[string]map[string]string, watermark, stamp gotenberg.Stamp, rotateAngle int, rotatePages string) error {
 	outputPath := ctx.GeneratePath(".pdf")
 	// See https://github.com/gotenberg/gotenberg/issues/1130.
 	filename := ctx.OutputFilename(outputPath)
@@ -831,6 +879,11 @@ func convertUrl(ctx *api.Context, chromium Api, engine gotenberg.PdfEngine, url
 		return fmt.Errorf("embed files into PDFs: %w", err)
 	}
 
+	err = pdfengines.EmbedFilesMetadataStub(ctx, engine, embedsMetadata, convertOutputPaths)
+	if err != nil {
+		return fmt.Errorf("set embeds metadata: %w", err)
+	}
+
 	err = pdfengines.EncryptPdfStub(ctx, engine, userPassword, ownerPassword, convertOutputPaths)
 	if err != nil {
 		return fmt.Errorf("encrypt PDFs: %w", err)

pkg/modules/exiftool/exiftool.go

@@ -2,16 +2,16 @@ package exiftool
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"log/slog"
 	"os"
 	"os/exec"
-	"reflect"
+	"regexp"
 	"strings"
 	"syscall"
 
-	"github.com/barasher/go-exiftool"
 	"go.opentelemetry.io/otel/codes"
 	semconv "go.opentelemetry.io/otel/semconv/v1.40.0"
 	"go.opentelemetry.io/otel/trace"
@@ -23,10 +23,33 @@ func init() {
 	gotenberg.MustRegisterModule(new(ExifTool))
 }
 
+// safeKeyPattern matches legitimate ExifTool tag names: alphanumeric,
+// hyphens, underscores, colons, and periods. The first character may not
+// be a hyphen, otherwise exiftool would treat the argv entry as a flag
+// rather than a tag assignment. Control characters are implicitly
+// rejected because the class is ASCII-only.
+var safeKeyPattern = regexp.MustCompile(`^[a-zA-Z0-9_.:][a-zA-Z0-9\-_.:]*$`)
+
+// validateMetadataValue rejects metadata values containing NUL, newline,
+// or carriage return. NUL terminates C strings and is rejected by
+// [exec.Cmd] anyway; newlines and carriage returns are rejected as
+// defense in depth against exiftool parsing quirks, even though argv
+// invocation is not susceptible to stdin-protocol injection the way
+// the previous go-exiftool backend was. The returned error wraps
+// [gotenberg.ErrPdfEngineMetadataValueNotSupported] so the API layer
+// surfaces it as HTTP 400.
+func validateMetadataValue(key, value string) error {
+	if strings.ContainsAny(value, "\n\r\x00") {
+		return fmt.Errorf("write PDF metadata with ExifTool: invalid metadata value for key %q (contains control character): %w", key, gotenberg.ErrPdfEngineMetadataValueNotSupported)
+	}
+	return nil
+}
+
 // systemTags lists ExifTool tags that reflect internal filesystem state
-// rather than actual PDF metadata. These are stripped from both read and
-// write operations.
+// or tool identity rather than actual PDF metadata. Stripped from read
+// output before returning to the caller.
 var systemTags = []string{
+	"SourceFile",          // Full path exiftool -j always emits first
 	"FileName",            // Reflects UUID-based disk name, not original filename
 	"Directory",           // Leaks internal temp path
 	"FileSize",            // System attribute
@@ -39,16 +62,97 @@ var systemTags = []string{
 	"Warning",             // Extraction warning messages
 }
 
-// writeOnlyDerivedTags lists ExifTool tags that are safe to return when
-// reading metadata but should not be written back (writing them can break
-// PDF/A compliance or cause side effects).
-var writeOnlyDerivedTags = []string{
-	"PageCount",         // Causes prism:pageCount injection
-	"Linearized",        // Computed status; writing it may invalidate structure
-	"PDFVersion",        // Header version; should not be manually forced via metadata
-	"MIMEType",          // Read-only derived
-	"FileType",          // Read-only derived
-	"FileTypeExtension", // Read-only derived
+// dangerousTags lists ExifTool pseudo-tags that trigger filesystem side
+// effects (file rename, move, link creation, permission change). Writes
+// containing any of these keys are silently dropped before the argv is
+// handed to exiftool. The comparison strips group prefixes (e.g.
+// "System:FileName" collapses to "FileName") because exiftool treats
+// the prefixed and bare forms identically.
+//
+// See https://exiftool.org/TagNames/Extra.html.
+var dangerousTags = []string{
+	"FileName",        // Writing this triggers a file rename in ExifTool
+	"Directory",       // Writing this triggers a file move in ExifTool
+	"HardLink",        // Writing this creates a hard link in ExifTool
+	"SymLink",         // Writing this creates a symbolic link in ExifTool
+	"FilePermissions", // Writing this changes the file's permissions
+}
+
+// isDangerousTag reports whether key matches one of the [dangerousTags]
+// after case-insensitive comparison with any group prefix stripped.
+func isDangerousTag(key string) bool {
+	bare := key
+	if i := strings.LastIndex(key, ":"); i >= 0 {
+		bare = key[i+1:]
+	}
+	for _, tag := range dangerousTags {
+		if strings.EqualFold(bare, tag) {
+			return true
+		}
+	}
+	return false
+}
+
+// buildExifToolWriteArgs builds the variadic argv tail for
+//
+//	exiftool -overwrite_original <args> <path>
+//
+// from a user-supplied metadata map. Dangerous pseudo-tags are silently
+// dropped. Invalid keys (empty, leading dash, control characters) and
+// values containing NUL or newlines return an error wrapping
+// [gotenberg.ErrPdfEngineMetadataValueNotSupported] so the API layer
+// replies with HTTP 400. Supported value kinds: string, []string,
+// []any of strings, bool, int, int64, float32, float64.
+func buildExifToolWriteArgs(metadata map[string]any) ([]string, error) {
+	var args []string
+	for key, value := range metadata {
+		if isDangerousTag(key) {
+			continue
+		}
+		if !safeKeyPattern.MatchString(key) {
+			return nil, fmt.Errorf("write PDF metadata with ExifTool: invalid metadata key %q: %w", key, gotenberg.ErrPdfEngineMetadataValueNotSupported)
+		}
+
+		switch val := value.(type) {
+		case string:
+			if err := validateMetadataValue(key, val); err != nil {
+				return nil, err
+			}
+			args = append(args, fmt.Sprintf("-%s=%s", key, val))
+		case []string:
+			for _, s := range val {
+				if err := validateMetadataValue(key, s); err != nil {
+					return nil, err
+				}
+				args = append(args, fmt.Sprintf("-%s=%s", key, s))
+			}
+		case []any:
+			// See https://github.com/gotenberg/gotenberg/issues/1048.
+			for _, entry := range val {
+				s, ok := entry.(string)
+				if !ok {
+					return nil, fmt.Errorf("write PDF metadata with ExifTool: unsupported element type %T in []any for key %q: %w", entry, key, gotenberg.ErrPdfEngineMetadataValueNotSupported)
+				}
+				if err := validateMetadataValue(key, s); err != nil {
+					return nil, err
+				}
+				args = append(args, fmt.Sprintf("-%s=%s", key, s))
+			}
+		case bool:
+			args = append(args, fmt.Sprintf("-%s=%t", key, val))
+		case int:
+			args = append(args, fmt.Sprintf("-%s=%d", key, val))
+		case int64:
+			args = append(args, fmt.Sprintf("-%s=%d", key, val))
+		case float32:
+			args = append(args, fmt.Sprintf("-%s=%g", key, val))
+		case float64:
+			args = append(args, fmt.Sprintf("-%s=%g", key, val))
+		default:
+			return nil, fmt.Errorf("write PDF metadata with ExifTool: unsupported type %T for key %q: %w", value, key, gotenberg.ErrPdfEngineMetadataValueNotSupported)
+		}
+	}
+	return args, nil
 }
 
 // ExifTool abstracts the CLI tool ExifTool and implements the
@@ -160,7 +264,8 @@ func (engine *ExifTool) Convert(ctx context.Context, logger *slog.Logger, format
 	return err
 }
 
-// ReadMetadata extracts the metadata of a given PDF file.
+// ReadMetadata extracts the metadata of a given PDF file by invoking
+// the exiftool binary with "-j" (JSON output) and parsing the result.
 func (engine *ExifTool) ReadMetadata(ctx context.Context, logger *slog.Logger, inputPath string) (map[string]any, error) {
 	_, span := gotenberg.Tracer().Start(ctx, "exiftool.ReadMetadata",
 		trace.WithSpanKind(trace.SpanKindClient),
@@ -168,40 +273,56 @@ func (engine *ExifTool) ReadMetadata(ctx context.Context, logger *slog.Logger, i
 	)
 	defer span.End()
 
-	exifTool, err := exiftool.NewExiftool(exiftool.SetExiftoolBinaryPath(engine.binPath))
+	cmd := exec.CommandContext(ctx, engine.binPath, "-j", inputPath) //nolint:gosec
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+
+	output, err := cmd.Output()
 	if err != nil {
-		err = fmt.Errorf("new ExifTool: %w", err)
+		err = fmt.Errorf("read metadata with ExifTool: %w", err)
 		span.RecordError(err)
 		span.SetStatus(codes.Error, err.Error())
 		return nil, err
 	}
 
-	defer func(exifTool *exiftool.Exiftool) {
-		err := exifTool.Close()
-		if err != nil {
-			logger.ErrorContext(ctx, fmt.Sprintf("close ExifTool: %v", err))
-		}
-	}(exifTool)
-
-	fileMetadata := exifTool.ExtractMetadata(inputPath)
-	if fileMetadata[0].Err != nil {
-		err = fmt.Errorf("read metadata with ExitfTool: %w", fileMetadata[0].Err)
+	var files []map[string]any
+	err = json.Unmarshal(output, &files)
+	if err != nil {
+		err = fmt.Errorf("parse ExifTool JSON output: %w", err)
+		span.RecordError(err)
+		span.SetStatus(codes.Error, err.Error())
+		return nil, err
+	}
+	if len(files) == 0 {
+		err = errors.New("ExifTool returned no file entries")
+		span.RecordError(err)
+		span.SetStatus(codes.Error, err.Error())
+		return nil, err
+	}
+
+	metadata := files[0]
+
+	// ExifTool records extraction errors as an "Error" key on the file
+	// entry rather than via a non-zero exit code. Surface that back as a
+	// Go error before stripping so callers see the real cause.
+	if msg, ok := metadata["Error"].(string); ok && msg != "" {
+		err = fmt.Errorf("read metadata with ExifTool: %s", msg)
 		span.RecordError(err)
 		span.SetStatus(codes.Error, err.Error())
 		return nil, err
 	}
 
-	// Strip system tags that reflect internal filesystem state (e.g.,
-	// UUID-based FileName, temp Directory) rather than actual PDF metadata.
 	for _, tag := range systemTags {
-		delete(fileMetadata[0].Fields, tag)
+		delete(metadata, tag)
 	}
 
 	span.SetStatus(codes.Ok, "")
-	return fileMetadata[0].Fields, nil
+	return metadata, nil
 }
 
-// WriteMetadata writes the metadata into a given PDF file.
+// WriteMetadata writes the metadata into a given PDF file by invoking
+// the exiftool binary with "-overwrite_original -TAG=VALUE ... path".
+// ExifTool preserves tags that are not mentioned in the argv, so the
+// write is a merge rather than a rewrite.
 func (engine *ExifTool) WriteMetadata(ctx context.Context, logger *slog.Logger, metadata map[string]any, inputPath string) error {
 	_, span := gotenberg.Tracer().Start(ctx, "exiftool.WriteMetadata",
 		trace.WithSpanKind(trace.SpanKindClient),
@@ -209,101 +330,34 @@ func (engine *ExifTool) WriteMetadata(ctx context.Context, logger *slog.Logger,
 	)
 	defer span.End()
 
-	exifTool, err := exiftool.NewExiftool(exiftool.SetExiftoolBinaryPath(engine.binPath))
+	extraArgs, err := buildExifToolWriteArgs(metadata)
 	if err != nil {
-		err = fmt.Errorf("new ExifTool: %w", err)
 		span.RecordError(err)
 		span.SetStatus(codes.Error, err.Error())
 		return err
 	}
 
-	defer func(exifTool *exiftool.Exiftool) {
-		err := exifTool.Close()
-		if err != nil {
-			logger.ErrorContext(ctx, fmt.Sprintf("close ExifTool: %v", err))
-		}
-	}(exifTool)
+	if len(extraArgs) == 0 {
+		// Nothing to write after filtering. Treat as success so the
+		// caller can move on without a dedicated zero-tag branch.
+		span.SetStatus(codes.Ok, "")
+		return nil
+	}
 
-	fileMetadata := exifTool.ExtractMetadata(inputPath)
-	if fileMetadata[0].Err != nil {
-		err = fmt.Errorf("read metadata with ExitfTool: %w", fileMetadata[0].Err)
+	args := append([]string{"-overwrite_original"}, extraArgs...)
+	args = append(args, inputPath)
+
+	cmd, err := gotenberg.CommandContext(ctx, logger, engine.binPath, args...)
+	if err != nil {
+		err = fmt.Errorf("create ExifTool command: %w", err)
 		span.RecordError(err)
 		span.SetStatus(codes.Error, err.Error())
 		return err
 	}
 
-	// Strip system and derived tags from the existing file metadata so
-	// they are not written back (which can break PDF/A compliance or
-	// cause side effects).
-	for _, tag := range systemTags {
-		delete(fileMetadata[0].Fields, tag)
-	}
-	for _, tag := range writeOnlyDerivedTags {
-		delete(fileMetadata[0].Fields, tag)
-	}
-
-	// Filter user-supplied metadata to prevent ExifTool pseudo-tags from
-	// triggering dangerous side effects like file renames, moves, or link
-	// creation. Comparison is case-insensitive because ExifTool processes
-	// tag names case-insensitively.
-	// See https://exiftool.org/TagNames/Extra.html.
-	dangerousTags := []string{
-		"FileName",  // Writing this triggers a file rename in ExifTool
-		"Directory", // Writing this triggers a file move in ExifTool
-		"HardLink",  // Writing this creates a hard link in ExifTool
-		"SymLink",   // Writing this creates a symbolic link in ExifTool
-	}
-	for key := range metadata {
-		for _, tag := range dangerousTags {
-			if strings.EqualFold(key, tag) {
-				delete(metadata, key)
-			}
-		}
-	}
-
-	for key, value := range metadata {
-		switch val := value.(type) {
-		case string:
-			fileMetadata[0].SetString(key, val)
-		case []string:
-			fileMetadata[0].SetStrings(key, val)
-		case []any:
-			// See https://github.com/gotenberg/gotenberg/issues/1048.
-			strs := make([]string, len(val))
-			for i, entry := range val {
-				if str, ok := entry.(string); ok {
-					strs[i] = str
-					continue
-				}
-				err = fmt.Errorf("write PDF metadata with ExifTool: %s %+v %s %w", key, val, reflect.TypeFor[[]any](), gotenberg.ErrPdfEngineMetadataValueNotSupported)
-				span.RecordError(err)
-				span.SetStatus(codes.Error, err.Error())
-				return err
-			}
-			fileMetadata[0].SetStrings(key, strs)
-		case bool:
-			fileMetadata[0].SetString(key, fmt.Sprintf("%t", val))
-		case int:
-			fileMetadata[0].SetInt(key, int64(val))
-		case int64:
-			fileMetadata[0].SetInt(key, val)
-		case float32:
-			fileMetadata[0].SetFloat(key, float64(val))
-		case float64:
-			fileMetadata[0].SetFloat(key, val)
-		// TODO: support more complex cases, e.g., arrays and nested objects
-		// 	(limitations in underlying library).
-		default:
-			err = fmt.Errorf("write PDF metadata with ExifTool: %s %+v %s %w", key, val, reflect.TypeOf(val), gotenberg.ErrPdfEngineMetadataValueNotSupported)
-			span.RecordError(err)
-			span.SetStatus(codes.Error, err.Error())
-			return err
-		}
-	}
-
-	exifTool.WriteMetadata(fileMetadata)
-	if fileMetadata[0].Err != nil {
-		err = fmt.Errorf("write PDF metadata with ExifTool: %w", fileMetadata[0].Err)
+	exitCode, err := cmd.Exec()
+	if err != nil {
+		err = fmt.Errorf("write PDF metadata with ExifTool (exit %d): %w", exitCode, err)
 		span.RecordError(err)
 		span.SetStatus(codes.Error, err.Error())
 		return err
@@ -464,6 +518,11 @@ func (engine *ExifTool) Rotate(ctx context.Context, logger *slog.Logger, inputPa
 	return err
 }
 
