Update README.md

docker cache fix (#5801 )
lint (#5802 )
2026-09-03 05:10:16 +03:00 · 2026-02-25 19:00:36 +00:00 · 2026-02-25 18:35:22 +00:00 · 2026-02-25 18:20:24 +00:00 · 2026-02-25 17:25:31 +00:00 · 2026-02-25 15:42:36 +00:00
679 changed files with 307373 additions and 291550 deletions
@@ -1,75 +1,52 @@
-# Node modules and build artifacts
-node_modules
-frontend/node_modules
-frontend/dist
-frontend/build
-frontend/.vite
-frontend/.tauri
-frontend/src-tauri/target
-
-# Gradle build artifacts
-.gradle
-build
-bin
-target
-out
-
-# Git
-.git
+# Version control
+.git/
 .gitignore

-# IDE
-.vscode
-.idea
+# Build outputs
+build/
+*/build/
+**/build/
+out/
+target/
+
+# Gradle caches (local, not what's in the container)
+.gradle/
+**/.gradle/
+
+# Node / frontend
+node_modules/
+**/node_modules/
+.npm/
+.yarn/
+
+# IDE and editor
+.idea/
+.vscode/
 *.iml
-*.iws
 *.ipr
+*.iws

-# Logs
+# Logs and temp files
 *.log
-logs
-
-# Environment files
-.env
-.env.*
-!.env.example
-
-# OS files
+*.tmp
+*.pid
 .DS_Store
 Thumbs.db

-# Java compiled files
-*.class
-*.jar
-*.war
-*.ear
-
-# Test reports
-test-results
-coverage
-
-# Docker
-docker-compose.override.yml
+# Docker itself
+Dockerfile*
 .dockerignore

-# Temporary files
-tmp
-temp
-*.tmp
-*.swp
-*~
-
-# Runtime database and config files (locked by running app)
-app/core/configs/**
-stirling/**
-stirling-pdf-DB*.mv.db
-stirling-pdf-DB*.trace.db
-
-# Documentation
-*.md
-!README.md
-docs
-
-# CI/CD
-.github
+# CI / CD configs (not needed in build context)
+.github/
+.circleci/
 .gitlab-ci.yml
+
+# Test reports
+**/test-results/
+**/jacoco/
+
+# Local env
+.env
+.env.*
+!.env.example
@@ -259,10 +259,27 @@ def check_for_differences(reference_file, file_list, branch, actor):
                report.append(
                    f"    - **_Extra keys in `{locale_dir}/{basename_current_file}`_**: `{missing_keys_str}` that are not present in **_`{basename_reference_file}`_**."
                )
+                report.append("")
+                report.append("    Use the following command to remove them:")
+                report.append(
+                    f"    `python scripts/translations/translation_merger.py {locale_dir} remove-unused`"
+                )
+                report.append("")
            if extra_keys_list:
                report.append(
                    f"    - **_Missing keys in `{locale_dir}/{basename_current_file}`_**: `{extra_keys_str}` that are not present in **_`{basename_reference_file}`_**."
                )
+                report.append("")
+                report.append("    Use the following command to add them:")
+                report.append(
+                    f"    `python scripts/translations/translation_merger.py {locale_dir} add-missing`"
+                )
+                report.append("")
+
+            if missing_keys_list or extra_keys_list:
+                report.append(
+                    "    See: https://github.com/Stirling-Tools/Stirling-PDF/tree/main/scripts/translations#2-translation_mergerpy"
+                )
        else:
            report.append("2. **Test Status:** ✅ **_Passed_**")

@@ -9,7 +9,7 @@
 # CVE-2025-6176 mitigation: pin brotli to a specific commit
 brotli @ git+https://github.com/google/brotli.git@028fb5a23661f123017c060daa546b55cf4bde29
    # via
-    #   -r .github/scripts/requirements_dev.in
+    #   -r requirements_dev.in
    #   fonttools
 cffi==2.0.0 \
    --hash=sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb \
@@ -256,105 +256,105 @@ opencv-python-headless==4.13.0.90 \
    --hash=sha256:e13790342591557050157713af17a7435ac1b50c65282715093c9297fa045d8f \
    --hash=sha256:eba38bc255d0b7d1969c5bcc90a060ca2b61a3403b613872c750bfa5dfe9e03b \
    --hash=sha256:f46b17ea0aa7e4124ca6ad71143f89233ae9557f61d2326bcdb34329a1ddf9bd
-    # via -r .github/scripts/requirements_dev.in
+    # via -r requirements_dev.in
 pdf2image==1.17.0 \
    --hash=sha256:eaa959bc116b420dd7ec415fcae49b98100dda3dd18cd2fdfa86d09f112f6d57 \
    --hash=sha256:ecdd58d7afb810dffe21ef2b1bbc057ef434dabbac6c33778a38a3f7744a27e2
-    # via -r .github/scripts/requirements_dev.in
-pillow==12.1.0 \
-    --hash=sha256:00162e9ca6d22b7c3ee8e61faa3c3253cd19b6a37f126cad04f2f88b306f557d \
-    --hash=sha256:079af2fb0c599c2ec144ba2c02766d1b55498e373b3ac64687e43849fbbef5bc \
-    --hash=sha256:0b022eaaf709541b391ee069f0022ee5b36c709df71986e3f7be312e46f42c84 \
-    --hash=sha256:0c27407a2d1b96774cbc4a7594129cc027339fd800cd081e44497722ea1179de \
-    --hash=sha256:0ddedfaa8b5f0b4ffbc2fa87b556dc59f6bb4ecb14a53b33f9189713ae8053c0 \
-    --hash=sha256:0deedf2ea233722476b3a81e8cdfbad786f7adbed5d848469fa59fe52396e4ef \
-    --hash=sha256:0ed07dca4a8464bada6139ab38f5382f83e5f111698caf3191cb8dbf27d908b4 \
-    --hash=sha256:0fde7ec5538ab5095cc02df38ee99b0443ff0e1c847a045554cf5f9af1f4aa82 \
-    --hash=sha256:15c794d74303828eaa957ff8070846d0efe8c630901a1c753fdc63850e19ecd9 \
-    --hash=sha256:1a949604f73eb07a8adab38c4fe50791f9919344398bdc8ac6b307f755fc7030 \
-    --hash=sha256:1f345e7bc9d7f368887c712aa5054558bad44d2a301ddf9248599f4161abc7c0 \
-    --hash=sha256:1fcc52d86ce7a34fd17cb04e87cfdb164648a3662a6f20565910a99653d66c18 \
-    --hash=sha256:21e686a21078b0f9cb8c8a961d99e6a4ddb88e0fc5ea6e130172ddddc2e5221a \
-    --hash=sha256:2415373395a831f53933c23ce051021e79c8cd7979822d8cc478547a3f4da8ef \
-    --hash=sha256:277518bf4fe74aa91489e1b20577473b19ee70fb97c374aa50830b279f25841b \
-    --hash=sha256:27b9baecb428899db6c0de572d6d305cfaf38ca1596b5c0542a5182e3e74e8c6 \
-    --hash=sha256:29a4cef9cb672363926f0470afc516dbf7305a14d8c54f7abbb5c199cd8f8179 \
-    --hash=sha256:3413c2ae377550f5487991d444428f1a8ae92784aac79caa8b1e3b89b175f77e \
-    --hash=sha256:351889afef0f485b84078ea40fe33727a0492b9af3904661b0abbafee0355b72 \
-    --hash=sha256:3ffaa2f0659e2f740473bcf03c702c39a8d4b2b7ffc629052028764324842c64 \
-    --hash=sha256:40a8e3b9e8773876d6e30daed22f016509e3987bab61b3b7fe309d7019a87451 \
-    --hash=sha256:414b9a78e14ffeb98128863314e62c3f24b8a86081066625700b7985b3f529bd \
-    --hash=sha256:43aca0a55ce1eefc0aefa6253661cb54571857b1a7b2964bd8a1e3ef4b729924 \
-    --hash=sha256:43b4899cfd091a9693a1278c4982f3e50f7fb7cff5153b05174b4afc9593b616 \
-    --hash=sha256:461f9dfdafa394c59cd6d818bdfdbab4028b83b02caadaff0ffd433faf4c9a7a \
-    --hash=sha256:4f9f6a650743f0ddee5593ac9e954ba1bdbc5e150bc066586d4f26127853ab94 \
-    --hash=sha256:53d8b764726d3af1a138dd353116f774e3862ec7e3794e0c8781e30db0f35dfc \
-    --hash=sha256:565c986f4b45c020f5421a4cea13ef294dde9509a8577f29b2fc5edc7587fff8 \
-    --hash=sha256:5c5ae0a06e9ea030ab786b0251b32c7e4ce10e58d983c0d5c56029455180b5b9 \
-    --hash=sha256:5cb7bc1966d031aec37ddb9dcf15c2da5b2e9f7cc3ca7c54473a20a927e1eb91 \
-    --hash=sha256:5da841d81b1a05ef940a8567da92decaa15bc4d7dedb540a8c219ad83d91808a \
-    --hash=sha256:5fee4c04aad8932da9f8f710af2c1a15a83582cfb884152a9caa79d4efcdbf9c \
-    --hash=sha256:609e89d9f90b581c8d16358c9087df76024cf058fa693dd3e1e1620823f39670 \
-    --hash=sha256:6258f3260986990ba2fa8a874f8b6e808cf5abb51a94015ca3dc3c68aa4f30ea \
-    --hash=sha256:64efdf00c09e31efd754448a383ea241f55a994fd079866b92d2bbff598aad91 \
-    --hash=sha256:65b80c1ee7e14a87d6a068dd3b0aea268ffcabfe0498d38661b00c5b4b22e74c \
-    --hash=sha256:6741e6f3074a35e47c77b23a4e4f2d90db3ed905cb1c5e6e0d49bff2045632bc \
-    --hash=sha256:681088909d7e8fa9e31b9799aaa59ba5234c58e5e4f1951b4c4d1082a2e980e0 \
-    --hash=sha256:6b7a9d1db5dad90e2991645874f708e87d9a3c370c243c2d7684d28f7e133e6b \
-    --hash=sha256:7315f9137087c4e0ee73a761b163fc9aa3b19f5f606a7fc08d83fd3e4379af65 \
-    --hash=sha256:742aea052cf5ab5034a53c3846165bc3ce88d7c38e954120db0ab867ca242661 \
-    --hash=sha256:75af0b4c229ac519b155028fa1be632d812a519abba9b46b20e50c6caa184f19 \
-    --hash=sha256:7b5dd7cbae20285cdb597b10eb5a2c13aa9de6cde9bb64a3c1317427b1db1ae1 \
-    --hash=sha256:7d6daa89a00b58c37cb1747ec9fb7ac3bc5ffd5949f5888657dfddde6d1312e0 \
-    --hash=sha256:800429ac32c9b72909c671aaf17ecd13110f823ddb7db4dfef412a5587c2c24e \
-    --hash=sha256:806f3987ffe10e867bab0ddad45df1148a2b98221798457fa097ad85d6e8bc75 \
-    --hash=sha256:808b99604f7873c800c4840f55ff389936ef1948e4e87645eaf3fccbc8477ac4 \
-    --hash=sha256:80941e6d573197a0c28f394753de529bb436b1ca990ed6e765cf42426abc39f8 \
-    --hash=sha256:84cabc7095dd535ca934d57e9ce2a72ffd216e435a84acb06b2277b1de2689bd \
-    --hash=sha256:8637e29d13f478bc4f153d8daa9ffb16455f0a6cb287da1b432fdad2bfbd66c7 \
-    --hash=sha256:896866d2d436563fa2a43a9d72f417874f16b5545955c54a64941e87c1376c61 \
-    --hash=sha256:8e178e3e99d3c0ea8fc64b88447f7cac8ccf058af422a6cedc690d0eadd98c51 \
-    --hash=sha256:907bfa8a9cb790748a9aa4513e37c88c59660da3bcfffbd24a7d9e6abf224551 \
-    --hash=sha256:9212d6b86917a2300669511ed094a9406888362e085f2431a7da985a6b124f45 \
-    --hash=sha256:92a7fe4225365c5e3a8e598982269c6d6698d3e783b3b1ae979e7819f9cd55c1 \
-    --hash=sha256:935b9d1aed48fcfb3f838caac506f38e29621b44ccc4f8a64d575cb1b2a88644 \
-    --hash=sha256:97e9993d5ed946aba26baf9c1e8cf18adbab584b99f452ee72f7ee8acb882796 \
-    --hash=sha256:983976c2ab753166dc66d36af6e8ec15bb511e4a25856e2227e5f7e00a160587 \
-    --hash=sha256:9f5fefaca968e700ad1a4a9de98bf0869a94e397fe3524c4c9450c1445252304 \
-    --hash=sha256:a332ac4ccb84b6dde65dbace8431f3af08874bf9770719d32a635c4ef411b18b \
-    --hash=sha256:a40905599d8079e09f25027423aed94f2823adaf2868940de991e53a449e14a8 \
-    --hash=sha256:a6dfc2af5b082b635af6e08e0d1f9f1c4e04d17d4e2ca0ef96131e85eda6eb17 \
-    --hash=sha256:a786bf667724d84aa29b5db1c61b7bfdde380202aaca12c3461afd6b71743171 \
-    --hash=sha256:a83e0850cb8f5ac975291ebfc4170ba481f41a28065277f7f735c202cd8e0af3 \
-    --hash=sha256:aa0c9cc0b82b14766a99fbe6084409972266e82f459821cd26997a488a7261a7 \
-    --hash=sha256:b17fbdbe01c196e7e159aacb889e091f28e61020a8abeac07b68079b6e626988 \
-    --hash=sha256:b63e13dd27da389ed9475b3d28510f0f954bca0041e8e551b2a4eb1eab56a39a \
-    --hash=sha256:b6e53e82ec2db0717eabb276aa56cf4e500c9a7cec2c2e189b55c24f65a3e8c0 \
-    --hash=sha256:bb0984b30e973f7e2884362b7d23d0a348c7143ee559f38ef3eaab640144204c \
-    --hash=sha256:bc11908616c8a283cf7d664f77411a5ed2a02009b0097ff8abbba5e79128ccf2 \
-    --hash=sha256:bdec5e43377761c5dbca620efb69a77f6855c5a379e32ac5b158f54c84212b14 \
-    --hash=sha256:bef9768cab184e7ae6e559c032e95ba8d07b3023c289f79a2bd36e8bf85605a5 \
-    --hash=sha256:c990547452ee2800d8506c4150280757f88532f3de2a58e3022e9b179107862a \
-    --hash=sha256:ca94b6aac0d7af2a10ba08c0f888b3d5114439b6b3ef39968378723622fed377 \
-    --hash=sha256:cad302dc10fac357d3467a74a9561c90609768a6f73a1923b0fd851b6486f8b0 \
-    --hash=sha256:d0a7735df32ccbcc98b98a1ac785cc4b19b580be1bdf0aeb5c03223220ea09d5 \
-    --hash=sha256:d70347c8a5b7ccd803ec0c85c8709f036e6348f1e6a5bf048ecd9c64d3550b8b \
-    --hash=sha256:d70534cea9e7966169ad29a903b99fc507e932069a881d0965a1a84bb57f6c6d \
-    --hash=sha256:db44d5c160a90df2d24a24760bbd37607d53da0b34fb546c4c232af7192298ac \
-    --hash=sha256:e115c15e3bc727b1ca3e641a909f77f8ca72a64fff150f666fcc85e57701c26c \
-    --hash=sha256:e2479c7f02f9d505682dc47df8c0ea1fc5e264c4d1629a5d63fe3e2334b89554 \
-    --hash=sha256:e5dcbe95016e88437ecf33544ba5db21ef1b8dd6e1b434a2cb2a3d605299e643 \
-    --hash=sha256:e6bdb408f7c9dd2a5ff2b14a3b0bb6d4deb29fb9961e6eb3ae2031ae9a5cec13 \
-    --hash=sha256:e75d3dba8fc1ddfec0cd752108f93b83b4f8d6ab40e524a95d35f016b9683b09 \
-    --hash=sha256:efdc140e7b63b8f739d09a99033aa430accce485ff78e6d311973a67b6bf3208 \
-    --hash=sha256:f10c98f49227ed8383d28174ee95155a675c4ed7f85e2e573b04414f7e371bda \
-    --hash=sha256:f188028b5af6b8fb2e9a76ac0f841a575bd1bd396e46ef0840d9b88a48fdbcea \
-    --hash=sha256:f188d580bd870cda1e15183790d1cc2fa78f666e76077d103edf048eed9c356e \
-    --hash=sha256:f45bd71d1fa5e5749587613037b172e0b3b23159d1c00ef2fc920da6f470e6f0 \
-    --hash=sha256:f61333d817698bdcdd0f9d7793e365ac3d2a21c1f1eb02b32ad6aefb8d8ea831 \
-    --hash=sha256:fb125d860738a09d363a88daa0f59c4533529a90e564785e20fe875b200b6dbd
+    # via -r requirements_dev.in
+pillow==12.1.1 \
+    --hash=sha256:02f84dfad02693676692746df05b89cf25597560db2857363a208e393429f5e9 \
+    --hash=sha256:0330d233c1a0ead844fc097a7d16c0abff4c12e856c0b325f231820fee1f39da \
+    --hash=sha256:03edcc34d688572014ff223c125a3f77fb08091e4607e7745002fc214070b35f \
+    --hash=sha256:097690ba1f2efdeb165a20469d59d8bb03c55fb6621eb2041a060ae8ea3e9642 \
+    --hash=sha256:178aa072084bd88ec759052feca8e56cbb14a60b39322b99a049e58090479713 \
+    --hash=sha256:18e5bddd742a44b7e6b1e773ab5db102bd7a94c32555ba656e76d319d19c3850 \
+    --hash=sha256:1a9b0ee305220b392e1124a764ee4265bd063e54a751a6b62eff69992f457fa9 \
+    --hash=sha256:1f1625b72740fdda5d77b4def688eb8fd6490975d06b909fd19f13f391e077e0 \
+    --hash=sha256:1f1be78ce9466a7ee64bfda57bdba0f7cc499d9794d518b854816c41bf0aa4e9 \
+    --hash=sha256:1f90cff8aa76835cba5769f0b3121a22bd4eb9e6884cfe338216e557a9a548b8 \
+    --hash=sha256:21329ec8c96c6e979cd0dfd29406c40c1d52521a90544463057d2aaa937d66a6 \
+    --hash=sha256:2815a87ab27848db0321fb78c7f0b2c8649dee134b7f2b80c6a45c6831d75ccd \
+    --hash=sha256:2c1fc0f2ca5f96a3c8407e41cca26a16e46b21060fe6d5b099d2cb01412222f5 \
+    --hash=sha256:2e0c664be47252947d870ac0d327fea7e63985a08794758aa8af5b6cb6ec0c9c \
+    --hash=sha256:339ffdcb7cbeaa08221cd401d517d4b1fe7a9ed5d400e4a8039719238620ca35 \
+    --hash=sha256:344cf1e3dab3be4b1fa08e449323d98a2a3f819ad20f4b22e77a0ede31f0faa1 \
+    --hash=sha256:36341d06738a9f66c8287cf8b876d24b18db9bd8740fa0672c74e259ad408cff \
+    --hash=sha256:365b10bb9417dd4498c0e3b128018c4a624dc11c7b97d8cc54effe3b096f4c38 \
+    --hash=sha256:3a5cbdcddad0af3da87cb16b60d23648bc3b51967eb07223e9fed77a82b457c4 \
+    --hash=sha256:417423db963cb4be8bac3fc1204fe61610f6abeed1580a7a2cbb2fbda20f12af \
+    --hash=sha256:42fc1f4677106188ad9a55562bbade416f8b55456f522430fadab3cef7cd4e60 \
+    --hash=sha256:44ce27545b6efcf0fdbdceb31c9a5bdea9333e664cda58a7e674bb74608b3986 \
+    --hash=sha256:472a8d7ded663e6162dafdf20015c486a7009483ca671cece7a9279b512fcb13 \
+    --hash=sha256:47b94983da0c642de92ced1702c5b6c292a84bd3a8e1d1702ff923f183594717 \
+    --hash=sha256:495c302af3aad1ca67420ddd5c7bd480c8867ad173528767d906428057a11f0e \
+    --hash=sha256:4ceb838d4bd9dab43e06c363cab2eebf63846d6a4aeaea283bbdfd8f1a8ed58b \
+    --hash=sha256:50480dcd74fa63b8e78235957d302d98d98d82ccbfac4c7e12108ba9ecbdba15 \
+    --hash=sha256:518a48c2aab7ce596d3bf79d0e275661b846e86e4d0e7dec34712c30fe07f02a \
+    --hash=sha256:559b38da23606e68681337ad74622c4dbba02254fc9cb4488a305dd5975c7eeb \
+    --hash=sha256:578510d88c6229d735855e1f278aa305270438d36a05031dfaae5067cc8eb04d \
+    --hash=sha256:597bd9c8419bc7c6af5604e55847789b69123bbe25d65cc6ad3012b4f3c98d8b \
+    --hash=sha256:5a8eb7ed8d4198bccbd07058416eeec51686b498e784eda166395a23eb99138e \
+    --hash=sha256:5c0dd1636633e7e6a0afe7bf6a51a14992b7f8e60de5789018ebbdfae55b040a \
+    --hash=sha256:5cb1785d97b0c3d1d1a16bc1d710c4a0049daefc4935f3a8f31f827f4d3d2e7f \
+    --hash=sha256:5d1f9575a12bed9e9eedd9a4972834b08c97a352bd17955ccdebfeca5913fa0a \
+    --hash=sha256:5d8c41325b382c07799a3682c1c258469ea2ff97103c53717b7893862d0c98ce \
+    --hash=sha256:5dae5f21afb91322f2ff791895ddd8889e5e947ff59f71b46041c8ce6db790bc \
+    --hash=sha256:600fd103672b925fe62ed08e0d874ea34d692474df6f4bf7ebe148b30f89f39f \
+    --hash=sha256:6408a7b064595afcab0a49393a413732a35788f2a5092fdc6266952ed67de586 \
+    --hash=sha256:652a2c9ccfb556235b2b501a3a7cf3742148cd22e04b5625c5fe057ea3e3191f \
+    --hash=sha256:665e1b916b043cef294bc54d47bf02d87e13f769bc4bc5fa225a24b3a6c5aca9 \
+    --hash=sha256:691ab2ac363b8217f7d31b3497108fb1f50faab2f75dfb03284ec2f217e87bf8 \
+    --hash=sha256:6c52f062424c523d6c4db85518774cc3d50f5539dd6eed32b8f6229b26f24d40 \
+    --hash=sha256:6c6db3b84c87d48d0088943bf33440e0c42370b99b1c2a7989216f7b42eede60 \
+    --hash=sha256:7311c0a0dcadb89b36b7025dfd8326ecfa36964e29913074d47382706e516a7c \
+    --hash=sha256:7aac39bcf8d4770d089588a2e1dd111cbaa42df5a94be3114222057d68336bd0 \
+    --hash=sha256:7b03048319bfc6170e93bd60728a1af51d3dd7704935feb228c4d4faab35d334 \
+    --hash=sha256:7e7976bf1910a8116b523b9f9f58bf410f3e8aa330cd9a2bb2953f9266ab49af \
+    --hash=sha256:8089c852a56c2966cf18835db62d9b34fef7ba74c726ad943928d494fa7f4735 \
+    --hash=sha256:86172b0831b82ce4f7877f280055892b31179e1576aa00d0df3bb1bbf8c3e524 \
+    --hash=sha256:89b54027a766529136a06cfebeecb3a04900397a3590fd252160b888479517bf \
+    --hash=sha256:89c7e895002bbe49cdc5426150377cbbc04767d7547ed145473f496dfa40408b \
+    --hash=sha256:8b7e5304e34942bf62e15184219a7b5ad4ff7f3bb5cca4d984f37df1a0e1aee2 \
+    --hash=sha256:8fd420ef0c52c88b5a035a0886f367748c72147b2b8f384c9d12656678dfdfa9 \
+    --hash=sha256:98edb152429ab62a1818039744d8fbb3ccab98a7c29fc3d5fcef158f3f1f68b7 \
+    --hash=sha256:99c1506ea77c11531d75e3a412832a13a71c7ebc8192ab9e4b2e355555920e3e \
+    --hash=sha256:9ad8fa5937ab05218e2b6a4cff30295ad35afd2f83ac592e68c0d871bb0fdbc4 \
+    --hash=sha256:9f51079765661884a486727f0729d29054242f74b46186026582b4e4769918e4 \
+    --hash=sha256:a003d7422449f6d1e3a34e3dd4110c22148336918ddbfc6a32581cd54b2e0b2b \
+    --hash=sha256:a0b1cd6232e2b618adcc54d9882e4e662a089d5768cd188f7c245b4c8c44a397 \
+    --hash=sha256:a285e3eb7a5a45a2ff504e31f4a8d1b12ef62e84e5411c6804a42197c1cf586c \
+    --hash=sha256:a37691702ed687799de29a518d63d4682d9016932db66d4e90c345831b02fb4e \
+    --hash=sha256:a550ae29b95c6dc13cf69e2c9dc5747f814c54eeb2e32d683e5e93af56caa029 \
+    --hash=sha256:ab174cd7d29a62dd139c44bf74b698039328f45cb03b4596c43473a46656b2f3 \
+    --hash=sha256:ab323b787d6e18b3d91a72fc99b1a2c28651e4358749842b8f8dfacd28ef2052 \
+    --hash=sha256:adebb5bee0f0af4909c30db0d890c773d1a92ffe83da908e2e9e720f8edf3984 \
+    --hash=sha256:aee2810642b2898bb187ced9b349e95d2a7272930796e022efaf12e99dccd293 \
+    --hash=sha256:af9a332e572978f0218686636610555ae3defd1633597be015ed50289a03c523 \
+    --hash=sha256:b574c51cf7d5d62e9be37ba446224b59a2da26dc4c1bb2ecbe936a4fb1a7cb7f \
+    --hash=sha256:b66e95d05ba806247aaa1561f080abc7975daf715c30780ff92a20e4ec546e1b \
+    --hash=sha256:b81b5e3511211631b3f672a595e3221252c90af017e399056d0faabb9538aa80 \
+    --hash=sha256:b957b71c6b2387610f556a7eb0828afbe40b4a98036fc0d2acfa5a44a0c2036f \
+    --hash=sha256:bb66b7cc26f50977108790e2456b7921e773f23db5630261102233eb355a3b79 \
+    --hash=sha256:c6008de247150668a705a6338156efb92334113421ceecf7438a12c9a12dab23 \
+    --hash=sha256:c7697918b5be27424e9ce568193efd13d925c4481dd364e43f5dff72d33e10f8 \
+    --hash=sha256:cb9bb857b2d057c6dfc72ac5f3b44836924ba15721882ef103cecb40d002d80e \
+    --hash=sha256:cc7d296b5ea4d29e6570dabeaed58d31c3fea35a633a69679fb03d7664f43fb3 \
+    --hash=sha256:d242e8ac078781f1de88bf823d70c1a9b3c7950a44cdf4b7c012e22ccbcd8e4e \
+    --hash=sha256:d2912fd8114fc5545aa3a4b5576512f64c55a03f3ebcca4c10194d593d43ea36 \
+    --hash=sha256:d470ab1178551dd17fdba0fef463359c41aaa613cdcd7ff8373f54be629f9f8f \
+    --hash=sha256:d4ce8e329c93845720cd2014659ca67eac35f6433fd3050393d85f3ecef0dad5 \
+    --hash=sha256:d6e4571eedf43af33d0fc233a382a76e849badbccdf1ac438841308652a08e1f \
+    --hash=sha256:e65498daf4b583091ccbb2556c7000abf0f3349fcd57ef7adc9a84a394ed29f6 \
+    --hash=sha256:e879bb6cd5c73848ef3b2b48b8af9ff08c5b71ecda8048b7dd22d8a33f60be32 \
+    --hash=sha256:e9e8064fb1cc019296958595f6db671fba95209e3ceb0c4734c9baf97de04b20 \
+    --hash=sha256:f7ed2c6543bad5a7d5530eb9e78c53132f93dfa44a28492db88b41cdab885202 \
+    --hash=sha256:f95c00d5d6700b2b890479664a06e754974848afaae5e21beb4d83c106923fd0 \
+    --hash=sha256:f975aa7ef9684ce7e2c18a3aa8f8e2106ce1e46b94ab713d156b2898811651d3 \
+    --hash=sha256:fbfa2a7c10cc2623f412753cddf391c7f971c52ca40a3f65dc5039b2939e8563 \
+    --hash=sha256:fc354a04072b765eccf2204f588a7a532c9511e8b9c7f900e1b64e3e33487090 \
+    --hash=sha256:fc44ef1f3de4f45b50ccf9136999d71abb99dca7706bc75d222ed350b9fd2289
    # via
-    #   -r .github/scripts/requirements_dev.in
+    #   -r requirements_dev.in
    #   pdf2image
    #   weasyprint
 platformdirs==4.5.1 \
@@ -364,7 +364,7 @@ platformdirs==4.5.1 \
 pre-commit==4.5.1 \
    --hash=sha256:3b3afd891e97337708c1674210f8eba659b52a38ea5f822ff142d10786221f77 \
    --hash=sha256:eb545fcff725875197837263e977ea257a402056661f09dae08e4b149b030a61
-    # via -r .github/scripts/requirements_dev.in
+    # via -r requirements_dev.in
 pycparser==3.0 \
    --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \
    --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
@@ -465,7 +465,7 @@ tinyhtml5==2.0.0 \
 unoserver==3.6 \
    --hash=sha256:25c360fa194396a89cb79b4edd2735f8e4f0fd8531e59db3952114585bd7df05 \
    --hash=sha256:e446bcb3638c51880f002aaeecab1cf74dfa9df81035f027f7ff2e081b6d7015
-    # via -r .github/scripts/requirements_dev.in
+    # via -r requirements_dev.in
 virtualenv==20.36.1 \
    --hash=sha256:575a8d6b124ef88f6f51d56d656132389f961062a9177016a50e4f507bbcc19f \
    --hash=sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba
@@ -473,7 +473,7 @@ virtualenv==20.36.1 \
 weasyprint==68.0 \
    --hash=sha256:447f40898b747cb44ac31a5d493d512e7441fd56e13f63744c099383bbf9cda9 \
    --hash=sha256:c2cb40c71b50837c5971f00171c9e4078e8c9912dd7c217f3e90e068f11e8aa1
-    # via -r .github/scripts/requirements_dev.in
+    # via -r requirements_dev.in
 webencodings==0.5.1 \
    --hash=sha256:a0af1213f3c2226497a97e2b3aa01a7e4bee4f403f95be16fc9acd2947514a78 \
    --hash=sha256:b36a1c245f2d304965eb4e0a82848379241dc04b865afcc4aab16748587e1923
@@ -500,8 +500,8 @@ zopfli==0.4.0 \
 pip==26.0 \
    --hash=sha256:3ce220a0a17915972fbf1ab451baae1521c4539e778b28127efa79b974aff0fa \
    --hash=sha256:98436feffb9e31bc9339cf369fd55d3331b1580b6a6f1173bacacddcf9c34754
-    # via -r .github/scripts/requirements_dev.in
+    # via -r requirements_dev.in
 setuptools==80.10.2 \
    --hash=sha256:8b0e9d10c784bf7d262c4e5ec5d4ec94127ce206e8738f29a437945fbc219b70 \
    --hash=sha256:95b30ddfb717250edb492926c92b5221f7ef3fbcc2b07579bcd4a27da21d0173
-    # via -r .github/scripts/requirements_dev.in
+    # via -r requirements_dev.in
@@ -116,7 +116,7 @@ jobs:
          egress-policy: audit

