2026.10.25

Fixed

• Images are detected by content when the extension is wrong or missing (image.php, scan.pdf
  holding a PNG/JPEG/GIF/BMP/WebP/TIFF…): they render as images instead of text or a failed
  conversion. RAW camera files keep their extension.

Changed

• The image applies Debian security updates on top of the Gotenberg base at build time, and so on
  every weekly rebuild: 659 fixable HIGH/CRITICAL CVEs in Chromium, LibreOffice, OpenSSL… down to 0.
• The image is a single flattened layer, so upgraded packages replace the base's copies instead of
  stacking on them: 2.75 GB (layered with the upgrade it would be 3.99 GB). A pull downloads the
  whole layer once per release instead of sharing layers with gotenberg/gotenberg.

What's Changed

• Test: untrusted HTML runs no JS and fetches nothing by @ohmyfelix in #2
• Image: Debian security updates in a single flattened layer by @ohmyfelix in #3

Full Changelog: 2026.10.24...2026.10.25