Update Italian translations (#5884)

Co-authored-by: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>

.dockerignore

@@ -1,75 +1,52 @@
-# Node modules and build artifacts
-node_modules
-frontend/node_modules
-frontend/dist
-frontend/build
-frontend/.vite
-frontend/.tauri
-frontend/src-tauri/target
-
-# Gradle build artifacts
-.gradle
-build
-bin
-target
-out
-
-# Git
-.git
+# Version control
+.git/
 .gitignore
 
-# IDE
-.vscode
-.idea
+# Build outputs
+build/
+*/build/
+**/build/
+out/
+target/
+
+# Gradle caches (local, not what's in the container)
+.gradle/
+**/.gradle/
+
+# Node / frontend
+node_modules/
+**/node_modules/
+.npm/
+.yarn/
+
+# IDE and editor
+.idea/
+.vscode/
 *.iml
-*.iws
 *.ipr
+*.iws
 
-# Logs
+# Logs and temp files
 *.log
-logs
-
-# Environment files
-.env
-.env.*
-!.env.example
-
-# OS files
+*.tmp
+*.pid
 .DS_Store
 Thumbs.db
 
-# Java compiled files
-*.class
-*.jar
-*.war
-*.ear
-
-# Test reports
-test-results
-coverage
-
-# Docker
-docker-compose.override.yml
+# Docker itself
+Dockerfile*
 .dockerignore
 
-# Temporary files
-tmp
-temp
-*.tmp
-*.swp
-*~
-
-# Runtime database and config files (locked by running app)
-app/core/configs/**
-stirling/**
-stirling-pdf-DB*.mv.db
-stirling-pdf-DB*.trace.db
-
-# Documentation
-*.md
-!README.md
-docs
-
-# CI/CD
-.github
+# CI / CD configs (not needed in build context)
+.github/
+.circleci/
 .gitlab-ci.yml
+
+# Test reports
+**/test-results/
+**/jacoco/
+
+# Local env
+.env
+.env.*
+!.env.example

.github/dependabot.yml

@@ -68,3 +68,8 @@ updates:
     schedule:
       interval: "weekly"
     rebase-strategy: "auto"
+
+  - package-ecosystem: cargo
+    directory: /frontend/src-tauri/provisioner
+    schedule:
+      interval: daily

.github/scripts/requirements_dev.txt

@@ -9,7 +9,7 @@
 # CVE-2025-6176 mitigation: pin brotli to a specific commit
 brotli @ git+https://github.com/google/brotli.git@028fb5a23661f123017c060daa546b55cf4bde29
     # via
-    #   -r .github/scripts/requirements_dev.in
+    #   -r requirements_dev.in
     #   fonttools
 cffi==2.0.0 \
     --hash=sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb \
@@ -256,105 +256,105 @@ opencv-python-headless==4.13.0.90 \
     --hash=sha256:e13790342591557050157713af17a7435ac1b50c65282715093c9297fa045d8f \
     --hash=sha256:eba38bc255d0b7d1969c5bcc90a060ca2b61a3403b613872c750bfa5dfe9e03b \
     --hash=sha256:f46b17ea0aa7e4124ca6ad71143f89233ae9557f61d2326bcdb34329a1ddf9bd
-    # via -r .github/scripts/requirements_dev.in
+    # via -r requirements_dev.in
 pdf2image==1.17.0 \
     --hash=sha256:eaa959bc116b420dd7ec415fcae49b98100dda3dd18cd2fdfa86d09f112f6d57 \
     --hash=sha256:ecdd58d7afb810dffe21ef2b1bbc057ef434dabbac6c33778a38a3f7744a27e2
-    # via -r .github/scripts/requirements_dev.in
-pillow==12.1.0 \
-    --hash=sha256:00162e9ca6d22b7c3ee8e61faa3c3253cd19b6a37f126cad04f2f88b306f557d \
-    --hash=sha256:079af2fb0c599c2ec144ba2c02766d1b55498e373b3ac64687e43849fbbef5bc \
-    --hash=sha256:0b022eaaf709541b391ee069f0022ee5b36c709df71986e3f7be312e46f42c84 \
-    --hash=sha256:0c27407a2d1b96774cbc4a7594129cc027339fd800cd081e44497722ea1179de \
-    --hash=sha256:0ddedfaa8b5f0b4ffbc2fa87b556dc59f6bb4ecb14a53b33f9189713ae8053c0 \
-    --hash=sha256:0deedf2ea233722476b3a81e8cdfbad786f7adbed5d848469fa59fe52396e4ef \
-    --hash=sha256:0ed07dca4a8464bada6139ab38f5382f83e5f111698caf3191cb8dbf27d908b4 \
-    --hash=sha256:0fde7ec5538ab5095cc02df38ee99b0443ff0e1c847a045554cf5f9af1f4aa82 \
-    --hash=sha256:15c794d74303828eaa957ff8070846d0efe8c630901a1c753fdc63850e19ecd9 \
-    --hash=sha256:1a949604f73eb07a8adab38c4fe50791f9919344398bdc8ac6b307f755fc7030 \
-    --hash=sha256:1f345e7bc9d7f368887c712aa5054558bad44d2a301ddf9248599f4161abc7c0 \
-    --hash=sha256:1fcc52d86ce7a34fd17cb04e87cfdb164648a3662a6f20565910a99653d66c18 \
-    --hash=sha256:21e686a21078b0f9cb8c8a961d99e6a4ddb88e0fc5ea6e130172ddddc2e5221a \
-    --hash=sha256:2415373395a831f53933c23ce051021e79c8cd7979822d8cc478547a3f4da8ef \
-    --hash=sha256:277518bf4fe74aa91489e1b20577473b19ee70fb97c374aa50830b279f25841b \
-    --hash=sha256:27b9baecb428899db6c0de572d6d305cfaf38ca1596b5c0542a5182e3e74e8c6 \
-    --hash=sha256:29a4cef9cb672363926f0470afc516dbf7305a14d8c54f7abbb5c199cd8f8179 \
-    --hash=sha256:3413c2ae377550f5487991d444428f1a8ae92784aac79caa8b1e3b89b175f77e \
-    --hash=sha256:351889afef0f485b84078ea40fe33727a0492b9af3904661b0abbafee0355b72 \
-    --hash=sha256:3ffaa2f0659e2f740473bcf03c702c39a8d4b2b7ffc629052028764324842c64 \
-    --hash=sha256:40a8e3b9e8773876d6e30daed22f016509e3987bab61b3b7fe309d7019a87451 \
-    --hash=sha256:414b9a78e14ffeb98128863314e62c3f24b8a86081066625700b7985b3f529bd \
-    --hash=sha256:43aca0a55ce1eefc0aefa6253661cb54571857b1a7b2964bd8a1e3ef4b729924 \
-    --hash=sha256:43b4899cfd091a9693a1278c4982f3e50f7fb7cff5153b05174b4afc9593b616 \
-    --hash=sha256:461f9dfdafa394c59cd6d818bdfdbab4028b83b02caadaff0ffd433faf4c9a7a \
-    --hash=sha256:4f9f6a650743f0ddee5593ac9e954ba1bdbc5e150bc066586d4f26127853ab94 \
-    --hash=sha256:53d8b764726d3af1a138dd353116f774e3862ec7e3794e0c8781e30db0f35dfc \
-    --hash=sha256:565c986f4b45c020f5421a4cea13ef294dde9509a8577f29b2fc5edc7587fff8 \
-    --hash=sha256:5c5ae0a06e9ea030ab786b0251b32c7e4ce10e58d983c0d5c56029455180b5b9 \
-    --hash=sha256:5cb7bc1966d031aec37ddb9dcf15c2da5b2e9f7cc3ca7c54473a20a927e1eb91 \
-    --hash=sha256:5da841d81b1a05ef940a8567da92decaa15bc4d7dedb540a8c219ad83d91808a \
-    --hash=sha256:5fee4c04aad8932da9f8f710af2c1a15a83582cfb884152a9caa79d4efcdbf9c \
-    --hash=sha256:609e89d9f90b581c8d16358c9087df76024cf058fa693dd3e1e1620823f39670 \
-    --hash=sha256:6258f3260986990ba2fa8a874f8b6e808cf5abb51a94015ca3dc3c68aa4f30ea \
-    --hash=sha256:64efdf00c09e31efd754448a383ea241f55a994fd079866b92d2bbff598aad91 \
-    --hash=sha256:65b80c1ee7e14a87d6a068dd3b0aea268ffcabfe0498d38661b00c5b4b22e74c \
-    --hash=sha256:6741e6f3074a35e47c77b23a4e4f2d90db3ed905cb1c5e6e0d49bff2045632bc \
-    --hash=sha256:681088909d7e8fa9e31b9799aaa59ba5234c58e5e4f1951b4c4d1082a2e980e0 \
-    --hash=sha256:6b7a9d1db5dad90e2991645874f708e87d9a3c370c243c2d7684d28f7e133e6b \
-    --hash=sha256:7315f9137087c4e0ee73a761b163fc9aa3b19f5f606a7fc08d83fd3e4379af65 \
-    --hash=sha256:742aea052cf5ab5034a53c3846165bc3ce88d7c38e954120db0ab867ca242661 \
-    --hash=sha256:75af0b4c229ac519b155028fa1be632d812a519abba9b46b20e50c6caa184f19 \
-    --hash=sha256:7b5dd7cbae20285cdb597b10eb5a2c13aa9de6cde9bb64a3c1317427b1db1ae1 \
-    --hash=sha256:7d6daa89a00b58c37cb1747ec9fb7ac3bc5ffd5949f5888657dfddde6d1312e0 \
-    --hash=sha256:800429ac32c9b72909c671aaf17ecd13110f823ddb7db4dfef412a5587c2c24e \
-    --hash=sha256:806f3987ffe10e867bab0ddad45df1148a2b98221798457fa097ad85d6e8bc75 \
-    --hash=sha256:808b99604f7873c800c4840f55ff389936ef1948e4e87645eaf3fccbc8477ac4 \
-    --hash=sha256:80941e6d573197a0c28f394753de529bb436b1ca990ed6e765cf42426abc39f8 \
-    --hash=sha256:84cabc7095dd535ca934d57e9ce2a72ffd216e435a84acb06b2277b1de2689bd \
-    --hash=sha256:8637e29d13f478bc4f153d8daa9ffb16455f0a6cb287da1b432fdad2bfbd66c7 \
-    --hash=sha256:896866d2d436563fa2a43a9d72f417874f16b5545955c54a64941e87c1376c61 \
-    --hash=sha256:8e178e3e99d3c0ea8fc64b88447f7cac8ccf058af422a6cedc690d0eadd98c51 \
-    --hash=sha256:907bfa8a9cb790748a9aa4513e37c88c59660da3bcfffbd24a7d9e6abf224551 \
-    --hash=sha256:9212d6b86917a2300669511ed094a9406888362e085f2431a7da985a6b124f45 \
-    --hash=sha256:92a7fe4225365c5e3a8e598982269c6d6698d3e783b3b1ae979e7819f9cd55c1 \
-    --hash=sha256:935b9d1aed48fcfb3f838caac506f38e29621b44ccc4f8a64d575cb1b2a88644 \
-    --hash=sha256:97e9993d5ed946aba26baf9c1e8cf18adbab584b99f452ee72f7ee8acb882796 \
-    --hash=sha256:983976c2ab753166dc66d36af6e8ec15bb511e4a25856e2227e5f7e00a160587 \
-    --hash=sha256:9f5fefaca968e700ad1a4a9de98bf0869a94e397fe3524c4c9450c1445252304 \
-    --hash=sha256:a332ac4ccb84b6dde65dbace8431f3af08874bf9770719d32a635c4ef411b18b \
-    --hash=sha256:a40905599d8079e09f25027423aed94f2823adaf2868940de991e53a449e14a8 \
-    --hash=sha256:a6dfc2af5b082b635af6e08e0d1f9f1c4e04d17d4e2ca0ef96131e85eda6eb17 \
-    --hash=sha256:a786bf667724d84aa29b5db1c61b7bfdde380202aaca12c3461afd6b71743171 \
-    --hash=sha256:a83e0850cb8f5ac975291ebfc4170ba481f41a28065277f7f735c202cd8e0af3 \
-    --hash=sha256:aa0c9cc0b82b14766a99fbe6084409972266e82f459821cd26997a488a7261a7 \
-    --hash=sha256:b17fbdbe01c196e7e159aacb889e091f28e61020a8abeac07b68079b6e626988 \
-    --hash=sha256:b63e13dd27da389ed9475b3d28510f0f954bca0041e8e551b2a4eb1eab56a39a \
-    --hash=sha256:b6e53e82ec2db0717eabb276aa56cf4e500c9a7cec2c2e189b55c24f65a3e8c0 \
-    --hash=sha256:bb0984b30e973f7e2884362b7d23d0a348c7143ee559f38ef3eaab640144204c \
-    --hash=sha256:bc11908616c8a283cf7d664f77411a5ed2a02009b0097ff8abbba5e79128ccf2 \
-    --hash=sha256:bdec5e43377761c5dbca620efb69a77f6855c5a379e32ac5b158f54c84212b14 \
-    --hash=sha256:bef9768cab184e7ae6e559c032e95ba8d07b3023c289f79a2bd36e8bf85605a5 \
-    --hash=sha256:c990547452ee2800d8506c4150280757f88532f3de2a58e3022e9b179107862a \
-    --hash=sha256:ca94b6aac0d7af2a10ba08c0f888b3d5114439b6b3ef39968378723622fed377 \
-    --hash=sha256:cad302dc10fac357d3467a74a9561c90609768a6f73a1923b0fd851b6486f8b0 \
-    --hash=sha256:d0a7735df32ccbcc98b98a1ac785cc4b19b580be1bdf0aeb5c03223220ea09d5 \
-    --hash=sha256:d70347c8a5b7ccd803ec0c85c8709f036e6348f1e6a5bf048ecd9c64d3550b8b \
-    --hash=sha256:d70534cea9e7966169ad29a903b99fc507e932069a881d0965a1a84bb57f6c6d \
-    --hash=sha256:db44d5c160a90df2d24a24760bbd37607d53da0b34fb546c4c232af7192298ac \
-    --hash=sha256:e115c15e3bc727b1ca3e641a909f77f8ca72a64fff150f666fcc85e57701c26c \
-    --hash=sha256:e2479c7f02f9d505682dc47df8c0ea1fc5e264c4d1629a5d63fe3e2334b89554 \
-    --hash=sha256:e5dcbe95016e88437ecf33544ba5db21ef1b8dd6e1b434a2cb2a3d605299e643 \
-    --hash=sha256:e6bdb408f7c9dd2a5ff2b14a3b0bb6d4deb29fb9961e6eb3ae2031ae9a5cec13 \
-    --hash=sha256:e75d3dba8fc1ddfec0cd752108f93b83b4f8d6ab40e524a95d35f016b9683b09 \
-    --hash=sha256:efdc140e7b63b8f739d09a99033aa430accce485ff78e6d311973a67b6bf3208 \
-    --hash=sha256:f10c98f49227ed8383d28174ee95155a675c4ed7f85e2e573b04414f7e371bda \
-    --hash=sha256:f188028b5af6b8fb2e9a76ac0f841a575bd1bd396e46ef0840d9b88a48fdbcea \
-    --hash=sha256:f188d580bd870cda1e15183790d1cc2fa78f666e76077d103edf048eed9c356e \
-    --hash=sha256:f45bd71d1fa5e5749587613037b172e0b3b23159d1c00ef2fc920da6f470e6f0 \
-    --hash=sha256:f61333d817698bdcdd0f9d7793e365ac3d2a21c1f1eb02b32ad6aefb8d8ea831 \
-    --hash=sha256:fb125d860738a09d363a88daa0f59c4533529a90e564785e20fe875b200b6dbd
+    # via -r requirements_dev.in
+pillow==12.1.1 \
+    --hash=sha256:02f84dfad02693676692746df05b89cf25597560db2857363a208e393429f5e9 \
+    --hash=sha256:0330d233c1a0ead844fc097a7d16c0abff4c12e856c0b325f231820fee1f39da \
+    --hash=sha256:03edcc34d688572014ff223c125a3f77fb08091e4607e7745002fc214070b35f \
+    --hash=sha256:097690ba1f2efdeb165a20469d59d8bb03c55fb6621eb2041a060ae8ea3e9642 \
+    --hash=sha256:178aa072084bd88ec759052feca8e56cbb14a60b39322b99a049e58090479713 \
+    --hash=sha256:18e5bddd742a44b7e6b1e773ab5db102bd7a94c32555ba656e76d319d19c3850 \
+    --hash=sha256:1a9b0ee305220b392e1124a764ee4265bd063e54a751a6b62eff69992f457fa9 \
+    --hash=sha256:1f1625b72740fdda5d77b4def688eb8fd6490975d06b909fd19f13f391e077e0 \
+    --hash=sha256:1f1be78ce9466a7ee64bfda57bdba0f7cc499d9794d518b854816c41bf0aa4e9 \
+    --hash=sha256:1f90cff8aa76835cba5769f0b3121a22bd4eb9e6884cfe338216e557a9a548b8 \
+    --hash=sha256:21329ec8c96c6e979cd0dfd29406c40c1d52521a90544463057d2aaa937d66a6 \
+    --hash=sha256:2815a87ab27848db0321fb78c7f0b2c8649dee134b7f2b80c6a45c6831d75ccd \
+    --hash=sha256:2c1fc0f2ca5f96a3c8407e41cca26a16e46b21060fe6d5b099d2cb01412222f5 \
+    --hash=sha256:2e0c664be47252947d870ac0d327fea7e63985a08794758aa8af5b6cb6ec0c9c \
+    --hash=sha256:339ffdcb7cbeaa08221cd401d517d4b1fe7a9ed5d400e4a8039719238620ca35 \
+    --hash=sha256:344cf1e3dab3be4b1fa08e449323d98a2a3f819ad20f4b22e77a0ede31f0faa1 \
+    --hash=sha256:36341d06738a9f66c8287cf8b876d24b18db9bd8740fa0672c74e259ad408cff \
+    --hash=sha256:365b10bb9417dd4498c0e3b128018c4a624dc11c7b97d8cc54effe3b096f4c38 \
+    --hash=sha256:3a5cbdcddad0af3da87cb16b60d23648bc3b51967eb07223e9fed77a82b457c4 \
+    --hash=sha256:417423db963cb4be8bac3fc1204fe61610f6abeed1580a7a2cbb2fbda20f12af \
+    --hash=sha256:42fc1f4677106188ad9a55562bbade416f8b55456f522430fadab3cef7cd4e60 \
+    --hash=sha256:44ce27545b6efcf0fdbdceb31c9a5bdea9333e664cda58a7e674bb74608b3986 \
+    --hash=sha256:472a8d7ded663e6162dafdf20015c486a7009483ca671cece7a9279b512fcb13 \
+    --hash=sha256:47b94983da0c642de92ced1702c5b6c292a84bd3a8e1d1702ff923f183594717 \
+    --hash=sha256:495c302af3aad1ca67420ddd5c7bd480c8867ad173528767d906428057a11f0e \
+    --hash=sha256:4ceb838d4bd9dab43e06c363cab2eebf63846d6a4aeaea283bbdfd8f1a8ed58b \
+    --hash=sha256:50480dcd74fa63b8e78235957d302d98d98d82ccbfac4c7e12108ba9ecbdba15 \
+    --hash=sha256:518a48c2aab7ce596d3bf79d0e275661b846e86e4d0e7dec34712c30fe07f02a \
+    --hash=sha256:559b38da23606e68681337ad74622c4dbba02254fc9cb4488a305dd5975c7eeb \
+    --hash=sha256:578510d88c6229d735855e1f278aa305270438d36a05031dfaae5067cc8eb04d \
+    --hash=sha256:597bd9c8419bc7c6af5604e55847789b69123bbe25d65cc6ad3012b4f3c98d8b \
+    --hash=sha256:5a8eb7ed8d4198bccbd07058416eeec51686b498e784eda166395a23eb99138e \
+    --hash=sha256:5c0dd1636633e7e6a0afe7bf6a51a14992b7f8e60de5789018ebbdfae55b040a \
+    --hash=sha256:5cb1785d97b0c3d1d1a16bc1d710c4a0049daefc4935f3a8f31f827f4d3d2e7f \
+    --hash=sha256:5d1f9575a12bed9e9eedd9a4972834b08c97a352bd17955ccdebfeca5913fa0a \
+    --hash=sha256:5d8c41325b382c07799a3682c1c258469ea2ff97103c53717b7893862d0c98ce \
+    --hash=sha256:5dae5f21afb91322f2ff791895ddd8889e5e947ff59f71b46041c8ce6db790bc \
+    --hash=sha256:600fd103672b925fe62ed08e0d874ea34d692474df6f4bf7ebe148b30f89f39f \
+    --hash=sha256:6408a7b064595afcab0a49393a413732a35788f2a5092fdc6266952ed67de586 \
+    --hash=sha256:652a2c9ccfb556235b2b501a3a7cf3742148cd22e04b5625c5fe057ea3e3191f \
+    --hash=sha256:665e1b916b043cef294bc54d47bf02d87e13f769bc4bc5fa225a24b3a6c5aca9 \
+    --hash=sha256:691ab2ac363b8217f7d31b3497108fb1f50faab2f75dfb03284ec2f217e87bf8 \
+    --hash=sha256:6c52f062424c523d6c4db85518774cc3d50f5539dd6eed32b8f6229b26f24d40 \
+    --hash=sha256:6c6db3b84c87d48d0088943bf33440e0c42370b99b1c2a7989216f7b42eede60 \
+    --hash=sha256:7311c0a0dcadb89b36b7025dfd8326ecfa36964e29913074d47382706e516a7c \
+    --hash=sha256:7aac39bcf8d4770d089588a2e1dd111cbaa42df5a94be3114222057d68336bd0 \
+    --hash=sha256:7b03048319bfc6170e93bd60728a1af51d3dd7704935feb228c4d4faab35d334 \
+    --hash=sha256:7e7976bf1910a8116b523b9f9f58bf410f3e8aa330cd9a2bb2953f9266ab49af \
+    --hash=sha256:8089c852a56c2966cf18835db62d9b34fef7ba74c726ad943928d494fa7f4735 \
+    --hash=sha256:86172b0831b82ce4f7877f280055892b31179e1576aa00d0df3bb1bbf8c3e524 \
+    --hash=sha256:89b54027a766529136a06cfebeecb3a04900397a3590fd252160b888479517bf \
+    --hash=sha256:89c7e895002bbe49cdc5426150377cbbc04767d7547ed145473f496dfa40408b \
+    --hash=sha256:8b7e5304e34942bf62e15184219a7b5ad4ff7f3bb5cca4d984f37df1a0e1aee2 \
+    --hash=sha256:8fd420ef0c52c88b5a035a0886f367748c72147b2b8f384c9d12656678dfdfa9 \
+    --hash=sha256:98edb152429ab62a1818039744d8fbb3ccab98a7c29fc3d5fcef158f3f1f68b7 \
+    --hash=sha256:99c1506ea77c11531d75e3a412832a13a71c7ebc8192ab9e4b2e355555920e3e \
+    --hash=sha256:9ad8fa5937ab05218e2b6a4cff30295ad35afd2f83ac592e68c0d871bb0fdbc4 \
+    --hash=sha256:9f51079765661884a486727f0729d29054242f74b46186026582b4e4769918e4 \
+    --hash=sha256:a003d7422449f6d1e3a34e3dd4110c22148336918ddbfc6a32581cd54b2e0b2b \
+    --hash=sha256:a0b1cd6232e2b618adcc54d9882e4e662a089d5768cd188f7c245b4c8c44a397 \
+    --hash=sha256:a285e3eb7a5a45a2ff504e31f4a8d1b12ef62e84e5411c6804a42197c1cf586c \
+    --hash=sha256:a37691702ed687799de29a518d63d4682d9016932db66d4e90c345831b02fb4e \
+    --hash=sha256:a550ae29b95c6dc13cf69e2c9dc5747f814c54eeb2e32d683e5e93af56caa029 \
+    --hash=sha256:ab174cd7d29a62dd139c44bf74b698039328f45cb03b4596c43473a46656b2f3 \
+    --hash=sha256:ab323b787d6e18b3d91a72fc99b1a2c28651e4358749842b8f8dfacd28ef2052 \
+    --hash=sha256:adebb5bee0f0af4909c30db0d890c773d1a92ffe83da908e2e9e720f8edf3984 \
+    --hash=sha256:aee2810642b2898bb187ced9b349e95d2a7272930796e022efaf12e99dccd293 \
+    --hash=sha256:af9a332e572978f0218686636610555ae3defd1633597be015ed50289a03c523 \
+    --hash=sha256:b574c51cf7d5d62e9be37ba446224b59a2da26dc4c1bb2ecbe936a4fb1a7cb7f \
+    --hash=sha256:b66e95d05ba806247aaa1561f080abc7975daf715c30780ff92a20e4ec546e1b \
+    --hash=sha256:b81b5e3511211631b3f672a595e3221252c90af017e399056d0faabb9538aa80 \
+    --hash=sha256:b957b71c6b2387610f556a7eb0828afbe40b4a98036fc0d2acfa5a44a0c2036f \
+    --hash=sha256:bb66b7cc26f50977108790e2456b7921e773f23db5630261102233eb355a3b79 \
+    --hash=sha256:c6008de247150668a705a6338156efb92334113421ceecf7438a12c9a12dab23 \
+    --hash=sha256:c7697918b5be27424e9ce568193efd13d925c4481dd364e43f5dff72d33e10f8 \
+    --hash=sha256:cb9bb857b2d057c6dfc72ac5f3b44836924ba15721882ef103cecb40d002d80e \
+    --hash=sha256:cc7d296b5ea4d29e6570dabeaed58d31c3fea35a633a69679fb03d7664f43fb3 \
+    --hash=sha256:d242e8ac078781f1de88bf823d70c1a9b3c7950a44cdf4b7c012e22ccbcd8e4e \
+    --hash=sha256:d2912fd8114fc5545aa3a4b5576512f64c55a03f3ebcca4c10194d593d43ea36 \
+    --hash=sha256:d470ab1178551dd17fdba0fef463359c41aaa613cdcd7ff8373f54be629f9f8f \
+    --hash=sha256:d4ce8e329c93845720cd2014659ca67eac35f6433fd3050393d85f3ecef0dad5 \
+    --hash=sha256:d6e4571eedf43af33d0fc233a382a76e849badbccdf1ac438841308652a08e1f \
+    --hash=sha256:e65498daf4b583091ccbb2556c7000abf0f3349fcd57ef7adc9a84a394ed29f6 \
+    --hash=sha256:e879bb6cd5c73848ef3b2b48b8af9ff08c5b71ecda8048b7dd22d8a33f60be32 \
+    --hash=sha256:e9e8064fb1cc019296958595f6db671fba95209e3ceb0c4734c9baf97de04b20 \
+    --hash=sha256:f7ed2c6543bad5a7d5530eb9e78c53132f93dfa44a28492db88b41cdab885202 \
+    --hash=sha256:f95c00d5d6700b2b890479664a06e754974848afaae5e21beb4d83c106923fd0 \
+    --hash=sha256:f975aa7ef9684ce7e2c18a3aa8f8e2106ce1e46b94ab713d156b2898811651d3 \
+    --hash=sha256:fbfa2a7c10cc2623f412753cddf391c7f971c52ca40a3f65dc5039b2939e8563 \
+    --hash=sha256:fc354a04072b765eccf2204f588a7a532c9511e8b9c7f900e1b64e3e33487090 \
+    --hash=sha256:fc44ef1f3de4f45b50ccf9136999d71abb99dca7706bc75d222ed350b9fd2289
     # via
-    #   -r .github/scripts/requirements_dev.in
+    #   -r requirements_dev.in
     #   pdf2image
     #   weasyprint
 platformdirs==4.5.1 \
@@ -364,7 +364,7 @@ platformdirs==4.5.1 \
 pre-commit==4.5.1 \
     --hash=sha256:3b3afd891e97337708c1674210f8eba659b52a38ea5f822ff142d10786221f77 \
     --hash=sha256:eb545fcff725875197837263e977ea257a402056661f09dae08e4b149b030a61
-    # via -r .github/scripts/requirements_dev.in
+    # via -r requirements_dev.in
 pycparser==3.0 \
     --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \
     --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
@@ -465,7 +465,7 @@ tinyhtml5==2.0.0 \
 unoserver==3.6 \
     --hash=sha256:25c360fa194396a89cb79b4edd2735f8e4f0fd8531e59db3952114585bd7df05 \
     --hash=sha256:e446bcb3638c51880f002aaeecab1cf74dfa9df81035f027f7ff2e081b6d7015
-    # via -r .github/scripts/requirements_dev.in
+    # via -r requirements_dev.in
 virtualenv==20.36.1 \
     --hash=sha256:575a8d6b124ef88f6f51d56d656132389f961062a9177016a50e4f507bbcc19f \
     --hash=sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba
@@ -473,7 +473,7 @@ virtualenv==20.36.1 \
 weasyprint==68.0 \
     --hash=sha256:447f40898b747cb44ac31a5d493d512e7441fd56e13f63744c099383bbf9cda9 \
     --hash=sha256:c2cb40c71b50837c5971f00171c9e4078e8c9912dd7c217f3e90e068f11e8aa1
-    # via -r .github/scripts/requirements_dev.in
+    # via -r requirements_dev.in
 webencodings==0.5.1 \
     --hash=sha256:a0af1213f3c2226497a97e2b3aa01a7e4bee4f403f95be16fc9acd2947514a78 \
     --hash=sha256:b36a1c245f2d304965eb4e0a82848379241dc04b865afcc4aab16748587e1923
@@ -500,8 +500,8 @@ zopfli==0.4.0 \
 pip==26.0 \
     --hash=sha256:3ce220a0a17915972fbf1ab451baae1521c4539e778b28127efa79b974aff0fa \
     --hash=sha256:98436feffb9e31bc9339cf369fd55d3331b1580b6a6f1173bacacddcf9c34754
-    # via -r .github/scripts/requirements_dev.in
+    # via -r requirements_dev.in
 setuptools==80.10.2 \
     --hash=sha256:8b0e9d10c784bf7d262c4e5ec5d4ec94127ce206e8738f29a437945fbc219b70 \
     --hash=sha256:95b30ddfb717250edb492926c92b5221f7ef3fbcc2b07579bcd4a27da21d0173
-    # via -r .github/scripts/requirements_dev.in
+    # via -r requirements_dev.in

.github/workflows/PR-Auto-Deploy-V2.yml

@@ -231,6 +231,8 @@ jobs:
           context: .
           file: ./docker/embedded/Dockerfile
           push: true
+          cache-from: type=gha,scope=stirling-pdf-latest
+          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
           build-args: VERSION_TAG=v2-alpha
           platforms: linux/amd64

.github/workflows/PR-Demo-Comment-with-react.yml

@@ -150,10 +150,10 @@ jobs:
           ref: refs/pull/${{ needs.check-comment.outputs.pr_number }}/merge
           token: ${{ steps.setup-bot.outputs.token }}
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
       - name: Setup Gradle
@@ -190,6 +190,8 @@ jobs:
           context: .
           file: ./docker/embedded/Dockerfile
           push: true
+          cache-from: type=gha,scope=stirling-pdf-latest
+          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
           build-args: VERSION_TAG=alpha
           platforms: linux/amd64

.github/workflows/ai_pr_title_review.yml

@@ -87,7 +87,7 @@ jobs:
       - name: AI PR Title Analysis
         if: steps.actor.outputs.is_repo_dev == 'true'
         id: ai-title-analysis
-        uses: actions/ai-inference@a6101c89c6feaecc585efdd8d461f18bb7896f20 # v2.0.5
+        uses: actions/ai-inference@e09e65981758de8b2fdab13c2bfb7c7d5493b0b6 # v2.0.7
         with:
           model: openai/gpt-4o
           system-prompt-file: ".github/config/system-prompt.txt"

.github/workflows/build.yml

@@ -52,7 +52,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        jdk-version: [17, 21]
+        jdk-version: [21, 25]
         spring-security: [true, false]
     steps:
       - name: Harden Runner
@@ -68,10 +68,20 @@ jobs:
           java-version: ${{ matrix.jdk-version }}
           distribution: "temurin"
 
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-${{ matrix.jdk-version }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
           gradle-version: 8.14
+          cache-disabled: true
 
       - name: Build with Gradle and spring security ${{ matrix.spring-security }}
         run: ./gradlew build -PnoSpotless
@@ -137,16 +147,26 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
           gradle-version: 8.14
+          cache-disabled: true
 
       - name: Generate OpenAPI documentation
         run: ./gradlew :stirling-pdf:generateOpenApiDocs
@@ -174,7 +194,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up Node.js
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: "22"
           cache: "npm"
@@ -182,7 +202,7 @@ jobs:
       - name: Install frontend dependencies
         run: cd frontend && npm ci
       - name: Type-check frontend
-        run: cd frontend && npm run prebuild && npm run typecheck:all
+        run: cd frontend && npm run prep && npm run typecheck:all
       - name: Lint frontend
         run: cd frontend && npm run lint
       - name: Build frontend
@@ -209,19 +229,34 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
           gradle-version: 8.14
+          cache-disabled: true
 
       - name: check the licenses for compatibility
-        run: ./gradlew checkLicense
+        # NOTE: --no-parallel is intentional here. Running the checkLicense task in parallel with other
+        # Gradle tasks has been observed to cause intermittent failures with the dependency license
+        # checking plugin on this Gradle version. Disabling parallel execution trades some build speed
+        # for more reliable, deterministic license checks. If upgrading Gradle or the plugin, consider
+        # re-evaluating whether this flag is still required before removing it.
+        run: ./gradlew checkLicense --no-parallel
         env:
           MAVEN_USER: ${{ secrets.MAVEN_USER }}
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
@@ -253,6 +288,10 @@ jobs:
     #     )
 
