feat(chromium): skip or waits for networkIdle2 event

.bruno/Chromium/Convert/HTML to PDF.bru

@@ -1,86 +0,0 @@
-meta {
-  name: HTML to PDF
-  type: http
-  seq: 2
-}
-
-post {
-  url: {{baseUrl}}/forms/chromium/convert/html
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  files: @file(../test/integration/testdata/page-1-html/index.html)
-  ~landscape: false
-  ~printBackground: false
-  ~scale: 1.0
-  ~singlePage: false
-  ~paperWidth: 8.5
-  ~paperHeight: 11
-  ~marginTop: 0.39
-  ~marginBottom: 0.39
-  ~marginLeft: 0.39
-  ~marginRight: 0.39
-  ~nativePageRanges: 1-2
-  ~preferCssPageSize: false
-  ~generateDocumentOutline: false
-  ~generateTaggedPdf: false
-  ~skipNetworkIdleEvent: false
-  ~failOnHttpStatusCodes: [499,599]
-  ~failOnResourceHttpStatusCodes: []
-  ~ignoreResourceHttpStatusDomains: []
-  ~failOnResourceLoadingFailed: false
-  ~failOnConsoleExceptions: false
-  ~waitDelay: 0s
-  ~waitWindowStatus:
-  ~waitForExpression:
-  ~waitForSelector:
-  ~cookies: [{"name":"my_cookie","value":"my_value","domain":"example.com"}]
-  ~userAgent:
-  ~extraHttpHeaders: {"X-Custom-Header":"value"}
-  ~emulatedMediaType: print
-  ~emulatedMediaFeatures: {"prefers-color-scheme":"dark"}
-  ~omitBackground: false
-  ~splitMode: intervals
-  ~splitSpan: 1
-  ~splitUnify: false
-  ~pdfa: PDF/A-1b
-  ~pdfua: true
-  ~metadata: {"Author":"Bruno","Title":"Test"}
-  ~userPassword:
-  ~ownerPassword:
-  ~allowPrinting: false
-  ~allowCopying: false
-  ~allowModifying: false
-  ~allowAnnotating: false
-  ~allowFillingForms: false
-  ~allowAssembling: false
-  ~embeds: @file(../test/integration/testdata/embed_1.xml)
-  ~embeds: @file(../test/integration/testdata/embed_2.xml)
-  ~embedsMetadata: {"embed_1.xml":{"mimeType":"text/xml","relationship":"Data"}, "embed_2.xml":{"mimeType":"text/xml","relationship":"Data"}}
-  ~facturxXml: @file(../test/integration/testdata/embed_1.xml)
-  ~facturxConformanceLevel: EN 16931
-  ~facturxDocumentType: INVOICE
-  ~facturxVersion: 1.0
-  ~watermarkSource: text
-  ~watermarkExpression: CONFIDENTIAL
-  ~watermarkPages:
-  ~watermarkOptions: {"scale":"0.5 abs","rot":"45","fillcolor":"#FF0000"}
-  ~stampSource: text
-  ~stampExpression: DRAFT
-  ~stampPages:
-  ~stampOptions: {"scale":"0.5 abs","rot":"45"}
-  ~rotateAngle: 90
-  ~rotatePages:
-}
-
-headers {
-  ~Gotenberg-Output-Filename: my-file
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}

.bruno/Chromium/Convert/Markdown to PDF.bru

@@ -1,87 +0,0 @@
-meta {
-  name: Markdown to PDF
-  type: http
-  seq: 3
-}
-
-post {
-  url: {{baseUrl}}/forms/chromium/convert/markdown
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  files: @file(../../test/integration/testdata/page-1-markdown/index.html)
-  files: @file(../../test/integration/testdata/page-1-markdown/page_1.md)
-  ~landscape: false
-  ~printBackground: false
-  ~scale: 1.0
-  ~singlePage: false
-  ~paperWidth: 8.5
-  ~paperHeight: 11
-  ~marginTop: 0.39
-  ~marginBottom: 0.39
-  ~marginLeft: 0.39
-  ~marginRight: 0.39
-  ~nativePageRanges: 1-2
-  ~preferCssPageSize: false
-  ~generateDocumentOutline: false
-  ~generateTaggedPdf: false
-  ~skipNetworkIdleEvent: false
-  ~failOnHttpStatusCodes: [499,599]
-  ~failOnResourceHttpStatusCodes: []
-  ~ignoreResourceHttpStatusDomains: []
-  ~failOnResourceLoadingFailed: false
-  ~failOnConsoleExceptions: false
-  ~waitDelay: 0s
-  ~waitWindowStatus:
-  ~waitForExpression:
-  ~waitForSelector:
-  ~cookies: [{"name":"my_cookie","value":"my_value","domain":"example.com"}]
-  ~userAgent:
-  ~extraHttpHeaders: {"X-Custom-Header":"value"}
-  ~emulatedMediaType: print
-  ~emulatedMediaFeatures: {"prefers-color-scheme":"dark"}
-  ~omitBackground: false
-  ~splitMode: intervals
-  ~splitSpan: 1
-  ~splitUnify: false
-  ~pdfa: PDF/A-1b
-  ~pdfua: true
-  ~metadata: {"Author":"Bruno","Title":"Test"}
-  ~userPassword:
-  ~ownerPassword:
-  ~allowPrinting: false
-  ~allowCopying: false
-  ~allowModifying: false
-  ~allowAnnotating: false
-  ~allowFillingForms: false
-  ~allowAssembling: false
-  ~embeds: @file(../test/integration/testdata/embed_1.xml)
-  ~embeds: @file(../test/integration/testdata/embed_2.xml)
-  ~embedsMetadata: {"embed_1.xml":{"mimeType":"text/xml","relationship":"Data"}, "embed_2.xml":{"mimeType":"text/xml","relationship":"Data"}}
-  ~facturxXml: @file(../../test/integration/testdata/embed_1.xml)
-  ~facturxConformanceLevel: EN 16931
-  ~facturxDocumentType: INVOICE
-  ~facturxVersion: 1.0
-  ~watermarkSource: text
-  ~watermarkExpression: CONFIDENTIAL
-  ~watermarkPages:
-  ~watermarkOptions: {"scale":"0.5 abs","rot":"45","fillcolor":"#FF0000"}
-  ~stampSource: text
-  ~stampExpression: DRAFT
-  ~stampPages:
-  ~stampOptions: {"scale":"0.5 abs","rot":"45"}
-  ~rotateAngle: 90
-  ~rotatePages:
-}
-
-headers {
-  ~Gotenberg-Output-Filename: my-file
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}

.bruno/Chromium/Convert/URL to PDF.bru

@@ -1,86 +0,0 @@
-meta {
-  name: URL to PDF
-  type: http
-  seq: 1
-}
-
-post {
-  url: {{baseUrl}}/forms/chromium/convert/url
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  url: https://example.com
-  ~landscape: false
-  ~printBackground: false
-  ~scale: 1.0
-  ~singlePage: false
-  ~paperWidth: 8.5
-  ~paperHeight: 11
-  ~marginTop: 0.39
-  ~marginBottom: 0.39
-  ~marginLeft: 0.39
-  ~marginRight: 0.39
-  ~nativePageRanges: 1-2
-  ~preferCssPageSize: false
-  ~generateDocumentOutline: false
-  ~generateTaggedPdf: false
-  ~skipNetworkIdleEvent: false
-  ~failOnHttpStatusCodes: [499,599]
-  ~failOnResourceHttpStatusCodes: []
-  ~ignoreResourceHttpStatusDomains: []
-  ~failOnResourceLoadingFailed: false
-  ~failOnConsoleExceptions: false
-  ~waitDelay: 0s
-  ~waitWindowStatus:
-  ~waitForExpression:
-  ~waitForSelector:
-  ~cookies: [{"name":"my_cookie","value":"my_value","domain":"example.com"}]
-  ~userAgent:
-  ~extraHttpHeaders: {"X-Custom-Header":"value"}
-  ~emulatedMediaType: print
-  ~emulatedMediaFeatures: {"prefers-color-scheme":"dark"}
-  ~omitBackground: false
-  ~splitMode: intervals
-  ~splitSpan: 1
-  ~splitUnify: false
-  ~pdfa: PDF/A-1b
-  ~pdfua: true
-  ~metadata: {"Author":"Bruno","Title":"Test"}
-  ~userPassword:
-  ~ownerPassword:
-  ~allowPrinting: false
-  ~allowCopying: false
-  ~allowModifying: false
-  ~allowAnnotating: false
-  ~allowFillingForms: false
-  ~allowAssembling: false
-  ~embeds: @file(../test/integration/testdata/embed_1.xml)
-  ~embeds: @file(../test/integration/testdata/embed_2.xml)
-  ~embedsMetadata: {"embed_1.xml":{"mimeType":"text/xml","relationship":"Data"}, "embed_2.xml":{"mimeType":"text/xml","relationship":"Data"}}
-  ~facturxXml: @file(../test/integration/testdata/embed_1.xml)
-  ~facturxConformanceLevel: EN 16931
-  ~facturxDocumentType: INVOICE
-  ~facturxVersion: 1.0
-  ~watermarkSource: text
-  ~watermarkExpression: CONFIDENTIAL
-  ~watermarkPages:
-  ~watermarkOptions: {"scale":"0.5 abs","rot":"45","fillcolor":"#FF0000"}
-  ~stampSource: text
-  ~stampExpression: DRAFT
-  ~stampPages:
-  ~stampOptions: {"scale":"0.5 abs","rot":"45"}
-  ~rotateAngle: 90
-  ~rotatePages:
-}
-
-headers {
-  ~Gotenberg-Output-Filename: my-file
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}

.bruno/Chromium/Screenshot/HTML Screenshot.bru

@@ -1,48 +0,0 @@
-meta {
-  name: HTML Screenshot
-  type: http
-  seq: 2
-}
-
-post {
-  url: {{baseUrl}}/forms/chromium/screenshot/html
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  files: @file(../../test/integration/testdata/page-1-html/index.html)
-  ~width: 800
-  ~height: 600
-  ~clip: false
-  ~format: png
-  ~quality: 100
-  ~optimizeForSpeed: false
-  ~skipNetworkIdleEvent: false
-  ~failOnHttpStatusCodes: [499,599]
-  ~failOnResourceHttpStatusCodes: []
-  ~ignoreResourceHttpStatusDomains: []
-  ~failOnResourceLoadingFailed: false
-  ~failOnConsoleExceptions: false
-  ~waitDelay: 0s
-  ~waitWindowStatus:
-  ~waitForExpression:
-  ~waitForSelector:
-  ~cookies: [{"name":"my_cookie","value":"my_value","domain":"example.com"}]
-  ~userAgent:
-  ~extraHttpHeaders: {"X-Custom-Header":"value"}
-  ~emulatedMediaType: screen
-  ~emulatedMediaFeatures: {"prefers-color-scheme":"dark"}
-  ~omitBackground: false
-  ~deviceScaleFactor: 1.0
-}
-
-headers {
-  ~Gotenberg-Output-Filename: my-screenshot
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}

.bruno/Chromium/Screenshot/Markdown Screenshot.bru

@@ -1,49 +0,0 @@
-meta {
-  name: Markdown Screenshot
-  type: http
-  seq: 3
-}
-
-post {
-  url: {{baseUrl}}/forms/chromium/screenshot/markdown
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  files: @file(../../test/integration/testdata/page-1-markdown/index.html)
-  files: @file(../../test/integration/testdata/page-1-markdown/page_1.md)
-  ~width: 800
-  ~height: 600
-  ~clip: false
-  ~format: png
-  ~quality: 100
-  ~optimizeForSpeed: false
-  ~skipNetworkIdleEvent: false
-  ~failOnHttpStatusCodes: [499,599]
-  ~failOnResourceHttpStatusCodes: []
-  ~ignoreResourceHttpStatusDomains: []
-  ~failOnResourceLoadingFailed: false
-  ~failOnConsoleExceptions: false
-  ~waitDelay: 0s
-  ~waitWindowStatus:
-  ~waitForExpression:
-  ~waitForSelector:
-  ~cookies: [{"name":"my_cookie","value":"my_value","domain":"example.com"}]
-  ~userAgent:
-  ~extraHttpHeaders: {"X-Custom-Header":"value"}
-  ~emulatedMediaType: screen
-  ~emulatedMediaFeatures: {"prefers-color-scheme":"dark"}
-  ~omitBackground: false
-  ~deviceScaleFactor: 1.0
-}
-
-headers {
-  ~Gotenberg-Output-Filename: my-screenshot
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}

.bruno/Chromium/Screenshot/URL Screenshot.bru

@@ -1,48 +0,0 @@
-meta {
-  name: URL Screenshot
-  type: http
-  seq: 1
-}
-
-post {
-  url: {{baseUrl}}/forms/chromium/screenshot/url
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  url: https://example.com
-  ~width: 800
-  ~height: 600
-  ~clip: false
-  ~format: png
-  ~quality: 100
-  ~optimizeForSpeed: false
-  ~skipNetworkIdleEvent: false
-  ~failOnHttpStatusCodes: [499,599]
-  ~failOnResourceHttpStatusCodes: []
-  ~ignoreResourceHttpStatusDomains: []
-  ~failOnResourceLoadingFailed: false
-  ~failOnConsoleExceptions: false
-  ~waitDelay: 0s
-  ~waitWindowStatus:
-  ~waitForExpression:
-  ~waitForSelector:
-  ~cookies: [{"name":"my_cookie","value":"my_value","domain":"example.com"}]
-  ~userAgent:
-  ~extraHttpHeaders: {"X-Custom-Header":"value"}
-  ~emulatedMediaType: screen
-  ~emulatedMediaFeatures: {"prefers-color-scheme":"dark"}
-  ~omitBackground: false
-  ~deviceScaleFactor: 1.0
-}
-
-headers {
-  ~Gotenberg-Output-Filename: my-screenshot
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}

.bruno/Health & Info/Debug.bru

@@ -1,11 +0,0 @@
-meta {
-  name: Debug
-  type: http
-  seq: 3
-}
-
-get {
-  url: {{baseUrl}}/debug
-  body: none
-  auth: none
-}

.bruno/Health & Info/Health.bru

@@ -1,11 +0,0 @@
-meta {
-  name: Health
-  type: http
-  seq: 1
-}
-
-get {
-  url: {{baseUrl}}/health
-  body: none
-  auth: none
-}

.bruno/Health & Info/Prometheus Metrics.bru

@@ -1,11 +0,0 @@
-meta {
-  name: Prometheus Metrics
-  type: http
-  seq: 4
-}
-
-get {
-  url: {{baseUrl}}/prometheus/metrics
-  body: none
-  auth: none
-}

.bruno/Health & Info/Version.bru

@@ -1,11 +0,0 @@
-meta {
-  name: Version
-  type: http
-  seq: 2
-}
-
-get {
-  url: {{baseUrl}}/version
-  body: none
-  auth: none
-}

.bruno/LibreOffice/Convert to PDF.bru

@@ -1,103 +0,0 @@
-meta {
-  name: Convert to PDF
-  type: http
-  seq: 1
-}
-
-post {
-  url: {{baseUrl}}/forms/libreoffice/convert
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  files: @file(../test/integration/testdata/page_1.docx)
-  ~password:
-  ~landscape: false
-  ~nativePageRanges:
-  ~updateIndexes: false
-  ~exportFormFields: true
-  ~allowDuplicateFieldNames: false
-  ~exportBookmarks: true
-  ~exportBookmarksToPdfDestination: false
-  ~exportPlaceholders: false
-  ~exportNotes: false
-  ~exportNotesPages: false
-  ~exportOnlyNotesPages: false
-  ~exportNotesInMargin: false
-  ~convertOooTargetToPdfTarget: false
-  ~exportLinksRelativeFsys: false
-  ~exportHiddenSlides: false
-  ~skipEmptyPages: false
-  ~addOriginalDocumentAsStream: false
-  ~singlePageSheets: false
-  ~initialView: 0
-  ~initialPage: 1
-  ~magnification: 0
-  ~zoom: 100
-  ~pageLayout: 0
-  ~firstPageOnLeft: false
-  ~resizeWindowToInitialPage: false
-  ~centerWindow: false
-  ~openInFullScreenMode: false
-  ~displayPDFDocumentTitle: true
-  ~hideViewerMenubar: false
-  ~hideViewerToolbar: false
-  ~hideViewerWindowControls: false
-  ~useTransitionEffects: true
-  ~openBookmarkLevels: -1
-  ~losslessImageCompression: false
-  ~quality: 90
-  ~reduceImageResolution: false
-  ~maxImageResolution: 300
-  ~nativeWatermarkText:
-  ~nativeWatermarkColor: 0
-  ~nativeWatermarkFontHeight: 0
-  ~nativeWatermarkRotateAngle: 0
-  ~nativeWatermarkFontName:
-  ~nativeTiledWatermarkText:
-  ~nativePdfFormats: true
-  ~merge: false
-  ~flatten: false
-  ~splitMode: intervals
-  ~splitSpan: 1
-  ~splitUnify: false
-  ~pdfa: PDF/A-1b
-  ~pdfua: true
-  ~metadata: {"Author":"Bruno","Title":"Test"}
-  ~userPassword:
-  ~ownerPassword:
-  ~allowPrinting: false
-  ~allowCopying: false
-  ~allowModifying: false
-  ~allowAnnotating: false
-  ~allowFillingForms: false
-  ~allowAssembling: false
-  ~embeds: @file(../test/integration/testdata/embed_1.xml)
-  ~embeds: @file(../test/integration/testdata/embed_2.xml)
-  ~embedsMetadata: {"embed_1.xml":{"mimeType":"text/xml","relationship":"Data"}, "embed_2.xml":{"mimeType":"text/xml","relationship":"Data"}}
-  ~facturxXml: @file(../test/integration/testdata/embed_1.xml)
-  ~facturxConformanceLevel: EN 16931
-  ~facturxDocumentType: INVOICE
-  ~facturxVersion: 1.0
-  ~watermarkSource: text
-  ~watermarkExpression: CONFIDENTIAL
-  ~watermarkPages:
-  ~watermarkOptions: {"scale":"0.5 abs","rot":"45","fillcolor":"#FF0000"}
-  ~stampSource: text
-  ~stampExpression: DRAFT
-  ~stampPages:
-  ~stampOptions: {"scale":"0.5 abs","rot":"45"}
-  ~rotateAngle: 90
-  ~rotatePages:
-}
-
-headers {
-  ~Gotenberg-Output-Filename: my-file
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}

.bruno/PDF Engines/Bookmarks/Read Bookmarks.bru

@@ -1,24 +0,0 @@
-meta {
-  name: Read Bookmarks
-  type: http
-  seq: 1
-}
-
-post {
-  url: {{baseUrl}}/forms/pdfengines/bookmarks/read
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  files: @file(../../test/integration/testdata/page_1.pdf)
-}
-
-headers {
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}

.bruno/PDF Engines/Bookmarks/Write Bookmarks.bru

@@ -1,26 +0,0 @@
-meta {
-  name: Write Bookmarks
-  type: http
-  seq: 2
-}
-
-post {
-  url: {{baseUrl}}/forms/pdfengines/bookmarks/write
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  files: @file(../../test/integration/testdata/page_1.pdf)
-  bookmarks: [{"title":"Chapter 1","page":1,"children":[{"title":"Section 1.1","page":1}]}]
-}
-
-headers {
-  ~Gotenberg-Output-Filename: with-bookmarks
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}

.bruno/PDF Engines/Convert/Convert PDF.bru

@@ -1,27 +0,0 @@
-meta {
-  name: Convert PDF
-  type: http
-  seq: 1
-}
-
-post {
-  url: {{baseUrl}}/forms/pdfengines/convert
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  files: @file(../../test/integration/testdata/page_1.pdf)
-  pdfa: PDF/A-1b
-  ~pdfua: true
-}
-
-headers {
-  ~Gotenberg-Output-Filename: converted
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}

.bruno/PDF Engines/Embed/Embed Files.bru

@@ -1,33 +0,0 @@
-meta {
-  name: Embed Files
-  type: http
-  seq: 1
-}
-
-post {
-  url: {{baseUrl}}/forms/pdfengines/embed
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  files: @file(../test/integration/testdata/page_1.pdf)
-  embeds: @file(../test/integration/testdata/embed_1.xml)
-  embeds: @file(../test/integration/testdata/embed_2.xml)
-  embedsMetadata: {"embed_1.xml":{"mimeType":"text/xml","relationship":"Data"}, "embed_2.xml":{"mimeType":"text/xml","relationship":"Data"}}
-  ~facturxXml: @file(../test/integration/testdata/embed_1.xml)
-  ~facturxConformanceLevel: EN 16931
-  ~facturxDocumentType: INVOICE
-  ~facturxVersion: 1.0
-  ~downloadFrom: [{"url":"https://example.com/attachment.xml","embedded":true}]
-}
-
-headers {
-  ~Gotenberg-Output-Filename: with-embeds
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}

.bruno/PDF Engines/Encrypt/Encrypt PDF.bru

@@ -1,33 +0,0 @@
-meta {
-  name: Encrypt PDF
-  type: http
-  seq: 1
-}
-
-post {
-  url: {{baseUrl}}/forms/pdfengines/encrypt
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  files: @file(../../test/integration/testdata/page_1.pdf)
-  userPassword: secret123
-  ~ownerPassword: owner456
-  ~allowPrinting: false
-  ~allowCopying: false
-  ~allowModifying: false
-  ~allowAnnotating: false
-  ~allowFillingForms: false
-  ~allowAssembling: false
-}
-
-headers {
-  ~Gotenberg-Output-Filename: encrypted
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}

.bruno/PDF Engines/Factur-X/Inject Factur-X XMP.bru

@@ -1,29 +0,0 @@
-meta {
-  name: Inject Factur-X XMP
-  type: http
-  seq: 1
-}
-
-post {
-  url: {{baseUrl}}/forms/pdfengines/factur-x
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  files: @file(../../test/integration/testdata/page_1.pdf)
-  facturxXml: @file(../../test/integration/testdata/embed_1.xml)
-  facturxConformanceLevel: EN 16931
-  ~facturxDocumentType: INVOICE
-  ~facturxVersion: 1.0
-}
-
-headers {
-  ~Gotenberg-Output-Filename: factur-x
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}

.bruno/PDF Engines/Flatten/Flatten PDF.bru

@@ -1,25 +0,0 @@
-meta {
-  name: Flatten PDF
-  type: http
-  seq: 1
-}
-
-post {
-  url: {{baseUrl}}/forms/pdfengines/flatten
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  files: @file(../../test/integration/testdata/page_1.pdf)
-}
-
-headers {
-  ~Gotenberg-Output-Filename: flattened
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}

.bruno/PDF Engines/Merge/Merge PDFs.bru

@@ -1,54 +0,0 @@
-meta {
-  name: Merge PDFs
-  type: http
-  seq: 1
-}
-
-post {
-  url: {{baseUrl}}/forms/pdfengines/merge
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  files: @file(../../test/integration/testdata/page_1.pdf)
-  files: @file(../../test/integration/testdata/page_2.pdf)
-  ~flatten: false
-  ~autoIndexBookmarks: false
-  ~pdfa: PDF/A-1b
-  ~pdfua: true
-  ~metadata: {"Author":"Bruno","Title":"Test"}
-  ~bookmarks: [{"title":"Page 1","page":1},{"title":"Page 2","page":2}]
-  ~userPassword:
-  ~ownerPassword:
-  ~allowPrinting: false
-  ~allowCopying: false
-  ~allowModifying: false
-  ~allowAnnotating: false
-  ~allowFillingForms: false
-  ~allowAssembling: false
-  ~watermarkSource: text
-  ~watermarkExpression: CONFIDENTIAL
-  ~watermarkPages:
-  ~watermarkOptions: {"scale":"0.5 abs","rot":"45","fillcolor":"#FF0000"}
-  ~stampSource: text
-  ~stampExpression: DRAFT
-  ~stampPages:
-  ~stampOptions: {"scale":"0.5 abs","rot":"45"}
-  ~rotateAngle: 90
-  ~rotatePages:
-  ~facturxXml: @file(../../test/integration/testdata/embed_1.xml)
-  ~facturxConformanceLevel: EN 16931
-  ~facturxDocumentType: INVOICE
-  ~facturxVersion: 1.0
-}
-
-headers {
-  ~Gotenberg-Output-Filename: merged
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}

.bruno/PDF Engines/Metadata/Read Metadata.bru

@@ -1,24 +0,0 @@
-meta {
-  name: Read Metadata
-  type: http
-  seq: 1
-}
-
-post {
-  url: {{baseUrl}}/forms/pdfengines/metadata/read
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  files: @file(../../test/integration/testdata/page_1.pdf)
-}
-
-headers {
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}

.bruno/PDF Engines/Metadata/Write Metadata.bru

@@ -1,26 +0,0 @@
-meta {
-  name: Write Metadata
-  type: http
-  seq: 2
-}
-
-post {
-  url: {{baseUrl}}/forms/pdfengines/metadata/write
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  files: @file(../../test/integration/testdata/page_1.pdf)
-  metadata: {"Author":"Bruno","Copyright":"Bruno","Creator":"Gotenberg","Keywords":["test"],"Marked":true,"Producer":"Gotenberg","Subject":"Test","Title":"Test Document","Trapped":"Unknown"}
-}
-
-headers {
-  ~Gotenberg-Output-Filename: with-metadata
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}

.bruno/PDF Engines/Rotate/Rotate PDF.bru

@@ -1,27 +0,0 @@
-meta {
-  name: Rotate PDF
-  type: http
-  seq: 1
-}
-
-post {
-  url: {{baseUrl}}/forms/pdfengines/rotate
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  files: @file(../../test/integration/testdata/page_1.pdf)
-  rotateAngle: 90
-  ~rotatePages: 1-2
-}
-
-headers {
-  ~Gotenberg-Output-Filename: rotated
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}

.bruno/PDF Engines/Split/Split PDF.bru

@@ -1,54 +0,0 @@
-meta {
-  name: Split PDF
-  type: http
-  seq: 1
-}
-
-post {
-  url: {{baseUrl}}/forms/pdfengines/split
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  files: @file(../../test/integration/testdata/pages_3.pdf)
-  splitMode: intervals
-  splitSpan: 1
-  ~splitUnify: false
-  ~flatten: false
-  ~pdfa: PDF/A-1b
-  ~pdfua: true
-  ~metadata: {"Author":"Bruno","Title":"Test"}
-  ~userPassword:
-  ~ownerPassword:
-  ~allowPrinting: false
-  ~allowCopying: false
-  ~allowModifying: false
-  ~allowAnnotating: false
-  ~allowFillingForms: false
-  ~allowAssembling: false
-  ~watermarkSource: text
-  ~watermarkExpression: CONFIDENTIAL
-  ~watermarkPages:
-  ~watermarkOptions: {"scale":"0.5 abs","rot":"45","fillcolor":"#FF0000"}
-  ~stampSource: text
-  ~stampExpression: DRAFT
-  ~stampPages:
-  ~stampOptions: {"scale":"0.5 abs","rot":"45"}
-  ~rotateAngle: 90
-  ~rotatePages:
-  ~facturxXml: @file(../../test/integration/testdata/embed_1.xml)
-  ~facturxConformanceLevel: EN 16931
-  ~facturxDocumentType: INVOICE
-  ~facturxVersion: 1.0
-}
-
-headers {
-  ~Gotenberg-Output-Filename: split
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}

.bruno/PDF Engines/Stamp/Stamp PDF.bru

@@ -1,31 +0,0 @@
-meta {
-  name: Stamp PDF
-  type: http
-  seq: 1
-}
-
-post {
-  url: {{baseUrl}}/forms/pdfengines/stamp
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  files: @file(../../test/integration/testdata/page_1.pdf)
-  stampSource: text
-  stampExpression: APPROVED
-  ~stampPages: 1-2
-  ~stampOptions: {"font":"Helvetica","fontSize":"48","color":"#00FF00","opacity":"0.5","rotation":"0"}
-  ~stamp: @file(../../test/integration/testdata/watermark.png)
-  ~downloadFrom: [{"url":"https://example.com/stamp.png","field":"stamp"}]
-}
-
-headers {
-  ~Gotenberg-Output-Filename: stamped
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}

.bruno/PDF Engines/Watermark/Watermark PDF.bru

@@ -1,31 +0,0 @@
-meta {
-  name: Watermark PDF
-  type: http
-  seq: 1
-}
-
-post {
-  url: {{baseUrl}}/forms/pdfengines/watermark
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  files: @file(../../test/integration/testdata/page_1.pdf)
-  watermarkSource: text
-  watermarkExpression: CONFIDENTIAL
-  ~watermarkPages: 1-2
-  ~watermarkOptions: {"font":"Helvetica","fontSize":"48","color":"#FF0000","opacity":"0.3","rotation":"45"}
-  ~watermark: @file(../../test/integration/testdata/watermark.png)
-  ~downloadFrom: [{"url":"https://example.com/watermark.png","field":"watermark"}]
-}
-
-headers {
-  ~Gotenberg-Output-Filename: watermarked
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}

.bruno/README.md

@@ -1,65 +0,0 @@
-# Bruno API Collection
-
-[Bruno](https://www.usebruno.com/) collection mirroring every Gotenberg route. Update the collection when adding or modifying a route.
-
-## Structure
-
-```
-.bruno/
-├── bruno.json                      # Collection config
-├── collection.bru                  # Collection-level defaults (Gotenberg-Trace header)
-├── environments/
-│   ├── Local.bru                   # baseUrl: http://localhost:3000
-│   └── Demo.bru                    # baseUrl: https://demo.gotenberg.dev
-├── Health & Info/                   # GET routes
-├── Chromium/Convert/                # POST routes grouped by module
-├── Chromium/Screenshot/
-├── LibreOffice/
-└── PDF Engines/<Feature>/           # One folder per feature (Merge, Split, Rotate, ...)
-```
-
-## `.bru` file format
-
-```bru
-meta {
-  name: <Human-readable name>
-  type: http
-  seq: <order within folder>
-}
-
-post {
-  url: {{baseUrl}}/forms/<path>
-  body: multipartForm
-  auth: none
-}
-
-body:multipart-form {
-  files: @file(../../test/integration/testdata/<file>)
-  <mandatoryField>: <value>
-  ~<optionalField>: <value>
-}
-
-headers {
-  ~Gotenberg-Output-Filename: <name>
-  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
-  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
-  ~Gotenberg-Webhook-Method: POST
-  ~Gotenberg-Webhook-Error-Method: POST
-  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
-}
-```
-
-## Conventions
-
-- Mandatory fields have no prefix. Optional fields use `~` (disabled by default in Bruno).
-- File references use relative paths to `test/integration/testdata/`.
-- Webhook and output filename headers appear on every POST route as optional (`~`).
-- One `.bru` file per request. For routes with read/write variants (e.g., bookmarks, metadata), create separate files in the same folder.
-
-## Checklist
-
-1. Create or update the `.bru` file in the matching folder under `.bruno/`.
-2. Include all form fields from the route handler. Check `FormData*` calls in the route function.
-3. For file upload fields (`files`, `watermark`, `stamp`, `embeds`), use `@file(...)` with a suitable test file.
-4. Verify the URL path matches the route's `Path` field exactly.
-5. For new module folders, keep the naming consistent (e.g., `PDF Engines/Rotate/`).

.bruno/bruno.json

@@ -1,6 +0,0 @@
-{
-  "version": "1",
-  "name": "Gotenberg",
-  "type": "collection",
-  "ignore": ["node_modules", ".git"]
-}

.bruno/collection.bru

@@ -1,3 +0,0 @@
-headers {
-  Gotenberg-Trace: {{traceId}}
-}

.bruno/environments/Demo.bru

@@ -1,4 +0,0 @@
-vars {
-  baseUrl: https://demo.gotenberg.dev
-  traceId: bruno-demo
-}

.bruno/environments/Local.bru

@@ -1,4 +0,0 @@
-vars {
-  baseUrl: http://localhost:3000
-  traceId: bruno-local
-}

.env

@@ -2,5 +2,6 @@ GOTENBERG_VERSION=snapshot
 DOCKER_REGISTRY=gotenberg
 DOCKER_REPOSITORY=gotenberg
 DOCKERFILE=build/Dockerfile
+DOCKERFILE_CLOUDRUN=build/Dockerfile.cloudrun
+DOCKERFILE_AWS_LAMBDA=build/Dockerfile.aws-lambda
 DOCKER_BUILD_CONTEXT='.'
-TARGET=gotenberg

.github/actions/build-test-push/action.yml

@@ -29,32 +29,14 @@ inputs:
 
 outputs:
   tags:
-    description: Comma separated list of full variant tags
+    description: Comma separated list of tag
     value: ${{ steps.build.outputs.tags }}
-  tags_chromium:
-    description: Comma separated list of Chromium variant tags
-    value: ${{ steps.build.outputs.tags_chromium }}
-  tags_libreoffice:
-    description: Comma separated list of LibreOffice variant tags
-    value: ${{ steps.build.outputs.tags_libreoffice }}
   tags_cloud_run:
-    description: Comma separated list of Cloud Run full variant tags (linux/amd64 only)
+    description: Comma separated list of Cloud Run tags (linux/amd64 only)
     value: ${{ steps.build.outputs.tags_cloud_run }}
-  tags_cloud_run_chromium:
-    description: Comma separated list of Cloud Run Chromium variant tags (linux/amd64 only)
-    value: ${{ steps.build.outputs.tags_cloud_run_chromium }}
-  tags_cloud_run_libreoffice:
-    description: Comma separated list of Cloud Run LibreOffice variant tags (linux/amd64 only)
-    value: ${{ steps.build.outputs.tags_cloud_run_libreoffice }}
   tags_aws_lambda:
-    description: Comma separated list of AWS Lambda full variant tags (linux/amd64 and linux/arm64 only)
+    description: Comma separated list of AWS Lambda tags (linux/amd64 and linux/arm64 only)
     value: ${{ steps.build.outputs.tags_aws_lambda }}
-  tags_aws_lambda_chromium:
-    description: Comma separated list of AWS Lambda Chromium variant tags (linux/amd64 and linux/arm64 only)
-    value: ${{ steps.build.outputs.tags_aws_lambda_chromium }}
-  tags_aws_lambda_libreoffice:
-    description: Comma separated list of AWS Lambda LibreOffice variant tags (linux/amd64 and linux/arm64 only)
-    value: ${{ steps.build.outputs.tags_aws_lambda_libreoffice }}
 
 runs:
   using: composite
@@ -66,7 +48,7 @@ runs:
       uses: docker/setup-buildx-action@v3
 
     - name: Check out code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v5
 
     - name: Log in to Docker Hub
       if: inputs.docker_hub_username != ''
@@ -78,53 +60,34 @@ runs:
     - name: Build ${{ inputs.platform }}
       id: build
       shell: bash
-      env:
-        INPUT_VERSION: ${{ inputs.version }}
-        INPUT_PLATFORM: ${{ inputs.platform }}
-        INPUT_ALTERNATE_REPOSITORY: ${{ inputs.alternate_repository }}
-        INPUT_DRY_RUN: ${{ inputs.dry_run }}
       run: |
         .github/actions/build-test-push/build.sh \
-          --version "$INPUT_VERSION" \
-          --platform "$INPUT_PLATFORM" \
-          --alternate-repository "$INPUT_ALTERNATE_REPOSITORY" \
-          --dry-run "$INPUT_DRY_RUN"
+          --version "${{ inputs.version }}" \
+          --platform "${{ inputs.platform }}" \
+          --alternate-repository "${{ inputs.alternate_repository }}" \
+          --dry-run "${{ inputs.dry_run }}"
 
     - name: Run integration tests
       if: inputs.skip_integrations_tests != 'true'
       shell: bash
-      env:
-        INPUT_VERSION: ${{ inputs.version }}
-        INPUT_PLATFORM: ${{ inputs.platform }}
-        INPUT_ALTERNATE_REPOSITORY: ${{ inputs.alternate_repository }}
-        INPUT_DRY_RUN: ${{ inputs.dry_run }}
       run: |
         .github/actions/build-test-push/test.sh \
-          --version "$INPUT_VERSION" \
-          --platform "$INPUT_PLATFORM" \
-          --alternate-repository "$INPUT_ALTERNATE_REPOSITORY" \
-          --dry-run "$INPUT_DRY_RUN"
+          --version "${{ inputs.version }}" \
+          --platform "${{ inputs.platform }}" \
+          --alternate-repository "${{ inputs.alternate_repository }}" \
+          --dry-run "${{ inputs.dry_run }}"
 
     - name: Push
       if: inputs.docker_hub_username != ''
       shell: bash
-      env:
-        INPUT_TAGS: ${{ steps.build.outputs.tags }},${{ steps.build.outputs.tags_chromium }},${{ steps.build.outputs.tags_libreoffice }},${{ steps.build.outputs.tags_cloud_run }},${{ steps.build.outputs.tags_cloud_run_chromium }},${{ steps.build.outputs.tags_cloud_run_libreoffice }},${{ steps.build.outputs.tags_aws_lambda }},${{ steps.build.outputs.tags_aws_lambda_chromium }},${{ steps.build.outputs.tags_aws_lambda_libreoffice }}
-        INPUT_DRY_RUN: ${{ inputs.dry_run }}
       run: |
         .github/actions/build-test-push/push.sh \
-          --tags "$INPUT_TAGS" \
-          --dry-run "$INPUT_DRY_RUN"
+          --tags "${{ steps.build.outputs.tags }},${{ steps.build.outputs.tags_cloud_run }},${{ steps.build.outputs.tags_aws_lambda }}" \
+          --dry-run "${{ inputs.dry_run }}"
 
     - name: Outputs
       shell: bash
       run: |
         echo "tags=${{ steps.build.outputs.tags }}"
-        echo "tags_chromium=${{ steps.build.outputs.tags_chromium }}"
-        echo "tags_libreoffice=${{ steps.build.outputs.tags_libreoffice }}"
         echo "tags_cloud_run=${{ steps.build.outputs.tags_cloud_run }}"
-        echo "tags_cloud_run_chromium=${{ steps.build.outputs.tags_cloud_run_chromium }}"
-        echo "tags_cloud_run_libreoffice=${{ steps.build.outputs.tags_cloud_run_libreoffice }}"
         echo "tags_aws_lambda=${{ steps.build.outputs.tags_aws_lambda }}"
-        echo "tags_aws_lambda_chromium=${{ steps.build.outputs.tags_aws_lambda_chromium }}"
-        echo "tags_aws_lambda_libreoffice=${{ steps.build.outputs.tags_aws_lambda_libreoffice }}"

.github/actions/build-test-push/build.sh

@@ -55,14 +55,8 @@ fi
 
 # Build tags arrays.
 tags=()
-tags_chromium=()
-tags_libreoffice=()
 tags_cloud_run=()
-tags_cloud_run_chromium=()
-tags_cloud_run_libreoffice=()
 tags_aws_lambda=()
-tags_aws_lambda_chromium=()
-tags_aws_lambda_libreoffice=()
 
 IFS='/' read -ra arch <<< "$platform"
 IFS='.' read -ra semver <<< "$version"
@@ -75,95 +69,55 @@ if [ "${#semver[@]}" -eq 3 ]; then
   minor="${semver[1]}"
   patch="${semver[2]}"
 
-  for suffix in "latest" "$major" "$major.$minor" "$major.$minor.$patch"; do
-    tags+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$suffix-${arch[1]}")
-    tags_chromium+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$suffix-chromium-${arch[1]}")
-    tags_libreoffice+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$suffix-libreoffice-${arch[1]}")
-  done
+  tags+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:latest-${arch[1]}")
+  tags+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$major-${arch[1]}")
+  tags+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$major.$minor-${arch[1]}")
+  tags+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$major.$minor.$patch-${arch[1]}")
 
   if [ "$platform" = "linux/amd64" ]; then
-    for suffix in "latest" "$major" "$major.$minor" "$major.$minor.$patch"; do
-      tags_cloud_run+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$suffix-cloudrun")
-      tags_cloud_run_chromium+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$suffix-chromium-cloudrun")
-      tags_cloud_run_libreoffice+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$suffix-libreoffice-cloudrun")
-    done
+    tags_cloud_run+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:latest-cloudrun")
+    tags_cloud_run+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$major-cloudrun")
+    tags_cloud_run+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$major.$minor-cloudrun")
+    tags_cloud_run+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$major.$minor.$patch-cloudrun")
   fi
 
   if [ "$platform" = "linux/amd64" ] || [ "$platform" = "linux/arm64" ]; then
-    for suffix in "latest" "$major" "$major.$minor" "$major.$minor.$patch"; do
-      tags_aws_lambda+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$suffix-aws-lambda-${arch[1]}")
-      tags_aws_lambda_chromium+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$suffix-chromium-aws-lambda-${arch[1]}")
-      tags_aws_lambda_libreoffice+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$suffix-libreoffice-aws-lambda-${arch[1]}")
-    done
+    tags_aws_lambda+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:latest-aws-lambda-${arch[1]}")
+    tags_aws_lambda+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$major-aws-lambda-${arch[1]}")
+    tags_aws_lambda+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$major.$minor-aws-lambda-${arch[1]}")
+    tags_aws_lambda+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$major.$minor.$patch-aws-lambda-${arch[1]}")
   fi
 else
   echo
   echo "Non-semver version detected, fallback to $version"
 
   tags+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$version-${arch[1]}")
-  tags_chromium+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$version-chromium-${arch[1]}")
-  tags_libreoffice+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$version-libreoffice-${arch[1]}")
-
   if [ "$platform" = "linux/amd64" ]; then
     tags_cloud_run+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$version-cloudrun")
-    tags_cloud_run_chromium+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$version-chromium-cloudrun")
-    tags_cloud_run_libreoffice+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$version-libreoffice-cloudrun")
   fi
 
   if [ "$platform" = "linux/amd64" ] || [ "$platform" = "linux/arm64" ]; then
     tags_aws_lambda+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$version-aws-lambda-${arch[1]}")
-    tags_aws_lambda_chromium+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$version-chromium-aws-lambda-${arch[1]}")
-    tags_aws_lambda_libreoffice+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$version-libreoffice-aws-lambda-${arch[1]}")
   fi
 fi
 
 tags_flags=()
-tags_chromium_flags=()
-tags_libreoffice_flags=()
 tags_cloud_run_flags=()
-tags_cloud_run_chromium_flags=()
-tags_cloud_run_libreoffice_flags=()
 tags_aws_lambda_flags=()
-tags_aws_lambda_chromium_flags=()
-tags_aws_lambda_libreoffice_flags=()
 
 echo "Will use the following tags:"
 for tag in "${tags[@]}"; do
   tags_flags+=("-t" "$tag")
   echo "- $tag"
 done
-for tag in "${tags_chromium[@]}"; do
-  tags_chromium_flags+=("-t" "$tag")
-  echo "- $tag"
-done
-for tag in "${tags_libreoffice[@]}"; do
-  tags_libreoffice_flags+=("-t" "$tag")
-  echo "- $tag"
-done
 for tag in "${tags_cloud_run[@]}"; do
   tags_cloud_run_flags+=("-t" "$tag")
   echo "- $tag"
 done
-for tag in "${tags_cloud_run_chromium[@]}"; do
-  tags_cloud_run_chromium_flags+=("-t" "$tag")
-  echo "- $tag"
-done
-for tag in "${tags_cloud_run_libreoffice[@]}"; do
-  tags_cloud_run_libreoffice_flags+=("-t" "$tag")
-  echo "- $tag"
-done
 for tag in "${tags_aws_lambda[@]}"; do
   tags_aws_lambda_flags+=("-t" "$tag")
   echo "- $tag"
 done
-for tag in "${tags_aws_lambda_chromium[@]}"; do
-  tags_aws_lambda_chromium_flags+=("-t" "$tag")
-  echo "- $tag"
-done
-for tag in "${tags_aws_lambda_libreoffice[@]}"; do
-  tags_aws_lambda_libreoffice_flags+=("-t" "$tag")
-  echo "- $tag"
-done
 echo
 
 # Build images.
@@ -191,9 +145,7 @@ join() {
 
 no_arch_tag="$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$version"
 
-# Full variant.
 cmd="docker buildx build \
-    --target gotenberg \
     --build-arg GOTENBERG_VERSION=$version \
     --platform $platform \
     --load \
@@ -203,102 +155,30 @@ cmd="docker buildx build \
 "
 run_cmd "$cmd"
 
-# Chromium only variant.
-cmd="docker buildx build \
-    --target gotenberg-chromium \
-    --build-arg GOTENBERG_VERSION=$version \
-    --platform $platform \
-    --load \
-    ${tags_chromium_flags[*]} \
-    -f $DOCKERFILE $DOCKER_BUILD_CONTEXT
-"
-run_cmd "$cmd"
-
-# LibreOffice only variant.
-cmd="docker buildx build \
-    --target gotenberg-libreoffice \
-    --build-arg GOTENBERG_VERSION=$version \
-    --platform $platform \
-    --load \
-    ${tags_libreoffice_flags[*]} \
-    -f $DOCKERFILE $DOCKER_BUILD_CONTEXT
-"
-run_cmd "$cmd"
-
-# Cloud Run variants (amd64 only).
 if [ "$platform" = "linux/amd64" ]; then
-  cmd="docker buildx build \
-      --target gotenberg-cloudrun \
+  cmd="docker build \
+      --build-arg DOCKER_REGISTRY=$DOCKER_REGISTRY \
+      --build-arg DOCKER_REPOSITORY=$DOCKER_REPOSITORY \
       --build-arg GOTENBERG_VERSION=$version \
-      --platform $platform \
-      --load \
       ${tags_cloud_run_flags[*]} \
-      -f $DOCKERFILE $DOCKER_BUILD_CONTEXT
-  "
-  run_cmd "$cmd"
-
-  cmd="docker buildx build \
-      --target gotenberg-cloudrun-chromium \
-      --build-arg GOTENBERG_VERSION=$version \
-      --platform $platform \
-      --load \
-      ${tags_cloud_run_chromium_flags[*]} \
-      -f $DOCKERFILE $DOCKER_BUILD_CONTEXT
-  "
-  run_cmd "$cmd"
-
-  cmd="docker buildx build \
-      --target gotenberg-cloudrun-libreoffice \
-      --build-arg GOTENBERG_VERSION=$version \
-      --platform $platform \
-      --load \
-      ${tags_cloud_run_libreoffice_flags[*]} \
-      -f $DOCKERFILE $DOCKER_BUILD_CONTEXT
+      -f $DOCKERFILE_CLOUDRUN $DOCKER_BUILD_CONTEXT
   "
   run_cmd "$cmd"
 fi
 
-# AWS Lambda variants (amd64 + arm64 only).
 if [ "$platform" = "linux/amd64" ] || [ "$platform" = "linux/arm64" ]; then
-  cmd="docker buildx build \
-      --target gotenberg-aws-lambda \
-      --build-arg GOTENBERG_VERSION=$version \
-      --platform $platform \
-      --load \
-      ${tags_aws_lambda_flags[*]} \
-      -f $DOCKERFILE $DOCKER_BUILD_CONTEXT
-  "
-  run_cmd "$cmd"
-
-  cmd="docker buildx build \
-      --target gotenberg-aws-lambda-chromium \
-      --build-arg GOTENBERG_VERSION=$version \
-      --platform $platform \
-      --load \
-      ${tags_aws_lambda_chromium_flags[*]} \
-      -f $DOCKERFILE $DOCKER_BUILD_CONTEXT
-  "
-  run_cmd "$cmd"
-
-  cmd="docker buildx build \
-      --target gotenberg-aws-lambda-libreoffice \
-      --build-arg GOTENBERG_VERSION=$version \
-      --platform $platform \
-      --load \
-      ${tags_aws_lambda_libreoffice_flags[*]} \
-      -f $DOCKERFILE $DOCKER_BUILD_CONTEXT
+  cmd="docker build \
+        --build-arg DOCKER_REGISTRY=$DOCKER_REGISTRY \
+        --build-arg DOCKER_REPOSITORY=$DOCKER_REPOSITORY \
+        --build-arg GOTENBERG_VERSION=$version \
+        ${tags_aws_lambda_flags[*]} \
+        -f $DOCKERFILE_AWS_LAMBDA $DOCKER_BUILD_CONTEXT
   "
   run_cmd "$cmd"
 fi
 
 echo "✅ Done!"
 echo "tags=$(join "," "${tags[@]}")" >> "$GITHUB_OUTPUT"
-echo "tags_chromium=$(join "," "${tags_chromium[@]}")" >> "$GITHUB_OUTPUT"
-echo "tags_libreoffice=$(join "," "${tags_libreoffice[@]}")" >> "$GITHUB_OUTPUT"
 echo "tags_cloud_run=$(join "," "${tags_cloud_run[@]}")" >> "$GITHUB_OUTPUT"
-echo "tags_cloud_run_chromium=$(join "," "${tags_cloud_run_chromium[@]}")" >> "$GITHUB_OUTPUT"
-echo "tags_cloud_run_libreoffice=$(join "," "${tags_cloud_run_libreoffice[@]}")" >> "$GITHUB_OUTPUT"
 echo "tags_aws_lambda=$(join "," "${tags_aws_lambda[@]}")" >> "$GITHUB_OUTPUT"
-echo "tags_aws_lambda_chromium=$(join "," "${tags_aws_lambda_chromium[@]}")" >> "$GITHUB_OUTPUT"
-echo "tags_aws_lambda_libreoffice=$(join "," "${tags_aws_lambda_libreoffice[@]}")" >> "$GITHUB_OUTPUT"
 exit 0

.github/actions/clean/action.yml

@@ -23,12 +23,9 @@ runs:
       env:
         DOCKERHUB_USERNAME: ${{ inputs.docker_hub_username }}
         DOCKERHUB_TOKEN: ${{ inputs.docker_hub_password }}
-        INPUT_TAGS: ${{ inputs.tags }}
-        INPUT_SNAPSHOT_VERSION: ${{ inputs.snapshot_version }}
-        INPUT_DRY_RUN: ${{ inputs.dry_run }}
       shell: bash
       run: |
         .github/actions/clean/clean.sh \
-          --tags "$INPUT_TAGS" \
-          --snapshot-version "$INPUT_SNAPSHOT_VERSION" \
-          --dry-run "$INPUT_DRY_RUN"
+          --tags "${{ inputs.tags }}" \
+          --snapshot-version "${{ inputs.snapshot_version }}" \
+          --dry-run "${{ inputs.dry_run }}"

.github/actions/merge/action.yml

@@ -31,7 +31,7 @@ runs:
       uses: docker/setup-buildx-action@v3
 
     - name: Check out code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v5
 
     - name: Log in to Docker Hub
       uses: docker/login-action@v3
@@ -41,12 +41,8 @@ runs:
 
     - name: Merge
       shell: bash
-      env:
-        INPUT_TAGS: ${{ inputs.tags }}
-        INPUT_ALTERNATE_REGISTRY: ${{ inputs.alternate_registry }}
-        INPUT_DRY_RUN: ${{ inputs.dry_run }}
       run: |
         .github/actions/merge/merge.sh \
-          --tags "$INPUT_TAGS" \
-          --alternate-registry "$INPUT_ALTERNATE_REGISTRY" \
-          --dry-run "$INPUT_DRY_RUN"
+          --tags "${{ inputs.tags }}" \
+          --alternate-registry "${{ inputs.alternate_registry }}" \
+          --dry-run "${{ inputs.dry_run }}"

.github/dependabot.yml

@@ -12,15 +12,7 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-    ignore:
-      # Held at v0.14.2: v0.15.x breaks the headless print-mode paint pipeline
-      # (rAF / ResizeObserver / IntersectionObserver stop firing, blank charts).
-      # See https://github.com/gotenberg/gotenberg/issues/1535.
-      - dependency-name: "github.com/chromedp/chromedp"
-      - dependency-name: "github.com/chromedp/cdproto"
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "weekly"
-    cooldown:
-      default-days: 7

.github/workflows/continuous-delivery.yml

@@ -13,17 +13,11 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       tags: ${{ steps.build_push.outputs.tags }}
-      tags_chromium: ${{ steps.build_push.outputs.tags_chromium }}
-      tags_libreoffice: ${{ steps.build_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_push.outputs.tags_cloud_run }}
-      tags_cloud_run_chromium: ${{ steps.build_push.outputs.tags_cloud_run_chromium }}
-      tags_cloud_run_libreoffice: ${{ steps.build_push.outputs.tags_cloud_run_libreoffice }}
       tags_aws_lambda: ${{ steps.build_push.outputs.tags_aws_lambda }}
-      tags_aws_lambda_chromium: ${{ steps.build_push.outputs.tags_aws_lambda_chromium }}
-      tags_aws_lambda_libreoffice: ${{ steps.build_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Build and push
         id: build_push
@@ -40,17 +34,11 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       tags: ${{ steps.build_push.outputs.tags }}
-      tags_chromium: ${{ steps.build_push.outputs.tags_chromium }}
-      tags_libreoffice: ${{ steps.build_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_push.outputs.tags_cloud_run }}
-      tags_cloud_run_chromium: ${{ steps.build_push.outputs.tags_cloud_run_chromium }}
-      tags_cloud_run_libreoffice: ${{ steps.build_push.outputs.tags_cloud_run_libreoffice }}
       tags_aws_lambda: ${{ steps.build_push.outputs.tags_aws_lambda }}
-      tags_aws_lambda_chromium: ${{ steps.build_push.outputs.tags_aws_lambda_chromium }}
-      tags_aws_lambda_libreoffice: ${{ steps.build_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Build and push
         id: build_push
@@ -67,17 +55,11 @@ jobs:
     runs-on: ubuntu-24.04-ppc64le
     outputs:
       tags: ${{ steps.build_push.outputs.tags }}
-      tags_chromium: ${{ steps.build_push.outputs.tags_chromium }}
-      tags_libreoffice: ${{ steps.build_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_push.outputs.tags_cloud_run }}
-      tags_cloud_run_chromium: ${{ steps.build_push.outputs.tags_cloud_run_chromium }}
-      tags_cloud_run_libreoffice: ${{ steps.build_push.outputs.tags_cloud_run_libreoffice }}
       tags_aws_lambda: ${{ steps.build_push.outputs.tags_aws_lambda }}
-      tags_aws_lambda_chromium: ${{ steps.build_push.outputs.tags_aws_lambda_chromium }}
-      tags_aws_lambda_libreoffice: ${{ steps.build_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Build and push
         id: build_push
@@ -94,17 +76,11 @@ jobs:
     runs-on: ubuntu-24.04-arm
     outputs:
       tags: ${{ steps.build_push.outputs.tags }}
-      tags_chromium: ${{ steps.build_push.outputs.tags_chromium }}
-      tags_libreoffice: ${{ steps.build_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_push.outputs.tags_cloud_run }}
-      tags_cloud_run_chromium: ${{ steps.build_push.outputs.tags_cloud_run_chromium }}
-      tags_cloud_run_libreoffice: ${{ steps.build_push.outputs.tags_cloud_run_libreoffice }}
       tags_aws_lambda: ${{ steps.build_push.outputs.tags_aws_lambda }}
-      tags_aws_lambda_chromium: ${{ steps.build_push.outputs.tags_aws_lambda_chromium }}
-      tags_aws_lambda_libreoffice: ${{ steps.build_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Build and push
         id: build_push
@@ -121,17 +97,11 @@ jobs:
     runs-on: ubuntu-24.04-arm
     outputs:
       tags: ${{ steps.build_push.outputs.tags }}
-      tags_chromium: ${{ steps.build_push.outputs.tags_chromium }}
-      tags_libreoffice: ${{ steps.build_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_push.outputs.tags_cloud_run }}
-      tags_cloud_run_chromium: ${{ steps.build_push.outputs.tags_cloud_run_chromium }}
-      tags_cloud_run_libreoffice: ${{ steps.build_push.outputs.tags_cloud_run_libreoffice }}
       tags_aws_lambda: ${{ steps.build_push.outputs.tags_aws_lambda }}
-      tags_aws_lambda_chromium: ${{ steps.build_push.outputs.tags_aws_lambda_chromium }}
-      tags_aws_lambda_libreoffice: ${{ steps.build_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Build and push
         id: build_push
@@ -154,7 +124,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Merge
         uses: ./.github/actions/merge
@@ -162,20 +132,7 @@ jobs:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
           tags: "${{ needs.release_amd64.outputs.tags }},${{ needs.release_386.outputs.tags }},${{ needs.release_ppc64le.outputs.tags }},${{ needs.release_arm64.outputs.tags }},${{ needs.release_arm_v7.outputs.tags }}"
-
-      - name: Merge Chromium
-        uses: ./.github/actions/merge
-        with:
-          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
-          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
-          tags: "${{ needs.release_amd64.outputs.tags_chromium }},${{ needs.release_386.outputs.tags_chromium }},${{ needs.release_ppc64le.outputs.tags_chromium }},${{ needs.release_arm64.outputs.tags_chromium }},${{ needs.release_arm_v7.outputs.tags_chromium }}"
-
-      - name: Merge LibreOffice
-        uses: ./.github/actions/merge
-        with:
-          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
-          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
-          tags: "${{ needs.release_amd64.outputs.tags_libreoffice }},${{ needs.release_386.outputs.tags_libreoffice }},${{ needs.release_ppc64le.outputs.tags_libreoffice }},${{ needs.release_arm64.outputs.tags_libreoffice }},${{ needs.release_arm_v7.outputs.tags_libreoffice }}"
+          alternate_registry: thecodingmachine
 
