Carbone Changelog

Carbone v5.14.5

2026-09-11T12:00:00.000Z

Fixed conversions failing in a cluster when the job balancer is enabled, for HTML templates with Chrome converter

Carbone v5.14.4

2026-09-08T12:00:00.000Z

⚠️ Important Security Update: Following an in-depth internal penetration test, we strongly recommend updating to this version to address two critical security fixes and numerous other improvements that significantly increase Carbone's overall security. Contact us if you want more details about the two critical security issues. The release note remains intentionally vague for security reasons, and the Open Source version will be updated in a few weeks.
- Critical: The LibreOffice converter is now significantly more secure.
- Critical: For historical reasons, Carbone allowed changing the template file extension (file type) via the API without strict validation. This is now restricted: only recognized formats (like docx, xlsx, xhtml, etc.) are accepted.
- LibreOffice converter: watermarking, file attachments (:appendFile, :attachFile, :appendTemplate), and signing (:sign) now work together even when generating password-protected PDFs. Previously, as soon as a PDF was protected with a password, the other features would stop working.
- Carbone ICE (Instant Converter Engine) now supports PDF encryption and watermarks, with the same options as Chrome, OnlyOffice, and LibreOffice.
- Documents generated in HTML, XHTML, SVG, or XML are now served with the Content-Security-Policy: sandbox HTTP header. This causes browsers to give these files an isolated origin and blocks all scripts, protecting against code injection.
- The X-Content-Type-Options: nosniff header is now reliably set on every response. Browsers are required to respect the Content-Type Carbone provides, reducing the risk of content-type based attacks.
- Added securityLevel options to remove local references in generated documents for these formats: docx, xlsx, xlsm, pptx, odt, ods, odp, odg, fodt, fods, fodp, html, xhtml, md, svg, xml, txt, css, rtf, mht, mhtml, vml.
  - SECURITY_API_REMOVE_LOCAL_HYPERLINK (256): Removes hyperlinks and references to private networks (local IPs, localhost, etc.).
  - SECURITY_API_REMOVE_EXTERNAL_FILE_REFERENCE (512): Removes references to local files (e.g., file paths) from documents.
- Authentication failures (other than missing or expired tokens) now return a 401 Unauthorized with a generic message: Unauthorized Access: Invalid API key or access token., instead of a 500 error with internal details.
- To prevent Denial of Service attacks, the following formatter arguments are now limited:
  - formatN and formatC decimal places: maximum 40
  - padl and padr target length: maximum 10,000 characters
  - Barcode width and height: maximum 1,000 millimeters each, and a combined area (with scale) of 25 million pixels
  - Barcode textsize: maximum 100 points
  - If these limits are exceeded, the value is rejected outright rather than silently reduced. Also, replace('') no longer inserts the replacement between each character.
- Hyperlinks provided in your dataset are now validated before being included in the generated document. This prevents malicious URLs from affecting the document's structure. Carbone encodes URLs before inserting them—if the URL already included a percent-escape (like %20), this is now handled reliably and safely. Additionally, malformed percent sequences (like a single %) are now safely encoded and will no longer cause errors during rendering.
- Color values from your dataset, used with bindColor, are now validated before being written in the document. Only hexadecimal color values are accepted; any invalid color is simply ignored and the inherited color is kept, as before. This safely prevents injection of unexpected content via colors.

Carbone v4.27.0

2026-09-08T12:00:00.000Z

Upgrade to the latest Node 22
- ⚠️ Important Security Update: Following an in-depth internal penetration test, we strongly recommend updating to this version to address two critical security fixes and other improvements that increase Carbone's overall security. Contact us if you want more details about the two critical security issues.
- Critical: The LibreOffice converter is now significantly more secure.
- Critical: For historical reasons, Carbone allowed changing the template file extension (file type) via the API without strict validation. This is now restricted: only recognized formats (like docx, xlsx, xhtml, etc.) are accepted.
- Documents generated in HTML, XHTML, SVG, or XML are now served with the Content-Security-Policy: sandbox HTTP header. This causes browsers to give these files an isolated origin and blocks all scripts, protecting against code injection.
- The X-Content-Type-Options: nosniff header is now reliably set on every response. Browsers are required to respect the Content-Type Carbone provides, reducing the risk of content-type based attacks.
- Authentication failures (other than missing or expired tokens) now return a 401 Unauthorized with a generic message: Unauthorized Access: Invalid API key or access token., instead of a 500 error with internal details.
- To prevent Denial of Service attacks, the following formatter arguments are now limited:
- formatN and formatC decimal places: maximum 40
- padl and padr target length: maximum 10,000 characters
- Barcode width and height: maximum 1,000 millimeters each, and a combined area (with scale) of 25 million pixels
- Barcode textsize: maximum 100 points
- If these limits are exceeded, the value is rejected outright rather than silently reduced. Also, replace('') no longer inserts the replacement between each character.
- Hyperlinks provided in your dataset are now validated before being included in the generated document. This prevents malicious URLs from affecting the document's structure. Carbone encodes URLs before inserting them—if the URL already included a percent-escape (like %20), this is now handled reliably and safely. Additionally, malformed percent sequences (like a single %) are now safely encoded and will no longer cause errors during rendering.
- Color values from your dataset, used with bindColor, are now validated before being written in the document. Only hexadecimal color values are accepted; any invalid color is simply ignored and the inherited color is kept, as before. This safely prevents injection of unexpected content via colors.