+// EmbedFilesMetadata is not available in this implementation.
+func (engine *ExifTool) EmbedFilesMetadata(ctx context.Context, logger *slog.Logger, metadata map[string]map[string]string, inputPath string) error {
+	return fmt.Errorf("set embeds metadata with ExifTool: %w", gotenberg.ErrPdfEngineMethodNotSupported)
+}
+
 // Interface guards.
 var (
 	_ gotenberg.Module      = (*ExifTool)(nil)

pkg/modules/exiftool/exiftool_test.go

@@ -0,0 +1,213 @@
+package exiftool
+
+import (
+	"errors"
+	"slices"
+	"testing"
+
+	"github.com/gotenberg/gotenberg/v8/pkg/gotenberg"
+)
+
+func TestBuildExifToolWriteArgs_String(t *testing.T) {
+	args, err := buildExifToolWriteArgs(map[string]any{"Title": "sample"})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	want := []string{"-Title=sample"}
+	if !slices.Equal(args, want) {
+		t.Fatalf("args = %v, want %v", args, want)
+	}
+}
+
+func TestBuildExifToolWriteArgs_StringSlice(t *testing.T) {
+	args, err := buildExifToolWriteArgs(map[string]any{"Keywords": []string{"first", "second"}})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	want := []string{"-Keywords=first", "-Keywords=second"}
+	if !slices.Equal(args, want) {
+		t.Fatalf("args = %v, want %v", args, want)
+	}
+}
+
+func TestBuildExifToolWriteArgs_AnySliceOfStrings(t *testing.T) {
+	args, err := buildExifToolWriteArgs(map[string]any{"Keywords": []any{"a", "b"}})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	want := []string{"-Keywords=a", "-Keywords=b"}
+	if !slices.Equal(args, want) {
+		t.Fatalf("args = %v, want %v", args, want)
+	}
+}
+
+func TestBuildExifToolWriteArgs_AnySliceMixedRejected(t *testing.T) {
+	_, err := buildExifToolWriteArgs(map[string]any{"Keywords": []any{"a", 42}})
+	if !errors.Is(err, gotenberg.ErrPdfEngineMetadataValueNotSupported) {
+		t.Fatalf("expected ErrPdfEngineMetadataValueNotSupported, got %v", err)
+	}
+}
+
+func TestBuildExifToolWriteArgs_Numbers(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		in   any
+		want string
+	}{
+		{"int", 42, "-K=42"},
+		{"int64", int64(42), "-K=42"},
+		{"float32", float32(1.5), "-K=1.5"},
+		{"float64", 1.7, "-K=1.7"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			args, err := buildExifToolWriteArgs(map[string]any{"K": tc.in})
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if len(args) != 1 || args[0] != tc.want {
+				t.Fatalf("args = %v, want [%q]", args, tc.want)
+			}
+		})
+	}
+}
+
+func TestBuildExifToolWriteArgs_Bool(t *testing.T) {
+	args, err := buildExifToolWriteArgs(map[string]any{"Marked": true})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	want := []string{"-Marked=true"}
+	if !slices.Equal(args, want) {
+		t.Fatalf("args = %v, want %v", args, want)
+	}
+}
+
+func TestBuildExifToolWriteArgs_InvalidKey(t *testing.T) {
+	for _, key := range []string{
+		"",           // empty
+		"-rm",        // leading dash — would be parsed as a flag
+		"foo\nbar",   // newline
+		"foo bar",    // space
+		"foo=bar",    // contains equals
+		"weird/char", // slash
+	} {
+		t.Run(key, func(t *testing.T) {
+			_, err := buildExifToolWriteArgs(map[string]any{key: "value"})
+			if !errors.Is(err, gotenberg.ErrPdfEngineMetadataValueNotSupported) {
+				t.Fatalf("expected ErrPdfEngineMetadataValueNotSupported for key %q, got %v", key, err)
+			}
+		})
+	}
+}
+
+func TestBuildExifToolWriteArgs_ControlCharValue(t *testing.T) {
+	for _, val := range []string{
+		"foo\nbar",
+		"foo\rbar",
+		"foo\x00bar",
+	} {
+		t.Run(val, func(t *testing.T) {
+			_, err := buildExifToolWriteArgs(map[string]any{"Title": val})
+			if !errors.Is(err, gotenberg.ErrPdfEngineMetadataValueNotSupported) {
+				t.Fatalf("expected ErrPdfEngineMetadataValueNotSupported for value %q, got %v", val, err)
+			}
+		})
+	}
+}
+
+func TestBuildExifToolWriteArgs_DangerousTagsStripped(t *testing.T) {
+	// Dangerous tag keys are silently dropped; legitimate keys still pass.
+	args, err := buildExifToolWriteArgs(map[string]any{
+		"Author":          "legit",
+		"FileName":        "stolen.pdf",
+		"System:FileName": "stolen.pdf",
+		"Directory":       "/tmp",
+		"HardLink":        "/tmp/link",
+		"SymLink":         "/tmp/link",
+		"FilePermissions": "777",
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !slices.Equal(args, []string{"-Author=legit"}) {
+		t.Fatalf("args = %v, want [-Author=legit]", args)
+	}
+}
+
+func TestBuildExifToolWriteArgs_DangerousTagsCaseInsensitive(t *testing.T) {
+	// Case variations are all dropped because exiftool is case-insensitive.
+	args, err := buildExifToolWriteArgs(map[string]any{
+		"filename":        "x",
+		"FILENAME":        "x",
+		"System:Filename": "x",
+		"Title":           "keep",
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !slices.Equal(args, []string{"-Title=keep"}) {
+		t.Fatalf("args = %v, want [-Title=keep]", args)
+	}
+}
+
+func TestBuildExifToolWriteArgs_UnsupportedType(t *testing.T) {
+	_, err := buildExifToolWriteArgs(map[string]any{"K": map[string]any{"nested": "x"}})
+	if !errors.Is(err, gotenberg.ErrPdfEngineMetadataValueNotSupported) {
+		t.Fatalf("expected ErrPdfEngineMetadataValueNotSupported, got %v", err)
+	}
+}
+
+func TestBuildExifToolWriteArgs_Empty(t *testing.T) {
+	args, err := buildExifToolWriteArgs(map[string]any{})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(args) != 0 {
+		t.Fatalf("args = %v, want empty", args)
+	}
+}
+
+func TestIsDangerousTag(t *testing.T) {
+	for _, tc := range []struct {
+		key  string
+		want bool
+	}{
+		{"FileName", true},
+		{"filename", true},
+		{"System:FileName", true},
+		{"XMP:FileName", true},
+		{"Directory", true},
+		{"HardLink", true},
+		{"SymLink", true},
+		{"FilePermissions", true},
+		{"Title", false},
+		{"Author", false},
+		{"FileNameExtra", false}, // Suffix must not match.
+		{"", false},
+	} {
+		t.Run(tc.key, func(t *testing.T) {
+			if got := isDangerousTag(tc.key); got != tc.want {
+				t.Fatalf("isDangerousTag(%q) = %v, want %v", tc.key, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestSafeKeyPattern(t *testing.T) {
+	// Rejects leading dash to prevent argv-level flag injection.
+	if safeKeyPattern.MatchString("-injected") {
+		t.Fatalf("leading-dash key must be rejected")
+	}
+	// Accepts common legitimate forms.
+	for _, k := range []string{"Title", "System:Title", "XMP-pdf:Title", "My_Tag.1"} {
+		if !safeKeyPattern.MatchString(k) {
+			t.Fatalf("key %q must be accepted", k)
+		}
+	}
+	// Rejects control characters.
+	for _, k := range []string{"a\nb", "a\rb", "a\x00b", "a b"} {
+		if safeKeyPattern.MatchString(k) {
+			t.Fatalf("control-char key %q must be rejected", k)
+		}
+	}
+}

pkg/modules/libreoffice/api/api.go

@@ -327,6 +327,10 @@ func (a *Api) Descriptor() gotenberg.ModuleDescriptor {
 			fs.Duration("libreoffice-idle-shutdown-timeout", 0, "Shutdown LibreOffice after being idle for the given duration. Set to 0 to disable this feature")
 			fs.Bool("libreoffice-auto-start", false, "Automatically launch LibreOffice upon initialization if set to true; otherwise, LibreOffice will start at the time of the first conversion")
 			fs.Duration("libreoffice-start-timeout", time.Duration(20)*time.Second, "Maximum duration to wait for LibreOffice to start or restart")
+			fs.StringSlice("libreoffice-allow-list", []string{}, "Set the allowed URLs for LibreOffice outbound fetches (embedded images, linked content) using regular expressions - supports multiple values")
+			fs.StringSlice("libreoffice-deny-list", []string{}, "Set the denied URLs for LibreOffice outbound fetches using regular expressions - supports multiple values")
+			fs.Bool("libreoffice-deny-private-ips", false, "Reject LibreOffice outbound URLs whose host resolves to a non-public IP address (loopback, RFC1918, link-local, unique-local). Enable on deployments that accept untrusted documents to mitigate SSRF against internal services")
+			fs.Bool("libreoffice-deny-public-ips", false, "Reject LibreOffice outbound URLs whose host resolves to a public IP address. Enable on air-gapped or data-governed deployments to prevent outbound traffic from leaving a private network")
 
 			return fs
 		}(),
@@ -353,6 +357,12 @@ func (a *Api) Provision(ctx *gotenberg.Context) error {
 		binPath:      libreOfficeBinPath,
 		unoBinPath:   unoBinPath,
 		startTimeout: flags.MustDuration("libreoffice-start-timeout"),
+		proxyOptions: outboundProxyOptions{
+			allowList:      flags.MustRegexpSlice("libreoffice-allow-list"),
+			denyList:       flags.MustRegexpSlice("libreoffice-deny-list"),
+			denyPrivateIPs: flags.MustBool("libreoffice-deny-private-ips"),
+			denyPublicIPs:  flags.MustBool("libreoffice-deny-public-ips"),
+		},
 	}
 
 	// Logger.

pkg/modules/libreoffice/api/libreoffice.go

@@ -24,12 +24,14 @@ type libreOfficeArguments struct {
 	binPath      string
 	unoBinPath   string
 	startTimeout time.Duration
+	proxyOptions outboundProxyOptions
 }
 
 type libreOfficeProcess struct {
 	socketPort         int
 	userProfileDirPath string
 	cmd                *gotenberg.Cmd
+	proxy              *libreOfficeProxy
 	cfgMu              sync.RWMutex
 	isStarted          atomic.Bool
 
@@ -57,7 +59,24 @@ func (p *libreOfficeProcess) Start(logger *slog.Logger) error {
 		return fmt.Errorf("get free port: %w", err)
 	}
 
+	proxy, err := newLibreOfficeProxy(logger, p.arguments.proxyOptions)
+	if err != nil {
+		return fmt.Errorf("create LibreOffice outbound proxy: %w", err)
+	}
+	proxy.Start()
+
 	userProfileDirPath := p.fs.NewDirPath()
+
+	// LibreOffice fetches external content (OOXML images via
+	// TargetMode=External, RTF INCLUDEPICTURE, ODT linked images) inside
+	// its own libcurl. Route those fetches through the in-process proxy
+	// so the chromium/webhook SSRF filters apply.
+	if err := writeSofficeProxyConfig(userProfileDirPath, proxy.Addr()); err != nil {
+		_ = proxy.Stop(context.Background())
+		return fmt.Errorf("write soffice proxy config: %w", err)
+	}
+	sofficeEnv := sofficeProxyEnv(os.Environ(), proxy.Addr())
+
 	args := []string{
 		"--headless",
 		"--invisible",
@@ -75,13 +94,16 @@ func (p *libreOfficeProcess) Start(logger *slog.Logger) error {
 
 	cmd, err := gotenberg.CommandContext(ctx, logger, p.arguments.binPath, args...)
 	if err != nil {
+		_ = proxy.Stop(context.Background())
 		return fmt.Errorf("create LibreOffice command: %w", err)
 	}
+	cmd.SetEnv(sofficeEnv)
 
 	// For whatever reason, LibreOffice requires a first start before being
 	// able to run as a daemon.
 	exitCode, err := cmd.Exec()
 	if err != nil && exitCode != 81 {
+		_ = proxy.Stop(context.Background())
 		return fmt.Errorf("execute LibreOffice: %w", err)
 	}
 
@@ -89,6 +111,7 @@ func (p *libreOfficeProcess) Start(logger *slog.Logger) error {
 
 	// Second start (daemon).
 	cmd = gotenberg.Command(logger, p.arguments.binPath, args...)
+	cmd.SetEnv(sofficeEnv)
 
 	err = cmd.Start()
 	if err != nil {
@@ -139,11 +162,18 @@ func (p *libreOfficeProcess) Start(logger *slog.Logger) error {
 			p.socketPort = port
 			p.userProfileDirPath = userProfileDirPath
 			p.cmd = cmd
+			p.proxy = proxy
 			p.isStarted.Store(true)
 
 			return
 		}
 
+		// LibreOffice failed to start; tear the proxy down too.
+		stopErr := proxy.Stop(context.Background())
+		if stopErr != nil {
+			logger.WarnContext(context.Background(), fmt.Sprintf("stop LibreOffice outbound proxy after failed start: %s", stopErr))
+		}
+
 		// Let's make sure the process is killed.
 		err = cmd.Kill()
 		if err != nil {
@@ -212,6 +242,16 @@ func (p *libreOfficeProcess) Stop(logger *slog.Logger) error {
 		return fmt.Errorf("kill LibreOffice process: %w", err)
 	}
 
+	if p.proxy != nil {
+		shutdownCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		stopErr := p.proxy.Stop(shutdownCtx)
+		cancel()
+		if stopErr != nil {
+			logger.WarnContext(context.Background(), fmt.Sprintf("stop LibreOffice outbound proxy: %s", stopErr))
+		}
+		p.proxy = nil
+	}
+
 	p.socketPort = 0
 	p.userProfileDirPath = ""
 	p.cmd = nil

pkg/modules/libreoffice/api/proxy.go

@@ -0,0 +1,323 @@
+package api
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/dlclark/regexp2"
+
+	"github.com/gotenberg/gotenberg/v8/pkg/gotenberg"
+)
+
+// outboundProxyOptions configures a [libreOfficeProxy].
+type outboundProxyOptions struct {
+	allowList      []*regexp2.Regexp
+	denyList       []*regexp2.Regexp
+	denyPrivateIPs bool
+	denyPublicIPs  bool
+}
+
+// libreOfficeProxy is an HTTP/HTTPS forward proxy that LibreOffice routes
+// outbound requests through. Every proxied request goes through
+// [gotenberg.DecideOutbound] so the same allow/deny lists and IP-class
+// filters that protect chromium and webhook fetches also apply to
+// soffice's own libcurl-driven fetches.
+//
+// soffice triggers an outbound request whenever a document references
+// external content (OOXML images via TargetMode="External", RTF
+// INCLUDEPICTURE, ODT linked images). Without a filtering proxy in the
+// path those fetches bypass every Go-side SSRF guard because they
+// originate inside the soffice subprocess.
+type libreOfficeProxy struct {
+	listener net.Listener
+	server   *http.Server
+	client   *http.Client
+	opts     outboundProxyOptions
+	logger   *slog.Logger
+
+	stopOnce sync.Once
+}
+
+// newLibreOfficeProxy binds a proxy listener to a free local port and
+// applies opts to every proxied request. Callers must call [Start]
+// before pointing soffice at the proxy and [Stop] on shutdown.
+func newLibreOfficeProxy(logger *slog.Logger, opts outboundProxyOptions) (*libreOfficeProxy, error) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		return nil, fmt.Errorf("bind LibreOffice proxy listener: %w", err)
+	}
+
+	decideOpts := []gotenberg.DecideOption{
+		gotenberg.WithDenyPrivateIPs(opts.denyPrivateIPs),
+		gotenberg.WithDenyPublicIPs(opts.denyPublicIPs),
+	}
+
+	p := &libreOfficeProxy{
+		listener: listener,
+		client:   gotenberg.NewOutboundHttpClient(0, opts.allowList, opts.denyList, decideOpts...),
+		opts:     opts,
+		logger:   logger.With(slog.String("logger", "libreoffice-proxy")),
+	}
+	p.server = &http.Server{
+		Handler:           p,
+		ReadHeaderTimeout: 10 * time.Second,
+	}
+	return p, nil
+}
+
+// Addr returns the host:port the proxy listens on.
+func (p *libreOfficeProxy) Addr() string {
+	return p.listener.Addr().String()
+}
+
+// Start serves proxy requests in a background goroutine until [Stop] is
+// called.
+func (p *libreOfficeProxy) Start() {
+	go func() {
+		err := p.server.Serve(p.listener)
+		if err != nil && !errors.Is(err, http.ErrServerClosed) {
+			p.logger.ErrorContext(context.Background(), fmt.Sprintf("LibreOffice proxy serve: %s", err))
+		}
+	}()
+}
+
+// Stop gracefully shuts the proxy down. Subsequent calls are no-ops.
+func (p *libreOfficeProxy) Stop(ctx context.Context) error {
+	var err error
+	p.stopOnce.Do(func() {
+		err = p.server.Shutdown(ctx)
+	})
+	if err != nil {
+		return fmt.Errorf("shutdown LibreOffice proxy: %w", err)
+	}
+	return nil
+}
+
+// ServeHTTP dispatches between CONNECT (HTTPS tunnels) and the absolute
+// URL form (HTTP forward).
+func (p *libreOfficeProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if r.Method == http.MethodConnect {
+		p.handleConnect(w, r)
+		return
+	}
+	p.handleHttp(w, r)
+}
+
+// handleHttp forwards a plain HTTP request whose URL line is absolute
+// (RFC 7230 5.3.2) through the outbound HTTP client, which validates
+// the destination and pins the dial.
+func (p *libreOfficeProxy) handleHttp(w http.ResponseWriter, r *http.Request) {
+	if r.URL == nil || !r.URL.IsAbs() {
+		http.Error(w, "proxy: expected absolute URI", http.StatusBadRequest)
+		return
+	}
+
+	outReq := r.Clone(r.Context())
+	outReq.RequestURI = ""
+	removeHopByHopHeaders(outReq.Header)
+
+	// gosec G704: outReq.URL is exactly what the proxy is here to filter; the
+	// http.Client returned by NewOutboundHttpClient validates and pins it.
+	resp, err := p.client.Do(outReq) //nolint:gosec
+	if err != nil {
+		p.logger.WarnContext(r.Context(), fmt.Sprintf("LibreOffice proxy rejected forward to '%s': %s", r.URL.String(), err))
+		http.Error(w, "proxy: destination rejected", http.StatusForbidden)
+		return
+	}
+	defer func() {
+		closeErr := resp.Body.Close()
+		if closeErr != nil {
+			p.logger.DebugContext(r.Context(), fmt.Sprintf("close upstream response body: %s", closeErr))
+		}
+	}()
+
+	removeHopByHopHeaders(resp.Header)
+	for key, values := range resp.Header {
+		for _, value := range values {
+			w.Header().Add(key, value)
+		}
+	}
+	w.WriteHeader(resp.StatusCode)
+	_, copyErr := io.Copy(w, resp.Body)
+	if copyErr != nil {
+		p.logger.DebugContext(r.Context(), fmt.Sprintf("copy proxied response body: %s", copyErr))
+	}
+}
+
+// handleConnect implements an HTTPS tunnel. It validates the destination
+// host through [gotenberg.DecideOutbound] (synthesizing an https URL),
+// dials the pinned IPs returned by the decision, and splices bytes
+// between client and server.
+func (p *libreOfficeProxy) handleConnect(w http.ResponseWriter, r *http.Request) {
+	host, port, err := net.SplitHostPort(r.Host)
+	if err != nil {
+		http.Error(w, "proxy: invalid CONNECT target", http.StatusBadRequest)
+		return
+	}
+
+	deadline, ok := r.Context().Deadline()
+	if !ok {
+		deadline = time.Now().Add(30 * time.Second)
+	}
+
+	rawURL := (&url.URL{Scheme: "https", Host: net.JoinHostPort(host, port)}).String()
+
+	decision, err := gotenberg.DecideOutbound(r.Context(), rawURL, p.opts.allowList, p.opts.denyList, deadline,
+		gotenberg.WithDenyPrivateIPs(p.opts.denyPrivateIPs),
+		gotenberg.WithDenyPublicIPs(p.opts.denyPublicIPs),
+	)
+	if err != nil {
+		p.logger.WarnContext(r.Context(), fmt.Sprintf("LibreOffice proxy rejected CONNECT to '%s': %s", rawURL, err))
+		http.Error(w, "proxy: destination rejected", http.StatusForbidden)
+		return
+	}
+
+	var dest net.Conn
+	switch {
+	case len(decision.Pinned) > 0:
+		dest, err = gotenberg.DialPinned(r.Context(), "tcp", decision.Pinned, port)
+	default:
+		// Bypass (allow-list match) or non-http-like scheme: dial directly.
+		// gosec G704: host:port has cleared DecideOutbound above.
+		dest, err = net.DialTimeout("tcp", net.JoinHostPort(host, port), 10*time.Second) //nolint:gosec
+	}
+	if err != nil {
+		p.logger.WarnContext(r.Context(), fmt.Sprintf("LibreOffice proxy CONNECT dial to '%s' failed: %s", rawURL, err))
+		http.Error(w, "proxy: dial failed", http.StatusBadGateway)
+		return
+	}
+
+	hijacker, ok := w.(http.Hijacker)
+	if !ok {
+		_ = dest.Close()
+		http.Error(w, "proxy: hijack unsupported", http.StatusInternalServerError)
+		return
+	}
+	client, _, err := hijacker.Hijack()
+	if err != nil {
+		_ = dest.Close()
+		p.logger.WarnContext(r.Context(), fmt.Sprintf("LibreOffice proxy hijack failed: %s", err))
+		return
+	}
+
+	_, writeErr := client.Write([]byte("HTTP/1.1 200 Connection Established\r\n\r\n"))
+	if writeErr != nil {
+		_ = client.Close()
+		_ = dest.Close()
+		return
+	}
+
+	go pipeAndClose(client, dest)
+	go pipeAndClose(dest, client)
+}
+
+// pipeAndClose copies bytes from src to dst and closes both ends when
+// the copy finishes.
+func pipeAndClose(dst, src net.Conn) {
+	defer func() {
+		_ = dst.Close()
+		_ = src.Close()
+	}()
+	_, _ = io.Copy(dst, src)
+}
+
+// hopByHopHeaders is the set of hop-by-hop headers from RFC 7230 6.1
+// plus the ones soffice adds when acting as a forward-proxy client.
+var hopByHopHeaders = []string{
+	"Connection",
+	"Proxy-Connection",
+	"Keep-Alive",
+	"Proxy-Authenticate",
+	"Proxy-Authorization",
+	"Te",
+	"Trailer",
+	"Transfer-Encoding",
+	"Upgrade",
+}
+
+// sofficeProxyConfigTmpl is the registrymodifications.xcu fragment that
+// tells soffice's UCB layer to route every HTTP and HTTPS fetch through
+// proxyHost:proxyPort. The %s placeholders accept the proxy host and
+// port respectively (host first, port second, repeated for HTTP and
+// HTTPS).
+const sofficeProxyConfigTmpl = `<?xml version="1.0" encoding="UTF-8"?>
+<oor:items xmlns:oor="http://openoffice.org/2001/registry" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+  <item oor:path="/org.openoffice.Inet/Settings"><prop oor:name="ooInetProxyType" oor:op="fuse"><value>1</value></prop></item>
+  <item oor:path="/org.openoffice.Inet/Settings"><prop oor:name="ooInetHTTPProxyName" oor:op="fuse"><value>%s</value></prop></item>
+  <item oor:path="/org.openoffice.Inet/Settings"><prop oor:name="ooInetHTTPProxyPort" oor:op="fuse"><value>%s</value></prop></item>
+  <item oor:path="/org.openoffice.Inet/Settings"><prop oor:name="ooInetHTTPSProxyName" oor:op="fuse"><value>%s</value></prop></item>
+  <item oor:path="/org.openoffice.Inet/Settings"><prop oor:name="ooInetHTTPSProxyPort" oor:op="fuse"><value>%s</value></prop></item>
+  <item oor:path="/org.openoffice.Inet/Settings"><prop oor:name="ooInetNoProxy" oor:op="fuse"><value></value></prop></item>
+</oor:items>
+`
+
+// writeSofficeProxyConfig drops a registrymodifications.xcu file into
+// userProfileDirPath/user/ that points soffice's UCB layer at proxyAddr
+// for both HTTP and HTTPS. proxyAddr must be a host:port pair.
+func writeSofficeProxyConfig(userProfileDirPath, proxyAddr string) error {
+	host, port, err := net.SplitHostPort(proxyAddr)
+	if err != nil {
+		return fmt.Errorf("split proxy address %q: %w", proxyAddr, err)
+	}
+
+	userDir := userProfileDirPath + "/user"
+	err = os.MkdirAll(userDir, 0o755)
+	if err != nil {
+		return fmt.Errorf("create soffice user profile directory: %w", err)
+	}
+
+	body := fmt.Sprintf(sofficeProxyConfigTmpl, host, port, host, port)
+	err = os.WriteFile(userDir+"/registrymodifications.xcu", []byte(body), 0o600)
+	if err != nil {
+		return fmt.Errorf("write registrymodifications.xcu: %w", err)
+	}
+
+	return nil
+}
+
+// sofficeProxyEnv overlays http_proxy/https_proxy on env so soffice's
+// libcurl path also routes through proxyAddr. The environment variables
+// supplement the registrymodifications.xcu config so coverage stays
+// intact if soffice upgrades and one of the two paths regresses.
+func sofficeProxyEnv(env []string, proxyAddr string) []string {
+	proxyURL := "http://" + proxyAddr
+
+	filtered := env[:0:0]
+	for _, kv := range env {
+		switch strings.ToLower(strings.SplitN(kv, "=", 2)[0]) {
+		case "http_proxy", "https_proxy", "no_proxy":
+			continue
+		}
+		filtered = append(filtered, kv)
+	}
+
+	return append(filtered,
+		"http_proxy="+proxyURL,
+		"https_proxy="+proxyURL,
+		"HTTP_PROXY="+proxyURL,
+		"HTTPS_PROXY="+proxyURL,
+		"no_proxy=",
+		"NO_PROXY=",
+	)
+}
+
+func removeHopByHopHeaders(h http.Header) {
+	if connection := h.Get("Connection"); connection != "" {
+		for name := range strings.SplitSeq(connection, ",") {
+			h.Del(strings.TrimSpace(name))
+		}
+	}
+	for _, name := range hopByHopHeaders {
+		h.Del(name)
+	}
+}