       - name: Merge AWS Lambda
         uses: ./.github/actions/merge
@@ -183,24 +140,11 @@ jobs:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
           tags: "${{ needs.release_amd64.outputs.tags_aws_lambda }},${{ needs.release_arm64.outputs.tags_aws_lambda }}"
-
-      - name: Merge AWS Lambda Chromium
-        uses: ./.github/actions/merge
-        with:
-          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
-          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
-          tags: "${{ needs.release_amd64.outputs.tags_aws_lambda_chromium }},${{ needs.release_arm64.outputs.tags_aws_lambda_chromium }}"
-
-      - name: Merge AWS Lambda LibreOffice
-        uses: ./.github/actions/merge
-        with:
-          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
-          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
-          tags: "${{ needs.release_amd64.outputs.tags_aws_lambda_libreoffice }},${{ needs.release_arm64.outputs.tags_aws_lambda_libreoffice }}"
+          alternate_registry: thecodingmachine
 
       - name: Clean
         uses: ./.github/actions/clean
         with:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
-          tags: "${{ needs.release_amd64.outputs.tags }},${{ needs.release_386.outputs.tags }},${{ needs.release_ppc64le.outputs.tags }},${{ needs.release_arm64.outputs.tags }},${{ needs.release_arm_v7.outputs.tags }},${{ needs.release_amd64.outputs.tags_chromium }},${{ needs.release_386.outputs.tags_chromium }},${{ needs.release_ppc64le.outputs.tags_chromium }},${{ needs.release_arm64.outputs.tags_chromium }},${{ needs.release_arm_v7.outputs.tags_chromium }},${{ needs.release_amd64.outputs.tags_libreoffice }},${{ needs.release_386.outputs.tags_libreoffice }},${{ needs.release_ppc64le.outputs.tags_libreoffice }},${{ needs.release_arm64.outputs.tags_libreoffice }},${{ needs.release_arm_v7.outputs.tags_libreoffice }},${{ needs.release_amd64.outputs.tags_aws_lambda }},${{ needs.release_arm64.outputs.tags_aws_lambda }},${{ needs.release_amd64.outputs.tags_aws_lambda_chromium }},${{ needs.release_arm64.outputs.tags_aws_lambda_chromium }},${{ needs.release_amd64.outputs.tags_aws_lambda_libreoffice }},${{ needs.release_arm64.outputs.tags_aws_lambda_libreoffice }}"
+          tags: "${{ needs.release_amd64.outputs.tags }},${{ needs.release_386.outputs.tags }},${{ needs.release_ppc64le.outputs.tags }},${{ needs.release_arm64.outputs.tags }},${{ needs.release_arm_v7.outputs.tags }},${{ needs.release_amd64.outputs.tags_aws_lambda }},${{ needs.release_arm64.outputs.tags_aws_lambda }}"

.github/workflows/continuous-integration.yml

@@ -21,10 +21,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Setup Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
 
@@ -38,15 +38,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version-file: .node-version
 
       - name: Install Dependencies
-        run: npm ci --ignore-scripts
+        run: npm i
 
       - name: Run linters
         run: make lint-prettier
@@ -59,10 +59,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Setup Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
 
@@ -77,17 +77,11 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       tags: ${{ steps.build_test_push.outputs.tags }}
-      tags_chromium: ${{ steps.build_test_push.outputs.tags_chromium }}
-      tags_libreoffice: ${{ steps.build_test_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_test_push.outputs.tags_cloud_run }}
-      tags_cloud_run_chromium: ${{ steps.build_test_push.outputs.tags_cloud_run_chromium }}
-      tags_cloud_run_libreoffice: ${{ steps.build_test_push.outputs.tags_cloud_run_libreoffice }}
       tags_aws_lambda: ${{ steps.build_test_push.outputs.tags_aws_lambda }}
-      tags_aws_lambda_chromium: ${{ steps.build_test_push.outputs.tags_aws_lambda_chromium }}
-      tags_aws_lambda_libreoffice: ${{ steps.build_test_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Build, test and push
         id: build_test_push
@@ -107,17 +101,11 @@ jobs:
     runs-on: ubuntu-24.04-ppc64le
     outputs:
       tags: ${{ steps.build_test_push.outputs.tags }}
-      tags_chromium: ${{ steps.build_test_push.outputs.tags_chromium }}
-      tags_libreoffice: ${{ steps.build_test_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_test_push.outputs.tags_cloud_run }}
-      tags_cloud_run_chromium: ${{ steps.build_test_push.outputs.tags_cloud_run_chromium }}
-      tags_cloud_run_libreoffice: ${{ steps.build_test_push.outputs.tags_cloud_run_libreoffice }}
       tags_aws_lambda: ${{ steps.build_test_push.outputs.tags_aws_lambda }}
-      tags_aws_lambda_chromium: ${{ steps.build_test_push.outputs.tags_aws_lambda_chromium }}
-      tags_aws_lambda_libreoffice: ${{ steps.build_test_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Build, test and push
         id: build_test_push
@@ -137,17 +125,11 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       tags: ${{ steps.build_test_push.outputs.tags }}
-      tags_chromium: ${{ steps.build_test_push.outputs.tags_chromium }}
-      tags_libreoffice: ${{ steps.build_test_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_test_push.outputs.tags_cloud_run }}
-      tags_cloud_run_chromium: ${{ steps.build_test_push.outputs.tags_cloud_run_chromium }}
-      tags_cloud_run_libreoffice: ${{ steps.build_test_push.outputs.tags_cloud_run_libreoffice }}
       tags_aws_lambda: ${{ steps.build_test_push.outputs.tags_aws_lambda }}
-      tags_aws_lambda_chromium: ${{ steps.build_test_push.outputs.tags_aws_lambda_chromium }}
-      tags_aws_lambda_libreoffice: ${{ steps.build_test_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Build, test and push
         id: build_test_push
@@ -167,17 +149,11 @@ jobs:
     runs-on: ubuntu-24.04-arm
     outputs:
       tags: ${{ steps.build_test_push.outputs.tags }}
-      tags_chromium: ${{ steps.build_test_push.outputs.tags_chromium }}
-      tags_libreoffice: ${{ steps.build_test_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_test_push.outputs.tags_cloud_run }}
-      tags_cloud_run_chromium: ${{ steps.build_test_push.outputs.tags_cloud_run_chromium }}
-      tags_cloud_run_libreoffice: ${{ steps.build_test_push.outputs.tags_cloud_run_libreoffice }}
       tags_aws_lambda: ${{ steps.build_test_push.outputs.tags_aws_lambda }}
-      tags_aws_lambda_chromium: ${{ steps.build_test_push.outputs.tags_aws_lambda_chromium }}
-      tags_aws_lambda_libreoffice: ${{ steps.build_test_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Build, test and push
         id: build_test_push
@@ -197,17 +173,11 @@ jobs:
     runs-on: ubuntu-24.04-arm
     outputs:
       tags: ${{ steps.build_test_push.outputs.tags }}
-      tags_chromium: ${{ steps.build_test_push.outputs.tags_chromium }}
-      tags_libreoffice: ${{ steps.build_test_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_test_push.outputs.tags_cloud_run }}
-      tags_cloud_run_chromium: ${{ steps.build_test_push.outputs.tags_cloud_run_chromium }}
-      tags_cloud_run_libreoffice: ${{ steps.build_test_push.outputs.tags_cloud_run_libreoffice }}
       tags_aws_lambda: ${{ steps.build_test_push.outputs.tags_aws_lambda }}
-      tags_aws_lambda_chromium: ${{ steps.build_test_push.outputs.tags_aws_lambda_chromium }}
-      tags_aws_lambda_libreoffice: ${{ steps.build_test_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Build, test and push
         id: build_test_push
@@ -253,7 +223,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Merge
         uses: ./.github/actions/merge
@@ -262,20 +232,6 @@ jobs:
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
           tags: "${{ needs.snapshot_amd64.outputs.tags }},${{ needs.snapshot_386.outputs.tags }},${{ needs.snapshot_ppc64le.outputs.tags }},${{ needs.snapshot_arm64.outputs.tags }},${{ needs.snapshot_arm_v7.outputs.tags }}"
 
-      - name: Merge Chromium
-        uses: ./.github/actions/merge
-        with:
-          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
-          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
-          tags: "${{ needs.snapshot_amd64.outputs.tags_chromium }},${{ needs.snapshot_386.outputs.tags_chromium }},${{ needs.snapshot_ppc64le.outputs.tags_chromium }},${{ needs.snapshot_arm64.outputs.tags_chromium }},${{ needs.snapshot_arm_v7.outputs.tags_chromium }}"
-
-      - name: Merge LibreOffice
-        uses: ./.github/actions/merge
-        with:
-          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
-          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
-          tags: "${{ needs.snapshot_amd64.outputs.tags_libreoffice }},${{ needs.snapshot_386.outputs.tags_libreoffice }},${{ needs.snapshot_ppc64le.outputs.tags_libreoffice }},${{ needs.snapshot_arm64.outputs.tags_libreoffice }},${{ needs.snapshot_arm_v7.outputs.tags_libreoffice }}"
-
       - name: Merge AWS Lambda
         uses: ./.github/actions/merge
         with:
@@ -283,26 +239,12 @@ jobs:
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
           tags: "${{ needs.snapshot_amd64.outputs.tags_aws_lambda }},${{ needs.snapshot_arm64.outputs.tags_aws_lambda }}"
 
-      - name: Merge AWS Lambda Chromium
-        uses: ./.github/actions/merge
-        with:
-          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
-          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
-          tags: "${{ needs.snapshot_amd64.outputs.tags_aws_lambda_chromium }},${{ needs.snapshot_arm64.outputs.tags_aws_lambda_chromium }}"
-
-      - name: Merge AWS Lambda LibreOffice
-        uses: ./.github/actions/merge
-        with:
-          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
-          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
-          tags: "${{ needs.snapshot_amd64.outputs.tags_aws_lambda_libreoffice }},${{ needs.snapshot_arm64.outputs.tags_aws_lambda_libreoffice }}"
-
       - name: Clean
         uses: ./.github/actions/clean
         with:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
-          tags: "${{ needs.snapshot_amd64.outputs.tags }},${{ needs.snapshot_386.outputs.tags }},${{ needs.snapshot_ppc64le.outputs.tags }},${{ needs.snapshot_arm64.outputs.tags }},${{ needs.snapshot_arm_v7.outputs.tags }},${{ needs.snapshot_amd64.outputs.tags_chromium }},${{ needs.snapshot_386.outputs.tags_chromium }},${{ needs.snapshot_ppc64le.outputs.tags_chromium }},${{ needs.snapshot_arm64.outputs.tags_chromium }},${{ needs.snapshot_arm_v7.outputs.tags_chromium }},${{ needs.snapshot_amd64.outputs.tags_libreoffice }},${{ needs.snapshot_386.outputs.tags_libreoffice }},${{ needs.snapshot_ppc64le.outputs.tags_libreoffice }},${{ needs.snapshot_arm64.outputs.tags_libreoffice }},${{ needs.snapshot_arm_v7.outputs.tags_libreoffice }},${{ needs.snapshot_amd64.outputs.tags_aws_lambda }},${{ needs.snapshot_arm64.outputs.tags_aws_lambda }},${{ needs.snapshot_amd64.outputs.tags_aws_lambda_chromium }},${{ needs.snapshot_arm64.outputs.tags_aws_lambda_chromium }},${{ needs.snapshot_amd64.outputs.tags_aws_lambda_libreoffice }},${{ needs.snapshot_arm64.outputs.tags_aws_lambda_libreoffice }}"
+          tags: "${{ needs.snapshot_amd64.outputs.tags }},${{ needs.snapshot_386.outputs.tags }},${{ needs.snapshot_ppc64le.outputs.tags }},${{ needs.snapshot_arm64.outputs.tags }},${{ needs.snapshot_arm_v7.outputs.tags }},${{ needs.snapshot_amd64.outputs.tags_aws_lambda }},${{ needs.snapshot_arm64.outputs.tags_aws_lambda }}"
 
   edge_amd64:
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
@@ -312,17 +254,11 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       tags: ${{ steps.build_test_push.outputs.tags }}
-      tags_chromium: ${{ steps.build_test_push.outputs.tags_chromium }}
-      tags_libreoffice: ${{ steps.build_test_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_test_push.outputs.tags_cloud_run }}
-      tags_cloud_run_chromium: ${{ steps.build_test_push.outputs.tags_cloud_run_chromium }}
-      tags_cloud_run_libreoffice: ${{ steps.build_test_push.outputs.tags_cloud_run_libreoffice }}
       tags_aws_lambda: ${{ steps.build_test_push.outputs.tags_aws_lambda }}
-      tags_aws_lambda_chromium: ${{ steps.build_test_push.outputs.tags_aws_lambda_chromium }}
-      tags_aws_lambda_libreoffice: ${{ steps.build_test_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Build, test and push
         id: build_test_push
@@ -341,17 +277,11 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       tags: ${{ steps.build_test_push.outputs.tags }}
-      tags_chromium: ${{ steps.build_test_push.outputs.tags_chromium }}
-      tags_libreoffice: ${{ steps.build_test_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_test_push.outputs.tags_cloud_run }}
-      tags_cloud_run_chromium: ${{ steps.build_test_push.outputs.tags_cloud_run_chromium }}
-      tags_cloud_run_libreoffice: ${{ steps.build_test_push.outputs.tags_cloud_run_libreoffice }}
       tags_aws_lambda: ${{ steps.build_test_push.outputs.tags_aws_lambda }}
-      tags_aws_lambda_chromium: ${{ steps.build_test_push.outputs.tags_aws_lambda_chromium }}
-      tags_aws_lambda_libreoffice: ${{ steps.build_test_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Build, test and push
         id: build_test_push
@@ -370,17 +300,11 @@ jobs:
     runs-on: ubuntu-24.04-ppc64le
     outputs:
       tags: ${{ steps.build_test_push.outputs.tags }}
-      tags_chromium: ${{ steps.build_test_push.outputs.tags_chromium }}
-      tags_libreoffice: ${{ steps.build_test_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_test_push.outputs.tags_cloud_run }}
-      tags_cloud_run_chromium: ${{ steps.build_test_push.outputs.tags_cloud_run_chromium }}
-      tags_cloud_run_libreoffice: ${{ steps.build_test_push.outputs.tags_cloud_run_libreoffice }}
       tags_aws_lambda: ${{ steps.build_test_push.outputs.tags_aws_lambda }}
-      tags_aws_lambda_chromium: ${{ steps.build_test_push.outputs.tags_aws_lambda_chromium }}
-      tags_aws_lambda_libreoffice: ${{ steps.build_test_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Build, test and push
         id: build_test_push
@@ -399,17 +323,11 @@ jobs:
     runs-on: ubuntu-24.04-arm
     outputs:
       tags: ${{ steps.build_test_push.outputs.tags }}
-      tags_chromium: ${{ steps.build_test_push.outputs.tags_chromium }}
-      tags_libreoffice: ${{ steps.build_test_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_test_push.outputs.tags_cloud_run }}
-      tags_cloud_run_chromium: ${{ steps.build_test_push.outputs.tags_cloud_run_chromium }}
-      tags_cloud_run_libreoffice: ${{ steps.build_test_push.outputs.tags_cloud_run_libreoffice }}
       tags_aws_lambda: ${{ steps.build_test_push.outputs.tags_aws_lambda }}
-      tags_aws_lambda_chromium: ${{ steps.build_test_push.outputs.tags_aws_lambda_chromium }}
-      tags_aws_lambda_libreoffice: ${{ steps.build_test_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Build, test and push
         id: build_test_push
@@ -428,17 +346,11 @@ jobs:
     runs-on: ubuntu-24.04-arm
     outputs:
       tags: ${{ steps.build_test_push.outputs.tags }}
-      tags_chromium: ${{ steps.build_test_push.outputs.tags_chromium }}
-      tags_libreoffice: ${{ steps.build_test_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_test_push.outputs.tags_cloud_run }}
-      tags_cloud_run_chromium: ${{ steps.build_test_push.outputs.tags_cloud_run_chromium }}
-      tags_cloud_run_libreoffice: ${{ steps.build_test_push.outputs.tags_cloud_run_libreoffice }}
       tags_aws_lambda: ${{ steps.build_test_push.outputs.tags_aws_lambda }}
-      tags_aws_lambda_chromium: ${{ steps.build_test_push.outputs.tags_aws_lambda_chromium }}
-      tags_aws_lambda_libreoffice: ${{ steps.build_test_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Build, test and push
         id: build_test_push
@@ -460,7 +372,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Merge
         uses: ./.github/actions/merge
@@ -468,20 +380,7 @@ jobs:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
           tags: "${{ needs.edge_amd64.outputs.tags }},${{ needs.edge_386.outputs.tags }},${{ needs.edge_ppc64le.outputs.tags }},${{ needs.edge_arm64.outputs.tags }},${{ needs.edge_arm_v7.outputs.tags }}"
-
-      - name: Merge Chromium
-        uses: ./.github/actions/merge
-        with:
-          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
-          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
-          tags: "${{ needs.edge_amd64.outputs.tags_chromium }},${{ needs.edge_386.outputs.tags_chromium }},${{ needs.edge_ppc64le.outputs.tags_chromium }},${{ needs.edge_arm64.outputs.tags_chromium }},${{ needs.edge_arm_v7.outputs.tags_chromium }}"
-
-      - name: Merge LibreOffice
-        uses: ./.github/actions/merge
-        with:
-          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
-          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
-          tags: "${{ needs.edge_amd64.outputs.tags_libreoffice }},${{ needs.edge_386.outputs.tags_libreoffice }},${{ needs.edge_ppc64le.outputs.tags_libreoffice }},${{ needs.edge_arm64.outputs.tags_libreoffice }},${{ needs.edge_arm_v7.outputs.tags_libreoffice }}"
+          alternate_registry: thecodingmachine
 
       - name: Merge AWS Lambda
         uses: ./.github/actions/merge
@@ -489,24 +388,11 @@ jobs:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
           tags: "${{ needs.edge_amd64.outputs.tags_aws_lambda }},${{ needs.edge_arm64.outputs.tags_aws_lambda }}"
-
-      - name: Merge AWS Lambda Chromium
-        uses: ./.github/actions/merge
-        with:
-          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
-          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
-          tags: "${{ needs.edge_amd64.outputs.tags_aws_lambda_chromium }},${{ needs.edge_arm64.outputs.tags_aws_lambda_chromium }}"
-
-      - name: Merge AWS Lambda LibreOffice
-        uses: ./.github/actions/merge
-        with:
-          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
-          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
-          tags: "${{ needs.edge_amd64.outputs.tags_aws_lambda_libreoffice }},${{ needs.edge_arm64.outputs.tags_aws_lambda_libreoffice }}"
+          alternate_registry: thecodingmachine
 
       - name: Clean
         uses: ./.github/actions/clean
         with:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
-          tags: "${{ needs.edge_amd64.outputs.tags }},${{ needs.edge_386.outputs.tags }},${{ needs.edge_ppc64le.outputs.tags }},${{ needs.edge_arm64.outputs.tags }},${{ needs.edge_arm_v7.outputs.tags }},${{ needs.edge_amd64.outputs.tags_chromium }},${{ needs.edge_386.outputs.tags_chromium }},${{ needs.edge_ppc64le.outputs.tags_chromium }},${{ needs.edge_arm64.outputs.tags_chromium }},${{ needs.edge_arm_v7.outputs.tags_chromium }},${{ needs.edge_amd64.outputs.tags_libreoffice }},${{ needs.edge_386.outputs.tags_libreoffice }},${{ needs.edge_ppc64le.outputs.tags_libreoffice }},${{ needs.edge_arm64.outputs.tags_libreoffice }},${{ needs.edge_arm_v7.outputs.tags_libreoffice }},${{ needs.edge_amd64.outputs.tags_aws_lambda }},${{ needs.edge_arm64.outputs.tags_aws_lambda }},${{ needs.edge_amd64.outputs.tags_aws_lambda_chromium }},${{ needs.edge_arm64.outputs.tags_aws_lambda_chromium }},${{ needs.edge_amd64.outputs.tags_aws_lambda_libreoffice }},${{ needs.edge_arm64.outputs.tags_aws_lambda_libreoffice }}"
+          tags: "${{ needs.edge_amd64.outputs.tags }},${{ needs.edge_386.outputs.tags }},${{ needs.edge_ppc64le.outputs.tags }},${{ needs.edge_arm64.outputs.tags }},${{ needs.edge_arm_v7.outputs.tags }},${{ needs.edge_amd64.outputs.tags_aws_lambda }},${{ needs.edge_arm64.outputs.tags_aws_lambda }}"

.github/workflows/pull-request-cleanup.yml

@@ -14,7 +14,7 @@ jobs:
     continue-on-error: true
     steps:
       - name: Check out code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Cleanup
         uses: ./.github/actions/clean

.golangci.yml

@@ -24,14 +24,13 @@ linters:
     - ineffassign
     - misspell
     - prealloc
+    - promlinter
     - staticcheck
     - testableexamples
     - tparallel
     - unconvert
     - unused
-    - sloglint
     - usetesting
-    - gocritic
     - wastedassign
     - whitespace
   exclusions:
@@ -41,6 +40,10 @@ linters:
       - common-false-positives
       - legacy
       - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
 formatters:
   enable:
     - gci
@@ -56,3 +59,7 @@ formatters:
       custom-order: true
   exclusions:
     generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

.node-version

@@ -1 +1 @@
-24.15.0
+24.11.0

.npmrc

@@ -1 +0,0 @@
-min-release-age=7

AGENTS.md

@@ -1 +0,0 @@
-CONTRIBUTING.md

AGENTS.md

@@ -0,0 +1,66 @@
+# Operational Guidelines for Gotenberg
+
+As an AI agent working on the Gotenberg repository, you are expected to act with the diligence and architectural foresight of a Senior Go Engineer. Gotenberg is a widely used production dependency; stability and backward compatibility are paramount.
+
+## 1. Core Philosophy & Stability
+
+- **Backward Compatibility is Law:** This project creates a public API. Never modify existing flags, configuration environment variables, or API form fields unless explicitly instructed to perform a breaking change. If a change is breaking, it must be flagged immediately in the plan.
+- **Defensive Programming:** Assume input data is malformed. Handle errors explicitly. Do not panic.
+- **Atomic Commits:** Isolate refactoring from feature additions. A Pull Request should do one thing well.
+
+## 2. Development Workflow & Tooling
+
+You must rely strictly on the project's Makefile for build and verification tasks. Do not run `go` commands directly unless debugging a specific package requires it.
+
+- **Formatting:** Run `make fmt` to format Go code before committing.
+- **Linting:**
+  - Run `make lint` to ensure Go code strictly adheres to the `.golangci.yml` configuration.
+  - Run `make lint-prettier` to verify formatting for non-Go files (Markdown, YAML, etc.).
+  - Zero linting errors are permitted.
+- **Building:** Run `make build` to verify compilation and Docker image construction.
+
+## 3. Architecture & Code Structure
+
+- **Idiomatic Go:** Follow "Effective Go" principles.
+- **Directory Separation:**
+  - `cmd/`: Application entry points only. Contains wiring and startup logic. **No business logic is permitted here.**
+  - `pkg/`: Core library code and modules. All business logic resides here.
+- **Module System:** Gotenberg is modular (e.g., Chromium, LibreOffice). When adding features, determine if they belong to an existing module or require a new strict isolation.
+
+## 4. Testing Standards
+
+Gotenberg utilizes a split testing strategy. **Integration tests are the primary and preferred method for verifying features.**
+
+- **Integration Tests (`make test-integration`):**
+  - **First Priority:** Always start here when adding features or routes.
+  - Gotenberg uses **Gherkin (Godog)** for end-to-end verification.
+  - You **must** create or update the corresponding `.feature` file in `test/integration`.
+  - These tests run within the Docker context; ensure environment consistency.
+- **Unit Tests (`make test-unit`):**
+  - Use table-driven tests for pure logic within `pkg/`.
+  - Mock external dependencies (filesystem, network) where appropriate.
+
+## 5. Documentation Requirements
+
+- **No README Updates:** Do not modify the root `README.md` unless explicitly asked.
+- **GoDoc is Mandatory:**
+  - **New Packages:** If creating a new package, you must include a `doc.go` file containing the package-level documentation.
+  - **Exported Symbols:** Every exported function, type, constant, and variable must have a proper GoDoc comment starting with its name.
+  - **Quality:** Comments must be complete sentences explaining _what_ the symbol does and _how_ to use it.
+  - **Example:**
+    ```go
+    // Convert transforms the input document to PDF using the Chromium engine.
+    // It returns an error if the connection to the browser instance fails.
+    func Convert(...) error
+    ```
+
+## 6. Definition of Done
+
+A task is considered complete only when:
+
+1.  The code compiles via `make build`.
+2.  The code is formatted via `make fmt`.
+3.  All linters pass via `make lint` and `make lint-prettier`.
+4.  Integration scenarios pass via `make test-integration`.
+5.  Unit tests pass via `make test-unit`.
+6.  All exported symbols and new packages have compliant GoDoc.

CLAUDE.md

@@ -1 +0,0 @@
-CONTRIBUTING.md

CONTRIBUTING.md

@@ -1,195 +0,0 @@
-# Contributing to Gotenberg
-
-Gotenberg is a Docker-based API for converting documents to PDF. Two rules override everything else:
-
-- **Backward compatibility.** Never rename or remove CLI flags, environment variables, API form fields, or HTTP endpoints without discussion.
-- **Defensive programming.** Assume input is malformed, handle errors explicitly, never panic.
-
-## Toolchain
-
-- Module: `github.com/gotenberg/gotenberg/v8`
-- Go: see version in `go.mod`
-- Docker
-- Node.js (see `.node-version`), for Prettier linting
-- [golangci-lint](https://golangci-lint.run/) v2+
-
-## Before you start
-
-For non-trivial changes, open an issue or a draft PR first. Describe what needs to change, the proposed solution (files to modify, interface changes, form fields), and which integration test tags are affected.
-
-One thing per PR. Keep features, bug fixes, and refactoring in separate PRs.
-
-When adding a feature or route, write the Gherkin scenario before the Go code, and plan to update the Bruno collection (`.bruno/`) if a route changes.
-
-## Project layout
-
-```
-cmd/gotenberg/       -> Entry point only (wiring/startup). No business logic.
-pkg/gotenberg/       -> Core module system, interfaces, utilities, mocks.
-pkg/modules/         -> Feature modules (api, chromium, libreoffice, pdfengines, etc.).
-pkg/standard/        -> Wires all standard modules together via imports.
-test/integration/    -> Gherkin feature files + Go test infrastructure.
-build/               -> Dockerfile, fonts, Chromium config.
-.bruno/              -> Bruno API collection (mirrors every route).
-```
-
-Key interfaces live in `pkg/gotenberg/`: `Module`, `Provisioner`, `Validator`, `Debuggable`. Every module implements `Descriptor()` and self-registers via `init()`.
-
-## Setup and Makefile
-
-All build and verification tasks go through the Makefile. Do not run `go` commands directly unless debugging a specific package.
-
-| Command                 | Purpose                                          | When to use                                                              |
-| ----------------------- | ------------------------------------------------ | ------------------------------------------------------------------------ |
-| `make build`            | Build the Gotenberg Docker image                 | Before integration tests or manual testing                               |
-| `make run`              | Run a Gotenberg container via `docker compose`   | Manual testing. Flags configured via Makefile variables and compose.yaml |
-| `make telemetry`        | Start an OpenTelemetry collector and OpenObserve | When testing telemetry locally                                           |
-| `make down`             | Stop all compose containers                      | After manual testing                                                     |
-| `make godoc`            | Serve GoDoc at `localhost:6060`                  | To verify documentation                                                  |
-| `make fmt`              | Format Go code                                   | Before committing                                                        |
-| `make lint`             | Lint Go code (zero errors permitted)             | Before committing                                                        |
-| `make prettify`         | Format non-Go files (Markdown, YAML, JSON)       | Before committing                                                        |
-| `make lint-prettier`    | Lint non-Go files                                | Before committing                                                        |
-| `make test-unit`        | Run unit tests                                   | Before committing                                                        |
-| `make test-integration` | Run all integration tests (40 min timeout)       | Before committing                                                        |
-
-Run only the integration test tag(s) relevant to your change rather than the full suite:
-
-```bash
-make test-integration TAGS=health
-make test-integration TAGS=chromium-convert-html
-make test-integration TAGS="merge,split"
-```
-
-## Code conventions
-
-### Module system
-
-Gotenberg uses a self-registering module architecture inspired by CaddyServer. Each module lives in `pkg/modules/<name>/`, implements at minimum `gotenberg.Module` (`Descriptor()`), and self-registers via `init()`. Wiring happens through `pkg/standard/`.
-
-Determine if a feature belongs in an existing module before creating a new one. Only create a new module for a genuinely separate concern.
-
-The `cmd/gotenberg/` package is strictly for wiring and startup. No business logic.
-
-### Backward compatibility
-
-CLI flags, environment variables, API form fields, HTTP endpoints, and default values that alter existing behavior must not change without discussion. Deprecate old names with `fs.MarkDeprecated()` and register both the old and new names side by side.
-
-If a change violates backward compatibility, flag it as a breaking change in the PR description.
-
-### Error handling
-
-- Wrap every error with context: `fmt.Errorf("description: %w", err)`.
-- Never swallow errors silently.
-- Match errors with `errors.Is`, never `strings.Contains`.
-- No panics in production code paths.
-- Validate input defensively.
-
-### Error messages
-
-Client- and operator-facing error messages state what failed, why when non-obvious, and how to fix it when a fix exists. Internal errors (the wrapped `fmt.Errorf` chains that only reach logs) are exempt; keep them precise and technical.
-
-- Client (HTTP response body): name the offending form field and its valid values. Never return a bare `http.StatusText()`.
-- Operator (startup, `Provision`, `Validate`): name the environment variable or flag to set, plus the path or value checked.
-- Security and filtering errors stay generic for clients. Don't reveal allow/deny lists or private-IP policy. Log the specific reason for operators.
-- No hedging ("while others may have failed"). No raw `os.Stat` or exec output in the human-facing remedy.
-
-### Logging
-
-Use `gotenberg.Logger(mod)` to get the module's slog logger during `Provision()`. All log calls must be context-aware: `logger.DebugContext(ctx, msg)`, `logger.InfoContext(ctx, msg)`, `logger.ErrorContext(ctx, msg)`. This propagates trace/span IDs into structured logs when OpenTelemetry is active.
-
-### Telemetry
-
-External tool calls (Chromium, LibreOffice, PDF engines, webhooks, downloads) must create OTEL spans with `trace.SpanKindClient` and `semconv.ServerAddress("toolname")`. Use `gotenberg.Tracer()` and `gotenberg.Meter()` for traces and metrics.
-
-### Import ordering
-
-Enforced by `gci`: standard library, then third-party, then `github.com/gotenberg/gotenberg/v8`. Three groups separated by blank lines.
-
-## Documentation conventions
-
-### Tone
-
-- Short, declarative sentences. Say what it does, then stop.
-- Lead with the action. "Validates font embedding", not "This function validates font embedding".
-- Active voice. "Gotenberg checks the profile", not "The profile is checked by Gotenberg".
-- No em dashes. Use a period, colon, or comma.
-- No "we" hedging. "Don't...", not "We do not recommend...".
-
-### Godoc
-
-Every exported type and function has a Godoc comment starting with its identifier name:
-
-```go
-// OutboundDecision is the result of validating an outbound URL via
-// [DecideOutbound]. ...
-type OutboundDecision struct { ... }
-
-// DialPinned dials each addr in turn until one connects, returning the
-// first successful connection or the last error. ...
-func DialPinned(ctx context.Context, network string, addrs []netip.Addr, port string) (net.Conn, error)
-```
-
-Each package should have a `doc.go` with a `// Package foo ...` comment:
-
-```go
-// Package api manages a LibreOffice instance via the UNO API.
-package api
-```
-
-Reference identifiers with `[Name]` brackets for pkg.go.dev linking:
-
-```go
-// Callers pass the Pinned slice from [OutboundDecision] so that the dial
-// targets exactly the IPs that [DecideOutbound] resolved, preventing DNS
-// rebinding between validation and connect.
-```
-
-### Code comments
-
-- Explain _why_, not _what_.
-- No numbered step comments (`// 1. Do X`, `// 2. Do Y`).
-- No section dividers with numbers (`// --- 8. Foo ---`). Plain dividers are fine for major boundaries.
-- No noise comments that restate the code (`// Check if err is nil`, `// Return results`).
-- Reference spec clauses where relevant (`// Per ISO 32000-2, Table 116...`).
-- Mark debt with `// TODO: [context]`.
-
-## Testing
-
-### Unit tests
-
-Table-driven tests in `*_test.go` files. Use the comprehensive mock implementations in `pkg/gotenberg/mocks.go` rather than rolling new ones.
-
-### Integration tests
-
-Gherkin (BDD) via Godog with `testcontainers-go` for Docker orchestration. Feature files live in `test/integration/features/`; step definitions live in `test/integration/scenario/`. Read `scenario.go` and `containers.go` before writing new tests.
-
-`make build` is required before running integration tests. The full suite has a 40-minute timeout, so run only the tag(s) relevant to your change.
-
-## Pull requests
-
-### Commits
-
-[Conventional Commits](https://www.conventionalcommits.org/): `<type>(<scope>): <description>`.
-
-Common types: `feat`, `fix`, `refactor`, `test`, `docs`, `chore`, `ci`, `build`. The scope matches the module or area of the change (e.g., `chromium`, `pdfengines`, `api`).
-
-Stage specific files. Never `git add -A` or `git add .`.
-
-### Checklist
-
-Before opening the PR, confirm:
-
-- [ ] No backward-compatibility regression. See [Backward compatibility](#backward-compatibility).
-- [ ] Code conventions met (error wrapping, logging, telemetry, import ordering, no panics, no business logic in `cmd/`). See [Code conventions](#code-conventions).
-- [ ] Documentation conventions met (Godoc on every exported identifier, `doc.go` for new packages, tone). See [Documentation conventions](#documentation-conventions).
-- [ ] `make fmt && make lint && make prettify && make lint-prettier` pass with zero warnings.
-- [ ] `make test-unit` passes.
-- [ ] Relevant `make test-integration TAGS=...` passes.
-- [ ] Bruno collection updated if routes were added or modified.
-
-## Further reading
-
-- [`test/integration/README.md`](test/integration/README.md) — Gherkin step reference, available tags, writing new tests.
-- [`.bruno/README.md`](.bruno/README.md) — `.bru` file format, conventions, route update checklist.
-- [`pkg/modules/pdfengines/README.md`](pkg/modules/pdfengines/README.md) — adding new engine features (Makefile variable and flag).

GEMINI.md

@@ -1 +0,0 @@
-CONTRIBUTING.md

Makefile

@@ -5,9 +5,8 @@ help: ## Show the help
 	@grep -hE '^[A-Za-z0-9_ \-]*?:.*##.*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
 
 .PHONY: build
-build: ## Build the Gotenberg's Docker image (use TARGET=gotenberg-chromium or TARGET=gotenberg-libreoffice for variants)
+build: ## Build the Gotenberg's Docker image
 	docker build \
-	--target $(TARGET) \
 	-t $(DOCKER_REGISTRY)/$(DOCKER_REPOSITORY):$(GOTENBERG_VERSION) \
 	-f $(DOCKERFILE) $(DOCKER_BUILD_CONTEXT)
 
@@ -18,8 +17,6 @@ GOTENBERG_BUILD_DEBUG_DATA=true
 API_PORT=3000
 API_PORT_FROM_ENV=
 API_BIND_IP=
-API_TLS_CERT_FILE=
-API_TLS_KEY_FILE=
 API_START_TIMEOUT=30s
 API_TIMEOUT=30s
 API_BODY_LIMIT=
@@ -29,20 +26,16 @@ API_ENABLE_BASIC_AUTH=false
 GOTENBERG_API_BASIC_AUTH_USERNAME=
 GOTENBERG_API_BASIC_AUTH_PASSWORD=
 API_DOWNLOAD_FROM_ALLOW_LIST=
-API_DOWNLOAD_FROM_DENY_LIST=^https?://(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.|0\.0\.0\.0|127\.|localhost|\[::1\]|\[fd)
-API_DOWNLOAD_FROM_DENY_PRIVATE_IPS=false
-API_DOWNLOAD_FROM_DENY_PUBLIC_IPS=false
-API_DOWNLOAD_FROM_ENABLE_ENVIRONMENT_PROXY=false
+API_DOWNLOAD_FROM_DENY_LIST=
 API_DOWNLOAD_FROM_MAX_RETRY=4
 API_DISABLE_DOWNLOAD_FROM=false
-API_DISABLE_HEALTH_CHECK_ROUTE_TELEMETRY=true
-API_DISABLE_ROOT_ROUTE_TELEMETRY=true
-API_DISABLE_DEBUG_ROUTE_TELEMETRY=true
-API_DISABLE_VERSION_ROUTE_TELEMETRY=true
+API_DISABLE_HEALTH_CHECK_ROUTE_TELEMETRY=false
+API_DISABLE_ROOT_ROUTE_TELEMETRY=false
+API_DISABLE_VERSION_ROUTE_TELEMETRY=false
+API_DISABLE_DEBUG_ROUTE_TELEMETRY=false
 API_ENABLE_DEBUG_ROUTE=false
 CHROMIUM_RESTART_AFTER=100
 CHROMIUM_MAX_QUEUE_SIZE=0
-CHROMIUM_IDLE_SHUTDOWN_TIMEOUT=0
 CHROMIUM_MAX_CONCURRENCY=6
 CHROMIUM_AUTO_START=false
 CHROMIUM_START_TIMEOUT=20s
@@ -52,52 +45,30 @@ CHROMIUM_DISABLE_WEB_SECURITY=false
 CHROMIUM_ALLOW_FILE_ACCESS_FROM_FILES=false
 CHROMIUM_HOST_RESOLVER_RULES=
 CHROMIUM_PROXY_SERVER=
-CHROMIUM_ENABLE_ENVIRONMENT_PROXY=false
 CHROMIUM_ALLOW_LIST=
 CHROMIUM_DENY_LIST=^file:(?!//\/tmp/).*
-CHROMIUM_DENY_PRIVATE_IPS=false
-CHROMIUM_DENY_PUBLIC_IPS=false
 CHROMIUM_CLEAR_CACHE=false
 CHROMIUM_CLEAR_COOKIES=false
 CHROMIUM_DISABLE_JAVASCRIPT=false
 CHROMIUM_DISABLE_ROUTES=false
 LIBREOFFICE_RESTART_AFTER=10
 LIBREOFFICE_MAX_QUEUE_SIZE=0
-LIBREOFFICE_IDLE_SHUTDOWN_TIMEOUT=0
 LIBREOFFICE_AUTO_START=false
 LIBREOFFICE_START_TIMEOUT=20s
-LIBREOFFICE_ALLOW_LIST=
-LIBREOFFICE_DENY_LIST=
-LIBREOFFICE_DENY_PRIVATE_IPS=false
-LIBREOFFICE_DENY_PUBLIC_IPS=false
-LIBREOFFICE_ENABLE_ENVIRONMENT_PROXY=false
 LIBREOFFICE_DISABLE_ROUTES=false
 LOG_LEVEL=info
 LOG_FIELDS_PREFIX=
 LOG_STD_FORMAT=auto
 LOG_STD_ENABLE_GCP_FIELDS=false
-LOG_STD_LEVEL_CASE=lower
-PDFENGINES_DISABLE_ROUTES=false
 PDFENGINES_MERGE_ENGINES=qpdf,pdfcpu,pdftk
 PDFENGINES_SPLIT_ENGINES=pdfcpu,qpdf,pdftk
 PDFENGINES_FLATTEN_ENGINES=qpdf
 PDFENGINES_CONVERT_ENGINES=libreoffice-pdfengine
 PDFENGINES_READ_METADATA_ENGINES=exiftool
 PDFENGINES_WRITE_METADATA_ENGINES=exiftool
-PDFENGINES_READ_BOOKMARKS_ENGINES=pdfcpu
-PDFENGINES_WRITE_BOOKMARKS_ENGINES=pdfcpu
-PDFENGINES_WATERMARK_ENGINES=pdfcpu,pdftk
-PDFENGINES_STAMP_ENGINES=pdfcpu,pdftk
 PDFENGINES_ENCRYPT_ENGINES=qpdf,pdfcpu,pdftk
-PDFENGINES_ROTATE_ENGINES=pdfcpu,pdftk
-PDFENGINES_EMBED_ENGINES=qpdf,pdfcpu
-PDFENGINES_EMBED_METADATA_ENGINES=qpdf
-PDFENGINES_FACTUR_X_ENGINES=qpdf
-PROMETHEUS_NAMESPACE=gotenberg
-PROMETHEUS_COLLECT_INTERVAL=1s
-PROMETHEUS_DISABLE_ROUTE_TELEMETRY=true
-PROMETHEUS_DISABLE_COLLECT=false
-PROMETHEUS_METRICS_PATH=/prometheus/metrics
+PDFENGINES_DISABLE_ROUTES=false
+PDFENGINES_ADD_ATTACHMENTS_ENGINES=pdfcpu
 OTEL_SERVICE_NAME=gotenberg
 OTEL_TRACES_EXPORTER=none
 OTEL_METRICS_EXPORTER=none
@@ -107,10 +78,9 @@ OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4317
 OTEL_EXPORTER_OTLP_INSECURE=true
 WEBHOOK_ENABLE_SYNC_MODE=false
 WEBHOOK_ALLOW_LIST=
-WEBHOOK_DENY_LIST=^https?://(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.|0\.0\.0\.0|127\.|localhost|\[::1\]|\[fd)
-WEBHOOK_DENY_PRIVATE_IPS=false
-WEBHOOK_DENY_PUBLIC_IPS=false
-WEBHOOK_ENABLE_ENVIRONMENT_PROXY=false
+WEBHOOK_DENY_LIST=
+WEBHOOK_ERROR_ALLOW_LIST=
+WEBHOOK_ERROR_DENY_LIST=
 WEBHOOK_MAX_RETRY=4
 WEBHOOK_RETRY_MIN_WAIT=1s
 WEBHOOK_RETRY_MAX_WAIT=30s
@@ -144,9 +114,6 @@ NO_CONCURRENCY=false
 # chromium-convert-html
 # chromium-convert-markdown
 # chromium-convert-url
-# chromium-screenshot-html
-# chromium-screenshot-markdown
-# chromium-screenshot-url
 # debug
 # health
 # libreoffice
@@ -154,8 +121,8 @@ NO_CONCURRENCY=false
 # output-filename
 # pdfengines
 # pdfengines-convert
-# pdfengines-embed
-# embed
+# pdfengines-attachments
+# attachments
 # pdfengines-encrypt
 # encrypt
 # pdfengines-flatten
@@ -166,24 +133,15 @@ NO_CONCURRENCY=false
 # metadata
 # pdfengines-split
 # split
-# pdfengines-watermark
-# watermark
-# pdfengines-stamp
-# stamp
-# pdfengines-rotate
-# rotate
-# factur-x
-# pdfengines-bookmarks
-# bookmarks
-# prometheus-metrics
 # root
 # version
 # webhook
 # download-from
+# telemetry
 TAGS=
 
 .PHONY: test-integration
-test-integration: ## Run integration tests (automatically retries failed scenarios up to 3 times)
+test-integration: ## Run integration tests
 	go test -timeout 40m -tags=integration -v github.com/gotenberg/gotenberg/v8/test/integration -args \
 	--gotenberg-docker-repository=$(DOCKER_REPOSITORY) \
 	--gotenberg-version=$(GOTENBERG_VERSION) \

README.md

@@ -1,7 +1,7 @@
 <p align="center">
-    <img src="https://raw.githubusercontent.com/gotenberg/art/master/logo.png" alt="Gotenberg Logo" width="150" height="150" />
+    <img src="https://user-images.githubusercontent.com/8983173/130322857-185831e2-f041-46eb-a17f-0a69d066c4e5.png" alt="Gotenberg Logo" width="150" height="150" />
     <h3 align="center">Gotenberg</h3>
-    <p align="center">A Docker-based API for converting documents to PDF</p>
+    <p align="center">A containerized API for seamless PDF conversion</p>
     <p align="center">
         <a href="https://hub.docker.com/r/gotenberg/gotenberg"><img alt="Total downloads (gotenberg/gotenberg)" src="https://img.shields.io/docker/pulls/gotenberg/gotenberg"></a>
         <a href="https://github.com/gotenberg/gotenberg/actions/workflows/continuous-integration.yml"><img alt="Continuous Integration" src="https://github.com/gotenberg/gotenberg/actions/workflows/continuous-integration.yml/badge.svg"></a>
@@ -10,61 +10,38 @@
     <p align="center">
         <a href="https://trendshift.io/repositories/2996"><img src="https://trendshift.io/api/badge/repositories/2996" alt="gotenberg%2Fgotenberg | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a>
     </p>
-    <p align="center">
-        <a href="https://gotenberg.dev/docs/getting-started/introduction"><strong>Documentation</strong></a> &#183;
-        <a href="https://gotenberg.dev/docs/getting-started/installation#live-demo"><strong>Live Demo</strong></a> &#183;
-        <a href="https://github.com/gotenberg/gotenberg/discussions"><strong>Community</strong></a>
-    </p>
+    <p align="center"><a href="https://gotenberg.dev/docs/getting-started/introduction">Read the Documentation</a> &#183; <a href="https://gotenberg.dev/docs/getting-started/installation#live-demo-">Try the Live Demo</a> 🔥</p>
 </p>
 
 ---
 
-**Gotenberg** is a Docker-based API for converting documents to PDF. Trusted in production by thousands of companies. Also adopted by notable open-source projects.
+**Gotenberg** is a containerized API that abstracts the complexity of PDF conversion.
 
-Send your files via `multipart/form-data`, get a PDF back. No need to manage Chromium, LibreOffice, or fonts yourself.
+It provides a `multipart/form-data` interface for interacting with powerful engines like Chromium and LibreOffice.
+Instead of managing heavy dependencies, browser versions, or fonts in your own backend, simply send your files to
+Gotenberg and get a PDF in return.
 
 ## Quick Start
 
+Open a terminal and run the following command:
+
 ```bash
 docker run --rm -p 3000:3000 gotenberg/gotenberg:8
 ```
 
-Convert a URL to PDF:
-
-```bash
-curl \
-  --request POST http://localhost:3000/forms/chromium/convert/url \
-  --form url=https://sparksuite.github.io/simple-html-invoice-template/ \
-  -o invoice.pdf
-```
-
-## Features
-
-- **HTML, URL, Markdown to PDF** via Headless Chromium
-- **Office documents to PDF** via LibreOffice (100+ formats)
-- **Merge, split, rotate, flatten** PDFs
-- **Watermark, stamp, encrypt** PDFs
-- **PDF/A and PDF/UA** compliance
-- **Screenshots** of URLs and HTML
-- **Read/write metadata and bookmarks**
-
-See the [full documentation](https://gotenberg.dev/docs/getting-started/introduction).
-
-## Contributing
-
-Questions and feedback: [GitHub Discussions](https://github.com/gotenberg/gotenberg/discussions).
-Bug reports: [GitHub Issues](https://github.com/gotenberg/gotenberg/issues).
+With the API running at `http://localhost:3000`, you are now ready to head
+to the **[Full Documentation](https://gotenberg.dev/docs/getting-started/introduction)** to discover how to convert URLs,
+local files, inject custom CSS, merge PDFs, and more.
 
 ## Sponsors
 
-If Gotenberg powers your workflow or your business, consider [**becoming a sponsor**](https://github.com/sponsors/gulien).
+Open-source development takes a significant amount of time, energy, and dedication. If Gotenberg helps streamline your
+workflow or powers your business, please consider supporting its continuous improvement by [**becoming a sponsor**](https://github.com/sponsors/gulien)! ❤️
 
 **Historic & GitHub Sponsors**
 
 - [TheCodingMachine](https://thecodingmachine.com/)
 - [pdfme](https://pdfme.com/)
-- [PDFBolt](https://pdfbolt.com)
-- [FileToPDF.dev](https://filetopdf.dev)
 
 **Powered By**
 

SECURITY.md

@@ -2,28 +2,40 @@
 
 ## Supported Versions
 
-Only the latest version receives security updates and patches. Keep your environment up to date.
+Please ensure to keep your environment up to date and use only the latest version of Gotenberg.
+Security updates and patches will be applied only to the most recent version.
 
 ## Reporting a Vulnerability
 
-Do not publish vulnerabilities publicly. Report them through [GitHub's private vulnerability reporting](https://github.com/gotenberg/gotenberg/security/advisories/new).
+Your help in identifying vulnerabilities in our project is much appreciated.
+We take all reports regarding security seriously.
 
-Include:
+If you discover a security vulnerability, please refrain from publishing it publicly.
+Instead, kindly send us the details via email to _neuhart [dot] julien [at] gmail [dot] com_.
+
+In the subject of your email, please indicate that it's a security vulnerability report for Gotenberg.
+In your message, please include:
 
 - A detailed description of the vulnerability.
-- Steps to reproduce the issue.
-- Potential impact on users or the system.
+- The steps to reproduce the issue.
+- Any potential impact of the vulnerability on the users or system.
 
-This process is handled on a best-effort basis. Response speed may vary depending on severity and available resources.
+Please remember that this process is done in a _'best-effort'_ manner.
+This means we strive to respond and act as quickly as possible, but the speed may vary depending on the severity of
+the issue and our resources.
+
+Thank you in advance for helping to keep our project safe!
 
 ## Disclosure Policy
 
-Once a report is received and confirmed:
+Once we have received your vulnerability report, we will work to validate and reproduce the issue.
+If we can confirm the vulnerability, we will proceed to:
 
-- A fix and release timeline will be prepared.
-- The reporter will be notified when the fix is released.
-- The reporter will be credited for the discovery (unless anonymity is requested).
+- Work on a fix and a release timeline.
+- Notify you when the fix has been implemented and released.
+- Credit you for discovering the vulnerability (unless you request anonymity).
+- Please note that we will do our best to keep you informed about the progress towards resolving the issue.
 
