Carbone Changelog — v3

v3.8.2

Fri, 03 Apr 2026 00:00:00 +0000

• [EE] Update to Node 20.20.2
• Add limits maxTemplateUncompressedSize (200 MB by default) for unzipped templates to improve resistance to zip bomb denial-of-service attacks
• Node.js library only: Fix a critical security issue identified in a recent audit. This issue had already been fixed in all other versions. Align published version on npm with this version

v3.8.1

Sat, 17 Jan 2026 00:00:00 +0000

• Update dependencies + latest IANA database to manage correctly Daylight Saving Time
• â ï¸ Fix a critical security issue identified in a recent audit

v3.8.0

Mon, 08 Sep 2025 00:00:00 +0000

• Fixed Carbone API Authentication to return status code 401 instead of 500 when an API key has expired.
• Carbone On-Premise: add parameter maxTemplateSize (bytes) to change default limit (20MB)
• Accept to send a volatile template when calling the API POST /render/template . This template is never stored and it does not trigger the middleware readTemplate { data : {}, template : "base64-encoded-file-with-or-without-data-URI-prefix", convertTo : "pdf" } This update makes Carbone v3 compatible with the new Carbone v5 Studio.

v3.7.2

Thu, 13 Jun 2024 00:00:00 +0000

• Update dependencies for security
• Improve Libreoffice detection on Arch Linux (Thank you @jan-san)
• Fix: removed the possibility of prototype pollution in formatters

v3.5.6

Wed, 12 Jun 2024 00:00:00 +0000

• Fix: removed the possibility of prototype pollution in formatters. This can only occur if the parent NodeJS application has the same security issue. CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.
• Update some dependencies

v3.7.1

Tue, 19 Dec 2023 00:00:00 +0000

• [EE] Fix crash when dynamic image URL contains forbidden characters

v3.7.0

Thu, 15 Jun 2023 00:00:00 +0000

• [EE] All APIs returns "400 Bad request" instead of "404 Not Found" when idTemplate is not valid
• [EE] Fixed HEAD /render/:renderId : The request don't delete the generated document anymore.
• [EE] Fixed GET /template/:templateId : If the template doesn't exist, the statusCode 404 is returned instead of 400.
• [EE] Force download of the rendered report when the query parameter ?download=true is set, such as: POST /render/:renderId?download=true
• [EE] On-Premise: New option to enable more security controls, following ANSSI (France) and BSI (Germany) recommendations. Contact us for more information.
• [EE] Updated DELETE /template/:templateId : If there isn't a template, Carbone does not remove any template but will still respond that the command was successful with a code 200 .

v3.6.0

Mon, 17 Apr 2023 00:00:00 +0000

• Support vector barcodes with the new svg option to improve print quality: {d.number:barcode(qrcode, svg:true)}

v3.5.6 [EE]

Thu, 16 Feb 2023 00:00:00 +0000

• [EE] BREAKING CHANGE in Carbone On-Premise plugins: the callback of getPublicKey must take two arguments (err, publicKeys) . If the first argument contains an error, the bad token is kept in quarantine area for 60s instead of infinitely.

v3.5.5

Wed, 07 Dec 2022 00:00:00 +0000

• Add user-agent Carbone when webhook is called.

v3.5.4

Wed, 15 Jun 2022 00:00:00 +0000

• [EE] Do not return an error when DEL /template is called and the template is already deleted on local storage. It may be already deleted by the plugin.

v3.5.3

Wed, 25 May 2022 00:00:00 +0000

• [EE] Accept convCRLF before :html formatter to convert to

v3.5.2

Fri, 06 May 2022 00:00:00 +0000

• [EE] Add file verification on template upload

v3.5.1

Wed, 04 May 2022 00:00:00 +0000

• Rollback fix in v3.4.9

v3.5.0

Wed, 04 May 2022 00:00:00 +0000

• Formatters add() , mul() , sub() and div() accept simple mathematical expressions inside parenthesis. Example: {d.val:add(.otherQty + .vat * .price - 10 / 2) Only mathematical operators +, *, -, / are allowed, without parenthesis Multiplication and division operators ( * , / ) has higher precedence than the addition/substration operator ( + , - ) and thus will be evaluated first.

