Carbone Changelog

Carbone v5.15.4

2026-10-06T12:00:00.000Z

Fix: DOCX templates using :html(inline) in a paragraph with borders or tab stops no longer fail with the error Cannot read properties of undefined (reading 'type').

Carbone v5.15.3

2026-10-01T12:00:00.000Z

Fix: When converting HTML to PDF using Chrome, images could stop downloading after processing a web page that changed the Content-Security-Policy (CSP).
- Improved Carbone ICE (Instant Converter Engine), especially for DOCX to PDF conversions:
  - If table of contents are saved with only first-level entries (common in Carbone templates), it is now rebuilt like Word does: deeper entries receive the correct styles and indentation. If a paragraph specifies a style not defined in the document, it now uses the default style instead.
  - Page breaks: If the first paragraph inside a content control starts with a page break, any extra space above is removed on the new page, just like Word does.
  - Charts: For charts with multiple data series and no title set, Word's default title ("Chart Title", in the document's language) is now displayed instead of leaving the space empty. Titles coming from spreadsheet cells are also shown correctly.
  - Lines mixing fonts: If a line has both a body font and a marker font (like Symbol or Wingdings), the line height now matches Word: it uses the tallest font's ascent and the deepest descent.
  - Improved ODT to PDF conversion: For bullet lists where the bullet uses a different font or size than the text, the line height now matches LibreOffice (highest ascent and deepest descent), and the text sits on the same baseline as the bullet.

Carbone v5.15.2

2026-09-25T12:00:00.000Z

:appendTemplate is much faster when it is called many times with a large data-set: each sub-document no longer receives a copy of the data. They are copied only if the appended template modifies them with the :set formatter. The jsonSize statistic sent to the afterRender storage plugin is now always 0 for "child" renders, as their data is already counted in the jsonSize of the parent render.
- Fix: The :set formatter now accepts whitespace around its name and parameter, like {d.value : set ( d.other.sub ) }. Previously, this syntax was not recognized as a :set marker: the value was stored with the legacy behavior (only at the root level of d or c, and only available to the tags placed after it in the document).

Carbone v5.15.1

2026-09-24T12:00:00.000Z

Improved Carbone ICE (Instant Converter Engine) for DOCX-to-PDF conversions:
- Table of contents now supports heading numbers before entries (if present)
- Headings with no color set are now white or black, depending on the background shade. Numbered heading shading now covers the number too.
- Conditional formatting for a table’s first/last row or column also applies to list items inside cells, not just plain paragraphs.
- Section pages are now laid out with the correct header. Previously, a section’s first page could be pushed down by a taller header from later pages, moving content down by up to 10 points.
  - [On-Premise] Improved and fixed the statistics sent to the afterRender storage plugin:
- Added a new type field:
  - "sync": for a synchronously generated document,
  - "async": for documents generated asynchronously and queued using the carbone-webhook-url header,
  - "child": for sub-documents generated by the appendTemplate formatter.
- Fix: Batch rendering (using batchSplitBy) previously sent no metrics; the metrics object was missing and "isDebugActive": true did not provide a debug object. The batchSize now counts all generated documents, so for a batch of 50 documents, "batchSize": 50" is returned.
- Fix: The jsonSize statistic was always missing for asynchronously generated documents
- Fix: Improved error handling for batch generation if a batch reaches the time limit, a timeout error is now correctly returned.

