Merge branch 'main' into AppImage_fix

# Description of Changes

This pull request updates the `.github/CODEOWNERS` file to reflect
changes in code ownership. The main updates are the addition of
`@balazs-szucs` as a code owner for several directories and some cleanup
of existing owner assignments.

Ownership updates:

* Added `@balazs-szucs` as a code owner for `/app/**`, `/frontend/**`,
`/app/core/src/main/resources/static/**`, and `/.github/**`.

Cleanup:

* Removed duplicate owner from `/docker/backend/**` entry.

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing)
for more details.

.github/CODEOWNERS

@@ -2,20 +2,17 @@
 * @Frooodle @Ludy87 @jbrunton96 @ConnorYoh
 
 # Backend
-/app/** @DarioGii @Frooodle @Ludy87 @jbrunton96 @ConnorYoh
-
-#V1 frontend
-/app/core/src/main/resources/static/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87
-/app/core/src/main/resources/templates/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87
+/app/** @DarioGii @Frooodle @Ludy87 @jbrunton96 @ConnorYoh @balazs-szucs
 
 #V2 frontend
-/frontend/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle
+/frontend/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @balazs-szucs
+/app/core/src/main/resources/static/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87 @balazs-szucs
 
 #V2 docker
-/docker/backend/** @Frooodle @Ludy87 @DarioGii @Ludy87
+/docker/backend/** @Frooodle @Ludy87 @DarioGii
 /docker/frontend/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87
 /docker/compose/** @reecebrowne @ConnorYoh @EthanHealy01 @DarioGii @jbrunton96 @Frooodle @Ludy87
 
 
 #GHA (All users)
-/.github/** @reecebrowne @ConnorYoh @EthanHealy01 @DarioGii @jbrunton96 @Frooodle @Ludy87
+/.github/** @reecebrowne @ConnorYoh @EthanHealy01 @DarioGii @jbrunton96 @Frooodle @Ludy87 @balazs-szucs

.github/workflows/multiOSReleases.yml

@@ -26,6 +26,18 @@ on:
   release:
     types: [created]
 
+# cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref_name || github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -75,15 +87,15 @@ jobs:
                 echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
                 ;;
               "linux")
-                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b appimage","name":"linux-x86_64-appimage"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b deb","name":"linux-x86_64-deb"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b rpm","name":"linux-x86_64-rpm"}]}' >> $GITHUB_OUTPUT
                 ;;
               *)
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b appimage","name":"linux-x86_64-appimage"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b deb","name":"linux-x86_64-deb"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b rpm","name":"linux-x86_64-rpm"}]}' >> $GITHUB_OUTPUT
                 ;;
             esac
           else
             # For push/release events, build all platforms
-            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b appimage","name":"linux-x86_64-appimage"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b deb","name":"linux-x86_64-deb"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b rpm","name":"linux-x86_64-rpm"}]}' >> $GITHUB_OUTPUT
           fi
 
   build-jars:
@@ -170,10 +182,60 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Install dependencies (ubuntu only)
-        if: matrix.platform == 'ubuntu-22.04'
+        if: matrix.platform == 'ubuntu-22.04' && matrix.name != 'linux-x86_64-appimage'
         run: |
           sudo apt-get update
-          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
+          # Dependencies explanation:
+          # - libwebkit2gtk-4.1-dev: WebKit engine for Tauri v2 (4.0 was for v1)
+          # - libappindicator3-dev: System tray support
+          # - librsvg2-dev: SVG rendering
+          # - patchelf: Required for AppImage packaging
+          # - libxdo-dev: Keyboard/mouse automation
+          # - libasound2-dev: Audio support
+          # - libopenblas-dev: GPU acceleration support
+          # - libx11-dev: X11 development files for window system interaction
+          # - libxtst-dev: X11 testing extensions for input simulation
+          # - libxrandr-dev: X11 RandR extension for display configuration
+          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libxdo-dev libasound2-dev libopenblas-dev libx11-dev libxtst-dev libxrandr-dev
+
+      - name: Install macOS DMG tooling
+        if: startsWith(matrix.platform, 'macos')
+        run: |
+          brew list create-dmg >/dev/null 2>&1 || brew install create-dmg
+
+      - name: Install dependencies (appimage only)
+        if: matrix.platform == 'ubuntu-22.04' && matrix.name == 'linux-x86_64-appimage'
+        run: |
+          sudo apt-get update
+
+          sudo apt-get install -y \
+            build-essential \
+            curl \
+            wget \
+            file \
+            libgtk-3-dev \
+            libxdo-dev \
+            libssl-dev \
+            libappindicator3-dev \
+            librsvg2-dev \
+            openjdk-17-jre-headless \
+            patchelf
+            
+          mkdir -p /tmp/ubuntu-packages
+          cd /tmp/ubuntu-packages
+          wget https://launchpadlibrarian.net/723972773/libwebkit2gtk-4.1-0_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download libwebkit2gtk-4.1-0"; exit 1; }
+          wget https://launchpadlibrarian.net/723972761/libwebkit2gtk-4.1-dev_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download libwebkit2gtk-4.1-dev"; exit 1; }
+          wget https://launchpadlibrarian.net/723972770/libjavascriptcoregtk-4.1-0_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download libjavascriptcoregtk-4.1-0"; exit 1; }
+          wget https://launchpadlibrarian.net/723972746/libjavascriptcoregtk-4.1-dev_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download libjavascriptcoregtk-4.1-dev"; exit 1; }
+          wget https://launchpadlibrarian.net/723972735/gir1.2-javascriptcoregtk-4.1_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download gir1.2-javascriptcoregtk-4.1"; exit 1; }
+          wget https://launchpadlibrarian.net/723972739/gir1.2-webkit2-4.1_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download gir1.2-webkit2-4.1"; exit 1; }
+          wget https://launchpadlibrarian.net/606433947/libicu70_70.1-2ubuntu1_amd64.deb || { echo "Failed to download libicu70"; exit 1; }
+          wget https://launchpadlibrarian.net/606433941/libicu-dev_70.1-2ubuntu1_amd64.deb || { echo "Failed to download libicu-dev"; exit 1; }
+          wget https://launchpadlibrarian.net/606433945/icu-devtools_70.1-2ubuntu1_amd64.deb || { echo "Failed to download icu-devtools"; exit 1; }
+          wget https://launchpadlibrarian.net/595623693/libjpeg8_8c-2ubuntu10_amd64.deb || { echo "Failed to download libjpeg8"; exit 1; }
+          wget https://launchpadlibrarian.net/587202140/libjpeg-turbo8_2.1.2-0ubuntu1_amd64.deb || { echo "Failed to download libjpeg-turbo8"; exit 1; }
+          wget https://launchpadlibrarian.net/592959859/xdg-desktop-portal-gtk_1.14.0-1build1_amd64.deb || { echo "Failed to download xdg-desktop-portal-gtk"; exit 1; }
+          sudo apt-get install -y /tmp/ubuntu-packages/*.deb
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -381,6 +443,35 @@ jobs:
           echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
           echo "Certificate imported successfully."
 
+      - name: Check DMG creation dependencies (macOS only)
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        run: |
+          echo "🔍 Checking DMG creation dependencies on ${{ matrix.platform }}..."
+          echo "hdiutil version: $(hdiutil --version || echo 'NOT FOUND')"
+          echo "create-dmg availability: $(which create-dmg || echo 'NOT FOUND')"
+          echo "Available disk space: $(df -h /tmp | tail -1)"
+          echo "macOS version: $(sw_vers -productVersion)"
+          echo "Available tools:"
+          ls -la /usr/bin/hd* || echo "No hd* tools found"
+
+      - name: Generate temporary GPG key for AppImage
+        if: matrix.platform == 'ubuntu-22.04' && matrix.name == 'linux-x86_64-appimage'
+        run: |
+          cat >keyparams <<EOF
+          %no-protection
+          Key-Type: RSA
+          Key-Length: 2048
+          Name-Real: CI AppImage Signer
+          Name-Email: ci-appimage@example.invalid
+          Expire-Date: 0
+          %commit
+          EOF
+          gpg --batch --generate-key keyparams
+          export GPG_FINGERPRINT=$(gpg --batch --with-colons --list-secret-keys | awk -F: '/^fpr:/ {print $10; exit}')
+          echo "GPG_FINGERPRINT=$GPG_FINGERPRINT" >> $GITHUB_ENV
+          echo "Generated temporary GPG key:"
+          gpg --list-secret-keys --keyid-format=long
+
       - name: Build Tauri app
         uses: tauri-apps/tauri-action@v0
         env:
@@ -404,6 +495,15 @@ jobs:
           tauriScript: npx tauri
           args: ${{ matrix.args }}
 
+      - name: Cleanup temporary GPG key
+        if: matrix.platform == 'ubuntu-22.04' && matrix.name == 'linux-x86_64-appimage'
+        run: |
+          if [ -n "${GPG_FINGERPRINT:-}" ]; then
+            gpg --batch --yes --delete-secret-keys "$GPG_FINGERPRINT" || true
+            gpg --batch --yes --delete-keys "$GPG_FINGERPRINT" || true
+          fi
+          rm -f keyparams
+
       # Sign with DigiCert KeyLocker (post-build)
       - name: Sign Windows binaries with DigiCert KeyLocker
         if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
@@ -509,10 +609,13 @@ jobs:
             find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
           elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
             find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
-            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
-          else
+            # find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
+          elif [ "${{ matrix.platform }}" = "ubuntu-22.04" ]; then
             find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.rpm" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.rpm" \;
             find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
+          else
+            echo "Unknown platform: ${{ matrix.platform }}"
           fi
 
       - name: Upload build artifacts
@@ -567,10 +670,11 @@ jobs:
           tag_name: v${{ needs.determine-matrix.outputs.version }}
           generate_release_notes: true
           files: |
-            ./artifacts/**/*.jar
-            ./artifacts/**/*.msi
-            ./artifacts/**/*.dmg
-            ./artifacts/**/*.deb
-            ./artifacts/**/*.AppImage
+            ./artifacts/**/Stirling-PDF-*.jar
+            ./artifacts/**/Stirling-PDF-*.msi
+            ./artifacts/**/Stirling-PDF-*.dmg
+            ./artifacts/**/Stirling-PDF-*.deb
+            ./artifacts/**/Stirling-PDF-*.rpm
+            ./artifacts/**/Stirling-PDF-*.AppImage
           draft: false
           prerelease: false

.github/workflows/push-docker-v2.yml

@@ -1,245 +0,0 @@
-name: Push Docker Image - V2 Branch
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - V2-master
-
-# cancel in-progress jobs if a new job is triggered
-# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
-# or a pull request is updated.
-# It helps to save resources and time by ensuring that only the latest commit is built and tested
-# This is particularly useful for long-running jobs that may take a while to complete.
-# The `group` is set to a combination of the workflow name, event name, and branch name.
-# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
-# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  push:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
-    runs-on: ubuntu-24.04-8core
-    permissions:
-      packages: write
-      id-token: write
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
-        with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
-        with:
-          gradle-version: 8.14
-
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
-
-      - name: Get version number
-        id: versionNumber
-        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
-
-      - name: Install cosign
-        if: github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
-        with:
-          cosign-release: "v2.4.1"
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_API }}
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
-
-      - name: Generate tags for latest (V2-master branch - production)
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref == 'refs/heads/V2-master'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
-            type=raw,value=latest
-
-      - name: Generate tags for latest (V1_V2_merge branch - test)
-        id: meta-test
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref == 'refs/heads/V1_V2_merge'
-        with:
-          images: |
-            ghcr.io/stirling-tools/stirling-pdf-test
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
-            type=raw,value=latest
-
-      - name: Build and push Unified Dockerfile (latest variant)
-        id: build-push-latest
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/embedded/Dockerfile
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.tags || steps.meta-test.outputs.tags }}
-          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.labels || steps.meta-test.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign regular images
-        if: github.ref == 'refs/heads/V2-master'
-        env:
-          DIGEST: ${{ steps.build-push-latest.outputs.digest }}
-          TAGS: ${{ steps.meta.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --yes \
-              --key env://COSIGN_PRIVATE_KEY \
-              "${tag}@${DIGEST}"
-          done
-
-      - name: Generate tags for latest-fat (V2-master branch - production)
-        id: meta-fat
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref == 'refs/heads/V2-master'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
-            type=raw,value=latest-fat
-
-      - name: Generate tags for latest-fat (V1_V2_merge branch - test)
-        id: meta-fat-test
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref == 'refs/heads/V1_V2_merge'
-        with:
-          images: |
-            ghcr.io/stirling-tools/stirling-pdf-test
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
-            type=raw,value=latest-fat
-
-      - name: Build and push Unified Dockerfile (fat variant)
-        id: build-push-fat
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/embedded/Dockerfile.fat
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.tags || steps.meta-fat-test.outputs.tags }}
-          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.labels || steps.meta-fat-test.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign fat images
-        if: github.ref == 'refs/heads/V2-master'
-        env:
-          DIGEST: ${{ steps.build-push-fat.outputs.digest }}
-          TAGS: ${{ steps.meta-fat.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-          done
-
-      - name: Generate tags for ultra-lite (V2-master branch - production)
-        id: meta-lite
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref == 'refs/heads/V2-master'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
-            type=raw,value=latest-ultra-lite
-
-      - name: Generate tags for ultra-lite (V1_V2_merge branch - test)
-        id: meta-lite-test
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref == 'refs/heads/V1_V2_merge'
-        with:
-          images: |
-            ghcr.io/stirling-tools/stirling-pdf-test
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
-            type=raw,value=latest-ultra-lite
-
-      - name: Build and push Unified Dockerfile (ultra-lite variant)
-        id: build-push-lite
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/embedded/Dockerfile.ultra-lite
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.tags || steps.meta-lite-test.outputs.tags }}
-          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.labels || steps.meta-lite-test.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign ultra-lite images
-        if: github.ref == 'refs/heads/V2-master'
-        env:
-          DIGEST: ${{ steps.build-push-lite.outputs.digest }}
-          TAGS: ${{ steps.meta-lite.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-          done

.github/workflows/push-docker.yml

@@ -6,6 +6,8 @@ on:
     branches:
       - master
       - main
+      - V2-master
+      - testMain
 
 # cancel in-progress jobs if a new job is triggered
 # This is useful to avoid running multiple builds for the same branch if a new commit is pushed
@@ -25,7 +27,7 @@ permissions:
 jobs:
   push:
     if: ${{ vars.CI_PROFILE != 'lite' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04-8core
     permissions:
       packages: write
       id-token: write
@@ -47,18 +49,6 @@ jobs:
         with:
           gradle-version: 8.14
 
-      - name: Run Gradle Command
-        run: ./gradlew clean build
-        env:
-          DISABLE_ADDITIONAL_FEATURES: true
-          STIRLING_PDF_DESKTOP_UI: false
-
-      - name: Install cosign
-        if: github.ref == 'refs/heads/master'
-        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
-        with:
-          cosign-release: "v2.4.1"
-
       - name: Set up Docker Buildx
         id: buildx
         uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
@@ -67,6 +57,12 @@ jobs:
         id: versionNumber
         run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
 
+      - name: Install cosign
+        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        with:
+          cosign-release: "v2.4.1"
+
       - name: Login to Docker Hub
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
@@ -87,10 +83,9 @@ jobs:
         id: repoowner
         run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
 
-      - name: Generate tags
+      - name: Generate tags for latest
         id: meta
         uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref != 'refs/heads/main'
         with:
           images: |
             ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -98,13 +93,13 @@ jobs:
             ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
             ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
           tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }},enable=${{ github.ref == 'refs/heads/master' }}
-            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }},enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=alpha,enable=${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/testMain' }}
 
-      - name: Build and push main Dockerfile
-        id: build-push-regular
+      - name: Build and push Unified Dockerfile (latest variant)
+        id: build-push-latest
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        if: github.ref != 'refs/heads/main'
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
@@ -120,9 +115,9 @@ jobs:
           sbom: true
 
       - name: Sign regular images
-        if: github.ref == 'refs/heads/master'
+        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
         env:
-          DIGEST: ${{ steps.build-push-regular.outputs.digest }}
+          DIGEST: ${{ steps.build-push-latest.outputs.digest }}
           TAGS: ${{ steps.meta.outputs.tags }}
           COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
           COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
@@ -133,10 +128,10 @@ jobs:
               "${tag}@${DIGEST}"
           done
 
-      - name: Generate tags ultra-lite
-        id: meta2
+      - name: Generate tags for latest-fat
+        id: meta-fat
         uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref != 'refs/heads/main'
+        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
         with:
           images: |
             ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -144,43 +139,13 @@ jobs:
             ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
             ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
           tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite,enable=${{ github.ref == 'refs/heads/master' }}
-            type=raw,value=latest-ultra-lite,enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=latest-fat,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
 
-      - name: Build and push Dockerfile-ultra-lite
-        id: build-push-lite
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        if: github.ref != 'refs/heads/main'
-        with:
-          context: .
-          file: ./docker/embedded/Dockerfile.ultra-lite
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ steps.meta2.outputs.tags }}
-          labels: ${{ steps.meta2.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Generate tags fat
-        id: meta3
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat,enable=${{ github.ref == 'refs/heads/master' }}
-            type=raw,value=latest-fat,enable=${{ github.ref == 'refs/heads/master' }}
-            type=raw,value=alpha,enable=${{ github.ref == 'refs/heads/main' }}
-
-      - name: Build and push main Dockerfile fat
+      - name: Build and push Unified Dockerfile (fat variant)
         id: build-push-fat
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
@@ -188,18 +153,62 @@ jobs:
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
-          tags: ${{ steps.meta3.outputs.tags }}
-          labels: ${{ steps.meta3.outputs.labels }}
+          tags: ${{ steps.meta-fat.outputs.tags }}
+          labels: ${{ steps.meta-fat.outputs.labels }}
           build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
           platforms: linux/amd64,linux/arm64/v8
           provenance: true
           sbom: true
 
       - name: Sign fat images
-        if: github.ref == 'refs/heads/master'
+        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
         env:
           DIGEST: ${{ steps.build-push-fat.outputs.digest }}
-          TAGS: ${{ steps.meta3.outputs.tags }}
+          TAGS: ${{ steps.meta-fat.outputs.tags }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: |
+          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
+            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
+          done
+
+      - name: Generate tags for ultra-lite
+        id: meta-lite
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
+        with:
+          images: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=latest-ultra-lite,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+
+      - name: Build and push Unified Dockerfile (ultra-lite variant)
+        id: build-push-lite
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./docker/embedded/Dockerfile.ultra-lite
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ steps.meta-lite.outputs.tags }}
+          labels: ${{ steps.meta-lite.outputs.labels }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Sign ultra-lite images
+        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
+        env:
+          DIGEST: ${{ steps.build-push-lite.outputs.digest }}
+          TAGS: ${{ steps.meta-lite.outputs.tags }}
           COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
           COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
         run: |

.github/workflows/tauri-build.yml

@@ -23,6 +23,18 @@ on:
   push:
     branches: [main]
 
+# cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref_name || github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -33,6 +45,11 @@ jobs:
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
       - name: Determine build matrix
         id: set-matrix
         run: |
@@ -45,15 +62,15 @@ jobs:
                 echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
                 ;;
               "linux")
-                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b appimage","name":"linux-x86_64-appimage"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b deb","name":"linux-x86_64-deb"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b rpm","name":"linux-x86_64-rpm"}]}' >> $GITHUB_OUTPUT
                 ;;
               *)
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b appimage","name":"linux-x86_64-appimage"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b deb","name":"linux-x86_64-deb"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b rpm","name":"linux-x86_64-rpm"}]}' >> $GITHUB_OUTPUT
                 ;;
             esac
           else
             # For PR/push events, build all platforms
-            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b appimage","name":"linux-x86_64-appimage"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b deb","name":"linux-x86_64-deb"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b rpm","name":"linux-x86_64-rpm"}]}' >> $GITHUB_OUTPUT
           fi
 
   build:
@@ -74,11 +91,61 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Install dependencies (ubuntu only)
-        if: matrix.platform == 'ubuntu-22.04'
+      - name: install dependencies (ubuntu only)
+        if: matrix.platform == 'ubuntu-22.04' && matrix.name != 'linux-x86_64-appimage'
         run: |
           sudo apt-get update
-          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
+          # Dependencies explanation:
+          # - libwebkit2gtk-4.1-dev: WebKit engine for Tauri v2 (4.0 was for v1)
+          # - libappindicator3-dev: System tray support
+          # - librsvg2-dev: SVG rendering
+          # - patchelf: Required for AppImage packaging
+          # - libxdo-dev: Keyboard/mouse automation
+          # - libasound2-dev: Audio support
+          # - libopenblas-dev: GPU acceleration support
+          # - libx11-dev: X11 development files for window system interaction
+          # - libxtst-dev: X11 testing extensions for input simulation
+          # - libxrandr-dev: X11 RandR extension for display configuration
+          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libxdo-dev libasound2-dev libopenblas-dev libx11-dev libxtst-dev libxrandr-dev
+
+      - name: Install macOS DMG tooling
+        if: startsWith(matrix.platform, 'macos')
+        run: |
+          brew list create-dmg >/dev/null 2>&1 || brew install create-dmg
+
+      - name: Install dependencies (appimage only)
+        if: matrix.platform == 'ubuntu-22.04' && matrix.name == 'linux-x86_64-appimage'
+        run: |
+          sudo apt-get update
+
+          sudo apt-get install -y \
+            build-essential \
+            curl \
+            wget \
+            file \
+            libgtk-3-dev \
+            libxdo-dev \
+            libssl-dev \
+            libappindicator3-dev \
+            librsvg2-dev \
+            openjdk-17-jre-headless \
+            patchelf
+            
+          mkdir -p /tmp/ubuntu-packages
+          cd /tmp/ubuntu-packages
+          wget https://launchpadlibrarian.net/723972773/libwebkit2gtk-4.1-0_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download libwebkit2gtk-4.1-0"; exit 1; }
+          wget https://launchpadlibrarian.net/723972761/libwebkit2gtk-4.1-dev_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download libwebkit2gtk-4.1-dev"; exit 1; }
+          wget https://launchpadlibrarian.net/723972770/libjavascriptcoregtk-4.1-0_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download libjavascriptcoregtk-4.1-0"; exit 1; }
+          wget https://launchpadlibrarian.net/723972746/libjavascriptcoregtk-4.1-dev_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download libjavascriptcoregtk-4.1-dev"; exit 1; }
+          wget https://launchpadlibrarian.net/723972735/gir1.2-javascriptcoregtk-4.1_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download gir1.2-javascriptcoregtk-4.1"; exit 1; }
+          wget https://launchpadlibrarian.net/723972739/gir1.2-webkit2-4.1_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download gir1.2-webkit2-4.1"; exit 1; }
+          wget https://launchpadlibrarian.net/606433947/libicu70_70.1-2ubuntu1_amd64.deb || { echo "Failed to download libicu70"; exit 1; }
+          wget https://launchpadlibrarian.net/606433941/libicu-dev_70.1-2ubuntu1_amd64.deb || { echo "Failed to download libicu-dev"; exit 1; }
+          wget https://launchpadlibrarian.net/606433945/icu-devtools_70.1-2ubuntu1_amd64.deb || { echo "Failed to download icu-devtools"; exit 1; }
+          wget https://launchpadlibrarian.net/595623693/libjpeg8_8c-2ubuntu10_amd64.deb || { echo "Failed to download libjpeg8"; exit 1; }
+          wget https://launchpadlibrarian.net/587202140/libjpeg-turbo8_2.1.2-0ubuntu1_amd64.deb || { echo "Failed to download libjpeg-turbo8"; exit 1; }
+          wget https://launchpadlibrarian.net/592959859/xdg-desktop-portal-gtk_1.14.0-1build1_amd64.deb || { echo "Failed to download xdg-desktop-portal-gtk"; exit 1; }
+          sudo apt-get install -y /tmp/ubuntu-packages/*.deb
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -99,6 +166,18 @@ jobs:
           java-version: "21"
           distribution: "temurin"
 
+      - name: Make libjvm discoverable (appimage only)
+        if: matrix.platform == 'ubuntu-22.04' && matrix.name == 'linux-x86_64-appimage'
+        run: |
+          JAVA_LIBJVM="$JAVA_HOME/lib/server/libjvm.so"
+          if [ -f "$JAVA_LIBJVM" ]; then
+            sudo ln -sf "$JAVA_LIBJVM" /usr/lib/libjvm.so
+            echo "Linked libjvm from $JAVA_LIBJVM"
+          else
+            echo "libjvm not found at $JAVA_LIBJVM"
+            exit 1
+          fi
+
       - name: Build Java backend with JLink
         working-directory: ./
         shell: bash
@@ -174,7 +253,7 @@ jobs:
 
       - name: Install frontend dependencies
         working-directory: ./frontend
-        run: npm install
+        run: npm ci
 
       # DigiCert KeyLocker Setup (Cloud HSM)
       - name: Setup DigiCert KeyLocker
@@ -298,6 +377,24 @@ jobs:
           echo "Available tools:"
           ls -la /usr/bin/hd* || echo "No hd* tools found"
 
+      - name: Generate temporary GPG key for AppImage
+        if: matrix.platform == 'ubuntu-22.04' && matrix.name == 'linux-x86_64-appimage'
+        run: |
+          cat >keyparams <<EOF
+          %no-protection
+          Key-Type: RSA
+          Key-Length: 2048
+          Name-Real: CI AppImage Signer
+          Name-Email: ci-appimage@example.invalid
+          Expire-Date: 0
+          %commit
+          EOF
+          gpg --batch --generate-key keyparams
+          export GPG_FINGERPRINT=$(gpg --batch --with-colons --list-secret-keys | awk -F: '/^fpr:/ {print $10; exit}')
+          echo "GPG_FINGERPRINT=$GPG_FINGERPRINT" >> $GITHUB_ENV
+          echo "Generated temporary GPG key:"
+          gpg --list-secret-keys --keyid-format=long
+
       - name: Build Tauri app
         uses: tauri-apps/tauri-action@v0
         env:
@@ -308,19 +405,33 @@ jobs:
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
+          # APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
           VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
           VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
-          # Only enable Windows signing in Tauri when on main
-          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
+          # Enable Windows signing only when ALL of the following are true:
+          #   - The build is running on the Windows platform (matrix.platform == 'windows-latest')
+          #   - The build is triggered from the main branch (github.ref == 'refs/heads/main')
+          #   - The DigiCert KeyLocker HSM is NOT being used (env.SM_API_KEY == '')
+          #   - A Windows certificate is available (env.WINDOWS_CERTIFICATE != '')
+          # If all conditions are met, SIGN=1 (enable signing); otherwise, SIGN=0 (disable signing).
+          SIGN: ${{ (matrix.platform == 'windows-latest' && github.ref == 'refs/heads/main' && env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
           CI: true
         with:
           projectPath: ./frontend
           tauriScript: npx tauri
           args: ${{ matrix.args }}
 
+      - name: Cleanup temporary GPG key
+        if: matrix.platform == 'ubuntu-22.04' && matrix.name == 'linux-x86_64-appimage'
+        run: |
+          if [ -n "${GPG_FINGERPRINT:-}" ]; then
+            gpg --batch --yes --delete-secret-keys "$GPG_FINGERPRINT" || true
+            gpg --batch --yes --delete-keys "$GPG_FINGERPRINT" || true
+          fi
+          rm -f keyparams
+
       # Sign with DigiCert KeyLocker (post-build)
       - name: Sign Windows binaries with DigiCert KeyLocker
         if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
@@ -507,10 +618,13 @@ jobs:
             find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
           elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
             find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
-            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
-          else
+            # find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
+          elif [ "${{ matrix.platform }}" = "ubuntu-22.04" ]; then
             find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.rpm" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.rpm" \;
             find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
+          else
+            echo "Unknown platform: ${{ matrix.platform }}"
           fi
 
       - name: Verify Windows Code Signature
@@ -595,18 +709,21 @@ jobs:
             fi
           elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
             echo "Checking for macOS artifacts..."
-            find . -name "*.dmg" -o -name "*.app" | head -5
-            if [ $(find . -name "*.dmg" -o -name "*.app" | wc -l) -eq 0 ]; then
+            find . -name "*.dmg" | head -5
+            if [ $(find . -name "*.dmg" | wc -l) -eq 0 ]; then
               echo "❌ No macOS artifacts found"
               exit 1
             fi
-          else
+          elif [ "${{ matrix.platform }}" = "ubuntu-22.04" ]; then
             echo "Checking for Linux artifacts..."
-            find . -name "*.deb" -o -name "*.AppImage" | head -5
-            if [ $(find . -name "*.deb" -o -name "*.AppImage" | wc -l) -eq 0 ]; then
+            find . -name "*.deb" -o -name "*.AppImage" -o -name "*.rpm" | head -5
+            if [ $(find . -name "*.deb" -o -name "*.AppImage" -o -name "*.rpm" | wc -l) -eq 0 ]; then
               echo "❌ No Linux artifacts found"
               exit 1
             fi
+          else
+            echo "Unknown platform: ${{ matrix.platform }}"
+            exit 1
           fi
 
           echo "✅ Build artifacts found for ${{ matrix.name }}"
@@ -616,7 +733,7 @@ jobs:
         run: |
           cd ./frontend/src-tauri/target
           echo "Artifact sizes for ${{ matrix.name }}:"
-          find . -name "*.exe" -o -name "*.dmg" -o -name "*.deb" -o -name "*.AppImage" -o -name "*.msi" | while read file; do
+          find . -name "*.exe" -o -name "*.dmg" -o -name "*.deb" -o -name "*.AppImage"  -o -name "*.rpm" -o -name "*.msi" | while read file; do
             if [ -f "$file" ]; then
               size=$(stat -c%s "$file" 2>/dev/null || stat -f%z "$file" 2>/dev/null || echo "unknown")
               echo "$file: $size bytes"

app/common/build.gradle

@@ -37,6 +37,7 @@ dependencies {
     api 'com.drewnoakes:metadata-extractor:2.19.0' // Image metadata extractor
     api 'com.vladsch.flexmark:flexmark-html2md-converter:0.64.8'
     api "org.apache.pdfbox:pdfbox:$pdfboxVersion"
+    api "org.apache.pdfbox:pdfbox-io:$pdfboxVersion"
     api "org.apache.pdfbox:xmpbox:$pdfboxVersion"
     api "org.apache.pdfbox:preflight:$pdfboxVersion"
     api 'com.github.junrar:junrar:7.5.7' // RAR archive support for CBR files

app/common/src/main/java/stirling/software/common/util/CbrUtils.java

@@ -129,7 +129,12 @@ public class CbrUtils {
                                         new PDRectangle(pdImage.getWidth(), pdImage.getHeight()));
                         document.addPage(page);
                         try (PDPageContentStream contentStream =
-                                new PDPageContentStream(document, page)) {
+                                new PDPageContentStream(
+                                        document,
+                                        page,
+                                        PDPageContentStream.AppendMode.OVERWRITE,
+                                        true,
+                                        true)) {
                             contentStream.drawImage(pdImage, 0, 0);
                         }
                     } catch (IOException e) {

app/common/src/main/java/stirling/software/common/util/CbzUtils.java

@@ -97,7 +97,12 @@ public class CbzUtils {
                                         new PDRectangle(pdImage.getWidth(), pdImage.getHeight()));
                         document.addPage(page);
                         try (PDPageContentStream contentStream =
-                                new PDPageContentStream(document, page)) {
+                                new PDPageContentStream(
+                                        document,
+                                        page,
+                                        PDPageContentStream.AppendMode.OVERWRITE,
+                                        true,
+                                        true)) {
                             contentStream.drawImage(pdImage, 0, 0);
                         }
                     } catch (IOException e) {

app/common/src/main/java/stirling/software/common/util/ExceptionUtils.java

@@ -41,7 +41,7 @@ import lombok.extern.slf4j.Slf4j;
  * <pre>{@code
  * // In service layer - create exception with ExceptionUtils
  * try {
- *     PDDocument doc = PDDocument.load(file);
+ *     PDDocument doc = Loader.loadPDF(file);
  * } catch (IOException e) {
  *     throw ExceptionUtils.createPdfCorruptedException("during load", e);
  * }

app/common/src/main/java/stirling/software/common/util/PdfToCbrUtils.java

@@ -60,6 +60,7 @@ public class PdfToCbrUtils {
 
     private static byte[] createCbrFromPdf(PDDocument document, int dpi) throws IOException {
         PDFRenderer pdfRenderer = new PDFRenderer(document);
+        pdfRenderer.setSubsamplingAllowed(true); // Enable subsampling to reduce memory usage
 