 ## Comments on this Policy
 
-Submit a pull request with suggestions for improving this process.
+If you have suggestions on how this process could be improved, please submit a pull request.

build/Dockerfile

@@ -1,7 +1,7 @@
 # ARG instructions do not create additional layers. Instead, next layers will
 # concatenate them. Also, we have to repeat ARG instructions in each build
 # stage that uses them.
-ARG GOLANG_VERSION=1.26.5
+ARG GOLANG_VERSION=1.26.0
 
 # ----------------------------------------------
 # pdfcpu binary build stage
@@ -11,22 +11,22 @@ ARG GOLANG_VERSION=1.26.5
 FROM golang:$GOLANG_VERSION AS pdfcpu-binary-stage
 
 # See https://github.com/pdfcpu/pdfcpu/releases.
-ARG PDFCPU_VERSION=v0.13.0
+ARG PDFCPU_VERSION=v0.11.1
 ENV CGO_ENABLED=0
 
 # Define the working directory outside of $GOPATH (we're using go modules).
 WORKDIR /home
 
-RUN curl -Ls "https://github.com/pdfcpu/pdfcpu/archive/refs/tags/$PDFCPU_VERSION.tar.gz" -o pdfcpu.tar.gz \
-    && tar --strip-components=1 -xvzf pdfcpu.tar.gz
+RUN curl -Ls "https://github.com/pdfcpu/pdfcpu/archive/refs/tags/$PDFCPU_VERSION.tar.gz" -o pdfcpu.tar.gz &&\
+    tar --strip-components=1 -xvzf pdfcpu.tar.gz
 
 # Install module dependencies.
-RUN go mod download \
-    && go mod verify
+RUN go mod download &&\
+    go mod verify
 
-RUN go build -o pdfcpu -ldflags "-s -w -X 'main.version=$PDFCPU_VERSION' -X 'github.com/pdfcpu/pdfcpu/pkg/pdfcpu/model.VersionStr=$PDFCPU_VERSION' -X main.builtBy=gotenberg" ./cmd/pdfcpu \
+RUN go build -o pdfcpu -ldflags "-s -w -X 'main.version=$PDFCPU_VERSION' -X 'github.com/pdfcpu/pdfcpu/pkg/pdfcpu.VersionStr=$PDFCPU_VERSION' -X main.builtBy=gotenberg" ./cmd/pdfcpu &&\
     # Verify installation.
-    && ./pdfcpu version
+    ./pdfcpu version
 
 # ----------------------------------------------
 # Gotenberg binary build stage
@@ -42,16 +42,14 @@ WORKDIR /home
 # Install module dependencies.
 COPY go.mod go.sum ./
 
-RUN go mod download \
-    && go mod verify
+RUN go mod download &&\
+    go mod verify
 
 # Copy the source code.
 COPY cmd ./cmd
 COPY pkg ./pkg
 
-RUN go build -o gotenberg -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v8/cmd.Version=$GOTENBERG_VERSION'" cmd/gotenberg/main.go \
-    && go build -o gotenberg-chromium -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v8/cmd.Version=$GOTENBERG_VERSION'" cmd/gotenberg-chromium/main.go \
-    && go build -o gotenberg-libreoffice -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v8/cmd.Version=$GOTENBERG_VERSION'" cmd/gotenberg-libreoffice/main.go
+RUN go build -o gotenberg -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v8/cmd.Version=$GOTENBERG_VERSION'" cmd/gotenberg/main.go
 
 # ----------------------------------------------
 # Custom JRE stage
@@ -59,13 +57,14 @@ RUN go build -o gotenberg -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v8/
 # ----------------------------------------------
 FROM debian:13-slim AS custom-jre-stage
 
-RUN apt-get update -qq \
-    && apt-get upgrade -yqq \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends default-jdk-headless binutils
+RUN \
+    apt-get update -qq &&\
+    apt-get upgrade -yqq &&\
+    DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends default-jdk-headless binutils
 
 # Note: jdeps helps finding which modules a JAR requires.
 # Currently only for PDFtk, as we don't rely on LibreOffice UNO Java SDK.
-ENV JAVA_MODULES=java.base,java.desktop,java.naming,java.sql
+ENV JAVA_MODULES=java.base,java.desktop,java.xml
 
 RUN jlink \
     --add-modules $JAVA_MODULES \
@@ -83,16 +82,16 @@ FROM debian:13-slim AS downloader-stage
 # See https://gitlab.com/pdftk-java/pdftk/-/releases - Binary package.
 ARG PDFTK_VERSION=v3.3.3
 
-RUN apt-get update -qq \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends curl ca-certificates
+RUN apt-get update -qq && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends curl ca-certificates
 
 WORKDIR /downloads
 
-RUN curl -Ls https://raw.githubusercontent.com/gotenberg/unoconverter/v0.4.0/unoconv -o unoconverter \
-    && chmod +x unoconverter
+RUN curl -Ls https://raw.githubusercontent.com/gotenberg/unoconverter/v0.2.0/unoconv -o unoconverter &&\
+    chmod +x unoconverter
 
-RUN curl -o pdftk-all.jar "https://gitlab.com/api/v4/projects/5024297/packages/generic/pdftk-java/$PDFTK_VERSION/pdftk-all.jar" \
-    && chmod a+x pdftk-all.jar
+RUN curl -o pdftk-all.jar "https://gitlab.com/api/v4/projects/5024297/packages/generic/pdftk-java/$PDFTK_VERSION/pdftk-all.jar" &&\
+    chmod a+x pdftk-all.jar
 
 # ----------------------------------------------
 # Base image stage
@@ -101,34 +100,48 @@ FROM debian:13-slim AS base-image-stage
 
 ARG TIMEZONE=UTC
 ENV TZ=$TIMEZONE
+# Set default characterset encoding to UTF-8.
+# See:
+# https://github.com/gotenberg/gotenberg/issues/104
+# https://github.com/gotenberg/gotenberg/issues/730
+ENV LANG=C.UTF-8
+ENV LC_ALL=C.UTF-8
 
 COPY --link --from=custom-jre-stage /custom-jre /opt/java
 
 ENV PATH="/opt/java/bin:${PATH}"
 
 # ----------------------------------------------
-# Common stage
+# Final stage
 # ----------------------------------------------
-FROM base-image-stage AS common-stage
+FROM base-image-stage
 
+ARG GOTENBERG_VERSION=snapshot
 ARG GOTENBERG_USER_GID=1001
 ARG GOTENBERG_USER_UID=1001
 
-# Create a non-root user.
-# All processes in the Docker container will run with this dedicated user.
-RUN groupadd --gid "$GOTENBERG_USER_GID" gotenberg \
-    && useradd --uid "$GOTENBERG_USER_UID" --gid gotenberg --shell /bin/bash --home /home/gotenberg --no-create-home gotenberg \
-    && mkdir /home/gotenberg \
-    && chown gotenberg: /home/gotenberg
+LABEL org.opencontainers.image.title="Gotenberg" \
+    org.opencontainers.image.description="A containerized API for seamless PDF conversion." \
+    org.opencontainers.image.version="$GOTENBERG_VERSION" \
+    org.opencontainers.image.authors="Julien Neuhart <neuhart.julien@gmail.com>" \
+    org.opencontainers.image.documentation="https://gotenberg.dev" \
+    org.opencontainers.image.source="https://github.com/gotenberg/gotenberg"
 
-# Note: tini is a helper for reaping zombie processes.
-RUN apt-get update -qq \
-    && apt-get upgrade -yqq \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
-        ca-certificates \
-        tini \
-        # Many users rely on curl for Docker health checks.
-        curl \
+RUN \
+    # Create a non-root user.
+    # All processes in the Docker container will run with this dedicated user.
+    groupadd --gid "$GOTENBERG_USER_GID" gotenberg &&\
+    useradd --uid "$GOTENBERG_USER_UID" --gid gotenberg --shell /bin/bash --home /home/gotenberg --no-create-home gotenberg &&\
+    mkdir /home/gotenberg &&\
+    chown gotenberg: /home/gotenberg
+
+RUN \
+    echo "deb http://deb.debian.org/debian trixie-backports main" >> /etc/apt/sources.list &&\
+    apt-get update -qq &&\
+    apt-get upgrade -yqq &&\
+    # Note: tini is a helper for reaping zombie processes.
+    DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
+        tini python3 python3-distutils-extra \
         # Install fonts.
         # Essential metric-compatible fonts for LibreOffice layout fidelity (replaces MS Fonts).
         fonts-crosextra-carlito \
@@ -141,29 +154,46 @@ RUN apt-get update -qq \
         fonts-noto-cjk \
         # Standard Emoji support.
         fonts-noto-color-emoji \
-        # Tofu prevention.
-        fonts-noto-core \
+        # Install Hyphenation for LibreOffice.
+        # Credits: https://wiki.archlinux.org/title/LibreOffice.
+        hyphen-af hyphen-as hyphen-be hyphen-bg hyphen-bn hyphen-ca hyphen-cs hyphen-da hyphen-de hyphen-el \
+        hyphen-en-gb hyphen-en-us hyphen-eo hyphen-es hyphen-fr hyphen-gl hyphen-gu hyphen-hi hyphen-hr hyphen-hu \
+        hyphen-id hyphen-is hyphen-it hyphen-kn hyphen-lt hyphen-lv hyphen-ml hyphen-mn hyphen-mr hyphen-nl \
+        hyphen-no hyphen-or hyphen-pa hyphen-pl hyphen-pt-br hyphen-pt-pt hyphen-ro hyphen-ru hyphen-sk hyphen-sl \
+        hyphen-sr hyphen-sv hyphen-ta hyphen-te hyphen-th hyphen-uk hyphen-zu \
+        # Install Chromium.
+        chromium \
         # Install QPDF & ExifTool (PDF engines).
-        qpdf exiftool \
+        qpdf exiftool &&\
+    # Install LibreOffice & unoconverter.
+    DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends -t trixie-backports \
+        libreoffice-writer libreoffice-calc libreoffice-impress libreoffice-draw python3-uno &&\
+    # unoconverter will look for the Python binary, which has to be at version 3.
+    ln -s /usr/bin/python3 /usr/bin/python &&\
     # See https://github.com/nextcloud/docker/issues/380.
-    && mkdir -p /usr/share/man/man1 \
+    mkdir -p /usr/share/man/man1 &&\
     # Cleanup.
-    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+    apt-get autoremove -yqq &&\
+    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/share/doc/* /usr/share/man/* /usr/share/info/*
 
-# PDFtk bash wrapper.
-# See https://github.com/gotenberg/gotenberg/pull/273.
-RUN printf '#!/bin/bash\n\nexec java -jar /usr/bin/pdftk-all.jar "$@"' > /usr/bin/pdftk \
-    && chmod +x /usr/bin/pdftk
+# Copy downloaded artifacts (unoconverter & PDFtk).
+COPY --link --from=downloader-stage /downloads/unoconverter /usr/bin/unoconverter
+COPY --link --from=downloader-stage /downloads/pdftk-all.jar /usr/bin/pdftk-all.jar
+
+RUN \
+    # Install PDFtk bash wrapper.
+    # See https://github.com/gotenberg/gotenberg/pull/273.
+    printf '#!/bin/bash\n\nexec java -jar /usr/bin/pdftk-all.jar "$@"' > /usr/bin/pdftk && \
+    chmod +x /usr/bin/pdftk
 
 # Support for arbitrary user IDs (OpenShift).
 # See:
 # https://github.com/gotenberg/gotenberg/issues/1049.
 # https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/images/creating-images#use-uid_create-images.
-RUN usermod -aG root gotenberg \
-    && chgrp -R 0 /home/gotenberg \
-    && chmod -R g=u /home/gotenberg
-
-# COPY instructions last to maximize cache reuse when only source code changes.
+RUN \
+    usermod -aG root gotenberg &&\
+    chgrp -R 0 /home/gotenberg &&\
+    chmod -R g=u /home/gotenberg
 
 # Improve fonts subpixel hinting and smoothing.
 # Credits:
@@ -171,121 +201,24 @@ RUN usermod -aG root gotenberg \
 # https://github.com/arachnys/athenapdf/commit/ba25a8d80a25d08d58865519c4cd8756dc9a336d.
 COPY --link build/fonts.conf /etc/fonts/conf.d/100-gotenberg.conf
 
-# Copy PDFtk jar.
-COPY --link --from=downloader-stage /downloads/pdftk-all.jar /usr/bin/pdftk-all.jar
+# Copy dictionnaries so that hypens work on Chromium.
+# See https://github.com/gotenberg/gotenberg/issues/1293.
+COPY --link --chown="$GOTENBERG_USER_UID:$GOTENBERG_USER_GID" build/chromium-hyphen-data /opt/gotenberg/chromium-hyphen-data
 
-# Copy the pdfcpu binary (shared across all variants).
+# Copy the Golang binaries.
 COPY --link --from=pdfcpu-binary-stage /home/pdfcpu /usr/bin/
+COPY --link --from=gotenberg-binary-stage /home/gotenberg /usr/bin/
 
-# Set default characterset encoding to UTF-8.
-# See:
-# https://github.com/gotenberg/gotenberg/issues/104
-# https://github.com/gotenberg/gotenberg/issues/730
-ENV LANG=C.UTF-8
-ENV LC_ALL=C.UTF-8
-
-# Environment variables for PDF engines.
+# Environment variables required by modules or else.
+ENV CHROMIUM_BIN_PATH=/usr/bin/chromium
+ENV CHROMIUM_HYPHEN_DATA_DIR_PATH=/opt/gotenberg/chromium-hyphen-data
+ENV LIBREOFFICE_BIN_PATH=/usr/lib/libreoffice/program/soffice.bin
+ENV UNOCONVERTER_BIN_PATH=/usr/bin/unoconverter
 ENV PDFTK_BIN_PATH=/usr/bin/pdftk
 ENV QPDF_BIN_PATH=/usr/bin/qpdf
 ENV EXIFTOOL_BIN_PATH=/usr/bin/exiftool
 ENV PDFCPU_BIN_PATH=/usr/bin/pdfcpu
 
-# Capture backing-binary versions at build time so the running process reports
-# them on traces without spawning the binaries at startup or per request.
-# See pkg/gotenberg/buildversions.go. Chromium and LibreOffice are captured in
-# the variant stages below, where they are installed.
-ENV GOTENBERG_VERSIONS_DIR_PATH=/opt/gotenberg/versions
-
-COPY --link build/capture-version.sh /opt/gotenberg/capture-version.sh
-
-RUN bash /opt/gotenberg/capture-version.sh "$GOTENBERG_VERSIONS_DIR_PATH" qpdf "$QPDF_BIN_PATH" --version \
-    && bash /opt/gotenberg/capture-version.sh "$GOTENBERG_VERSIONS_DIR_PATH" exiftool "$EXIFTOOL_BIN_PATH" -ver \
-    && bash /opt/gotenberg/capture-version.sh "$GOTENBERG_VERSIONS_DIR_PATH" pdftk "$PDFTK_BIN_PATH" --version \
-    && bash /opt/gotenberg/capture-version.sh "$GOTENBERG_VERSIONS_DIR_PATH" pdfcpu "$PDFCPU_BIN_PATH" version
-
-# OpenTelemetry defaults (noop - no telemetry overhead unless explicitly enabled).
-ENV OTEL_TRACES_EXPORTER=none
-ENV OTEL_METRICS_EXPORTER=none
-ENV OTEL_LOGS_EXPORTER=none
-
-# ----------------------------------------------
-# Final stage: full (Chromium + LibreOffice)
-# ----------------------------------------------
-FROM common-stage AS gotenberg
-
-ARG GOTENBERG_VERSION=snapshot
-ARG GOTENBERG_USER_GID=1001
-ARG GOTENBERG_USER_UID=1001
-ARG TMP_CHROMIUM_VERSION_PPC64EL="146.0.7680.80-1~deb13u1"
-
-LABEL org.opencontainers.image.title="Gotenberg" \
-    org.opencontainers.image.description="A Docker-based API for converting documents to PDF." \
-    org.opencontainers.image.version="$GOTENBERG_VERSION" \
-    org.opencontainers.image.authors="Julien Neuhart <neuhart.julien@gmail.com>" \
-    org.opencontainers.image.documentation="https://gotenberg.dev" \
-    org.opencontainers.image.source="https://github.com/gotenberg/gotenberg"
-
-# Install Chromium.
-# On ppc64el, the latest Chromium is broken, so we pin a known working
-# version from snapshot.debian.org via debsnap.
-RUN /bin/bash -c \
-    'set -e &&\
-    if [[ "$(dpkg --print-architecture)" == "ppc64el" ]]; then \
-      apt-get update -qq &&\
-      DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends devscripts &&\
-      debsnap chromium-common "$TMP_CHROMIUM_VERSION_PPC64EL" -v --force --binary --architecture ppc64el &&\
-      debsnap chromium "$TMP_CHROMIUM_VERSION_PPC64EL" -v --force --binary --architecture ppc64el &&\
-      DEBIAN_FRONTEND=noninteractive apt-get install --fix-broken -y -qq --no-install-recommends "./binary-chromium-common/chromium-common_${TMP_CHROMIUM_VERSION_PPC64EL}_ppc64el.deb" "./binary-chromium/chromium_${TMP_CHROMIUM_VERSION_PPC64EL}_ppc64el.deb" &&\
-      DEBIAN_FRONTEND=noninteractive apt-get purge -y -qq devscripts &&\
-      rm -rf ./binary-chromium-common/* ./binary-chromium/*; \
-    else \
-      apt-get update -qq &&\
-      apt-get upgrade -yqq &&\
-      DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends chromium; \
-    fi' \
-    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
-
-# Install LibreOffice & unoconverter.
-RUN echo "deb http://deb.debian.org/debian trixie-backports main" >> /etc/apt/sources.list \
-    && apt-get update -qq \
-    && apt-get upgrade -yqq \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
-        python3 python3-distutils-extra \
-        # Install Hyphenation for LibreOffice.
-        # Credits: https://wiki.archlinux.org/title/LibreOffice.
-        hyphen-af hyphen-as hyphen-be hyphen-bg hyphen-bn hyphen-ca hyphen-cs hyphen-da hyphen-de hyphen-el \
-        hyphen-en-gb hyphen-en-us hyphen-eo hyphen-es hyphen-fr hyphen-gl hyphen-gu hyphen-hi hyphen-hr hyphen-hu \
-        hyphen-id hyphen-is hyphen-it hyphen-kn hyphen-lt hyphen-lv hyphen-ml hyphen-mn hyphen-mr hyphen-nl \
-        hyphen-no hyphen-or hyphen-pa hyphen-pl hyphen-pt-br hyphen-pt-pt hyphen-ro hyphen-ru hyphen-sk hyphen-sl \
-        hyphen-sr hyphen-sv hyphen-ta hyphen-te hyphen-th hyphen-uk hyphen-zu \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends -t trixie-backports \
-        libreoffice-writer libreoffice-calc libreoffice-impress libreoffice-draw python3-uno \
-    # unoconverter will look for the Python binary, which has to be at version 3.
-    && ln -s /usr/bin/python3 /usr/bin/python \
-    # Cleanup.
-    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
-
-# COPY instructions last to maximize cache reuse.
-
-# Copy the Gotenberg binary (full variant with all modules).
-COPY --link --from=gotenberg-binary-stage /home/gotenberg /usr/bin/
-
-# Copy unoconverter.
-COPY --link --from=downloader-stage /downloads/unoconverter /usr/bin/unoconverter
-
-# Copy dictionnaries so that hyphens work on Chromium.
-# See https://github.com/gotenberg/gotenberg/issues/1293.
-COPY --link --chown="$GOTENBERG_USER_UID:$GOTENBERG_USER_GID" build/chromium-hyphen-data /opt/gotenberg/chromium-hyphen-data
-
-ENV CHROMIUM_BIN_PATH=/usr/bin/chromium
-ENV CHROMIUM_HYPHEN_DATA_DIR_PATH=/opt/gotenberg/chromium-hyphen-data
-ENV LIBREOFFICE_BIN_PATH=/usr/lib/libreoffice/program/soffice.bin
-ENV UNOCONVERTER_BIN_PATH=/usr/bin/unoconverter
-
-# Capture Chromium and LibreOffice versions now that both are installed.
-RUN bash /opt/gotenberg/capture-version.sh "$GOTENBERG_VERSIONS_DIR_PATH" chromium "$CHROMIUM_BIN_PATH" --version \
-    && bash /opt/gotenberg/capture-version.sh "$GOTENBERG_VERSIONS_DIR_PATH" libreoffice-api "$LIBREOFFICE_BIN_PATH" --version
-
 USER gotenberg
 WORKDIR /home/gotenberg
 
@@ -293,241 +226,4 @@ WORKDIR /home/gotenberg
 EXPOSE 3000
 
 ENTRYPOINT [ "/usr/bin/tini", "--" ]
-CMD [ "gotenberg" ]
-
-# ----------------------------------------------
-# Final stage: Chromium only
-# ----------------------------------------------
-FROM common-stage AS gotenberg-chromium
-
-ARG GOTENBERG_VERSION=snapshot
-ARG GOTENBERG_USER_GID=1001
-ARG GOTENBERG_USER_UID=1001
-ARG TMP_CHROMIUM_VERSION_PPC64EL="146.0.7680.80-1~deb13u1"
-
-LABEL org.opencontainers.image.title="Gotenberg (Chromium)" \
-    org.opencontainers.image.description="A Docker-based API for converting documents to PDF — Chromium variant." \
-    org.opencontainers.image.version="$GOTENBERG_VERSION" \
-    org.opencontainers.image.authors="Julien Neuhart <neuhart.julien@gmail.com>" \
-    org.opencontainers.image.documentation="https://gotenberg.dev" \
-    org.opencontainers.image.source="https://github.com/gotenberg/gotenberg"
-
-# Install Chromium.
-# On ppc64el, the latest Chromium is broken, so we pin a known working
-# version from snapshot.debian.org via debsnap.
-RUN /bin/bash -c \
-    'set -e &&\
-    if [[ "$(dpkg --print-architecture)" == "ppc64el" ]]; then \
-      apt-get update -qq &&\
-      DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends devscripts &&\
-      debsnap chromium-common "$TMP_CHROMIUM_VERSION_PPC64EL" -v --force --binary --architecture ppc64el &&\
-      debsnap chromium "$TMP_CHROMIUM_VERSION_PPC64EL" -v --force --binary --architecture ppc64el &&\
-      DEBIAN_FRONTEND=noninteractive apt-get install --fix-broken -y -qq --no-install-recommends "./binary-chromium-common/chromium-common_${TMP_CHROMIUM_VERSION_PPC64EL}_ppc64el.deb" "./binary-chromium/chromium_${TMP_CHROMIUM_VERSION_PPC64EL}_ppc64el.deb" &&\
-      DEBIAN_FRONTEND=noninteractive apt-get purge -y -qq devscripts &&\
-      rm -rf ./binary-chromium-common/* ./binary-chromium/*; \
-    else \
-      apt-get update -qq &&\
-      apt-get upgrade -yqq &&\
-      DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends chromium; \
-    fi' \
-    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
-
-# COPY instructions last to maximize cache reuse.
-
-# Copy the Gotenberg binary (Chromium variant, no LibreOffice modules).
-COPY --link --from=gotenberg-binary-stage /home/gotenberg-chromium /usr/bin/gotenberg
-
-# Copy dictionnaries so that hyphens work on Chromium.
-# See https://github.com/gotenberg/gotenberg/issues/1293.
-COPY --link --chown="$GOTENBERG_USER_UID:$GOTENBERG_USER_GID" build/chromium-hyphen-data /opt/gotenberg/chromium-hyphen-data
-
-ENV CHROMIUM_BIN_PATH=/usr/bin/chromium
-ENV CHROMIUM_HYPHEN_DATA_DIR_PATH=/opt/gotenberg/chromium-hyphen-data
-# No LibreOffice in this variant; override the default to use all available engines.
-ENV PDFENGINES_CONVERT_ENGINES=
-
-# Capture the Chromium version now that it is installed.
-RUN bash /opt/gotenberg/capture-version.sh "$GOTENBERG_VERSIONS_DIR_PATH" chromium "$CHROMIUM_BIN_PATH" --version
-
-USER gotenberg
-WORKDIR /home/gotenberg
-
-# Default API port.
-EXPOSE 3000
-
-ENTRYPOINT [ "/usr/bin/tini", "--" ]
-CMD [ "gotenberg" ]
-
-# ----------------------------------------------
-# Final stage: LibreOffice only
-# ----------------------------------------------
-FROM common-stage AS gotenberg-libreoffice
-
-ARG GOTENBERG_VERSION=snapshot
-
-LABEL org.opencontainers.image.title="Gotenberg (LibreOffice)" \
-    org.opencontainers.image.description="A Docker-based API for converting documents to PDF — LibreOffice variant." \
-    org.opencontainers.image.version="$GOTENBERG_VERSION" \
-    org.opencontainers.image.authors="Julien Neuhart <neuhart.julien@gmail.com>" \
-    org.opencontainers.image.documentation="https://gotenberg.dev" \
-    org.opencontainers.image.source="https://github.com/gotenberg/gotenberg"
-
-# Install LibreOffice & unoconverter.
-RUN echo "deb http://deb.debian.org/debian trixie-backports main" >> /etc/apt/sources.list \
-    && apt-get update -qq \
-    && apt-get upgrade -yqq \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
-        python3 python3-distutils-extra \
-        # Install Hyphenation for LibreOffice.
-        # Credits: https://wiki.archlinux.org/title/LibreOffice.
-        hyphen-af hyphen-as hyphen-be hyphen-bg hyphen-bn hyphen-ca hyphen-cs hyphen-da hyphen-de hyphen-el \
-        hyphen-en-gb hyphen-en-us hyphen-eo hyphen-es hyphen-fr hyphen-gl hyphen-gu hyphen-hi hyphen-hr hyphen-hu \
-        hyphen-id hyphen-is hyphen-it hyphen-kn hyphen-lt hyphen-lv hyphen-ml hyphen-mn hyphen-mr hyphen-nl \
-        hyphen-no hyphen-or hyphen-pa hyphen-pl hyphen-pt-br hyphen-pt-pt hyphen-ro hyphen-ru hyphen-sk hyphen-sl \
-        hyphen-sr hyphen-sv hyphen-ta hyphen-te hyphen-th hyphen-uk hyphen-zu \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends -t trixie-backports \
-        libreoffice-writer libreoffice-calc libreoffice-impress libreoffice-draw python3-uno \
-    # unoconverter will look for the Python binary, which has to be at version 3.
-    && ln -s /usr/bin/python3 /usr/bin/python \
-    # Cleanup.
-    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
-
-# COPY instructions last to maximize cache reuse.
-
-# Copy the Gotenberg binary (LibreOffice variant, no Chromium modules).
-COPY --link --from=gotenberg-binary-stage /home/gotenberg-libreoffice /usr/bin/gotenberg
-
-# Copy unoconverter.
-COPY --link --from=downloader-stage /downloads/unoconverter /usr/bin/unoconverter
-
-ENV LIBREOFFICE_BIN_PATH=/usr/lib/libreoffice/program/soffice.bin
-ENV UNOCONVERTER_BIN_PATH=/usr/bin/unoconverter
-
-# Capture the LibreOffice version now that it is installed.
-RUN bash /opt/gotenberg/capture-version.sh "$GOTENBERG_VERSIONS_DIR_PATH" libreoffice-api "$LIBREOFFICE_BIN_PATH" --version
-
-USER gotenberg
-WORKDIR /home/gotenberg
-
-# Default API port.
-EXPOSE 3000
-
-ENTRYPOINT [ "/usr/bin/tini", "--" ]
-CMD [ "gotenberg" ]
-
-# ==============================================================
-# Cloud Run variants
-# ==============================================================
-
-# ----------------------------------------------
-# Cloud Run: full (Chromium + LibreOffice)
-# ----------------------------------------------
-FROM gotenberg AS gotenberg-cloudrun
-
-USER root
-
-# For security reasons, the non-root user gotenberg does not own the Tini binary by default.
-# However, some providers like Cloud Run from Google Cloud cannot start a Docker container in that case.
-# See https://github.com/gotenberg/gotenberg/issues/90#issuecomment-543551353.
-RUN chown gotenberg: /usr/bin/tini
-
-ENV API_PORT_FROM_ENV=PORT
-ENV CHROMIUM_AUTO_START=true
-ENV LIBREOFFICE_AUTO_START=true
-ENV WEBHOOK_ENABLE_SYNC_MODE=true
-ENV GOTENBERG_BUILD_DEBUG_DATA=false
-ENV LOG_STD_ENABLE_GCP_FIELDS=true
-
-USER gotenberg
-
-# ----------------------------------------------
-# Cloud Run: Chromium only
-# ----------------------------------------------
-FROM gotenberg-chromium AS gotenberg-cloudrun-chromium
-
-USER root
-
-RUN chown gotenberg: /usr/bin/tini
-
-ENV API_PORT_FROM_ENV=PORT
-ENV CHROMIUM_AUTO_START=true
-ENV WEBHOOK_ENABLE_SYNC_MODE=true
-ENV GOTENBERG_BUILD_DEBUG_DATA=false
-ENV LOG_STD_ENABLE_GCP_FIELDS=true
-
-USER gotenberg
-
-# ----------------------------------------------
-# Cloud Run: LibreOffice only
-# ----------------------------------------------
-FROM gotenberg-libreoffice AS gotenberg-cloudrun-libreoffice
-
-USER root
-
-RUN chown gotenberg: /usr/bin/tini
-
-ENV API_PORT_FROM_ENV=PORT
-ENV LIBREOFFICE_AUTO_START=true
-ENV WEBHOOK_ENABLE_SYNC_MODE=true
-ENV GOTENBERG_BUILD_DEBUG_DATA=false
-ENV LOG_STD_ENABLE_GCP_FIELDS=true
-
-USER gotenberg
-
-# ==============================================================
-# AWS Lambda variants
-# ==============================================================
-
-# ----------------------------------------------
-# AWS Lambda: full (Chromium + LibreOffice)
-# ----------------------------------------------
-FROM gotenberg AS gotenberg-aws-lambda
-
-USER root
-
-COPY --from=public.ecr.aws/awsguru/aws-lambda-adapter:0.9.1 /lambda-adapter /opt/extensions/lambda-adapter
-
-ENV AWS_LWA_PORT=3000
-ENV AWS_LWA_READINESS_CHECK_PATH=/health
-ENV AWS_LWA_INVOKE_MODE=buffered
-ENV API_PORT_FROM_ENV=AWS_LWA_PORT
-ENV WEBHOOK_ENABLE_SYNC_MODE=true
-ENV GOTENBERG_BUILD_DEBUG_DATA=false
-
-USER gotenberg
-
-# ----------------------------------------------
-# AWS Lambda: Chromium only
-# ----------------------------------------------
-FROM gotenberg-chromium AS gotenberg-aws-lambda-chromium
-
-USER root
-
-COPY --from=public.ecr.aws/awsguru/aws-lambda-adapter:0.9.1 /lambda-adapter /opt/extensions/lambda-adapter
-
-ENV AWS_LWA_PORT=3000
-ENV AWS_LWA_READINESS_CHECK_PATH=/health
-ENV AWS_LWA_INVOKE_MODE=buffered
-ENV API_PORT_FROM_ENV=AWS_LWA_PORT
-ENV WEBHOOK_ENABLE_SYNC_MODE=true
-ENV GOTENBERG_BUILD_DEBUG_DATA=false
-
-USER gotenberg
-
-# ----------------------------------------------
-# AWS Lambda: LibreOffice only
-# ----------------------------------------------
-FROM gotenberg-libreoffice AS gotenberg-aws-lambda-libreoffice
-
-USER root
-
-COPY --from=public.ecr.aws/awsguru/aws-lambda-adapter:0.9.1 /lambda-adapter /opt/extensions/lambda-adapter
-
-ENV AWS_LWA_PORT=3000
-ENV AWS_LWA_READINESS_CHECK_PATH=/health
-ENV AWS_LWA_INVOKE_MODE=buffered
-ENV API_PORT_FROM_ENV=AWS_LWA_PORT
-ENV WEBHOOK_ENABLE_SYNC_MODE=true
-ENV GOTENBERG_BUILD_DEBUG_DATA=false
-
-USER gotenberg
+CMD [ "gotenberg" ]

build/Dockerfile.aws-lambda

@@ -0,0 +1,21 @@
+ARG DOCKER_REGISTRY
+ARG DOCKER_REPOSITORY
+ARG GOTENBERG_VERSION
+
+FROM $DOCKER_REGISTRY/$DOCKER_REPOSITORY:$GOTENBERG_VERSION
+
+USER root
+
+COPY --from=public.ecr.aws/awsguru/aws-lambda-adapter:0.9.1 /lambda-adapter /opt/extensions/lambda-adapter
+
+# AWS.
+ENV AWS_LWA_PORT=3000
+ENV AWS_LWA_READINESS_CHECK_PATH=/health
+ENV AWS_LWA_INVOKE_MODE=buffered
+
+# Gotenberg.
+ENV API_PORT_FROM_ENV=AWS_LWA_PORT
+ENV WEBHOOK_ENABLE_SYNC_MODE=true
+ENV GOTENBERG_BUILD_DEBUG_DATA=false
+
+USER gotenberg

build/Dockerfile.cloudrun

@@ -0,0 +1,22 @@
+ARG DOCKER_REGISTRY
+ARG DOCKER_REPOSITORY
+ARG GOTENBERG_VERSION
+
+FROM $DOCKER_REGISTRY/$DOCKER_REPOSITORY:$GOTENBERG_VERSION
+
+USER root
+
+# For security reasons, the non-root user gotenberg does not own the Tini binary by default.
+# However, some providers like Cloud Run from Google Cloud cannot start a Docker container in that case.
+# See https://github.com/gotenberg/gotenberg/issues/90#issuecomment-543551353.
+RUN chown gotenberg: /usr/bin/tini
+
+# Gotenberg.
+ENV API_PORT_FROM_ENV=PORT
+ENV CHROMIUM_AUTO_START=true
+ENV LIBREOFFICE_AUTO_START=true
+ENV WEBHOOK_ENABLE_SYNC_MODE=true
+ENV GOTENBERG_BUILD_DEBUG_DATA=false
+ENV LOG_ENABLE_GCP_FIELDS=true
+
+USER gotenberg

build/capture-version.sh

@@ -1,34 +0,0 @@
-#!/usr/bin/env bash
-# Captures the version of a backing binary into a per-module file that the
-# running Gotenberg process reads via gotenberg.BuildVersion, so it never spawns
-# the binary just to report a version. This keeps cold start and the first
-# request cheap, which matters on serverless platforms.
-#
-# Failure-tolerant by design: a probe that errors writes an empty file, and the
-# runtime falls back to detecting the version live. A failing probe must never
-# fail the image build.
-#
-# Usage: capture-version.sh <output-dir> <module-id> <bin> [args...]
-set -u
-
-dir="$1"
-id="$2"
-shift 2
-
-mkdir -p "$dir"
-
-# Run the probe once. On failure, keep going with empty output.
-raw="$("$@" 2>/dev/null)" || raw=""
-
-case "$id" in
-pdfcpu)
-    # pdfcpu prints "pdfcpu: <version>"; keep only the part the runtime parser
-    # keeps so the recorded value matches the live-detection fallback.
-    version="$(printf '%s\n' "$raw" | grep -m1 '^pdfcpu:' | sed 's/^pdfcpu:[[:space:]]*//')"
-    ;;
-*)
-    version="$(printf '%s\n' "$raw" | head -n1)"
-    ;;
-esac
-
-printf '%s' "$version" | tr -d '\r' >"$dir/$id"

cmd/gotenberg-chromium/main.go

@@ -1,11 +0,0 @@
-package main
-
-import (
-	gotenbergcmd "github.com/gotenberg/gotenberg/v8/cmd"
-	// Gotenberg modules (Chromium variant — no LibreOffice).
-	_ "github.com/gotenberg/gotenberg/v8/pkg/standard/chromium"
-)
-
-func main() {
-	gotenbergcmd.Run()
-}

cmd/gotenberg-libreoffice/main.go

@@ -1,11 +0,0 @@
-package main
-
-import (
-	gotenbergcmd "github.com/gotenberg/gotenberg/v8/cmd"
-	// Gotenberg modules (LibreOffice variant — no Chromium).
-	_ "github.com/gotenberg/gotenberg/v8/pkg/standard/libreoffice"
-)
-
-func main() {
-	gotenbergcmd.Run()
-}

cmd/gotenberg.go

@@ -25,7 +25,7 @@ const banner = `
 \___/\___/\__/\__/_//_/_.__/\__/_/  \_, / 
                                    /___/
 
-A Docker-based API for converting documents to PDF.
+A containerized API for seamless PDF conversion.
 Version: %s
 -------------------------------------------------------
 `
@@ -43,25 +43,10 @@ func Run() {
 	fs.Bool("gotenberg-hide-banner", false, "Hide the banner")
 	fs.Duration("gotenberg-graceful-shutdown-duration", time.Duration(30)*time.Second, "Set the graceful shutdown duration")
 	fs.Bool("gotenberg-build-debug-data", true, "Set if build data is needed")
-
-	// Logging & telemetry flags.
-	fs.String("log-level", gotenberg.InfoLoggingLevel, "Set the log level")
-	fs.String("log-fields-prefix", "", "Prepend a specified prefix to each log field key")
-	fs.String("log-std-format", gotenberg.AutoLoggingFormat, "Set the log format for standard output")
-	fs.Bool("log-std-enable-gcp-fields", false, "Use GCP-compatible field names in log output")
-	fs.String("log-std-level-case", gotenberg.LowerLevelCase, "Set the case of the level field in the standard output, either lower or upper")
-
-	// Deprecated logging flags.
-	fs.String("log-format", gotenberg.AutoLoggingFormat, "Set the log format")
-	fs.Bool("log-enable-gcp-fields", false, "Use GCP-compatible field names")
-
-	if err := errors.Join(
-		fs.MarkDeprecated("log-format", "use --log-std-format instead"),
-		fs.MarkDeprecated("log-enable-gcp-fields", "use --log-std-enable-gcp-fields instead"),
-	); err != nil {
-		fmt.Printf("[FATAL] mark deprecated flags: %s\n", err)
-		os.Exit(1)
-	}
+	fs.String("log-level", gotenberg.InfoLoggingLevel, fmt.Sprintf("Choose the level of logging detail. Options include %s, %s, %s, or %s", gotenberg.ErrorLoggingLevel, gotenberg.WarnLoggingLevel, gotenberg.InfoLoggingLevel, gotenberg.DebugLoggingLevel))
+	fs.String("log-fields-prefix", "", "Prepend a specified prefix to each field in the logs")
+	fs.String("log-std-format", gotenberg.AutoLoggingFormat, fmt.Sprintf("Specify the format of standard logging. Options include %s, %s, or %s", gotenberg.AutoLoggingFormat, gotenberg.JsonLoggingFormat, gotenberg.TextLoggingFormat))
+	fs.Bool("log-std-enable-gcp-fields", false, "Enable Google Cloud Platform fields for standard logging - namely: time, message, severity")
 
 	descriptors := gotenberg.GetModuleDescriptors()
 	var modsInfo strings.Builder
@@ -95,11 +80,10 @@ func Run() {
 				fmt.Printf("[FATAL] invalid overriding value '%s' from %s: %v\n", val, envName, err)
 				os.Exit(1)
 			}
-			f.Changed = true
 			return
 		}
 
-		err = fs.Set(f.Name, val)
+		err = f.Value.Set(val)
 		if err != nil {
 			fmt.Printf("[FATAL] invalid overriding value '%s' from %s: %v\n", val, envName, err)
 			os.Exit(1)
@@ -111,44 +95,43 @@ func Run() {
 	hideBanner := parsedFlags.MustBool("gotenberg-hide-banner")
 	gracefulShutdownDuration := parsedFlags.MustDuration("gotenberg-graceful-shutdown-duration")
 
-	// Initialize telemetry (logging + OTEL).
 	serviceName := os.Getenv("OTEL_SERVICE_NAME")
 	if serviceName == "" {
 		serviceName = "gotenberg"
 	}
 
-	telemetryCfg := gotenberg.TelemetryConfig{
-		ServiceName:           serviceName,
-		ServiceVersion:        Version,
-		LogLevel:              parsedFlags.MustDeprecatedString("log-format", "log-std-format"),
+	telemetryConfig := gotenberg.TelemetryConfig{
+		// OpenTelemetry.
+		ServiceName:    serviceName,
+		ServiceVersion: Version,
+		// Logging.
+		LogLevel:              parsedFlags.MustString("log-level"),
 		LogFieldsPrefix:       parsedFlags.MustString("log-fields-prefix"),
 		LogStdFormat:          parsedFlags.MustDeprecatedString("log-format", "log-std-format"),
 		LogStdEnableGcpFields: parsedFlags.MustDeprecatedBool("log-enable-gcp-fields", "log-std-enable-gcp-fields"),
-		LogStdLevelCase:       parsedFlags.MustString("log-std-level-case"),
-	}
-	// LogLevel uses its own flag, not the format flag.
-	telemetryCfg.LogLevel = parsedFlags.MustString("log-level")
-
-	err = telemetryCfg.Validate()
-	if err != nil {
-		fmt.Printf("[FATAL] invalid telemetry config: %s\n", err)
-		os.Exit(1)
-	}
-
-	shutdownTelemetry, err := gotenberg.StartTelemetry(telemetryCfg)
-	if err != nil {
-		fmt.Printf("[FATAL] start telemetry: %s\n", err)
-		os.Exit(1)
 	}
 
 	if !hideBanner {
 		fmt.Printf(banner, Version)
 	}
-	fmt.Printf("[SYSTEM] modules: %s\n", modsInfo.String())
 
+	err = telemetryConfig.Validate()
+	if err != nil {
+		fmt.Printf("[FATAL] telemetry: %s\n", err)
+		os.Exit(1)
+	}
+
+	// Telemetry.
+	shutdownTelemetry, err := gotenberg.StartTelemetry(telemetryConfig)
+	if err != nil {
+		fmt.Printf("[FATAL] telemetry: %s\n", err)
+		os.Exit(1)
+	}
+
+	// Modules.
+	fmt.Printf("[SYSTEM] modules: %s\n", modsInfo.String())
 	ctx := gotenberg.NewContext(parsedFlags, descriptors)
 
-	// Start application modules.
 	apps, err := ctx.Modules(new(gotenberg.App))
 	if err != nil {
 		fmt.Printf("[FATAL] %s\n", err)
@@ -240,18 +223,16 @@ func Run() {
 
 	err = eg.Wait()
 	if err != nil {
-		cancel()
 		fmt.Printf("[FATAL] %v\n", err)
-		os.Exit(1) //nolint:gocritic // defers are already called explicitly above
+		os.Exit(1)
 	}
 
-	// Shutdown telemetry (flush spans, metrics, logs).
 	err = shutdownTelemetry(gracefulShutdownCtx)
 	if err != nil {
-		cancel()
-		fmt.Printf("[FATAL] %v\n", err)
-		os.Exit(1) //nolint:gocritic // defers are already called explicitly above
+		fmt.Printf("[FATAL] telemetry: %v\n", err)
+		os.Exit(1)
 	}
+	fmt.Printf("[SYSTEM] telemetry: shutdown success\n")
 
 	os.Exit(0)
 }

compose.yaml

@@ -21,8 +21,6 @@ services:
       - "--api-port=${API_PORT}"
       - "--api-port-from-env=${API_PORT_FROM_ENV}"
       - "--api-bind-ip=${API_BIND_IP}"
-      - "--api-tls-cert-file=${API_TLS_CERT_FILE}"
-      - "--api-tls-key-file=${API_TLS_KEY_FILE}"
       - "--api-start-timeout=${API_START_TIMEOUT}"
       - "--api-timeout=${API_TIMEOUT}"
       - "--api-body-limit=${API_BODY_LIMIT}"
@@ -31,20 +29,16 @@ services:
       - "--api-enable-basic-auth=${API_ENABLE_BASIC_AUTH}"
       - "--api-download-from-allow-list=${API_DOWNLOAD_FROM_ALLOW_LIST}"
       - "--api-download-from-deny-list=${API_DOWNLOAD_FROM_DENY_LIST}"
-      - "--api-download-from-deny-private-ips=${API_DOWNLOAD_FROM_DENY_PRIVATE_IPS}"
-      - "--api-download-from-deny-public-ips=${API_DOWNLOAD_FROM_DENY_PUBLIC_IPS}"
-      - "--api-download-from-enable-environment-proxy=${API_DOWNLOAD_FROM_ENABLE_ENVIRONMENT_PROXY}"
       - "--api-download-from-max-retry=${API_DOWNLOAD_FROM_MAX_RETRY}"
       - "--api-disable-download-from=${API_DISABLE_DOWNLOAD_FROM}"
       - "--api-disable-health-check-route-telemetry=${API_DISABLE_HEALTH_CHECK_ROUTE_TELEMETRY}"
       - "--api-disable-root-route-telemetry=${API_DISABLE_ROOT_ROUTE_TELEMETRY}"
-      - "--api-disable-debug-route-telemetry=${API_DISABLE_DEBUG_ROUTE_TELEMETRY}"
       - "--api-disable-version-route-telemetry=${API_DISABLE_VERSION_ROUTE_TELEMETRY}"
+      - "--api-disable-debug-route-telemetry=${API_DISABLE_DEBUG_ROUTE_TELEMETRY}"
       - "--api-enable-debug-route=${API_ENABLE_DEBUG_ROUTE}"
       - "--chromium-restart-after=${CHROMIUM_RESTART_AFTER}"
       - "--chromium-auto-start=${CHROMIUM_AUTO_START}"
       - "--chromium-max-queue-size=${CHROMIUM_MAX_QUEUE_SIZE}"
-      - "--chromium-idle-shutdown-timeout=${CHROMIUM_IDLE_SHUTDOWN_TIMEOUT}"
       - "--chromium-max-concurrency=${CHROMIUM_MAX_CONCURRENCY}"
       - "--chromium-start-timeout=${CHROMIUM_START_TIMEOUT}"
       - "--chromium-allow-insecure-localhost=${CHROMIUM_ALLOW_INSECURE_LOCALHOST}"
@@ -53,58 +47,35 @@ services:
       - "--chromium-allow-file-access-from-files=${CHROMIUM_ALLOW_FILE_ACCESS_FROM_FILES}"
       - "--chromium-host-resolver-rules=${CHROMIUM_HOST_RESOLVER_RULES}"
       - "--chromium-proxy-server=${CHROMIUM_PROXY_SERVER}"
-      - "--chromium-enable-environment-proxy=${CHROMIUM_ENABLE_ENVIRONMENT_PROXY}"
       - "--chromium-allow-list=${CHROMIUM_ALLOW_LIST}"
       - "--chromium-deny-list=${CHROMIUM_DENY_LIST}"
-      - "--chromium-deny-private-ips=${CHROMIUM_DENY_PRIVATE_IPS}"
-      - "--chromium-deny-public-ips=${CHROMIUM_DENY_PUBLIC_IPS}"
       - "--chromium-clear-cache=${CHROMIUM_CLEAR_CACHE}"
       - "--chromium-clear-cookies=${CHROMIUM_CLEAR_COOKIES}"
       - "--chromium-disable-javascript=${CHROMIUM_DISABLE_JAVASCRIPT}"
       - "--chromium-disable-routes=${CHROMIUM_DISABLE_ROUTES}"
       - "--libreoffice-restart-after=${LIBREOFFICE_RESTART_AFTER}"
       - "--libreoffice-max-queue-size=${LIBREOFFICE_MAX_QUEUE_SIZE}"
-      - "--libreoffice-idle-shutdown-timeout=${LIBREOFFICE_IDLE_SHUTDOWN_TIMEOUT}"
       - "--libreoffice-auto-start=${LIBREOFFICE_AUTO_START}"
       - "--libreoffice-start-timeout=${LIBREOFFICE_START_TIMEOUT}"
-      - "--libreoffice-allow-list=${LIBREOFFICE_ALLOW_LIST}"
-      - "--libreoffice-deny-list=${LIBREOFFICE_DENY_LIST}"
-      - "--libreoffice-deny-private-ips=${LIBREOFFICE_DENY_PRIVATE_IPS}"
-      - "--libreoffice-deny-public-ips=${LIBREOFFICE_DENY_PUBLIC_IPS}"
-      - "--libreoffice-enable-environment-proxy=${LIBREOFFICE_ENABLE_ENVIRONMENT_PROXY}"
       - "--libreoffice-disable-routes=${LIBREOFFICE_DISABLE_ROUTES}"
       - "--log-level=${LOG_LEVEL}"
       - "--log-fields-prefix=${LOG_FIELDS_PREFIX}"
       - "--log-std-format=${LOG_STD_FORMAT}"
       - "--log-std-enable-gcp-fields=${LOG_STD_ENABLE_GCP_FIELDS}"
-      - "--log-std-level-case=${LOG_STD_LEVEL_CASE}"
       - "--pdfengines-merge-engines=${PDFENGINES_MERGE_ENGINES}"
       - "--pdfengines-split-engines=${PDFENGINES_SPLIT_ENGINES}"
       - "--pdfengines-flatten-engines=${PDFENGINES_FLATTEN_ENGINES}"
       - "--pdfengines-convert-engines=${PDFENGINES_CONVERT_ENGINES}"
       - "--pdfengines-read-metadata-engines=${PDFENGINES_READ_METADATA_ENGINES}"
       - "--pdfengines-write-metadata-engines=${PDFENGINES_WRITE_METADATA_ENGINES}"
-      - "--pdfengines-read-bookmarks-engines=${PDFENGINES_READ_BOOKMARKS_ENGINES}"
-      - "--pdfengines-write-bookmarks-engines=${PDFENGINES_WRITE_BOOKMARKS_ENGINES}"
-      - "--pdfengines-watermark-engines=${PDFENGINES_WATERMARK_ENGINES}"
-      - "--pdfengines-stamp-engines=${PDFENGINES_STAMP_ENGINES}"
       - "--pdfengines-encrypt-engines=${PDFENGINES_ENCRYPT_ENGINES}"
-      - "--pdfengines-rotate-engines=${PDFENGINES_ROTATE_ENGINES}"
-      - "--pdfengines-embed-engines=${PDFENGINES_EMBED_ENGINES}"
-      - "--pdfengines-embed-metadata-engines=${PDFENGINES_EMBED_METADATA_ENGINES}"
-      - "--pdfengines-factur-x-engines=${PDFENGINES_FACTUR_X_ENGINES}"
       - "--pdfengines-disable-routes=${PDFENGINES_DISABLE_ROUTES}"
-      - "--prometheus-namespace=${PROMETHEUS_NAMESPACE}"
-      - "--prometheus-collect-interval=${PROMETHEUS_COLLECT_INTERVAL}"
-      - "--prometheus-disable-route-telemetry=${PROMETHEUS_DISABLE_ROUTE_TELEMETRY}"
-      - "--prometheus-disable-collect=${PROMETHEUS_DISABLE_COLLECT}"
-      - "--prometheus-metrics-path=${PROMETHEUS_METRICS_PATH}"
+      - "--pdfengines-add-attachments-engines=${PDFENGINES_ADD_ATTACHMENTS_ENGINES}"
       - "--webhook-enable-sync-mode=${WEBHOOK_ENABLE_SYNC_MODE}"
       - "--webhook-allow-list=${WEBHOOK_ALLOW_LIST}"
       - "--webhook-deny-list=${WEBHOOK_DENY_LIST}"
-      - "--webhook-deny-private-ips=${WEBHOOK_DENY_PRIVATE_IPS}"
-      - "--webhook-deny-public-ips=${WEBHOOK_DENY_PUBLIC_IPS}"
-      - "--webhook-enable-environment-proxy=${WEBHOOK_ENABLE_ENVIRONMENT_PROXY}"
+      - "--webhook-error-allow-list=${WEBHOOK_ERROR_ALLOW_LIST}"
+      - "--webhook-error-deny-list=${WEBHOOK_ERROR_DENY_LIST}"
       - "--webhook-max-retry=${WEBHOOK_MAX_RETRY}"
       - "--webhook-retry-min-wait=${WEBHOOK_RETRY_MIN_WAIT}"
       - "--webhook-retry-max-wait=${WEBHOOK_RETRY_MAX_WAIT}"
@@ -119,20 +90,14 @@ services:
     ports:
       - "4317:4317" # OTLP gRPC receiver
     depends_on:
-      openobserve:
-        condition: service_started
-    restart: on-failure
+      - openobserve
 
   openobserve:
     image: public.ecr.aws/zinclabs/openobserve:latest
     restart: always
     ports:
       - "5080:5080"
-      - "5081:5081"
+      - "5081:5081" # OTLP gRPC ingestion
     environment:
       ZO_ROOT_USER_EMAIL: telemetry@gotenberg.dev
       ZO_ROOT_USER_PASSWORD: telemetry
-
-networks:
-  default:
-    enable_ipv6: false

go.mod

@@ -1,40 +1,41 @@
 module github.com/gotenberg/gotenberg/v8
 
-go 1.26.5
+go 1.26.0
 
 require (
 	github.com/alexliesenfeld/health v0.8.1
-	github.com/chromedp/cdproto v0.0.0-20250803210736-d308e07a266d // pinned with chromedp v0.14.2, see below
-	github.com/chromedp/chromedp v0.14.2 // pinned: v0.15.x breaks the headless print-mode paint pipeline (rAF / ResizeObserver / IntersectionObserver stop firing, blank charts). See https://github.com/gotenberg/gotenberg/issues/1535.
-	github.com/cucumber/godog v0.16.0
-	github.com/dlclark/regexp2 v1.12.0
-	github.com/gomarkdown/markdown v0.0.0-20260614204949-e08cff860f76
+	github.com/barasher/go-exiftool v1.10.0
+	github.com/chromedp/cdproto v0.0.0-20250803210736-d308e07a266d
+	github.com/chromedp/chromedp v0.14.2
+	github.com/cucumber/godog v0.15.1
+	github.com/dlclark/regexp2 v1.11.5
+	github.com/docker/docker v28.5.2+incompatible
+	github.com/docker/go-connections v0.6.0
+	github.com/gomarkdown/markdown v0.0.0-20260217112301-37c66b85d6ab
 	github.com/google/uuid v1.6.0
 	github.com/hashicorp/go-retryablehttp v0.7.8
-	github.com/labstack/echo/v4 v4.15.4
-	github.com/labstack/gommon v0.5.0
+	github.com/labstack/echo/v4 v4.15.1
+	github.com/labstack/gommon v0.4.2
 	github.com/mholt/archives v0.1.5
 	github.com/microcosm-cc/bluemonday v1.0.27
-	github.com/moby/moby/api v1.55.0
-	github.com/moby/moby/client v0.5.1
-	github.com/prometheus/client_golang v1.24.1
-	github.com/shirou/gopsutil/v4 v4.26.7
+	github.com/shirou/gopsutil/v4 v4.26.1
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
-	github.com/testcontainers/testcontainers-go v0.43.0
-	go.opentelemetry.io/contrib/bridges/otelslog v0.19.0
-	go.opentelemetry.io/contrib/exporters/autoexport v0.69.0
-	go.opentelemetry.io/otel v1.45.0
-	go.opentelemetry.io/otel/log v0.20.0
-	go.opentelemetry.io/otel/metric v1.45.0
-	go.opentelemetry.io/otel/sdk v1.45.0
-	go.opentelemetry.io/otel/sdk/log v0.20.0
-	go.opentelemetry.io/otel/sdk/metric v1.45.0
-	go.opentelemetry.io/otel/trace v1.45.0
-	golang.org/x/net v0.57.0
-	golang.org/x/sync v0.22.0
-	golang.org/x/term v0.45.0
-	golang.org/x/text v0.40.0
+	github.com/testcontainers/testcontainers-go v0.40.0
+	go.opentelemetry.io/contrib/bridges/otelslog v0.15.0
+	go.opentelemetry.io/contrib/exporters/autoexport v0.67.0
+	go.opentelemetry.io/otel v1.42.0
+	go.opentelemetry.io/otel/log v0.18.0
+	go.opentelemetry.io/otel/metric v1.42.0
+	go.opentelemetry.io/otel/sdk v1.42.0
+	go.opentelemetry.io/otel/sdk/log v0.18.0
+	go.opentelemetry.io/otel/sdk/metric v1.42.0
+	go.opentelemetry.io/otel/trace v1.42.0
+	go.uber.org/multierr v1.11.0
+	golang.org/x/net v0.51.0
+	golang.org/x/sync v0.19.0
+	golang.org/x/term v0.40.0
+	golang.org/x/text v0.34.0
 )
 