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: read
+      checks: write
 
     steps:
       - name: Harden Runner
@@ -263,20 +302,34 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
           gradle-version: 8.14
+          cache-disabled: true
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
+      # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for docker buildx type=gha cache backend.
+      - name: Expose GitHub runtime for Buildx cache
+        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124 # v3.1.0
+
       - name: Install Docker Compose
         run: |
           sudo curl -SL "https://github.com/docker/compose/releases/download/v2.39.4/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
@@ -292,6 +345,7 @@ jobs:
       - name: Pip requirements
         run: |
           pip install --require-hashes -r ./testing/cucumber/requirements.txt
+          pip install behave-html-formatter
 
       - name: Run Docker Compose Tests
         run: |
@@ -304,6 +358,24 @@ jobs:
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
           MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
 
+      - name: Upload Cucumber Report
+        if: always()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: cucumber-report
+          path: testing/cucumber/report.html
+          retention-days: 7
+          if-no-files-found: warn
+
+      - name: Cucumber Test Report
+        if: always()
+        uses: dorny/test-reporter@b082adf0eced0765477756c2a610396589b8c637 # v2.5.0
+        with:
+          name: Cucumber Tests
+          path: testing/cucumber/junit/*.xml
+          reporter: java-junit
+          fail-on-error: false
+
   test-build-docker-images:
     if: github.event_name == 'pull_request' && needs.files-changed.outputs.project == 'true'
     needs: [files-changed, build, check-generateOpenApiDocs, check-licence]
@@ -314,10 +386,13 @@ jobs:
         include:
           - docker-rev: docker/embedded/Dockerfile
             artifact-suffix: Dockerfile
+            cache-scope: stirling-pdf-latest
           - docker-rev: docker/embedded/Dockerfile.ultra-lite
             artifact-suffix: Dockerfile.ultra-lite
+            cache-scope: stirling-pdf-ultra-lite
           - docker-rev: docker/embedded/Dockerfile.fat
             artifact-suffix: Dockerfile.fat
+            cache-scope: stirling-pdf-fat
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
@@ -334,16 +409,26 @@ jobs:
           docker system prune -af || true
           echo "Disk space after cleanup:" && df -h
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
           gradle-version: 8.14
+          cache-disabled: true
 
       - name: Build application
         run: ./gradlew build
@@ -368,8 +453,8 @@ jobs:
           context: .
           file: ./${{ matrix.docker-rev }}
           push: false
-          cache-from: type=gha,scope=${{ matrix.artifact-suffix }}
-          cache-to: type=gha,mode=max,scope=${{ matrix.artifact-suffix }}
+          cache-from: type=gha,scope=${{ matrix.cache-scope }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.cache-scope }}
           platforms: linux/amd64,linux/arm64/v8
           provenance: true
           sbom: true

.github/workflows/deploy-on-v2-commit.yml

@@ -97,6 +97,8 @@ jobs:
           context: .
           file: ./docker/frontend/Dockerfile
           push: true
+          cache-from: type=gha,scope=stirling-v2-frontend
+          cache-to: type=gha,mode=max,scope=stirling-v2-frontend
           tags: |
             ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
             ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-latest
@@ -110,6 +112,8 @@ jobs:
           context: .
           file: ./docker/backend/Dockerfile
           push: true
+          cache-from: type=gha,scope=stirling-v2-backend
+          cache-to: type=gha,mode=max,scope=stirling-v2-backend
           tags: |
             ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
             ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-latest

.github/workflows/frontend-backend-licenses-update.yml

@@ -77,7 +77,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: "22"
           cache: "npm"
@@ -330,10 +330,10 @@ jobs:
           app-id: ${{ secrets.GH_APP_ID }}
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
       - name: Setup Gradle
@@ -344,7 +344,12 @@ jobs:
       - name: Check licenses and generate report
         id: license-check
         run: |
-          ./gradlew checkLicense generateLicenseReport || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV
+          # NOTE: --no-parallel is intentional here. Running the license-checking tasks in parallel has
+          # previously caused intermittent concurrency issues in CI (e.g. flaky failures in the license
+          # plugin/Gradle when multiple projects are evaluated concurrently). Disabling parallelism trades
+          # some build speed for more reliable license reports. If the underlying issues are resolved in
+          # future Gradle or plugin versions, this flag can be reconsidered.
+          ./gradlew checkLicense generateLicenseReport --no-parallel || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV
         env:
           MAVEN_USER: ${{ secrets.MAVEN_USER }}
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}

.github/workflows/multiOSReleases.yml

@@ -21,8 +21,6 @@ on:
           - windows
           - macos
           - linux
-  push:
-    branches: [main, V2-master]
   release:
     types: [created]
 
@@ -44,12 +42,22 @@ jobs:
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
+      - name: Cache Gradle dependencies
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-
+
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
@@ -117,10 +125,10 @@ jobs:
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
       - name: Setup Gradle
@@ -130,7 +138,7 @@ jobs:
 
       - name: Setup Node.js
         if: matrix.variant.build_frontend == true
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 22
           cache: "npm"
@@ -185,7 +193,7 @@ jobs:
           sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
 
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 22
           cache: "npm"
@@ -197,10 +205,10 @@ jobs:
           toolchain: stable
           targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
       - name: Setup Gradle
@@ -291,7 +299,7 @@ jobs:
       - name: Setup DigiCert KeyLocker
         id: digicert-setup
         if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
-        uses: digicert/ssm-code-signing@af7f4b07694120e514fe5b19f0598af3c20256e3 # v1.2.0
+        uses: digicert/ssm-code-signing@1d820463733701cf1484c7eb5d7d24a15ca2c454 # v1.2.1
         env:
           SM_API_KEY: ${{ secrets.SM_API_KEY }}
           SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
@@ -411,8 +419,9 @@ jobs:
           APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
+          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY || 'sb_publishable_UHz2SVRF5mvdrPHWkRteyA_yNlZTkYb' }}
+          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL || 'https://app.stirlingpdf.com' }}
+          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
           # Only enable Windows signing in Tauri when on release or V2-master
           SIGN: ${{ (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
           CI: true

.github/workflows/pre_commit.yml

@@ -59,10 +59,10 @@ jobs:
           pre-commit run trailing-whitespace --all-files -c .pre-commit-config.yaml
         continue-on-error: true
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: 21
+          java-version: "25"
           distribution: "temurin"
 
       - name: Setup Gradle

.github/workflows/push-docker.yml

@@ -39,12 +39,22 @@ jobs:
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
+      - name: Cache Gradle dependencies
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-
+
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
@@ -116,8 +126,8 @@ jobs:
           context: .
           file: ./docker/embedded/Dockerfile
           push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=stirling-pdf-latest
+          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
@@ -162,8 +172,8 @@ jobs:
           context: .
           file: ./docker/embedded/Dockerfile.fat
           push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=stirling-pdf-fat
+          cache-to: type=gha,mode=max,scope=stirling-pdf-fat
           tags: ${{ steps.meta-fat.outputs.tags }}
           labels: ${{ steps.meta-fat.outputs.labels }}
           build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
@@ -206,8 +216,8 @@ jobs:
           context: .
           file: ./docker/embedded/Dockerfile.ultra-lite
           push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=stirling-pdf-ultra-lite
+          cache-to: type=gha,mode=max,scope=stirling-pdf-ultra-lite
           tags: ${{ steps.meta-lite.outputs.tags }}
           labels: ${{ steps.meta-lite.outputs.labels }}
           build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}

.github/workflows/scorecards.yml

@@ -75,6 +75,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.29.5
+        uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v3.29.5
         with:
           sarif_file: results.sarif

.github/workflows/swagger.yml

@@ -33,10 +33,10 @@ jobs:
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
       - name: Setup Gradle

.github/workflows/tauri-build.yml

@@ -14,14 +14,16 @@ on:
           - macos
           - linux
   pull_request:
-    branches: [main, V2-tauri-windows]
+    branches: [main]
+    types: [opened, reopened, synchronize, ready_for_review]
     paths:
       - "frontend/src-tauri/**"
       - "frontend/src/desktop/**"
       - "frontend/tsconfig.desktop.json"
+      - "frontend/package.json"
+      - "frontend/package-lock.json"
+      - "frontend/vite.config.ts"
       - ".github/workflows/tauri-build.yml"
-  push:
-    branches: [main]
 
 permissions:
   contents: read
@@ -41,27 +43,42 @@ jobs:
 
       - name: Determine build matrix
         id: set-matrix
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
         run: |
+          WINDOWS='{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}'
+          MACOS_ARM='{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"}'
+          MACOS_INTEL='{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}'
+          LINUX='{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}'
+
+          # Resolve requested platform (non-dispatch events always build all)
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            case "${{ github.event.inputs.platform }}" in
-              "windows")
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "macos")
-                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "linux")
-                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              *)
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-            esac
+            PLATFORM="${{ github.event.inputs.platform }}"
           else
-            # For PR/push events, build all platforms
-            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+            PLATFORM="all"
           fi
 
+          # Build candidate list
+          case "$PLATFORM" in
+            windows) ENTRIES=("$WINDOWS") ;;
+            macos)   ENTRIES=("$MACOS_ARM" "$MACOS_INTEL") ;;
+            linux)   ENTRIES=("$LINUX") ;;
+            *)       ENTRIES=("$WINDOWS" "$MACOS_ARM" "$MACOS_INTEL" "$LINUX") ;;
+          esac
+
+          # Drop macOS entries when Apple certificate secret is unavailable
+          if [ -z "$APPLE_CERTIFICATE" ]; then
+            echo "⚠️ APPLE_CERTIFICATE secret not available - skipping macOS builds"
+            FILTERED=()
+            for entry in "${ENTRIES[@]}"; do
+              [[ "$entry" != *'"macos'* ]] && FILTERED+=("$entry")
+            done
+            ENTRIES=("${FILTERED[@]}")
+          fi
+
+          JOINED=$(IFS=','; echo "${ENTRIES[*]}")
+          echo "matrix={\"include\":[$JOINED]}" >> $GITHUB_OUTPUT
+
   build:
     needs: determine-matrix
     strategy:
@@ -71,6 +88,7 @@ jobs:
     env:
       SM_API_KEY: ${{ secrets.SM_API_KEY }}
       WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+      APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
@@ -87,7 +105,7 @@ jobs:
           sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
 
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 22
           cache: "npm"
@@ -99,10 +117,10 @@ jobs:
           toolchain: stable
           targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
       - name: Setup Gradle
@@ -194,7 +212,7 @@ jobs:
       - name: Setup DigiCert KeyLocker
         id: digicert-setup
         if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        uses: digicert/ssm-code-signing@af7f4b07694120e514fe5b19f0598af3c20256e3 # v1.2.0
+        uses: digicert/ssm-code-signing@1d820463733701cf1484c7eb5d7d24a15ca2c454 # v1.2.1
         env:
           SM_API_KEY: ${{ secrets.SM_API_KEY }}
           SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
@@ -269,7 +287,7 @@ jobs:
           }
 
       - name: Import Apple Developer Certificate
-        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && env.APPLE_CERTIFICATE != ''
         env:
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -290,7 +308,7 @@ jobs:
           rm certificate.p12
 
       - name: Verify Certificate
-        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && env.APPLE_CERTIFICATE != ''
         run: |
           echo "Verifying Apple Developer Certificate..."
           KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
@@ -325,8 +343,9 @@ jobs:
           APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
+          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY || 'sb_publishable_UHz2SVRF5mvdrPHWkRteyA_yNlZTkYb' }}
+          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL || 'https://app.stirlingpdf.com' }}
+          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
           # Only enable Windows signing in Tauri when on main
           SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
           CI: true

.github/workflows/testdriver.yml

@@ -32,10 +32,10 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
       - name: Setup Gradle
@@ -72,6 +72,8 @@ jobs:
           context: .
           file: ./docker/embedded/Dockerfile
           push: true
+          cache-from: type=gha,scope=stirling-pdf-latest
+          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
           build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
           platforms: linux/amd64
@@ -155,7 +157,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Node
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           cache: "npm"
           cache-dependency-path: frontend/package-lock.json

.gitignore

@@ -158,6 +158,7 @@ __pycache__/
 
 # Virtual environments
 .env*
+!.env*.example
 .venv*
 env*/
 venv*/

AGENTS.md

@@ -0,0 +1,347 @@
+# AGENTS.md
+
+This file provides guidance to AI Agents when working with code in this repository.
+
+## Common Development Commands
+
+### Build and Test
+- **Build project**: `./gradlew clean build`
+- **Run locally**: `./gradlew bootRun`
+- **Full test suite**: `./test.sh` (builds all Docker variants and runs comprehensive tests)
+- **Code formatting**: `./gradlew spotlessApply` (runs automatically before compilation)
+
+### Docker Development
+- **Build ultra-lite**: `docker build -t stirlingtools/stirling-pdf:latest-ultra-lite -f ./Dockerfile.ultra-lite .`
+- **Build standard**: `docker build -t stirlingtools/stirling-pdf:latest -f ./Dockerfile .`
+- **Build fat version**: `docker build -t stirlingtools/stirling-pdf:latest-fat -f ./Dockerfile.fat .`
+- **Example compose files**: Located in `exampleYmlFiles/` directory
+
+### Security Mode Development
+Set `DOCKER_ENABLE_SECURITY=true` environment variable to enable security features during development. This is required for testing the full version locally.
+
+### Frontend Development
+- **Frontend dev server**: `cd frontend && npm run dev` (requires backend on localhost:8080)
+- **Tech Stack**: Vite + React + TypeScript + Mantine UI + TailwindCSS
+- **Proxy Configuration**: Vite proxies `/api/*` calls to backend (localhost:8080)
+- **Build Process**: DO NOT run build scripts manually - builds are handled by CI/CD pipelines
+- **Package Installation**: DO NOT run npm install commands - package management handled separately
+- **Deployment Options**:
+  - **Desktop App**: `npm run tauri-build` (native desktop application)
+  - **Web Server**: `npm run build` then serve dist/ folder
+  - **Development**: `npm run tauri-dev` for desktop dev mode
+
+#### Environment Variables
+- All `VITE_*` variables must be declared in the appropriate example file:
+  - `frontend/config/.env.example` — core, proprietary, and shared vars
+  - `frontend/config/.env.saas.example` — SaaS-only vars
+  - `frontend/config/.env.desktop.example` — desktop (Tauri)-only vars
+- Never use `|| 'hardcoded-fallback'` inline — put defaults in the example files
+- `npm run prep` / `prep:saas` / `prep:desktop` auto-create the env files from examples on first run, and error if any required keys are missing
+- These prep scripts run automatically at the start of all `dev*`, `build*`, and `tauri*` commands
+- See `frontend/README.md#environment-variables` for full documentation
+
+#### Import Paths - CRITICAL
+**ALWAYS use `@app/*` for imports.** Do not use `@core/*` or `@proprietary/*` unless explicitly wrapping/extending a lower layer implementation.
+
+```typescript
+// ✅ CORRECT - Use @app/* for all imports
+import { AppLayout } from "@app/components/AppLayout";
+import { useFileContext } from "@app/contexts/FileContext";
+import { FileContext } from "@app/contexts/FileContext";
+
+// ❌ WRONG - Do not use @core/* or @proprietary/* in normal code
+import { AppLayout } from "@core/components/AppLayout";
+import { useFileContext } from "@proprietary/contexts/FileContext";
+```
+
+**Only use explicit aliases when:**
+- Building layer-specific override that wraps a lower layer's component
+- Example: `import { AppProviders as CoreAppProviders } from "@core/components/AppProviders"` when creating proprietary/AppProviders.tsx that extends the core version
+
+The `@app/*` alias automatically resolves to the correct layer based on build target (core/proprietary/desktop) and handles the fallback cascade.
+
+#### Component Override Pattern (Stub/Shadow)
+Use this pattern for desktop-specific or proprietary-specific features WITHOUT runtime checks or conditionals.
+
+**How it works:**
+1. Core defines stub component (returns null or no-op)
+2. Desktop/proprietary overrides with same path/name
+3. Core imports via `@app/*` - higher layer "shadows" core in those builds
+4. No `@ts-ignore`, no `isTauri()` checks, no runtime conditionals!
+
+**Example - Desktop-specific footer:**
+
+```typescript
+// core/components/rightRail/RightRailFooterExtensions.tsx (stub)
+interface RightRailFooterExtensionsProps {
+  className?: string;
+}
+
+export function RightRailFooterExtensions(_props: RightRailFooterExtensionsProps) {
+  return null; // Stub - does nothing in web builds
+}
+```
+
+```typescript
+// desktop/components/rightRail/RightRailFooterExtensions.tsx (real implementation)
+import { Box } from '@mantine/core';
+import { BackendHealthIndicator } from '@app/components/BackendHealthIndicator';
+
+interface RightRailFooterExtensionsProps {
+  className?: string;
+}
+
+export function RightRailFooterExtensions({ className }: RightRailFooterExtensionsProps) {
+  return (
+    <Box className={className}>
+      <BackendHealthIndicator />
+    </Box>
+  );
+}
+```
+
+```typescript
+// core/components/shared/RightRail.tsx (usage - works in ALL builds)
+import { RightRailFooterExtensions } from '@app/components/rightRail/RightRailFooterExtensions';
+
+export function RightRail() {
+  return (
+    <div>
+      {/* In web builds: renders nothing (stub returns null) */}
+      {/* In desktop builds: renders BackendHealthIndicator */}
+      <RightRailFooterExtensions className="right-rail-footer" />
+    </div>
+  );
+}
+```
+
+**Build resolution:**
+- **Core build**: `@app/*` → `core/*` → Gets stub (returns null)
+- **Desktop build**: `@app/*` → `desktop/*` → Gets real implementation (shadows core)
+
+**Benefits:**
+- No runtime checks or feature flags
+- Type-safe across all builds
+- Clean, readable code
+- Build-time optimization (dead code elimination)
+
+#### Multi-Tool Workflow Architecture
+Frontend designed for **stateful document processing**:
+- Users upload PDFs once, then chain tools (split → merge → compress → view)
+- File state and processing results persist across tool switches
+- No file reloading between tools - performance critical for large PDFs (up to 100GB+)
+
+#### FileContext - Central State Management
+**Location**: `frontend/src/core/contexts/FileContext.tsx`
+- **Active files**: Currently loaded PDFs and their variants
+- **Tool navigation**: Current mode (viewer/pageEditor/fileEditor/toolName)
+- **Memory management**: PDF document cleanup, blob URL lifecycle, Web Worker management
+- **IndexedDB persistence**: File storage with thumbnail caching
+- **Preview system**: Tools can preview results (e.g., Split → Viewer → back to Split) without context pollution
+
+**Critical**: All file operations go through FileContext. Don't bypass with direct file handling.
+
+#### Processing Services
+- **enhancedPDFProcessingService**: Background PDF parsing and manipulation
+- **thumbnailGenerationService**: Web Worker-based with main-thread fallback
+- **fileStorage**: IndexedDB with LRU cache management
+
+#### Memory Management Strategy
+**Why manual cleanup exists**: Large PDFs (up to 100GB+) through multiple tools accumulate:
+- PDF.js documents that need explicit .destroy() calls
+- Blob URLs from tool outputs that need revocation
+- Web Workers that need termination
+Without cleanup: browser crashes with memory leaks.
+
+#### Tool Development
+
+**Architecture**: Modular hook-based system with clear separation of concerns:
+
+- **useToolOperation** (`frontend/src/core/hooks/tools/shared/useToolOperation.ts`): Main orchestrator hook
+  - Coordinates all tool operations with consistent interface
+  - Integrates with FileContext for operation tracking
+  - Handles validation, error handling, and UI state management
+
+- **Supporting Hooks**:
+  - **useToolState**: UI state management (loading, progress, error, files)
+  - **useToolApiCalls**: HTTP requests and file processing
+  - **useToolResources**: Blob URLs, thumbnails, ZIP downloads
+
+- **Utilities**:
+  - **toolErrorHandler**: Standardized error extraction and i18n support
+  - **toolResponseProcessor**: API response handling (single/zip/custom)
+  - **toolOperationTracker**: FileContext integration utilities
+
+**Three Tool Patterns**:
+
+**Pattern 1: Single-File Tools** (Individual processing)
+- Backend processes one file per API call
+- Set `multiFileEndpoint: false`
+- Examples: Compress, Rotate
+```typescript
+return useToolOperation({
+  operationType: 'compress',
+  endpoint: '/api/v1/misc/compress-pdf',
+  buildFormData: (params, file: File) => { /* single file */ },
+  multiFileEndpoint: false,
+});
+```
+
+**Pattern 2: Multi-File Tools** (Batch processing)
+- Backend accepts `MultipartFile[]` arrays in single API call
+- Set `multiFileEndpoint: true`
+- Examples: Split, Merge, Overlay
+```typescript
+return useToolOperation({
+  operationType: 'split',
+  endpoint: '/api/v1/general/split-pages',
+  buildFormData: (params, files: File[]) => { /* all files */ },
+  multiFileEndpoint: true,
+  filePrefix: 'split_',
+});
+```
+
+**Pattern 3: Complex Tools** (Custom processing)
+- Tools with complex routing logic or non-standard processing
+- Provide `customProcessor` for full control
+- Examples: Convert, OCR
+```typescript
+return useToolOperation({
+  operationType: 'convert',
+  customProcessor: async (params, files) => { /* custom logic */ },
+});
+```
+
+**Benefits**:
+- **No Timeouts**: Operations run until completion (supports 100GB+ files)
+- **Consistent**: All tools follow same pattern and interface
+- **Maintainable**: Single responsibility hooks, easy to test and modify
+- **i18n Ready**: Built-in internationalization support
+- **Type Safe**: Full TypeScript support with generic interfaces
+- **Memory Safe**: Automatic resource cleanup and blob URL management
+
+## Architecture Overview
+
+### Project Structure
+- **Backend**: Spring Boot application
+- **Frontend**: React-based SPA in `/frontend` directory
+  - **File Storage**: IndexedDB for client-side file persistence and thumbnails
+  - **Internationalization**: JSON-based translations (converted from backend .properties)
+- **PDF Processing**: PDFBox for core PDF operations, LibreOffice for conversions, PDF.js for client-side rendering
+- **Security**: Spring Security with optional authentication (controlled by `DOCKER_ENABLE_SECURITY`)
+- **Configuration**: YAML-based configuration with environment variable overrides
+
+### Controller Architecture
+- **API Controllers** (`src/main/java/.../controller/api/`): REST endpoints for PDF operations
+  - Organized by function: converters, security, misc, pipeline
+  - Follow pattern: `@RestController` + `@RequestMapping("/api/v1/...")`
+
+### Key Components
+- **SPDFApplication.java**: Main application class with desktop UI and browser launching logic
+- **ConfigInitializer**: Handles runtime configuration and settings files
+- **Pipeline System**: Automated PDF processing workflows via `PipelineController`
+- **Security Layer**: Authentication, authorization, and user management (when enabled)
+
+### Frontend Directory Structure
+The frontend is organized with a clear separation of concerns:
+
+- **`frontend/src/core/`**: Main application code (shared, production-ready components)
+  - **`core/components/`**: React components organized by feature
+    - `core/components/tools/`: Individual PDF tool implementations
+    - `core/components/viewer/`: PDF viewer components
+    - `core/components/pageEditor/`: Page manipulation UI
+    - `core/components/tooltips/`: Help tooltips for tools
+    - `core/components/shared/`: Reusable UI components
+  - **`core/contexts/`**: React Context providers
+    - `FileContext.tsx`: Central file state management
+    - `file/`: File reducer and selectors
+    - `toolWorkflow/`: Tool workflow state
+  - **`core/hooks/`**: Custom React hooks
+    - `hooks/tools/`: Tool-specific operation hooks (one directory per tool)
+    - `hooks/tools/shared/`: Shared hook utilities (useToolOperation, etc.)
+  - **`core/constants/`**: Application constants and configuration
+  - **`core/data/`**: Static data (tool taxonomy, etc.)
+  - **`core/services/`**: Business logic services (PDF processing, storage, etc.)
+
+- **`frontend/src/desktop/`**: Desktop-specific (Tauri) code
+- **`frontend/src/proprietary/`**: Proprietary/licensed features
+- **`frontend/src-tauri/`**: Tauri (Rust) native desktop application code
+- **`frontend/public/`**: Static assets served directly
+  - `public/locales/`: Translation JSON files
+
+### Component Architecture
+- **Static Assets**: CSS, JS, and resources in `src/main/resources/static/` (legacy) + `frontend/public/` (modern)
+- **Internationalization**:
+  - Backend: `messages_*.properties` files
+  - Frontend: JSON files in `frontend/public/locales/` (converted from .properties)
+  - Conversion Script: `scripts/convert_properties_to_json.py`
+
+### Configuration Modes
+- **Ultra-lite**: Basic PDF operations only
+- **Standard**: Full feature set
+- **Fat**: Pre-downloaded dependencies for air-gapped environments
+- **Security Mode**: Adds authentication, user management, and enterprise features
+
+### Testing Strategy
+- **Integration Tests**: Cucumber tests in `testing/cucumber/`
+- **Docker Testing**: `test.sh` validates all Docker variants
+- **Manual Testing**: No unit tests currently - relies on UI and API testing
+
+## Development Workflow
+
+1. **Local Development**:
+   - Backend: `./gradlew bootRun` (runs on localhost:8080)
+   - Frontend: `cd frontend && npm run dev` (runs on localhost:5173, proxies to backend)
+2. **Docker Testing**: Use `./test.sh` before submitting PRs
+3. **Code Style**: Spotless enforces Google Java Format automatically
+4. **Translations**:
+   - Backend: Use helper scripts in `/scripts` for multi-language updates
+   - Frontend: Update JSON files in `frontend/public/locales/` or use conversion script
+5. **Documentation**: API docs auto-generated and available at `/swagger-ui/index.html`
+
+## Frontend Architecture Status
+
+- **Core Status**: React SPA architecture complete with multi-tool workflow support
+- **State Management**: FileContext handles all file operations and tool navigation
+- **File Processing**: Production-ready with memory management for large PDF workflows (up to 100GB+)
+- **Tool Integration**: Modular hook architecture with `useToolOperation` orchestrator
+  - Individual hooks: `useToolState`, `useToolApiCalls`, `useToolResources`
+  - Utilities: `toolErrorHandler`, `toolResponseProcessor`, `toolOperationTracker`
+  - Pattern: Each tool creates focused operation hook, UI consumes state/actions
+- **Preview System**: Tool results can be previewed without polluting file context (Split tool example)
+- **Performance**: Web Worker thumbnails, IndexedDB persistence, background processing
+
+## Translation Rules
+
+- **CRITICAL**: Always update translations in `en-GB` only, never `en-US`
+- Translation files are located in `frontend/public/locales/`
+
+## Important Notes
+
+- **Java Version**: Minimum JDK 21, supports and recommends JDK 25
+- **Lombok**: Used extensively - ensure IDE plugin is installed
+- **File Persistence**:
+  - **Backend**: Designed to be stateless - files are processed in memory/temp locations only
+  - **Frontend**: Uses IndexedDB for client-side file storage and caching (with thumbnails)
+- **Security**: When `DOCKER_ENABLE_SECURITY=false`, security-related classes are excluded from compilation
+- **Import Paths**: ALWAYS use `@app/*` for imports - never use `@core/*` or `@proprietary/*` unless explicitly wrapping/extending a lower layer
+- **FileContext**: All file operations MUST go through FileContext - never bypass with direct File handling
+- **Memory Management**: Manual cleanup required for PDF.js documents and blob URLs - don't remove cleanup code
+- **Tool Development**: New tools should follow `useToolOperation` hook pattern (see `useCompressOperation.ts`)
+- **Performance Target**: Must handle PDFs up to 100GB+ without browser crashes
+- **Preview System**: Tools can preview results without polluting main file context (see Split tool implementation)
+- **Adding Tools**: See `ADDING_TOOLS.md` for complete guide to creating new PDF tools
+
+## Communication Style
+- Be direct and to the point
+- No apologies or conversational filler
+- Answer questions directly without preamble
+- Explain reasoning concisely when asked
+- Avoid unnecessary elaboration
+
+## Decision Making
+- Ask clarifying questions before making assumptions
+- Stop and ask when uncertain about project-specific details
+- Confirm approach before making structural changes
+- Request guidance on preferences (cross-platform vs specific tools, etc.)
+- Verify understanding of requirements before proceeding