         Path tempDir = Files.createTempDirectory("stirling-pdf-cbr-");
         List<Path> generatedImages = new ArrayList<>();

app/common/src/main/java/stirling/software/common/util/PdfToCbzUtils.java

@@ -55,6 +55,7 @@ public class PdfToCbzUtils {
 
     private static byte[] createCbzFromPdf(PDDocument document, int dpi) throws IOException {
         PDFRenderer pdfRenderer = new PDFRenderer(document);
+        pdfRenderer.setSubsamplingAllowed(true); // Enable subsampling to reduce memory usage
 
         try (ByteArrayOutputStream cbzOutputStream = new ByteArrayOutputStream();
                 ZipOutputStream zipOut = new ZipOutputStream(cbzOutputStream)) {

app/common/src/main/java/stirling/software/common/util/PdfUtils.java

@@ -119,11 +119,11 @@ public class PdfUtils {
 
     public boolean hasTextOnPage(PDPage page, String phrase) throws IOException {
         PDFTextStripper textStripper = new PDFTextStripper();
-        PDDocument tempDoc = new PDDocument();
-        tempDoc.addPage(page);
-        String pageText = textStripper.getText(tempDoc);
-        tempDoc.close();
-        return pageText.contains(phrase);
+        try (PDDocument tempDoc = new PDDocument()) {
+            tempDoc.addPage(page);
+            String pageText = textStripper.getText(tempDoc);
+            return pageText.contains(phrase);
+        }
     }
 
     public byte[] convertFromPdf(
@@ -153,7 +153,8 @@ public class PdfUtils {
                     maxSafeDpi);
         }
 
-        try (PDDocument document = pdfDocumentFactory.load(inputStream)) {
+        try (PDDocument document = pdfDocumentFactory.load(inputStream);
+                ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
             PDFRenderer pdfRenderer = new PDFRenderer(document);
             pdfRenderer.setSubsamplingAllowed(true);
             if (!includeAnnotations) {
@@ -161,9 +162,6 @@ public class PdfUtils {
             }
             int pageCount = document.getNumberOfPages();
 
-            // Create a ByteArrayOutputStream to save the image(s) to
-            ByteArrayOutputStream baos = new ByteArrayOutputStream();
-
             if (singleImage) {
                 if ("tiff".equals(imageType.toLowerCase(Locale.ROOT))
                         || "tif".equals(imageType.toLowerCase(Locale.ROOT))) {
@@ -400,55 +398,61 @@ public class PdfUtils {
      */
     public PDDocument convertPdfToPdfImage(PDDocument document) throws IOException {
         PDDocument imageDocument = new PDDocument();
-        PDFRenderer pdfRenderer = new PDFRenderer(document);
-        pdfRenderer.setSubsamplingAllowed(true);
-        for (int page = 0; page < document.getNumberOfPages(); ++page) {
-            final int pageIndex = page;
-            BufferedImage bim;
+        try {
+            PDFRenderer pdfRenderer = new PDFRenderer(document);
+            pdfRenderer.setSubsamplingAllowed(true);
+            for (int page = 0; page < document.getNumberOfPages(); ++page) {
+                final int pageIndex = page;
+                BufferedImage bim;
 
-            // Use global maximum DPI setting, fallback to 300 if not set
-            int renderDpi = 300; // Default fallback
-            ApplicationProperties properties =
-                    ApplicationContextProvider.getBean(ApplicationProperties.class);
-            if (properties != null && properties.getSystem() != null) {
-                renderDpi = properties.getSystem().getMaxDPI();
-            }
-            final int dpi = renderDpi;
-
-            try {
-                bim =
-                        ExceptionUtils.handleOomRendering(
-                                pageIndex + 1,
-                                dpi,
-                                () ->
-                                        pdfRenderer.renderImageWithDPI(
-                                                pageIndex, dpi, ImageType.RGB));
-            } catch (IllegalArgumentException e) {
-                if (e.getMessage() != null
-                        && e.getMessage().contains("Maximum size of image exceeded")) {
-                    throw ExceptionUtils.createIllegalArgumentException(
-                            "error.pageTooBigFor300Dpi",
-                            "PDF page {0} is too large to render at 300 DPI. The resulting image"
-                                    + " would exceed Java's maximum array size. Please use a lower DPI"
-                                    + " value for PDF-to-image conversion.",
-                            pageIndex + 1);
+                // Use global maximum DPI setting, fallback to 300 if not set
+                int renderDpi = 300; // Default fallback
+                ApplicationProperties properties =
+                        ApplicationContextProvider.getBean(ApplicationProperties.class);
+                if (properties != null && properties.getSystem() != null) {
+                    renderDpi = properties.getSystem().getMaxDPI();
                 }
-                throw e;
+                final int dpi = renderDpi;
+
+                try {
+                    bim =
+                            ExceptionUtils.handleOomRendering(
+                                    pageIndex + 1,
+                                    dpi,
+                                    () ->
+                                            pdfRenderer.renderImageWithDPI(
+                                                    pageIndex, dpi, ImageType.RGB));
+                } catch (IllegalArgumentException e) {
+                    if (e.getMessage() != null
+                            && e.getMessage().contains("Maximum size of image exceeded")) {
+                        throw ExceptionUtils.createIllegalArgumentException(
+                                "error.pageTooBigFor300Dpi",
+                                "PDF page {0} is too large to render at 300 DPI. The resulting image"
+                                        + " would exceed Java's maximum array size. Please use a lower DPI"
+                                        + " value for PDF-to-image conversion.",
+                                pageIndex + 1);
+                    }
+                    throw e;
+                }
+                PDPage originalPage = document.getPage(page);
+
+                float width = originalPage.getMediaBox().getWidth();
+                float height = originalPage.getMediaBox().getHeight();
+
+                PDPage newPage = new PDPage(new PDRectangle(width, height));
+                imageDocument.addPage(newPage);
+                PDImageXObject pdImage = LosslessFactory.createFromImage(imageDocument, bim);
+                try (PDPageContentStream contentStream =
+                        new PDPageContentStream(
+                                imageDocument, newPage, AppendMode.APPEND, true, true)) {
+                    contentStream.drawImage(pdImage, 0, 0, width, height);
+                }
+                bim.flush();
             }
-            PDPage originalPage = document.getPage(page);
-
-            float width = originalPage.getMediaBox().getWidth();
-            float height = originalPage.getMediaBox().getHeight();
-
-            PDPage newPage = new PDPage(new PDRectangle(width, height));
-            imageDocument.addPage(newPage);
-            PDImageXObject pdImage = LosslessFactory.createFromImage(imageDocument, bim);
-            PDPageContentStream contentStream =
-                    new PDPageContentStream(imageDocument, newPage, AppendMode.APPEND, true, true);
-            contentStream.drawImage(pdImage, 0, 0, width, height);
-            contentStream.close();
+            return imageDocument;
+        } catch (Exception e) {
+            throw e;
         }
-        return imageDocument;
     }
 
     private BufferedImage prepareImageForPdfToImage(int maxWidth, int height, String imageType) {

app/common/src/main/java/stirling/software/common/util/WebResponseUtils.java

@@ -69,7 +69,6 @@ public class WebResponseUtils {
         // Open Byte Array and save document to it
         ByteArrayOutputStream baos = new ByteArrayOutputStream();
         document.save(baos);
-        document.close();
 
         return baosToWebResponse(baos, docName);
     }

app/common/src/main/java/stirling/software/common/util/misc/CustomColorReplaceStrategy.java

@@ -146,13 +146,18 @@ public class CustomColorReplaceStrategy extends ReplaceAndInvertColorStrategy {
             // Save the modified PDF to a ByteArrayOutputStream
             ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
             document.save(byteArrayOutputStream);
-            document.close();
 
             // Prepare the modified PDF for download
             ByteArrayInputStream inputStream =
                     new ByteArrayInputStream(byteArrayOutputStream.toByteArray());
             InputStreamResource resource = new InputStreamResource(inputStream);
             return resource;
+        } finally {
+            try {
+                Files.deleteIfExists(file.toPath());
+            } catch (IOException e) {
+                log.warn("Failed to delete temporary file: {}", file.getAbsolutePath(), e);
+            }
         }
     }
 

app/common/src/main/java/stirling/software/common/util/misc/InvertFullColorStrategy.java

@@ -7,6 +7,7 @@ import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
 import java.nio.file.Files;
+import java.nio.file.Path;
 
 import javax.imageio.ImageIO;
 
@@ -19,11 +20,14 @@ import org.apache.pdfbox.rendering.PDFRenderer;
 import org.springframework.core.io.InputStreamResource;
 import org.springframework.web.multipart.MultipartFile;
 
+import lombok.extern.slf4j.Slf4j;
+
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.api.misc.ReplaceAndInvert;
 import stirling.software.common.util.ApplicationContextProvider;
 import stirling.software.common.util.ExceptionUtils;
 
+@Slf4j
 public class InvertFullColorStrategy extends ReplaceAndInvertColorStrategy {
 
     public InvertFullColorStrategy(MultipartFile file, ReplaceAndInvert replaceAndInvert) {
@@ -43,6 +47,8 @@ public class InvertFullColorStrategy extends ReplaceAndInvertColorStrategy {
             try (PDDocument document = Loader.loadPDF(tempFile.getFile())) {
                 // Render each page and invert colors
                 PDFRenderer pdfRenderer = new PDFRenderer(document);
+                pdfRenderer.setSubsamplingAllowed(
+                        true); // Enable subsampling to reduce memory usage
                 for (int page = 0; page < document.getNumberOfPages(); page++) {
                     BufferedImage image;
 
@@ -73,12 +79,27 @@ public class InvertFullColorStrategy extends ReplaceAndInvertColorStrategy {
                         PDImageXObject pdImage =
                                 PDImageXObject.createFromFileByContent(tempImageFile, document);
 
+                        // Delete temp file immediately after loading into memory to prevent disk
+                        // exhaustion
+                        // The file content is now in the PDImageXObject, so the file is no longer
+                        // needed
+                        try {
+                            Files.deleteIfExists(tempImageFile.toPath());
+                            tempImageFile = null; // Mark as deleted to avoid double deletion
+                        } catch (IOException e) {
+                            log.warn(
+                                    "Failed to delete temporary image file: {}",
+                                    tempImageFile.getAbsolutePath(),
+                                    e);
+                        }
+
                         try (PDPageContentStream contentStream =
                                 new PDPageContentStream(
                                         document,
                                         pdPage,
                                         PDPageContentStream.AppendMode.OVERWRITE,
-                                        true)) {
+                                        true,
+                                        true)) { // resetContext=true ensures clean graphics state
                             contentStream.drawImage(
                                     pdImage,
                                     0,
@@ -87,8 +108,16 @@ public class InvertFullColorStrategy extends ReplaceAndInvertColorStrategy {
                                     pdPage.getMediaBox().getHeight());
                         }
                     } finally {
+                        // Safety net: ensure temp file is deleted even if an exception occurred
                         if (tempImageFile != null && tempImageFile.exists()) {
-                            Files.delete(tempImageFile.toPath());
+                            try {
+                                Files.deleteIfExists(tempImageFile.toPath());
+                            } catch (IOException e) {
+                                log.warn(
+                                        "Failed to delete temporary image file: {}",
+                                        tempImageFile.getAbsolutePath(),
+                                        e);
+                            }
                         }
                     }
                 }
@@ -128,7 +157,10 @@ public class InvertFullColorStrategy extends ReplaceAndInvertColorStrategy {
 
     // Helper method to convert BufferedImage to InputStream
     private File convertToBufferedImageTpFile(BufferedImage image) throws IOException {
-        File file = File.createTempFile("image", ".png");
+        // Use Files.createTempFile instead of File.createTempFile for better security and modern
+        // Java practices
+        Path tempPath = Files.createTempFile("image", ".png");
+        File file = tempPath.toFile();
         ImageIO.write(image, "png", file);
         return file;
     }

app/common/src/test/java/stirling/software/common/util/WebResponseUtilsTest.java

@@ -92,8 +92,7 @@ public class WebResponseUtilsTest {
 
     @Test
     public void testPdfDocToWebResponse() {
-        try {
-            PDDocument document = new PDDocument();
+        try (PDDocument document = new PDDocument()) {
             document.addPage(new org.apache.pdfbox.pdmodel.PDPage());
             String docName = "sample.pdf";
 

app/core/src/main/java/stirling/software/SPDF/SPDFApplication.java

@@ -141,10 +141,10 @@ public class SPDFApplication {
         String backendUrl = appConfig.getBackendUrl();
         String contextPath = appConfig.getContextPath();
         String serverPort = appConfig.getServerPort();
-        baseUrlStatic = backendUrl;
+        baseUrlStatic = normalizeBackendUrl(backendUrl, serverPort);
         contextPathStatic = contextPath;
         serverPortStatic = serverPort;
-        String url = backendUrl + ":" + getStaticPort() + contextPath;
+        String url = buildFullUrl(baseUrlStatic, getStaticPort(), contextPathStatic);
 
         // Log Tauri mode information
         if (Boolean.parseBoolean(System.getProperty("STIRLING_PDF_TAURI_MODE", "false"))) {
@@ -210,7 +210,7 @@ public class SPDFApplication {
 
     private static void printStartupLogs() {
         log.info("Stirling-PDF Started.");
-        String url = baseUrlStatic + ":" + getStaticPort() + contextPathStatic;
+        String url = buildFullUrl(baseUrlStatic, getStaticPort(), contextPathStatic);
         log.info("Navigate to {}", url);
     }
 
@@ -258,4 +258,79 @@ public class SPDFApplication {
     public static String getStaticContextPath() {
         return contextPathStatic;
     }
+
+    private static String buildFullUrl(String backendUrl, String port, String contextPath) {
+        String normalizedBase = normalizeBackendUrl(backendUrl, port);
+
+        String normalizedContextPath =
+                (contextPath == null || contextPath.isBlank() || "/".equals(contextPath))
+                        ? "/"
+                        : (contextPath.startsWith("/") ? contextPath : "/" + contextPath);
+
+        return normalizedBase + normalizedContextPath;
+    }
+
+    private static String normalizeBackendUrl(String backendUrl, String port) {
+        String trimmedBase =
+                (backendUrl == null || backendUrl.isBlank())
+                        ? "http://localhost"
+                        : backendUrl.trim().replaceAll("/+$", "");
+        boolean hasScheme = trimmedBase.matches("^[a-zA-Z][a-zA-Z0-9+.-]*://.*");
+        String baseForParsing = hasScheme ? trimmedBase : "http://" + trimmedBase;
+        Integer parsedPort = parsePort(port);
+
+        try {
+            java.net.URI uri = new java.net.URI(baseForParsing);
+            String scheme = uri.getScheme() == null ? "http" : uri.getScheme();
+            String host = uri.getHost();
+            if (host == null) {
+                return appendPortFallback(trimmedBase, parsedPort);
+            }
+
+            boolean defaultHttp =
+                    "http".equalsIgnoreCase(scheme) && Integer.valueOf(80).equals(parsedPort);
+            boolean defaultHttps =
+                    "https".equalsIgnoreCase(scheme) && Integer.valueOf(443).equals(parsedPort);
+
+            int effectivePort = uri.getPort();
+            if (effectivePort == -1 && parsedPort != null && !defaultHttp && !defaultHttps) {
+                effectivePort = parsedPort;
+            }
+
+            java.net.URI rebuilt =
+                    new java.net.URI(
+                            scheme,
+                            uri.getUserInfo(),
+                            host,
+                            effectivePort,
+                            uri.getPath(),
+                            uri.getQuery(),
+                            uri.getFragment());
+            return rebuilt.toString();
+        } catch (java.net.URISyntaxException e) {
+            return appendPortFallback(trimmedBase, parsedPort);
+        }
+    }
+
+    private static Integer parsePort(String port) {
+        if (port == null || port.isBlank()) {
+            return null;
+        }
+        try {
+            int parsed = Integer.parseInt(port);
+            return parsed > 0 ? parsed : null;
+        } catch (NumberFormatException e) {
+            return null;
+        }
+    }
+
+    private static String appendPortFallback(String trimmedBase, Integer port) {
+        if (port == null) {
+            return trimmedBase;
+        }
+        if (trimmedBase.matches(".+:\\d+$")) {
+            return trimmedBase;
+        }
+        return trimmedBase + ":" + port;
+    }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/BookletImpositionController.java

@@ -29,6 +29,7 @@ import lombok.RequiredArgsConstructor;
 import stirling.software.SPDF.model.api.general.BookletImpositionRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.service.CustomPDFDocumentFactory;
+import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.WebResponseUtils;
 
 @RestController
@@ -68,33 +69,33 @@ public class BookletImpositionController {
                     "Booklet printing uses 2 pages per side (landscape). For 4-up, use the N-up feature.");
         }
 
-        PDDocument sourceDocument = pdfDocumentFactory.load(file);
-        int totalPages = sourceDocument.getNumberOfPages();
+        try (PDDocument sourceDocument = pdfDocumentFactory.load(file)) {
+            int totalPages = sourceDocument.getNumberOfPages();
 
-        // Create proper booklet with signature-based page ordering
-        PDDocument newDocument =
-                createSaddleBooklet(
-                        sourceDocument,
-                        totalPages,
-                        addBorder,
-                        spineLocation,
-                        addGutter,
-                        gutterSize,
-                        doubleSided,
-                        duplexPass,
-                        flipOnShortEdge);
+            // Create proper booklet with signature-based page ordering
+            try (PDDocument newDocument =
+                    createSaddleBooklet(
+                            sourceDocument,
+                            totalPages,
+                            addBorder,
+                            spineLocation,
+                            addGutter,
+                            gutterSize,
+                            doubleSided,
+                            duplexPass,
+                            flipOnShortEdge)) {
 
-        sourceDocument.close();
+                ByteArrayOutputStream baos = new ByteArrayOutputStream();
+                newDocument.save(baos);
 
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-        newDocument.save(baos);
-        newDocument.close();
-
-        byte[] result = baos.toByteArray();
-        return WebResponseUtils.bytesToWebResponse(
-                result,
-                Filenames.toSimpleFileName(file.getOriginalFilename()).replaceFirst("[.][^.]+$", "")
-                        + "_booklet.pdf");
+                byte[] result = baos.toByteArray();
+                return WebResponseUtils.bytesToWebResponse(
+                        result,
+                        GeneralUtils.generateFilename(
+                                Filenames.toSimpleFileName(file.getOriginalFilename()),
+                                "_booklet.pdf"));
+            }
+        }
     }
 
     private static int padToMultipleOf4(int n) {

app/core/src/main/java/stirling/software/SPDF/controller/api/CropController.java

@@ -155,6 +155,7 @@ public class CropController {
             try (PDDocument newDocument =
                     pdfDocumentFactory.createNewDocumentBasedOnOldDocument(sourceDocument)) {
                 PDFRenderer renderer = new PDFRenderer(sourceDocument);
+                renderer.setSubsamplingAllowed(true); // Enable subsampling to reduce memory usage
                 LayerUtility layerUtility = new LayerUtility(newDocument);
 
                 for (int i = 0; i < sourceDocument.getNumberOfPages(); i++) {

app/core/src/main/java/stirling/software/SPDF/controller/api/MergeController.java

@@ -3,6 +3,7 @@ package stirling.software.SPDF.controller.api;
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Comparator;
@@ -27,7 +28,6 @@ import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.multipart.MultipartFile;
-import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
 
 import io.swagger.v3.oas.annotations.Operation;
 
@@ -277,7 +277,7 @@ public class MergeController {
                     "This endpoint merges multiple PDF files into a single PDF file. The merged"
                             + " file will contain all pages from the input files in the order they were"
                             + " provided. Input:PDF Output:PDF Type:MISO")
-    public ResponseEntity<StreamingResponseBody> mergePdfs(
+    public ResponseEntity<byte[]> mergePdfs(
             @ModelAttribute MergePdfsRequest request,
             @RequestParam(value = "fileOrder", required = false) String fileOrder)
             throws IOException {
@@ -304,8 +304,6 @@ public class MergeController {
                             request.getSortType())); // Sort files based on requested sort type
         }
 
-        ResponseEntity<StreamingResponseBody> response;
-
         try (TempFile mt = new TempFile(tempFileManager, ".pdf")) {
 
             PDFMergerUtility mergerUtility = new PDFMergerUtility();
@@ -399,7 +397,7 @@ public class MergeController {
         String mergedFileName =
                 GeneralUtils.generateFilename(firstFilename, "_merged_unsigned.pdf");
 
-        response = WebResponseUtils.pdfFileToWebResponse(outputTempFile, mergedFileName);
-        return response;
+        byte[] pdfBytes = Files.readAllBytes(outputTempFile.getPath());
+        return WebResponseUtils.bytesToWebResponse(pdfBytes, mergedFileName);
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/MultiPageLayoutController.java

@@ -70,108 +70,109 @@ public class MultiPageLayoutController {
                         : (int) Math.sqrt(pagesPerSheet);
         int rows = pagesPerSheet == 2 || pagesPerSheet == 3 ? 1 : (int) Math.sqrt(pagesPerSheet);
 
-        PDDocument sourceDocument = pdfDocumentFactory.load(file);
-        PDDocument newDocument =
-                pdfDocumentFactory.createNewDocumentBasedOnOldDocument(sourceDocument);
-        PDPage newPage = new PDPage(PDRectangle.A4);
-        newDocument.addPage(newPage);
+        try (PDDocument sourceDocument = pdfDocumentFactory.load(file)) {
+            try (PDDocument newDocument =
+                    pdfDocumentFactory.createNewDocumentBasedOnOldDocument(sourceDocument)) {
+                int totalPages = sourceDocument.getNumberOfPages();
+                LayerUtility layerUtility = new LayerUtility(newDocument);
 
-        int totalPages = sourceDocument.getNumberOfPages();
-        float cellWidth = newPage.getMediaBox().getWidth() / cols;
-        float cellHeight = newPage.getMediaBox().getHeight() / rows;
+                // Calculate cell dimensions once (all output pages are A4) - declare outside try
+                // blocks
+                float cellWidth = PDRectangle.A4.getWidth() / cols;
+                float cellHeight = PDRectangle.A4.getHeight() / rows;
 
-        PDPageContentStream contentStream =
-                new PDPageContentStream(
-                        newDocument, newPage, PDPageContentStream.AppendMode.APPEND, true, true);
-        LayerUtility layerUtility = new LayerUtility(newDocument);
+                // Process pages in groups of pagesPerSheet, creating a new page and content stream
+                // for each group
+                for (int i = 0; i < totalPages; i += pagesPerSheet) {
+                    // Create a new output page for each group of pagesPerSheet
+                    PDPage newPage = new PDPage(PDRectangle.A4);
+                    newDocument.addPage(newPage);
 
-        float borderThickness = 1.5f; // Specify border thickness as required
-        contentStream.setLineWidth(borderThickness);
-        contentStream.setStrokingColor(Color.BLACK);
+                    // Use try-with-resources for each content stream to ensure proper cleanup
+                    // resetContext=true: Start with a clean graphics state for new content
+                    try (PDPageContentStream contentStream =
+                            new PDPageContentStream(
+                                    newDocument,
+                                    newPage,
+                                    PDPageContentStream.AppendMode.APPEND,
+                                    true,
+                                    true)) {
+                        float borderThickness = 1.5f; // Specify border thickness as required
+                        contentStream.setLineWidth(borderThickness);
+                        contentStream.setStrokingColor(Color.BLACK);
 
-        for (int i = 0; i < totalPages; i++) {
-            if (i != 0 && i % pagesPerSheet == 0) {
-                // Close the current content stream and create a new page and content stream
-                contentStream.close();
-                newPage = new PDPage(PDRectangle.A4);
-                newDocument.addPage(newPage);
-                contentStream =
-                        new PDPageContentStream(
+                        // Process all pages in this group
+                        for (int j = 0; j < pagesPerSheet && (i + j) < totalPages; j++) {
+                            int pageIndex = i + j;
+                            PDPage sourcePage = sourceDocument.getPage(pageIndex);
+                            PDRectangle rect = sourcePage.getMediaBox();
+                            float scaleWidth = cellWidth / rect.getWidth();
+                            float scaleHeight = cellHeight / rect.getHeight();
+                            float scale = Math.min(scaleWidth, scaleHeight);
+
+                            int adjustedPageIndex = j % pagesPerSheet;
+                            int rowIndex = adjustedPageIndex / cols;
+                            int colIndex = adjustedPageIndex % cols;
+
+                            float x =
+                                    colIndex * cellWidth
+                                            + (cellWidth - rect.getWidth() * scale) / 2;
+                            float y =
+                                    newPage.getMediaBox().getHeight()
+                                            - ((rowIndex + 1) * cellHeight
+                                                    - (cellHeight - rect.getHeight() * scale) / 2);
+
+                            contentStream.saveGraphicsState();
+                            contentStream.transform(Matrix.getTranslateInstance(x, y));
+                            contentStream.transform(Matrix.getScaleInstance(scale, scale));
+
+                            PDFormXObject formXObject =
+                                    layerUtility.importPageAsForm(sourceDocument, pageIndex);
+                            contentStream.drawForm(formXObject);
+
+                            contentStream.restoreGraphicsState();
+
+                            if (addBorder) {
+                                // Draw border around each page
+                                float borderX = colIndex * cellWidth;
+                                float borderY =
+                                        newPage.getMediaBox().getHeight()
+                                                - (rowIndex + 1) * cellHeight;
+                                contentStream.addRect(borderX, borderY, cellWidth, cellHeight);
+                                contentStream.stroke();
+                            }
+                        }
+                    } // contentStream is automatically closed here
+                }
+
+                // If any source page is rotated, skip form copying/transformation entirely
+                boolean hasRotation = GeneralFormCopyUtils.hasAnyRotatedPage(sourceDocument);
+                if (hasRotation) {
+                    log.info("Source document has rotated pages; skipping form field copying.");
+                } else {
+                    try {
+                        GeneralFormCopyUtils.copyAndTransformFormFields(
+                                sourceDocument,
                                 newDocument,
-                                newPage,
-                                PDPageContentStream.AppendMode.APPEND,
-                                true,
-                                true);
-            }
+                                totalPages,
+                                pagesPerSheet,
+                                cols,
+                                rows,
+                                cellWidth,
+                                cellHeight);
+                    } catch (Exception e) {
+                        log.warn("Failed to copy and transform form fields: {}", e.getMessage(), e);
+                    }
+                }
 
-            PDPage sourcePage = sourceDocument.getPage(i);
-            PDRectangle rect = sourcePage.getMediaBox();
-            float scaleWidth = cellWidth / rect.getWidth();
-            float scaleHeight = cellHeight / rect.getHeight();
-            float scale = Math.min(scaleWidth, scaleHeight);
-
-            int adjustedPageIndex =
-                    i % pagesPerSheet; // Close the current content stream and create a new
-            // page and content stream
-            int rowIndex = adjustedPageIndex / cols;
-            int colIndex = adjustedPageIndex % cols;
-
-            float x = colIndex * cellWidth + (cellWidth - rect.getWidth() * scale) / 2;
-            float y =
-                    newPage.getMediaBox().getHeight()
-                            - ((rowIndex + 1) * cellHeight
-                                    - (cellHeight - rect.getHeight() * scale) / 2);
-
-            contentStream.saveGraphicsState();
-            contentStream.transform(Matrix.getTranslateInstance(x, y));
-            contentStream.transform(Matrix.getScaleInstance(scale, scale));
-
-            PDFormXObject formXObject = layerUtility.importPageAsForm(sourceDocument, i);
-            contentStream.drawForm(formXObject);
-
-            contentStream.restoreGraphicsState();
-
-            if (addBorder) {
-                // Draw border around each page
-                float borderX = colIndex * cellWidth;
-                float borderY = newPage.getMediaBox().getHeight() - (rowIndex + 1) * cellHeight;
-                contentStream.addRect(borderX, borderY, cellWidth, cellHeight);
-                contentStream.stroke();
-            }
-        }
-
-        contentStream.close();
-
-        // If any source page is rotated, skip form copying/transformation entirely
-        boolean hasRotation = GeneralFormCopyUtils.hasAnyRotatedPage(sourceDocument);
-        if (hasRotation) {
-            log.info("Source document has rotated pages; skipping form field copying.");
-        } else {
-            try {
-                GeneralFormCopyUtils.copyAndTransformFormFields(
-                        sourceDocument,
-                        newDocument,
-                        totalPages,
-                        pagesPerSheet,
-                        cols,
-                        rows,
-                        cellWidth,
-                        cellHeight);
-            } catch (Exception e) {
-                log.warn("Failed to copy and transform form fields: {}", e.getMessage(), e);
-            }
-        }
-
-        sourceDocument.close();
-
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-        newDocument.save(baos);
-        newDocument.close();
-
-        byte[] result = baos.toByteArray();
-        return WebResponseUtils.bytesToWebResponse(
-                result,
-                GeneralUtils.generateFilename(
-                        file.getOriginalFilename(), "_multi_page_layout.pdf"));
+                ByteArrayOutputStream baos = new ByteArrayOutputStream();
+                newDocument.save(baos);
+                byte[] result = baos.toByteArray();
+                return WebResponseUtils.bytesToWebResponse(
+                        result,
+                        GeneralUtils.generateFilename(
+                                file.getOriginalFilename(), "_multi_page_layout.pdf"));
+            } // newDocument is closed here
+        } // sourceDocument is closed here
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/PdfImageRemovalController.java

@@ -53,25 +53,28 @@ public class PdfImageRemovalController {
                     "This endpoint remove images from file to reduce the file size.Input:PDF"
                             + " Output:PDF Type:SISO")
     public ResponseEntity<byte[]> removeImages(@ModelAttribute PDFFile file) throws IOException {
-        // Load the PDF document
-        PDDocument document = pdfDocumentFactory.load(file);
+        // Load the PDF document with proper resource management
+        try (PDDocument document = pdfDocumentFactory.load(file)) {
 
-        // Remove images from the PDF document using the service
-        PDDocument modifiedDocument = pdfImageRemovalService.removeImagesFromPdf(document);
+            // Remove images from the PDF document using the service
+            try (PDDocument modifiedDocument =
+                    pdfImageRemovalService.removeImagesFromPdf(document)) {
 
-        // Create a ByteArrayOutputStream to hold the modified PDF data
-        ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
+                // Create a ByteArrayOutputStream to hold the modified PDF data
+                ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
 
-        // Save the modified PDF document to the output stream
-        modifiedDocument.save(outputStream);
-        modifiedDocument.close();
+                // Save the modified PDF document to the output stream
+                modifiedDocument.save(outputStream);
 
-        // Generate a new filename for the modified PDF
-        String mergedFileName =
-                GeneralUtils.generateFilename(
-                        file.getFileInput().getOriginalFilename(), "_images_removed.pdf");
+                // Generate a new filename for the modified PDF
+                String mergedFileName =
+                        GeneralUtils.generateFilename(
+                                file.getFileInput().getOriginalFilename(), "_images_removed.pdf");
 
-        // Convert the byte array to a web response and return it
-        return WebResponseUtils.bytesToWebResponse(outputStream.toByteArray(), mergedFileName);
+                // Convert the byte array to a web response and return it
+                return WebResponseUtils.bytesToWebResponse(
+                        outputStream.toByteArray(), mergedFileName);
+            }
+        }
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/RearrangePagesPDFController.java

@@ -50,23 +50,25 @@ public class RearrangePagesPDFController {
         MultipartFile pdfFile = request.getFileInput();
         String pagesToDelete = request.getPageNumbers();
 
-        PDDocument document = pdfDocumentFactory.load(pdfFile);
+        try (PDDocument document = pdfDocumentFactory.load(pdfFile)) {
 
-        // Split the page order string into an array of page numbers or range of numbers
-        String[] pageOrderArr = pagesToDelete.split(",");
+            // Split the page order string into an array of page numbers or range of numbers
+            String[] pageOrderArr = pagesToDelete.split(",");
 
-        List<Integer> pagesToRemove =
-                GeneralUtils.parsePageList(pageOrderArr, document.getNumberOfPages(), false);
+            List<Integer> pagesToRemove =
+                    GeneralUtils.parsePageList(pageOrderArr, document.getNumberOfPages(), false);
 
-        Collections.sort(pagesToRemove);
+            Collections.sort(pagesToRemove);
 
-        for (int i = pagesToRemove.size() - 1; i >= 0; i--) {
-            int pageIndex = pagesToRemove.get(i);
-            document.removePage(pageIndex);
+            for (int i = pagesToRemove.size() - 1; i >= 0; i--) {
+                int pageIndex = pagesToRemove.get(i);
+                document.removePage(pageIndex);
+            }
+            return WebResponseUtils.pdfDocToWebResponse(
+                    document,
+                    GeneralUtils.generateFilename(
+                            pdfFile.getOriginalFilename(), "_removed_pages.pdf"));
         }
-        return WebResponseUtils.pdfDocToWebResponse(
-                document,
-                GeneralUtils.generateFilename(pdfFile.getOriginalFilename(), "_removed_pages.pdf"));
     }
 
     private List<Integer> removeFirst(int totalPages) {
@@ -243,41 +245,43 @@ public class RearrangePagesPDFController {
         String pageOrder = request.getPageNumbers();
         String sortType = request.getCustomMode();
         try {
-            // Load the input PDF
-            PDDocument document = pdfDocumentFactory.load(pdfFile);
+            // Load the input PDF with proper resource management
+            try (PDDocument document = pdfDocumentFactory.load(pdfFile)) {
 