Carbone v5.15.0

2026-09-22T12:00:00.000Z

Added the failOn option of POST /render: with "failOn": ["IMAGE_URL_ERROR"], the report generation stops and returns an error if an image cannot be downloaded from its URL, instead of replacing it with the "broken image" placeholder. As with :appendFile and :appendTemplate, an empty or undefined image value is not an error, and the report is generated as usual. Only images coming from a URL are concerned: base64 images, barcodes and charts keep their current behavior. The option must be an array of strings, and an unknown value is rejected with an explicit error instead of being ignored.
- ⚡️ Improved Carbone ICE (Instant Converter Engine), even faster than the first version in 5.14.0, still requires no LibreOffice or any other program on the machine. Use it the same way: "converter": "I" in the options of POST /render, or "Carbone ICE" in the document converter panel of the Studio preview, or with {o.converter=I} in the template.
  - Improved DOCX to PDF conversion:
    - Table of contents: entries and their page numbers are automatically updated.
    - Footnotes: now show their separator and notes
    - Fixes more than 100 bugs: Rows taller than a page, page break before, section-specific page numbering, vertical text, shape groups, text in shapes and columns, floating tables, cell and header row heights, cell clipping, table borders, whitespace around text, and the positioning of shapes and images, complex sections, etc...
  - Supports ODT to PDF conversion [Beta] From 3x to 300x faster than the LibreOffice converter, with speed improvements scaling with document size (the larger the document, the greater the speed gain). Supports ODT templates with different page formats and sections (paper size, margins, headers/footers, mixed portrait/landscape, text columns), paragraph and character styles, right-to-left languages, lists and outline numbering, tables (borders, shading, merges, floating tables, rows kept together), images, shapes with text inside them, connectors, gradients, form controls, and basic charts rendered as vectors. Not yet supported (list may be incomplete): comments, tracked changes, and footnotes/endnotes. These elements are ignored if present; the rest of the document is converted normally. Consider this ODT-to-PDF as beta and only use it for documents that need extreme conversion speed.
  - Supports right-to-left languages (Arabic, Hebrew) using the complete Unicode bidirectional algorithm, for text, tables, and image placement.
  - Requesting the template's own file format (docx to docx, odt to odt) no longer returns an error.
  - Improved performance with smarter rotating cache management: fonts are now kept in memory from one document to the next, saving multiple milliseconds per document and per font face. The new iceFontCacheSize setting (environment variable CARBONE_ICE_FONT_CACHE_SIZE, 24 by default) controls how many font faces a factory keeps.
- [Carbone Studio Cloud] Improvements and fixes
  - The account menu now mirrors Carbone Account: Overview, API keys, Plans & pricing, Billing, Team members, and My profile, each returning to Studio after use. These pages are visible only to administrators and are hidden from other team members, as is the link to unlock the paid preview. Signing out is now done through Carbone Account.
  - A new version uploaded from the Studio now keeps the origin of the template (API, HubSpot, Salesforce, Odoo) instead of being marked as a Studio template, so all versions of a template share the same origin.
- Fix: HTML to PDF, the <carbone-pdf-header>, <carbone-pdf-footer> and <carbone-pdf-options> custom elements are now detected even if the tag is spread over multiple lines, contains extra spaces or attributes, or is written in uppercase. Previously, the multi-line form of <carbone-pdf-options> was ignored, and a header written as <carbone-pdf-header > silently disappeared from the PDF while staying visible in the document. Also fixes the page-ranges option to accept a string like "1-5"; ranges containing only digits, such as page-ranges="2", are now accepted.
- The self-hosted binaries are now built with Node 24. Contrary to what was previously announced, version 5.14.0 still worked with Node 22.
- Fix: POST /render with "data": null no longer crashes when the template has an image marker with a value (e.g., {d.signature:prepend('data:image/jpeg;base64,')}).

Carbone v5.14.5

2026-09-11T12:00:00.000Z

Fixed conversions failing in a cluster when the job balancer is enabled, for HTML templates with Chrome converter

Carbone v5.14.4

2026-09-08T12:00:00.000Z

⚠️ Important Security Update: Following an in-depth internal penetration test, we strongly recommend updating to this version to address two critical security fixes and numerous other improvements that significantly increase Carbone's overall security. Contact us if you want more details about the two critical security issues. The release note remains intentionally vague for security reasons, and the Open Source version will be updated in a few weeks.
- Critical: The LibreOffice converter is now significantly more secure.
- Critical: For historical reasons, Carbone allowed changing the template file extension (file type) via the API without strict validation. This is now restricted: only recognized formats (like docx, xlsx, xhtml, etc.) are accepted.
- LibreOffice converter: watermarking, file attachments (:appendFile, :attachFile, :appendTemplate), and signing (:sign) now work together even when generating password-protected PDFs. Previously, as soon as a PDF was protected with a password, the other features would stop working.
- Carbone ICE (Instant Converter Engine) now supports PDF encryption and watermarks, with the same options as Chrome, OnlyOffice, and LibreOffice.
- Documents generated in HTML, XHTML, SVG, or XML are now served with the Content-Security-Policy: sandbox HTTP header. This causes browsers to give these files an isolated origin and blocks all scripts, protecting against code injection.
- The X-Content-Type-Options: nosniff header is now reliably set on every response. Browsers are required to respect the Content-Type Carbone provides, reducing the risk of content-type based attacks.
- Added securityLevel options to remove local references in generated documents for these formats: docx, xlsx, xlsm, pptx, odt, ods, odp, odg, fodt, fods, fodp, html, xhtml, md, svg, xml, txt, css, rtf, mht, mhtml, vml.
  - SECURITY_API_REMOVE_LOCAL_HYPERLINK (256): Removes hyperlinks and references to private networks (local IPs, localhost, etc.).
  - SECURITY_API_REMOVE_EXTERNAL_FILE_REFERENCE (512): Removes references to local files (e.g., file paths) from documents.
- Authentication failures (other than missing or expired tokens) now return a 401 Unauthorized with a generic message: Unauthorized Access: Invalid API key or access token., instead of a 500 error with internal details.
- To prevent Denial of Service attacks, the following formatter arguments are now limited:
  - formatN and formatC decimal places: maximum 40
  - padl and padr target length: maximum 10,000 characters
  - Barcode width and height: maximum 1,000 millimeters each, and a combined area (with scale) of 25 million pixels
  - Barcode textsize: maximum 100 points
  - If these limits are exceeded, the value is rejected outright rather than silently reduced. Also, replace('') no longer inserts the replacement between each character.
- Hyperlinks provided in your dataset are now validated before being included in the generated document. This prevents malicious URLs from affecting the document's structure. Carbone encodes URLs before inserting them—if the URL already included a percent-escape (like %20), this is now handled reliably and safely. Additionally, malformed percent sequences (like a single %) are now safely encoded and will no longer cause errors during rendering.
- Color values from your dataset, used with bindColor, are now validated before being written in the document. Only hexadecimal color values are accepted; any invalid color is simply ignored and the inherited color is kept, as before. This safely prevents injection of unexpected content via colors.