Carbone v3.9.0

2026-09-07T12:00:00.000Z

Upgrade to the latest Node 22
- ⚠️ Important Security Update: Following an in-depth internal penetration test, we strongly recommend updating to this version to address two critical security fixes and other improvements that increase Carbone's overall security. Contact us if you want more details about the two critical security issues.
- Critical: The LibreOffice converter is now significantly more secure.
- Critical: For historical reasons, Carbone allowed changing the template file extension (file type) via the API without strict validation. This is now restricted: only recognized formats (like docx, xlsx, xhtml, etc.) are accepted.
- Documents generated in HTML, XHTML, SVG, or XML are now served with the Content-Security-Policy: sandbox HTTP header. This causes browsers to give these files an isolated origin and blocks all scripts, protecting against code injection.
- The X-Content-Type-Options: nosniff header is now reliably set on every response. Browsers are required to respect the Content-Type Carbone provides, reducing the risk of content-type based attacks.
- To prevent Denial of Service attacks, the following formatter arguments are now limited:
- formatN and formatC decimal places: maximum 40
- padl and padr target length: maximum 10,000 characters
- Barcode width and height: maximum 1,000 millimeters each, and a combined area (with scale) of 25 million pixels
- Barcode textsize: maximum 100 points
- If these limits are exceeded, the value is rejected outright rather than silently reduced.
- Hyperlinks provided in your dataset are now validated before being included in the generated document. This prevents malicious URLs from affecting the document's structure. Carbone encodes URLs before inserting them—if the URL already included a percent-escape (like %20), this is now handled reliably and safely. Additionally, malformed percent sequences (like a single %) are now safely encoded and will no longer cause errors during rendering.
- Color values from your dataset, used with bindColor, are now validated before being written in the document. Only hexadecimal color values are accepted; any invalid color is simply ignored and the inherited color is kept, as before. This safely prevents injection of unexpected content via colors.

Carbone v5.14.3

2026-08-25T12:00:00.000Z

Fix: a template error in a batch item (e.g. Missing showEnd or hideEnd) no longer crashes the worker. The error is now returned to the callback instead.

Carbone v5.14.2

2026-08-25T12:00:00.000Z

Fix: Version v5.14.0 introduced a regression due to a security headers update, which prevented downloading generated documents inside an iframe. This has been fixed.
- Fix: HEAD /render/:renderId is now allowed without authentication, like GET /render/:renderId. A HEAD used to return 401 when authentication was on.

Carbone v5.14.1

2026-08-21T12:00:00.000Z

[EE] Fix: :set() with a relative path (e.g. {d.obj.val:set(.flag)}) no longer crashes when the parent object is missing from the data. The value is left unset, the same way a marker naming missing data prints nothing.
- [EE] Fix: batchReportName is now respected even when the ZIP contains only one file.
- Carbone ICE (Instant Converter Engine): now correctly handles line breaks.