pkg/modules/libreoffice/api/proxy_test.go

@@ -0,0 +1,369 @@
+package api
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/dlclark/regexp2"
+)
+
+func compileRegexes(t *testing.T, patterns ...string) []*regexp2.Regexp {
+	t.Helper()
+	out := make([]*regexp2.Regexp, 0, len(patterns))
+	for _, p := range patterns {
+		r, err := regexp2.Compile(p, 0)
+		if err != nil {
+			t.Fatalf("compile %q: %v", p, err)
+		}
+		out = append(out, r)
+	}
+	return out
+}
+
+func startProxy(t *testing.T, opts outboundProxyOptions) *libreOfficeProxy {
+	t.Helper()
+	p, err := newLibreOfficeProxy(slog.New(slog.DiscardHandler), opts)
+	if err != nil {
+		t.Fatalf("new proxy: %v", err)
+	}
+	p.Start()
+	t.Cleanup(func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+		defer cancel()
+		_ = p.Stop(ctx)
+	})
+	return p
+}
+
+func TestLibreOfficeProxy_HttpForwardAllowed(t *testing.T) {
+	origin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusTeapot)
+		_, _ = w.Write([]byte("hello"))
+	}))
+	defer origin.Close()
+
+	p := startProxy(t, outboundProxyOptions{})
+
+	proxyURL, _ := url.Parse("http://" + p.Addr())
+	client := &http.Client{
+		Transport: &http.Transport{Proxy: http.ProxyURL(proxyURL)},
+		Timeout:   5 * time.Second,
+	}
+
+	resp, err := client.Get(origin.URL + "/foo")
+	if err != nil {
+		t.Fatalf("client.Get: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusTeapot {
+		t.Fatalf("status: got %d, want %d", resp.StatusCode, http.StatusTeapot)
+	}
+	body, _ := io.ReadAll(resp.Body)
+	if string(body) != "hello" {
+		t.Fatalf("body: got %q, want %q", body, "hello")
+	}
+}
+
+func TestLibreOfficeProxy_HttpForwardDenyListRejects(t *testing.T) {
+	origin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		t.Fatal("origin must not be reached")
+	}))
+	defer origin.Close()
+
+	p := startProxy(t, outboundProxyOptions{
+		denyList: compileRegexes(t, `.*`),
+	})
+
+	proxyURL, _ := url.Parse("http://" + p.Addr())
+	client := &http.Client{
+		Transport: &http.Transport{Proxy: http.ProxyURL(proxyURL)},
+		Timeout:   5 * time.Second,
+	}
+
+	resp, err := client.Get(origin.URL + "/foo")
+	if err != nil {
+		t.Fatalf("client.Get: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusForbidden {
+		t.Fatalf("status: got %d, want %d", resp.StatusCode, http.StatusForbidden)
+	}
+}
+
+func TestLibreOfficeProxy_HttpForwardDenyPrivateIPsRejects(t *testing.T) {
+	// httptest binds on 127.0.0.1 (a private IP), so denyPrivateIPs
+	// must reject the forward.
+	origin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		t.Fatal("origin must not be reached")
+	}))
+	defer origin.Close()
+
+	p := startProxy(t, outboundProxyOptions{denyPrivateIPs: true})
+
+	proxyURL, _ := url.Parse("http://" + p.Addr())
+	client := &http.Client{
+		Transport: &http.Transport{Proxy: http.ProxyURL(proxyURL)},
+		Timeout:   5 * time.Second,
+	}
+
+	resp, err := client.Get(origin.URL + "/foo")
+	if err != nil {
+		t.Fatalf("client.Get: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusForbidden {
+		t.Fatalf("status: got %d, want %d", resp.StatusCode, http.StatusForbidden)
+	}
+}
+
+func TestLibreOfficeProxy_ConnectTunnelHappyPath(t *testing.T) {
+	// Bring up a tiny TCP echo server.
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen echo: %v", err)
+	}
+	defer listener.Close()
+
+	go func() {
+		conn, acceptErr := listener.Accept()
+		if acceptErr != nil {
+			return
+		}
+		defer conn.Close()
+		_, _ = io.Copy(conn, conn)
+	}()
+
+	p := startProxy(t, outboundProxyOptions{})
+
+	conn, err := net.DialTimeout("tcp", p.Addr(), 2*time.Second)
+	if err != nil {
+		t.Fatalf("dial proxy: %v", err)
+	}
+	defer conn.Close()
+
+	target := listener.Addr().String()
+	_, err = fmt.Fprintf(conn, "CONNECT %s HTTP/1.1\r\nHost: %s\r\n\r\n", target, target)
+	if err != nil {
+		t.Fatalf("write CONNECT: %v", err)
+	}
+
+	reader := bufio.NewReader(conn)
+	statusLine, err := reader.ReadString('\n')
+	if err != nil {
+		t.Fatalf("read CONNECT response: %v", err)
+	}
+	if !strings.Contains(statusLine, "200") {
+		t.Fatalf("CONNECT status: got %q, want 200", statusLine)
+	}
+	// Drain remaining headers.
+	for {
+		line, readErr := reader.ReadString('\n')
+		if readErr != nil {
+			t.Fatalf("read CONNECT headers: %v", readErr)
+		}
+		if line == "\r\n" || line == "\n" {
+			break
+		}
+	}
+
+	// Tunnel established. Round-trip a payload through the echo server.
+	want := "ping"
+	_, err = conn.Write([]byte(want))
+	if err != nil {
+		t.Fatalf("write payload: %v", err)
+	}
+
+	got := make([]byte, len(want))
+	_, err = io.ReadFull(reader, got)
+	if err != nil {
+		t.Fatalf("read echo: %v", err)
+	}
+	if string(got) != want {
+		t.Fatalf("echo: got %q, want %q", got, want)
+	}
+}
+
+func TestLibreOfficeProxy_ConnectDenyListRejects(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	defer listener.Close()
+
+	p := startProxy(t, outboundProxyOptions{denyList: compileRegexes(t, `.*`)})
+
+	conn, err := net.DialTimeout("tcp", p.Addr(), 2*time.Second)
+	if err != nil {
+		t.Fatalf("dial proxy: %v", err)
+	}
+	defer conn.Close()
+
+	target := listener.Addr().String()
+	_, err = fmt.Fprintf(conn, "CONNECT %s HTTP/1.1\r\nHost: %s\r\n\r\n", target, target)
+	if err != nil {
+		t.Fatalf("write CONNECT: %v", err)
+	}
+
+	reader := bufio.NewReader(conn)
+	statusLine, err := reader.ReadString('\n')
+	if err != nil {
+		t.Fatalf("read response: %v", err)
+	}
+	if !strings.Contains(statusLine, "403") {
+		t.Fatalf("CONNECT status: got %q, want 403", statusLine)
+	}
+}
+
+func TestLibreOfficeProxy_ConnectDenyPrivateIPsRejects(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	defer listener.Close()
+
+	p := startProxy(t, outboundProxyOptions{denyPrivateIPs: true})
+
+	conn, err := net.DialTimeout("tcp", p.Addr(), 2*time.Second)
+	if err != nil {
+		t.Fatalf("dial proxy: %v", err)
+	}
+	defer conn.Close()
+
+	// 127.0.0.1 is a private IP under denyPrivateIPs.
+	target := listener.Addr().String()
+	_, err = fmt.Fprintf(conn, "CONNECT %s HTTP/1.1\r\nHost: %s\r\n\r\n", target, target)
+	if err != nil {
+		t.Fatalf("write CONNECT: %v", err)
+	}
+
+	reader := bufio.NewReader(conn)
+	statusLine, err := reader.ReadString('\n')
+	if err != nil {
+		t.Fatalf("read response: %v", err)
+	}
+	if !strings.Contains(statusLine, "403") {
+		t.Fatalf("CONNECT status: got %q, want 403", statusLine)
+	}
+}
+
+func TestLibreOfficeProxy_StopIsIdempotent(t *testing.T) {
+	p, err := newLibreOfficeProxy(slog.New(slog.DiscardHandler), outboundProxyOptions{})
+	if err != nil {
+		t.Fatalf("new proxy: %v", err)
+	}
+	p.Start()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+
+	if err := p.Stop(ctx); err != nil {
+		t.Fatalf("first Stop: %v", err)
+	}
+	if err := p.Stop(ctx); err != nil {
+		t.Fatalf("second Stop: %v", err)
+	}
+}
+
+func TestWriteSofficeProxyConfig(t *testing.T) {
+	dir := t.TempDir()
+
+	if err := writeSofficeProxyConfig(dir, "127.0.0.1:9876"); err != nil {
+		t.Fatalf("writeSofficeProxyConfig: %v", err)
+	}
+
+	body, err := os.ReadFile(filepath.Join(dir, "user", "registrymodifications.xcu"))
+	if err != nil {
+		t.Fatalf("read xcu: %v", err)
+	}
+
+	for _, want := range []string{
+		`ooInetProxyType`, `<value>1</value>`,
+		`ooInetHTTPProxyName`, `<value>127.0.0.1</value>`,
+		`ooInetHTTPProxyPort`, `<value>9876</value>`,
+		`ooInetHTTPSProxyName`, `ooInetHTTPSProxyPort`,
+	} {
+		if !strings.Contains(string(body), want) {
+			t.Errorf("xcu missing %q\nfull body:\n%s", want, body)
+		}
+	}
+}
+
+func TestWriteSofficeProxyConfig_InvalidAddr(t *testing.T) {
+	err := writeSofficeProxyConfig(t.TempDir(), "not-a-host-port")
+	if err == nil {
+		t.Fatal("expected error for malformed proxy address")
+	}
+	if !errors.Is(err, errors.Unwrap(err)) {
+		// Only checking that an error was returned; underlying error type is
+		// implementation detail.
+		_ = err
+	}
+}
+
+func TestSofficeProxyEnv_OverridesExisting(t *testing.T) {
+	in := []string{
+		"PATH=/usr/bin",
+		"http_proxy=http://attacker:1",
+		"HTTPS_PROXY=http://attacker:1",
+		"NO_PROXY=internal",
+		"USER=gotenberg",
+	}
+	out := sofficeProxyEnv(in, "127.0.0.1:9876")
+
+	want := map[string]string{
+		"http_proxy":  "http://127.0.0.1:9876",
+		"https_proxy": "http://127.0.0.1:9876",
+		"HTTP_PROXY":  "http://127.0.0.1:9876",
+		"HTTPS_PROXY": "http://127.0.0.1:9876",
+		"no_proxy":    "",
+		"NO_PROXY":    "",
+	}
+
+	got := map[string]string{}
+	for _, kv := range out {
+		parts := strings.SplitN(kv, "=", 2)
+		got[parts[0]] = parts[1]
+	}
+
+	for key, value := range want {
+		if got[key] != value {
+			t.Errorf("env[%s]: got %q, want %q", key, got[key], value)
+		}
+	}
+
+	// Pre-existing unrelated keys must survive.
+	if got["PATH"] != "/usr/bin" {
+		t.Errorf("env[PATH]: got %q, want /usr/bin", got["PATH"])
+	}
+	if got["USER"] != "gotenberg" {
+		t.Errorf("env[USER]: got %q, want gotenberg", got["USER"])
+	}
+
+	// Old proxy values must be gone, not duplicated. Count exact-case keys.
+	counts := map[string]int{}
+	for _, kv := range out {
+		key := strings.SplitN(kv, "=", 2)[0]
+		counts[key]++
+	}
+	for _, key := range []string{"http_proxy", "HTTP_PROXY", "https_proxy", "HTTPS_PROXY", "no_proxy", "NO_PROXY"} {
+		if counts[key] != 1 {
+			t.Errorf("env[%s] count: got %d, want 1", key, counts[key])
+		}
+	}
+}

pkg/modules/libreoffice/pdfengine/pdfengine.go

@@ -115,6 +115,11 @@ func (engine *LibreOfficePdfEngine) EmbedFiles(ctx context.Context, logger *slog
 	return fmt.Errorf("embed files with LibreOffice: %w", gotenberg.ErrPdfEngineMethodNotSupported)
 }
 
+// EmbedFilesMetadata is not available in this implementation.
+func (engine *LibreOfficePdfEngine) EmbedFilesMetadata(ctx context.Context, logger *slog.Logger, metadata map[string]map[string]string, inputPath string) error {
+	return fmt.Errorf("set embeds metadata with LibreOffice: %w", gotenberg.ErrPdfEngineMethodNotSupported)
+}
+
 // Watermark is not available in this implementation.
 func (engine *LibreOfficePdfEngine) Watermark(ctx context.Context, logger *slog.Logger, inputPath string, stamp gotenberg.Stamp) error {
 	return fmt.Errorf("watermark PDF with LibreOffice: %w", gotenberg.ErrPdfEngineMethodNotSupported)

pkg/modules/libreoffice/routes.go

@@ -37,6 +37,7 @@ func convertRoute(libreOffice libreofficeapi.Uno, engine gotenberg.PdfEngine) ap
 			stamp := pdfengines.FormDataPdfStamp(form, false)
 			stampFile := pdfengines.FormDataPdfStampFile(form)
 			angle, rotatePages := pdfengines.FormDataPdfRotate(form, false)
+			embedsMetadata := pdfengines.FormDataPdfEmbedsMetadata(form)
 
 			zeroValuedSplitMode := gotenberg.SplitMode{}
 
@@ -303,11 +304,13 @@ func convertRoute(libreOffice libreofficeapi.Uno, engine gotenberg.PdfEngine) ap
 				return fmt.Errorf("validate form data: %w", err)
 			}
 
-			if (watermark.Source == gotenberg.StampSourceImage || watermark.Source == gotenberg.StampSourcePDF) && watermarkFile != "" {
-				watermark.Expression = watermarkFile
+			err = pdfengines.EnsureWatermarkFile(&watermark, watermarkFile)
+			if err != nil {
+				return fmt.Errorf("validate watermark: %w", err)
 			}
-			if (stamp.Source == gotenberg.StampSourceImage || stamp.Source == gotenberg.StampSourcePDF) && stampFile != "" {
-				stamp.Expression = stampFile
+			err = pdfengines.EnsureStampFile(&stamp, stampFile)
+			if err != nil {
+				return fmt.Errorf("validate stamp: %w", err)
 			}
 
 			err = pdfengines.ValidatePdfFormatsCompat(pdfFormats, userPassword, embedPaths)
@@ -495,6 +498,11 @@ func convertRoute(libreOffice libreofficeapi.Uno, engine gotenberg.PdfEngine) ap
 				return fmt.Errorf("embed files into PDFs: %w", err)
 			}
 