      - name: Checkout main repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: ${{ github.repository }}
          ref: main
@@ -172,7 +172,7 @@ jobs:
            return newComment.id;

      - name: Checkout PR
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: ${{ needs.check-pr.outputs.pr_repository }}
          ref: ${{ needs.check-pr.outputs.pr_ref }}
@@ -189,7 +189,7 @@ jobs:
          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT

      - name: Login to Docker Hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}
@@ -231,6 +231,8 @@ jobs:
          context: .
          file: ./docker/embedded/Dockerfile
          push: true
+          cache-from: type=gha,scope=stirling-pdf-latest
+          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
          build-args: VERSION_TAG=v2-alpha
          platforms: linux/amd64
@@ -362,7 +364,7 @@ jobs:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup GitHub App Bot
        if: github.actor != 'dependabot[bot]'
@@ -45,7 +45,7 @@ jobs:
          egress-policy: audit

      - name: Checkout PR
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup GitHub App Bot
        if: github.actor != 'dependabot[bot]'
@@ -133,7 +133,7 @@ jobs:
          egress-policy: audit

      - name: Checkout PR
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup GitHub App Bot
        if: github.actor != 'dependabot[bot]'
@@ -145,19 +145,19 @@ jobs:
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

      - name: Checkout PR
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: refs/pull/${{ needs.check-comment.outputs.pr_number }}/merge
          token: ${{ steps.setup-bot.outputs.token }}

-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
-          java-version: "21"
+          java-version: "25"
          distribution: "temurin"

      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          gradle-version: 8.14

@@ -179,7 +179,7 @@ jobs:
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Login to Docker Hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}
@@ -190,6 +190,8 @@ jobs:
          context: .
          file: ./docker/embedded/Dockerfile
          push: true
+          cache-from: type=gha,scope=stirling-pdf-latest
+          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
          build-args: VERSION_TAG=alpha
          platforms: linux/amd64
@@ -375,7 +377,7 @@ jobs:
          egress-policy: audit

      - name: Check out the repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup GitHub App Bot
        id: setup-bot
@@ -26,7 +26,7 @@ jobs:
          egress-policy: audit

      - name: Checkout PR
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup GitHub App Bot
        if: github.actor != 'dependabot[bot]'
@@ -23,7 +23,7 @@ jobs:
        with:
          egress-policy: audit

-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

@@ -87,7 +87,7 @@ jobs:
      - name: AI PR Title Analysis
        if: steps.actor.outputs.is_repo_dev == 'true'
        id: ai-title-analysis
-        uses: actions/ai-inference@334892bb203895caaed82ec52d23c1ed9385151e # v2.0.4
+        uses: actions/ai-inference@a6101c89c6feaecc585efdd8d461f18bb7896f20 # v2.0.5
        with:
          model: openai/gpt-4o
          system-prompt-file: ".github/config/system-prompt.txt"
@@ -20,7 +20,7 @@ jobs:
        with:
          egress-policy: audit

-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup GitHub App Bot
        id: setup-bot
@@ -36,7 +36,7 @@ jobs:
        with:
          egress-policy: audit
      - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Check for file changes
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
@@ -52,7 +52,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        jdk-version: [17, 21]
+        jdk-version: [21, 25]
        spring-security: [true, false]
    steps:
      - name: Harden Runner
@@ -60,18 +60,28 @@ jobs:
        with:
          egress-policy: audit
      - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up JDK ${{ matrix.jdk-version }}
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: ${{ matrix.jdk-version }}
          distribution: "temurin"

+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-${{ matrix.jdk-version }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          gradle-version: 8.14
+          cache-disabled: true

      - name: Build with Gradle and spring security ${{ matrix.spring-security }}
        run: ./gradlew build -PnoSpotless
@@ -101,7 +111,7 @@ jobs:

      - name: Upload Test Reports
        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: test-reports-jdk-${{ matrix.jdk-version }}-spring-security-${{ matrix.spring-security }}
          path: |
@@ -135,18 +145,28 @@ jobs:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
-          java-version: "21"
+          java-version: "25"
          distribution: "temurin"

+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          gradle-version: 8.14
+          cache-disabled: true

      - name: Generate OpenAPI documentation
        run: ./gradlew :stirling-pdf:generateOpenApiDocs
@@ -157,7 +177,7 @@ jobs:
          DISABLE_ADDITIONAL_FEATURES: true

      - name: Upload OpenAPI Documentation
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: openapi-docs
          path: ./SwaggerDoc.json
@@ -172,9 +192,9 @@ jobs:
        with:
          egress-policy: audit
      - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Set up Node.js
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
        with:
          node-version: "22"
          cache: "npm"
@@ -190,7 +210,7 @@ jobs:
      - name: Run frontend tests
        run: cd frontend && npm run test -- --run
      - name: Upload frontend build artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: frontend-build
          path: frontend/dist/
@@ -207,21 +227,36 @@ jobs:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
-          java-version: "21"
+          java-version: "25"
          distribution: "temurin"

+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          gradle-version: 8.14
+          cache-disabled: true

      - name: check the licenses for compatibility
-        run: ./gradlew checkLicense
+        # NOTE: --no-parallel is intentional here. Running the checkLicense task in parallel with other
+        # Gradle tasks has been observed to cause intermittent failures with the dependency license
+        # checking plugin on this Gradle version. Disabling parallel execution trades some build speed
+        # for more reliable, deterministic license checks. If upgrading Gradle or the plugin, consider
+        # re-evaluating whether this flag is still required before removing it.
+        run: ./gradlew checkLicense --no-parallel
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
@@ -229,7 +264,7 @@ jobs:

      - name: FAILED - check the licenses for compatibility
        if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: dependencies-without-allowed-license.json
          path: build/reports/dependency-license/dependencies-without-allowed-license.json
@@ -253,6 +288,10 @@ jobs:
    #     )

    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: read
+      checks: write

    steps:
      - name: Harden Runner
@@ -261,22 +300,36 @@ jobs:
          egress-policy: audit

      - name: Checkout Repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
-          java-version: "21"
+          java-version: "25"
          distribution: "temurin"

+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          gradle-version: 8.14
+          cache-disabled: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

+      # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for docker buildx type=gha cache backend.
+      - name: Expose GitHub runtime for Buildx cache
+        uses: crazy-max/ghaction-github-runtime@v3
+
      - name: Install Docker Compose
        run: |
          sudo curl -SL "https://github.com/docker/compose/releases/download/v2.39.4/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
@@ -292,6 +345,7 @@ jobs:
      - name: Pip requirements
        run: |
          pip install --require-hashes -r ./testing/cucumber/requirements.txt
+          pip install behave-html-formatter

      - name: Run Docker Compose Tests
        run: |
@@ -304,6 +358,24 @@ jobs:
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}

+      - name: Upload Cucumber Report
+        if: always()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: cucumber-report
+          path: testing/cucumber/report.html
+          retention-days: 7
+          if-no-files-found: warn
+
+      - name: Cucumber Test Report
+        if: always()
+        uses: dorny/test-reporter@b082adf0eced0765477756c2a610396589b8c637 # v2.5.0
+        with:
+          name: Cucumber Tests
+          path: testing/cucumber/junit/*.xml
+          reporter: java-junit
+          fail-on-error: false
+
  test-build-docker-images:
    if: github.event_name == 'pull_request' && needs.files-changed.outputs.project == 'true'
    needs: [files-changed, build, check-generateOpenApiDocs, check-licence]
@@ -314,10 +386,13 @@ jobs:
        include:
          - docker-rev: docker/embedded/Dockerfile
            artifact-suffix: Dockerfile
+            cache-scope: stirling-pdf-latest
          - docker-rev: docker/embedded/Dockerfile.ultra-lite
            artifact-suffix: Dockerfile.ultra-lite
+            cache-scope: stirling-pdf-ultra-lite
          - docker-rev: docker/embedded/Dockerfile.fat
            artifact-suffix: Dockerfile.fat
+            cache-scope: stirling-pdf-fat
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
@@ -325,7 +400,7 @@ jobs:
          egress-policy: audit

      - name: Checkout Repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Free disk space on runner
        run: |
@@ -334,16 +409,26 @@ jobs:
          docker system prune -af || true
          echo "Disk space after cleanup:" && df -h

-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
-          java-version: "21"
+          java-version: "25"
          distribution: "temurin"

+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          gradle-version: 8.14
+          cache-disabled: true

      - name: Build application
        run: ./gradlew build
@@ -368,15 +453,15 @@ jobs:
          context: .
          file: ./${{ matrix.docker-rev }}
          push: false
-          cache-from: type=gha,scope=${{ matrix.artifact-suffix }}
-          cache-to: type=gha,mode=max,scope=${{ matrix.artifact-suffix }}
+          cache-from: type=gha,scope=${{ matrix.cache-scope }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.cache-scope }}
          platforms: linux/amd64,linux/arm64/v8
          provenance: true
          sbom: true

      - name: Upload Reports
        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: reports-docker-${{ matrix.artifact-suffix }}
          path: |
@@ -32,7 +32,7 @@ jobs:
          egress-policy: audit

      - name: Checkout main branch first
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup GitHub App Bot
        id: setup-bot
@@ -22,7 +22,7 @@ jobs:
          egress-policy: audit

      - name: "Checkout Repository"
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "Dependency Review"
        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
        with:
@@ -23,7 +23,7 @@ jobs:
          egress-policy: audit

      - name: Checkout code
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
@@ -85,7 +85,7 @@ jobs:
          fi

      - name: Login to Docker Hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}
@@ -97,6 +97,8 @@ jobs:
          context: .
          file: ./docker/frontend/Dockerfile
          push: true
+          cache-from: type=gha,scope=stirling-v2-frontend
+          cache-to: type=gha,mode=max,scope=stirling-v2-frontend
          tags: |
            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-latest
@@ -110,6 +112,8 @@ jobs:
          context: .
          file: ./docker/backend/Dockerfile
          push: true
+          cache-from: type=gha,scope=stirling-v2-backend
+          cache-to: type=gha,mode=max,scope=stirling-v2-backend
          tags: |
            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-latest
@@ -30,7 +30,7 @@ jobs:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Check for file changes
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
@@ -54,7 +54,7 @@ jobs:
          egress-policy: audit

      - name: Checkout PR head (default)
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -69,7 +69,7 @@ jobs:

      - name: Checkout BASE branch (safe script)
        if: github.event_name == 'pull_request'
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.pull_request.base.sha }}
          path: base
@@ -77,7 +77,7 @@ jobs:
          persist-credentials: false

      - name: Set up Node.js
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
        with:
          node-version: "22"
          cache: "npm"
@@ -273,7 +273,7 @@ jobs:
      - name: Create Pull Request (Push only)
        id: cpr
        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
-        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
        with:
          token: ${{ steps.setup-bot.outputs.token }}
          commit-message: "Update Frontend 3rd Party Licenses"
@@ -317,7 +317,7 @@ jobs:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -330,21 +330,26 @@ jobs:
          app-id: ${{ secrets.GH_APP_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
-          java-version: "21"
+          java-version: "25"
          distribution: "temurin"

      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          gradle-version: 8.14

      - name: Check licenses and generate report
        id: license-check
        run: |
-          ./gradlew checkLicense generateLicenseReport || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV
+          # NOTE: --no-parallel is intentional here. Running the license-checking tasks in parallel has
+          # previously caused intermittent concurrency issues in CI (e.g. flaky failures in the license
+          # plugin/Gradle when multiple projects are evaluated concurrently). Disabling parallelism trades
+          # some build speed for more reliable license reports. If the underlying issues are resolved in
+          # future Gradle or plugin versions, this flag can be reconsidered.
+          ./gradlew checkLicense generateLicenseReport --no-parallel || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
@@ -364,7 +369,7 @@ jobs:

      - name: Upload artifact on license issues
        if: env.LICENSE_WARNINGS_EXIST == 'true'
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: backend-dependencies-without-allowed-license.json
          path: build/reports/dependency-license/dependencies-without-allowed-license.json
@@ -490,7 +495,7 @@ jobs:
      - name: Create Pull Request (push only)
        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
        id: cpr
-        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
        with:
          token: ${{ steps.setup-bot.outputs.token }}
          commit-message: "Update Backend 3rd Party Licenses"
@@ -20,7 +20,7 @@ jobs:
          egress-policy: audit

      - name: Check out the repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Run Labeler
        uses: crazy-max/ghaction-github-labeler@24d110aa46a59976b8a7f35518cb7f14f434c916 # v5.3.0
@@ -21,8 +21,6 @@ on:
          - windows
          - macos
          - linux
-  push:
-    branches: [main, V2-master]
  release:
    types: [created]

@@ -42,16 +40,26 @@ jobs:
        with:
          egress-policy: audit

-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
-          java-version: "21"
+          java-version: "25"
          distribution: "temurin"

+      - name: Cache Gradle dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-
+
      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          gradle-version: 8.14

@@ -115,16 +123,16 @@ jobs:
        with:
          egress-policy: audit

-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
-          java-version: "21"
+          java-version: "25"
          distribution: "temurin"

      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          gradle-version: 8.14

@@ -154,7 +162,7 @@ jobs:
          cp app/core/build/libs/stirling-pdf-${{ needs.determine-matrix.outputs.version }}.jar ./jar-dist/Stirling-PDF${{ matrix.variant.file_suffix }}.jar

      - name: Upload JAR artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: jar${{ matrix.variant.file_suffix }}
          path: ./jar-dist/*.jar
@@ -176,7 +184,7 @@ jobs:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install dependencies (ubuntu only)
        if: matrix.platform == 'ubuntu-22.04'
@@ -197,14 +205,14 @@ jobs:
          toolchain: stable
          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
-          java-version: "21"
+          java-version: "25"
          distribution: "temurin"

      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          gradle-version: 8.14

@@ -291,7 +299,7 @@ jobs:
      - name: Setup DigiCert KeyLocker
        id: digicert-setup
        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
-        uses: digicert/ssm-code-signing@9476ceec3ea1c63298d4403b983e1ccf2556ff4c # v1.1.0
+        uses: digicert/ssm-code-signing@af7f4b07694120e514fe5b19f0598af3c20256e3 # v1.2.0
        env:
          SM_API_KEY: ${{ secrets.SM_API_KEY }}
          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
@@ -533,7 +541,7 @@ jobs:
          fi