Carbone v5.14.0

2026-08-18T12:00:00.000Z

Upgraded all dependencies and switched from Node 22 to Node 24
- ⚡️ New converter: Carbone ICE (Instant Converter Engine). It reads a DOCX and converts it to PDF directly within Carbone, without relying on LibreOffice, OnlyOffice, Chrome or any other program on the machine. There is no office suite to install, no external process to start, watch or restart, and no temporary file written between the report generation and its conversion.
  - Up to 60x faster than LibreOffice on a 1000-page DOCX, and 3x faster on a one-page document. The bigger the document, the wider the gap: a large report no longer pays the fixed cost of an office suite loading it, laying it out and printing it.
  - When the job balancer is off, the document is handed directly from the render process to the converter in memory. On a 150-page report, this reduces the handover time to 30 ms instead of 345 ms.
  - How to use it: pass "converter": "I" in the options of POST /render, next to the existing "L" (LibreOffice), "O" (OnlyOffice) and "C" (Chrome). In the Studio, pick "Carbone ICE (docx to pdf)" in the document converter panel of the preview. The converter is enabled and available by default. It can be disabled by setting carboneIcePath (environment variable CARBONE_CARBONE_ICE_PATH) to an empty string.
  - Multi-threaded: Carbone ICE converts multiple documents in parallel, controlled by the factories setting (CARBONE_FACTORIES). Each factory runs as a worker thread.
  - Scope for this first release:
    - DOCX to PDF conversion only. Support for more formats coming soon.
    - Pages/sections: Handles page size/orientation, section margins, headers, footers, mixed portrait/landscape, page/section breaks, text columns.
    - Headers/footers: Different headers/footers for first, odd/even pages, per section. Calculates PAGE, NUMPAGES, SECTIONPAGES.
    - Paragraphs: Supports all paragraph styles, alignment (left/center/right/justified), indentation, spacing, line spacing, tab stops, borders, shading, widow/orphan control.
    - Text: Character styles, fonts, size, bold/italic/etc, color, highlighting, letter spacing, and clickable hyperlinks.
    - Lists: Numbered/bulleted lists at all levels, with correct numbering format, bullet shapes, indentation, and alignment.
    - Tables: Styles, conditional formatting (header rows/columns etc.), layouts, column widths, merges, cell borders/shading, nested tables, repeated header rows, floating tables.
    - Pictures: Inline/floating images with all positioning options, cropping, full PNG/JPEG/SVG support keeping original color profiles and EXIF.
    - Shapes/Text boxes: Supports standard and custom shapes, all fills/outlines, text inside shapes with correct styles.
    - Charts: Bar, line, area, pie, doughnut—drawn as vectors. Includes titles, legends, axes options, gridlines, labels, colors, number formats.
    - Fonts/colors: Uses installed fonts or falls back to "Noto Sans". Reads all system font directories at startup.
    - Fidelity: Output is matched pixel-for-pixel to the PDF saved from Word, ensuring layout accuracy.
  - Not yet supported (may not be exhaustive): WEBP images, table of contents, SmartArt, complex charts, footnotes/endnotes, comments, tracked changes, bookmarks and links to them, form fields, equations, EMF/WMF images (Windows-only). These are ignored if present; the document still converts.
- Fix: GET /templates now returns a 400 error instead of a 500 when search or category contains a malformed URI (e.g. a % not followed by two hex digits).
- Fix: files inside the ZIP archive of batch processing now keep the decoded batchReportName. An index is appended to the filename (e.g. report_1.pdf, report_2.pdf) when batchReportName is empty or not dynamic (it does not contain a Carbone tag). A second protection also triggers this automatic indexed naming if the first two files have the same name. Filenames are sanitized (.., /, \, Windows reserved names such as CON/NUL, and characters like :*?"<>|). Note: the generated filename index is not guaranteed to match the order of the input data.
- [Studio] Fixed issue where the converter would not correctly reset to LibreOffice when navigating to or from the design page.
- :html formatter: optimize DOCX HTML list rendering by applying the numbering reset only to

Carbone v5.13.1

2026-08-15T12:00:00.000Z

⚠️ Chrome converter Only (HTML to PDF) : Fixed a rare issue where PDFs could mix content from different reports if several were generated at the same time. Now, each PDF always contains the correct data. No more blocked or mixed documents if a download is cancelled or the connection is lost during PDF creation. Errors or interruptions for one PDF can no longer affect another.
- [EE] Hardened the job balancer (only when CARBONE_JOB_BALANCER=true) with improved cluster-wide ID safety to prevent collisions. Cancelled or interrupted reports are now safely re-queued and are never lost or duplicated. This improvement is independent of the Chrome issue above and was made at the same time as a comprehensive review of the job system's robustness.