 require (
@@ -42,11 +43,11 @@ require (
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/STARRY-S/zip v0.2.3 // indirect
-	github.com/andybalholm/brotli v1.2.1 // indirect
+	github.com/andybalholm/brotli v1.2.0 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bodgit/plumbing v1.3.0 // indirect
-	github.com/bodgit/sevenzip v1.6.4 // indirect
+	github.com/bodgit/sevenzip v1.6.1 // indirect
 	github.com/bodgit/windows v1.0.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
@@ -57,87 +58,90 @@ require (
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
 	github.com/cpuguy83/dockercfg v0.3.2 // indirect
-	github.com/cucumber/gherkin/go/v42 v42.0.0 // indirect
-	github.com/cucumber/messages/go/v34 v34.2.0 // indirect
+	github.com/cucumber/gherkin/go/v26 v26.2.0 // indirect
+	github.com/cucumber/messages/go/v21 v21.0.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/go-connections v0.7.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
-	github.com/ebitengine/purego v0.10.2 // indirect
-	github.com/felixge/httpsnoop v1.1.0 // indirect
-	github.com/go-json-experiment/json v0.0.0-20260601182631-00ed12fed2a6 // indirect
-	github.com/go-logr/logr v1.4.4 // indirect
+	github.com/ebitengine/purego v0.10.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/go-json-experiment/json v0.0.0-20260214004413-d219187c3433 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
 	github.com/gobwas/httphead v0.1.0 // indirect
 	github.com/gobwas/pool v0.2.1 // indirect
 	github.com/gobwas/ws v1.4.0 // indirect
+	github.com/gofrs/uuid v4.4.0+incompatible // indirect
 	github.com/gorilla/css v1.0.1 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
 	github.com/hashicorp/go-memdb v1.3.5 // indirect
 	github.com/hashicorp/golang-lru v1.0.2 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
-	github.com/klauspost/compress v1.19.1 // indirect
+	github.com/klauspost/compress v1.18.4 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
-	github.com/lufia/plan9stats v0.0.0-20260330125221-c963978e514e // indirect
+	github.com/lufia/plan9stats v0.0.0-20260216142805-b3301c5f2a88 // indirect
 	github.com/magiconair/properties v1.8.10 // indirect
-	github.com/mattn/go-colorable v0.1.15 // indirect
-	github.com/mattn/go-isatty v0.0.22 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mikelolasagasti/xz v1.0.1 // indirect
-	github.com/minio/minlz v1.1.1 // indirect
+	github.com/minio/minlz v1.0.1 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/go-archive v0.2.0 // indirect
-	github.com/moby/patternmatcher v0.6.1 // indirect
-	github.com/moby/sys/sequential v0.7.0 // indirect
+	github.com/moby/patternmatcher v0.6.0 // indirect
+	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/moby/term v0.5.2 // indirect
+	github.com/morikuni/aec v1.1.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/nwaples/rardecode/v2 v2.2.5 // indirect
+	github.com/nwaples/rardecode/v2 v2.2.2 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
-	github.com/pierrec/lz4/v4 v4.1.27 // indirect
+	github.com/pierrec/lz4/v4 v4.1.25 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
+	github.com/prometheus/client_golang v1.23.2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.70.1 // indirect
+	github.com/prometheus/common v0.67.5 // indirect
 	github.com/prometheus/otlptranslator v1.0.0 // indirect
-	github.com/prometheus/procfs v0.21.1 // indirect
+	github.com/prometheus/procfs v0.20.1 // indirect
 	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/sorairolake/lzip-go v0.3.8 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
-	github.com/stangelandcl/ppmd v0.1.1 // indirect
-	github.com/tklauser/go-sysconf v0.4.0 // indirect
-	github.com/tklauser/numcpus v0.12.0 // indirect
+	github.com/tklauser/go-sysconf v0.3.16 // indirect
+	github.com/tklauser/numcpus v0.11.0 // indirect
 	github.com/ulikunitz/xz v0.5.15 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasttemplate v1.2.2 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/bridges/prometheus v0.69.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.20.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.20.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.44.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.44.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0 // indirect
-	go.opentelemetry.io/otel/exporters/prometheus v0.66.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.20.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.44.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.44.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
+	go.opentelemetry.io/contrib/bridges/prometheus v0.67.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.18.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.18.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/prometheus v0.64.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.18.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.9.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go4.org v0.0.0-20260112195520-a5071408f32f // indirect
-	golang.org/x/crypto v0.54.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/time v0.15.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260615183401-62b3387ff324 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260615183401-62b3387ff324 // indirect
-	google.golang.org/grpc v1.82.1 // indirect
+	golang.org/x/crypto v0.48.0 // indirect
+	golang.org/x/sys v0.41.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
+	google.golang.org/grpc v1.79.2 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -10,16 +10,18 @@ github.com/STARRY-S/zip v0.2.3 h1:luE4dMvRPDOWQdeDdUxUoZkzUIpTccdKdhHHsQJ1fm4=
 github.com/STARRY-S/zip v0.2.3/go.mod h1:lqJ9JdeRipyOQJrYSOtpNAiaesFO6zVDsE8GIGFaoSk=
 github.com/alexliesenfeld/health v0.8.1 h1:wdE3vt+cbJotiR8DGDBZPKHDFoJbAoWEfQTcqrmedUg=
 github.com/alexliesenfeld/health v0.8.1/go.mod h1:TfNP0f+9WQVWMQRzvMUjlws4ceXKEL3WR+6Hp95HUFc=
-github.com/andybalholm/brotli v1.2.1 h1:R+f5xP285VArJDRgowrfb9DqL18yVK0gKAW/F+eTWro=
-github.com/andybalholm/brotli v1.2.1/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
+github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
+github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
+github.com/barasher/go-exiftool v1.10.0 h1:f5JY5jc42M7tzR6tbL9508S2IXdIcG9QyieEXNMpIhs=
+github.com/barasher/go-exiftool v1.10.0/go.mod h1:F9s/a3uHSM8YniVfwF+sbQUtP8Gmh9nyzigNF+8vsWo=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bodgit/plumbing v1.3.0 h1:pf9Itz1JOQgn7vEOE7v7nlEfBykYqvUYioC61TwWCFU=
 github.com/bodgit/plumbing v1.3.0/go.mod h1:JOTb4XiRu5xfnmdnDJo6GmSbSbtSyufrsyZFByMtKEs=
-github.com/bodgit/sevenzip v1.6.4 h1:iHiVJfxbrB6RF4X+snI2MpVgNBKmVfGaTqZGNlMQIU0=
-github.com/bodgit/sevenzip v1.6.4/go.mod h1:ZtNi5KNgHXeXg1G7WiF0IWSuFE2eG6lt/cTGlvuirO0=
+github.com/bodgit/sevenzip v1.6.1 h1:kikg2pUMYC9ljU7W9SaqHXhym5HyKm8/M/jd31fYan4=
+github.com/bodgit/sevenzip v1.6.1/go.mod h1:GVoYQbEVbOGT8n2pfqCIMRUaRjQ8F9oSqoBEqZh5fQ8=
 github.com/bodgit/windows v1.0.1 h1:tF7K6KOluPYygXa3Z2594zxlkbKPAOvqr97etrGNIz4=
 github.com/bodgit/windows v1.0.1/go.mod h1:a6JLwrB4KrTR5hBpp8FI9/9W9jJfeQ2h4XDXU74ZCdM=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
@@ -44,39 +46,43 @@ github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpS
 github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
 github.com/cpuguy83/dockercfg v0.3.2 h1:DlJTyZGBDlXqUZ2Dk2Q3xHs/FtnooJJVaad2S9GKorA=
 github.com/cpuguy83/dockercfg v0.3.2/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc=
-github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
-github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
-github.com/cucumber/gherkin/go/v42 v42.0.0 h1:Ulh3E2awUUSSja+wonP/IOQ+ycmiZwZbgmzqk5H8JNI=
-github.com/cucumber/gherkin/go/v42 v42.0.0/go.mod h1:CsaumaO2dR9XvBc6ZyiGLMhWCKtTRDxgoxqJigSjSSg=
-github.com/cucumber/godog v0.16.0 h1:ezQbgItuWqZrjPUQwLJ3muwIlvzXBOfZso5QZfG7efE=
-github.com/cucumber/godog v0.16.0/go.mod h1:EDUX9yCqANK+GpbftMDeu61sUDtdLuo1JJgXD2n3bbM=
-github.com/cucumber/messages/go/v34 v34.2.0 h1:VCbcNOMz+f8ccjjOOx1NLBNhwvE7/X49Atc8klJa+i8=
-github.com/cucumber/messages/go/v34 v34.2.0/go.mod h1:LYUPjqlTS1kS0pdkdf6sS5uirnjwiIzEGyXPezXNhL8=
+github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
+github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
+github.com/cucumber/gherkin/go/v26 v26.2.0 h1:EgIjePLWiPeslwIWmNQ3XHcypPsWAHoMCz/YEBKP4GI=
+github.com/cucumber/gherkin/go/v26 v26.2.0/go.mod h1:t2GAPnB8maCT4lkHL99BDCVNzCh1d7dBhCLt150Nr/0=
+github.com/cucumber/godog v0.15.1 h1:rb/6oHDdvVZKS66hrhpjFQFHjthFSrQBCOI1LwshNTI=
+github.com/cucumber/godog v0.15.1/go.mod h1:qju+SQDewOljHuq9NSM66s0xEhogx0q30flfxL4WUk8=
+github.com/cucumber/messages/go/v21 v21.0.1 h1:wzA0LxwjlWQYZd32VTlAVDTkW6inOFmSM+RuOwHZiMI=
+github.com/cucumber/messages/go/v21 v21.0.1/go.mod h1:zheH/2HS9JLVFukdrsPWoPdmUtmYQAQPLk7w5vWsk5s=
+github.com/cucumber/messages/go/v22 v22.0.0/go.mod h1:aZipXTKc0JnjCsXrJnuZpWhtay93k7Rn3Dee7iyPJjs=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
-github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/docker/go-connections v0.7.0 h1:6SsRfJddP22WMrCkj19x9WKjEDTB+ahsdiGYf0mN39c=
-github.com/docker/go-connections v0.7.0/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
+github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ=
+github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/docker/docker v28.5.2+incompatible h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM=
+github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
+github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 h1:2tV76y6Q9BB+NEBasnqvs7e49aEBFI8ejC89PSnWH+4=
 github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707/go.mod h1:qssHWj60/X5sZFNxpG4HBPDHVqxNm4DfnCKgrbZOT+s=
 github.com/dsnet/golib v0.0.0-20171103203638-1ea166775780/go.mod h1:Lj+Z9rebOhdfkVLjJ8T6VcRQv3SXugXy999NBtR9aFY=
-github.com/ebitengine/purego v0.10.2 h1:W809HbnvzAxgdm+aOvlSekrM16wGCdT/e76+9tS7gzE=
-github.com/ebitengine/purego v0.10.2/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/ebitengine/purego v0.10.0 h1:QIw4xfpWT6GWTzaW5XEKy3HXoqrJGx1ijYHzTF0/ISU=
+github.com/ebitengine/purego v0.10.0/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
 github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
-github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
-github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
-github.com/go-json-experiment/json v0.0.0-20260601182631-00ed12fed2a6 h1:nxP4pPoyqOAgX8lYDFCfl3DyKeXErCvSvhcyzwGV9CE=
-github.com/go-json-experiment/json v0.0.0-20260601182631-00ed12fed2a6/go.mod h1:tphK2c80bpPhMOI4v6bIc2xWywPfbqi1Z06+RcrMkDg=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/go-json-experiment/json v0.0.0-20260214004413-d219187c3433 h1:vymEbVwYFP/L05h5TKQxvkXoKxNvTpjxYKdF1Nlwuao=
+github.com/go-json-experiment/json v0.0.0-20260214004413-d219187c3433/go.mod h1:tphK2c80bpPhMOI4v6bIc2xWywPfbqi1Z06+RcrMkDg=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
-github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
@@ -88,10 +94,14 @@ github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
 github.com/gobwas/ws v1.4.0 h1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=
 github.com/gobwas/ws v1.4.0/go.mod h1:G3gNqMNtPppf5XUz7O4shetPpcZ1VJ7zt18dlUeakrc=
+github.com/gofrs/uuid v4.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
+github.com/gofrs/uuid v4.3.1+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
+github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=
+github.com/gofrs/uuid v4.4.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/gomarkdown/markdown v0.0.0-20260614204949-e08cff860f76 h1:Ltt9ldIaSYEsjA7sPY2c8r9dOmnKM1vlzhh3dxlhBHM=
-github.com/gomarkdown/markdown v0.0.0-20260614204949-e08cff860f76/go.mod h1:JDGcbDT52eL4fju3sZ4TeHGsQwhG9nbDV21aMyhwPoA=
+github.com/gomarkdown/markdown v0.0.0-20260217112301-37c66b85d6ab h1:VYNivV7P8IRHUam2swVUNkhIdp0LRRFKe4hXNnoZKTc=
+github.com/gomarkdown/markdown v0.0.0-20260217112301-37c66b85d6ab/go.mod h1:JDGcbDT52eL4fju3sZ4TeHGsQwhG9nbDV21aMyhwPoA=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
@@ -99,14 +109,16 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
 github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
 github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-immutable-radix v1.3.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=
 github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
+github.com/hashicorp/go-memdb v1.3.4/go.mod h1:uBTr1oQbtuMgd1SSGoR8YV27eT3sBHbYiNm53bMpgSg=
 github.com/hashicorp/go-memdb v1.3.5 h1:b3taDMxCBCBVgyRrS1AZVHO14ubMYZB++QpNhBg+Nyo=
 github.com/hashicorp/go-memdb v1.3.5/go.mod h1:8IVKKBkVe+fxFgdFOYxzQQNjz+sWCyHCdIC/+5+Vy1Y=
 github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
@@ -120,114 +132,124 @@ github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iP
 github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=
-github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c=
+github.com/klauspost/compress v1.18.4/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
 github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/labstack/echo/v4 v4.15.4 h1:DL45vVYa+BWE+XuW+zZNd9H0YEdZ80UAWJGcTVW4EVs=
-github.com/labstack/echo/v4 v4.15.4/go.mod h1:CuMetKIRwsuO/qlAgMq+KTAalwGoB/h4tC+yPdrTj1g=
-github.com/labstack/gommon v0.5.0 h1:6VSQ2NOzsnEJ5W6+84E0RbcaDDmgB6NIAzWCczTEe6c=
-github.com/labstack/gommon v0.5.0/go.mod h1:Rzlg7HHy1maLfzBYGg9NZcVuz1sA68HHhLjhcEllYE0=
+github.com/labstack/echo/v4 v4.15.1 h1:S9keusg26gZpjMmPqB5hOEvNKnmd1lNmcHrbbH2lnFs=
+github.com/labstack/echo/v4 v4.15.1/go.mod h1:xmw1clThob0BSVRX1CRQkGQ/vjwcpOMjQZSZa9fKA/c=
+github.com/labstack/gommon v0.4.2 h1:F8qTUNXgG1+6WQmqoUWnz8WiEU60mXVVw0P4ht1WRA0=
+github.com/labstack/gommon v0.4.2/go.mod h1:QlUFxVM+SNXhDL/Z7YhocGIBYOiwB0mXm1+1bAPHPyU=
 github.com/ledongthuc/pdf v0.0.0-20220302134840-0c2507a12d80 h1:6Yzfa6GP0rIo/kULo2bwGEkFvCePZ3qHDDTC3/J9Swo=
 github.com/ledongthuc/pdf v0.0.0-20220302134840-0c2507a12d80/go.mod h1:imJHygn/1yfhB7XSJJKlFZKl/J+dCPAknuiaGOshXAs=
-github.com/lufia/plan9stats v0.0.0-20260330125221-c963978e514e h1:Q6MvJtQK/iRcRtzAscm/zF23XxJlbECiGPyRicsX+Ak=
-github.com/lufia/plan9stats v0.0.0-20260330125221-c963978e514e/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
+github.com/lufia/plan9stats v0.0.0-20260216142805-b3301c5f2a88 h1:PTw+yKnXcOFCR6+8hHTyWBeQ/P4Nb7dd4/0ohEcWQuM=
+github.com/lufia/plan9stats v0.0.0-20260216142805-b3301c5f2a88/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
 github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
 github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
-github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
-github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
-github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mholt/archives v0.1.5 h1:Fh2hl1j7VEhc6DZs2DLMgiBNChUux154a1G+2esNvzQ=
 github.com/mholt/archives v0.1.5/go.mod h1:3TPMmBLPsgszL+1As5zECTuKwKvIfj6YcwWPpeTAXF4=
 github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
 github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
 github.com/mikelolasagasti/xz v1.0.1 h1:Q2F2jX0RYJUG3+WsM+FJknv+6eVjsjXNDV0KJXZzkD0=
 github.com/mikelolasagasti/xz v1.0.1/go.mod h1:muAirjiOUxPRXwm9HdDtB3uoRPrGnL85XHtokL9Hcgc=
-github.com/minio/minlz v1.1.1 h1:OGmft1V6AnI/Wme332U6bhG54nxEan+VFgkD7lat4KM=
-github.com/minio/minlz v1.1.1/go.mod h1:qT0aEB35q79LLornSzeDH75LBf3aH1MV+jB5w9Wasec=
+github.com/minio/minlz v1.0.1 h1:OUZUzXcib8diiX+JYxyRLIdomyZYzHct6EShOKtQY2A=
+github.com/minio/minlz v1.0.1/go.mod h1:qT0aEB35q79LLornSzeDH75LBf3aH1MV+jB5w9Wasec=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/go-archive v0.2.0 h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8=
 github.com/moby/go-archive v0.2.0/go.mod h1:mNeivT14o8xU+5q1YnNrkQVpK+dnNe/K6fHqnTg4qPU=
-github.com/moby/moby/api v1.55.0 h1:2/sexvQyqIWS8pRSCFddBfpW2qE7vR7FCL+vN8pxwMc=
-github.com/moby/moby/api v1.55.0/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
-github.com/moby/moby/client v0.5.1 h1:tYNaJno4c0HXz12y5BiqEDy0rVTYkWzI26lGvnTMiJw=
-github.com/moby/moby/client v0.5.1/go.mod h1:odLstlZ6uSnfvAgVxMpvgmb8SUdd+siH2T0GBuxVAlM=
-github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U=
-github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
-github.com/moby/sys/sequential v0.7.0 h1:ASQNGNROJSuOO6LL6bPHbKvuZu6NU8P4ldPWk31zj/8=
-github.com/moby/sys/sequential v0.7.0/go.mod h1:NfSTAp6V3fw4tmkD62PEcOKeZKquXT8VKCkf7aVR79o=
+github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
+github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
+github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
+github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
+github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
+github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
 github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
 github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
 github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
 github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
 github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
+github.com/morikuni/aec v1.1.0 h1:vBBl0pUnvi/Je71dsRrhMBtreIqNMYErSAbEeb8jrXQ=
+github.com/morikuni/aec v1.1.0/go.mod h1:xDRgiq/iw5l+zkao76YTKzKttOp2cwPEne25HDkJnBw=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/nwaples/rardecode/v2 v2.2.5 h1:L5doqgGfQwI7qADJMqnkrSB86rpPsqQDrHeO0HWa5JY=
-github.com/nwaples/rardecode/v2 v2.2.5/go.mod h1:7uz379lSxPe6j9nvzxUZ+n7mnJNgjsRNb6IbvGVHRmw=
+github.com/nwaples/rardecode/v2 v2.2.2 h1:/5oL8dzYivRM/tqX9VcTSWfbpwcbwKG1QtSJr3b3KcU=
+github.com/nwaples/rardecode/v2 v2.2.2/go.mod h1:7uz379lSxPe6j9nvzxUZ+n7mnJNgjsRNb6IbvGVHRmw=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde h1:x0TT0RDC7UhAVbbWWBzr41ElhJx5tXPWkIHA2HWPRuw=
 github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0=
-github.com/pierrec/lz4/v4 v4.1.27 h1:+PhzhWDrjRj89TH2sw43nE3+4+W8lSxIuQadEHZyjUk=
-github.com/pierrec/lz4/v4 v4.1.27/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=
+github.com/pierrec/lz4/v4 v4.1.25 h1:kocOqRffaIbU5djlIBr7Wh+cx82C0vtFb0fOurZHqD0=
+github.com/pierrec/lz4/v4 v4.1.25/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
-github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=
-github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=
+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY=
-github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc=
+github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
+github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
 github.com/prometheus/otlptranslator v1.0.0 h1:s0LJW/iN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=
 github.com/prometheus/otlptranslator v1.0.0/go.mod h1:vRYWnXvI6aWGpsdY/mOT/cbeVRBlPWtBNDb7kGR3uKM=
-github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
-github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
+github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
+github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
-github.com/shirou/gopsutil/v4 v4.26.7 h1:IXzpHz/dkMRYAhKkOXr1HB6SuzWU3eoyyeWe7g3bNZc=
-github.com/shirou/gopsutil/v4 v4.26.7/go.mod h1:5O9FjBiXoTDFatIWjZZosqj4pV0DRtLx598xGbBehzM=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/shirou/gopsutil/v4 v4.26.1 h1:TOkEyriIXk2HX9d4isZJtbjXbEjf5qyKPAzbzY0JWSo=
+github.com/shirou/gopsutil/v4 v4.26.1/go.mod h1:medLI9/UNAb0dOI9Q3/7yWSqKkj00u+1tgY8nvv41pc=
 github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
 github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
 github.com/sorairolake/lzip-go v0.3.8 h1:j5Q2313INdTA80ureWYRhX+1K78mUXfMoPZCw/ivWik=
 github.com/sorairolake/lzip-go v0.3.8/go.mod h1:JcBqGMV0frlxwrsE9sMWXDjqn3EeVf0/54YPsw66qkU=
 github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
 github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
+github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stangelandcl/ppmd v0.1.1 h1:c25QazhlWUn5nmR1QOzafKhQxBicAr7GGCKER2aJ8H8=
-github.com/stangelandcl/ppmd v0.1.1/go.mod h1:Rrv7M+/2P5jYr/GMLhBl7Ug3uJ1bUiVzr5LbbaV6xgY=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
-github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/testcontainers/testcontainers-go v0.43.0 h1:oEQx5MW2DGd9z3AeEQfB2lPM0eLs7ztyaGRu75bFo5A=
-github.com/testcontainers/testcontainers-go v0.43.0/go.mod h1:+VxkT2NQnKOZPKi6praMuMKYHYyOGXr0XSBSlSMCzFo=
-github.com/tklauser/go-sysconf v0.4.0 h1:7H0uAN+7RkwWRaxhYXDLqa5V3LPrJeV8wmD9dRUgPQU=
-github.com/tklauser/go-sysconf v0.4.0/go.mod h1:8mTNWyog7H+MpKijp4VmKJAd2bbYQ2zuUwkYRbUArPI=
-github.com/tklauser/numcpus v0.12.0 h1:NR85qdvHA9pFse3x3weVZ0r0ST8R6l5RHbZrlRaqob4=
-github.com/tklauser/numcpus v0.12.0/go.mod h1:ABHeXzJnr/qqwguhClkZKT1/8VABcYrsyUiUGobwWJg=
+github.com/testcontainers/testcontainers-go v0.40.0 h1:pSdJYLOVgLE8YdUY2FHQ1Fxu+aMnb6JfVz1mxk7OeMU=
+github.com/testcontainers/testcontainers-go v0.40.0/go.mod h1:FSXV5KQtX2HAMlm7U3APNyLkkap35zNLxukw9oBi/MY=
+github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA=
+github.com/tklauser/go-sysconf v0.3.16/go.mod h1:/qNL9xxDhc7tx3HSRsLWNnuzbVfh3e7gh/BmM179nYI=
+github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw=
+github.com/tklauser/numcpus v0.11.0/go.mod h1:z+LwcLq54uWZTX0u/bGobaV34u6V7KNlTZejzM6/3MQ=
 github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
 github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
@@ -241,90 +263,90 @@ github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/bridges/otelslog v0.19.0 h1:5RgvxieNq9tS3ewrV1vnODvbHPfKUIJcYtF9Cvz+6aQ=
-go.opentelemetry.io/contrib/bridges/otelslog v0.19.0/go.mod h1:iTBIdNwx/xmUhfgJs6+84S4dIK059811cO1eUBjKcHY=
-go.opentelemetry.io/contrib/bridges/prometheus v0.69.0 h1:saQoWg5845Q8TojpqeVStS7zGwVZ6bc5W2PJavTPiBM=
-go.opentelemetry.io/contrib/bridges/prometheus v0.69.0/go.mod h1:AAaS6xs5AyqMdR3Ir0nSWK+QudL2XM8Vbw5INzUxNc8=
-go.opentelemetry.io/contrib/exporters/autoexport v0.69.0 h1:R3jsCoTIzv0BiYNhW0axyswn/6SMJ8xL1OuGxvni1Kw=
-go.opentelemetry.io/contrib/exporters/autoexport v0.69.0/go.mod h1:m07gqyr2QhQxKOKb5vqKCCBtLH3uqlNYR7PU/FISXVU=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI=
-go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
-go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.20.0 h1:rydZ9sxbcFdm/oWrVyfLTjHIygMgv0bEeMd+3B/BvoM=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.20.0/go.mod h1:earQ25dooT0Hhspq59DZ8YCC50jWfOlFEeWoxy/P444=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.20.0 h1:owlhcJ3QO3X0YTDTCcDZ4V+6aVDkWbNmBoQ5NUp7Oww=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.20.0/go.mod h1:MP4eemTiI9zC8fgg+DYynhYDYf3ba72S376TvP+Ye0Q=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.44.0 h1:SUplec5dp06reu1zaXmOXdvqH398taqrDXqUl99jxSc=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.44.0/go.mod h1:ho2g4N+ane+swq5I/VBkKWnRDY4kUINH3FuqyZqX/Ug=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.44.0 h1:RuynHbfU8JUEw7DyONgkVYg2SVtsoF28y0LGIr69jgA=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.44.0/go.mod h1:qZF+/lBs71APw8mlnEZcqZHMzqrYrsFiJOv83lX1OGo=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 h1:4YsVu3B8+3qtWYYrsUYgn0OG78pN0rnNPRGX4SbokQI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0/go.mod h1:+wnlSn0mD1ADVMe3v9Z/WIaiz6q6gL2J/ejaAmdmv80=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 h1:qazEJlUOQzhCpzQpFETGby7EdqjI1wsd0W+6Gg1SCTU=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0/go.mod h1:fOD2Yefuxixkx3ahVNf0O/PERb6r4OlbxfATVnYvzCo=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0 h1:lgh3PiVrRUWMLOVSkQicxzZll5NjF1r+AtsX1XRIHw0=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0/go.mod h1:5Cnhth3m/AgOeTgE3ex12pPmiu/gGtZit03kSzx9X7s=
-go.opentelemetry.io/otel/exporters/prometheus v0.66.0 h1:vkrK8PAznv2NKt2r+kdu252ccGzkEqLc2aSXbQIALYQ=
-go.opentelemetry.io/otel/exporters/prometheus v0.66.0/go.mod h1:V/UB6D3vMF/UBOL5igAsAYnk1nG/bzYYTzvsB16cy7o=
-go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.20.0 h1:aZfdmtI6QU/DAPD4b7YZ5zuJgewxO1EW9miOZklqleU=
-go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.20.0/go.mod h1:isNl10/Om5CBWu9jj8WOb2+tJLbCVXDgqwzCaJMnJ6w=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.44.0 h1:hqxVTu/GtBF+vJ8d1fzW7fRxZFvgoDjWcxwwCaFDYpU=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.44.0/go.mod h1:z5fVEF4X5v0ESvlJqBrrFlBVoj5EQuefZpzsu7R+x5Q=
-go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.44.0 h1:bl2S7Ubua0Nms+D/gAmznQTd4dxxMA93aKbcpKqiTCs=
-go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.44.0/go.mod h1:L0hRV50XdVIODHUfWEqGRCXQvj2rV82STVo12FMFBU0=
-go.opentelemetry.io/otel/log v0.20.0 h1:/5i0vuHxCLWUfChWG41K9wkM0jafruPw9NU1/RCJirs=
-go.opentelemetry.io/otel/log v0.20.0/go.mod h1:wOcMcjsZpG8x7Bak7IhSi/lg8wscV2C1VdrKCLPlt0E=
-go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
-go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
-go.opentelemetry.io/otel/metric/x v0.67.0 h1:PcicCNZFkZ4bXfSooXdo3WN7RBOVOtjVdo1wD358Uns=
-go.opentelemetry.io/otel/metric/x v0.67.0/go.mod h1:FBjCWZe6wgcqxcMtjdGiClDKXb2YxxXii0CXftE4QtI=
-go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=
-go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA=
-go.opentelemetry.io/otel/sdk/log v0.20.0 h1:vM3xI7TQgKPiSghe6urZtAkyFY7SodrSpC83CffDFuY=
-go.opentelemetry.io/otel/sdk/log v0.20.0/go.mod h1:Knej2nmsTUzN79T2eeXdRsjjPcoxoq2pUyUHz9TFyyU=
-go.opentelemetry.io/otel/sdk/log/logtest v0.20.0 h1:OqdRZ1guyzamK3M6LlRsmGqRrjkHWw6WZOKKli5ELpg=
-go.opentelemetry.io/otel/sdk/log/logtest v0.20.0/go.mod h1:PuMIlm7zAt7c3z8zfOI5ox4iT1Z87We+PF6YoINux/M=
-go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=
-go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA=
-go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
-go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
-go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
-go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
+go.opentelemetry.io/contrib/bridges/otelslog v0.15.0 h1:yOYhGNPZseueTTvWp5iBD3/CthrmvayUXYEX862dDi4=
+go.opentelemetry.io/contrib/bridges/otelslog v0.15.0/go.mod h1:CvaNVqIfcybc+7xqZNubbE+26K6P7AKZF/l0lE2kdCk=
+go.opentelemetry.io/contrib/bridges/prometheus v0.67.0 h1:dkBzNEAIKADEaFnuESzcXvpd09vxvDZsOjx11gjUqLk=
+go.opentelemetry.io/contrib/bridges/prometheus v0.67.0/go.mod h1:Z5RIwRkZgauOIfnG5IpidvLpERjhTninpP1dTG2jTl4=
+go.opentelemetry.io/contrib/exporters/autoexport v0.67.0 h1:4fnRcNpc6YFtG3zsFw9achKn3XgmxPxuMuqIL5rE8e8=
+go.opentelemetry.io/contrib/exporters/autoexport v0.67.0/go.mod h1:qTvIHMFKoxW7HXg02gm6/Wofhq5p3Ib/A/NNt1EoBSQ=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 h1:7iP2uCb7sGddAr30RRS6xjKy7AZ2JtTOPA3oolgVSw8=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0/go.mod h1:c7hN3ddxs/z6q9xwvfLPk+UHlWRQyaeR1LdgfL/66l0=
+go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho=
+go.opentelemetry.io/otel v1.42.0/go.mod h1:lJNsdRMxCUIWuMlVJWzecSMuNjE7dOYyWlqOXWkdqCc=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.18.0 h1:deI9UQMoGFgrg5iLPgzueqFPHevDl+28YKfSpPTI6rY=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.18.0/go.mod h1:PFx9NgpNUKXdf7J4Q3agRxMs3Y07QhTCVipKmLsMKnU=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.18.0 h1:icqq3Z34UrEFk2u+HMhTtRsvo7Ues+eiJVjaJt62njs=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.18.0/go.mod h1:W2m8P+d5Wn5kipj4/xmbt9uMqezEKfBjzVJadfABSBE=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 h1:MdKucPl/HbzckWWEisiNqMPhRrAOQX8r4jTuGr636gk=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0/go.mod h1:RolT8tWtfHcjajEH5wFIZ4Dgh5jpPdFXYV9pTAk/qjc=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.42.0 h1:H7O6RlGOMTizyl3R08Kn5pdM06bnH8oscSj7o11tmLA=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.42.0/go.mod h1:mBFWu/WOVDkWWsR7Tx7h6EpQB8wsv7P0Yrh0Pb7othc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 h1:THuZiwpQZuHPul65w4WcwEnkX2QIuMT+UFoOrygtoJw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0/go.mod h1:J2pvYM5NGHofZ2/Ru6zw/TNWnEQp5crgyDeSrYpXkAw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 h1:zWWrB1U6nqhS/k6zYB74CjRpuiitRtLLi68VcgmOEto=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0/go.mod h1:2qXPNBX1OVRC0IwOnfo1ljoid+RD0QK3443EaqVlsOU=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.42.0 h1:uLXP+3mghfMf7XmV4PkGfFhFKuNWoCvvx5wP/wOXo0o=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.42.0/go.mod h1:v0Tj04armyT59mnURNUJf7RCKcKzq+lgJs6QSjHjaTc=
+go.opentelemetry.io/otel/exporters/prometheus v0.64.0 h1:g0LRDXMX/G1SEZtK8zl8Chm4K6GBwRkjPKE36LxiTYs=
+go.opentelemetry.io/otel/exporters/prometheus v0.64.0/go.mod h1:UrgcjnarfdlBDP3GjDIJWe6HTprwSazNjwsI+Ru6hro=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.18.0 h1:KJVjPD3rcPb98rIs3HznyJlrfx9ge5oJvxxlGR+P/7s=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.18.0/go.mod h1:K3kRa2ckmHWQaTWQdPRHc7qGXASuVuoEQXzrvlA98Ws=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.42.0 h1:lSZHgNHfbmQTPfuTmWVkEu8J8qXaQwuV30pjCcAUvP8=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.42.0/go.mod h1:so9ounLcuoRDu033MW/E0AD4hhUjVqswrMF5FoZlBcw=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0 h1:s/1iRkCKDfhlh1JF26knRneorus8aOwVIDhvYx9WoDw=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0/go.mod h1:UI3wi0FXg1Pofb8ZBiBLhtMzgoTm1TYkMvn71fAqDzs=
+go.opentelemetry.io/otel/log v0.18.0 h1:XgeQIIBjZZrliksMEbcwMZefoOSMI1hdjiLEiiB0bAg=
+go.opentelemetry.io/otel/log v0.18.0/go.mod h1:KEV1kad0NofR3ycsiDH4Yjcoj0+8206I6Ox2QYFSNgI=
+go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4=
+go.opentelemetry.io/otel/metric v1.42.0/go.mod h1:RlUN/7vTU7Ao/diDkEpQpnz3/92J9ko05BIwxYa2SSI=
+go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=
+go.opentelemetry.io/otel/sdk v1.42.0/go.mod h1:rGHCAxd9DAph0joO4W6OPwxjNTYWghRWmkHuGbayMts=
+go.opentelemetry.io/otel/sdk/log v0.18.0 h1:n8OyZr7t7otkeTnPTbDNom6rW16TBYGtvyy2Gk6buQw=
+go.opentelemetry.io/otel/sdk/log v0.18.0/go.mod h1:C0+wxkTwKpOCZLrlJ3pewPiiQwpzycPI/u6W0Z9fuYk=
+go.opentelemetry.io/otel/sdk/log/logtest v0.18.0 h1:l3mYuPsuBx6UKE47BVcPrZoZ0q/KER57vbj2qkgDLXA=
+go.opentelemetry.io/otel/sdk/log/logtest v0.18.0/go.mod h1:7cHtiVJpZebB3wybTa4NG+FUo5NPe3PROz1FqB0+qdw=
+go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9RKCAZ3YGuA=
+go.opentelemetry.io/otel/sdk/metric v1.42.0/go.mod h1:Ua6AAlDKdZ7tdvaQKfSmnFTdHx37+J4ba8MwVCYM5hc=
+go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=
+go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc=
+go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A=
+go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
-go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
+go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
 go4.org v0.0.0-20260112195520-a5071408f32f h1:ziUVAjmTPwQMBmYR1tbdRFJPtTcQUI12fH9QQjfb0Sw=
 go4.org v0.0.0-20260112195520-a5071408f32f/go.mod h1:ZRJnO5ZI4zAwMFp+dS1+V6J6MSyAowhRqAE+DPa1Xp0=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
+golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
+golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
+golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
-golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
-golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
+golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
+golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
+golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
+golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
-gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/api v0.0.0-20260615183401-62b3387ff324 h1:g0RAkxK/smSu/iRwC/KIX1mwUoVJtk2OjbgaeS4DmUM=
-google.golang.org/genproto/googleapis/api v0.0.0-20260615183401-62b3387ff324/go.mod h1:Z4WJ5pJOYWFWcHEQUelD5QaZDknIQkpIL/+fyJOT9+A=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260615183401-62b3387ff324 h1:9HZDLIdYBJXAnaFOr9WHrKVycfpY+75s9HGadC0305A=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260615183401-62b3387ff324/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
-google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 h1:tu/dtnW1o3wfaxCOjSLn5IRX4YDcJrtlpzYkhHhGaC4=
+google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171/go.mod h1:M5krXqk4GhBKvB596udGL3UyjL4I1+cTbK0orROM9ng=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.79.2 h1:fRMD94s2tITpyJGtBBn7MkMseNpOZU8ZxgC3MMBaXRU=
+google.golang.org/grpc v1.79.2/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -335,5 +357,3 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
-pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk=
-pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=

package-lock.json

@@ -5,9 +5,9 @@
   "packages": {
     "": {
       "devDependencies": {
-        "prettier": "3.9.6",
+        "prettier": "3.8.1",
         "prettier-plugin-gherkin": "^3.1.3",
-        "prettier-plugin-sh": "^0.19.0"
+        "prettier-plugin-sh": "^0.18.0"
       }
     },
     "node_modules/@cucumber/gherkin": {
@@ -34,80 +34,15 @@
       }
     },
     "node_modules/@reteps/dockerfmt": {
-      "version": "0.5.4",
-      "resolved": "https://registry.npmjs.org/@reteps/dockerfmt/-/dockerfmt-0.5.4.tgz",
-      "integrity": "sha512-HEGgXVVOb+JtGUSSzXl/XPKFIZjMDTUoHarCjaQdkY+cb5M9K/O3b5xm+x0IPIk3SfHurbc0bSgcFsQlzjitxA==",
+      "version": "0.3.6",
+      "resolved": "https://registry.npmjs.org/@reteps/dockerfmt/-/dockerfmt-0.3.6.tgz",
+      "integrity": "sha512-Tb5wIMvBf/nLejTQ61krK644/CEMB/cpiaIFXqGApfGqO3GwcR3qnI0DbmkFVCl2OyEp8LnLX3EkucoL0+tbFg==",
       "dev": true,
       "license": "MIT",
-      "bin": {
-        "dockerfmt": "dist/launcher.js"
-      },
       "engines": {
         "node": "^v12.20.0 || ^14.13.0 || >=16.0.0"
-      },
-      "optionalDependencies": {
-        "@reteps/dockerfmt-darwin-arm64": "0.5.4",
-        "@reteps/dockerfmt-darwin-x64": "0.5.4",
-        "@reteps/dockerfmt-linux-arm64": "0.5.4",
-        "@reteps/dockerfmt-linux-x64": "0.5.4"
       }
     },
-    "node_modules/@reteps/dockerfmt-darwin-arm64": {
-      "version": "0.5.4",
-      "resolved": "https://registry.npmjs.org/@reteps/dockerfmt-darwin-arm64/-/dockerfmt-darwin-arm64-0.5.4.tgz",
-      "integrity": "sha512-urMqV+dQyvVI8/WrXwClX9e1PEyS35wFdwJjpZYmL09AkV4Io5U1oam8UBKK7jZk0+YsdF88ay6e86Kn6DIyQg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@reteps/dockerfmt-darwin-x64": {
-      "version": "0.5.4",
-      "resolved": "https://registry.npmjs.org/@reteps/dockerfmt-darwin-x64/-/dockerfmt-darwin-x64-0.5.4.tgz",
-      "integrity": "sha512-fJORy6DFxbgDiMqxpLTPZlb5KUY0Vq0iR4NGnyKnuYZ9LdZUS508DK2kt/AJ87/jIKNV1qRG0JXG1Tc6xdvWjw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@reteps/dockerfmt-linux-arm64": {
-      "version": "0.5.4",
-      "resolved": "https://registry.npmjs.org/@reteps/dockerfmt-linux-arm64/-/dockerfmt-linux-arm64-0.5.4.tgz",
-      "integrity": "sha512-6pVakO06eXtDuvxy1Dnjs/gQyUoGGycle8PRSt5IFRwLi/AVaOQwfkfmW0WP8VH9wNUeti6BfJ3ksTn2G+XMxg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@reteps/dockerfmt-linux-x64": {
-      "version": "0.5.4",
-      "resolved": "https://registry.npmjs.org/@reteps/dockerfmt-linux-x64/-/dockerfmt-linux-x64-0.5.4.tgz",
-      "integrity": "sha512-OD6SIlUV1D4TgJoTui3FMBAZsGbTSPYsiT0BKhD6jMUcJb3GpFTa7dY9rL8rP9FUqfL7OTHVUGUOL4Rh64Olog==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
     "node_modules/@types/uuid": {
       "version": "10.0.0",
       "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-10.0.0.tgz",
@@ -123,9 +58,9 @@
       "license": "MIT"
     },
     "node_modules/prettier": {
-      "version": "3.9.6",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.6.tgz",
-      "integrity": "sha512-OpN0zzVdiaiAhxpuuj5efpIS4sY9j7bY6uR5mnj5yPzGkdkjNKSJeUThPb60Jw29QuAZgA4o+/iB49kFiaBX6g==",
+      "version": "3.8.1",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.8.1.tgz",
+      "integrity": "sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -151,14 +86,14 @@
       }
     },
     "node_modules/prettier-plugin-sh": {
-      "version": "0.19.0",
-      "resolved": "https://registry.npmjs.org/prettier-plugin-sh/-/prettier-plugin-sh-0.19.0.tgz",
-      "integrity": "sha512-39VXFZH/cOGtcuu8aeSvqp/hhwomOR4QroZUj+jBz2cNb3os9s0sqFZSNlYts6jdtLLDU7D2YT3Z1+abtb7adQ==",
+      "version": "0.18.0",
+      "resolved": "https://registry.npmjs.org/prettier-plugin-sh/-/prettier-plugin-sh-0.18.0.tgz",
+      "integrity": "sha512-cW1XL27FOJQ/qGHOW6IHwdCiNWQsAgK+feA8V6+xUTaH0cD3Mh+tFAtBvEEWvuY6hTDzRV943Fzeii+qMOh7nQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@reteps/dockerfmt": "^0.5.4",
-        "sh-syntax": "^0.6.0"
+        "@reteps/dockerfmt": "^0.3.6",
+        "sh-syntax": "^0.5.8"
       },
       "engines": {
         "node": ">=16.0.0"
@@ -178,11 +113,14 @@
       "license": "Apache-2.0"
     },
     "node_modules/sh-syntax": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/sh-syntax/-/sh-syntax-0.6.0.tgz",
-      "integrity": "sha512-52VK6z/cdZHv7UURjIcwfBUQZrAhIEEe0bY4lrkfypjnFIKsDZdD3Uaz/dBiw/sF8BeX0Mssv140s8EnrsJ9dQ==",
+      "version": "0.5.8",
+      "resolved": "https://registry.npmjs.org/sh-syntax/-/sh-syntax-0.5.8.tgz",
+      "integrity": "sha512-JfVoxf4FxQI5qpsPbkHhZo+n6N9YMJobyl4oGEUBb/31oQYlgTjkXQD8PBiafS2UbWoxrTO0Z5PJUBXEPAG1Zw==",
       "dev": true,
       "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.8.1"
+      },
       "engines": {
         "node": ">=16.0.0"
       },
@@ -190,6 +128,13 @@
         "url": "https://opencollective.com/sh-syntax"
       }
     },
+    "node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "dev": true,
+      "license": "0BSD"
+    },
     "node_modules/uuid": {
       "version": "11.0.5",
       "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.0.5.tgz",

package.json

@@ -1,7 +1,7 @@
 {
   "devDependencies": {
-    "prettier": "3.9.6",
+    "prettier": "3.8.1",
     "prettier-plugin-gherkin": "^3.1.3",
-    "prettier-plugin-sh": "^0.19.0"
+    "prettier-plugin-sh": "^0.18.0"
   }
 }

pkg/gotenberg/attrs.go

@@ -1,53 +0,0 @@
-package gotenberg
-
-import (
-	"net/url"
-	"slices"
-)
-
-// maxAttrRunes bounds the length of a string span attribute to keep payload
-// size and backend cardinality in check.
-const maxAttrRunes = 256
-
-// CapAttr truncates s to at most [maxAttrRunes] runes, appending an ellipsis
-// when it shortens the value. It is multibyte-safe.
-func CapAttr(s string) string {
-	runes := []rune(s)
-	if len(runes) <= maxAttrRunes {
-		return s
-	}
-	return string(runes[:maxAttrRunes-1]) + "…"
-}
-
-// RedactURL parses raw and returns a redacted, length-capped form safe to use
-// as a span attribute or event value. Userinfo, query, and fragment are
-// dropped because they may carry credentials or other sensitive data. It
-// returns an empty string when raw is empty or cannot be parsed.
-func RedactURL(raw string) string {
-	if raw == "" {
-		return ""
-	}
-
-	parsed, err := url.Parse(raw)
-	if err != nil {
-		return ""
-	}
-
-	parsed.User = nil
-	parsed.RawQuery = ""
-	parsed.ForceQuery = false
-	parsed.Fragment = ""
-	parsed.RawFragment = ""
-
-	return CapAttr(parsed.String())
-}
-
-// MapEnum returns value when it belongs to allowed, otherwise "other". It keeps
-// a span attribute or metric dimension bounded even when an upstream tool
-// introduces a new enum value.
-func MapEnum(value string, allowed ...string) string {
-	if slices.Contains(allowed, value) {
-		return value
-	}
-	return "other"
-}

pkg/gotenberg/attrs_test.go

@@ -1,62 +0,0 @@
-package gotenberg
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestRedactURL(t *testing.T) {
-	for _, tc := range []struct {
-		name string
-		raw  string
-		want string
-	}{
-		{"empty", "", ""},
-		{"strips userinfo query fragment", "https://user:pass@example.com/path?token=secret#frag", "https://example.com/path"},
-		{"keeps host and path", "http://example.com/a/b", "http://example.com/a/b"},
-		{"parse error", "http://example.com/%zz", ""},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			if got := RedactURL(tc.raw); got != tc.want {
-				t.Errorf("RedactURL(%q) = %q, want %q", tc.raw, got, tc.want)
-			}
-		})
-	}
-}
-
-func TestRedactURL_Caps(t *testing.T) {
-	raw := "https://example.com/" + strings.Repeat("a", 400)
-	got := RedactURL(raw)
-	if n := len([]rune(got)); n != maxAttrRunes {
-		t.Errorf("expected capped length %d, got %d", maxAttrRunes, n)
-	}
-}
-
-func TestCapAttr(t *testing.T) {
-	t.Run("short unchanged", func(t *testing.T) {
-		if got := CapAttr("short"); got != "short" {
-			t.Errorf("expected unchanged, got %q", got)
-		}
-	})
-
-	t.Run("multibyte truncated to rune cap", func(t *testing.T) {
-		got := CapAttr(strings.Repeat("é", 400))
-		if n := len([]rune(got)); n != maxAttrRunes {
-			t.Errorf("expected %d runes, got %d", maxAttrRunes, n)
-		}
-		if !strings.HasSuffix(got, "…") {
-			t.Error("expected an ellipsis suffix on a truncated value")
-		}
-	})
-}
-
-func TestMapEnum(t *testing.T) {
-	allowed := []string{"document", "stylesheet", "script"}
-
-	if got := MapEnum("script", allowed...); got != "script" {
-		t.Errorf("expected member passthrough, got %q", got)
-	}
-	if got := MapEnum("websocket", allowed...); got != "other" {
-		t.Errorf("expected non-member to map to other, got %q", got)
-	}
-}

pkg/gotenberg/buildversions.go

@@ -1,50 +0,0 @@
-package gotenberg
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-)
-
-// BuildVersionsDirPathEnvVar names the environment variable holding the
-// absolute path to a directory of build-time version files. The Gotenberg image
-// writes one file per module there, named by module ID and holding the version
-// string of that module's backing binary, captured right after the binary is
-// installed. The running process reads these files instead of executing the
-// binaries, which keeps startup and the first request cheap.
-const BuildVersionsDirPathEnvVar = "GOTENBERG_VERSIONS_DIR_PATH"
-
-// BuildVersion returns the build-time version captured for the module with the
-// given ID. The boolean is false when no version was captured, which is the
-// case for local or non-Docker builds where the directory is absent. A module
-// uses it to avoid spawning its backing binary just to report a version.
-//
-// It is defensive: an unset variable, a missing or unreadable file, or an empty
-// value all yield ("", false), so the caller falls back to detecting the
-// version at runtime. See [BuildVersionsDirPathEnvVar].
-func BuildVersion(moduleID string) (string, bool) {
-	dir := os.Getenv(BuildVersionsDirPathEnvVar)
-	if dir == "" {
-		return "", false
-	}
-
-	// Module IDs are fixed internal constants, never paths. Guard anyway so a
-	// stray separator can't escape the versions directory.
-	if moduleID != filepath.Base(moduleID) {
-		return "", false
-	}
-
-	// The directory comes from a trusted operator-set environment variable,
-	// mirroring how engines exec their env-configured binaries.
-	b, err := os.ReadFile(filepath.Join(dir, moduleID)) //nolint:gosec
-	if err != nil {
-		return "", false
-	}
-
-	version := strings.TrimSpace(string(b))
-	if version == "" {
-		return "", false
-	}
-
-	return version, true
-}

pkg/gotenberg/buildversions_test.go

@@ -1,81 +0,0 @@
-package gotenberg
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestBuildVersion(t *testing.T) {
-	for _, tc := range []struct {
-		scenario  string
-		fileBody  string
-		writeFile bool
-		setEnv    bool
-		moduleID  string
-		wantValue string
-		wantOk    bool
-	}{
-		{
-			scenario:  "version present",
-			fileBody:  "Chromium 146.0",
-			writeFile: true,
-			setEnv:    true,
-			moduleID:  "chromium",
-			wantValue: "Chromium 146.0",
-			wantOk:    true,
-		},
-		{
-			scenario:  "value trimmed",
-			fileBody:  "  qpdf version 11.9.0  \n",
-			writeFile: true,
-			setEnv:    true,
-			moduleID:  "qpdf",
-			wantValue: "qpdf version 11.9.0",
-			wantOk:    true,
-		},
-		{
-			scenario:  "empty file falls back",
-			fileBody:  "   \n",
-			writeFile: true,
-			setEnv:    true,
-			moduleID:  "pdftk",
-			wantValue: "",
-			wantOk:    false,
-		},
-		{
-			scenario:  "missing file falls back",
-			writeFile: false,
-			setEnv:    true,
-			moduleID:  "exiftool",
-			wantValue: "",
-			wantOk:    false,
-		},
-		{
-			scenario:  "env unset falls back",
-			setEnv:    false,
-			moduleID:  "chromium",
-			wantValue: "",
-			wantOk:    false,
-		},
-	} {
-		t.Run(tc.scenario, func(t *testing.T) {
-			if tc.setEnv {
-				dir := t.TempDir()
-				if tc.writeFile {
-					if err := os.WriteFile(filepath.Join(dir, tc.moduleID), []byte(tc.fileBody), 0o600); err != nil {
-						t.Fatalf("write version file: %v", err)
-					}
-				}
-				t.Setenv(BuildVersionsDirPathEnvVar, dir)
-			} else {
-				t.Setenv(BuildVersionsDirPathEnvVar, "")
-			}
-
-			value, ok := BuildVersion(tc.moduleID)
-			if value != tc.wantValue || ok != tc.wantOk {
-				t.Errorf("BuildVersion(%q) = (%q, %t), want (%q, %t)", tc.moduleID, value, ok, tc.wantValue, tc.wantOk)
-			}
-		})
-	}
-}

pkg/gotenberg/cmd.go

@@ -8,14 +8,8 @@ import (
 	"io"
 	"log/slog"
 	"os/exec"
-	"path/filepath"
 	"strings"
 	"syscall"
-
-	"go.opentelemetry.io/otel/attribute"
-	"go.opentelemetry.io/otel/codes"
-	semconv "go.opentelemetry.io/otel/semconv/v1.41.0"
-	"go.opentelemetry.io/otel/trace"
 )
 
 // Cmd wraps an [exec.Cmd].
@@ -61,13 +55,6 @@ func CommandContext(ctx context.Context, logger *slog.Logger, binPath string, ar
 	}, nil
 }
 
-// SetEnv replaces the environment variables passed to the underlying
-// process. When SetEnv is not called, the process inherits the parent's
-// environment.
-func (cmd *Cmd) SetEnv(env []string) {
-	cmd.process.Env = env
-}
-
 // Start starts the command but does not wait for its completion.
 func (cmd *Cmd) Start() error {
 	err := cmd.pipeOutput()
@@ -75,7 +62,7 @@ func (cmd *Cmd) Start() error {
 		return fmt.Errorf("pipe unix process output: %w", err)
 	}
 
-	cmd.logger.DebugContext(context.Background(), fmt.Sprintf("start unix process: %s", strings.Join(cmd.process.Args, " ")))
+	cmd.logger.DebugContext(cmd.ctx, fmt.Sprintf("start unix process: %s", strings.Join(cmd.process.Args, " ")))
 
 	err = cmd.process.Start()
 	if err != nil {
@@ -98,44 +85,11 @@ func (cmd *Cmd) Wait() error {
 
 // Exec executes the command and waits for its completion or until the context
 // is done. In any case, it kills the unix process and all its children.
-//
-// When the context carries an active trace span, Exec records a
-// "process.exec" client span around the execution. It is the single
-// instrumentation point for every short-lived external binary (soffice, pdftk,
-// qpdf, exiftool, pdfcpu). The span is skipped when there is no active parent,
-// so process starts performed off the request path do not emit orphan roots.
 func (cmd *Cmd) Exec() (int, error) {
 	if cmd.ctx == nil {
 		return 10, errors.New("nil context")
 	}
 
-	var span trace.Span
-	if trace.SpanContextFromContext(cmd.ctx).IsValid() {
-		_, span = Tracer().Start(cmd.ctx, "process.exec",
-			trace.WithSpanKind(trace.SpanKindClient),
-			trace.WithAttributes(semconv.ProcessExecutableName(filepath.Base(cmd.process.Path))),
-		)
-		defer span.End()
-	}
-
-	code, err := cmd.exec()
-
-	if span != nil {
-		span.SetAttributes(attribute.Int("process.exit.code", code))
-		if err != nil {
-			span.RecordError(err)
-			span.SetStatus(codes.Error, err.Error())
-			span.SetAttributes(semconv.ErrorTypeKey.String(execErrorType(cmd.ctx)))
-		} else {
-			span.SetStatus(codes.Ok, "")
-		}
-	}
-
-	return code, err
-}
-
-// exec runs the command and returns its exit code and error.
-func (cmd *Cmd) exec() (int, error) {
 	err := cmd.Start()
 	if err != nil {
 		if cmd.process.ProcessState == nil {
@@ -155,7 +109,7 @@ func (cmd *Cmd) exec() (int, error) {
 	case err = <-errChan:
 		errProc := cmd.Kill()
 		if errProc != nil {
-			cmd.logger.ErrorContext(context.Background(), errProc.Error())
+			cmd.logger.ErrorContext(cmd.ctx, errProc.Error())
 		}
 
 		if err == nil {
@@ -170,30 +124,17 @@ func (cmd *Cmd) exec() (int, error) {
 	case <-cmd.ctx.Done():
 		errProc := cmd.Kill()
 		if errProc != nil {
-			cmd.logger.ErrorContext(context.Background(), errProc.Error())
+			cmd.logger.ErrorContext(cmd.ctx, errProc.Error())
 		}
 
 		return 62, fmt.Errorf("context done: %w", cmd.ctx.Err())
 	}
 }
 
-// execErrorType maps an execution failure to a bounded semconv error.type
-// value.
-func execErrorType(ctx context.Context) string {
-	switch {
-	case errors.Is(ctx.Err(), context.DeadlineExceeded):
-		return "context_deadline_exceeded"
-	case errors.Is(ctx.Err(), context.Canceled):
-		return "context_canceled"
-	default:
-		return "process_error"
-	}
-}
-
 // pipeOutput creates logs entries according to the process stdout and stderr.
 // It does nothing if the logging level is not debug.
 func (cmd *Cmd) pipeOutput() error {
-	if !cmd.logger.Enabled(context.Background(), slog.LevelDebug) {
+	if !cmd.logger.Enabled(cmd.ctx, slog.LevelDebug) {
 		return nil
 	}
 
@@ -214,7 +155,7 @@ func (cmd *Cmd) pipeOutput() error {
 		defer func(reader io.ReadCloser) {
 			err := reader.Close()
 			if err != nil && !strings.Contains(err.Error(), "file already closed") {
-				logger.ErrorContext(context.Background(), fmt.Sprintf("close reader: %s", err))
+				logger.ErrorContext(cmd.ctx, fmt.Sprintf("close reader: %s", err))
 			}
 		}(reader)
 
@@ -222,14 +163,14 @@ func (cmd *Cmd) pipeOutput() error {
 			line, _, err := r.ReadLine()
 			if err != nil {
 				if err != io.EOF && !strings.Contains(err.Error(), "file already closed") {
-					logger.ErrorContext(context.Background(), fmt.Sprintf("pipe unix process output error: %s", err))
+					logger.ErrorContext(cmd.ctx, fmt.Sprintf("pipe unix process output error: %s", err))
 				}
 
 				break
 			}
 
 			if len(line) != 0 {
-				logger.DebugContext(context.Background(), string(line))
+				logger.DebugContext(cmd.ctx, string(line))
 			}
 		}
 	}
@@ -253,13 +194,13 @@ func (cmd *Cmd) Kill() error {
 
 	err := syscall.Kill(-cmd.process.Process.Pid, syscall.SIGKILL)
 	if err == nil {
-		cmd.logger.DebugContext(context.Background(), "unix process killed")
+		cmd.logger.DebugContext(cmd.ctx, "unix process killed")
 		return nil
 	}
 