      - name: Upload build artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: Stirling-PDF-${{ matrix.name }}
          path: ./dist/*
@@ -26,9 +26,10 @@ jobs:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
+          persist-credentials: false

      - name: Setup GitHub App Bot
        id: setup-bot
@@ -48,17 +49,24 @@ jobs:
        run: |
          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_pre_commit.txt

-      - run: pre-commit run --all-files -c .pre-commit-config.yaml
+      - name: Run Pre-Commit
+        run: |
+          pre-commit run ruff --all-files -c .pre-commit-config.yaml
+          pre-commit run ruff-format --all-files -c .pre-commit-config.yaml
+          pre-commit run codespell --all-files -c .pre-commit-config.yaml
+          pre-commit run gitleaks --all-files -c .pre-commit-config.yaml
+          pre-commit run end-of-file-fixer --all-files -c .pre-commit-config.yaml
+          pre-commit run trailing-whitespace --all-files -c .pre-commit-config.yaml
        continue-on-error: true

      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: 21
          distribution: "temurin"

      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          gradle-version: 8.14

@@ -76,7 +84,7 @@ jobs:

      - name: Create Pull Request
        if: env.CHANGES_DETECTED == 'true'
-        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
        with:
          token: ${{ steps.setup-bot.outputs.token }}
          commit-message: ":file_folder: pre-commit"
@@ -37,16 +37,26 @@ jobs:
        with:
          egress-policy: audit

-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
-          java-version: "21"
+          java-version: "25"
          distribution: "temurin"

+      - name: Cache Gradle dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-
+
      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          gradle-version: 8.14

@@ -75,13 +85,13 @@ jobs:
          cosign-release: "v2.4.1"

      - name: Login to Docker Hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -116,8 +126,8 @@ jobs:
          context: .
          file: ./docker/embedded/Dockerfile
          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=stirling-pdf-latest
+          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
@@ -162,8 +172,8 @@ jobs:
          context: .
          file: ./docker/embedded/Dockerfile.fat
          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=stirling-pdf-fat
+          cache-to: type=gha,mode=max,scope=stirling-pdf-fat
          tags: ${{ steps.meta-fat.outputs.tags }}
          labels: ${{ steps.meta-fat.outputs.labels }}
          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
@@ -206,8 +216,8 @@ jobs:
          context: .
          file: ./docker/embedded/Dockerfile.ultra-lite
          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=stirling-pdf-ultra-lite
+          cache-to: type=gha,mode=max,scope=stirling-pdf-ultra-lite
          tags: ${{ steps.meta-lite.outputs.tags }}
          labels: ${{ steps.meta-lite.outputs.labels }}
          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
@@ -40,7 +40,7 @@ jobs:
          egress-policy: audit

      - name: "Checkout code"
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

@@ -67,7 +67,7 @@ jobs:
      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
      # format to the repository Actions tab.
      - name: "Upload artifact"
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: SARIF file
          path: results.sarif
@@ -31,16 +31,16 @@ jobs:
        with:
          egress-policy: audit

-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
-          java-version: "21"
+          java-version: "25"
          distribution: "temurin"

      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          gradle-version: 8.14

@@ -39,7 +39,9 @@ jobs:
        with:
          egress-policy: audit

-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false

      - name: Setup GitHub App Bot
        id: setup-bot
@@ -55,12 +57,16 @@ jobs:
          cache: "pip" # caching pip dependencies

      - name: Install Python dependencies
-        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt
+        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt -r ./.github/scripts/requirements_pre_commit.txt

      - name: Sync translation TOML files
        run: |
          python .github/scripts/check_language_toml.py --reference-file "frontend/public/locales/en-GB/translation.toml" --branch main

+      - name: pre-commit run
+        run: |
+          pre-commit run toml-sort-fix --all-files
+
      - name: Commit translation files
        run: |
          git add frontend/public/locales/*/translation.toml
@@ -77,7 +83,7 @@ jobs:

      - name: Create Pull Request
        if: always()
-        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
        with:
          token: ${{ steps.setup-bot.outputs.token }}
          commit-message: Update files
@@ -15,16 +15,19 @@ on:
          - linux
  pull_request:
    branches: [main, V2-tauri-windows]
+    types: [opened, reopened, synchronize, ready_for_review]
    paths:
      - "frontend/src-tauri/**"
      - "frontend/src/desktop/**"
      - "frontend/tsconfig.desktop.json"
+      - "frontend/package.json"
+      - "frontend/package-lock.json"
+      - "frontend/vite.config.ts"
      - ".github/workflows/tauri-build.yml"
-  push:
-    branches: [main]

 permissions:
  contents: read
+  pull-requests: write

 jobs:
  determine-matrix:
@@ -77,7 +80,7 @@ jobs:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install dependencies (ubuntu only)
        if: matrix.platform == 'ubuntu-22.04'
@@ -99,13 +102,13 @@ jobs:
          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

      - name: Set up JDK 21
-        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "21"
          distribution: "temurin"

      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          gradle-version: 8.14

@@ -193,7 +196,7 @@ jobs:
      - name: Setup DigiCert KeyLocker
        id: digicert-setup
        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        uses: digicert/ssm-code-signing@9476ceec3ea1c63298d4403b983e1ccf2556ff4c # v1.1.0
+        uses: digicert/ssm-code-signing@af7f4b07694120e514fe5b19f0598af3c20256e3 # v1.2.0
        env:
          SM_API_KEY: ${{ secrets.SM_API_KEY }}
          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
@@ -326,6 +329,7 @@ jobs:
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
+          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL }}
          # Only enable Windows signing in Tauri when on main
          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
          CI: true
@@ -586,7 +590,7 @@ jobs:
          }

      - name: Upload artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: Stirling-PDF-${{ matrix.name }}
          path: ./dist/*
@@ -639,6 +643,100 @@ jobs:
            fi
          done

+  pr-comment:
+    needs: build
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request' && needs.build.result == 'success'
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: Post/Update PR Comment with Download Links
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const prNumber = context.issue.number;
+            const runId = context.runId;
+
+            // Fetch artifacts for this workflow run
+            const { data: artifactsList } = await github.rest.actions.listWorkflowRunArtifacts({
+              owner,
+              repo,
+              run_id: runId
+            });
+
+            // Map of expected artifact names to display info
+            const artifactMap = {
+              'Stirling-PDF-windows-x86_64': { icon: '🪟', platform: 'Windows x64', files: '.exe, .msi' },
+              'Stirling-PDF-macos-aarch64': { icon: '🍎', platform: 'macOS ARM64', files: '.dmg' },
+              'Stirling-PDF-macos-x86_64': { icon: '🍎', platform: 'macOS Intel', files: '.dmg' },
+              'Stirling-PDF-linux-x86_64': { icon: '🐧', platform: 'Linux x64', files: '.deb, .AppImage' }
+            };
+
+            let commentBody = `## 📦 Tauri Desktop Builds Ready!\n\n`;
+            commentBody += `The desktop applications have been built and are ready for testing.\n\n`;
+            commentBody += `### Download Artifacts:\n\n`;
+
+            // Add links for each found artifact
+            let foundArtifacts = 0;
+            for (const artifact of artifactsList.artifacts) {
+              const info = artifactMap[artifact.name];
+              if (info) {
+                foundArtifacts++;
+                // GitHub doesn't provide direct download URLs via API, but we can link to the artifact on the Actions page
+                const artifactUrl = `https://github.com/${owner}/${repo}/actions/runs/${runId}/artifacts/${artifact.id}`;
+                commentBody += `${info.icon} **${info.platform}**: [Download ${artifact.name}](${artifactUrl}) `;
+                commentBody += `(${info.files}) - ${(artifact.size_in_bytes / 1024 / 1024).toFixed(1)} MB\n`;
+              }
+            }
+
+            if (foundArtifacts === 0) {
+              commentBody += `⚠️ **Warning**: No artifacts found in workflow run.\n`;
+              commentBody += `[View workflow run](https://github.com/${owner}/${repo}/actions/runs/${runId})\n`;
+            }
+
+            commentBody += `\n---\n`;
+            commentBody += `_Built from commit ${context.sha.substring(0, 7)}_\n`;
+            commentBody += `_Artifacts expire in 7 days_`;
+
+            // Find existing comment
+            const { data: comments } = await github.rest.issues.listComments({
+              owner,
+              repo,
+              issue_number: prNumber
+            });
+
+            const botComment = comments.find(comment =>
+              comment.user.type === 'Bot' &&
+              comment.body.includes('📦 Tauri Desktop Builds Ready!')
+            );
+
+            if (botComment) {
+              // Update existing comment
+              await github.rest.issues.updateComment({
+                owner,
+                repo,
+                comment_id: botComment.id,
+                body: commentBody
+              });
+              console.log('Updated existing comment');
+            } else {
+              // Create new comment
+              await github.rest.issues.createComment({
+                owner,
+                repo,
+                issue_number: prNumber,
+                body: commentBody
+              });
+              console.log('Created new comment');
+            }
+
  report:
    needs: build
    runs-on: ubuntu-latest
@@ -30,16 +30,16 @@ jobs:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "21"
          distribution: "temurin"

      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          gradle-version: 8.14

@@ -61,7 +61,7 @@ jobs:
          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT

      - name: Login to Docker Hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}
@@ -72,6 +72,8 @@ jobs:
          context: .
          file: ./docker/embedded/Dockerfile
          push: true
+          cache-from: type=gha,scope=stirling-pdf-latest
+          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
          platforms: linux/amd64
@@ -133,7 +135,7 @@ jobs:
        with:
          egress-policy: audit

-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Check for file changes
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
@@ -152,10 +154,10 @@ jobs:
        with:
          egress-policy: audit

-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Node
-        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
        with:
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json
@@ -149,6 +149,7 @@ app/proprietary/build
 common/build
 proprietary/build
 stirling-pdf/build
+frontend/src-tauri/provisioner/target

 # Byte-compiled / optimized / DLL files
 __pycache__/
@@ -243,4 +244,3 @@ docs/type3/signatures/

 # Type3 sample PDFs (development only)
 **/type3/samples/
-
@@ -1,6 +1,6 @@
 repos:
  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.8
+    rev: v0.14.14
    hooks:
      - id: ruff
        args:
@@ -16,11 +16,11 @@ repos:
    hooks:
      - id: codespell
        args:
-          - --ignore-words-list=thirdParty,tabEl,tabEls
+          - --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist
          - --skip="./.*,*.csv,*.json,*.ambr"
          - --quiet-level=2
        files: \.(html|css|js|py|md)$
-        exclude: (.vscode|.devcontainer|app/core/src/main/resources|app/proprietary/src/main/resources|Dockerfile|.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js)
+        exclude: (.vscode|.devcontainer|app/core/src/main/resources|app/proprietary/src/main/resources|frontend/public/vendor|Dockerfile|.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js)
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.30.0
    hooks:
@@ -34,6 +34,12 @@ repos:
      - id: trailing-whitespace
        files: ^.*(\.js|\.java|\.py|\.yml)$
        exclude: ^(.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js|\.github/workflows/.*$)
+  - repo: https://github.com/pappasam/toml-sort
+    rev: v0.24.3
+    hooks:
+      - id: toml-sort-fix
+        files: frontend/public/locales/.*\.toml$
+        args: ['--in-place', '--all', '--ignore-case']
  # - repo: https://github.com/thibaudcolas/pre-commit-stylelint
  #   rev: v16.21.1
  #   hooks:
@@ -13,7 +13,7 @@
    "vscjava.vscode-spring-boot-dashboard", // Spring Boot dashboard for managing and visualizing Spring Boot applications
    "EditorConfig.EditorConfig", // EditorConfig support for maintaining consistent coding styles
    "ms-azuretools.vscode-docker", // Docker extension for Visual Studio Code
-    "GitHub.copilot", // GitHub Copilot AI pair programmer for Visual Studio Code
+    "GitHub.copilot-chat", // GitHub Copilot AI pair programmer for Visual Studio Code
    "GitHub.vscode-pull-request-github", // GitHub Pull Requests extension for Visual Studio Code
    "charliermarsh.ruff", // Ruff code formatter for Python to follow the Ruff Style Guide
    "yzhang.markdown-all-in-one", // Markdown All-in-One extension for enhanced Markdown editing
@@ -30,6 +30,91 @@ Set `DOCKER_ENABLE_SECURITY=true` environment variable to enable security featur
  - **Web Server**: `npm run build` then serve dist/ folder
  - **Development**: `npm run tauri-dev` for desktop dev mode

+#### Import Paths - CRITICAL
+**ALWAYS use `@app/*` for imports.** Do not use `@core/*` or `@proprietary/*` unless explicitly wrapping/extending a lower layer implementation.
+
+```typescript
+// ✅ CORRECT - Use @app/* for all imports
+import { AppLayout } from "@app/components/AppLayout";
+import { useFileContext } from "@app/contexts/FileContext";
+import { FileContext } from "@app/contexts/FileContext";
+
+// ❌ WRONG - Do not use @core/* or @proprietary/* in normal code
+import { AppLayout } from "@core/components/AppLayout";
+import { useFileContext } from "@proprietary/contexts/FileContext";
+```
+
+**Only use explicit aliases when:**
+- Building layer-specific override that wraps a lower layer's component
+- Example: `import { AppProviders as CoreAppProviders } from "@core/components/AppProviders"` when creating proprietary/AppProviders.tsx that extends the core version
+
+The `@app/*` alias automatically resolves to the correct layer based on build target (core/proprietary/desktop) and handles the fallback cascade.
+
+#### Component Override Pattern (Stub/Shadow)
+Use this pattern for desktop-specific or proprietary-specific features WITHOUT runtime checks or conditionals.
+
+**How it works:**
+1. Core defines stub component (returns null or no-op)
+2. Desktop/proprietary overrides with same path/name
+3. Core imports via `@app/*` - higher layer "shadows" core in those builds
+4. No `@ts-ignore`, no `isTauri()` checks, no runtime conditionals!
+
+**Example - Desktop-specific footer:**
+
+```typescript
+// core/components/rightRail/RightRailFooterExtensions.tsx (stub)
+interface RightRailFooterExtensionsProps {
+  className?: string;
+}
+
+export function RightRailFooterExtensions(_props: RightRailFooterExtensionsProps) {
+  return null; // Stub - does nothing in web builds
+}
+```
+
+```typescript
+// desktop/components/rightRail/RightRailFooterExtensions.tsx (real implementation)
+import { Box } from '@mantine/core';
+import { BackendHealthIndicator } from '@app/components/BackendHealthIndicator';
+
+interface RightRailFooterExtensionsProps {
+  className?: string;
+}
+
+export function RightRailFooterExtensions({ className }: RightRailFooterExtensionsProps) {
+  return (
+    <Box className={className}>
+      <BackendHealthIndicator />
+    </Box>
+  );
+}
+```
+
+```typescript
+// core/components/shared/RightRail.tsx (usage - works in ALL builds)
+import { RightRailFooterExtensions } from '@app/components/rightRail/RightRailFooterExtensions';
+
+export function RightRail() {
+  return (
+    <div>
+      {/* In web builds: renders nothing (stub returns null) */}
+      {/* In desktop builds: renders BackendHealthIndicator */}
+      <RightRailFooterExtensions className="right-rail-footer" />
+    </div>
+  );
+}
+```
+
+**Build resolution:**
+- **Core build**: `@app/*` → `core/*` → Gets stub (returns null)
+- **Desktop build**: `@app/*` → `desktop/*` → Gets real implementation (shadows core)
+
+**Benefits:**
+- No runtime checks or feature flags
+- Type-safe across all builds
+- Clean, readable code
+- Build-time optimization (dead code elimination)
+
 #### Multi-Tool Workflow Architecture
 Frontend designed for **stateful document processing**:
 - Users upload PDFs once, then chain tools (split → merge → compress → view)
@@ -37,7 +122,7 @@ Frontend designed for **stateful document processing**:
 - No file reloading between tools - performance critical for large PDFs (up to 100GB+)

 #### FileContext - Central State Management
-**Location**: `src/contexts/FileContext.tsx`
+**Location**: `frontend/src/core/contexts/FileContext.tsx`
 - **Active files**: Currently loaded PDFs and their variants
 - **Tool navigation**: Current mode (viewer/pageEditor/fileEditor/toolName)
 - **Memory management**: PDF document cleanup, blob URL lifecycle, Web Worker management
@@ -62,7 +147,7 @@ Without cleanup: browser crashes with memory leaks.

 **Architecture**: Modular hook-based system with clear separation of concerns:

- **useToolOperation** (`frontend/src/hooks/tools/shared/useToolOperation.ts`): Main orchestrator hook
+- **useToolOperation** (`frontend/src/core/hooks/tools/shared/useToolOperation.ts`): Main orchestrator hook
  - Coordinates all tool operations with consistent interface
  - Integrates with FileContext for operation tracking
  - Handles validation, error handling, and UI state management
@@ -147,8 +232,34 @@ return useToolOperation({
 - **Pipeline System**: Automated PDF processing workflows via `PipelineController`
 - **Security Layer**: Authentication, authorization, and user management (when enabled)

+### Frontend Directory Structure
+The frontend is organized with a clear separation of concerns:
+
+- **`frontend/src/core/`**: Main application code (shared, production-ready components)
+  - **`core/components/`**: React components organized by feature
+    - `core/components/tools/`: Individual PDF tool implementations
+    - `core/components/viewer/`: PDF viewer components
+    - `core/components/pageEditor/`: Page manipulation UI
+    - `core/components/tooltips/`: Help tooltips for tools
+    - `core/components/shared/`: Reusable UI components
+  - **`core/contexts/`**: React Context providers
+    - `FileContext.tsx`: Central file state management
+    - `file/`: File reducer and selectors
+    - `toolWorkflow/`: Tool workflow state
+  - **`core/hooks/`**: Custom React hooks
+    - `hooks/tools/`: Tool-specific operation hooks (one directory per tool)
+    - `hooks/tools/shared/`: Shared hook utilities (useToolOperation, etc.)
+  - **`core/constants/`**: Application constants and configuration
+  - **`core/data/`**: Static data (tool taxonomy, etc.)
+  - **`core/services/`**: Business logic services (PDF processing, storage, etc.)
+
+- **`frontend/src/desktop/`**: Desktop-specific (Tauri) code
+- **`frontend/src/proprietary/`**: Proprietary/licensed features
+- **`frontend/src-tauri/`**: Tauri (Rust) native desktop application code
+- **`frontend/public/`**: Static assets served directly
+  - `public/locales/`: Translation JSON files
+
 ### Component Architecture
- **React Components**: Located in `frontend/src/components/` and `frontend/src/tools/`
 - **Static Assets**: CSS, JS, and resources in `src/main/resources/static/` (legacy) + `frontend/public/` (modern)
 - **Internationalization**:
  - Backend: `messages_*.properties` files
@@ -203,6 +314,7 @@ return useToolOperation({
  - **Backend**: Designed to be stateless - files are processed in memory/temp locations only
  - **Frontend**: Uses IndexedDB for client-side file storage and caching (with thumbnails)
 - **Security**: When `DOCKER_ENABLE_SECURITY=false`, security-related classes are excluded from compilation
+- **Import Paths**: ALWAYS use `@app/*` for imports - never use `@core/*` or `@proprietary/*` unless explicitly wrapping/extending a lower layer
 - **FileContext**: All file operations MUST go through FileContext - never bypass with direct File handling
 - **Memory Management**: Manual cleanup required for PDF.js documents and blob URLs - don't remove cleanup code
 - **Tool Development**: New tools should follow `useToolOperation` hook pattern (see `useCompressOperation.ts`)
@@ -1,69 +1 @@
-<p align="center">
-  <img src="https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/main/docs/stirling.png" width="80" alt="Stirling PDF logo">
-</p>
-
-<h1 align="center">Stirling PDF - The Open-Source PDF Platform</h1>
-
-Stirling PDF is a powerful, open-source PDF editing platform. Run it as a personal desktop app, in the browser, or deploy it on your own servers with a private API. Edit, sign, redact, convert, and automate PDFs without sending documents to external services.
-
-<p align="center">
-  <a href="https://hub.docker.com/r/stirlingtools/stirling-pdf">
-    <img src="https://img.shields.io/docker/pulls/frooodle/s-pdf" alt="Docker Pulls">
-  </a>
-  <a href="https://discord.gg/HYmhKj45pU">
-    <img src="https://img.shields.io/discord/1068636748814483718?label=Discord" alt="Discord">
-  </a>
-  <a href="https://scorecard.dev/viewer/?uri=github.com/Stirling-Tools/Stirling-PDF">
-    <img src="https://api.scorecard.dev/projects/github.com/Stirling-Tools/Stirling-PDF/badge" alt="OpenSSF Scorecard">
-  </a>
-  <a href="https://github.com/Stirling-Tools/stirling-pdf">
-    <img src="https://img.shields.io/github/stars/stirling-tools/stirling-pdf?style=social" alt="GitHub Repo stars">
-  </a>
-</p>
-
-![Stirling PDF - Dashboard](images/home-light.png)
-
-## Key Capabilities
-
- **Everywhere you work** - Desktop client, browser UI, and self-hosted server with a private API.
- **50+ PDF tools** - Edit, merge, split, sign, redact, convert, OCR, compress, and more.
- **Automation & workflows** - No-code pipelines direct in UI with APIs to process millions of PDFs.
- **Enterprise‑grade** - SSO, auditing, and flexible on‑prem deployments.
- **Developer platform** - REST APIs available for nearly all tools to integrate into your existing systems.
- **Global UI** - Interface available in 40+ languages.
-
-For a full feature list, see the docs: **https://docs.stirlingpdf.com**
-
-## Quick Start
-
-```bash
-docker run -p 8080:8080 docker.stirlingpdf.com/stirlingtools/stirling-pdf
-```
-
-Then open: http://localhost:8080
-
-For full installation options (including desktop and Kubernetes), see our [Documentation Guide](https://docs.stirlingpdf.com/#documentation-guide).
-
-## Resources
-
- [**Documentation**](https://docs.stirlingpdf.com)
- [**Homepage**](https://stirling.com)
- [**API Docs**](https://registry.scalar.com/@stirlingpdf/apis/stirling-pdf-processing-api/)
- [**Server Plan & Enterprise**](https://docs.stirlingpdf.com/Paid-Offerings)
-
-## Support
-
- **Community** [Discord](https://discord.gg/HYmhKj45pU)
- **Bug Reports**: [Github issues](https://github.com/Stirling-Tools/Stirling-PDF/issues)
-
-## Contributing
-
-We welcome contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
-
-For development setup, see the [Developer Guide](DeveloperGuide.md).
-
-For adding translations, see the [Translation Guide](devGuide/HowToAddNewLanguage.md).
-
-## License
-
-Stirling PDF is open-core. See [LICENSE](LICENSE) for details.
+dont emrge only for test delpoyment
@@ -27,8 +27,8 @@ spotless {
    }
 }
 dependencies {
-    api 'org.springframework.boot:spring-boot-starter-web'
-    api 'org.springframework.boot:spring-boot-starter-aop'
+    api 'org.springframework.boot:spring-boot-starter-webmvc'
+    api 'org.springframework.boot:spring-boot-starter-aspectj'
    api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20240325.1'
    api 'com.fathzer:javaluator:3.0.6'
    api 'com.posthog.java:posthog:1.2.0'
@@ -42,7 +42,7 @@ dependencies {
    api 'com.github.junrar:junrar:7.5.7' // RAR archive support for CBR files
    api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
    api 'org.snakeyaml:snakeyaml-engine:3.0.1'
-    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.15"
+    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.1"
    // Simple Java Mail for EML/MSG parsing (replaces direct Angus Mail usage)
    api 'org.simplejavamail:simple-java-mail:8.12.6'
    api 'org.simplejavamail:outlook-module:8.12.6' // MSG file support
@@ -391,13 +391,24 @@ public class EndpointConfiguration {
        addEndpointToGroup("Advance", "extract-image-scans");
        addEndpointToGroup("Advance", "repair");
        addEndpointToGroup("Advance", "auto-rename");
-        addEndpointToGroup("Advance", "handleData");
        addEndpointToGroup("Advance", "scanner-effect");
-        addEndpointToGroup("Advance", "show-javascript");
        addEndpointToGroup("Advance", "overlay-pdf");
        // Backend-only endpoints
        addEndpointToGroup("Advance", "adjust-contrast");
-        addEndpointToGroup("Advance", "pipeline");
+
+        // Adding endpoints to "Automation" group
+        addEndpointToGroup("Automation", "handleData");
+        addEndpointToGroup("Automation", "automate"); // Alias for handleData (user-friendly name)
+        addEndpointToGroup("Automation", "pipeline");
+
+        // Adding endpoints to "DeveloperTools" group
+        addEndpointToGroup("DeveloperTools", "show-javascript");
+
+        // Adding endpoints to "DeveloperDocs" group (fake endpoints for link-only tools)
+        addEndpointToGroup("DeveloperDocs", "dev-api-docs");
+        addEndpointToGroup("DeveloperDocs", "dev-folder-scanning-docs");
+        addEndpointToGroup("DeveloperDocs", "dev-sso-guide-docs");
+        addEndpointToGroup("DeveloperDocs", "dev-airgapped-docs");