Carbone v5.13.0

2026-08-10T12:00:00.000Z

Chrome converter improvements:
- Reverted the changes in 5.12.0 regarding the maximum message size between Carbone and Chrome. Chrome enforces a built-in 100MB limit on messages (input HTML, or generated PDF), regardless of what Carbone sets for its WebSocket. The Carbone-defined limit is therefore removed. When the Chrome limit is reached, Carbone now swiftly restores communication, ensuring stability.
- Carbone forces Chrome to exit after 5 seconds if it cannot shut down properly, preventing an infinite wait.
  - Added the ability to disable detection of missing i+1 tag in v5 when a pre-release tag (preReleaseFeatureIn) is set to a value lower than 5000000 in the template, API, or global configuration (CARBONE_PRE_RELEASE_FEATURE_IN). This can force Carbone v5 to behave like Carbone v4, helping you migrate to production without fixing legacy templates that contain syntax errors but previously worked in v4. Only features and fixes introduced up to the specified tag are enabled. Any introduced in a higher tag are disabled.
  - Multiple improvements to PDF operations when generating PDFs with Chrome and OnlyOffice converters:
- Default encryption is now AES-256 instead of the deprecated 128-bit encryption.
- Password protection now encrypts document properties (Title, Author, Subject, and other Info strings).
- Encryption performance improved by a factor of 5.
  - Appending, merging, and adding multiple watermarks to PDFs is now at least twice as fast.
  - Studio improvements
- studio.setConfig({ defaultDataPanel : 'editor' }) selects the panel shown at startup in the data editor: 'editor' for the raw JSON editor (default), 'viewer' for the simplified JSON viewer, where clicking a property inserts the corresponding Carbone tag. The user can still switch panels with the two buttons of the data editor.
- Accept more template origins: Salesforce (origin = 2), Odoo (3), HubSpot (4). For reference: 0 = API, 1 = Studio.
  - [EE] Markdown templates now support dynamic barcodes (:barcode) and charts (:chart). Use an <img src="{d.config:chart}" width="600" height="400"/> tag to control the size of the injected image in the converted PDF/DOCX/ODT.
  - [EE] The :html formatter now renders <hr>, <blockquote> and the task list checkboxes (<input type="checkbox">) in ODT/DOCX/PDF documents. This is a pre-release feature: it requires {o.preReleaseFeatureIn=5011000} in the template, otherwise the tags are ignored.
- The three elements are supported everywhere: inside the lists, the table cells, the headings, and inside a paragraph, which <hr> splits while keeping the surrounding styles. The spacing and the indentation reproduce a browser: 0.5em around the rule, 40px for a quote, cumulative on each nesting level and added to the indentation of a list.
- New quotetheme option for <blockquote>, like tabletheme and headingtheme: it applies a paragraph style of the template to the quotes instead of the default indentation, for example {d.content:html(quotetheme:Quote)}. Word and LibreOffice both provide a Quote and an Intense Quote style by default. In ODT, a style name containing a space must be written the way ODF stores it, so Intense Quote is passed as Intense_20_Quote.
- A checkbox is ticked with the HTML checked attribute, whatever its form (checked, checked="", checked="checked"), and unticked without it: <ul><li><input type="checkbox"> todo</li><li><input type="checkbox" checked> done</li></ul>.
- In DOCX a checkbox stays clickable in Word, and it is rendered as a character everywhere else (☑/☐). Like a browser, the bullet of a task item is not rendered. Only <input type="checkbox"> is rendered, the other input types are ignored.
  - [EE] Fixed the :html formatter. Unless stated otherwise, the fixes require {o.preReleaseFeatureIn=5011000} so the existing templates are not impacted:
- An unencoded < (e.g. i<=2 in a <pre> block) could swallow the next real closing tag, corrupting the rest of the content. It now renders as expected.
- In DOCX, two identical <ol>/<ul> lists shared the same numbering ID, so Word continued the count instead of restarting the second list. The second list now resets the numbering.
- Like a web browser, a <?xml ?> processing instruction and a closing tag whose </ is not followed by a letter (</ 3>, </>) are now ignored.
- A <td>, <th> or <tr> placed outside a <table>, and a block element left unclosed at the end of the HTML (<b><li>), were throwing an error and stopping the whole rendering. Fixed for all templates, no option needed.
- A list or a table left unclosed (<ul><li>a, <table><tr><td>A) generated an invalid XML, refused by Word: the missing closing tags are now added, and a closing tag without an opening tag is ignored, like a browser.
- The CSS of an element without a closing tag leaked on all the content coming after it: <br style="color:red"/> turned the rest of the document red.
- A <pre> placed inside a list item was rendered on the same line as the item, and in DOCX its line breaks produced an invalid <w:br/> nested inside <w:t>: Word rendered it, but any tool reading <w:t> as a simple text lost everything after the first break.
- An <img> with uppercase attributes (SRC, WIDTH, HEIGHT) was dropped, HTML attribute names are case-insensitive.
- A text or a paragraph placed inside a <table> but outside a cell (<table><p>text</p><tr>...) generated an invalid XML. Like a browser, it is not rendered inside the table anymore.
- The element names are now matched without the case: <P>, <B>, <BR>, <UL> and <LI> were ignored.
- An attribute is now read whatever its quoting. HTML accepts href="x", href='x' and href=x, only the double quotes were read, so a link, an image, a style or a colspan written with the two other syntaxes was silently lost.
- ODT: the headings <h1> to <h6> had no style when no headingtheme was provided. A <text:h> needs a style name, so the built-in Heading_20_1 to Heading_20_6 of the template are now used.