CLAUDE.md

@@ -1,337 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Common Development Commands
-
-### Build and Test
-- **Build project**: `./gradlew clean build`
-- **Run locally**: `./gradlew bootRun`
-- **Full test suite**: `./test.sh` (builds all Docker variants and runs comprehensive tests)
-- **Code formatting**: `./gradlew spotlessApply` (runs automatically before compilation)
-
-### Docker Development
-- **Build ultra-lite**: `docker build -t stirlingtools/stirling-pdf:latest-ultra-lite -f ./Dockerfile.ultra-lite .`
-- **Build standard**: `docker build -t stirlingtools/stirling-pdf:latest -f ./Dockerfile .`
-- **Build fat version**: `docker build -t stirlingtools/stirling-pdf:latest-fat -f ./Dockerfile.fat .`
-- **Example compose files**: Located in `exampleYmlFiles/` directory
-
-### Security Mode Development
-Set `DOCKER_ENABLE_SECURITY=true` environment variable to enable security features during development. This is required for testing the full version locally.
-
-### Frontend Development
-- **Frontend dev server**: `cd frontend && npm run dev` (requires backend on localhost:8080)
-- **Tech Stack**: Vite + React + TypeScript + Mantine UI + TailwindCSS
-- **Proxy Configuration**: Vite proxies `/api/*` calls to backend (localhost:8080)
-- **Build Process**: DO NOT run build scripts manually - builds are handled by CI/CD pipelines
-- **Package Installation**: DO NOT run npm install commands - package management handled separately
-- **Deployment Options**:
-  - **Desktop App**: `npm run tauri-build` (native desktop application)
-  - **Web Server**: `npm run build` then serve dist/ folder
-  - **Development**: `npm run tauri-dev` for desktop dev mode
-
-#### Import Paths - CRITICAL
-**ALWAYS use `@app/*` for imports.** Do not use `@core/*` or `@proprietary/*` unless explicitly wrapping/extending a lower layer implementation.
-
-```typescript
-// ✅ CORRECT - Use @app/* for all imports
-import { AppLayout } from "@app/components/AppLayout";
-import { useFileContext } from "@app/contexts/FileContext";
-import { FileContext } from "@app/contexts/FileContext";
-
-// ❌ WRONG - Do not use @core/* or @proprietary/* in normal code
-import { AppLayout } from "@core/components/AppLayout";
-import { useFileContext } from "@proprietary/contexts/FileContext";
-```
-
-**Only use explicit aliases when:**
-- Building layer-specific override that wraps a lower layer's component
-- Example: `import { AppProviders as CoreAppProviders } from "@core/components/AppProviders"` when creating proprietary/AppProviders.tsx that extends the core version
-
-The `@app/*` alias automatically resolves to the correct layer based on build target (core/proprietary/desktop) and handles the fallback cascade.
-
-#### Component Override Pattern (Stub/Shadow)
-Use this pattern for desktop-specific or proprietary-specific features WITHOUT runtime checks or conditionals.
-
-**How it works:**
-1. Core defines stub component (returns null or no-op)
-2. Desktop/proprietary overrides with same path/name
-3. Core imports via `@app/*` - higher layer "shadows" core in those builds
-4. No `@ts-ignore`, no `isTauri()` checks, no runtime conditionals!
-
-**Example - Desktop-specific footer:**
-
-```typescript
-// core/components/rightRail/RightRailFooterExtensions.tsx (stub)
-interface RightRailFooterExtensionsProps {
-  className?: string;
-}
-
-export function RightRailFooterExtensions(_props: RightRailFooterExtensionsProps) {
-  return null; // Stub - does nothing in web builds
-}
-```
-
-```typescript
-// desktop/components/rightRail/RightRailFooterExtensions.tsx (real implementation)
-import { Box } from '@mantine/core';
-import { BackendHealthIndicator } from '@app/components/BackendHealthIndicator';
-
-interface RightRailFooterExtensionsProps {
-  className?: string;
-}
-
-export function RightRailFooterExtensions({ className }: RightRailFooterExtensionsProps) {
-  return (
-    <Box className={className}>
-      <BackendHealthIndicator />
-    </Box>
-  );
-}
-```
-
-```typescript
-// core/components/shared/RightRail.tsx (usage - works in ALL builds)
-import { RightRailFooterExtensions } from '@app/components/rightRail/RightRailFooterExtensions';
-
-export function RightRail() {
-  return (
-    <div>
-      {/* In web builds: renders nothing (stub returns null) */}
-      {/* In desktop builds: renders BackendHealthIndicator */}
-      <RightRailFooterExtensions className="right-rail-footer" />
-    </div>
-  );
-}
-```
-
-**Build resolution:**
-- **Core build**: `@app/*` → `core/*` → Gets stub (returns null)
-- **Desktop build**: `@app/*` → `desktop/*` → Gets real implementation (shadows core)
-
-**Benefits:**
-- No runtime checks or feature flags
-- Type-safe across all builds
-- Clean, readable code
-- Build-time optimization (dead code elimination)
-
-#### Multi-Tool Workflow Architecture
-Frontend designed for **stateful document processing**:
-- Users upload PDFs once, then chain tools (split → merge → compress → view)
-- File state and processing results persist across tool switches
-- No file reloading between tools - performance critical for large PDFs (up to 100GB+)
-
-#### FileContext - Central State Management
-**Location**: `frontend/src/core/contexts/FileContext.tsx`
-- **Active files**: Currently loaded PDFs and their variants
-- **Tool navigation**: Current mode (viewer/pageEditor/fileEditor/toolName)
-- **Memory management**: PDF document cleanup, blob URL lifecycle, Web Worker management
-- **IndexedDB persistence**: File storage with thumbnail caching
-- **Preview system**: Tools can preview results (e.g., Split → Viewer → back to Split) without context pollution
-
-**Critical**: All file operations go through FileContext. Don't bypass with direct file handling.
-
-#### Processing Services
-- **enhancedPDFProcessingService**: Background PDF parsing and manipulation
-- **thumbnailGenerationService**: Web Worker-based with main-thread fallback
-- **fileStorage**: IndexedDB with LRU cache management
-
-#### Memory Management Strategy
-**Why manual cleanup exists**: Large PDFs (up to 100GB+) through multiple tools accumulate:
-- PDF.js documents that need explicit .destroy() calls
-- Blob URLs from tool outputs that need revocation
-- Web Workers that need termination
-Without cleanup: browser crashes with memory leaks.
-
-#### Tool Development
-
-**Architecture**: Modular hook-based system with clear separation of concerns:
-
-- **useToolOperation** (`frontend/src/core/hooks/tools/shared/useToolOperation.ts`): Main orchestrator hook
-  - Coordinates all tool operations with consistent interface
-  - Integrates with FileContext for operation tracking
-  - Handles validation, error handling, and UI state management
-
-- **Supporting Hooks**:
-  - **useToolState**: UI state management (loading, progress, error, files)
-  - **useToolApiCalls**: HTTP requests and file processing
-  - **useToolResources**: Blob URLs, thumbnails, ZIP downloads
-
-- **Utilities**:
-  - **toolErrorHandler**: Standardized error extraction and i18n support
-  - **toolResponseProcessor**: API response handling (single/zip/custom)
-  - **toolOperationTracker**: FileContext integration utilities
-
-**Three Tool Patterns**:
-
-**Pattern 1: Single-File Tools** (Individual processing)
-- Backend processes one file per API call
-- Set `multiFileEndpoint: false`
-- Examples: Compress, Rotate
-```typescript
-return useToolOperation({
-  operationType: 'compress',
-  endpoint: '/api/v1/misc/compress-pdf',
-  buildFormData: (params, file: File) => { /* single file */ },
-  multiFileEndpoint: false,
-});
-```
-
-**Pattern 2: Multi-File Tools** (Batch processing)
-- Backend accepts `MultipartFile[]` arrays in single API call
-- Set `multiFileEndpoint: true`
-- Examples: Split, Merge, Overlay
-```typescript
-return useToolOperation({
-  operationType: 'split',
-  endpoint: '/api/v1/general/split-pages',
-  buildFormData: (params, files: File[]) => { /* all files */ },
-  multiFileEndpoint: true,
-  filePrefix: 'split_',
-});
-```
-
-**Pattern 3: Complex Tools** (Custom processing)
-- Tools with complex routing logic or non-standard processing
-- Provide `customProcessor` for full control
-- Examples: Convert, OCR
-```typescript
-return useToolOperation({
-  operationType: 'convert',
-  customProcessor: async (params, files) => { /* custom logic */ },
-});
-```
-
-**Benefits**:
-- **No Timeouts**: Operations run until completion (supports 100GB+ files)
-- **Consistent**: All tools follow same pattern and interface
-- **Maintainable**: Single responsibility hooks, easy to test and modify
-- **i18n Ready**: Built-in internationalization support
-- **Type Safe**: Full TypeScript support with generic interfaces
-- **Memory Safe**: Automatic resource cleanup and blob URL management
-
-## Architecture Overview
-
-### Project Structure
-- **Backend**: Spring Boot application
-- **Frontend**: React-based SPA in `/frontend` directory
-  - **File Storage**: IndexedDB for client-side file persistence and thumbnails
-  - **Internationalization**: JSON-based translations (converted from backend .properties)
-- **PDF Processing**: PDFBox for core PDF operations, LibreOffice for conversions, PDF.js for client-side rendering
-- **Security**: Spring Security with optional authentication (controlled by `DOCKER_ENABLE_SECURITY`)
-- **Configuration**: YAML-based configuration with environment variable overrides
-
-### Controller Architecture
-- **API Controllers** (`src/main/java/.../controller/api/`): REST endpoints for PDF operations
-  - Organized by function: converters, security, misc, pipeline
-  - Follow pattern: `@RestController` + `@RequestMapping("/api/v1/...")`
-
-### Key Components
-- **SPDFApplication.java**: Main application class with desktop UI and browser launching logic
-- **ConfigInitializer**: Handles runtime configuration and settings files
-- **Pipeline System**: Automated PDF processing workflows via `PipelineController`
-- **Security Layer**: Authentication, authorization, and user management (when enabled)
-
-### Frontend Directory Structure
-The frontend is organized with a clear separation of concerns:
-
-- **`frontend/src/core/`**: Main application code (shared, production-ready components)
-  - **`core/components/`**: React components organized by feature
-    - `core/components/tools/`: Individual PDF tool implementations
-    - `core/components/viewer/`: PDF viewer components
-    - `core/components/pageEditor/`: Page manipulation UI
-    - `core/components/tooltips/`: Help tooltips for tools
-    - `core/components/shared/`: Reusable UI components
-  - **`core/contexts/`**: React Context providers
-    - `FileContext.tsx`: Central file state management
-    - `file/`: File reducer and selectors
-    - `toolWorkflow/`: Tool workflow state
-  - **`core/hooks/`**: Custom React hooks
-    - `hooks/tools/`: Tool-specific operation hooks (one directory per tool)
-    - `hooks/tools/shared/`: Shared hook utilities (useToolOperation, etc.)
-  - **`core/constants/`**: Application constants and configuration
-  - **`core/data/`**: Static data (tool taxonomy, etc.)
-  - **`core/services/`**: Business logic services (PDF processing, storage, etc.)
-
-- **`frontend/src/desktop/`**: Desktop-specific (Tauri) code
-- **`frontend/src/proprietary/`**: Proprietary/licensed features
-- **`frontend/src-tauri/`**: Tauri (Rust) native desktop application code
-- **`frontend/public/`**: Static assets served directly
-  - `public/locales/`: Translation JSON files
-
-### Component Architecture
-- **Static Assets**: CSS, JS, and resources in `src/main/resources/static/` (legacy) + `frontend/public/` (modern)
-- **Internationalization**:
-  - Backend: `messages_*.properties` files
-  - Frontend: JSON files in `frontend/public/locales/` (converted from .properties)
-  - Conversion Script: `scripts/convert_properties_to_json.py`
-
-### Configuration Modes
-- **Ultra-lite**: Basic PDF operations only
-- **Standard**: Full feature set
-- **Fat**: Pre-downloaded dependencies for air-gapped environments
-- **Security Mode**: Adds authentication, user management, and enterprise features
-
-### Testing Strategy
-- **Integration Tests**: Cucumber tests in `testing/cucumber/`
-- **Docker Testing**: `test.sh` validates all Docker variants
-- **Manual Testing**: No unit tests currently - relies on UI and API testing
-
-## Development Workflow
-
-1. **Local Development**:
-   - Backend: `./gradlew bootRun` (runs on localhost:8080)
-   - Frontend: `cd frontend && npm run dev` (runs on localhost:5173, proxies to backend)
-2. **Docker Testing**: Use `./test.sh` before submitting PRs
-3. **Code Style**: Spotless enforces Google Java Format automatically
-4. **Translations**:
-   - Backend: Use helper scripts in `/scripts` for multi-language updates
-   - Frontend: Update JSON files in `frontend/public/locales/` or use conversion script
-5. **Documentation**: API docs auto-generated and available at `/swagger-ui/index.html`
-
-## Frontend Architecture Status
-
-- **Core Status**: React SPA architecture complete with multi-tool workflow support
-- **State Management**: FileContext handles all file operations and tool navigation
-- **File Processing**: Production-ready with memory management for large PDF workflows (up to 100GB+)
-- **Tool Integration**: Modular hook architecture with `useToolOperation` orchestrator
-  - Individual hooks: `useToolState`, `useToolApiCalls`, `useToolResources`
-  - Utilities: `toolErrorHandler`, `toolResponseProcessor`, `toolOperationTracker`
-  - Pattern: Each tool creates focused operation hook, UI consumes state/actions
-- **Preview System**: Tool results can be previewed without polluting file context (Split tool example)
-- **Performance**: Web Worker thumbnails, IndexedDB persistence, background processing
-
-## Translation Rules
-
-- **CRITICAL**: Always update translations in `en-GB` only, never `en-US`
-- Translation files are located in `frontend/public/locales/`
-
-## Important Notes
-
-- **Java Version**: Minimum JDK 17, supports and recommends JDK 21
-- **Lombok**: Used extensively - ensure IDE plugin is installed
-- **File Persistence**:
-  - **Backend**: Designed to be stateless - files are processed in memory/temp locations only
-  - **Frontend**: Uses IndexedDB for client-side file storage and caching (with thumbnails)
-- **Security**: When `DOCKER_ENABLE_SECURITY=false`, security-related classes are excluded from compilation
-- **Import Paths**: ALWAYS use `@app/*` for imports - never use `@core/*` or `@proprietary/*` unless explicitly wrapping/extending a lower layer
-- **FileContext**: All file operations MUST go through FileContext - never bypass with direct File handling
-- **Memory Management**: Manual cleanup required for PDF.js documents and blob URLs - don't remove cleanup code
-- **Tool Development**: New tools should follow `useToolOperation` hook pattern (see `useCompressOperation.ts`)
-- **Performance Target**: Must handle PDFs up to 100GB+ without browser crashes
-- **Preview System**: Tools can preview results without polluting main file context (see Split tool implementation)
-- **Adding Tools**: See `ADDING_TOOLS.md` for complete guide to creating new PDF tools
-
-## Communication Style
-- Be direct and to the point
-- No apologies or conversational filler
-- Answer questions directly without preamble
-- Explain reasoning concisely when asked
-- Avoid unnecessary elaboration
-
-## Decision Making
-- Ask clarifying questions before making assumptions
-- Stop and ask when uncertain about project-specific details
-- Confirm approach before making structural changes
-- Request guidance on preferences (cross-platform vs specific tools, etc.)
-- Verify understanding of requirements before proceeding

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

DeveloperGuide.md

@@ -11,7 +11,7 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 **Stirling 2.0** is built using:
 
 **Backend:**
-- Spring Boot (Java 17+, JDK 21 recommended)
+- Spring Boot (Java 21+, JDK 25 recommended)
 - PDFBox for core PDF operations
 - LibreOffice for document conversions
 - qpdf for PDF optimization
@@ -44,7 +44,7 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 
 - Docker
 - Git
-- Java JDK 17 or later (JDK 21 recommended)
+- Java JDK 21 or later (JDK 25 recommended)
 - Node.js 18+ and npm (required for frontend development)
 - Gradle 7.0 or later (Included within the repo)
 - Rust and Cargo (required for Tauri desktop app development)
@@ -59,7 +59,7 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
    cd Stirling-PDF
    ```
 
-2. Install Docker and JDK17 if not already installed.
+2. Install Docker and JDK 21 (or JDK 25 recommended) if not already installed.
 
 3. Install a recommended Java IDE such as Eclipse, IntelliJ, or VSCode
    1. Only VSCode

LICENSE

@@ -10,6 +10,8 @@ if that directory exists, is licensed under the license defined in "app/propriet
 if that directory exists, is licensed under the license defined in "frontend/src/proprietary/LICENSE".
 * All content that resides under the "frontend/src/desktop/" directory of this repository,
 if that directory exists, is licensed under the license defined in "frontend/src/desktop/LICENSE".
+* All content that resides under the "frontend/src/saas/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/saas/LICENSE".
 * Content outside of the above mentioned directories or restrictions above is
 available under the MIT License as defined below.
 

app/common/build.gradle

@@ -5,10 +5,10 @@ bootRun {
 spotless {
     java {
         target 'src/**/java/**/*.java'
+        targetExclude 'src/main/java/org/apache/**'
         googleJavaFormat(googleJavaFormatVersion).aosp().reorderImports(false)
 
         importOrder("java", "javax", "org", "com", "net", "io", "jakarta", "lombok", "me", "stirling")
-        toggleOffOn()
         trimTrailingWhitespace()
         leadingTabsToSpaces()
         endWithNewline()
@@ -27,9 +27,10 @@ spotless {
     }
 }
 dependencies {
-    api 'org.springframework.boot:spring-boot-starter-web'
-    api 'org.springframework.boot:spring-boot-starter-aop'
-    api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20240325.1'
+    api 'com.google.guava:guava:33.4.8-jre'
+    api 'org.springframework.boot:spring-boot-starter-webmvc'
+    api 'org.springframework.boot:spring-boot-starter-aspectj'
+    api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20260102.1'
     api 'com.fathzer:javaluator:3.0.6'
     api 'com.posthog.java:posthog:1.2.0'
     api 'org.apache.commons:commons-lang3:3.20.0'
@@ -39,10 +40,10 @@ dependencies {
     api "org.apache.pdfbox:pdfbox-io:$pdfboxVersion"
     api "org.apache.pdfbox:xmpbox:$pdfboxVersion"
     api "org.apache.pdfbox:preflight:$pdfboxVersion"
-    api 'com.github.junrar:junrar:7.5.7' // RAR archive support for CBR files
+    api 'com.github.junrar:junrar:7.5.8' // RAR archive support for CBR files
     api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
     api 'org.snakeyaml:snakeyaml-engine:3.0.1'
-    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.15"
+    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.1"
     // Simple Java Mail for EML/MSG parsing (replaces direct Angus Mail usage)
     api 'org.simplejavamail:simple-java-mail:8.12.6'
     api 'org.simplejavamail:outlook-module:8.12.6' // MSG file support

app/common/src/main/java/stirling/software/SPDF/config/EndpointConfiguration.java

@@ -103,8 +103,9 @@ public class EndpointConfiguration {
 
         // Rule 2: Functional-group override - check if endpoint belongs to any disabled functional
         // group
-        for (String group : endpointGroups.keySet()) {
-            if (disabledGroups.contains(group) && endpointGroups.get(group).contains(endpoint)) {
+        for (Map.Entry<String, Set<String>> entry : endpointGroups.entrySet()) {
+            String group = entry.getKey();
+            if (disabledGroups.contains(group) && entry.getValue().contains(endpoint)) {
                 // Skip tool groups (qpdf, OCRmyPDF, Ghostscript, LibreOffice, etc.)
                 if (!isToolGroup(group)) {
                     log.debug(
@@ -131,10 +132,11 @@ public class EndpointConfiguration {
 
         // Rule 4: Single-dependency check - if no alternatives defined, check if endpoint belongs
         // to any disabled tool groups
-        for (String group : endpointGroups.keySet()) {
+        for (Map.Entry<String, Set<String>> entry : endpointGroups.entrySet()) {
+            String group = entry.getKey();
             if (isToolGroup(group)
                     && disabledGroups.contains(group)
-                    && endpointGroups.get(group).contains(endpoint)) {
+                    && entry.getValue().contains(endpoint)) {
                 log.debug(
                         "isEndpointEnabled('{}') -> false (single tool group '{}' disabled, no alternatives)",
                         original,
@@ -645,8 +647,9 @@ public class EndpointConfiguration {
         }
 
         // Check if endpoint belongs to any disabled functional group
-        for (String group : endpointGroups.keySet()) {
-            if (disabledGroups.contains(group) && endpointGroups.get(group).contains(endpoint)) {
+        for (Map.Entry<String, Set<String>> entry : endpointGroups.entrySet()) {
+            String group = entry.getKey();
+            if (disabledGroups.contains(group) && entry.getValue().contains(endpoint)) {
                 if (!isToolGroup(group)) {
                     return false;
                 }

app/common/src/main/java/stirling/software/common/aop/AutoJobAspect.java

@@ -2,12 +2,14 @@ package stirling.software.common.aop;
 
 import java.io.IOException;
 import java.time.Duration;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.TimeUnit;
+import java.util.HashMap;
+import java.util.Map;
 import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.Supplier;
 
 import org.aspectj.lang.ProceedingJoinPoint;
 import org.aspectj.lang.annotation.*;
+import org.slf4j.MDC;
 import org.springframework.core.annotation.Order;
 import org.springframework.stereotype.Component;
 import org.springframework.web.multipart.MultipartFile;
@@ -26,7 +28,7 @@ import stirling.software.common.service.JobExecutorService;
 @Component
 @RequiredArgsConstructor
 @Slf4j
-@Order(0) // Highest precedence - executes before audit aspects
+@Order(20) // Lower precedence - executes AFTER audit aspects populate MDC
 public class AutoJobAspect {
 
     private static final Duration RETRY_BASE_DELAY = Duration.ofMillis(100);
@@ -70,26 +72,29 @@ public class AutoJobAspect {
             // No retries needed, simple execution
             return jobExecutorService.runJobGeneric(
                     async,
-                    () -> {
-                        try {
-                            // Note: Progress tracking is handled in TaskManager/JobExecutorService
-                            // The trackProgress flag controls whether detailed progress is stored
-                            // for REST API queries, not WebSocket notifications
-                            return joinPoint.proceed(args);
-                        } catch (Throwable ex) {
-                            log.error(
-                                    "AutoJobAspect caught exception during job execution: {}",
-                                    ex.getMessage(),
-                                    ex);
-                            // Rethrow RuntimeException as-is to preserve exception type
-                            if (ex instanceof RuntimeException) {
-                                throw (RuntimeException) ex;
-                            }
-                            // Wrap checked exceptions - GlobalExceptionHandler will unwrap
-                            // BaseAppException
-                            throw new RuntimeException(ex);
-                        }
-                    },
+                    wrapWithMDC(
+                            () -> {
+                                try {
+                                    // Note: Progress tracking is handled in
+                                    // TaskManager/JobExecutorService
+                                    // The trackProgress flag controls whether detailed progress is
+                                    // stored
+                                    // for REST API queries, not WebSocket notifications
+                                    return joinPoint.proceed(args);
+                                } catch (Throwable ex) {
+                                    log.error(
+                                            "AutoJobAspect caught exception during job execution: {}",
+                                            ex.getMessage(),
+                                            ex);
+                                    // Rethrow RuntimeException as-is to preserve exception type
+                                    if (ex instanceof RuntimeException) {
+                                        throw (RuntimeException) ex;
+                                    }
+                                    // Wrap checked exceptions - GlobalExceptionHandler will unwrap
+                                    // BaseAppException
+                                    throw new RuntimeException(ex);
+                                }
+                            }),
                     timeout,
                     queueable,
                     resourceWeight);
@@ -123,114 +128,108 @@ public class AutoJobAspect {
 
         return jobExecutorService.runJobGeneric(
                 async,
-                () -> {
-                    // Use iterative approach instead of recursion to avoid stack overflow
-                    Throwable lastException = null;
+                wrapWithMDC(
+                        () -> {
+                            // Use iterative approach instead of recursion to avoid stack overflow
+                            Throwable lastException = null;
 
-                    // Attempt counter starts at 1 for first try
-                    for (int currentAttempt = 1; currentAttempt <= maxRetries; currentAttempt++) {
-                        try {
-                            if (trackProgress && async) {
-                                // Get jobId for progress tracking in TaskManager
-                                // This enables REST API progress queries, not WebSocket
-                                if (jobIdRef.get() == null) {
-                                    jobIdRef.set(getJobIdFromContext());
-                                }
-                                String jobId = jobIdRef.get();
-                                if (jobId != null) {
-                                    log.debug(
-                                            "Tracking progress for job {} (attempt {}/{})",
-                                            jobId,
+                            // Attempt counter starts at 1 for first try
+                            for (int currentAttempt = 1;
+                                    currentAttempt <= maxRetries;
+                                    currentAttempt++) {
+                                try {
+                                    if (trackProgress && async) {
+                                        // Get jobId for progress tracking in TaskManager
+                                        // This enables REST API progress queries, not WebSocket
+                                        if (jobIdRef.get() == null) {
+                                            jobIdRef.set(getJobIdFromContext());
+                                        }
+                                        String jobId = jobIdRef.get();
+                                        if (jobId != null) {
+                                            log.debug(
+                                                    "Tracking progress for job {} (attempt {}/{})",
+                                                    jobId,
+                                                    currentAttempt,
+                                                    maxRetries);
+                                            // Progress is tracked in TaskManager for REST API
+                                            // access
+                                            // No WebSocket notifications sent here
+                                        }
+                                    }
+
+                                    // Attempt to execute the operation
+                                    return joinPoint.proceed(args);
+
+                                } catch (Throwable ex) {
+                                    lastException = ex;
+                                    log.error(
+                                            "AutoJobAspect caught exception during job execution (attempt"
+                                                    + " {}/{}): {}",
                                             currentAttempt,
-                                            maxRetries);
-                                    // Progress is tracked in TaskManager for REST API access
-                                    // No WebSocket notifications sent here
-                                }
-                            }
+                                            maxRetries,
+                                            ex.getMessage(),
+                                            ex);
 
-                            // Attempt to execute the operation
-                            return joinPoint.proceed(args);
+                                    // Check if we should retry
+                                    if (currentAttempt < maxRetries) {
+                                        log.info(
+                                                "Retrying operation, attempt {}/{}",
+                                                currentAttempt + 1,
+                                                maxRetries);
 
-                        } catch (Throwable ex) {
-                            lastException = ex;
-                            log.error(
-                                    "AutoJobAspect caught exception during job execution (attempt"
-                                            + " {}/{}): {}",
-                                    currentAttempt,
-                                    maxRetries,
-                                    ex.getMessage(),
-                                    ex);
+                                        if (trackProgress && async) {
+                                            String jobId = jobIdRef.get();
+                                            if (jobId != null) {
+                                                log.debug(
+                                                        "Recording retry attempt for job {} in TaskManager",
+                                                        jobId);
+                                                // Retry info is tracked in TaskManager for REST API
+                                                // access
+                                            }
+                                        }
 
-                            // Check if we should retry
-                            if (currentAttempt < maxRetries) {
-                                log.info(
-                                        "Retrying operation, attempt {}/{}",
-                                        currentAttempt + 1,
-                                        maxRetries);
+                                        // Use sleep for retry delay
+                                        // For sync jobs, both sleep and async are blocking at this
+                                        // point
+                                        // For async jobs, the delay occurs in the executor thread
+                                        long delayMs = RETRY_BASE_DELAY.toMillis() * currentAttempt;
 
-                                if (trackProgress && async) {
-                                    String jobId = jobIdRef.get();
-                                    if (jobId != null) {
-                                        log.debug(
-                                                "Recording retry attempt for job {} in TaskManager",
-                                                jobId);
-                                        // Retry info is tracked in TaskManager for REST API access
+                                        try {
+                                            Thread.sleep(delayMs);
+                                        } catch (InterruptedException e) {
+                                            Thread.currentThread().interrupt();
+                                            log.debug(
+                                                    "Retry delay interrupted for attempt {}/{}",
+                                                    currentAttempt,
+                                                    maxRetries);
+                                            break;
+                                        }
+                                    } else {
+                                        // No more retries, we'll throw the exception after the loop
+                                        break;
                                     }
                                 }
-
-                                // Use non-blocking delay for all retry attempts to avoid blocking
-                                // threads
-                                // For sync jobs this avoids starving the tomcat thread pool under
-                                // load
-                                long delayMs = RETRY_BASE_DELAY.toMillis() * currentAttempt;
-
-                                // Execute the retry after a delay through the JobExecutorService
-                                // rather than blocking the current thread with sleep
-                                CompletableFuture<Object> delayedRetry = new CompletableFuture<>();
-
-                                // Use a delayed executor for non-blocking delay
-                                CompletableFuture.delayedExecutor(delayMs, TimeUnit.MILLISECONDS)
-                                        .execute(
-                                                () -> {
-                                                    // Continue the retry loop in the next iteration
-                                                    // We can't return from here directly since
-                                                    // we're in a Runnable
-                                                    delayedRetry.complete(null);
-                                                });
-
-                                // Wait for the delay to complete before continuing
-                                try {
-                                    delayedRetry.join();
-                                } catch (Exception e) {
-                                    Thread.currentThread().interrupt();
-                                    break;
-                                }
-                            } else {
-                                // No more retries, we'll throw the exception after the loop
-                                break;
                             }
-                        }
-                    }
 
-                    // If we get here, all retries failed
-                    if (lastException != null) {
-                        // Rethrow RuntimeException as-is to preserve exception type
-                        if (lastException instanceof RuntimeException) {
-                            throw (RuntimeException) lastException;
-                        }
-                        // Wrap checked exceptions - GlobalExceptionHandler will unwrap
-                        // BaseAppException
-                        throw new RuntimeException(
-                                "Job failed after "
-                                        + maxRetries
-                                        + " attempts: "
-                                        + lastException.getMessage(),
-                                lastException);
-                    }
+                            // If we get here, all retries failed
+                            if (lastException != null) {
+                                // Rethrow RuntimeException as-is to preserve exception type
+                                if (lastException instanceof RuntimeException) {
+                                    throw (RuntimeException) lastException;
+                                }
+                                // Wrap checked exceptions - GlobalExceptionHandler will unwrap
+                                // BaseAppException
+                                throw new RuntimeException(
+                                        "Job failed after "
+                                                + maxRetries
+                                                + " attempts: "
+                                                + lastException.getMessage(),
+                                        lastException);
+                            }
 
-                    // This should never happen if lastException is properly tracked
-                    throw new RuntimeException("Job failed but no exception was recorded");
-                },
+                            // This should never happen if lastException is properly tracked
+                            throw new RuntimeException("Job failed but no exception was recorded");
+                        }),
                 timeout,
                 queueable,
                 resourceWeight);
@@ -299,4 +298,32 @@ public class AutoJobAspect {
             return null;
         }
     }
+
+    /**
+     * Wraps a supplier to propagate MDC context to background threads. Captures MDC on request
+     * thread and restores it in the background thread. Ensures proper cleanup to prevent context
+     * leakage across jobs in thread pools.
+     */
+    private <T> Supplier<T> wrapWithMDC(Supplier<T> supplier) {
+        final Map<String, String> captured = MDC.getCopyOfContextMap();
+        return () -> {
+            final Map<String, String> previous = MDC.getCopyOfContextMap();
+            try {
+                // Set the captured context (or clear if none was captured)
+                if (captured != null) {
+                    MDC.setContextMap(new HashMap<>(captured));
+                } else {
+                    MDC.clear();
+                }
+                return supplier.get();
+            } finally {
+                // Restore previous state (or clear if there was none)
+                if (previous != null) {
+                    MDC.setContextMap(previous);
+                } else {
+                    MDC.clear();
+                }
+            }
+        };
+    }
 }

app/common/src/main/java/stirling/software/common/configuration/InstallationPathConfig.java

@@ -14,7 +14,6 @@ public class InstallationPathConfig {
     private static final String CUSTOM_FILES_PATH;
     private static final String CLIENT_WEBUI_PATH;
     private static final String PIPELINE_PATH;
-    private static final String PLUGINS_PATH;
 
     // Config paths
     private static final String SETTINGS_PATH;
@@ -41,7 +40,6 @@ public class InstallationPathConfig {
         CUSTOM_FILES_PATH = BASE_PATH + "customFiles" + File.separator;
         CLIENT_WEBUI_PATH = BASE_PATH + "clientWebUI" + File.separator;
         PIPELINE_PATH = BASE_PATH + "pipeline" + File.separator;
-        PLUGINS_PATH = CUSTOM_FILES_PATH + "plugins" + File.separator;
 
         // Initialize config paths
         SETTINGS_PATH = CONFIG_PATH + "settings.yml";
@@ -112,10 +110,6 @@ public class InstallationPathConfig {
         return SIGNATURES_PATH;
     }
 
-    public static String getPluginsPath() {
-        return PLUGINS_PATH;
-    }
-
     public static String getPrivateKeyPath() {
         return BACKUP_PRIVATE_KEY_PATH;
     }

app/common/src/main/java/stirling/software/common/configuration/RuntimePathConfig.java

@@ -91,9 +91,9 @@ public class RuntimePathConfig {
 
         // Initialize Operation paths
         String defaultWeasyPrintPath = isDocker ? "/opt/venv/bin/weasyprint" : "weasyprint";
-        String defaultUnoConvertPath = isDocker ? "/opt/venv/bin/unoconvert" : "unoconvert";
+        String defaultUnoConvertPath = isDocker ? "/usr/local/bin/unoconvert" : "unoconvert";
         String defaultCalibrePath = isDocker ? "/opt/calibre/ebook-convert" : "ebook-convert";
-        String defaultOcrMyPdfPath = isDocker ? "/usr/bin/ocrmypdf" : "ocrmypdf";
+        String defaultOcrMyPdfPath = isDocker ? "/opt/venv/bin/ocrmypdf" : "ocrmypdf";
         String defaultSOfficePath = isDocker ? "/usr/bin/soffice" : "soffice";
 
         Operations operations = customPaths.getOperations();

app/common/src/main/java/stirling/software/common/configuration/SchedulingConfig.java

@@ -0,0 +1,23 @@
+package stirling.software.common.configuration;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.scheduling.TaskScheduler;
+import org.springframework.scheduling.concurrent.SimpleAsyncTaskScheduler;
+
+/**
+ * Configures the scheduler used by all {@code @Scheduled} methods. Uses virtual threads so that
+ * long-running scheduled tasks (e.g. cleanup, license checks, file monitoring) never block each
+ * other — each runs on its own lightweight virtual thread.
+ */
+@Configuration
+public class SchedulingConfig {
+
+    @Bean
+    public TaskScheduler taskScheduler() {
+        SimpleAsyncTaskScheduler scheduler = new SimpleAsyncTaskScheduler();
+        scheduler.setVirtualThreads(true);
+        scheduler.setThreadNamePrefix("scheduled-vt-");
+        return scheduler;
+    }
+}

app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java

@@ -365,11 +365,11 @@ public class ApplicationProperties {
             }
 
             public boolean isSettingsValid() {
-                return !ValidationUtils.isStringEmpty(this.getIssuer())
-                        && !ValidationUtils.isStringEmpty(this.getClientId())
-                        && !ValidationUtils.isStringEmpty(this.getClientSecret())
-                        && !ValidationUtils.isCollectionEmpty(this.getScopes())
-                        && !ValidationUtils.isStringEmpty(this.getUseAsUsername());
+                return !ValidationUtils.isStringEmpty(this.issuer)
+                        && !ValidationUtils.isStringEmpty(this.clientId)
+                        && !ValidationUtils.isStringEmpty(this.clientSecret)
+                        && !ValidationUtils.isCollectionEmpty(this.scopes)
+                        && !ValidationUtils.isStringEmpty(this.useAsUsername);
             }
 
             @Data
@@ -575,19 +575,17 @@ public class ApplicationProperties {
         }
 
         public boolean isAnalyticsEnabled() {
-            return this.getEnableAnalytics() != null && this.getEnableAnalytics();
+            return this.enableAnalytics != null && this.enableAnalytics;
         }
 
         public boolean isPosthogEnabled() {
             // Treat null as enabled when analytics is enabled
-            return this.isAnalyticsEnabled()
-                    && (this.getEnablePosthog() == null || this.getEnablePosthog());
+            return this.isAnalyticsEnabled() && (this.enablePosthog == null || this.enablePosthog);
         }
 
         public boolean isScarfEnabled() {
             // Treat null as enabled when analytics is enabled
-            return this.isAnalyticsEnabled()
-                    && (this.getEnableScarf() == null || this.getEnableScarf());
+            return this.isAnalyticsEnabled() && (this.enableScarf == null || this.enableScarf);
         }
     }
 
@@ -698,7 +696,8 @@ public class ApplicationProperties {
 
         @Override
         public String toString() {
-            return """
+            return
+                    """
             Driver {
               driverName='%s'
             }
@@ -714,6 +713,7 @@ public class ApplicationProperties {
         private String logoStyle = "classic"; // Options: "classic" (default) or "modern"
         private boolean defaultHideUnavailableTools = false;
         private boolean defaultHideUnavailableConversions = false;
+        private HideDisabledTools hideDisabledTools = new HideDisabledTools();
 
         public String getAppNameNavbar() {
             return appNameNavbar != null && !appNameNavbar.trim().isEmpty() ? appNameNavbar : null;
@@ -726,6 +726,12 @@ public class ApplicationProperties {
             }
             return "classic"; // default
         }
+
+        @Data
+        public static class HideDisabledTools {
+            private boolean googleDrive = false;
+            private boolean mobileQRScanner = false;
+        }
     }
 
     @Data
@@ -913,6 +919,15 @@ public class ApplicationProperties {
             private boolean ssoAutoLogin;
             private boolean database;
             private CustomMetadata customMetadata = new CustomMetadata();
+            private GoogleDrive googleDrive = new GoogleDrive();
+
+            @Data
+            public static class GoogleDrive {
+                private boolean enabled = false;
+                private String clientId = "";
+                private String apiKey = "";
+                private String appId = "";
+            }
 
             @Data
             public static class CustomMetadata {
@@ -962,6 +977,12 @@ public class ApplicationProperties {
                 private boolean enabled = true;
                 private int level = 2; // 0=OFF, 1=BASIC, 2=STANDARD, 3=VERBOSE
                 private int retentionDays = 90;
+                private boolean captureFileHash =
+                        false; // Capture SHA-256 hash of files (increases processing time)
+                private boolean capturePdfAuthor =
+                        false; // Capture PDF author metadata (increases processing time)
+                private boolean captureOperationResults =
+                        false; // Capture operation return values (not recommended, high volume)
             }
 
             @Data

app/common/src/main/java/stirling/software/common/model/enumeration/Role.java

@@ -42,7 +42,7 @@ public enum Role {
         // Using the fromString method to get the Role enum based on the roleId
         Role role = fromString(roleId);
         // Return the roleName of the found Role enum
-        return role.getRoleName();
+        return role.roleName;
     }
 