+			err = pdfengines.EmbedFilesMetadataStub(ctx, engine, embedsMetadata, outputPaths)
+			if err != nil {
+				return fmt.Errorf("set embeds metadata: %w", err)
+			}
+
 			err = pdfengines.EncryptPdfStub(ctx, engine, userPassword, ownerPassword, outputPaths)
 			if err != nil {
 				return fmt.Errorf("encrypt PDFs: %w", err)

pkg/modules/pdfcpu/pdfcpu.go

@@ -142,14 +142,14 @@ func (engine *PdfCpu) Split(ctx context.Context, logger *slog.Logger, mode goten
 
 	switch mode.Mode {
 	case gotenberg.SplitModeIntervals:
-		args = append(args, "split", "-mode", "span", inputPath, outputDirPath, mode.Span)
+		args = append(args, "split", "--mode", "span", inputPath, outputDirPath, mode.Span)
 	case gotenberg.SplitModePages:
 		if mode.Unify {
 			outputPath := fmt.Sprintf("%s/%s", outputDirPath, filepath.Base(inputPath))
-			args = append(args, "trim", "-pages", mode.Span, inputPath, outputPath)
+			args = append(args, "trim", "--pages", mode.Span, inputPath, outputPath)
 			break
 		}
-		args = append(args, "extract", "-mode", "page", "-pages", mode.Span, inputPath, outputDirPath)
+		args = append(args, "extract", "--mode", "page", "--pages", mode.Span, inputPath, outputDirPath)
 	default:
 		err := fmt.Errorf("split PDFs using mode '%s' with pdfcpu: %w", mode.Mode, gotenberg.ErrPdfSplitModeNotSupported)
 		span.RecordError(err)
@@ -426,7 +426,7 @@ func (engine *PdfCpu) WriteBookmarks(ctx context.Context, logger *slog.Logger, i
 		}
 	}()
 
-	args := []string{"bookmarks", "import", "-replace", inputPath, tmpPath, inputPath}
+	args := []string{"bookmarks", "import", "--replace", inputPath, tmpPath, inputPath}
 	cmd, err := gotenberg.CommandContext(ctx, logger, engine.binPath, args...)
 	if err != nil {
 		err = fmt.Errorf("create command: %w", err)
@@ -447,6 +447,11 @@ func (engine *PdfCpu) WriteBookmarks(ctx context.Context, logger *slog.Logger, i
 	return nil
 }
 
+// EmbedFilesMetadata is not available in this implementation.
+func (engine *PdfCpu) EmbedFilesMetadata(ctx context.Context, logger *slog.Logger, metadata map[string]map[string]string, inputPath string) error {
+	return fmt.Errorf("set embeds metadata with pdfcpu: %w", gotenberg.ErrPdfEngineMethodNotSupported)
+}
+
 // EmbedFiles embeds files into a PDF. All files are embedded as file attachments
 // without modifying the main PDF content.
 func (engine *PdfCpu) EmbedFiles(ctx context.Context, logger *slog.Logger, filePaths []string, inputPath string) error {
@@ -508,10 +513,10 @@ func (engine *PdfCpu) Encrypt(ctx context.Context, logger *slog.Logger, inputPat
 
 	args := make([]string, 0, 11)
 	args = append(args, "encrypt")
-	args = append(args, "-mode", "aes")
-	args = append(args, "-upw", userPassword)
-	args = append(args, "-opw", ownerPassword)
-	args = append(args, "-perm", "all")
+	args = append(args, "--mode", "aes")
+	args = append(args, "--upw", userPassword)
+	args = append(args, "--opw", ownerPassword)
+	args = append(args, "--perm", "all")
 	args = append(args, inputPath, inputPath)
 
 	cmd, err := gotenberg.CommandContext(ctx, logger, engine.binPath, args...)
@@ -582,7 +587,7 @@ func (engine *PdfCpu) Rotate(ctx context.Context, logger *slog.Logger, inputPath
 
 	args := []string{"rotate"}
 	if pages != "" {
-		args = append(args, "-pages", pages)
+		args = append(args, "--pages", pages)
 	}
 	args = append(args, "--", inputPath, strconv.Itoa(angle), inputPath)
 
@@ -626,10 +631,10 @@ func (engine *PdfCpu) applyStampOrWatermark(ctx context.Context, logger *slog.Lo
 	}
 	description := strings.Join(descParts, ", ")
 
-	args := []string{command, "add", "-mode", mode}
+	args := []string{command, "add", "--mode", mode}
 
 	if stamp.Pages != "" {
-		args = append(args, "-pages", stamp.Pages)
+		args = append(args, "--pages", stamp.Pages)
 	}
 
 	args = append(args, "--", stamp.Expression, description, inputPath, inputPath)

pkg/modules/pdfengines/README.md

@@ -1,14 +1,17 @@
 # Adding PDF Engine Features
 
-Each new PDF engine capability (e.g., bookmarks, watermark, stamp, embed) requires a matching Makefile entry. The Makefile variables control which engines are passed to Gotenberg at `make run` and `make test-integration` time (via `compose.yaml`). If you skip this step, the flag still works when set manually, but `make run` falls back to the default defined in `pdfengines.go`, which may not include the new engine.
+Each new PDF engine capability (bookmarks, watermark, stamp, embed, etc.) requires a matching Makefile entry. The Makefile variables control which engines are passed to Gotenberg at `make run` and `make test-integration` time via `compose.yaml`. Skip this step and `make run` falls back to the default defined in `pdfengines.go`, which may not include the new engine.
 
-Every `--pdfengines-*-engines` flag registered in `pkg/modules/pdfengines/pdfengines.go` must have a corresponding variable and flag in the Makefile:
+Every `--pdfengines-*-engines` flag registered in `pdfengines.go` needs two additions:
+
+1. A variable in the Makefile's variable block (around line 60-70):
 