Carbone v4.27.0

2026-09-08T12:00:00.000Z

Upgrade to the latest Node 22
- ⚠️ Important Security Update: Following an in-depth internal penetration test, we strongly recommend updating to this version to address two critical security fixes and other improvements that increase Carbone's overall security. Contact us if you want more details about the two critical security issues.
- Critical: The LibreOffice converter is now significantly more secure.
- Critical: For historical reasons, Carbone allowed changing the template file extension (file type) via the API without strict validation. This is now restricted: only recognized formats (like docx, xlsx, xhtml, etc.) are accepted.
- Documents generated in HTML, XHTML, SVG, or XML are now served with the Content-Security-Policy: sandbox HTTP header. This causes browsers to give these files an isolated origin and blocks all scripts, protecting against code injection.
- The X-Content-Type-Options: nosniff header is now reliably set on every response. Browsers are required to respect the Content-Type Carbone provides, reducing the risk of content-type based attacks.
- Authentication failures (other than missing or expired tokens) now return a 401 Unauthorized with a generic message: Unauthorized Access: Invalid API key or access token., instead of a 500 error with internal details.
- To prevent Denial of Service attacks, the following formatter arguments are now limited:
- formatN and formatC decimal places: maximum 40
- padl and padr target length: maximum 10,000 characters
- Barcode width and height: maximum 1,000 millimeters each, and a combined area (with scale) of 25 million pixels
- Barcode textsize: maximum 100 points
- If these limits are exceeded, the value is rejected outright rather than silently reduced. Also, replace('') no longer inserts the replacement between each character.
- Hyperlinks provided in your dataset are now validated before being included in the generated document. This prevents malicious URLs from affecting the document's structure. Carbone encodes URLs before inserting them—if the URL already included a percent-escape (like %20), this is now handled reliably and safely. Additionally, malformed percent sequences (like a single %) are now safely encoded and will no longer cause errors during rendering.
- Color values from your dataset, used with bindColor, are now validated before being written in the document. Only hexadecimal color values are accepted; any invalid color is simply ignored and the inherited color is kept, as before. This safely prevents injection of unexpected content via colors.

Carbone v3.9.0

2026-09-07T12:00:00.000Z

Upgrade to the latest Node 22
- ⚠️ Important Security Update: Following an in-depth internal penetration test, we strongly recommend updating to this version to address two critical security fixes and other improvements that increase Carbone's overall security. Contact us if you want more details about the two critical security issues.
- Critical: The LibreOffice converter is now significantly more secure.
- Critical: For historical reasons, Carbone allowed changing the template file extension (file type) via the API without strict validation. This is now restricted: only recognized formats (like docx, xlsx, xhtml, etc.) are accepted.
- Documents generated in HTML, XHTML, SVG, or XML are now served with the Content-Security-Policy: sandbox HTTP header. This causes browsers to give these files an isolated origin and blocks all scripts, protecting against code injection.
- The X-Content-Type-Options: nosniff header is now reliably set on every response. Browsers are required to respect the Content-Type Carbone provides, reducing the risk of content-type based attacks.
- To prevent Denial of Service attacks, the following formatter arguments are now limited:
- formatN and formatC decimal places: maximum 40
- padl and padr target length: maximum 10,000 characters
- Barcode width and height: maximum 1,000 millimeters each, and a combined area (with scale) of 25 million pixels
- Barcode textsize: maximum 100 points
- If these limits are exceeded, the value is rejected outright rather than silently reduced.
- Hyperlinks provided in your dataset are now validated before being included in the generated document. This prevents malicious URLs from affecting the document's structure. Carbone encodes URLs before inserting them—if the URL already included a percent-escape (like %20), this is now handled reliably and safely. Additionally, malformed percent sequences (like a single %) are now safely encoded and will no longer cause errors during rendering.
- Color values from your dataset, used with bindColor, are now validated before being written in the document. Only hexadecimal color values are accepted; any invalid color is simply ignored and the inherited color is kept, as before. This safely prevents injection of unexpected content via colors.

Carbone v5.14.3

2026-08-25T12:00:00.000Z

Fix: a template error in a batch item (e.g. Missing showEnd or hideEnd) no longer crashes the worker. The error is now returned to the callback instead.