     // Method to retrieve all role IDs and role names
@@ -50,14 +50,14 @@ public enum Role {
         // Using LinkedHashMap to preserve order
         Map<String, String> roleDetails = new LinkedHashMap<>();
         for (Role role : Role.values()) {
-            roleDetails.put(role.getRoleId(), role.getRoleName());
+            roleDetails.put(role.roleId, role.roleName);
         }
         return roleDetails;
     }
 
     public static Role fromString(String roleId) {
         for (Role role : Role.values()) {
-            if (role.getRoleId().equalsIgnoreCase(roleId)) {
+            if (role.roleId.equalsIgnoreCase(roleId)) {
                 return role;
             }
         }

app/common/src/main/java/stirling/software/common/model/oauth2/Provider.java

@@ -117,13 +117,13 @@ public class Provider {
                 + ", clientName="
                 + getClientName()
                 + ", clientId="
-                + getClientId()
+                + clientId
                 + ", clientSecret="
-                + (getClientSecret() != null && !getClientSecret().isEmpty() ? "*****" : "NULL")
+                + (clientSecret != null && !clientSecret.isEmpty() ? "*****" : "NULL")
                 + ", scopes="
                 + getScopes()
                 + ", useAsUsername="
-                + getUseAsUsername()
+                + useAsUsername
                 + "]";
     }
 }

app/common/src/main/java/stirling/software/common/plugins/PluginDescriptor.java

@@ -1,34 +0,0 @@
-package stirling.software.common.plugins;
-
-import java.util.Collections;
-import java.util.List;
-import java.util.Map;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-
-import lombok.Builder;
-import lombok.Value;
-
-/** Immutable descriptor that represents a loaded plugin. */
-@Value
-@Builder
-@JsonInclude(JsonInclude.Include.NON_EMPTY)
-public class PluginDescriptor {
-
-    String id;
-    String icon;
-    String name;
-    String description;
-    String version;
-    String author;
-    String frontendLabel;
-    String frontendPath;
-    String iconPath;
-    String minHostVersion;
-    String jarCreatedAt;
-
-    @Builder.Default boolean hasFrontend = false;
-
-    @Builder.Default List<String> backendEndpoints = Collections.emptyList();
-    @Builder.Default Map<String, String> metadata = Collections.emptyMap();
-}

app/common/src/main/java/stirling/software/common/plugins/PluginDescriptorResponse.java

@@ -1,65 +0,0 @@
-package stirling.software.common.plugins;
-
-import java.util.List;
-import java.util.Map;
-
-import lombok.Builder;
-import lombok.Value;
-
-@Value
-@Builder
-/**
- * API-facing representation of a plugin descriptor with a fully resolved frontend URL.
- *
- * <p>This DTO is returned to clients so they can render plugin metadata and open plugin UIs.
- */
-public class PluginDescriptorResponse {
-    String id;
-    String icon;
-    String name;
-    String description;
-    String version;
-    String author;
-    String frontendUrl;
-    String frontendLabel;
-    String iconPath;
-    String minHostVersion;
-    String jarCreatedAt;
-    boolean hasFrontend;
-    List<String> backendEndpoints;
-    Map<String, String> metadata;
-
-    /**
-     * Creates a response object from an internal {@link PluginDescriptor}.
-     *
-     * @param descriptor loaded plugin descriptor
-     * @param baseUrl optional API base URL used to build an absolute frontend URL
-     * @return normalized response payload for API clients
-     */
-    public static PluginDescriptorResponse from(PluginDescriptor descriptor, String baseUrl) {
-        String frontendPath = descriptor.getFrontendPath();
-        String normalizedBase = baseUrl != null ? baseUrl.replaceAll("/+$", "") : "";
-        String normalizedPath = frontendPath != null ? frontendPath.replaceAll("^/+", "/") : "";
-        String frontendUrl =
-                (normalizedBase.isEmpty() || normalizedPath.isEmpty())
-                        ? (normalizedPath.isEmpty() ? null : normalizedPath)
-                        : normalizedBase + normalizedPath;
-
-        return PluginDescriptorResponse.builder()
-                .id(descriptor.getId())
-                .icon(descriptor.getIcon())
-                .name(descriptor.getName())
-                .description(descriptor.getDescription())
-                .version(descriptor.getVersion())
-                .author(descriptor.getAuthor())
-                .frontendUrl(frontendUrl)
-                .frontendLabel(descriptor.getFrontendLabel())
-                .iconPath(descriptor.getIconPath())
-                .hasFrontend(descriptor.isHasFrontend())
-                .backendEndpoints(descriptor.getBackendEndpoints())
-                .metadata(descriptor.getMetadata())
-                .minHostVersion(descriptor.getMinHostVersion())
-                .jarCreatedAt(descriptor.getJarCreatedAt())
-                .build();
-    }
-}

app/common/src/main/java/stirling/software/common/plugins/PluginLoader.java

@@ -1,261 +0,0 @@
-package stirling.software.common.plugins;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.net.MalformedURLException;
-import java.net.URL;
-import java.net.URLClassLoader;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.attribute.BasicFileAttributes;
-import java.nio.file.attribute.FileTime;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.Comparator;
-import java.util.List;
-import java.util.jar.JarEntry;
-import java.util.jar.JarFile;
-import java.util.stream.Collectors;
-import java.util.stream.Stream;
-
-import com.fasterxml.jackson.databind.ObjectMapper;
-
-import lombok.AccessLevel;
-import lombok.NoArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.common.configuration.InstallationPathConfig;
-
-/**
- * Utility responsible for discovering plugin jars, parsing their metadata, and integrating them
- * into the Stirling-PDF runtime.
- */
-@Slf4j
-@NoArgsConstructor(access = AccessLevel.PRIVATE)
-public final class PluginLoader {
-    private static final String JAR_EXTENSION = ".jar";
-    private static final String JAR_MIME_TYPE = "application/java-archive";
-    private static final String METADATA_RESOURCE = "META-INF/stirling-plugin.json";
-    private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
-
-    /**
-     * Discovers plugin jar files in the configured plugins directory.
-     *
-     * @return sorted list of valid plugin jar paths
-     */
-    public static List<Path> listPluginJars() {
-        Path pluginDir = ensurePluginDirectory();
-        if (!Files.isDirectory(pluginDir)) {
-            return Collections.emptyList();
-        }
-        try (Stream<Path> stream = Files.list(pluginDir)) {
-            return stream.filter(Files::isRegularFile)
-                    .filter(PluginLoader::looksLikeJarFile)
-                    .filter(PluginLoader::isReadableJarArchive)
-                    .sorted(
-                            Comparator.comparing(
-                                    path -> path.getFileName().toString().toLowerCase()))
-                    .collect(Collectors.toList());
-        } catch (IOException e) {
-            log.warn("Failed to list plugin directory {}: {}", pluginDir, e.getMessage());
-            return Collections.emptyList();
-        }
-    }
-
-    /**
-     * Converts discovered plugin jar paths into URL entries suitable for class/resource loading.
-     *
-     * @return immutable-style list of valid jar URLs
-     */
-    public static List<URL> pluginJarUrls() {
-        List<Path> jars = listPluginJars();
-        if (jars.isEmpty()) {
-            return Collections.emptyList();
-        }
-        List<URL> urls = new ArrayList<>(jars.size());
-        for (Path jar : jars) {
-            try {
-                urls.add(jar.toUri().toURL());
-            } catch (MalformedURLException e) {
-                log.warn("Skipping plugin jar with invalid URL {}: {}", jar, e.getMessage());
-            }
-        }
-        return urls;
-    }
-
-    /**
-     * Creates a class loader that can load classes/resources from installed plugins.
-     *
-     * @param parent parent class loader
-     * @return plugin-aware class loader or parent when no plugin jars exist
-     */
-    public static ClassLoader buildPluginClassLoader(ClassLoader parent) {
-        List<URL> urls = pluginJarUrls();
-        if (urls.isEmpty()) {
-            return parent;
-        }
-        log.info(
-                "Scanning {} plugin jars in {}",
-                urls.size(),
-                InstallationPathConfig.getPluginsPath());
-        return new URLClassLoader(urls.toArray(URL[]::new), parent);
-    }
-
-    /**
-     * Loads descriptors for all discovered plugin jars.
-     *
-     * @return immutable list of successfully parsed descriptors
-     */
-    public static List<PluginDescriptor> loadDescriptors() {
-        List<Path> jars = listPluginJars();
-        if (jars.isEmpty()) {
-            return Collections.emptyList();
-        }
-        List<PluginDescriptor> descriptors = new ArrayList<>();
-        for (Path jar : jars) {
-            PluginDescriptor descriptor = readDescriptorFromJar(jar);
-            if (descriptor != null) {
-                descriptors.add(descriptor);
-            }
-        }
-        return Collections.unmodifiableList(descriptors);
-    }
-
-    /**
-     * Loads metadata for one plugin jar and maps it to a descriptor.
-     *
-     * @param jarPath plugin jar path
-     * @return descriptor when valid metadata exists, otherwise {@code null}
-     */
-    public static PluginDescriptor loadDescriptor(Path jarPath) {
-        return readDescriptorFromJar(jarPath);
-    }
-
-    private static Path ensurePluginDirectory() {
-        Path pluginDir = Path.of(InstallationPathConfig.getPluginsPath());
-        try {
-            return Files.createDirectories(pluginDir);
-        } catch (IOException e) {
-            log.error("Unable to create plugin directory {}", pluginDir, e);
-            return pluginDir;
-        }
-    }
-
-    private static PluginDescriptor readDescriptorFromJar(Path jarPath) {
-        if (!Files.isRegularFile(jarPath)) {
-            log.warn("Plugin jar {} is not a regular file, skipping", jarPath);
-            return null;
-        }
-        try (JarFile jarFile = new JarFile(jarPath.toFile())) {
-            JarEntry entry = jarFile.getJarEntry(METADATA_RESOURCE);
-            if (entry == null) {
-                log.info("Plugin jar {} does not include {}, skipping", jarPath, METADATA_RESOURCE);
-                return null;
-            }
-            PluginMetadata metadata;
-            try (InputStream inputStream = jarFile.getInputStream(entry)) {
-                metadata = OBJECT_MAPPER.readValue(inputStream, PluginMetadata.class);
-            }
-
-            String createdAt = resolveJarTimestamp(jarPath);
-
-            if (metadata.getId() == null || metadata.getId().isBlank()) {
-                log.warn("Plugin metadata in {} is missing required id, ignoring", jarPath);
-                return null;
-            }
-
-            String pluginId = metadata.getId();
-            log.info(
-                    "Loaded metadata for plugin '{}': name='{}' version='{}'",
-                    pluginId,
-                    metadata.getName(),
-                    metadata.getVersion());
-
-            return buildDescriptor(metadata, createdAt);
-        } catch (IOException e) {
-            log.warn("Failed to inspect plugin jar {}: {}", jarPath, e.getMessage());
-            return null;
-        }
-    }
-
-    private static PluginDescriptor buildDescriptor(PluginMetadata metadata, String jarCreatedAt) {
-        PluginMetadata.PluginFrontend frontend = metadata.getFrontend();
-        String id = metadata.getId();
-        String icon = metadata.getIcon();
-
-        String frontendPath =
-                (frontend != null
-                                && frontend.getEntrypoint() != null
-                                && !frontend.getEntrypoint().isBlank())
-                        ? ensureLeadingSlash(frontend.getEntrypoint())
-                        : "/plugins/" + id + "/index.html";
-
-        return PluginDescriptor.builder()
-                .id(id)
-                .icon(defaultIfEmpty(icon, null))
-                .name(defaultIfEmpty(metadata.getName(), id))
-                .description(defaultIfEmpty(metadata.getDescription(), ""))
-                .version(defaultIfEmpty(metadata.getVersion(), "0.0.0"))
-                .author(metadata.getAuthor())
-                .frontendLabel(frontend != null ? frontend.getLabel() : null)
-                .frontendPath(frontendPath)
-                .iconPath(frontend != null ? frontend.getIconPath() : null)
-                .hasFrontend(frontend != null)
-                .backendEndpoints(
-                        metadata.getBackendEndpoints() == null
-                                ? Collections.emptyList()
-                                : metadata.getBackendEndpoints())
-                .metadata(
-                        metadata.getMetadata() == null
-                                ? Collections.emptyMap()
-                                : metadata.getMetadata())
-                .minHostVersion(defaultIfEmpty(metadata.getMinHostVersion(), null))
-                .jarCreatedAt(jarCreatedAt)
-                .build();
-    }
-
-    private static String defaultIfEmpty(String value, String fallback) {
-        return (value == null || value.isBlank()) ? fallback : value;
-    }
-
-    private static String ensureLeadingSlash(String path) {
-        if (path == null || path.isBlank()) {
-            return "/";
-        }
-        return path.startsWith("/") ? path : "/" + path;
-    }
-
-    private static boolean looksLikeJarFile(Path path) {
-        return path.getFileName().toString().toLowerCase().endsWith(JAR_EXTENSION);
-    }
-
-    private static boolean isReadableJarArchive(Path path) {
-        try {
-            String mimeType = Files.probeContentType(path);
-            if (mimeType != null && !JAR_MIME_TYPE.equals(mimeType)) {
-                log.debug("Ignoring non-jar mime type {} for {}", mimeType, path);
-                return false;
-            }
-        } catch (IOException e) {
-            log.debug("Unable to probe mime type for {}: {}", path, e.getMessage());
-        }
-
-        try (JarFile ignored = new JarFile(path.toFile())) {
-            return true;
-        } catch (IOException e) {
-            log.warn("Skipping invalid jar archive {}: {}", path, e.getMessage());
-            return false;
-        }
-    }
-
-    private static String resolveJarTimestamp(Path jarPath) throws IOException {
-        BasicFileAttributes attrs = Files.readAttributes(jarPath, BasicFileAttributes.class);
-        FileTime creationTime = attrs.creationTime();
-        FileTime lastModifiedTime = attrs.lastModifiedTime();
-        FileTime preferredTime =
-                creationTime == null || creationTime.toMillis() <= 0
-                        ? lastModifiedTime
-                        : creationTime;
-        return preferredTime.toInstant().toString();
-    }
-}

app/common/src/main/java/stirling/software/common/plugins/PluginMetadata.java

@@ -1,36 +0,0 @@
-package stirling.software.common.plugins;
-
-import java.util.List;
-import java.util.Map;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-
-import lombok.Getter;
-import lombok.Setter;
-
-@Getter
-@Setter
-@JsonIgnoreProperties(ignoreUnknown = true)
-/** Model for deserializing {@code META-INF/stirling-plugin.json} from a plugin jar. */
-public class PluginMetadata {
-    private String id;
-    private String icon;
-    private String name;
-    private String description;
-    private String version;
-    private String author;
-    private String minHostVersion;
-    private PluginFrontend frontend;
-    private List<String> backendEndpoints;
-    private Map<String, String> metadata;
-
-    /** Frontend-specific metadata block declared inside plugin metadata JSON. */
-    @Getter
-    @Setter
-    @JsonIgnoreProperties(ignoreUnknown = true)
-    public static class PluginFrontend {
-        private String entrypoint;
-        private String label;
-        private String iconPath;
-    }
-}

app/common/src/main/java/stirling/software/common/plugins/PluginResourceConfig.java

@@ -1,28 +0,0 @@
-package stirling.software.common.plugins;
-
-import java.util.List;
-import java.util.stream.Collectors;
-
-import org.springframework.context.annotation.Configuration;
-import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
-import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
-
-@Configuration
-/** Registers MVC resource handlers that expose static assets from plugin jars. */
-public class PluginResourceConfig implements WebMvcConfigurer {
-
-    /** Adds {@code /plugins/**} static resource mappings for every discovered plugin jar. */
-    @Override
-    public void addResourceHandlers(ResourceHandlerRegistry registry) {
-        List<String> locations =
-                PluginLoader.pluginJarUrls().stream()
-                        .map(url -> "jar:" + url + "!/META-INF/resources/plugins/")
-                        .collect(Collectors.toList());
-
-        if (!locations.isEmpty()) {
-            registry.addResourceHandler("/plugins/**")
-                    .addResourceLocations(locations.toArray(String[]::new))
-                    .setCachePeriod(0);
-        }
-    }
-}

app/common/src/main/java/stirling/software/common/service/FileStorage.java

@@ -1,6 +1,8 @@
 package stirling.software.common.service;
 
+import java.io.BufferedInputStream;
 import java.io.IOException;
+import java.io.InputStream;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.UUID;
@@ -21,6 +23,9 @@ import lombok.extern.slf4j.Slf4j;
 @Slf4j
 public class FileStorage {
 
+    /** Holds the result of a stream-to-disk store operation: the file ID and the bytes written. */
+    public record StoredFile(String fileId, long size) {}
+
     @Value("${stirling.tempDir:/tmp/stirling-files}")
     private String tempDirPath;
 
@@ -104,6 +109,40 @@ public class FileStorage {
         return Files.readAllBytes(filePath);
     }
 
+    /**
+     * Retrieve a file by its ID as a streaming InputStream. The caller is responsible for closing
+     * the returned stream.
+     *
+     * @param fileId The ID of the file to retrieve
+     * @return A buffered InputStream for the file
+     * @throws IOException If the file doesn't exist or can't be read
+     */
+    public InputStream retrieveInputStream(String fileId) throws IOException {
+        Path filePath = getFilePath(fileId);
+        // Let Files.newInputStream throw NoSuchFileException naturally — avoids TOCTOU race
+        // between exists-check and open when another thread may delete concurrently.
+        return new BufferedInputStream(Files.newInputStream(filePath));
+    }
+
+    /**
+     * Store data from an InputStream as a file and return its unique ID and byte count. Streams
+     * directly to disk without buffering the entire content in heap.
+     *
+     * @param inputStream The input stream to read from
+     * @param originalName The original name of the file (unused, kept for API symmetry)
+     * @return A {@link StoredFile} containing the file ID and the number of bytes written
+     * @throws IOException If there is an error storing the file
+     */
+    public StoredFile storeInputStream(InputStream inputStream, String originalName)
+            throws IOException {
+        String fileId = generateFileId();
+        Path filePath = getFilePath(fileId);
+        Files.createDirectories(filePath.getParent());
+        long size = Files.copy(inputStream, filePath);
+        log.debug("Stored input stream with ID: {}", fileId);
+        return new StoredFile(fileId, size);
+    }
+
     /**
      * Delete a file by its ID
      *

app/common/src/main/java/stirling/software/common/service/JobExecutorService.java

@@ -35,7 +35,7 @@ public class JobExecutorService {
     private final HttpServletRequest request;
     private final ResourceMonitor resourceMonitor;
     private final JobQueue jobQueue;
-    private final ExecutorService executor = ExecutorFactory.newVirtualOrCachedThreadExecutor();
+    private final ExecutorService executor = ExecutorFactory.newVirtualThreadExecutor();
     private final long effectiveTimeoutMs;
 
     @Autowired(required = false)
@@ -254,10 +254,13 @@ public class JobExecutorService {
                 return ResponseEntity.internalServerError()
                         .body(Map.of("error", "Job timed out after " + timeoutToUse + " ms"));
             } catch (RuntimeException e) {
-                // Check if this is a wrapped typed exception that should be handled by
-                // GlobalExceptionHandler
+                // Check if this is a typed exception that should be handled by
+                // GlobalExceptionHandler (either directly or wrapped)
                 Throwable cause = e.getCause();
-                if (cause instanceof stirling.software.common.util.ExceptionUtils.BaseAppException
+                if (e instanceof IllegalArgumentException
+                        || cause
+                                instanceof
+                                stirling.software.common.util.ExceptionUtils.BaseAppException
                         || cause
                                 instanceof
                                 stirling.software.common.util.ExceptionUtils
@@ -313,7 +316,7 @@ public class JobExecutorService {
                             filename =
                                     disposition.substring(
                                             disposition.indexOf("filename=") + 9,
-                                            disposition.lastIndexOf("\""));
+                                            disposition.lastIndexOf('"'));
                         }
                     }
 

app/common/src/main/java/stirling/software/common/service/JobQueue.java

@@ -44,8 +44,10 @@ public class JobQueue implements SmartLifecycle {
 
     private volatile BlockingQueue<QueuedJob> jobQueue;
     private final Map<String, QueuedJob> jobMap = new ConcurrentHashMap<>();
-    private final ScheduledExecutorService scheduler = Executors.newSingleThreadScheduledExecutor();
-    private final ExecutorService jobExecutor = ExecutorFactory.newVirtualOrCachedThreadExecutor();
+    private final ScheduledExecutorService scheduler =
+            Executors.newSingleThreadScheduledExecutor(
+                    Thread.ofVirtual().name("job-queue-scheduler-", 0).factory());
+    private final ExecutorService jobExecutor = ExecutorFactory.newVirtualThreadExecutor();
     private final Object queueLock = new Object(); // Lock for synchronizing queue operations
 
     private boolean shuttingDown = false;

app/common/src/main/java/stirling/software/common/service/MobileScannerService.java

@@ -129,7 +129,7 @@ public class MobileScannerService {
                         FILE_EXTENSION_PATTERN.matcher(safeFilename).replaceFirst("");
                 String ext =
                         safeFilename.contains(".")
-                                ? safeFilename.substring(safeFilename.lastIndexOf("."))
+                                ? safeFilename.substring(safeFilename.lastIndexOf('.'))
                                 : "";
                 safeFilename = nameWithoutExt + "-" + counter + ext;
                 filePath = sessionDir.resolve(safeFilename).normalize().toAbsolutePath();

app/common/src/main/java/stirling/software/common/service/PdfMetadataService.java

@@ -169,7 +169,10 @@ public class PdfMetadataService {
                             .getAuthor();
 
             if (userService != null) {
-                author = author.replace("username", userService.getCurrentUsername());
+                String username = userService.getCurrentUsername();
+                if (username != null) {
+                    author = author.replace("username", username);
+                }
             }
         }
         pdf.getDocumentInformation().setAuthor(author);

app/common/src/main/java/stirling/software/common/service/ResourceMonitor.java

@@ -43,7 +43,9 @@ public class ResourceMonitor {
     @Value("${stirling.resource.monitor.interval-ms:60000}")
     private long monitorIntervalMs = 60000; // 60 seconds
 
-    private final ScheduledExecutorService scheduler = Executors.newSingleThreadScheduledExecutor();
+    private final ScheduledExecutorService scheduler =
+            Executors.newSingleThreadScheduledExecutor(
+                    Thread.ofVirtual().name("resource-monitor-", 0).factory());
     private final MemoryMXBean memoryMXBean = ManagementFactory.getMemoryMXBean();
     private final OperatingSystemMXBean osMXBean = ManagementFactory.getOperatingSystemMXBean();
 

app/common/src/main/java/stirling/software/common/service/TaskManager.java

@@ -1,8 +1,8 @@
 package stirling.software.common.service;
 
-import java.io.ByteArrayInputStream;
-import java.io.ByteArrayOutputStream;
+import java.io.BufferedInputStream;
 import java.io.IOException;
+import java.io.InputStream;
 import java.time.LocalDateTime;
 import java.time.temporal.ChronoUnit;
 import java.util.ArrayList;
@@ -19,7 +19,6 @@ import java.util.zip.ZipInputStream;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.MediaType;
 import org.springframework.stereotype.Service;
-import org.springframework.web.multipart.MultipartFile;
 
 import io.github.pixee.security.ZipSecurity;
 
@@ -42,7 +41,8 @@ public class TaskManager {
 
     private final FileStorage fileStorage;
     private final ScheduledExecutorService cleanupExecutor =
-            Executors.newSingleThreadScheduledExecutor();
+            Executors.newSingleThreadScheduledExecutor(
+                    Thread.ofVirtual().name("task-cleanup-", 0).factory());
 
     /** Initialize the task manager and start the cleanup scheduler */
     public TaskManager(FileStorage fileStorage) {
@@ -362,39 +362,29 @@ public class TaskManager {
             String zipFileId, String originalZipFileName) throws IOException {
         List<ResultFile> extractedFiles = new ArrayList<>();
 
-        MultipartFile zipFile = fileStorage.retrieveFile(zipFileId);
-
-        try (ZipInputStream zipIn =
-                ZipSecurity.createHardenedInputStream(
-                        new ByteArrayInputStream(zipFile.getBytes()))) {
+        try (InputStream fileStream = fileStorage.retrieveInputStream(zipFileId);
+                ZipInputStream zipIn =
+                        ZipSecurity.createHardenedInputStream(
+                                new BufferedInputStream(fileStream))) {
             ZipEntry entry;
             while ((entry = zipIn.getNextEntry()) != null) {
                 if (!entry.isDirectory()) {
-                    // Use buffered reading for memory safety
-                    ByteArrayOutputStream out = new ByteArrayOutputStream();
-                    byte[] buffer = new byte[4096];
-                    int bytesRead;
-                    while ((bytesRead = zipIn.read(buffer)) != -1) {
-                        out.write(buffer, 0, bytesRead);
-                    }
-                    byte[] fileContent = out.toByteArray();
-
                     String contentType = determineContentType(entry.getName());
-                    String individualFileId = fileStorage.storeBytes(fileContent, entry.getName());
+                    // storeInputStream returns the fileId and byte count — no extra stat needed
+                    FileStorage.StoredFile stored =
+                            fileStorage.storeInputStream(zipIn, entry.getName());
 
                     ResultFile resultFile =
                             ResultFile.builder()
-                                    .fileId(individualFileId)
+                                    .fileId(stored.fileId())
                                     .fileName(entry.getName())
                                     .contentType(contentType)
-                                    .fileSize(fileContent.length)
+                                    .fileSize(stored.size())
                                     .build();
 
                     extractedFiles.add(resultFile);
                     log.debug(
-                            "Extracted file: {} (size: {} bytes)",
-                            entry.getName(),
-                            fileContent.length);
+                            "Extracted file: {} (size: {} bytes)", entry.getName(), stored.size());
                 }
                 zipIn.closeEntry();
             }
@@ -466,4 +456,24 @@ public class TaskManager {
         }
         return null;
     }
+
+    /**
+     * Find the job key that owns a given file ID.
+     *
+     * @param fileId file identifier to look up
+     * @return scoped job key if found, otherwise null
+     */
+    public String findJobKeyByFileId(String fileId) {
+        for (Map.Entry<String, JobResult> entry : jobResults.entrySet()) {
+            JobResult jobResult = entry.getValue();
+            if (jobResult.hasFiles()) {
+                for (ResultFile resultFile : jobResult.getAllResultFiles()) {
+                    if (fileId.equals(resultFile.getFileId())) {
+                        return entry.getKey();
+                    }
+                }
+            }
+        }
+        return null;
+    }
 }

app/common/src/main/java/stirling/software/common/util/CbzUtils.java

@@ -4,6 +4,7 @@ import java.io.BufferedInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Comparator;
 import java.util.Enumeration;
@@ -30,15 +31,7 @@ import stirling.software.common.service.CustomPDFDocumentFactory;
 @UtilityClass
 public class CbzUtils {
 
-    public byte[] convertCbzToPdf(
-            MultipartFile cbzFile,
-            CustomPDFDocumentFactory pdfDocumentFactory,
-            TempFileManager tempFileManager)
-            throws IOException {
-        return convertCbzToPdf(cbzFile, pdfDocumentFactory, tempFileManager, false);
-    }
-
-    public byte[] convertCbzToPdf(
+    public TempFile convertCbzToPdf(
             MultipartFile cbzFile,
             CustomPDFDocumentFactory pdfDocumentFactory,
             TempFileManager tempFileManager,
@@ -64,70 +57,90 @@ public class CbzUtils {
 
             try (PDDocument document = pdfDocumentFactory.createNewDocument();
                     ZipFile zipFile = new ZipFile(tempFile.getFile())) {
+
+                // Pass 1: collect sorted image names (cheap just strings, no image data)
+                List<String> sortedImageNames = new ArrayList<>();
                 Enumeration<? extends ZipEntry> entries = zipFile.entries();
-                List<ImageEntryData> imageEntries = new ArrayList<>();
                 while (entries.hasMoreElements()) {
                     ZipEntry entry = entries.nextElement();
                     if (!entry.isDirectory() && isImageFile(entry.getName())) {
-                        try (InputStream is = zipFile.getInputStream(entry)) {
-                            ByteArrayOutputStream baos = new ByteArrayOutputStream();
-                            is.transferTo(baos);
-                            imageEntries.add(
-                                    new ImageEntryData(entry.getName(), baos.toByteArray()));
-                        } catch (IOException e) {
-                            log.warn("Error reading image {}: {}", entry.getName(), e.getMessage());
-                        }
+                        sortedImageNames.add(entry.getName());
                     }
                 }
+                sortedImageNames.sort(new NaturalOrderComparator());
 
-                imageEntries.sort(
-                        Comparator.comparing(ImageEntryData::name, new NaturalOrderComparator()));
-
-                if (imageEntries.isEmpty()) {
+                if (sortedImageNames.isEmpty()) {
                     throw ExceptionUtils.createCbzNoImagesException();
                 }
 
-                for (ImageEntryData imageEntry : imageEntries) {
-                    try {
-                        PDImageXObject pdImage =
-                                PDImageXObject.createFromByteArray(
-                                        document, imageEntry.data(), imageEntry.name());
-                        PDPage page =
-                                new PDPage(
-                                        new PDRectangle(pdImage.getWidth(), pdImage.getHeight()));
-                        document.addPage(page);
-                        try (PDPageContentStream contentStream =
-                                new PDPageContentStream(
-                                        document,
-                                        page,
-                                        PDPageContentStream.AppendMode.OVERWRITE,
-                                        true,
-                                        true)) {
-                            contentStream.drawImage(pdImage, 0, 0);
+                // Pass 2: load ONE image at a time peak memory = max(single image)
+                for (String imageName : sortedImageNames) {
+                    ZipEntry entry = zipFile.getEntry(imageName);
+                    try (InputStream is = zipFile.getInputStream(entry)) {
+                        ByteArrayOutputStream imgBaos = new ByteArrayOutputStream();
+                        is.transferTo(imgBaos);
+                        byte[] imageBytes = imgBaos.toByteArray();
+                        try {
+                            PDImageXObject pdImage =
+                                    PDImageXObject.createFromByteArray(
+                                            document, imageBytes, imageName);
+                            PDPage page =
+                                    new PDPage(
+                                            new PDRectangle(
+                                                    pdImage.getWidth(), pdImage.getHeight()));
+                            document.addPage(page);
+                            try (PDPageContentStream contentStream =
+                                    new PDPageContentStream(
+                                            document,
+                                            page,
+                                            PDPageContentStream.AppendMode.OVERWRITE,
+                                            true,
+                                            true)) {
+                                contentStream.drawImage(pdImage, 0, 0);
+                            }
+                        } catch (IOException e) {
+                            log.warn("Error processing image {}: {}", imageName, e.getMessage());
                         }
+                        // imageBytes eligible for GC after each iteration
                     } catch (IOException e) {
-                        log.warn(
-                                "Error processing image {}: {}", imageEntry.name(), e.getMessage());
+                        log.warn("Error reading image {}: {}", imageName, e.getMessage());
                     }
                 }
 
                 if (document.getNumberOfPages() == 0) {
                     throw ExceptionUtils.createCbzCorruptedImagesException();
                 }
-                ByteArrayOutputStream baos = new ByteArrayOutputStream();
-                document.save(baos);
-                byte[] pdfBytes = baos.toByteArray();
 
-                // Apply Ghostscript optimization if requested
-                if (optimizeForEbook) {
-                    try {
-                        return GeneralUtils.optimizePdfWithGhostscript(pdfBytes);
-                    } catch (IOException e) {
-                        log.warn("Ghostscript optimization failed, returning unoptimized PDF", e);
+                // Write to TempFile (not BAOS)
+                TempFile pdfTempFile = new TempFile(tempFileManager, ".pdf");
+                try {
+                    document.save(pdfTempFile.getFile());
+
+                    if (optimizeForEbook) {
+                        try {
+                            byte[] pdfBytes = Files.readAllBytes(pdfTempFile.getPath());
+                            byte[] optimized = GeneralUtils.optimizePdfWithGhostscript(pdfBytes);
+                            pdfTempFile.close();
+                            TempFile optimizedFile = new TempFile(tempFileManager, ".pdf");
+                            try {
+                                Files.write(optimizedFile.getPath(), optimized);
+                                return optimizedFile;
+                            } catch (Exception e) {
+                                optimizedFile.close();
+                                throw e;
+                            }
+                        } catch (IOException e) {
+                            log.warn(
+                                    "Ghostscript optimization failed, returning unoptimized PDF",
+                                    e);
+                        }
                     }
-                }
 
-                return pdfBytes;
+                    return pdfTempFile;
+                } catch (Exception e) {
+                    pdfTempFile.close();
+                    throw e;
+                }
             }
         }
     }
@@ -175,8 +188,6 @@ public class CbzUtils {
         return RegexPatternUtils.getInstance().getImageFilePattern().matcher(filename).matches();
     }
 
-    private record ImageEntryData(String name, byte[] data) {}
-
     private class NaturalOrderComparator implements Comparator<String> {
         @Override
         public int compare(String s1, String s2) {

app/common/src/main/java/stirling/software/common/util/EmlProcessingUtils.java

@@ -341,7 +341,8 @@ public class EmlProcessingUtils {
     }
 
     private String getFallbackStyles() {
-        return """
+        return
+        """
             /* Minimal fallback - main CSS resource failed to load */
             body {
                 font-family: var(--font-family, Helvetica, sans-serif);

app/common/src/main/java/stirling/software/common/util/ExecutorFactory.java

@@ -2,30 +2,28 @@ package stirling.software.common.util;
 