-1. **Add a variable** in the Makefile's variable block (around line 60 to 70):
    ```makefile
    PDFENGINES_<FEATURE>_ENGINES=<default engines>
    ```
-2. **Add the flag** in `compose.yaml`'s command args:
+
+2. A flag in `compose.yaml`'s command args:
+
    ```yaml
    - "--pdfengines-<feature>-engines=${PDFENGINES_<FEATURE>_ENGINES}"
    ```
@@ -17,7 +20,7 @@ The default value must match the `fs.StringSlice(...)` call for that flag in `pd
 
 ## Example: Rotate
 
-The rotate feature was added with two engines (`pdfcpu` and `pdftk`). Here is what the additions look like:
+Rotate was added with two engines (`pdfcpu` and `pdftk`):
 
 **Makefile** (variable block):
 

pkg/modules/pdfengines/multi.go

@@ -22,6 +22,7 @@ type multiPdfEngines struct {
 	writeMetadataEngines  []gotenberg.PdfEngine
 	passwordEngines       []gotenberg.PdfEngine
 	embedEngines          []gotenberg.PdfEngine
+	embedMetadataEngines  []gotenberg.PdfEngine
 	readBookmarksEngines  []gotenberg.PdfEngine
 	writeBookmarksEngines []gotenberg.PdfEngine
 	watermarkEngines      []gotenberg.PdfEngine
@@ -38,6 +39,7 @@ func newMultiPdfEngines(
 	writeMetadataEngines,
 	passwordEngines,
 	embedEngines,
+	embedMetadataEngines,
 	readBookmarksEngines,
 	writeBookmarksEngines,
 	watermarkEngines,
@@ -53,6 +55,7 @@ func newMultiPdfEngines(
 		writeMetadataEngines:  writeMetadataEngines,
 		passwordEngines:       passwordEngines,
 		embedEngines:          embedEngines,
+		embedMetadataEngines:  embedMetadataEngines,
 		readBookmarksEngines:  readBookmarksEngines,
 		writeBookmarksEngines: writeBookmarksEngines,
 		watermarkEngines:      watermarkEngines,
@@ -603,6 +606,43 @@ func (multi *multiPdfEngines) Rotate(ctx context.Context, logger *slog.Logger, i
 	return err
 }
 
+// EmbedFilesMetadata sets metadata on embedded files using the first available
+// engine that supports it.
+//
+//nolint:dupl
+func (multi *multiPdfEngines) EmbedFilesMetadata(ctx context.Context, logger *slog.Logger, metadata map[string]map[string]string, inputPath string) error {
+	tracer := gotenberg.Tracer()
+	ctx, span := tracer.Start(ctx, "pdfengines.EmbedFilesMetadata", trace.WithSpanKind(trace.SpanKindInternal))
+	defer span.End()
+
+	var err error
+	errChan := make(chan error, 1)
+
+	for _, engine := range multi.embedMetadataEngines {
+		go func(engine gotenberg.PdfEngine) {
+			errChan <- engine.EmbedFilesMetadata(ctx, logger, metadata, inputPath)
+		}(engine)
+
+		select {
+		case setErr := <-errChan:
+			if setErr != nil {
+				err = errors.Join(err, setErr)
+			} else {
+				span.SetStatus(codes.Ok, "")
+				return nil
+			}
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+	}
+
+	err = fmt.Errorf("set embeds metadata using multi PDF engines: %w", err)
+	span.RecordError(err)
+	span.SetStatus(codes.Error, err.Error())
+
+	return err
+}
+
 // Interface guards.
 var (
 	_ gotenberg.PdfEngine = (*multiPdfEngines)(nil)

pkg/modules/pdfengines/pdfengines.go

@@ -36,6 +36,7 @@ type PdfEngines struct {
 	writeMetadataNames  []string
 	encryptNames        []string
 	embedNames          []string
+	embedMetadataNames  []string
 	readBookmarksNames  []string
 	writeBookmarksNames []string
 	watermarkNames      []string
@@ -59,6 +60,7 @@ func (mod *PdfEngines) Descriptor() gotenberg.ModuleDescriptor {
 			fs.StringSlice("pdfengines-write-metadata-engines", []string{"exiftool"}, "Set the PDF engines and their order for the write metadata feature - empty means all")
 			fs.StringSlice("pdfengines-encrypt-engines", []string{"qpdf", "pdftk", "pdfcpu"}, "Set the PDF engines and their order for the password protection feature - empty means all")
 			fs.StringSlice("pdfengines-embed-engines", []string{"pdfcpu"}, "Set the PDF engines and their order for the file embedding feature - empty means all")
+			fs.StringSlice("pdfengines-embed-metadata-engines", []string{"qpdf"}, "Set the PDF engines and their order for the embed metadata feature - empty means all")
 			fs.StringSlice("pdfengines-read-bookmarks-engines", []string{"pdfcpu"}, "Set the PDF engines and their order for the read bookmarks feature - empty means all")
 			fs.StringSlice("pdfengines-write-bookmarks-engines", []string{"pdfcpu"}, "Set the PDF engines and their order for the write bookmarks feature - empty means all")
 			fs.StringSlice("pdfengines-watermark-engines", []string{"pdfcpu", "pdftk"}, "Set the PDF engines and their order for the watermark feature - empty means all")
@@ -91,6 +93,7 @@ func (mod *PdfEngines) Provision(ctx *gotenberg.Context) error {
 	writeMetadataNames := flags.MustStringSlice("pdfengines-write-metadata-engines")
 	encryptNames := flags.MustStringSlice("pdfengines-encrypt-engines")
 	embedNames := flags.MustStringSlice("pdfengines-embed-engines")
+	embedMetadataNames := flags.MustStringSlice("pdfengines-embed-metadata-engines")
 	readBookmarksNames := flags.MustStringSlice("pdfengines-read-bookmarks-engines")
 	writeBookmarksNames := flags.MustStringSlice("pdfengines-write-bookmarks-engines")
 	watermarkNames := flags.MustStringSlice("pdfengines-watermark-engines")
@@ -162,6 +165,11 @@ func (mod *PdfEngines) Provision(ctx *gotenberg.Context) error {
 		mod.embedNames = embedNames
 	}
 
+	mod.embedMetadataNames = defaultNames
+	if len(embedMetadataNames) > 0 {
+		mod.embedMetadataNames = embedMetadataNames
+	}
+
 	mod.readBookmarksNames = defaultNames
 	if len(readBookmarksNames) > 0 {
 		mod.readBookmarksNames = readBookmarksNames
@@ -236,6 +244,7 @@ func (mod *PdfEngines) Validate() error {
 	findNonExistingEngines(mod.writeMetadataNames)
 	findNonExistingEngines(mod.encryptNames)
 	findNonExistingEngines(mod.embedNames)
+	findNonExistingEngines(mod.embedMetadataNames)
 	findNonExistingEngines(mod.readBookmarksNames)
 	findNonExistingEngines(mod.writeBookmarksNames)
 	findNonExistingEngines(mod.watermarkNames)
@@ -261,6 +270,7 @@ func (mod *PdfEngines) SystemMessages() []string {
 		fmt.Sprintf("write metadata engines - %s", strings.Join(mod.writeMetadataNames, " ")),
 		fmt.Sprintf("encrypt engines - %s", strings.Join(mod.encryptNames, " ")),
 		fmt.Sprintf("embed engines - %s", strings.Join(mod.embedNames, " ")),
+		fmt.Sprintf("embed metadata engines - %s", strings.Join(mod.embedMetadataNames, " ")),
 		fmt.Sprintf("read bookmarks engines - %s", strings.Join(mod.readBookmarksNames, " ")),
 		fmt.Sprintf("write bookmarks engines - %s", strings.Join(mod.writeBookmarksNames, " ")),
 		fmt.Sprintf("watermark engines - %s", strings.Join(mod.watermarkNames, " ")),
@@ -294,6 +304,7 @@ func (mod *PdfEngines) PdfEngine() (gotenberg.PdfEngine, error) {
 		engines(mod.writeMetadataNames),
 		engines(mod.encryptNames),
 		engines(mod.embedNames),
+		engines(mod.embedMetadataNames),
 		engines(mod.readBookmarksNames),
 		engines(mod.writeBookmarksNames),
 		engines(mod.watermarkNames),

pkg/modules/pdfengines/routes.go

@@ -443,6 +443,30 @@ func FormDataPdfEmbeds(form *api.FormData) []string {
 	return embedPaths
 }
 
+// FormDataPdfEmbedsMetadata extracts embeds metadata from form data.
+// The "embedsMetadata" field is a JSON string keyed by filename.
+func FormDataPdfEmbedsMetadata(form *api.FormData) map[string]map[string]string {
+	var metadata map[string]map[string]string
+	form.EmbedsMetadata(&metadata)
+	return metadata
+}
+
+// EmbedFilesMetadataStub sets metadata on embedded files in PDFs.
+func EmbedFilesMetadataStub(ctx *api.Context, engine gotenberg.PdfEngine, metadata map[string]map[string]string, inputPaths []string) error {
+	if len(metadata) == 0 {
+		return nil
+	}
+
+	for _, inputPath := range inputPaths {
+		err := engine.EmbedFilesMetadata(ctx, ctx.Log(), metadata, inputPath)
+		if err != nil {
+			return fmt.Errorf("set embeds metadata on PDF '%s': %w", inputPath, err)
+		}
+	}
+
+	return nil
+}
+
 // FormDataPdfEncrypt extracts encryption parameters from form data.
 func FormDataPdfEncrypt(form *api.FormData) (userPassword, ownerPassword string) {
 	form.String("userPassword", &userPassword, "")
@@ -584,6 +608,50 @@ func FormDataPdfStampFile(form *api.FormData) string {
 	return path
 }
 
+// EnsureStampFile validates that, when stamp.Source is image or pdf, an
+// uploaded stamp file was supplied, and replaces stamp.Expression with
+// uploadedFile in that case. Returning an [api] HTTP 400 error prevents
+// an anonymous caller from passing an arbitrary filesystem path via
+// stampExpression and having pdfcpu read it. Source values of text or
+// empty are passed through unchanged.
+func EnsureStampFile(stamp *gotenberg.Stamp, uploadedFile string) error {
+	if stamp.Source != gotenberg.StampSourceImage && stamp.Source != gotenberg.StampSourcePDF {
+		return nil
+	}
+	if uploadedFile == "" {
+		return api.WrapError(
+			errors.New("no stamp file provided for image or pdf source"),
+			api.NewSentinelHttpError(
+				http.StatusBadRequest,
+				"Invalid form data: a stamp file is required for image or pdf source",
+			),
+		)
+	}
+	stamp.Expression = uploadedFile
+	return nil
+}
+
+// EnsureWatermarkFile mirrors [EnsureStampFile] for a watermark. The
+// shape is identical: image or pdf sources must be accompanied by an
+// uploaded file, and the file path replaces watermark.Expression to
+// prevent pdfcpu from reading an attacker-controlled path.
+func EnsureWatermarkFile(watermark *gotenberg.Stamp, uploadedFile string) error {
+	if watermark.Source != gotenberg.StampSourceImage && watermark.Source != gotenberg.StampSourcePDF {
+		return nil
+	}
+	if uploadedFile == "" {
+		return api.WrapError(
+			errors.New("no watermark file provided for image or pdf source"),
+			api.NewSentinelHttpError(
+				http.StatusBadRequest,
+				"Invalid form data: a watermark file is required for image or pdf source",
+			),
+		)
+	}
+	watermark.Expression = uploadedFile
+	return nil
+}
+
 // WatermarkStub applies a watermark to a list of PDF files. If the stamp has
 // no source, it does nothing.
 func WatermarkStub(ctx *api.Context, engine gotenberg.PdfEngine, stamp gotenberg.Stamp, inputPaths []string) error {
@@ -638,6 +706,7 @@ func mergeRoute(engine gotenberg.PdfEngine) api.Route {
 			stamp := FormDataPdfStamp(form, false)
 			stampFile := FormDataPdfStampFile(form)
 			angle, rotatePages := FormDataPdfRotate(form, false)
+			embedsMetadata := FormDataPdfEmbedsMetadata(form)
 
 			var inputPaths []string
 			var flatten bool
@@ -651,11 +720,13 @@ func mergeRoute(engine gotenberg.PdfEngine) api.Route {
 				return fmt.Errorf("validate form data: %w", err)
 			}
 
-			if (watermark.Source == gotenberg.StampSourceImage || watermark.Source == gotenberg.StampSourcePDF) && watermarkFile != "" {
-				watermark.Expression = watermarkFile
+			err = EnsureWatermarkFile(&watermark, watermarkFile)
+			if err != nil {
+				return fmt.Errorf("validate watermark: %w", err)
 			}
-			if (stamp.Source == gotenberg.StampSourceImage || stamp.Source == gotenberg.StampSourcePDF) && stampFile != "" {
-				stamp.Expression = stampFile
+			err = EnsureStampFile(&stamp, stampFile)
+			if err != nil {
+				return fmt.Errorf("validate stamp: %w", err)
 			}
 
 			err = ValidatePdfFormatsCompat(pdfFormats, userPassword, embedPaths)
@@ -754,6 +825,11 @@ func mergeRoute(engine gotenberg.PdfEngine) api.Route {
 				return fmt.Errorf("embed files into PDFs: %w", err)
 			}
 
+			err = EmbedFilesMetadataStub(ctx, engine, embedsMetadata, outputPaths)
+			if err != nil {
+				return fmt.Errorf("set embeds metadata: %w", err)
+			}
+
 			err = EncryptPdfStub(ctx, engine, userPassword, ownerPassword, outputPaths)
 			if err != nil {
 				return fmt.Errorf("encrypt PDFs: %w", err)
@@ -789,6 +865,7 @@ func splitRoute(engine gotenberg.PdfEngine) api.Route {
 			stamp := FormDataPdfStamp(form, false)
 			stampFile := FormDataPdfStampFile(form)
 			angle, rotatePages := FormDataPdfRotate(form, false)
+			embedsMetadata := FormDataPdfEmbedsMetadata(form)
 
 			var inputPaths []string
 			var flatten bool
@@ -800,11 +877,13 @@ func splitRoute(engine gotenberg.PdfEngine) api.Route {
 				return fmt.Errorf("validate form data: %w", err)
 			}
 
-			if (watermark.Source == gotenberg.StampSourceImage || watermark.Source == gotenberg.StampSourcePDF) && watermarkFile != "" {
-				watermark.Expression = watermarkFile
+			err = EnsureWatermarkFile(&watermark, watermarkFile)
+			if err != nil {
+				return fmt.Errorf("validate watermark: %w", err)
 			}
-			if (stamp.Source == gotenberg.StampSourceImage || stamp.Source == gotenberg.StampSourcePDF) && stampFile != "" {
-				stamp.Expression = stampFile
+			err = EnsureStampFile(&stamp, stampFile)
+			if err != nil {
+				return fmt.Errorf("validate stamp: %w", err)
 			}
 
 			err = ValidatePdfFormatsCompat(pdfFormats, userPassword, embedPaths)
@@ -856,6 +935,11 @@ func splitRoute(engine gotenberg.PdfEngine) api.Route {
 				return fmt.Errorf("embed files into PDFs: %w", err)
 			}
 
+			err = EmbedFilesMetadataStub(ctx, engine, embedsMetadata, convertOutputPaths)
+			if err != nil {
+				return fmt.Errorf("set embeds metadata: %w", err)
+			}
+
 			err = EncryptPdfStub(ctx, engine, userPassword, ownerPassword, convertOutputPaths)
 			if err != nil {
 				return fmt.Errorf("encrypt PDFs: %w", err)
@@ -1180,6 +1264,7 @@ func embedRoute(engine gotenberg.PdfEngine) api.Route {
 
 			form := ctx.FormData()
 			embedPaths := FormDataPdfEmbeds(form)
+			embedsMetadata := FormDataPdfEmbedsMetadata(form)
 
 			var inputPaths []string
 			err := form.
@@ -1193,6 +1278,11 @@ func embedRoute(engine gotenberg.PdfEngine) api.Route {
 				return fmt.Errorf("embed files into PDFs: %w", err)
 			}
 
+			err = EmbedFilesMetadataStub(ctx, engine, embedsMetadata, inputPaths)
+			if err != nil {
+				return fmt.Errorf("set embeds metadata: %w", err)
+			}
+
 			err = ctx.AddOutputPaths(inputPaths...)
 			if err != nil {
 				return fmt.Errorf("add output paths: %w", err)
@@ -1226,17 +1316,9 @@ func watermarkRoute(engine gotenberg.PdfEngine) api.Route {
 				return fmt.Errorf("validate form data: %w", err)
 			}
 
-			if stamp.Source == gotenberg.StampSourceImage || stamp.Source == gotenberg.StampSourcePDF {
-				if watermarkFile == "" {
-					return api.WrapError(
-						errors.New("no watermark file provided"),
-						api.NewSentinelHttpError(
-							http.StatusBadRequest,
-							"Invalid form data: a watermark file is required for image or pdf source",
-						),
-					)
-				}
-				stamp.Expression = watermarkFile
+			err = EnsureWatermarkFile(&stamp, watermarkFile)
+			if err != nil {
+				return fmt.Errorf("validate watermark: %w", err)
 			}
 
 			err = WatermarkStub(ctx, engine, stamp, inputPaths)
@@ -1277,17 +1359,9 @@ func stampRoute(engine gotenberg.PdfEngine) api.Route {
 				return fmt.Errorf("validate form data: %w", err)
 			}
 
-			if stamp.Source == gotenberg.StampSourceImage || stamp.Source == gotenberg.StampSourcePDF {
-				if stampFile == "" {
-					return api.WrapError(
-						errors.New("no stamp file provided"),
-						api.NewSentinelHttpError(
-							http.StatusBadRequest,
-							"Invalid form data: a stamp file is required for image or pdf source",
-						),
-					)
-				}
-				stamp.Expression = stampFile
+			err = EnsureStampFile(&stamp, stampFile)
+			if err != nil {
+				return fmt.Errorf("validate stamp: %w", err)
 			}
 
 			err = StampStub(ctx, engine, stamp, inputPaths)

pkg/modules/pdftk/pdftk.go

@@ -495,6 +495,11 @@ func (engine *PdfTk) Rotate(ctx context.Context, logger *slog.Logger, inputPath
 	return nil
 }
 
+// EmbedFilesMetadata is not available in this implementation.
+func (engine *PdfTk) EmbedFilesMetadata(ctx context.Context, logger *slog.Logger, metadata map[string]map[string]string, inputPath string) error {
+	return fmt.Errorf("set embeds metadata with PDFtk: %w", gotenberg.ErrPdfEngineMethodNotSupported)
+}
+
 // Interface guards.
 var (
 	_ gotenberg.Module      = (*PdfTk)(nil)

pkg/modules/qpdf/qpdf.go

@@ -3,12 +3,14 @@ package qpdf
 import (
 	"bytes"
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"log/slog"
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strings"
 	"syscall"
 
 	"go.opentelemetry.io/otel/codes"
@@ -348,6 +350,291 @@ func (engine *QPdf) EmbedFiles(ctx context.Context, logger *slog.Logger, filePat
 	return err
 }
 
+// EmbedFilesMetadata sets metadata on already-embedded files in a PDF using
+// QPDF's JSON manipulation. It sets /AFRelationship on Filespec objects,
+// /Subtype on EmbeddedFile streams, and ensures the Catalog /AF array
+// references the Filespec objects.
+func (engine *QPdf) EmbedFilesMetadata(ctx context.Context, logger *slog.Logger, metadata map[string]map[string]string, inputPath string) error {
+	ctx, span := gotenberg.Tracer().Start(ctx, "qpdf.EmbedFilesMetadata",
+		trace.WithSpanKind(trace.SpanKindClient),
+		trace.WithAttributes(semconv.ServerAddress(engine.binPath)),
+	)
+	defer span.End()
+
+	if len(metadata) == 0 {
+		span.SetStatus(codes.Ok, "")
+		return nil
+	}
+
+	logger.DebugContext(ctx, fmt.Sprintf("setting embeds metadata on %s with QPDF", inputPath))
+
+	args := append([]string{inputPath}, engine.globalArgs...)
+	args = append(args, "--newline-before-endstream", "--json-output")
+
+	output, err := engine.execCaptureOutput(ctx, args...)
+	if err != nil {
+		err = fmt.Errorf("get PDF JSON with QPDF: %w", err)
+		span.RecordError(err)
+		span.SetStatus(codes.Error, err.Error())
+		return err
+	}
+
+	objects, err := parsePdfObjects(output)
+	if err != nil {
+		span.RecordError(err)
+		span.SetStatus(codes.Error, err.Error())
+		return err
+	}
+
+	catalogRef, catalogValue, filespecRefs, updateObjects := patchFilespecMetadata(logger, objects, metadata)
+	if len(filespecRefs) == 0 {
+		span.SetStatus(codes.Ok, "")
+		return nil
+	}
+
+	patchCatalogAF(catalogRef, catalogValue, filespecRefs, updateObjects)
+
+	err = engine.writeAndApplyUpdate(ctx, logger, inputPath, updateObjects)
+	if err != nil {
+		span.RecordError(err)
+		span.SetStatus(codes.Error, err.Error())
+		return err
+	}
+
+	span.SetStatus(codes.Ok, "")
+	return nil
+}
+
+// execCaptureOutput runs QPDF and returns its stdout. This uses
+// exec.CommandContext directly because gotenberg.Cmd does not support
+// capturing stdout (it only pipes to debug logs).
+func (engine *QPdf) execCaptureOutput(ctx context.Context, args ...string) ([]byte, error) {
+	cmd := exec.CommandContext(ctx, engine.binPath, args...) //nolint:gosec
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+	return cmd.Output()
+}
+
+// parsePdfObjects parses QPDF JSON v2 output and returns the objects map.
+func parsePdfObjects(output []byte) (map[string]json.RawMessage, error) {
+	var pdfJSON struct {
+		Qpdf []json.RawMessage `json:"qpdf"`
+	}
+	if err := json.Unmarshal(output, &pdfJSON); err != nil {
+		return nil, fmt.Errorf("parse PDF JSON: %w", err)
+	}
+	if len(pdfJSON.Qpdf) < 2 {
+		return nil, fmt.Errorf("unexpected QPDF JSON structure: expected at least 2 elements")
+	}
+
+	var objects map[string]json.RawMessage
+	if err := json.Unmarshal(pdfJSON.Qpdf[1], &objects); err != nil {
+		return nil, fmt.Errorf("parse QPDF objects: %w", err)
+	}
+
+	return objects, nil
+}
+
+// patchFilespecMetadata walks QPDF objects to find Filespecs matching the
+// metadata keys. It sets /AFRelationship and /Subtype on matching objects
+// and returns the catalog reference, catalog value, filespec references,
+// and the update objects map.
+func patchFilespecMetadata(logger *slog.Logger, objects map[string]json.RawMessage, metadata map[string]map[string]string) (string, map[string]any, []string, map[string]any) {
+	updateObjects := make(map[string]any)
+	var catalogRef string
+	var catalogValue map[string]any
+	var filespecRefs []string
+
+	for ref, raw := range objects {
+		var obj map[string]json.RawMessage
+		if err := json.Unmarshal(raw, &obj); err != nil {
+			continue
+		}
+
+		valueRaw, hasValue := obj["value"]
+		if !hasValue {
+			continue
+		}
+
+		var value map[string]any
+		if err := json.Unmarshal(valueRaw, &value); err != nil {
+			continue
+		}
+
+		typeVal, _ := value["/Type"].(string)
+
+		if typeVal == "/Catalog" {
+			catalogRef = ref
+			catalogValue = value
+		}
+
+		if typeVal == "/Filespec" {
+			uf, _ := value["/UF"].(string)
+			if uf == "" {
+				uf, _ = value["/F"].(string)
+			}
+
+			cleanUf := stripQpdfStringPrefix(uf)
+
+			meta, exists := metadata[cleanUf]
+			if !exists {
+				continue
+			}
+
+			if rel, ok := meta["relationship"]; ok {
+				value["/AFRelationship"] = "/" + rel
+			}
+
+			if mimeType, ok := meta["mimeType"]; ok {
+				if ef, ok := value["/EF"].(map[string]any); ok {
+					efRef, _ := ef["/F"].(string)
+					if efRef != "" {
+						setStreamSubtype(logger, objects, updateObjects, efRef, mimeType)
+					}
+				}
+			}
+
+			filespecRefs = append(filespecRefs, ref)
+			updateObjects[ref] = map[string]any{"value": value}
+		}
+	}
+
+	return catalogRef, catalogValue, filespecRefs, updateObjects
+}
+
+// patchCatalogAF ensures the Catalog /AF array references all filespec objects.
+func patchCatalogAF(catalogRef string, catalogValue map[string]any, filespecRefs []string, updateObjects map[string]any) {
+	if catalogRef == "" || catalogValue == nil {
+		return
+	}
+
+	afSet := make(map[string]bool)
+	existingAF, _ := catalogValue["/AF"].([]any)
+	for _, r := range existingAF {
+		if s, ok := r.(string); ok {
+			afSet[s] = true
+		}
+	}
+	for _, ref := range filespecRefs {
+		// Object references in values use "9 0 R" format,
+		// not the "obj:9 0 R" key format.
+		valRef := strings.TrimPrefix(ref, "obj:")
+		if !afSet[valRef] {
+			existingAF = append(existingAF, valRef)
+		}
+	}
+	catalogValue["/AF"] = existingAF
+	updateObjects[catalogRef] = map[string]any{"value": catalogValue}
+}
+
+// writeAndApplyUpdate marshals the update objects as QPDF JSON v2, writes
+// them to a temp file, and applies the update via --update-from-json.
+func (engine *QPdf) writeAndApplyUpdate(ctx context.Context, logger *slog.Logger, inputPath string, updateObjects map[string]any) error {
+	updateJSON := map[string]any{
+		"qpdf": []any{
+			map[string]any{
+				"jsonversion":                  2,
+				"pushedinheritedpageresources": false,
+				"calledgetallpages":            false,
+				"maxobjectid":                  0,
+			},
+			updateObjects,
+		},
+	}
+
+	jsonBytes, err := json.Marshal(updateJSON)
+	if err != nil {
+		return fmt.Errorf("marshal update JSON: %w", err)
+	}
+
+	tmpFile, err := os.CreateTemp(filepath.Dir(inputPath), "qpdf-embeds-metadata-*.json")
+	if err != nil {
+		return fmt.Errorf("create temp file for update JSON: %w", err)
+	}
+	defer os.Remove(tmpFile.Name())
+
+	if _, err := tmpFile.Write(jsonBytes); err != nil {
+		tmpFile.Close()
+		return fmt.Errorf("write update JSON: %w", err)
+	}
+	if err := tmpFile.Close(); err != nil {
+		return fmt.Errorf("close temp file: %w", err)
+	}
+
+	updateArgs := make([]string, 0, 5+len(engine.globalArgs))
+	updateArgs = append(updateArgs, inputPath)
+	updateArgs = append(updateArgs, engine.globalArgs...)
+	updateArgs = append(updateArgs, "--newline-before-endstream")
+	updateArgs = append(updateArgs, "--update-from-json="+tmpFile.Name())
+	updateArgs = append(updateArgs, "--replace-input")
+
+	cmd, err := gotenberg.CommandContext(ctx, logger, engine.binPath, updateArgs...)
+	if err != nil {
+		return fmt.Errorf("create command for JSON update: %w", err)