        // CLI
        addEndpointToGroup("CLI", "compress-pdf");
@@ -595,6 +606,12 @@ public class EndpointConfiguration {
        return endpointGroups.getOrDefault(group, new HashSet<>());
    }

+    public Set<String> getAllEndpoints() {
+        return endpointGroups.values().stream()
+                .flatMap(Set::stream)
+                .collect(java.util.stream.Collectors.toSet());
+    }
+
    private boolean isToolGroup(String group) {
        return "qpdf".equals(group)
                || "OCRmyPDF".equals(group)
@@ -91,9 +91,9 @@ public class RuntimePathConfig {

        // Initialize Operation paths
        String defaultWeasyPrintPath = isDocker ? "/opt/venv/bin/weasyprint" : "weasyprint";
-        String defaultUnoConvertPath = isDocker ? "/opt/venv/bin/unoconvert" : "unoconvert";
+        String defaultUnoConvertPath = isDocker ? "/usr/local/bin/unoconvert" : "unoconvert";
        String defaultCalibrePath = isDocker ? "/opt/calibre/ebook-convert" : "ebook-convert";
-        String defaultOcrMyPdfPath = isDocker ? "/usr/bin/ocrmypdf" : "ocrmypdf";
+        String defaultOcrMyPdfPath = isDocker ? "/opt/venv/bin/ocrmypdf" : "ocrmypdf";
        String defaultSOfficePath = isDocker ? "/usr/bin/soffice" : "soffice";

        Operations operations = customPaths.getOperations();
@@ -0,0 +1,23 @@
+package stirling.software.common.configuration;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.scheduling.TaskScheduler;
+import org.springframework.scheduling.concurrent.SimpleAsyncTaskScheduler;
+
+/**
+ * Configures the scheduler used by all {@code @Scheduled} methods. Uses virtual threads so that
+ * long-running scheduled tasks (e.g. cleanup, license checks, file monitoring) never block each
+ * other — each runs on its own lightweight virtual thread.
+ */
+@Configuration
+public class SchedulingConfig {
+
+    @Bean
+    public TaskScheduler taskScheduler() {
+        SimpleAsyncTaskScheduler scheduler = new SimpleAsyncTaskScheduler();
+        scheduler.setVirtualThreads(true);
+        scheduler.setThreadNamePrefix("scheduled-vt-");
+        return scheduler;
+    }
+}
@@ -0,0 +1,49 @@
+package stirling.software.common.constants;
+
+/**
+ * Centralized constants for JWT token management.
+ *
+ * <p>These defaults are used when configuration values are not explicitly set.
+ */
+public final class JwtConstants {
+
+    private JwtConstants() {
+        throw new UnsupportedOperationException("Utility class");
+    }
+
+    /** Default JWT access token lifetime in minutes (24 hours). */
+    public static final int DEFAULT_TOKEN_EXPIRY_MINUTES = 1440;
+
+    /** Default desktop client token lifetime in minutes (30 days). */
+    public static final int DEFAULT_DESKTOP_TOKEN_EXPIRY_MINUTES = 43200;
+
+    /**
+     * Default refresh grace period in minutes.
+     *
+     * <p>Allows refresh of expired tokens within this window after expiration.
+     */
+    public static final int DEFAULT_REFRESH_GRACE_MINUTES = 15;
+
+    /**
+     * Default allowed clock skew in seconds.
+     *
+     * <p>Tolerates small time drift between client and server clocks during validation.
+     */
+    public static final int DEFAULT_CLOCK_SKEW_SECONDS = 60;
+
+    /** Milliseconds per minute. */
+    public static final long MILLIS_PER_MINUTE = 60_000L;
+
+    /** Seconds per minute. */
+    public static final long SECONDS_PER_MINUTE = 60L;
+
+    /** JWT issuer identifier. */
+    public static final String ISSUER = "https://stirling.com";
+
+    /**
+     * Maximum refresh attempts allowed within the grace period window.
+     *
+     * <p>Prevents abuse of expired tokens by limiting refresh attempts.
+     */
+    public static final int MAX_REFRESH_ATTEMPTS_IN_GRACE = 3;
+}
@@ -29,6 +29,8 @@ import org.springframework.stereotype.Component;
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonProperty;

+import jakarta.annotation.PostConstruct;
+
 import lombok.Data;
 import lombok.Getter;
 import lombok.Setter;
@@ -37,6 +39,7 @@ import lombok.extern.slf4j.Slf4j;

 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.configuration.YamlPropertySourceFactory;
+import stirling.software.common.constants.JwtConstants;
 import stirling.software.common.model.exception.UnsupportedProviderException;
 import stirling.software.common.model.oauth2.GitHubProvider;
 import stirling.software.common.model.oauth2.GoogleProvider;
@@ -98,6 +101,52 @@ public class ApplicationProperties {
        return propertySource;
    }

+    /**
+     * Initialize fileUploadLimit from environment variables if not set in settings.yml. Supports
+     * SYSTEMFILEUPLOADLIMIT (format: "100MB") and SYSTEM_MAXFILESIZE (format: "100" in MB).
+     */
+    @PostConstruct
+    public void initializeFileUploadLimitFromEnv() {
+        // Only override if fileUploadLimit is not already set in settings.yml
+        if (system.getFileUploadLimit() == null || system.getFileUploadLimit().isEmpty()) {
+            String fileUploadLimit = null;
+
+            // Check SYSTEMFILEUPLOADLIMIT first (format: "100MB", "1GB", etc.)
+            String systemFileUploadLimit = java.lang.System.getenv("SYSTEMFILEUPLOADLIMIT");
+            if (systemFileUploadLimit != null && !systemFileUploadLimit.trim().isEmpty()) {
+                fileUploadLimit = systemFileUploadLimit.trim();
+                log.info("Setting fileUploadLimit from SYSTEMFILEUPLOADLIMIT: {}", fileUploadLimit);
+            } else {
+                // Check SYSTEM_MAXFILESIZE (format: number in MB, e.g., "100")
+                String systemMaxFileSize = java.lang.System.getenv("SYSTEM_MAXFILESIZE");
+                if (systemMaxFileSize != null && !systemMaxFileSize.trim().isEmpty()) {
+                    try {
+                        // Validate it's a number
+                        long sizeInMB = Long.parseLong(systemMaxFileSize.trim());
+                        if (sizeInMB > 0 && sizeInMB <= 999) {
+                            fileUploadLimit = sizeInMB + "MB";
+                            log.info(
+                                    "Setting fileUploadLimit from SYSTEM_MAXFILESIZE: {}MB",
+                                    sizeInMB);
+                        } else {
+                            log.warn(
+                                    "SYSTEM_MAXFILESIZE value {} is out of valid range (1-999), ignoring",
+                                    sizeInMB);
+                        }
+                    } catch (NumberFormatException e) {
+                        log.warn(
+                                "SYSTEM_MAXFILESIZE value '{}' is not a valid number, ignoring",
+                                systemMaxFileSize);
+                    }
+                }
+            }
+
+            if (fileUploadLimit != null) {
+                system.setFileUploadLimit(fileUploadLimit);
+            }
+        }
+    }
+
    @Data
    public static class AutoPipeline {
        private String outputFolder;
@@ -345,12 +394,107 @@ public class ApplicationProperties {
            }
        }

+        /**
+         * JWT token configuration.
+         *
+         * <p><b>BREAKING CHANGE (v2.0):</b> Default token expiry increased from 12 hours (720
+         * minutes) to 24 hours (1440 minutes). If you require the previous behavior, explicitly set
+         * {@code tokenExpiryMinutes: 720} in your configuration.
+         */
        @Data
        public static class Jwt {
            private boolean enableKeystore = true;
            private boolean enableKeyRotation = false;
            private boolean enableKeyCleanup = true;
-            private int keyRetentionDays = 7;
+
+            /**
+             * JWT access token lifetime in minutes for web clients.
+             *
+             * <p>Default: {@value JwtConstants#DEFAULT_TOKEN_EXPIRY_MINUTES} minutes (24 hours).
+             *
+             * <p><b>BREAKING CHANGE:</b> Previously hardcoded to 720 minutes (12 hours). Now
+             * defaults to 1440 minutes (24 hours).
+             */
+            private int tokenExpiryMinutes = JwtConstants.DEFAULT_TOKEN_EXPIRY_MINUTES;
+
+            /**
+             * JWT access token lifetime in minutes for desktop clients (Tauri app).
+             *
+             * <p>Desktop clients are automatically detected via User-Agent header and receive
+             * longer-lived tokens because they run on personal devices with OS-level encrypted
+             * storage (macOS Keychain, Windows Credential Manager, Linux Secret Service).
+             *
+             * <p>This provides better UX (login once per month) while maintaining security through
+             * device encryption and secure storage, matching the behavior of popular desktop apps
+             * like Slack, Discord, VS Code, etc.
+             *
+             * <p>Default: 43200 minutes (30 days).
+             */
+            private int desktopTokenExpiryMinutes = 43200;
+
+            /**
+             * Allowed clock skew in seconds for JWT validation.
+             *
+             * <p>Tolerates small time drift between client and server clocks. Tokens that are
+             * slightly expired or slightly in the future (within this window) will still be
+             * accepted.
+             *
+             * <p>Default: {@value JwtConstants#DEFAULT_CLOCK_SKEW_SECONDS} seconds.
+             */
+            private int allowedClockSkewSeconds = JwtConstants.DEFAULT_CLOCK_SKEW_SECONDS;
+
+            /**
+             * Grace period in minutes for refreshing expired tokens.
+             *
+             * <p>Allows token refresh using an expired access token if the token expired within
+             * this many minutes. This provides better UX by allowing users to refresh slightly
+             * expired tokens without re-authentication.
+             *
+             * <p>Rate limiting is applied to prevent abuse of expired tokens within the grace
+             * window (max {@value JwtConstants#MAX_REFRESH_ATTEMPTS_IN_GRACE} attempts).
+             *
+             * <p>Default: {@value JwtConstants#DEFAULT_REFRESH_GRACE_MINUTES} minutes.
+             */
+            private int refreshGraceMinutes = JwtConstants.DEFAULT_REFRESH_GRACE_MINUTES;
+
+            /**
+             * Calculate number of days to retain old JWT signing keys.
+             *
+             * <p>Automatically calculated based on the longest token lifetime plus a proportional
+             * safety buffer. Keys must be retained for at least as long as the tokens they signed
+             * remain valid, otherwise token verification will fail.
+             *
+             * <p>Formula: ceil((maxTokenExpiry + 10% buffer + refreshGrace + clockSkew) / 1440)
+             *
+             * <p>The buffer includes:
+             *
+             * <ul>
+             *   <li>10% of token lifetime (scales with token duration)
+             *   <li>Token refresh grace period ({@link #refreshGraceMinutes})
+             *   <li>Clock skew tolerance ({@link #allowedClockSkewSeconds} converted to minutes)
+             * </ul>
+             *
+             * @return calculated key retention period in days
+             */
+            public int getKeyRetentionDays() {
+                final int MINUTES_PER_DAY = 1440;
+                final double BUFFER_PERCENTAGE = 0.10; // 10% buffer
+
+                int maxTokenExpiryMinutes = Math.max(tokenExpiryMinutes, desktopTokenExpiryMinutes);
+
+                // Add 10% buffer (scales with token lifetime)
+                int bufferMinutes = (int) Math.ceil(maxTokenExpiryMinutes * BUFFER_PERCENTAGE);
+
+                // Add refresh grace period
+                bufferMinutes += refreshGraceMinutes;
+
+                // Add clock skew (convert seconds to minutes, round up)
+                bufferMinutes += (int) Math.ceil(allowedClockSkewSeconds / 60.0);
+
+                // Total retention in minutes, convert to days (round up)
+                int totalMinutes = maxTokenExpiryMinutes + bufferMinutes;
+                return (int) Math.ceil(totalMinutes / (double) MINUTES_PER_DAY);
+            }
        }

        @Data
@@ -568,6 +712,8 @@ public class ApplicationProperties {
        private String appNameNavbar;
        private List<String> languages;
        private String logoStyle = "classic"; // Options: "classic" (default) or "modern"
+        private boolean defaultHideUnavailableTools = false;
+        private boolean defaultHideUnavailableConversions = false;

        public String getAppNameNavbar() {
            return appNameNavbar != null && !appNameNavbar.trim().isEmpty() ? appNameNavbar : null;
@@ -0,0 +1,98 @@
+package stirling.software.common.model;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/** Form field information with coordinates for interactive form viewer. */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@Schema(description = "Form field with coordinates and metadata")
+public class FormFieldWithCoordinates {
+
+    @Schema(description = "Fully qualified field name", example = "form1.firstName")
+    private String name;
+
+    @Schema(description = "Display label for the field", example = "First Name")
+    private String label;
+
+    @Schema(description = "Field type: text, checkbox, radio, combobox, listbox, button, signature")
+    private String type;
+
+    @Schema(description = "Current field value")
+    private String value;
+
+    @Schema(
+            description =
+                    "Available options (export values) for choice fields"
+                            + " (dropdown, radio, listbox)")
+    private List<String> options;
+
+    @Schema(
+            description =
+                    "Human-readable display labels for choice field options,"
+                            + " parallel to the 'options' list. Null when identical to options.")
+    private List<String> displayOptions;
+
+    @Schema(description = "Whether the field is required")
+    private boolean required;
+
+    @Schema(description = "Whether the field is read-only")
+    private boolean readOnly;
+
+    @Schema(description = "Whether this is a multi-select list box")
+    private boolean multiSelect;
+
+    @Schema(description = "Whether this is a multi-line text field")
+    private boolean multiline;
+
+    @Schema(description = "Tooltip/alternate name for the field")
+    private String tooltip;
+
+    @Schema(description = "Widget coordinates on each page (fields can have multiple widgets)")
+    private List<WidgetCoordinates> widgets;
+
+    /**
+     * Coordinates for a single widget annotation (visual representation of the field). A field can
+     * have multiple widgets if it appears on multiple pages.
+     */
+    @Data
+    @Builder
+    @NoArgsConstructor
+    @AllArgsConstructor
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    @Schema(description = "Widget coordinates in PDF space")
+    public static class WidgetCoordinates {
+
+        @Schema(description = "Page index (0-based)", example = "0")
+        private int pageIndex;
+
+        @Schema(description = "X coordinate in PDF points (lower-left origin)")
+        private float x;
+
+        @Schema(description = "Y coordinate in PDF points (lower-left origin)")
+        private float y;
+
+        @Schema(description = "Width in PDF points")
+        private float width;
+
+        @Schema(description = "Height in PDF points")
+        private float height;
+
+        @Schema(description = "Export value for this widget (radio/checkbox buttons only)")
+        private String exportValue;
+
+        @Schema(description = "Font size in PDF points")
+        private Float fontSize;
+    }
+}
@@ -35,7 +35,7 @@ public class JobExecutorService {
    private final HttpServletRequest request;
    private final ResourceMonitor resourceMonitor;
    private final JobQueue jobQueue;
-    private final ExecutorService executor = ExecutorFactory.newVirtualOrCachedThreadExecutor();
+    private final ExecutorService executor = ExecutorFactory.newVirtualThreadExecutor();
    private final long effectiveTimeoutMs;

    @Autowired(required = false)
@@ -254,10 +254,13 @@ public class JobExecutorService {
                return ResponseEntity.internalServerError()
                        .body(Map.of("error", "Job timed out after " + timeoutToUse + " ms"));
            } catch (RuntimeException e) {
-                // Check if this is a wrapped typed exception that should be handled by
-                // GlobalExceptionHandler
+                // Check if this is a typed exception that should be handled by
+                // GlobalExceptionHandler (either directly or wrapped)
                Throwable cause = e.getCause();
-                if (cause instanceof stirling.software.common.util.ExceptionUtils.BaseAppException
+                if (e instanceof IllegalArgumentException
+                        || cause
+                                instanceof
+                                stirling.software.common.util.ExceptionUtils.BaseAppException
                        || cause
                                instanceof
                                stirling.software.common.util.ExceptionUtils
@@ -44,8 +44,10 @@ public class JobQueue implements SmartLifecycle {

    private volatile BlockingQueue<QueuedJob> jobQueue;
    private final Map<String, QueuedJob> jobMap = new ConcurrentHashMap<>();
-    private final ScheduledExecutorService scheduler = Executors.newSingleThreadScheduledExecutor();
-    private final ExecutorService jobExecutor = ExecutorFactory.newVirtualOrCachedThreadExecutor();
+    private final ScheduledExecutorService scheduler =
+            Executors.newSingleThreadScheduledExecutor(
+                    Thread.ofVirtual().name("job-queue-scheduler-", 0).factory());
+    private final ExecutorService jobExecutor = ExecutorFactory.newVirtualThreadExecutor();
    private final Object queueLock = new Object(); // Lock for synchronizing queue operations

    private boolean shuttingDown = false;
@@ -0,0 +1,29 @@
+package stirling.software.common.service;
+
+/**
+ * Interface for checking license status dynamically. Implementation provided by proprietary module
+ * when available.
+ */
+public interface LicenseServiceInterface {
+
+    /**
+     * Get the license type as a string.
+     *
+     * @return "NORMAL", "SERVER", or "ENTERPRISE"
+     */
+    String getLicenseTypeName();
+
+    /**
+     * Check if running Pro or higher (SERVER or ENTERPRISE license).
+     *
+     * @return true if SERVER or ENTERPRISE license is active
+     */
+    boolean isRunningProOrHigher();
+
+    /**
+     * Check if running Enterprise edition.
+     *
+     * @return true if ENTERPRISE license is active
+     */
+    boolean isRunningEE();
+}
@@ -9,6 +9,7 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
+import java.util.regex.Pattern;

 import org.springframework.scheduling.annotation.Scheduled;
 import org.springframework.stereotype.Service;
@@ -25,6 +26,9 @@ import lombok.extern.slf4j.Slf4j;
 public class MobileScannerService {

    private static final long SESSION_TIMEOUT_MS = 10 * 60 * 1000; // 10 minutes
+    private static final Pattern FILENAME_SANITIZE_PATTERN = Pattern.compile("[^a-zA-Z0-9._-]");
+    private static final Pattern SESSION_ID_VALIDATION_PATTERN = Pattern.compile("[a-zA-Z0-9-]+");
+    private static final Pattern FILE_EXTENSION_PATTERN = Pattern.compile("[.][^.]+$");
    private final Map<String, SessionData> activeSessions = new ConcurrentHashMap<>();
    private final Path tempDirectory;

@@ -121,7 +125,8 @@ public class MobileScannerService {
            // Handle duplicate filenames
            int counter = 1;
            while (Files.exists(filePath)) {
-                String nameWithoutExt = safeFilename.replaceFirst("[.][^.]+$", "");
+                String nameWithoutExt =
+                        FILE_EXTENSION_PATTERN.matcher(safeFilename).replaceFirst("");
                String ext =
                        safeFilename.contains(".")
                                ? safeFilename.substring(safeFilename.lastIndexOf("."))
@@ -271,14 +276,14 @@ public class MobileScannerService {
            throw new IllegalArgumentException("Session ID cannot be empty");
        }
        // Basic validation: alphanumeric and hyphens only
-        if (!sessionId.matches("[a-zA-Z0-9-]+")) {
+        if (!SESSION_ID_VALIDATION_PATTERN.matcher(sessionId).matches()) {
            throw new IllegalArgumentException("Invalid session ID format");
        }
    }

    private String sanitizeFilename(String filename) {
        // Remove path traversal attempts and dangerous characters
-        String sanitized = filename.replaceAll("[^a-zA-Z0-9._-]", "_");
+        String sanitized = FILENAME_SANITIZE_PATTERN.matcher(filename).replaceAll("_");
        // Ensure we have a non-empty, safe filename
        if (sanitized.isBlank()) {
            sanitized = "upload-" + System.currentTimeMillis();
@@ -43,7 +43,9 @@ public class ResourceMonitor {
    @Value("${stirling.resource.monitor.interval-ms:60000}")
    private long monitorIntervalMs = 60000; // 60 seconds

-    private final ScheduledExecutorService scheduler = Executors.newSingleThreadScheduledExecutor();
+    private final ScheduledExecutorService scheduler =
+            Executors.newSingleThreadScheduledExecutor(
+                    Thread.ofVirtual().name("resource-monitor-", 0).factory());
    private final MemoryMXBean memoryMXBean = ManagementFactory.getMemoryMXBean();
    private final OperatingSystemMXBean osMXBean = ManagementFactory.getOperatingSystemMXBean();

@@ -42,7 +42,8 @@ public class TaskManager {

    private final FileStorage fileStorage;
    private final ScheduledExecutorService cleanupExecutor =
-            Executors.newSingleThreadScheduledExecutor();
+            Executors.newSingleThreadScheduledExecutor(
+                    Thread.ofVirtual().name("task-cleanup-", 0).factory());

    /** Initialize the task manager and start the cleanup scheduler */
    public TaskManager(FileStorage fileStorage) {
@@ -2,30 +2,28 @@ package stirling.software.common.util;