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
 
-import lombok.extern.slf4j.Slf4j;
+/**
+ * Factory for creating executors backed by virtual threads (Java 21+). Virtual threads are
+ * lightweight, managed by the JVM, and ideal for I/O-bound tasks. They eliminate the need for
+ * thread pool sizing since thousands can run concurrently with minimal overhead.
+ */
+public final class ExecutorFactory {
 
-@Slf4j
-public class ExecutorFactory {
+    private ExecutorFactory() {}
+
+    /** Creates an {@link ExecutorService} that starts a new virtual thread for each task. */
+    public static ExecutorService newVirtualThreadExecutor() {
+        return Executors.newVirtualThreadPerTaskExecutor();
+    }
 
     /**
-     * Creates an ExecutorService using virtual threads if available (Java 21+), or falls back to a
-     * cached thread pool on older Java versions.
+     * Creates a {@link ScheduledExecutorService} backed by a single virtual thread. Useful for
+     * periodic/delayed tasks that should not pin a platform thread.
      */
-    public static ExecutorService newVirtualOrCachedThreadExecutor() {
-        try {
-            ExecutorService executor =
-                    (ExecutorService)
-                            Executors.class
-                                    .getMethod("newVirtualThreadPerTaskExecutor")
-                                    .invoke(null);
-            return executor;
-        } catch (NoSuchMethodException e) {
-            log.debug("Virtual threads not available; falling back to cached thread pool.");
-        } catch (Exception e) {
-            log.debug("Error initializing virtual thread executor: {}", e.getMessage(), e);
-        }
-
-        return Executors.newCachedThreadPool();
+    public static ScheduledExecutorService newSingleVirtualThreadScheduledExecutor() {
+        return Executors.newSingleThreadScheduledExecutor(
+                Thread.ofVirtual().name("scheduled-vt-", 0).factory());
     }
 }

app/common/src/main/java/stirling/software/common/util/FileMonitor.java

@@ -68,6 +68,17 @@ public class FileMonitor {
 
         if (this.rootDirs.isEmpty()) {
             log.error("No valid directories to monitor - FileMonitor will not function");
+        } else {
+            // Register directories eagerly so the first @Scheduled tick does not warn.
+            for (Path rootDir : this.rootDirs) {
+                if (Files.exists(rootDir)) {
+                    try {
+                        recursivelyRegisterEntry(rootDir);
+                    } catch (IOException e) {
+                        log.error("Failed to register monitoring for {}", rootDir, e);
+                    }
+                }
+            }
         }
     }
 

app/common/src/main/java/stirling/software/common/util/FileToPdf.java

@@ -44,9 +44,7 @@ public class FileToPdf {
                             sanitizeHtmlContent(
                                     new String(fileBytes, StandardCharsets.UTF_8),
                                     customHtmlSanitizer);
-                    Files.write(
-                            tempInputFile.getPath(),
-                            sanitizedHtml.getBytes(StandardCharsets.UTF_8));
+                    Files.writeString(tempInputFile.getPath(), sanitizedHtml);
                 } else if (fileName.toLowerCase(Locale.ROOT).endsWith(".zip")) {
                     Files.write(tempInputFile.getPath(), fileBytes);
                     sanitizeHtmlFilesInZip(
@@ -100,6 +98,13 @@ public class FileToPdf {
                 while (entry != null) {
                     Path filePath =
                             tempUnzippedDir.getPath().resolve(sanitizeZipFilename(entry.getName()));
+                    Path normalizedTargetDir =
+                            tempUnzippedDir.getPath().toAbsolutePath().normalize();
+                    Path normalizedFilePath = filePath.toAbsolutePath().normalize();
+                    if (!normalizedFilePath.startsWith(normalizedTargetDir)) {
+                        throw new IOException(
+                                "Zip entry path escapes target directory: " + entry.getName());
+                    }
                     if (!entry.isDirectory()) {
                         Files.createDirectories(filePath.getParent());
                         if (entry.getName().toLowerCase(Locale.ROOT).endsWith(".html")
@@ -108,8 +113,7 @@ public class FileToPdf {
                                     new String(zipIn.readAllBytes(), StandardCharsets.UTF_8);
                             String sanitizedContent =
                                     sanitizeHtmlContent(content, customHtmlSanitizer);
-                            Files.write(
-                                    filePath, sanitizedContent.getBytes(StandardCharsets.UTF_8));
+                            Files.writeString(filePath, sanitizedContent);
                         } else {
                             Files.copy(zipIn, filePath);
                         }

app/common/src/main/java/stirling/software/common/util/FormFieldTypeSupport.java

@@ -1,4 +1,4 @@
-package stirling.software.proprietary.util;
+package stirling.software.common.util;
 
 import java.io.IOException;
 import java.util.Arrays;

app/common/src/main/java/stirling/software/common/util/FormUtils.java

@@ -1,4 +1,4 @@
-package stirling.software.proprietary.util;
+package stirling.software.common.util;
 
 import java.awt.image.BufferedImage;
 import java.io.IOException;
@@ -17,6 +17,7 @@ import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
+import java.util.regex.Pattern;
 
 import org.apache.pdfbox.cos.COSArray;
 import org.apache.pdfbox.cos.COSBase;
@@ -49,9 +50,6 @@ import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.FormFieldWithCoordinates;
-import stirling.software.common.util.ApplicationContextProvider;
-import stirling.software.common.util.ExceptionUtils;
-import stirling.software.common.util.RegexPatternUtils;
 
 @Slf4j
 @UtilityClass
@@ -77,6 +75,10 @@ public class FormUtils {
      */
     private static final float SAME_LINE_THRESHOLD_PT = 10.0f;
 
+    private static final Pattern HEX_UUID_PATTERN =
+            Pattern.compile("^[0-9a-fA-F]{8}[0-9a-fA-F]{24,}$");
+    private static final Pattern WHITESPACE_PATTERN = Pattern.compile("\\s+");
+
     /**
      * Returns a normalized logical type string for the supplied PDFBox field instance. Centralized
      * so all callers share identical mapping logic.
@@ -135,7 +137,7 @@ public class FormUtils {
                 continue;
             }
 
-            String currentValue = safeValue(terminalField);
+            String currentValue = safeFieldValue(terminalField);
             boolean required = field.isRequired();
             int pageIndex = resolveFirstWidgetPageIndex(document, terminalField, annotationPageMap);
             List<String> options = resolveOptions(terminalField);
@@ -206,7 +208,7 @@ public class FormUtils {
                 continue;
             }
 
-            String currentValue = safeValue(terminalField);
+            String currentValue = safeFieldValue(terminalField);
             boolean required = field.isRequired();
             boolean readOnly = field.isReadOnly();
             List<String> options = resolveOptions(terminalField);
@@ -1237,7 +1239,11 @@ public class FormUtils {
         return states;
     }
 
-    private String safeValue(PDTerminalField field) {
+    public String safeValue(String value) {
+        return value != null ? value : "";
+    }
+
+    private String safeFieldValue(PDTerminalField field) {
         try {
             // PDChoice.getValueAsString() returns a raw COS string representation
             // that doesn't reliably reflect the selected value. Use getValue()
@@ -1356,7 +1362,7 @@ public class FormUtils {
             if (da != null && !da.isBlank()) {
                 // Standard DA looks like: /Helv 12 Tf 0 g
                 // We want the number before 'Tf'
-                String[] tokens = da.split("\\s+");
+                String[] tokens = WHITESPACE_PATTERN.split(da);
                 for (int i = 0; i < tokens.length; i++) {
                     if ("Tf".equals(tokens[i]) && i > 0) {
                         try {
@@ -1456,9 +1462,8 @@ public class FormUtils {
         // Detect UUID-like hex strings (e.g. "cdc47b7041524571 7b2d93017fe77bf7")
         // Standard UUIDs are 32 hex characters; require at least that to avoid
         // false positives on short hex-like field names.
-        String nospaces = simplified.replaceAll("\\s+", "");
-        if (nospaces.length() >= 32 && nospaces.matches("^[0-9a-fA-F]{8}[0-9a-fA-F]{24,}$"))
-            return true;
+        String nospaces = WHITESPACE_PATTERN.matcher(simplified).replaceAll("");
+        if (nospaces.length() >= 32 && HEX_UUID_PATTERN.matcher(nospaces).matches()) return true;
 
         return patterns.getGenericFieldNamePattern().matcher(simplified).matches()
                 || patterns.getSimpleFormFieldPattern().matcher(simplified).matches()

app/common/src/main/java/stirling/software/common/util/GeneralUtils.java

@@ -649,8 +649,10 @@ public class GeneralUtils {
     }
 
     public List<Integer> parsePageList(String[] pages, int totalPages, boolean oneBased) {
-        List<Integer> result = new ArrayList<>();
+        // Use LinkedHashSet to prevent duplicates from inflating size and triggering maxSize guard
+        Set<Integer> result = new LinkedHashSet<>();
         int offset = oneBased ? 1 : 0;
+        int maxSize = Math.max(1000, totalPages * 3);
         for (String page : pages) {
             if ("all".equalsIgnoreCase(page)) {
 
@@ -666,8 +668,12 @@ public class GeneralUtils {
             } else {
                 result.addAll(handlePart(page, totalPages, offset));
             }
+            if (result.size() > maxSize) {
+                throw new IllegalArgumentException(
+                        "Page list exceeds maximum allowed size of " + maxSize);
+            }
         }
-        return result;
+        return new ArrayList<>(result);
     }
 
     /*
@@ -867,6 +873,36 @@ public class GeneralUtils {
         settingsYaml.saveOverride(settingsPath);
     }
 
+    /**
+     * Updates multiple settings in a single transaction. This ensures that nested settings (e.g.,
+     * oauth2.client.google.*) don't lose sibling values when partial updates are made.
+     *
+     * <p>Instead of multiple read-update-write cycles (which could cause race conditions), this
+     * method loads the YAML once, applies all updates, and saves once.
+     *
+     * @param settingsMap Map of dotted-notation keys to values to update
+     * @throws IOException if file read/write fails
+     */
+    public void updateSettingsTransactional(Map<String, Object> settingsMap) throws IOException {
+        if (settingsMap == null || settingsMap.isEmpty()) {
+            return;
+        }
+
+        Path settingsPath = Paths.get(InstallationPathConfig.getSettingsPath());
+        YamlHelper settingsYaml = new YamlHelper(settingsPath);
+
+        // Apply all updates to the same YamlHelper instance
+        for (Map.Entry<String, Object> entry : settingsMap.entrySet()) {
+            String key = entry.getKey();
+            Object value = entry.getValue();
+            String[] keyArray = key.split("\\.");
+            settingsYaml.updateValue(Arrays.asList(keyArray), value);
+        }
+
+        // Save only once after all updates are applied
+        settingsYaml.saveOverride(settingsPath);
+    }
+
     /*
      * Machine fingerprint generation with better error logging and fallbacks.
      *

app/common/src/main/java/stirling/software/common/util/PDFToFile.java

@@ -10,6 +10,7 @@ import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Objects;
+import java.util.regex.Pattern;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipOutputStream;
 
@@ -33,6 +34,8 @@ import stirling.software.common.util.ProcessExecutor.ProcessExecutorResult;
 @Slf4j
 public class PDFToFile {
 
+    private static final Pattern PATTERN =
+            Pattern.compile("(!\\[.*?\\])\\((?!images/)([^/)][^)]*?)\\)");
     private final TempFileManager tempFileManager;
     private final RuntimePathConfig runtimePathConfig;
 
@@ -163,7 +166,7 @@ public class PDFToFile {
     private String updateImageReferences(String markdown) {
         // Match markdown image syntax: ![alt text](image.png)
         // Only update if the path doesn't already start with images/
-        return markdown.replaceAll("(!\\[.*?\\])\\((?!images/)([^/)][^)]*?)\\)", "$1(images/$2)");
+        return PATTERN.matcher(markdown).replaceAll("$1(images/$2)");
     }
 
     public ResponseEntity<byte[]> processPdfToHtml(MultipartFile inputFile)

app/common/src/main/java/stirling/software/common/util/PdfToCbzUtils.java

@@ -1,8 +1,8 @@
 package stirling.software.common.util;
 
 import java.awt.image.BufferedImage;
-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.Locale;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipOutputStream;
@@ -22,8 +22,11 @@ import stirling.software.common.service.CustomPDFDocumentFactory;
 @Slf4j
 public class PdfToCbzUtils {
 
-    public static byte[] convertPdfToCbz(
-            MultipartFile pdfFile, int dpi, CustomPDFDocumentFactory pdfDocumentFactory)
+    public static TempFile convertPdfToCbz(
+            MultipartFile pdfFile,
+            int dpi,
+            CustomPDFDocumentFactory pdfDocumentFactory,
+            TempFileManager tempFileManager)
             throws IOException {
 
         validatePdfFile(pdfFile);
@@ -33,7 +36,7 @@ public class PdfToCbzUtils {
                 throw ExceptionUtils.createPdfNoPages();
             }
 
-            return createCbzFromPdf(document, dpi);
+            return createCbzFromPdf(document, dpi, tempFileManager);
         }
     }
 
@@ -53,46 +56,49 @@ public class PdfToCbzUtils {
         }
     }
 
-    private static byte[] createCbzFromPdf(PDDocument document, int dpi) throws IOException {
+    private static TempFile createCbzFromPdf(
+            PDDocument document, int dpi, TempFileManager tempFileManager) throws IOException {
         PDFRenderer pdfRenderer = new PDFRenderer(document);
         pdfRenderer.setSubsamplingAllowed(true); // Enable subsampling to reduce memory usage
 
-        try (ByteArrayOutputStream cbzOutputStream = new ByteArrayOutputStream();
-                ZipOutputStream zipOut = new ZipOutputStream(cbzOutputStream)) {
+        TempFile cbzTempFile = new TempFile(tempFileManager, ".cbz");
+        try {
+            try (ZipOutputStream zipOut =
+                    new ZipOutputStream(Files.newOutputStream(cbzTempFile.getPath()))) {
 
-            int totalPages = document.getNumberOfPages();
+                int totalPages = document.getNumberOfPages();
 
-            for (int pageIndex = 0; pageIndex < totalPages; pageIndex++) {
-                final int currentPage = pageIndex;
-                try {
-                    BufferedImage image =
-                            ExceptionUtils.handleOomRendering(
-                                    currentPage + 1,
-                                    dpi,
-                                    () ->
-                                            pdfRenderer.renderImageWithDPI(
-                                                    currentPage, dpi, ImageType.RGB));
+                for (int pageIndex = 0; pageIndex < totalPages; pageIndex++) {
+                    final int currentPage = pageIndex;
+                    try {
+                        BufferedImage image =
+                                ExceptionUtils.handleOomRendering(
+                                        currentPage + 1,
+                                        dpi,
+                                        () ->
+                                                pdfRenderer.renderImageWithDPI(
+                                                        currentPage, dpi, ImageType.RGB));
 
-                    String imageFilename =
-                            String.format(Locale.ROOT, "page_%03d.png", currentPage + 1);
-                    ZipEntry zipEntry = new ZipEntry(imageFilename);
-                    zipOut.putNextEntry(zipEntry);
+                        String imageFilename =
+                                String.format(Locale.ROOT, "page_%03d.png", currentPage + 1);
+                        zipOut.putNextEntry(new ZipEntry(imageFilename));
+                        ImageIO.write(image, "PNG", zipOut);
+                        zipOut.closeEntry();
 
-                    ImageIO.write(image, "PNG", zipOut);
-                    zipOut.closeEntry();
-
-                } catch (ExceptionUtils.OutOfMemoryDpiException e) {
-                    // Re-throw OOM exceptions without wrapping
-                    throw e;
-                } catch (IOException e) {
-                    // Wrap other IOExceptions with context
-                    throw ExceptionUtils.createFileProcessingException(
-                            "CBZ creation for page " + (currentPage + 1), e);
+                    } catch (ExceptionUtils.OutOfMemoryDpiException e) {
+                        // Re-throw OOM exceptions without wrapping
+                        throw e;
+                    } catch (IOException e) {
+                        // Wrap other IOExceptions with context
+                        throw ExceptionUtils.createFileProcessingException(
+                                "CBZ creation for page " + (currentPage + 1), e);
+                    }
                 }
             }
-
-            zipOut.finish();
-            return cbzOutputStream.toByteArray();
+            return cbzTempFile;
+        } catch (Exception e) {
+            cbzTempFile.close();
+            throw e;
         }
     }
 

app/common/src/main/java/stirling/software/common/util/PdfUtils.java

@@ -219,58 +219,31 @@ public class PdfUtils {
                     int maxWidth = 0;
                     int totalHeight = 0;
 
-                    BufferedImage pdfSizeImage = null;
-                    int pdfSizeImageIndex = -1;
-
-                    // Using a map to store the rendered dimensions of each page size
-                    // to avoid rendering the same page sizes multiple times
+                    // Using a map to store the calculated dimensions of each page size
                     HashMap<PdfRenderSettingsKey, PdfImageDimensionValue> pageSizes =
                             new HashMap<>();
                     for (int i = 0; i < pageCount; ++i) {
-                        final int pageIndex = i;
                         PDPage page = document.getPage(i);
-                        PDRectangle mediaBox = page.getMediaBox();
+                        PDRectangle cropBox = page.getCropBox();
                         int rotation = page.getRotation();
                         PdfRenderSettingsKey settings =
                                 new PdfRenderSettingsKey(
-                                        mediaBox.getWidth(), mediaBox.getHeight(), rotation);
+                                        cropBox.getWidth(), cropBox.getHeight(), rotation);
                         PdfImageDimensionValue dimension = pageSizes.get(settings);
                         if (dimension == null) {
-                            // Render the image to get the dimensions
-                            try {
-                                // Validate dimensions before rendering
-                                ExceptionUtils.validateRenderingDimensions(
-                                        page, pageIndex + 1, DPI);
-
-                                pdfSizeImage =
-                                        ExceptionUtils.handleOomRendering(
-                                                pageIndex + 1,
-                                                DPI,
-                                                () ->
-                                                        pdfRenderer.renderImageWithDPI(
-                                                                pageIndex, DPI, colorType));
-                            } catch (IllegalArgumentException e) {
-                                if (e.getMessage() != null
-                                        && e.getMessage()
-                                                .contains("Maximum size of image exceeded")) {
-                                    throw ExceptionUtils.createIllegalArgumentException(
-                                            "error.pageTooBigExceedsArray",
-                                            "PDF page {0} is too large to render at {1} DPI. The"
-                                                    + " resulting image would exceed Java's maximum"
-                                                    + " array size. Please try a lower DPI value"
-                                                    + " (recommended: 150 or less).",
-                                            i + 1,
-                                            DPI);
-                                }
-                                throw e;
+                            float scale = DPI / 72f;
+                            int widthPx = (int) Math.max(Math.floor(cropBox.getWidth() * scale), 1);
+                            int heightPx =
+                                    (int) Math.max(Math.floor(cropBox.getHeight() * scale), 1);
+                            if (rotation == 90 || rotation == 270) {
+                                int tmp = widthPx;
+                                widthPx = heightPx;
+                                heightPx = tmp;
                             }
-                            pdfSizeImageIndex = i;
-                            dimension =
-                                    new PdfImageDimensionValue(
-                                            pdfSizeImage.getWidth(), pdfSizeImage.getHeight());
+                            dimension = new PdfImageDimensionValue(widthPx, heightPx);
                             pageSizes.put(settings, dimension);
-                            if (pdfSizeImage.getWidth() > maxWidth) {
-                                maxWidth = pdfSizeImage.getWidth();
+                            if (widthPx > maxWidth) {
+                                maxWidth = widthPx;
                             }
                         }
                         totalHeight += dimension.height();
@@ -284,40 +257,32 @@ public class PdfUtils {
                     int currentHeight = 0;
                     BufferedImage pageImage;
 
-                    // Check if the first image is the last rendered image
-                    boolean firstImageAlreadyRendered = pdfSizeImageIndex == 0;
-
                     for (int i = 0; i < pageCount; ++i) {
                         final int pageIndex = i;
-                        if (firstImageAlreadyRendered && i == 0) {
-                            pageImage = pdfSizeImage;
-                        } else {
-                            try {
-                                // Validate dimensions before rendering
-                                ExceptionUtils.validateRenderingDimensions(
-                                        document.getPage(pageIndex), pageIndex + 1, DPI);
+                        try {
+                            // Validate dimensions before rendering
+                            ExceptionUtils.validateRenderingDimensions(
+                                    document.getPage(pageIndex), pageIndex + 1, DPI);
 
-                                pageImage =
-                                        ExceptionUtils.handleOomRendering(
-                                                pageIndex + 1,
-                                                DPI,
-                                                () ->
-                                                        pdfRenderer.renderImageWithDPI(
-                                                                pageIndex, DPI, colorType));
-                            } catch (IllegalArgumentException e) {
-                                if (e.getMessage() != null
-                                        && e.getMessage()
-                                                .contains("Maximum size of image exceeded")) {
-                                    throw ExceptionUtils.createIllegalArgumentException(
-                                            "error.pageTooBigForDpi",
-                                            "PDF page {0} is too large to render at {1} DPI. Please"
-                                                    + " try a lower DPI value (recommended: 150 or"
-                                                    + " less).",
-                                            i + 1,
-                                            DPI);
-                                }
-                                throw e;
+                            pageImage =
+                                    ExceptionUtils.handleOomRendering(
+                                            pageIndex + 1,
+                                            DPI,
+                                            () ->
+                                                    pdfRenderer.renderImageWithDPI(
+                                                            pageIndex, DPI, colorType));
+                        } catch (IllegalArgumentException e) {
+                            if (e.getMessage() != null
+                                    && e.getMessage().contains("Maximum size of image exceeded")) {
+                                throw ExceptionUtils.createIllegalArgumentException(
+                                        "error.pageTooBigForDpi",
+                                        "PDF page {0} is too large to render at {1} DPI. Please"
+                                                + " try a lower DPI value (recommended: 150 or"
+                                                + " less).",
+                                        i + 1,
+                                        DPI);
                             }
+                            throw e;
                         }
 
                         // Calculate the x-coordinate to center the image

app/common/src/main/java/stirling/software/common/util/ProcessExecutor.java

@@ -226,50 +226,54 @@ public class ProcessExecutor {
             List<String> outputLines = new ArrayList<>();
 
             Thread errorReaderThread =
-                    new Thread(
-                            () -> {
-                                try (BufferedReader errorReader =
-                                        new BufferedReader(
-                                                new InputStreamReader(
-                                                        process.getErrorStream(),
-                                                        StandardCharsets.UTF_8))) {
-                                    String line;
-                                    while ((line =
-                                                    BoundedLineReader.readLine(
-                                                            errorReader, 5_000_000))
-                                            != null) {
-                                        errorLines.add(line);
-                                        if (liveUpdates) log.info(line);
-                                    }
-                                } catch (InterruptedIOException e) {
-                                    log.warn("Error reader thread was interrupted due to timeout.");
-                                } catch (IOException e) {
-                                    log.error("exception", e);
-                                }
-                            });
+                    Thread.ofVirtual()
+                            .unstarted(
+                                    () -> {
+                                        try (BufferedReader errorReader =
+                                                new BufferedReader(
+                                                        new InputStreamReader(
+                                                                process.getErrorStream(),
+                                                                StandardCharsets.UTF_8))) {
+                                            String line;
+                                            while ((line =
+                                                            BoundedLineReader.readLine(
+                                                                    errorReader, 5_000_000))
+                                                    != null) {
+                                                errorLines.add(line);
+                                                if (liveUpdates) log.info(line);
+                                            }
+                                        } catch (InterruptedIOException e) {
+                                            log.warn(
+                                                    "Error reader thread was interrupted due to timeout.");
+                                        } catch (IOException e) {
+                                            log.error("exception", e);
+                                        }
+                                    });
 
             Thread outputReaderThread =
-                    new Thread(
-                            () -> {
-                                try (BufferedReader outputReader =
-                                        new BufferedReader(
-                                                new InputStreamReader(
-                                                        process.getInputStream(),
-                                                        StandardCharsets.UTF_8))) {
-                                    String line;
-                                    while ((line =
-                                                    BoundedLineReader.readLine(
-                                                            outputReader, 5_000_000))
-                                            != null) {
-                                        outputLines.add(line);
-                                        if (liveUpdates) log.info(line);
-                                    }
-                                } catch (InterruptedIOException e) {
-                                    log.warn("Error reader thread was interrupted due to timeout.");
-                                } catch (IOException e) {
-                                    log.error("exception", e);
-                                }
-                            });
+                    Thread.ofVirtual()
+                            .unstarted(
+                                    () -> {
+                                        try (BufferedReader outputReader =
+                                                new BufferedReader(
+                                                        new InputStreamReader(
+                                                                process.getInputStream(),
+                                                                StandardCharsets.UTF_8))) {
+                                            String line;
+                                            while ((line =
+                                                            BoundedLineReader.readLine(
+                                                                    outputReader, 5_000_000))
+                                                    != null) {
+                                                outputLines.add(line);
+                                                if (liveUpdates) log.info(line);
+                                            }
+                                        } catch (InterruptedIOException e) {
+                                            log.warn(
+                                                    "Error reader thread was interrupted due to timeout.");
+                                        } catch (IOException e) {
+                                            log.error("exception", e);
+                                        }
+                                    });
 
             errorReaderThread.start();
             outputReaderThread.start();
@@ -370,7 +374,7 @@ public class ProcessExecutor {
             }
             // Match common unoconvert variants (but NOT soffice)
             String lowerBasename = basename.toLowerCase(java.util.Locale.ROOT);
-            if (lowerBasename.contains("unoconvert") || lowerBasename.equals("unoconv")) {
+            if (lowerBasename.contains("unoconvert") || "unoconv".equals(lowerBasename)) {
                 return true;
             }
         }

app/common/src/main/java/stirling/software/common/util/SvgSanitizer.java

@@ -86,7 +86,7 @@ public class SvgSanitizer {
         DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
 
         factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
-
+        factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
         factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
         factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
         factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);

app/common/src/main/java/stirling/software/common/util/YamlHelper.java

@@ -191,7 +191,7 @@ public class YamlHelper {
             mappingNode.getValue().clear();
             mappingNode.getValue().addAll(updatedTuples);
         }
-        setNewNode(node);
+        updatedRootNode = node;
 
         return updated;
     }

app/common/src/main/java/stirling/software/common/util/misc/ReplaceAndInvertColorStrategy.java

@@ -19,7 +19,7 @@ public abstract class ReplaceAndInvertColorStrategy extends PDFFile {
 
     public ReplaceAndInvertColorStrategy(MultipartFile file, ReplaceAndInvert replaceAndInvert) {
         setFileInput(file);
-        setReplaceAndInvert(replaceAndInvert);
+        this.replaceAndInvert = replaceAndInvert;
     }
 
     public abstract InputStreamResource replace() throws IOException;

app/common/src/main/java/stirling/software/common/util/propertyeditor/StringToArrayListPropertyEditor.java

@@ -4,18 +4,23 @@ import java.beans.PropertyEditorSupport;
 import java.util.ArrayList;
 import java.util.List;
 
-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.DeserializationFeature;
-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.model.api.security.RedactionArea;
 
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.DeserializationFeature;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
+
 @Slf4j
 public class StringToArrayListPropertyEditor extends PropertyEditorSupport {
 
-    private final ObjectMapper objectMapper = new ObjectMapper();
+    private final ObjectMapper objectMapper =
+            JsonMapper.builder()
+                    .enable(DeserializationFeature.ACCEPT_SINGLE_VALUE_AS_ARRAY)
+                    .disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)
+                    .build();
 
     @Override
     public void setAsText(String text) throws IllegalArgumentException {
@@ -24,7 +29,6 @@ public class StringToArrayListPropertyEditor extends PropertyEditorSupport {
             return;
         }
         try {
-            objectMapper.configure(DeserializationFeature.ACCEPT_SINGLE_VALUE_AS_ARRAY, true);
             TypeReference<ArrayList<RedactionArea>> typeRef = new TypeReference<>() {};
             List<RedactionArea> list = objectMapper.readValue(text, typeRef);
             setValue(list);

app/common/src/main/java/stirling/software/common/util/propertyeditor/StringToMapPropertyEditor.java

@@ -4,12 +4,13 @@ import java.beans.PropertyEditorSupport;
 import java.util.HashMap;
 import java.util.Map;
 
-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.ObjectMapper;
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
 
 public class StringToMapPropertyEditor extends PropertyEditorSupport {
 
-    private final ObjectMapper objectMapper = new ObjectMapper();
+    private final ObjectMapper objectMapper = JsonMapper.builder().build();
 
     @Override
     public void setAsText(String text) throws IllegalArgumentException {

app/common/src/test/java/stirling/software/common/service/SpyPDFDocumentFactory.java

@@ -12,11 +12,12 @@ class SpyPDFDocumentFactory extends CustomPDFDocumentFactory {
     public StrategyType lastStrategyUsed;
 
     public SpyPDFDocumentFactory(PdfMetadataService service) {
-        super(service);
+        super(service); // TempFileManager falls back to Files.createTempFile in tests
     }
 
     @Override
-    public StreamCacheCreateFunction getStreamCacheFunction(long contentSize) {
+    protected StreamCacheCreateFunction getStreamCacheFunction(
+            long contentSize, MemorySnapshot mem) {
         StrategyType type;
         if (contentSize < 10 * 1024 * 1024) {
             type = StrategyType.MEMORY_ONLY;
@@ -26,6 +27,6 @@ class SpyPDFDocumentFactory extends CustomPDFDocumentFactory {
             type = StrategyType.TEMP_FILE;
         }
         this.lastStrategyUsed = type;
-        return super.getStreamCacheFunction(contentSize); // delegate to real behavior
+        return super.getStreamCacheFunction(contentSize, mem);
     }
 }

app/common/src/test/java/stirling/software/common/util/FormUtilsTest.java

@@ -1,4 +1,4 @@
-package stirling.software.proprietary.util;
+package stirling.software.common.util;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;

app/common/src/test/java/stirling/software/common/util/UnoServerPoolTest.java

@@ -121,17 +121,19 @@ public class UnoServerPoolTest {
 
         // Try to acquire a third endpoint in separate thread (should block)
         Thread blockingThread =
-                new Thread(
-                        () -> {
-                            try {
-                                acquireLatch.countDown(); // Signal we're about to block
-                                UnoServerPool.UnoServerLease lease3 = pool.acquireEndpoint();
-                                acquired.incrementAndGet();
-                                lease3.close();
-                            } catch (InterruptedException e) {
-                                Thread.currentThread().interrupt();
-                            }
-                        });
+                Thread.ofVirtual()
+                        .unstarted(
+                                () -> {
+                                    try {
+                                        acquireLatch.countDown(); // Signal we're about to block
+                                        UnoServerPool.UnoServerLease lease3 =
+                                                pool.acquireEndpoint();
+                                        acquired.incrementAndGet();
+                                        lease3.close();
+                                    } catch (InterruptedException e) {
+                                        Thread.currentThread().interrupt();
+                                    }
+                                });
 
         blockingThread.start();
         acquireLatch.await(); // Wait for thread to start

app/common/src/test/java/stirling/software/common/util/propertyeditor/StringToArrayListPropertyEditorTest.java

@@ -143,11 +143,21 @@ class StringToArrayListPropertyEditorTest {
     }
 
     @Test
-    void testSetAsText_InvalidStructure() {
-        // Arrange - this JSON doesn't match RedactionArea structure
+    void testSetAsText_UnknownProperties() {
+        // Arrange - this JSON contains properties not in RedactionArea
+        // With FAIL_ON_UNKNOWN_PROPERTIES disabled, this should ignore the unknown properties
         String json = "[{\"invalid\":\"structure\"}]";
 
-        // Act & Assert
-        assertThrows(IllegalArgumentException.class, () -> editor.setAsText(json));
+        // Act
+        editor.setAsText(json);
+        Object value = editor.getValue();
+
+        // Assert
+        assertNotNull(value, "Value should not be null");
+        assertInstanceOf(List.class, value, "Value should be a List");
+
+        @SuppressWarnings("unchecked")
+        List<RedactionArea> list = (List<RedactionArea>) value;
+        assertEquals(1, list.size(), "List should have 1 entry (empty object)");
     }
 }

app/core/build.gradle

@@ -12,11 +12,10 @@ configurations {
 spotless {
     java {
         target 'src/**/java/**/*.java'
-        targetExclude 'src/main/resources/static/**'
+        targetExclude 'src/main/resources/static/**', 'src/main/java/org/apache/**'
         googleJavaFormat(googleJavaFormatVersion).aosp().reorderImports(false)
 
         importOrder("java", "javax", "org", "com", "net", "io", "jakarta", "lombok", "me", "stirling")
-        toggleOffOn()
         trimTrailingWhitespace()
         leadingTabsToSpaces()
         endWithNewline()
@@ -46,8 +45,23 @@ dependencies {
 
     implementation project(':common')
     implementation 'org.springframework.boot:spring-boot-starter-jetty'
-    implementation 'com.posthog.java:posthog:1.2.0'
-    implementation 'org.telegram:telegrambots:6.9.7.1'
+    implementation 'org.eclipse.jetty.http2:jetty-http2-server'
+    implementation ('org.telegram:telegrambots:6.9.7.1') {
+        // Grizzly server + Jersey JAX-RS stack: only used for webhook mode;
+        // Stirling-PDF uses long-polling mode so these are dead weight (~3 MB)
+        exclude group: 'org.glassfish.jersey.inject'
+        exclude group: 'org.glassfish.jersey.media'
+        exclude group: 'org.glassfish.jersey.containers'
+        exclude group: 'org.glassfish.jersey.core'
+        exclude group: 'org.glassfish.jersey.ext'
+        exclude group: 'org.glassfish.grizzly'
+        exclude group: 'org.glassfish.hk2'
+        exclude group: 'org.glassfish.hk2.external'
+        exclude group: 'org.javassist', module: 'javassist'
+        // Old javax JAX-RS Jackson bindings (not needed, project uses jakarta)
+        exclude group: 'com.fasterxml.jackson.jaxrs'
+        exclude group: 'com.fasterxml.jackson.module', module: 'jackson-module-jaxb-annotations'
+    }
     implementation 'commons-io:commons-io:2.21.0'
     implementation "org.bouncycastle:bcprov-jdk18on:$bouncycastleVersion"
     implementation "org.bouncycastle:bcpkix-jdk18on:$bouncycastleVersion"
@@ -61,11 +75,14 @@ dependencies {
     implementation "org.apache.pdfbox:xmpbox:$pdfboxVersion"
 
     implementation 'org.verapdf:validation-model:1.28.2'
+    // CVE-2025-66453: Explicit rhino 1.7.15 to override verapdf's 1.7.13
+    implementation 'org.mozilla:rhino:1.9.1'
 