-            // Split the page order string into an array of page numbers or range of numbers
-            String[] pageOrderArr = pageOrder != null ? pageOrder.split(",") : new String[0];
-            int totalPages = document.getNumberOfPages();
-            List<Integer> newPageOrder;
-            if (sortType != null
-                    && !sortType.isEmpty()
-                    && !"custom".equals(sortType.toLowerCase(Locale.ROOT))) {
-                newPageOrder = processSortTypes(sortType, totalPages, pageOrder);
-            } else {
-                newPageOrder = GeneralUtils.parsePageList(pageOrderArr, totalPages, false);
+                // Split the page order string into an array of page numbers or range of numbers
+                String[] pageOrderArr = pageOrder != null ? pageOrder.split(",") : new String[0];
+                int totalPages = document.getNumberOfPages();
+                List<Integer> newPageOrder;
+                if (sortType != null
+                        && !sortType.isEmpty()
+                        && !"custom".equals(sortType.toLowerCase(Locale.ROOT))) {
+                    newPageOrder = processSortTypes(sortType, totalPages, pageOrder);
+                } else {
+                    newPageOrder = GeneralUtils.parsePageList(pageOrderArr, totalPages, false);
+                }
+                log.info("newPageOrder = {}", newPageOrder);
+                log.info("totalPages = {}", totalPages);
+                // Create a new list to hold the pages in the new order
+                List<PDPage> newPages = new ArrayList<>();
+                for (int i = 0; i < newPageOrder.size(); i++) {
+                    newPages.add(document.getPage(newPageOrder.get(i)));
+                }
+
+                // Create a new document based on the original one
+                try (PDDocument rearrangedDocument =
+                        pdfDocumentFactory.createNewDocumentBasedOnOldDocument(document)) {
+
+                    // Add the pages in the new order
+                    for (PDPage page : newPages) {
+                        rearrangedDocument.addPage(page);
+                    }
+
+                    return WebResponseUtils.pdfDocToWebResponse(
+                            rearrangedDocument,
+                            GeneralUtils.generateFilename(
+                                    pdfFile.getOriginalFilename(), "_rearranged.pdf"));
+                }
             }
-            log.info("newPageOrder = {}", newPageOrder);
-            log.info("totalPages = {}", totalPages);
-            // Create a new list to hold the pages in the new order
-            List<PDPage> newPages = new ArrayList<>();
-            for (int i = 0; i < newPageOrder.size(); i++) {
-                newPages.add(document.getPage(newPageOrder.get(i)));
-            }
-
-            // Create a new document based on the original one
-            PDDocument rearrangedDocument =
-                    pdfDocumentFactory.createNewDocumentBasedOnOldDocument(document);
-
-            // Add the pages in the new order
-            for (PDPage page : newPages) {
-                rearrangedDocument.addPage(page);
-            }
-
-            return WebResponseUtils.pdfDocToWebResponse(
-                    rearrangedDocument,
-                    GeneralUtils.generateFilename(
-                            pdfFile.getOriginalFilename(), "_rearranged.pdf"));
         } catch (IOException e) {
             ExceptionUtils.logException("document rearrangement", e);
             throw e;

app/core/src/main/java/stirling/software/SPDF/controller/api/RotationController.java

@@ -47,19 +47,20 @@ public class RotationController {
                     "error.angleNotMultipleOf90", "Angle must be a multiple of 90");
         }
 
-        // Load the PDF document
-        PDDocument document = pdfDocumentFactory.load(request);
+        // Load the PDF document with proper resource management
+        try (PDDocument document = pdfDocumentFactory.load(request)) {
 
-        // Get the list of pages in the document
-        PDPageTree pages = document.getPages();
+            // Get the list of pages in the document
+            PDPageTree pages = document.getPages();
 
-        for (PDPage page : pages) {
-            page.setRotation(page.getRotation() + angle);
+            for (PDPage page : pages) {
+                page.setRotation(page.getRotation() + angle);
+            }
+
+            // Return the rotated PDF as a response
+            return WebResponseUtils.pdfDocToWebResponse(
+                    document,
+                    GeneralUtils.generateFilename(pdfFile.getOriginalFilename(), "_rotated.pdf"));
         }
-
-        // Return the rotated PDF as a response
-        return WebResponseUtils.pdfDocToWebResponse(
-                document,
-                GeneralUtils.generateFilename(pdfFile.getOriginalFilename(), "_rotated.pdf"));
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/SplitPdfBySectionsController.java

@@ -1,9 +1,10 @@
 package stirling.software.SPDF.controller.api;
 
+import java.io.ByteArrayOutputStream;
 import java.io.IOException;
-import java.io.OutputStream;
 import java.nio.file.Files;
 import java.util.*;
+import java.util.stream.IntStream;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipOutputStream;
 
@@ -18,38 +19,37 @@ import org.apache.pdfbox.util.Matrix;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
-import org.springframework.web.bind.annotation.PostMapping;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.multipart.MultipartFile;
-import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
 
 import io.swagger.v3.oas.annotations.Operation;
-import io.swagger.v3.oas.annotations.tags.Tag;
 
 import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.SPDF.config.swagger.MultiFileResponse;
 import stirling.software.SPDF.model.SplitTypes;
 import stirling.software.SPDF.model.api.SplitPdfBySectionsRequest;
+import stirling.software.common.annotations.AutoJobPostMapping;
+import stirling.software.common.annotations.api.GeneralApi;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
-import stirling.software.common.util.PDFService;
 import stirling.software.common.util.TempFile;
 import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;
 
-@RestController
-@RequestMapping("/api/v1/general")
-@Tag(name = "General", description = "General APIs")
+@GeneralApi
+@Slf4j
 @RequiredArgsConstructor
 public class SplitPdfBySectionsController {
 
     private final CustomPDFDocumentFactory pdfDocumentFactory;
     private final TempFileManager tempFileManager;
-    private final PDFService pdfService;
 
-    @PostMapping(value = "/split-pdf-by-sections", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @AutoJobPostMapping(
+            consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
+            value = "/split-pdf-by-sections")
+    @MultiFileResponse
     @Operation(
             summary = "Split PDF pages into smaller sections",
             description =
@@ -57,8 +57,8 @@ public class SplitPdfBySectionsController {
                             + " which page to split, and how to split"
                             + " ( halves, thirds, quarters, etc.), both vertically and horizontally."
                             + " Input:PDF Output:ZIP-PDF Type:SISO")
-    public ResponseEntity<StreamingResponseBody> splitPdf(
-            @ModelAttribute SplitPdfBySectionsRequest request) throws Exception {
+    public ResponseEntity<byte[]> splitPdf(@ModelAttribute SplitPdfBySectionsRequest request)
+            throws Exception {
         MultipartFile file = request.getFileInput();
         String pageNumbers = request.getPageNumbers();
         SplitTypes splitMode =
@@ -77,9 +77,10 @@ public class SplitPdfBySectionsController {
             String filename = GeneralUtils.generateFilename(file.getOriginalFilename(), "_split");
 
             if (merge) {
-                TempFile tempFile = new TempFile(tempFileManager, ".pdf");
-                try (PDDocument mergedDoc = pdfDocumentFactory.createNewDocument();
-                        OutputStream out = Files.newOutputStream(tempFile.getPath())) {
+                try (PDDocument mergedDoc =
+                                pdfDocumentFactory.createNewDocumentBasedOnOldDocument(
+                                        sourceDocument);
+                        ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
                     LayerUtility layerUtility = new LayerUtility(mergedDoc);
                     for (int pageIndex = 0;
                             pageIndex < sourceDocument.getNumberOfPages();
@@ -96,9 +97,9 @@ public class SplitPdfBySectionsController {
                             addPageToTarget(sourceDocument, pageIndex, mergedDoc, layerUtility);
                         }
                     }
-                    mergedDoc.save(out);
+                    mergedDoc.save(baos);
+                    return WebResponseUtils.baosToWebResponse(baos, filename + ".pdf");
                 }
-                return WebResponseUtils.pdfFileToWebResponse(tempFile, filename + ".pdf");
             } else {
                 TempFile zipTempFile = new TempFile(tempFileManager, ".zip");
                 try (ZipOutputStream zipOut =
@@ -131,6 +132,13 @@ public class SplitPdfBySectionsController {
                                                         + sectionNum
                                                         + ".pdf";
                                         saveDocToZip(subDoc, zipOut, entryName);
+                                    } catch (IOException e) {
+                                        log.error(
+                                                "Error creating section {} for page {}",
+                                                (i * verti + j + 1),
+                                                pageNum,
+                                                e);
+                                        throw e;
                                     }
                                 }
                             }
@@ -140,12 +148,23 @@ public class SplitPdfBySectionsController {
                                 addPageToTarget(sourceDocument, pageIndex, subDoc, subLayerUtility);
                                 String entryName = filename + "_" + pageNum + "_1.pdf";
                                 saveDocToZip(subDoc, zipOut, entryName);
+                            } catch (IOException e) {
+                                log.error("Error processing unsplit page {}", pageNum, e);
+                                throw e;
                             }
                         }
                     }
+                } catch (IOException e) {
+                    log.error("Error creating ZIP file with split PDF sections", e);
+                    throw e;
                 }
-                return WebResponseUtils.zipFileToWebResponse(zipTempFile, filename + ".zip");
+                byte[] zipBytes = Files.readAllBytes(zipTempFile.getPath());
+                return WebResponseUtils.bytesToWebResponse(
+                        zipBytes, filename + ".zip", MediaType.APPLICATION_OCTET_STREAM);
             }
+        } catch (Exception e) {
+            log.error("Error splitting PDF file: {}", file.getOriginalFilename(), e);
+            throw e;
         }
     }
 
@@ -160,6 +179,9 @@ public class SplitPdfBySectionsController {
         try (PDPageContentStream contentStream =
                 new PDPageContentStream(targetDoc, newPage, AppendMode.APPEND, true, true)) {
             contentStream.drawForm(form);
+        } catch (IOException e) {
+            log.error("Error adding page {} to target document", pageIndex, e);
+            throw e;
         }
     }
 
@@ -197,6 +219,10 @@ public class SplitPdfBySectionsController {
                     contentStream.transform(new Matrix(1, 0, 0, 1, translateX, translateY));
                     contentStream.drawForm(form);
                     contentStream.restoreGraphicsState();
+                } catch (IOException e) {
+                    log.error(
+                            "Error adding split section ({}, {}) for page {}", i, j, pageIndex, e);
+                    throw e;
                 }
             }
         }
@@ -233,6 +259,14 @@ public class SplitPdfBySectionsController {
             contentStream.transform(new Matrix(1, 0, 0, 1, translateX, translateY));
             contentStream.drawForm(form);
             contentStream.restoreGraphicsState();
+        } catch (IOException e) {
+            log.error(
+                    "Error adding single section ({}, {}) for page {} to target",
+                    horizIndex,
+                    vertIndex,
+                    pageIndex,
+                    e);
+            throw e;
         }
     }
 
@@ -264,27 +298,19 @@ public class SplitPdfBySectionsController {
                 break;
 
             case SPLIT_ALL:
-                for (int i = 0; i < totalPages; i++) {
-                    pagesToSplit.add(i);
-                }
+                pagesToSplit.addAll(IntStream.range(0, totalPages).boxed().toList());
                 break;
 
             case SPLIT_ALL_EXCEPT_FIRST:
-                for (int i = 1; i < totalPages; i++) {
-                    pagesToSplit.add(i);
-                }
+                pagesToSplit.addAll(IntStream.range(1, totalPages).boxed().toList());
                 break;
 
             case SPLIT_ALL_EXCEPT_LAST:
-                for (int i = 0; i < totalPages - 1; i++) {
-                    pagesToSplit.add(i);
-                }
+                pagesToSplit.addAll(IntStream.range(0, totalPages - 1).boxed().toList());
                 break;
 
             case SPLIT_ALL_EXCEPT_FIRST_AND_LAST:
-                for (int i = 1; i < totalPages - 1; i++) {
-                    pagesToSplit.add(i);
-                }
+                pagesToSplit.addAll(IntStream.range(1, totalPages - 1).boxed().toList());
                 break;
 
             default:

app/core/src/main/java/stirling/software/SPDF/controller/api/SplitPdfBySizeController.java

@@ -473,34 +473,36 @@ public class SplitPdfBySizeController {
             PDDocument document, ZipOutputStream zipOut, String baseFilename, int index)
             throws IOException {
         log.debug("Starting saveDocumentToZip for document part {}", index);
-        ByteArrayOutputStream outStream = new ByteArrayOutputStream();
+        try (ByteArrayOutputStream outStream = new ByteArrayOutputStream()) {
 
-        try (PDDocument doc = document) {
-            log.debug("Saving document part {} to byte array", index);
-            doc.save(outStream);
-            log.debug("Successfully saved document part {} ({} bytes)", index, outStream.size());
-        } catch (Exception e) {
-            log.error("Error saving document part {} to byte array", index, e);
-            throw ExceptionUtils.createFileProcessingException("split", e);
-        }
+            try (PDDocument doc = document) {
+                log.debug("Saving document part {} to byte array", index);
+                doc.save(outStream);
+                log.debug(
+                        "Successfully saved document part {} ({} bytes)", index, outStream.size());
+            } catch (Exception e) {
+                log.error("Error saving document part {} to byte array", index, e);
+                throw ExceptionUtils.createFileProcessingException("split", e);
+            }
 
-        try {
-            // Create a new zip entry
-            String entryName = baseFilename + "_" + index + ".pdf";
-            log.debug("Creating ZIP entry: {}", entryName);
-            ZipEntry zipEntry = new ZipEntry(entryName);
-            zipOut.putNextEntry(zipEntry);
+            try {
+                // Create a new zip entry
+                String entryName = baseFilename + "_" + index + ".pdf";
+                log.debug("Creating ZIP entry: {}", entryName);
+                ZipEntry zipEntry = new ZipEntry(entryName);
+                zipOut.putNextEntry(zipEntry);
 
-            byte[] bytes = outStream.toByteArray();
-            log.debug("Writing {} bytes to ZIP entry", bytes.length);
-            zipOut.write(bytes);
+                byte[] bytes = outStream.toByteArray();
+                log.debug("Writing {} bytes to ZIP entry", bytes.length);
+                zipOut.write(bytes);
 
-            log.debug("Closing ZIP entry");
-            zipOut.closeEntry();
-            log.debug("Successfully added document part {} to ZIP", index);
-        } catch (Exception e) {
-            log.error("Error adding document part {} to ZIP", index, e);
-            throw ExceptionUtils.createFileProcessingException("split", e);
+                log.debug("Closing ZIP entry");
+                zipOut.closeEntry();
+                log.debug("Successfully added document part {} to ZIP", index);
+            } catch (Exception e) {
+                log.error("Error adding document part {} to ZIP", index, e);
+                throw ExceptionUtils.createFileProcessingException("split", e);
+            }
         }
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertImgPDFController.java

@@ -188,15 +188,15 @@ public class ConvertImgPDFController {
                     bodyBytes = Files.readAllBytes(webpFilePath);
                 } else {
                     // Create a ZIP file containing all WebP images
-                    ByteArrayOutputStream zipOutputStream = new ByteArrayOutputStream();
-                    try (ZipOutputStream zos = new ZipOutputStream(zipOutputStream)) {
+                    try (ByteArrayOutputStream zipOutputStream = new ByteArrayOutputStream();
+                            ZipOutputStream zos = new ZipOutputStream(zipOutputStream)) {
                         for (Path webpFile : webpFiles) {
                             zos.putNextEntry(new ZipEntry(webpFile.getFileName().toString()));
                             Files.copy(webpFile, zos);
                             zos.closeEntry();
                         }
+                        bodyBytes = zipOutputStream.toByteArray();
                     }
-                    bodyBytes = zipOutputStream.toByteArray();
                 }
                 // Clean up the temporary files
                 Files.deleteIfExists(tempFile);

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertOfficeController.java

@@ -196,11 +196,12 @@ public class ConvertOfficeController {
         try {
             file = convertToPdf(inputFile);
 
-            PDDocument doc = pdfDocumentFactory.load(file);
-            return WebResponseUtils.pdfDocToWebResponse(
-                    doc,
-                    GeneralUtils.generateFilename(
-                            inputFile.getOriginalFilename(), "_convertedToPDF.pdf"));
+            try (PDDocument doc = pdfDocumentFactory.load(file)) {
+                return WebResponseUtils.pdfDocToWebResponse(
+                        doc,
+                        GeneralUtils.generateFilename(
+                                inputFile.getOriginalFilename(), "_convertedToPDF.pdf"));
+            }
         } finally {
             if (file != null && file.getParent() != null) {
                 FileUtils.deleteDirectory(file.getParentFile());

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertPDFToPDFA.java

@@ -21,6 +21,7 @@ import org.apache.pdfbox.cos.COSArray;
 import org.apache.pdfbox.cos.COSBase;
 import org.apache.pdfbox.cos.COSDictionary;
 import org.apache.pdfbox.cos.COSName;
+import org.apache.pdfbox.cos.COSStream;
 import org.apache.pdfbox.io.RandomAccessRead;
 import org.apache.pdfbox.io.RandomAccessReadBufferedFile;
 import org.apache.pdfbox.pdfwriter.compress.CompressParameters;
@@ -51,7 +52,7 @@ import org.apache.pdfbox.pdmodel.graphics.image.LosslessFactory;
 import org.apache.pdfbox.pdmodel.graphics.image.PDImageXObject;
 import org.apache.pdfbox.pdmodel.graphics.optionalcontent.PDOptionalContentProperties;
 import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotation;
-import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationTextMarkup;
+import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationHighlight;
 import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationWidget;
 import org.apache.pdfbox.pdmodel.interactive.annotation.PDAppearanceDictionary;
 import org.apache.pdfbox.pdmodel.interactive.viewerpreferences.PDViewerPreferences;
@@ -378,7 +379,6 @@ public class ConvertPDFToPDFA {
         command.add("-sOutputICCProfile=" + colorProfiles.rgb().toAbsolutePath());
         command.add("-sDefaultRGBProfile=" + colorProfiles.rgb().toAbsolutePath());
         command.add("-sDefaultGrayProfile=" + colorProfiles.gray().toAbsolutePath());
-        command.add("-sDefaultCMYKProfile=" + colorProfiles.rgb().toAbsolutePath());
 
         // Font handling optimized for PDF/A CIDSet compliance
         command.add("-dEmbedAllFonts=true");
@@ -673,25 +673,55 @@ public class ConvertPDFToPDFA {
                     if (descriptor == null) continue;
 
                     // Check if this is a Type1 font
-                    if (fontNameStr.contains("Type1")
-                            || descriptor.getFontFile() != null
-                            || (descriptor.getFontFile2() == null
-                                    && descriptor.getFontFile3() == null)) {
+                    boolean isType1 =
+                            isType1Font(font)
+                                    || descriptor.getFontFile() != null
+                                    || (descriptor.getFontFile2() == null
+                                            && descriptor.getFontFile3() == null);
 
-                        String existingCharSet =
-                                descriptor.getCOSObject().getString(COSName.CHAR_SET);
+                    if (isType1) {
+                        COSDictionary descDict = descriptor.getCOSObject();
+                        String existingCharSet = descDict.getString(COSName.CHAR_SET);
 
-                        String glyphSet = buildStandardType1GlyphSet();
-                        if (!glyphSet.isEmpty()) {
-                            if (existingCharSet == null
-                                    || existingCharSet.trim().isEmpty()
-                                    || countGlyphs(existingCharSet) < countGlyphs(glyphSet)) {
-                                descriptor.getCOSObject().setString(COSName.CHAR_SET, glyphSet);
+                        // Check if font is embedded and if CharSet might be invalid
+                        boolean fontEmbedded = font.isEmbedded();
+                        boolean hasFontFile =
+                                descriptor.getFontFile() != null
+                                        || descriptor.getFontFile2() != null
+                                        || descriptor.getFontFile3() != null;
+
+                        // For PDF/A compliance: if CharSet exists but font is subsetted or
+                        // we can't verify it matches the font file, remove it to avoid validation
+                        // errors
+                        if (existingCharSet != null && !existingCharSet.trim().isEmpty()) {
+                            // If the font appears to be subsetted (indicated by subset prefix in
+                            // name)
+                            // or if we can't verify the CharSet is correct, remove it
+                            if (fontNameStr.contains("+") || fontNameStr.contains("Subset")) {
+                                descDict.removeItem(COSName.CHAR_SET);
                                 log.debug(
-                                        "Fixed CharSet for Type1 font {} with {} glyphs (was: {})",
-                                        fontNameStr,
-                                        countGlyphs(glyphSet),
-                                        existingCharSet != null ? countGlyphs(existingCharSet) : 0);
+                                        "Removed potentially invalid CharSet from subsetted Type1 font: {}",
+                                        fontNameStr);
+                            } else if (!hasFontFile && fontEmbedded) {
+                                // Font is embedded but we can't verify CharSet, remove it
+                                descDict.removeItem(COSName.CHAR_SET);
+                                log.debug(
+                                        "Removed unverifiable CharSet from embedded Type1 font: {}",
+                                        fontNameStr);
+                            }
+                        } else if (existingCharSet == null || existingCharSet.trim().isEmpty()) {
+                            // Only add CharSet if font is not subsetted and we can verify it
+                            if (!fontNameStr.contains("+")
+                                    && !fontNameStr.contains("Subset")
+                                    && hasFontFile) {
+                                String glyphSet = buildStandardType1GlyphSet();
+                                if (!glyphSet.isEmpty()) {
+                                    descDict.setString(COSName.CHAR_SET, glyphSet);
+                                    log.debug(
+                                            "Added missing CharSet for Type1 font {} with {} glyphs",
+                                            fontNameStr,
+                                            countGlyphs(glyphSet));
+                                }
                             }
                         }
                     }
@@ -1211,7 +1241,7 @@ public class ConvertPDFToPDFA {
                 List<PDAnnotation> annotations = page.getAnnotations();
                 for (PDAnnotation annot : annotations) {
                     if (ANNOTATION_HIGHLIGHT.equals(annot.getSubtype())
-                            && annot instanceof PDAnnotationTextMarkup highlight) {
+                            && annot instanceof PDAnnotationHighlight highlight) {
                         float[] colorComponents =
                                 highlight.getColor() != null
                                         ? highlight.getColor().getComponents()
@@ -1349,13 +1379,22 @@ public class ConvertPDFToPDFA {
 
             for (COSBase base : ocgArray) {
                 if (base instanceof COSDictionary ocgDict) {
-                    if (!ocgDict.containsKey(COSName.NAME)) {
+                    // Ensure Name entry exists and is not empty
+                    String nameValue = ocgDict.getString(COSName.NAME);
+                    if (nameValue == null || nameValue.trim().isEmpty()) {
                         String newName = "Layer " + unnamedCount++;
                         ocgDict.setString(COSName.NAME, newName);
-                        log.debug("Fixed OCG missing name, set to: {}", newName);
+                        log.debug("Fixed OCG missing or empty name, set to: {}", newName);
                     }
                 }
             }
+        } else if (ocgs instanceof COSDictionary ocgDict) {
+            // Handle case where OCGS is a single dictionary instead of array
+            String nameValue = ocgDict.getString(COSName.NAME);
+            if (nameValue == null || nameValue.trim().isEmpty()) {
+                ocgDict.setString(COSName.NAME, "Layer 1");
+                log.debug("Fixed single OCG missing or empty name");
+            }
         }
     }
 
@@ -1479,7 +1518,9 @@ public class ConvertPDFToPDFA {
         Path pdfaDefFile = createPdfaDefFile(workingDir, colorProfiles, profile);
 
         // Preprocess PDF for PDF/A compliance using the sanitizer
-        Path sanitizedInputPdf = sanitizePdfWithPdfBox(inputPdf);
+        // We add a white background to ensure transparency is flattened correctly against white
+        // instead of black, addressing common PDF/A conversion issues.
+        Path sanitizedInputPdf = sanitizePdfWithPdfBox(inputPdf, true);
         Path preprocessedPdf = sanitizedInputPdf != null ? sanitizedInputPdf : inputPdf;
 
         // For PDF/A-1, clean CIDSet issues that may cause validation failures
@@ -1500,11 +1541,14 @@ public class ConvertPDFToPDFA {
                     buildGhostscriptCommand(
                             inputForGs, outputPdf, colorProfiles, workingDir, profile, pdfaDefFile);
 
+            log.info("Running Ghostscript command: {}", String.join(" ", command));
+
             ProcessExecutorResult result =
                     ProcessExecutor.getInstance(ProcessExecutor.Processes.GHOSTSCRIPT)
                             .runCommandWithOutputHandling(command);
 
             if (result.getRc() != 0) {
+                log.error("Ghostscript failed with output: {}", result.getMessages());
                 throw new IOException("Ghostscript exited with code " + result.getRc());
             }
 
@@ -1665,6 +1709,7 @@ public class ConvertPDFToPDFA {
     }
 
     private byte[] convertWithPdfBoxMethod(Path inputPath, PdfaProfile profile) throws Exception {
+        log.info("Starting PDFBox/LibreOffice conversion for PDF/A-{}", profile.getPart());
         Path tempInputFile = null;
         byte[] fileBytes;
         Path loPdfPath = null;
@@ -1720,17 +1765,20 @@ public class ConvertPDFToPDFA {
         ColorProfiles colorProfiles = prepareColorProfiles(workingDir);
 
         // Sanitize the PDF before PDF/X conversion for better Ghostscript compatibility
-        Path sanitizedInputPdf = sanitizePdfWithPdfBox(inputPdf);
+        Path sanitizedInputPdf = sanitizePdfWithPdfBox(inputPdf, true);
         Path inputForGs = sanitizedInputPdf != null ? sanitizedInputPdf : inputPdf;
 
         List<String> command =
                 buildGhostscriptCommandX(inputForGs, outputPdf, colorProfiles, workingDir, profile);
 
+        log.info("Running Ghostscript PDF/X command: {}", String.join(" ", command));
+
         ProcessExecutorResult result =
                 ProcessExecutor.getInstance(ProcessExecutor.Processes.GHOSTSCRIPT)
                         .runCommandWithOutputHandling(command);
 
         if (result.getRc() != 0) {
+            log.error("Ghostscript PDF/X failed with output: {}", result.getMessages());
             throw new IOException("Ghostscript exited with code " + result.getRc());
         }
 
@@ -1796,12 +1844,12 @@ public class ConvertPDFToPDFA {
         }
     }
 
-    private Path sanitizePdfWithPdfBox(Path inputPdf) {
+    private Path sanitizePdfWithPdfBox(Path inputPdf, boolean addWhiteBackground) {
         try {
             Path sanitizedPath =
                     inputPdf.getParent().resolve("sanitized_" + inputPdf.getFileName().toString());
 
-            sanitizeDocument(inputPdf, sanitizedPath);
+            sanitizeDocument(inputPdf, sanitizedPath, addWhiteBackground);
 
             log.info("PDF sanitized with PDFBox for better Ghostscript compatibility");
             return sanitizedPath;
@@ -1813,7 +1861,8 @@ public class ConvertPDFToPDFA {
         }
     }
 
-    private void sanitizeDocument(Path inputPath, Path outputPath) throws IOException {
+    private void sanitizeDocument(Path inputPath, Path outputPath, boolean addWhiteBackground)
+            throws IOException {
         try (PDDocument doc = Loader.loadPDF(inputPath.toFile())) {
             Map<String, DocumentSanitizer> sanitizers = new LinkedHashMap<>();
             sanitizers.put("Flatten highlight annotations", this::flattenHighlightsToContent);
@@ -1824,6 +1873,11 @@ public class ConvertPDFToPDFA {
             sanitizers.put("Ensure embedded file compliance", this::ensureEmbeddedFileCompliance);
             sanitizers.put(
                     "Fix optional content groups", ConvertPDFToPDFA::fixOptionalContentGroups);
+            sanitizers.put("Fix separation color spaces", this::fixSeparationColorSpaces);
+
+            if (addWhiteBackground) {
+                sanitizers.put("Add white background", this::addWhiteBackground);
+            }
 
             for (Map.Entry<String, DocumentSanitizer> entry : sanitizers.entrySet()) {
                 try {
@@ -1841,6 +1895,191 @@ public class ConvertPDFToPDFA {
         }
     }
 
+    private void fixSeparationColorSpaces(PDDocument doc) throws IOException {
+        Map<String, COSBase> knownTintTransforms = new HashMap<>();
+        Set<COSBase> visitedResources = new HashSet<>();
+
+        // Process all pages first to collect all separation color spaces
+        for (PDPage page : doc.getPages()) {
+            PDResources resources = page.getResources();
+            processResourcesForSeparation(resources, knownTintTransforms, visitedResources);
+        }
+
+        // Process document-level resources if they exist
+        PDDocumentCatalog catalog = doc.getDocumentCatalog();
+        if (catalog != null) {
+            PDResources docResources =
+                    catalog.getAcroForm() != null
+                            ? catalog.getAcroForm().getDefaultResources()
+                            : null;
+            if (docResources != null) {
+                processResourcesForSeparation(docResources, knownTintTransforms, visitedResources);
+            }
+        }
+
+        // Second pass: ensure all separations with the same name use the same tintTransform
+        visitedResources.clear();
+        for (PDPage page : doc.getPages()) {
+            PDResources resources = page.getResources();
+            enforceSeparationConsistency(resources, knownTintTransforms, visitedResources);
+        }
+    }
+
+    private void processResourcesForSeparation(
+            PDResources resources,
+            Map<String, COSBase> knownTintTransforms,
+            Set<COSBase> visitedResources) {
+        if (resources == null) return;
+
+        // Prevent infinite recursion if resources are shared or cyclic
+        if (!visitedResources.add(resources.getCOSObject())) {
+            return;
+        }
+
+        // Check defined ColorSpaces
+        COSDictionary csDict =
+                (COSDictionary) resources.getCOSObject().getDictionaryObject(COSName.COLORSPACE);
+        if (csDict != null) {
+            for (COSName name : csDict.keySet()) {
+                COSBase csVal = csDict.getDictionaryObject(name);
+                checkAndFixSeparation(csVal, knownTintTransforms);
+            }
+        }
+
+        // Recursively check XObjects (Forms)
+        COSDictionary xObjDict =
+                (COSDictionary) resources.getCOSObject().getDictionaryObject(COSName.XOBJECT);
+        if (xObjDict != null) {
+            for (COSName name : xObjDict.keySet()) {
+                COSBase xObj = xObjDict.getDictionaryObject(name);
+                if (xObj instanceof COSStream stream) {
+                    COSName type = (COSName) stream.getDictionaryObject(COSName.SUBTYPE);
+                    if (COSName.FORM.equals(type)) {
+                        COSBase formRes = stream.getDictionaryObject(COSName.RESOURCES);
+                        if (formRes instanceof COSDictionary formResDict) {
+                            processResourcesForSeparation(
+                                    new PDResources(formResDict),
+                                    knownTintTransforms,
+                                    visitedResources);
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    private void checkAndFixSeparation(COSBase cs, Map<String, COSBase> knownTintTransforms) {
+        if (cs instanceof COSArray arr && arr.size() >= 4) {
+            COSBase type = arr.getObject(0);
+            if (COSName.SEPARATION.equals(type)) {
+                // Separation: [/Separation name altSpace tintTransform]
+                COSBase nameBase = arr.getObject(1);
+                if (nameBase instanceof COSName colorName) {
+                    String name = colorName.getName();
+                    COSBase tintTransform = arr.getObject(3);
+
+                    if (knownTintTransforms.containsKey(name)) {
+                        COSBase known = knownTintTransforms.get(name);
+                        // If objects are not identical (same reference), unify them
+                        if (known != tintTransform) {
+                            arr.set(3, known);
+                            log.debug("Unified TintTransform for Separation color: {}", name);
+                        }
+                    } else {
+                        // Store the first encountered tintTransform for this color name
+                        knownTintTransforms.put(name, tintTransform);
+                    }
+                }
+            }
+        }
+    }
+
+    private void enforceSeparationConsistency(
+            PDResources resources,
+            Map<String, COSBase> knownTintTransforms,
+            Set<COSBase> visitedResources) {
+        if (resources == null) return;
+
+        // Prevent infinite recursion
+        if (!visitedResources.add(resources.getCOSObject())) {
+            return;
+        }
+
+        // Check defined ColorSpaces
+        COSDictionary csDict =
+                (COSDictionary) resources.getCOSObject().getDictionaryObject(COSName.COLORSPACE);
+        if (csDict != null) {
+            for (COSName name : csDict.keySet()) {
+                COSBase csVal = csDict.getDictionaryObject(name);
+                enforceSeparationTintTransform(csVal, knownTintTransforms);
+            }
+        }
+
+        // Recursively check XObjects (Forms)
+        COSDictionary xObjDict =
+                (COSDictionary) resources.getCOSObject().getDictionaryObject(COSName.XOBJECT);
+        if (xObjDict != null) {
+            for (COSName name : xObjDict.keySet()) {
+                COSBase xObj = xObjDict.getDictionaryObject(name);
+                if (xObj instanceof COSStream stream) {
+                    COSName type = (COSName) stream.getDictionaryObject(COSName.SUBTYPE);
+                    if (COSName.FORM.equals(type)) {
+                        COSBase formRes = stream.getDictionaryObject(COSName.RESOURCES);
+                        if (formRes instanceof COSDictionary formResDict) {
+                            enforceSeparationConsistency(
+                                    new PDResources(formResDict),
+                                    knownTintTransforms,
+                                    visitedResources);
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    private void enforceSeparationTintTransform(
+            COSBase cs, Map<String, COSBase> knownTintTransforms) {
+        if (cs instanceof COSArray arr && arr.size() >= 4) {
+            COSBase type = arr.getObject(0);
+            if (COSName.SEPARATION.equals(type)) {
+                COSBase nameBase = arr.getObject(1);
+                if (nameBase instanceof COSName colorName) {
+                    String name = colorName.getName();
+                    COSBase tintTransform = arr.getObject(3);
+
+                    // Ensure all separations with the same name use the same tintTransform
+                    // reference
+                    if (knownTintTransforms.containsKey(name)) {
+                        COSBase known = knownTintTransforms.get(name);
+                        if (known != tintTransform) {
+                            arr.set(3, known);
+                            log.debug(
+                                    "Enforced consistent TintTransform for Separation color: {}",
+                                    name);
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    private void addWhiteBackground(PDDocument doc) throws IOException {
+        for (PDPage page : doc.getPages()) {
+            PDRectangle mediaBox = page.getMediaBox();
+            try (PDPageContentStream cs =
+                    new PDPageContentStream(
+                            doc, page, PDPageContentStream.AppendMode.PREPEND, true, true)) {
+                cs.setNonStrokingColor(Color.WHITE);
+                cs.addRect(
+                        mediaBox.getLowerLeftX(),
+                        mediaBox.getLowerLeftY(),
+                        mediaBox.getWidth(),
+                        mediaBox.getHeight());
+                cs.fill();
+            }
+        }
+    }
+
     private void flattenHighlightsToContent(PDDocument doc) throws IOException {
         for (PDPage page : doc.getPages()) {
             List<PDAnnotation> annotations = new ArrayList<>(page.getAnnotations());
@@ -1851,7 +2090,7 @@ public class ConvertPDFToPDFA {
                             doc, page, PDPageContentStream.AppendMode.PREPEND, true, true)) {
 
                 for (PDAnnotation annot : annotations) {
-                    if (annot instanceof PDAnnotationTextMarkup highlight
+                    if (annot instanceof PDAnnotationHighlight highlight
                             && ANNOTATION_HIGHLIGHT.equals(annot.getSubtype())) {
 