+	}
+
+	_, err = cmd.Exec()
+	if err != nil {
+		return fmt.Errorf("update embeds metadata with QPDF: %w", err)
+	}
+
+	return nil
+}
+
+// setStreamSubtype finds a stream object by reference and sets the /Subtype
+// key in its dict.
+func setStreamSubtype(logger *slog.Logger, objects map[string]json.RawMessage, updateObjects map[string]any, ref, mimeType string) {
+	objKey := ref
+	if !strings.HasPrefix(objKey, "obj:") {
+		objKey = "obj:" + objKey
+	}
+	raw, ok := objects[objKey]
+	if !ok {
+		logger.Warn(fmt.Sprintf("set stream subtype on %s: object not found", ref))
+		return
+	}
+
+	var obj map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &obj); err != nil {
+		logger.Warn(fmt.Sprintf("set stream subtype on %s: unmarshal object: %s", ref, err))
+		return
+	}
+
+	streamRaw, ok := obj["stream"]
+	if !ok {
+		logger.Warn(fmt.Sprintf("set stream subtype on %s: no stream key", ref))
+		return
+	}
+
+	var stream map[string]any
+	if err := json.Unmarshal(streamRaw, &stream); err != nil {
+		logger.Warn(fmt.Sprintf("set stream subtype on %s: unmarshal stream: %s", ref, err))
+		return
+	}
+
+	dict, ok := stream["dict"].(map[string]any)
+	if !ok {
+		logger.Warn(fmt.Sprintf("set stream subtype on %s: stream dict is not a map", ref))
+		return
+	}
+
+	// QPDF JSON uses literal name syntax; it handles PDF name
+	// encoding internally when writing the binary PDF.
+	dict["/Subtype"] = "/" + mimeType
+	stream["dict"] = dict
+	updateObjects[objKey] = map[string]any{"stream": stream}
+}
+
+// stripQpdfStringPrefix removes the type prefix that QPDF adds to JSON
+// string values. Known prefixes: "u:" (Unicode), "b:" (binary), "e:" (encoded).
+func stripQpdfStringPrefix(s string) string {
+	for _, prefix := range []string{"u:", "b:", "e:"} {
+		if strings.HasPrefix(s, prefix) {
+			return s[len(prefix):]
+		}
+	}
+	return s
+}
+
 // Watermark is not available in this implementation.
 func (engine *QPdf) Watermark(ctx context.Context, logger *slog.Logger, inputPath string, stamp gotenberg.Stamp) error {
 	_, span := gotenberg.Tracer().Start(ctx, "qpdf.Watermark",

pkg/modules/qpdf/qpdf_test.go

@@ -0,0 +1,271 @@
+package qpdf
+
+import (
+	"encoding/json"
+	"log/slog"
+	"os"
+	"testing"
+)
+
+func TestStripQpdfStringPrefix(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{"unicode prefix", "u:factur-x.xml", "factur-x.xml"},
+		{"binary prefix", "b:binary.bin", "binary.bin"},
+		{"encoded prefix", "e:encoded.txt", "encoded.txt"},
+		{"no prefix", "plain.xml", "plain.xml"},
+		{"empty string", "", ""},
+		{"prefix only", "u:", ""},
+		{"colon in value", "u:file:name.xml", "file:name.xml"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := stripQpdfStringPrefix(tt.input)
+			if got != tt.expected {
+				t.Errorf("stripQpdfStringPrefix(%q) = %q, want %q", tt.input, got, tt.expected)
+			}
+		})
+	}
+}
+
+func TestParsePdfObjects(t *testing.T) {
+	tests := []struct {
+		name      string
+		input     string
+		wantKeys  []string
+		wantError bool
+	}{
+		{
+			name:     "valid QPDF JSON v2",
+			input:    `{"qpdf":[{"jsonversion":2},{"obj:1 0 R":{"value":{"/Type":"/Catalog"}}}]}`,
+			wantKeys: []string{"obj:1 0 R"},
+		},
+		{
+			name:      "invalid JSON",
+			input:     `not json`,
+			wantError: true,
+		},
+		{
+			name:      "empty qpdf array",
+			input:     `{"qpdf":[]}`,
+			wantError: true,
+		},
+		{
+			name:      "only header element",
+			input:     `{"qpdf":[{"jsonversion":2}]}`,
+			wantError: true,
+		},
+		{
+			name:     "multiple objects",
+			input:    `{"qpdf":[{},{"obj:1 0 R":{"value":{}},"obj:2 0 R":{"value":{}}}]}`,
+			wantKeys: []string{"obj:1 0 R", "obj:2 0 R"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			objects, err := parsePdfObjects([]byte(tt.input))
+			if tt.wantError {
+				if err == nil {
+					t.Error("expected error, got nil")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			for _, key := range tt.wantKeys {
+				if _, ok := objects[key]; !ok {
+					t.Errorf("expected key %q in objects", key)
+				}
+			}
+		})
+	}
+}
+
+func TestPatchFilespecMetadata(t *testing.T) {
+	logger := slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelError}))
+
+	t.Run("sets AFRelationship on matching Filespec", func(t *testing.T) {
+		objects := map[string]json.RawMessage{
+			"obj:1 0 R": json.RawMessage(`{"value":{"/Type":"/Catalog"}}`),
+			"obj:2 0 R": json.RawMessage(`{"value":{"/Type":"/Filespec","/UF":"u:factur-x.xml"}}`),
+		}
+		metadata := map[string]map[string]string{
+			"factur-x.xml": {"relationship": "Data"},
+		}
+
+		catalogRef, _, filespecRefs, updateObjects := patchFilespecMetadata(logger, objects, metadata)
+
+		if catalogRef != "obj:1 0 R" {
+			t.Errorf("catalogRef = %q, want %q", catalogRef, "obj:1 0 R")
+		}
+		if len(filespecRefs) != 1 || filespecRefs[0] != "obj:2 0 R" {
+			t.Errorf("filespecRefs = %v, want [obj:2 0 R]", filespecRefs)
+		}
+		updated, ok := updateObjects["obj:2 0 R"]
+		if !ok {
+			t.Fatal("expected obj:2 0 R in updateObjects")
+		}
+		value := updated.(map[string]any)["value"].(map[string]any)
+		if value["/AFRelationship"] != "/Data" {
+			t.Errorf("/AFRelationship = %v, want /Data", value["/AFRelationship"])
+		}
+	})
+
+	t.Run("skips Filespec with no matching metadata", func(t *testing.T) {
+		objects := map[string]json.RawMessage{
+			"obj:1 0 R": json.RawMessage(`{"value":{"/Type":"/Filespec","/UF":"u:other.xml"}}`),
+		}
+		metadata := map[string]map[string]string{
+			"factur-x.xml": {"relationship": "Data"},
+		}
+
+		_, _, filespecRefs, _ := patchFilespecMetadata(logger, objects, metadata)
+		if len(filespecRefs) != 0 {
+			t.Errorf("filespecRefs = %v, want empty", filespecRefs)
+		}
+	})
+
+	t.Run("falls back to /F when /UF is absent", func(t *testing.T) {
+		objects := map[string]json.RawMessage{
+			"obj:1 0 R": json.RawMessage(`{"value":{"/Type":"/Filespec","/F":"u:factur-x.xml"}}`),
+		}
+		metadata := map[string]map[string]string{
+			"factur-x.xml": {"relationship": "Alternative"},
+		}
+
+		_, _, filespecRefs, updateObjects := patchFilespecMetadata(logger, objects, metadata)
+		if len(filespecRefs) != 1 {
+			t.Fatalf("filespecRefs = %v, want 1 entry", filespecRefs)
+		}
+		value := updateObjects["obj:1 0 R"].(map[string]any)["value"].(map[string]any)
+		if value["/AFRelationship"] != "/Alternative" {
+			t.Errorf("/AFRelationship = %v, want /Alternative", value["/AFRelationship"])
+		}
+	})
+
+	t.Run("sets stream Subtype via EF reference", func(t *testing.T) {
+		objects := map[string]json.RawMessage{
+			"obj:2 0 R": json.RawMessage(`{"value":{"/Type":"/Filespec","/UF":"u:factur-x.xml","/EF":{"/F":"3 0 R"}}}`),
+			"obj:3 0 R": json.RawMessage(`{"stream":{"dict":{"/Type":"/EmbeddedFile"}}}`),
+		}
+		metadata := map[string]map[string]string{
+			"factur-x.xml": {"mimeType": "text/xml"},
+		}
+
+		_, _, _, updateObjects := patchFilespecMetadata(logger, objects, metadata)
+		streamObj, ok := updateObjects["obj:3 0 R"]
+		if !ok {
+			t.Fatal("expected obj:3 0 R in updateObjects")
+		}
+		stream := streamObj.(map[string]any)["stream"].(map[string]any)
+		dict := stream["dict"].(map[string]any)
+		if dict["/Subtype"] != "/text/xml" {
+			t.Errorf("/Subtype = %v, want /text/xml", dict["/Subtype"])
+		}
+	})
+}
+
+func TestPatchCatalogAF(t *testing.T) {
+	t.Run("adds filespec refs to AF array", func(t *testing.T) {
+		catalogValue := map[string]any{"/Type": "/Catalog"}
+		updateObjects := make(map[string]any)
+
+		patchCatalogAF("obj:1 0 R", catalogValue, []string{"obj:2 0 R", "obj:3 0 R"}, updateObjects)
+
+		af, ok := catalogValue["/AF"].([]any)
+		if !ok {
+			t.Fatal("expected /AF to be []any")
+		}
+		if len(af) != 2 {
+			t.Fatalf("/AF has %d entries, want 2", len(af))
+		}
+		if af[0] != "2 0 R" || af[1] != "3 0 R" {
+			t.Errorf("/AF = %v, want [2 0 R, 3 0 R]", af)
+		}
+	})
+
+	t.Run("does not duplicate existing refs", func(t *testing.T) {
+		catalogValue := map[string]any{
+			"/Type": "/Catalog",
+			"/AF":   []any{"2 0 R"},
+		}
+		updateObjects := make(map[string]any)
+
+		patchCatalogAF("obj:1 0 R", catalogValue, []string{"obj:2 0 R", "obj:3 0 R"}, updateObjects)
+
+		af := catalogValue["/AF"].([]any)
+		if len(af) != 2 {
+			t.Fatalf("/AF has %d entries, want 2", len(af))
+		}
+	})
+
+	t.Run("no-op when catalogRef is empty", func(t *testing.T) {
+		updateObjects := make(map[string]any)
+		patchCatalogAF("", nil, []string{"obj:2 0 R"}, updateObjects)
+		if len(updateObjects) != 0 {
+			t.Error("expected no updates for empty catalogRef")
+		}
+	})
+}
+
+func TestSetStreamSubtype(t *testing.T) {
+	logger := slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelError}))
+
+	t.Run("sets Subtype in stream dict", func(t *testing.T) {
+		objects := map[string]json.RawMessage{
+			"obj:3 0 R": json.RawMessage(`{"stream":{"dict":{"/Type":"/EmbeddedFile"}}}`),
+		}
+		updateObjects := make(map[string]any)
+
+		setStreamSubtype(logger, objects, updateObjects, "obj:3 0 R", "text/xml")
+
+		streamObj := updateObjects["obj:3 0 R"].(map[string]any)["stream"].(map[string]any)
+		dict := streamObj["dict"].(map[string]any)
+		if dict["/Subtype"] != "/text/xml" {
+			t.Errorf("/Subtype = %v, want /text/xml", dict["/Subtype"])
+		}
+	})
+
+	t.Run("auto-adds obj: prefix to ref", func(t *testing.T) {
+		objects := map[string]json.RawMessage{
+			"obj:5 0 R": json.RawMessage(`{"stream":{"dict":{}}}`),
+		}
+		updateObjects := make(map[string]any)
+
+		setStreamSubtype(logger, objects, updateObjects, "5 0 R", "application/pdf")
+
+		if _, ok := updateObjects["obj:5 0 R"]; !ok {
+			t.Error("expected obj:5 0 R in updateObjects")
+		}
+	})
+
+	t.Run("warns on missing object", func(t *testing.T) {
+		objects := map[string]json.RawMessage{}
+		updateObjects := make(map[string]any)
+
+		setStreamSubtype(logger, objects, updateObjects, "obj:99 0 R", "text/xml")
+
+		if len(updateObjects) != 0 {
+			t.Error("expected no updates for missing object")
+		}
+	})
+
+	t.Run("warns on object without stream key", func(t *testing.T) {
+		objects := map[string]json.RawMessage{
+			"obj:3 0 R": json.RawMessage(`{"value":{"/Type":"/Page"}}`),
+		}
+		updateObjects := make(map[string]any)
+
+		setStreamSubtype(logger, objects, updateObjects, "obj:3 0 R", "text/xml")
+
+		if len(updateObjects) != 0 {
+			t.Error("expected no updates for non-stream object")
+		}
+	})
+}

pkg/modules/webhook/middleware.go

@@ -127,14 +127,19 @@ func webhookMiddleware(w *Webhook) api.Middleware {
 					}
 
 					// Let's check if the webhook URLs are acceptable according to our
-					// allowed/denied lists.
-					err := gotenberg.FilterDeadline(w.allowList, w.denyList, webhookUrl, deadline)
+					// allowed/denied lists, and against the IP-class options.
+					// See [gotenberg.FilterOutboundURL].
+					ipOpts := []gotenberg.DecideOption{
+						gotenberg.WithDenyPrivateIPs(w.denyPrivateIPs),
+						gotenberg.WithDenyPublicIPs(w.denyPublicIPs),
+					}
+					err := gotenberg.FilterOutboundURL(ctx, webhookUrl, w.allowList, w.denyList, deadline, ipOpts...)
 					if err != nil {
 						return fmt.Errorf("filter webhook URL: %w", err)
 					}
 
 					if webhookErrorUrl != "" {
-						err = gotenberg.FilterDeadline(w.errorAllowList, w.errorDenyList, webhookErrorUrl, deadline)
+						err = gotenberg.FilterOutboundURL(ctx, webhookErrorUrl, w.errorAllowList, w.errorDenyList, deadline, ipOpts...)
 						if err != nil {
 							return fmt.Errorf("filter webhook error URL: %w", err)
 						}
@@ -197,7 +202,7 @@ func webhookMiddleware(w *Webhook) api.Middleware {
 
 					// Filter the events URL if provided.
 					if webhookEventsUrl != "" {
-						err = gotenberg.FilterDeadline(w.allowList, w.denyList, webhookEventsUrl, deadline)
+						err = gotenberg.FilterOutboundURL(ctx, webhookEventsUrl, w.allowList, w.denyList, deadline, ipOpts...)
 						if err != nil {
 							return fmt.Errorf("filter webhook events URL: %w", err)
 						}
@@ -219,9 +224,7 @@ func webhookMiddleware(w *Webhook) api.Middleware {
 						startTime:        startTime,
 
 						client: &retryablehttp.Client{
-							HTTPClient: &http.Client{
-								Timeout: w.clientTimeout,
-							},
+							HTTPClient:   gotenberg.NewOutboundHttpClient(w.clientTimeout, w.allowList, w.denyList, ipOpts...),
 							RetryMax:     w.maxRetry,
 							RetryWaitMin: w.retryMinWait,
 							RetryWaitMax: w.retryMaxWait,
@@ -335,13 +338,38 @@ func webhookMiddleware(w *Webhook) api.Middleware {
 
 					// As a webhook URL has been given, we handle the request in a
 					// goroutine and return immediately.
+					//
+					// Echo returns the echo.Context back to its sync.Pool as
+					// soon as this synchronous handler returns ErrAsyncProcess.
+					// A concurrent request can then claim the recycled context
+					// and c.Reset() wipes the shared store, which would cause
+					// any c.Get("...").(T) assertion downstream of the webhook
+					// goroutine to panic on a nil value and crash the process.
+					// Snapshot the keys downstream reads onto a detached
+					// wrapper before spawning the goroutine so pool reuse
+					// cannot reach into our async work.
+					detached := newPoolSafeContext(c, "logger", "context", "correlationId", "correlationIdHeader", "startTime")
+
 					w.asyncCount.Add(1)
 					go func() {
 						defer cancel()
 						defer w.asyncCount.Add(-1)
 
+						// Defense in depth: any panic that escapes the
+						// downstream chain (including future regressions of
+						// the pool-reuse bug) routes through handleError and
+						// leaves the process running.
+						defer func() {
+							r := recover()
+							if r == nil {
+								return
+							}
+							ctx.Log().Error(fmt.Sprintf("webhook goroutine panic: %v", r))
+							handleError(fmt.Errorf("internal error: %v", r))
+						}()
+
 						// Call the next middleware in the chain.
-						err := next(c)
+						err := next(detached)
 						if err != nil {
 							if errors.Is(err, api.ErrNoOutputFile) {
 								errNoOutputFile := fmt.Errorf("%w - the webhook middleware cannot handle the result of this route", err)

pkg/modules/webhook/pool_safe_context.go

@@ -0,0 +1,58 @@
+package webhook
+
+import (
+	"sync"
+
+	"github.com/labstack/echo/v4"
+)
+
+// poolSafeContext wraps an [echo.Context] and keeps a private snapshot of
+// the values that downstream middleware and route handlers read from the
+// store. Echo returns an [echo.Context] to its sync.Pool as soon as the
+// synchronous handler returns, including when the webhook middleware
+// returns [api.ErrAsyncProcess]. A concurrent request can then claim the
+// recycled context and c.Reset() wipes the shared store out from under
+// the webhook goroutine, which causes any
+// `c.Get("logger").(*slog.Logger)`-style assertion further down the
+// chain to panic on a nil value.
+//
+// Wrapping c before handing it to the goroutine insulates the async work
+// from pool reuse: Get/Set read and write the private store while every
+// other [echo.Context] method delegates to the embedded context for
+// anything the downstream might still need.
+type poolSafeContext struct {
+	echo.Context
+	mu    sync.RWMutex
+	store map[string]any
+}
+
+// newPoolSafeContext snapshots the given keys from c into a detached
+// store and returns a wrapper whose Get/Set operate on that store
+// exclusively. Keys absent from c are omitted; the wrapper still
+// returns nil for them, matching [echo.Context.Get] behavior.
+func newPoolSafeContext(c echo.Context, keys ...string) *poolSafeContext {
+	store := make(map[string]any, len(keys))
+	for _, key := range keys {
+		if v := c.Get(key); v != nil {
+			store[key] = v
+		}
+	}
+	return &poolSafeContext{Context: c, store: store}
+}
+
+// Get returns the value stored in the detached store, not the embedded
+// context's pooled store.
+func (p *poolSafeContext) Get(key string) any {
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+	return p.store[key]
+}
+
+// Set writes to the detached store, not the embedded context's pooled
+// store. This prevents downstream middleware writes from leaking into a
+// later request that claims the same pooled context.
+func (p *poolSafeContext) Set(key string, val any) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.store[key] = val
+}

pkg/modules/webhook/pool_safe_context_test.go

@@ -0,0 +1,60 @@
+package webhook
+
+import (
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/labstack/echo/v4"
+)
+
+func TestPoolSafeContext_SurvivesUnderlyingReset(t *testing.T) {
+	e := echo.New()
+	req := httptest.NewRequest(http.MethodPost, "/", nil)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+
+	logger := slog.Default()
+	c.Set("logger", logger)
+	c.Set("correlationId", "abc-123")
+
+	detached := newPoolSafeContext(c, "logger", "correlationId", "missing")
+
+	// Simulate Echo recycling c for a concurrent request. Reset wipes the
+	// shared store, which is exactly the crash scenario the wrapper
+	// guards against.
+	c.Reset(httptest.NewRequest(http.MethodGet, "/", nil), httptest.NewRecorder())
+
+	if got, _ := detached.Get("logger").(*slog.Logger); got != logger {
+		t.Fatalf("logger = %v, want snapshotted default logger", got)
+	}
+	if got, _ := detached.Get("correlationId").(string); got != "abc-123" {
+		t.Fatalf("correlationId = %q, want %q", got, "abc-123")
+	}
+	if got := detached.Get("missing"); got != nil {
+		t.Fatalf("missing key returned %v, want nil", got)
+	}
+
+	// Underlying c must remain clean.
+	if c.Get("logger") != nil {
+		t.Fatalf("underlying c.Get(\"logger\") leaked wrapper state after reset")
+	}
+}
+
+func TestPoolSafeContext_SetDoesNotTouchUnderlying(t *testing.T) {
+	e := echo.New()
+	req := httptest.NewRequest(http.MethodPost, "/", nil)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+
+	detached := newPoolSafeContext(c)
+	detached.Set("foo", "bar")
+
+	if got, _ := detached.Get("foo").(string); got != "bar" {
+		t.Fatalf("detached Get = %q, want bar", got)
+	}
+	if c.Get("foo") != nil {
+		t.Fatalf("Set leaked %q to the underlying pooled context", "foo")
+	}
+}

pkg/modules/webhook/webhook.go

@@ -23,6 +23,8 @@ type Webhook struct {
 	denyList       []*regexp2.Regexp
 	errorAllowList []*regexp2.Regexp
 	errorDenyList  []*regexp2.Regexp
+	denyPrivateIPs bool
+	denyPublicIPs  bool
 	maxRetry       int
 	retryMinWait   time.Duration
 	retryMaxWait   time.Duration
@@ -40,9 +42,21 @@ func (w *Webhook) Descriptor() gotenberg.ModuleDescriptor {
 			fs.Bool("webhook-enable-sync-mode", false, "Enable synchronous mode for the webhook feature")
 			fs.StringSlice("webhook-allow-list", []string{}, "Set the allowed URLs for the webhook feature using regular expressions - supports multiple values")
 			fs.StringSlice("webhook-deny-list", []string{}, "Set the denied URLs for the webhook feature using regular expressions - supports multiple values")
+			fs.Bool("webhook-deny-private-ips", false, "Reject webhook URLs whose host resolves to a non-public IP address (loopback, RFC1918, link-local, unique-local). Enable on deployments that accept untrusted webhook destinations to mitigate SSRF against internal services")
+			fs.Bool("webhook-deny-public-ips", false, "Reject webhook URLs whose host resolves to a public IP address. Enable on air-gapped or data-governed deployments to prevent callbacks from leaving a private network")
+			fs.Int("webhook-max-retry", 4, "Set the maximum number of retries for the webhook feature")
+
+			// Deprecated flags.
 			fs.StringSlice("webhook-error-allow-list", []string{}, "Set the allowed URLs in case of an error for the webhook feature using regular expressions - supports multiple values")
 			fs.StringSlice("webhook-error-deny-list", []string{}, "Set the denied URLs in case of an error for the webhook feature using regular expressions - supports multiple values")
-			fs.Int("webhook-max-retry", 4, "Set the maximum number of retries for the webhook feature")
+			err := fs.MarkDeprecated("webhook-error-allow-list", "use --webhook-allow-list instead")
+			if err != nil {
+				panic(err)
+			}
+			err = fs.MarkDeprecated("webhook-error-deny-list", "use --webhook-deny-list instead")
+			if err != nil {
+				panic(err)
+			}
 			fs.Duration("webhook-retry-min-wait", time.Duration(1)*time.Second, "Set the minimum duration to wait before trying to call the webhook again")
 			fs.Duration("webhook-retry-max-wait", time.Duration(30)*time.Second, "Set the maximum duration to wait before trying to call the webhook again")
 			fs.Duration("webhook-client-timeout", time.Duration(30)*time.Second, "Set the time limit for requests to the webhook")
@@ -60,8 +74,10 @@ func (w *Webhook) Provision(ctx *gotenberg.Context) error {
 	w.enableSyncMode = flags.MustBool("webhook-enable-sync-mode")
 	w.allowList = flags.MustRegexpSlice("webhook-allow-list")
 	w.denyList = flags.MustRegexpSlice("webhook-deny-list")
-	w.errorAllowList = flags.MustRegexpSlice("webhook-error-allow-list")
-	w.errorDenyList = flags.MustRegexpSlice("webhook-error-deny-list")
+	w.errorAllowList = flags.MustDeprecatedRegexpSlice("webhook-error-allow-list", "webhook-allow-list")
+	w.errorDenyList = flags.MustDeprecatedRegexpSlice("webhook-error-deny-list", "webhook-deny-list")
+	w.denyPrivateIPs = flags.MustBool("webhook-deny-private-ips")
+	w.denyPublicIPs = flags.MustBool("webhook-deny-public-ips")
 	w.maxRetry = flags.MustInt("webhook-max-retry")
 	w.retryMinWait = flags.MustDuration("webhook-retry-min-wait")
 	w.retryMaxWait = flags.MustDuration("webhook-retry-max-wait")

test/integration/README.md

@@ -1,60 +1,52 @@
 # Integration Tests
 
-- **Framework:** Gherkin (BDD) via [Godog](https://github.com/cucumber/godog), with `testcontainers-go` for Docker orchestration.
-- **Feature files:** `test/integration/features/*.feature`, one file per endpoint or capability.
-- **Test infrastructure:** `test/integration/scenario/` contains Go step definitions, container management, HTTP helpers, and PDF validation.
-- **Entry point:** `test/integration/main_test.go` (build tag: `integration`).
-- **Test data:** `test/integration/testdata/`
+Gherkin (BDD) via [Godog](https://github.com/cucumber/godog), with `testcontainers-go` for Docker orchestration.
 
-## How It Works
+- Feature files: `test/integration/features/*.feature`, one per endpoint or capability.
+- Step definitions: `test/integration/scenario/` (container management, HTTP helpers, PDF validation).
+- Entry point: `test/integration/main_test.go` (build tag: `integration`).
+- Test data: `test/integration/testdata/`.
 
-Each scenario spins up a fresh Gotenberg Docker container via testcontainers. Step definitions in `scenario/scenario.go` map Gherkin steps to Go functions. A separate `gotenberg/integration-tools` container provides PDF validation tools (`verapdf`, `pdfinfo`, `pdftotext`).
+Each scenario spins up a fresh Gotenberg Docker container via testcontainers. A separate `gotenberg/integration-tools` container provides PDF validation tools (`verapdf`, `pdfinfo`, `pdftotext`).
 
-**Important:** Run `make build` before `make test-integration`. Integration tests require a Docker image.
+Run `make build` before `make test-integration`. Integration tests require a Docker image.
 
-## Selective Test Runs
-
-Use the `TAGS` variable to run only relevant scenarios:
+## Selective runs
 