     // veraPDF still uses javax.xml.bind, not the new jakarta namespace
     implementation 'javax.xml.bind:jaxb-api:2.3.1'
     implementation 'com.sun.xml.bind:jaxb-impl:2.3.9'
-    implementation 'com.sun.xml.bind:jaxb-core:2.3.0.1'
+    implementation 'com.sun.xml.bind:jaxb-core:4.0.6'
+    implementation 'org.apache.poi:poi-ooxml:5.5.1'
 
     // https://mvnrepository.com/artifact/technology.tabula/tabula
     implementation ('technology.tabula:tabula:1.0.5')  {
@@ -73,11 +90,17 @@ dependencies {
         exclude group: 'org.bouncycastle', module: 'bcprov-jdk15on'
         exclude group: 'com.google.code.gson', module: 'gson'
     }
+    // CVE-2022-25647: Explicit gson 2.13.2 to prevent unsafe deserialization (tabula would pull 2.8.7)
+    implementation 'com.google.code.gson:gson:2.13.2'
     implementation 'org.apache.pdfbox:jbig2-imageio:3.0.4'
     implementation 'com.opencsv:opencsv:5.12.0' // https://mvnrepository.com/artifact/com.opencsv/opencsv
+    implementation 'org.apache.poi:poi-ooxml:5.5.1'
 
-    // Batik
-    implementation 'org.apache.xmlgraphics:batik-all:1.19'
+    // Batik only bridge module needed (transitively pulls anim, gvt, util, css, dom, svg-dom)
+    // Replaces batik-all which included unused codec, svggen, transcoder, script modules
+    implementation 'org.apache.xmlgraphics:batik-bridge:1.19'
+    // Required by TwelveMonkeys imageio-batik SPI (SVGImageReaderSpi) during ImageIO init
+    runtimeOnly 'org.apache.xmlgraphics:batik-transcoder:1.19'
 
     // PDFBox Graphics2D bridge for Batik SVG to PDF conversion
     implementation 'de.rototor.pdfbox:graphics2d:3.0.5'

app/core/src/main/java/org/apache/pdfbox/examples/signature/CreateSignatureBase.java

@@ -88,10 +88,10 @@ public abstract class CreateSignatureBase implements SignatureInterface {
         Certificate cert = null;
         while (cert == null && aliases.hasMoreElements()) {
             alias = aliases.nextElement();
-            setPrivateKey((PrivateKey) keystore.getKey(alias, pin));
+            privateKey = (PrivateKey) keystore.getKey(alias, pin);
             Certificate[] certChain = keystore.getCertificateChain(alias);
             if (certChain != null) {
-                setCertificateChain(certChain);
+                certificateChain = certChain;
                 cert = certChain[0];
                 if (cert instanceof X509Certificate) {
                     // avoid expired certificate

app/core/src/main/java/stirling/software/SPDF/LibreOfficeListener.java

@@ -49,8 +49,8 @@ public class LibreOfficeListener {
         process = SystemCommand.runCommand(Runtime.getRuntime(), "unoconv --listener");
         lastActivityTime = System.currentTimeMillis();
 
-        // Start a background thread to monitor the activity timeout
-        executorService = Executors.newSingleThreadExecutor();
+        // Start a virtual thread to monitor the activity timeout
+        executorService = Executors.newVirtualThreadPerTaskExecutor();
         executorService.submit(
                 () -> {
                     while (true) {

app/core/src/main/java/stirling/software/SPDF/SPDFApplication.java

@@ -13,8 +13,7 @@ import java.util.regex.Pattern;
 
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
-import org.springframework.boot.builder.SpringApplicationBuilder;
-import org.springframework.boot.web.context.WebServerInitializedEvent;
+import org.springframework.boot.context.event.ApplicationReadyEvent;
 import org.springframework.context.event.EventListener;
 import org.springframework.core.env.Environment;
 import org.springframework.scheduling.annotation.EnableScheduling;
@@ -29,7 +28,6 @@ import stirling.software.common.configuration.AppConfig;
 import stirling.software.common.configuration.ConfigInitializer;
 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.model.ApplicationProperties;
-import stirling.software.common.plugins.PluginLoader;
 
 @Slf4j
 @EnableScheduling
@@ -61,11 +59,11 @@ public class SPDFApplication {
     }
 
     public static void main(String[] args) throws IOException, InterruptedException {
-        SpringApplicationBuilder builder = new SpringApplicationBuilder(SPDFApplication.class);
+        SpringApplication app = new SpringApplication(SPDFApplication.class);
 
         Properties props = new Properties();
 
-        builder.profiles(getActiveProfile(args));
+        app.setAdditionalProfiles(getActiveProfile(args));
 
         ConfigInitializer initializer = new ConfigInitializer();
         try {
@@ -113,13 +111,8 @@ public class SPDFApplication {
         if (!props.isEmpty()) {
             finalProps.putAll(props);
         }
-        ClassLoader pluginClassLoader =
-                PluginLoader.buildPluginClassLoader(SPDFApplication.class.getClassLoader());
-        if (pluginClassLoader != SPDFApplication.class.getClassLoader()) {
-            Thread.currentThread().setContextClassLoader(pluginClassLoader);
-        }
-        SpringApplication app = builder.build();
         app.setDefaultProperties(finalProps);
+
         app.run(args);
 
         // Ensure directories are created
@@ -141,7 +134,7 @@ public class SPDFApplication {
         baseUrlStatic = normalizeBackendUrl(backendUrl, serverPort);
         contextPathStatic = contextPath;
         serverPortStatic = serverPort;
-        String url = buildFullUrl(baseUrlStatic, getStaticPort(), contextPathStatic);
+        String url = buildFullUrl(baseUrlStatic, serverPortStatic, contextPathStatic);
 
         // Log Tauri mode information
         if (Boolean.parseBoolean(System.getProperty("STIRLING_PDF_TAURI_MODE", "false"))) {
@@ -183,16 +176,19 @@ public class SPDFApplication {
     }
 
     @EventListener
-    public void onWebServerInitialized(WebServerInitializedEvent event) {
-        int actualPort = event.getWebServer().getPort();
-        serverPortStatic = String.valueOf(actualPort);
+    public void onApplicationReady(ApplicationReadyEvent event) {
+        String port =
+                event.getApplicationContext().getEnvironment().getProperty("local.server.port");
+        if (port != null) {
+            serverPortStatic = port;
+        }
         // Log the actual runtime port for Tauri to parse
-        log.info("Stirling-PDF running on port: {}", actualPort);
+        log.info("Stirling-PDF running on port: {}", serverPortStatic);
     }
 
     private static void printStartupLogs() {
         log.info("Stirling-PDF Started.");
-        String url = buildFullUrl(baseUrlStatic, getStaticPort(), contextPathStatic);
+        String url = buildFullUrl(baseUrlStatic, serverPortStatic, contextPathStatic);
         log.info("Navigate to {}", url);
     }
 

app/core/src/main/java/stirling/software/SPDF/config/EndpointInspector.java

@@ -104,7 +104,7 @@ public class EndpointInspector implements ApplicationListener<ContextRefreshedEv
             String infoString = mappingInfo.toString();
             if (infoString.contains("{")) {
                 String patternsSection =
-                        infoString.substring(infoString.indexOf("{") + 1, infoString.indexOf("}"));
+                        infoString.substring(infoString.indexOf('{') + 1, infoString.indexOf('}'));
 
                 for (String pattern : patternsSection.split(",")) {
                     pattern = pattern.trim();

app/core/src/main/java/stirling/software/SPDF/config/ExternalAppDepConfig.java

@@ -51,9 +51,7 @@ public class ExternalAppDepConfig {
      */
     private final Map<String, List<String>> commandToGroupMapping;
 
-    private final ExecutorService pool =
-            Executors.newFixedThreadPool(
-                    Math.max(2, Runtime.getRuntime().availableProcessors() / 2));
+    private final ExecutorService pool = Executors.newVirtualThreadPerTaskExecutor();
 
     public ExternalAppDepConfig(
             EndpointConfiguration endpointConfiguration, RuntimePathConfig runtimePathConfig) {

app/core/src/main/java/stirling/software/SPDF/config/MultipartConfiguration.java

@@ -1,7 +1,7 @@
 package stirling.software.SPDF.config;
 
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.web.servlet.MultipartConfigFactory;
+import org.springframework.boot.servlet.MultipartConfigFactory;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.DependsOn;

app/core/src/main/java/stirling/software/SPDF/config/TauriProcessMonitor.java

@@ -54,8 +54,8 @@ public class TauriProcessMonitor {
         scheduler =
                 Executors.newSingleThreadScheduledExecutor(
                         r -> {
-                            Thread t = new Thread(r, "tauri-process-monitor");
-                            t.setDaemon(true);
+                            Thread t =
+                                    Thread.ofVirtual().name("tauri-process-monitor").unstarted(r);
                             return t;
                         });
 

app/core/src/main/java/stirling/software/SPDF/config/WebMvcConfig.java

@@ -82,6 +82,9 @@ public class WebMvcConfig implements WebMvcConfigurer {
             logger.info("Tauri mode detected - enabling CORS for Tauri protocols (v1 and v2)");
             registry.addMapping("/**")
                     .allowedOriginPatterns(
+                            "http://localhost:*",
+                            "https://localhost:*",
+                            "tauri://*", // Add this for Tauri apps
                             "tauri://localhost",
                             "http://tauri.localhost",
                             "https://tauri.localhost")
@@ -154,8 +157,8 @@ public class WebMvcConfig implements WebMvcConfigurer {
                     .maxAge(3600);
         } else {
             // Default to allowing all origins when nothing is configured
-            logger.info(
-                    "No CORS allowed origins configured in settings.yml (system.corsAllowedOrigins); allowing all origins.");
+            logger.debug(
+                    "No CORS allowed origins configured in settings.yml (system.corsAllowedOrigins); WebMvcConfig allowing all origins.");
             registry.addMapping("/**")
                     .allowedOriginPatterns("*")
                     .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")

app/core/src/main/java/stirling/software/SPDF/controller/api/AnalysisController.java

@@ -8,10 +8,12 @@ import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDDocumentInformation;
 import org.apache.pdfbox.pdmodel.PDPage;
 import org.apache.pdfbox.pdmodel.PDPageTree;
+import org.apache.pdfbox.pdmodel.PDResources;
 import org.apache.pdfbox.pdmodel.encryption.PDEncryption;
 import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotation;
 import org.apache.pdfbox.pdmodel.interactive.form.PDAcroForm;
 import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.*;
 
 import io.swagger.v3.oas.annotations.Operation;
@@ -35,9 +37,9 @@ public class AnalysisController {
     @Operation(
             summary = "Get PDF page count",
             description = "Returns total number of pages in PDF. Input:PDF Output:JSON Type:SISO")
-    public Map<String, Integer> getPageCount(@ModelAttribute PDFFile file) throws IOException {
+    public ResponseEntity<?> getPageCount(@ModelAttribute PDFFile file) throws IOException {
         try (PDDocument document = pdfDocumentFactory.load(file.getFileInput())) {
-            return Map.of("pageCount", document.getNumberOfPages());
+            return ResponseEntity.ok(Map.of("pageCount", document.getNumberOfPages()));
         }
     }
 
@@ -46,13 +48,13 @@ public class AnalysisController {
     @Operation(
             summary = "Get basic PDF information",
             description = "Returns page count, version, file size. Input:PDF Output:JSON Type:SISO")
-    public Map<String, Object> getBasicInfo(@ModelAttribute PDFFile file) throws IOException {
+    public ResponseEntity<?> getBasicInfo(@ModelAttribute PDFFile file) throws IOException {
         try (PDDocument document = pdfDocumentFactory.load(file.getFileInput())) {
             Map<String, Object> info = new HashMap<>();
             info.put("pageCount", document.getNumberOfPages());
             info.put("pdfVersion", document.getVersion());
             info.put("fileSize", file.getFileInput().getSize());
-            return info;
+            return ResponseEntity.ok(info);
         }
     }
 
@@ -63,7 +65,7 @@ public class AnalysisController {
     @Operation(
             summary = "Get PDF document properties",
             description = "Returns title, author, subject, etc. Input:PDF Output:JSON Type:SISO")
-    public Map<String, String> getDocumentProperties(@ModelAttribute PDFFile file)
+    public ResponseEntity<?> getDocumentProperties(@ModelAttribute PDFFile file)
             throws IOException {
         // Load the document in read-only mode to prevent modifications and ensure the integrity of
         // the original file.
@@ -76,9 +78,15 @@ public class AnalysisController {
             properties.put("keywords", info.getKeywords());
             properties.put("creator", info.getCreator());
             properties.put("producer", info.getProducer());
-            properties.put("creationDate", info.getCreationDate().toString());
-            properties.put("modificationDate", info.getModificationDate().toString());
-            return properties;
+            properties.put(
+                    "creationDate",
+                    info.getCreationDate() != null ? info.getCreationDate().toString() : null);
+            properties.put(
+                    "modificationDate",
+                    info.getModificationDate() != null
+                            ? info.getModificationDate().toString()
+                            : null);
+            return ResponseEntity.ok(properties);
         }
     }
 
@@ -87,8 +95,7 @@ public class AnalysisController {
     @Operation(
             summary = "Get page dimensions for all pages",
             description = "Returns width and height of each page. Input:PDF Output:JSON Type:SISO")
-    public List<Map<String, Float>> getPageDimensions(@ModelAttribute PDFFile file)
-            throws IOException {
+    public ResponseEntity<?> getPageDimensions(@ModelAttribute PDFFile file) throws IOException {
         try (PDDocument document = pdfDocumentFactory.load(file.getFileInput())) {
             List<Map<String, Float>> dimensions = new ArrayList<>();
             PDPageTree pages = document.getPages();
@@ -99,7 +106,7 @@ public class AnalysisController {
                 pageDim.put("height", page.getBBox().getHeight());
                 dimensions.add(pageDim);
             }
-            return dimensions;
+            return ResponseEntity.ok(dimensions);
         }
     }
 
@@ -109,7 +116,7 @@ public class AnalysisController {
             summary = "Get form field information",
             description =
                     "Returns count and details of form fields. Input:PDF Output:JSON Type:SISO")
-    public Map<String, Object> getFormFields(@ModelAttribute PDFFile file) throws IOException {
+    public ResponseEntity<?> getFormFields(@ModelAttribute PDFFile file) throws IOException {
         try (PDDocument document = pdfDocumentFactory.load(file.getFileInput())) {
             Map<String, Object> formInfo = new HashMap<>();
             PDAcroForm form = document.getDocumentCatalog().getAcroForm();
@@ -123,7 +130,7 @@ public class AnalysisController {
                 formInfo.put("hasXFA", false);
                 formInfo.put("isSignaturesExist", false);
             }
-            return formInfo;
+            return ResponseEntity.ok(formInfo);
         }
     }
 
@@ -132,7 +139,7 @@ public class AnalysisController {
     @Operation(
             summary = "Get annotation information",
             description = "Returns count and types of annotations. Input:PDF Output:JSON Type:SISO")
-    public Map<String, Object> getAnnotationInfo(@ModelAttribute PDFFile file) throws IOException {
+    public ResponseEntity<?> getAnnotationInfo(@ModelAttribute PDFFile file) throws IOException {
         try (PDDocument document = pdfDocumentFactory.load(file.getFileInput())) {
             Map<String, Object> annotInfo = new HashMap<>();
             int totalAnnotations = 0;
@@ -148,7 +155,7 @@ public class AnalysisController {
 
             annotInfo.put("totalCount", totalAnnotations);
             annotInfo.put("typeBreakdown", annotationTypes);
-            return annotInfo;
+            return ResponseEntity.ok(annotInfo);
         }
     }
 
@@ -158,20 +165,23 @@ public class AnalysisController {
             summary = "Get font information",
             description =
                     "Returns list of fonts used in the document. Input:PDF Output:JSON Type:SISO")
-    public Map<String, Object> getFontInfo(@ModelAttribute PDFFile file) throws IOException {
+    public ResponseEntity<?> getFontInfo(@ModelAttribute PDFFile file) throws IOException {
         try (PDDocument document = pdfDocumentFactory.load(file.getFileInput())) {
             Map<String, Object> fontInfo = new HashMap<>();
             Set<String> fontNames = new HashSet<>();
 
             for (PDPage page : document.getPages()) {
-                for (COSName font : page.getResources().getFontNames()) {
-                    fontNames.add(font.getName());
+                PDResources resources = page.getResources();
+                if (resources != null) {
+                    for (COSName font : resources.getFontNames()) {
+                        fontNames.add(font.getName());
+                    }
                 }
             }
 
             fontInfo.put("fontCount", fontNames.size());
             fontInfo.put("fonts", fontNames);
-            return fontInfo;
+            return ResponseEntity.ok(fontInfo);
         }
     }
 
@@ -181,7 +191,7 @@ public class AnalysisController {
             summary = "Get security information",
             description =
                     "Returns encryption and permission details. Input:PDF Output:JSON Type:SISO")
-    public Map<String, Object> getSecurityInfo(@ModelAttribute PDFFile file) throws IOException {
+    public ResponseEntity<?> getSecurityInfo(@ModelAttribute PDFFile file) throws IOException {
         try (PDDocument document = pdfDocumentFactory.load(file.getFileInput())) {
             Map<String, Object> securityInfo = new HashMap<>();
             PDEncryption encryption = document.getEncryption();
@@ -208,7 +218,7 @@ public class AnalysisController {
                 securityInfo.put("isEncrypted", false);
             }
 
-            return securityInfo;
+            return ResponseEntity.ok(securityInfo);
         }
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/CropController.java

@@ -24,6 +24,7 @@ import io.swagger.v3.oas.annotations.Operation;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.SPDF.config.EndpointConfiguration;
 import stirling.software.SPDF.model.api.general.CropPdfForm;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.GeneralApi;
@@ -118,6 +119,12 @@ public class CropController {
         return r >= threshold && g >= threshold && b >= threshold;
     }
 
+    private final EndpointConfiguration endpointConfiguration;
+
+    private boolean isGhostscriptEnabled() {
+        return endpointConfiguration.isGroupEnabled("Ghostscript");
+    }
+
     @AutoJobPostMapping(value = "/crop", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
     @Operation(
             summary = "Crops a PDF document",
@@ -137,7 +144,7 @@ public class CropController {
                     "Crop coordinates (x, y, width, height) are required when auto-crop is not enabled");
         }
 
-        if (request.isRemoveDataOutsideCrop()) {
+        if (request.isRemoveDataOutsideCrop() && isGhostscriptEnabled()) {
             return cropWithGhostscript(request);
         } else {
             return cropWithPDFBox(request);

app/core/src/main/java/stirling/software/SPDF/controller/api/EditTableOfContentsController.java

@@ -15,9 +15,6 @@ import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.multipart.MultipartFile;
 
-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import io.swagger.v3.oas.annotations.Operation;
 
 import lombok.Getter;
@@ -32,6 +29,9 @@ import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.WebResponseUtils;
 
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.ObjectMapper;
+
 @GeneralApi
 @Slf4j
 @RequiredArgsConstructor

app/core/src/main/java/stirling/software/SPDF/controller/api/MergeController.java

@@ -399,7 +399,12 @@ public class MergeController {
         String mergedFileName =
                 GeneralUtils.generateFilename(firstFilename, "_merged_unsigned.pdf");
 
-        byte[] pdfBytes = Files.readAllBytes(outputTempFile.getPath());
+        byte[] pdfBytes;
+        try {
+            pdfBytes = Files.readAllBytes(outputTempFile.getPath());
+        } finally {
+            outputTempFile.close();
+        }
         return WebResponseUtils.bytesToWebResponse(pdfBytes, mergedFileName);
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/PdfOverlayController.java

@@ -194,7 +194,7 @@ public class PdfOverlayController {
             // Load the overlay document to check its page count
             try (PDDocument overlayPdf = Loader.loadPDF(overlayFile)) {
                 int overlayPageCount = overlayPdf.getNumberOfPages();
-                for (int j = 0; j < repeatCount; j++) {
+                for (int j = 0; j < repeatCount && currentPage <= basePageCount; j++) {
                     for (int page = 0; page < overlayPageCount; page++) {
                         if (currentPage > basePageCount) break;
                         overlayGuide.put(currentPage++, overlayFile.getAbsolutePath());

app/core/src/main/java/stirling/software/SPDF/controller/api/PosterPdfController.java

@@ -0,0 +1,275 @@
+package stirling.software.SPDF.controller.api;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipOutputStream;
+
+import org.apache.pdfbox.multipdf.LayerUtility;
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.pdmodel.PDPageContentStream;
+import org.apache.pdfbox.pdmodel.common.PDRectangle;
+import org.apache.pdfbox.pdmodel.graphics.form.PDFormXObject;
+import org.apache.pdfbox.util.Matrix;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.ModelAttribute;
+import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
+
+import io.swagger.v3.oas.annotations.Operation;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.config.swagger.MultiFileResponse;
+import stirling.software.SPDF.model.api.general.PosterPdfRequest;
+import stirling.software.common.annotations.AutoJobPostMapping;
+import stirling.software.common.annotations.api.GeneralApi;
+import stirling.software.common.service.CustomPDFDocumentFactory;
+import stirling.software.common.util.ExceptionUtils;
+import stirling.software.common.util.GeneralUtils;
+import stirling.software.common.util.TempFile;
+import stirling.software.common.util.TempFileManager;
+import stirling.software.common.util.WebResponseUtils;
+
+@GeneralApi
+@Slf4j
+@RequiredArgsConstructor
+public class PosterPdfController {
+
+    private final CustomPDFDocumentFactory pdfDocumentFactory;
+    private final TempFileManager tempFileManager;
+
+    @AutoJobPostMapping(value = "/split-for-poster-print", consumes = "multipart/form-data")
+    @MultiFileResponse
+    @Operation(
+            summary = "Split large PDF pages into smaller printable chunks",
+            description =
+                    "This endpoint splits large or oddly-sized PDF pages into smaller chunks "
+                            + "suitable for printing on standard paper sizes (e.g., A4, Letter). "
+                            + "Divides each page into a grid of smaller pages using Apache PDFBox. "
+                            + "Input: PDF Output: ZIP-PDF Type: SISO")
+    public ResponseEntity<StreamingResponseBody> posterPdf(@ModelAttribute PosterPdfRequest request)
+            throws Exception {
+
+        log.debug("Starting PDF poster split process with request: {}", request);
+        MultipartFile file = request.getFileInput();
+
+        String filename = GeneralUtils.generateFilename(file.getOriginalFilename(), "");
+        log.debug("Base filename for output: {}", filename);
+
+        TempFile zipTempFile = new TempFile(tempFileManager, ".zip");
+        try {
+            try (PDDocument sourceDocument = pdfDocumentFactory.load(file);
+                    PDDocument outputDocument =
+                            pdfDocumentFactory.createNewDocumentBasedOnOldDocument(sourceDocument);
+                    TempFile pdfTempFile = new TempFile(tempFileManager, ".pdf")) {
+
+                // Get target page size
+                PDRectangle targetPageSize = getTargetPageSize(request.getPageSize());
+                log.debug(
+                        "Target page size: {} ({}x{})",
+                        request.getPageSize(),
+                        targetPageSize.getWidth(),
+                        targetPageSize.getHeight());
+
+                // Create LayerUtility for importing pages as forms
+                LayerUtility layerUtility = new LayerUtility(outputDocument);
+
+                int totalPages = sourceDocument.getNumberOfPages();
+                int xFactor = request.getXFactor();
+                int yFactor = request.getYFactor();
+                boolean rightToLeft = request.isRightToLeft();
+
+                log.debug(
+                        "Processing {} pages with grid {}x{}, RTL={}",
+                        totalPages,
+                        xFactor,
+                        yFactor,
+                        rightToLeft);
+
+                // Process each page
+                for (int pageIndex = 0; pageIndex < totalPages; pageIndex++) {
+                    PDPage sourcePage = sourceDocument.getPage(pageIndex);
+
+                    // Get both MediaBox and CropBox
+                    PDRectangle mediaBox = sourcePage.getMediaBox();
+                    PDRectangle cropBox = sourcePage.getCropBox();
+
+                    // If no CropBox is set, use MediaBox
+                    if (cropBox == null) {
+                        cropBox = mediaBox;
+                    }
+
+                    // Save original boxes for restoration
+                    PDRectangle originalMediaBox = sourcePage.getMediaBox();
+                    PDRectangle originalCropBox = sourcePage.getCropBox();
+
+                    // Normalize the page: set MediaBox to CropBox
+                    // This ensures the form's coordinate space starts at (0, 0)
+                    // instead of having an offset from the original MediaBox
+                    sourcePage.setMediaBox(cropBox);
+                    sourcePage.setCropBox(cropBox);
+
+                    // Handle page rotation
+                    int rotation = sourcePage.getRotation();
+                    float sourceWidth = cropBox.getWidth();
+                    float sourceHeight = cropBox.getHeight();
+
+                    // Swap dimensions if rotated 90 or 270 degrees
+                    if (rotation == 90 || rotation == 270) {
+                        float temp = sourceWidth;
+                        sourceWidth = sourceHeight;
+                        sourceHeight = temp;
+                    }
+
+                    log.debug(
+                            "Page {}: Normalized to CropBox dimensions {}x{}, rotation {}",
+                            pageIndex,
+                            sourceWidth,
+                            sourceHeight,
+                            rotation);
+
+                    // Import source page as form (now with normalized coordinate space)
+                    PDFormXObject form = layerUtility.importPageAsForm(sourceDocument, pageIndex);
+
+                    // Restore original boxes
+                    sourcePage.setMediaBox(originalMediaBox);
+                    sourcePage.setCropBox(originalCropBox);
+
+                    // Calculate cell dimensions in source page coordinates
+                    float cellWidth = sourceWidth / xFactor;
+                    float cellHeight = sourceHeight / yFactor;
+
+                    // Create grid cells (rows × columns)
+                    for (int row = 0; row < yFactor; row++) {
+                        for (int col = 0; col < xFactor; col++) {
+                            // Apply RTL ordering for columns if enabled
+                            int actualCol = rightToLeft ? (xFactor - 1 - col) : col;
+
+                            // Calculate crop rectangle in source coordinates
+                            // PDF coordinates start at bottom-left
+                            float cropX = actualCol * cellWidth;
+                            // For Y: invert so row 0 shows TOP (following
+                            // SplitPdfBySectionsController
+                            // pattern)
+                            float cropY = (yFactor - 1 - row) * cellHeight;
+
+                            // Create new output page with target size
+                            PDPage outputPage = new PDPage(targetPageSize);
+                            outputDocument.addPage(outputPage);
+
+                            try (PDPageContentStream contentStream =
+                                    new PDPageContentStream(
+                                            outputDocument,
+                                            outputPage,
+                                            PDPageContentStream.AppendMode.APPEND,
+                                            true,
+                                            true)) {
+
+                                // Calculate uniform scale to fit cell into target page
+                                // Scale UP if cell is smaller than target, scale DOWN if larger
+                                float scaleX = targetPageSize.getWidth() / cellWidth;
+                                float scaleY = targetPageSize.getHeight() / cellHeight;
+                                float scale = Math.min(scaleX, scaleY);
+
+                                // Center the scaled content on the target page
+                                float scaledCellWidth = cellWidth * scale;
+                                float scaledCellHeight = cellHeight * scale;
+                                float offsetX = (targetPageSize.getWidth() - scaledCellWidth) / 2;
+                                float offsetY = (targetPageSize.getHeight() - scaledCellHeight) / 2;
+
+                                // Apply transformations
+                                contentStream.saveGraphicsState();
+
+                                // Translate to center position
+                                contentStream.transform(
+                                        Matrix.getTranslateInstance(offsetX, offsetY));
+
+                                // Scale uniformly
+                                contentStream.transform(Matrix.getScaleInstance(scale, scale));
+
+                                // Translate to show only the desired grid cell
+                                // IMPORTANT: The PDFormXObject's BBox already matches the CropBox
+                                // (including its offset), so we only need to translate by
+                                // cropX/cropY
+                                // relative to the CropBox origin, NOT the MediaBox origin
+                                contentStream.transform(
+                                        Matrix.getTranslateInstance(-cropX, -cropY));
+
+                                // Draw the form
+                                contentStream.drawForm(form);
+
+                                contentStream.restoreGraphicsState();
+                            }
+
+                            log.trace(
+                                    "Created output page for grid cell [{},{}] of page {}: cropX={}, cropY={}, translate=({}, {})",
+                                    row,
+                                    actualCol,
+                                    pageIndex,
+                                    cropX,
+                                    cropY,
+                                    -cropX,
+                                    -cropY);
+                        }
+                    }
+                }
+
+                // Save output PDF to intermediate TempFile
+                outputDocument.save(pdfTempFile.getFile());
+                log.debug("Generated output PDF with {} pages", outputDocument.getNumberOfPages());
+
+                // Create ZIP from the PDF TempFile, streaming directly to zip TempFile
+                try (ZipOutputStream zipOut =
+                        new ZipOutputStream(Files.newOutputStream(zipTempFile.getPath()))) {
+                    zipOut.putNextEntry(new ZipEntry(filename + "_poster.pdf"));
+                    Files.copy(pdfTempFile.getPath(), zipOut);
+                    zipOut.closeEntry();
+                }
+                // pdfTempFile auto-closed and deleted here (end of inner try-with-resources)
+            }
+
+            log.debug("Successfully created ZIP");
+            return WebResponseUtils.zipFileToWebResponse(zipTempFile, filename + "_poster.zip");
+
+        } catch (IOException e) {
+            ExceptionUtils.logException("PDF poster split process", e);
+            zipTempFile.close();
+            throw e;
+        } catch (Exception e) {
+            zipTempFile.close();
+            throw e;
+        }
+    }
+
+    /**
+     * Maps page size string to PDRectangle.
+     *
+     * @param pageSize the page size name (e.g., "A4", "Letter")
+     * @return the corresponding PDRectangle
+     * @throws IllegalArgumentException if page size is not supported
+     */
+    private PDRectangle getTargetPageSize(String pageSize) {
+        Map<String, PDRectangle> sizeMap = new HashMap<>();
+        sizeMap.put("A4", PDRectangle.A4);
+        sizeMap.put("Letter", PDRectangle.LETTER);
+        sizeMap.put("A3", PDRectangle.A3);
+        sizeMap.put("A5", PDRectangle.A5);
+        sizeMap.put("Legal", PDRectangle.LEGAL);
+        sizeMap.put("Tabloid", new PDRectangle(792, 1224)); // 11x17 inches
+
+        PDRectangle size = sizeMap.get(pageSize);
+        if (size == null) {
+            throw ExceptionUtils.createIllegalArgumentException(
+                    "error.invalidPageSize",
+                    "Invalid page size: {0}",
+                    pageSize,
+                    String.join(", ", sizeMap.keySet()));
+        }
+        return size;
+    }
+}

app/core/src/main/java/stirling/software/SPDF/controller/api/RearrangePagesPDFController.java

@@ -191,6 +191,14 @@ public class RearrangePagesPDFController {
         if (duplicateCount < 1) {
             duplicateCount = 2; // Default to 2 if invalid input
         }
+        int maxDuplicateCount = Math.max(100, totalPages * 3);
+        if (duplicateCount > maxDuplicateCount) {
+            throw ExceptionUtils.createIllegalArgumentException(
+                    "error.invalidFormat",
+                    "Invalid {0} format: {1}",
+                    "duplicateCount",
+                    "must not exceed " + maxDuplicateCount);
+        }
 
         // For each page in the document
         for (int pageNum = 0; pageNum < totalPages; pageNum++) {

app/core/src/main/java/stirling/software/SPDF/controller/api/SplitPDFController.java

@@ -1,6 +1,5 @@
 package stirling.software.SPDF.controller.api;
 
-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.util.ArrayList;
@@ -10,11 +9,11 @@ import java.util.zip.ZipEntry;
 import java.util.zip.ZipOutputStream;
 
 import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.PDPage;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
 
 import io.swagger.v3.oas.annotations.Operation;
 
@@ -49,83 +48,60 @@ public class SplitPDFController {
                             + " specified page numbers or ranges. Users can specify pages using"
                             + " individual numbers, ranges, or 'all' for every page. Input:PDF"
                             + " Output:PDF Type:SIMO")
-    public ResponseEntity<byte[]> splitPdf(@ModelAttribute PDFWithPageNums request)
+    public ResponseEntity<StreamingResponseBody> splitPdf(@ModelAttribute PDFWithPageNums request)
             throws IOException {
 