 	// If the process does not exist anymore, the error is irrelevant.
 	if strings.Contains(err.Error(), "no such process") {
-		cmd.logger.DebugContext(context.Background(), "unix process already killed")
+		cmd.logger.DebugContext(cmd.ctx, "unix process already killed")
 		return nil
 	}
 

pkg/gotenberg/cmd_test.go

@@ -1,136 +0,0 @@
-package gotenberg
-
-import (
-	"context"
-	"log/slog"
-	"testing"
-
-	"go.opentelemetry.io/otel"
-	"go.opentelemetry.io/otel/attribute"
-	"go.opentelemetry.io/otel/codes"
-	sdktrace "go.opentelemetry.io/otel/sdk/trace"
-	"go.opentelemetry.io/otel/sdk/trace/tracetest"
-)
-
-func newTestSpanRecorder(t *testing.T) *tracetest.SpanRecorder {
-	t.Helper()
-	recorder := tracetest.NewSpanRecorder()
-	provider := sdktrace.NewTracerProvider(sdktrace.WithSpanProcessor(recorder))
-	previous := otel.GetTracerProvider()
-	otel.SetTracerProvider(provider)
-	t.Cleanup(func() { otel.SetTracerProvider(previous) })
-	return recorder
-}
-
-func findSpan(recorder *tracetest.SpanRecorder, name string) sdktrace.ReadOnlySpan {
-	for _, s := range recorder.Ended() {
-		if s.Name() == name {
-			return s
-		}
-	}
-	return nil
-}
-
-func spanAttr(span sdktrace.ReadOnlySpan, key string) (attribute.Value, bool) {
-	for _, kv := range span.Attributes() {
-		if string(kv.Key) == key {
-			return kv.Value, true
-		}
-	}
-	return attribute.Value{}, false
-}
-
-func TestCmd_Exec_NilContext(t *testing.T) {
-	cmd := Command(slog.New(slog.DiscardHandler), "true")
-
-	code, err := cmd.Exec()
-	if err == nil {
-		t.Error("expected an error for a nil context")
-	}
-	if code != 10 {
-		t.Errorf("expected code 10, got %d", code)
-	}
-}
-
-func TestCmd_Exec_NoParentSpanProducesNoSpan(t *testing.T) {
-	recorder := newTestSpanRecorder(t)
-
-	cmd, err := CommandContext(context.Background(), slog.New(slog.DiscardHandler), "sh", "-c", "exit 0")
-	if err != nil {
-		t.Fatalf("create command: %v", err)
-	}
-
-	code, err := cmd.Exec()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if code != 0 {
-		t.Errorf("expected code 0, got %d", code)
-	}
-	if n := len(recorder.Ended()); n != 0 {
-		t.Errorf("expected no span without an active parent, got %d", n)
-	}
-}
-
-func TestCmd_Exec_RecordsSpanOnSuccess(t *testing.T) {
-	recorder := newTestSpanRecorder(t)
-
-	ctx, parent := otel.Tracer("test").Start(context.Background(), "parent")
-	cmd, err := CommandContext(ctx, slog.New(slog.DiscardHandler), "sh", "-c", "exit 0")
-	if err != nil {
-		t.Fatalf("create command: %v", err)
-	}
-
-	code, err := cmd.Exec()
-	parent.End()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if code != 0 {
-		t.Errorf("expected code 0, got %d", code)
-	}
-
-	span := findSpan(recorder, "process.exec")
-	if span == nil {
-		t.Fatal("expected a process.exec span to be recorded")
-	}
-	if span.Status().Code != codes.Ok {
-		t.Errorf("expected status Ok, got %v", span.Status().Code)
-	}
-	if name, ok := spanAttr(span, "process.executable.name"); !ok || name.AsString() != "sh" {
-		t.Errorf("expected process.executable.name=sh, got %q (present=%t)", name.AsString(), ok)
-	}
-	if exit, ok := spanAttr(span, "process.exit.code"); !ok || exit.AsInt64() != 0 {
-		t.Errorf("expected process.exit.code=0, got %d (present=%t)", exit.AsInt64(), ok)
-	}
-}
-
-func TestCmd_Exec_RecordsSpanOnError(t *testing.T) {
-	recorder := newTestSpanRecorder(t)
-
-	ctx, parent := otel.Tracer("test").Start(context.Background(), "parent")
-	cmd, err := CommandContext(ctx, slog.New(slog.DiscardHandler), "sh", "-c", "exit 3")
-	if err != nil {
-		t.Fatalf("create command: %v", err)
-	}
-
-	code, err := cmd.Exec()
-	parent.End()
-	if err == nil {
-		t.Error("expected an error for a non-zero exit code")
-	}
-	if code != 3 {
-		t.Errorf("expected exit code 3, got %d", code)
-	}
-
-	span := findSpan(recorder, "process.exec")
-	if span == nil {
-		t.Fatal("expected a process.exec span to be recorded")
-	}
-	if span.Status().Code != codes.Error {
-		t.Errorf("expected status Error, got %v", span.Status().Code)
-	}
-	if et, ok := spanAttr(span, "error.type"); !ok || et.AsString() != "process_error" {
-		t.Errorf("expected error.type=process_error, got %q (present=%t)", et.AsString(), ok)
-	}
-}

pkg/gotenberg/doc.go

@@ -1,7 +1,7 @@
-// Package gotenberg implements the core module system.
+// Package gotenberg provides most of the logic of the module system.
 //
-// Significantly inspired by caddyserver/caddy, licensed under the Apache
-// License 2.0.
+// caddyserver/caddy, licensed under the Apache License 2.0, has significantly
+// inspired this module system.
 //
-// See https://caddyserver.com/.
+// More details are available on https://caddyserver.com/.
 package gotenberg

pkg/gotenberg/errortype.go

@@ -1,52 +0,0 @@
-package gotenberg
-
-import (
-	"context"
-	"errors"
-
-	semconv "go.opentelemetry.io/otel/semconv/v1.41.0"
-	"go.opentelemetry.io/otel/trace"
-)
-
-// Engine-agnostic, low-cardinality error.type values shared by the conversion
-// engines. They are safe to use both as the semconv error.type span attribute
-// and as bounded metric label values.
-const (
-	ErrorTypeTimeout           = "timeout"
-	ErrorTypeContextCancelled  = "context_cancelled"
-	ErrorTypeQueueSizeExceeded = "queue_size_exceeded"
-	ErrorTypeProcessRestarting = "process_restarting"
-	ErrorTypeInvalidInput      = "invalid_input"
-	ErrorTypeUnknown           = "unknown"
-)
-
-// ClassifyError maps err to a bounded, engine-agnostic error.type value. It
-// recognizes the failure modes shared by every engine: deadline, cancellation,
-// queue saturation, and process restart. It returns an empty string for a nil
-// error and [ErrorTypeUnknown] for anything it does not recognize, leaving
-// engine-specific refinement (such as [ErrorTypeInvalidInput]) to the caller.
-func ClassifyError(err error) string {
-	switch {
-	case err == nil:
-		return ""
-	case errors.Is(err, context.DeadlineExceeded):
-		return ErrorTypeTimeout
-	case errors.Is(err, context.Canceled):
-		return ErrorTypeContextCancelled
-	case errors.Is(err, ErrMaximumQueueSizeExceeded):
-		return ErrorTypeQueueSizeExceeded
-	case errors.Is(err, ErrProcessAlreadyRestarting):
-		return ErrorTypeProcessRestarting
-	default:
-		return ErrorTypeUnknown
-	}
-}
-
-// SpanErrorType records errorType as the semconv error.type attribute on span.
-// It is a no-op when errorType is empty.
-func SpanErrorType(span trace.Span, errorType string) {
-	if errorType == "" {
-		return
-	}
-	span.SetAttributes(semconv.ErrorTypeKey.String(errorType))
-}

pkg/gotenberg/errortype_test.go

@@ -1,60 +0,0 @@
-package gotenberg
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"testing"
-
-	"go.opentelemetry.io/otel"
-)
-
-func TestClassifyError(t *testing.T) {
-	for _, tc := range []struct {
-		name string
-		err  error
-		want string
-	}{
-		{"nil", nil, ""},
-		{"deadline", context.DeadlineExceeded, ErrorTypeTimeout},
-		{"canceled", context.Canceled, ErrorTypeContextCancelled},
-		{"queue size exceeded", ErrMaximumQueueSizeExceeded, ErrorTypeQueueSizeExceeded},
-		{"process restarting", ErrProcessAlreadyRestarting, ErrorTypeProcessRestarting},
-		{"wrapped deadline", fmt.Errorf("convert: %w", context.DeadlineExceeded), ErrorTypeTimeout},
-		{"joined queue", errors.Join(errors.New("attempt"), ErrMaximumQueueSizeExceeded), ErrorTypeQueueSizeExceeded},
-		{"arbitrary", errors.New("boom"), ErrorTypeUnknown},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			if got := ClassifyError(tc.err); got != tc.want {
-				t.Errorf("ClassifyError(%v) = %q, want %q", tc.err, got, tc.want)
-			}
-		})
-	}
-}
-
-func TestSpanErrorType(t *testing.T) {
-	recorder := newTestSpanRecorder(t)
-
-	_, span := otel.Tracer("test").Start(context.Background(), "engine.Op")
-	SpanErrorType(span, "")               // no-op, must not add an attribute
-	SpanErrorType(span, ErrorTypeTimeout) // sets error.type
-	span.End()
-
-	got := findSpan(recorder, "engine.Op")
-	if got == nil {
-		t.Fatal("expected the span to be recorded")
-	}
-
-	count := 0
-	for _, kv := range got.Attributes() {
-		if string(kv.Key) == "error.type" {
-			count++
-			if kv.Value.AsString() != ErrorTypeTimeout {
-				t.Errorf("expected error.type=%q, got %q", ErrorTypeTimeout, kv.Value.AsString())
-			}
-		}
-	}
-	if count != 1 {
-		t.Errorf("expected exactly one error.type attribute, got %d", count)
-	}
-}

pkg/gotenberg/filter.go

@@ -12,57 +12,40 @@ import (
 // ErrFiltered happens if a value is filtered by the [FilterDeadline] function.
 var ErrFiltered = errors.New("value filtered")
 
-// FilterDeadline checks if the given value is allowed and not denied according
-// to regex patterns. The allowed list uses OR semantics (value must match at
-// least one pattern). The denied list uses OR semantics (value is denied if it
-// matches any pattern). It returns a [context.DeadlineExceeded] if it takes
-// too long to process.
-func FilterDeadline(allowed, denied []*regexp2.Regexp, s string, deadline time.Time) error {
-	if len(allowed) > 0 {
-		matched := false
+// FilterDeadline checks if given value is allowed and not denied according to
+// regex patterns. It returns a [context.DeadlineExceeded] if it takes too long
+// to process.
+func FilterDeadline(allowed, denied *regexp2.Regexp, s string, deadline time.Time) error {
+	// FIXME: not ideal to compile everytime, but is there another way to create a clone?
+	if allowed.String() != "" {
+		allow := regexp2.MustCompile(allowed.String(), 0)
+		allow.MatchTimeout = time.Until(deadline)
 
-		for _, pattern := range allowed {
-			// FIXME: not ideal to compile everytime, but is there another way to create a clone?
-			clone := regexp2.MustCompile(pattern.String(), 0)
-			clone.MatchTimeout = time.Until(deadline)
-
-			ok, err := clone.MatchString(s)
-			if err != nil {
-				if time.Now().After(deadline) {
-					return context.DeadlineExceeded
-				}
-
-				return fmt.Errorf("'%s' cannot handle '%s': %w", clone.String(), s, err)
-			}
-
-			if ok {
-				matched = true
-				break
+		ok, err := allow.MatchString(s)
+		if err != nil {
+			if time.Now().After(deadline) {
+				return context.DeadlineExceeded
 			}
+			return fmt.Errorf("'%s' cannot handle '%s': %w", allow.String(), s, err)
 		}
-
-		if !matched {
-			return fmt.Errorf("'%s' does not match any expression from the allowed list: %w", s, ErrFiltered)
+		if !ok {
+			return fmt.Errorf("'%s' does not match the expression from the allowed list: %w", s, ErrFiltered)
 		}
 	}
 
-	if len(denied) > 0 {
-		for _, pattern := range denied {
-			clone := regexp2.MustCompile(pattern.String(), 0)
-			clone.MatchTimeout = time.Until(deadline)
+	if denied.String() != "" {
+		deny := regexp2.MustCompile(denied.String(), 0)
+		deny.MatchTimeout = time.Until(deadline)
 
-			ok, err := clone.MatchString(s)
-			if err != nil {
-				if time.Now().After(deadline) {
-					return context.DeadlineExceeded
-				}
-
-				return fmt.Errorf("'%s' cannot handle '%s': %w", clone.String(), s, err)
-			}
-
-			if ok {
-				return fmt.Errorf("'%s' matches the expression from the denied list: %w", s, ErrFiltered)
+		ok, err := deny.MatchString(s)
+		if err != nil {
+			if time.Now().After(deadline) {
+				return context.DeadlineExceeded
 			}
+			return fmt.Errorf("'%s' cannot handle '%s': %w", deny.String(), s, err)
+		}
+		if ok {
+			return fmt.Errorf("'%s' matches the expression from the denied list: %w", s, ErrFiltered)
 		}
 	}
 

pkg/gotenberg/filter_test.go

@@ -12,8 +12,8 @@ import (
 func TestFilterDeadline(t *testing.T) {
 	for _, tc := range []struct {
 		scenario      string
-		allowed       []*regexp2.Regexp
-		denied        []*regexp2.Regexp
+		allowed       *regexp2.Regexp
+		denied        *regexp2.Regexp
 		s             string
 		deadline      time.Time
 		expectError   bool
@@ -21,17 +21,17 @@ func TestFilterDeadline(t *testing.T) {
 	}{
 		{
 			scenario:      "DeadlineExceeded (allowed)",
-			allowed:       []*regexp2.Regexp{regexp2.MustCompile("foo", 0)},
-			denied:        nil,
+			allowed:       regexp2.MustCompile("foo", 0),
+			denied:        regexp2.MustCompile("", 0),
 			s:             "foo",
 			deadline:      time.Now().Add(time.Duration(-1) * time.Hour),
 			expectError:   true,
 			expectedError: context.DeadlineExceeded,
 		},
 		{
-			scenario:      "ErrFiltered (allowed, no match)",
-			allowed:       []*regexp2.Regexp{regexp2.MustCompile("foo", 0)},
-			denied:        nil,
+			scenario:      "ErrFiltered (allowed)",
+			allowed:       regexp2.MustCompile("foo", 0),
+			denied:        regexp2.MustCompile("", 0),
 			s:             "bar",
 			deadline:      time.Now().Add(time.Duration(5) * time.Second),
 			expectError:   true,
@@ -39,8 +39,8 @@ func TestFilterDeadline(t *testing.T) {
 		},
 		{
 			scenario:      "DeadlineExceeded (denied)",
-			allowed:       nil,
-			denied:        []*regexp2.Regexp{regexp2.MustCompile("foo", 0)},
+			allowed:       regexp2.MustCompile("", 0),
+			denied:        regexp2.MustCompile("foo", 0),
 			s:             "foo",
 			deadline:      time.Now().Add(time.Duration(-1) * time.Hour),
 			expectError:   true,
@@ -48,55 +48,21 @@ func TestFilterDeadline(t *testing.T) {
 		},
 		{
 			scenario:      "ErrFiltered (denied)",
-			allowed:       nil,
-			denied:        []*regexp2.Regexp{regexp2.MustCompile("foo", 0)},
+			allowed:       regexp2.MustCompile("", 0),
+			denied:        regexp2.MustCompile("foo", 0),
 			s:             "foo",
 			deadline:      time.Now().Add(time.Duration(5) * time.Second),
 			expectError:   true,
 			expectedError: ErrFiltered,
 		},
 		{
-			scenario:    "success (empty lists)",
-			allowed:     nil,
-			denied:      nil,
+			scenario:    "success",
+			allowed:     regexp2.MustCompile("", 0),
+			denied:      regexp2.MustCompile("", 0),
 			s:           "foo",
 			deadline:    time.Now().Add(time.Duration(5) * time.Second),
 			expectError: false,
 		},
-		{
-			scenario:    "multi-pattern allow list, second matches",
-			allowed:     []*regexp2.Regexp{regexp2.MustCompile("^https://", 0), regexp2.MustCompile("^file:///tmp/", 0)},
-			denied:      nil,
-			s:           "file:///tmp/abc/index.html",
-			deadline:    time.Now().Add(time.Duration(5) * time.Second),
-			expectError: false,
-		},
-		{
-			scenario:      "multi-pattern allow list, none matches",
-			allowed:       []*regexp2.Regexp{regexp2.MustCompile("^https://", 0), regexp2.MustCompile("^ftp://", 0)},
-			denied:        nil,
-			s:             "file:///tmp/abc/index.html",
-			deadline:      time.Now().Add(time.Duration(5) * time.Second),
-			expectError:   true,
-			expectedError: ErrFiltered,
-		},
-		{
-			scenario:      "multi-pattern deny list, second matches",
-			allowed:       nil,
-			denied:        []*regexp2.Regexp{regexp2.MustCompile("^ftp://", 0), regexp2.MustCompile("^file:.*", 0)},
-			s:             "file:///etc/passwd",
-			deadline:      time.Now().Add(time.Duration(5) * time.Second),
-			expectError:   true,
-			expectedError: ErrFiltered,
-		},
-		{
-			scenario:    "https URL passes deny list targeting file://",
-			allowed:     nil,
-			denied:      []*regexp2.Regexp{regexp2.MustCompile("^file:.*", 0)},
-			s:           "https://example.com",
-			deadline:    time.Now().Add(time.Duration(5) * time.Second),
-			expectError: false,
-		},
 	} {
 		t.Run(tc.scenario, func(t *testing.T) {
 			err := FilterDeadline(tc.allowed, tc.denied, tc.s, tc.deadline)

pkg/gotenberg/flags.go

@@ -222,32 +222,3 @@ func (f *ParsedFlags) MustDeprecatedRegexp(deprecated string, newName string) *r
 
 	return f.MustRegexp(newName)
 }
-
-// MustRegexpSlice returns a slice of compiled regular expressions from a
-// string-slice flag given by name. Empty strings are skipped.
-// It panics if an error occurs.
-func (f *ParsedFlags) MustRegexpSlice(name string) []*regexp2.Regexp {
-	vals := f.MustStringSlice(name)
-
-	var regexps []*regexp2.Regexp
-	for _, val := range vals {
-		if val == "" {
-			continue
-		}
-
-		regexps = append(regexps, regexp2.MustCompile(val, 0))
-	}
-
-	return regexps
-}
-
-// MustDeprecatedRegexpSlice returns the slice of compiled regular expressions
-// of a deprecated flag if it was explicitly set or the slice of the new flag.
-// It panics if an error occurs.
-func (f *ParsedFlags) MustDeprecatedRegexpSlice(deprecated string, newName string) []*regexp2.Regexp {
-	if f.Changed(deprecated) {
-		return f.MustRegexpSlice(deprecated)
-	}
-
-	return f.MustRegexpSlice(newName)
-}

pkg/gotenberg/flags_test.go

@@ -6,7 +6,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/dlclark/regexp2"
 	flag "github.com/spf13/pflag"
 )
 
@@ -834,120 +833,3 @@ func TestParsedFlags_MustDeprecatedRegexp(t *testing.T) {
 		})
 	}
 }
-
-func TestParsedFlags_MustRegexpSlice(t *testing.T) {
-	fs := flag.NewFlagSet("tests", flag.ContinueOnError)
-	fs.StringSlice("foo", []string{}, "")
-
-	err := fs.Parse([]string{"--foo=^file:.*", "--foo=^ftp://.*"})
-	if err != nil {
-		t.Fatalf("expected no error but got: %v", err)
-	}
-
-	parsedFlags := ParsedFlags{FlagSet: fs}
-
-	for _, tc := range []struct {
-		scenario    string
-		name        string
-		expectPanic bool
-		expectLen   int
-	}{
-		{
-			scenario:    "success with multiple patterns",
-			name:        "foo",
-			expectPanic: false,
-			expectLen:   2,
-		},
-		{
-			scenario:    "non-existing flag",
-			name:        "bar",
-			expectPanic: true,
-		},
-	} {
-		t.Run(tc.scenario, func(t *testing.T) {
-			if tc.expectPanic {
-				defer func() {
-					if r := recover(); r == nil {
-						t.Fatal("expected panic but got none")
-					}
-				}()
-			}
-
-			if !tc.expectPanic {
-				defer func() {
-					if r := recover(); r != nil {
-						t.Fatalf("expected no panic but got: %v", r)
-					}
-				}()
-			}
-
-			result := parsedFlags.MustRegexpSlice(tc.name)
-
-			if !tc.expectPanic && len(result) != tc.expectLen {
-				t.Errorf("expected %d regexps but got %d", tc.expectLen, len(result))
-			}
-		})
-	}
-
-	// Test empty strings are skipped.
-	fs2 := flag.NewFlagSet("tests2", flag.ContinueOnError)
-	fs2.StringSlice("baz", []string{""}, "")
-
-	err = fs2.Parse([]string{})
-	if err != nil {
-		t.Fatalf("expected no error but got: %v", err)
-	}
-
-	parsedFlags2 := ParsedFlags{FlagSet: fs2}
-	result := parsedFlags2.MustRegexpSlice("baz")
-	if len(result) != 0 {
-		t.Errorf("expected 0 regexps for empty strings but got %d", len(result))
-	}
-}
-
-func TestParsedFlags_MustDeprecatedRegexpSlice(t *testing.T) {
-	for _, tc := range []struct {
-		scenario      string
-		rawFlags      []string
-		expectPattern string
-	}{
-		{
-			scenario:      "deprecated flag value",
-			rawFlags:      []string{"--foo=^file:.*"},
-			expectPattern: "^file:.*",
-		},
-		{
-			scenario:      "non-deprecated flag value",
-			rawFlags:      []string{"--bar=^ftp://.*"},
-			expectPattern: "^ftp://.*",
-		},
-		{
-			scenario:      "deprecated flag value > non-deprecated flag value",
-			rawFlags:      []string{"--foo=^file:.*", "--bar=^ftp://.*"},
-			expectPattern: "^file:.*",
-		},
-	} {
-		t.Run(tc.scenario, func(t *testing.T) {
-			fs := flag.NewFlagSet("tests", flag.ContinueOnError)
-			fs.StringSlice("foo", []string{}, "")
-			fs.StringSlice("bar", []string{}, "")
-
-			parsedFlags := ParsedFlags{FlagSet: fs}
-
-			err := parsedFlags.Parse(tc.rawFlags)
-			if err != nil {
-				t.Fatalf("expected no error but got: %v", err)
-			}
-
-			actual := parsedFlags.MustDeprecatedRegexpSlice("foo", "bar")
-			if len(actual) != 1 {
-				t.Fatalf("expected 1 regexp but got %d", len(actual))
-			}
-			if actual[0].String() != tc.expectPattern {
-				t.Errorf("expected pattern '%s' but got '%s'", tc.expectPattern, actual[0].String())
-			}
-		})
-	}
-
-	_ = regexp2.None // Keep import alive.
-}

pkg/gotenberg/gc.go

@@ -38,7 +38,7 @@ func GarbageCollect(ctx context.Context, logger *slog.Logger, rootPath string, i
 
 		for _, substr := range includeSubstr {
 			if (strings.Contains(info.Name(), substr) || path == substr) && info.ModTime().Before(expirationTime) {
-				err := os.RemoveAll(path) //nolint:gosec // G122: rootPath is a trusted internal working directory
+				err := os.RemoveAll(path)
 				if err != nil {
 					return fmt.Errorf("garbage collect '%s': %w", path, err)
 				}

pkg/gotenberg/gc_test.go

@@ -67,7 +67,7 @@ func TestGarbageCollect(t *testing.T) {
 				}
 			}()
 
-			err := GarbageCollect(context.Background(), slog.New(slog.DiscardHandler), tc.rootPath, tc.includeSubstr, time.Now())
+			err := GarbageCollect(context.Background(), slog.New(slog.NewJSONHandler(os.Stdout, nil)), tc.rootPath, tc.includeSubstr, time.Now())
 
 			if !tc.expectError && err != nil {
 				t.Fatalf("expected no error but got: %v", err)

pkg/gotenberg/internal/log/stdhandler.go

@@ -50,12 +50,7 @@ func (h traceContextHandler) WithGroup(name string) slog.Handler {
 }
 
 // NewStdHandler returns a [slog.Handler] instance for the standard output.
-// upperLevelCase is the value of the level-case setting that keeps the level
-// field uppercase in the standard output. It mirrors gotenberg.UpperLevelCase,
-// duplicated here because the internal log package cannot import gotenberg.
-const upperLevelCase = "upper"
-
-func NewStdHandler(level slog.Level, format string, fieldsPrefix string, enableGcpFields bool, levelCase string) (slog.Handler, error) {
+func NewStdHandler(level slog.Level, format string, fieldsPrefix string, enableGcpFields bool) (slog.Handler, error) {
 	// #nosec: G115
 	isTerminal := term.IsTerminal(int(os.Stdout.Fd()))
 
@@ -76,22 +71,17 @@ func NewStdHandler(level slog.Level, format string, fieldsPrefix string, enableG
 		// Configure level encoding based on format and GCP settings.
 		if a.Key == slog.LevelKey {
 			l := a.Value.Any().(slog.Level)
-			switch {
-			case format == textLoggingFormat && isTerminal:
+			if format == textLoggingFormat && isTerminal {
 				if enableGcpFields {
 					a.Value = slog.StringValue(gcpSeverityColorEncoder(l))
 				} else {
 					a.Value = slog.StringValue(levelToColor(l).Add(l.String()))
 				}
-			case enableGcpFields && format != textLoggingFormat:
+			} else if enableGcpFields && format != textLoggingFormat {
 				a.Key = "severity"
 				a.Value = slog.StringValue(gcpSeverity(l))
-			default:
-				if levelCase == upperLevelCase {
-					a.Value = slog.StringValue(l.String())
-				} else {
-					a.Value = slog.StringValue(strings.ToLower(l.String()))
-				}
+			} else {
+				a.Value = slog.StringValue(strings.ToLower(l.String()))
 			}
 		}
 

pkg/gotenberg/internal/log/stdhandler_test.go

@@ -1,53 +0,0 @@
-package log
-
-import (
-	"encoding/json"
-	"io"
-	"log/slog"
-	"os"
-	"testing"
-)
-
-func TestNewStdHandler_LevelCase(t *testing.T) {
-	for _, tc := range []struct {
-		name      string
-		levelCase string
-		want      string
-	}{
-		{"lower is the default behavior", "lower", "info"},
-		{"upper keeps slog casing", "upper", "INFO"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			original := os.Stderr
-			reader, writer, err := os.Pipe()
-			if err != nil {
-				t.Fatalf("create pipe: %v", err)
-			}
-			os.Stderr = writer
-			defer func() { os.Stderr = original }()
-
-			handler, err := NewStdHandler(slog.LevelInfo, "json", "", false, tc.levelCase)
-			if err != nil {
-				t.Fatalf("create handler: %v", err)
-			}
-
-			slog.New(handler).Info("hello")
-
-			if err := writer.Close(); err != nil {
-				t.Fatalf("close writer: %v", err)
-			}
-			out, err := io.ReadAll(reader)
-			if err != nil {
-				t.Fatalf("read output: %v", err)
-			}
-
-			var record map[string]any
-			if err := json.Unmarshal(out, &record); err != nil {
-				t.Fatalf("parse log line %q: %v", out, err)
-			}
-			if record["level"] != tc.want {
-				t.Errorf("level = %v, want %v", record["level"], tc.want)
-			}
-		})
-	}
-}

pkg/gotenberg/internal/otel/doc.go

@@ -1,24 +1,8 @@
 // Package otel gathers initialization utilities for OpenTelemetry
 // instrumentation.
 //
-// Significantly inspired by https://github.com/lucavallin/gotel.
+// This package has been significantly inspired by
+// https://github.com/lucavallin/gotel.
 //
-// # Sampling
-//
-// No sampler is configured in code, so the SDK default applies:
-// parentbased_always_on. Every trace is recorded and exported. Operators tune
-// sampling through the standard environment variables, honored by the SDK:
-//
-//	OTEL_TRACES_SAMPLER       e.g. parentbased_traceidratio, always_off
-//	OTEL_TRACES_SAMPLER_ARG   e.g. 0.1 for a 10% ratio
-//
-// Head sampling drops whole traces up front, including the rare slow or failed
-// conversions that matter most for diagnosis. For high-throughput deployments,
-// prefer keeping head sampling permissive and applying tail sampling in the
-// collector (sample on error or high latency), which decides after a trace
-// completes. Gotenberg emits trace-based metric exemplars, so the conversion
-// histograms still link to representative traces regardless of the head
-// sampling ratio.
-//
-// See https://opentelemetry.io/.
+// See: https://opentelemetry.io/.
 package otel

pkg/gotenberg/internal/otel/otel.go

@@ -14,73 +14,33 @@ import (
 	"go.opentelemetry.io/otel/propagation"
 	"go.opentelemetry.io/otel/sdk/log"
 	"go.opentelemetry.io/otel/sdk/metric"
-	"go.opentelemetry.io/otel/sdk/metric/exemplar"
 	"go.opentelemetry.io/otel/sdk/resource"
 	"go.opentelemetry.io/otel/sdk/trace"
-	semconv "go.opentelemetry.io/otel/semconv/v1.43.0"
+	semconv "go.opentelemetry.io/otel/semconv/v1.40.0"
 )
 
-// buildResource assembles the OpenTelemetry resource shared by the tracer,
-// meter, and logger providers. Detection is best-effort: a detector or merge
-// failure is logged and the build proceeds with whatever was gathered, so a
-// flaky environment never prevents telemetry from starting.
-//
-// The semconv version imported here must match the one the SDK resource
-// detectors use (go.opentelemetry.io/otel/sdk/resource). Drift makes
-// [resource.Merge] fail with [resource.ErrSchemaURLConflict] and strips the
-// schema URL off every exported signal.
-func buildResource(ctx context.Context, logger *slog.Logger, serviceName, serviceVersion string) *resource.Resource {
-	base := resource.NewWithAttributes(
-		semconv.SchemaURL,
-		semconv.ServiceName(serviceName),
-		semconv.ServiceVersion(serviceVersion),
-	)
-
-	// Granular detectors only. The WithProcess() bundle is deliberately omitted
-	// because it adds process.command_args/process.command_line, which can carry
-	// proxy credentials and host-resolver rules passed on the command line.
-	detected, err := resource.New(ctx,
-		resource.WithFromEnv(),
-		resource.WithTelemetrySDK(),
-		resource.WithHost(),
-		resource.WithHostID(),
-		resource.WithOS(),
-		resource.WithContainer(),
-		resource.WithProcessPID(),
-		resource.WithProcessExecutableName(),
-		resource.WithProcessExecutablePath(),
-		resource.WithProcessRuntimeName(),
-		resource.WithProcessRuntimeVersion(),
-		resource.WithProcessRuntimeDescription(),
-	)
-	if err != nil {
-		logger.WarnContext(ctx, fmt.Sprintf("partially detect OpenTelemetry resource: %s", err))
-	}
-	if detected == nil {
-		return base
-	}
-
-	// A schema URL conflict still yields a resource holding every attribute, only
-	// without a schema URL. Keep it: falling back to base would drop the host,
-	// OS, container, process, and OTEL_RESOURCE_ATTRIBUTES data.
-	merged, err := resource.Merge(detected, base)
-	if err != nil {
-		logger.WarnContext(ctx, fmt.Sprintf("merge OpenTelemetry resource: %s", err))
-	}
-	if merged == nil {
-		return base
-	}
-
-	return merged
-}
-
 // InitTracerProvider initializes the OpenTelemetry tracer provider.
 func InitTracerProvider(logger *slog.Logger, serviceName, serviceVersion string) (shutdown func(context.Context) error, err error) {
 	initOtelLogger(logger)
 
 	ctx := context.Background()
+	hostname, err := os.Hostname()
+	if err != nil {
+		return nil, fmt.Errorf("get hostname: %w", err)
+	}
 
-	res := buildResource(ctx, logger, serviceName, serviceVersion)
+	res, err := resource.Merge(
+		resource.Default(),
+		resource.NewWithAttributes(
+			semconv.SchemaURL,
+			semconv.ServiceName(serviceName),
+			semconv.ServiceVersion(serviceVersion),
+			semconv.HostName(hostname),
+		),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("merge resource: %w", err)
+	}
 
 	traceOpts := []trace.TracerProviderOption{
 		trace.WithResource(res),
@@ -111,13 +71,27 @@ func InitMeterProvider(logger *slog.Logger, serviceName, serviceVersion string)
 	initOtelLogger(logger)
 
 	ctx := context.Background()
+	hostname, err := os.Hostname()
+	if err != nil {
+		return nil, fmt.Errorf("get hostname: %w", err)
+	}
 
-	res := buildResource(ctx, logger, serviceName, serviceVersion)
+	res, err := resource.Merge(
+		resource.Default(),
+		resource.NewWithAttributes(
+			semconv.SchemaURL,
+			semconv.ServiceName(serviceName),
+			semconv.ServiceVersion(serviceVersion),
+			semconv.HostName(hostname),
+		),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("merge resource: %w", err)
+	}
 
 	metricOpts := []metric.Option{
 		metric.WithResource(res),
 	}
-	metricOpts = append(metricOpts, exemplarFilterOptions()...)
 
 	metricReader, err := autoexport.NewMetricReader(ctx)
 	if err != nil {
@@ -134,24 +108,28 @@ func InitMeterProvider(logger *slog.Logger, serviceName, serviceVersion string)
 	return meterProvider.Shutdown, nil
 }
 
-// exemplarFilterOptions returns the meter provider options that pin trace-based
-// exemplars, so the histograms expose the trace id of a representative
-// measurement. It yields no option when the operator selects a filter via
-// OTEL_METRICS_EXEMPLAR_FILTER, letting the SDK's own env handling win.
-func exemplarFilterOptions() []metric.Option {
-	if _, ok := os.LookupEnv("OTEL_METRICS_EXEMPLAR_FILTER"); ok {
-		return nil
-	}
-	return []metric.Option{metric.WithExemplarFilter(exemplar.TraceBasedFilter)}
-}
-
 // InitLoggerProvider initializes the OpenTelemetry logger provider.
 func InitLoggerProvider(logger *slog.Logger, serviceName, serviceVersion string) (shutdown func(context.Context) error, handler slog.Handler, err error) {
 	initOtelLogger(logger)
 
 	ctx := context.Background()
+	hostname, err := os.Hostname()
+	if err != nil {
+		return nil, nil, fmt.Errorf("get hostname: %w", err)
+	}
 
-	res := buildResource(ctx, logger, serviceName, serviceVersion)
+	res, err := resource.Merge(
+		resource.Default(),
+		resource.NewWithAttributes(
+			semconv.SchemaURL,
+			semconv.ServiceName(serviceName),
+			semconv.ServiceVersion(serviceVersion),
+			semconv.HostName(hostname),
+		),
+	)
+	if err != nil {
+		return nil, nil, fmt.Errorf("merge resource: %w", err)
+	}
 
 	logOpts := []log.LoggerProviderOption{
 		log.WithResource(res),

pkg/gotenberg/internal/otel/otel_test.go

@@ -1,158 +0,0 @@
-package otel
-
-import (
-	"context"
-	"log/slog"
-	"os"
-	"testing"
-
-	"go.opentelemetry.io/otel"
-	sdkmetric "go.opentelemetry.io/otel/sdk/metric"
-	"go.opentelemetry.io/otel/sdk/metric/exemplar"
-	"go.opentelemetry.io/otel/sdk/metric/metricdata"
-	sdktrace "go.opentelemetry.io/otel/sdk/trace"
-	semconv "go.opentelemetry.io/otel/semconv/v1.43.0"
-)
-
-func TestBuildResource(t *testing.T) {
-	res := buildResource(context.Background(), slog.New(slog.DiscardHandler), "gotenberg", "v8.0.0")
-
-	got := map[string]struct{}{}
-	values := map[string]string{}
-	for _, kv := range res.Attributes() {
-		got[string(kv.Key)] = struct{}{}
-		values[string(kv.Key)] = kv.Value.AsString()
-	}
-
-	// Guards the semconv version pinned in buildResource against the one the SDK
-	// resource detectors use. Drift makes resource.Merge conflict and drops the
-	// schema URL from every exported signal.
-	if res.SchemaURL() != semconv.SchemaURL {
-		t.Errorf("resource schema URL = %q, want %q", res.SchemaURL(), semconv.SchemaURL)
-	}
-
-	if values[string(semconv.ServiceNameKey)] != "gotenberg" {
-		t.Errorf("service.name = %q, want %q", values[string(semconv.ServiceNameKey)], "gotenberg")
-	}
-	if values[string(semconv.ServiceVersionKey)] != "v8.0.0" {
-		t.Errorf("service.version = %q, want %q", values[string(semconv.ServiceVersionKey)], "v8.0.0")
-	}
-
-	for _, key := range []string{
-		string(semconv.HostNameKey),
-		string(semconv.OSTypeKey),
-		string(semconv.ProcessRuntimeNameKey),
-	} {
-		if _, ok := got[key]; !ok {
-			t.Errorf("expected resource attribute %q to be present", key)
-		}
-	}
-
-	// The command-line bundle must never be detected (it can leak credentials).
-	for _, key := range []string{"process.command_args", "process.command_line"} {
-		if _, ok := got[key]; ok {
-			t.Errorf("did not expect sensitive resource attribute %q", key)
-		}
-	}
-}
-
-// TestInitTracerProvider_HonorsSamplerEnv guards the contract that the tracer
-// provider keeps honoring OTEL_TRACES_SAMPLER. The SDK reads it only when no
-// explicit sampler is configured, so any future WithSampler() would silently
-// break operator-side sampling control.
-func TestInitTracerProvider_HonorsSamplerEnv(t *testing.T) {
-	for _, tc := range []struct {
-		name        string
-		sampler     string
-		wantSampled bool
-	}{
-		{"always off", "always_off", false},
-		{"always on", "always_on", true},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Setenv("OTEL_TRACES_EXPORTER", "none")
-			t.Setenv("OTEL_TRACES_SAMPLER", tc.sampler)
-
-			shutdown, err := InitTracerProvider(slog.New(slog.DiscardHandler), "test", "v0.0.0")
-			if err != nil {
-				t.Fatalf("init tracer provider: %v", err)
-			}
-			t.Cleanup(func() { _ = shutdown(context.Background()) })
-
-			_, span := otel.Tracer("test").Start(context.Background(), "span")
-			span.End()
-
-			if got := span.SpanContext().IsSampled(); got != tc.wantSampled {
-				t.Errorf("OTEL_TRACES_SAMPLER=%q: IsSampled() = %v, want %v", tc.sampler, got, tc.wantSampled)
-			}
-		})
-	}
-}
-
-func TestExemplarFilterOptions(t *testing.T) {
-	t.Run("default pins trace-based", func(t *testing.T) {
-		if v, ok := os.LookupEnv("OTEL_METRICS_EXEMPLAR_FILTER"); ok {
-			os.Unsetenv("OTEL_METRICS_EXEMPLAR_FILTER")
-			t.Cleanup(func() { os.Setenv("OTEL_METRICS_EXEMPLAR_FILTER", v) })
-		}
-		if got := exemplarFilterOptions(); len(got) != 1 {
-			t.Errorf("expected 1 option when env unset, got %d", len(got))
-		}
-	})
-
-	t.Run("env override yields no option", func(t *testing.T) {
-		t.Setenv("OTEL_METRICS_EXEMPLAR_FILTER", "always_off")
-		if got := exemplarFilterOptions(); len(got) != 0 {
-			t.Errorf("expected 0 options when env set, got %d", len(got))
-		}
-	})
-}
-
-// TestMeterProvider_TraceBasedExemplar guards that the trace-based filter we pin
-// actually attaches a trace id to a histogram measurement recorded inside a
-// sampled span.
-func TestMeterProvider_TraceBasedExemplar(t *testing.T) {
-	reader := sdkmetric.NewManualReader()
-	provider := sdkmetric.NewMeterProvider(
-		sdkmetric.WithReader(reader),
-		sdkmetric.WithExemplarFilter(exemplar.TraceBasedFilter),
-	)
-	t.Cleanup(func() { _ = provider.Shutdown(context.Background()) })
-
-	hist, err := provider.Meter("test").Float64Histogram("conversion.duration")
-	if err != nil {
-		t.Fatalf("create histogram: %v", err)
-	}
-
-	tracer := sdktrace.NewTracerProvider(sdktrace.WithSampler(sdktrace.AlwaysSample())).Tracer("test")
-	ctx, span := tracer.Start(context.Background(), "conversion")
-	hist.Record(ctx, 1.0)
-	traceID := span.SpanContext().TraceID()
-	span.End()
-
-	var rm metricdata.ResourceMetrics
-	if err := reader.Collect(context.Background(), &rm); err != nil {
-		t.Fatalf("collect: %v", err)
-	}
-
-	var found bool
-	for _, sm := range rm.ScopeMetrics {
-		for _, m := range sm.Metrics {
-			hd, ok := m.Data.(metricdata.Histogram[float64])
-			if !ok {
-				continue
-			}
-			for _, dp := range hd.DataPoints {
-				for _, ex := range dp.Exemplars {
-					if string(ex.TraceID) == string(traceID[:]) {
-						found = true
-					}
-				}
-			}
-		}
-	}
-
-	if !found {
-		t.Error("expected a trace-based exemplar carrying the span trace id")
-	}
-}

pkg/gotenberg/logging.go

@@ -1 +0,0 @@
-package gotenberg

pkg/gotenberg/metrics.go

@@ -1,26 +0,0 @@
-package gotenberg
-
-// Metric represents a unitary metric.
-type Metric struct {
-	// Name is the unique identifier.
-	// Required.
-	Name string
-
-	// Description describes the metric.
-	// Optional.
-	Description string
-
-	// Read returns the current value.
-	// Required.
-	Read func() float64
-}
-
-// MetricsProvider is a module interface which provides a list of [Metric].
-//
-//	func (m *YourModule) Provision(ctx *gotenberg.Context) error {
-//		provider, _ := ctx.Module(new(gotenberg.MetricsProvider))
-//		metrics, _  := provider.(gotenberg.MetricsProvider).Metrics()
-//	}
-type MetricsProvider interface {
-	Metrics() ([]Metric, error)
-}

pkg/gotenberg/mocks.go

@@ -45,23 +45,14 @@ func (mod *DebuggableMock) Debug() map[string]any {
 //
 //nolint:dupl
 type PdfEngineMock struct {
-	MergeMock               func(ctx context.Context, logger *slog.Logger, inputPaths []string, outputPath string) error
-	SplitMock               func(ctx context.Context, logger *slog.Logger, mode SplitMode, inputPath, outputDirPath string) ([]string, error)
-	FlattenMock             func(ctx context.Context, logger *slog.Logger, inputPath string) error
-	ConvertMock             func(ctx context.Context, logger *slog.Logger, formats PdfFormats, inputPath, outputPath string) error
-	ReadMetadataMock        func(ctx context.Context, logger *slog.Logger, inputPath string) (map[string]any, error)
-	PageCountMock           func(ctx context.Context, logger *slog.Logger, inputPath string) (int, error)
-	WriteMetadataMock       func(ctx context.Context, logger *slog.Logger, metadata map[string]any, inputPath string) error
-	ReadBookmarksMock       func(ctx context.Context, logger *slog.Logger, inputPath string) ([]Bookmark, error)
-	EncryptMock             func(ctx context.Context, logger *slog.Logger, inputPath string, opts EncryptOptions) error
-	EmbedFilesMock          func(ctx context.Context, logger *slog.Logger, filePaths []string, inputPath string) error
-	EmbedFilesMetadataMock  func(ctx context.Context, logger *slog.Logger, metadata map[string]map[string]string, inputPath string) error
-	WriteBookmarksMock      func(ctx context.Context, logger *slog.Logger, inputPath string, bookmarks []Bookmark) error
-	WatermarkMock           func(ctx context.Context, logger *slog.Logger, inputPath string, stamp Stamp) error
-	StampMock               func(ctx context.Context, logger *slog.Logger, inputPath string, stamp Stamp) error
-	RotateMock              func(ctx context.Context, logger *slog.Logger, inputPath string, angle int, pages string) error
-	InjectFacturXXMPMock    func(ctx context.Context, logger *slog.Logger, facturX FacturX, inputPath string) error
-	ReadPdfAConformanceMock func(ctx context.Context, logger *slog.Logger, inputPath string) (string, string, error)
+	MergeMock          func(ctx context.Context, logger *slog.Logger, inputPaths []string, outputPath string) error
+	SplitMock          func(ctx context.Context, logger *slog.Logger, mode SplitMode, inputPath, outputDirPath string) ([]string, error)
+	FlattenMock        func(ctx context.Context, logger *slog.Logger, inputPath string) error
+	ConvertMock        func(ctx context.Context, logger *slog.Logger, formats PdfFormats, inputPath, outputPath string) error
+	ReadMetadataMock   func(ctx context.Context, logger *slog.Logger, inputPath string) (map[string]any, error)
+	WriteMetadataMock  func(ctx context.Context, logger *slog.Logger, metadata map[string]any, inputPath string) error
+	EncryptMock        func(ctx context.Context, logger *slog.Logger, inputPath, userPassword, ownerPassword string) error
+	AddAttachmentsMock func(ctx context.Context, logger *slog.Logger, filePaths []string, inputPath string) error
 }
 
 func (engine *PdfEngineMock) Merge(ctx context.Context, logger *slog.Logger, inputPaths []string, outputPath string) error {
@@ -84,52 +75,16 @@ func (engine *PdfEngineMock) ReadMetadata(ctx context.Context, logger *slog.Logg
 	return engine.ReadMetadataMock(ctx, logger, inputPath)
 }
 
-func (engine *PdfEngineMock) PageCount(ctx context.Context, logger *slog.Logger, inputPath string) (int, error) {
-	return engine.PageCountMock(ctx, logger, inputPath)
-}
-
 func (engine *PdfEngineMock) WriteMetadata(ctx context.Context, logger *slog.Logger, metadata map[string]any, inputPath string) error {
 	return engine.WriteMetadataMock(ctx, logger, metadata, inputPath)
 }
 
-func (engine *PdfEngineMock) ReadBookmarks(ctx context.Context, logger *slog.Logger, inputPath string) ([]Bookmark, error) {
-	return engine.ReadBookmarksMock(ctx, logger, inputPath)
+func (engine *PdfEngineMock) Encrypt(ctx context.Context, logger *slog.Logger, inputPath, userPassword, ownerPassword string) error {
+	return engine.EncryptMock(ctx, logger, inputPath, userPassword, ownerPassword)
 }
 
-func (engine *PdfEngineMock) Encrypt(ctx context.Context, logger *slog.Logger, inputPath string, opts EncryptOptions) error {
-	return engine.EncryptMock(ctx, logger, inputPath, opts)
-}
-
-func (engine *PdfEngineMock) EmbedFiles(ctx context.Context, logger *slog.Logger, filePaths []string, inputPath string) error {
-	return engine.EmbedFilesMock(ctx, logger, filePaths, inputPath)
-}
-
-func (engine *PdfEngineMock) EmbedFilesMetadata(ctx context.Context, logger *slog.Logger, metadata map[string]map[string]string, inputPath string) error {
-	return engine.EmbedFilesMetadataMock(ctx, logger, metadata, inputPath)
-}
-
-func (engine *PdfEngineMock) WriteBookmarks(ctx context.Context, logger *slog.Logger, inputPath string, bookmarks []Bookmark) error {
-	return engine.WriteBookmarksMock(ctx, logger, inputPath, bookmarks)
-}
-
-func (engine *PdfEngineMock) Watermark(ctx context.Context, logger *slog.Logger, inputPath string, stamp Stamp) error {
-	return engine.WatermarkMock(ctx, logger, inputPath, stamp)
-}
-
-func (engine *PdfEngineMock) Stamp(ctx context.Context, logger *slog.Logger, inputPath string, stamp Stamp) error {
-	return engine.StampMock(ctx, logger, inputPath, stamp)
-}
-
-func (engine *PdfEngineMock) Rotate(ctx context.Context, logger *slog.Logger, inputPath string, angle int, pages string) error {
-	return engine.RotateMock(ctx, logger, inputPath, angle, pages)
-}
-
-func (engine *PdfEngineMock) InjectFacturXXMP(ctx context.Context, logger *slog.Logger, facturX FacturX, inputPath string) error {
-	return engine.InjectFacturXXMPMock(ctx, logger, facturX, inputPath)
-}
-
-func (engine *PdfEngineMock) ReadPdfAConformance(ctx context.Context, logger *slog.Logger, inputPath string) (string, string, error) {
-	return engine.ReadPdfAConformanceMock(ctx, logger, inputPath)
+func (engine *PdfEngineMock) AddAttachments(ctx context.Context, logger *slog.Logger, filePaths []string, inputPath string) error {
+	return engine.AddAttachmentsMock(ctx, logger, filePaths, inputPath)
 }
 
 // PdfEngineProviderMock is a mock for the [PdfEngineProvider] interface.
@@ -162,14 +117,13 @@ func (p *ProcessMock) Healthy(logger *slog.Logger) bool {
 
 // ProcessSupervisorMock is a mock for the [ProcessSupervisor] interface.
 type ProcessSupervisorMock struct {
-	LaunchMock                  func() error
-	ShutdownMock                func() error
-	HealthyMock                 func() bool
-	RunMock                     func(ctx context.Context, logger *slog.Logger, task func() error) error
-	ReqQueueSizeMock            func() int64
-	RestartsCountMock           func() int64
-	ActiveTasksCountMock        func() int64
-	ConversionsSinceRestartMock func() int64
+	LaunchMock           func() error
+	ShutdownMock         func() error
+	HealthyMock          func() bool
+	RunMock              func(ctx context.Context, logger *slog.Logger, task func() error) error
+	ReqQueueSizeMock     func() int64
+	ActiveTasksCountMock func() int64
+	RestartsCountMock    func() int64
 }
 
 func (s *ProcessSupervisorMock) Launch() error {
@@ -192,25 +146,12 @@ func (s *ProcessSupervisorMock) ReqQueueSize() int64 {
 	return s.ReqQueueSizeMock()
 }
 
-func (s *ProcessSupervisorMock) RestartsCount() int64 {
-	return s.RestartsCountMock()
-}
-
 func (s *ProcessSupervisorMock) ActiveTasksCount() int64 {
 	return s.ActiveTasksCountMock()
 }
 
-func (s *ProcessSupervisorMock) ConversionsSinceRestart() int64 {
-	return s.ConversionsSinceRestartMock()
-}
-
-// MetricsProviderMock is a mock for the [MetricsProvider] interface.
-type MetricsProviderMock struct {
-	MetricsMock func() ([]Metric, error)
-}
-
-func (provider *MetricsProviderMock) Metrics() ([]Metric, error) {
-	return provider.MetricsMock()
+func (s *ProcessSupervisorMock) RestartsCount() int64 {
+	return s.RestartsCountMock()
 }
 