 ```bash
 make test-integration TAGS=health
 make test-integration TAGS=chromium-convert-html
 make test-integration TAGS="merge,split"
+make test-integration NO_CONCURRENCY=true  # disable parallel scenarios
+make test-integration PLATFORM=linux/arm64 # force a specific platform
 ```
 
 Available tags:
 
-| Group          | Tags                                                                                                                                                                                                                                                                                                                                                                 |
-| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Chromium       | `chromium`, `chromium-concurrent`, `chromium-convert-html`, `chromium-convert-markdown`, `chromium-convert-url`, `chromium-screenshot-html`, `chromium-screenshot-markdown`, `chromium-screenshot-url`                                                                                                                                                               |
-| LibreOffice    | `libreoffice`, `libreoffice-convert`                                                                                                                                                                                                                                                                                                                                 |
-| PDF Engines    | `pdfengines`, `pdfengines-convert`, `pdfengines-merge`, `merge`, `pdfengines-split`, `split`, `pdfengines-flatten`, `flatten`, `pdfengines-rotate`, `rotate`, `pdfengines-embed`, `embed`, `pdfengines-encrypt`, `encrypt`, `pdfengines-watermark`, `watermark`, `pdfengines-stamp`, `stamp`, `pdfengines-metadata`, `metadata`, `pdfengines-bookmarks`, `bookmarks` |
-| Infrastructure | `health`, `debug`, `root`, `version`, `output-filename`, `prometheus-metrics`, `webhook`, `download-from`                                                                                                                                                                                                                                                            |
+| Group       | Tags                                                                                                                                                                                                                                                                                                                                                                 |
+| ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Chromium    | `chromium`, `chromium-concurrent`, `chromium-convert-html`, `chromium-convert-markdown`, `chromium-convert-url`, `chromium-screenshot-html`, `chromium-screenshot-markdown`, `chromium-screenshot-url`                                                                                                                                                               |
+| LibreOffice | `libreoffice`, `libreoffice-convert`                                                                                                                                                                                                                                                                                                                                 |
+| PDF Engines | `pdfengines`, `pdfengines-convert`, `pdfengines-merge`, `merge`, `pdfengines-split`, `split`, `pdfengines-flatten`, `flatten`, `pdfengines-rotate`, `rotate`, `pdfengines-embed`, `embed`, `pdfengines-encrypt`, `encrypt`, `pdfengines-watermark`, `watermark`, `pdfengines-stamp`, `stamp`, `pdfengines-metadata`, `metadata`, `pdfengines-bookmarks`, `bookmarks` |
+| Infra       | `health`, `debug`, `root`, `version`, `output-filename`, `prometheus-metrics`, `webhook`, `download-from`                                                                                                                                                                                                                                                            |
 
-Other useful flags:
-
-```bash
-make test-integration NO_CONCURRENCY=true  # Disable parallel scenarios
-make test-integration PLATFORM=linux/arm64 # Force a specific platform
-```
-
-## Writing a New Integration Test
+## Writing a new test
 
 1. Create or update a `.feature` file in `test/integration/features/`.
 2. Tag it appropriately (e.g., `@chromium @chromium-convert-html`).
-3. For new tags, add them to both the `TAGS` comment block in the `Makefile` and the "Available tags" list above.
-4. For new step definitions, add the function to `scenario/scenario.go`, register it in `InitializeScenario`, and add the step pattern to the "Available Gherkin Steps" list below (follow the existing format: backtick-quoted pattern, then parenthetical notes on arguments).
+3. For new tags, add them to both the `TAGS` comment block in the `Makefile` and the table above.
+4. For new step definitions, add the function to `scenario/scenario.go`, register it in `InitializeScenario`, and add the step pattern to the step reference below.
 5. Test data goes in `test/integration/testdata/`.
 
-## Available Gherkin Steps
+## Step reference
 
-**Given (setup):**
+### Given (setup)
 
 - `I have a default Gotenberg container`
 - `I have a Gotenberg container with the following environment variable(s):` (table: key | value)
 - `I have a (webhook|static) server`
 
-**When (action):**
+### When (action)
 
 - `I make a "(GET|HEAD)" request to Gotenberg at the "<endpoint>" endpoint`
 - `I make a "(GET|HEAD)" request to Gotenberg at the "<endpoint>" endpoint with the following header(s):` (table: name | value)
@@ -62,14 +54,14 @@ make test-integration PLATFORM=linux/arm64 # Force a specific platform
 - `I make <N> concurrent "(POST)" requests to Gotenberg at the "<endpoint>" endpoint with the following form data and header(s):` (same table format)
 - `I wait for the asynchronous request to the webhook`
 
-**Then (assertions):**
+### Then (assertions)
 
 - `the response status code should be <code>`
 - `the (response|webhook request|file request|server request) header "<name>" should be "<value>"`
 - `the (response|webhook request|file request|server request) cookie "<name>" should be "<value>"`
 - `the (response|webhook request) body should match string:` (docstring)
 - `the (response|webhook request) body should contain string:` (docstring)
-- `the (response|webhook request) body should match JSON:` (docstring, use `"ignore"` for dynamic values like timestamps)
+- `the (response|webhook request) body should match JSON:` (docstring, use `"ignore"` for dynamic values)
 - `the webhook event should match JSON:` (docstring, use `"ignore"` for dynamic values; polls for up to 5s)
 - `there should be <N> PDF(s) in the (response|webhook request)`
 - `there should be the following file(s) in the (response|webhook request):` (table of filenames)

test/integration/features/chromium_convert_html.feature

@@ -195,6 +195,55 @@ Feature: /forms/chromium/convert/html
       Wait delay > 2 seconds or expression window globalVar === 'ready' returns true.
       """
 
+  Scenario: POST /forms/chromium/convert/html (rAF / ResizeObserver / IntersectionObserver fire with waitForExpression)
+    Given I have a default Gotenberg container
+    When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/html" endpoint with the following form data and header(s):
+      | files                     | testdata/paint-callbacks-html/index.html       | file   |
+      | waitForExpression         | !!document.body.getAttribute('data-pdf-ready') | field  |
+      | Gotenberg-Output-Filename | foo                                            | header |
+    Then the response status code should be 200
+    Then the response header "Content-Type" should be "application/pdf"
+    Then there should be 1 PDF(s) in the response
+    Then there should be the following file(s) in the response:
+      | foo.pdf |
+    Then the "foo.pdf" PDF should have the following content at page 1:
+      """
+      raf-fired
+      """
+    Then the "foo.pdf" PDF should have the following content at page 1:
+      """
+      ro-fired
+      """
+    Then the "foo.pdf" PDF should have the following content at page 1:
+      """
+      io-fired
+      """
+
+  Scenario: POST /forms/chromium/convert/html (rAF / ResizeObserver / IntersectionObserver fire with waitDelay and emulatedMediaType=print)
+    Given I have a default Gotenberg container
+    When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/html" endpoint with the following form data and header(s):
+      | files                     | testdata/paint-callbacks-html/index.html | file   |
+      | waitDelay                 | 3s                                       | field  |
+      | emulatedMediaType         | print                                    | field  |
+      | Gotenberg-Output-Filename | foo                                      | header |
+    Then the response status code should be 200
+    Then the response header "Content-Type" should be "application/pdf"
+    Then there should be 1 PDF(s) in the response
+    Then there should be the following file(s) in the response:
+      | foo.pdf |
+    Then the "foo.pdf" PDF should have the following content at page 1:
+      """
+      raf-fired
+      """
+    Then the "foo.pdf" PDF should have the following content at page 1:
+      """
+      ro-fired
+      """
+    Then the "foo.pdf" PDF should have the following content at page 1:
+      """
+      io-fired
+      """
+
   Scenario: POST /forms/chromium/convert/html (Wait For Selector)
     Given I have a default Gotenberg container
     When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/html" endpoint with the following form data and header(s):
@@ -1188,6 +1237,30 @@ Feature: /forms/chromium/convert/html
     Then the "foo.pdf" PDF should have 1 page(s)
     Then the "foo.pdf" PDF should have 1 image(s)
 
+  Scenario: POST /forms/chromium/convert/html (stampSource=pdf without uploaded stamp file => 400)
+    Given I have a default Gotenberg container
+    When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/html" endpoint with the following form data and header(s):
+      | files           | testdata/page-1-html/index.html | file  |
+      | stampSource     | pdf                             | field |
+      | stampExpression | /etc/hostname                   | field |
+    Then the response status code should be 400
+    Then the response body should match string:
+      """
+      Invalid form data: a stamp file is required for image or pdf source
+      """
+
+  Scenario: POST /forms/chromium/convert/html (watermarkSource=pdf without uploaded watermark file => 400)
+    Given I have a default Gotenberg container
+    When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/html" endpoint with the following form data and header(s):
+      | files               | testdata/page-1-html/index.html | file  |
+      | watermarkSource     | pdf                             | field |
+      | watermarkExpression | /etc/hostname                   | field |
+    Then the response status code should be 400
+    Then the response body should match string:
+      """
+      Invalid form data: a watermark file is required for image or pdf source
+      """
+
   # See: https://github.com/gotenberg/gotenberg/issues/1500.
   Scenario: POST /forms/chromium/convert/html (Long Filename)
     Given I have a default Gotenberg container

test/integration/features/chromium_convert_markdown.feature

@@ -1153,6 +1153,32 @@ Feature: /forms/chromium/convert/markdown
     Then the response status code should be 200
     Then the response header "Content-Type" should be "application/pdf"
 
+  Scenario: POST /forms/chromium/convert/markdown (stampSource=pdf without uploaded stamp file => 400)
+    Given I have a default Gotenberg container
+    When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/markdown" endpoint with the following form data and header(s):
+      | files           | testdata/page-1-markdown/index.html | file  |
+      | files           | testdata/page-1-markdown/page_1.md  | file  |
+      | stampSource     | pdf                                 | field |
+      | stampExpression | /etc/hostname                       | field |
+    Then the response status code should be 400
+    Then the response body should match string:
+      """
+      Invalid form data: a stamp file is required for image or pdf source
+      """
+
+  Scenario: POST /forms/chromium/convert/markdown (watermarkSource=pdf without uploaded watermark file => 400)
+    Given I have a default Gotenberg container
+    When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/markdown" endpoint with the following form data and header(s):
+      | files               | testdata/page-1-markdown/index.html | file  |
+      | files               | testdata/page-1-markdown/page_1.md  | file  |
+      | watermarkSource     | pdf                                 | field |
+      | watermarkExpression | /etc/hostname                       | field |
+    Then the response status code should be 400
+    Then the response body should match string:
+      """
+      Invalid form data: a watermark file is required for image or pdf source
+      """
+
   # See: https://github.com/gotenberg/gotenberg/issues/1500.
   Scenario: POST /forms/chromium/convert/markdown (Long Filename)
     Given I have a default Gotenberg container

test/integration/features/chromium_convert_url.feature

@@ -478,6 +478,51 @@ Feature: /forms/chromium/convert/url
       # Modern browsers block file URIs from being loaded into iframes when the parent page is served over HTTP/HTTPS.
       | 'file:///etc/passwd' does not match any expression from the allowed list |
 
+  Scenario: POST /forms/chromium/convert/url (file:// scheme rejected at route layer)
+    Given I have a default Gotenberg container
+    When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/url" endpoint with the following form data and header(s):
+      | url | file:///tmp/foo/index.html | field |
+    Then the response status code should be 400
+    Then the response header "Content-Type" should be "text/plain; charset=UTF-8"
+    Then the response body should match string:
+      """
+      file:// URLs are not accepted on this route. Use the /convert/html or /convert/markdown routes to render local HTML
+      """
+
+  Scenario: POST /forms/chromium/convert/url (Main URL resolves to a non-public IP, permissive default)
+    Given I have a Gotenberg container with the following environment variable(s):
+      | CHROMIUM_ALLOW_LIST |  |
+    Given I have a static server
+    When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/url" endpoint with the following form data and header(s):
+      | url | http://host.docker.internal:%d/html/testdata/page-1-html/index.html | field |
+    Then the response status code should be 200
+    Then the response header "Content-Type" should be "application/pdf"
+    Then there should be 1 PDF(s) in the response
+
+  Scenario: POST /forms/chromium/convert/url (Main URL is a non-public IP literal, deny-private-ips on)
+    Given I have a Gotenberg container with the following environment variable(s):
+      | CHROMIUM_ALLOW_LIST       |      |
+      | CHROMIUM_DENY_PRIVATE_IPS | true |
+    When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/url" endpoint with the following form data and header(s):
+      | url | http://127.0.0.1/ | field |
+    Then the response status code should be 403
+    Then the response header "Content-Type" should be "text/plain; charset=UTF-8"
+    Then the response body should match string:
+      """
+      Forbidden
+      """
+
+  Scenario: POST /forms/chromium/convert/url (Main URL resolves to a non-public IP, deny-private-ips on with allow-list bypass)
+    Given I have a Gotenberg container with the following environment variable(s):
+      | CHROMIUM_ALLOW_LIST       | .+   |
+      | CHROMIUM_DENY_PRIVATE_IPS | true |
+    Given I have a static server
+    When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/url" endpoint with the following form data and header(s):
+      | url | http://host.docker.internal:%d/html/testdata/page-1-html/index.html | field |
+    Then the response status code should be 200
+    Then the response header "Content-Type" should be "application/pdf"
+    Then there should be 1 PDF(s) in the response
+
   Scenario: POST /forms/chromium/convert/url (JavaScript Enabled)
     Given I have a default Gotenberg container
     Given I have a static server
@@ -1234,6 +1279,32 @@ Feature: /forms/chromium/convert/url
     Then the response status code should be 200
     Then the response header "Content-Type" should be "application/pdf"
 
+  Scenario: POST /forms/chromium/convert/url (stampSource=pdf without uploaded stamp file => 400)
+    Given I have a default Gotenberg container
+    Given I have a static server
+    When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/url" endpoint with the following form data and header(s):
+      | url             | http://host.docker.internal:%d/html/testdata/page-1-html/index.html | field |
+      | stampSource     | pdf                                                                 | field |
+      | stampExpression | /etc/hostname                                                       | field |
+    Then the response status code should be 400
+    Then the response body should match string:
+      """
+      Invalid form data: a stamp file is required for image or pdf source
+      """
+
+  Scenario: POST /forms/chromium/convert/url (watermarkSource=pdf without uploaded watermark file => 400)
+    Given I have a default Gotenberg container
+    Given I have a static server
+    When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/url" endpoint with the following form data and header(s):
+      | url                 | http://host.docker.internal:%d/html/testdata/page-1-html/index.html | field |
+      | watermarkSource     | pdf                                                                 | field |
+      | watermarkExpression | /etc/hostname                                                       | field |
+    Then the response status code should be 400
+    Then the response body should match string:
+      """
+      Invalid form data: a watermark file is required for image or pdf source
+      """
+
   # See: https://github.com/gotenberg/gotenberg/issues/1500.
   Scenario: POST /forms/chromium/convert/url (Long Filename)
     Given I have a default Gotenberg container

test/integration/features/chromium_screenshot_url.feature

@@ -44,6 +44,17 @@ Feature: /forms/chromium/screenshot/url
     Then the response status code should be 400
     Then the response header "Content-Type" should be "text/plain; charset=UTF-8"
 
+  Scenario: POST /forms/chromium/screenshot/url (file:// scheme rejected at route layer)
+    Given I have a default Gotenberg container
+    When I make a "POST" request to Gotenberg at the "/forms/chromium/screenshot/url" endpoint with the following form data and header(s):
+      | url | file:///tmp/foo/index.html | field |
+    Then the response status code should be 400
+    Then the response header "Content-Type" should be "text/plain; charset=UTF-8"
+    Then the response body should match string:
+      """
+      file:// URLs are not accepted on this route. Use the /convert/html or /convert/markdown routes to render local HTML
+      """
+
   @webhook
   Scenario: POST /forms/chromium/screenshot/url (Webhook)
     Given I have a default Gotenberg container

test/integration/features/debug.feature

@@ -62,8 +62,10 @@ Feature: /debug
           "api-disable-health-check-route-telemetry": "true",
           "api-disable-root-route-telemetry": "true",
           "api-disable-version-route-telemetry": "true",
-          "api-download-from-allow-list": "[]",
+          "api-download-from-allow-list": "[.+]",
           "api-download-from-deny-list": "[]",
+          "api-download-from-deny-private-ips": "false",
+          "api-download-from-deny-public-ips": "false",
           "api-download-from-max-retry": "4",
           "api-enable-basic-auth": "false",
           "api-enable-debug-route": "true",
@@ -77,11 +79,13 @@ Feature: /debug
           "api-trace-header": "Gotenberg-Trace",
           "chromium-allow-file-access-from-files": "false",
           "chromium-allow-insecure-localhost": "false",
-          "chromium-allow-list": "[]",
+          "chromium-allow-list": "[.+]",
           "chromium-auto-start": "false",