 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;

-import lombok.extern.slf4j.Slf4j;
+/**
+ * Factory for creating executors backed by virtual threads (Java 21+). Virtual threads are
+ * lightweight, managed by the JVM, and ideal for I/O-bound tasks. They eliminate the need for
+ * thread pool sizing since thousands can run concurrently with minimal overhead.
+ */
+public final class ExecutorFactory {

-@Slf4j
-public class ExecutorFactory {
+    private ExecutorFactory() {}
+
+    /** Creates an {@link ExecutorService} that starts a new virtual thread for each task. */
+    public static ExecutorService newVirtualThreadExecutor() {
+        return Executors.newVirtualThreadPerTaskExecutor();
+    }

    /**
-     * Creates an ExecutorService using virtual threads if available (Java 21+), or falls back to a
-     * cached thread pool on older Java versions.
+     * Creates a {@link ScheduledExecutorService} backed by a single virtual thread. Useful for
+     * periodic/delayed tasks that should not pin a platform thread.
     */
-    public static ExecutorService newVirtualOrCachedThreadExecutor() {
-        try {
-            ExecutorService executor =
-                    (ExecutorService)
-                            Executors.class
-                                    .getMethod("newVirtualThreadPerTaskExecutor")
-                                    .invoke(null);
-            return executor;
-        } catch (NoSuchMethodException e) {
-            log.debug("Virtual threads not available; falling back to cached thread pool.");
-        } catch (Exception e) {
-            log.debug("Error initializing virtual thread executor: {}", e.getMessage(), e);
-        }
-
-        return Executors.newCachedThreadPool();
+    public static ScheduledExecutorService newSingleVirtualThreadScheduledExecutor() {
+        return Executors.newSingleThreadScheduledExecutor(
+                Thread.ofVirtual().name("scheduled-vt-", 0).factory());
    }
 }
@@ -68,6 +68,17 @@ public class FileMonitor {

        if (this.rootDirs.isEmpty()) {
            log.error("No valid directories to monitor - FileMonitor will not function");
+        } else {
+            // Register directories eagerly so the first @Scheduled tick does not warn.
+            for (Path rootDir : this.rootDirs) {
+                if (Files.exists(rootDir)) {
+                    try {
+                        recursivelyRegisterEntry(rootDir);
+                    } catch (IOException e) {
+                        log.error("Failed to register monitoring for {}", rootDir, e);
+                    }
+                }
+            }
        }
    }

@@ -100,6 +100,13 @@ public class FileToPdf {
                while (entry != null) {
                    Path filePath =
                            tempUnzippedDir.getPath().resolve(sanitizeZipFilename(entry.getName()));
+                    Path normalizedTargetDir =
+                            tempUnzippedDir.getPath().toAbsolutePath().normalize();
+                    Path normalizedFilePath = filePath.toAbsolutePath().normalize();
+                    if (!normalizedFilePath.startsWith(normalizedTargetDir)) {
+                        throw new IOException(
+                                "Zip entry path escapes target directory: " + entry.getName());
+                    }
                    if (!entry.isDirectory()) {
                        Files.createDirectories(filePath.getParent());
                        if (entry.getName().toLowerCase(Locale.ROOT).endsWith(".html")
@@ -1,4 +1,4 @@
-package stirling.software.proprietary.util;
+package stirling.software.common.util;

 import java.io.IOException;
 import java.util.Arrays;
@@ -1,10 +1,11 @@
-package stirling.software.proprietary.util;
+package stirling.software.common.util;

 import java.awt.image.BufferedImage;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
+import java.util.Comparator;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.IdentityHashMap;
@@ -18,6 +19,7 @@ import java.util.Optional;
 import java.util.Set;

 import org.apache.pdfbox.cos.COSArray;
+import org.apache.pdfbox.cos.COSBase;
 import org.apache.pdfbox.cos.COSDictionary;
 import org.apache.pdfbox.cos.COSName;
 import org.apache.pdfbox.pdmodel.PDDocument;
@@ -46,9 +48,7 @@ import lombok.experimental.UtilityClass;
 import lombok.extern.slf4j.Slf4j;

 import stirling.software.common.model.ApplicationProperties;
-import stirling.software.common.util.ApplicationContextProvider;
-import stirling.software.common.util.ExceptionUtils;
-import stirling.software.common.util.RegexPatternUtils;
+import stirling.software.common.model.FormFieldWithCoordinates;

@Slf4j
@UtilityClass
@@ -67,6 +67,13 @@ public class FormUtils {
    public final Set<String> CHOICE_FIELD_TYPES =
            Set.of(FIELD_TYPE_COMBOBOX, FIELD_TYPE_LISTBOX, FIELD_TYPE_RADIO);

+    /**
+     * Threshold in PDF points for considering two widgets to be on the same line. Fields whose
+     * y-coordinates differ by less than this value are sorted left-to-right by x-coordinate instead
+     * of top-to-bottom.
+     */
+    private static final float SAME_LINE_THRESHOLD_PT = 10.0f;
+
    /**
     * Returns a normalized logical type string for the supplied PDFBox field instance. Centralized
     * so all callers share identical mapping logic.
@@ -109,6 +116,8 @@ public class FormUtils {
        List<FormFieldInfo> fields = new ArrayList<>();
        Map<String, Integer> typeCounters = new HashMap<>();
        Map<Integer, Integer> pageOrderCounters = new HashMap<>();
+        Map<COSDictionary, Integer> annotationPageMap = buildAnnotationPageMap(document);
+
        for (PDField field : acroForm.getFieldTree()) {
            if (!(field instanceof PDTerminalField terminalField)) {
                continue;
@@ -123,9 +132,9 @@ public class FormUtils {
                continue;
            }

-            String currentValue = safeValue(terminalField);
+            String currentValue = safeFieldValue(terminalField);
            boolean required = field.isRequired();
-            int pageIndex = resolveFirstWidgetPageIndex(document, terminalField);
+            int pageIndex = resolveFirstWidgetPageIndex(document, terminalField, annotationPageMap);
            List<String> options = resolveOptions(terminalField);
            String tooltip = resolveTooltip(terminalField);
            int typeIndex = typeCounters.merge(type, 1, Integer::sum);
@@ -164,6 +173,396 @@ public class FormUtils {
        return Collections.unmodifiableList(fields);
    }

+    /**
+     * Extract form fields with widget coordinates for the interactive form viewer.
+     *
+     * @param document PDF document
+     * @return List of form fields with coordinates and metadata
+     */
+    public List<FormFieldWithCoordinates> extractFormFieldsWithCoordinates(PDDocument document) {
+        if (document == null) return List.of();
+
+        PDAcroForm acroForm = getAcroFormSafely(document);
+        if (acroForm == null) return List.of();
+
+        List<FormFieldWithCoordinates> fields = new ArrayList<>();
+        Map<String, Integer> typeCounters = new HashMap<>();
+
+        Map<COSDictionary, Integer> annotationPageMap = buildAnnotationPageMap(document);
+
+        for (PDField field : acroForm.getFieldTree()) {
+            if (!(field instanceof PDTerminalField terminalField)) {
+                continue;
+            }
+
+            String type = detectFieldType(terminalField);
+            String name =
+                    Optional.ofNullable(field.getFullyQualifiedName())
+                            .orElseGet(field::getPartialName);
+            if (name == null || name.isBlank()) {
+                continue;
+            }
+
+            String currentValue = safeFieldValue(terminalField);
+            boolean required = field.isRequired();
+            boolean readOnly = field.isReadOnly();
+            List<String> options = resolveOptions(terminalField);
+            List<String> displayOptions = resolveDisplayOptions(terminalField);
+            String tooltip = resolveTooltip(terminalField);
+            int typeIndex = typeCounters.merge(type, 1, Integer::sum);
+            String displayLabel =
+                    deriveDisplayLabel(field, name, tooltip, type, typeIndex, options);
+            boolean multiSelect = resolveMultiSelect(terminalField);
+            boolean multiline =
+                    terminalField instanceof PDTextField
+                            && ((PDTextField) terminalField).isMultiline();
+
+            // Extract widget coordinates
+            List<FormFieldWithCoordinates.WidgetCoordinates> widgets =
+                    extractWidgetCoordinates(document, terminalField, annotationPageMap);
+
+            // Only include displayOptions when they differ from export options
+            List<String> displayOptsToSend = null;
+            if (displayOptions != null
+                    && !displayOptions.isEmpty()
+                    && !displayOptions.equals(options)) {
+                displayOptsToSend = displayOptions;
+            }
+
+            fields.add(
+                    FormFieldWithCoordinates.builder()
+                            .name(name)
+                            .label(displayLabel)
+                            .type(type)
+                            .value(currentValue)
+                            .options(options.isEmpty() ? null : options)
+                            .displayOptions(displayOptsToSend)
+                            .required(required)
+                            .readOnly(readOnly)
+                            .multiSelect(multiSelect)
+                            .multiline(multiline)
+                            .tooltip(tooltip)
+                            .widgets(widgets.isEmpty() ? null : widgets)
+                            .build());
+        }
+
+        // Sort by page and position
+        fields.sort(new FieldCoordinateComparator());
+
+        log.debug("Total fields processed: {}", fields.size());
+        log.debug(
+                "Fields WITH widgets: {}",
+                fields.stream()
+                        .filter(f -> f.getWidgets() != null && !f.getWidgets().isEmpty())
+                        .count());
+        log.debug(
+                "Fields WITHOUT widgets: {}",
+                fields.stream()
+                        .filter(f -> f.getWidgets() == null || f.getWidgets().isEmpty())
+                        .count());
+
+        fields.stream()
+                .filter(f -> f.getWidgets() == null || f.getWidgets().isEmpty())
+                .forEach(
+                        f ->
+                                log.debug(
+                                        "Field '{}' type={} has NO widget coordinates",
+                                        f.getName(),
+                                        f.getType()));
+
+        return Collections.unmodifiableList(fields);
+    }
+
+    /**
+     * Extract widget coordinates for a form field.
+     *
+     * @param document PDF document
+     * @param field Terminal field
+     * @return List of widget coordinates
+     */
+    private List<FormFieldWithCoordinates.WidgetCoordinates> extractWidgetCoordinates(
+            PDDocument document,
+            PDTerminalField field,
+            Map<COSDictionary, Integer> annotationPageMap) {
+        List<FormFieldWithCoordinates.WidgetCoordinates> result = new ArrayList<>();
+
+        List<PDAnnotationWidget> widgets = field.getWidgets();
+
+        log.debug(
+                "Field '{}' type={} has {} widgets",
+                field.getFullyQualifiedName(),
+                field.getClass().getSimpleName(),
+                widgets != null ? widgets.size() : 0);
+
+        if (widgets == null || widgets.isEmpty()) {
+            // Some fields (especially text fields) might be their own widget annotation
+            log.trace(
+                    "Field '{}' has no widgets, checking if field acts as its own annotation",
+                    field.getFullyQualifiedName());
+            try {
+                COSDictionary fieldDict = field.getCOSObject();
+                COSBase rectBase = fieldDict.getDictionaryObject(COSName.RECT);
+                if (rectBase instanceof COSArray rectArray) {
+                    int pageIndex =
+                            findPageIndexForAnnotation(document, fieldDict, annotationPageMap);
+                    if (pageIndex >= 0) {
+                        PDRectangle rectangle = new PDRectangle(rectArray);
+                        result.add(
+                                createWidgetCoordinates(
+                                        document, rectangle, pageIndex, null, field));
+                    } else {
+                        log.warn(
+                                "Found rectangle for field '{}' but could not resolve page index",
+                                field.getFullyQualifiedName());
+                    }
+                }
+            } catch (Exception e) {
+                log.debug(
+                        "Could not extract direct rectangle for field '{}': {}",
+                        field.getFullyQualifiedName(),
+                        e.getMessage());
+            }
+            return result;
+        }
+
+        // For radio buttons, pre-resolve export values per widget
+        List<String> exportValues = null;
+        if (field instanceof PDRadioButton radio) {
+            exportValues = radio.getExportValues();
+        }
+
+        for (int i = 0; i < widgets.size(); i++) {
+            PDAnnotationWidget widget = widgets.get(i);
+            try {
+                PDRectangle rectangle = widget.getRectangle();
+                if (rectangle == null) {
+                    log.warn(
+                            "Field '{}' widget {} has NULL rectangle",
+                            field.getFullyQualifiedName(),
+                            i);
+                    continue;
+                }
+
+                int pageIndex = resolveWidgetPageIndex(document, widget, annotationPageMap);
+                if (pageIndex < 0) {
+                    log.warn(
+                            "Field '{}' widget {} could not resolve page index",
+                            field.getFullyQualifiedName(),
+                            i);
+                    continue;
+                }
+
+                // Resolve export value for radio/checkbox widgets
+                String exportValue = null;
+                if (exportValues != null && i < exportValues.size()) {
+                    exportValue = exportValues.get(i);
+                } else if (field instanceof PDButton) {
+                    // Fall back to appearance state name from the widget's normal appearance
+                    try {
+                        var ap = widget.getAppearance();
+                        if (ap != null && ap.getNormalAppearance() != null) {
+                            var normalAp = ap.getNormalAppearance();
+                            if (normalAp.isSubDictionary()) {
+                                for (var cosName : normalAp.getSubDictionary().keySet()) {
+                                    String key = cosName.getName();
+                                    if (!"Off".equals(key)) {
+                                        exportValue = key;
+                                        break;
+                                    }
+                                }
+                            }
+                        }
+                    } catch (Exception e) {
+                        log.trace(
+                                "Could not extract export value for widget in '{}': {}",
+                                field.getFullyQualifiedName(),
+                                e.getMessage());
+                    }
+                }
+
+                result.add(
+                        createWidgetCoordinates(
+                                document, rectangle, pageIndex, exportValue, field));
+            } catch (Exception e) {
+                log.debug(
+                        "Failed to extract coordinates for widget in field '{}': {}",
+                        field.getFullyQualifiedName(),
+                        e.getMessage());
+            }
+        }
+
+        return result;
+    }
+
+    private FormFieldWithCoordinates.WidgetCoordinates createWidgetCoordinates(
+            PDDocument document,
+            PDRectangle rectangle,
+            int pageIndex,
+            String exportValue,
+            PDTerminalField field) {
+        if (pageIndex < 0 || pageIndex >= document.getNumberOfPages()) {
+            return null;
+        }
+
+        PDPage page = document.getPage(pageIndex);
+        PDRectangle cropBox = page.getCropBox();
+
+        // Use CropBox dimensions for the y-flip.
+        // Note: getWidth() and getHeight() return dimensions BEFORE rotation.
+        float cropHeight = cropBox.getHeight();
+
+        // Get absolute widget coordinates (in MediaBox space, un-rotated)
+        float pdfX = rectangle.getLowerLeftX();
+        float pdfY = rectangle.getLowerLeftY();
+        float width = rectangle.getWidth();
+        float height = rectangle.getHeight();
+
+        // Adjust relative to CropBox origin
+        float relativeX = pdfX - cropBox.getLowerLeftX();
+        float relativeY = pdfY - cropBox.getLowerLeftY();
+
+        // Convert from PDF lower-left origin to CSS upper-left origin (y-flip).
+        // Widget /Rect coordinates are always in un-rotated PDF user space.
+        // The embedpdf viewer wraps all page content inside a <Rotate> CSS
+        // component that handles visual rotation — we must NOT apply any
+        // rotation transform here, or widgets would be double-rotated.
+        float finalX = relativeX;
+        float finalY = cropHeight - relativeY - height;
+        float finalW = width;
+        float finalH = height;
+
+        // Validate coordinates are within reasonable bounds
+        if (finalX < -1.0f
+                || finalY < -1.0f
+                || finalX > cropBox.getWidth() * 2 // Allow some horizontal overflow
+                || finalY > cropHeight + 1.0f) {
+            log.warn(
+                    "Widget coordinates out of bounds for field '{}': page={}, x={}, y={}, w={}, h={}",
+                    field.getFullyQualifiedName(),
+                    pageIndex,
+                    finalX,
+                    finalY,
+                    finalW,
+                    finalH);
+            return null;
+        }
+
+        return FormFieldWithCoordinates.WidgetCoordinates.builder()
+                .pageIndex(pageIndex)
+                .x(finalX)
+                .y(finalY)
+                .width(finalW)
+                .height(finalH)
+                .exportValue(exportValue)
+                .fontSize(extractFontSize(field))
+                .build();
+    }
+
+    /**
+     * Repairs widgets with missing page references by scanning all pages and setting the /P entry
+     * for orphan widgets.
+     *
+     * <p>This should be called BEFORE extracting form field coordinates.
+     *
+     * @param document PDF document to repair
+     */
+    public void repairMissingWidgetPageReferences(PDDocument document) {
+        try {
+            PDAcroForm acroForm = getAcroFormSafely(document);
+            if (acroForm == null) {
+                return;
+            }
+
+            log.debug("Checking for widgets with missing page references...");
+            int repairedCount = 0;
+
+            Map<COSDictionary, Integer> annotationPageMap = buildAnnotationPageMap(document);
+
+            for (PDField field : acroForm.getFieldTree()) {
+                if (!(field instanceof PDTerminalField terminalField)) {
+                    continue;
+                }
+
+                List<PDAnnotationWidget> widgets = terminalField.getWidgets();
+
+                if (widgets == null || widgets.isEmpty()) {
+                    continue;
+                }
+
+                for (PDAnnotationWidget widget : widgets) {
+                    if (widget.getPage() == null) {
+                        Integer pageIndex = annotationPageMap.get(widget.getCOSObject());
+                        if (pageIndex != null && pageIndex >= 0) {
+                            PDPage foundPage = document.getPage(pageIndex);
+                            widget.setPage(foundPage);
+                            repairedCount++;
+                            log.debug(
+                                    "Repaired widget for field '{}' - set page reference via map",
+                                    field.getFullyQualifiedName());
+                        } else {
+                            log.warn(
+                                    "Could not find page for widget in field '{}'",
+                                    field.getFullyQualifiedName());
+                        }
+                    }
+                }
+            }
+
+            if (repairedCount > 0) {
+                log.debug(
+                        "Successfully repaired {} widgets with missing page references",
+                        repairedCount);
+            } else {
+                log.debug("No widgets needed repair");
+            }
+
+        } catch (Exception e) {
+            log.error("Error repairing widget page references: {}", e.getMessage(), e);
+        }
+    }
+
+    private int findPageIndexForAnnotation(
+            PDDocument document,
+            COSDictionary annotDict,
+            Map<COSDictionary, Integer> annotationPageMap) {
+        try {
+            // Method 0: Check the pre-built lookup map (fastest)
+            if (annotationPageMap != null) {
+                Integer idx = annotationPageMap.get(annotDict);
+                if (idx != null) {
+                    return idx;
+                }
+            }
+
+            // Method 1: Check the /P entry if it points to a page
+            COSBase base = annotDict.getDictionaryObject(COSName.P);
+            COSDictionary pageDict = (base instanceof COSDictionary c) ? c : null;
+            if (pageDict != null) {
+                for (int i = 0; i < document.getNumberOfPages(); i++) {
+                    if (document.getPage(i).getCOSObject() == pageDict) {
+                        return i;
+                    }
+                }
+            }
+
+            // Method 2: Fallback search through all pages' annotations
+            for (int i = 0; i < document.getNumberOfPages(); i++) {
+                PDPage page = document.getPage(i);
+                List<PDAnnotation> annotations = page.getAnnotations();
+                if (annotations != null) {
+                    for (PDAnnotation annot : annotations) {
+                        if (annot != null && annot.getCOSObject() == annotDict) {
+                            return i;
+                        }
+                    }
+                }
+            }
+        } catch (Exception e) {
+            log.trace("Error finding page for annotation: {}", e.getMessage());
+        }
+        return -1;
+    }
+
    /**
     * Build a single record object (field-name -> value placeholder) that can be directly submitted
     * to /api/v1/form/fill as the 'data' JSON. For checkboxes a boolean false is supplied unless
@@ -312,7 +711,24 @@ public class FormUtils {
            return;
        }

-        flattenViaRendering(document, acroForm);
+        if (acroForm == null) {
+            return;
+        }
+
+        // Use PDFBox's built-in field flattening which bakes form field values
+        // into the page content stream as static text/graphics, removing the
+        // interactive form structure but preserving all other document content
+        // (images, text, annotations, etc.) at full quality.
+        try {
+            ensureAppearances(acroForm);
+            acroForm.flatten();
+        } catch (Exception e) {
+            log.warn(
+                    "PDFBox acroForm.flatten() failed, falling back to rendering: {}",
+                    e.getMessage(),
+                    e);
+            flattenViaRendering(document, acroForm);
+        }
    }

    private void rebuildDocumentFromImages(PDDocument document, PDFRenderer renderer, int dpi)
@@ -385,7 +801,7 @@ public class FormUtils {

                PDPage page = widget.getPage();
                if (page == null) {
-                    page = resolveWidgetPage(document, widget);
+                    page = resolveWidgetPage(document, widget, null);
                    if (page != null) {
                        widget.setPage(page);
                    }
@@ -818,8 +1234,22 @@ public class FormUtils {
        return states;
    }

-    private String safeValue(PDTerminalField field) {
+    public String safeValue(String value) {
+        return value != null ? value : "";
+    }
+
+    private String safeFieldValue(PDTerminalField field) {
        try {
+            // PDChoice.getValueAsString() returns a raw COS string representation
+            // that doesn't reliably reflect the selected value. Use getValue()
+            // which returns the proper List<String> of selected options.
+            if (field instanceof PDChoice choiceField) {
+                List<String> selected = choiceField.getValue();
+                if (selected == null || selected.isEmpty()) {
+                    return null;
+                }
+                return String.join(",", selected);
+            }
            return field.getValueAsString();
        } catch (Exception e) {
            log.debug(
@@ -833,14 +1263,25 @@ public class FormUtils {
    List<String> resolveOptions(PDTerminalField field) {
        try {
            if (field instanceof PDChoice choice) {
-                List<String> display = choice.getOptionsDisplayValues();
-                if (display != null && !display.isEmpty()) {
-                    return new ArrayList<>(display);
-                }
+                LinkedHashSet<String> allowed = new LinkedHashSet<>();
                List<String> exportValues = choice.getOptionsExportValues();
-                if (exportValues != null && !exportValues.isEmpty()) {
-                    return new ArrayList<>(exportValues);
+                List<String> displayValues = choice.getOptionsDisplayValues();
+
+                if (exportValues != null) {
+                    exportValues.stream()
+                            .filter(Objects::nonNull)
+                            .map(String::trim)
+                            .filter(s -> !s.isEmpty())
+                            .forEach(allowed::add);
                }
+                if (displayValues != null) {
+                    displayValues.stream()
+                            .filter(Objects::nonNull)
+                            .map(String::trim)
+                            .filter(s -> !s.isEmpty())
+                            .forEach(allowed::add);
+                }
+                return new ArrayList<>(allowed);
            } else if (field instanceof PDRadioButton radio) {
                List<String> exports = radio.getExportValues();
                if (exports != null && !exports.isEmpty()) {
@@ -861,6 +1302,29 @@ public class FormUtils {
        return Collections.emptyList();
    }