Carbone v5.14.2

2026-08-25T12:00:00.000Z

Fix: Version v5.14.0 introduced a regression due to a security headers update, which prevented downloading generated documents inside an iframe. This has been fixed.
- Fix: HEAD /render/:renderId is now allowed without authentication, like GET /render/:renderId. A HEAD used to return 401 when authentication was on.

Carbone v5.14.1

2026-08-21T12:00:00.000Z

[EE] Fix: :set() with a relative path (e.g. {d.obj.val:set(.flag)}) no longer crashes when the parent object is missing from the data. The value is left unset, the same way a marker naming missing data prints nothing.
- [EE] Fix: batchReportName is now respected even when the ZIP contains only one file.
- Carbone ICE (Instant Converter Engine): now correctly handles line breaks.

Carbone v5.14.0

2026-08-18T12:00:00.000Z

Upgraded all dependencies and switched from Node 22 to Node 24
- ⚡️ New converter: Carbone ICE (Instant Converter Engine). It reads a DOCX and converts it to PDF directly within Carbone, without relying on LibreOffice, OnlyOffice, Chrome or any other program on the machine. There is no office suite to install, no external process to start, watch or restart, and no temporary file written between the report generation and its conversion.
  - Up to 60x faster than LibreOffice on a 1000-page DOCX, and 3x faster on a one-page document. The bigger the document, the wider the gap: a large report no longer pays the fixed cost of an office suite loading it, laying it out and printing it.
  - When the job balancer is off, the document is handed directly from the render process to the converter in memory. On a 150-page report, this reduces the handover time to 30 ms instead of 345 ms.
  - How to use it: pass "converter": "I" in the options of POST /render, next to the existing "L" (LibreOffice), "O" (OnlyOffice) and "C" (Chrome). In the Studio, pick "Carbone ICE (docx to pdf)" in the document converter panel of the preview. The converter is enabled and available by default. It can be disabled by setting carboneIcePath (environment variable CARBONE_CARBONE_ICE_PATH) to an empty string.
  - Multi-threaded: Carbone ICE converts multiple documents in parallel, controlled by the factories setting (CARBONE_FACTORIES). Each factory runs as a worker thread.
  - Scope for this first release:
    - DOCX to PDF conversion only. Support for more formats coming soon.
    - Pages/sections: Handles page size/orientation, section margins, headers, footers, mixed portrait/landscape, page/section breaks, text columns.
    - Headers/footers: Different headers/footers for first, odd/even pages, per section. Calculates PAGE, NUMPAGES, SECTIONPAGES.
    - Paragraphs: Supports all paragraph styles, alignment (left/center/right/justified), indentation, spacing, line spacing, tab stops, borders, shading, widow/orphan control.
    - Text: Character styles, fonts, size, bold/italic/etc, color, highlighting, letter spacing, and clickable hyperlinks.
    - Lists: Numbered/bulleted lists at all levels, with correct numbering format, bullet shapes, indentation, and alignment.
    - Tables: Styles, conditional formatting (header rows/columns etc.), layouts, column widths, merges, cell borders/shading, nested tables, repeated header rows, floating tables.
    - Pictures: Inline/floating images with all positioning options, cropping, full PNG/JPEG/SVG support keeping original color profiles and EXIF.
    - Shapes/Text boxes: Supports standard and custom shapes, all fills/outlines, text inside shapes with correct styles.
    - Charts: Bar, line, area, pie, doughnut—drawn as vectors. Includes titles, legends, axes options, gridlines, labels, colors, number formats.
    - Fonts/colors: Uses installed fonts or falls back to "Noto Sans". Reads all system font directories at startup.
    - Fidelity: Output is matched pixel-for-pixel to the PDF saved from Word, ensuring layout accuracy.
  - Not yet supported (may not be exhaustive): WEBP images, table of contents, SmartArt, complex charts, footnotes/endnotes, comments, tracked changes, bookmarks and links to them, form fields, equations, EMF/WMF images (Windows-only). These are ignored if present; the document still converts.
- Fix: GET /templates now returns a 400 error instead of a 500 when search or category contains a malformed URI (e.g. a % not followed by two hex digits).
- Fix: files inside the ZIP archive of batch processing now keep the decoded batchReportName. An index is appended to the filename (e.g. report_1.pdf, report_2.pdf) when batchReportName is empty or not dynamic (it does not contain a Carbone tag). A second protection also triggers this automatic indexed naming if the first two files have the same name. Filenames are sanitized (.., /, \, Windows reserved names such as CON/NUL, and characters like :*?"<>|). Note: the generated filename index is not guaranteed to match the order of the input data.
- [Studio] Fixed issue where the converter would not correctly reset to LibreOffice when navigating to or from the design page.
- :html formatter: optimize DOCX HTML list rendering by applying the numbering reset only to

Carbone v5.13.1

2026-08-15T12:00:00.000Z

⚠️ Chrome converter Only (HTML to PDF) : Fixed a rare issue where PDFs could mix content from different reports if several were generated at the same time. Now, each PDF always contains the correct data. No more blocked or mixed documents if a download is cancelled or the connection is lost during PDF creation. Errors or interruptions for one PDF can no longer affect another.
- [EE] Hardened the job balancer (only when CARBONE_JOB_BALANCER=true) with improved cluster-wide ID safety to prevent collisions. Cancelled or interrupted reports are now safely re-queued and are never lost or duplicated. This improvement is independent of the Chrome issue above and was made at the same time as a comprehensive review of the job system's robustness.