                         PDColor color = highlight.getColor();
@@ -1973,7 +2212,7 @@ public class ConvertPDFToPDFA {
                 return annot.getAppearance() != null;
             }
 
-            if (annot instanceof PDAnnotationTextMarkup) {
+            if (annot instanceof PDAnnotationHighlight) {
                 return false; // Will be handled by flattening
             }
 

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/AutoRenameController.java

@@ -47,102 +47,105 @@ public class AutoRenameController {
         MultipartFile file = request.getFileInput();
         boolean useFirstTextAsFallback = Boolean.TRUE.equals(request.getUseFirstTextAsFallback());
 
-        PDDocument document = pdfDocumentFactory.load(file);
-        PDFTextStripper reader =
-                new PDFTextStripper() {
-                    List<LineInfo> lineInfos = new ArrayList<>();
-                    StringBuilder lineBuilder = new StringBuilder();
-                    float lastY = -1;
-                    float maxFontSizeInLine = 0.0f;
-                    int lineCount = 0;
+        try (PDDocument document = pdfDocumentFactory.load(file)) {
+            PDFTextStripper reader =
+                    new PDFTextStripper() {
+                        List<LineInfo> lineInfos = new ArrayList<>();
+                        StringBuilder lineBuilder = new StringBuilder();
+                        float lastY = -1;
+                        float maxFontSizeInLine = 0.0f;
+                        int lineCount = 0;
 
-                    @Override
-                    protected void processTextPosition(TextPosition text) {
-                        if (lastY != text.getY() && lineCount < LINE_LIMIT) {
-                            processLine();
-                            lineBuilder = new StringBuilder(text.getUnicode());
-                            maxFontSizeInLine = text.getFontSizeInPt();
-                            lastY = text.getY();
-                            lineCount++;
-                        } else if (lineCount < LINE_LIMIT) {
-                            lineBuilder.append(text.getUnicode());
-                            if (text.getFontSizeInPt() > maxFontSizeInLine) {
+                        @Override
+                        protected void processTextPosition(TextPosition text) {
+                            if (lastY != text.getY() && lineCount < LINE_LIMIT) {
+                                processLine();
+                                lineBuilder = new StringBuilder(text.getUnicode());
                                 maxFontSizeInLine = text.getFontSizeInPt();
+                                lastY = text.getY();
+                                lineCount++;
+                            } else if (lineCount < LINE_LIMIT) {
+                                lineBuilder.append(text.getUnicode());
+                                if (text.getFontSizeInPt() > maxFontSizeInLine) {
+                                    maxFontSizeInLine = text.getFontSizeInPt();
+                                }
                             }
                         }
-                    }
 
-                    private void processLine() {
-                        if (!lineBuilder.isEmpty() && lineCount < LINE_LIMIT) {
-                            lineInfos.add(new LineInfo(lineBuilder.toString(), maxFontSizeInLine));
-                        }
-                    }
-
-                    @Override
-                    public String getText(PDDocument doc) throws IOException {
-                        this.lineInfos.clear();
-                        this.lineBuilder = new StringBuilder();
-                        this.lastY = -1;
-                        this.maxFontSizeInLine = 0.0f;
-                        this.lineCount = 0;
-                        super.getText(doc);
-                        processLine(); // Process the last line
-
-                        // Merge lines with same font size
-                        List<LineInfo> mergedLineInfos = new ArrayList<>();
-                        for (int i = 0; i < lineInfos.size(); i++) {
-                            StringBuilder mergedText = new StringBuilder(lineInfos.get(i).text);
-                            float fontSize = lineInfos.get(i).fontSize;
-                            while (i + 1 < lineInfos.size()
-                                    && lineInfos.get(i + 1).fontSize == fontSize) {
-                                mergedText.append(" ").append(lineInfos.get(i + 1).text);
-                                i++;
+                        private void processLine() {
+                            if (!lineBuilder.isEmpty() && lineCount < LINE_LIMIT) {
+                                lineInfos.add(
+                                        new LineInfo(lineBuilder.toString(), maxFontSizeInLine));
                             }
-                            mergedLineInfos.add(new LineInfo(mergedText.toString(), fontSize));
                         }
 
-                        // Sort lines by font size in descending order and get the first one
-                        mergedLineInfos.sort(
-                                Comparator.comparing((LineInfo li) -> li.fontSize).reversed());
-                        String title =
-                                mergedLineInfos.isEmpty() ? null : mergedLineInfos.get(0).text;
+                        @Override
+                        public String getText(PDDocument doc) throws IOException {
+                            this.lineInfos.clear();
+                            this.lineBuilder = new StringBuilder();
+                            this.lastY = -1;
+                            this.maxFontSizeInLine = 0.0f;
+                            this.lineCount = 0;
+                            super.getText(doc);
+                            processLine(); // Process the last line
 
-                        return title != null
-                                ? title
-                                : (useFirstTextAsFallback
-                                        ? (mergedLineInfos.isEmpty()
-                                                ? null
-                                                : mergedLineInfos.get(mergedLineInfos.size() - 1)
-                                                        .text)
-                                        : null);
-                    }
+                            // Merge lines with same font size
+                            List<LineInfo> mergedLineInfos = new ArrayList<>();
+                            for (int i = 0; i < lineInfos.size(); i++) {
+                                StringBuilder mergedText = new StringBuilder(lineInfos.get(i).text);
+                                float fontSize = lineInfos.get(i).fontSize;
+                                while (i + 1 < lineInfos.size()
+                                        && lineInfos.get(i + 1).fontSize == fontSize) {
+                                    mergedText.append(" ").append(lineInfos.get(i + 1).text);
+                                    i++;
+                                }
+                                mergedLineInfos.add(new LineInfo(mergedText.toString(), fontSize));
+                            }
 
-                    class LineInfo {
-                        String text;
-                        float fontSize;
+                            // Sort lines by font size in descending order and get the first one
+                            mergedLineInfos.sort(
+                                    Comparator.comparing((LineInfo li) -> li.fontSize).reversed());
+                            String title =
+                                    mergedLineInfos.isEmpty() ? null : mergedLineInfos.get(0).text;
 
-                        LineInfo(String text, float fontSize) {
-                            this.text = text;
-                            this.fontSize = fontSize;
+                            return title != null
+                                    ? title
+                                    : (useFirstTextAsFallback
+                                            ? (mergedLineInfos.isEmpty()
+                                                    ? null
+                                                    : mergedLineInfos.get(
+                                                                    mergedLineInfos.size() - 1)
+                                                            .text)
+                                            : null);
                         }
-                    }
-                };
 
-        String header = reader.getText(document);
+                        class LineInfo {
+                            String text;
+                            float fontSize;
 
-        // Sanitize the header string by removing characters not allowed in a filename.
-        if (header != null && header.length() < 255) {
-            header =
-                    RegexPatternUtils.getInstance()
-                            .getSafeFilenamePattern()
-                            .matcher(header)
-                            .replaceAll("")
-                            .trim();
-            return WebResponseUtils.pdfDocToWebResponse(document, header + ".pdf");
-        } else {
-            log.info("File has no good title to be found");
-            return WebResponseUtils.pdfDocToWebResponse(
-                    document, Filenames.toSimpleFileName(file.getOriginalFilename()));
+                            LineInfo(String text, float fontSize) {
+                                this.text = text;
+                                this.fontSize = fontSize;
+                            }
+                        }
+                    };
+
+            String header = reader.getText(document);
+
+            // Sanitize the header string by removing characters not allowed in a filename.
+            if (header != null && header.length() < 255) {
+                header =
+                        RegexPatternUtils.getInstance()
+                                .getSafeFilenamePattern()
+                                .matcher(header)
+                                .replaceAll("")
+                                .trim();
+                return WebResponseUtils.pdfDocToWebResponse(document, header + ".pdf");
+            } else {
+                log.info("File has no good title to be found");
+                return WebResponseUtils.pdfDocToWebResponse(
+                        document, Filenames.toSimpleFileName(file.getOriginalFilename()));
+            }
         }
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/CompressController.java

@@ -1100,8 +1100,9 @@ public class CompressController {
                             inputFile.getOriginalFilename(), "_Optimized.pdf");
 
             try {
-                return WebResponseUtils.pdfDocToWebResponse(
-                        pdfDocumentFactory.load(currentFile.toFile()), outputFilename);
+                try (PDDocument document = pdfDocumentFactory.load(currentFile.toFile())) {
+                    return WebResponseUtils.pdfDocToWebResponse(document, outputFilename);
+                }
             } catch (IOException e) {
                 throw ExceptionUtils.handlePdfException(e, "PDF optimization");
             }

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/FlattenController.java

@@ -49,93 +49,103 @@ public class FlattenController {
     public ResponseEntity<byte[]> flatten(@ModelAttribute FlattenRequest request) throws Exception {
         MultipartFile file = request.getFileInput();
 
-        PDDocument document = pdfDocumentFactory.load(file);
-        Boolean flattenOnlyForms = request.getFlattenOnlyForms();
+        try (PDDocument document = pdfDocumentFactory.load(file)) {
+            Boolean flattenOnlyForms = request.getFlattenOnlyForms();
 
-        if (Boolean.TRUE.equals(flattenOnlyForms)) {
-            PDAcroForm acroForm = document.getDocumentCatalog().getAcroForm();
-            if (acroForm != null) {
-                acroForm.flatten();
-            }
-            return WebResponseUtils.pdfDocToWebResponse(
-                    document, Filenames.toSimpleFileName(file.getOriginalFilename()));
-        } else {
-            // flatten whole page aka convert each page to image and re-add it (making text
-            // unselectable)
-            PDFRenderer pdfRenderer = new PDFRenderer(document);
-            PDDocument newDocument =
-                    pdfDocumentFactory.createNewDocumentBasedOnOldDocument(document);
+            if (Boolean.TRUE.equals(flattenOnlyForms)) {
+                PDAcroForm acroForm = document.getDocumentCatalog().getAcroForm();
+                if (acroForm != null) {
+                    acroForm.flatten();
+                }
+                return WebResponseUtils.pdfDocToWebResponse(
+                        document, Filenames.toSimpleFileName(file.getOriginalFilename()));
+            } else {
+                // flatten whole page aka convert each page to image and re-add it (making text
+                // unselectable)
+                PDFRenderer pdfRenderer = new PDFRenderer(document);
+                pdfRenderer.setSubsamplingAllowed(
+                        true); // Enable subsampling to reduce memory usage
 
-            int defaultRenderDpi = 100; // Default fallback
-            ApplicationProperties properties =
-                    ApplicationContextProvider.getBean(ApplicationProperties.class);
-            Integer configuredMaxDpi = null;
-            if (properties != null && properties.getSystem() != null) {
-                configuredMaxDpi = properties.getSystem().getMaxDPI();
-            }
+                try (PDDocument newDocument =
+                        pdfDocumentFactory.createNewDocumentBasedOnOldDocument(document)) {
 
-            int maxDpi =
-                    (configuredMaxDpi != null && configuredMaxDpi > 0)
-                            ? configuredMaxDpi
-                            : defaultRenderDpi;
-
-            Integer requestedDpi = request.getRenderDpi();
-            int renderDpiTemp = maxDpi;
-            if (requestedDpi != null) {
-                renderDpiTemp = Math.min(requestedDpi, maxDpi);
-                renderDpiTemp = Math.max(renderDpiTemp, 72);
-            }
-            final int renderDpi = renderDpiTemp;
-
-            int numPages = document.getNumberOfPages();
-            for (int i = 0; i < numPages; i++) {
-                final int pageIndex = i;
-                BufferedImage image = null;
-                try {
-                    // Validate dimensions BEFORE rendering to prevent OOM
-                    ExceptionUtils.validateRenderingDimensions(
-                            document.getPage(pageIndex), pageIndex + 1, renderDpi);
-
-                    // Wrap entire rendering operation to catch OutOfMemoryError from any depth
-                    image =
-                            ExceptionUtils.handleOomRendering(
-                                    pageIndex + 1,
-                                    renderDpi,
-                                    () ->
-                                            pdfRenderer.renderImageWithDPI(
-                                                    pageIndex, renderDpi, ImageType.RGB));
-
-                    PDPage page = new PDPage();
-                    page.setMediaBox(document.getPage(i).getMediaBox());
-                    newDocument.addPage(page);
-                    try (PDPageContentStream contentStream =
-                            new PDPageContentStream(newDocument, page)) {
-                        PDImageXObject pdImage = JPEGFactory.createFromImage(newDocument, image);
-                        float pageWidth = page.getMediaBox().getWidth();
-                        float pageHeight = page.getMediaBox().getHeight();
-
-                        contentStream.drawImage(pdImage, 0, 0, pageWidth, pageHeight);
+                    int defaultRenderDpi = 100; // Default fallback
+                    ApplicationProperties properties =
+                            ApplicationContextProvider.getBean(ApplicationProperties.class);
+                    Integer configuredMaxDpi = null;
+                    if (properties != null && properties.getSystem() != null) {
+                        configuredMaxDpi = properties.getSystem().getMaxDPI();
                     }
-                } catch (ExceptionUtils.OutOfMemoryDpiException e) {
-                    // Re-throw OutOfMemoryDpiException to be handled by GlobalExceptionHandler
-                    newDocument.close();
-                    document.close();
-                    throw e;
-                } catch (IOException e) {
-                    log.error("IOException during page processing: ", e);
-                    // Continue processing other pages
-                } catch (OutOfMemoryError e) {
-                    // Catch any OutOfMemoryError that escaped the inner try block
-                    newDocument.close();
-                    document.close();
-                    throw ExceptionUtils.createOutOfMemoryDpiException(i + 1, renderDpi, e);
-                } finally {
-                    // Help GC by clearing the image reference
-                    image = null;
+
+                    int maxDpi =
+                            (configuredMaxDpi != null && configuredMaxDpi > 0)
+                                    ? configuredMaxDpi
+                                    : defaultRenderDpi;
+
+                    Integer requestedDpi = request.getRenderDpi();
+                    int renderDpiTemp = maxDpi;
+                    if (requestedDpi != null) {
+                        renderDpiTemp = Math.min(requestedDpi, maxDpi);
+                        renderDpiTemp = Math.max(renderDpiTemp, 72);
+                    }
+                    final int renderDpi = renderDpiTemp;
+
+                    int numPages = document.getNumberOfPages();
+                    for (int i = 0; i < numPages; i++) {
+                        final int pageIndex = i;
+                        BufferedImage image = null;
+                        try {
+                            // Validate dimensions BEFORE rendering to prevent OOM
+                            ExceptionUtils.validateRenderingDimensions(
+                                    document.getPage(pageIndex), pageIndex + 1, renderDpi);
+
+                            // Wrap entire rendering operation to catch OutOfMemoryError from any
+                            // depth
+                            image =
+                                    ExceptionUtils.handleOomRendering(
+                                            pageIndex + 1,
+                                            renderDpi,
+                                            () ->
+                                                    pdfRenderer.renderImageWithDPI(
+                                                            pageIndex, renderDpi, ImageType.RGB));
+
+                            PDPage page = new PDPage();
+                            page.setMediaBox(document.getPage(i).getMediaBox());
+                            newDocument.addPage(page);
+                            // resetContext=true: Ensure clean graphics state when overwriting.
+                            try (PDPageContentStream contentStream =
+                                    new PDPageContentStream(
+                                            newDocument,
+                                            page,
+                                            PDPageContentStream.AppendMode.OVERWRITE,
+                                            true,
+                                            true)) {
+                                PDImageXObject pdImage =
+                                        JPEGFactory.createFromImage(newDocument, image);
+                                float pageWidth = page.getMediaBox().getWidth();
+                                float pageHeight = page.getMediaBox().getHeight();
+
+                                contentStream.drawImage(pdImage, 0, 0, pageWidth, pageHeight);
+                            }
+                        } catch (ExceptionUtils.OutOfMemoryDpiException e) {
+                            // Re-throw OutOfMemoryDpiException to be handled by
+                            // GlobalExceptionHandler
+                            throw e;
+                        } catch (IOException e) {
+                            log.error("IOException during page processing: ", e);
+                            // Continue processing other pages
+                        } catch (OutOfMemoryError e) {
+                            // Catch any OutOfMemoryError that escaped the inner try block
+                            throw ExceptionUtils.createOutOfMemoryDpiException(i + 1, renderDpi, e);
+                        } finally {
+                            // Help GC by clearing the image reference
+                            image = null;
+                        }
+                    }
+                    return WebResponseUtils.pdfDocToWebResponse(
+                            newDocument, Filenames.toSimpleFileName(file.getOriginalFilename()));
                 }
             }
-            return WebResponseUtils.pdfDocToWebResponse(
-                    newDocument, Filenames.toSimpleFileName(file.getOriginalFilename()));
         }
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/MetadataController.java

@@ -84,93 +84,102 @@ public class MetadataController {
         if (allRequestParams == null) {
             allRequestParams = new java.util.HashMap<String, String>();
         }
-        // Load the PDF file into a PDDocument
-        PDDocument document = pdfDocumentFactory.load(pdfFile, true);
+        // Load the PDF file into a PDDocument with proper resource management
+        try (PDDocument document = pdfDocumentFactory.load(pdfFile, true)) {
 
-        // Get the document information from the PDF
-        PDDocumentInformation info = document.getDocumentInformation();
+            // Get the document information from the PDF
+            PDDocumentInformation info = document.getDocumentInformation();
 
-        // Check if each metadata value is "undefined" and set it to null if it is
-        author = checkUndefined(author);
-        creationDate = checkUndefined(creationDate);
-        creator = checkUndefined(creator);
-        keywords = checkUndefined(keywords);
-        modificationDate = checkUndefined(modificationDate);
-        producer = checkUndefined(producer);
-        subject = checkUndefined(subject);
-        title = checkUndefined(title);
-        trapped = checkUndefined(trapped);
+            // Check if each metadata value is "undefined" and set it to null if it is
+            author = checkUndefined(author);
+            creationDate = checkUndefined(creationDate);
+            creator = checkUndefined(creator);
+            keywords = checkUndefined(keywords);
+            modificationDate = checkUndefined(modificationDate);
+            producer = checkUndefined(producer);
+            subject = checkUndefined(subject);
+            title = checkUndefined(title);
+            trapped = checkUndefined(trapped);
 
-        // If the "deleteAll" flag is set, remove all metadata from the document
-        // information
-        if (deleteAll) {
-            for (String key : info.getMetadataKeys()) {
-                info.setCustomMetadataValue(key, null);
-            }
-            // Remove metadata from the PDF history
-            document.getDocumentCatalog().getCOSObject().removeItem(COSName.getPDFName("Metadata"));
-            document.getDocumentCatalog()
-                    .getCOSObject()
-                    .removeItem(COSName.getPDFName("PieceInfo"));
-            author = null;
-            creationDate = null;
-            creator = null;
-            keywords = null;
-            modificationDate = null;
-            producer = null;
-            subject = null;
-            title = null;
-            trapped = null;
-        } else {
-            // Iterate through the request parameters and set the metadata values
-            for (Entry<String, String> entry : allRequestParams.entrySet()) {
-                String key = entry.getKey();
-                // Check if the key is a standard metadata key
-                if (!"Author".equalsIgnoreCase(key)
-                        && !"CreationDate".equalsIgnoreCase(key)
-                        && !"Creator".equalsIgnoreCase(key)
-                        && !"Keywords".equalsIgnoreCase(key)
-                        && !"modificationDate".equalsIgnoreCase(key)
-                        && !"Producer".equalsIgnoreCase(key)
-                        && !"Subject".equalsIgnoreCase(key)
-                        && !"Title".equalsIgnoreCase(key)
-                        && !"Trapped".equalsIgnoreCase(key)
-                        && !key.contains("customKey")
-                        && !key.contains("customValue")) {
-                    info.setCustomMetadataValue(key, entry.getValue());
-                } else if (key.contains("customKey")) {
-                    int number =
-                            Integer.parseInt(
-                                    RegexPatternUtils.getInstance()
-                                            .getNumericExtractionPattern()
-                                            .matcher(key)
-                                            .replaceAll(""));
-                    String customKey = entry.getValue();
-                    String customValue = allRequestParams.get("customValue" + number);
-                    info.setCustomMetadataValue(customKey, customValue);
+            // If the "deleteAll" flag is set, remove all metadata from the document
+            // information
+            if (deleteAll) {
+                for (String key : info.getMetadataKeys()) {
+                    info.setCustomMetadataValue(key, null);
+                }
+                // Remove metadata from the PDF history
+                document.getDocumentCatalog()
+                        .getCOSObject()
+                        .removeItem(COSName.getPDFName("Metadata"));
+                document.getDocumentCatalog()
+                        .getCOSObject()
+                        .removeItem(COSName.getPDFName("PieceInfo"));
+                author = null;
+                creationDate = null;
+                creator = null;
+                keywords = null;
+                modificationDate = null;
+                producer = null;
+                subject = null;
+                title = null;
+                trapped = null;
+            } else {
+                // Iterate through the request parameters and set the metadata values
+                for (Entry<String, String> entry : allRequestParams.entrySet()) {
+                    String key = entry.getKey();
+                    // Check if the key is a standard metadata key
+                    if (!"Author".equalsIgnoreCase(key)
+                            && !"CreationDate".equalsIgnoreCase(key)
+                            && !"Creator".equalsIgnoreCase(key)
+                            && !"Keywords".equalsIgnoreCase(key)
+                            && !"modificationDate".equalsIgnoreCase(key)
+                            && !"Producer".equalsIgnoreCase(key)
+                            && !"Subject".equalsIgnoreCase(key)
+                            && !"Title".equalsIgnoreCase(key)
+                            && !"Trapped".equalsIgnoreCase(key)
+                            && !key.contains("customKey")
+                            && !key.contains("customValue")) {
+                        info.setCustomMetadataValue(key, entry.getValue());
+                    } else if (key.contains("customKey")) {
+                        try {
+                            int number =
+                                    Integer.parseInt(
+                                            RegexPatternUtils.getInstance()
+                                                    .getNumericExtractionPattern()
+                                                    .matcher(key)
+                                                    .replaceAll(""));
+                            String customKey = entry.getValue();
+                            String customValue = allRequestParams.get("customValue" + number);
+                            info.setCustomMetadataValue(customKey, customValue);
+                        } catch (NumberFormatException e) {
+                            // Skip invalid custom key entries that don't have valid numeric
+                            // suffixes
+                            log.warn("Skipping invalid custom key '{}': {}", key, e.getMessage());
+                        }
+                    }
                 }
             }
+            // Set creation date using utility method
+            Calendar creationDateCal = PdfMetadataService.parseToCalendar(creationDate);
+            info.setCreationDate(creationDateCal);
+
+            // Set modification date using utility method
+            Calendar modificationDateCal = PdfMetadataService.parseToCalendar(modificationDate);
+            info.setModificationDate(modificationDateCal);
+            info.setCreator(creator);
+            info.setKeywords(keywords);
+            info.setAuthor(author);
+            info.setProducer(producer);
+            info.setSubject(subject);
+            info.setTitle(title);
+            info.setTrapped(trapped);
+
+            document.setDocumentInformation(info);
+            return WebResponseUtils.pdfDocToWebResponse(
+                    document,
+                    GeneralUtils.removeExtension(
+                                    Filenames.toSimpleFileName(pdfFile.getOriginalFilename()))
+                            + "_metadata.pdf");
         }
-        // Set creation date using utility method
-        Calendar creationDateCal = PdfMetadataService.parseToCalendar(creationDate);
-        info.setCreationDate(creationDateCal);
-
-        // Set modification date using utility method
-        Calendar modificationDateCal = PdfMetadataService.parseToCalendar(modificationDate);
-        info.setModificationDate(modificationDateCal);
-        info.setCreator(creator);
-        info.setKeywords(keywords);
-        info.setAuthor(author);
-        info.setProducer(producer);
-        info.setSubject(subject);
-        info.setTitle(title);
-        info.setTrapped(trapped);
-
-        document.setDocumentInformation(info);
-        return WebResponseUtils.pdfDocToWebResponse(
-                document,
-                GeneralUtils.removeExtension(
-                                Filenames.toSimpleFileName(pdfFile.getOriginalFilename()))
-                        + "_metadata.pdf");
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/OCRController.java

@@ -15,6 +15,7 @@ import java.util.zip.ZipOutputStream;
 
 import javax.imageio.ImageIO;
 
+import org.apache.pdfbox.io.IOUtils;
 import org.apache.pdfbox.multipdf.PDFMergerUtility;
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
@@ -326,6 +327,8 @@ public class OCRController {
 
             try (PDDocument document = pdfDocumentFactory.load(tempInputFile.toFile())) {
                 PDFRenderer pdfRenderer = new PDFRenderer(document);
+                pdfRenderer.setSubsamplingAllowed(
+                        true); // Enable subsampling to reduce memory usage
                 int pageCount = document.getNumberOfPages();
 
                 for (int pageNum = 0; pageNum < pageCount; pageNum++) {
@@ -415,7 +418,7 @@ public class OCRController {
             }
 
             // Merge all pages into final PDF
-            merger.mergeDocuments(null);
+            merger.mergeDocuments(IOUtils.createTempFileOnlyStreamCache());
 
             // Copy final output to the expected location
             Files.copy(

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/PageNumbersController.java

@@ -65,113 +65,114 @@ public class PageNumbersController {
             }
         }
 
-        PDDocument document = pdfDocumentFactory.load(file);
-
-        float marginFactor =
-                switch (customMargin == null ? "" : customMargin.toLowerCase(Locale.ROOT)) {
-                    case "small" -> 0.02f;
-                    case "large" -> 0.05f;
-                    case "x-large" -> 0.075f;
-                    case "medium" -> 0.035f;
-                    default -> 0.035f;
-                };
-
-        if (pagesToNumber == null || pagesToNumber.isEmpty()) {
-            pagesToNumber = "all";
-        }
-        if (customText == null || customText.isEmpty()) {
-            customText = "{n}";
-        }
-
-        final String baseFilename =
-                Filenames.toSimpleFileName(file.getOriginalFilename())
-                        .replaceFirst("[.][^.]+$", "");
-
-        List<Integer> pagesToNumberList =
-                GeneralUtils.parsePageList(pagesToNumber.split(","), document.getNumberOfPages());
-
-        // Clamp position to 1..9 (1 = top-left, 9 = bottom-right)
-        int pos = Math.max(1, Math.min(9, position));
-
-        for (int i : pagesToNumberList) {
-            PDPage page = document.getPage(i);
-            PDRectangle pageSize = page.getMediaBox();
-
-            String text =
-                    customText
-                            .replace("{n}", String.valueOf(pageNumber))
-                            .replace("{total}", String.valueOf(document.getNumberOfPages()))
-                            .replace(
-                                    "{filename}",
-                                    GeneralUtils.removeExtension(
-                                            Filenames.toSimpleFileName(
-                                                    file.getOriginalFilename())));
-
-            PDType1Font currentFont =
-                    switch (fontType == null ? "" : fontType.toLowerCase(Locale.ROOT)) {
-                        case "courier" -> new PDType1Font(Standard14Fonts.FontName.COURIER);
-                        case "times" -> new PDType1Font(Standard14Fonts.FontName.TIMES_ROMAN);
-                        default -> new PDType1Font(Standard14Fonts.FontName.HELVETICA);
+        try (PDDocument document = pdfDocumentFactory.load(file)) {
+            float marginFactor =
+                    switch (customMargin == null ? "" : customMargin.toLowerCase(Locale.ROOT)) {
+                        case "small" -> 0.02f;
+                        case "large" -> 0.05f;
+                        case "x-large" -> 0.075f;
+                        case "medium" -> 0.035f;
+                        default -> 0.035f;
                     };
 
-            // Text dimensions and font metrics
-            float textWidth = currentFont.getStringWidth(text) / 1000f * fontSize;
-            float ascent = currentFont.getFontDescriptor().getAscent() / 1000f * fontSize;
-            float descent = currentFont.getFontDescriptor().getDescent() / 1000f * fontSize;
-
-            // Derive column/row in range 1..3 (1 = left/top, 2 = center/middle, 3 = right/bottom)
-            int col = ((pos - 1) % 3) + 1; // 1 = left, 2 = center, 3 = right
-            int row = ((pos - 1) / 3) + 1; // 1 = top, 2 = middle, 3 = bottom
-
-            // Anchor coordinates with margin
-            float leftX = pageSize.getLowerLeftX() + marginFactor * pageSize.getWidth();
-            float midX = pageSize.getLowerLeftX() + pageSize.getWidth() / 2f;
-            float rightX = pageSize.getUpperRightX() - marginFactor * pageSize.getWidth();
-
-            float botY = pageSize.getLowerLeftY() + marginFactor * pageSize.getHeight();
-            float midY = pageSize.getLowerLeftY() + pageSize.getHeight() / 2f;
-            float topY = pageSize.getUpperRightY() - marginFactor * pageSize.getHeight();
-
-            // Horizontal alignment: left = anchor, center = centered, right = right-aligned
-            float x =
-                    switch (col) {
-                        case 1 -> leftX;
-                        case 2 -> midX - textWidth / 2f;
-                        default -> rightX - textWidth;
-                    };
-
-            // Vertical alignment (baseline!):
-            // top    = align text top at topY,
-            // middle = optical middle using ascent/descent,
-            // bottom = baseline at botY
-            float y =
-                    switch (row) {
-                        case 1 -> topY - ascent;
-                        case 2 -> midY - (ascent + descent) / 2f;
-                        default -> botY;
-                    };
-
-            try (PDPageContentStream contentStream =
-                    new PDPageContentStream(
-                            document, page, PDPageContentStream.AppendMode.APPEND, true, true)) {
-                contentStream.beginText();
-                contentStream.setFont(currentFont, fontSize);
-                contentStream.setNonStrokingColor(color);
-                contentStream.newLineAtOffset(x, y);
-                contentStream.showText(text);
-                contentStream.endText();
+            if (pagesToNumber == null || pagesToNumber.isEmpty()) {
+                pagesToNumber = "all";
+            }
+            if (customText == null || customText.isEmpty()) {
+                customText = "{n}";
             }
 