 // MkdirAllMock is a mock for the [MkdirAll] interface.
@@ -239,7 +180,6 @@ var (
 	_ PdfEngineProvider = (*PdfEngineProviderMock)(nil)
 	_ Process           = (*ProcessMock)(nil)
 	_ ProcessSupervisor = (*ProcessSupervisorMock)(nil)
-	_ MetricsProvider   = (*MetricsProviderMock)(nil)
 	_ MkdirAll          = (*MkdirAllMock)(nil)
 	_ PathRename        = (*PathRenameMock)(nil)
 )

pkg/gotenberg/outbound.go

@@ -1,676 +0,0 @@
-package gotenberg
-
-import (
-	"bufio"
-	"context"
-	"crypto/tls"
-	"encoding/base64"
-	"errors"
-	"fmt"
-	"net"
-	"net/http"
-	"net/netip"
-	"net/url"
-	"os"
-	"strings"
-	"time"
-
-	"github.com/dlclark/regexp2"
-	"golang.org/x/net/http/httpproxy"
-)
-
-// ErrNonPublicIP indicates that an outbound URL targets an IP address that
-// is not reachable on the public internet. This covers loopback, RFC1918
-// private, link-local, unspecified, multicast, and IPv6 unique-local
-// (fc00::/7) addresses, as well as their IPv4-mapped IPv6 wrappers (for
-// example [::ffff:127.0.0.1]).
-var ErrNonPublicIP = errors.New("non-public IP")
-
-// ErrPublicIP indicates that an outbound URL targets an IP address that is
-// reachable on the public internet. It is returned when a caller opts
-// into denying public destinations via [WithDenyPublicIPs]; typical use
-// cases are air-gapped or data-governed deployments where Gotenberg must
-// only talk to hosts on a private network.
-var ErrPublicIP = errors.New("public IP")
-
-// netipResolver is the subset of [net.Resolver] used by [resolveHost].
-// Defining it as an interface allows tests to substitute a stub resolver.
-type netipResolver interface {
-	LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error)
-}
-
-// outboundResolver is the resolver used by [resolveHost]. It is a
-// package-level variable so that tests can substitute a stub resolver.
-var outboundResolver netipResolver = net.DefaultResolver
-
-// outboundDialer is the underlying dialer used by [secureDialContext]. It is
-// a package-level variable so that tests can replace it.
-var outboundDialer = &net.Dialer{
-	Timeout:   30 * time.Second,
-	KeepAlive: 30 * time.Second,
-}
-
-// nonPublicIPv6Prefixes lists IPv6 ranges that the standard library does
-// not classify via [netip.Addr] helpers but that must not be considered
-// public:
-//
-//   - 2002::/16    6to4 (RFC 3056, deprecated by RFC 7526). Bits 16-47
-//     embed an IPv4 destination, including private ones.
-//   - 2001::/32    Teredo (RFC 4380). Bits 96-127 embed an IPv4
-//     destination, including private ones.
-//   - 64:ff9b::/96 NAT64 well-known prefix (RFC 6052). Low 32 bits
-//     embed an IPv4 destination translated by a NAT64 gateway.
-//   - 64:ff9b:1::/48 NAT64 local-use prefix (RFC 8215). Same risk.
-//   - fec0::/10    Deprecated site-local (RFC 3879). Not covered by
-//     [netip.Addr.IsPrivate] which only handles fc00::/7.
-//   - ::/96        IPv4-compatible IPv6 (deprecated). Embeds an IPv4
-//     destination and is not handled by [netip.Addr.Unmap].
-//   - 2001:db8::/32 Documentation range (RFC 3849). Never routable.
-//   - 100::/64     Discard prefix (RFC 6666).
-var nonPublicIPv6Prefixes = []netip.Prefix{
-	netip.MustParsePrefix("2002::/16"),
-	netip.MustParsePrefix("2001::/32"),
-	netip.MustParsePrefix("64:ff9b::/96"),
-	netip.MustParsePrefix("64:ff9b:1::/48"),
-	netip.MustParsePrefix("fec0::/10"),
-	netip.MustParsePrefix("::/96"),
-	netip.MustParsePrefix("2001:db8::/32"),
-	netip.MustParsePrefix("100::/64"),
-}
-
-// IsPublicIP reports whether addr is reachable on the public internet. It
-// returns false for loopback, private (RFC1918), link-local, unspecified,
-// multicast, and unique-local addresses. IPv4-mapped IPv6 addresses are
-// unmapped before evaluation so that [::ffff:127.0.0.1] is correctly
-// identified as loopback.
-//
-// IPv6 prefixes that tunnel or translate to an embedded IPv4 destination
-// (6to4, Teredo, NAT64) are rejected wholesale rather than recursed into,
-// because a host that routes them implicitly trusts the IPv4 mapping and
-// the prefixes themselves are deprecated or translation-only. See
-// [nonPublicIPv6Prefixes] for the full list and rationale.
-func IsPublicIP(addr netip.Addr) bool {
-	if !addr.IsValid() {
-		return false
-	}
-	addr = addr.Unmap()
-	switch {
-	case addr.IsLoopback(),
-		addr.IsPrivate(),
-		addr.IsLinkLocalUnicast(),
-		addr.IsLinkLocalMulticast(),
-		addr.IsMulticast(),
-		addr.IsUnspecified(),
-		addr.IsInterfaceLocalMulticast():
-		return false
-	}
-	if addr.Is6() {
-		for _, p := range nonPublicIPv6Prefixes {
-			if p.Contains(addr) {
-				return false
-			}
-		}
-	}
-	return true
-}
-
-// ResolveAndCheckPublic resolves host and rejects any resolved address
-// that fails [IsPublicIP] with [ErrNonPublicIP]. It is the strict
-// equivalent of [DecideOutbound] with [WithDenyPrivateIPs] true for a
-// bare host. Callers that need a different policy should use
-// [DecideOutbound] directly.
-func ResolveAndCheckPublic(ctx context.Context, host string) ([]netip.Addr, error) {
-	return resolveHost(ctx, host, true, false)
-}
-
-// resolveHost resolves host and returns the addresses. When denyPrivate
-// is true, a non-public address is rejected with [ErrNonPublicIP]. When
-// denyPublic is true, a public address is rejected with [ErrPublicIP].
-// Both checks may be active at the same time, in which case any
-// resolved address fails and the caller must rely on an allow-list
-// bypass.
-func resolveHost(ctx context.Context, host string, denyPrivate, denyPublic bool) ([]netip.Addr, error) {
-	if host == "" {
-		return nil, errors.New("empty host")
-	}
-
-	check := func(a netip.Addr) error {
-		public := IsPublicIP(a)
-		if denyPublic && public {
-			return fmt.Errorf("%q: %w", a, ErrPublicIP)
-		}
-		if denyPrivate && !public {
-			return fmt.Errorf("%q: %w", a, ErrNonPublicIP)
-		}
-		return nil
-	}
-
-	if addr, err := netip.ParseAddr(host); err == nil {
-		if err := check(addr); err != nil {
-			return nil, err
-		}
-		return []netip.Addr{addr}, nil
-	}
-	addrs, err := outboundResolver.LookupNetIP(ctx, "ip", host)
-	if err != nil {
-		return nil, fmt.Errorf("resolve %q: %w", host, err)
-	}
-	if len(addrs) == 0 {
-		return nil, fmt.Errorf("resolve %q: no addresses returned", host)
-	}
-	for _, a := range addrs {
-		if err := check(a); err != nil {
-			return nil, fmt.Errorf("%q resolves to rejected address %w", host, err)
-		}
-	}
-	return addrs, nil
-}
-
-// OutboundDecision is the result of validating an outbound URL via
-// [DecideOutbound]. Callers use it to dial the destination either directly
-// (operator-approved allow-list match, Bypass true) or via [DialPinned] so
-// that the connect targets the IPs resolved at validation time. Passing
-// the decision to the dialer closes the window between validation and
-// connect that DNS rebinding exploits.
-type OutboundDecision struct {
-	// Bypass is true when an allow-list pattern matched the URL. The
-	// operator has explicitly opted into the destination; the caller
-	// should dial directly without an additional IP check.
-	Bypass bool
-
-	// Pinned holds the IPs resolved for the URL host. The caller should
-	// dial one of these via [DialPinned] to prevent DNS rebinding between
-	// validation and connect.
-	Pinned []netip.Addr
-}
-
-// outboundDecisionKey is the context key under which an [OutboundDecision]
-// is stored.
-type outboundDecisionKey struct{}
-
-// outboundProxiedKey is the context key under which [outboundRoundTripper]
-// records that the environment proxy will carry this request, so that the
-// dialer knows the address it receives is the proxy's rather than the
-// destination's.
-type outboundProxiedKey struct{}
-
-// decideConfig carries optional settings for [DecideOutbound] and
-// [FilterOutboundURL]. See [DecideOption] for how callers configure it.
-type decideConfig struct {
-	denyPrivateIPs bool
-	denyPublicIPs  bool
-}
-
-// DecideOption customizes how [DecideOutbound] and [FilterOutboundURL]
-// validate a URL. Options are applied in order on top of the permissive
-// defaults (no IP-class rejection).
-type DecideOption func(*decideConfig)
-
-// WithDenyPrivateIPs rejects URLs whose host resolves to a non-public IP
-// address (loopback, RFC1918, link-local, unique-local, multicast,
-// unspecified). DNS still runs and the returned [OutboundDecision] still
-// carries the resolved IPs for dial pinning, so enabling or disabling
-// this option does not affect DNS-rebinding protection. Use it on
-// internet-exposed deployments to mitigate SSRF against internal
-// services.
-func WithDenyPrivateIPs(deny bool) DecideOption {
-	return func(c *decideConfig) { c.denyPrivateIPs = deny }
-}
-
-// WithDenyPublicIPs rejects URLs whose host resolves to a public IP
-// address. Use it on air-gapped or data-governed deployments where
-// Gotenberg must only reach hosts on a private network; the option
-// prevents data exfiltration to attacker-controlled public servers via
-// webhook callbacks, downloadFrom URLs, or user-supplied stamp sources.
-// May be combined with [WithDenyPrivateIPs]; in that case every resolved
-// address fails and only an allow-list bypass permits a destination.
-func WithDenyPublicIPs(deny bool) DecideOption {
-	return func(c *decideConfig) { c.denyPublicIPs = deny }
-}
-
-// httpLikeScheme reports whether scheme is one of http, https, ws, or wss.
-// Only these schemes go through the IP-based address check; data, blob,
-// file, and other schemes are filtered by the regex layer alone.
-func httpLikeScheme(scheme string) bool {
-	switch scheme {
-	case "http", "https", "ws", "wss":
-		return true
-	}
-	return false
-}
-
-// DecideOutbound parses rawURL, runs the regex allow/deny lists against
-// the normalized form, and (when no allow-list match) resolves the host
-// and applies the IP-class checks selected by opts. It returns the
-// resulting [OutboundDecision] so the caller can pin the dial to the IPs
-// that were resolved here and skip a second DNS lookup later, which
-// closes the DNS rebinding window that affects callers that only receive
-// an error from [FilterOutboundURL].
-//
-// The semantics:
-//
-//  1. The URL is parsed and its scheme and host lowercased.
-//  2. allowList and denyList apply against the normalized form with OR
-//     semantics. The deny-list always applies.
-//  3. For http, https, ws, and wss, the host is resolved and every
-//     resolved address must satisfy the enabled IP-class checks
-//     ([WithDenyPrivateIPs], [WithDenyPublicIPs]). An allow-list match
-//     bypasses the IP-class checks and the returned decision carries
-//     Bypass true. Otherwise the decision carries Pinned with the
-//     resolved addresses.
-//
-// Callers that dial the destination themselves must honor Bypass and
-// Pinned: bypassed URLs dial the hostname directly (operator opt-in);
-// pinned URLs must dial one of Pinned via [DialPinned].
-func DecideOutbound(ctx context.Context, rawURL string, allowList, denyList []*regexp2.Regexp, deadline time.Time, opts ...DecideOption) (OutboundDecision, error) {
-	cfg := decideConfig{}
-	for _, opt := range opts {
-		opt(&cfg)
-	}
-
-	parsed, err := url.Parse(rawURL)
-	if err != nil {
-		return OutboundDecision{}, fmt.Errorf("parse URL %q: %w", rawURL, ErrFiltered)
-	}
-	parsed.Scheme = strings.ToLower(parsed.Scheme)
-	parsed.Host = strings.ToLower(parsed.Host)
-	normalized := parsed.String()
-
-	allowMatched := false
-	if len(allowList) > 0 {
-		for _, pattern := range allowList {
-			clone := regexp2.MustCompile(pattern.String(), 0)
-			clone.MatchTimeout = time.Until(deadline)
-
-			ok, err := clone.MatchString(normalized)
-			if err != nil {
-				if time.Now().After(deadline) {
-					return OutboundDecision{}, context.DeadlineExceeded
-				}
-				return OutboundDecision{}, fmt.Errorf("'%s' cannot handle '%s': %w", clone.String(), normalized, err)
-			}
-
-			if ok {
-				allowMatched = true
-				break
-			}
-		}
-
-		if !allowMatched {
-			return OutboundDecision{}, fmt.Errorf("'%s' does not match any expression from the allowed list: %w", normalized, ErrFiltered)
-		}
-	}
-
-	for _, pattern := range denyList {
-		clone := regexp2.MustCompile(pattern.String(), 0)
-		clone.MatchTimeout = time.Until(deadline)
-
-		ok, err := clone.MatchString(normalized)
-		if err != nil {
-			if time.Now().After(deadline) {
-				return OutboundDecision{}, context.DeadlineExceeded
-			}
-			return OutboundDecision{}, fmt.Errorf("'%s' cannot handle '%s': %w", clone.String(), normalized, err)
-		}
-
-		if ok {
-			return OutboundDecision{}, fmt.Errorf("'%s' matches the expression from the denied list: %w", normalized, ErrFiltered)
-		}
-	}
-
-	if allowMatched {
-		return OutboundDecision{Bypass: true}, nil
-	}
-
-	if !httpLikeScheme(parsed.Scheme) {
-		return OutboundDecision{}, nil
-	}
-
-	host := parsed.Hostname()
-	if host == "" {
-		return OutboundDecision{}, fmt.Errorf("URL %q has no host: %w", rawURL, ErrFiltered)
-	}
-
-	addrs, err := resolveHost(ctx, host, cfg.denyPrivateIPs, cfg.denyPublicIPs)
-	if err != nil {
-		switch {
-		case errors.Is(err, ErrNonPublicIP):
-			return OutboundDecision{}, fmt.Errorf("'%s' targets a non-public address: %w", normalized, ErrFiltered)
-		case errors.Is(err, ErrPublicIP):
-			return OutboundDecision{}, fmt.Errorf("'%s' targets a public address: %w", normalized, ErrFiltered)
-		default:
-			return OutboundDecision{}, fmt.Errorf("validate '%s' host: %w", normalized, err)
-		}
-	}
-
-	return OutboundDecision{Pinned: addrs}, nil
-}
-
-// FilterOutboundURL validates that rawURL is acceptable for an outbound
-// request from Gotenberg. It is the URL-aware replacement for
-// [FilterDeadline] and should be preferred for any new code that filters
-// a URL before issuing or instructing an outbound request.
-//
-// The default behavior is permissive: the URL passes as long as it clears
-// the regex allow-list and deny-list. Callers that need IP-class checks
-// opt in via [WithDenyPrivateIPs] or [WithDenyPublicIPs]. The deny-list
-// always applies and cannot be bypassed by an allow-list match.
-func FilterOutboundURL(ctx context.Context, rawURL string, allowList, denyList []*regexp2.Regexp, deadline time.Time, opts ...DecideOption) error {
-	_, err := DecideOutbound(ctx, rawURL, allowList, denyList, deadline, opts...)
-	return err
-}
-
-// outboundRoundTripper is an [http.RoundTripper] that validates each
-// request URL via [DecideOutbound] and stashes the resulting
-// [OutboundDecision] in the request context so that [secureDialContext]
-// can pin the dial or bypass the IP check as appropriate. Because the
-// http.Client invokes RoundTrip again for each redirect hop, this also
-// re-validates redirect targets without a separate CheckRedirect.
-type outboundRoundTripper struct {
-	base      http.RoundTripper
-	allowList []*regexp2.Regexp
-	denyList  []*regexp2.Regexp
-	opts      []DecideOption
-
-	// proxyFunc mirrors the transport's own proxy resolution. It is nil unless
-	// the environment proxy is enabled.
-	proxyFunc func(*url.URL) (*url.URL, error)
-}
-
-// RoundTrip validates req.URL and delegates to the base transport.
-func (rt *outboundRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
-	deadline, ok := req.Context().Deadline()
-	if !ok {
-		deadline = time.Now().Add(30 * time.Second)
-	}
-
-	decision, err := DecideOutbound(req.Context(), req.URL.String(), rt.allowList, rt.denyList, deadline, rt.opts...)
-	if err != nil {
-		return nil, err
-	}
-
-	ctx := context.WithValue(req.Context(), outboundDecisionKey{}, decision)
-
-	// A request the proxy will not carry is dialed directly, so it still gets
-	// pinned. Without this, enabling the environment proxy would silently drop
-	// DNS-rebinding protection for every NO_PROXY host, and for all traffic
-	// when no proxy variable is set at all.
-	if rt.proxyFunc != nil {
-		proxyURL, proxyErr := rt.proxyFunc(req.URL)
-		if proxyErr == nil && proxyURL != nil {
-			ctx = context.WithValue(ctx, outboundProxiedKey{}, true)
-		}
-	}
-
-	return rt.base.RoundTrip(req.WithContext(ctx))
-}
-
-// NewOutboundHttpClient returns an [http.Client] that validates every
-// outbound request URL via the same logic as [FilterOutboundURL] and
-// pins the resulting dial to the resolved IPs.
-//
-// The client re-validates redirect targets automatically because the
-// underlying [http.Client] invokes the wrapping [http.RoundTripper] once
-// per hop. This closes the redirect-based SSRF bypass that affects raw
-// [http.Client] usage when no CheckRedirect is set.
-//
-// The default posture is permissive; callers pass [WithDenyPrivateIPs]
-// or [WithDenyPublicIPs] to opt into IP-class rejection.
-//
-// When enableEnvironmentProxy is true, the client routes through the proxy
-// defined by the standard HTTP_PROXY, HTTPS_PROXY, and NO_PROXY variables,
-// including any credentials embedded in those URLs. Dial pinning does not apply
-// to a hop the proxy carries, since the proxy owns DNS and egress there; a hop
-// the proxy declines, such as a NO_PROXY host, is dialed directly and stays
-// pinned. The URL allow/deny and IP-class validation runs either way. Callers
-// gate this behind their module's opt-in flag. See
-// https://github.com/gotenberg/gotenberg/issues/1592.
-func NewOutboundHttpClient(timeout time.Duration, allowList, denyList []*regexp2.Regexp, enableEnvironmentProxy bool, opts ...DecideOption) *http.Client {
-	base := http.DefaultTransport.(*http.Transport).Clone()
-
-	var proxyFunc func(*url.URL) (*url.URL, error)
-
-	if enableEnvironmentProxy {
-		// Route through the operator's proxy (standard env vars, credentials
-		// included). httpproxy.FromEnvironment reads the environment now rather
-		// than caching it process-wide like http.ProxyFromEnvironment.
-		proxyFunc = httpproxy.FromEnvironment().ProxyFunc()
-		base.Proxy = func(req *http.Request) (*url.URL, error) {
-			return proxyFunc(req.URL)
-		}
-		// Only a hop the proxy actually carries skips pinning: there the dial
-		// targets the proxy, not the destination, and the proxy owns DNS. A hop
-		// the proxy declines is dialed directly and stays pinned.
-		base.DialContext = func(ctx context.Context, network, addr string) (net.Conn, error) {
-			if proxied, _ := ctx.Value(outboundProxiedKey{}).(bool); proxied {
-				return outboundDialer.DialContext(ctx, network, addr)
-			}
-			return secureDialContext(ctx, network, addr)
-		}
-	} else {
-		// Default: ignore any proxy environment variables and pin the dial to
-		// the IPs resolved during validation, closing the DNS-rebinding
-		// window. Clearing Proxy is deliberate: the cloned default transport
-		// carries http.ProxyFromEnvironment, which combined with the pinned
-		// dialer would connect to the destination IP on the proxy's port.
-		base.Proxy = nil
-		base.DialContext = secureDialContext
-	}
-
-	return &http.Client{
-		Timeout: timeout,
-		Transport: &outboundRoundTripper{
-			base:      base,
-			allowList: allowList,
-			denyList:  denyList,
-			opts:      opts,
-			proxyFunc: proxyFunc,
-		},
-	}
-}
-
-// environmentProxyVariables are the variables golang.org/x/net/http/httpproxy
-// reads, in the casing precedence it applies.
-var environmentProxyVariables = []string{
-	"HTTP_PROXY", "http_proxy",
-	"HTTPS_PROXY", "https_proxy",
-	"ALL_PROXY", "all_proxy",
-}
-
-// ValidateEnvironmentProxyVariables checks that every proxy variable currently
-// set can be parsed as a proxy URL.
-//
-// httpproxy discards a parse error and falls back to a direct connection, so an
-// operator who mistypes a proxy URL would silently lose the egress path they
-// meant to enforce. Modules exposing an environment proxy flag call this from
-// their Validate so that startup fails loudly instead.
-//
-// Values are never included in the error: a proxy URL may carry credentials.
-func ValidateEnvironmentProxyVariables() error {
-	var err error
-
-	for _, name := range environmentProxyVariables {
-		if os.Getenv(name) == "" {
-			continue
-		}
-
-		if !isUsableProxyURL(os.Getenv(name)) {
-			err = errors.Join(err, fmt.Errorf("environment variable %s is not a usable proxy URL; unset it, or set it to a value like 'http://user:password@host:3128'", name))
-		}
-	}
-
-	return err
-}
-
-// isUsableProxyURL mirrors httpproxy's own parsing: a URL with a proxy scheme,
-// or anything that becomes one once a scheme is prefixed.
-func isUsableProxyURL(value string) bool {
-	proxyURL, err := url.Parse(value)
-	if err == nil {
-		switch proxyURL.Scheme {
-		case "http", "https", "socks5", "socks5h":
-			return true
-		}
-	}
-
-	// httpproxy retries bare values such as "host:3128" with a scheme.
-	_, err = url.Parse("http://" + value)
-	return err == nil
-}
-
-// secureDialContext consumes the [OutboundDecision] stashed in ctx by
-// [outboundRoundTripper]. When the decision is to bypass (allow-list
-// match), it dials directly. When the decision contains pinned IPs, it
-// dials each in turn until one connects. When no decision is present
-// (the dialer was used outside of [outboundRoundTripper]), it falls back
-// to resolving the destination without IP-class checks so that the
-// fallback matches the permissive default and operators who need
-// restrictions configure them at the caller.
-func secureDialContext(ctx context.Context, network, addr string) (net.Conn, error) {
-	host, port, err := net.SplitHostPort(addr)
-	if err != nil {
-		return nil, fmt.Errorf("split host:port %q: %w", addr, err)
-	}
-
-	if decision, ok := ctx.Value(outboundDecisionKey{}).(OutboundDecision); ok {
-		if decision.Bypass {
-			return outboundDialer.DialContext(ctx, network, addr)
-		}
-		if len(decision.Pinned) > 0 {
-			return DialPinned(ctx, network, decision.Pinned, port)
-		}
-	}
-
-	addrs, err := resolveHost(ctx, host, false, false)
-	if err != nil {
-		return nil, err
-	}
-	return DialPinned(ctx, network, addrs, port)
-}
-
-// DialPinned dials each addr in turn until one connects, returning the
-// first successful connection or the last error. Callers pass the Pinned
-// slice from [OutboundDecision] so that the dial targets exactly the IPs
-// that [DecideOutbound] resolved, preventing DNS rebinding between
-// validation and connect.
-func DialPinned(ctx context.Context, network string, addrs []netip.Addr, port string) (net.Conn, error) {
-	var lastErr error
-	for _, a := range addrs {
-		conn, err := outboundDialer.DialContext(ctx, network, net.JoinHostPort(a.String(), port))
-		if err == nil {
-			return conn, nil
-		}
-		lastErr = err
-	}
-	if lastErr == nil {
-		return nil, errors.New("no addresses to dial")
-	}
-	return nil, lastErr
-}
-
-// DialThroughProxy opens a TCP tunnel to target (a host:port) through the
-// HTTP CONNECT proxy at proxyURL, authenticating with any credentials
-// embedded in proxyURL. dialProxy dials the proxy's own address; callers pass
-// a plain dialer. Chromium and soffice cannot authenticate to a proxy
-// themselves, so Gotenberg performs the CONNECT handshake on their behalf.
-// The returned connection carries the raw tunnel for the caller to splice
-// with the client. See https://github.com/gotenberg/gotenberg/issues/1592.
-func DialThroughProxy(ctx context.Context, proxyURL *url.URL, target string, dialProxy func(ctx context.Context, network, addr string) (net.Conn, error)) (net.Conn, error) {
-	conn, err := dialProxy(ctx, "tcp", proxyHostPort(proxyURL))
-	if err != nil {
-		return nil, fmt.Errorf("dial proxy: %w", err)
-	}
-
-	if proxyURL.Scheme == "https" {
-		tlsConn := tls.Client(conn, &tls.Config{ServerName: proxyURL.Hostname()})
-		err = tlsConn.HandshakeContext(ctx)
-		if err != nil {
-			_ = conn.Close()
-			return nil, fmt.Errorf("TLS handshake with proxy: %w", err)
-		}
-		conn = tlsConn
-	}
-
-	// Bound the CONNECT handshake by the request deadline; cleared once the
-	// tunnel is established so splicing manages its own lifetime.
-	if deadline, ok := ctx.Deadline(); ok {
-		_ = conn.SetDeadline(deadline)
-	}
-
-	connectReq := &http.Request{
-		Method: http.MethodConnect,
-		URL:    &url.URL{Opaque: target},
-		Host:   target,
-		Header: make(http.Header),
-	}
-	if user := proxyURL.User; user != nil {
-		password, _ := user.Password()
-		connectReq.Header.Set("Proxy-Authorization", proxyAuthHeader(user.Username(), password))
-	}
-
-	err = connectReq.Write(conn)
-	if err != nil {
-		_ = conn.Close()
-		return nil, fmt.Errorf("write CONNECT to proxy: %w", err)
-	}
-
-	br := bufio.NewReader(conn)
-	resp, err := http.ReadResponse(br, connectReq)
-	if err != nil {
-		_ = conn.Close()
-		return nil, fmt.Errorf("read CONNECT response from proxy: %w", err)
-	}
-	// A CONNECT response carries no body; discard defensively.
-	_ = resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		_ = conn.Close()
-		return nil, fmt.Errorf("proxy refused CONNECT to %q with status %d", target, resp.StatusCode)
-	}
-
-	_ = conn.SetDeadline(time.Time{})
-
-	// The reader may hold bytes the proxy sent right after the response;
-	// overlay it so those tunnel bytes are not lost when splicing.
-	return &bufferedConn{Conn: conn, r: br}, nil
-}
-
-// proxyHostPort returns proxyURL's host:port, defaulting the port from the
-// scheme when the URL omits it.
-func proxyHostPort(proxyURL *url.URL) string {
-	port := proxyURL.Port()
-	if port == "" {
-		port = "80"
-		if proxyURL.Scheme == "https" {
-			port = "443"
-		}
-	}
-	return net.JoinHostPort(proxyURL.Hostname(), port)
-}
-
-// proxyAuthHeader builds a Basic Proxy-Authorization header value.
-func proxyAuthHeader(username, password string) string {
-	return "Basic " + base64.StdEncoding.EncodeToString([]byte(username+":"+password))
-}
-
-// bufferedConn overlays a [bufio.Reader] on a [net.Conn] so that bytes
-// buffered while reading a proxy's CONNECT response are not lost when the
-// tunnel is spliced.
-type bufferedConn struct {
-	net.Conn
-	r *bufio.Reader
-}
-
-func (c *bufferedConn) Read(b []byte) (int, error) {
-	return c.r.Read(b)
-}
-
-// CloseWrite half-closes the underlying connection. Embedding [net.Conn] hides
-// the method, so a CONNECT splice over this connection could never signal EOF
-// to the upstream and both sides waited for the other until a timeout.
-func (c *bufferedConn) CloseWrite() error {
-	cw, ok := c.Conn.(interface{ CloseWrite() error })
-	if !ok {
-		return fmt.Errorf("underlying %T does not support half-close", c.Conn)
-	}
-	return cw.CloseWrite()
-}

pkg/gotenberg/outbound_envproxy_test.go

@@ -1,155 +0,0 @@
-package gotenberg
-
-import (
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"net/netip"
-	"strings"
-	"testing"
-)
-
-func TestValidateEnvironmentProxyVariables(t *testing.T) {
-	for _, tc := range []struct {
-		name    string
-		env     map[string]string
-		wantErr bool
-		// wantIn is a substring the error must name, so that an operator can
-		// find the offending variable.
-		wantIn string
-	}{
-		{
-			name: "nothing set",
-			env:  map[string]string{},
-		},
-		{
-			name: "well formed URL",
-			env:  map[string]string{"HTTP_PROXY": "http://proxy.example.com:3128"},
-		},
-		{
-			name: "credentials are accepted",
-			env:  map[string]string{"HTTPS_PROXY": "http://user:password@proxy.example.com:3128"},
-		},
-		{
-			name: "bare host and port is accepted, as httpproxy prefixes a scheme",
-			env:  map[string]string{"HTTP_PROXY": "proxy.example.com:3128"},
-		},
-		{
-			name: "socks5 is accepted",
-			env:  map[string]string{"ALL_PROXY": "socks5://proxy.example.com:1080"},
-		},
-		{
-			name: "lowercase variables are checked too",
-			env:  map[string]string{"http_proxy": "http://proxy.example.com:3128"},
-		},
-		{
-			name:    "unparseable URL",
-			env:     map[string]string{"HTTP_PROXY": "http://proxy.example.com:3128/%zz"},
-			wantErr: true,
-			wantIn:  "HTTP_PROXY",
-		},
-		{
-			name:    "the failing variable is named",
-			env:     map[string]string{"HTTPS_PROXY": "://%zz"},
-			wantErr: true,
-			wantIn:  "HTTPS_PROXY",
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			for _, name := range environmentProxyVariables {
-				t.Setenv(name, "")
-			}
-			for name, value := range tc.env {
-				t.Setenv(name, value)
-			}
-
-			err := ValidateEnvironmentProxyVariables()
-			if tc.wantErr && err == nil {
-				t.Fatal("expected an error, got none")
-			}
-			if !tc.wantErr && err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-			if tc.wantIn != "" && !strings.Contains(err.Error(), tc.wantIn) {
-				t.Errorf("error %q does not name %q", err, tc.wantIn)
-			}
-		})
-	}
-}
-
-// TestValidateEnvironmentProxyVariables_DoesNotLeakCredentials pins that a
-// proxy URL, which may embed a password, never reaches the error text.
-func TestValidateEnvironmentProxyVariables_DoesNotLeakCredentials(t *testing.T) {
-	for _, name := range environmentProxyVariables {
-		t.Setenv(name, "")
-	}
-	t.Setenv("HTTP_PROXY", "http://admin:hunter2@proxy.example.com:3128/%zz")
-
-	err := ValidateEnvironmentProxyVariables()
-	if err == nil {
-		t.Fatal("expected an error, got none")
-	}
-	if strings.Contains(err.Error(), "hunter2") {
-		t.Errorf("error leaks the proxy password: %q", err)
-	}
-	if strings.Contains(err.Error(), "admin") {
-		t.Errorf("error leaks the proxy username: %q", err)
-	}
-}
-
-// TestNewOutboundHttpClient_EnvironmentProxyPinsDirectHops is the regression
-// test for the dial-pinning gap: with the environment proxy enabled but no
-// proxy applicable to the request, the dial must still go through the pinning
-// dialer rather than a plain one.
-//
-// The request targets a hostname that only the stub resolver knows, so a plain
-// dial would hand that unresolvable name to the OS and fail. Only a pinned dial,
-// which substitutes the address resolved during validation, can connect.
-// See https://github.com/gotenberg/gotenberg/issues/1592.
-func TestNewOutboundHttpClient_EnvironmentProxyPinsDirectHops(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusNoContent)
-	}))
-	defer srv.Close()
-
-	_, port, err := net.SplitHostPort(strings.TrimPrefix(srv.URL, "http://"))
-	if err != nil {
-		t.Fatalf("split server address: %v", err)
-	}
-
-	const host = "pinned-only.invalid"
-
-	// NO_PROXY covers the destination, so httpproxy declines it and the
-	// transport dials directly. That direct dial is the hop that used to lose
-	// pinning.
-	for _, name := range environmentProxyVariables {
-		t.Setenv(name, "")
-	}
-	t.Setenv("HTTP_PROXY", "http://proxy.invalid:3128")
-	t.Setenv("NO_PROXY", host)
-
-	withStubResolver(t, func(string) ([]netip.Addr, error) {
-		return []netip.Addr{netip.MustParseAddr("127.0.0.1")}, nil
-	})
-
-	client := NewOutboundHttpClient(0, nil, nil, true)
-	rt, ok := client.Transport.(*outboundRoundTripper)
-	if !ok {
-		t.Fatalf("transport is %T, want *outboundRoundTripper", client.Transport)
-	}
-	if rt.proxyFunc == nil {
-		t.Fatal("proxyFunc is nil, want the environment proxy to be resolved per request")
-	}
-
-	resp, err := client.Get("http://" + net.JoinHostPort(host, port))
-	if err != nil {
-		t.Fatalf("GET failed, so the direct hop was not pinned: %v", err)
-	}
-	defer func() {
-		_ = resp.Body.Close()
-	}()
-
-	if resp.StatusCode != http.StatusNoContent {
-		t.Errorf("status = %d, want %d", resp.StatusCode, http.StatusNoContent)
-	}
-}

pkg/gotenberg/outbound_proxy_test.go

@@ -1,153 +0,0 @@
-package gotenberg
-
-import (
-	"bufio"
-	"context"
-	"encoding/base64"
-	"io"
-	"net"
-	"net/http"
-	"net/url"
-	"sync"
-	"testing"
-	"time"
-)
-
-// connectCapture records the CONNECT request a proxy stub received.
-type connectCapture struct {
-	mu     sync.Mutex
-	method string
-	host   string
-	auth   string
-}
-
-func (c *connectCapture) set(method, host, auth string) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	c.method, c.host, c.auth = method, host, auth
-}
-
-func (c *connectCapture) get() (string, string, string) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	return c.method, c.host, c.auth
-}
-
-// startConnectProxyStub starts a raw TCP server that behaves like an HTTP
-// CONNECT proxy: it reads the CONNECT request, records it, replies 200 with a
-// greeting appended to the same write (to exercise buffered-byte handling),
-// then echoes tunnel bytes back to the caller.
-func startConnectProxyStub(t *testing.T, capture *connectCapture) string {
-	t.Helper()
-	l, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-	t.Cleanup(func() { _ = l.Close() })
-
-	go func() {
-		conn, err := l.Accept()
-		if err != nil {
-			return
-		}
-		defer func() { _ = conn.Close() }()
-
-		br := bufio.NewReader(conn)
-		req, err := http.ReadRequest(br)
-		if err != nil {
-			return
-		}
-		capture.set(req.Method, req.Host, req.Header.Get("Proxy-Authorization"))
-
-		// The greeting rides along with the response so the client's CONNECT
-		// response parser buffers it; bufferedConn must not drop it.
-		_, _ = conn.Write([]byte("HTTP/1.1 200 Connection established\r\n\r\nTUNNEL-HELLO"))
-		_, _ = io.Copy(conn, br)
-	}()
-
-	return l.Addr().String()
-}
-
-func TestDialThroughProxy(t *testing.T) {
-	capture := &connectCapture{}
-	addr := startConnectProxyStub(t, capture)
-
-	proxyURL := &url.URL{Scheme: "http", Host: addr, User: url.UserPassword("alice", "s3cr3t")}
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	conn, err := DialThroughProxy(ctx, proxyURL, "example.com:443", func(ctx context.Context, network, addr string) (net.Conn, error) {
-		var d net.Dialer
-		return d.DialContext(ctx, network, addr)
-	})
-	if err != nil {
-		t.Fatalf("DialThroughProxy: %v", err)
-	}
-	defer func() { _ = conn.Close() }()
-
-	// The greeting buffered while reading the CONNECT response must survive.
-	greeting := make([]byte, len("TUNNEL-HELLO"))
-	_, err = io.ReadFull(conn, greeting)
-	if err != nil {
-		t.Fatalf("read greeting: %v", err)
-	}
-	if string(greeting) != "TUNNEL-HELLO" {
-		t.Fatalf("greeting = %q, want TUNNEL-HELLO", greeting)
-	}
-
-	// The tunnel must round-trip bytes.
-	_, err = conn.Write([]byte("ping"))
-	if err != nil {
-		t.Fatalf("write to tunnel: %v", err)
-	}
-	echo := make([]byte, 4)
-	_, err = io.ReadFull(conn, echo)
-	if err != nil {
-		t.Fatalf("read echo: %v", err)
-	}
-	if string(echo) != "ping" {
-		t.Fatalf("echo = %q, want ping", echo)
-	}
-
-	method, host, auth := capture.get()
-	if method != http.MethodConnect {
-		t.Fatalf("proxy saw method %q, want CONNECT", method)
-	}
-	if host != "example.com:443" {
-		t.Fatalf("proxy saw target %q, want example.com:443", host)
-	}
-	wantAuth := "Basic " + base64.StdEncoding.EncodeToString([]byte("alice:s3cr3t"))
-	if auth != wantAuth {
-		t.Fatalf("proxy saw Proxy-Authorization %q, want %q", auth, wantAuth)
-	}
-}
-
-func TestDialThroughProxy_RefusedStatus(t *testing.T) {
-	l, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-	t.Cleanup(func() { _ = l.Close() })
-
-	go func() {
-		conn, err := l.Accept()
-		if err != nil {
-			return
-		}
-		defer func() { _ = conn.Close() }()
-		br := bufio.NewReader(conn)
-		_, _ = http.ReadRequest(br)
-		_, _ = conn.Write([]byte("HTTP/1.1 407 Proxy Authentication Required\r\n\r\n"))
-	}()
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	_, err = DialThroughProxy(ctx, &url.URL{Scheme: "http", Host: l.Addr().String()}, "example.com:443", func(ctx context.Context, network, addr string) (net.Conn, error) {
-		var d net.Dialer
-		return d.DialContext(ctx, network, addr)
-	})
-	if err == nil {
-		t.Fatal("expected an error when the proxy refuses CONNECT, got nil")
-	}
-}

pkg/gotenberg/outbound_test.go

@@ -1,489 +0,0 @@
-package gotenberg
-
-import (
-	"context"
-	"errors"
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/dlclark/regexp2"
-)
-
-func TestIsPublicIP(t *testing.T) {
-	for _, tc := range []struct {
-		addr   string
-		public bool
-	}{
-		// Public.
-		{"1.1.1.1", true},
-		{"8.8.8.8", true},
-		{"2606:4700:4700::1111", true},
-
-		// Loopback.
-		{"127.0.0.1", false},
-		{"127.255.255.254", false},
-		{"::1", false},
-
-		// IPv4-mapped IPv6 (Issue 2).
-		{"::ffff:127.0.0.1", false},
-		{"::ffff:10.0.0.1", false},
-		{"::ffff:169.254.169.254", false},
-
-		// RFC1918.
-		{"10.0.0.1", false},
-		{"172.16.0.1", false},
-		{"172.31.255.254", false},
-		{"192.168.1.1", false},
-
-		// Link-local.
-		{"169.254.169.254", false},
-		{"fe80::1", false},
-
-		// Unique-local.
-		{"fc00::1", false},
-		{"fd12:3456:789a::1", false},
-
-		// Unspecified.
-		{"0.0.0.0", false},
-		{"::", false},
-
-		// Multicast.
-		{"224.0.0.1", false},
-		{"ff02::1", false},
-
-		// 6to4 wrapping internal/private IPv4 (RFC 3056, deprecated by
-		// RFC 7526). a9fe:a9fe = 169.254.169.254 (cloud metadata).
-		{"2002:a9fe:a9fe::", false},
-		{"2002:0a00:0001::", false},
-		{"2002:c0a8:0101::", false},
-
-		// 6to4 wrapping a public IPv4 (8.8.8.8) is rejected wholesale.
-		{"2002:0808:0808::", false},
-
-		// NAT64 well-known prefix (RFC 6052).
-		{"64:ff9b::a9fe:a9fe", false},
-		{"64:ff9b::0808:0808", false},
-
-		// NAT64 local-use prefix (RFC 8215).
-		{"64:ff9b:1::a9fe:a9fe", false},
-
-		// Teredo (RFC 4380).
-		{"2001:0:abcd:ef12:3456:7890:a9fe:a9fe", false},
-
-		// Deprecated site-local (RFC 3879).
-		{"fec0::1", false},
-		{"feff:ffff:ffff:ffff:ffff:ffff:ffff:ffff", false},
-
-		// IPv4-compatible IPv6 (deprecated, not handled by Unmap).
-		{"::a9fe:a9fe", false},
-
-		// Documentation prefix (RFC 3849).
-		{"2001:db8::1", false},
-
-		// Discard prefix (RFC 6666).
-		{"100::1", false},
-	} {
-		t.Run(tc.addr, func(t *testing.T) {
-			addr, err := netip.ParseAddr(tc.addr)
-			if err != nil {
-				t.Fatalf("parse %q: %v", tc.addr, err)
-			}
-			if got := IsPublicIP(addr); got != tc.public {
-				t.Fatalf("IsPublicIP(%q) = %v, want %v", tc.addr, got, tc.public)
-			}
-		})
-	}
-}
-
-// stubResolver lets tests fake DNS lookups in [ResolveAndCheckPublic].
-type stubResolver struct {
-	lookup func(host string) ([]netip.Addr, error)
-}
-
-func (s stubResolver) LookupNetIP(_ context.Context, _, host string) ([]netip.Addr, error) {
-	return s.lookup(host)
-}
-
-func withStubResolver(t *testing.T, fn func(host string) ([]netip.Addr, error)) {
-	t.Helper()
-	prev := outboundResolver
-	outboundResolver = stubResolver{lookup: fn}
-	t.Cleanup(func() { outboundResolver = prev })
-}
-
-func mustAddrs(t *testing.T, ss ...string) []netip.Addr {
-	t.Helper()
-	out := make([]netip.Addr, 0, len(ss))
-	for _, s := range ss {
-		a, err := netip.ParseAddr(s)
-		if err != nil {
-			t.Fatalf("parse %q: %v", s, err)
-		}
-		out = append(out, a)
-	}
-	return out
-}
-
-func TestFilterOutboundURL(t *testing.T) {
-	defaultDeny := []*regexp2.Regexp{
-		regexp2.MustCompile(`^https?://(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.|0\.0\.0\.0|127\.|localhost|\[::1\]|\[fd)`, 0),
-	}
-	chromiumDeny := []*regexp2.Regexp{
-		regexp2.MustCompile(`^file:(?!//\/tmp/).*`, 0),
-	}
-
-	for _, tc := range []struct {
-		scenario     string
-		rawURL       string
-		allow        []*regexp2.Regexp
-		deny         []*regexp2.Regexp
-		opts         []DecideOption
-		stub         func(host string) ([]netip.Addr, error)
-		expectErr    bool
-		expectIs     error
-		expectErrMsg string
-	}{
-		{
-			scenario:  "public IP literal passes",
-			rawURL:    "https://1.1.1.1/",
-			deny:      defaultDeny,
-			expectErr: false,
-		},
-		{
-			scenario:  "loopback IP literal blocked by default deny-list",
-			rawURL:    "http://127.0.0.1:8080/",
-			deny:      defaultDeny,
-			expectErr: true,
-			expectIs:  ErrFiltered,
-		},
-		{
-			scenario:  "Issue 4: uppercase scheme normalized then blocked by deny-list",
-			rawURL:    "HTTP://127.0.0.1:8080/",
-			deny:      defaultDeny,
-			expectErr: true,
-			expectIs:  ErrFiltered,
-		},
-		{
-			scenario:  "Issue 2: IPv4-mapped IPv6 evades deny-list but blocked by IP check",
-			rawURL:    "http://[::ffff:127.0.0.1]:8080/page.pdf",
-			deny:      defaultDeny,
-			opts:      []DecideOption{WithDenyPrivateIPs(true)},
-			expectErr: true,
-			expectIs:  ErrFiltered,
-		},
-		{
-			scenario:  "Issue 2: IPv4-mapped IPv6 to RFC1918 blocked by IP check",
-			rawURL:    "http://[::ffff:10.0.0.1]/",
-			deny:      defaultDeny,
-			opts:      []DecideOption{WithDenyPrivateIPs(true)},
-			expectErr: true,
-			expectIs:  ErrFiltered,
-		},
-		{
-			scenario:  "hostname resolving to public IP passes with deny-private-ips",
-			rawURL:    "https://example.com/",
-			deny:      defaultDeny,
-			opts:      []DecideOption{WithDenyPrivateIPs(true)},
-			stub:      func(string) ([]netip.Addr, error) { return mustAddrs(t, "93.184.216.34"), nil },
-			expectErr: false,
-		},
-		{
-			scenario:  "hostname resolving to loopback blocked with deny-private-ips",
-			rawURL:    "https://rebind.example/",
-			deny:      defaultDeny,
-			opts:      []DecideOption{WithDenyPrivateIPs(true)},
-			stub:      func(string) ([]netip.Addr, error) { return mustAddrs(t, "127.0.0.1"), nil },
-			expectErr: true,
-			expectIs:  ErrFiltered,
-		},
-		{
-			scenario:  "hostname resolving to mixed public+private blocked with deny-private-ips",
-			rawURL:    "https://mixed.example/",
-			deny:      defaultDeny,
-			opts:      []DecideOption{WithDenyPrivateIPs(true)},
-			stub:      func(string) ([]netip.Addr, error) { return mustAddrs(t, "1.1.1.1", "10.0.0.1"), nil },
-			expectErr: true,
-			expectIs:  ErrFiltered,
-		},
-		{
-			scenario:  "allow-list match bypasses IP check",
-			rawURL:    "http://internal.service/api",
-			allow:     []*regexp2.Regexp{regexp2.MustCompile(`^http://internal\.service`, 0)},
-			deny:      defaultDeny,
-			opts:      []DecideOption{WithDenyPrivateIPs(true)},
-			expectErr: false,
-		},
-		{
-			scenario:  "deny-list still wins over allow-list match",
-			rawURL:    "http://internal.service/api",
-			allow:     []*regexp2.Regexp{regexp2.MustCompile(`^http://internal`, 0)},
-			deny:      []*regexp2.Regexp{regexp2.MustCompile(`/api$`, 0)},
-			expectErr: true,
-			expectIs:  ErrFiltered,
-		},
-		{
-			scenario:  "allow-list non-empty and no match rejects",
-			rawURL:    "https://other.example/",
-			allow:     []*regexp2.Regexp{regexp2.MustCompile(`^https://allowed\.example`, 0)},
-			expectErr: true,
-			expectIs:  ErrFiltered,
-		},
-		{
-			scenario:  "file:// allowed under tmp passes Chromium default",
-			rawURL:    "file:///tmp/index.html",
-			deny:      chromiumDeny,
-			expectErr: false,
-		},
-		{
-			scenario:  "file:// outside tmp blocked by Chromium default",
-			rawURL:    "file:///etc/passwd",
-			deny:      chromiumDeny,
-			expectErr: true,
-			expectIs:  ErrFiltered,
-		},
-		{
-			scenario:  "Chromium default permissive passes http to public host",
-			rawURL:    "https://example.com/",
-			deny:      chromiumDeny,
-			stub:      func(string) ([]netip.Addr, error) { return mustAddrs(t, "93.184.216.34"), nil },
-			expectErr: false,
-		},
-		{
-			scenario:  "Chromium with deny-private-ips blocks http to loopback",
-			rawURL:    "http://127.0.0.1:3000/health",
-			deny:      chromiumDeny,
-			opts:      []DecideOption{WithDenyPrivateIPs(true)},
-			expectErr: true,
-			expectIs:  ErrFiltered,
-		},
-		{
-			scenario:  "Chromium with deny-private-ips blocks cloud metadata",
-			rawURL:    "http://169.254.169.254/latest/meta-data/",
-			deny:      chromiumDeny,
-			opts:      []DecideOption{WithDenyPrivateIPs(true)},
-			expectErr: true,
-			expectIs:  ErrFiltered,
-		},
-		{
-			scenario:  "data: URL passes (non-network scheme)",
-			rawURL:    "data:text/html;base64,PGgxPmhpPC9oMT4=",
-			expectErr: false,
-		},
-		{
-			scenario:  "URL with no host rejected",
-			rawURL:    "http:///path",
-			expectErr: true,
-			expectIs:  ErrFiltered,
-		},
-		{
-			scenario:  "userinfo cannot mask host when deny-private-ips enabled",
-			rawURL:    "http://example.com@127.0.0.1/",
-			deny:      defaultDeny,
-			opts:      []DecideOption{WithDenyPrivateIPs(true)},
-			expectErr: true,
-			expectIs:  ErrFiltered,
-		},
-	} {
-		t.Run(tc.scenario, func(t *testing.T) {
-			if tc.stub != nil {
-				withStubResolver(t, tc.stub)
-			} else {
-				// Default: any DNS lookup in a non-stubbed test is a bug.
-				withStubResolver(t, func(host string) ([]netip.Addr, error) {
-					t.Fatalf("unexpected DNS lookup for %q", host)
-					return nil, nil
-				})
-			}
-
-			err := FilterOutboundURL(context.Background(), tc.rawURL, tc.allow, tc.deny, time.Now().Add(5*time.Second), tc.opts...)
-
-			if tc.expectErr && err == nil {
-				t.Fatalf("expected error, got nil")
-			}
-			if !tc.expectErr && err != nil {
-				t.Fatalf("expected no error, got: %v", err)
-			}
-			if tc.expectIs != nil && !errors.Is(err, tc.expectIs) {
-				t.Fatalf("expected error to wrap %v, got: %v", tc.expectIs, err)
-			}
-		})
-	}
-}
-
-func TestResolveAndCheckPublic_IPLiteralLoopback(t *testing.T) {
-	withStubResolver(t, func(host string) ([]netip.Addr, error) {
-		t.Fatalf("unexpected DNS lookup for %q", host)
-		return nil, nil
-	})
-
-	_, err := ResolveAndCheckPublic(context.Background(), "127.0.0.1")
-	if !errors.Is(err, ErrNonPublicIP) {
-		t.Fatalf("expected ErrNonPublicIP, got: %v", err)
-	}
-}
-
-func TestResolveAndCheckPublic_HostResolvesToLoopback(t *testing.T) {
-	withStubResolver(t, func(host string) ([]netip.Addr, error) {
-		return mustAddrs(t, "127.0.0.1"), nil
-	})
-
-	_, err := ResolveAndCheckPublic(context.Background(), "rebind.example")
-	if !errors.Is(err, ErrNonPublicIP) {
-		t.Fatalf("expected ErrNonPublicIP, got: %v", err)
-	}
-}
-
-func TestResolveAndCheckPublic_HostResolvesToPublic(t *testing.T) {
-	withStubResolver(t, func(host string) ([]netip.Addr, error) {
-		return mustAddrs(t, "1.1.1.1"), nil
-	})
-
-	addrs, err := ResolveAndCheckPublic(context.Background(), "example.com")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if len(addrs) != 1 || addrs[0].String() != "1.1.1.1" {
-		t.Fatalf("expected [1.1.1.1], got: %v", addrs)
-	}
-}
-
-func TestDecideOutbound_DenyPrivateIPs_RejectsLoopbackLiteral(t *testing.T) {
-	withStubResolver(t, func(host string) ([]netip.Addr, error) {
-		t.Fatalf("unexpected DNS lookup for %q", host)
-		return nil, nil
-	})
-
-	_, err := DecideOutbound(
-		context.Background(),
-		"http://127.0.0.1:8080/",
-		nil, nil,
-		time.Now().Add(5*time.Second),
-		WithDenyPrivateIPs(true),
-	)
-	if !errors.Is(err, ErrFiltered) {
-		t.Fatalf("WithDenyPrivateIPs(true) must reject loopback literal, got: %v", err)
-	}
-}
-
-func TestDecideOutbound_DenyPrivateIPs_AllowsPublic(t *testing.T) {
-	withStubResolver(t, func(host string) ([]netip.Addr, error) {
-		return mustAddrs(t, "93.184.216.34"), nil
-	})
-
-	decision, err := DecideOutbound(
-		context.Background(),
-		"http://example.com/",
-		nil, nil,
-		time.Now().Add(5*time.Second),
-		WithDenyPrivateIPs(true),
-	)
-	if err != nil {
-		t.Fatalf("expected no error for public host, got: %v", err)
-	}
-	if len(decision.Pinned) != 1 || decision.Pinned[0].String() != "93.184.216.34" {
-		t.Fatalf("decision.Pinned = %v, want [93.184.216.34]", decision.Pinned)
-	}
-}
-
-func TestDecideOutbound_DenyPublicIPs_RejectsPublic(t *testing.T) {
-	withStubResolver(t, func(host string) ([]netip.Addr, error) {
-		return mustAddrs(t, "1.1.1.1"), nil
-	})
-
-	_, err := DecideOutbound(
-		context.Background(),
-		"http://example.com/",
-		nil, nil,
-		time.Now().Add(5*time.Second),
-		WithDenyPublicIPs(true),
-	)
-	if !errors.Is(err, ErrFiltered) {
-		t.Fatalf("WithDenyPublicIPs(true) must reject public host, got: %v", err)
-	}
-}
-
-func TestDecideOutbound_DenyPublicIPs_AllowsPrivate(t *testing.T) {
-	withStubResolver(t, func(host string) ([]netip.Addr, error) {
-		return mustAddrs(t, "10.0.0.5"), nil
-	})
-
-	decision, err := DecideOutbound(
-		context.Background(),
-		"http://internal.svc/",
-		nil, nil,
-		time.Now().Add(5*time.Second),
-		WithDenyPublicIPs(true),
-	)
-	if err != nil {
-		t.Fatalf("expected no error for private host, got: %v", err)
-	}
-	if len(decision.Pinned) != 1 || decision.Pinned[0].String() != "10.0.0.5" {
-		t.Fatalf("decision.Pinned = %v, want [10.0.0.5]", decision.Pinned)
-	}
-}
-
-func TestDecideOutbound_DenyBoth_WhitelistOnly(t *testing.T) {
-	withStubResolver(t, func(host string) ([]netip.Addr, error) {
-		return mustAddrs(t, "1.1.1.1"), nil
-	})
-
-	// Both denies active and no allow-list match: every resolved address
-	// fails. Only an allow-list match can permit a destination under
-	// this posture.
-	_, err := DecideOutbound(
-		context.Background(),
-		"http://example.com/",
-		nil, nil,
-		time.Now().Add(5*time.Second),
-		WithDenyPrivateIPs(true),
-		WithDenyPublicIPs(true),
-	)
-	if !errors.Is(err, ErrFiltered) {
-		t.Fatalf("expected ErrFiltered with both denies enabled, got: %v", err)
-	}
-}
-
-func TestDecideOutbound_DenyLists_WinOverDenyPrivateIPs(t *testing.T) {
-	withStubResolver(t, func(host string) ([]netip.Addr, error) {
-		t.Fatalf("unexpected DNS lookup for %q", host)
-		return nil, nil
-	})
-
-	// The regex deny-list fires before any resolution; verifies that
-	// operator-supplied deny patterns remain effective regardless of
-	// IP-class options.
-	deny := []*regexp2.Regexp{regexp2.MustCompile(`^http://evil\.`, 0)}
-
-	_, err := DecideOutbound(
-		context.Background(),
-		"http://evil.local/",
-		nil, deny,
-		time.Now().Add(5*time.Second),
-		WithDenyPrivateIPs(true),
-	)
-	if !errors.Is(err, ErrFiltered) {
-		t.Fatalf("deny-list must still reject, got: %v", err)
-	}
-}
-
-func TestDecideOutbound_Permissive_AllowsPrivate(t *testing.T) {
-	withStubResolver(t, func(host string) ([]netip.Addr, error) {
-		return mustAddrs(t, "10.0.0.5"), nil
-	})
-
-	// No options passed: default posture is permissive across both
-	// IP classes. The caller still gets pinned IPs for dial safety.
-	decision, err := DecideOutbound(
-		context.Background(),
-		"http://internal.svc/",
-		nil, nil,
-		time.Now().Add(5*time.Second),
-	)
-	if err != nil {
-		t.Fatalf("permissive default must allow private host, got: %v", err)
-	}
-	if len(decision.Pinned) != 1 || decision.Pinned[0].String() != "10.0.0.5" {
-		t.Fatalf("decision.Pinned = %v, want [10.0.0.5]", decision.Pinned)
-	}
-}

pkg/gotenberg/pdfengine.go

@@ -27,18 +27,6 @@ var (
 	// ErrPdfEncryptionNotSupported is returned when encryption
 	// is not supported by the PDF engine.
 	ErrPdfEncryptionNotSupported = errors.New("encryption not supported")
-
-	// ErrPdfStampSourceNotSupported is returned when a stamp source type
-	// is not supported by the PDF engine.
-	ErrPdfStampSourceNotSupported = errors.New("stamp source not supported")
-
-	// ErrPdfRotateAngleNotSupported is returned when the rotation angle is
-	// not supported.
-	ErrPdfRotateAngleNotSupported = errors.New("rotation angle not supported")
-
-	// ErrPdfFacturXValueNotSupported is returned when a Factur-X field value
-	// (e.g., an unknown conformance level or document type) is not supported.
-	ErrPdfFacturXValueNotSupported = errors.New("Factur-X value not supported")
 )
 
 // PdfEngineInvalidArgsError represents an error returned by a PDF engine when
@@ -60,33 +48,6 @@ func NewPdfEngineInvalidArgs(engine, msg string) error {
 	return &PdfEngineInvalidArgsError{engine, msg}
 }
 
-const (
-	// StampSourceText represents a text-based stamp source.
-	StampSourceText string = "text"
-
-	// StampSourceImage represents an image-based stamp source.
-	StampSourceImage string = "image"
-
-	// StampSourcePDF represents a PDF-based stamp source.
-	StampSourcePDF string = "pdf"
-)
-
-// Stamp gathers the data required to apply a watermark or stamp to a PDF.
-type Stamp struct {
-	// Source is one of "text", "image", or "pdf".
-	Source string
-
-	// Expression is the text content (for text source) or file path (for
-	// image/pdf source).
-	Expression string
-
-	// Pages is the optional page range to apply the stamp to.
-	Pages string
-
-	// Options holds engine-specific styling options.
-	Options map[string]string
-}
-
 const (
 	// SplitModeIntervals represents a mode where a PDF is split at specific
 	// intervals.
@@ -147,117 +108,6 @@ type PdfFormats struct {
 	PdfUa bool
 }
 