Carbone v5.13.0

2026-08-10T12:00:00.000Z

Chrome converter improvements:
- Reverted the changes in 5.12.0 regarding the maximum message size between Carbone and Chrome. Chrome enforces a built-in 100MB limit on messages (input HTML, or generated PDF), regardless of what Carbone sets for its WebSocket. The Carbone-defined limit is therefore removed. When the Chrome limit is reached, Carbone now swiftly restores communication, ensuring stability.
- Carbone forces Chrome to exit after 5 seconds if it cannot shut down properly, preventing an infinite wait.
  - Added the ability to disable detection of missing i+1 tag in v5 when a pre-release tag (preReleaseFeatureIn) is set to a value lower than 5000000 in the template, API, or global configuration (CARBONE_PRE_RELEASE_FEATURE_IN). This can force Carbone v5 to behave like Carbone v4, helping you migrate to production without fixing legacy templates that contain syntax errors but previously worked in v4. Only features and fixes introduced up to the specified tag are enabled. Any introduced in a higher tag are disabled.
  - Multiple improvements to PDF operations when generating PDFs with Chrome and OnlyOffice converters:
- Default encryption is now AES-256 instead of the deprecated 128-bit encryption.
- Password protection now encrypts document properties (Title, Author, Subject, and other Info strings).
- Encryption performance improved by a factor of 5.
  - Appending, merging, and adding multiple watermarks to PDFs is now at least twice as fast.
  - Studio improvements
- studio.setConfig({ defaultDataPanel : 'editor' }) selects the panel shown at startup in the data editor: 'editor' for the raw JSON editor (default), 'viewer' for the simplified JSON viewer, where clicking a property inserts the corresponding Carbone tag. The user can still switch panels with the two buttons of the data editor.
- Accept more template origins: Salesforce (origin = 2), Odoo (3), HubSpot (4). For reference: 0 = API, 1 = Studio.
  - [EE] Markdown templates now support dynamic barcodes (:barcode) and charts (:chart). Use an <img src="{d.config:chart}" width="600" height="400"/> tag to control the size of the injected image in the converted PDF/DOCX/ODT.
  - [EE] The :html formatter now renders <hr>, <blockquote> and the task list checkboxes (<input type="checkbox">) in ODT/DOCX/PDF documents. This is a pre-release feature: it requires {o.preReleaseFeatureIn=5011000} in the template, otherwise the tags are ignored.
- The three elements are supported everywhere: inside the lists, the table cells, the headings, and inside a paragraph, which <hr> splits while keeping the surrounding styles. The spacing and the indentation reproduce a browser: 0.5em around the rule, 40px for a quote, cumulative on each nesting level and added to the indentation of a list.
- New quotetheme option for <blockquote>, like tabletheme and headingtheme: it applies a paragraph style of the template to the quotes instead of the default indentation, for example {d.content:html(quotetheme:Quote)}. Word and LibreOffice both provide a Quote and an Intense Quote style by default. In ODT, a style name containing a space must be written the way ODF stores it, so Intense Quote is passed as Intense_20_Quote.
- A checkbox is ticked with the HTML checked attribute, whatever its form (checked, checked="", checked="checked"), and unticked without it: <ul><li><input type="checkbox"> todo</li><li><input type="checkbox" checked> done</li></ul>.
- In DOCX a checkbox stays clickable in Word, and it is rendered as a character everywhere else (☑/☐). Like a browser, the bullet of a task item is not rendered. Only <input type="checkbox"> is rendered, the other input types are ignored.
  - [EE] Fixed the :html formatter. Unless stated otherwise, the fixes require {o.preReleaseFeatureIn=5011000} so the existing templates are not impacted:
- An unencoded < (e.g. i<=2 in a <pre> block) could swallow the next real closing tag, corrupting the rest of the content. It now renders as expected.
- In DOCX, two identical <ol>/<ul> lists shared the same numbering ID, so Word continued the count instead of restarting the second list. The second list now resets the numbering.
- Like a web browser, a <?xml ?> processing instruction and a closing tag whose </ is not followed by a letter (</ 3>, </>) are now ignored.
- A <td>, <th> or <tr> placed outside a <table>, and a block element left unclosed at the end of the HTML (<b><li>), were throwing an error and stopping the whole rendering. Fixed for all templates, no option needed.
- A list or a table left unclosed (<ul><li>a, <table><tr><td>A) generated an invalid XML, refused by Word: the missing closing tags are now added, and a closing tag without an opening tag is ignored, like a browser.
- The CSS of an element without a closing tag leaked on all the content coming after it: <br style="color:red"/> turned the rest of the document red.
- A <pre> placed inside a list item was rendered on the same line as the item, and in DOCX its line breaks produced an invalid <w:br/> nested inside <w:t>: Word rendered it, but any tool reading <w:t> as a simple text lost everything after the first break.
- An <img> with uppercase attributes (SRC, WIDTH, HEIGHT) was dropped, HTML attribute names are case-insensitive.
- A text or a paragraph placed inside a <table> but outside a cell (<table><p>text</p><tr>...) generated an invalid XML. Like a browser, it is not rendered inside the table anymore.
- The element names are now matched without the case: <P>, <B>, <BR>, <UL> and <LI> were ignored.
- An attribute is now read whatever its quoting. HTML accepts href="x", href='x' and href=x, only the double quotes were read, so a link, an image, a style or a colspan written with the two other syntaxes was silently lost.
- ODT: the headings <h1> to <h6> had no style when no headingtheme was provided. A <text:h> needs a style name, so the built-in Heading_20_1 to Heading_20_6 of the template are now used.