-            pageNumber++;
+            List<Integer> pagesToNumberList =
+                    GeneralUtils.parsePageList(
+                            pagesToNumber.split(","), document.getNumberOfPages());
+
+            // Clamp position to 1..9 (1 = top-left, 9 = bottom-right)
+            int pos = Math.max(1, Math.min(9, position));
+
+            for (int i : pagesToNumberList) {
+                PDPage page = document.getPage(i);
+                PDRectangle pageSize = page.getMediaBox();
+
+                String text =
+                        customText
+                                .replace("{n}", String.valueOf(pageNumber))
+                                .replace("{total}", String.valueOf(document.getNumberOfPages()))
+                                .replace(
+                                        "{filename}",
+                                        GeneralUtils.removeExtension(
+                                                Filenames.toSimpleFileName(
+                                                        file.getOriginalFilename())));
+
+                PDType1Font currentFont =
+                        switch (fontType == null ? "" : fontType.toLowerCase(Locale.ROOT)) {
+                            case "courier" -> new PDType1Font(Standard14Fonts.FontName.COURIER);
+                            case "times" -> new PDType1Font(Standard14Fonts.FontName.TIMES_ROMAN);
+                            default -> new PDType1Font(Standard14Fonts.FontName.HELVETICA);
+                        };
+
+                // Text dimensions and font metrics
+                float textWidth = currentFont.getStringWidth(text) / 1000f * fontSize;
+                float ascent = currentFont.getFontDescriptor().getAscent() / 1000f * fontSize;
+                float descent = currentFont.getFontDescriptor().getDescent() / 1000f * fontSize;
+
+                // Derive column/row in range 1..3 (1 = left/top, 2 = center/middle, 3 =
+                // right/bottom)
+                int col = ((pos - 1) % 3) + 1; // 1 = left, 2 = center, 3 = right
+                int row = ((pos - 1) / 3) + 1; // 1 = top, 2 = middle, 3 = bottom
+
+                // Anchor coordinates with margin
+                float leftX = pageSize.getLowerLeftX() + marginFactor * pageSize.getWidth();
+                float midX = pageSize.getLowerLeftX() + pageSize.getWidth() / 2f;
+                float rightX = pageSize.getUpperRightX() - marginFactor * pageSize.getWidth();
+
+                float botY = pageSize.getLowerLeftY() + marginFactor * pageSize.getHeight();
+                float midY = pageSize.getLowerLeftY() + pageSize.getHeight() / 2f;
+                float topY = pageSize.getUpperRightY() - marginFactor * pageSize.getHeight();
+
+                // Horizontal alignment: left = anchor, center = centered, right = right-aligned
+                float x =
+                        switch (col) {
+                            case 1 -> leftX;
+                            case 2 -> midX - textWidth / 2f;
+                            default -> rightX - textWidth;
+                        };
+
+                // Vertical alignment (baseline!):
+                // top    = align text top at topY,
+                // middle = optical middle using ascent/descent,
+                // bottom = baseline at botY
+                float y =
+                        switch (row) {
+                            case 1 -> topY - ascent;
+                            case 2 -> midY - (ascent + descent) / 2f;
+                            default -> botY;
+                        };
+
+                try (PDPageContentStream contentStream =
+                        new PDPageContentStream(
+                                document,
+                                page,
+                                PDPageContentStream.AppendMode.APPEND,
+                                true,
+                                true)) {
+                    contentStream.beginText();
+                    contentStream.setFont(currentFont, fontSize);
+                    contentStream.setNonStrokingColor(color);
+                    contentStream.newLineAtOffset(x, y);
+                    contentStream.showText(text);
+                    contentStream.endText();
+                }
+
+                pageNumber++;
+            }
+
+            ByteArrayOutputStream baos = new ByteArrayOutputStream();
+            document.save(baos);
+
+            return WebResponseUtils.bytesToWebResponse(
+                    baos.toByteArray(),
+                    GeneralUtils.generateFilename(
+                            file.getOriginalFilename(), "_page_numbers_added.pdf"));
         }
-
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-        document.save(baos);
-        document.close();
-
-        return WebResponseUtils.bytesToWebResponse(
-                baos.toByteArray(),
-                GeneralUtils.generateFilename(
-                        file.getOriginalFilename(), "_page_numbers_added.pdf"));
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/PrintFileController.java

@@ -7,7 +7,10 @@ import java.awt.print.Printable;
 import java.awt.print.PrinterException;
 import java.awt.print.PrinterJob;
 import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.nio.file.Paths;
+import java.nio.file.StandardCopyOption;
 import java.util.Arrays;
 import java.util.Locale;
 
@@ -77,11 +80,19 @@ public class PrintFileController {
             log.info("Selected Printer: {}", selectedService.getName());
 
             if (MediaType.APPLICATION_PDF_VALUE.equals(contentType)) {
-                try (PDDocument document = Loader.loadPDF(file.getBytes())) {
-                    PrinterJob job = PrinterJob.getPrinterJob();
-                    job.setPrintService(selectedService);
-                    job.setPageable(new PDFPageable(document));
-                    job.print();
+                // Use Stream-to-File pattern: write to temp file first, then load from file
+                Path tempFile = Files.createTempFile("print-", ".pdf");
+                try {
+                    Files.copy(
+                            file.getInputStream(), tempFile, StandardCopyOption.REPLACE_EXISTING);
+                    try (PDDocument document = Loader.loadPDF(tempFile.toFile())) {
+                        PrinterJob job = PrinterJob.getPrinterJob();
+                        job.setPrintService(selectedService);
+                        job.setPageable(new PDFPageable(document));
+                        job.print();
+                    }
+                } finally {
+                    Files.deleteIfExists(tempFile);
                 }
             } else if (contentType.startsWith("image/")) {
                 try (var inputStream = file.getInputStream()) {

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/ScannerEffectController.java

@@ -463,7 +463,13 @@ public class ScannerEffectController {
             PDPage newPage = new PDPage(new PDRectangle(page.origW, page.origH));
             document.addPage(newPage);
 
-            try (PDPageContentStream contentStream = new PDPageContentStream(document, newPage)) {
+            try (PDPageContentStream contentStream =
+                    new PDPageContentStream(
+                            document,
+                            newPage,
+                            PDPageContentStream.AppendMode.OVERWRITE,
+                            true,
+                            true)) {
                 PDImageXObject pdImage = LosslessFactory.createFromImage(document, page.image);
                 contentStream.drawImage(
                         pdImage, page.offsetX, page.offsetY, page.drawW, page.drawH);

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/StampController.java

@@ -134,60 +134,65 @@ public class StampController {
                 };
 
         // Load the input PDF
-        PDDocument document = pdfDocumentFactory.load(pdfFile);
+        try (PDDocument document = pdfDocumentFactory.load(pdfFile)) {
 
-        List<Integer> pageNumbers = request.getPageNumbersList(document, true);
+            List<Integer> pageNumbers = request.getPageNumbersList(document, true);
 
-        for (int pageIndex : pageNumbers) {
-            int zeroBasedIndex = pageIndex - 1;
-            if (zeroBasedIndex >= 0 && zeroBasedIndex < document.getNumberOfPages()) {
-                PDPage page = document.getPage(zeroBasedIndex);
-                PDRectangle pageSize = page.getMediaBox();
-                float margin = marginFactor * (pageSize.getWidth() + pageSize.getHeight()) / 2;
+            for (int pageIndex : pageNumbers) {
+                int zeroBasedIndex = pageIndex - 1;
+                if (zeroBasedIndex >= 0 && zeroBasedIndex < document.getNumberOfPages()) {
+                    PDPage page = document.getPage(zeroBasedIndex);
+                    PDRectangle pageSize = page.getMediaBox();
+                    float margin = marginFactor * (pageSize.getWidth() + pageSize.getHeight()) / 2;
 
-                PDPageContentStream contentStream =
-                        new PDPageContentStream(
-                                document, page, PDPageContentStream.AppendMode.APPEND, true, true);
+                    PDPageContentStream contentStream =
+                            new PDPageContentStream(
+                                    document,
+                                    page,
+                                    PDPageContentStream.AppendMode.APPEND,
+                                    true,
+                                    true);
 
-                PDExtendedGraphicsState graphicsState = new PDExtendedGraphicsState();
-                graphicsState.setNonStrokingAlphaConstant(opacity);
-                contentStream.setGraphicsStateParameters(graphicsState);
+                    PDExtendedGraphicsState graphicsState = new PDExtendedGraphicsState();
+                    graphicsState.setNonStrokingAlphaConstant(opacity);
+                    contentStream.setGraphicsStateParameters(graphicsState);
 
-                if ("text".equalsIgnoreCase(stampType)) {
-                    addTextStamp(
-                            contentStream,
-                            stampText,
-                            document,
-                            page,
-                            rotation,
-                            position,
-                            fontSize,
-                            alphabet,
-                            overrideX,
-                            overrideY,
-                            margin,
-                            customColor);
-                } else if ("image".equalsIgnoreCase(stampType)) {
-                    addImageStamp(
-                            contentStream,
-                            stampImage,
-                            document,
-                            page,
-                            rotation,
-                            position,
-                            fontSize,
-                            overrideX,
-                            overrideY,
-                            margin);
+                    if ("text".equalsIgnoreCase(stampType)) {
+                        addTextStamp(
+                                contentStream,
+                                stampText,
+                                document,
+                                page,
+                                rotation,
+                                position,
+                                fontSize,
+                                alphabet,
+                                overrideX,
+                                overrideY,
+                                margin,
+                                customColor);
+                    } else if ("image".equalsIgnoreCase(stampType)) {
+                        addImageStamp(
+                                contentStream,
+                                stampImage,
+                                document,
+                                page,
+                                rotation,
+                                position,
+                                fontSize,
+                                overrideX,
+                                overrideY,
+                                margin);
+                    }
+
+                    contentStream.close();
                 }
-
-                contentStream.close();
             }
+            // Return the stamped PDF as a response
+            return WebResponseUtils.pdfDocToWebResponse(
+                    document,
+                    GeneralUtils.generateFilename(pdfFile.getOriginalFilename(), "_stamped.pdf"));
         }
-        // Return the stamped PDF as a response
-        return WebResponseUtils.pdfDocToWebResponse(
-                document,
-                GeneralUtils.generateFilename(pdfFile.getOriginalFilename(), "_stamped.pdf"));
     }
 
     private void addTextStamp(

app/core/src/main/java/stirling/software/SPDF/controller/api/security/CertSignController.java

@@ -139,11 +139,12 @@ public class CertSignController {
                     signatureOptions.setPage(pageNumber);
 
                     doc.addSignature(signature, instance, signatureOptions);
+                    doc.saveIncremental(output);
                 }
             } else {
                 doc.addSignature(signature, instance);
+                doc.saveIncremental(output);
             }
-            doc.saveIncremental(output);
         } catch (Exception e) {
             ExceptionUtils.logException("PDF signing", e);
         }

app/core/src/main/java/stirling/software/SPDF/controller/api/security/GetInfoOnPDF.java

@@ -3,6 +3,8 @@ package stirling.software.SPDF.controller.api.security;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.time.Instant;
 import java.time.ZoneId;
 import java.time.ZonedDateTime;
@@ -14,7 +16,8 @@ import java.util.regex.Pattern;
 import org.apache.pdfbox.cos.COSInputStream;
 import org.apache.pdfbox.cos.COSName;
 import org.apache.pdfbox.cos.COSString;
-import org.apache.pdfbox.io.RandomAccessReadBuffer;
+import org.apache.pdfbox.io.RandomAccessRead;
+import org.apache.pdfbox.io.RandomAccessReadBufferedFile;
 import org.apache.pdfbox.pdmodel.*;
 import org.apache.pdfbox.pdmodel.common.PDMetadata;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
@@ -198,10 +201,20 @@ public class GetInfoOnPDF {
             return false;
         }
 
-        try (ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
-            document.save(baos);
+        // Use Stream-to-File pattern: save to temp file instead of loading into memory
+        // This prevents OutOfMemoryError on large PDFs
+        Path tempFile = null;
+        try {
+            tempFile = Files.createTempFile("preflight-", ".pdf");
 
-            try (RandomAccessReadBuffer source = new RandomAccessReadBuffer(baos.toByteArray())) {
+            // Save document to temp file (avoids loading entire document into memory)
+            try (var outputStream = Files.newOutputStream(tempFile)) {
+                document.save(outputStream);
+            }
+
+            // Use RandomAccessReadBufferedFile for efficient file-based reading
+            // This avoids Windows file locking issues that occur with memory-mapped files
+            try (RandomAccessRead source = new RandomAccessReadBufferedFile(tempFile.toFile())) {
                 PreflightParser parser = new PreflightParser(source);
 
                 try (PDDocument parsedDocument = parser.parse()) {
@@ -243,6 +256,19 @@ public class GetInfoOnPDF {
             log.debug("IOException during PDF/A validation: {}", e.getMessage());
         } catch (Exception e) {
             log.debug("Unexpected error during PDF/A validation: {}", e.getMessage());
+        } finally {
+            // Explicitly clean up temp file to prevent disk exhaustion
+            // This must be in finally block to ensure cleanup even on exceptions
+            if (tempFile != null) {
+                try {
+                    Files.deleteIfExists(tempFile);
+                } catch (IOException e) {
+                    log.warn(
+                            "Failed to delete temp file during PDF/A validation cleanup: {}",
+                            tempFile,
+                            e);
+                }
+            }
         }
 
         return false;

app/core/src/main/java/stirling/software/SPDF/controller/api/security/PasswordController.java

@@ -42,25 +42,17 @@ public class PasswordController {
         MultipartFile fileInput = request.getFileInput();
         String password = request.getPassword();
 
-        PDDocument document;
-        try {
-            document = pdfDocumentFactory.load(fileInput, password);
-        } catch (IOException e) {
-            // Handle password errors specifically
-            if (ExceptionUtils.isPasswordError(e)) {
-                throw ExceptionUtils.createPdfPasswordException(e);
-            }
-            throw ExceptionUtils.handlePdfException(e);
-        }
-
-        try {
+        try (PDDocument document = pdfDocumentFactory.load(fileInput, password)) {
             document.setAllSecurityToBeRemoved(true);
             return WebResponseUtils.pdfDocToWebResponse(
                     document,
                     GeneralUtils.generateFilename(
                             fileInput.getOriginalFilename(), "_password_removed.pdf"));
         } catch (IOException e) {
-            document.close();
+            // Handle password errors specifically
+            if (ExceptionUtils.isPasswordError(e)) {
+                throw ExceptionUtils.createPdfPasswordException(e);
+            }
             ExceptionUtils.logException("password removal", e);
             throw ExceptionUtils.handlePdfException(e);
         }
@@ -91,31 +83,36 @@ public class PasswordController {
         boolean preventPrinting = Boolean.TRUE.equals(request.getPreventPrinting());
         boolean preventPrintingFaithful = Boolean.TRUE.equals(request.getPreventPrintingFaithful());
 
-        PDDocument document = pdfDocumentFactory.load(fileInput);
-        AccessPermission ap = new AccessPermission();
-        ap.setCanAssembleDocument(!preventAssembly);
-        ap.setCanExtractContent(!preventExtractContent);
-        ap.setCanExtractForAccessibility(!preventExtractForAccessibility);
-        ap.setCanFillInForm(!preventFillInForm);
-        ap.setCanModify(!preventModify);
-        ap.setCanModifyAnnotations(!preventModifyAnnotations);
-        ap.setCanPrint(!preventPrinting);
-        ap.setCanPrintFaithful(!preventPrintingFaithful);
-        StandardProtectionPolicy spp = new StandardProtectionPolicy(ownerPassword, password, ap);
+        try (PDDocument document = pdfDocumentFactory.load(fileInput)) {
+            AccessPermission ap = new AccessPermission();
+            ap.setCanAssembleDocument(!preventAssembly);
+            ap.setCanExtractContent(!preventExtractContent);
+            ap.setCanExtractForAccessibility(!preventExtractForAccessibility);
+            ap.setCanFillInForm(!preventFillInForm);
+            ap.setCanModify(!preventModify);
+            ap.setCanModifyAnnotations(!preventModifyAnnotations);
+            ap.setCanPrint(!preventPrinting);
+            ap.setCanPrintFaithful(!preventPrintingFaithful);
+            StandardProtectionPolicy spp =
+                    new StandardProtectionPolicy(ownerPassword, password, ap);
 
-        if (!"".equals(ownerPassword) || !"".equals(password)) {
-            spp.setEncryptionKeyLength(keyLength);
-        }
-        spp.setPermissions(ap);
-        document.protect(spp);
+            if ((ownerPassword != null && ownerPassword.length() > 0)
+                    || (password != null && password.length() > 0)) {
+                spp.setEncryptionKeyLength(keyLength);
+            }
+            spp.setPermissions(ap);
+            document.protect(spp);
 
-        if ("".equals(ownerPassword) && "".equals(password))
+            if ((ownerPassword == null || ownerPassword.length() == 0)
+                    && (password == null || password.length() == 0))
+                return WebResponseUtils.pdfDocToWebResponse(
+                        document,
+                        GeneralUtils.generateFilename(
+                                fileInput.getOriginalFilename(), "_permissions.pdf"));
             return WebResponseUtils.pdfDocToWebResponse(
                     document,
                     GeneralUtils.generateFilename(
-                            fileInput.getOriginalFilename(), "_permissions.pdf"));
-        return WebResponseUtils.pdfDocToWebResponse(
-                document,
-                GeneralUtils.generateFilename(fileInput.getOriginalFilename(), "_passworded.pdf"));
+                            fileInput.getOriginalFilename(), "_passworded.pdf"));
+        }
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/security/RemoveCertSignController.java

@@ -41,28 +41,29 @@ public class RemoveCertSignController {
             throws Exception {
         MultipartFile pdf = request.getFileInput();
 
-        // Load the PDF document
-        PDDocument document = pdfDocumentFactory.load(pdf);
+        // Load the PDF document with proper resource management
+        try (PDDocument document = pdfDocumentFactory.load(pdf)) {
 
-        // Get the document catalog
-        PDDocumentCatalog catalog = document.getDocumentCatalog();
+            // Get the document catalog
+            PDDocumentCatalog catalog = document.getDocumentCatalog();
 
-        // Get the AcroForm
-        PDAcroForm acroForm = catalog.getAcroForm();
-        if (acroForm != null) {
-            // Remove signature fields safely
-            List<PDField> fieldsToRemove =
-                    acroForm.getFields().stream()
-                            .filter(field -> field instanceof PDSignatureField)
-                            .toList();
+            // Get the AcroForm
+            PDAcroForm acroForm = catalog.getAcroForm();
+            if (acroForm != null) {
+                // Remove signature fields safely
+                List<PDField> fieldsToRemove =
+                        acroForm.getFields().stream()
+                                .filter(field -> field instanceof PDSignatureField)
+                                .toList();
 
-            if (!fieldsToRemove.isEmpty()) {
-                acroForm.flatten(fieldsToRemove, false);
+                if (!fieldsToRemove.isEmpty()) {
+                    acroForm.flatten(fieldsToRemove, false);
+                }
             }
+            // Return the modified PDF as a response
+            return WebResponseUtils.pdfDocToWebResponse(
+                    document,
+                    GeneralUtils.generateFilename(pdf.getOriginalFilename(), "_unsigned.pdf"));
         }
-        // Return the modified PDF as a response
-        return WebResponseUtils.pdfDocToWebResponse(
-                document,
-                GeneralUtils.generateFilename(pdf.getOriginalFilename(), "_unsigned.pdf"));
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/security/SanitizeController.java

@@ -67,39 +67,40 @@ public class SanitizeController {
         boolean removeLinks = Boolean.TRUE.equals(request.getRemoveLinks());
         boolean removeFonts = Boolean.TRUE.equals(request.getRemoveFonts());
 
-        PDDocument document = pdfDocumentFactory.load(inputFile, true);
-        if (removeJavaScript) {
-            sanitizeJavaScript(document);
+        try (PDDocument document = pdfDocumentFactory.load(inputFile, true)) {
+            if (removeJavaScript) {
+                sanitizeJavaScript(document);
+            }
+
+            if (removeEmbeddedFiles) {
+                sanitizeEmbeddedFiles(document);
+            }
+
+            if (removeXMPMetadata) {
+                sanitizeXMPMetadata(document);
+            }
+
+            if (removeMetadata) {
+                sanitizeDocumentInfoMetadata(document);
+            }
+
+            if (removeLinks) {
+                sanitizeLinks(document);
+            }
+
+            if (removeFonts) {
+                sanitizeFonts(document);
+            }
+
+            // Save the sanitized document to output stream
+            ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
+            document.save(outputStream);
+
+            return WebResponseUtils.bytesToWebResponse(
+                    outputStream.toByteArray(),
+                    GeneralUtils.generateFilename(
+                            inputFile.getOriginalFilename(), "_sanitized.pdf"));
         }
-
-        if (removeEmbeddedFiles) {
-            sanitizeEmbeddedFiles(document);
-        }
-
-        if (removeXMPMetadata) {
-            sanitizeXMPMetadata(document);
-        }
-
-        if (removeMetadata) {
-            sanitizeDocumentInfoMetadata(document);
-        }
-
-        if (removeLinks) {
-            sanitizeLinks(document);
-        }
-
-        if (removeFonts) {
-            sanitizeFonts(document);
-        }
-
-        // Save the sanitized document to output stream
-        ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
-        document.save(outputStream);
-        document.close();
-
-        return WebResponseUtils.bytesToWebResponse(
-                outputStream.toByteArray(),
-                GeneralUtils.generateFilename(inputFile.getOriginalFilename(), "_sanitized.pdf"));
     }
 
     private static void sanitizeJavaScript(PDDocument document) throws IOException {

app/core/src/main/java/stirling/software/SPDF/controller/api/security/WatermarkController.java

@@ -98,60 +98,67 @@ public class WatermarkController {
         String customColor = request.getCustomColor();
         boolean convertPdfToImage = Boolean.TRUE.equals(request.getConvertPDFToImage());
 
-        // Load the input PDF
-        PDDocument document = pdfDocumentFactory.load(pdfFile);
+        // Load the input PDF with proper resource management
+        try (PDDocument document = pdfDocumentFactory.load(pdfFile)) {
 
-        // Create a page in the document
-        for (PDPage page : document.getPages()) {
+            // Create a page in the document
+            for (PDPage page : document.getPages()) {
+                // Get the page's content stream
+                try (PDPageContentStream contentStream =
+                        new PDPageContentStream(
+                                document,
+                                page,
+                                PDPageContentStream.AppendMode.APPEND,
+                                true,
+                                true)) {
 
-            // Get the page's content stream
-            PDPageContentStream contentStream =
-                    new PDPageContentStream(
-                            document, page, PDPageContentStream.AppendMode.APPEND, true, true);
+                    // Set transparency
+                    PDExtendedGraphicsState graphicsState = new PDExtendedGraphicsState();
+                    graphicsState.setNonStrokingAlphaConstant(opacity);
+                    contentStream.setGraphicsStateParameters(graphicsState);
 
-            // Set transparency
-            PDExtendedGraphicsState graphicsState = new PDExtendedGraphicsState();
-            graphicsState.setNonStrokingAlphaConstant(opacity);
-            contentStream.setGraphicsStateParameters(graphicsState);
-
-            if ("text".equalsIgnoreCase(watermarkType)) {
-                addTextWatermark(
-                        contentStream,
-                        watermarkText,
-                        document,
-                        page,
-                        rotation,
-                        widthSpacer,
-                        heightSpacer,
-                        fontSize,
-                        alphabet,
-                        customColor);
-            } else if ("image".equalsIgnoreCase(watermarkType)) {
-                addImageWatermark(
-                        contentStream,
-                        watermarkImage,
-                        document,
-                        page,
-                        rotation,
-                        widthSpacer,
-                        heightSpacer,
-                        fontSize);
+                    if ("text".equalsIgnoreCase(watermarkType)) {
+                        addTextWatermark(
+                                contentStream,
+                                watermarkText,
+                                document,
+                                page,
+                                rotation,
+                                widthSpacer,
+                                heightSpacer,
+                                fontSize,
+                                alphabet,
+                                customColor);
+                    } else if ("image".equalsIgnoreCase(watermarkType)) {
+                        addImageWatermark(
+                                contentStream,
+                                watermarkImage,
+                                document,
+                                page,
+                                rotation,
+                                widthSpacer,
+                                heightSpacer,
+                                fontSize);
+                    }
+                }
             }
 
-            // Close the content stream
-            contentStream.close();
+            if (convertPdfToImage) {
+                try (PDDocument convertedPdf = PdfUtils.convertPdfToPdfImage(document)) {
+                    // Return the watermarked PDF as a response
+                    return WebResponseUtils.pdfDocToWebResponse(
+                            convertedPdf,
+                            GeneralUtils.generateFilename(
+                                    pdfFile.getOriginalFilename(), "_watermarked.pdf"));
+                }
+            } else {
+                // Return the watermarked PDF as a response
+                return WebResponseUtils.pdfDocToWebResponse(
+                        document,
+                        GeneralUtils.generateFilename(
+                                pdfFile.getOriginalFilename(), "_watermarked.pdf"));
+            }
         }
-
-        if (convertPdfToImage) {
-            PDDocument convertedPdf = PdfUtils.convertPdfToPdfImage(document);
-            document.close();
-            document = convertedPdf;
-        }
-
-        // Return the watermarked PDF as a response
-        return WebResponseUtils.pdfDocToWebResponse(
-                document,
-                GeneralUtils.generateFilename(pdfFile.getOriginalFilename(), "_watermarked.pdf"));
     }
 
     private void addTextWatermark(

app/core/src/main/java/stirling/software/SPDF/controller/web/ReactRoutingController.java

@@ -15,84 +15,106 @@ import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.util.HtmlUtils;
+import org.springframework.web.util.JavaScriptUtils;
 
 import jakarta.annotation.PostConstruct;
 import jakarta.servlet.http.HttpServletRequest;
 
-import lombok.extern.slf4j.Slf4j;
-
 import stirling.software.common.configuration.InstallationPathConfig;
 
-@Slf4j
 @Controller
 public class ReactRoutingController {
 
+    private static final org.slf4j.Logger log =
+            org.slf4j.LoggerFactory.getLogger(ReactRoutingController.class);
+
     @Value("${server.servlet.context-path:/}")
     private String contextPath;
 
     private String cachedIndexHtml;
+    private String cachedCallbackHtml;
     private boolean indexHtmlExists = false;
     private boolean useExternalIndexHtml = false;
+    private boolean loggedMissingIndex = false;
 
     @PostConstruct
     public void init() {
         log.info("Static files custom path: {}", InstallationPathConfig.getStaticPath());
 
+        // Always initialize callback HTML (used for OAuth desktop flow)
+        this.cachedCallbackHtml = buildCallbackHtml();
+
         // Check for external index.html first (customFiles/static/)
         Path externalIndexPath = Paths.get(InstallationPathConfig.getStaticPath(), "index.html");
         log.debug("Checking for custom index.html at: {}", externalIndexPath);
         if (Files.exists(externalIndexPath) && Files.isReadable(externalIndexPath)) {
             log.info("Using custom index.html from: {}", externalIndexPath);
-            try {
-                this.cachedIndexHtml = processIndexHtml();
-                this.indexHtmlExists = true;
-                this.useExternalIndexHtml = true;
-                return;
-            } catch (IOException e) {
-                log.warn("Failed to load custom index.html, falling back to classpath", e);
-            }
+            this.cachedIndexHtml = processIndexHtml();
+            this.indexHtmlExists = true;
+            this.useExternalIndexHtml = true;
+            return;
         }
 
         // Fall back to classpath index.html
         ClassPathResource resource = new ClassPathResource("static/index.html");
         if (resource.exists()) {
-            try {
-                this.cachedIndexHtml = processIndexHtml();
-                this.indexHtmlExists = true;
-                this.useExternalIndexHtml = false;
-            } catch (IOException e) {
-                // Failed to cache, will process on each request
-                log.warn("Failed to cache index.html", e);
-                this.indexHtmlExists = false;
+            this.cachedIndexHtml = processIndexHtml();
+            this.indexHtmlExists = true;
+            this.useExternalIndexHtml = false;
+            return;
+        }
+
+        // Neither external nor classpath index.html exists - cache fallback once
+        this.cachedIndexHtml = buildFallbackHtml();
+        this.indexHtmlExists = true;
+        this.useExternalIndexHtml = false;
+        this.loggedMissingIndex = true;
+        log.warn(
+                "index.html not found in classpath or custom path; using lightweight fallback page");
+    }
+
+    private String processIndexHtml() {
+        try {
+            Resource resource = getIndexHtmlResource();
+
+            if (!resource.exists()) {
+                if (!loggedMissingIndex) {
+                    log.warn("index.html not found, using lightweight fallback page");
+                    loggedMissingIndex = true;
+                }
+                return buildFallbackHtml();
             }
+
+            try (InputStream inputStream = resource.getInputStream()) {
+                String html = new String(inputStream.readAllBytes(), StandardCharsets.UTF_8);
+
+                // Replace %BASE_URL% with the actual context path for base href
+                String baseUrl = contextPath.endsWith("/") ? contextPath : contextPath + "/";
+                html = html.replace("%BASE_URL%", baseUrl);
+                // Also rewrite any existing <base> tag (Vite may have baked one in)
+                html =
+                        html.replaceFirst(
+                                "<base href=\\\"[^\\\"]*\\\"\\s*/?>",
+                                "<base href=\\\"" + baseUrl + "\\\" />");
+
+                // Inject context path as a global variable for API calls
+                String contextPathScript =
+                        "<script>window.STIRLING_PDF_API_BASE_URL = '" + baseUrl + "';</script>";
+                html = html.replace("</head>", contextPathScript + "</head>");
+
+                return html;
+            }
+        } catch (Exception ex) {
+            if (!loggedMissingIndex) {
+                log.warn("index.html not found, using lightweight fallback page", ex);
+                loggedMissingIndex = true;
+            }
+            return buildFallbackHtml();
         }
     }
 
-    private String processIndexHtml() throws IOException {
-        Resource resource = getIndexHtmlResource();
-
-        try (InputStream inputStream = resource.getInputStream()) {
-            String html = new String(inputStream.readAllBytes(), StandardCharsets.UTF_8);
-
-            // Replace %BASE_URL% with the actual context path for base href
-            String baseUrl = contextPath.endsWith("/") ? contextPath : contextPath + "/";
-            html = html.replace("%BASE_URL%", baseUrl);
-            // Also rewrite any existing <base> tag (Vite may have baked one in)
-            html =
-                    html.replaceFirst(
-                            "<base href=\\\"[^\\\"]*\\\"\\s*/?>",
-                            "<base href=\\\"" + baseUrl + "\\\" />");
-
-            // Inject context path as a global variable for API calls
-            String contextPathScript =
-                    "<script>window.STIRLING_PDF_API_BASE_URL = '" + baseUrl + "';</script>";
-            html = html.replace("</head>", contextPathScript + "</head>");
-
-            return html;
-        }
-    }
-
-    private Resource getIndexHtmlResource() throws IOException {
+    private Resource getIndexHtmlResource() {
         // Check external location first
         Path externalIndexPath = Paths.get(InstallationPathConfig.getStaticPath(), "index.html");
         if (Files.exists(externalIndexPath) && Files.isReadable(externalIndexPath)) {
@@ -106,12 +128,28 @@ public class ReactRoutingController {
     @GetMapping(
             value = {"/", "/index.html"},
             produces = MediaType.TEXT_HTML_VALUE)
-    public ResponseEntity<String> serveIndexHtml(HttpServletRequest request) throws IOException {
-        if (indexHtmlExists && cachedIndexHtml != null) {
-            return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(cachedIndexHtml);
+    public ResponseEntity<String> serveIndexHtml(HttpServletRequest request) {
+        try {
+            if (indexHtmlExists && cachedIndexHtml != null) {
+                return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(cachedIndexHtml);
+            }
+            // Fallback: process on each request (dev mode or cache failed)
+            return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(processIndexHtml());
+        } catch (Exception ex) {
+            log.error("Failed to serve index.html, returning fallback", ex);
+            return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(buildFallbackHtml());
         }
-        // Fallback: process on each request (dev mode or cache failed)
-        return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(processIndexHtml());
+    }
+
+    @GetMapping(value = "/auth/callback", produces = MediaType.TEXT_HTML_VALUE)
+    public ResponseEntity<String> serveAuthCallback(HttpServletRequest request) {
+        return serveIndexHtml(request);
+    }
+
+    @GetMapping(value = "/auth/callback/tauri", produces = MediaType.TEXT_HTML_VALUE)
+    public ResponseEntity<String> serveTauriAuthCallback(HttpServletRequest request) {
+        // cachedCallbackHtml is always initialized in @PostConstruct
+        return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(cachedCallbackHtml);
     }
 