Carbone v5.12.0

2026-07-29T12:00:00.000Z

Improved logging: Suppressed unnecessary error messages during routine cleanup of the template/render directories when files are already deleted or removed due to race conditions.
- [EE] Cluster peer connections (peerPort / peerEndpoints) are now more reliable, key improvements:
  - A periodic supervisor:
    - Recreates the WebSocket server if it crashes or the port becomes unavailable (EADDRINUSE).
    - Re-resolves peerEndpoints via DNS, so peers with changed IPs (e.g. during Kubernetes rolling updates) are rediscovered.
    - Reconnects to any missing peer endpoint.
    - Cleans up dead connections using a liveness timer when a connection opens, preventing rare deadlocks that could occur in previous versions and ensuring automatic connection recovery without requiring a restart.
  - New exposed parameter peerCheckInterval (or CARBONE_PEER_CHECK_INTERVAL, default 10s): period of the peer liveness ping. The supervisor runs twice as often (half this value) so a lost peer is re-dialed faster than it is detected.
  - Connections establish more reliably, no matter which peer initiates
  - Supervisor uses exponential backoff: starts at half peerCheckInterval, increases up to 1 minute, and resets to fast on important events (startup, server restart, peer connect/disconnect).
  - Peer DNS resolution is fault-tolerant: if a peer name cannot be resolved (e.g. missing DNS during a rolling update), other available peers still connect; the whole cluster isn't skipped.
  - Maximum WebSocket message size for cluster peer connections now uses the existing maxDataSize (CARBONE_MAX_DATA_SIZE) parameter. By consequence, the default changed from 100MB to 60MB.
  - Improved Event-bus logs: cluster events show peer count and addresses resolved by DNS resolution (only when changed). Unreachable peers are logged with the next retry delay (e.g. cannot reach peer ... - retrying in Xs) at every attempt, so network issues are visible without enabling debug logs. Remaining low-level socket errors are shown only at debug level.
- The maximum message size between Carbone and Chrome is now limited by the existing maxDataSize (CARBONE_MAX_DATA_SIZE). As a consequence, the default changed from 100MB to 60MB (same as default maxDataSize).

Carbone v5.11.0

2026-07-24T12:00:00.000Z

[EE] Make the :autoOrient formatter more robust when DOCX files are edited with Microsoft Word Online.
- [EE] The :html formatter now renders the <sup>, <sub>, <mark>, <code>, <kbd>, <samp>, and <pre> elements in ODT/DOCX/PDF documents. This is a pre-release feature: it requires {o.preReleaseFeatureIn=5011000} in the template, otherwise the content of these tags is rendered without formatting.
  - <sup> / <sub>: renders text as superscript / subscript.
  - <mark>: applies a fixed yellow highlight (color not customizable).
  - <code> / <kbd> / <samp> — applies the Courier New font.
  - <pre>: renders preformatted text, preserving newline characters (\n, \r\n), with the Courier New font. An empty paragraph is added after the block to mimic the browser's bottom spacing.
  - Options affecting <pre>:
    - nospace: removes the empty paragraph added after a <pre> block.
    - inline: collapses newline characters to a single space. <pre> keeps its Courier New font but no longer renders newlines.
  - Each element must have a matching opening and closing tag; an unclosed tag (e.g. a <pre> with no </pre>) produces invalid HTML.
- [EE] Fixed :html heading rendering (<h1>–<h6>) in ODT templates: when a heading is not closed, the empty paragraph reproducing the browser's bottom spacing is now added. It was previously missing.

Carbone v5.10.0-beta

2026-07-09T12:00:00.000Z

[EE] The job balancer now also distributes asynchronous rendering jobs (POST /render with a webhook). When enabled, both job types (document conversions and asynchronous document generations) can be offloaded to other peers that have available resources.
- Asynchronous jobs are now stored on disk in a compressed format, reducing disk usage and speeding up job transfers between peers.

Carbone v5.9.2

2026-06-30T12:00:00.000Z

Improved logs when the job balancer is used, making it easier to distinguish between external requests and internal job distribution.

Carbone v5.9.1

2026-06-30T12:00:00.000Z

[EE] Added a job balancer (Beta) that spreads document conversion load across the peers of a cluster. When a peer is idle and another peer is overloaded, the idle peer automatically "steals" pending conversion jobs from the busy peer, runs them locally, and sends the result back. This smooths out conversion spikes without any external load balancer.
- Disabled by default. Enable it with the jobBalancer parameter (env var CARBONE_JOB_BALANCER=true).
- It only works when the internal cluster channel is enabled, i.e. when peerPort is set (and peers are reachable through peerEndpoints). If peerPort is not defined, the job balancer stays inactive even when jobBalancer is true.
- How it works: each peer periodically broadcasts the size of its conversion queue to the other peers. A peer that has free conversion factories pulls jobs from the most overloaded peer (pull-based model, so newly started peers naturally take their share and slow peers take fewer jobs). Aborted jobs and timeouts are propagated to the remote peer, and a peer stops stealing new jobs as soon as it begins a graceful shutdown.
- ⚠️ Like the rest of the cluster channel, this internal traffic is not authenticated or encrypted: use it only inside a secure private network.
  - [EE] The OpenMetrics /metrics endpoint now exposes a new gauge carbone_reports_inflight{stage="conversion"} reporting the number of document conversion jobs currently waiting in the queue.