-// PdfPermissions gathers the document permissions enforced when a PDF is
-// encrypted. Each field defaults to true (the action is allowed); set a field
-// to false to restrict it. Restrictions are advisory: viewers honor them, but
-// they are not cryptographically enforced once the document opens.
-type PdfPermissions struct {
-	// AllowPrinting permits printing the document.
-	AllowPrinting bool
-
-	// AllowCopying permits extracting text and graphics.
-	AllowCopying bool
-
-	// AllowModifying permits changing the document content.
-	AllowModifying bool
-
-	// AllowAnnotating permits adding or modifying annotations.
-	AllowAnnotating bool
-
-	// AllowFillingForms permits filling in form fields.
-	AllowFillingForms bool
-
-	// AllowAssembling permits inserting, deleting, and rotating pages.
-	AllowAssembling bool
-}
-
-// Restricted reports whether at least one permission is denied.
-func (p PdfPermissions) Restricted() bool {
-	return !p.AllowPrinting ||
-		!p.AllowCopying ||
-		!p.AllowModifying ||
-		!p.AllowAnnotating ||
-		!p.AllowFillingForms ||
-		!p.AllowAssembling
-}
-
-// EncryptOptions gathers the parameters for encrypting a PDF. An empty
-// UserPassword with a set OwnerPassword produces an owner-only document: it
-// opens without a password but enforces the [PdfPermissions].
-type EncryptOptions struct {
-	// UserPassword is required to open the document. Empty means no open
-	// password.
-	UserPassword string
-
-	// OwnerPassword grants full access (lifts the permission restrictions).
-	// When empty, it defaults to UserPassword.
-	OwnerPassword string
-
-	// Permissions are the actions allowed when opened with the user password.
-	Permissions PdfPermissions
-}
-
-// Bookmark represents a node in the PDF document's outline
-// (table of contents).
-type Bookmark struct {
-	Title    string     `json:"title"`
-	Page     int        `json:"page"`
-	Children []Bookmark `json:"children,omitempty"`
-}
-
-const (
-	// FacturXConformanceMinimum represents the MINIMUM Factur-X conformance level.
-	FacturXConformanceMinimum string = "MINIMUM"
-
-	// FacturXConformanceBasicWL represents the BASIC WL Factur-X conformance level.
-	FacturXConformanceBasicWL string = "BASIC WL"
-
-	// FacturXConformanceBasic represents the BASIC Factur-X conformance level.
-	FacturXConformanceBasic string = "BASIC"
-
-	// FacturXConformanceEN16931 represents the EN 16931 Factur-X conformance level.
-	FacturXConformanceEN16931 string = "EN 16931"
-
-	// FacturXConformanceExtended represents the EXTENDED Factur-X conformance level.
-	FacturXConformanceExtended string = "EXTENDED"
-
-	// FacturXConformanceXRechnung represents the XRECHNUNG Factur-X conformance level.
-	FacturXConformanceXRechnung string = "XRECHNUNG"
-
-	// FacturXDocumentTypeInvoice represents the INVOICE Factur-X document type.
-	FacturXDocumentTypeInvoice string = "INVOICE"
-
-	// FacturXDocumentTypeOrder represents the ORDER Factur-X document type.
-	FacturXDocumentTypeOrder string = "ORDER"
-
-	// FacturXDocumentTypeOrderResponse represents the ORDER_RESPONSE Factur-X document type.
-	FacturXDocumentTypeOrderResponse string = "ORDER_RESPONSE"
-
-	// FacturXDocumentTypeOrderChange represents the ORDER_CHANGE Factur-X document type.
-	FacturXDocumentTypeOrderChange string = "ORDER_CHANGE"
-
-	// FacturXDocumentFileName is the canonical name of the embedded XML invoice
-	// mandated by the Factur-X standard. Validators expect this exact name.
-	FacturXDocumentFileName string = "factur-x.xml"
-)
-
-// FacturX gathers the properties required by the Factur-X/ZUGFeRD standard for
-// the document-level XMP metadata packet of a PDF/A-3.
-type FacturX struct {
-	// ConformanceLevel is one of the FacturXConformance* values.
-	ConformanceLevel string
-
-	// DocumentType is one of the FacturXDocumentType* values.
-	DocumentType string
-
-	// DocumentFileName is the name of the embedded XML invoice. It is set
-	// internally to the canonical [FacturXDocumentFileName], not by the caller.
-	DocumentFileName string
-
-	// Version is the Factur-X version (e.g., "1.0").
-	Version string
-}
-
 // PdfEngine provides an interface for operations on PDFs. Implementations
 // can use various tools like PDFtk, or implement functionality directly in
 // Go.
@@ -284,57 +134,18 @@ type PdfEngine interface {
 	// ReadMetadata extracts the metadata of a given PDF file.
 	ReadMetadata(ctx context.Context, logger *slog.Logger, inputPath string) (map[string]any, error)
 
-	// PageCount returns the number of pages in a PDF file.
-	PageCount(ctx context.Context, logger *slog.Logger, inputPath string) (int, error)
-
 	// WriteMetadata writes the metadata into a given PDF file.
 	WriteMetadata(ctx context.Context, logger *slog.Logger, metadata map[string]any, inputPath string) error
 
-	// ReadBookmarks reads the document outline (bookmarks) of a PDF file.
-	ReadBookmarks(ctx context.Context, logger *slog.Logger, inputPath string) ([]Bookmark, error)
+	// Encrypt adds password protection to a PDF file.
+	// The userPassword is required to open the document.
+	// The ownerPassword provides full access to the document.
+	// If the ownerPassword is empty, it defaults to the userPassword.
+	Encrypt(ctx context.Context, logger *slog.Logger, inputPath, userPassword, ownerPassword string) error
 
-	// WriteBookmarks adds a document outline (bookmarks) to a PDF file.
-	// The bookmarks parameter represents the hierarchical tree of the outline.
-	WriteBookmarks(ctx context.Context, logger *slog.Logger, inputPath string, bookmarks []Bookmark) error
-
-	// Encrypt adds password protection and permission restrictions to a PDF
-	// file, as described by [EncryptOptions]. An empty user password with a set
-	// owner password yields an owner-only document (opens without a password,
-	// permissions enforced).
-	Encrypt(ctx context.Context, logger *slog.Logger, inputPath string, opts EncryptOptions) error
-
-	// EmbedFiles embeds files into a PDF. All files are embedded as file attachments
-	// without modifying the main PDF content.
-	// TODO: attachments instead? Rename the route?
-	EmbedFiles(ctx context.Context, logger *slog.Logger, filePaths []string, inputPath string) error
-
-	// EmbedFilesMetadata sets metadata (such as MIME type and AFRelationship)
-	// on already-embedded files in a PDF. The metadata map is keyed by
-	// filename, with each value being a map of property names to values
-	// (e.g., "mimeType" and "relationship").
-	EmbedFilesMetadata(ctx context.Context, logger *slog.Logger, metadata map[string]map[string]string, inputPath string) error
-
-	// Watermark applies a watermark (behind page content) to a PDF file.
-	Watermark(ctx context.Context, logger *slog.Logger, inputPath string, stamp Stamp) error
-
-	// Stamp applies a stamp (on top of page content) to a PDF file.
-	Stamp(ctx context.Context, logger *slog.Logger, inputPath string, stamp Stamp) error
-
-	// Rotate rotates pages of a PDF file by the given angle (90, 180, 270).
-	// If pages is empty, all pages are rotated.
-	Rotate(ctx context.Context, logger *slog.Logger, inputPath string, angle int, pages string) error
-
-	// InjectFacturXXMP injects Factur-X/ZUGFeRD XMP metadata into the
-	// document-level XMP packet (Catalog /Metadata stream) of a PDF/A-3. It
-	// registers the fx namespace, the four fx properties, and the matching
-	// PDF/A extension schema so the result stays PDF/A-valid.
-	InjectFacturXXMP(ctx context.Context, logger *slog.Logger, facturX FacturX, inputPath string) error
-
-	// ReadPdfAConformance reads the PDF/A part and conformance (e.g., "3" and
-	// "B") from the document-level XMP packet (Catalog /Metadata stream,
-	// pdfaid:part and pdfaid:conformance). It returns empty strings when the
-	// document carries no PDF/A identification.
-	ReadPdfAConformance(ctx context.Context, logger *slog.Logger, inputPath string) (part string, conformance string, err error)
+	// AddAttachments adds attachments into a PDF. All files are attached as
+	// file attachments without modifying the main PDF content.
+	AddAttachments(ctx context.Context, logger *slog.Logger, filePaths []string, inputPath string) error
 }
 
 // PdfEngineProvider offers an interface to instantiate a [PdfEngine].

pkg/gotenberg/semconv/doc.go

@@ -1,5 +1,7 @@
-// Package semconv contains utilities not yet exposed in the OpenTelemetry Go
-// SDK. Remove this package once an official API exists.
+// Package semconv is a copy/paste of utilities that are currently not exposed
+// in the OpenTelemery Go SDK.
 //
-// See https://github.com/open-telemetry/opentelemetry-go-contrib/issues/4580.
+// This package MUST be removed once an "official" API is provided.
+//
+// See: https://github.com/open-telemetry/opentelemetry-go-contrib/issues/4580.
 package semconv

pkg/gotenberg/supervisor.go

@@ -7,11 +7,6 @@ import (
 	"log/slog"
 	"sync"
 	"sync/atomic"
-	"time"
-
-	"go.opentelemetry.io/otel/attribute"
-	"go.opentelemetry.io/otel/codes"
-	"go.opentelemetry.io/otel/trace"
 )
 
 // ErrProcessAlreadyRestarting happens if the [ProcessSupervisor] is trying
@@ -58,9 +53,9 @@ type ProcessSupervisor interface {
 
 	// Healthy checks and returns the health status of the managed [Process].
 	//
-	// A non-started process is considered healthy (startup is deferred until
-	// the first request). Returns false if the process is currently restarting
-	// or is reported unhealthy by the underlying [Process].
+	// If the process has not been started or is restarting, it is considered
+	// healthy and true is returned. Otherwise, it returns the health status of
+	// the actual process.
 	Healthy() bool
 
 	// Run executes a provided task while managing the state of the [Process].
@@ -75,89 +70,44 @@ type ProcessSupervisor interface {
 	// ReqQueueSize returns the current size of the request queue.
 	ReqQueueSize() int64
 
-	// RestartsCount returns the current number of restart.
-	RestartsCount() int64
-
 	// ActiveTasksCount returns the current number of active tasks.
 	ActiveTasksCount() int64
 
-	// ConversionsSinceRestart returns the number of tasks handled since the
-	// last process (re)start.
-	ConversionsSinceRestart() int64
+	// RestartsCount returns the current number of restart.
+	RestartsCount() int64
 }
 
-// healthCheckCacheTTL caches successful health probe results so kubelet-
-// style probes (liveness + readiness, every few seconds each) do not
-// hammer the underlying process with CDP roundtrips on every call.
-// Tuned to bridge typical probe periods while still catching outages
-// quickly: a real outage surfaces on the next probe after the TTL
-// elapses.
-const healthCheckCacheTTL = 2 * time.Second
-
-// healthFailureThreshold is the number of consecutive Healthy() failures
-// the supervisor tolerates before reporting unhealthy. Absorbs single-
-// probe blips of transient CDP latency (for example a slow
-// Browser.getVersion roundtrip when several conversion slots are
-// simultaneously stuck), without delaying detection of a real outage.
-// The container orchestrator's own failureThreshold stacks on top of
-// this. See https://github.com/gotenberg/gotenberg/issues/1561.
-const healthFailureThreshold = 2
-
 type processSupervisor struct {
-	logger         *slog.Logger
-	engine         string
-	process        Process
-	maxReqLimit    int64
-	maxQueueSize   int64
-	maxConcurrency int64
-	semaphore      chan struct{}
-	firstStart     atomic.Bool
-	// firstStartMu serializes lazy-launch attempts so concurrent callers do
-	// not all spawn Launch() simultaneously. Using a mutex (instead of
-	// sync.Once) lets a failed launch be retried by the next caller, since a
-	// transient failure (such as a cold-start timeout) must not poison the
-	// supervisor for the rest of the container's lifetime. See
-	// https://github.com/gotenberg/gotenberg/issues/1538.
-	firstStartMu        sync.Mutex
-	reqCounter          atomic.Int64
-	reqQueueSize        atomic.Int64
-	restartsCounter     atomic.Int64
-	isRestarting        atomic.Bool
-	activeTasks         atomic.Int64
-	restartMutex        sync.Mutex
-	idleShutdownTimeout time.Duration
-	lastActivity        atomic.Int64 // unix nano timestamp of last completed task
-	// healthMu serializes Healthy() probes so concurrent callers do not
-	// all issue a CDP roundtrip; the second caller hits the refreshed
-	// cache instead.
-	healthMu                  sync.Mutex
-	lastHealthyAt             atomic.Int64  // unix nano of last successful probe; 0 means never
-	consecutiveHealthFailures atomic.Int64  // reset to 0 on every successful probe
-	idleMu                    sync.Mutex    // protects idleStopChan
-	idleStopChan              chan struct{} // signal to stop the idle ticker goroutine
+	logger          *slog.Logger
+	process         Process
+	maxReqLimit     int64
+	maxQueueSize    int64
+	maxConcurrency  int64
+	semaphore       chan struct{}
+	firstStart      atomic.Bool
+	firstStartOnce  sync.Once
+	firstStartErr   error
+	reqCounter      atomic.Int64
+	reqQueueSize    atomic.Int64
+	restartsCounter atomic.Int64
+	isRestarting    atomic.Bool
+	activeTasks     atomic.Int64
+	restartMutex    sync.Mutex
 }
 
-// NewProcessSupervisor initializes a new [ProcessSupervisor]. engine names the
-// managed process (for example "chromium" or "libreoffice") and prefixes the
-// telemetry sub-spans; an empty engine falls back to "process".
-func NewProcessSupervisor(logger *slog.Logger, engine string, process Process, maxReqLimit, maxQueueSize, maxConcurrency int64, idleShutdownTimeout time.Duration) ProcessSupervisor {
+// NewProcessSupervisor initializes a new [ProcessSupervisor].
+func NewProcessSupervisor(logger *slog.Logger, process Process, maxReqLimit, maxQueueSize, maxConcurrency int64) ProcessSupervisor {
 	if maxConcurrency < 1 {
 		maxConcurrency = 1
 	}
 
-	if engine == "" {
-		engine = "process"
-	}
-
 	b := &processSupervisor{
-		logger:              logger,
-		engine:              engine,
-		process:             process,
-		semaphore:           make(chan struct{}, maxConcurrency),
-		maxReqLimit:         maxReqLimit,
-		maxQueueSize:        maxQueueSize,
-		maxConcurrency:      maxConcurrency,
-		idleShutdownTimeout: idleShutdownTimeout,
+		logger:         logger,
+		process:        process,
+		semaphore:      make(chan struct{}, maxConcurrency),
+		maxReqLimit:    maxReqLimit,
+		maxQueueSize:   maxQueueSize,
+		maxConcurrency: maxConcurrency,
 	}
 	b.reqCounter.Store(0)
 	b.reqQueueSize.Store(0)
@@ -176,12 +126,6 @@ func (s *processSupervisor) Launch() error {
 	}
 
 	s.firstStart.Store(true)
-
-	if s.idleShutdownTimeout > 0 {
-		s.lastActivity.Store(time.Now().UnixNano())
-		s.startIdleTicker()
-	}
-
 	s.logger.DebugContext(context.Background(), "process successfully started")
 
 	return nil
@@ -189,9 +133,6 @@ func (s *processSupervisor) Launch() error {
 
 func (s *processSupervisor) Shutdown() error {
 	s.logger.DebugContext(context.Background(), "shutdown process")
-
-	s.stopIdleTicker()
-
 	err := s.process.Stop(s.logger)
 	if err != nil {
 		return fmt.Errorf("shutdown process: %w", err)
@@ -207,9 +148,8 @@ func (s *processSupervisor) restart() error {
 
 	err := s.Shutdown()
 	if err != nil {
-		// Not necessarily critical — chances are the process is already stopped,
-		// but worth flagging in case it indicates a real issue.
-		s.logger.WarnContext(context.Background(), fmt.Sprintf("stop process before restart: %s", err))
+		// No big deal? Chances are it's already stopped.
+		s.logger.DebugContext(context.Background(), fmt.Sprintf("stop process before restart: %s", err))
 	}
 
 	err = s.Launch()
@@ -226,139 +166,117 @@ func (s *processSupervisor) restart() error {
 
 func (s *processSupervisor) Healthy() bool {
 	if !s.firstStart.Load() {
-		// A non-started process is considered healthy: Gotenberg defers
-		// process startup until the first request to keep resource usage low.
-		// Reporting unhealthy here would cause container orchestrators to
-		// restart the pod before any request arrives.
+		// A non-started process is always healthy.
 		return true
 	}
 
 	if s.isRestarting.Load() {
-		// A restarting process is not yet healthy. This gives load balancers
-		// honest information so they can avoid routing traffic to this node.
-		return false
-	}
-
-	// Cache hit: a recent probe succeeded. Skip the CDP roundtrip so probe
-	// spam does not pile commands onto a busy websocket.
-	if s.recentlyHealthy() {
+		// A restarting process is always healthy.
 		return true
 	}
 
-	// Serialize probes so concurrent callers do not all roundtrip. The
-	// second caller will see the refreshed cache (or counter) and return
-	// without re-probing.
-	s.healthMu.Lock()
-	defer s.healthMu.Unlock()
-
-	if s.recentlyHealthy() {
-		return true
-	}
-
-	if s.process.Healthy(s.logger) {
-		s.lastHealthyAt.Store(time.Now().UnixNano())
-		s.consecutiveHealthFailures.Store(0)
-		return true
-	}
-
-	if s.consecutiveHealthFailures.Add(1) < healthFailureThreshold {
-		// First failure: tolerate it. Under load, a single blown CDP
-		// timeout is more likely transient pressure than a dead process.
-		// A genuinely dead process will fail the next probe as well and
-		// flip us unhealthy then.
-		return true
-	}
-	return false
-}
-
-// recentlyHealthy reports whether a successful probe landed within
-// [healthCheckCacheTTL]. Negative results are never cached so recovery
-// from a real outage is observable on the very next probe.
-func (s *processSupervisor) recentlyHealthy() bool {
-	last := s.lastHealthyAt.Load()
-	if last == 0 {
-		return false
-	}
-	return time.Since(time.Unix(0, last)) < healthCheckCacheTTL
+	return s.process.Healthy(s.logger)
 }
 
 func (s *processSupervisor) Run(ctx context.Context, logger *slog.Logger, task func() error) error {
-	// Time spent before the task body runs: queueing, slot acquisition, lazy
-	// launch, and health checks. Ended once, when the task is about to execute.
-	_, queueSpan := Tracer().Start(ctx, s.engine+".queue.wait",
-		trace.WithSpanKind(trace.SpanKindInternal),
-	)
-	queueWaitDone := false
-	endQueueWait := func() {
-		if !queueWaitDone {
-			queueWaitDone = true
-			queueSpan.End()
-		}
-	}
-	defer endQueueWait()
-
-	// Atomically check and increment the queue size to avoid the TOCTOU race
-	// originally reported in https://github.com/gotenberg/gotenberg/issues/951.
-	for {
-		current := s.reqQueueSize.Load()
-		if s.maxQueueSize > 0 && current >= s.maxQueueSize {
-			return ErrMaximumQueueSizeExceeded
-		}
-		if s.reqQueueSize.CompareAndSwap(current, current+1) {
-			break
-		}
+	// A user reported a potential issue:
+	//
+	// "Although the counting operation is atomic, nothing prevent 2 concurrent
+	// goroutines to retrieve the same 'currentQueueSize' and to compare its
+	// value against the max limit. Then, resulting queue size would be 1 above
+	// the allowed limit."
+	//
+	// However, he was unable to actually trigger this issue, even when sending
+	// a lot of requests.
+	//
+	// For now, the best option is to consider this issue to be unlikely to
+	// happen, and keep the code as it is because it is more readable this way.
+	//
+	// See https://github.com/gotenberg/gotenberg/issues/951.
+	currentQueueSize := s.reqQueueSize.Load()
+	if s.maxQueueSize > 0 && currentQueueSize >= s.maxQueueSize {
+		return ErrMaximumQueueSizeExceeded
 	}
 
-	// Decrement when Run() returns, regardless of which path is taken
-	// (context timeout, task completion, error, etc.). This ensures the
-	// request is counted as "in the queue" for the entire duration of Run(),
-	// preventing new requests from entering while one is being processed.
-	// See https://github.com/gotenberg/gotenberg/issues/1502.
-	defer s.reqQueueSize.Add(-1)
+	s.reqQueueSize.Add(1)
 
 	for {
 		err := func() error {
-			if err := s.acquireSlot(ctx, logger); err != nil {
-				return err
-			}
+			select {
+			case s.semaphore <- struct{}{}:
+				logger.DebugContext(ctx, "process lock acquired")
 
-			s.reqCounter.Add(1)
-			s.activeTasks.Add(1)
-			semaphoreOwned := true
-
-			defer func() {
-				s.activeTasks.Add(-1)
-				if s.idleShutdownTimeout > 0 {
-					s.lastActivity.Store(time.Now().UnixNano())
-				}
-				if semaphoreOwned {
-					logger.DebugContext(ctx, "process lock released")
+				// If a restart drain is in progress, release the slot
+				// immediately so the drain can acquire it instead.
+				if s.isRestarting.Load() {
 					<-s.semaphore
+					return ErrProcessAlreadyRestarting
 				}
-			}()
 
-			if err := s.ensureStarted(ctx); err != nil {
+				s.reqQueueSize.Add(-1)
+				s.reqCounter.Add(1)
+				s.activeTasks.Add(1)
+				releaseSemaphore := true
+
+				defer func() {
+					s.activeTasks.Add(-1)
+					if releaseSemaphore {
+						logger.DebugContext(ctx, "process lock released")
+						<-s.semaphore
+					}
+				}()
+
+				if !s.firstStart.Load() {
+					s.firstStartOnce.Do(func() {
+						s.firstStartErr = s.runWithDeadline(ctx, func() error {
+							return s.Launch()
+						})
+					})
+					if s.firstStartErr != nil {
+						return fmt.Errorf("process first start: %w", s.firstStartErr)
+					}
+				}
+
+				if !s.Healthy() {
+					s.logger.DebugContext(ctx, "process is unhealthy, cannot handle task, restarting...")
+					err := s.doRestart(ctx)
+					if err != nil {
+						return fmt.Errorf("process restart before task: %w", err)
+					}
+				}
+
+				err := s.runWithDeadline(ctx, task)
+
+				if s.maxReqLimit > 0 && s.reqCounter.Load() >= s.maxReqLimit {
+					// Only one goroutine should trigger the restart.
+					if s.restartMutex.TryLock() {
+						s.logger.DebugContext(ctx, "max request limit reached, restarting eagerly...")
+						releaseSemaphore = false
+
+						go func() {
+							restartErr := s.doRestartLocked(context.Background())
+							s.restartMutex.Unlock()
+							if restartErr != nil {
+								s.logger.ErrorContext(context.Background(), fmt.Sprintf("process restart after task: %v", restartErr))
+							}
+							logger.DebugContext(context.Background(), "process lock released")
+							<-s.semaphore
+						}()
+					}
+				}
+
+				// Note: no error wrapping because it leaks on Chromium console exceptions output.
 				return err
+			case <-ctx.Done():
+				logger.DebugContext(ctx, "failed to acquire process lock before deadline")
+				s.reqQueueSize.Add(-1)
+
+				return fmt.Errorf("acquire process lock: %w", ctx.Err())
 			}
-
-			if err := s.ensureHealthy(ctx); err != nil {
-				return err
-			}
-
-			endQueueWait()
-			err := s.runWithDeadline(ctx, task)
-
-			if s.maybeRestartAfterTask(logger) {
-				semaphoreOwned = false
-			}
-
-			// Note: no error wrapping because it leaks on Chromium console exceptions output.
-			return err
 		}()
 
 		if errors.Is(err, ErrProcessAlreadyRestarting) {
 			logger.DebugContext(ctx, "process is already restarting, trying to acquire process lock again...")
-			time.Sleep(10 * time.Millisecond)
 			continue
 		}
 
@@ -367,210 +285,17 @@ func (s *processSupervisor) Run(ctx context.Context, logger *slog.Logger, task f
 	}
 }
 
-// startIdleTicker starts a background goroutine that periodically checks
-// whether the process has been idle long enough to shut down.
-func (s *processSupervisor) startIdleTicker() {
-	stopChan := make(chan struct{})
-
-	s.idleMu.Lock()
-	s.idleStopChan = stopChan
-	s.idleMu.Unlock()
-
-	go func() {
-		ticker := time.NewTicker(s.idleShutdownTimeout)
-		defer ticker.Stop()
-		for {
-			select {
-			case <-ticker.C:
-				s.maybeIdleShutdown()
-			case <-stopChan:
-				return
-			}
-		}
-	}()
-}
-
-// stopIdleTicker signals the idle ticker goroutine to exit, if one is running.
-func (s *processSupervisor) stopIdleTicker() {
-	s.idleMu.Lock()
-	defer s.idleMu.Unlock()
-
-	if s.idleStopChan != nil {
-		close(s.idleStopChan)
-		s.idleStopChan = nil
-	}
-}
-
-// maybeIdleShutdown stops the process if it has been idle for longer than
-// the configured timeout. It is safe to call concurrently with Run and
-// restart.
-func (s *processSupervisor) maybeIdleShutdown() {
-	if !s.firstStart.Load() || s.isRestarting.Load() {
-		return
-	}
-
-	if s.activeTasks.Load() > 0 || s.reqQueueSize.Load() > 0 {
-		return
-	}
-
-	lastNano := s.lastActivity.Load()
-	if lastNano == 0 || time.Since(time.Unix(0, lastNano)) < s.idleShutdownTimeout {
-		return
-	}
-
-	if !s.restartMutex.TryLock() {
-		return
-	}
-	defer s.restartMutex.Unlock()
-
-	// Double-check after acquiring the lock.
-	if s.activeTasks.Load() > 0 || s.reqQueueSize.Load() > 0 {
-		return
-	}
-
-	s.logger.DebugContext(context.Background(), "idle shutdown timeout reached, stopping process")
-
-	// Stop the ticker — it will be restarted on the next Launch().
-	s.stopIdleTicker()
-
-	err := s.process.Stop(s.logger)
-	if err != nil {
-		s.logger.WarnContext(context.Background(), fmt.Sprintf("idle shutdown: %s", err))
-		return
-	}
-
-	// Reset state so ensureStarted() re-launches on next request.
-	s.firstStart.Store(false)
-	s.reqCounter.Store(0)
-
-	s.logger.DebugContext(context.Background(), "process stopped due to idle timeout")
-}
-
-// acquireSlot attempts to acquire a semaphore slot, yielding it back if a
-// restart drain is in progress.
-func (s *processSupervisor) acquireSlot(ctx context.Context, logger *slog.Logger) error {
-	select {
-	case s.semaphore <- struct{}{}:
-		// If a restart drain is in progress, release the slot
-		// immediately so the drain can acquire it instead.
-		if s.isRestarting.Load() {
-			<-s.semaphore
-			return ErrProcessAlreadyRestarting
-		}
-
-		logger.DebugContext(ctx, "process lock acquired")
-
-		return nil
-	case <-ctx.Done():
-		logger.DebugContext(ctx, "failed to acquire process lock before deadline")
-
-		return fmt.Errorf("acquire process lock: %w", ctx.Err())
-	}
-}
-
-// ensureStarted performs a lazy launch of the process on its first use.
-// Concurrent callers serialize on firstStartMu; once the launch succeeds,
-// subsequent calls short-circuit on the firstStart flag. A failed launch
-// leaves firstStart unset, so the next caller retries the launch.
-func (s *processSupervisor) ensureStarted(ctx context.Context) error {
-	if s.firstStart.Load() {
-		return nil
-	}
-
-	s.firstStartMu.Lock()
-	defer s.firstStartMu.Unlock()
-
-	if s.firstStart.Load() {
-		return nil
-	}
-
-	err := s.tracedLaunch(ctx, "first_start", func() error {
-		return s.runWithDeadline(ctx, s.Launch)
-	})
-	if err != nil {
-		return fmt.Errorf("process first start: %w", err)
-	}
-
-	return nil
-}
-
-// tracedLaunch wraps a process (re)start in an <engine>.process.start span,
-// tagged with the reason that triggered it. The eager restart after the maximum
-// request limit runs on a background context, so its span is a detached root.
-func (s *processSupervisor) tracedLaunch(ctx context.Context, reason string, launch func() error) error {
-	_, span := Tracer().Start(ctx, s.engine+".process.start",
-		trace.WithSpanKind(trace.SpanKindInternal),
-		trace.WithAttributes(attribute.String("gotenberg.process.start.reason", reason)),
-	)
-	defer span.End()
-
-	err := launch()
-	if err != nil {
-		span.RecordError(err)
-		span.SetStatus(codes.Error, err.Error())
-		return err
-	}
-
-	span.SetStatus(codes.Ok, "")
-	return nil
-}
-
-// ensureHealthy checks the underlying process health and triggers a
-// synchronous restart if the process is unhealthy. Skips the check if a
-// restart is already in progress.
-func (s *processSupervisor) ensureHealthy(ctx context.Context) error {
-	if s.isRestarting.Load() || s.process.Healthy(s.logger) {
-		return nil
-	}
-
-	s.logger.DebugContext(context.Background(), "process is unhealthy, cannot handle task, restarting...")
-
-	if err := s.doRestart(ctx, "unhealthy"); err != nil {
-		return fmt.Errorf("process restart before task: %w", err)
-	}
-
-	return nil
-}
-
-// maybeRestartAfterTask checks if the maximum request limit has been reached
-// and, if so, triggers an asynchronous restart. If a restart is initiated, it
-// takes ownership of the caller's semaphore slot (the caller must not release
-// it). Returns true if ownership was taken.
-func (s *processSupervisor) maybeRestartAfterTask(logger *slog.Logger) bool {
-	if s.maxReqLimit <= 0 || s.reqCounter.Load() < s.maxReqLimit {
-		return false
-	}
-
-	if !s.restartMutex.TryLock() {
-		return false
-	}
-
-	s.logger.DebugContext(context.Background(), "max request limit reached, restarting eagerly...")
-
-	go func() {
-		restartErr := s.doRestartLocked(context.Background(), "max_requests")
-		s.restartMutex.Unlock()
-		if restartErr != nil {
-			s.logger.ErrorContext(context.Background(), fmt.Sprintf("process restart after task: %v", restartErr))
-		}
-		logger.DebugContext(context.Background(), "process lock released")
-		<-s.semaphore
-	}()
-
-	return true
-}
-
 // doRestart coordinates a process restart, draining all active concurrent
 // tasks before stopping and restarting the process.
-func (s *processSupervisor) doRestart(ctx context.Context, reason string) error {
+func (s *processSupervisor) doRestart(ctx context.Context) error {
 	s.restartMutex.Lock()
 	defer s.restartMutex.Unlock()
 
-	return s.doRestartLocked(ctx, reason)
+	return s.doRestartLocked(ctx)
 }
 
 // doRestartLocked performs the restart drain logic. The caller must hold restartMutex.
-func (s *processSupervisor) doRestartLocked(ctx context.Context, reason string) error {
+func (s *processSupervisor) doRestartLocked(ctx context.Context) error {
 	s.isRestarting.Store(true)
 	defer s.isRestarting.Store(false)
 
@@ -590,8 +315,8 @@ func (s *processSupervisor) doRestartLocked(ctx context.Context, reason string)
 		}
 	}
 
-	err := s.tracedLaunch(ctx, reason, func() error {
-		return s.runWithDeadline(ctx, s.restart)
+	err := s.runWithDeadline(ctx, func() error {
+		return s.restart()
 	})
 
 	for range acquired {
@@ -621,19 +346,12 @@ func (s *processSupervisor) ReqQueueSize() int64 {
 	return s.reqQueueSize.Load()
 }
 
-func (s *processSupervisor) RestartsCount() int64 {
-	return s.restartsCounter.Load()
-}
-
 func (s *processSupervisor) ActiveTasksCount() int64 {
 	return s.activeTasks.Load()
 }
 
-// ConversionsSinceRestart returns the number of tasks handled since the last
-// process (re)start. reqCounter is reset to zero on every restart and idle
-// shutdown.
-func (s *processSupervisor) ConversionsSinceRestart() int64 {
-	return s.reqCounter.Load()
+func (s *processSupervisor) RestartsCount() int64 {
+	return s.restartsCounter.Load()
 }
 
 // Interface guards.

pkg/gotenberg/supervisor_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"log/slog"
+	"os"
 	"sync"
 	"sync/atomic"
 	"testing"
@@ -37,7 +38,7 @@ func TestProcessSupervisor_Launch(t *testing.T) {
 		},
 	} {
 		t.Run(tc.scenario, func(t *testing.T) {
-			logger := slog.New(slog.DiscardHandler)
+			logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 
 			process := &ProcessMock{
 				StartMock: func(logger *slog.Logger) error {
@@ -45,7 +46,7 @@ func TestProcessSupervisor_Launch(t *testing.T) {
 				},
 			}
 
-			ps := NewProcessSupervisor(logger, "test", process, 5, 0, 1, 0).(*processSupervisor)
+			ps := NewProcessSupervisor(logger, process, 5, 0, 1).(*processSupervisor)
 			if tc.firstStartSet {
 				ps.firstStart.Store(true)
 			}
@@ -85,7 +86,7 @@ func TestProcessSupervisor_Shutdown(t *testing.T) {
 		},
 	} {
 		t.Run(tc.scenario, func(t *testing.T) {
-			logger := slog.New(slog.DiscardHandler)
+			logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 
 			process := &ProcessMock{
 				StopMock: func(logger *slog.Logger) error {
@@ -93,7 +94,7 @@ func TestProcessSupervisor_Shutdown(t *testing.T) {
 				},
 			}
 
-			ps := NewProcessSupervisor(logger, "test", process, 5, 0, 1, 0)
+			ps := NewProcessSupervisor(logger, process, 5, 0, 1)
 			err := ps.Shutdown()
 
 			if !tc.expectError && err != nil {
@@ -134,7 +135,7 @@ func TestProcessSupervisor_restart(t *testing.T) {
 		},
 	} {
 		t.Run(tc.scenario, func(t *testing.T) {
-			logger := slog.New(slog.DiscardHandler)
+			logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 
 			process := &ProcessMock{
 				StartMock: func(logger *slog.Logger) error {
@@ -145,7 +146,7 @@ func TestProcessSupervisor_restart(t *testing.T) {
 				},
 			}
 
-			ps := NewProcessSupervisor(logger, "test", process, 5, 0, 1, 0).(*processSupervisor)
+			ps := NewProcessSupervisor(logger, process, 5, 0, 1).(*processSupervisor)
 
 			err := ps.restart()
 
@@ -169,15 +170,15 @@ func TestProcessSupervisor_Healthy(t *testing.T) {
 		expectHealthy       bool
 	}{
 		{
-			scenario:         "non-started process is healthy",
+			scenario:         "non-started process is always healthy",
 			initiallyStarted: false,
 			expectHealthy:    true,
 		},
 		{
-			scenario:            "restarting process is not healthy",
+			scenario:            "restarting process is always healthy",
 			initiallyStarted:    true,
 			initiallyRestarting: true,
-			expectHealthy:       false,
+			expectHealthy:       true,
 		},
 		{
 			scenario:         "process reports as healthy",
@@ -186,14 +187,14 @@ func TestProcessSupervisor_Healthy(t *testing.T) {
 			expectHealthy:    true,
 		},
 		{
-			scenario:         "single probe failure is tolerated",
+			scenario:         "process reports as unhealthy",
 			initiallyStarted: true,
 			processHealthy:   false,
-			expectHealthy:    true,
+			expectHealthy:    false,
 		},
 	} {
 		t.Run(tc.scenario, func(t *testing.T) {
-			logger := slog.New(slog.DiscardHandler)
+			logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 
 			process := &ProcessMock{
 				HealthyMock: func(logger *slog.Logger) bool {
@@ -201,7 +202,7 @@ func TestProcessSupervisor_Healthy(t *testing.T) {
 				},
 			}
 
-			ps := NewProcessSupervisor(logger, "test", process, 5, 0, 1, 0).(*processSupervisor)
+			ps := NewProcessSupervisor(logger, process, 5, 0, 1).(*processSupervisor)
 			if tc.initiallyStarted {
 				ps.firstStart.Store(true)
 			}
@@ -218,109 +219,6 @@ func TestProcessSupervisor_Healthy(t *testing.T) {
 	}
 }
 
-// TestProcessSupervisor_Healthy_ConsecutiveFailures verifies that only
-// the second consecutive process-level failure flips the supervisor to
-// unhealthy, and that a single success in between resets the counter.
-func TestProcessSupervisor_Healthy_ConsecutiveFailures(t *testing.T) {
-	logger := slog.New(slog.DiscardHandler)
-
-	var processHealthy atomic.Bool
-	process := &ProcessMock{
-		HealthyMock: func(_ *slog.Logger) bool { return processHealthy.Load() },
-	}
-
-	ps := NewProcessSupervisor(logger, "test", process, 5, 0, 1, 0).(*processSupervisor)
-	ps.firstStart.Store(true)
-
-	processHealthy.Store(false)
-	if !ps.Healthy() {
-		t.Fatal("first failure should be tolerated and report healthy")
-	}
-	if ps.Healthy() {
-		t.Fatal("second consecutive failure should report unhealthy")
-	}
-
-	processHealthy.Store(true)
-	if !ps.Healthy() {
-		t.Fatal("recovery should report healthy immediately")
-	}
-
-	processHealthy.Store(false)
-	// Cache hit from the previous success absorbs the first new failure;
-	// invalidate it so we exercise the counter again.
-	ps.lastHealthyAt.Store(0)
-	if !ps.Healthy() {
-		t.Fatal("post-recovery first failure should be tolerated again")
-	}
-	if ps.Healthy() {
-		t.Fatal("post-recovery second consecutive failure should report unhealthy")
-	}
-}
-
-// TestProcessSupervisor_Healthy_CachesPositiveResult verifies that a
-// successful probe is cached for [healthCheckCacheTTL] so subsequent
-// supervisor.Healthy() calls do not re-issue the underlying process
-// check.
-func TestProcessSupervisor_Healthy_CachesPositiveResult(t *testing.T) {
-	logger := slog.New(slog.DiscardHandler)
-
-	var calls atomic.Int64
-	process := &ProcessMock{
-		HealthyMock: func(_ *slog.Logger) bool {
-			calls.Add(1)
-			return true
-		},
-	}
-
-	ps := NewProcessSupervisor(logger, "test", process, 5, 0, 1, 0).(*processSupervisor)
-	ps.firstStart.Store(true)
-
-	for range 5 {
-		if !ps.Healthy() {
-			t.Fatal("expected healthy")
-		}
-	}
-
-	if got := calls.Load(); got != 1 {
-		t.Fatalf("process.Healthy called %d times, want exactly 1 (cache should absorb the other 4)", got)
-	}
-}
-
-// TestProcessSupervisor_Healthy_DoesNotCacheNegativeResult verifies that
-// a probe failure is not cached: the next Healthy() call must re-issue
-// the underlying process check so a recovered process surfaces on the
-// very next probe.
-func TestProcessSupervisor_Healthy_DoesNotCacheNegativeResult(t *testing.T) {
-	logger := slog.New(slog.DiscardHandler)
-
-	var calls atomic.Int64
-	var processHealthy atomic.Bool
-	process := &ProcessMock{
-		HealthyMock: func(_ *slog.Logger) bool {
-			calls.Add(1)
-			return processHealthy.Load()
-		},
-	}
-
-	ps := NewProcessSupervisor(logger, "test", process, 5, 0, 1, 0).(*processSupervisor)
-	ps.firstStart.Store(true)
-
-	processHealthy.Store(false)
-	_ = ps.Healthy()
-	_ = ps.Healthy()
-	if got := calls.Load(); got != 2 {
-		t.Fatalf("after two failing probes, process.Healthy called %d times, want 2 (negative results must not be cached)", got)
-	}
-
-	processHealthy.Store(true)
-	if !ps.Healthy() {
-		t.Fatal("expected healthy on recovery")
-	}
-	if got := calls.Load(); got != 3 {
-		t.Fatalf("after recovery, process.Healthy called %d times, want 3", got)
-	}
-}
-
 func TestProcessSupervisor_Run(t *testing.T) {
 	for _, tc := range []struct {
 		scenario             string
@@ -467,7 +365,7 @@ func TestProcessSupervisor_Run(t *testing.T) {
 		},
 	} {
 		t.Run(tc.scenario, func(t *testing.T) {
-			logger := slog.New(slog.DiscardHandler)
+			logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 
 			var startCalls, healthyCalls, stopCalls atomic.Int64
 			startCalls.Store(0)
@@ -489,7 +387,7 @@ func TestProcessSupervisor_Run(t *testing.T) {
 				},
 			}
 
-			ps := NewProcessSupervisor(logger, "test", process, tc.maxReqLimit, tc.maxQueueSize, 1, 0).(*processSupervisor)
+			ps := NewProcessSupervisor(logger, process, tc.maxReqLimit, tc.maxQueueSize, 1).(*processSupervisor)
 			if tc.initiallyStarted {
 				ps.firstStart.Store(true)
 			}
@@ -573,7 +471,7 @@ func TestProcessSupervisor_runWithDeadline(t *testing.T) {
 		},
 	} {
 		t.Run(tc.scenario, func(t *testing.T) {
-			ps := NewProcessSupervisor(slog.New(slog.DiscardHandler), "test", new(ProcessMock), 0, 0, 1, 0).(*processSupervisor)
+			ps := NewProcessSupervisor(slog.New(slog.NewJSONHandler(os.Stdout, nil)), new(ProcessMock), 0, 0, 1).(*processSupervisor)
 
 			ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
 			if tc.ctxDone {
@@ -598,7 +496,7 @@ func TestProcessSupervisor_runWithDeadline(t *testing.T) {
 }
 
 func TestProcessSupervisor_ReqQueueSize(t *testing.T) {
-	logger := slog.New(slog.DiscardHandler)
+	logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 	process := &ProcessMock{
 		StartMock: func(logger *slog.Logger) error {
 			return nil
@@ -607,7 +505,7 @@ func TestProcessSupervisor_ReqQueueSize(t *testing.T) {
 			return true
 		},
 	}
-	ps := NewProcessSupervisor(logger, "test", process, 0, 0, 1, 0).(*processSupervisor)
+	ps := NewProcessSupervisor(logger, process, 0, 0, 1).(*processSupervisor)
 
 	// Simulating a lock.
 	ps.semaphore <- struct{}{}
@@ -654,111 +552,6 @@ func TestProcessSupervisor_ReqQueueSize(t *testing.T) {
 	}
 }
 
-func TestProcessSupervisor_QueueSizeCAS(t *testing.T) {
-	logger := slog.New(slog.DiscardHandler)
-
-	process := &ProcessMock{
-		StartMock: func(logger *slog.Logger) error {
-			return nil
-		},
-		HealthyMock: func(logger *slog.Logger) bool {
-			return true
-		},
-	}
-
-	maxQueueSize := int64(50)
-	// maxConcurrency=1 so all goroutines block on the semaphore, exercising queue logic.
-	ps := NewProcessSupervisor(logger, "test", process, 0, maxQueueSize, 1, 0).(*processSupervisor)
-
-	// Simulating a lock so that all goroutines queue up.
-	ps.semaphore <- struct{}{}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	goroutines := 100
-	var wg sync.WaitGroup
-	var exceeded atomic.Int64
-
-	for range goroutines {
-		wg.Go(func() {
-			err := ps.Run(ctx, logger, func() error {
-				return nil
-			})
-			if err != nil {
-				if errors.Is(err, ErrMaximumQueueSizeExceeded) {
-					exceeded.Add(1)
-				}
-			}
-		})
-	}
-
-	// Wait a bit for goroutines to queue up.
-	time.Sleep(50 * time.Millisecond)
-
-	currentQueue := ps.ReqQueueSize()
-	if currentQueue > maxQueueSize {
-		t.Fatalf("queue size %d exceeded max %d", currentQueue, maxQueueSize)
-	}
-
-	cancel()
-	wg.Wait()
-
-	if exceeded.Load() < int64(goroutines)-maxQueueSize {
-		t.Errorf("expected at least %d rejections, got %d", goroutines-int(maxQueueSize), exceeded.Load())
-	}
-}
-
-func TestProcessSupervisor_QueueSizeIncludesActiveTasks(t *testing.T) {
-	logger := slog.New(slog.DiscardHandler)
-
-	process := &ProcessMock{
-		StartMock: func(logger *slog.Logger) error {
-			return nil
-		},
-		HealthyMock: func(logger *slog.Logger) bool {
-			return true
-		},
-	}
-
-	// maxQueueSize=1, maxConcurrency=1: only one request at a time.
-	ps := NewProcessSupervisor(logger, "test", process, 0, 1, 1, 0)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	taskStarted := make(chan struct{})
-	taskDone := make(chan struct{})
-
-	// Start a long-running task that holds the slot.
-	var wg sync.WaitGroup
-	wg.Go(func() {
-		err := ps.Run(ctx, logger, func() error {
-			close(taskStarted)
-			<-taskDone
-			return nil
-		})
-		if err != nil {
-			t.Errorf("first task: unexpected error: %v", err)
-		}
-	})
-
-	// Wait for the first task to be running.
-	<-taskStarted
-
-	// A second request should be rejected immediately because the queue
-	// slot is still held by the active task.
-	err := ps.Run(ctx, logger, func() error {
-		return nil
-	})
-	if !errors.Is(err, ErrMaximumQueueSizeExceeded) {
-		t.Fatalf("expected ErrMaximumQueueSizeExceeded but got: %v", err)
-	}
-
-	close(taskDone)
-	wg.Wait()
-}
-
 func TestProcessSupervisor_RestartsCount(t *testing.T) {
 	for _, tc := range []struct {
 		scenario              string
@@ -800,7 +593,7 @@ func TestProcessSupervisor_RestartsCount(t *testing.T) {
 		},
 	} {
 		t.Run(tc.scenario, func(t *testing.T) {
-			logger := slog.New(slog.DiscardHandler)
+			logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 
 			process := &ProcessMock{
 				StartMock: func(logger *slog.Logger) error {
@@ -811,7 +604,7 @@ func TestProcessSupervisor_RestartsCount(t *testing.T) {
 				},
 			}
 
-			ps := NewProcessSupervisor(logger, "test", process, 0, 0, 1, 0).(*processSupervisor)
+			ps := NewProcessSupervisor(logger, process, 0, 0, 1).(*processSupervisor)
 			ps.restartsCounter.Store(tc.initialRestartsCount)
 
 			for i := 0; i < tc.restartAttempts; i++ {
@@ -827,7 +620,7 @@ func TestProcessSupervisor_RestartsCount(t *testing.T) {
 }
 
 func TestProcessSupervisor_ConcurrentRun(t *testing.T) {
-	logger := slog.New(slog.DiscardHandler)
+	logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 
 	var startCalls atomic.Int64
 	process := &ProcessMock{
@@ -844,7 +637,7 @@ func TestProcessSupervisor_ConcurrentRun(t *testing.T) {
 	}
 
 	maxConcurrency := int64(3)
-	ps := NewProcessSupervisor(logger, "test", process, 0, 0, maxConcurrency, 0).(*processSupervisor)
+	ps := NewProcessSupervisor(logger, process, 0, 0, maxConcurrency).(*processSupervisor)
 
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
@@ -891,7 +684,7 @@ func TestProcessSupervisor_ConcurrentRun(t *testing.T) {
 }
 
 func TestProcessSupervisor_RestartDrainsAllSlots(t *testing.T) {
-	logger := slog.New(slog.DiscardHandler)
+	logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 
 	process := &ProcessMock{
 		StartMock: func(logger *slog.Logger) error {
@@ -906,7 +699,7 @@ func TestProcessSupervisor_RestartDrainsAllSlots(t *testing.T) {
 	}
 
 	maxConcurrency := int64(3)
-	ps := NewProcessSupervisor(logger, "test", process, 3, 0, maxConcurrency, 0).(*processSupervisor)
+	ps := NewProcessSupervisor(logger, process, 3, 0, maxConcurrency).(*processSupervisor)
 	ps.firstStart.Store(true)
 
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
@@ -944,217 +737,3 @@ func TestProcessSupervisor_RestartDrainsAllSlots(t *testing.T) {
 		t.Fatalf("expected 1 restart, got %d", ps.RestartsCount())
 	}
 }
-
-func TestProcessSupervisor_IdleShutdown(t *testing.T) {
-	logger := slog.New(slog.DiscardHandler)
-
-	var stopCalls atomic.Int64
-	process := &ProcessMock{
-		StartMock: func(logger *slog.Logger) error {
-			return nil
-		},
-		StopMock: func(logger *slog.Logger) error {
-			stopCalls.Add(1)
-			return nil
-		},
-		HealthyMock: func(logger *slog.Logger) bool {
-			return true
-		},
-	}
-
-	idleTimeout := 50 * time.Millisecond
-	ps := NewProcessSupervisor(logger, "test", process, 0, 0, 1, idleTimeout).(*processSupervisor)
-
-	ctx := context.Background()
-	err := ps.Run(ctx, logger, func() error {
-		return nil
-	})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	// Wait for idle shutdown to fire.
-	deadline := time.After(2 * time.Second)
-	for ps.firstStart.Load() {
-		select {
-		case <-deadline:
-			t.Fatal("timed out waiting for idle shutdown")
-		default:
-			time.Sleep(10 * time.Millisecond)
-		}
-	}
-
-	if stopCalls.Load() < 1 {
-		t.Fatal("expected process to be stopped via idle shutdown")
-	}
-
-	// Verify re-launch on next request.
-	err = ps.Run(ctx, logger, func() error {
-		return nil
-	})
-	if err != nil {
-		t.Fatalf("unexpected error on re-launch: %v", err)
-	}
-
-	if !ps.firstStart.Load() {
-		t.Fatal("expected process to be re-launched after idle shutdown")
-	}
-}
-
-func TestProcessSupervisor_RetryAfterFailedFirstStart(t *testing.T) {
-	// Regression test for https://github.com/gotenberg/gotenberg/issues/1538:
-	// a failed first launch must not poison the supervisor; the next request
-	// must retry Launch() instead of returning the cached error forever.
-	logger := slog.New(slog.DiscardHandler)
-
-	var startCalls atomic.Int64
-	process := &ProcessMock{
-		StartMock: func(logger *slog.Logger) error {
-			if startCalls.Add(1) == 1 {
-				return errors.New("first start failed")
-			}
-			return nil
-		},
-		StopMock: func(logger *slog.Logger) error {
-			return nil
-		},
-		HealthyMock: func(logger *slog.Logger) bool {
-			return true
-		},
-	}
-
-	ps := NewProcessSupervisor(logger, "test", process, 0, 0, 1, 0).(*processSupervisor)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	err := ps.Run(ctx, logger, func() error { return nil })
-	if err == nil {
-		t.Fatal("expected first Run to fail because Launch failed")
-	}
-	if ps.firstStart.Load() {
-		t.Fatal("firstStart must remain false after a failed Launch")
-	}
-
-	err = ps.Run(ctx, logger, func() error { return nil })
-	if err != nil {
-		t.Fatalf("expected second Run to succeed after the supervisor retries Launch, got: %v", err)
-	}
-	if !ps.firstStart.Load() {
-		t.Fatal("expected firstStart to be set after the second Launch succeeds")
-	}
-	if got := startCalls.Load(); got != 2 {
-		t.Fatalf("expected exactly 2 Start calls, got %d", got)
-	}
-}
-
-func TestProcessSupervisor_IdleShutdownSkippedWhenActive(t *testing.T) {
-	logger := slog.New(slog.DiscardHandler)
-
-	var stopCalls atomic.Int64
-	taskRunning := make(chan struct{})
-	taskDone := make(chan struct{})
-
-	process := &ProcessMock{
-		StartMock: func(logger *slog.Logger) error {
-			return nil
-		},
-		StopMock: func(logger *slog.Logger) error {
-			stopCalls.Add(1)
-			return nil
-		},
-		HealthyMock: func(logger *slog.Logger) bool {
-			return true
-		},
-	}
-
-	idleTimeout := 50 * time.Millisecond
-	ps := NewProcessSupervisor(logger, "test", process, 0, 0, 1, idleTimeout)
-
-	ctx := context.Background()
-	go func() {
-		_ = ps.Run(ctx, logger, func() error {
-			close(taskRunning)
-			<-taskDone
-			return nil
-		})
-	}()
-
-	<-taskRunning
-
-	// Wait longer than the idle timeout while a task is active.
-	time.Sleep(idleTimeout * 3)
-
-	if stopCalls.Load() > 0 {
-		t.Fatal("idle shutdown should not fire while a task is active")
-	}
-
-	close(taskDone)
-}
-
-func TestProcessSupervisor_ConversionsSinceRestart(t *testing.T) {
-	process := &ProcessMock{
-		StartMock:   func(*slog.Logger) error { return nil },
-		StopMock:    func(*slog.Logger) error { return nil },
-		HealthyMock: func(*slog.Logger) bool { return true },
-	}
-	s := NewProcessSupervisor(slog.New(slog.DiscardHandler), "test", process, 0, 0, 1, 0).(*processSupervisor)
-
-	if got := s.ConversionsSinceRestart(); got != 0 {
-		t.Errorf("expected 0 conversions initially, got %d", got)
-	}
-
-	s.reqCounter.Store(7)
-	if got := s.ConversionsSinceRestart(); got != 7 {
-		t.Errorf("expected 7 conversions, got %d", got)
-	}
-
-	if err := s.restart(); err != nil {
-		t.Fatalf("restart: %v", err)
-	}
-	if got := s.ConversionsSinceRestart(); got != 0 {
-		t.Errorf("expected 0 conversions after restart, got %d", got)
-	}
-}
-
-func TestProcessSupervisor_RunEmitsSubSpans(t *testing.T) {
-	recorder := newTestSpanRecorder(t)
-
-	process := &ProcessMock{
-		StartMock:   func(*slog.Logger) error { return nil },
-		StopMock:    func(*slog.Logger) error { return nil },
-		HealthyMock: func(*slog.Logger) bool { return true },
-	}
-	s := NewProcessSupervisor(slog.New(slog.DiscardHandler), "chromium", process, 0, 0, 1, 0)
-
-	err := s.Run(context.Background(), slog.New(slog.DiscardHandler), func() error { return nil })
-	if err != nil {
-		t.Fatalf("run: %v", err)
-	}
-
-	var queueWaits, processStarts int
-	var startReason string
-	for _, span := range recorder.Ended() {
-		switch span.Name() {
-		case "chromium.queue.wait":
-			queueWaits++
-		case "chromium.process.start":
-			processStarts++
-			for _, kv := range span.Attributes() {
-				if string(kv.Key) == "gotenberg.process.start.reason" {
-					startReason = kv.Value.AsString()
-				}
-			}
-		}
-	}
-
-	if queueWaits != 1 {
-		t.Errorf("expected 1 chromium.queue.wait span, got %d", queueWaits)
-	}
-	if processStarts != 1 {
-		t.Errorf("expected 1 chromium.process.start span (first start), got %d", processStarts)
-	}
-	if startReason != "first_start" {
-		t.Errorf("expected process start reason first_start, got %q", startReason)
-	}
-}

pkg/gotenberg/telemetry.go

@@ -11,6 +11,7 @@ import (
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/metric"
 	"go.opentelemetry.io/otel/trace"
+	"go.uber.org/multierr"
 
 	"github.com/gotenberg/gotenberg/v8/pkg/gotenberg/internal/log"
 	internalotel "github.com/gotenberg/gotenberg/v8/pkg/gotenberg/internal/otel"
@@ -29,11 +30,6 @@ const (
 	DebugLoggingLevel = "debug"
 )
 
-const (
-	LowerLevelCase = "lower"
-	UpperLevelCase = "upper"
-)
-
 // TelemetryConfig gathers the configuration data for Gotenberg's telemetry.
 type TelemetryConfig struct {
 	ServiceName    string
@@ -43,7 +39,6 @@ type TelemetryConfig struct {
 	LogFieldsPrefix       string
 	LogStdFormat          string
 	LogStdEnableGcpFields bool
-	LogStdLevelCase       string
 }
 
 func (cfg TelemetryConfig) slogLevel() slog.Level {
@@ -60,13 +55,13 @@ func (cfg TelemetryConfig) Validate() error {
 	var err error
 
 	if cfg.ServiceName == "" {
-		err = errors.Join(err,
+		err = multierr.Append(err,
 			errors.New("service name must not be empty"),
 		)
 	}
 
 	if cfg.ServiceVersion == "" {
-		err = errors.Join(err,
+		err = multierr.Append(err,
 			errors.New("service version must not be empty"),
 		)
 	}
@@ -75,7 +70,7 @@ func (cfg TelemetryConfig) Validate() error {
 	case ErrorLoggingLevel, WarnLoggingLevel, InfoLoggingLevel, DebugLoggingLevel:
 		break
 	default:
-		err = errors.Join(
+		err = multierr.Append(
 			err,
 			fmt.Errorf("log level must be either %s, %s, %s or %s", ErrorLoggingLevel, WarnLoggingLevel, InfoLoggingLevel, DebugLoggingLevel),
 		)
@@ -85,22 +80,12 @@ func (cfg TelemetryConfig) Validate() error {
 	case AutoLoggingFormat, JsonLoggingFormat, TextLoggingFormat:
 		break
 	default:
-		err = errors.Join(
+		err = multierr.Append(
 			err,
 			fmt.Errorf("standard log format must be either %s, %s or %s", AutoLoggingFormat, JsonLoggingFormat, TextLoggingFormat),
 		)
 	}
 