+    /**
+     * Returns the display-value labels for a choice field's options. For radio / checkbox this
+     * returns an empty list (no separate display values). For PDChoice fields, if the PDF provides
+     * distinct display values, those are returned; otherwise an empty list (indicating that the
+     * export values from {@link #resolveOptions} should be shown directly).
+     */
+    List<String> resolveDisplayOptions(PDTerminalField field) {
+        try {
+            if (field instanceof PDChoice choice) {
+                List<String> display = choice.getOptionsDisplayValues();
+                if (display != null && !display.isEmpty()) {
+                    return new ArrayList<>(display);
+                }
+            }
+        } catch (Exception e) {
+            log.debug(
+                    "Failed to resolve display options for field '{}': {}",
+                    field.getFullyQualifiedName(),
+                    e.getMessage());
+        }
+        return Collections.emptyList();
+    }
+
    private boolean resolveMultiSelect(PDTerminalField field) {
        if (field instanceof PDListBox listBox) {
            try {
@@ -875,6 +1339,44 @@ public class FormUtils {
        return false;
    }

+    private Float extractFontSize(PDTerminalField field) {
+        try {
+            String da = null;
+            if (field instanceof PDVariableText vt) {
+                da = vt.getDefaultAppearance();
+            }
+
+            if (da == null || da.isBlank()) {
+                // Check parent/acroform default appearance if field's is missing
+                PDAcroForm form = field.getAcroForm();
+                if (form != null) {
+                    da = form.getDefaultAppearance();
+                }
+            }
+
+            if (da != null && !da.isBlank()) {
+                // Standard DA looks like: /Helv 12 Tf 0 g
+                // We want the number before 'Tf'
+                String[] tokens = da.split("\\s+");
+                for (int i = 0; i < tokens.length; i++) {
+                    if ("Tf".equals(tokens[i]) && i > 0) {
+                        try {
+                            float size = Float.parseFloat(tokens[i - 1]);
+                            return size > 0 ? size : null;
+                        } catch (NumberFormatException ignored) {
+                        }
+                    }
+                }
+            }
+        } catch (Exception e) {
+            log.trace(
+                    "Could not extract font size for field '{}': {}",
+                    field.getFullyQualifiedName(),
+                    e.getMessage());
+        }
+        return null;
+    }
+
    private boolean isSettableCheckBoxState(String state) {
        if (state == null) return false;
        String trimmed = state.trim();
@@ -952,6 +1454,13 @@ public class FormUtils {

        if (simplified.isEmpty()) return true;

+        // Detect UUID-like hex strings (e.g. "cdc47b7041524571 7b2d93017fe77bf7")
+        // Standard UUIDs are 32 hex characters; require at least that to avoid
+        // false positives on short hex-like field names.
+        String nospaces = simplified.replaceAll("\\s+", "");
+        if (nospaces.length() >= 32 && nospaces.matches("^[0-9a-fA-F]{8}[0-9a-fA-F]{24,}$"))
+            return true;
+
        return patterns.getGenericFieldNamePattern().matcher(simplified).matches()
                || patterns.getSimpleFormFieldPattern().matcher(simplified).matches()
                || patterns.getOptionalTNumericPattern().matcher(simplified).matches();
@@ -1007,7 +1516,7 @@ public class FormUtils {

            PDAnnotationWidget widget = widgets.get(0);
            PDRectangle originalRectangle = cloneRectangle(widget.getRectangle());
-            PDPage page = resolveWidgetPage(document, widget);
+            PDPage page = resolveWidgetPage(document, widget, null);
            if (page == null || originalRectangle == null) {
                log.warn(
                        "Unable to resolve widget page or rectangle for '{}'; skipping",
@@ -1064,7 +1573,7 @@ public class FormUtils {
                            desiredName,
                            modification.label(),
                            resolvedType,
-                            determineWidgetPageIndex(document, widget),
+                            determineWidgetPageIndex(document, widget, null),
                            originalRectangle.getLowerLeftX(),
                            originalRectangle.getLowerLeftY(),
                            originalRectangle.getWidth(),
@@ -1205,59 +1714,43 @@ public class FormUtils {
        return null;
    }

-    private int resolveFirstWidgetPageIndex(PDDocument document, PDTerminalField field) {
+    private int resolveFirstWidgetPageIndex(
+            PDDocument document,
+            PDTerminalField field,
+            Map<COSDictionary, Integer> annotationPageMap) {
        List<PDAnnotationWidget> widgets = field.getWidgets();
        if (widgets == null || widgets.isEmpty()) {
            return -1;
        }
-        Map<PDAnnotationWidget, Integer> widgetPageFallbacks = null;
        for (PDAnnotationWidget widget : widgets) {
-            int idx = resolveWidgetPageIndex(document, widget);
+            int idx = resolveWidgetPageIndex(document, widget, annotationPageMap);
            if (idx >= 0) {
                return idx;
            }
-            try {
-                COSDictionary widgetDictionary = widget.getCOSObject();
-                if (widgetDictionary != null
-                        && widgetDictionary.getDictionaryObject(COSName.P) == null) {
-                    if (widgetPageFallbacks == null) {
-                        widgetPageFallbacks = buildWidgetPageFallbackMap(document);
-                    }
-                    Integer fallbackIndex = widgetPageFallbacks.get(widget);
-                    if (fallbackIndex != null && fallbackIndex >= 0) {
-                        return fallbackIndex;
-                    }
-                }
-            } catch (Exception e) {
-                log.debug(
-                        "Failed to inspect widget page reference for field '{}': {}",
-                        field.getFullyQualifiedName(),
-                        e.getMessage());
-            }
        }
        return -1;
    }

-    private int resolveWidgetPageIndex(PDDocument document, PDAnnotationWidget widget) {
+    private int resolveWidgetPageIndex(
+            PDDocument document,
+            PDAnnotationWidget widget,
+            Map<COSDictionary, Integer> annotationPageMap) {
        if (document == null || widget == null) {
            return -1;
        }
-        try {
-            COSDictionary widgetDictionary = widget.getCOSObject();
-            if (widgetDictionary != null
-                    && widgetDictionary.getDictionaryObject(COSName.P) == null) {
-                Map<PDAnnotationWidget, Integer> fallback = buildWidgetPageFallbackMap(document);
-                Integer index = fallback.get(widget);
-                if (index != null) {
-                    return index;
-                }
+
+        // Method 0: Check the pre-built lookup map (fastest)
+        if (annotationPageMap != null) {
+            Integer idx = annotationPageMap.get(widget.getCOSObject());
+            if (idx != null) {
+                return idx;
            }
-        } catch (Exception e) {
-            log.debug("Widget page lookup via fallback map failed: {}", e.getMessage());
        }
+
        try {
            PDPage page = widget.getPage();
            if (page != null) {
+                // indexOf is O(N), still slower than map but better than scanning annotations
                int idx = document.getPages().indexOf(page);
                if (idx >= 0) {
                    return idx;
@@ -1267,14 +1760,36 @@ public class FormUtils {
            log.debug("Widget page lookup failed: {}", e.getMessage());
        }

+        // Method 1: Check the /P entry if it points to a page
+        try {
+            COSDictionary widgetDictionary = widget.getCOSObject();
+            if (widgetDictionary != null) {
+                COSBase base = widgetDictionary.getDictionaryObject(COSName.P);
+                COSDictionary pageDict = (base instanceof COSDictionary c) ? c : null;
+                if (pageDict != null) {
+                    for (int i = 0; i < document.getNumberOfPages(); i++) {
+                        if (document.getPage(i).getCOSObject() == pageDict) {
+                            return i;
+                        }
+                    }
+                }
+            }
+        } catch (Exception e) {
+            log.debug("Widget page lookup via /P entry failed: {}", e.getMessage());
+        }
+
+        // Method 2: Fallback search through all pages' annotations
        int pageCount = document.getNumberOfPages();
+        COSDictionary widgetDict = widget.getCOSObject();
        for (int i = 0; i < pageCount; i++) {
            try {
                PDPage candidate = document.getPage(i);
                List<PDAnnotation> annotations = candidate.getAnnotations();
-                for (PDAnnotation annotation : annotations) {
-                    if (annotation == widget) {
-                        return i;
+                if (annotations != null) {
+                    for (PDAnnotation annot : annotations) {
+                        if (annot != null && annot.getCOSObject() == widgetDict) {
+                            return i;
+                        }
                    }
                }
            } catch (IOException e) {
@@ -1317,7 +1832,7 @@ public class FormUtils {
            List<PDAnnotationWidget> widgets = field.getWidgets();
            if (widgets != null) {
                for (PDAnnotationWidget widget : widgets) {
-                    PDPage page = resolveWidgetPage(document, widget);
+                    PDPage page = resolveWidgetPage(document, widget, null);
                    if (page != null) {
                        page.getAnnotations().remove(widget);
                    }
@@ -1437,7 +1952,10 @@ public class FormUtils {
                rectangle.getHeight());
    }

-    private PDPage resolveWidgetPage(PDDocument document, PDAnnotationWidget widget) {
+    private PDPage resolveWidgetPage(
+            PDDocument document,
+            PDAnnotationWidget widget,
+            Map<COSDictionary, Integer> annotationPageMap) {
        if (widget == null) {
            return null;
        }
@@ -1445,7 +1963,7 @@ public class FormUtils {
        if (page != null) {
            return page;
        }
-        int pageIndex = determineWidgetPageIndex(document, widget);
+        int pageIndex = determineWidgetPageIndex(document, widget, annotationPageMap);
        if (pageIndex >= 0) {
            try {
                return document.getPage(pageIndex);
@@ -1456,11 +1974,21 @@ public class FormUtils {
        return null;
    }

-    private int determineWidgetPageIndex(PDDocument document, PDAnnotationWidget widget) {
+    private int determineWidgetPageIndex(
+            PDDocument document,
+            PDAnnotationWidget widget,
+            Map<COSDictionary, Integer> annotationPageMap) {
        if (document == null || widget == null) {
            return -1;
        }

+        if (annotationPageMap != null) {
+            Integer idx = annotationPageMap.get(widget.getCOSObject());
+            if (idx != null) {
+                return idx;
+            }
+        }
+
        PDPage directPage = widget.getPage();
        if (directPage != null) {
            int index = 0;
@@ -1488,6 +2016,33 @@ public class FormUtils {
        return -1;
    }

+    /**
+     * Build a map of annotation COS dictionaries to their respective page index. Scan once
+     * per-document to avoid O(N^2) lookups during field extraction.
+     */
+    public Map<COSDictionary, Integer> buildAnnotationPageMap(PDDocument document) {
+        if (document == null) {
+            return Collections.emptyMap();
+        }
+
+        Map<COSDictionary, Integer> map = new HashMap<>();
+        int pageCount = document.getNumberOfPages();
+        for (int i = 0; i < pageCount; i++) {
+            try {
+                PDPage page = document.getPage(i);
+                List<PDAnnotation> annotations = page.getAnnotations();
+                for (PDAnnotation annot : annotations) {
+                    if (annot != null) {
+                        map.putIfAbsent(annot.getCOSObject(), i);
+                    }
+                }
+            } catch (Exception e) {
+                log.debug("Failed to index annotations for page {}: {}", i, e.getMessage());
+            }
+        }
+        return map;
+    }
+
    private Map<PDAnnotationWidget, Integer> buildWidgetPageFallbackMap(PDDocument document) {
        if (document == null) {
            return Collections.emptyMap();
@@ -1760,4 +2315,46 @@ public class FormUtils {
            boolean multiSelect,
            String tooltip,
            int pageOrder) {}
+
+    /**
+     * Comparator for sorting form fields by page, then vertically (top-to-bottom), then
+     * horizontally (left-to-right) for fields on approximately the same line.
+     */
+    static final class FieldCoordinateComparator implements Comparator<FormFieldWithCoordinates> {
+
+        private static int firstWidgetPageIndex(FormFieldWithCoordinates f) {
+            return (f.getWidgets() != null && !f.getWidgets().isEmpty())
+                    ? f.getWidgets().get(0).getPageIndex()
+                    : -1;
+        }
+
+        private static float firstWidgetY(FormFieldWithCoordinates f) {
+            return (f.getWidgets() != null && !f.getWidgets().isEmpty())
+                    ? f.getWidgets().get(0).getY()
+                    : 0;
+        }
+
+        private static float firstWidgetX(FormFieldWithCoordinates f) {
+            return (f.getWidgets() != null && !f.getWidgets().isEmpty())
+                    ? f.getWidgets().get(0).getX()
+                    : 0;
+        }
+
+        @Override
+        public int compare(FormFieldWithCoordinates a, FormFieldWithCoordinates b) {
+            int pageA = firstWidgetPageIndex(a);
+            int pageB = firstWidgetPageIndex(b);
+            int pageCompare = Integer.compare(pageA, pageB);
+            if (pageCompare != 0) return pageCompare;
+
+            float yA = firstWidgetY(a);
+            float yB = firstWidgetY(b);
+
+            // Fields on approximately the same line should be sorted left-to-right
+            if (Math.abs(yA - yB) < SAME_LINE_THRESHOLD_PT) {
+                return Float.compare(firstWidgetX(a), firstWidgetX(b));
+            }
+            return Float.compare(yA, yB);
+        }
+    }
 }
@@ -649,8 +649,10 @@ public class GeneralUtils {
    }

    public List<Integer> parsePageList(String[] pages, int totalPages, boolean oneBased) {
-        List<Integer> result = new ArrayList<>();
+        // Use LinkedHashSet to prevent duplicates from inflating size and triggering maxSize guard
+        Set<Integer> result = new LinkedHashSet<>();
        int offset = oneBased ? 1 : 0;
+        int maxSize = Math.max(1000, totalPages * 3);
        for (String page : pages) {
            if ("all".equalsIgnoreCase(page)) {

@@ -666,8 +668,12 @@ public class GeneralUtils {
            } else {
                result.addAll(handlePart(page, totalPages, offset));
            }
+            if (result.size() > maxSize) {
+                throw new IllegalArgumentException(
+                        "Page list exceeds maximum allowed size of " + maxSize);
+            }
        }
-        return result;
+        return new ArrayList<>(result);
    }

    /*
@@ -107,56 +107,65 @@ public class PDFToFile {
            File[] outputFiles =
                    Objects.requireNonNull(tempOutputDir.getPath().toFile().listFiles());
            List<File> markdownFiles = new ArrayList<>();
+            List<File> imageFiles = new ArrayList<>();

-            // Convert HTML files to Markdown
+            // Convert HTML files to Markdown and collect image files
            for (File outputFile : outputFiles) {
                if (outputFile.getName().endsWith(".html")) {
                    String html = Files.readString(outputFile.toPath());
                    String markdown = htmlToMarkdownConverter.convert(html);

+                    // Update image references to point to images/ folder
+                    markdown = updateImageReferences(markdown);
+
                    String mdFileName = outputFile.getName().replace(".html", ".md");
                    File mdFile = new File(tempOutputDir.getPath().toFile(), mdFileName);
                    Files.writeString(mdFile.toPath(), markdown);
                    markdownFiles.add(mdFile);
+                } else if (!outputFile.getName().endsWith(".md")) {
+                    // Collect non-HTML, non-MD files as images/assets
+                    imageFiles.add(outputFile);
                }
            }

-            // If there's only one markdown file, return it directly
-            if (markdownFiles.size() == 1) {
-                fileName = pdfBaseName + ".md";
-                fileBytes = Files.readAllBytes(markdownFiles.get(0).toPath());
-            } else {
-                // Multiple files - create a zip
-                fileName = pdfBaseName + "ToMarkdown.zip";
-                ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
+            // Always create a ZIP file
+            fileName = pdfBaseName + "ToMarkdown.zip";
+            ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();

-                try (ZipOutputStream zipOutputStream = new ZipOutputStream(byteArrayOutputStream)) {
-                    // Add markdown files
-                    for (File mdFile : markdownFiles) {
-                        ZipEntry mdEntry = new ZipEntry(mdFile.getName());
-                        zipOutputStream.putNextEntry(mdEntry);
-                        Files.copy(mdFile.toPath(), zipOutputStream);
-                        zipOutputStream.closeEntry();
-                    }
-
-                    // Add images and other assets
-                    for (File file : outputFiles) {
-                        if (!file.getName().endsWith(".html") && !file.getName().endsWith(".md")) {
-                            ZipEntry assetEntry = new ZipEntry(file.getName());
-                            zipOutputStream.putNextEntry(assetEntry);
-                            Files.copy(file.toPath(), zipOutputStream);
-                            zipOutputStream.closeEntry();
-                        }
-                    }
+            try (ZipOutputStream zipOutputStream = new ZipOutputStream(byteArrayOutputStream)) {
+                // Add markdown files to root of ZIP
+                for (File mdFile : markdownFiles) {
+                    ZipEntry mdEntry = new ZipEntry(mdFile.getName());
+                    zipOutputStream.putNextEntry(mdEntry);
+                    Files.copy(mdFile.toPath(), zipOutputStream);
+                    zipOutputStream.closeEntry();
                }

-                fileBytes = byteArrayOutputStream.toByteArray();
+                // Add images and other assets to images/ folder
+                for (File imageFile : imageFiles) {
+                    ZipEntry assetEntry = new ZipEntry("images/" + imageFile.getName());
+                    zipOutputStream.putNextEntry(assetEntry);
+                    Files.copy(imageFile.toPath(), zipOutputStream);
+                    zipOutputStream.closeEntry();
+                }
            }
+
+            fileBytes = byteArrayOutputStream.toByteArray();
        }
        return WebResponseUtils.bytesToWebResponse(
                fileBytes, fileName, MediaType.APPLICATION_OCTET_STREAM);
    }

+    /**
+     * Updates image references in markdown to point to the images/ folder. Matches patterns like
+     * ![alt](filename.png) and converts to ![alt](images/filename.png)
+     */
+    private String updateImageReferences(String markdown) {
+        // Match markdown image syntax: ![alt text](image.png)
+        // Only update if the path doesn't already start with images/
+        return markdown.replaceAll("(!\\[.*?\\])\\((?!images/)([^/)][^)]*?)\\)", "$1(images/$2)");
+    }
+
    public ResponseEntity<byte[]> processPdfToHtml(MultipartFile inputFile)
            throws IOException, InterruptedException {
        if (!MediaType.APPLICATION_PDF_VALUE.equals(inputFile.getContentType())) {
@@ -574,34 +574,39 @@ public class PdfUtils {
            boolean everyPage)
            throws IOException {

-        PDDocument document = pdfDocumentFactory.load(pdfBytes);
-
-        // Get the first page of the PDF
-        int pages = document.getNumberOfPages();
-        for (int i = 0; i < pages; i++) {
-            PDPage page = document.getPage(i);
-            try (PDPageContentStream contentStream =
-                    new PDPageContentStream(
-                            document, page, PDPageContentStream.AppendMode.APPEND, true, true)) {
-                // Create an image object from the image bytes
-                PDImageXObject image = PDImageXObject.createFromByteArray(document, imageBytes, "");
-                // Draw the image onto the page at the specified x and y coordinates
-                contentStream.drawImage(image, x, y);
-                log.info("Image successfully overlaid onto PDF");
-                if (!everyPage && i == 0) {
-                    break;
+        try (PDDocument document = pdfDocumentFactory.load(pdfBytes)) {
+            // Get the first page of the PDF
+            int pages = document.getNumberOfPages();
+            for (int i = 0; i < pages; i++) {
+                PDPage page = document.getPage(i);
+                try (PDPageContentStream contentStream =
+                        new PDPageContentStream(
+                                document,
+                                page,
+                                PDPageContentStream.AppendMode.APPEND,
+                                true,
+                                true)) {
+                    // Create an image object from the image bytes
+                    PDImageXObject image =
+                            PDImageXObject.createFromByteArray(document, imageBytes, "");
+                    // Draw the image onto the page at the specified x and y coordinates
+                    contentStream.drawImage(image, x, y);
+                    log.info("Image successfully overlaid onto PDF");
+                    if (!everyPage && i == 0) {
+                        break;
+                    }
+                } catch (IOException e) {
+                    // Log an error message if there is an issue overlaying the image onto the PDF
+                    log.error("Error overlaying image onto PDF", e);
+                    throw e;
                }
-            } catch (IOException e) {
-                // Log an error message if there is an issue overlaying the image onto the PDF
-                log.error("Error overlaying image onto PDF", e);
-                throw e;
            }
+            // Create a ByteArrayOutputStream to save the PDF to
+            ByteArrayOutputStream baos = new ByteArrayOutputStream();
+            document.save(baos);
+            log.info("PDF successfully saved to byte array");
+            return baos.toByteArray();
        }
-        // Create a ByteArrayOutputStream to save the PDF to
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-        document.save(baos);
-        log.info("PDF successfully saved to byte array");
-        return baos.toByteArray();
    }

    public boolean containsTextInFile(PDDocument pdfDocument, String text, String pagesToCheck)
@@ -226,50 +226,54 @@ public class ProcessExecutor {
            List<String> outputLines = new ArrayList<>();

            Thread errorReaderThread =
-                    new Thread(
-                            () -> {
-                                try (BufferedReader errorReader =
-                                        new BufferedReader(
-                                                new InputStreamReader(
-                                                        process.getErrorStream(),
-                                                        StandardCharsets.UTF_8))) {
-                                    String line;
-                                    while ((line =
-                                                    BoundedLineReader.readLine(
-                                                            errorReader, 5_000_000))
-                                            != null) {
-                                        errorLines.add(line);
-                                        if (liveUpdates) log.info(line);
-                                    }
-                                } catch (InterruptedIOException e) {
-                                    log.warn("Error reader thread was interrupted due to timeout.");
-                                } catch (IOException e) {
-                                    log.error("exception", e);
-                                }
-                            });
+                    Thread.ofVirtual()
+                            .unstarted(
+                                    () -> {
+                                        try (BufferedReader errorReader =
+                                                new BufferedReader(
+                                                        new InputStreamReader(
+                                                                process.getErrorStream(),
+                                                                StandardCharsets.UTF_8))) {
+                                            String line;
+                                            while ((line =
+                                                            BoundedLineReader.readLine(
+                                                                    errorReader, 5_000_000))
+                                                    != null) {
+                                                errorLines.add(line);
+                                                if (liveUpdates) log.info(line);
+                                            }
+                                        } catch (InterruptedIOException e) {
+                                            log.warn(
+                                                    "Error reader thread was interrupted due to timeout.");
+                                        } catch (IOException e) {
+                                            log.error("exception", e);
+                                        }
+                                    });