Carbone v5.9.0

2026-06-22T12:00:00.000Z

If data is undefined when calling POST /render, Carbone only converts the file and skips the entire templating process. As a result, tags remain unchanged in the converted document.
- Added support for the custom header carbone-egress-header-authorization to customize the authorization header for egress traffic, such as webhooks, images, and external PDF URLs. For example, if carbone-egress-header-authorization: my-secret is included during report generation, the header authorization: my-secret will be added when Carbone calls a webhook, an external image URL, an external PDF URL, etc. If carbone-webhook-header-authorization is used at the same time, it overrides carbone-egress-header-authorization for webhook calls only. Only the authorization header can be customized, and its value must not exceed 512 characters.
- Studio: General UX improvements:
  - Rename the "Stop Auto-Upload" button to the less technical "Finish Editing".
  - Improve filename readability for long filenames by displaying as much of the name as possible while always keeping the end of the filename visible (use an ellipsis in the middle).
  - Clearly indicate that the Studio is listening for file changes with a subtle, low-resource animated icon.
  - Clearly show how long ago the file was updated and when the latest changes were synchronized and taken into account by the Studio.
  - Add a Docs button with an enriched menu.
  - Fix the Profile button on Safari.
  - Improve text search in the JSON editor with Next and Previous buttons, a result counter, and the current search position. If more than 200 occurrences are found, the UI stops counting them to avoid performance issues with very large JSON files.

Carbone v5.8.0

2026-06-10T12:00:00.000Z

[Studio] Fix the drop-down list bug and the recent list issue in Safari.
- [On-Premise only] In Markdown templates, the special tag {o.styleSource = templateOrVersionId} allows applying the style from another DOCX or ODT template. The style template can include Carbone tags. Styles such as headings, tables, headers, and footers are applied only when converting Markdown to DOCX, ODT, or PDF.
- [EE] PDFs generated with Chrome and OnlyOffice converters now support full encryption and security options, matching LibreOffice.
  - All PDF security features are supported:
    - EncryptFile (boolean): Enable PDF encryption (requires password).
    - DocumentOpenPassword (string): Password required to open the PDF.
    - RestrictPermissions (boolean): Restrict actions like printing, copying, and editing (requires PermissionPassword).
    - PermissionPassword (string): Password to set/change permissions.
    - Changes (integer): Control what edits are allowed (0: none, 1: pages, 2: forms, 3: comments/forms, 4: all except extraction).
    - EnableCopyingOfContent (boolean): Allow content copying.
    - EnableTextAccessForAccessibilityTools (boolean): Allow access for accessibility tools.
    - Printing (integer): Allow printing (0: none, 1: low-res, 2: high-res).
- Increased the allowed memory allocation to 8 GB to support large XLSX reports.

Carbone v5.7.0

2026-06-05T12:00:00.000Z

[Studio] Small UI fixes and update BeerCSS to v4.0.21 (Material Design M3)
- Template list: remove empty items from category/tag filters
- The selected item in the list is now visible only after pressing a keyboard arrow key to avoid confusion with mouse hover
- Replace HTML main tags with div elements to keep a single global main element and avoid bugs with the new BeerCSS
- Harmonize margins and button styles
- Use the new split buttons
- Improve table responsiveness
  - Accept equality filters that do not strictly match types in array search expressions (lookup), added in v5.2.0. For example: table[rank=3] matches both rank = 3 and rank = '3'. This change aligns the behavior with the historical behavior of array filters.

Carbone v5.6.1

2026-05-14T12:00:00.000Z

[On-Premise] Added the global parameter maxDownloadFileTimeout (CARBONE_MAX_DOWNLOAD_FILE_TIMEOUT) to configure the default timeout (6 seconds) for downloading images or files from URLs or when using appendTemplate (which behaves similarly by downloading a file from another Carbone instance).
- [On-Premise] Added the global boolean parameter pdfPostCompression (CARBONE_PDF_POST_COMPRESSION, default: false), which can reduce PDF size by up to 3x when merging PDFs using :appendTemplate, :appendFile, or during batch processing to a single PDF output.
- [EE] Fix: PDF templates that use annotations with Carbone tags to update forms are now cleanly removed from the result PDF.
- [EE] PDFs generated with Chrome converter can now be encrypted using the same options as LibreOffice. Example: { "convertTo": { "formatName": "pdf", "formatOptions": { "EncryptFile": true, "DocumentOpenPassword": "QWERTY1234" } } }
- [EE] Fix: Timeout when downloading images or files from URLs when using batch processing no longer causes a crash.
- [On-Premise] Improve logs at startup (number of factories, show if options pdfPostCompression or nbReportMaxPerBatch are activated)

Carbone v5.6.0

2026-05-07T12:00:00.000Z

[EE] The :autoOrient formatter can be used to automatically rotate an image according to the camera or smartphone orientation. It is supported only in DOCX templates. It can be used with imageFit(contain) or imageFit(fillWidth), but not with imageFit(fill). It only works with JPEG images. Other image formats ignore this formatter. To reduce processing as much as possible, the orientation is applied directly in the template (no JPEG processing).
- Fix: Accepts whitespace before the :color formatter.
- [EE] The :color(scope, type) formatter is supported in PPTX templates for all combinations of type (background, text, border) and scope (row, cell, shape). "border" is supported only for shapes.