-	switch cfg.LogStdLevelCase {
-	case LowerLevelCase, UpperLevelCase:
-		break
-	default:
-		err = errors.Join(
-			err,
-			fmt.Errorf("standard log level case must be either %s or %s", LowerLevelCase, UpperLevelCase),
-		)
-	}
-
 	return err
 }
 
@@ -108,7 +93,7 @@ func (cfg TelemetryConfig) Validate() error {
 func StartTelemetry(cfg TelemetryConfig) (shutdown func(context.Context) error, err error) {
 	var handlers []slog.Handler
 
-	stdHandler, err := log.NewStdHandler(cfg.slogLevel(), cfg.LogStdFormat, cfg.LogFieldsPrefix, cfg.LogStdEnableGcpFields, cfg.LogStdLevelCase)
+	stdHandler, err := log.NewStdHandler(cfg.slogLevel(), cfg.LogStdFormat, cfg.LogFieldsPrefix, cfg.LogStdEnableGcpFields)
 	if err != nil {
 		return nil, fmt.Errorf("get standard logger handler: %w", err)
 	}

pkg/modules/api/api.go

@@ -7,6 +7,7 @@ import (
 	"log/slog"
 	"net"
 	"net/http"
+	"os"
 	"sort"
 	"strings"
 	"time"
@@ -15,6 +16,7 @@ import (
 	"github.com/dlclark/regexp2"
 	"github.com/labstack/echo/v4"
 	flag "github.com/spf13/pflag"
+	"go.uber.org/multierr"
 	"golang.org/x/net/http2"
 	"golang.org/x/sync/errgroup"
 
@@ -26,7 +28,7 @@ func init() {
 }
 
 // Api is a module that provides an HTTP server. Other modules may add routes,
-// middlewares or health checks.
+// middlewares, or health checks.
 type Api struct {
 	port                             int
 	bindIp                           string
@@ -36,14 +38,14 @@ type Api struct {
 	bodyLimit                        int64
 	timeout                          time.Duration
 	rootPath                         string
-	correlationIdHeader              string
 	basicAuthUsername                string
 	basicAuthPassword                string
+	correlationIdHeader              string
 	downloadFromCfg                  downloadFromConfig
 	disableHealthCheckRouteTelemetry bool
 	disableRootRouteTelemetry        bool
-	disableDebugRouteTelemetry       bool
 	disableVersionRouteTelemetry     bool
+	disableDebugRouteTelemetry       bool
 	enableDebugRoute                 bool
 
 	routes              []Route
@@ -57,13 +59,10 @@ type Api struct {
 }
 
 type downloadFromConfig struct {
-	allowList              []*regexp2.Regexp
-	denyList               []*regexp2.Regexp
-	denyPrivateIPs         bool
-	denyPublicIPs          bool
-	enableEnvironmentProxy bool
-	maxRetry               int
-	disable                bool
+	allowList *regexp2.Regexp
+	denyList  *regexp2.Regexp
+	maxRetry  int
+	disable   bool
 }
 
 // Router is a module interface that adds routes to the [Api].
@@ -85,8 +84,7 @@ type Route struct {
 	// Optional.
 	IsMultipart bool
 
-	// DisableTelemetry disables telemetry (logging, tracing, metrics) for
-	// this route.
+	// DisableTelemetry disables the telemetry and logging for this route.
 	// Optional.
 	DisableTelemetry bool
 
@@ -124,29 +122,6 @@ const (
 
 // Middleware is a middleware that can be added to the [Api]'s middlewares
 // chain.
-//
-//	middleware := Middleware{
-//	  Handler: func() echo.MiddlewareFunc {
-//	    return func(next echo.HandlerFunc) echo.HandlerFunc {
-//	      return func(c echo.Context) error {
-//	        rootPath := c.Get("rootPath").(string)
-//	        healthURI := fmt.Sprintf("%shealth", rootPath)
-//
-//	        // Skip the middleware if health check URI.
-//	        if c.Request().RequestURI == healthURI {
-//	          // Call the next middleware in the chain.
-//	          return next(c)
-//	        }
-//
-//	        // Your middleware process.
-//	        // ...
-//
-//	        // Call the next middleware in the chain.
-//	        return next(c)
-//	      }
-//	    }
-//	  }(),
-//	}
 type Middleware struct {
 	// Stack tells in which stack the middleware should be located.
 	// Default to [DefaultStack].
@@ -196,32 +171,18 @@ func (a *Api) Descriptor() gotenberg.ModuleDescriptor {
 			fs.Duration("api-timeout", time.Duration(30)*time.Second, "Set the time limit for requests")
 			fs.String("api-body-limit", "", "Set the body limit for multipart/form-data requests - it accepts values like 5MB, 1GB, etc")
 			fs.String("api-root-path", "/", "Set the root path of the API - for service discovery via URL paths")
-			fs.String("api-correlation-id-header", "Gotenberg-Trace", "Set the header name to use for identifying requests")
 			fs.Bool("api-enable-basic-auth", false, "Enable basic authentication - will look for the GOTENBERG_API_BASIC_AUTH_USERNAME and GOTENBERG_API_BASIC_AUTH_PASSWORD environment variables")
-			fs.StringSlice("api-download-from-allow-list", []string{}, "Set the allowed URLs for the download from feature using regular expressions - supports multiple values")
-			fs.StringSlice("api-download-from-deny-list", []string{}, "Set the denied URLs for the download from feature using regular expressions - supports multiple values")
-			fs.Bool("api-download-from-deny-private-ips", false, "Reject downloadFrom URLs whose host resolves to a non-public IP address (loopback, RFC1918, link-local, unique-local). Enable on deployments that accept untrusted downloadFrom sources to mitigate SSRF against internal services")
-			fs.Bool("api-download-from-deny-public-ips", false, "Reject downloadFrom URLs whose host resolves to a public IP address. Enable on air-gapped or data-governed deployments to prevent downloads from reaching the public internet")
-			fs.Bool("api-download-from-enable-environment-proxy", false, "Route downloadFrom fetches through the proxy defined by the standard HTTP_PROXY, HTTPS_PROXY, and NO_PROXY variables, including credentials")
+			fs.String("api-correlation-id-header", "X-Correlation-ID", "Set the header name to use to set the correlation id in the logs")
+			fs.String("api-download-from-allow-list", "", "Set the allowed URLs for the download from feature using a regular expression")
+			fs.String("api-download-from-deny-list", "", "Set the denied URLs for the download from feature using a regular expression")
 			fs.Int("api-download-from-max-retry", 4, "Set the maximum number of retries for the download from feature")
 			fs.Bool("api-disable-download-from", false, "Disable the download from feature")
-			fs.Bool("api-disable-health-check-route-telemetry", true, "Disable telemetry for health check route")
-			fs.Bool("api-disable-root-route-telemetry", true, "Disable telemetry for the root route")
-			fs.Bool("api-disable-debug-route-telemetry", true, "Disable telemetry for the debug route")
-			fs.Bool("api-disable-version-route-telemetry", true, "Disable telemetry for the version route")
+			fs.Bool("api-disable-health-check-route-telemetry", false, "Disable the health check route telemetry")
+			fs.Bool("api-disable-root-route-telemetry", false, "Disable the root route telemetry")
+			fs.Bool("api-disable-version-route-telemetry", false, "Disable the version route telemetry")
+			fs.Bool("api-disable-debug-route-telemetry", false, "Disable the debug route telemetry")
 			fs.Bool("api-enable-debug-route", false, "Enable the debug route")
 
-			// Deprecated flags.
-			fs.String("api-trace-header", "Gotenberg-Trace", "Set the header name to use for identifying requests")
-			fs.Bool("api-disable-health-check-logging", false, "Disable health check logging")
-
-			err := errors.Join(
-				fs.MarkDeprecated("api-trace-header", "use --api-correlation-id-header instead"),
-				fs.MarkDeprecated("api-disable-health-check-logging", "use --api-disable-health-check-route-telemetry instead"),
-			)
-			if err != nil {
-				panic(err)
-			}
 			return fs
 		}(),
 		New: func() gotenberg.Module { return new(Api) },
@@ -239,20 +200,17 @@ func (a *Api) Provision(ctx *gotenberg.Context) error {
 	a.timeout = flags.MustDuration("api-timeout")
 	a.bodyLimit = flags.MustHumanReadableBytes("api-body-limit")
 	a.rootPath = flags.MustString("api-root-path")
-	a.correlationIdHeader = flags.MustDeprecatedString("api-trace-header", "api-correlation-id-header")
+	a.correlationIdHeader = flags.MustString("api-correlation-id-header")
 	a.downloadFromCfg = downloadFromConfig{
-		allowList:              flags.MustRegexpSlice("api-download-from-allow-list"),
-		denyList:               flags.MustRegexpSlice("api-download-from-deny-list"),
-		denyPrivateIPs:         flags.MustBool("api-download-from-deny-private-ips"),
-		denyPublicIPs:          flags.MustBool("api-download-from-deny-public-ips"),
-		enableEnvironmentProxy: flags.MustBool("api-download-from-enable-environment-proxy"),
-		maxRetry:               flags.MustInt("api-download-from-max-retry"),
-		disable:                flags.MustBool("api-disable-download-from"),
+		allowList: flags.MustRegexp("api-download-from-allow-list"),
+		denyList:  flags.MustRegexp("api-download-from-deny-list"),
+		maxRetry:  flags.MustInt("api-download-from-max-retry"),
+		disable:   flags.MustBool("api-disable-download-from"),
 	}
-	a.disableHealthCheckRouteTelemetry = flags.MustDeprecatedBool("api-disable-health-check-logging", "api-disable-health-check-route-telemetry")
+	a.disableHealthCheckRouteTelemetry = flags.MustBool("api-disable-health-check-route-telemetry")
 	a.disableRootRouteTelemetry = flags.MustBool("api-disable-root-route-telemetry")
-	a.disableDebugRouteTelemetry = flags.MustBool("api-disable-debug-route-telemetry")
 	a.disableVersionRouteTelemetry = flags.MustBool("api-disable-version-route-telemetry")
+	a.disableDebugRouteTelemetry = flags.MustBool("api-disable-debug-route-telemetry")
 	a.enableDebugRoute = flags.MustBool("api-enable-debug-route")
 
 	// Port from env?
@@ -371,46 +329,33 @@ func (a *Api) Validate() error {
 	var err error
 
 	if a.port < 1 || a.port > 65535 {
-		err = errors.Join(err,
+		err = multierr.Append(err,
 			errors.New("port must be more than 1 and less than 65535"),
 		)
 	}
 
 	if a.bindIp != "" && net.ParseIP(a.bindIp) == nil {
-		err = errors.Join(err, errors.New("IP must be a valid IP address"))
-	}
-
-	if a.downloadFromCfg.enableEnvironmentProxy {
-		proxyErr := gotenberg.ValidateEnvironmentProxyVariables()
-		if proxyErr != nil {
-			err = errors.Join(err, fmt.Errorf("--api-download-from-enable-environment-proxy is set: %w", proxyErr))
-		}
+		err = multierr.Append(err, errors.New("IP must be a valid IP address"))
 	}
 
 	if (a.tlsCertFile != "" && a.tlsKeyFile == "") || (a.tlsCertFile == "" && a.tlsKeyFile != "") {
-		err = errors.Join(err,
+		err = multierr.Append(err,
 			errors.New("both TLS certificate and key files must be set"),
 		)
 	}
 
 	if !strings.HasPrefix(a.rootPath, "/") {
-		err = errors.Join(err,
+		err = multierr.Append(err,
 			errors.New("root path must start with /"),
 		)
 	}
 
 	if !strings.HasSuffix(a.rootPath, "/") {
-		err = errors.Join(err,
+		err = multierr.Append(err,
 			errors.New("root path must end with /"),
 		)
 	}
 
-	if len(strings.TrimSpace(a.correlationIdHeader)) == 0 {
-		err = errors.Join(err,
-			errors.New("trace header must not be empty"),
-		)
-	}
-
 	if err != nil {
 		return err
 	}
@@ -477,29 +422,40 @@ func (a *Api) Start() error {
 			disableTelemetryForPaths = append(disableTelemetryForPaths, strings.TrimPrefix(route.Path, "/"))
 		}
 	}
-
-	// Check if the user wishes to disable telemetry for specific routes.
+	// Check if the user wishes to disable telemetry for system routes.
+	// Note: root path will be used as prefix in the underlying middlewares.
 	if a.disableHealthCheckRouteTelemetry {
 		disableTelemetryForPaths = append(disableTelemetryForPaths, "health")
 	}
+
 	if a.disableRootRouteTelemetry {
 		disableTelemetryForPaths = append(disableTelemetryForPaths, "")
 	}
-	if a.disableDebugRouteTelemetry {
-		disableTelemetryForPaths = append(disableTelemetryForPaths, "debug")
-	}
+
 	if a.disableVersionRouteTelemetry {
 		disableTelemetryForPaths = append(disableTelemetryForPaths, "version")
 	}
 
-	serverName := fmt.Sprintf("%s:%d", a.bindIp, a.port)
+	if a.disableDebugRouteTelemetry {
+		disableTelemetryForPaths = append(disableTelemetryForPaths, "debug")
+	}
+
+	// Always disable telemetry for favicon.
+	disableTelemetryForPaths = append(disableTelemetryForPaths,
+		"favicon.ico",
+	)
 
 	// Add the API middlewares.
+	hostname, err := os.Hostname()
+	if err != nil {
+		return fmt.Errorf("get hostname: %w", err)
+	}
+
 	a.srv.Pre(
 		latencyMiddleware(),
 		rootPathMiddleware(a.rootPath),
 		outputFilenameMiddleware(),
-		telemetryMiddleware(a.logger, serverName, a.correlationIdHeader, disableTelemetryForPaths),
+		telemetryMiddleware(a.logger, hostname, a.correlationIdHeader, disableTelemetryForPaths),
 	)
 
 	// Add the modules' middlewares in their respective stacks.
@@ -571,9 +527,7 @@ func (a *Api) Start() error {
 	)
 
 	// Let's not forget the health check routes...
-	checks := make([]health.CheckerOption, len(a.healthChecks), len(a.healthChecks)+1)
-	copy(checks, a.healthChecks)
-	checks = append(checks, health.WithTimeout(a.timeout))
+	checks := append(a.healthChecks, health.WithTimeout(a.timeout))
 	checker := health.NewChecker(checks...)
 	healthCheckHandler := health.NewHandler(checker)
 
@@ -621,7 +575,7 @@ func (a *Api) Start() error {
 		eg.Go(f)
 	}
 
-	err := eg.Wait()
+	err = eg.Wait()
 	if err != nil {
 		return fmt.Errorf("waiting for modules readiness: %w", err)
 	}
@@ -639,6 +593,7 @@ func (a *Api) Start() error {
 		}
 		if !errors.Is(err, http.ErrServerClosed) {
 			a.logger.ErrorContext(context.Background(), err.Error())
+			os.Exit(1)
 		}
 	}()
 

pkg/modules/api/context.go

@@ -21,14 +21,13 @@ import (
 	"github.com/labstack/echo/v4"
 	"github.com/mholt/archives"
 	"go.opentelemetry.io/otel"
-	"go.opentelemetry.io/otel/codes"
 	"go.opentelemetry.io/otel/propagation"
-	semconv "go.opentelemetry.io/otel/semconv/v1.40.0"
 	"go.opentelemetry.io/otel/trace"
 	"golang.org/x/sync/errgroup"
 	"golang.org/x/text/unicode/norm"
 
 	"github.com/gotenberg/gotenberg/v8/pkg/gotenberg"
+	semconvutil "github.com/gotenberg/gotenberg/v8/pkg/gotenberg/semconv"
 )
 
 var (
@@ -43,13 +42,12 @@ var (
 
 // Context is the request context for a "multipart/form-data" request.
 type Context struct {
-	dirPath        string
-	values         map[string][]string
-	files          map[string]string
-	filesByField   map[string][]string
-	diskToOriginal map[string]string
-	outputPaths    []string
-	cancelled      bool
+	dirPath      string
+	values       map[string][]string
+	files        map[string]string
+	filesByField map[string][]string
+	outputPaths  []string
+	cancelled    bool
 
 	logger     *slog.Logger
 	echoCtx    echo.Context
@@ -87,14 +85,8 @@ type downloadFrom struct {
 	// ExtraHttpHeaders are the HTTP headers to send alongside.
 	ExtraHttpHeaders map[string]string `json:"extraHttpHeaders"`
 
-	// Embedded routes the downloaded file as an embed. Deprecated: use
-	// Field instead. Kept for backward compatibility.
-	Embedded bool `json:"embedded"`
-
-	// Field routes the downloaded file to a specific form field bucket.
-	// Supported values: "watermark", "stamp". For embeds, prefer the
-	// Embedded flag or set Field to "embedded".
-	Field string `json:"field"`
+	// Download as an attachment file.
+	Attachment bool `json:"attachment"`
 }
 
 // newContext returns a [Context] by parsing a "multipart/form-data" request.
@@ -111,7 +103,7 @@ func newContext(echoCtx echo.Context, logger *slog.Logger, fs *gotenberg.FileSys
 		if bodyLimit != 0 && newTotal > bodyLimit {
 			return WrapError(
 				fmt.Errorf("body limit reached (> %d)", bodyLimit),
-				NewSentinelHttpError(http.StatusRequestEntityTooLarge, "The request body exceeds the configured size limit. Increase it with --api-body-limit, or send a smaller request."),
+				NewSentinelHttpError(http.StatusRequestEntityTooLarge, http.StatusText(http.StatusRequestEntityTooLarge)),
 			)
 		}
 		return nil
@@ -143,12 +135,12 @@ func newContext(echoCtx echo.Context, logger *slog.Logger, fs *gotenberg.FileSys
 
 			err := os.RemoveAll(ctx.dirPath)
 			if err != nil {
-				ctx.logger.ErrorContext(context.Background(), fmt.Sprintf("remove context's working directory: %s", err))
+				ctx.logger.ErrorContext(ctx, fmt.Sprintf("remove context's working directory: %s", err))
 
 				return
 			}
 
-			ctx.logger.DebugContext(context.Background(), fmt.Sprintf("'%s' context's working directory removed", ctx.dirPath))
+			ctx.logger.DebugContext(ctx, fmt.Sprintf("'%s' context's working directory removed", ctx.dirPath))
 			ctx.cancelled = true
 		}
 	}()
@@ -201,7 +193,6 @@ func newContext(echoCtx echo.Context, logger *slog.Logger, fs *gotenberg.FileSys
 	ctx.values = form.Value
 	ctx.files = make(map[string]string)
 	ctx.filesByField = make(map[string][]string)
-	ctx.diskToOriginal = make(map[string]string)
 
 	// First, try to download files listed in the "downloadFrom" form field, if
 	// any.
@@ -216,15 +207,6 @@ func newContext(echoCtx echo.Context, logger *slog.Logger, fs *gotenberg.FileSys
 			)
 		}
 
-		// Each goroutine writes to its own results slot. The main
-		// goroutine merges into ctx.files, ctx.diskToOriginal, and
-		// ctx.filesByField after eg.Wait() to avoid concurrent map
-		// writes.
-		type downloadFromResult struct {
-			filename, path, formField string
-		}
-		results := make([]downloadFromResult, len(dls))
-
 		eg, _ := errgroup.WithContext(ctx)
 		for i, dl := range dls {
 			eg.Go(func() error {
@@ -241,27 +223,15 @@ func newContext(echoCtx echo.Context, logger *slog.Logger, fs *gotenberg.FileSys
 					)
 				}
 
-				ipOpts := []gotenberg.DecideOption{
-					gotenberg.WithDenyPrivateIPs(downloadFromCfg.denyPrivateIPs),
-					gotenberg.WithDenyPublicIPs(downloadFromCfg.denyPublicIPs),
-				}
-				err := gotenberg.FilterOutboundURL(ctx, dl.Url, downloadFromCfg.allowList, downloadFromCfg.denyList, deadline, ipOpts...)
+				err := gotenberg.FilterDeadline(downloadFromCfg.allowList, downloadFromCfg.denyList, dl.Url, deadline)
 				if err != nil {
 					return fmt.Errorf("filter URL: %w", err)
 				}
 
-				dlCtx, dlSpan := gotenberg.Tracer().Start(ctx, "GET Download From",
-					trace.WithSpanKind(trace.SpanKindClient),
-					trace.WithAttributes(semconv.ServerAddress(dl.Url)),
-				)
+				logger.DebugContext(ctx, fmt.Sprintf("download file from '%s'", dl.Url))
 
-				logger.DebugContext(dlCtx, fmt.Sprintf("download file from '%s'", dl.Url))
-
-				req, err := retryablehttp.NewRequest(http.MethodGet, dl.Url, nil)
+				req, err := retryablehttp.NewRequestWithContext(ctx, http.MethodGet, dl.Url, nil)
 				if err != nil {
-					dlSpan.RecordError(err)
-					dlSpan.SetStatus(codes.Error, err.Error())
-					dlSpan.End()
 					return fmt.Errorf("create request to '%s': %w", dl.Url, err)
 				}
 
@@ -269,37 +239,45 @@ func newContext(echoCtx echo.Context, logger *slog.Logger, fs *gotenberg.FileSys
 				for key, value := range dl.ExtraHttpHeaders {
 					req.Header.Set(key, value)
 				}
+				req.Header.Set(echoCtx.Get("correlationIdHeader").(string), echoCtx.Get("correlationId").(string))
 
-				// Inject OTEL trace context into outbound request.
-				otel.GetTextMapPropagator().Inject(dlCtx, propagation.HeaderCarrier(req.Header))
+				// OpenTelemetry.
+				meter := gotenberg.Meter()
+				semconvClient := semconvutil.NewHTTPClient(meter)
 
-				// Propagate correlation ID header.
-				if correlationIdHeader, ok := echoCtx.Get("correlationIdHeader").(string); ok {
-					if correlationId, ok := echoCtx.Get("correlationId").(string); ok {
-						req.Header.Set(correlationIdHeader, correlationId)
-					}
-				}
+				tracer := gotenberg.Tracer()
+				traceCtx, span := tracer.Start(ctx, fmt.Sprintf("%s Download From", req.Method),
+					trace.WithSpanKind(trace.SpanKindClient),
+					trace.WithAttributes(semconvClient.RequestTraceAttrs(req.Request)...),
+				)
+				defer span.End()
+
+				otel.GetTextMapPropagator().Inject(traceCtx, propagation.HeaderCarrier(req.Header))
 
 				client := &retryablehttp.Client{
-					HTTPClient:   gotenberg.NewOutboundHttpClient(time.Until(deadline), downloadFromCfg.allowList, downloadFromCfg.denyList, downloadFromCfg.enableEnvironmentProxy, ipOpts...),
+					HTTPClient: &http.Client{
+						Timeout: time.Until(deadline),
+					},
 					RetryMax:     downloadFromCfg.maxRetry,
 					RetryWaitMin: time.Duration(1) * time.Second,
 					RetryWaitMax: time.Until(deadline),
-					Logger:       gotenberg.NewLeveledLogger(logger),
+					Logger:       gotenberg.NewLeveledLogger(logger).WithContext(ctx),
 					CheckRetry:   retryablehttp.DefaultRetryPolicy,
 					Backoff:      retryablehttp.DefaultBackoff,
 				}
 
 				resp, err := client.Do(req)
 				if err != nil {
-					dlSpan.RecordError(err)
-					dlSpan.SetStatus(codes.Error, err.Error())
-					dlSpan.End()
+					span.RecordError(err)
+					span.SetStatus(semconvClient.Status(0))
 					return WrapError(
 						fmt.Errorf("download file from to '%s': %w", dl.Url, err),
 						NewSentinelHttpError(http.StatusBadRequest, fmt.Sprintf("Unable to download file from '%s': %s", dl.Url, err)),
 					)
 				}
+
+				span.SetAttributes(semconvClient.ResponseTraceAttrs(resp)...)
+				span.SetStatus(semconvClient.Status(resp.StatusCode))
 				defer func() {
 					err := resp.Body.Close()
 					if err != nil {
@@ -308,24 +286,16 @@ func newContext(echoCtx echo.Context, logger *slog.Logger, fs *gotenberg.FileSys
 				}()
 
 				if resp.StatusCode != http.StatusOK {
-					dlErr := fmt.Errorf("download file from to '%s': got status: '%s'", dl.Url, resp.Status)
-					dlSpan.RecordError(dlErr)
-					dlSpan.SetStatus(codes.Error, dlErr.Error())
-					dlSpan.End()
 					return WrapError(
-						dlErr,
+						fmt.Errorf("download file from to '%s': got status: '%s'", dl.Url, resp.Status),
 						NewSentinelHttpError(http.StatusBadRequest, fmt.Sprintf("Unable to download file from '%s': got status: '%s'", dl.Url, resp.Status)),
 					)
 				}
 
 				contentDisposition := resp.Header.Get("Content-Disposition")
 				if contentDisposition == "" {
-					dlErr := fmt.Errorf("no 'Content-Disposition' header from '%s'", dl.Url)
-					dlSpan.RecordError(dlErr)
-					dlSpan.SetStatus(codes.Error, dlErr.Error())
-					dlSpan.End()
 					return WrapError(
-						dlErr,
+						fmt.Errorf("no 'Content-Disposition' header from '%s'", dl.Url),
 						NewSentinelHttpError(http.StatusBadRequest, fmt.Sprintf("No 'Content-Disposition' header from '%s'", dl.Url)),
 					)
 				}
@@ -335,49 +305,29 @@ func newContext(echoCtx echo.Context, logger *slog.Logger, fs *gotenberg.FileSys
 				//  See: https://github.com/golang/go/issues/69551.
 				_, params, err := mime.ParseMediaType(contentDisposition)
 				if err != nil {
-					dlErr := fmt.Errorf("parse 'Content-Disposition' header '%s' from '%s': %w", contentDisposition, dl.Url, err)
-					dlSpan.RecordError(dlErr)
-					dlSpan.SetStatus(codes.Error, dlErr.Error())
-					dlSpan.End()
 					return WrapError(
-						dlErr,
+						fmt.Errorf("parse 'Content-Disposition' header '%s' from '%s': %w", contentDisposition, dl.Url, err),
 						NewSentinelHttpError(http.StatusBadRequest, fmt.Sprintf("Invalid 'Content-Disposition' header '%s' from '%s': %s", contentDisposition, dl.Url, err)),
 					)
 				}
 
 				filename, ok := params["filename"]
 				if !ok {
-					dlErr := fmt.Errorf("get filename from 'Content-Disposition' header '%s' from '%s'", contentDisposition, dl.Url)
-					dlSpan.RecordError(dlErr)
-					dlSpan.SetStatus(codes.Error, dlErr.Error())
-					dlSpan.End()
 					return WrapError(
-						dlErr,
+						fmt.Errorf("get filename from 'Content-Disposition' header '%s' from '%s'", contentDisposition, dl.Url),
 						NewSentinelHttpError(http.StatusBadRequest, fmt.Sprintf("Invalid 'Content-Disposition' header '%s' from '%s': no filename", contentDisposition, dl.Url)),
 					)
 				}
 
-				// Strip path separators (including backslashes) and control
-				// characters, then NFC-normalize. Defends against directory
-				// traversal in the on-disk name and Windows-side Zip Slip
-				// when the original filename is later embedded in an output
-				// zip entry.
+				// Avoid directory traversal and make sure filename characters are
+				// normalized.
 				// See: https://github.com/gotenberg/gotenberg/issues/662.
-				filename = sanitizeFilename(filename)
-
-				// Use a UUID-based name on disk to avoid filesystem
-				// NAME_MAX limits with long filenames.
-				// See: https://github.com/gotenberg/gotenberg/issues/1500.
-				safeName := uuid.New().String() + filepath.Ext(filename)
-				path := fmt.Sprintf("%s/%s", ctx.dirPath, safeName)
+				filename = norm.NFC.String(filepath.Base(filename))
+				path := fmt.Sprintf("%s/%s", dirPath, filename)
 
 				out, err := os.Create(path)
 				if err != nil {
-					dlErr := fmt.Errorf("create local file: %w", err)
-					dlSpan.RecordError(dlErr)
-					dlSpan.SetStatus(codes.Error, dlErr.Error())
-					dlSpan.End()
-					return dlErr
+					return fmt.Errorf("create local file: %w", err)
 				}
 				defer func() {
 					err := out.Close()
@@ -391,26 +341,13 @@ func newContext(echoCtx echo.Context, logger *slog.Logger, fs *gotenberg.FileSys
 
 				_, err = io.Copy(out, reader)
 				if err != nil {
-					dlErr := fmt.Errorf("copy downloaded file from '%s' to local file: %w", dl.Url, err)
-					dlSpan.RecordError(dlErr)
-					dlSpan.SetStatus(codes.Error, dlErr.Error())
-					dlSpan.End()
-					return dlErr
+					return fmt.Errorf("copy downloaded file from '%s' to local file: %w", dl.Url, err)
 				}
 
-				dlSpan.SetStatus(codes.Ok, "")
-				dlSpan.End()
-
-				var formField string
-				switch {
-				case dl.Field == "embedded" || dl.Embedded:
-					formField = EmbedsFormField
-				case dl.Field == "watermark":
-					formField = WatermarkFormField
-				case dl.Field == "stamp":
-					formField = StampFormField
+				ctx.files[filename] = path
+				if dl.Attachment {
+					ctx.filesByField[AttachmentsFormField] = append(ctx.filesByField[AttachmentsFormField], path)
 				}
-				results[i] = downloadFromResult{filename: filename, path: path, formField: formField}
 
 				return nil
 			})
@@ -420,14 +357,6 @@ func newContext(echoCtx echo.Context, logger *slog.Logger, fs *gotenberg.FileSys
 		if err != nil {
 			return ctx, cancel, err
 		}
-
-		for _, r := range results {
-			ctx.files[r.filename] = r.path
-			ctx.diskToOriginal[r.path] = r.filename
-			if r.formField != "" {
-				ctx.filesByField[r.formField] = append(ctx.filesByField[r.formField], r.path)
-			}
-		}
 	}
 
 	copyToDisk := func(fh *multipart.FileHeader) error {
@@ -439,25 +368,18 @@ func newContext(echoCtx echo.Context, logger *slog.Logger, fs *gotenberg.FileSys
 		defer func() {
 			err := in.Close()
 			if err != nil {
-				logger.ErrorContext(context.Background(), fmt.Sprintf("close file header: %s", err))
+				logger.ErrorContext(ctx, fmt.Sprintf("close file header: %s", err))
 			}
 		}()
 
 		// This will ensure we do not exceed the body limit.
 		reader := &trackingReader{R: in, AddReadBytes: addReadBytes}
 
-		// Strip path separators (including backslashes) and control
-		// characters, then NFC-normalize. Defends against directory
-		// traversal in the on-disk name and Windows-side Zip Slip when the
-		// original filename is later embedded in an output zip entry.
+		// Avoid directory traversal and make sure filename characters are
+		// normalized.
 		// See: https://github.com/gotenberg/gotenberg/issues/662.
-		filename := sanitizeFilename(fh.Filename)
-
-		// Use a UUID-based name on disk to avoid filesystem
-		// NAME_MAX limits with long filenames.
-		// See: https://github.com/gotenberg/gotenberg/issues/1500.
-		safeName := uuid.New().String() + filepath.Ext(filename)
-		path := fmt.Sprintf("%s/%s", ctx.dirPath, safeName)
+		filename := norm.NFC.String(filepath.Base(fh.Filename))
+		path := fmt.Sprintf("%s/%s", ctx.dirPath, filename)
 
 		out, err := os.Create(path)
 		if err != nil {
@@ -466,7 +388,7 @@ func newContext(echoCtx echo.Context, logger *slog.Logger, fs *gotenberg.FileSys
 		defer func() {
 			err := out.Close()
 			if err != nil {
-				logger.ErrorContext(context.Background(), fmt.Sprintf("close local file: %s", err))
+				logger.ErrorContext(ctx, fmt.Sprintf("close local file: %s", err))
 			}
 		}()
 
@@ -476,7 +398,6 @@ func newContext(echoCtx echo.Context, logger *slog.Logger, fs *gotenberg.FileSys
 		}
 
 		ctx.files[filename] = path
-		ctx.diskToOriginal[path] = filename
 
 		return nil
 	}
@@ -489,29 +410,12 @@ func newContext(echoCtx echo.Context, logger *slog.Logger, fs *gotenberg.FileSys
 				return ctx, cancel, fmt.Errorf("copy to disk: %w", err)
 			}
 			// Track files by field name
-			filename := sanitizeFilename(fh.Filename)
+			filename := norm.NFC.String(filepath.Base(fh.Filename))
 			filePath := ctx.files[filename]
 			ctx.filesByField[fieldName] = append(ctx.filesByField[fieldName], filePath)
 		}
 	}
 
-	// Create symlinks from original filenames to UUID-based disk names
-	// so that relative asset references (e.g., <img src="image.png">)
-	// resolve correctly when Chromium navigates to a file:// URL.
-	// Symlink creation is best-effort: it may fail for filenames that
-	// exceed the filesystem NAME_MAX limit (the reason UUIDs were
-	// introduced in the first place).
-	for originalName, diskPath := range ctx.files {
-		symlinkPath := fmt.Sprintf("%s/%s", ctx.dirPath, originalName)
-		if symlinkPath == diskPath {
-			continue
-		}
-		err = os.Symlink(filepath.Base(diskPath), symlinkPath)
-		if err != nil {
-			logger.DebugContext(context.Background(), fmt.Sprintf("skip symlink for '%s': %s", originalName, err))
-		}
-	}
-
 	ctx.Log().DebugContext(ctx, fmt.Sprintf("form fields: %+v", ctx.values))
 	ctx.Log().DebugContext(ctx, fmt.Sprintf("form files: %+v", ctx.files))
 	ctx.Log().DebugContext(ctx, fmt.Sprintf("form files by field: %+v", ctx.filesByField))
@@ -528,39 +432,13 @@ func (ctx *Context) Request() *http.Request {
 // FormData return a [FormData].
 func (ctx *Context) FormData() *FormData {
 	return &FormData{
-		values:         ctx.values,
-		files:          ctx.files,
-		filesByField:   ctx.filesByField,
-		diskToOriginal: ctx.diskToOriginal,
-		errors:         nil,
+		values:       ctx.values,
+		files:        ctx.files,
+		filesByField: ctx.filesByField,
+		errors:       nil,
 	}
 }
 
-// FileCount returns the number of files received in the request.
-func (ctx *Context) FileCount() int {
-	return len(ctx.files)
-}
-
-// OriginalFilename returns the original filename associated with a disk path.
-// If no mapping exists, it falls back to [filepath.Base].
-func (ctx *Context) OriginalFilename(diskPath string) string {
-	if original, ok := ctx.diskToOriginal[diskPath]; ok {
-		return original
-	}
-	return filepath.Base(diskPath)
-}
-
-// RegisterDiskPath associates a disk path with an original filename so that
-// [Context.OriginalFilename] can resolve it later.
-func (ctx *Context) RegisterDiskPath(diskPath, originalFilename string) {
-	ctx.diskToOriginal[diskPath] = originalFilename
-}
-
-// DirPath returns the path to the request's working directory.
-func (ctx *Context) DirPath() string {
-	return ctx.dirPath
-}
-
 // GeneratePath generates a path within the context's working directory.
 // It generates a new UUID-based filename. It does not create a file.
 func (ctx *Context) GeneratePath(extension string) string {
@@ -568,14 +446,10 @@ func (ctx *Context) GeneratePath(extension string) string {
 }
 
 // GeneratePathFromFilename generates a path within the context's working
-// directory. It uses a UUID-based name on disk to avoid filesystem NAME_MAX
-// limits but registers the given filename so that [Context.OriginalFilename]
-// can resolve it. It does not create a file.
+// directory, using the given filename (with extension). It does not create
+// a file.
 func (ctx *Context) GeneratePathFromFilename(filename string) string {
-	safeName := uuid.New().String() + filepath.Ext(filename)
-	path := fmt.Sprintf("%s/%s", ctx.dirPath, safeName)
-	ctx.diskToOriginal[path] = filename
-	return path
+	return fmt.Sprintf("%s/%s", ctx.dirPath, filename)
 }
 
 // CreateSubDirectory creates a subdirectory within the context's working
@@ -642,7 +516,7 @@ func (ctx *Context) BuildOutputFile() (string, error) {
 	filesInfo, err := archives.FilesFromDisk(ctx.Context, nil, func() map[string]string {
 		f := make(map[string]string)
 		for _, outputPath := range ctx.outputPaths {
-			f[outputPath] = ctx.OriginalFilename(outputPath)
+			f[outputPath] = ""
 		}
 		return f
 	}())
@@ -678,26 +552,8 @@ func (ctx *Context) OutputFilename(outputPath string) string {
 	filename := ctx.echoCtx.Get("outputFilename").(string)
 
 	if filename == "" {
-		return ctx.OriginalFilename(outputPath)
+		return filepath.Base(outputPath)
 	}
 
 	return fmt.Sprintf("%s%s", filename, filepath.Ext(outputPath))
 }
-
-// sanitizeFilename strips path separators (including backslashes, which
-// [filepath.Base] ignores on Linux) and control characters from a
-// caller-supplied filename, then NFC-normalizes the result. This prevents a
-// Windows-side Zip Slip when an output zip is extracted by a permissive
-// extractor that interprets '\' as a path separator.
-func sanitizeFilename(name string) string {
-	if i := strings.LastIndexAny(name, `/\`); i >= 0 {
-		name = name[i+1:]
-	}
-	name = strings.Map(func(r rune) rune {
-		if r < 0x20 || r == 0x7f {
-			return -1
-		}
-		return r
-	}, name)
-	return norm.NFC.String(name)
-}

pkg/modules/api/context_test.go

@@ -3,13 +3,11 @@ package api
 import (
 	"bytes"
 	"context"
-	"encoding/json"
-	"fmt"
 	"log/slog"
 	"mime/multipart"
 	"net/http"
 	"net/http/httptest"
-	"sync"
+	"os"
 	"testing"
 	"time"
 
@@ -38,7 +36,7 @@ func TestNewContext_Cancellation(t *testing.T) {
 	rec := httptest.NewRecorder()
 	c := e.NewContext(req, rec)
 
-	logger := slog.New(slog.DiscardHandler)
+	logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 	fs := gotenberg.NewFileSystem(new(gotenberg.OsMkdirAll))
 	timeout := time.Duration(10) * time.Second
 	downloadFromCfg := downloadFromConfig{
@@ -72,153 +70,3 @@ func TestNewContext_Cancellation(t *testing.T) {
 		t.Fatal("expected context to be cancelled after request context cancellation, but it timed out")
 	}
 }
-
-// Concurrent downloadFrom entries must not race on the shared maps
-// (ctx.files, ctx.diskToOriginal, ctx.filesByField). Run under -race
-// to catch the data race; without -race a sufficient number of entries
-// still surfaces "fatal error: concurrent map writes".
-func TestNewContext_DownloadFromConcurrentMapWrites(t *testing.T) {
-	const downloads = 64
-
-	var ready sync.WaitGroup
-	ready.Add(downloads)
-	release := make(chan struct{})
-	var releaseOnce sync.Once
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		ready.Done()
-		go func() {
-			ready.Wait()
-			releaseOnce.Do(func() { close(release) })
-		}()
-		<-release
-
-		filename := fmt.Sprintf("download-%s.txt", r.URL.Query().Get("i"))
-		w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="%s"`, filename))
-		_, _ = w.Write([]byte("downloaded"))
-	}))
-	defer server.Close()
-
-	dls := make([]downloadFrom, downloads)
-	for i := range dls {
-		dls[i] = downloadFrom{
-			Url:   fmt.Sprintf("%s/file?i=%d", server.URL, i),
-			Field: "embedded",
-		}
-	}
-
-	payload, err := json.Marshal(dls)
-	if err != nil {
-		t.Fatalf("marshal downloadFrom payload: %v", err)
-	}
-
-	body := new(bytes.Buffer)
-	writer := multipart.NewWriter(body)
-	err = writer.WriteField("downloadFrom", string(payload))
-	if err != nil {
-		t.Fatalf("write downloadFrom field: %v", err)
-	}
-	err = writer.Close()
-	if err != nil {
-		t.Fatalf("close multipart writer: %v", err)
-	}
-
-	req := httptest.NewRequest(http.MethodPost, "/forms/libreoffice/convert", body)
-	req.Header.Set("Content-Type", writer.FormDataContentType())
-
-	echoCtx := echo.New().NewContext(req, httptest.NewRecorder())
-	logger := slog.New(slog.DiscardHandler)
-	fs := gotenberg.NewFileSystem(new(gotenberg.OsMkdirAll))
-	downloadFromCfg := downloadFromConfig{
-		maxRetry: 0,
-	}
-
-	ctx, cancel, err := newContext(echoCtx, logger, fs, 10*time.Second, 0, downloadFromCfg)
-	if err != nil {
-		t.Fatalf("newContext returned error: %v", err)
-	}
-	defer cancel()
-
-	if got := len(ctx.files); got != downloads {
-		t.Fatalf("downloaded files = %d, want %d", got, downloads)
-	}
-	if got := len(ctx.diskToOriginal); got != downloads {
-		t.Fatalf("diskToOriginal entries = %d, want %d", got, downloads)
-	}
-	if got := len(ctx.filesByField[EmbedsFormField]); got != downloads {
-		t.Fatalf("filesByField[%q] entries = %d, want %d", EmbedsFormField, got, downloads)
-	}
-}
-
-func TestSanitizeFilename(t *testing.T) {
-	for _, tc := range []struct {
-		scenario string
-		input    string
-		expect   string
-	}{
-		{
-			scenario: "plain filename is unchanged",
-			input:    "report.pdf",
-			expect:   "report.pdf",
-		},
-		{
-			scenario: "POSIX traversal is stripped",
-			input:    "../../etc/passwd",
-			expect:   "passwd",
-		},
-		{
-			scenario: "Windows traversal with backslashes is stripped",
-			input:    `..\..\..\..\Windows\System32\evil.pdf`,
-			expect:   "evil.pdf",
-		},
-		{
-			scenario: "mixed separators take the last segment",
-			input:    `foo/bar\baz.pdf`,
-			expect:   "baz.pdf",
-		},
-		{
-			scenario: "control characters are dropped",
-			input:    "evil\x00\x07\x1f\x7f.pdf",
-			expect:   "evil.pdf",
-		},
-		{
-			scenario: "NFC normalization collapses decomposed sequences",
-			// "e" + combining acute accent -> precomposed "é".
-			input:  "café.pdf",
-			expect: "café.pdf",
-		},
-		{
-			scenario: "trailing backslash yields empty name",
-			input:    `foo\`,
-			expect:   "",
-		},
-		{
-			scenario: "empty input yields empty name",
-			input:    "",
-			expect:   "",
-		},
-	} {
-		t.Run(tc.scenario, func(t *testing.T) {
-			got := sanitizeFilename(tc.input)
-			if got != tc.expect {
-				t.Errorf("sanitizeFilename(%q) = %q, want %q", tc.input, got, tc.expect)
-			}
-		})
-	}
-}
-
-func TestContext_FileCount(t *testing.T) {
-	ctx := &Context{}
-	if got := ctx.FileCount(); got != 0 {
-		t.Errorf("expected 0 files, got %d", got)
-	}
-
-	ctx.files = map[string]string{
-		"index.html":  "/work/index.html",
-		"header.html": "/work/header.html",
-		"styles.css":  "/work/styles.css",
-	}
-	if got := ctx.FileCount(); got != 3 {
-		t.Errorf("expected 3 files, got %d", got)
-	}
-}

pkg/modules/api/doc.go

@@ -1,3 +1,3 @@
-// Package api implements the HTTP server module. Other modules register
-// multipart/form data routes, middlewares, and health checks through it.
+// Package api provides a module, which is an HTTP server. Other modules may
+// add multipart/form-data routes, middlewares, and health checks.
 package api

pkg/modules/api/formdata.go

@@ -1,8 +1,6 @@
 package api
 
 import (
-	"encoding/json"
-	"errors"
 	"fmt"
 	"math"
 	"net/http"
@@ -14,22 +12,14 @@ import (
 	"strings"
 	"time"
 
+	"go.uber.org/multierr"
+
 	"github.com/gotenberg/gotenberg/v8/pkg/gotenberg"
 )
 
+// AttachmentsFormField represents the form field name for attaching files.
 const (
-	// EmbedsFormField represents the form field name for embedding files.
-	EmbedsFormField string = "embeds"
-
-	// WatermarkFormField represents the form field name for the watermark file.
-	WatermarkFormField string = "watermark"
-
-	// StampFormField represents the form field name for the stamp file.
-	StampFormField string = "stamp"
-
-	// FacturXXmlFormField represents the form field name for the Factur-X CII
-	// invoice XML file.
-	FacturXXmlFormField string = "facturxXml"
+	AttachmentsFormField string = "attachments"
 )
 
 // FormData is a helper for validating and hydrating values from a
@@ -37,11 +27,10 @@ const (
 //
 //	form := ctx.FormData()
 type FormData struct {
-	values         map[string][]string
-	files          map[string]string
-	filesByField   map[string][]string
-	diskToOriginal map[string]string
-	errors         error
+	values       map[string][]string
+	files        map[string]string
+	filesByField map[string][]string
+	errors       error
 }
 
 // Validate returns nil or an error related to the [FormData] values, with a
@@ -376,58 +365,26 @@ func (form *FormData) Paths(extensions []string, target *[]string) *FormData {
 	return form.paths(extensions, target)
 }
 
-// Embeds binds the absolute paths of form data files that should be
-// embedded in the PDF. Only files uploaded with the "embeds" field name
+// Attachments binds the absolute paths of form data files that should be
+// attached in the PDF. Only files uploaded with the "attachments" field name
 // will be included.
 //
-//	var embeds []string
+//	var attachments []string
 //
-//	ctx.FormData().Embeds(&embeds)
-func (form *FormData) Embeds(target *[]string) *FormData {
+//	ctx.FormData().Attachments(&attachments)
+func (form *FormData) Attachments(target *[]string) *FormData {
 	if form.errors != nil {
 		return form
 	}
 
-	// Get files from the "embeds" field
-	if paths, ok := form.filesByField[EmbedsFormField]; ok {
+	// Get files from the "attachments" field
+	if paths, ok := form.filesByField[AttachmentsFormField]; ok {
 		*target = append(*target, paths...)
 	}
 
 	return form
 }
 
-// EmbedsMetadata parses the "embedsMetadata" form field (a JSON string) into
-// a map keyed by filename. Each value is a map of property names to values
-// (e.g., "mimeType" and "relationship").
-//
-//	var metadata map[string]map[string]string
-//
-//	ctx.FormData().EmbedsMetadata(&metadata)
-func (form *FormData) EmbedsMetadata(target *map[string]map[string]string) *FormData {
-	if form.errors != nil {
-		return form
-	}
-
-	val, ok := form.values["embedsMetadata"]
-	if !ok || len(val) == 0 || val[0] == "" {
-		return form
-	}
-
-	raw := val[0]
-	parsed := make(map[string]map[string]string)
-
-	err := json.Unmarshal([]byte(raw), &parsed)
-	if err != nil {
-		form.append(
-			fmt.Errorf("form field 'embedsMetadata' is invalid: %w", err),
-		)
-		return form
-	}
-
-	*target = parsed
-	return form
-}
-
 // MandatoryPaths binds the absolute paths of form data files, according to a
 // list of file extensions, to a string slice variable. It populates an error
 // if there is no file for given file extensions.
@@ -449,115 +406,34 @@ func (form *FormData) MandatoryPaths(extensions []string, target *[]string) *For
 	return form
 }
 
-// Watermark binds the absolute path of the form data file that should be
-// used as a watermark source. Only a file uploaded with the "watermark"
-// field name will be included.
-func (form *FormData) Watermark(target *string) *FormData {
-	if form.errors != nil {
-		return form
-	}
-
-	if paths, ok := form.filesByField[WatermarkFormField]; ok && len(paths) > 0 {
-		*target = paths[0]
-	}
-
-	return form
-}
-
-// Stamp binds the absolute path of the form data file that should be
-// used as a stamp source. Only a file uploaded with the "stamp"
-// field name will be included.
-func (form *FormData) Stamp(target *string) *FormData {
-	if form.errors != nil {
-		return form
-	}
-
-	if paths, ok := form.filesByField[StampFormField]; ok && len(paths) > 0 {
-		*target = paths[0]
-	}
-
-	return form
-}
-
-// FacturXXml binds the absolute path of the uploaded Factur-X CII invoice
-// XML. Only a file uploaded with the "facturxXml" field name is included.
-func (form *FormData) FacturXXml(target *string) *FormData {
-	if form.errors != nil {
-		return form
-	}
-
-	if paths, ok := form.filesByField[FacturXXmlFormField]; ok && len(paths) > 0 {
-		*target = paths[0]
-	}
-
-	return form
-}
-
 // paths bind the absolute paths of form data files, according to a list of
 // file extensions, to a string slice variable.
-// embeds, watermark, stamp, and facturxXml files are excluded.
+// attachments are excluded.
 func (form *FormData) paths(extensions []string, target *[]string) *FormData {
-	embeds, ok := form.filesByField[EmbedsFormField]
-	watermarks, wmOk := form.filesByField[WatermarkFormField]
-	stamps, stOk := form.filesByField[StampFormField]
-	facturxXmls, fxOk := form.filesByField[FacturXXmlFormField]
-
-	// Collect (originalFilename, diskPath) pairs so that we can sort by
-	// original filename rather than by UUID-based disk name.
-	// See https://github.com/gotenberg/gotenberg/issues/1500.
-	type entry struct {
-		original string
-		disk     string
-	}
-	var entries []entry
+	attachments, ok := form.filesByField[AttachmentsFormField]
 
 	for filename, path := range form.files {
-		if ok && slices.Contains(embeds, path) {
-			continue
-		}
-
-		if wmOk && slices.Contains(watermarks, path) {
-			continue
-		}
-
-		if stOk && slices.Contains(stamps, path) {
-			continue
-		}
-
-		if fxOk && slices.Contains(facturxXmls, path) {
+		if ok && slices.Contains(attachments, path) {
 			continue
 		}
 
 		for _, ext := range extensions {
 			// See https://github.com/gotenberg/gotenberg/issues/228.
 			if strings.ToLower(filepath.Ext(filename)) == ext {
-				entries = append(entries, entry{original: filename, disk: path})
+				*target = append(*target, path)
 			}
 		}
 	}
 
 	// See https://github.com/gotenberg/gotenberg/issues/139.
-	originals := make(gotenberg.AlphanumericSort, len(entries))
-	for i, e := range entries {
-		originals[i] = e.original
-	}
-	sort.Sort(originals)
-
-	// Build a lookup from original name to disk path.
-	lookup := make(map[string]string, len(entries))
-	for _, e := range entries {
-		lookup[e.original] = e.disk
-	}
-	for _, o := range originals {
-		*target = append(*target, lookup[o])
-	}
+	sort.Sort(gotenberg.AlphanumericSort(*target))
 
 	return form
 }
 
 // append adds an error to the list of errors.
 func (form *FormData) append(err error) {
-	form.errors = errors.Join(form.errors, err)
+	form.errors = multierr.Append(form.errors, err)
 }
 
 // mustValue binds the target interface with a form field. If the value is

pkg/modules/api/formdata_test.go

@@ -1613,15 +1613,15 @@ func TestFormData_Paths(t *testing.T) {
 			expectCount: 2,
 		},
 		{
-			scenario: "files except embeds",
+			scenario: "files except attachments",
 			form: &FormData{
 				files: map[string]string{
-					"foo.pdf":     "/foo.pdf",
-					"embed_1.pdf": "/embed_1.pdf",
-					"embed_2.xml": "/embed_2.xml",
+					"foo.pdf":           "/foo.pdf",
+					"attachments_1.pdf": "/attachments_1.pdf",
+					"attachments_2.xml": "/attachments_2.xml",
 				},
 				filesByField: map[string][]string{
-					"embeds": {"/embed_1.pdf", "/embed_2.xml"},
+					"attachments": {"/attachments_1.pdf", "/attachments_2.xml"},
 				},
 			},
 			extensions: []string{".pdf"},
@@ -1759,7 +1759,7 @@ func TestFormData_mustAssign(t *testing.T) {
 	form.mustAssign("foo", "foo", &target)
 }
 
-func TestFormData_Embeds(t *testing.T) {
+func TestFormData_Attachments(t *testing.T) {
 	expected := []string{"/bar.xml", "/baz.xml"}
 
 	var actual []string
@@ -1770,70 +1770,16 @@ func TestFormData_Embeds(t *testing.T) {
 			"baz.xml": "/baz.xml",
 		},
 		filesByField: map[string][]string{
-			"embeds": {"/bar.xml", "/baz.xml"},
+			"attachments": {"/bar.xml", "/baz.xml"},
 		},
 	}
-	form.Embeds(&actual)
+	form.Attachments(&actual)
 
 	if len(actual) != len(expected) {
-		t.Errorf("expected %d embeds but got %d", len(expected), len(actual))
+		t.Errorf("expected %d attachments but got %d", len(expected), len(actual))
 	}
 
 	if !reflect.DeepEqual(actual, expected) {
 		t.Errorf("expected %v but got %v", expected, actual)
 	}
 }
-
-func TestFormData_FacturXXml(t *testing.T) {
-	for _, tc := range []struct {
-		scenario string
-		form     *FormData
-		expect   string
-	}{
-		{
-			scenario: "no facturxXml file",
-			form:     &FormData{},
-			expect:   "",
-		},
-		{
-			scenario: "facturxXml file present",
-			form: &FormData{
-				filesByField: map[string][]string{
-					FacturXXmlFormField: {"/tmp/abc/12345.xml"},
-				},
-			},
-			expect: "/tmp/abc/12345.xml",
-		},
-	} {
-		t.Run(tc.scenario, func(t *testing.T) {
-			var actual string
-
-			tc.form.FacturXXml(&actual)
-
-			if actual != tc.expect {
-				t.Errorf("expected %q but got %q", tc.expect, actual)
-			}
-		})
-	}
-}
-
-// TestFormData_paths_excludesFacturXXml verifies that an uploaded facturxXml is
-// never picked up as an input document by paths().
-func TestFormData_paths_excludesFacturXXml(t *testing.T) {
-	form := &FormData{
-		files: map[string]string{
-			"document.xml": "/tmp/abc/document.xml",
-			"factur-x.xml": "/tmp/abc/invoice.xml",
-		},
-		filesByField: map[string][]string{
-			FacturXXmlFormField: {"/tmp/abc/invoice.xml"},
-		},
-	}
-
-	var paths []string
-	form.paths([]string{".xml"}, &paths)
-
-	if len(paths) != 1 || paths[0] != "/tmp/abc/document.xml" {
-		t.Errorf("expected only the non-Factur-X .xml document, got %+v", paths)
-	}
-}