           "chromium-clear-cache": "false",
           "chromium-clear-cookies": "false",
           "chromium-deny-list": "[^file:(?!//\\/tmp/).*]",
+          "chromium-deny-private-ips": "false",
+          "chromium-deny-public-ips": "false",
           "chromium-disable-javascript": "false",
           "chromium-disable-routes": "false",
           "chromium-disable-web-security": "false",
@@ -124,9 +128,11 @@ Feature: /debug
           "prometheus-disable-route-telemetry": "true",
           "prometheus-namespace": "gotenberg",
           "prometheus-metrics-path": "/prometheus/metrics",
-          "webhook-allow-list": "[]",
+          "webhook-allow-list": "[.+]",
           "webhook-client-timeout": "30s",
           "webhook-deny-list": "[]",
+          "webhook-deny-private-ips": "false",
+          "webhook-deny-public-ips": "false",
           "webhook-disable": "false",
           "webhook-error-allow-list": "[]",
           "webhook-error-deny-list": "[]",
@@ -194,8 +200,10 @@ Feature: /debug
           "api-disable-health-check-route-telemetry": "true",
           "api-disable-root-route-telemetry": "true",
           "api-disable-version-route-telemetry": "true",
-          "api-download-from-allow-list": "[]",
+          "api-download-from-allow-list": "[.+]",
           "api-download-from-deny-list": "[]",
+          "api-download-from-deny-private-ips": "false",
+          "api-download-from-deny-public-ips": "false",
           "api-download-from-max-retry": "4",
           "api-enable-basic-auth": "false",
           "api-enable-debug-route": "true",
@@ -209,11 +217,13 @@ Feature: /debug
           "api-trace-header": "Gotenberg-Trace",
           "chromium-allow-file-access-from-files": "false",
           "chromium-allow-insecure-localhost": "false",
-          "chromium-allow-list": "[]",
+          "chromium-allow-list": "[.+]",
           "chromium-auto-start": "false",
           "chromium-clear-cache": "false",
           "chromium-clear-cookies": "false",
           "chromium-deny-list": "[^file:(?!//\\/tmp/).*]",
+          "chromium-deny-private-ips": "false",
+          "chromium-deny-public-ips": "false",
           "chromium-disable-javascript": "false",
           "chromium-disable-routes": "false",
           "chromium-disable-web-security": "false",
@@ -256,9 +266,11 @@ Feature: /debug
           "prometheus-disable-route-telemetry": "true",
           "prometheus-namespace": "gotenberg",
           "prometheus-metrics-path": "/prometheus/metrics",
-          "webhook-allow-list": "[]",
+          "webhook-allow-list": "[.+]",
           "webhook-client-timeout": "30s",
           "webhook-deny-list": "[]",
+          "webhook-deny-private-ips": "false",
+          "webhook-deny-public-ips": "false",
           "webhook-disable": "false",
           "webhook-error-allow-list": "[]",
           "webhook-error-deny-list": "[]",

test/integration/features/libreoffice_convert.feature

@@ -817,6 +817,30 @@ Feature: /forms/libreoffice/convert
     Then the response status code should be 200
     Then the response header "Content-Type" should be "application/pdf"
 
+  Scenario: POST /forms/libreoffice/convert (stampSource=pdf without uploaded stamp file => 400)
+    Given I have a default Gotenberg container
+    When I make a "POST" request to Gotenberg at the "/forms/libreoffice/convert" endpoint with the following form data and header(s):
+      | files           | testdata/page_1.docx | file  |
+      | stampSource     | pdf                  | field |
+      | stampExpression | /etc/hostname        | field |
+    Then the response status code should be 400
+    Then the response body should match string:
+      """
+      Invalid form data: a stamp file is required for image or pdf source
+      """
+
+  Scenario: POST /forms/libreoffice/convert (watermarkSource=pdf without uploaded watermark file => 400)
+    Given I have a default Gotenberg container
+    When I make a "POST" request to Gotenberg at the "/forms/libreoffice/convert" endpoint with the following form data and header(s):
+      | files               | testdata/page_1.docx | file  |
+      | watermarkSource     | pdf                  | field |
+      | watermarkExpression | /etc/hostname        | field |
+    Then the response status code should be 400
+    Then the response body should match string:
+      """
+      Invalid form data: a watermark file is required for image or pdf source
+      """
+
   # See: https://github.com/gotenberg/gotenberg/issues/1500.
   Scenario: POST /forms/libreoffice/convert (Long Filename)
     Given I have a default Gotenberg container

test/integration/features/pdfengines_embed.feature

@@ -17,6 +17,21 @@ Feature: /forms/pdfengines/embed
     Then the response PDF(s) should have the "embed_1.xml" file embedded
     Then the response PDF(s) should have the "embed_2.xml" file embedded
 
+  Scenario: POST /forms/pdfengines/embed with metadata
+    Given I have a default Gotenberg container
+    When I make a "POST" request to Gotenberg at the "/forms/pdfengines/embed" endpoint with the following form data and header(s):
+      | files          | testdata/page_1.pdf                                                                                                              | file  |
+      | embeds         | testdata/embed_1.xml                                                                                                             | file  |
+      | embeds         | testdata/embed_2.xml                                                                                                             | file  |
+      | embedsMetadata | {"embed_1.xml":{"mimeType":"text/xml","relationship":"Data"},"embed_2.xml":{"mimeType":"text/xml","relationship":"Alternative"}} | field |
+    Then the response status code should be 200
+    And the response header "Content-Type" should be "application/pdf"
+    And there should be 1 PDF(s) in the response
+    And the response PDF(s) should have the "embed_1.xml" file embedded
+    And the response PDF(s) should have the "embed_1.xml" file embedded with relationship "Data"
+    And the response PDF(s) should have the "embed_2.xml" file embedded
+    And the response PDF(s) should have the "embed_2.xml" file embedded with relationship "Alternative"
+
   @download-from
   Scenario: POST /forms/pdfengines/embed with (Download From)
     Given I have a default Gotenberg container

test/integration/features/pdfengines_merge.feature

@@ -665,6 +665,32 @@ Feature: /forms/pdfengines/merge
       | embeds | testdata/embed_1.xml | file  |
     Then the response status code should be 200
 
+  Scenario: POST /forms/pdfengines/merge (stampSource=pdf without uploaded stamp file => 400)
+    Given I have a default Gotenberg container
+    When I make a "POST" request to Gotenberg at the "/forms/pdfengines/merge" endpoint with the following form data and header(s):
+      | files           | testdata/page_1.pdf | file  |
+      | files           | testdata/page_2.pdf | file  |
+      | stampSource     | pdf                 | field |
+      | stampExpression | /etc/hostname       | field |
+    Then the response status code should be 400
+    Then the response body should match string:
+      """
+      Invalid form data: a stamp file is required for image or pdf source
+      """
+
+  Scenario: POST /forms/pdfengines/merge (watermarkSource=pdf without uploaded watermark file => 400)
+    Given I have a default Gotenberg container
+    When I make a "POST" request to Gotenberg at the "/forms/pdfengines/merge" endpoint with the following form data and header(s):
+      | files               | testdata/page_1.pdf | file  |
+      | files               | testdata/page_2.pdf | file  |
+      | watermarkSource     | pdf                 | field |
+      | watermarkExpression | /etc/hostname       | field |
+    Then the response status code should be 400
+    Then the response body should match string:
+      """
+      Invalid form data: a watermark file is required for image or pdf source
+      """
+
   # See: https://github.com/gotenberg/gotenberg/issues/1500.
   Scenario: POST /forms/pdfengines/merge (Long Filename)
     Given I have a default Gotenberg container

test/integration/features/pdfengines_metadata.feature

@@ -106,6 +106,43 @@ Feature: /forms/pdfengines/metadata/{write|read}
       Invalid form data: form field 'metadata' is invalid (got 'foo', resulting to unmarshal metadata: invalid character 'o' in literal false (expecting 'a'))
       """
 
+  Scenario: POST /forms/pdfengines/metadata/write (Reject Newline-Injected Pseudo-Tag)
+    # Regression: a newline in a metadata value would split go-exiftool's
+    # stdin line and inject an arbitrary ExifTool pseudo-tag such as
+    # -FileName=, -SymLink=, or -HardLink=, allowing arbitrary filesystem
+    # writes as the container user. WriteMetadata now rejects values
+    # containing control characters with HTTP 400.
+    Given I have a default Gotenberg container
+    When I make a "POST" request to Gotenberg at the "/forms/pdfengines/metadata/write" endpoint with the following form data and header(s):
+      | files    | testdata/page_1.pdf                            | file  |
+      | metadata | {"Title":"test\\n-FileName=/tmp/inject_proof"} | field |
+    Then the response status code should be 400
+    Then the response header "Content-Type" should be "text/plain; charset=UTF-8"
+    Then the response body should contain string:
+      """
+      At least one PDF engine cannot process the requested metadata
+      """
+
+  Scenario: POST /forms/pdfengines/metadata/write (Reject Group-Prefixed Dangerous Tag)
+    # Regression: ExifTool treats "System:FileName" identically to "FileName".
+    # The dangerous-tag blocklist must strip group prefixes before comparing,
+    # otherwise the attacker renames/moves files with a single HTTP request.
+    Given I have a default Gotenberg container
+    When I make a "POST" request to Gotenberg at the "/forms/pdfengines/metadata/write" endpoint with the following form data and header(s):
+      | files                     | testdata/page_1.pdf                                                         | file   |
+      | metadata                  | {"System:FileName":"stolen.pdf","System:Directory":"/tmp","Author":"legit"} | field  |
+      | Gotenberg-Output-Filename | foo                                                                         | header |
+    Then the response status code should be 200
+    Then the response header "Content-Type" should be "application/pdf"
+    Then there should be 1 PDF(s) in the response
+    When I make a "POST" request to Gotenberg at the "/forms/pdfengines/metadata/read" endpoint with the following form data and header(s):
+      | files | teststore/foo.pdf | file |
+    Then the response status code should be 200
+    Then the response body should contain string:
+      """
+      "Author":"legit"
+      """
+
   Scenario: POST /forms/pdfengines/metadata/read (Bad Request)
     Given I have a default Gotenberg container
     When I make a "POST" request to Gotenberg at the "/forms/pdfengines/metadata/read" endpoint with the following form data and header(s):

test/integration/features/pdfengines_split.feature

@@ -767,6 +767,34 @@ Feature: /forms/pdfengines/split
       | embeds    | testdata/embed_1.xml | file  |
     Then the response status code should be 200
 
+  Scenario: POST /forms/pdfengines/split (stampSource=pdf without uploaded stamp file => 400)
+    Given I have a default Gotenberg container
+    When I make a "POST" request to Gotenberg at the "/forms/pdfengines/split" endpoint with the following form data and header(s):
+      | files           | testdata/pages_3.pdf | file  |
+      | splitMode       | intervals            | field |
+      | splitSpan       | 2                    | field |
+      | stampSource     | pdf                  | field |
+      | stampExpression | /etc/hostname        | field |
+    Then the response status code should be 400
+    Then the response body should match string:
+      """
+      Invalid form data: a stamp file is required for image or pdf source
+      """
+
+  Scenario: POST /forms/pdfengines/split (watermarkSource=pdf without uploaded watermark file => 400)
+    Given I have a default Gotenberg container
+    When I make a "POST" request to Gotenberg at the "/forms/pdfengines/split" endpoint with the following form data and header(s):
+      | files               | testdata/pages_3.pdf | file  |
+      | splitMode           | intervals            | field |
+      | splitSpan           | 2                    | field |
+      | watermarkSource     | pdf                  | field |
+      | watermarkExpression | /etc/hostname        | field |
+    Then the response status code should be 400
+    Then the response body should match string:
+      """
+      Invalid form data: a watermark file is required for image or pdf source
+      """
+
   # See: https://github.com/gotenberg/gotenberg/issues/1500.
   Scenario: POST /forms/pdfengines/split (Long Filename)
     Given I have a default Gotenberg container

test/integration/scenario/containers.go

@@ -7,9 +7,9 @@ import (
 	"path/filepath"
 	"time"
 
-	"github.com/docker/docker/api/types/container"
-	"github.com/docker/go-connections/nat"
+	"github.com/moby/moby/api/types/container"
 	"github.com/testcontainers/testcontainers-go"
+	"github.com/testcontainers/testcontainers-go/exec"
 	"github.com/testcontainers/testcontainers-go/network"
 	"github.com/testcontainers/testcontainers-go/wait"
 )
@@ -26,10 +26,53 @@ func (n *noopLogger) Printf(format string, v ...any) {
 	// NOOP
 }
 
+// integrationAllowList is the default allow-list pattern injected into
+// every Gotenberg container started by the integration tests. The outbound
+// URL guard introduced for SSRF protection rejects URLs whose host
+// resolves to a non-public IP, which would block:
+//
+//   - host.docker.internal (Docker host gateway, RFC1918)
+//   - The static helper server running inside the test network
+//   - file:// URIs created in /tmp by the API context
+//
+// Setting the allow-list to a permissive pattern flips the URL guard into
+// "allow-list match bypasses the IP check" mode for every URL the tests
+// touch. Operator-supplied deny-lists still apply, so deny-list scenarios
+// keep working. Test scenarios that exercise allow-list semantics
+// explicitly override this default in their environment table.
+//
+// Production operators wanting a similar bypass for trusted internal
+// destinations should set their own --*-allow-list with a tighter regex
+// (for example ^https?://internal\.svc(:|/|$)).
+const integrationAllowList = `.+`
+
+// applyDefaultEnv merges baseline environment variables that the
+// integration tests rely on into env, without overwriting values supplied
+// by the test scenario itself. Tests can clear a default by setting it to
+// the empty string in their scenario table.
+func applyDefaultEnv(env map[string]string) map[string]string {
+	if env == nil {
+		env = make(map[string]string)
+	}
+	defaults := map[string]string{
+		"CHROMIUM_ALLOW_LIST":          integrationAllowList,
+		"API_DOWNLOAD_FROM_ALLOW_LIST": integrationAllowList,
+		"WEBHOOK_ALLOW_LIST":           integrationAllowList,
+	}
+	for k, v := range defaults {
+		if _, ok := env[k]; !ok {
+			env[k] = v
+		}
+	}
+	return env
+}
+
 func startGotenbergContainer(ctx context.Context, env map[string]string) (*testcontainers.DockerNetwork, testcontainers.Container, error) {
 	ctx, cancel := context.WithTimeout(ctx, 2*time.Minute)
 	defer cancel()
 
+	env = applyDefaultEnv(env)
+
 	n, err := network.New(ctx)
 	if err != nil {
 		return nil, nil, fmt.Errorf("create Gotenberg container network: %w", err)
@@ -96,7 +139,7 @@ func execCommandInIntegrationToolsContainer(ctx context.Context, cmd []string, p
 		}
 	}(c, ctx)
 
-	_, output, err := c.Exec(ctx, cmd)
+	_, output, err := c.Exec(ctx, cmd, exec.Multiplexed())
 	if err != nil {
 		return "", fmt.Errorf("exec %q: %w", cmd, err)
 	}
@@ -109,7 +152,7 @@ func execCommandInIntegrationToolsContainer(ctx context.Context, cmd []string, p
 	return string(b), nil
 }
 
-func containerHttpEndpoint(ctx context.Context, container testcontainers.Container, port nat.Port) (string, error) {
+func containerHttpEndpoint(ctx context.Context, container testcontainers.Container, port string) (string, error) {
 	ip, err := container.Host(ctx)
 	if err != nil {
 		return "", fmt.Errorf("get container IP: %w", err)

test/integration/scenario/scenario.go

@@ -1262,6 +1262,68 @@ func (s *scenario) thePdfsShouldHaveEmbeddedFile(ctx context.Context, kind, shou
 	return nil
 }
 
+func (s *scenario) thePdfsShouldHaveEmbeddedFileWithRelationship(ctx context.Context, kind, embed, relationship string) error {
+	dirPath := s.teststoreDir
+
+	_, err := os.Stat(dirPath)
+	if os.IsNotExist(err) {
+		return fmt.Errorf("directory %q does not exist", dirPath)
+	}
+
+	var paths []string
+	err = filepath.Walk(dirPath, func(path string, info os.FileInfo, pathErr error) error {
+		if pathErr != nil {
+			return pathErr
+		}
+		if strings.EqualFold(filepath.Ext(info.Name()), ".pdf") {
+			paths = append(paths, path)
+		}
+		return nil
+	})
+	if err != nil {
+		return fmt.Errorf("walk %q: %w", dirPath, err)
+	}
+
+	for _, path := range paths {
+		cmd := []string{
+			"verapdf",
+			"--off",
+			"--loglevel",
+			"0",
+			"--extract",
+			"embeddedFile",
+			filepath.Base(path),
+		}
+
+		output, err := execCommandInIntegrationToolsContainer(ctx, cmd, path)
+		if err != nil {
+			return fmt.Errorf("exec %q: %w", cmd, err)
+		}
+
+		fileNameTag := fmt.Sprintf("<fileName>%s</fileName>", embed)
+		relationshipTag := fmt.Sprintf("<afRelationship>%s</afRelationship>", relationship)
+
+		blocks := strings.Split(output, "</embeddedFile>")
+		found := false
+		for _, block := range blocks {
+			if !strings.Contains(block, fileNameTag) {
+				continue
+			}
+			if !strings.Contains(block, relationshipTag) {
+				return fmt.Errorf("embedded file %q missing afRelationship %q", embed, relationship)
+			}
+			found = true
+			break
+		}
+
+		if !found {
+			return fmt.Errorf("embedded file %q not found in verapdf output", embed)
+		}
+	}
+
+	return nil
+}
+
 func InitializeScenario(ctx *godog.ScenarioContext) {
 	s := &scenario{}
 	ctx.Before(func(ctx context.Context, sc *godog.Scenario) (context.Context, error) {
@@ -1300,6 +1362,7 @@ func InitializeScenario(ctx *godog.ScenarioContext) {
 	ctx.Then(`^the (response|webhook request) PDF\(s\) (should|should NOT) be flatten$`, s.thePdfsShouldBeFlatten)
 	ctx.Then(`^the (response|webhook request) PDF\(s\) (should|should NOT) be encrypted`, s.thePdfsShouldBeEncrypted)
 	ctx.Then(`^the (response|webhook request) PDF\(s\) (should|should NOT) have the "([^"]*)" file embedded$`, s.thePdfsShouldHaveEmbeddedFile)
+	ctx.Then(`^the (response|webhook request) PDF\(s\) should have the "([^"]*)" file embedded with relationship "([^"]*)"$`, s.thePdfsShouldHaveEmbeddedFileWithRelationship)
 	ctx.Then(`^the "([^"]*)" PDF should have (\d+) page\(s\)$`, s.thePdfShouldHavePages)
 	ctx.Then(`^the "([^"]*)" PDF (should|should NOT) be set to landscape orientation$`, s.thePdfShouldBeSetToLandscapeOrientation)
 	ctx.Then(`^the "([^"]*)" PDF (should|should NOT) have the following content at page (\d+):$`, s.thePdfShouldHaveTheFollowingContentAtPage)

test/integration/testdata/paint-callbacks-html/index.html

@@ -0,0 +1,46 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>Paint-driven callbacks</title>
+    <style>
+      body {
+        font-family: monospace;
+        padding: 20px;
+      }
+      #target {
+        width: 100px;
+        height: 100px;
+        background: #eee;
+      }
+    </style>
+  </head>
+  <body>
+    <p id="raf">raf-pending</p>
+    <p id="ro">ro-pending</p>
+    <p id="io">io-pending</p>
+    <div id="target">target</div>
+    <script>
+      requestAnimationFrame(function () {
+        document.getElementById("raf").textContent = "raf-fired";
+      });
+
+      var target = document.getElementById("target");
+
+      new ResizeObserver(function () {
+        document.getElementById("ro").textContent = "ro-fired";
+      }).observe(target);
+
+      new IntersectionObserver(function () {
+        document.getElementById("io").textContent = "io-fired";
+      }).observe(target);
+
+      // Signal Gotenberg to print after 2 s. Long enough for rAF / RO / IO
+      // to have fired when the polyfill is active; short enough to keep
+      // the test fast.
+      setTimeout(function () {
+        document.body.setAttribute("data-pdf-ready", "true");
+      }, 2000);
+    </script>
+  </body>
+</html>