Carbone v5.12.0

2026-07-29T12:00:00.000Z

Improved logging: Suppressed unnecessary error messages during routine cleanup of the template/render directories when files are already deleted or removed due to race conditions.
- [EE] Cluster peer connections (peerPort / peerEndpoints) are now more reliable, key improvements:
  - A periodic supervisor:
    - Recreates the WebSocket server if it crashes or the port becomes unavailable (EADDRINUSE).
    - Re-resolves peerEndpoints via DNS, so peers with changed IPs (e.g. during Kubernetes rolling updates) are rediscovered.
    - Reconnects to any missing peer endpoint.
    - Cleans up dead connections using a liveness timer when a connection opens, preventing rare deadlocks that could occur in previous versions and ensuring automatic connection recovery without requiring a restart.
  - New exposed parameter peerCheckInterval (or CARBONE_PEER_CHECK_INTERVAL, default 10s): period of the peer liveness ping. The supervisor runs twice as often (half this value) so a lost peer is re-dialed faster than it is detected.
  - Connections establish more reliably, no matter which peer initiates
  - Supervisor uses exponential backoff: starts at half peerCheckInterval, increases up to 1 minute, and resets to fast on important events (startup, server restart, peer connect/disconnect).
  - Peer DNS resolution is fault-tolerant: if a peer name cannot be resolved (e.g. missing DNS during a rolling update), other available peers still connect; the whole cluster isn't skipped.
  - Maximum WebSocket message size for cluster peer connections now uses the existing maxDataSize (CARBONE_MAX_DATA_SIZE) parameter. By consequence, the default changed from 100MB to 60MB.
  - Improved Event-bus logs: cluster events show peer count and addresses resolved by DNS resolution (only when changed). Unreachable peers are logged with the next retry delay (e.g. cannot reach peer ... - retrying in Xs) at every attempt, so network issues are visible without enabling debug logs. Remaining low-level socket errors are shown only at debug level.
- The maximum message size between Carbone and Chrome is now limited by the existing maxDataSize (CARBONE_MAX_DATA_SIZE). As a consequence, the default changed from 100MB to 60MB (same as default maxDataSize).

Carbone v5.11.0

2026-07-24T12:00:00.000Z

[EE] Make the :autoOrient formatter more robust when DOCX files are edited with Microsoft Word Online.
- [EE] The :html formatter now renders the <sup>, <sub>, <mark>, <code>, <kbd>, <samp>, and <pre> elements in ODT/DOCX/PDF documents. This is a pre-release feature: it requires {o.preReleaseFeatureIn=5011000} in the template, otherwise the content of these tags is rendered without formatting.
  - <sup> / <sub>: renders text as superscript / subscript.
  - <mark>: applies a fixed yellow highlight (color not customizable).
  - <code> / <kbd> / <samp> — applies the Courier New font.
  - <pre>: renders preformatted text, preserving newline characters (\n, \r\n), with the Courier New font. An empty paragraph is added after the block to mimic the browser's bottom spacing.
  - Options affecting <pre>:
    - nospace: removes the empty paragraph added after a <pre> block.
    - inline: collapses newline characters to a single space. <pre> keeps its Courier New font but no longer renders newlines.
  - Each element must have a matching opening and closing tag; an unclosed tag (e.g. a <pre> with no </pre>) produces invalid HTML.
- [EE] Fixed :html heading rendering (<h1>–<h6>) in ODT templates: when a heading is not closed, the empty paragraph reproducing the browser's bottom spacing is now added. It was previously missing.