     @GetMapping(
@@ -126,4 +164,309 @@ public class ReactRoutingController {
             throws IOException {
         return serveIndexHtml(request);
     }
+
+    private String buildFallbackHtml() {
+        String baseUrl = contextPath.endsWith("/") ? contextPath : contextPath + "/";
+
+        // Escape for HTML attribute context
+        String escapedBaseUrlHtml = HtmlUtils.htmlEscape(baseUrl);
+
+        // Escape for JavaScript string context
+        String escapedBaseUrlJs = JavaScriptUtils.javaScriptEscape(baseUrl);
+
+        String serverUrl = "(window.location.origin + '" + escapedBaseUrlJs + "')";
+        return """
+                <!doctype html>
+                <html>
+                  <head>
+                    <meta charset="utf-8" />
+                    <base href="%s" />
+                    <title>Stirling PDF</title>
+                    <script>
+                      // Minimal handler for SSO callback when index.html is missing (desktop fallback)
+                      (function() {
+                        const baseUrl = '%s';
+                        window.STIRLING_PDF_API_BASE_URL = baseUrl;
+                        const hashParams = new URLSearchParams(window.location.hash.replace(/^#/, ''));
+                        const searchParams = new URLSearchParams(window.location.search);
+                        const token = hashParams.get('access_token') || hashParams.get('token') || searchParams.get('access_token');
+                        const serverUrl = %s;
+
+                        if (token) {
+                          // Extract nonce from URL to send back to desktop app for validation
+                          const nonceFromUrl = hashParams.get('nonce') || searchParams.get('nonce');
+
+                          console.log('[Fallback Auth] Token received, sending to desktop app via deep link');
+
+                          // Send token + nonce via deep link to desktop app
+                          // Desktop app will validate nonce before accepting token
+                          try {
+                            const encodedToken = encodeURIComponent(token);
+                            const encodedServer = encodeURIComponent(serverUrl);
+                            const encodedNonce = nonceFromUrl ? encodeURIComponent(nonceFromUrl) : '';
+                            const deepLink = `stirlingpdf://auth/sso-complete?server=${encodedServer}#access_token=${encodedToken}&nonce=${encodedNonce}&type=sso-selfhosted`;
+                            window.location.href = deepLink;
+                            return;
+                          } catch (_) {
+                            // ignore deep link errors
+                          }
+                        }
+
+                        // No redirect to avoid loops when index.html is missing
+                      })();
+                    </script>
+                  </head>
+                  <body>
+                    <p>Stirling PDF is running.</p>
+                  </body>
+                </html>
+                """
+                .formatted(escapedBaseUrlHtml, escapedBaseUrlJs, serverUrl);
+    }
+
+    private String buildCallbackHtml() {
+        String baseUrl = contextPath.endsWith("/") ? contextPath : contextPath + "/";
+
+        // Escape for HTML attribute context
+        String escapedBaseUrlHtml = HtmlUtils.htmlEscape(baseUrl);
+
+        // Escape for JavaScript string context
+        String escapedBaseUrlJs = JavaScriptUtils.javaScriptEscape(baseUrl);
+
+        String serverUrl = "(window.location.origin + '" + escapedBaseUrlJs + "')";
+        return """
+                <!doctype html>
+                <html>
+                  <head>
+                    <meta charset="utf-8" />
+                    <base href="%s" />
+                    <title>Authentication Complete</title>
+                    <style>
+                      * {
+                        margin: 0;
+                        padding: 0;
+                        box-sizing: border-box;
+                      }
+
+                      body {
+                        font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
+                        text-align: center;
+                        padding: 50px 20px;
+                        background: #f5f5f5;
+                        min-height: 100vh;
+                        display: flex;
+                        align-items: center;
+                        justify-content: center;
+                      }
+
+                      .container {
+                        background: #ffffff;
+                        border-radius: 12px;
+                        padding: 40px;
+                        max-width: 420px;
+                        width: 100%%;
+                        box-shadow: 0 2px 8px rgba(0, 0, 0, 0.1);
+                        border: 1px solid #e5e7eb;
+                        color: #1a1a1a;
+                      }
+
+                      .icon {
+                        font-size: 48px;
+                        margin-bottom: 16px;
+                        color: #2e7d32;
+                      }
+
+                      .icon.error {
+                        color: #d32f2f;
+                      }
+
+                      h1 {
+                        font-size: 24px;
+                        font-weight: 600;
+                        margin-bottom: 12px;
+                        color: #1a1a1a;
+                      }
+
+                      p {
+                        color: #666;
+                        line-height: 1.6;
+                        font-size: 15px;
+                      }
+
+                      .error-details {
+                        background: #ffebee;
+                        border: 1px solid #ffcdd2;
+                        padding: 16px;
+                        border-radius: 8px;
+                        margin-top: 20px;
+                        font-size: 14px;
+                        color: #c62828;
+                        word-break: break-word;
+                        text-align: left;
+                        line-height: 1.5;
+                        display: none;
+                      }
+
+                      @media (prefers-color-scheme: dark) {
+                        body {
+                          background: #1a1a1a;
+                          color: #e0e0e0;
+                        }
+
+                        .container {
+                          background: #2d2d2d;
+                          box-shadow: 0 2px 8px rgba(0, 0, 0, 0.3);
+                          border-color: #374151;
+                          color: #e5e7eb;
+                        }
+
+                        .icon {
+                          color: #66bb6a;
+                        }
+
+                        .icon.error {
+                          color: #ef5350;
+                        }
+
+                        h1 {
+                          color: #f5f5f5;
+                        }
+
+                        p {
+                          color: #b0b0b0;
+                        }
+
+                        .error-details {
+                          background: #3d2020;
+                          border: 1px solid #5d3030;
+                          color: #ef9a9a;
+                        }
+                      }
+
+                      @media (max-width: 480px) {
+                        body {
+                          padding: 20px 16px;
+                        }
+
+                        .container {
+                          padding: 32px 24px;
+                        }
+
+                        h1 {
+                          font-size: 20px;
+                        }
+
+                        .icon {
+                          font-size: 40px;
+                        }
+                      }
+                    </style>
+                    <script>
+                      (function() {
+                        const run = () => {
+                          const hashParams = new URLSearchParams(window.location.hash.replace(/^#/, ''));
+                          const searchParams = new URLSearchParams(window.location.search);
+                          const token = hashParams.get('access_token') || hashParams.get('token') || searchParams.get('access_token');
+                          const errorCode = searchParams.get('errorOAuth')
+                            || searchParams.get('error')
+                            || hashParams.get('error')
+                            || searchParams.get('error_description')
+                            || hashParams.get('error_description');
+                          const serverUrl = %s;
+                          const iconEl = document.getElementById('auth-icon');
+                          const titleEl = document.getElementById('auth-title');
+                          const messageEl = document.getElementById('auth-message');
+                          const detailsEl = document.getElementById('auth-error-details');
+
+                          const sendDeepLink = (type, value, key) => {
+                            try {
+                              const encodedValue = encodeURIComponent(value || '');
+                              const encodedServer = encodeURIComponent(serverUrl);
+                              const hashKey = key || 'access_token';
+                              const deepLink = `stirlingpdf://auth/sso-complete?server=${encodedServer}#${hashKey}=${encodedValue}&type=${type}`;
+                              window.location.href = deepLink;
+                            } catch (_) {
+                              // ignore deep link errors
+                            }
+                          };
+
+                          const showError = (message, details) => {
+                            if (iconEl) {
+                              iconEl.textContent = '✗';
+                              iconEl.classList.add('error');
+                            }
+                            if (titleEl) {
+                              titleEl.textContent = 'Authentication failed';
+                            }
+                            if (messageEl) {
+                              messageEl.textContent = message;
+                            }
+                            if (detailsEl && details) {
+                              detailsEl.textContent = details;
+                              detailsEl.style.display = 'block';
+                            }
+                          };
+
+                          if (token) {
+                            // Extract nonce from URL to send back to desktop app for validation
+                            // (System browser doesn't have access to desktop app's sessionStorage)
+                            const nonceFromUrl = hashParams.get('nonce') || searchParams.get('nonce');
+
+                            console.log('[Auth Callback] Token received, sending to desktop app via deep link');
+
+                            // Send token + nonce via deep link to desktop app
+                            // Desktop app will validate nonce before accepting token
+                            setTimeout(() => {
+                              try {
+                                const encodedToken = encodeURIComponent(token);
+                                const encodedServer = encodeURIComponent(serverUrl);
+                                const encodedNonce = nonceFromUrl ? encodeURIComponent(nonceFromUrl) : '';
+                                const deepLink = `stirlingpdf://auth/sso-complete?server=${encodedServer}#access_token=${encodedToken}&nonce=${encodedNonce}&type=sso-selfhosted`;
+                                window.location.href = deepLink;
+                              } catch (err) {
+                                console.error('[Auth Callback] Failed to trigger deep link:', err);
+                              }
+                            }, 200);
+
+                            return;
+                          }
+
+                          if (errorCode) {
+                            const isCancelled = errorCode === 'access_denied';
+                            sendDeepLink('sso-error', errorCode, 'error');
+                            showError(
+                              isCancelled
+                                ? 'Authentication was cancelled. You can close this window and return to the app.'
+                                : 'Authentication was not successful. You can close this window and return to the app.',
+                              errorCode
+                            );
+                            return;
+                          }
+
+                          showError(
+                            'Authentication did not complete. You can close this window and try again.',
+                            'missing_token'
+                          );
+                        };
+
+                        if (document.readyState === 'loading') {
+                          document.addEventListener('DOMContentLoaded', run);
+                        } else {
+                          run();
+                        }
+                      })();
+                    </script>
+                  </head>
+                  <body>
+                    <div class="container">
+                      <div class="icon" id="auth-icon">&#10003;</div>
+                      <h1 id="auth-title">Authentication complete</h1>
+                      <p id="auth-message">You can close this window and return to Stirling PDF.</p>
+                      <div class="error-details" id="auth-error-details"></div>
+                    </div>
+                  </body>
+                </html>
+                """
+                .formatted(escapedBaseUrlHtml, serverUrl);
+    }
 }

app/core/src/main/java/stirling/software/SPDF/exception/GlobalExceptionHandler.java

@@ -80,7 +80,7 @@ import stirling.software.common.util.RegexPatternUtils;
  * <pre>{@code
  * // In controllers/services - use ExceptionUtils to create typed exceptions:
  * try {
- *     PDDocument doc = PDDocument.load(file);
+ *     PDDocument doc = Loader.loadPDF(file);
  * } catch (IOException e) {
  *     throw ExceptionUtils.createPdfCorruptedException("during load", e);
  * }
@@ -1117,6 +1117,34 @@ public class GlobalExceptionHandler {
             return handleBaseApp((BaseAppException) processedException, request);
         }
 
+        // Check if this is a NoSuchFileException (temp file was deleted prematurely)
+        if (ex instanceof java.nio.file.NoSuchFileException) {
+            log.error(
+                    "Temporary file not found at {}: {}",
+                    request.getRequestURI(),
+                    ex.getMessage(),
+                    ex);
+
+            String message =
+                    getLocalizedMessage(
+                            "error.tempFileNotFound.detail",
+                            "The temporary file was not found. This may indicate a processing error or cleanup issue. Please try again.");
+            String title =
+                    getLocalizedMessage("error.tempFileNotFound.title", "Temporary File Not Found");
+
+            ProblemDetail problemDetail =
+                    createBaseProblemDetail(HttpStatus.INTERNAL_SERVER_ERROR, message, request);
+            problemDetail.setType(URI.create("https://stirlingpdf.com/errors/temp-file-not-found"));
+            problemDetail.setTitle(title);
+            problemDetail.setProperty("title", title);
+            problemDetail.setProperty("errorCode", "E999");
+            problemDetail.setProperty(
+                    "hint.1",
+                    "This error usually occurs when temporary files are cleaned up before processing completes.");
+            problemDetail.setProperty("hint.2", "Try submitting your request again.");
+            return new ResponseEntity<>(problemDetail, HttpStatus.INTERNAL_SERVER_ERROR);
+        }
+
         log.error("IO error at {}: {}", request.getRequestURI(), ex.getMessage(), ex);
 
         String message =
@@ -1161,9 +1189,19 @@ public class GlobalExceptionHandler {
      */
     @ExceptionHandler(Exception.class)
     public ResponseEntity<ProblemDetail> handleGenericException(
-            Exception ex, HttpServletRequest request) {
+            Exception ex, HttpServletRequest request, HttpServletResponse response) {
         log.error("Unexpected error at {}: {}", request.getRequestURI(), ex.getMessage(), ex);
 
+        // If response is already committed (e.g., during streaming), we can't send an error
+        // response
+        // Log the error and return null to let Spring handle it gracefully
+        if (response.isCommitted()) {
+            log.warn(
+                    "Cannot send error response because response is already committed for URI: {}",
+                    request.getRequestURI());
+            return null; // Spring will handle gracefully
+        }
+
         String userMessage =
                 getLocalizedMessage(
                         "error.unexpected",

app/core/src/main/java/stirling/software/SPDF/service/pdfjson/type3/library/Type3FontLibrary.java

@@ -220,6 +220,9 @@ public class Type3FontLibrary {
     }
 
     private byte[] loadResourceBytes(String location) throws IOException {
+        if (location == null || location.isBlank()) {
+            throw new IOException("Resource location is null or blank");
+        }
         String resolved = resolveLocation(location);
         Resource resource = resourceLoader.getResource(resolved);
         if (!resource.exists()) {

app/core/src/test/java/stirling/software/SPDF/SPDFApplicationTest.java

@@ -55,7 +55,7 @@ public class SPDFApplicationTest {
 
         sPDFApplication.init();
 
-        assertEquals("http://localhost", SPDFApplication.getStaticBaseUrl());
+        assertEquals("http://localhost:8080", SPDFApplication.getStaticBaseUrl());
         assertEquals("/app", SPDFApplication.getStaticContextPath());
         assertEquals("8080", SPDFApplication.getStaticPort());
     }

app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/SecurityConfiguration.java

@@ -18,6 +18,7 @@ import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
 import org.springframework.security.saml2.provider.service.authentication.OpenSaml4AuthenticationProvider;
 import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
 import org.springframework.security.saml2.provider.service.web.authentication.OpenSaml4AuthenticationRequestResolver;
@@ -46,6 +47,7 @@ import stirling.software.proprietary.security.filter.JwtAuthenticationFilter;
 import stirling.software.proprietary.security.filter.UserAuthenticationFilter;
 import stirling.software.proprietary.security.oauth2.CustomOAuth2AuthenticationFailureHandler;
 import stirling.software.proprietary.security.oauth2.CustomOAuth2AuthenticationSuccessHandler;
+import stirling.software.proprietary.security.oauth2.TauriAuthorizationRequestResolver;
 import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticationFailureHandler;
 import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticationSuccessHandler;
 import stirling.software.proprietary.security.saml2.CustomSaml2ResponseAuthenticationConverter;
@@ -82,6 +84,7 @@ public class SecurityConfiguration {
     private final OpenSaml4AuthenticationRequestResolver saml2AuthenticationRequestResolver;
     private final stirling.software.proprietary.service.UserLicenseSettingsService
             licenseSettingsService;
+    private final ClientRegistrationRepository clientRegistrationRepository;
 
     public SecurityConfiguration(
             PersistentLoginRepository persistentLoginRepository,
@@ -102,6 +105,7 @@ public class SecurityConfiguration {
                     RelyingPartyRegistrationRepository saml2RelyingPartyRegistrations,
             @Autowired(required = false)
                     OpenSaml4AuthenticationRequestResolver saml2AuthenticationRequestResolver,
+            @Autowired(required = false) ClientRegistrationRepository clientRegistrationRepository,
             stirling.software.proprietary.service.UserLicenseSettingsService
                     licenseSettingsService) {
         this.userDetailsService = userDetailsService;
@@ -120,6 +124,7 @@ public class SecurityConfiguration {
         this.oAuth2userAuthoritiesMapper = oAuth2userAuthoritiesMapper;
         this.saml2RelyingPartyRegistrations = saml2RelyingPartyRegistrations;
         this.saml2AuthenticationRequestResolver = saml2AuthenticationRequestResolver;
+        this.clientRegistrationRepository = clientRegistrationRepository;
         this.licenseSettingsService = licenseSettingsService;
     }
 
@@ -290,6 +295,15 @@ public class SecurityConfiguration {
                 http.oauth2Login(
                         oauth2 -> {
                             oauth2.loginPage("/login")
+                                    .authorizationEndpoint(
+                                            authorizationEndpoint -> {
+                                                if (clientRegistrationRepository != null) {
+                                                    authorizationEndpoint
+                                                            .authorizationRequestResolver(
+                                                                    new TauriAuthorizationRequestResolver(
+                                                                            clientRegistrationRepository));
+                                                }
+                                            })
                                     .successHandler(
                                             new CustomOAuth2AuthenticationSuccessHandler(
                                                     loginAttemptService,

app/proprietary/src/main/java/stirling/software/proprietary/security/oauth2/CustomOAuth2AuthenticationFailureHandler.java

@@ -1,7 +1,11 @@
 package stirling.software.proprietary.security.oauth2;
 
 import java.io.IOException;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
 
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.ResponseCookie;
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.authentication.DisabledException;
 import org.springframework.security.authentication.LockedException;
@@ -60,9 +64,66 @@ public class CustomOAuth2AuthenticationFailureHandler
                     "OAuth2 Authentication error: {}",
                     errorCode != null ? errorCode : exception.getMessage(),
                     exception);
-            getRedirectStrategy().sendRedirect(request, response, "/login?errorOAuth=" + errorCode);
+            String errorValue = errorCode != null ? errorCode : "oauth2AuthenticationError";
+            clearRedirectCookie(response);
+            boolean tauriState = TauriOAuthUtils.isTauriState(request);
+            String redirectUrl;
+            if (tauriState) {
+                String basePath =
+                        TauriOAuthUtils.defaultTauriCallbackPath(request.getContextPath());
+                redirectUrl = basePath;
+                String stateParam = request.getParameter("state");
+                if (stateParam != null && !stateParam.isBlank()) {
+                    redirectUrl = appendQueryParam(redirectUrl, "state", stateParam);
+                    // Extract and pass nonce for CSRF validation
+                    String nonce = TauriOAuthUtils.extractNonceFromState(stateParam);
+                    if (nonce != null) {
+                        redirectUrl = appendQueryParam(redirectUrl, "nonce", nonce);
+                    }
+                }
+                redirectUrl = appendQueryParam(redirectUrl, "errorOAuth", errorValue);
+            } else {
+                redirectUrl = buildFailureRedirectUrl(request, errorValue);
+            }
+            getRedirectStrategy().sendRedirect(request, response, redirectUrl);
+            return;
         }
         log.error("Unhandled authentication exception", exception);
         super.onAuthenticationFailure(request, response, exception);
     }
+
+    private String buildFailureRedirectUrl(HttpServletRequest request, String errorValue) {
+        String contextPath = request.getContextPath();
+        String cookiePath = TauriOAuthUtils.extractRedirectPathFromCookie(request);
+        String redirectPath =
+                cookiePath != null ? cookiePath : TauriOAuthUtils.defaultCallbackPath(contextPath);
+        if (TauriOAuthUtils.isTauriState(request)) {
+            redirectPath = appendQueryParam(redirectPath, "tauri", "1");
+        }
+        String resolvedPath =
+                redirectPath.startsWith("/")
+                        ? TauriOAuthUtils.normalizeContextPath(contextPath) + redirectPath
+                        : TauriOAuthUtils.normalizeContextPath(contextPath) + "/" + redirectPath;
+        return appendQueryParam(resolvedPath, "errorOAuth", errorValue);
+    }
+
+    private void clearRedirectCookie(HttpServletResponse response) {
+        ResponseCookie cookie =
+                ResponseCookie.from(TauriOAuthUtils.SPA_REDIRECT_COOKIE, "")
+                        .path("/")
+                        .sameSite("Lax")
+                        .maxAge(0)
+                        .build();
+        response.addHeader(HttpHeaders.SET_COOKIE, cookie.toString());
+    }
+
+    private String appendQueryParam(String path, String key, String value) {
+        if (path == null || path.isBlank()) {
+            return path;
+        }
+        String separator = path.contains("?") ? "&" : "?";
+        String encodedKey = URLEncoder.encode(key, StandardCharsets.UTF_8);
+        String encodedValue = value == null ? "" : URLEncoder.encode(value, StandardCharsets.UTF_8);
+        return path + separator + encodedKey + "=" + encodedValue;
+    }
 }

app/proprietary/src/main/java/stirling/software/proprietary/security/oauth2/CustomOAuth2AuthenticationSuccessHandler.java

@@ -4,8 +4,6 @@ import static stirling.software.proprietary.security.model.AuthenticationType.OA
 import static stirling.software.proprietary.security.model.AuthenticationType.SSO;
 
 import java.io.IOException;
-import java.net.URLDecoder;
-import java.nio.charset.StandardCharsets;
 import java.sql.SQLException;
 import java.util.Map;
 import java.util.Optional;
@@ -21,7 +19,6 @@ import org.springframework.security.web.authentication.SavedRequestAwareAuthenti
 import org.springframework.security.web.savedrequest.SavedRequest;
 
 import jakarta.servlet.ServletException;
-import jakarta.servlet.http.Cookie;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import jakarta.servlet.http.HttpSession;
@@ -45,9 +42,6 @@ import stirling.software.proprietary.security.service.UserService;
 public class CustomOAuth2AuthenticationSuccessHandler
         extends SavedRequestAwareAuthenticationSuccessHandler {
 
-    private static final String SPA_REDIRECT_COOKIE = "stirling_redirect_path";
-    private static final String DEFAULT_CALLBACK_PATH = "/auth/callback";
-
     private final LoginAttemptService loginAttemptService;
     private final ApplicationProperties.Security.OAUTH2 oauth2Properties;
     private final UserService userService;
@@ -210,39 +204,28 @@ public class CustomOAuth2AuthenticationSuccessHandler
                                         resolveOriginFromReferer(request)
                                                 .orElseGet(() -> buildOriginFromRequest(request)));
         clearRedirectCookie(response);
-        return origin + redirectPath + "#access_token=" + jwt;
+
+        // Extract nonce from state for CSRF validation in callback
+        String nonce = TauriOAuthUtils.extractNonceFromRequest(request);
+        String url = origin + redirectPath + "#access_token=" + jwt;
+        if (nonce != null) {
+            url +=
+                    "&nonce="
+                            + java.net.URLEncoder.encode(
+                                    nonce, java.nio.charset.StandardCharsets.UTF_8);
+        }
+        return url;
     }
 
     private String resolveRedirectPath(HttpServletRequest request, String contextPath) {
-        return extractRedirectPathFromCookie(request)
-                .filter(path -> path.startsWith("/"))
-                .orElseGet(() -> defaultCallbackPath(contextPath));
-    }
-
-    private Optional<String> extractRedirectPathFromCookie(HttpServletRequest request) {
-        Cookie[] cookies = request.getCookies();
-        if (cookies == null) {
-            return Optional.empty();
+        if (TauriOAuthUtils.isTauriState(request)) {
+            return TauriOAuthUtils.defaultTauriCallbackPath(contextPath);
         }
-        for (Cookie cookie : cookies) {
-            if (SPA_REDIRECT_COOKIE.equals(cookie.getName())) {
-                String value = URLDecoder.decode(cookie.getValue(), StandardCharsets.UTF_8).trim();
-                if (!value.isEmpty()) {
-                    return Optional.of(value);
-                }
-            }
+        String cookiePath = TauriOAuthUtils.extractRedirectPathFromCookie(request);
+        if (cookiePath != null && cookiePath.startsWith("/")) {
+            return cookiePath;
         }
-        return Optional.empty();
-    }
-
-    private String defaultCallbackPath(String contextPath) {
-        if (contextPath == null
-                || contextPath.isBlank()
-                || "/".equals(contextPath)
-                || "\\".equals(contextPath)) {
-            return DEFAULT_CALLBACK_PATH;
-        }
-        return contextPath + DEFAULT_CALLBACK_PATH;
+        return TauriOAuthUtils.defaultCallbackPath(contextPath);
     }
 
     private Optional<String> resolveForwardedOrigin(HttpServletRequest request) {
@@ -326,7 +309,7 @@ public class CustomOAuth2AuthenticationSuccessHandler
 
     private void clearRedirectCookie(HttpServletResponse response) {
         ResponseCookie cookie =
-                ResponseCookie.from(SPA_REDIRECT_COOKIE, "")
+                ResponseCookie.from(TauriOAuthUtils.SPA_REDIRECT_COOKIE, "")
                         .path("/")
                         .sameSite("Lax")
                         .maxAge(0)

app/proprietary/src/main/java/stirling/software/proprietary/security/oauth2/TauriAuthorizationRequestResolver.java

@@ -0,0 +1,58 @@
+package stirling.software.proprietary.security.oauth2;
+
+import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
+import org.springframework.security.oauth2.client.web.DefaultOAuth2AuthorizationRequestResolver;
+import org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestResolver;
+import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest;
+
+import jakarta.servlet.http.HttpServletRequest;
+
+public class TauriAuthorizationRequestResolver implements OAuth2AuthorizationRequestResolver {
+
+    private static final String TAURI_STATE_PREFIX = "tauri:";
+
+    private final OAuth2AuthorizationRequestResolver delegate;
+
+    public TauriAuthorizationRequestResolver(
+            ClientRegistrationRepository clientRegistrationRepository) {
+        this.delegate =
+                new DefaultOAuth2AuthorizationRequestResolver(
+                        clientRegistrationRepository, "/oauth2/authorization");
+    }
+
+    @Override
+    public OAuth2AuthorizationRequest resolve(HttpServletRequest request) {
+        return customize(request, delegate.resolve(request));
+    }
+
+    @Override
+    public OAuth2AuthorizationRequest resolve(
+            HttpServletRequest request, String clientRegistrationId) {
+        return customize(request, delegate.resolve(request, clientRegistrationId));
+    }
+
+    private OAuth2AuthorizationRequest customize(
+            HttpServletRequest request, OAuth2AuthorizationRequest authorizationRequest) {
+        if (authorizationRequest == null) {
+            return null;
+        }
+        String tauriParam = request.getParameter("tauri");
+        if (!"1".equals(tauriParam)) {
+            return authorizationRequest;
+        }
+
+        String state = authorizationRequest.getState();
+        if (state == null || state.startsWith(TAURI_STATE_PREFIX)) {
+            return authorizationRequest;
+        }
+
+        // Extract nonce from request for CSRF protection
+        String nonce = request.getParameter("nonce");
+        String customState = TAURI_STATE_PREFIX + state;
+        if (nonce != null && !nonce.isBlank()) {
+            customState = customState + ":" + nonce;
+        }
+
+        return OAuth2AuthorizationRequest.from(authorizationRequest).state(customState).build();
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/security/oauth2/TauriOAuthUtils.java

@@ -0,0 +1,122 @@
+package stirling.software.proprietary.security.oauth2;
+
+import jakarta.servlet.http.Cookie;
+import jakarta.servlet.http.HttpServletRequest;
+
+/**
+ * Utility class for Tauri desktop OAuth flow handling. Centralizes common logic for OAuth state
+ * management, nonce validation, and callback path construction.
+ */
+public final class TauriOAuthUtils {
+
+    public static final String TAURI_STATE_PREFIX = "tauri:";
+    public static final String SPA_REDIRECT_COOKIE = "stirling_redirect_path";
+    public static final String DEFAULT_CALLBACK_PATH = "/auth/callback";
+    public static final String TAURI_CALLBACK_SUFFIX = "/tauri";
+
+    private TauriOAuthUtils() {
+        // Utility class - prevent instantiation
+    }
+
+    /**
+     * Extracts nonce from OAuth state parameter for CSRF validation. State format:
+     * tauri:<original-state>:<nonce>
+     *
+     * @param state The state parameter value
+     * @return The nonce if present, null otherwise
+     */
+    public static String extractNonceFromState(String state) {
+        if (state == null || !state.startsWith(TAURI_STATE_PREFIX)) {
+            return null;
+        }
+        // Split by ':' and get the last part (nonce)
+        String[] parts = state.split(":");
+        if (parts.length >= 3) {
+            return parts[parts.length - 1];
+        }
+        return null;
+    }
+
+    /**
+     * Extracts nonce from request's state parameter.
+     *
+     * @param request The HTTP request
+     * @return The nonce if present, null otherwise
+     */
+    public static String extractNonceFromRequest(HttpServletRequest request) {
+        String state = request.getParameter("state");
+        return extractNonceFromState(state);
+    }
+
+    /**
+     * Checks if the request has a Tauri state parameter (desktop OAuth flow).
+     *
+     * @param request The HTTP request
+     * @return true if this is a Tauri desktop OAuth flow, false otherwise
+     */
+    public static boolean isTauriState(HttpServletRequest request) {
+        String state = request.getParameter("state");
+        return state != null && state.startsWith(TAURI_STATE_PREFIX);
+    }
+
+    /**
+     * Builds the default callback path for the given context path.
+     *
+     * @param contextPath The application context path
+     * @return The full callback path
+     */
+    public static String defaultCallbackPath(String contextPath) {
+        if (contextPath == null
+                || contextPath.isBlank()
+                || "/".equals(contextPath)
+                || "\\".equals(contextPath)) {
+            return DEFAULT_CALLBACK_PATH;
+        }
+        return contextPath + DEFAULT_CALLBACK_PATH;
+    }
+
+    /**
+     * Builds the Tauri-specific callback path (includes /tauri suffix).
+     *
+     * @param contextPath The application context path
+     * @return The full Tauri callback path
+     */
+    public static String defaultTauriCallbackPath(String contextPath) {
+        return defaultCallbackPath(contextPath) + TAURI_CALLBACK_SUFFIX;
+    }
+
+    /**
+     * Normalizes context path by removing trailing slashes and handling empty/root paths.
+     *
+     * @param contextPath The context path to normalize
+     * @return Normalized context path (empty string for root)
+     */
+    public static String normalizeContextPath(String contextPath) {
+        if (contextPath == null || contextPath.isBlank() || "/".equals(contextPath)) {
+            return "";
+        }
+        return contextPath;
+    }
+
+    /**
+     * Finds the SPA redirect cookie value from the request.
+     *
+     * @param request The HTTP request
+     * @return The redirect path from cookie, or null if not found
+     */
+    public static String extractRedirectPathFromCookie(HttpServletRequest request) {
+        Cookie[] cookies = request.getCookies();
+        if (cookies == null) {
+            return null;
+        }
+        for (Cookie cookie : cookies) {
+            if (SPA_REDIRECT_COOKIE.equals(cookie.getName())) {
+                String value =
+                        java.net.URLDecoder.decode(
+                                cookie.getValue(), java.nio.charset.StandardCharsets.UTF_8);
+                return value.trim().isEmpty() ? null : value.trim();
+            }
+        }
+        return null;
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/util/FormUtils.java

@@ -292,6 +292,7 @@ public class FormUtils {
         }
 
         PDFRenderer renderer = new PDFRenderer(document);
+        renderer.setSubsamplingAllowed(true); // Enable subsampling to reduce memory usage
         ApplicationProperties properties =
                 ApplicationContextProvider.getBean(ApplicationProperties.class);
 

app/proprietary/src/test/java/stirling/software/proprietary/security/oauth2/CustomOAuth2AuthenticationFailureHandlerTest.java

@@ -0,0 +1,47 @@
+package stirling.software.proprietary.security.oauth2;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
+import org.springframework.security.oauth2.core.OAuth2Error;
+
+class CustomOAuth2AuthenticationFailureHandlerTest {
+
+    @Test
+    void redirectsToTauriCallbackWhenStateMarked() throws Exception {
+        CustomOAuth2AuthenticationFailureHandler handler =
+                new CustomOAuth2AuthenticationFailureHandler();
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        request.setContextPath("");
+        request.setParameter("state", "tauri:abc");
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        handler.onAuthenticationFailure(
+                request,
+                response,
+                new OAuth2AuthenticationException(new OAuth2Error("access_denied")));
+
+        assertEquals(
+                "/auth/callback/tauri?state=tauri%3Aabc&errorOAuth=access_denied",
+                response.getRedirectedUrl());
+    }
+
+    @Test
+    void redirectsToDefaultCallbackWithoutTauriState() throws Exception {
+        CustomOAuth2AuthenticationFailureHandler handler =
+                new CustomOAuth2AuthenticationFailureHandler();
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        request.setContextPath("");
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        handler.onAuthenticationFailure(
+                request,
+                response,
+                new OAuth2AuthenticationException(new OAuth2Error("access_denied")));
+
+        assertEquals("/auth/callback?errorOAuth=access_denied", response.getRedirectedUrl());
+    }
+}

app/proprietary/src/test/java/stirling/software/proprietary/security/oauth2/CustomOAuth2AuthenticationSuccessHandlerTest.java

@@ -0,0 +1,79 @@
+package stirling.software.proprietary.security.oauth2;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+import java.util.Map;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
+import org.springframework.security.oauth2.core.user.DefaultOAuth2User;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.security.service.JwtServiceInterface;
+import stirling.software.proprietary.security.service.LoginAttemptService;
+import stirling.software.proprietary.security.service.UserService;
+import stirling.software.proprietary.service.UserLicenseSettingsService;
+
+@ExtendWith(MockitoExtension.class)
+class CustomOAuth2AuthenticationSuccessHandlerTest {
+
+    @Test
+    void redirectsToTauriCallbackWhenStateMarked() throws Exception {
+        LoginAttemptService loginAttemptService = mock(LoginAttemptService.class);
+        UserService userService = mock(UserService.class);
+        JwtServiceInterface jwtService = mock(JwtServiceInterface.class);
+        UserLicenseSettingsService licenseSettingsService = mock(UserLicenseSettingsService.class);
+
+        ApplicationProperties.Security.OAUTH2 oauth2Props =
+                new ApplicationProperties.Security.OAUTH2();
+        oauth2Props.setAutoCreateUser(true);
+        oauth2Props.setBlockRegistration(false);
+
+        CustomOAuth2AuthenticationSuccessHandler handler =
+                new CustomOAuth2AuthenticationSuccessHandler(
+                        loginAttemptService,
+                        oauth2Props,
+                        userService,
+                        jwtService,
+                        licenseSettingsService);
+
+        when(userService.usernameExistsIgnoreCase("user")).thenReturn(false);
+        when(licenseSettingsService.isOAuthEligible(null)).thenReturn(true);
+        when(userService.isUserDisabled("user")).thenReturn(false);
+        when(jwtService.isJwtEnabled()).thenReturn(true);
+        when(jwtService.generateToken(
+                        org.mockito.Mockito.any(
+                                org.springframework.security.core.Authentication.class),
+                        org.mockito.Mockito.anyMap()))
+                .thenReturn("jwt");
+
+        Map<String, Object> attributes = Map.of("sub", "provider-sub", "name", "user");
+        DefaultOAuth2User oauthUser =
+                new DefaultOAuth2User(
+                        List.of(new SimpleGrantedAuthority("ROLE_USER")), attributes, "name");
+        OAuth2AuthenticationToken authentication =
+                new OAuth2AuthenticationToken(oauthUser, oauthUser.getAuthorities(), "google");
+
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        request.setContextPath("");
+        request.setScheme("http");
+        request.setServerName("localhost");
+        request.setServerPort(8080);
+        request.setParameter("state", "tauri:abc");
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        handler.onAuthenticationSuccess(request, response, authentication);
+
+        assertEquals(
+                "http://localhost:8080/auth/callback/tauri#access_token=jwt",
+                response.getRedirectedUrl());
+    }
+}

app/proprietary/src/test/java/stirling/software/proprietary/security/oauth2/TauriAuthorizationRequestResolverTest.java