v3.4.9

Wed, 27 Apr 2022 00:00:00 +0000

• Fix crash with very complex JSON map

v3.4.8

Tue, 15 Mar 2022 00:00:00 +0000

• [EE] Fix: avoid crash when a tag is used on a shape instead of a sample image (v3.2.2-1)
• [EE] Fix graceful exit on SIGTERM, keep the converter alive to finish remaining renders! As soon as Carbone has finished all renders, it exits after 15 seconds instead of 10 seconds
• [EE] Fix DOCX documents that are including dynamic images and static charts

v3.2.2-1

Fri, 11 Mar 2022 00:00:00 +0000

• Fix: avoid crash when a tag is used on a shape instead of a sample image

v3.4.7

Tue, 01 Mar 2022 00:00:00 +0000

• [EE] Carbone-EE On-Premise accepts to read the license from environment variable CARBONE_EE_LICENSE , or --license CLI options

v3.4.6

Fri, 18 Feb 2022 00:00:00 +0000

• [EE] The HTTP server starts as soon as possible, before LibreOffice.
• [EE] Gracefully exits on SIGTERM. When the signal is received GET /status returns 503. The reverse-proxy should stop sending new requests As soon as Carbone has finished all renders, it exits after 10 seconds Whatever happens, it exists after 300 seconds.
• [EE] Add barcode options: pass to the formatter :barcode options as second argument. It should keep the format "key:value", such as: {d.number:barcode(qrcode, width:300, height:100, includetext:false)} . Options available: width Width a number as millimeters. Example: {d.number:barcode(qrcode, width:300)} height Height a number as millimeters. Example: {d.number:barcode(qrcode, height:10)} scale Quality of the barcode as a number between 1 to 10 . The default value is 3 . Example: {d.number:barcode(qrcode, scale:3)} includetext Show the text and takes a Boolean as value, true or false . Example: {d.number:barcode(qrcode, includetext:false)} . textsize Number to change the size of the text. Example: {d.number:barcode(qrcode, textsize:20)} textxalign Change the alignment of the text horizontally. Takes only 4 values: left , center , right , or justify . The default value is center. Example: {d.number:barcode(qrcode, textxalign:right)} textyalign Change the alignment of the text vertically. Takes only 3 values: below , center , or above . The default value is below. Example: {d.number:barcode(qrcode, textyalign:above)} . rotate Rotate the barcode and the text. Takes only 4 values (case insensitive): N for not rotated, R for 90 degree right rotation, L for 90 degree left rotation, I of 180 degree rotation. Example: {d.number:barcode(qrcode, rotate:R)} or {d.number:barcode(qrcode, rotate:l)} . barcolor Color of bars as hexadecimal #RRGGBB . Example: {d.number:barcode(qrcode, barcolor:#1FDE25)} . Note: 6 characters required, and case insensitive. textcolor Color of the text as hexadecimal #RRGGBB . Example: {d.number:barcode(qrcode,… (read more: https://carbone.io/changelog.html#v3-4-6)

v3.4.5

Wed, 09 Feb 2022 00:00:00 +0000

• Now the parameter converterFactoryTimeout updates also the HTTP socket timeout accordingly

v3.4.4

Mon, 07 Feb 2022 00:00:00 +0000

• [EE] Experimental: increase the limit to 200 repetitions maximum when using the repetition feature {d[i+1*qty]

v3.4.3

Mon, 31 Jan 2022 00:00:00 +0000

• [EE] Bump dependencies to latest version
• [EE] Add options.isDebugActive . If true, POST /render returns additional information in debug sub-object: { "renderId" : "file.pdf" , "debug" : { "markers" : [ "{d.id}" , "{d.tab[i].id}" ] // all tags found in template } }

v3.4.2

Mon, 10 Jan 2022 00:00:00 +0000

• [EE] Fix do not crash if content passed to :html formatter is not a string

v3.4.1

Thu, 09 Dec 2021 00:00:00 +0000

• Accepts "OpenDocument Text Flat XML" (.fodt) template files
• Includes v3.3.3: fix timezone conversion with latest IANA database to manage correctly Daylight Saving Time
• [EE] Fix dynamic colors for DOCX cells background