Carbone v5.10.0-beta

2026-07-09T12:00:00.000Z

[EE] The job balancer now also distributes asynchronous rendering jobs (POST /render with a webhook). When enabled, both job types (document conversions and asynchronous document generations) can be offloaded to other peers that have available resources.
- Asynchronous jobs are now stored on disk in a compressed format, reducing disk usage and speeding up job transfers between peers.

Carbone v5.9.2

2026-06-30T12:00:00.000Z

Improved logs when the job balancer is used, making it easier to distinguish between external requests and internal job distribution.

Carbone v5.9.1

2026-06-30T12:00:00.000Z

[EE] Added a job balancer (Beta) that spreads document conversion load across the peers of a cluster. When a peer is idle and another peer is overloaded, the idle peer automatically "steals" pending conversion jobs from the busy peer, runs them locally, and sends the result back. This smooths out conversion spikes without any external load balancer.
- Disabled by default. Enable it with the jobBalancer parameter (env var CARBONE_JOB_BALANCER=true).
- It only works when the internal cluster channel is enabled, i.e. when peerPort is set (and peers are reachable through peerEndpoints). If peerPort is not defined, the job balancer stays inactive even when jobBalancer is true.
- How it works: each peer periodically broadcasts the size of its conversion queue to the other peers. A peer that has free conversion factories pulls jobs from the most overloaded peer (pull-based model, so newly started peers naturally take their share and slow peers take fewer jobs). Aborted jobs and timeouts are propagated to the remote peer, and a peer stops stealing new jobs as soon as it begins a graceful shutdown.
- ⚠️ Like the rest of the cluster channel, this internal traffic is not authenticated or encrypted: use it only inside a secure private network.
  - [EE] The OpenMetrics /metrics endpoint now exposes a new gauge carbone_reports_inflight{stage="conversion"} reporting the number of document conversion jobs currently waiting in the queue.

Carbone v5.9.0

2026-06-22T12:00:00.000Z

If data is undefined when calling POST /render, Carbone only converts the file and skips the entire templating process. As a result, tags remain unchanged in the converted document.
- Added support for the custom header carbone-egress-header-authorization to customize the authorization header for egress traffic, such as webhooks, images, and external PDF URLs. For example, if carbone-egress-header-authorization: my-secret is included during report generation, the header authorization: my-secret will be added when Carbone calls a webhook, an external image URL, an external PDF URL, etc. If carbone-webhook-header-authorization is used at the same time, it overrides carbone-egress-header-authorization for webhook calls only. Only the authorization header can be customized, and its value must not exceed 512 characters.
- Studio: General UX improvements:
  - Rename the "Stop Auto-Upload" button to the less technical "Finish Editing".
  - Improve filename readability for long filenames by displaying as much of the name as possible while always keeping the end of the filename visible (use an ellipsis in the middle).
  - Clearly indicate that the Studio is listening for file changes with a subtle, low-resource animated icon.
  - Clearly show how long ago the file was updated and when the latest changes were synchronized and taken into account by the Studio.
  - Add a Docs button with an enriched menu.
  - Fix the Profile button on Safari.
  - Improve text search in the JSON editor with Next and Previous buttons, a result counter, and the current search position. If more than 200 occurrences are found, the UI stops counting them to avoid performance issues with very large JSON files.

Carbone v5.8.0

2026-06-10T12:00:00.000Z

[Studio] Fix the drop-down list bug and the recent list issue in Safari.
- [On-Premise only] In Markdown templates, the special tag {o.styleSource = templateOrVersionId} allows applying the style from another DOCX or ODT template. The style template can include Carbone tags. Styles such as headings, tables, headers, and footers are applied only when converting Markdown to DOCX, ODT, or PDF.
- [EE] PDFs generated with Chrome and OnlyOffice converters now support full encryption and security options, matching LibreOffice.
  - All PDF security features are supported:
    - EncryptFile (boolean): Enable PDF encryption (requires password).
    - DocumentOpenPassword (string): Password required to open the PDF.
    - RestrictPermissions (boolean): Restrict actions like printing, copying, and editing (requires PermissionPassword).
    - PermissionPassword (string): Password to set/change permissions.
    - Changes (integer): Control what edits are allowed (0: none, 1: pages, 2: forms, 3: comments/forms, 4: all except extraction).
    - EnableCopyingOfContent (boolean): Allow content copying.
    - EnableTextAccessForAccessibilityTools (boolean): Allow access for accessibility tools.
    - Printing (integer): Allow printing (0: none, 1: low-res, 2: high-res).
- Increased the allowed memory allocation to 8 GB to support large XLSX reports.

Carbone v5.7.0

2026-06-05T12:00:00.000Z

[Studio] Small UI fixes and update BeerCSS to v4.0.21 (Material Design M3)
- Template list: remove empty items from category/tag filters
- The selected item in the list is now visible only after pressing a keyboard arrow key to avoid confusion with mouse hover
- Replace HTML main tags with div elements to keep a single global main element and avoid bugs with the new BeerCSS
- Harmonize margins and button styles
- Use the new split buttons
- Improve table responsiveness
  - Accept equality filters that do not strictly match types in array search expressions (lookup), added in v5.2.0. For example: table[rank=3] matches both rank = 3 and rank = '3'. This change aligns the behavior with the historical behavior of array filters.