Carbone v5.5.1

2026-05-06T12:00:00.000Z

[On-Premise] Add the debug option DEBUG=carbone:webserver to see sparse logs of the HTTP body and headers when a report is generated

Carbone v5.5.0

2026-04-30T12:00:00.000Z

[EE] Added a new :drop/:keep option col to dynamically delete table columns. This beta feature is supported for DOCX, XLSX, PPTX, ODT, ODS, ODP, and HTML templates. Example Carbone tag to place in a table cell: {d.value:ifEM:drop(col)}. This means that if the value is empty, the entire column is deleted. It can be combined with other :drop(row) tags or with multiple :drop(col) tags based on different conditions.
- [EE] The :html formatter supports the full spectrum of HTML entities (previously limited to named entities only):
  - Added full support for decimal © and hexadecimal © numeric entities, with strict XML 1.0 validation.
  - Added Emojis support as literal Unicode characters and numeric HTML entities.
  - Fixed named entities mapping to two code points (e.g. &fjlig;, &caps;) now render correctly.
- [EE] Completely reworked the asynchronous rendering system with webhooks to fix race condition issues and speed up processing.
- [EE] Reduce the risk of converter starvation when a template uses appendTemplate. When a template uses this formatter, maxDownloadFileConcurrency is automatically adjusted for this report only, so it is lower than or equal to the number of converter threads.

Carbone v5.4.5

2026-04-13T12:00:00.000Z

[On-Premise] Fixed Markdown file type detection to enable MD to PDF, MD to DOCX, MD to ODT, ...
- [On-Premise] Added Markdown support in the Studio
- Fixed Swiss QR code (swissqrcode) bugs related to accented characters
- Fixes for the :html formatter:
  - Multiple arguments provided to the formatter were not recognised; now fully supported: Custom Heading and/or Table Themes and/or the "nospace" option.
  - If the HTML contained a color as an inline style, it was not recognised when it contained space characters; it is now fully recognised.

Carbone v5.4.4

2026-04-08T12:00:00.000Z

Add the new optional tag {o.hardRefresh=true} to force a template to be processed by a converter (LibreOffice, etc.) even when the output file type is the same as the input file type. For example, it can be used to update XLSX formulas after Carbone injects the data.
- Add limits maxTemplateUncompressedSize (200 MB by default) for unzipped templates to improve resistance to zip bomb denial-of-service attacks (CVE-2026-18929)
- [EE] Update to Node 22.22.2

Carbone v4.26.3

2026-04-07T12:00:00.000Z

[EE] Update to Node 20.20.2
- Add limits maxTemplateUncompressedSize (200 MB by default) for unzipped templates to improve resistance to zip bomb denial-of-service attacks (CVE-2026-18929)

Carbone v3.8.2

2026-04-03T12:00:00.000Z

[EE] Update to Node 20.20.2
- Add limits maxTemplateUncompressedSize (200 MB by default) for unzipped templates to improve resistance to zip bomb denial-of-service attacks (CVE-2026-18929)
- Node.js library only:
  - Fix a critical security issue identified in a recent audit. This issue had already been fixed in all other versions.
  - Align published version on npm with this version

Carbone v5.4.3

2026-03-30T12:00:00.000Z

Add new options that can be used in a template to force some parameters
- {o.timezone = Europe/Paris}: force the timezone
- {o.converter = L}: force the converter (L: LibreOffice, O: OnlyOffice, C: Chrome)
- {o.lang = en-US}: force the language. Accepts uppercase or lowercase
- {o.exportFormattedValuesAsText = true}: force formatN to generate numbers as localized text instead of converting them to the XLSX number format. Available only for XLSX templates.
  - Fix: after analysis, we noticed that the fix for object iteration introduced in v5.4.2 could break some poorly designed reports. Therefore, this version disables the fix by default. It can be enabled only by adding the pre-release tag {o.preReleaseFeatureIn=5004002} to the template.
  - [Studio] Fix: avoid relying on the machine time to set the deployment timestamp
  - [API]: POST and PATCH /template now return the deployedAt value saved by the backend. This is useful when the submitted object contains the constant value 42000000000 to set the deployment time to now.
  - [Studio] Fix: Studio now automatically deploys a version if all versions of a template have deployedAt = 0 (no deployed template). This can happen if the template was created through the API without setting the deployedAt timestamp.
  - [Studio] Fix: remove an unnecessary preview refresh when downloading a file too early, before the file is fully downloaded
  - Enable the :appendTemplate formatter for Carbone Cloud

Carbone v5.4.2

2026-03-25T12:00:00.000Z

Fix: Support direct object access and iteration over the object at the same time: <xml> {d.myObj.id} <b/> {d.myObj[i].att} <b/> {d.myObj[i+1].att} </xml>
- Fix: Incorrect output when direct object access is used after iterating over the object at the same time
- Fix: Support :aggSum when the root d is an array with nested loops: {d[].sub[].val:aggSum}
- Fix: Scheduled metadata flush cron now works even when peerEndpoints is defined but no peers are available

Carbone v5.4.1

2026-03-18T12:00:00.000Z

[On-Premise] Fix the template metadata cron when no other peers are used.