@@ -0,0 +1,62 @@
+package stirling.software.proprietary.security.oauth2;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.security.oauth2.client.registration.ClientRegistration;
+import org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository;
+import org.springframework.security.oauth2.core.AuthorizationGrantType;
+import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest;
+
+class TauriAuthorizationRequestResolverTest {
+
+    private TauriAuthorizationRequestResolver buildResolver() {
+        ClientRegistration registration =
+                ClientRegistration.withRegistrationId("google")
+                        .clientId("client-id")
+                        .clientSecret("client-secret")
+                        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
+                        .authorizationUri("https://accounts.example.com/o/oauth2/auth")
+                        .tokenUri("https://accounts.example.com/o/oauth2/token")
+                        .redirectUri("http://localhost:8080/login/oauth2/code/google")
+                        .userInfoUri("https://accounts.example.com/userinfo")
+                        .userNameAttributeName("sub")
+                        .clientName("Google")
+                        .scope("email")
+                        .build();
+
+        return new TauriAuthorizationRequestResolver(
+                new InMemoryClientRegistrationRepository(registration));
+    }
+
+    private MockHttpServletRequest buildRequest(boolean tauri) {
+        MockHttpServletRequest request =
+                new MockHttpServletRequest("GET", "/oauth2/authorization/google");
+        request.setServletPath("/oauth2/authorization/google");
+        if (tauri) {
+            request.setParameter("tauri", "1");
+        }
+        return request;
+    }
+
+    @Test
+    void resolve_prefixesStateWhenTauriParamPresent() {
+        TauriAuthorizationRequestResolver resolver = buildResolver();
+        OAuth2AuthorizationRequest authRequest = resolver.resolve(buildRequest(true));
+        assertNotNull(authRequest);
+        assertNotNull(authRequest.getState());
+        assertTrue(authRequest.getState().startsWith("tauri:"));
+    }
+
+    @Test
+    void resolve_doesNotPrefixStateWithoutTauriParam() {
+        TauriAuthorizationRequestResolver resolver = buildResolver();
+        OAuth2AuthorizationRequest authRequest = resolver.resolve(buildRequest(false));
+        assertNotNull(authRequest);
+        assertNotNull(authRequest.getState());
+        assertFalse(authRequest.getState().startsWith("tauri:"));
+    }
+}

app/proprietary/src/test/java/stirling/software/proprietary/security/oauth2/TauriOAuthUtilsTest.java

@@ -0,0 +1,135 @@
+package stirling.software.proprietary.security.oauth2;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.mock.web.MockHttpServletRequest;
+
+class TauriOAuthUtilsTest {
+
+    @Test
+    void extractNonceFromState_validState() {
+        String state = "tauri:original-state-12345:test-nonce-uuid";
+        String nonce = TauriOAuthUtils.extractNonceFromState(state);
+        assertEquals("test-nonce-uuid", nonce);
+    }
+
+    @Test
+    void extractNonceFromState_stateWithColonInNonce() {
+        String state = "tauri:original:complex:nonce-with-colon";
+        String nonce = TauriOAuthUtils.extractNonceFromState(state);
+        assertEquals("nonce-with-colon", nonce);
+    }
+
+    @Test
+    void extractNonceFromState_noNonce() {
+        String state = "tauri:original-state";
+        String nonce = TauriOAuthUtils.extractNonceFromState(state);
+        assertNull(nonce);
+    }
+
+    @Test
+    void extractNonceFromState_notTauriState() {
+        String state = "regular-state:with-colons";
+        String nonce = TauriOAuthUtils.extractNonceFromState(state);
+        assertNull(nonce);
+    }
+
+    @Test
+    void extractNonceFromState_nullState() {
+        String nonce = TauriOAuthUtils.extractNonceFromState(null);
+        assertNull(nonce);
+    }
+
+    @Test
+    void extractNonceFromRequest_validRequest() {
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        request.setParameter("state", "tauri:abc:nonce-123");
+
+        String nonce = TauriOAuthUtils.extractNonceFromRequest(request);
+        assertEquals("nonce-123", nonce);
+    }
+
+    @Test
+    void isTauriState_validTauriState() {
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        request.setParameter("state", "tauri:original-state");
+
+        assertTrue(TauriOAuthUtils.isTauriState(request));
+    }
+
+    @Test
+    void isTauriState_notTauriState() {
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        request.setParameter("state", "regular-state");
+
+        assertFalse(TauriOAuthUtils.isTauriState(request));
+    }
+
+    @Test
+    void isTauriState_noState() {
+        MockHttpServletRequest request = new MockHttpServletRequest();
+
+        assertFalse(TauriOAuthUtils.isTauriState(request));
+    }
+
+    @Test
+    void defaultCallbackPath_rootContext() {
+        assertEquals("/auth/callback", TauriOAuthUtils.defaultCallbackPath("/"));
+        assertEquals("/auth/callback", TauriOAuthUtils.defaultCallbackPath(""));
+        assertEquals("/auth/callback", TauriOAuthUtils.defaultCallbackPath(null));
+    }
+
+    @Test
+    void defaultCallbackPath_withContext() {
+        assertEquals("/myapp/auth/callback", TauriOAuthUtils.defaultCallbackPath("/myapp"));
+    }
+
+    @Test
+    void defaultTauriCallbackPath_rootContext() {
+        assertEquals("/auth/callback/tauri", TauriOAuthUtils.defaultTauriCallbackPath("/"));
+    }
+
+    @Test
+    void defaultTauriCallbackPath_withContext() {
+        assertEquals(
+                "/myapp/auth/callback/tauri", TauriOAuthUtils.defaultTauriCallbackPath("/myapp"));
+    }
+
+    @Test
+    void normalizeContextPath_rootPaths() {
+        assertEquals("", TauriOAuthUtils.normalizeContextPath("/"));
+        assertEquals("", TauriOAuthUtils.normalizeContextPath(""));
+        assertEquals("", TauriOAuthUtils.normalizeContextPath(null));
+    }
+
+    @Test
+    void normalizeContextPath_withPath() {
+        assertEquals("/myapp", TauriOAuthUtils.normalizeContextPath("/myapp"));
+    }
+
+    @Test
+    void extractRedirectPathFromCookie_noCookies() {
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        assertNull(TauriOAuthUtils.extractRedirectPathFromCookie(request));
+    }
+
+    @Test
+    void extractRedirectPathFromCookie_withCookie() {
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        request.setCookies(
+                new jakarta.servlet.http.Cookie(
+                        TauriOAuthUtils.SPA_REDIRECT_COOKIE, "/auth/callback"));
+
+        assertEquals("/auth/callback", TauriOAuthUtils.extractRedirectPathFromCookie(request));
+    }
+
+    @Test
+    void extractRedirectPathFromCookie_emptyCookie() {
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        request.setCookies(
+                new jakarta.servlet.http.Cookie(TauriOAuthUtils.SPA_REDIRECT_COOKIE, ""));
+
+        assertNull(TauriOAuthUtils.extractRedirectPathFromCookie(request));
+    }
+}

docker/Dockerfile.unified

@@ -66,7 +66,7 @@ COPY docker/unified/entrypoint.sh /entrypoint.sh
 
 # Environment Variables
 ENV VERSION_TAG=$VERSION_TAG \
-    JAVA_BASE_OPTS="-XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70" \
+    JAVA_BASE_OPTS="-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/configs/heap_dumps -XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70" \
     JAVA_CUSTOM_OPTS="" \
     HOME=/home/stirlingpdfuser \
     PUID=1000 \
@@ -129,7 +129,7 @@ RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/a
     ln -s /usr/lib/libreoffice/program/unohelper.py /opt/venv/lib/python3.12/site-packages/ && \
     ln -s /usr/lib/libreoffice/program /opt/venv/lib/python3.12/site-packages/LibreOffice && \
     mv /usr/share/tessdata /usr/share/tessdata-original && \
-    mkdir -p $HOME /configs /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf /pipeline/watchedFolders /pipeline/finishedFolders && \
+    mkdir -p $HOME /configs /configs/heap_dumps /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf /pipeline/watchedFolders /pipeline/finishedFolders && \
     mkdir -p /var/lib/nginx/tmp /var/log/nginx && \
     fc-cache -f -v && \
     chmod +x /scripts/* && \

docker/Dockerfile.unified-lite

@@ -66,7 +66,7 @@ COPY docker/unified/entrypoint.sh /entrypoint.sh
 # Environment Variables
 ENV DISABLE_ADDITIONAL_FEATURES=false \
     VERSION_TAG=$VERSION_TAG \
-    JAVA_BASE_OPTS="-XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70" \
+    JAVA_BASE_OPTS="-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/configs/heap_dumps -XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70" \
     JAVA_CUSTOM_OPTS="" \
     HOME=/home/stirlingpdfuser \
     PUID=1000 \
@@ -95,7 +95,7 @@ RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/a
     su-exec \
     openjdk21-jre \
     nginx && \
-    mkdir -p $HOME /configs /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf /pipeline/watchedFolders /pipeline/finishedFolders && \
+    mkdir -p $HOME /configs /configs/heap_dumps /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf /pipeline/watchedFolders /pipeline/finishedFolders && \
     mkdir -p /usr/share/fonts/opentype/noto /var/lib/nginx/tmp /var/log/nginx && \
     chmod +x /scripts/*.sh && \
     chmod +x /entrypoint.sh && \

docker/backend/Dockerfile

@@ -128,7 +128,8 @@ LABEL org.opencontainers.image.keywords="PDF, manipulation, backend, API, Spring
 # ==============================================================================
 ENV VERSION_TAG=$VERSION_TAG \
     DISABLE_ADDITIONAL_FEATURES=true \
-    JAVA_BASE_OPTS="-XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 \
+    JAVA_BASE_OPTS="-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/configs/heap_dumps \
+    -XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 \
     -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 \
     -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70 \
     -Djava.awt.headless=true" \
@@ -166,7 +167,7 @@ ENV PATH="/opt/venv/bin:/opt/unoserver-venv/bin:${PATH}"
 # ==============================================================================
 RUN set -eux; \
     chmod +x /scripts/*; \
-    mkdir -p /configs /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf; \
+    mkdir -p /configs /configs/heap_dumps /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf; \
     chown -R stirlingpdfuser:stirlingpdfgroup \
     /home/stirlingpdfuser /configs /logs /customFiles /pipeline /tmp/stirling-pdf \
     /app.jar /restart-helper.jar /usr/share/fonts/truetype /scripts; \

docker/backend/Dockerfile.fat

@@ -127,7 +127,8 @@ LABEL org.opencontainers.image.keywords="PDF, manipulation, merge, split, conver
 # ==============================================================================
 ENV VERSION_TAG=$VERSION_TAG \
     DISABLE_ADDITIONAL_FEATURES=true \
-    JAVA_BASE_OPTS="-XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 \
+    JAVA_BASE_OPTS="-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/configs/heap_dumps \
+    -XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 \
     -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 \
     -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70 \
     -Djava.awt.headless=true" \
@@ -167,7 +168,7 @@ ENV PATH="/opt/venv/bin:/opt/unoserver-venv/bin:${PATH}"
 # ==============================================================================
 RUN set -eux; \
     chmod +x /scripts/*; \
-    mkdir -p /configs /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf; \
+    mkdir -p /configs /configs/heap_dumps /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf; \
     chown -R stirlingpdfuser:stirlingpdfgroup \
     /home/stirlingpdfuser /configs /logs /customFiles /pipeline /tmp/stirling-pdf \
     /app.jar /restart-helper.jar /usr/share/fonts/truetype /scripts; \

docker/backend/Dockerfile.ultra-lite

@@ -34,7 +34,7 @@ ARG VERSION_TAG
 # Set Environment Variables
 ENV HOME=/home/stirlingpdfuser \
     VERSION_TAG=$VERSION_TAG \
-    JAVA_BASE_OPTS="-XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70" \
+    JAVA_BASE_OPTS="-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/configs/heap_dumps -XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70" \
     JAVA_CUSTOM_OPTS="" \
     PUID=1000 \
     PGID=1000 \
@@ -71,7 +71,7 @@ RUN apk add --no-cache bash \
         ghostscript \
         fontforge && \
     # User permissions
-    mkdir -p /configs /logs /customFiles /usr/share/fonts/opentype/noto /tmp/stirling-pdf /pipeline/watchedFolders /pipeline/finishedFolders && \
+    mkdir -p /configs /configs/heap_dumps /logs /customFiles /usr/share/fonts/opentype/noto /tmp/stirling-pdf /pipeline/watchedFolders /pipeline/finishedFolders && \
     chmod +x /scripts/*.sh && \
     addgroup -S stirlingpdfgroup && adduser -S stirlingpdfuser -G stirlingpdfgroup && \
     chown -R stirlingpdfuser:stirlingpdfgroup $HOME /scripts /pipeline /configs /customFiles /pipeline /tmp/stirling-pdf && \

docker/compose/docker-compose.fat.yml

@@ -4,7 +4,7 @@ services:
       context: ../..
       dockerfile: docker/backend/Dockerfile.fat
     container_name: stirling-pdf-backend-fat
-    restart: on-failure:5
+    restart: unless-stopped
     deploy:
       resources:
         limits:
@@ -42,7 +42,7 @@ services:
       context: ../..
       dockerfile: docker/frontend/Dockerfile
     container_name: stirling-pdf-frontend-fat
-    restart: on-failure:5
+    restart: unless-stopped
     ports:
       - "3000:80"
     environment:

docker/compose/docker-compose.ultra-lite.yml

@@ -4,7 +4,7 @@ services:
       context: ../..
       dockerfile: docker/backend/Dockerfile.ultra-lite
     container_name: stirling-pdf-backend-ultra-lite
-    restart: on-failure:5
+    restart: unless-stopped
     deploy:
       resources:
         limits:
@@ -39,7 +39,7 @@ services:
       context: ../..
       dockerfile: docker/frontend/Dockerfile
     container_name: stirling-pdf-frontend-ultra-lite
-    restart: on-failure:5
+    restart: unless-stopped
     ports:
       - "3000:80"
     environment:

docker/compose/docker-compose.yml

@@ -4,7 +4,7 @@ services:
       context: ../..
       dockerfile: docker/backend/Dockerfile
     container_name: stirling-pdf-backend
-    restart: on-failure:5
+    restart: unless-stopped
     healthcheck:
       test: ["CMD-SHELL", "curl -f http://localhost:8080/api/v1/info/status | grep -q 'UP'"]
       interval: 5s
@@ -37,7 +37,7 @@ services:
       context: ../..
       dockerfile: docker/frontend/Dockerfile
     container_name: stirling-pdf-frontend
-    restart: on-failure:5
+    restart: unless-stopped
     ports:
       - "3000:80"
     environment:

docker/embedded/Dockerfile

@@ -54,7 +54,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     tesseract-ocr tesseract-ocr-eng tesseract-ocr-deu tesseract-ocr-fra \
     tesseract-ocr-por tesseract-ocr-chi-sim \
     libcairo2 libpango-1.0-0 libpangoft2-1.0-0 libgdk-pixbuf-2.0-0 \
-    gosu unpaper \
+    gosu unpaper qpdf \
     # AWT headless support (required for some Java graphics operations)
     libfreetype6 libfontconfig1 libx11-6 libxt6 libxext6 libxrender1 libxtst6 libxi6 \
     libxinerama1 libxkbcommon0 libxkbfile1 libsm6 libice6 \
@@ -133,7 +133,7 @@ LABEL org.opencontainers.image.keywords="PDF, manipulation, API, Spring Boot, Re
 # Runtime environment variables
 # ==============================================================================
 ENV VERSION_TAG=$VERSION_TAG \
-    JAVA_BASE_OPTS="-XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70 -Djava.awt.headless=true" \
+    JAVA_BASE_OPTS="-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/configs/heap_dumps -XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70 -Djava.awt.headless=true" \
     JAVA_CUSTOM_OPTS="" \
     HOME=/home/stirlingpdfuser \
     PUID=${PUID} \
@@ -168,7 +168,7 @@ ENV PATH="/opt/venv/bin:/opt/unoserver-venv/bin:${PATH}"
 # ==============================================================================
 RUN set -eux; \
     chmod +x /scripts/*; \
-    mkdir -p /configs /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf; \
+    mkdir -p /configs /configs/heap_dumps /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf; \
     chown -R stirlingpdfuser:stirlingpdfgroup \
     /home/stirlingpdfuser /configs /logs /customFiles /pipeline /tmp/stirling-pdf \
     /app.jar /restart-helper.jar /usr/share/fonts/truetype /scripts; \

docker/embedded/Dockerfile.fat

@@ -54,7 +54,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     tesseract-ocr tesseract-ocr-eng tesseract-ocr-deu tesseract-ocr-fra \
     tesseract-ocr-por tesseract-ocr-chi-sim \
     libcairo2 libpango-1.0-0 libpangoft2-1.0-0 libgdk-pixbuf-2.0-0 \
-    gosu unpaper \
+    gosu unpaper qpdf \
     # Extra fonts for fat/air-gapped version
     fonts-dejavu fonts-liberation fonts-noto fonts-noto-cjk fonts-noto-color-emoji \
     fonts-freefont-ttf fonts-terminus fonts-linuxlibertine \
@@ -136,7 +136,7 @@ LABEL org.opencontainers.image.keywords="PDF, manipulation, fat, air-gapped, API
 # Runtime environment variables
 # ==============================================================================
 ENV VERSION_TAG=$VERSION_TAG \
-    JAVA_BASE_OPTS="-XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70 -Djava.awt.headless=true" \
+    JAVA_BASE_OPTS="-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/configs/heap_dumps -XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70 -Djava.awt.headless=true" \
     JAVA_CUSTOM_OPTS="" \
     HOME=/home/stirlingpdfuser \
     PUID=${PUID} \
@@ -173,7 +173,7 @@ ENV PATH="/opt/venv/bin:/opt/unoserver-venv/bin:${PATH}"
 # ==============================================================================
 RUN set -eux; \
     chmod +x /scripts/*; \
-    mkdir -p /configs /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf; \
+    mkdir -p /configs /configs/heap_dumps /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf; \
     chown -R stirlingpdfuser:stirlingpdfgroup \
     /home/stirlingpdfuser /configs /logs /customFiles /pipeline /tmp/stirling-pdf \
     /app.jar /restart-helper.jar /usr/share/fonts/truetype /scripts; \

docker/embedded/Dockerfile.ultra-lite

@@ -63,7 +63,7 @@ COPY --from=build /app/build/libs/restart-helper.jar /restart-helper.jar
 
 # Environment Variables
 ENV VERSION_TAG=$VERSION_TAG \
-    JAVA_BASE_OPTS="-XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70" \
+    JAVA_BASE_OPTS="-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/configs/heap_dumps -XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70" \
     JAVA_CUSTOM_OPTS="" \
     HOME=/home/stirlingpdfuser \
     PUID=1000 \
@@ -89,7 +89,7 @@ RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/a
     shadow \
     su-exec \
     openjdk21-jre && \
-    mkdir -p $HOME /configs /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf && \
+    mkdir -p $HOME /configs /configs/heap_dumps /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf && \
     mkdir -p /usr/share/fonts/opentype/noto && \
     chmod +x /scripts/*.sh && \
     # User permissions

docker/embedded/compose/docker-compose-latest-fat-endpoints-disabled.yml

@@ -33,4 +33,4 @@ services:
       METRICS_ENABLED: "true"
       SYSTEM_GOOGLEVISIBILITY: "true"
       SHOW_SURVEY: "true"
-    restart: on-failure:5
+    restart: unless-stopped

docker/embedded/compose/docker-compose-latest-fat-security.yml

@@ -31,4 +31,4 @@ services:
       METRICS_ENABLED: "true"
       SYSTEM_GOOGLEVISIBILITY: "true"
       SHOW_SURVEY: "true"
-    restart: on-failure:5
+    restart: unless-stopped

docker/embedded/compose/docker-compose-latest-ultra-lite.yml

@@ -26,4 +26,4 @@ services:
       METRICS_ENABLED: "true"
       SYSTEM_GOOGLEVISIBILITY: "true"
       SHOW_SURVEY: "true"
-    restart: on-failure:5
+    restart: unless-stopped

frontend/package.json

@@ -17,6 +17,7 @@
     "@embedpdf/plugin-loader": "^1.5.0",
     "@embedpdf/plugin-pan": "^1.5.0",
     "@embedpdf/plugin-print": "^1.5.0",
+    "@embedpdf/plugin-redaction": "^1.5.0",
     "@embedpdf/plugin-render": "^1.5.0",
     "@embedpdf/plugin-rotate": "^1.5.0",
     "@embedpdf/plugin-scroll": "^1.5.0",
@@ -42,9 +43,10 @@
     "@supabase/supabase-js": "^2.47.13",
     "@tailwindcss/postcss": "^4.1.13",
     "@tanstack/react-virtual": "^3.13.12",
-    "@tauri-apps/api": "^2.5.0",
+    "@tauri-apps/api": "^2.9.1",
     "@tauri-apps/plugin-fs": "^2.4.0",
     "@tauri-apps/plugin-http": "^2.5.4",
+    "@tauri-apps/plugin-shell": "^2.3.3",
     "autoprefixer": "^10.4.21",
     "axios": "^1.12.2",
     "globals": "^16.4.0",
@@ -76,6 +78,10 @@
     "preview": "vite preview",
     "tauri-dev": "tauri dev --no-watch",
     "tauri-build": "tauri build",
+    "tauri-build-dev": "tauri build --no-bundle",
+    "tauri-build-dev-mac": "tauri build --bundles app",
+    "tauri-build-dev-windows": "tauri build --bundles nsis",
+    "tauri-build-dev-linux": "tauri build --bundles appimage",
     "tauri-clean": "cd src-tauri && cargo clean && cd .. && rm -rf dist build",
     "typecheck": "npm run typecheck:proprietary",
     "typecheck:core": "tsc --noEmit --project tsconfig.core.json",
@@ -123,7 +129,7 @@
     "@iconify-json/material-symbols": "^1.2.48",
     "@iconify/utils": "^3.0.2",
     "@playwright/test": "^1.55.0",
-    "@tauri-apps/cli": "^2.5.0",
+    "@tauri-apps/cli": "^2.9.5",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.8.0",
     "@testing-library/react": "^16.3.0",

frontend/public/locales/en-GB/translation.toml

@@ -1,8 +1,11 @@
 unsavedChanges = "You have unsaved changes to your PDF."
+pendingRedactionsTitle = "Unapplied Redactions"
+pendingRedactions = "You have unapplied redactions that will be lost."
 areYouSure = "Are you sure you want to leave?"
 unsavedChangesTitle = "Unsaved Changes"
 keepWorking = "Keep Working"
 discardChanges = "Discard & Leave"
+discardRedactions = "Discard & Leave"
 applyAndContinue = "Save & Leave"
 exportAndContinue = "Export & Continue"
 cancel = "Cancel"
@@ -528,6 +531,8 @@ accountSettings = "Account Settings"
 adminSettings = "Admin Settings - View and Add Users"
 userControlSettings = "User Control Settings"
 changeUsername = "Change Username"
+changeUsernameDescription = "Update your username. You will be logged out after updating."
+newUsernamePlaceholder = "Enter your new username"
 newUsername = "New Username"
 password = "Confirmation Password"
 oldPassword = "Old password"
@@ -3219,6 +3224,7 @@ title = "Redaction Method"
 mode = "Mode"
 automatic = "Automatic"
 automaticDesc = "Redact text based on search terms"
+automaticDisabledTooltip = "Select files in the file manager to redact multiple files at once"
 manual = "Manual"
 manualDesc = "Click and drag to redact specific areas"
 manualComingSoon = "Manual redaction coming soon"
@@ -3289,8 +3295,35 @@ text = "Only match complete words, not partial matches. 'John' won't match 'John
 title = "Convert to PDF-Image"
 text = "Converts the PDF to an image-based PDF after redaction. This ensures text behind redaction boxes is completely removed and unrecoverable."
 
+[redact.tooltip.manual.header]
+title = "Manual Redaction Controls"
+
+[redact.tooltip.manual.markText]
+title = "Mark Text Tool"
+text = "Select text directly on the PDF to mark it for redaction. Click and drag to highlight specific text that you want to redact."
+
+[redact.tooltip.manual.markArea]
+title = "Mark Area Tool"
+text = "Draw rectangular areas on the PDF to mark regions for redaction. Useful for redacting images, signatures, or irregular shapes."
+
+[redact.tooltip.manual.apply]
+title = "Apply Redactions"
+text = "After marking content, click 'Apply' to permanently redact all marked areas. The pending count shows how many redactions are ready to be applied."
+bullet1 = "Mark as many areas as needed before applying"
+bullet2 = "All pending redactions are applied at once"
+bullet3 = "Redactions cannot be undone after applying"
+
 [redact.manual]
+title = "Redaction Tools"
+instructions = "Select text or draw areas on the PDF to mark content for redaction."
+markText = "Mark Text"
+markArea = "Mark Area"
+pendingLabel = "Pending:"
+applyWarning = "⚠️ Permanent application, cannot be undone and the data underneath will be deleted"
+apply = "Apply"
+noMarks = "No redaction marks. Use the tools above to mark content for redaction."
 header = "Manual Redaction"
+controlsTitle = "Manual Redaction Controls"
 textBasedRedaction = "Text-based Redaction"
 pageBasedRedaction = "Page-based Redaction"
 convertPDFToImageLabel = "Convert PDF to PDF-Image (Used to remove text behind the box)"
@@ -4078,11 +4111,16 @@ language = "Language"
 toggleAnnotations = "Toggle Annotations Visibility"
 search = "Search PDF"
 panMode = "Pan Mode"
+applyRedactionsFirst = "Apply redactions first"
 rotateLeft = "Rotate Left"
 rotateRight = "Rotate Right"
 toggleSidebar = "Toggle Sidebar"
 toggleBookmarks = "Toggle Bookmarks"
 print = "Print PDF"
+draw = "Draw"
+redact = "Redact"
+exitRedaction = "Exit Redaction Mode"
+save = "Save"
 downloadAll = "Download All"
 saveAll = "Save All"
 
@@ -4156,6 +4194,7 @@ editSwitchToSelect = "Switch to Select & Edit to edit this annotation."
 undo = "Undo"
 redo = "Redo"
 applyChanges = "Apply Changes"
+saveChanges = "Save Changes"
 
 [search]
 title = "Search PDF"
@@ -6196,6 +6235,7 @@ connectingTo = "Connecting to:"
 submit = "Login"
 signInWith = "Sign in with"
 oauthPending = "Opening browser for authentication..."
+sso = "Single Sign-On"
 orContinueWith = "Or continue with email"
 serverRequirement = "Note: The server must have login enabled."
 showInstructions = "How to enable?"

frontend/src-tauri/Cargo.toml

@@ -4,7 +4,9 @@ version = "0.1.0"
 description = "Stirling-PDF Desktop Application"
 authors = ["Stirling-PDF Contributors"]
 license = ""
-repository = ""
+repository = "https://github.com/Stirling-Tools/Stirling-PDF"
+homepage = "https://www.stirlingpdf.com"
+documentation = "https://docs.stirlingpdf.com"
 edition = "2021"
 rust-version = "1.77.2"
 
@@ -18,37 +20,37 @@ name = "app_lib"
 crate-type = ["staticlib", "cdylib", "rlib"]
 
 [build-dependencies]
-tauri-build = { version = "2.2.0", features = [] }
+tauri-build = { version = "2.5.3", features = [] }
 
 [dependencies]
 serde_json = "1.0"
 serde = { version = "1.0", features = ["derive"] }
 log = "0.4"
-tauri = { version = "2.9.0", features = [ "devtools"] }
-tauri-plugin-log = "2.0.0-rc"
-tauri-plugin-shell = "2.1.0"
+tauri = { version = "2.9.4", features = [ "devtools"] }
+tauri-plugin-log = "2.7.1"
+tauri-plugin-shell = "2.3.3"
 tauri-plugin-fs = "2.4.4"
-tauri-plugin-http = "2.4.4"
+tauri-plugin-http = "2.5.4"
 tauri-plugin-single-instance = { version = "2.3.6", features = ["deep-link"] }
-tauri-plugin-store = "2.1.0"
-tauri-plugin-opener = "2.0.0"
+tauri-plugin-store = "2.4.1"
+tauri-plugin-opener = "2.5.2"
+keyring = { version = "3.6.3", features = ["apple-native", "windows-native"] }
+tokio = { version = "1.48", features = ["time", "sync"] }
+reqwest = { version = "0.12", features = ["json"] }
 tauri-plugin-deep-link = "2.4.5"
-keyring = { version = "3.6.1", features = ["apple-native", "windows-native"] }
-tokio = { version = "1.0", features = ["time", "sync"] }
-reqwest = { version = "0.11", features = ["json"] }
 tiny_http = "0.12"
 url = "2.5"
 urlencoding = "2.1"
 sha2 = "0.10"
 base64 = "0.22"
-rand = "0.8"
+rand = "0.9"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 core-foundation = "0.10"
 core-services = "1.0"
 
 [target.'cfg(target_os = "windows")'.dependencies]
-windows = { version = "0.58", features = [
+windows = { version = "0.61", features = [
     "Win32_Foundation",
     "Win32_System_Com",
     "Win32_UI_Shell",

frontend/src-tauri/src/commands/auth.rs

@@ -6,8 +6,8 @@ use tauri_plugin_store::StoreExt;
 use tiny_http::{Response, Server};
 use sha2::{Sha256, Digest};
 use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
-use rand::{thread_rng, Rng};
-use rand::distributions::Alphanumeric;
+use rand::Rng;
+use rand::distr::Alphanumeric;
 
 const STORE_FILE: &str = "connection.json";
 const USER_INFO_KEY: &str = "user_info";
@@ -85,7 +85,14 @@ pub async fn clear_auth_token(_app_handle: AppHandle) -> Result<(), String> {
     // Delete the token - ignore error if it doesn't exist
     match entry.delete_credential() {
         Ok(_) | Err(keyring::Error::NoEntry) => Ok(()),
-        Err(e) => Err(format!("Failed to clear token: {}", e)),
+        Err(e) => {
+            log::warn!("Failed to delete keyring credential: {}. Attempting overwrite with empty token.", e);
+            // As a fallback, overwrite with an empty token so a stale value cannot be reused
+            match entry.set_password("") {
+                Ok(_) => Ok(()),
+                Err(e2) => Err(format!("Failed to clear token (delete + overwrite failed): {}", e2)),
+            }
+        },
     }
 }
 
@@ -312,7 +319,7 @@ pub async fn login(
 
 /// Generate PKCE code_verifier (random 43-128 character string)
 fn generate_code_verifier() -> String {
-    thread_rng()
+    rand::rng()
         .sample_iter(&Alphanumeric)
         .take(128)
         .map(char::from)

frontend/src-tauri/src/lib.rs

@@ -40,8 +40,33 @@ fn dispatch_deep_link(app: &AppHandle, url: &str) {
   }
 }
 
+#[cfg(target_os = "linux")]
+fn configure_linux_webview() {
+  let mut applied_settings = Vec::new();
+
+  if std::env::var_os("WEBKIT_DISABLE_COMPOSITING_MODE").is_none() {
+    std::env::set_var("WEBKIT_DISABLE_COMPOSITING_MODE", "1");
+    applied_settings.push("WEBKIT_DISABLE_COMPOSITING_MODE=1 (software rendering)");
+  }
+
+  if std::env::var_os("WEBKIT_DISABLE_DMABUF_RENDERER").is_none() {
+    std::env::set_var("WEBKIT_DISABLE_DMABUF_RENDERER", "1");
+    applied_settings.push("WEBKIT_DISABLE_DMABUF_RENDERER=1 (fallback EGL renderer)");
+  }
+
+  if !applied_settings.is_empty() {
+    add_log(format!(
+      "🛠️ Applied Linux WebKit fallbacks to avoid EGL issues: {}",
+      applied_settings.join(", ")
+    ));
+  }
+}
+
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
+  #[cfg(target_os = "linux")]
+  configure_linux_webview();
+
   tauri::Builder::default()
     .plugin(
       tauri_plugin_log::Builder::new()

frontend/src-tauri/stirling-pdf.desktop

@@ -3,7 +3,8 @@ Version=1.0
 Type=Application
 Name=Stirling-PDF
 Comment=Locally hosted web application that allows you to perform various operations on PDF files
-Exec=/usr/bin/stirling-pdf
+TryExec={{exec}}
+Exec={{exec}} %F
 Icon={{icon}}
 Terminal=false
 MimeType=application/pdf;
@@ -12,4 +13,4 @@ Actions=open-file;
 