         MultipartFile file = request.getFileInput();
-
-        try (TempFile outputTempFile = new TempFile(tempFileManager, ".zip");
-                PDDocument document = pdfDocumentFactory.load(file)) {
-
-            List<ByteArrayOutputStream> splitDocumentsBoas = new ArrayList<>();
-
-            int totalPages = document.getNumberOfPages();
-            List<Integer> pageNumbers = request.getPageNumbersList(document, false);
-            if (!pageNumbers.contains(totalPages - 1)) {
-                // Create a mutable ArrayList so we can add to it
-                pageNumbers = new ArrayList<>(pageNumbers);
-                pageNumbers.add(totalPages - 1);
-            }
-
-            log.debug(
-                    "Splitting PDF into pages: {}",
-                    pageNumbers.stream().map(String::valueOf).collect(Collectors.joining(",")));
-
-            splitDocumentsBoas = new ArrayList<>(pageNumbers.size());
-            int previousPageNumber = 0;
-            for (int splitPoint : pageNumbers) {
-                try (PDDocument splitDocument =
-                                pdfDocumentFactory.createNewDocumentBasedOnOldDocument(document);
-                        ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
-                    for (int i = previousPageNumber; i <= splitPoint; i++) {
-                        PDPage page = document.getPage(i);
-                        splitDocument.addPage(page);
-                        log.debug("Adding page {} to split document", i);
-                    }
-                    previousPageNumber = splitPoint + 1;
-
-                    // Transfer metadata to split pdf
-                    // PdfMetadataService.setMetadataToPdf(splitDocument, metadata);
-
-                    splitDocument.save(baos);
-                    splitDocumentsBoas.add(baos);
-                } catch (Exception e) {
-                    ExceptionUtils.logException("document splitting and saving", e);
-                    throw e;
+        TempFile outputTempFile = new TempFile(tempFileManager, ".zip");
+        try {
+            try (PDDocument document = pdfDocumentFactory.load(file)) {
+                int totalPages = document.getNumberOfPages();
+                List<Integer> pageNumbers = request.getPageNumbersList(document, false);
+                if (!pageNumbers.contains(totalPages - 1)) {
+                    pageNumbers = new ArrayList<>(pageNumbers);
+                    pageNumbers.add(totalPages - 1);
                 }
-            }
 
-            String baseFilename = GeneralUtils.removeExtension(file.getOriginalFilename());
+                log.debug(
+                        "Splitting PDF into pages: {}",
+                        pageNumbers.stream().map(String::valueOf).collect(Collectors.joining(",")));
 
-            try (ZipOutputStream zipOut =
-                    new ZipOutputStream(Files.newOutputStream(outputTempFile.getPath()))) {
-                int splitDocumentsSize = splitDocumentsBoas.size();
-                for (int i = 0; i < splitDocumentsSize; i++) {
-                    StringBuilder sb = new StringBuilder(baseFilename.length() + 10);
-                    sb.append(baseFilename).append('_').append(i + 1).append(".pdf");
-                    String fileName = sb.toString();
+                String baseFilename = GeneralUtils.removeExtension(file.getOriginalFilename());
+                try (ZipOutputStream zipOut =
+                        new ZipOutputStream(Files.newOutputStream(outputTempFile.getPath()))) {
+                    int previousPageNumber = 0;
+                    for (int splitIndex = 0; splitIndex < pageNumbers.size(); splitIndex++) {
+                        int splitPoint = pageNumbers.get(splitIndex);
+                        try (PDDocument splitDocument =
+                                pdfDocumentFactory.createNewDocumentBasedOnOldDocument(document)) {
+                            for (int i = previousPageNumber; i <= splitPoint; i++) {
+                                splitDocument.addPage(document.getPage(i));
+                                log.debug("Adding page {} to split document", i);
+                            }
+                            previousPageNumber = splitPoint + 1;
 
-                    ByteArrayOutputStream baos = splitDocumentsBoas.get(i);
-                    byte[] pdf = baos.toByteArray();
-
-                    ZipEntry pdfEntry = new ZipEntry(fileName);
-                    zipOut.putNextEntry(pdfEntry);
-                    zipOut.write(pdf);
-                    zipOut.closeEntry();
-
-                    log.debug("Wrote split document {} to zip file", fileName);
+                            String fileName = baseFilename + "_" + (splitIndex + 1) + ".pdf";
+                            zipOut.putNextEntry(new ZipEntry(fileName));
+                            splitDocument.save(zipOut);
+                            zipOut.closeEntry();
+                            log.debug("Wrote split document {} to zip file", fileName);
+                        } catch (Exception e) {
+                            ExceptionUtils.logException("document splitting and saving", e);
+                            throw e;
+                        }
+                    }
                 }
             }
 
             log.debug(
                     "Successfully created zip file with split documents: {}",
                     outputTempFile.getPath().toString());
-            byte[] data = Files.readAllBytes(outputTempFile.getPath());
-
             String zipFilename =
                     GeneralUtils.generateFilename(file.getOriginalFilename(), "_split.zip");
-            return WebResponseUtils.bytesToWebResponse(
-                    data, zipFilename, MediaType.APPLICATION_OCTET_STREAM);
+            return WebResponseUtils.zipFileToWebResponse(outputTempFile, zipFilename);
+        } catch (Exception e) {
+            outputTempFile.close();
+            throw e;
         }
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/SplitPdfByChaptersController.java

@@ -1,8 +1,6 @@
 package stirling.software.SPDF.controller.api;
 
-import java.io.ByteArrayOutputStream;
 import java.nio.file.Files;
-import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Locale;
@@ -17,6 +15,7 @@ import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
 
 import io.swagger.v3.oas.annotations.Operation;
 
@@ -36,6 +35,8 @@ import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.service.PdfMetadataService;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
+import stirling.software.common.util.TempFile;
+import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;
 
 @GeneralApi
@@ -47,6 +48,8 @@ public class SplitPdfByChaptersController {
 
     private final CustomPDFDocumentFactory pdfDocumentFactory;
 
+    private final TempFileManager tempFileManager;
+
     private static List<Bookmark> extractOutlineItems(
             PDDocument sourceDocument,
             PDOutlineItem current,
@@ -122,22 +125,19 @@ public class SplitPdfByChaptersController {
     @Operation(
             summary = "Split PDFs by Chapters",
             description = "Splits a PDF into chapters and returns a ZIP file.")
-    public ResponseEntity<byte[]> splitPdf(@ModelAttribute SplitPdfByChaptersRequest request)
-            throws Exception {
+    public ResponseEntity<StreamingResponseBody> splitPdf(
+            @ModelAttribute SplitPdfByChaptersRequest request) throws Exception {
         MultipartFile file = request.getFileInput();
-        PDDocument sourceDocument = null;
-        Path zipFile = null;
 
-        try {
-            boolean includeMetadata = Boolean.TRUE.equals(request.getIncludeMetadata());
-            Integer bookmarkLevel =
-                    request.getBookmarkLevel(); // levels start from 0 (top most bookmarks)
-            if (bookmarkLevel < 0) {
-                throw ExceptionUtils.createIllegalArgumentException(
-                        "error.invalidArgument", "Invalid argument: {0}", "bookmark level");
-            }
-            sourceDocument = pdfDocumentFactory.load(file);
+        boolean includeMetadata = Boolean.TRUE.equals(request.getIncludeMetadata());
+        Integer bookmarkLevel =
+                request.getBookmarkLevel(); // levels start from 0 (top most bookmarks)
+        if (bookmarkLevel < 0) {
+            throw ExceptionUtils.createIllegalArgumentException(
+                    "error.invalidArgument", "Invalid argument: {0}", "bookmark level");
+        }
 
+        try (PDDocument sourceDocument = pdfDocumentFactory.load(file)) {
             PDDocumentOutline outline = sourceDocument.getDocumentCatalog().getDocumentOutline();
 
             if (outline == null) {
@@ -157,12 +157,10 @@ public class SplitPdfByChaptersController {
                                 bookmarkLevel);
                 // to handle last page edge case
                 bookmarks.get(bookmarks.size() - 1).setEndPage(sourceDocument.getNumberOfPages());
-                Bookmark lastBookmark = bookmarks.get(bookmarks.size() - 1);
 
             } catch (Exception e) {
                 ExceptionUtils.logException("outline extraction", e);
-                return ResponseEntity.internalServerError()
-                        .body("Unable to extract outline items".getBytes());
+                throw e;
             }
 
             boolean allowDuplicates = Boolean.TRUE.equals(request.getAllowDuplicates());
@@ -181,29 +179,10 @@ public class SplitPdfByChaptersController {
                         bookmark.getStartPage(),
                         bookmark.getEndPage());
             }
-            List<ByteArrayOutputStream> splitDocumentsBoas =
-                    getSplitDocumentsBoas(sourceDocument, bookmarks, includeMetadata);
-
-            zipFile = createZipFile(bookmarks, splitDocumentsBoas);
-
-            byte[] data = Files.readAllBytes(zipFile);
-            Files.deleteIfExists(zipFile);
 
+            TempFile zipTempFile = createZipFile(sourceDocument, bookmarks, includeMetadata);
             String filename = GeneralUtils.generateFilename(file.getOriginalFilename(), "");
-            sourceDocument.close();
-            return WebResponseUtils.bytesToWebResponse(
-                    data, filename + ".zip", MediaType.APPLICATION_OCTET_STREAM);
-        } finally {
-            try {
-                if (sourceDocument != null) {
-                    sourceDocument.close();
-                }
-                if (zipFile != null) {
-                    Files.deleteIfExists(zipFile);
-                }
-            } catch (Exception e) {
-                log.error("Error while cleaning up resources", e);
-            }
+            return WebResponseUtils.zipFileToWebResponse(zipTempFile, filename + ".zip");
         }
     }
 
@@ -232,72 +211,55 @@ public class SplitPdfByChaptersController {
         return bookmarks;
     }
 
-    private Path createZipFile(
-            List<Bookmark> bookmarks, List<ByteArrayOutputStream> splitDocumentsBoas)
-            throws Exception {
-        Path zipFile = Files.createTempFile("split_documents", ".zip");
-        String fileNumberFormatter = "%0" + (Integer.toString(bookmarks.size()).length()) + "d ";
-        try (ZipOutputStream zipOut = new ZipOutputStream(Files.newOutputStream(zipFile))) {
-            for (int i = 0; i < splitDocumentsBoas.size(); i++) {
-
-                // split files will be named as "[FILE_NUMBER] [BOOKMARK_TITLE].pdf"
-
-                String fileName =
-                        String.format(Locale.ROOT, fileNumberFormatter, i)
-                                + bookmarks.get(i).getTitle()
-                                + ".pdf";
-                ByteArrayOutputStream baos = splitDocumentsBoas.get(i);
-                byte[] pdf = baos.toByteArray();
-
-                ZipEntry pdfEntry = new ZipEntry(fileName);
-                zipOut.putNextEntry(pdfEntry);
-                zipOut.write(pdf);
-                zipOut.closeEntry();
-
-                log.debug("Wrote split document {} to zip file", fileName);
-            }
-        } catch (Exception e) {
-            log.error("Failed writing to zip", e);
-            throw e;
-        }
-
-        log.info("Successfully created zip file with split documents: {}", zipFile);
-        return zipFile;
-    }
-
-    public List<ByteArrayOutputStream> getSplitDocumentsBoas(
+    private TempFile createZipFile(
             PDDocument sourceDocument, List<Bookmark> bookmarks, boolean includeMetadata)
             throws Exception {
-        List<ByteArrayOutputStream> splitDocumentsBoas = new ArrayList<>();
-        PdfMetadata metadata = null;
-        if (includeMetadata) {
-            metadata = pdfMetadataService.extractMetadataFromPdf(sourceDocument);
-        }
-        for (Bookmark bookmark : bookmarks) {
-            try (PDDocument splitDocument = new PDDocument()) {
-                boolean isSinglePage = (bookmark.getStartPage() == bookmark.getEndPage());
+        PdfMetadata metadata =
+                includeMetadata ? pdfMetadataService.extractMetadataFromPdf(sourceDocument) : null;
+        String fileNumberFormatter = "%0" + (Integer.toString(bookmarks.size()).length()) + "d ";
+        TempFile zipTempFile = new TempFile(tempFileManager, ".zip");
+        try {
+            try (ZipOutputStream zipOut =
+                    new ZipOutputStream(Files.newOutputStream(zipTempFile.getPath()))) {
+                for (int i = 0; i < bookmarks.size(); i++) {
+                    Bookmark bookmark = bookmarks.get(i);
+                    try (PDDocument splitDocument = new PDDocument()) {
+                        boolean isSinglePage = (bookmark.getStartPage() == bookmark.getEndPage());
 
-                for (int i = bookmark.getStartPage();
-                        i < bookmark.getEndPage() + (isSinglePage ? 1 : 0);
-                        i++) {
-                    PDPage page = sourceDocument.getPage(i);
-                    splitDocument.addPage(page);
-                    log.debug("Adding page {} to split document", i);
+                        for (int pg = bookmark.getStartPage();
+                                pg < bookmark.getEndPage() + (isSinglePage ? 1 : 0);
+                                pg++) {
+                            PDPage page = sourceDocument.getPage(pg);
+                            splitDocument.addPage(page);
+                            log.debug("Adding page {} to split document", pg);
+                        }
+                        if (includeMetadata) {
+                            pdfMetadataService.setMetadataToPdf(splitDocument, metadata);
+                        }
+
+                        // split files will be named as "[FILE_NUMBER] [BOOKMARK_TITLE].pdf"
+                        String fileName =
+                                String.format(Locale.ROOT, fileNumberFormatter, i)
+                                        + bookmark.getTitle()
+                                        + ".pdf";
+                        zipOut.putNextEntry(new ZipEntry(fileName));
+                        splitDocument.save(zipOut);
+                        zipOut.closeEntry();
+                        log.debug("Wrote split document {} to zip file", fileName);
+                    } catch (Exception e) {
+                        ExceptionUtils.logException("document splitting and saving", e);
+                        throw e;
+                    }
                 }
-                ByteArrayOutputStream baos = new ByteArrayOutputStream();
-                if (includeMetadata) {
-                    pdfMetadataService.setMetadataToPdf(splitDocument, metadata);
-                }
-
-                splitDocument.save(baos);
-
-                splitDocumentsBoas.add(baos);
-            } catch (Exception e) {
-                ExceptionUtils.logException("document splitting and saving", e);
-                throw e;
             }
+            log.info(
+                    "Successfully created zip file with split documents: {}",
+                    zipTempFile.getPath());
+            return zipTempFile;
+        } catch (Exception e) {
+            zipTempFile.close();
+            throw e;
         }
-        return splitDocumentsBoas;
     }
 }
 

app/core/src/main/java/stirling/software/SPDF/controller/api/SplitPdfBySectionsController.java

@@ -23,6 +23,8 @@ import org.springframework.web.multipart.MultipartFile;
 
 import io.swagger.v3.oas.annotations.Operation;
 
+import jakarta.validation.Valid;
+
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
@@ -57,7 +59,7 @@ public class SplitPdfBySectionsController {
                             + " which page to split, and how to split"
                             + " ( halves, thirds, quarters, etc.), both vertically and horizontally."
                             + " Input:PDF Output:ZIP-PDF Type:SISO")
-    public ResponseEntity<byte[]> splitPdf(@ModelAttribute SplitPdfBySectionsRequest request)
+    public ResponseEntity<byte[]> splitPdf(@Valid @ModelAttribute SplitPdfBySectionsRequest request)
             throws Exception {
         MultipartFile file = request.getFileInput();
         String pageNumbers = request.getPageNumbers();

app/core/src/main/java/stirling/software/SPDF/controller/api/SplitPdfBySizeController.java

@@ -3,7 +3,6 @@ package stirling.software.SPDF.controller.api;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.file.Files;
-import java.nio.file.Path;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipOutputStream;
 
@@ -13,9 +12,11 @@ import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
 
 import io.swagger.v3.oas.annotations.Operation;
 
+import lombok.Getter;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
@@ -50,8 +51,8 @@ public class SplitPdfBySizeController {
                             + " if 10MB and each page is 1MB and you enter 2MB then 5 docs each 2MB"
                             + " (rounded so that it accepts 1.9MB but not 2.1MB) Input:PDF"
                             + " Output:ZIP-PDF Type:SISO")
-    public ResponseEntity<byte[]> autoSplitPdf(@ModelAttribute SplitPdfBySizeOrCountRequest request)
-            throws Exception {
+    public ResponseEntity<StreamingResponseBody> autoSplitPdf(
+            @ModelAttribute SplitPdfBySizeOrCountRequest request) throws Exception {
 
         log.debug("Starting PDF split process with request: {}", request);
         MultipartFile file = request.getFileInput();
@@ -59,63 +60,51 @@ public class SplitPdfBySizeController {
         String filename = GeneralUtils.generateFilename(file.getOriginalFilename(), "");
         log.debug("Base filename for output: {}", filename);
 
-        try (TempFile zipTempFile = new TempFile(tempFileManager, ".zip")) {
-            Path managedZipPath = zipTempFile.getPath();
-            log.debug("Created temporary managed zip file: {}", managedZipPath);
-            try {
-                log.debug("Reading input file bytes");
-                byte[] pdfBytes = file.getBytes();
-                log.debug("Successfully read {} bytes from input file", pdfBytes.length);
+        TempFile zipTempFile = new TempFile(tempFileManager, ".zip");
+        try {
+            log.debug("Created temporary managed zip file: {}", zipTempFile.getPath());
+            log.debug("Creating ZIP output stream");
+            try (ZipOutputStream zipOut =
+                            new ZipOutputStream(Files.newOutputStream(zipTempFile.getPath()));
+                    PDDocument sourceDocument = pdfDocumentFactory.load(file)) {
+                log.debug(
+                        "Successfully loaded PDF with {} pages", sourceDocument.getNumberOfPages());
 
-                log.debug("Creating ZIP output stream");
-                try (ZipOutputStream zipOut =
-                        new ZipOutputStream(Files.newOutputStream(managedZipPath))) {
-                    log.debug("Loading PDF document");
-                    try (PDDocument sourceDocument = pdfDocumentFactory.load(pdfBytes)) {
-                        log.debug(
-                                "Successfully loaded PDF with {} pages",
-                                sourceDocument.getNumberOfPages());
+                int type = request.getSplitType();
+                String value = request.getSplitValue();
+                log.debug("Split type: {}, Split value: {}", type, value);
 
-                        int type = request.getSplitType();
-                        String value = request.getSplitValue();
-                        log.debug("Split type: {}, Split value: {}", type, value);
-
-                        if (type == 0) {
-                            log.debug("Processing split by size");
-                            long maxBytes = GeneralUtils.convertSizeToBytes(value);
-                            log.debug("Max bytes per document: {}", maxBytes);
-                            handleSplitBySize(sourceDocument, maxBytes, zipOut, filename);
-                        } else if (type == 1) {
-                            log.debug("Processing split by page count");
-                            int pageCount = Integer.parseInt(value);
-                            log.debug("Pages per document: {}", pageCount);
-                            handleSplitByPageCount(sourceDocument, pageCount, zipOut, filename);
-                        } else if (type == 2) {
-                            log.debug("Processing split by document count");
-                            int documentCount = Integer.parseInt(value);
-                            log.debug("Total number of documents: {}", documentCount);
-                            handleSplitByDocCount(sourceDocument, documentCount, zipOut, filename);
-                        } else {
-                            log.error("Invalid split type: {}", type);
-                            throw ExceptionUtils.createIllegalArgumentException(
-                                    "error.invalidArgument",
-                                    "Invalid argument: {0}",
-                                    "split type: " + type);
-                        }
-                        log.debug("PDF splitting completed successfully");
-                    }
+                if (type == 0) {
+                    log.debug("Processing split by size");
+                    long maxBytes = GeneralUtils.convertSizeToBytes(value);
+                    log.debug("Max bytes per document: {}", maxBytes);
+                    handleSplitBySize(sourceDocument, maxBytes, zipOut, filename);
+                } else if (type == 1) {
+                    log.debug("Processing split by page count");
+                    int pageCount = Integer.parseInt(value);
+                    log.debug("Pages per document: {}", pageCount);
+                    handleSplitByPageCount(sourceDocument, pageCount, zipOut, filename);
+                } else if (type == 2) {
+                    log.debug("Processing split by document count");
+                    int documentCount = Integer.parseInt(value);
+                    log.debug("Total number of documents: {}", documentCount);
+                    handleSplitByDocCount(sourceDocument, documentCount, zipOut, filename);
+                } else {
+                    log.error("Invalid split type: {}", type);
+                    throw ExceptionUtils.createIllegalArgumentException(
+                            "error.invalidArgument",
+                            "Invalid argument: {0}",
+                            "split type: " + type);
                 }
-
-                byte[] data = Files.readAllBytes(managedZipPath);
-                log.debug("Successfully read {} bytes from ZIP file", data.length);
-
-                log.debug("Returning response with {} bytes of data", data.length);
-                return WebResponseUtils.bytesToWebResponse(
-                        data, filename + ".zip", MediaType.APPLICATION_OCTET_STREAM);
-            } catch (Exception e) {
-                ExceptionUtils.logException("PDF splitting process", e);
-                throw e; // Re-throw to ensure proper error response
+                log.debug("PDF splitting completed successfully");
             }
+
+            log.debug("Returning streaming response for zip file");
+            return WebResponseUtils.zipFileToWebResponse(zipTempFile, filename + ".zip");
+        } catch (Exception e) {
+            ExceptionUtils.logException("PDF splitting process", e);
+            zipTempFile.close();
+            throw e;
         }
     }
 
@@ -124,6 +113,7 @@ public class SplitPdfBySizeController {
             throws IOException {
         log.debug("Starting handleSplitBySize with maxBytes={}", maxBytes);
 
+        @Getter
         class DocHolder implements AutoCloseable {
             private PDDocument doc;
 
@@ -131,10 +121,6 @@ public class SplitPdfBySizeController {
                 this.doc = doc;
             }
 
-            public PDDocument getDoc() {
-                return doc;
-            }
-
             public void setDoc(PDDocument doc) {
                 if (this.doc != null) {
                     try {

app/core/src/main/java/stirling/software/SPDF/controller/api/UIDataController.java

@@ -16,9 +16,6 @@ import org.springframework.core.io.ResourceLoader;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.GetMapping;
 
-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import io.swagger.v3.oas.annotations.Operation;
 
 import lombok.Data;
@@ -35,6 +32,9 @@ import stirling.software.common.service.UserServiceInterface;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
 
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.ObjectMapper;
+
 @Slf4j
 @UiDataApi
 public class UIDataController {
@@ -44,18 +44,21 @@ public class UIDataController {
     private final UserServiceInterface userService;
     private final ResourceLoader resourceLoader;
     private final RuntimePathConfig runtimePathConfig;
+    private final ObjectMapper objectMapper;
 
     public UIDataController(
             ApplicationProperties applicationProperties,
             SharedSignatureService signatureService,
             @Autowired(required = false) UserServiceInterface userService,
             ResourceLoader resourceLoader,
-            RuntimePathConfig runtimePathConfig) {
+            RuntimePathConfig runtimePathConfig,
+            ObjectMapper objectMapper) {
         this.applicationProperties = applicationProperties;
         this.signatureService = signatureService;
         this.userService = userService;
         this.resourceLoader = resourceLoader;
         this.runtimePathConfig = runtimePathConfig;
+        this.objectMapper = objectMapper;
     }
 
     @GetMapping("/footer-info")
@@ -93,9 +96,8 @@ public class UIDataController {
 
         try (InputStream is = resource.getInputStream()) {
             String json = new String(is.readAllBytes(), StandardCharsets.UTF_8);
-            ObjectMapper mapper = new ObjectMapper();
             Map<String, List<Dependency>> licenseData =
-                    mapper.readValue(json, new TypeReference<>() {});
+                    objectMapper.readValue(json, new TypeReference<>() {});
             data.setDependencies(licenseData.get("dependencies"));
         } catch (IOException e) {
             log.error("Failed to load licenses data", e);
@@ -127,8 +129,8 @@ public class UIDataController {
 
                 for (String config : pipelineConfigs) {
                     Map<String, Object> jsonContent =
-                            new ObjectMapper()
-                                    .readValue(config, new TypeReference<Map<String, Object>>() {});
+                            objectMapper.readValue(
+                                    config, new TypeReference<Map<String, Object>>() {});
                     String name = (String) jsonContent.get("name");
                     if (name == null || name.length() < 1) {
                         String filename =

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertImgPDFController.java

@@ -22,6 +22,7 @@ import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
 
 import io.swagger.v3.oas.annotations.Operation;
 
@@ -51,6 +52,7 @@ import stirling.software.common.util.PdfUtils;
 import stirling.software.common.util.ProcessExecutor;
 import stirling.software.common.util.ProcessExecutor.ProcessExecutorResult;
 import stirling.software.common.util.RegexPatternUtils;
+import stirling.software.common.util.TempFile;
 import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;
 
@@ -78,7 +80,7 @@ public class ConvertImgPDFController {
                     "This endpoint converts a PDF file to image(s) with the specified image format,"
                             + " color type, and DPI. Users can choose to get a single image or multiple"
                             + " images.  Input:PDF Output:Image Type:SI-Conditional")
-    public ResponseEntity<byte[]> convertToImage(@ModelAttribute ConvertToImageRequest request)
+    public ResponseEntity<?> convertToImage(@ModelAttribute ConvertToImageRequest request)
             throws Exception {
         MultipartFile file = request.getFileInput();
         String imageFormat = request.getImageFormat();
@@ -180,28 +182,33 @@ public class ConvertImgPDFController {
                             "No WebP files were created. " + resultProcess.getMessages());
                 }
 
-                byte[] bodyBytes = new byte[0];
-
                 if (webpFiles.size() == 1) {
-                    // Return the single WebP file directly
                     Path webpFilePath = webpFiles.get(0);
-                    bodyBytes = Files.readAllBytes(webpFilePath);
+                    byte[] webpBytes = Files.readAllBytes(webpFilePath);
+                    Files.deleteIfExists(tempFile);
+                    tempFile = null;
+                    FileUtils.deleteDirectory(tempOutputDir.toFile());
+                    tempOutputDir = null;
+                    String docName = filename + "." + imageFormat;
+                    MediaType mediaType = MediaType.parseMediaType(getMediaType(imageFormat));
+                    return WebResponseUtils.bytesToWebResponse(webpBytes, docName, mediaType);
                 } else {
-                    // Create a ZIP file containing all WebP images
-                    try (ByteArrayOutputStream zipOutputStream = new ByteArrayOutputStream();
-                            ZipOutputStream zos = new ZipOutputStream(zipOutputStream)) {
+                    ByteArrayOutputStream zipBAOS = new ByteArrayOutputStream();
+                    try (ZipOutputStream zos = new ZipOutputStream(zipBAOS)) {
                         for (Path webpFile : webpFiles) {
                             zos.putNextEntry(new ZipEntry(webpFile.getFileName().toString()));
                             Files.copy(webpFile, zos);
                             zos.closeEntry();
                         }
-                        bodyBytes = zipOutputStream.toByteArray();
                     }
+                    Files.deleteIfExists(tempFile);
+                    tempFile = null;
+                    FileUtils.deleteDirectory(tempOutputDir.toFile());
+                    tempOutputDir = null;
+                    String zipFilename = filename + "_convertedToImages.zip";
+                    return WebResponseUtils.bytesToWebResponse(
+                            zipBAOS.toByteArray(), zipFilename, MediaType.APPLICATION_OCTET_STREAM);
                 }
-                // Clean up the temporary files
-                Files.deleteIfExists(tempFile);
-                if (tempOutputDir != null) FileUtils.deleteDirectory(tempOutputDir.toFile());
-                result = bodyBytes;
             }
 
             if (singleImage) {
@@ -267,8 +274,8 @@ public class ConvertImgPDFController {
             description =
                     "This endpoint converts a CBZ (ZIP) comic book archive to a PDF file. "
                             + "Input:CBZ Output:PDF Type:SISO")
-    public ResponseEntity<?> convertCbzToPdf(@ModelAttribute ConvertCbzToPdfRequest request)
-            throws IOException {
+    public ResponseEntity<StreamingResponseBody> convertCbzToPdf(
+            @ModelAttribute ConvertCbzToPdfRequest request) throws IOException {
         MultipartFile file = request.getFileInput();
         boolean optimizeForEbook = request.isOptimizeForEbook();
 
@@ -278,13 +285,13 @@ public class ConvertImgPDFController {
             optimizeForEbook = false;
         }
 
-        byte[] pdfBytes =
+        TempFile pdfFile =
                 CbzUtils.convertCbzToPdf(
                         file, pdfDocumentFactory, tempFileManager, optimizeForEbook);
 
         String filename = createConvertedFilename(file.getOriginalFilename(), "_converted.pdf");
 
-        return WebResponseUtils.bytesToWebResponse(pdfBytes, filename);
+        return WebResponseUtils.pdfFileToWebResponse(pdfFile, filename);
     }
 
     @AutoJobPostMapping(consumes = MediaType.MULTIPART_FORM_DATA_VALUE, value = "/pdf/cbz")
@@ -293,8 +300,8 @@ public class ConvertImgPDFController {
             description =
                     "This endpoint converts a PDF file to a CBZ (ZIP) comic book archive. "
                             + "Input:PDF Output:CBZ Type:SISO")
-    public ResponseEntity<?> convertPdfToCbz(@ModelAttribute ConvertPdfToCbzRequest request)
-            throws IOException {
+    public ResponseEntity<StreamingResponseBody> convertPdfToCbz(
+            @ModelAttribute ConvertPdfToCbzRequest request) throws IOException {
         MultipartFile file = request.getFileInput();
         int dpi = request.getDpi();
 
@@ -302,12 +309,12 @@ public class ConvertImgPDFController {
             dpi = 300;
         }
 
-        byte[] cbzBytes = PdfToCbzUtils.convertPdfToCbz(file, dpi, pdfDocumentFactory);
+        TempFile cbzFile =
+                PdfToCbzUtils.convertPdfToCbz(file, dpi, pdfDocumentFactory, tempFileManager);
 
         String filename = createConvertedFilename(file.getOriginalFilename(), "_converted.cbz");
 
-        return WebResponseUtils.bytesToWebResponse(
-                cbzBytes, filename, MediaType.APPLICATION_OCTET_STREAM);
+        return WebResponseUtils.zipFileToWebResponse(cbzFile, filename);
     }
 
     @AutoJobPostMapping(consumes = MediaType.MULTIPART_FORM_DATA_VALUE, value = "/cbr/pdf")

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertMarkdownToPdf.java

@@ -83,7 +83,13 @@ public class ConvertMarkdownToPdf {
                     java.util.zip.ZipEntry entry;
                     while ((entry = zipIn.getNextEntry()) != null) {
                         if (!entry.isDirectory()) {
-                            java.nio.file.Path filePath = tempDirPath.resolve(entry.getName());
+                            java.nio.file.Path filePath =
+                                    tempDirPath.resolve(entry.getName()).normalize();
+                            if (!filePath.startsWith(tempDirPath)) {
+                                throw new java.io.IOException(
+                                        "ZIP entry is outside of target directory: "
+                                                + entry.getName());
+                            }
                             java.nio.file.Files.createDirectories(filePath.getParent());
                             java.nio.file.Files.copy(zipIn, filePath);
                         }

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertOfficeController.java

@@ -91,22 +91,32 @@ public class ConvertOfficeController {
 
         Path libreOfficeProfile = null;
         try {
-            ProcessExecutorResult result;
-            // Run Unoconvert command
-            if (isUnoconvertAvailable()) {
-                // Unoconvert: schreibe direkt in outputPath innerhalb des workDir
-                List<String> command = new ArrayList<>();
-                command.add(runtimePathConfig.getUnoConvertPath());
-                command.add("--convert-to");
-                command.add("pdf");
-                command.add(inputPath.toString());
-                command.add(outputPath.toString());
+            ProcessExecutorResult result = null;
+            IOException unoconvertException = null;
 
-                result =
-                        ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
-                                .runCommandWithOutputHandling(command);
-            } // Run soffice command
-            else {
+            // Try unoconvert first if available
+            if (isUnoconvertAvailable()) {
+                try {
+                    List<String> command = new ArrayList<>();
+                    command.add(runtimePathConfig.getUnoConvertPath());
+                    command.add("--convert-to");
+                    command.add("pdf");
+                    command.add(inputPath.toString());
+                    command.add(outputPath.toString());
+
+                    result =
+                            ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
+                                    .runCommandWithOutputHandling(command);
+                } catch (IOException e) {
+                    unoconvertException = e;
+                    log.warn(
+                            "Unoconvert command failed ({}). Falling back to soffice command.",
+                            e.getMessage());
+                }
+            }
+
+            // Fallback to soffice if unoconvert was unavailable or failed
+            if (result == null) {
                 libreOfficeProfile = Files.createTempDirectory("libreoffice_profile_");
                 List<String> command = new ArrayList<>();
                 command.add(runtimePathConfig.getSOfficePath());
@@ -114,14 +124,21 @@ public class ConvertOfficeController {
                 command.add("--headless");
                 command.add("--nologo");
                 command.add("--convert-to");
-                command.add("pdf:writer_pdf_Export");
+                command.add("pdf");
                 command.add("--outdir");
                 command.add(workDir.toString());
                 command.add(inputPath.toString());
 
-                result =
-                        ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
-                                .runCommandWithOutputHandling(command);
+                try {
+                    result =
+                            ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
+                                    .runCommandWithOutputHandling(command);
+                } catch (IOException e) {
+                    if (unoconvertException != null) {
+                        e.addSuppressed(unoconvertException);
+                    }
+                    throw e;
+                }
             }
 
             // Check the result

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertPDFToEpubController.java

@@ -54,6 +54,12 @@ public class ConvertPDFToEpubController {
         command.add(inputPath.toString());
         command.add(outputPath.toString());
 