            Thread outputReaderThread =
-                    new Thread(
-                            () -> {
-                                try (BufferedReader outputReader =
-                                        new BufferedReader(
-                                                new InputStreamReader(
-                                                        process.getInputStream(),
-                                                        StandardCharsets.UTF_8))) {
-                                    String line;
-                                    while ((line =
-                                                    BoundedLineReader.readLine(
-                                                            outputReader, 5_000_000))
-                                            != null) {
-                                        outputLines.add(line);
-                                        if (liveUpdates) log.info(line);
-                                    }
-                                } catch (InterruptedIOException e) {
-                                    log.warn("Error reader thread was interrupted due to timeout.");
-                                } catch (IOException e) {
-                                    log.error("exception", e);
-                                }
-                            });
+                    Thread.ofVirtual()
+                            .unstarted(
+                                    () -> {
+                                        try (BufferedReader outputReader =
+                                                new BufferedReader(
+                                                        new InputStreamReader(
+                                                                process.getInputStream(),
+                                                                StandardCharsets.UTF_8))) {
+                                            String line;
+                                            while ((line =
+                                                            BoundedLineReader.readLine(
+                                                                    outputReader, 5_000_000))
+                                                    != null) {
+                                                outputLines.add(line);
+                                                if (liveUpdates) log.info(line);
+                                            }
+                                        } catch (InterruptedIOException e) {
+                                            log.warn(
+                                                    "Error reader thread was interrupted due to timeout.");
+                                        } catch (IOException e) {
+                                            log.error("exception", e);
+                                        }
+                                    });

            errorReaderThread.start();
            outputReaderThread.start();
@@ -370,7 +374,7 @@ public class ProcessExecutor {
            }
            // Match common unoconvert variants (but NOT soffice)
            String lowerBasename = basename.toLowerCase(java.util.Locale.ROOT);
-            if (lowerBasename.contains("unoconvert") || lowerBasename.equals("unoconv")) {
+            if (lowerBasename.contains("unoconvert") || "unoconv".equals(lowerBasename)) {
                return true;
            }
        }
@@ -47,6 +47,7 @@ public class SvgSanitizer {
    private static final Pattern DATA_SCRIPT_PATTERN =
            Pattern.compile(
                    "^\\s*data\\s*:[^,]*(?:script|javascript|vbscript)", Pattern.CASE_INSENSITIVE);
+    private static final Pattern NULL_BYTE_PATTERN = Pattern.compile("\u0000");
    private final SsrfProtectionService ssrfProtectionService;
    private final ApplicationProperties applicationProperties;

@@ -85,7 +86,7 @@ public class SvgSanitizer {
        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();

        factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
-
+        factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
        factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
        factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
        factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
@@ -210,7 +211,7 @@ public class SvgSanitizer {

        String result = url.trim();

-        result = result.replaceAll("\u0000", "");
+        result = NULL_BYTE_PATTERN.matcher(result).replaceAll("");

        for (int i = 0; i < 3; i++) {
            try {
@@ -4,18 +4,23 @@ import java.beans.PropertyEditorSupport;
 import java.util.ArrayList;
 import java.util.List;

-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.DeserializationFeature;
-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import lombok.extern.slf4j.Slf4j;

 import stirling.software.common.model.api.security.RedactionArea;

+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.DeserializationFeature;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
+
@Slf4j
 public class StringToArrayListPropertyEditor extends PropertyEditorSupport {

-    private final ObjectMapper objectMapper = new ObjectMapper();
+    private final ObjectMapper objectMapper =
+            JsonMapper.builder()
+                    .enable(DeserializationFeature.ACCEPT_SINGLE_VALUE_AS_ARRAY)
+                    .disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)
+                    .build();

    @Override
    public void setAsText(String text) throws IllegalArgumentException {
@@ -24,7 +29,6 @@ public class StringToArrayListPropertyEditor extends PropertyEditorSupport {
            return;
        }
        try {
-            objectMapper.configure(DeserializationFeature.ACCEPT_SINGLE_VALUE_AS_ARRAY, true);
            TypeReference<ArrayList<RedactionArea>> typeRef = new TypeReference<>() {};
            List<RedactionArea> list = objectMapper.readValue(text, typeRef);
            setValue(list);
@@ -4,12 +4,13 @@ import java.beans.PropertyEditorSupport;
 import java.util.HashMap;
 import java.util.Map;

-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.ObjectMapper;
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;

 public class StringToMapPropertyEditor extends PropertyEditorSupport {

-    private final ObjectMapper objectMapper = new ObjectMapper();
+    private final ObjectMapper objectMapper = JsonMapper.builder().build();

    @Override
    public void setAsText(String text) throws IllegalArgumentException {
@@ -12,11 +12,12 @@ class SpyPDFDocumentFactory extends CustomPDFDocumentFactory {
    public StrategyType lastStrategyUsed;

    public SpyPDFDocumentFactory(PdfMetadataService service) {
-        super(service);
+        super(service); // TempFileManager falls back to Files.createTempFile in tests
    }

    @Override
-    public StreamCacheCreateFunction getStreamCacheFunction(long contentSize) {
+    protected StreamCacheCreateFunction getStreamCacheFunction(
+            long contentSize, MemorySnapshot mem) {
        StrategyType type;
        if (contentSize < 10 * 1024 * 1024) {
            type = StrategyType.MEMORY_ONLY;
@@ -26,6 +27,6 @@ class SpyPDFDocumentFactory extends CustomPDFDocumentFactory {
            type = StrategyType.TEMP_FILE;
        }
        this.lastStrategyUsed = type;
-        return super.getStreamCacheFunction(contentSize); // delegate to real behavior
+        return super.getStreamCacheFunction(contentSize, mem);
    }
 }
@@ -1,4 +1,4 @@
-package stirling.software.proprietary.util;
+package stirling.software.common.util;

 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
@@ -153,11 +153,12 @@ class PDFToFileTest {
                            MediaType.APPLICATION_PDF_VALUE,
                            "Fake PDF content".getBytes());

-            // Create a mock HTML output file
+            // Create a mock HTML output file with image references
            Path htmlOutputFile = tempDir.resolve("test.html");
            Files.write(
                    htmlOutputFile,
-                    "<html><body><h1>Test</h1><p>This is a test.</p></body></html>".getBytes());
+                    "<html><body><h1>Test</h1><p>This is a test.</p><img src=\"image1.png\" /></body></html>"
+                            .getBytes());

            // Setup ProcessExecutor mock
            mockedStaticProcessExecutor
@@ -174,18 +175,61 @@ class PDFToFileTest {
                                Files.copy(
                                        htmlOutputFile, Path.of(outputDir.getPath(), "test.html"));

+                                // Create a mock image file
+                                Files.write(
+                                        Path.of(outputDir.getPath(), "image1.png"),
+                                        "Fake image data".getBytes());
+
                                return mockExecutorResult;
                            });

            // Execute the method
            ResponseEntity<byte[]> response = pdfToFile.processPdfToMarkdown(pdfFile);

-            // Verify
+            // Verify - should now return a ZIP file instead of plain markdown
            assertEquals(HttpStatus.OK, response.getStatusCode());
            assertNotNull(response.getBody());
            assertTrue(response.getBody().length > 0);
+
+            // Verify content disposition indicates a ZIP file
            assertTrue(
-                    response.getHeaders().getContentDisposition().toString().contains("test.md"));
+                    response.getHeaders()
+                            .getContentDisposition()
+                            .toString()
+                            .contains("ToMarkdown.zip"));
+
+            // Verify the content by unzipping it
+            try (ZipInputStream zipStream =
+                    ZipSecurity.createHardenedInputStream(
+                            new java.io.ByteArrayInputStream(response.getBody()))) {
+                ZipEntry entry;
+                boolean foundMdFile = false;
+                boolean foundImageInFolder = false;
+                String markdownContent = null;
+
+                while ((entry = zipStream.getNextEntry()) != null) {
+                    if (entry.getName().endsWith(".md")) {
+                        foundMdFile = true;
+                        // Read markdown content to verify image references
+                        markdownContent =
+                                new String(
+                                        zipStream.readAllBytes(),
+                                        java.nio.charset.StandardCharsets.UTF_8);
+                    } else if (entry.getName().startsWith("images/")
+                            && entry.getName().endsWith(".png")) {
+                        foundImageInFolder = true;
+                    }
+                    zipStream.closeEntry();
+                }
+
+                assertTrue(foundMdFile, "ZIP should contain Markdown file");
+                assertTrue(foundImageInFolder, "ZIP should contain image in images/ folder");
+                assertNotNull(markdownContent, "Markdown content should be present");
+                // Verify markdown references images with images/ prefix
+                assertTrue(
+                        markdownContent.contains("images/"),
+                        "Markdown should reference images with images/ prefix");
+            }
        }
    }

@@ -256,14 +300,15 @@ class PDFToFileTest {
                while ((entry = zipStream.getNextEntry()) != null) {
                    if (entry.getName().endsWith(".md")) {
                        foundMdFiles = true;
-                    } else if (entry.getName().endsWith(".png")) {
+                    } else if (entry.getName().startsWith("images/")
+                            && entry.getName().endsWith(".png")) {
                        foundImage = true;
                    }
                    zipStream.closeEntry();
                }

                assertTrue(foundMdFiles, "ZIP should contain Markdown files");
-                assertTrue(foundImage, "ZIP should contain image files");
+                assertTrue(foundImage, "ZIP should contain image files in images/ folder");
            }
        }
    }
@@ -121,17 +121,19 @@ public class UnoServerPoolTest {

        // Try to acquire a third endpoint in separate thread (should block)
        Thread blockingThread =
-                new Thread(
-                        () -> {
-                            try {
-                                acquireLatch.countDown(); // Signal we're about to block
-                                UnoServerPool.UnoServerLease lease3 = pool.acquireEndpoint();
-                                acquired.incrementAndGet();
-                                lease3.close();
-                            } catch (InterruptedException e) {
-                                Thread.currentThread().interrupt();
-                            }
-                        });
+                Thread.ofVirtual()
+                        .unstarted(
+                                () -> {
+                                    try {
+                                        acquireLatch.countDown(); // Signal we're about to block
+                                        UnoServerPool.UnoServerLease lease3 =
+                                                pool.acquireEndpoint();
+                                        acquired.incrementAndGet();
+                                        lease3.close();
+                                    } catch (InterruptedException e) {
+                                        Thread.currentThread().interrupt();
+                                    }
+                                });

        blockingThread.start();
        acquireLatch.await(); // Wait for thread to start
@@ -143,11 +143,21 @@ class StringToArrayListPropertyEditorTest {
    }

    @Test
-    void testSetAsText_InvalidStructure() {
-        // Arrange - this JSON doesn't match RedactionArea structure
+    void testSetAsText_UnknownProperties() {
+        // Arrange - this JSON contains properties not in RedactionArea
+        // With FAIL_ON_UNKNOWN_PROPERTIES disabled, this should ignore the unknown properties
        String json = "[{\"invalid\":\"structure\"}]";

-        // Act & Assert
-        assertThrows(IllegalArgumentException.class, () -> editor.setAsText(json));
+        // Act
+        editor.setAsText(json);
+        Object value = editor.getValue();
+
+        // Assert
+        assertNotNull(value, "Value should not be null");
+        assertInstanceOf(List.class, value, "Value should be a List");
+
+        @SuppressWarnings("unchecked")
+        List<RedactionArea> list = (List<RedactionArea>) value;
+        assertEquals(1, list.size(), "List should have 1 entry (empty object)");
    }
 }
@@ -46,8 +46,23 @@ dependencies {

    implementation project(':common')
    implementation 'org.springframework.boot:spring-boot-starter-jetty'
-    implementation 'com.posthog.java:posthog:1.2.0'
-    implementation 'org.telegram:telegrambots:6.9.7.1'
+    implementation 'org.eclipse.jetty.http2:jetty-http2-server'
+    implementation ('org.telegram:telegrambots:6.9.7.1') {
+        // Grizzly server + Jersey JAX-RS stack: only used for webhook mode;
+        // Stirling-PDF uses long-polling mode so these are dead weight (~3 MB)
+        exclude group: 'org.glassfish.jersey.inject'
+        exclude group: 'org.glassfish.jersey.media'
+        exclude group: 'org.glassfish.jersey.containers'
+        exclude group: 'org.glassfish.jersey.core'
+        exclude group: 'org.glassfish.jersey.ext'
+        exclude group: 'org.glassfish.grizzly'
+        exclude group: 'org.glassfish.hk2'
+        exclude group: 'org.glassfish.hk2.external'
+        exclude group: 'org.javassist', module: 'javassist'
+        // Old javax JAX-RS Jackson bindings (not needed, project uses jakarta)
+        exclude group: 'com.fasterxml.jackson.jaxrs'
+        exclude group: 'com.fasterxml.jackson.module', module: 'jackson-module-jaxb-annotations'
+    }
    implementation 'commons-io:commons-io:2.21.0'
    implementation "org.bouncycastle:bcprov-jdk18on:$bouncycastleVersion"
    implementation "org.bouncycastle:bcpkix-jdk18on:$bouncycastleVersion"
@@ -61,11 +76,14 @@ dependencies {
    implementation "org.apache.pdfbox:xmpbox:$pdfboxVersion"

    implementation 'org.verapdf:validation-model:1.28.2'
+    // CVE-2025-66453: Explicit rhino 1.7.15 to override verapdf's 1.7.13
+    implementation 'org.mozilla:rhino:1.7.15'

    // veraPDF still uses javax.xml.bind, not the new jakarta namespace
    implementation 'javax.xml.bind:jaxb-api:2.3.1'
    implementation 'com.sun.xml.bind:jaxb-impl:2.3.9'
    implementation 'com.sun.xml.bind:jaxb-core:2.3.0.1'
+    implementation 'org.apache.poi:poi-ooxml:5.5.1'

    // https://mvnrepository.com/artifact/technology.tabula/tabula
    implementation ('technology.tabula:tabula:1.0.5')  {
@@ -73,11 +91,15 @@ dependencies {
        exclude group: 'org.bouncycastle', module: 'bcprov-jdk15on'
        exclude group: 'com.google.code.gson', module: 'gson'
    }
+    // CVE-2022-25647: Explicit gson 2.8.9 to prevent unsafe deserialization (tabula would pull 2.8.7)
+    implementation 'com.google.code.gson:gson:2.8.9'
    implementation 'org.apache.pdfbox:jbig2-imageio:3.0.4'
    implementation 'com.opencsv:opencsv:5.12.0' // https://mvnrepository.com/artifact/com.opencsv/opencsv
+    implementation 'org.apache.poi:poi-ooxml:5.5.1'

-    // Batik
-    implementation 'org.apache.xmlgraphics:batik-all:1.19'
+    // Batik only bridge module needed (transitively pulls anim, gvt, util, css, dom, svg-dom)
+    // Replaces batik-all which included unused codec, svggen, transcoder, script modules
+    implementation 'org.apache.xmlgraphics:batik-bridge:1.19'

    // PDFBox Graphics2D bridge for Batik SVG to PDF conversion
    implementation 'de.rototor.pdfbox:graphics2d:3.0.5'
@@ -168,6 +190,7 @@ def generatedFrontendPaths = [
 ]

 tasks.register('npmInstall', Exec) {
+    doNotTrackState("node_modules contains symlinks that Gradle cannot snapshot on Windows/WSL")
    enabled = buildWithFrontend
    group = 'frontend'
    description = 'Install frontend dependencies'
@@ -214,6 +237,7 @@ tasks.register('npmInstall', Exec) {
 }

 tasks.register('npmBuild', Exec) {
+    doNotTrackState("Frontend build depends on untracked npmInstall task")
    enabled = buildWithFrontend
    group = 'frontend'
    description = 'Build frontend application'
@@ -49,8 +49,8 @@ public class LibreOfficeListener {
        process = SystemCommand.runCommand(Runtime.getRuntime(), "unoconv --listener");
        lastActivityTime = System.currentTimeMillis();

-        // Start a background thread to monitor the activity timeout
-        executorService = Executors.newSingleThreadExecutor();
+        // Start a virtual thread to monitor the activity timeout
+        executorService = Executors.newVirtualThreadPerTaskExecutor();
        executorService.submit(
                () -> {
                    while (true) {
@@ -9,10 +9,11 @@ import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Properties;
+import java.util.regex.Pattern;

 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
-import org.springframework.boot.web.context.WebServerInitializedEvent;
+import org.springframework.boot.context.event.ApplicationReadyEvent;
 import org.springframework.context.event.EventListener;
 import org.springframework.core.env.Environment;
 import org.springframework.scheduling.annotation.EnableScheduling;
@@ -38,6 +39,10 @@ import stirling.software.common.model.ApplicationProperties;
        })
 public class SPDFApplication {

+    private static final Pattern PORT_SUFFIX_PATTERN = Pattern.compile(".+:\\d+$");
+    private static final Pattern URL_SCHEME_PATTERN =
+            Pattern.compile("^[a-zA-Z][a-zA-Z0-9+.-]*://.*");
+    private static final Pattern TRAILING_SLASH_PATTERN = Pattern.compile("/+$");
    private static String serverPortStatic;
    private static String baseUrlStatic;
    private static String contextPathStatic;
@@ -171,11 +176,14 @@ public class SPDFApplication {
    }

    @EventListener
-    public void onWebServerInitialized(WebServerInitializedEvent event) {
-        int actualPort = event.getWebServer().getPort();
-        serverPortStatic = String.valueOf(actualPort);
+    public void onApplicationReady(ApplicationReadyEvent event) {
+        String port =
+                event.getApplicationContext().getEnvironment().getProperty("local.server.port");
+        if (port != null) {
+            serverPortStatic = port;
+        }
        // Log the actual runtime port for Tauri to parse
-        log.info("Stirling-PDF running on port: {}", actualPort);
+        log.info("Stirling-PDF running on port: {}", serverPortStatic);
    }

    private static void printStartupLogs() {
@@ -244,8 +252,8 @@ public class SPDFApplication {
        String trimmedBase =
                (backendUrl == null || backendUrl.isBlank())
                        ? "http://localhost"
-                        : backendUrl.trim().replaceAll("/+$", "");
-        boolean hasScheme = trimmedBase.matches("^[a-zA-Z][a-zA-Z0-9+.-]*://.*");
+                        : TRAILING_SLASH_PATTERN.matcher(backendUrl.trim()).replaceAll("");
+        boolean hasScheme = URL_SCHEME_PATTERN.matcher(trimmedBase).matches();
        String baseForParsing = hasScheme ? trimmedBase : "http://" + trimmedBase;
        Integer parsedPort = parsePort(port);

@@ -298,7 +306,7 @@ public class SPDFApplication {
        if (port == null) {
            return trimmedBase;
        }
-        if (trimmedBase.matches(".+:\\d+$")) {
+        if (PORT_SUFFIX_PATTERN.matcher(trimmedBase).matches()) {
            return trimmedBase;
        }
        return trimmedBase + ":" + port;
@@ -51,9 +51,7 @@ public class ExternalAppDepConfig {
     */
    private final Map<String, List<String>> commandToGroupMapping;

-    private final ExecutorService pool =
-            Executors.newFixedThreadPool(
-                    Math.max(2, Runtime.getRuntime().availableProcessors() / 2));
+    private final ExecutorService pool = Executors.newVirtualThreadPerTaskExecutor();

    public ExternalAppDepConfig(
            EndpointConfiguration endpointConfiguration, RuntimePathConfig runtimePathConfig) {
@@ -0,0 +1,79 @@
+package stirling.software.SPDF.config;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.servlet.MultipartConfigFactory;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.DependsOn;
+import org.springframework.util.unit.DataSize;
+
+import jakarta.servlet.MultipartConfigElement;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.controller.web.UploadLimitService;
+
+/**
+ * Configuration for Spring multipart file upload settings. Synchronizes multipart limits with
+ * fileUploadLimit from settings.yml or environment variables (SYSTEMFILEUPLOADLIMIT or
+ * SYSTEM_MAXFILESIZE).
+ */
+@Configuration
+@Slf4j
+public class MultipartConfiguration {
+
+    @Autowired private UploadLimitService uploadLimitService;
+
+    /**
+     * Creates MultipartConfigElement that respects fileUploadLimit from settings.yml or environment
+     * variables (SYSTEMFILEUPLOADLIMIT or SYSTEM_MAXFILESIZE). Depends on ApplicationProperties
+     * being initialized so @PostConstruct has run.
+     */
+    @Bean
+    @DependsOn("applicationProperties")
+    public MultipartConfigElement multipartConfigElement() {
+        MultipartConfigFactory factory = new MultipartConfigFactory();
+
+        // First check if SPRING_SERVLET_MULTIPART_MAX_FILE_SIZE is explicitly set
+        String springMaxFileSize =
+                java.lang.System.getenv("SPRING_SERVLET_MULTIPART_MAX_FILE_SIZE");
+        long uploadLimitBytes = 0;
+
+        if (springMaxFileSize != null && !springMaxFileSize.trim().isEmpty()) {
+            // Parse the Spring property format (e.g., "2000MB")
+            try {
+                DataSize dataSize = DataSize.parse(springMaxFileSize.trim());
+                uploadLimitBytes = dataSize.toBytes();
+                log.info("Using SPRING_SERVLET_MULTIPART_MAX_FILE_SIZE: {}", springMaxFileSize);
+            } catch (Exception e) {
+                log.warn(
+                        "Failed to parse SPRING_SERVLET_MULTIPART_MAX_FILE_SIZE: {}",
+                        springMaxFileSize,
+                        e);
+            }
+        }
+
+        // If not set via Spring property, use UploadLimitService which reads from
+        // fileUploadLimit (set from SYSTEMFILEUPLOADLIMIT/SYSTEM_MAXFILESIZE or settings.yml)
+        if (uploadLimitBytes == 0) {
+            uploadLimitBytes = uploadLimitService.getUploadLimit();
+            if (uploadLimitBytes > 0) {
+                log.info(
+                        "Using fileUploadLimit setting: {}",
+                        uploadLimitService.getReadableUploadLimit());
+            }
+        }
+
+        // If still no limit, use default of 2000MB
+        if (uploadLimitBytes == 0) {
+            uploadLimitBytes = 2000L * 1024 * 1024; // 2000MB default
+            log.info("Using default multipart file upload limit: 2000MB");
+        }
+
+        // Set max file size and max request size to the same value
+        factory.setMaxFileSize(DataSize.ofBytes(uploadLimitBytes));
+        factory.setMaxRequestSize(DataSize.ofBytes(uploadLimitBytes));
+
+        return factory.createMultipartConfig();
+    }
+}
@@ -54,8 +54,8 @@ public class TauriProcessMonitor {
        scheduler =
                Executors.newSingleThreadScheduledExecutor(
                        r -> {
-                            Thread t = new Thread(r, "tauri-process-monitor");
-                            t.setDaemon(true);
+                            Thread t =
+                                    Thread.ofVirtual().name("tauri-process-monitor").unstarted(r);
                            return t;
                        });