Carbone v5.4.0

2026-03-17T12:00:00.000Z

👌 We simplified the vocabulary across the documentation and logs to make Carbone easier to understand:
- "Stateful VS Stateless" becomes "With / Without template management"
- "Studio Web Component: embedded versioning vs embedded" becomes "Studio Web Component: With / Without template management"
- "With / Without versioning" becomes "With / Without template management"
- "With / Without database" becomes "With / Without template management"
- The term "Database" is replaced by "Template metadata"
- For new installations, the default filename stored on disk (or external storage) is metadata.db. Consider it as a special template file, stored like any other template in template storage.
  - Renamed databaseName (CARBONE_DATABASE_NAME) to templateMetadataFile (CARBONE_TEMPLATE_METADATA_FILE). Default value is "metadata.db".
  - databaseName (CARBONE_DATABASE_NAME) remains supported for backward compatibility and automatically enables templateManagement=true. If both old and new parameters are set, Carbone uses the new parameters in priority
  - ☝️ Add a single boolean configuration parameter, templateManagement (or CARBONE_TEMPLATE_MANAGEMENT), to enable the template management. It replaces the old method, which required setting a filename in databaseName (or CARBONE_DATABASE_NAME).
  - ⚡️ Adds the final missing features to fully support template management across a cluster of nodes or Docker containers, with high availability and no single point of failure
- Carbone now regularly flushes template metadata to /template as:
  - .metadata.db.0 = current
  - .metadata.db.1 = previous
- If template plugin hooks are implemented (writeTemplate and readTemplate), these files are also stored on external storage as:
  - .metadata.db.0.backup = current
  - .metadata.db.1.backup = previous
- Combined with the existing conflict-free synchronization (peerPort and peerEndpoints), this allows cluster nodes to start and stop dynamically while staying in sync without data loss
- Additional parameters:
```
/* Flush frequency on disk / external storage */
templateMetadataFlushCron: '5 0 * * *', // = CARBONE_TEMPLATE_METADATA_FLUSH_CRON
/* Flush on exit */
templateMetadataFlushOnExit: true, // = CARBONE_TEMPLATE_METADATA_FLUSH_ON_EXIT
/* Retention time of CRDT patch sets used for synchronization between cluster nodes.
  Must be greater than the time between 2 flushes. */
templateMetadataPatchRetentionHours: 50, // = CARBONE_TEMPLATE_METADATA_PATCH_RETENTION_HOURS
```
- Startup lifecycle:
  - On startup, Carbone tries to load the latest flushed metadata from external storage .metadata.db.0(.backup) or from the shared /template volume
  - If the current file is missing, Carbone falls back to .metadata.db.1(.backup)
  - It then fetches the missing events from other peers since the last persisted flush. It is possible because each cluster node keeps events for templateMetadataPatchRetentionHours.
  - HTTP servers start only after synchronization is complete
- Shutdown lifecycle:
  - If the cluster node is elected leader (the oldest peer ID), it automatically flushes metadata based on templateMetadataFlushCron, or on exit if templateMetadataFlushOnExit=true
  - Before overwriting .metadata.db.0(.backup), Carbone copies the previous file to .metadata.db.1(.backup), locally and on external storage when plugin hooks are enabled
  - If the cluster node is not the leader, it ensures all local changes are synchronized with the other nodes before exiting
  - Removed the backup directories.
  - Rewrite startup logs for better readability.
  - Fix the Prometheus metric replication_connected_peers and add last_successful_backup_timestamp.
  - Fix and optimize Carbone shutdown. Before, it could take up to 1.5 seconds to stop Carbone while waiting for Chrome to exit. Now it is almost instantaneous (as long as there are no pending requests and no metadata flush in progress).
  - Accept peerEndpoints without a port. In that case, it assumes the endpoints use the same port as peerPort.
  - peerEndpoints accepts a domain name with or without a port. It resolves the domain automatically and uses all returned IP addresses as peer endpoints.
  - Accept the in unit in PPTX/ODP when using the :transform formatter.
  - When template management is enabled, all API endpoints return an error if the template ID or version ID is not a 64-hex-character value or a 64-bit number.
  - Improve the API rules for PATCH /template/:id and POST /template:
- Fix an inconsistency between the documentation and the API about the constant value used to set the “current timestamp” (42000000000 vs 4200000000). The API was expecting 4200000000 (one zero was missing).
- Return an error if deployedAt has the same value as the currently deployed version.
- Return an error if a template changes its ID and there is a conflict (same value) with the deployedAt of the currently deployed version.
- Return an error when the new deployedAt is lower than the currently deployed version (to prevent modifying the currently deployed version). To un-deploy a version, a new version must be deployed.