+        // Use pdftohtml engine (poppler) for PDF input instead of calibre's Qt-based engine.
+        // This avoids the Qt WebEngine dependency for PDF parsing and uses the lighter
+        // poppler-utils pdftohtml binary which is already available in the container.
+        command.add("--pdf-engine");
+        command.add("pdftohtml");
+
         // Golden defaults
         command.add("--enable-heuristics");
         command.add("--insert-blank-line");

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertPDFToExcelController.java

@@ -0,0 +1,124 @@
+package stirling.software.SPDF.controller.api.converters;
+
+import java.io.ByteArrayOutputStream;
+import java.util.List;
+import java.util.Locale;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.poi.ss.usermodel.Cell;
+import org.apache.poi.ss.usermodel.Row;
+import org.apache.poi.ss.usermodel.Sheet;
+import org.apache.poi.ss.usermodel.Workbook;
+import org.apache.poi.ss.util.WorkbookUtil;
+import org.apache.poi.xssf.usermodel.XSSFWorkbook;
+import org.springframework.http.ContentDisposition;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.ModelAttribute;
+
+import io.swagger.v3.oas.annotations.Operation;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.model.api.PDFWithPageNums;
+import stirling.software.common.annotations.AutoJobPostMapping;
+import stirling.software.common.annotations.api.ConvertApi;
+import stirling.software.common.service.CustomPDFDocumentFactory;
+import stirling.software.common.util.GeneralUtils;
+
+import technology.tabula.ObjectExtractor;
+import technology.tabula.Page;
+import technology.tabula.RectangularTextContainer;
+import technology.tabula.Table;
+import technology.tabula.extractors.SpreadsheetExtractionAlgorithm;
+
+@ConvertApi
+@Slf4j
+@RequiredArgsConstructor
+public class ConvertPDFToExcelController {
+
+    private final CustomPDFDocumentFactory pdfDocumentFactory;
+
+    @AutoJobPostMapping(value = "/pdf/xlsx", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @Operation(
+            summary = "Convert a PDF to an Excel spreadsheet (XLSX)",
+            description =
+                    "Extracts tabular data from each page of a PDF and writes it into an Excel"
+                            + " workbook, one sheet per table. Input:PDF Output:XLSX Type:SISO")
+    public ResponseEntity<byte[]> pdfToExcel(@ModelAttribute PDFWithPageNums request)
+            throws Exception {
+        String baseName =
+                GeneralUtils.removeExtension(request.getFileInput().getOriginalFilename());
+
+        try (PDDocument document = pdfDocumentFactory.load(request);
+                XSSFWorkbook workbook = new XSSFWorkbook();
+                ObjectExtractor extractor = new ObjectExtractor(document)) {
+
+            List<Integer> pages = request.getPageNumbersList(document, true);
+            SpreadsheetExtractionAlgorithm sea = new SpreadsheetExtractionAlgorithm();
+            int sheetCount = 0;
+
+            for (int pageNum : pages) {
+                Page page = extractor.extract(pageNum);
+                List<Table> tables = sea.extract(page);
+
+                for (int tableIdx = 0; tableIdx < tables.size(); tableIdx++) {
+                    Table table = tables.get(tableIdx);
+                    String sheetName =
+                            tables.size() == 1
+                                    ? String.format(Locale.ROOT, "Page %d", pageNum)
+                                    : String.format(
+                                            Locale.ROOT, "Page %d Table %d", pageNum, tableIdx + 1);
+
+                    sheetName = getUniqueSheetName(workbook, sheetName);
+                    Sheet sheet = workbook.createSheet(sheetName);
+                    List<List<RectangularTextContainer>> rows = table.getRows();
+
+                    for (int rowIdx = 0; rowIdx < rows.size(); rowIdx++) {
+                        Row excelRow = sheet.createRow(rowIdx);
+                        List<RectangularTextContainer> cells = rows.get(rowIdx);
+                        for (int cellIdx = 0; cellIdx < cells.size(); cellIdx++) {
+                            Cell excelCell = excelRow.createCell(cellIdx);
+                            excelCell.setCellValue(cells.get(cellIdx).getText());
+                        }
+                    }
+                    sheetCount++;
+                }
+            }
+
+            if (sheetCount == 0) {
+                return ResponseEntity.noContent().build();
+            }
+
+            ByteArrayOutputStream baos = new ByteArrayOutputStream();
+            workbook.write(baos);
+
+            HttpHeaders headers = new HttpHeaders();
+            headers.setContentDisposition(
+                    ContentDisposition.builder("attachment").filename(baseName + ".xlsx").build());
+            headers.setContentType(
+                    MediaType.parseMediaType(
+                            "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"));
+
+            return ResponseEntity.ok().headers(headers).body(baos.toByteArray());
+        }
+    }
+
+    private String getUniqueSheetName(Workbook workbook, String baseName) {
+        String safeName = WorkbookUtil.createSafeSheetName(baseName);
+        String uniqueName = safeName;
+        int count = 1;
+        while (workbook.getSheet(uniqueName) != null) {
+            String suffix = " (" + count + ")";
+            if (safeName.length() + suffix.length() > 31) {
+                uniqueName = safeName.substring(0, 31 - suffix.length()) + suffix;
+            } else {
+                uniqueName = safeName + suffix;
+            }
+            count++;
+        }
+        return uniqueName;
+    }
+}

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertPdfJsonController.java

@@ -39,6 +39,8 @@ import stirling.software.common.util.WebResponseUtils;
 public class ConvertPdfJsonController {
 
     private static final Pattern FILE_EXTENSION_PATTERN = Pattern.compile("[.][^.]+$");
+    private static final Pattern WHITESPACE_PATTERN = Pattern.compile("[\\r\\n\\t]+");
+    private static final Pattern NON_PRINTABLE_PATTERN = Pattern.compile("[^\\x20-\\x7E]");
     private final PdfJsonConversionService pdfJsonConversionService;
 
     @Autowired(required = false)
@@ -259,7 +261,10 @@ public class ConvertPdfJsonController {
             if (length > 0) {
                 int start = Math.max(0, length - 64);
                 tail = new String(jsonBytes, start, length - start, StandardCharsets.UTF_8);
-                tail = tail.replaceAll("[\\r\\n\\t]+", " ").replaceAll("[^\\x20-\\x7E]", "?");
+                tail =
+                        NON_PRINTABLE_PATTERN
+                                .matcher(WHITESPACE_PATTERN.matcher(tail).replaceAll(" "))
+                                .replaceAll("?");
             }
             log.debug(
                     "Returning {} JSON response ({} bytes, endsWithJson={}, tail='{}')",
@@ -421,9 +426,9 @@ public class ConvertPdfJsonController {
     private String truncateForLog(String value) {
         int max = 64;
         if (value.length() <= max) {
-            return value.replaceAll("[\\r\\n\\t]+", " ");
+            return WHITESPACE_PATTERN.matcher(value).replaceAll(" ");
         }
-        return value.substring(0, max).replaceAll("[\\r\\n\\t]+", " ") + "...";
+        return WHITESPACE_PATTERN.matcher(value.substring(0, max)).replaceAll(" ") + "...";
     }
 
     /**

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertPdfJsonExceptionHandler.java

@@ -9,13 +9,13 @@ import org.springframework.web.bind.annotation.ControllerAdvice;
 import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.ResponseBody;
 
-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.exception.CacheUnavailableException;
 
+import tools.jackson.databind.ObjectMapper;
+
 @ControllerAdvice(assignableTypes = ConvertPdfJsonController.class)
 @Slf4j
 @RequiredArgsConstructor

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertWebsiteToPDF.java

@@ -166,7 +166,7 @@ public class ConvertWebsiteToPDF {
     private String fetchRemoteHtml(String url) throws IOException, InterruptedException {
         HttpClient client =
                 HttpClient.newBuilder()
-                        .followRedirects(HttpClient.Redirect.NORMAL)
+                        .followRedirects(HttpClient.Redirect.NEVER)
                         .connectTimeout(Duration.ofSeconds(10))
                         .build();
 
@@ -180,7 +180,7 @@ public class ConvertWebsiteToPDF {
         HttpResponse<String> response =
                 client.send(request, HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));
 
-        if (response.statusCode() >= 400 || response.body() == null) {
+        if (response.statusCode() >= 300 || response.body() == null) {
             throw ExceptionUtils.createIOException(
                     "error.httpRequestFailed",
                     "Failed to retrieve remote HTML. Status: {0}",

app/core/src/main/java/stirling/software/SPDF/controller/api/form/FormFillController.java

@@ -1,12 +1,15 @@
-package stirling.software.proprietary.controller.api.form;
+package stirling.software.SPDF.controller.api.form;
 
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
+import java.io.StringWriter;
 import java.nio.charset.StandardCharsets;
 import java.util.List;
 import java.util.Map;
 
 import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.poi.ss.usermodel.*;
+import org.apache.poi.xssf.usermodel.XSSFWorkbook;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -16,7 +19,7 @@ import org.springframework.web.bind.annotation.RequestPart;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.multipart.MultipartFile;
 
-import com.fasterxml.jackson.databind.ObjectMapper;
+import com.opencsv.CSVWriter;
 
 import io.github.pixee.security.Filenames;
 import io.swagger.v3.oas.annotations.Operation;
@@ -30,8 +33,11 @@ import lombok.RequiredArgsConstructor;
 import stirling.software.common.model.FormFieldWithCoordinates;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.ExceptionUtils;
+import stirling.software.common.util.FormUtils;
 import stirling.software.common.util.WebResponseUtils;
-import stirling.software.proprietary.util.FormUtils;
+
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.ObjectMapper;
 
 @RestController
 @RequestMapping("/api/v1/form")
@@ -139,6 +145,117 @@ public class FormFillController {
         }
     }
 
+    @PostMapping(value = "/extract-csv", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @Operation(
+            summary = "Extract form fields as CSV",
+            description =
+                    "Returns a CSV file containing all form field names and their current values")
+    public ResponseEntity<byte[]> extractCsv(
+            @Parameter(
+                            description = "The input PDF file",
+                            required = true,
+                            content =
+                                    @Content(
+                                            mediaType = MediaType.APPLICATION_PDF_VALUE,
+                                            schema = @Schema(type = "string", format = "binary")))
+                    @RequestParam("file")
+                    MultipartFile file,
+            @RequestParam(value = "data", required = false) MultipartFile data)
+            throws IOException {
+
+        requirePdf(file);
+        try (PDDocument document = pdfDocumentFactory.load(file, true);
+                StringWriter sw = new StringWriter()) {
+
+            FormUtils.repairMissingWidgetPageReferences(document);
+
+            if (data != null && !data.isEmpty()) {
+                Map<String, String> values =
+                        objectMapper.readValue(
+                                data.getInputStream(), new TypeReference<Map<String, String>>() {});
+                FormUtils.applyFieldValues(document, values, false);
+            }
+
+            List<FormUtils.FormFieldInfo> fields = FormUtils.extractFormFields(document);
+
+            try (CSVWriter csvWriter = new CSVWriter(sw)) {
+                String[] header = {"Field Name", "Value"};
+                csvWriter.writeNext(header);
+
+                for (FormUtils.FormFieldInfo field : fields) {
+                    csvWriter.writeNext(new String[] {field.name(), field.value()});
+                }
+            }
+
+            byte[] csvBytes = sw.toString().getBytes(StandardCharsets.UTF_8);
+            String baseName = buildBaseName(file, "extracted");
+            return WebResponseUtils.bytesToWebResponse(
+                    csvBytes, baseName + ".csv", MediaType.parseMediaType("text/csv"));
+        }
+    }
+
+    @PostMapping(value = "/extract-xlsx", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @Operation(
+            summary = "Extract form fields as XLSX",
+            description =
+                    "Returns an Excel (XLSX) file containing all form field names and their current values")
+    public ResponseEntity<byte[]> extractXlsx(
+            @Parameter(
+                            description = "The input PDF file",
+                            required = true,
+                            content =
+                                    @Content(
+                                            mediaType = MediaType.APPLICATION_PDF_VALUE,
+                                            schema = @Schema(type = "string", format = "binary")))
+                    @RequestParam("file")
+                    MultipartFile file,
+            @RequestParam(value = "data", required = false) MultipartFile data)
+            throws IOException {
+
+        requirePdf(file);
+        try (PDDocument document = pdfDocumentFactory.load(file, true);
+                Workbook workbook = new XSSFWorkbook();
+                ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
+
+            FormUtils.repairMissingWidgetPageReferences(document);
+
+            if (data != null && !data.isEmpty()) {
+                Map<String, String> values =
+                        objectMapper.readValue(
+                                data.getInputStream(), new TypeReference<Map<String, String>>() {});
+                FormUtils.applyFieldValues(document, values, false);
+            }
+
+            List<FormUtils.FormFieldInfo> fields = FormUtils.extractFormFields(document);
+            Sheet sheet = workbook.createSheet("Form Fields");
+
+            // Header row
+            Row headerRow = sheet.createRow(0);
+            headerRow.createCell(0).setCellValue("Field Name");
+            headerRow.createCell(1).setCellValue("Value");
+
+            // Data rows
+            int rowNum = 1;
+            for (FormUtils.FormFieldInfo field : fields) {
+                Row row = sheet.createRow(rowNum++);
+                row.createCell(0).setCellValue(field.name());
+                row.createCell(1).setCellValue(FormUtils.safeValue(field.value()));
+            }
+
+            // Auto-size columns
+            sheet.autoSizeColumn(0);
+            sheet.autoSizeColumn(1);
+
+            workbook.write(baos);
+            String baseName = buildBaseName(file, "extracted");
+            return WebResponseUtils.bytesToWebResponse(
+                    baos.toByteArray(),
+                    baseName + ".xlsx",
+                    MediaType.parseMediaType(
+                            "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"));
+        }
+    }
+
     @PostMapping(value = "/modify-fields", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
     @Operation(
             summary = "Modify existing form fields",

app/core/src/main/java/stirling/software/SPDF/controller/api/form/FormPayloadParser.java

@@ -1,6 +1,5 @@
-package stirling.software.proprietary.controller.api.form;
+package stirling.software.SPDF.controller.api.form;
 
-import java.io.IOException;
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.LinkedHashSet;
@@ -8,12 +7,13 @@ import java.util.List;
 import java.util.Map;
 import java.util.Set;
 
-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import stirling.software.common.util.ExceptionUtils;
-import stirling.software.proprietary.util.FormUtils;
+import stirling.software.common.util.FormUtils;
+
+import tools.jackson.core.JacksonException;
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;
 
 final class FormPayloadParser {
 
@@ -32,8 +32,7 @@ final class FormPayloadParser {
 
     private FormPayloadParser() {}
 
-    static Map<String, Object> parseValueMap(ObjectMapper objectMapper, String json)
-            throws IOException {
+    static Map<String, Object> parseValueMap(ObjectMapper objectMapper, String json) {
         if (json == null || json.isBlank()) {
             return Map.of();
         }
@@ -41,7 +40,7 @@ final class FormPayloadParser {
         JsonNode root;
         try {
             root = objectMapper.readTree(json);
-        } catch (IOException e) {
+        } catch (JacksonException e) {
             // Fallback to legacy direct map parse (will throw again if invalid)
             return objectMapper.readValue(json, MAP_TYPE);
         }
@@ -88,14 +87,14 @@ final class FormPayloadParser {
     }
 
     static List<FormUtils.ModifyFormFieldDefinition> parseModificationDefinitions(
-            ObjectMapper objectMapper, String json) throws IOException {
+            ObjectMapper objectMapper, String json) {
         if (json == null || json.isBlank()) {
             return List.of();
         }
         return objectMapper.readValue(json, MODIFY_FIELD_LIST_TYPE);
     }
 
-    static List<String> parseNameList(ObjectMapper objectMapper, String json) throws IOException {
+    static List<String> parseNameList(ObjectMapper objectMapper, String json) {
         if (json == null || json.isBlank()) {
             return List.of();
         }
@@ -119,7 +118,7 @@ final class FormPayloadParser {
                 }
             }
         } else if (root.isTextual()) {
-            final String single = trimToNull(root.asText());
+            final String single = trimToNull(root.asText(""));
             if (single != null) {
                 names.add(single);
             }
@@ -131,7 +130,7 @@ final class FormPayloadParser {
 
         try {
             return objectMapper.readValue(json, STRING_LIST_TYPE);
-        } catch (IOException e) {
+        } catch (JacksonException e) {
             throw ExceptionUtils.createIllegalArgumentException(
                     "error.invalidFormat",
                     "Invalid {0} format: {1}",
@@ -199,7 +198,7 @@ final class FormPayloadParser {
             return null;
         }
         if (node.isTextual()) {
-            return trimToEmpty(node.asText());
+            return trimToEmpty(node.asText(""));
         }
         if (node.isNumber()) {
             return node.numberValue().toString();
@@ -208,7 +207,7 @@ final class FormPayloadParser {
             return Boolean.toString(node.booleanValue());
         }
         // Fallback for other scalar-like nodes
-        return trimToEmpty(node.asText());
+        return trimToEmpty(node.asText(""));
     }
 
     private static void collectNames(JsonNode arrayNode, Set<String> sink) {
@@ -229,7 +228,7 @@ final class FormPayloadParser {
         }
 
         if (node.isTextual()) {
-            return trimToNull(node.asText());
+            return trimToNull(node.asText(""));
         }
 
         if (node.isObject()) {
@@ -264,8 +263,8 @@ final class FormPayloadParser {
     private static Map<String, Object> objectToLinkedMap(JsonNode objectNode) {
         final Map<String, Object> result = new LinkedHashMap<>();
         objectNode
-                .fieldNames()
-                .forEachRemaining(
+                .propertyNames()
+                .forEach(
                         key -> {
                             final JsonNode v = objectNode.get(key);
                             if (v == null || v.isNull()) {

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/ConfigController.java

@@ -9,23 +9,17 @@ import org.springframework.context.ApplicationContext;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.servlet.support.ServletUriComponentsBuilder;
 
 import io.swagger.v3.oas.annotations.Hidden;
 
-import jakarta.servlet.http.HttpServletRequest;
-
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.config.EndpointConfiguration;
 import stirling.software.SPDF.config.EndpointConfiguration.EndpointAvailability;
 import stirling.software.SPDF.config.InitialSetup;
-import stirling.software.SPDF.service.plugin.PluginService;
 import stirling.software.common.annotations.api.ConfigApi;
 import stirling.software.common.configuration.AppConfig;
-import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.model.ApplicationProperties;
-import stirling.software.common.plugins.PluginDescriptorResponse;
 import stirling.software.common.service.ServerCertificateServiceInterface;
 import stirling.software.common.service.UserServiceInterface;
 
@@ -41,7 +35,6 @@ public class ConfigController {
     private final UserServiceInterface userService;
     private final stirling.software.common.service.LicenseServiceInterface licenseService;
     private final stirling.software.SPDF.config.ExternalAppDepConfig externalAppDepConfig;
-    private final PluginService pluginService;
 
     public ConfigController(
             ApplicationProperties applicationProperties,
@@ -53,8 +46,7 @@ public class ConfigController {
                     UserServiceInterface userService,
             @org.springframework.beans.factory.annotation.Autowired(required = false)
                     stirling.software.common.service.LicenseServiceInterface licenseService,
-            stirling.software.SPDF.config.ExternalAppDepConfig externalAppDepConfig,
-            PluginService pluginService) {
+            stirling.software.SPDF.config.ExternalAppDepConfig externalAppDepConfig) {
         this.applicationProperties = applicationProperties;
         this.applicationContext = applicationContext;
         this.endpointConfiguration = endpointConfiguration;
@@ -62,7 +54,6 @@ public class ConfigController {
         this.userService = userService;
         this.licenseService = licenseService;
         this.externalAppDepConfig = externalAppDepConfig;
-        this.pluginService = pluginService;
     }
 
     /**
@@ -168,6 +159,24 @@ public class ConfigController {
                     "defaultHideUnavailableConversions",
                     applicationProperties.getUi().isDefaultHideUnavailableConversions());
 
+            // Hide disabled tools settings
+            configData.put(
+                    "hideDisabledToolsGoogleDrive",
+                    applicationProperties.getUi().getHideDisabledTools().isGoogleDrive());
+            configData.put(
+                    "hideDisabledToolsMobileQRScanner",
+                    applicationProperties.getUi().getHideDisabledTools().isMobileQRScanner());
+
+            // Google Drive backend settings (only if enabled)
+            ApplicationProperties.Premium.ProFeatures.GoogleDrive googleDrive =
+                    applicationProperties.getPremium().getProFeatures().getGoogleDrive();
+            if (googleDrive.isEnabled()) {
+                configData.put("googleDriveEnabled", true);
+                configData.put("googleDriveClientId", googleDrive.getClientId());
+                configData.put("googleDriveApiKey", googleDrive.getApiKey());
+                configData.put("googleDriveAppId", googleDrive.getAppId());
+            }
+
             // Security settings
             // enableLogin requires both the config flag AND proprietary features to be loaded
             // If userService is null, proprietary module isn't loaded
@@ -297,10 +306,6 @@ public class ConfigController {
                 // Version/machine info not available
             }
 
-            // config directory path
-            configData.put("basePath", InstallationPathConfig.getPath());
-            configData.put("pluginsPath", InstallationPathConfig.getPluginsPath());
-
             return ResponseEntity.ok(configData);
 
         } catch (Exception e) {
@@ -310,23 +315,6 @@ public class ConfigController {
         }
     }
 
-    @GetMapping("/plugins")
-    public ResponseEntity<List<PluginDescriptorResponse>> getPlugins(HttpServletRequest request) {
-        String baseUrl =
-                ServletUriComponentsBuilder.fromRequestUri(request)
-                        .replacePath(null)
-                        .replaceQuery(null)
-                        .build()
-                        .toUriString();
-
-        List<PluginDescriptorResponse> mapped =
-                pluginService.getPlugins().stream()
-                        .map(descriptor -> PluginDescriptorResponse.from(descriptor, baseUrl))
-                        .toList();
-
-        return ResponseEntity.ok(mapped);
-    }
-
     @GetMapping("/endpoint-enabled")
     public ResponseEntity<Boolean> isEndpointEnabled(
             @RequestParam(name = "endpoint") String endpoint) {

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/ExtractImageScansController.java

@@ -67,7 +67,7 @@ public class ExtractImageScansController {
         MultipartFile inputFile = request.getFileInput();
 
         String fileName = inputFile.getOriginalFilename();
-        String extension = fileName.substring(fileName.lastIndexOf(".") + 1);
+        String extension = fileName.substring(fileName.lastIndexOf('.') + 1);
 
         List<String> images = new ArrayList<>();
 

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/ExtractImagesController.java

@@ -5,6 +5,7 @@ import java.awt.image.BufferedImage;
 import java.awt.image.RenderedImage;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.util.Arrays;
@@ -28,6 +29,7 @@ import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
 
 import io.swagger.v3.oas.annotations.Operation;
 
@@ -42,6 +44,8 @@ import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.ImageProcessingUtils;
+import stirling.software.common.util.TempFile;
+import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;
 
 @MiscApi
@@ -50,6 +54,7 @@ import stirling.software.common.util.WebResponseUtils;
 public class ExtractImagesController {
 
     private final CustomPDFDocumentFactory pdfDocumentFactory;
+    private final TempFileManager tempFileManager;
 
     @AutoJobPostMapping(consumes = MediaType.MULTIPART_FORM_DATA_VALUE, value = "/extract-images")
     @MultiFileResponse
@@ -59,112 +64,115 @@ public class ExtractImagesController {
                     "This endpoint extracts images from a given PDF file and returns them in a zip"
                             + " file. Users can specify the output image format. Input:PDF"
                             + " Output:IMAGE/ZIP Type:SIMO")
-    public ResponseEntity<byte[]> extractImages(@ModelAttribute PDFExtractImagesRequest request)
+    public ResponseEntity<StreamingResponseBody> extractImages(
+            @ModelAttribute PDFExtractImagesRequest request)
             throws IOException, InterruptedException, ExecutionException {
         MultipartFile file = request.getFileInput();
         String format = request.getFormat();
         boolean allowDuplicates = Boolean.TRUE.equals(request.getAllowDuplicates());
-        PDDocument document = pdfDocumentFactory.load(file);
-
-        // Determine if multithreading should be used based on PDF size or number of pages
-        boolean useMultithreading = shouldUseMultithreading(file, document);
-
-        // Create ByteArrayOutputStream to write zip file to byte array
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-
-        // Create ZipOutputStream to create zip file
-        ZipOutputStream zos = new ZipOutputStream(baos);
-
-        // Set compression level
-        zos.setLevel(Deflater.BEST_COMPRESSION);
 
         String filename = GeneralUtils.removeExtension(file.getOriginalFilename());
         Set<byte[]> processedImages = new HashSet<>();
 
-        if (useMultithreading) {
-            // Executor service to handle multithreading
-            ExecutorService executor =
-                    Executors.newFixedThreadPool(Runtime.getRuntime().availableProcessors());
-            Set<Future<Void>> futures = new HashSet<>();
+        TempFile zipTempFile = new TempFile(tempFileManager, ".zip");
+        try (ZipOutputStream zos =
+                        new ZipOutputStream(Files.newOutputStream(zipTempFile.getPath()));
+                PDDocument document = pdfDocumentFactory.load(file)) {
 
-            // Safely iterate over each page, handling corrupt PDFs where page count might be wrong
-            try {
-                int pageCount = document.getPages().getCount();
-                log.debug("Document reports {} pages", pageCount);
+            // Set compression level
+            zos.setLevel(Deflater.BEST_COMPRESSION);
 
-                int consecutiveFailures = 0;
+            // Determine if multithreading should be used based on PDF size or number of pages
+            boolean useMultithreading = shouldUseMultithreading(file, document);
 
-                for (int pgNum = 0; pgNum < pageCount; pgNum++) {
-                    try {
-                        PDPage page = document.getPage(pgNum);
-                        consecutiveFailures = 0; // Reset on success
-                        final int currentPageNum = pgNum + 1; // Convert to 1-based page numbering
-                        Future<Void> future =
-                                executor.submit(
-                                        () -> {
-                                            try {
-                                                // Call the image extraction method for each page
-                                                extractImagesFromPage(
-                                                        page,
-                                                        format,
-                                                        filename,
-                                                        currentPageNum,
-                                                        processedImages,
-                                                        zos,
-                                                        allowDuplicates);
-                                            } catch (Exception e) {
-                                                // Log the error and continue processing other pages
-                                                ExceptionUtils.logException(
-                                                        "image extraction from page "
-                                                                + currentPageNum,
-                                                        e);
-                                            }
+            if (useMultithreading) {
+                ExecutorService executor = Executors.newVirtualThreadPerTaskExecutor();
+                Set<Future<Void>> futures = new HashSet<>();
 
-                                            return null; // Callable requires a return type
-                                        });
+                try {
+                    int pageCount = document.getPages().getCount();
+                    log.debug("Document reports {} pages", pageCount);
 
-                        // Add the Future object to the list to track completion
-                        futures.add(future);
-                    } catch (Exception e) {
-                        consecutiveFailures++;
-                        ExceptionUtils.logException("page access for page " + (pgNum + 1), e);
+                    int consecutiveFailures = 0;
 
-                        if (consecutiveFailures >= 3) {
-                            log.warn("Stopping page iteration after 3 consecutive failures");
-                            break;
+                    for (int pgNum = 0; pgNum < pageCount; pgNum++) {
+                        try {
+                            PDPage page = document.getPage(pgNum);
+                            consecutiveFailures = 0; // Reset on success
+                            final int currentPageNum =
+                                    pgNum + 1; // Convert to 1-based page numbering
+                            Future<Void> future =
+                                    executor.submit(
+                                            () -> {
+                                                try {
+                                                    // Call the image extraction method for each
+                                                    // page
+                                                    extractImagesFromPage(
+                                                            page,
+                                                            format,
+                                                            filename,
+                                                            currentPageNum,
+                                                            processedImages,
+                                                            zos,
+                                                            allowDuplicates);
+                                                } catch (Exception e) {
+                                                    // Log the error and continue processing other
+                                                    // pages
+                                                    ExceptionUtils.logException(
+                                                            "image extraction from page "
+                                                                    + currentPageNum,
+                                                            e);
+                                                }
+
+                                                return null; // Callable requires a return type
+                                            });
+
+                            // Add the Future object to the list to track completion
+                            futures.add(future);
+                        } catch (Exception e) {
+                            consecutiveFailures++;
+                            ExceptionUtils.logException("page access for page " + (pgNum + 1), e);
+
+                            if (consecutiveFailures >= 3) {
+                                log.warn("Stopping page iteration after 3 consecutive failures");
+                                break;
+                            }
                         }
                     }
+                } catch (Exception e) {
+                    ExceptionUtils.logException("page count determination", e);
+                    throw e;
                 }
-            } catch (Exception e) {
-                ExceptionUtils.logException("page count determination", e);
-                throw e;
-            }
 
-            // Wait for all tasks to complete
-            for (Future<Void> future : futures) {
-                future.get();
-            }
+                // Wait for all tasks to complete
+                for (Future<Void> future : futures) {
+                    future.get();
+                }
 
-            // Close executor service
-            executor.shutdown();
-        } else {
-            // Single-threaded extraction
-            for (int pgNum = 0; pgNum < document.getPages().getCount(); pgNum++) {
-                PDPage page = document.getPage(pgNum);
-                extractImagesFromPage(
-                        page, format, filename, pgNum + 1, processedImages, zos, allowDuplicates);
+                // Close executor service
+                executor.shutdown();
+            } else {
+                // Single-threaded extraction
+                for (int pgNum = 0; pgNum < document.getPages().getCount(); pgNum++) {
+                    PDPage page = document.getPage(pgNum);
+                    extractImagesFromPage(
+                            page,
+                            format,
+                            filename,
+                            pgNum + 1,
+                            processedImages,
+                            zos,
+                            allowDuplicates);
+                }
             }
+            // document and zos closed by try-with-resources
+        } catch (Exception e) {
+            zipTempFile.close();
+            throw e;
         }
 
-        // Close PDDocument and ZipOutputStream
-        document.close();
-        zos.close();
-
-        // Create ByteArrayResource from byte array
-        byte[] zipContents = baos.toByteArray();
-
-        return WebResponseUtils.baosToWebResponse(
-                baos, filename + "_extracted-images.zip", MediaType.APPLICATION_OCTET_STREAM);
+        return WebResponseUtils.zipFileToWebResponse(
+                zipTempFile, filename + "_extracted-images.zip");
     }
 
     private boolean shouldUseMultithreading(MultipartFile file, PDDocument document) {
@@ -215,13 +223,17 @@ public class ExtractImagesController {
                     // Convert to standard RGB colorspace if needed
                     BufferedImage bufferedImage = convertToRGB(renderedImage, format);
 
-                    // Write image to zip file
+                    // Encode image outside the lock to allow parallel encoding across threads
                     String imageName = filename + "_page_" + pageNum + "_" + count++ + "." + format;
+                    ByteArrayOutputStream imageBaos = new ByteArrayOutputStream();
+                    ImageIO.write(bufferedImage, format, imageBaos);
+                    byte[] imageData = imageBaos.toByteArray();
+
+                    // Write encoded bytes to zip under lock (ZipOutputStream requires
+                    // serialization)
                     synchronized (zos) {
                         zos.putNextEntry(new ZipEntry(imageName));
-                        ByteArrayOutputStream imageBaos = new ByteArrayOutputStream();
-                        ImageIO.write(bufferedImage, format, imageBaos);
-                        zos.write(imageBaos.toByteArray());
+                        zos.write(imageData);
                         zos.closeEntry();
                     }
                 }

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/OCRController.java

@@ -94,7 +94,7 @@ public class OCRController {
             throws IOException, InterruptedException {
         MultipartFile inputFile = request.getFileInput();
         List<String> selectedLanguages = request.getLanguages();
-        Boolean sidecar = request.isSidecar();
+        boolean sidecar = request.isSidecar();
         Boolean deskew = request.isDeskew();
         Boolean clean = request.isClean();
         Boolean cleanFinal = request.isCleanFinal();
@@ -246,10 +246,12 @@ public class OCRController {
             command.add("--clean-final");
         }
         if (ocrType != null && !ocrType.isEmpty()) {
-            if ("skip-text".equals(ocrType)) {
-                command.add("--skip-text");
-            } else if ("force-ocr".equals(ocrType)) {
+            if ("force-ocr".equals(ocrType)) {
                 command.add("--force-ocr");
+            } else {
+                // Default for 'Normal' and 'skip-text': use --skip-text
+                // ocrmypdf 17+ requires explicit flag when PDF already contains text
+                command.add("--skip-text");
             }
         }
         command.add("--invalidate-digital-signatures");
@@ -378,11 +380,12 @@ public class OCRController {
                         List<String> command = new ArrayList<>();
                         command.add("tesseract");
                         command.add(imagePath.toString());
-                        command.add(
+                        String outputBase =
                                 new File(
                                                 tempOutputDir,
                                                 String.format(Locale.ROOT, "page_%d", pageNum))
-                                        .toString());
+                                        .toString();
+                        command.add(outputBase);
                         command.add("-l");
                         command.add(String.join("+", selectedLanguages));
                         command.add("pdf"); // Always output PDF
@@ -400,6 +403,18 @@ public class OCRController {
                                     result.getRc());
                         }
 
+                        // Verify the OCR'd PDF was created
+                        if (!pageOutputPath.exists()) {
+                            log.warn(
+                                    "Tesseract did not create expected output file: {}. Page may be blank or unreadable.",
+                                    pageOutputPath.getAbsolutePath());
+                            // Save original page without OCR as fallback
+                            try (PDDocument pageDoc = new PDDocument()) {
+                                pageDoc.addPage(page);
+                                pageDoc.save(pageOutputPath);
+                            }
+                        }
+
                         // Add OCR'd PDF to merger
                         merger.addSource(pageOutputPath);
                     } else {