Carbone v5.6.1

2026-05-14T12:00:00.000Z

[On-Premise] Added the global parameter maxDownloadFileTimeout (CARBONE_MAX_DOWNLOAD_FILE_TIMEOUT) to configure the default timeout (6 seconds) for downloading images or files from URLs or when using appendTemplate (which behaves similarly by downloading a file from another Carbone instance).
- [On-Premise] Added the global boolean parameter pdfPostCompression (CARBONE_PDF_POST_COMPRESSION, default: false), which can reduce PDF size by up to 3x when merging PDFs using :appendTemplate, :appendFile, or during batch processing to a single PDF output.
- [EE] Fix: PDF templates that use annotations with Carbone tags to update forms are now cleanly removed from the result PDF.
- [EE] PDFs generated with Chrome converter can now be encrypted using the same options as LibreOffice. Example: { "convertTo": { "formatName": "pdf", "formatOptions": { "EncryptFile": true, "DocumentOpenPassword": "QWERTY1234" } } }
- [EE] Fix: Timeout when downloading images or files from URLs when using batch processing no longer causes a crash.
- [On-Premise] Improve logs at startup (number of factories, show if options pdfPostCompression or nbReportMaxPerBatch are activated)

Carbone v5.6.0

2026-05-07T12:00:00.000Z

[EE] The :autoOrient formatter can be used to automatically rotate an image according to the camera or smartphone orientation. It is supported only in DOCX templates. It can be used with imageFit(contain) or imageFit(fillWidth), but not with imageFit(fill). It only works with JPEG images. Other image formats ignore this formatter. To reduce processing as much as possible, the orientation is applied directly in the template (no JPEG processing).
- Fix: Accepts whitespace before the :color formatter.
- [EE] The :color(scope, type) formatter is supported in PPTX templates for all combinations of type (background, text, border) and scope (row, cell, shape). "border" is supported only for shapes.

Carbone v5.5.1

2026-05-06T12:00:00.000Z

[On-Premise] Add the debug option DEBUG=carbone:webserver to see sparse logs of the HTTP body and headers when a report is generated

Carbone v5.5.0

2026-04-30T12:00:00.000Z

[EE] Added a new :drop/:keep option col to dynamically delete table columns. This beta feature is supported for DOCX, XLSX, PPTX, ODT, ODS, ODP, and HTML templates. Example Carbone tag to place in a table cell: {d.value:ifEM:drop(col)}. This means that if the value is empty, the entire column is deleted. It can be combined with other :drop(row) tags or with multiple :drop(col) tags based on different conditions.
- [EE] The :html formatter supports the full spectrum of HTML entities (previously limited to named entities only):
  - Added full support for decimal © and hexadecimal © numeric entities, with strict XML 1.0 validation.
  - Added Emojis support as literal Unicode characters and numeric HTML entities.
  - Fixed named entities mapping to two code points (e.g. &fjlig;, &caps;) now render correctly.
- [EE] Completely reworked the asynchronous rendering system with webhooks to fix race condition issues and speed up processing.
- [EE] Reduce the risk of converter starvation when a template uses appendTemplate. When a template uses this formatter, maxDownloadFileConcurrency is automatically adjusted for this report only, so it is lower than or equal to the number of converter threads.

Carbone v5.4.5

2026-04-13T12:00:00.000Z

[On-Premise] Fixed Markdown file type detection to enable MD to PDF, MD to DOCX, MD to ODT, ...
- [On-Premise] Added Markdown support in the Studio
- Fixed Swiss QR code (swissqrcode) bugs related to accented characters
- Fixes for the :html formatter:
  - Multiple arguments provided to the formatter were not recognised; now fully supported: Custom Heading and/or Table Themes and/or the "nospace" option.
  - If the HTML contained a color as an inline style, it was not recognised when it contained space characters; it is now fully recognised.

Carbone v5.4.4

2026-04-08T12:00:00.000Z

Add the new optional tag {o.hardRefresh=true} to force a template to be processed by a converter (LibreOffice, etc.) even when the output file type is the same as the input file type. For example, it can be used to update XLSX formulas after Carbone injects the data.
- Add limits maxTemplateUncompressedSize (200 MB by default) for unzipped templates to improve resistance to zip bomb denial-of-service attacks (CVE-2026-18929)
- [EE] Update to Node 22.22.2

Carbone v4.26.3

2026-04-07T12:00:00.000Z

[EE] Update to Node 20.20.2
- Add limits maxTemplateUncompressedSize (200 MB by default) for unzipped templates to improve resistance to zip bomb denial-of-service attacks (CVE-2026-18929)