v3.3.3

Fri, 26 Nov 2021 00:00:00 +0000

• Fix timezone conversion with latest IANA database to manage correctly Daylight Saving Time 2021-11-18T08:05+0000 -> Europe/London -> Thursday, November 18, 2021 8:05 AM

v3.4.0

Wed, 17 Nov 2021 00:00:00 +0000

• Remove compatibility with NodeJS 10.x. V8 uses timsort since NodeJS 11. So we can remove timsort dependency. NodeJS 12+ required.
• Bump DayJS to 1.10.7 and debug to 4.3.2
• Improve thread management of LibreOffice on Linux: The system, which auto-restarts LibreOffice when it crashes or if there is a conversion timeout, could hang indefinitely on Linux. On the Enterprise Edition, the global watchdog system was able to fix this bad behavior but it was slow. Now, the LibreOffice is correctly killed. No zombie processes remaining. Avoid launching the parent process "oosplash" of LibreOffice Improve auto-restart mechanism Add debug logs All tests passed on Linux ð
• [EE] Bump all dependencies
• [EE] Fix random image display in LibreOffice documents. Sometimes, LibreOffice hides one image when two or more images share the same name. Now, Carbone generates a unique name for each image with the format "carbone-image-".
• [EE] Experimental: Deffered rendering with a webhook, it is dedicated to render huge reports: Render a document as usual with the request POST /render/:templateID with the JSON dataset into the body request AND you have to insert the header carbone-webhook-url as a callback URL. It is an endpoint of your server listening when a document is rendered. Carbone will generate your document and it will notify your webhook with a renderID Retrieve the generated document with a GET /render/:renderID and voilÃ !
• [EE] Experimental: add the possibility to duplicate rows using an attribute of an object Data : [ { "id" : "A" , "qty" : 2 } , { "id" : "B" , "qty" : 3 } , { "id" : "C" , "qty" : 0 } , { "id" : "D" , "qty" : 1 } ] Template : {d[i].id} - {d[i+1*qty].id} Result : A - A - B - B - B - D
• [EE] â¡ï¸ Carbone supports 107 barcodes in DOCX/ODT/XLSX/ODS templates: Barcodes are inserted as a dynamic image to support more types In your template, barcodes tags must be inserted inside the title or description field of a… (read more: https://carbone.io/changelog.html#v3-4-0)

v3.3.2

Mon, 11 Oct 2021 00:00:00 +0000

• [EE] Dynamic Image fix: image types verification support uppercase and lower case formats

v3.3.1

Thu, 09 Sep 2021 00:00:00 +0000

• [EE] New Carbone On-premise: Pass the option "maxDataSize" to change the maximum JSON data size when rendering a report. The value must be bytes . The default value is 60MB.

v3.3.0

Mon, 30 Aug 2021 00:00:00 +0000

• [EE] HTML Formatter: Fix: The HTML content is rendered without adding an empty line above it. Fix: The HTML content and static content are rendered in the expected order. New: If static content and Carbone tags are mixed with an HTML formatter in the same paragraph, the html is isolated into a new paragraph and each element are seperated above or below. For example, the following template on a text editor A rocket is made of {d.data:html} {d.details}, this is cool! will be transform into 3 paragraphs on the generated report A rocket is made of {d.data:html} {d.details}, this is cool! . Improved HTML rendering stability when it is mixed with lists, tables, and images.
• [EE] Dynamic Checkbox are supported only for ODT file. A tag should be inserted into the checkbox property "name" and it is used to set the value of the checkbox on the generated report. The checkbox is ticked (checked) when the value is a Boolean with the value "true", a non empty string, a non empty array or a non empty object. If the exported file type is a PDF, the checkbox can be edited on the generated document. An ODT document created from MS Word that include checkboxes does not work. It is also not possible to create a list of checkboxes with the expressions [i] / [i+1] .
• Accept null for the attribute complement in options