Auxiliary PDF Render Service 0.1.29 Stable (2026-10-22)

Version?Type?Release Date?Config.Changes?
0.1.29Stable2026-10-22No

Download: https://hub.docker.com/r/humio/pdf-render-service

Updates

Upgrades

Changes that may occur or be required during an upgrade.

  • Security

    • The Alpine upgrade updates the following system packages, addressing these CVEs:

      • pcre2 10.46-r0 to 10.49-r0: CVE-2026-86145 (CVSS 8.2), CVE-2026-89161 (7.8), CVE-2026-103111 (7.6), CVE-2026-89157 (7.4), CVE-2026-89160 (6.5), CVE-2026-89158 (6.5), CVE-2026-89156 (5.9), and CVE-2026-89162 (3.3).

      • zlib 1.3.2-r0 to 1.3.2-r1: CVE-2026-85091 (CVSS 7.4).

      • libpng 1.6.57-r0 to 1.6.59-r0: CVE-2026-40930 (CVSS 5.4) and CVE-2026-46675 (4.5).

      • musl 1.2.5-r12 to 1.2.6-r3: CVE-2026-107891.

      • tiff 4.7.1-r0 is no longer part of the image, which removes CVE-2026-4775 (CVSS 7.8).

  • Installation and Deployment

    • No configuration changes: this release contains base image and dependency updates only.

    • Upgraded qs to 6.16.1 to address CVE-2026-110816 (CVSS 5.3), where qs.stringify with the comma array format throws on certain inputs. The service was not exposed: it only uses qs to parse requests and never calls qs.stringify.

    • Upgraded brace-expansion to 2.1.7 and 5.0.12 to address CVE-2026-102276 (CVSS 7.5), CVE-2026-102278 (CVSS 7.5), and CVE-2026-102277 (CVSS 5.3), which allow a crafted brace pattern to exhaust the stack or CPU of a Node.js process. The service was not exposed: the library is used only by a development-time test coverage tool and is not installed in the runtime application.

    • Upgraded the base image from Alpine 3.22 to Alpine 3.24 and Node.js from 26.3.0 to 26.12.1, the current 26.x release, which includes the Node.js security release of 21 October 2026.

      The bundled Chromium moves from 142.0.7444.59 to 155.0.8059.84 as part of the Alpine upgrade. PDFs are now rendered by this newer Chromium version.