 [Desktop Action open-file]
 Name=Open PDF File
-Exec=/usr/bin/stirling-pdf %F
+Exec={{exec}} %F

frontend/src-tauri/tauri.conf.json

@@ -25,8 +25,8 @@
         "targets": [
             "deb",
             "rpm",
+            "appimage",
             "dmg",
-            "app",
             "msi"
         ],
         "icon": [
@@ -57,6 +57,12 @@
         "linux": {
             "deb": {
                 "desktopTemplate": "stirling-pdf.desktop"
+            },
+            "rpm": {
+                "desktopTemplate": "stirling-pdf.desktop"
+            },
+            "appimage": {
+                "bundleMediaFramework": false
             }
         },
         "windows": {
@@ -86,4 +92,4 @@
             }
         }
     }
-}
+}

frontend/src/core/components/AppProviders.tsx

@@ -22,6 +22,7 @@ import { useScarfTracking } from "@app/hooks/useScarfTracking";
 import { useAppInitialization } from "@app/hooks/useAppInitialization";
 import { useLogoAssets } from '@app/hooks/useLogoAssets';
 import AppConfigLoader from '@app/components/shared/AppConfigLoader';
+import { RedactionProvider } from "@app/contexts/RedactionContext";
 
 // Component to initialize scarf tracking (must be inside AppConfigProvider)
 function ScarfTrackingInitializer() {
@@ -96,6 +97,7 @@ export function AppProviders({ children, appConfigRetryOptions, appConfigProvide
                                 <ViewerProvider>
                                   <PageEditorProvider>
                                     <SignatureProvider>
+                                      <RedactionProvider>
                                       <AnnotationProvider>
                                         <RightRailProvider>
                                           <TourOrchestrationProvider>
@@ -105,6 +107,7 @@ export function AppProviders({ children, appConfigRetryOptions, appConfigProvide
                                           </TourOrchestrationProvider>
                                         </RightRailProvider>
                                       </AnnotationProvider>
+                                      </RedactionProvider>
                                     </SignatureProvider>
                                   </PageEditorProvider>
                                 </ViewerProvider>

frontend/src/core/components/fileEditor/FileEditor.tsx

@@ -43,7 +43,7 @@ const FileEditor = ({
   const { clearAllFileErrors } = fileContextActions;
 
   // Extract needed values from state (memoized to prevent infinite loops)
-  const activeStirlingFileStubs = useMemo(() => selectors.getStirlingFileStubs(), [selectors.getFilesSignature()]);
+  const activeStirlingFileStubs = useMemo(() => selectors.getStirlingFileStubs(), [state.files.byId, state.files.ids]);
   const selectedFileIds = state.ui.selectedFileIds;
   const totalItems = state.files.ids.length;
   const selectedCount = selectedFileIds.length;
@@ -365,7 +365,7 @@ const FileEditor = ({
       activateOnDrag={true}
     >
       <Box pos="relative" style={{ overflow: 'auto' }}>
-        <LoadingOverlay visible={false} />
+        <LoadingOverlay visible={state.ui.isProcessing} />
 
         <Box p="md">
 

frontend/src/core/components/fileEditor/FileEditorThumbnail.tsx

@@ -1,5 +1,5 @@
 import React, { useState, useCallback, useRef, useMemo } from 'react';
-import { Text, ActionIcon, CheckboxIndicator, Tooltip, Modal, Button, Group, Stack } from '@mantine/core';
+import { Text, ActionIcon, CheckboxIndicator, Tooltip, Modal, Button, Group, Stack, Loader } from '@mantine/core';
 import { useIsMobile } from '@app/hooks/useIsMobile';
 import { alert } from '@app/components/toast';
 import { useTranslation } from 'react-i18next';
@@ -389,7 +389,7 @@ const FileEditorThumbnail = ({
         style={isSupported || hasError ? undefined : { filter: 'grayscale(80%)', opacity: 0.6 }}
       >
         <div className={styles.previewPaper}>
-          {file.thumbnailUrl && (
+          {file.thumbnailUrl ? (
             <PrivateContent>
               <img
                 src={file.thumbnailUrl}
@@ -416,7 +416,12 @@ const FileEditorThumbnail = ({
               }}
             />
             </PrivateContent>
-          )}
+          ) : file.type?.startsWith('application/pdf') ? (
+            <Stack align="center" justify="center" gap="xs" style={{ height: '100%' }}>
+              <Loader size="sm" />
+              <Text size="xs" c="dimmed">Loading thumbnail...</Text>
+            </Stack>
+          ) : null}
         </div>
 
         {/* Drag handle (span wrapper so we can attach a ref reliably) */}

frontend/src/core/components/fileManager/FileDetails.tsx

@@ -73,9 +73,9 @@ const FileDetails: React.FC<FileDetailsProps> = ({
   }
 
   return (
-    <Stack gap="lg" h={`calc(${modalHeight} - 2rem)`}>
+    <Stack gap="lg" h={`calc(${modalHeight} - 2rem)`} justify="flex-start">
       {/* Section 1: Thumbnail Preview */}
-      <Box style={{ width: '100%', height: `calc(${modalHeight} * 0.5 - 2rem)`, textAlign: 'center', padding: 'xs' }}>
+      <Box style={{ width: '100%', height: 'min(35vh, 280px)', textAlign: 'center', flexShrink: 0 }}>
         <FilePreview
           file={currentFile}
           thumbnail={getCurrentThumbnail()}
@@ -96,12 +96,10 @@ const FileDetails: React.FC<FileDetailsProps> = ({
 
       <Button
         size="md"
-        mb="xl"
         onClick={onOpenFiles}
         disabled={!hasSelection}
         fullWidth
         style={{
-          flexShrink: 0,
           backgroundColor: hasSelection ? 'var(--btn-open-file)' : 'var(--mantine-color-gray-4)',
           color: 'white'
         }}

frontend/src/core/components/fileManager/FileInfoCard.tsx

@@ -18,13 +18,13 @@ const FileInfoCard: React.FC<FileInfoCardProps> = ({
   const { t } = useTranslation();
 
   return (
-    <Card withBorder p={0} h={`calc(${modalHeight} * 0.32 - 1rem)`} style={{ flex: 1, overflow: 'hidden' }}>
-      <Box bg="gray.4" p="sm" style={{ borderTopLeftRadius: 'var(--mantine-radius-md)', borderTopRightRadius: 'var(--mantine-radius-md)' }}>
+    <Card withBorder p={0} mah={`calc(${modalHeight} * 0.45)`} style={{ overflow: 'hidden', flexShrink: 1, display: 'flex', flexDirection: 'column' }}>
+      <Box bg="gray.4" p="sm" style={{ borderTopLeftRadius: 'var(--mantine-radius-md)', borderTopRightRadius: 'var(--mantine-radius-md)', flexShrink: 0 }}>
         <Text size="sm" fw={500} ta="center" c="white">
           {t('fileManager.details', 'File Details')}
         </Text>
       </Box>
-      <ScrollArea style={{ flex: 1 }} p="md">
+      <ScrollArea style={{ flex: 1, minHeight: 0 }} p="md">
         <Stack gap="sm">
           <Group justify="space-between" py="xs">
             <Text size="sm" c="dimmed">

frontend/src/core/components/layout/Workbench.tsx

@@ -1,9 +1,10 @@
+import { useCallback } from 'react';
 import { Box } from '@mantine/core';
 import { useRainbowThemeContext } from '@app/components/shared/RainbowThemeProvider';
 import { useToolWorkflow } from '@app/contexts/ToolWorkflowContext';
 import { useFileHandler } from '@app/hooks/useFileHandler';
 import { useFileState } from '@app/contexts/FileContext';
-import { useNavigationState, useNavigationActions } from '@app/contexts/NavigationContext';
+import { useNavigationState, useNavigationActions, useNavigationGuard } from '@app/contexts/NavigationContext';
 import { isBaseWorkbench } from '@app/types/workbench';
 import { useViewer } from '@app/contexts/ViewerContext';
 import { useAppConfig } from '@app/contexts/AppConfigContext';
@@ -51,6 +52,21 @@ export default function Workbench() {
 
   // Get active file index from ViewerContext
   const { activeFileIndex, setActiveFileIndex } = useViewer();
+  
+  // Get navigation guard for unsaved changes check when switching files
+  const { requestNavigation } = useNavigationGuard();
+
+  // Wrap file selection to check for unsaved changes before switching
+  // requestNavigation will show the modal if there are unsaved changes, otherwise navigate immediately
+  const handleFileSelect = useCallback((index: number) => {
+    // Don't do anything if selecting the same file
+    if (index === activeFileIndex) return;
+    
+    // requestNavigation handles the unsaved changes check internally
+    requestNavigation(() => {
+      setActiveFileIndex(index);
+    });
+  }, [activeFileIndex, requestNavigation, setActiveFileIndex]);
 
   const handlePreviewClose = () => {
     setPreviewFile(null);
@@ -182,7 +198,7 @@ export default function Workbench() {
             return { fileId: f.fileId, name: f.name, versionNumber: stub?.versionNumber };
           })}
           currentFileIndex={activeFileIndex}
-          onFileSelect={setActiveFileIndex}
+          onFileSelect={handleFileSelect}
         />
       )}
 

frontend/src/core/components/shared/ButtonSelector.tsx

@@ -1,10 +1,11 @@
-import { Button, Group, Stack, Text } from "@mantine/core";
+import { Button, Group, Stack, Text, Tooltip } from "@mantine/core";
 import FitText from "@app/components/shared/FitText";
 
 export interface ButtonOption<T> {
   value: T;
   label: string;
   disabled?: boolean;
+  tooltip?: string;  // Tooltip shown on hover (useful for explaining why option is disabled)
 }
 
 interface ButtonSelectorProps<T> {
@@ -39,33 +40,46 @@ const ButtonSelector = <T extends string | number>({
 
       {/* Buttons */}
       <Group gap='4px'>
-        {options.map((option) => (
-          <Button
-            key={option.value}
-            variant={value === option.value ? 'filled' : 'outline'}
-            color={value === option.value ? 'var(--color-primary-500)' : 'var(--text-muted)'}
-            onClick={() => onChange(option.value)}
-            disabled={disabled || option.disabled}
-            className={buttonClassName}
-            style={{
-              flex: fullWidth ? 1 : undefined,
-              height: 'auto',
-              minHeight: '2.5rem',
-              fontSize: 'var(--mantine-font-size-sm)',
-              lineHeight: '1.4',
-              paddingTop: '0.5rem',
-              paddingBottom: '0.5rem'
-            }}
-          >
-            <FitText
-              text={option.label}
-              lines={1}
-              minimumFontScale={0.5}
-              fontSize={10}
-              className={textClassName}
-            />
-          </Button>
-        ))}
+        {options.map((option) => {
+          const isDisabled = disabled || option.disabled;
+          const button = (
+            <Button
+              variant={value === option.value ? 'filled' : 'outline'}
+              color={value === option.value ? 'var(--color-primary-500)' : 'var(--text-muted)'}
+              onClick={() => onChange(option.value)}
+              disabled={isDisabled}
+              className={buttonClassName}
+              style={{
+                flex: fullWidth ? 1 : undefined,
+                height: 'auto',
+                minHeight: '2.5rem',
+                fontSize: 'var(--mantine-font-size-sm)',
+                lineHeight: '1.4',
+                paddingTop: '0.5rem',
+                paddingBottom: '0.5rem'
+              }}
+            >
+              <FitText
+                text={option.label}
+                lines={1}
+                minimumFontScale={0.5}
+                fontSize={10}
+                className={textClassName}
+              />
+            </Button>
+          );
+
+          // Wrap with tooltip if provided (useful for disabled state explanations)
+          if (option.tooltip && isDisabled) {
+            return (
+              <Tooltip key={option.value} label={option.tooltip} position="top" withArrow>
+                <span style={{ flex: fullWidth ? 1 : undefined, display: 'flex' }}>{button}</span>
+              </Tooltip>
+            );
+          }
+
+          return <span key={option.value} style={{ flex: fullWidth ? 1 : undefined, display: 'flex' }}>{button}</span>;
+        })}
       </Group>
     </Stack>
   );

frontend/src/core/components/shared/FileCard.tsx

@@ -1,5 +1,5 @@
 import { useState } from "react";
-import { Card, Stack, Text, Group, Badge, Button, Box, Image, ThemeIcon, ActionIcon, Tooltip } from "@mantine/core";
+import { Card, Stack, Text, Group, Badge, Button, Box, Image, ThemeIcon, ActionIcon, Tooltip, Loader } from "@mantine/core";
 import { useTranslation } from "react-i18next";
 import PictureAsPdfIcon from "@mui/icons-material/PictureAsPdf";
 import StorageIcon from "@mui/icons-material/Storage";
@@ -29,6 +29,10 @@ const FileCard = ({ file, fileStub, onRemove, onDoubleClick, onView, onEdit, isS
   const thumb = fileStub?.thumbnailUrl || indexedDBThumb;
   const [isHovered, setIsHovered] = useState(false);
 
+  // Show loading state during hydration: PDF file without thumbnail yet
+  const isPdf = file.type === 'application/pdf';
+  const isHydrating = isPdf && !thumb && !isGenerating;
+
   return (
     <Card
       shadow="xs"
@@ -125,24 +129,11 @@ const FileCard = ({ file, fileStub, onRemove, onDoubleClick, onView, onEdit, isS
               fit="contain"
               radius="sm"
             />
-          ) : isGenerating ? (
-            <div style={{
-              display: 'flex',
-              flexDirection: 'column',
-              alignItems: 'center',
-              justifyContent: 'center'
-            }}>
-              <div style={{
-                width: 20,
-                height: 20,
-                border: '2px solid #ddd',
-                borderTop: '2px solid #666',
-                borderRadius: '50%',
-                animation: 'spin 1s linear infinite',
-                marginBottom: 8
-              }} />
-              <Text size="xs" c="dimmed">Generating...</Text>
-            </div>
+          ) : (isGenerating || isHydrating) ? (
+            <Stack align="center" justify="center" gap="xs">
+              <Loader size="sm" />
+              <Text size="xs" c="dimmed">Loading...</Text>
+            </Stack>
           ) : (
             <div style={{
               display: 'flex',

frontend/src/core/components/shared/Footer.tsx

@@ -25,9 +25,6 @@ export default function Footer({
   const { t } = useTranslation();
   const { footerInfo } = useFooterInfo();
 
-  console.log('[Footer] Props analyticsEnabled:', analyticsEnabled);
-  console.log('[Footer] Fetched footerInfo:', footerInfo);
-
   // Use props if provided, otherwise fall back to fetched footer info
   const finalAnalyticsEnabled = analyticsEnabled ?? footerInfo?.analyticsEnabled ?? false;
   const finalPrivacyPolicy = privacyPolicy ?? footerInfo?.privacyPolicy;
@@ -36,8 +33,6 @@ export default function Footer({
   const finalCookiePolicy = cookiePolicy ?? footerInfo?.cookiePolicy;
   const finalImpressum = impressum ?? footerInfo?.impressum;
 
-  console.log('[Footer] Final analyticsEnabled:', finalAnalyticsEnabled);
-
   const { showCookiePreferences } = useCookieConsent({ analyticsEnabled: finalAnalyticsEnabled, forceLightMode });
 
   // Default URLs

frontend/src/core/components/shared/NavigationWarningModal.tsx

@@ -4,13 +4,16 @@ import { useTranslation } from "react-i18next";
 import ArrowBackIcon from "@mui/icons-material/ArrowBack";
 import DeleteOutlineIcon from "@mui/icons-material/DeleteOutline";
 import CheckCircleOutlineIcon from "@mui/icons-material/CheckCircleOutline";
+import { Z_INDEX_TOAST } from "@app/styles/zIndex";
 
 interface NavigationWarningModalProps {
   onApplyAndContinue?: () => Promise<void>;
   onExportAndContinue?: () => Promise<void>;
+  /** Called when discarding - allows saving applied changes while discarding pending ones */
+  onDiscardAndContinue?: () => Promise<void>;
 }
 
-const NavigationWarningModal = ({ onApplyAndContinue, onExportAndContinue }: NavigationWarningModalProps) => {
+const NavigationWarningModal = ({ onApplyAndContinue, onExportAndContinue, onDiscardAndContinue }: NavigationWarningModalProps) => {
   const { t } = useTranslation();
   const { showNavigationWarning, hasUnsavedChanges, pendingNavigation, cancelNavigation, confirmNavigation, setHasUnsavedChanges } =
     useNavigationGuard();
@@ -19,7 +22,11 @@ const NavigationWarningModal = ({ onApplyAndContinue, onExportAndContinue }: Nav
     cancelNavigation();
   };
 
-  const handleDiscardChanges = () => {
+  const handleDiscardChanges = async () => {
+    // If a discard handler is provided, call it to save any already-applied changes, then discard the unsaved changes
+    if (onDiscardAndContinue) {
+      await onDiscardAndContinue();
+    }
     setHasUnsavedChanges(false);
     confirmNavigation();
   };
@@ -32,14 +39,15 @@ const NavigationWarningModal = ({ onApplyAndContinue, onExportAndContinue }: Nav
     confirmNavigation();
   };
 
-  const _handleExportAndContinue = async () => {
+  const handleExportAndContinue = async () => {
     if (onExportAndContinue) {
       await onExportAndContinue();
     }
     setHasUnsavedChanges(false);
     confirmNavigation();
   };
-  const BUTTON_WIDTH = "10rem";
+
+  const BUTTON_WIDTH = "12rem";
 
   // Only show modal if there are unsaved changes AND there's an actual pending navigation
   // This prevents the modal from showing due to spurious state updates
@@ -56,6 +64,7 @@ const NavigationWarningModal = ({ onApplyAndContinue, onExportAndContinue }: Nav
       size="auto"
       closeOnClickOutside={true}
       closeOnEscape={true}
+      zIndex={Z_INDEX_TOAST}
     >
       <Stack>
         <Stack  ta="center"  p="md">
@@ -83,6 +92,11 @@ const NavigationWarningModal = ({ onApplyAndContinue, onExportAndContinue }: Nav
                 {t("applyAndContinue", "Apply & Leave")}
               </Button>
             )}
+            {onExportAndContinue && (
+              <Button variant="filled"  onClick={handleExportAndContinue} w={BUTTON_WIDTH} leftSection={<CheckCircleOutlineIcon fontSize="small" />}>
+                {t("exportAndContinue", "Export & Leave")}
+              </Button>
+            )}
           </Group>
         </Group>
 
@@ -99,6 +113,11 @@ const NavigationWarningModal = ({ onApplyAndContinue, onExportAndContinue }: Nav
               {t("applyAndContinue", "Apply & Leave")}
             </Button>
           )}
+          {onExportAndContinue && (
+            <Button variant="filled" onClick={handleExportAndContinue} w={BUTTON_WIDTH} leftSection={<CheckCircleOutlineIcon fontSize="small" />}>
+              {t("exportAndContinue", "Export & Leave")}
+            </Button>
+          )}
         </Stack>
       </Stack>
     </Modal>

frontend/src/core/components/shared/RightRail.tsx

@@ -91,6 +91,7 @@ export default function RightRail() {
     (btn: RightRailButtonConfig) => {
       const action = actions[btn.id];
       const disabled = Boolean(btn.disabled || allButtonsDisabled || disableForFullscreen);
+      const isActive = Boolean(btn.active);
 
       const triggerAction = () => {
         if (!disabled) action?.();
@@ -103,6 +104,7 @@ export default function RightRail() {
           allButtonsDisabled,
           action,
           triggerAction,
+          active: isActive,
         };
         return btn.render(context) ?? null;
       }
@@ -114,12 +116,15 @@ export default function RightRail() {
       const className = ['right-rail-icon', btn.className].filter(Boolean).join(' ');
       const buttonNode = (
         <ActionIcon
-          variant="subtle"
+          variant={isActive ? 'filled' : 'subtle'}
+          color={isActive ? 'blue' : undefined}
           radius="md"
           className={className}
           onClick={triggerAction}
           disabled={disabled}
           aria-label={ariaLabel}
+          aria-pressed={isActive ? true : undefined}
+          data-active={isActive ? 'true' : 'false'}
         >
           {btn.icon}
         </ActionIcon>

frontend/src/core/components/shared/filePreview/DocumentThumbnail.tsx

@@ -41,7 +41,12 @@ const DocumentThumbnail: React.FC<DocumentThumbnailProps> = ({
             src={thumbnail}
             alt={`Preview of ${file.name}`}
             fit="contain"
-            style={{ maxWidth: '100%', maxHeight: '100%' }}
+            style={{ 
+              maxWidth: '100%', 
+              maxHeight: '100%',
+              width: 'auto',
+              height: 'auto'
+            }}
           />
         </PrivateContent>
         {children}

frontend/src/core/components/shared/rightRail/RightRail.README.md

@@ -86,6 +86,7 @@ interface RightRailButtonWithAction {
   id: string;                    // Unique identifier
   icon?: React.ReactNode;        // Icon component (omit when using render)
   tooltip?: React.ReactNode;     // Hover tooltip / description
+  active?: boolean;              // Optional active state for highlight
   section?: 'top' | 'middle' | 'bottom'; // Section (default: 'top')
   order?: number;                // Sort order (default: 0)
   disabled?: boolean;            // Disabled state (default: false)
@@ -100,6 +101,7 @@ interface RightRailRenderContext {
   allButtonsDisabled: boolean;
   action?: () => void;
   triggerAction: () => void;
+  active: boolean;
 }
 ```
 

frontend/src/core/components/shared/rightRail/RightRail.css

@@ -71,6 +71,10 @@
   color: var(--right-rail-icon);
 }
 
+.right-rail-icon[data-active="true"] {
+  color: #fff;
+}
+
 .right-rail-icon[aria-disabled="true"],
 .right-rail-icon[disabled] {
   color: var(--right-rail-icon-disabled) !important;

frontend/src/core/components/shared/rightRail/ViewerAnnotationControls.tsx

@@ -1,12 +1,18 @@
-import React from 'react';
+import React, { useCallback } from 'react';
 import { ActionIcon } from '@mantine/core';
 import { useTranslation } from 'react-i18next';
 import LocalIcon from '@app/components/shared/LocalIcon';
 import { Tooltip } from '@app/components/shared/Tooltip';
 import { ViewerContext } from '@app/contexts/ViewerContext';
-import { useNavigationState } from '@app/contexts/NavigationContext';
+import { useSignature } from '@app/contexts/SignatureContext';
+import { useFileState, useFileContext } from '@app/contexts/FileContext';
+import { createStirlingFilesAndStubs } from '@app/services/fileStubHelpers';
+import { useNavigationState, useNavigationGuard, useNavigationActions } from '@app/contexts/NavigationContext';
 import { useSidebarContext } from '@app/contexts/SidebarContext';
+import { useToolWorkflow } from '@app/contexts/ToolWorkflowContext';
 import { useRightRailTooltipSide } from '@app/hooks/useRightRailTooltipSide';
+import { useRedactionMode, useRedaction } from '@app/contexts/RedactionContext';
+import { defaultParameters, RedactParameters } from '@app/hooks/tools/redact/useRedactParameters';
 
 interface ViewerAnnotationControlsProps {
   currentView: string;
@@ -16,47 +22,162 @@ interface ViewerAnnotationControlsProps {
 export default function ViewerAnnotationControls({ currentView, disabled = false }: ViewerAnnotationControlsProps) {
   const { t } = useTranslation();
   const { sidebarRefs } = useSidebarContext();
+  const { setLeftPanelView, setSidebarsVisible } = useToolWorkflow();
   const { position: tooltipPosition, offset: tooltipOffset } = useRightRailTooltipSide(sidebarRefs);
 
   // Viewer context for PDF controls - safely handle when not available
   const viewerContext = React.useContext(ViewerContext);
 
-  // Check if we're in sign mode
+  // Signature context for accessing drawing API
+  const { historyApiRef, isPlacementMode } = useSignature();
+
+  // File state for save functionality
+  const { state, selectors } = useFileState();
+  const { actions: fileActions } = useFileContext();
+  const activeFiles = selectors.getFiles();
+
+  // Check if we're in sign mode or redaction mode
   const { selectedTool } = useNavigationState();
+  const { actions: navActions } = useNavigationActions();
   const isSignMode = selectedTool === 'sign';
+  const isRedactMode = selectedTool === 'redact';
+  
+  // Get redaction pending state and navigation guard
+  const { isRedacting: _isRedacting } = useRedactionMode();
+  const { requestNavigation, setHasUnsavedChanges } = useNavigationGuard();
+  const { setRedactionMode, activateTextSelection, setRedactionConfig, setRedactionsApplied, redactionApiRef, setActiveType } = useRedaction();
+
 
   // Check if we're in any annotation tool that should disable the toggle
   const isInAnnotationTool = selectedTool === 'annotate' || selectedTool === 'sign' || selectedTool === 'addImage' || selectedTool === 'addText';
 
   // Check if we're on annotate tool to highlight the button
   const isAnnotateActive = selectedTool === 'annotate';
+  const annotationsHidden = viewerContext ? !viewerContext.isAnnotationsVisible : false;
 
   // Don't show any annotation controls in sign mode
   if (isSignMode) {
     return null;
   }
 
+  // Persist annotations to file if there are unsaved changes
+  const saveAnnotationsIfNeeded = async () => {
+    if (!viewerContext?.exportActions?.saveAsCopy || currentView !== 'viewer' || !historyApiRef?.current?.canUndo()) return;
+    if (activeFiles.length === 0 || state.files.ids.length === 0) return;
+
+    try {
+      const arrayBuffer = await viewerContext.exportActions.saveAsCopy();
+      if (!arrayBuffer) return;
+
+      const file = new File([new Blob([arrayBuffer])], activeFiles[0].name, { type: 'application/pdf' });
+      const parentStub = selectors.getStirlingFileStub(state.files.ids[0]);
+      if (!parentStub) return;
+
+      const { stirlingFiles, stubs } = await createStirlingFilesAndStubs([file], parentStub, 'redact');
+      await fileActions.consumeFiles([state.files.ids[0]], stirlingFiles, stubs);
+      
+      // Clear unsaved changes flags after successful save
+      setHasUnsavedChanges(false);
+      setRedactionsApplied(false);
+    } catch (error) {
+      console.error('Error auto-saving annotations before redaction:', error);
+    }
+  };
+
+  const exitRedactionMode = useCallback(() => {
+    navActions.setToolAndWorkbench(null, 'viewer');
+    setLeftPanelView('toolPicker');
+    setRedactionMode(false);
+    setActiveType(null);
+  }, [navActions, setLeftPanelView, setRedactionMode, setActiveType]);
+
+  // Handle redaction mode toggle
+  const handleRedactionToggle = async () => {
+    if (isRedactMode) {
+      // Exit redaction mode
+      exitRedactionMode();
+    } else {
+      // Check for unsaved annotation changes
+      const hasAnnotationChanges = historyApiRef?.current?.canUndo() ?? false;
+
+      const enterRedactionMode = async () => {
+        await saveAnnotationsIfNeeded();
+
+        // Set redaction config to manual mode when opening from viewer
+        const manualConfig: RedactParameters = {
+          ...defaultParameters,
+          mode: 'manual',
+        };
+        setRedactionConfig(manualConfig);
+
+        // Set tool and keep viewer workbench
+        navActions.setToolAndWorkbench('redact', 'viewer');
+
+        // Ensure sidebars are visible and open tool content
+        setSidebarsVisible(true);
+        setLeftPanelView('toolContent');
+
+        setRedactionMode(true);
+        // Activate text selection mode after a short delay
+        setTimeout(() => {
+          const currentType = redactionApiRef.current?.getActiveType?.();
+          if (currentType !== 'redactSelection') {
+            activateTextSelection();
+          }
+        }, 200);
+      };
+
+      if (hasAnnotationChanges) {
+        requestNavigation(enterRedactionMode);
+      } else {
+        await enterRedactionMode();
+      }
+    }
+  };
+
+
   return (
     <>
-      {/* Annotation Visibility Toggle */}
-      <Tooltip content={t('rightRail.toggleAnnotations', 'Toggle Annotations Visibility')} position={tooltipPosition} offset={tooltipOffset} arrow portalTarget={document.body}>
+      {/* Redaction Mode Toggle */}
+      <Tooltip content={isRedactMode ? t('rightRail.exitRedaction', 'Exit Redaction Mode') : t('rightRail.redact', 'Redact')} position={tooltipPosition} offset={tooltipOffset} arrow portalTarget={document.body}>
         <ActionIcon
-          variant={isAnnotateActive ? "filled" : "subtle"}
-          color="blue"
+          variant={isRedactMode ? 'filled' : 'subtle'}
+          color={isRedactMode ? 'blue' : undefined}
           radius="md"
           className="right-rail-icon"
-          onClick={() => {
-            viewerContext?.toggleAnnotationsVisibility();
-          }}
-          disabled={disabled || currentView !== 'viewer' || isInAnnotationTool}
+          onClick={handleRedactionToggle}
+          disabled={disabled || currentView !== 'viewer'}
         >
           <LocalIcon
-            icon={viewerContext?.isAnnotationsVisible ? "visibility" : "visibility-off-rounded"}
+            icon="scan-delete-rounded"
             width="1.5rem"
             height="1.5rem"
           />
         </ActionIcon>
       </Tooltip>
+
+      {/* Annotation Visibility Toggle */}
+      <Tooltip content={t('rightRail.toggleAnnotations', 'Toggle Annotations Visibility')} position={tooltipPosition} offset={tooltipOffset} arrow portalTarget={document.body}>
+        <ActionIcon
+          variant={annotationsHidden ? "filled" : "subtle"}
+          color={annotationsHidden ? "blue" : undefined}
+          radius="md"
+          className="right-rail-icon"
+          onClick={() => {
+            viewerContext?.toggleAnnotationsVisibility();
+          }}
+          disabled={disabled || currentView !== 'viewer' || (isInAnnotationTool && !isAnnotateActive) || isPlacementMode}
+          data-active={annotationsHidden ? 'true' : undefined}
+          aria-pressed={annotationsHidden}
+        >
+          <LocalIcon
+            icon={viewerContext?.isAnnotationsVisible ? "visibility" : "preview-off-rounded"}
+            width="1.5rem"
+            height="1.5rem"
+          />
+        </ActionIcon>
+      </Tooltip>
+
     </>
   );
 }

frontend/src/core/components/tools/addPageNumbers/PageNumberPreview.module.css

@@ -8,7 +8,7 @@
 }
 
 .containerWithThumbnail {
-  background-color: transparent;
+  background-color: white;
 }
 
 .containerWithoutThumbnail {
@@ -27,6 +27,7 @@
   height: 100%;
   object-fit: contain;
   filter: grayscale(10%) contrast(95%) brightness(105%);
+  opacity: 0.3;
 }
 
 /* Quick grid overlay styles - EXACT copy from stamp */

frontend/src/core/components/tools/addPageNumbers/PageNumberPreview.tsx

@@ -181,7 +181,7 @@ export default function PageNumberPreview({ parameters, onParameterChange, file,
     position: 'relative' as const,
     width: '100%',
     aspectRatio: `${(pageSize?.widthPts ?? 595.28) / (pageSize?.heightPts ?? 841.89)} / 1`,
-    backgroundColor: pageThumbnail ? 'transparent' : 'rgba(255,255,255,0.03)',
+    backgroundColor: pageThumbnail ? 'white' : 'rgba(255,255,255,0.03)',
     border: '1px solid var(--border-default, #333)',
     overflow: 'hidden' as const
   }), [pageSize, pageThumbnail]);

frontend/src/core/components/tools/addStamp/StampPreview.module.css

@@ -8,7 +8,7 @@
 }
 
 .containerWithThumbnail {
-  background-color: transparent;
+  background-color: white;
 }
 
 .containerWithoutThumbnail {
@@ -27,6 +27,7 @@
   height: 100%;
   object-fit: contain;
   filter: grayscale(10%) contrast(95%) brightness(105%);
+  opacity: 0.3;
 }
 
 /* Stamp item styles */

frontend/src/core/components/tools/addStamp/StampPreview.tsx

@@ -4,6 +4,7 @@ import { pdfWorkerManager } from '@app/services/pdfWorkerManager';
 import { useThumbnailGeneration } from '@app/hooks/useThumbnailGeneration';
 import { A4_ASPECT_RATIO, getFirstSelectedPage, getFontFamily, computeStampPreviewStyle, getAlphabetPreviewScale } from '@app/components/tools/addStamp/StampPreviewUtils';
 import styles from '@app/components/tools/addStamp/StampPreview.module.css';
+import {PrivateContent} from "@app/components/shared/PrivateContent";
 
 type Props = {
   parameters: AddStampParameters;
@@ -255,20 +256,22 @@ export default function StampPreview({ parameters, onParameterChange, file, show
         <div className={styles.divider} />
         <div className={styles.previewLabel}>Preview Stamp</div>
       </div>
-      <div 
-        ref={containerRef} 
+      <div
+        ref={containerRef}
         className={`${styles.container} ${styles.containerBorder} ${pageThumbnail ? styles.containerWithThumbnail : styles.containerWithoutThumbnail}`}
-        style={style.container as React.CSSProperties} 
-        onPointerMove={handlePointerMove} 
+        style={style.container as React.CSSProperties}
+        onPointerMove={handlePointerMove}
         onPointerUp={handlePointerUp}
       >
         {pageThumbnail && (
-          <img
-            src={pageThumbnail}
-            alt="page preview"
-            className={styles.pageThumbnail}
-            draggable={false}
-          />
+          <PrivateContent>
+            <img
+              src={pageThumbnail}
+              alt="page preview"
+              className={styles.pageThumbnail}
+              draggable={false}
+            />
+          </PrivateContent>
         )}
         {parameters.stampType === 'text' && (
           <div