@@ -82,6 +82,9 @@ public class WebMvcConfig implements WebMvcConfigurer {
            logger.info("Tauri mode detected - enabling CORS for Tauri protocols (v1 and v2)");
            registry.addMapping("/**")
                    .allowedOriginPatterns(
+                            "http://localhost:*",
+                            "https://localhost:*",
+                            "tauri://*", // Add this for Tauri apps
                            "tauri://localhost",
                            "http://tauri.localhost",
                            "https://tauri.localhost")
@@ -154,8 +157,8 @@ public class WebMvcConfig implements WebMvcConfigurer {
                    .maxAge(3600);
        } else {
            // Default to allowing all origins when nothing is configured
-            logger.info(
-                    "No CORS allowed origins configured in settings.yml (system.corsAllowedOrigins); allowing all origins.");
+            logger.debug(
+                    "No CORS allowed origins configured in settings.yml (system.corsAllowedOrigins); WebMvcConfig allowing all origins.");
            registry.addMapping("/**")
                    .allowedOriginPatterns("*")
                    .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")
@@ -8,10 +8,12 @@ import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDDocumentInformation;
 import org.apache.pdfbox.pdmodel.PDPage;
 import org.apache.pdfbox.pdmodel.PDPageTree;
+import org.apache.pdfbox.pdmodel.PDResources;
 import org.apache.pdfbox.pdmodel.encryption.PDEncryption;
 import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotation;
 import org.apache.pdfbox.pdmodel.interactive.form.PDAcroForm;
 import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.*;

 import io.swagger.v3.oas.annotations.Operation;
@@ -35,9 +37,9 @@ public class AnalysisController {
    @Operation(
            summary = "Get PDF page count",
            description = "Returns total number of pages in PDF. Input:PDF Output:JSON Type:SISO")
-    public Map<String, Integer> getPageCount(@ModelAttribute PDFFile file) throws IOException {
+    public ResponseEntity<?> getPageCount(@ModelAttribute PDFFile file) throws IOException {
        try (PDDocument document = pdfDocumentFactory.load(file.getFileInput())) {
-            return Map.of("pageCount", document.getNumberOfPages());
+            return ResponseEntity.ok(Map.of("pageCount", document.getNumberOfPages()));
        }
    }

@@ -46,13 +48,13 @@ public class AnalysisController {
    @Operation(
            summary = "Get basic PDF information",
            description = "Returns page count, version, file size. Input:PDF Output:JSON Type:SISO")
-    public Map<String, Object> getBasicInfo(@ModelAttribute PDFFile file) throws IOException {
+    public ResponseEntity<?> getBasicInfo(@ModelAttribute PDFFile file) throws IOException {
        try (PDDocument document = pdfDocumentFactory.load(file.getFileInput())) {
            Map<String, Object> info = new HashMap<>();
            info.put("pageCount", document.getNumberOfPages());
            info.put("pdfVersion", document.getVersion());
            info.put("fileSize", file.getFileInput().getSize());
-            return info;
+            return ResponseEntity.ok(info);
        }
    }

@@ -63,7 +65,7 @@ public class AnalysisController {
    @Operation(
            summary = "Get PDF document properties",
            description = "Returns title, author, subject, etc. Input:PDF Output:JSON Type:SISO")
-    public Map<String, String> getDocumentProperties(@ModelAttribute PDFFile file)
+    public ResponseEntity<?> getDocumentProperties(@ModelAttribute PDFFile file)
            throws IOException {
        // Load the document in read-only mode to prevent modifications and ensure the integrity of
        // the original file.
@@ -76,9 +78,15 @@ public class AnalysisController {
            properties.put("keywords", info.getKeywords());
            properties.put("creator", info.getCreator());
            properties.put("producer", info.getProducer());
-            properties.put("creationDate", info.getCreationDate().toString());
-            properties.put("modificationDate", info.getModificationDate().toString());
-            return properties;
+            properties.put(
+                    "creationDate",
+                    info.getCreationDate() != null ? info.getCreationDate().toString() : null);
+            properties.put(
+                    "modificationDate",
+                    info.getModificationDate() != null
+                            ? info.getModificationDate().toString()
+                            : null);
+            return ResponseEntity.ok(properties);
        }
    }

@@ -87,8 +95,7 @@ public class AnalysisController {
    @Operation(
            summary = "Get page dimensions for all pages",
            description = "Returns width and height of each page. Input:PDF Output:JSON Type:SISO")
-    public List<Map<String, Float>> getPageDimensions(@ModelAttribute PDFFile file)
-            throws IOException {
+    public ResponseEntity<?> getPageDimensions(@ModelAttribute PDFFile file) throws IOException {
        try (PDDocument document = pdfDocumentFactory.load(file.getFileInput())) {
            List<Map<String, Float>> dimensions = new ArrayList<>();
            PDPageTree pages = document.getPages();
@@ -99,7 +106,7 @@ public class AnalysisController {
                pageDim.put("height", page.getBBox().getHeight());
                dimensions.add(pageDim);
            }
-            return dimensions;
+            return ResponseEntity.ok(dimensions);
        }
    }

@@ -109,7 +116,7 @@ public class AnalysisController {
            summary = "Get form field information",
            description =
                    "Returns count and details of form fields. Input:PDF Output:JSON Type:SISO")
-    public Map<String, Object> getFormFields(@ModelAttribute PDFFile file) throws IOException {
+    public ResponseEntity<?> getFormFields(@ModelAttribute PDFFile file) throws IOException {
        try (PDDocument document = pdfDocumentFactory.load(file.getFileInput())) {
            Map<String, Object> formInfo = new HashMap<>();
            PDAcroForm form = document.getDocumentCatalog().getAcroForm();
@@ -123,7 +130,7 @@ public class AnalysisController {
                formInfo.put("hasXFA", false);
                formInfo.put("isSignaturesExist", false);
            }
-            return formInfo;
+            return ResponseEntity.ok(formInfo);
        }
    }

@@ -132,7 +139,7 @@ public class AnalysisController {
    @Operation(
            summary = "Get annotation information",
            description = "Returns count and types of annotations. Input:PDF Output:JSON Type:SISO")
-    public Map<String, Object> getAnnotationInfo(@ModelAttribute PDFFile file) throws IOException {
+    public ResponseEntity<?> getAnnotationInfo(@ModelAttribute PDFFile file) throws IOException {
        try (PDDocument document = pdfDocumentFactory.load(file.getFileInput())) {
            Map<String, Object> annotInfo = new HashMap<>();
            int totalAnnotations = 0;
@@ -148,7 +155,7 @@ public class AnalysisController {

            annotInfo.put("totalCount", totalAnnotations);
            annotInfo.put("typeBreakdown", annotationTypes);
-            return annotInfo;
+            return ResponseEntity.ok(annotInfo);
        }
    }

@@ -158,20 +165,23 @@ public class AnalysisController {
            summary = "Get font information",
            description =
                    "Returns list of fonts used in the document. Input:PDF Output:JSON Type:SISO")
-    public Map<String, Object> getFontInfo(@ModelAttribute PDFFile file) throws IOException {
+    public ResponseEntity<?> getFontInfo(@ModelAttribute PDFFile file) throws IOException {
        try (PDDocument document = pdfDocumentFactory.load(file.getFileInput())) {
            Map<String, Object> fontInfo = new HashMap<>();
            Set<String> fontNames = new HashSet<>();

            for (PDPage page : document.getPages()) {
-                for (COSName font : page.getResources().getFontNames()) {
-                    fontNames.add(font.getName());
+                PDResources resources = page.getResources();
+                if (resources != null) {
+                    for (COSName font : resources.getFontNames()) {
+                        fontNames.add(font.getName());
+                    }
                }
            }

            fontInfo.put("fontCount", fontNames.size());
            fontInfo.put("fonts", fontNames);
-            return fontInfo;
+            return ResponseEntity.ok(fontInfo);
        }
    }

@@ -181,7 +191,7 @@ public class AnalysisController {
            summary = "Get security information",
            description =
                    "Returns encryption and permission details. Input:PDF Output:JSON Type:SISO")
-    public Map<String, Object> getSecurityInfo(@ModelAttribute PDFFile file) throws IOException {
+    public ResponseEntity<?> getSecurityInfo(@ModelAttribute PDFFile file) throws IOException {
        try (PDDocument document = pdfDocumentFactory.load(file.getFileInput())) {
            Map<String, Object> securityInfo = new HashMap<>();
            PDEncryption encryption = document.getEncryption();
@@ -208,7 +218,7 @@ public class AnalysisController {
                securityInfo.put("isEncrypted", false);
            }

-            return securityInfo;
+            return ResponseEntity.ok(securityInfo);
        }
    }
 }
@@ -15,9 +15,6 @@ import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.multipart.MultipartFile;

-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import io.swagger.v3.oas.annotations.Operation;

 import lombok.Getter;
@@ -32,6 +29,9 @@ import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.WebResponseUtils;

+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.ObjectMapper;
+
@GeneralApi
@Slf4j
@RequiredArgsConstructor
@@ -46,18 +46,18 @@ public class EditTableOfContentsController {
    @Operation(
            summary = "Extract PDF Bookmarks",
            description = "Extracts bookmarks/table of contents from a PDF document as JSON.")
-    @ResponseBody
-    public List<Map<String, Object>> extractBookmarks(@RequestParam("file") MultipartFile file)
-            throws Exception {
+    public ResponseEntity<List<Map<String, Object>>> extractBookmarks(
+            @RequestParam("file") MultipartFile file) throws Exception {
        try (PDDocument document = pdfDocumentFactory.load(file)) {
            PDDocumentOutline outline = document.getDocumentCatalog().getDocumentOutline();

            if (outline == null) {
                log.info("No outline/bookmarks found in PDF");
-                return new ArrayList<>();
+                return ResponseEntity.ok(new ArrayList<>());
            }

-            return extractBookmarkItems(document, outline);
+            List<Map<String, Object>> bookmarks = extractBookmarkItems(document, outline);
+            return ResponseEntity.ok(bookmarks);
        }
    }

@@ -8,6 +8,7 @@ import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Comparator;
 import java.util.List;
+import java.util.regex.Pattern;

 import org.apache.pdfbox.multipdf.PDFMergerUtility;
 import org.apache.pdfbox.pdmodel.PDDocument;
@@ -51,6 +52,7 @@ import stirling.software.common.util.WebResponseUtils;
@RequiredArgsConstructor
 public class MergeController {

+    private static final Pattern QUOTE_WRAP_PATTERN = Pattern.compile("^\"|\"$");
    private final CustomPDFDocumentFactory pdfDocumentFactory;
    private final TempFileManager tempFileManager;

@@ -173,7 +175,7 @@ public class MergeController {
                String[] parts = inside.split(",");
                String[] result = new String[parts.length];
                for (int i = 0; i < parts.length; i++) {
-                    result[i] = parts[i].trim().replaceAll("^\"|\"$", "");
+                    result[i] = QUOTE_WRAP_PATTERN.matcher(parts[i].trim()).replaceAll("");
                }
                return result;
            }
@@ -397,7 +399,12 @@ public class MergeController {
        String mergedFileName =
                GeneralUtils.generateFilename(firstFilename, "_merged_unsigned.pdf");

-        byte[] pdfBytes = Files.readAllBytes(outputTempFile.getPath());
+        byte[] pdfBytes;
+        try {
+            pdfBytes = Files.readAllBytes(outputTempFile.getPath());
+        } finally {
+            outputTempFile.close();
+        }
        return WebResponseUtils.bytesToWebResponse(pdfBytes, mergedFileName);
    }
 }
@@ -194,7 +194,7 @@ public class PdfOverlayController {
            // Load the overlay document to check its page count
            try (PDDocument overlayPdf = Loader.loadPDF(overlayFile)) {
                int overlayPageCount = overlayPdf.getNumberOfPages();
-                for (int j = 0; j < repeatCount; j++) {
+                for (int j = 0; j < repeatCount && currentPage <= basePageCount; j++) {
                    for (int page = 0; page < overlayPageCount; page++) {
                        if (currentPage > basePageCount) break;
                        overlayGuide.put(currentPage++, overlayFile.getAbsolutePath());
@@ -0,0 +1,271 @@
+package stirling.software.SPDF.controller.api;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipOutputStream;
+
+import org.apache.pdfbox.multipdf.LayerUtility;
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.pdmodel.PDPageContentStream;
+import org.apache.pdfbox.pdmodel.common.PDRectangle;
+import org.apache.pdfbox.pdmodel.graphics.form.PDFormXObject;
+import org.apache.pdfbox.util.Matrix;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.ModelAttribute;
+import org.springframework.web.multipart.MultipartFile;
+
+import io.swagger.v3.oas.annotations.Operation;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.config.swagger.MultiFileResponse;
+import stirling.software.SPDF.model.api.general.PosterPdfRequest;
+import stirling.software.common.annotations.AutoJobPostMapping;
+import stirling.software.common.annotations.api.GeneralApi;
+import stirling.software.common.service.CustomPDFDocumentFactory;
+import stirling.software.common.util.ExceptionUtils;
+import stirling.software.common.util.GeneralUtils;
+import stirling.software.common.util.WebResponseUtils;
+
+@GeneralApi
+@Slf4j
+@RequiredArgsConstructor
+public class PosterPdfController {
+
+    private final CustomPDFDocumentFactory pdfDocumentFactory;
+
+    @AutoJobPostMapping(
+            value = "/split-for-poster-print",
+            consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @MultiFileResponse
+    @Operation(
+            summary = "Split large PDF pages into smaller printable chunks",
+            description =
+                    "This endpoint splits large or oddly-sized PDF pages into smaller chunks "
+                            + "suitable for printing on standard paper sizes (e.g., A4, Letter). "
+                            + "Divides each page into a grid of smaller pages using Apache PDFBox. "
+                            + "Input: PDF Output: ZIP-PDF Type: SISO")
+    public ResponseEntity<byte[]> posterPdf(@ModelAttribute PosterPdfRequest request)
+            throws Exception {
+
+        log.debug("Starting PDF poster split process with request: {}", request);
+        MultipartFile file = request.getFileInput();
+
+        String filename = GeneralUtils.generateFilename(file.getOriginalFilename(), "");
+        log.debug("Base filename for output: {}", filename);
+
+        try (PDDocument sourceDocument = pdfDocumentFactory.load(file);
+                PDDocument outputDocument =
+                        pdfDocumentFactory.createNewDocumentBasedOnOldDocument(sourceDocument);
+                ByteArrayOutputStream pdfOutputStream = new ByteArrayOutputStream();
+                ByteArrayOutputStream zipOutputStream = new ByteArrayOutputStream()) {
+
+            // Get target page size
+            PDRectangle targetPageSize = getTargetPageSize(request.getPageSize());
+            log.debug(
+                    "Target page size: {} ({}x{})",
+                    request.getPageSize(),
+                    targetPageSize.getWidth(),
+                    targetPageSize.getHeight());
+
+            // Create LayerUtility for importing pages as forms
+            LayerUtility layerUtility = new LayerUtility(outputDocument);
+
+            int totalPages = sourceDocument.getNumberOfPages();
+            int xFactor = request.getXFactor();
+            int yFactor = request.getYFactor();
+            boolean rightToLeft = request.isRightToLeft();
+
+            log.debug(
+                    "Processing {} pages with grid {}x{}, RTL={}",
+                    totalPages,
+                    xFactor,
+                    yFactor,
+                    rightToLeft);
+
+            // Process each page
+            for (int pageIndex = 0; pageIndex < totalPages; pageIndex++) {
+                PDPage sourcePage = sourceDocument.getPage(pageIndex);
+
+                // Get both MediaBox and CropBox
+                PDRectangle mediaBox = sourcePage.getMediaBox();
+                PDRectangle cropBox = sourcePage.getCropBox();
+
+                // If no CropBox is set, use MediaBox
+                if (cropBox == null) {
+                    cropBox = mediaBox;
+                }
+
+                // Save original boxes for restoration
+                PDRectangle originalMediaBox = sourcePage.getMediaBox();
+                PDRectangle originalCropBox = sourcePage.getCropBox();
+
+                // Normalize the page: set MediaBox to CropBox
+                // This ensures the form's coordinate space starts at (0, 0)
+                // instead of having an offset from the original MediaBox
+                sourcePage.setMediaBox(cropBox);
+                sourcePage.setCropBox(cropBox);
+
+                // Handle page rotation
+                int rotation = sourcePage.getRotation();
+                float sourceWidth = cropBox.getWidth();
+                float sourceHeight = cropBox.getHeight();
+
+                // Swap dimensions if rotated 90 or 270 degrees
+                if (rotation == 90 || rotation == 270) {
+                    float temp = sourceWidth;
+                    sourceWidth = sourceHeight;
+                    sourceHeight = temp;
+                }
+
+                log.debug(
+                        "Page {}: Normalized to CropBox dimensions {}x{}, rotation {}",
+                        pageIndex,
+                        sourceWidth,
+                        sourceHeight,
+                        rotation);
+
+                // Import source page as form (now with normalized coordinate space)
+                PDFormXObject form = layerUtility.importPageAsForm(sourceDocument, pageIndex);
+
+                // Restore original boxes
+                sourcePage.setMediaBox(originalMediaBox);
+                sourcePage.setCropBox(originalCropBox);
+
+                // Calculate cell dimensions in source page coordinates
+                float cellWidth = sourceWidth / xFactor;
+                float cellHeight = sourceHeight / yFactor;
+
+                // Create grid cells (rows × columns)
+                for (int row = 0; row < yFactor; row++) {
+                    for (int col = 0; col < xFactor; col++) {
+                        // Apply RTL ordering for columns if enabled
+                        int actualCol = rightToLeft ? (xFactor - 1 - col) : col;
+
+                        // Calculate crop rectangle in source coordinates
+                        // PDF coordinates start at bottom-left
+                        float cropX = actualCol * cellWidth;
+                        // For Y: invert so row 0 shows TOP (following SplitPdfBySectionsController
+                        // pattern)
+                        float cropY = (yFactor - 1 - row) * cellHeight;
+
+                        // Create new output page with target size
+                        PDPage outputPage = new PDPage(targetPageSize);
+                        outputDocument.addPage(outputPage);
+
+                        try (PDPageContentStream contentStream =
+                                new PDPageContentStream(
+                                        outputDocument,
+                                        outputPage,
+                                        PDPageContentStream.AppendMode.APPEND,
+                                        true,
+                                        true)) {
+
+                            // Calculate uniform scale to fit cell into target page
+                            // Scale UP if cell is smaller than target, scale DOWN if larger
+                            float scaleX = targetPageSize.getWidth() / cellWidth;
+                            float scaleY = targetPageSize.getHeight() / cellHeight;
+                            float scale = Math.min(scaleX, scaleY);
+
+                            // Center the scaled content on the target page
+                            float scaledCellWidth = cellWidth * scale;
+                            float scaledCellHeight = cellHeight * scale;
+                            float offsetX = (targetPageSize.getWidth() - scaledCellWidth) / 2;
+                            float offsetY = (targetPageSize.getHeight() - scaledCellHeight) / 2;
+
+                            // Apply transformations
+                            contentStream.saveGraphicsState();
+
+                            // Translate to center position
+                            contentStream.transform(Matrix.getTranslateInstance(offsetX, offsetY));
+
+                            // Scale uniformly
+                            contentStream.transform(Matrix.getScaleInstance(scale, scale));
+
+                            // Translate to show only the desired grid cell
+                            // IMPORTANT: The PDFormXObject's BBox already matches the CropBox
+                            // (including its offset), so we only need to translate by cropX/cropY
+                            // relative to the CropBox origin, NOT the MediaBox origin
+                            contentStream.transform(Matrix.getTranslateInstance(-cropX, -cropY));
+
+                            // Draw the form
+                            contentStream.drawForm(form);
+
+                            contentStream.restoreGraphicsState();
+                        }
+
+                        log.trace(
+                                "Created output page for grid cell [{},{}] of page {}: cropX={}, cropY={}, translate=({}, {})",
+                                row,
+                                actualCol,
+                                pageIndex,
+                                cropX,
+                                cropY,
+                                -cropX,
+                                -cropY);
+                    }
+                }
+            }
+
+            // Save output PDF
+            outputDocument.save(pdfOutputStream);
+            byte[] pdfData = pdfOutputStream.toByteArray();
+
+            log.debug(
+                    "Generated output PDF with {} pages ({} bytes)",
+                    outputDocument.getNumberOfPages(),
+                    pdfData.length);
+
+            // Create ZIP file with the result
+            try (ZipOutputStream zipOut = new ZipOutputStream(zipOutputStream)) {
+                ZipEntry zipEntry = new ZipEntry(filename + "_poster.pdf");
+                zipOut.putNextEntry(zipEntry);
+                zipOut.write(pdfData);
+                zipOut.closeEntry();
+            }
+
+            byte[] zipData = zipOutputStream.toByteArray();
+            log.debug("Successfully created ZIP with {} bytes", zipData.length);
+
+            return WebResponseUtils.bytesToWebResponse(
+                    zipData, filename + "_poster.zip", MediaType.APPLICATION_OCTET_STREAM);
+
+        } catch (IOException e) {
+            ExceptionUtils.logException("PDF poster split process", e);
+            throw e;
+        }
+    }
+
+    /**
+     * Maps page size string to PDRectangle.
+     *
+     * @param pageSize the page size name (e.g., "A4", "Letter")
+     * @return the corresponding PDRectangle
+     * @throws IllegalArgumentException if page size is not supported
+     */
+    private PDRectangle getTargetPageSize(String pageSize) {
+        Map<String, PDRectangle> sizeMap = new HashMap<>();
+        sizeMap.put("A4", PDRectangle.A4);
+        sizeMap.put("Letter", PDRectangle.LETTER);
+        sizeMap.put("A3", PDRectangle.A3);
+        sizeMap.put("A5", PDRectangle.A5);
+        sizeMap.put("Legal", PDRectangle.LEGAL);
+        sizeMap.put("Tabloid", new PDRectangle(792, 1224)); // 11x17 inches
+
+        PDRectangle size = sizeMap.get(pageSize);
+        if (size == null) {
+            throw ExceptionUtils.createIllegalArgumentException(
+                    "error.invalidPageSize",
+                    "Invalid page size: {0}",
+                    pageSize,
+                    String.join(", ", sizeMap.keySet()));
+        }
+        return size;
+    }
+}
@@ -191,6 +191,14 @@ public class RearrangePagesPDFController {
        if (duplicateCount < 1) {
            duplicateCount = 2; // Default to 2 if invalid input
        }
+        int maxDuplicateCount = Math.max(100, totalPages * 3);
+        if (duplicateCount > maxDuplicateCount) {
+            throw ExceptionUtils.createIllegalArgumentException(
+                    "error.invalidFormat",
+                    "Invalid {0} format: {1}",
+                    "duplicateCount",
+                    "must not exceed " + maxDuplicateCount);
+        }

        // For each page in the document
        for (int pageNum = 0; pageNum < totalPages; pageNum++) {
@@ -23,6 +23,8 @@ import org.springframework.web.multipart.MultipartFile;

 import io.swagger.v3.oas.annotations.Operation;

+import jakarta.validation.Valid;
+
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;

@@ -57,7 +59,7 @@ public class SplitPdfBySectionsController {
                            + " which page to split, and how to split"
                            + " ( halves, thirds, quarters, etc.), both vertically and horizontally."
                            + " Input:PDF Output:ZIP-PDF Type:SISO")
-    public ResponseEntity<byte[]> splitPdf(@ModelAttribute SplitPdfBySectionsRequest request)
+    public ResponseEntity<byte[]> splitPdf(@Valid @ModelAttribute SplitPdfBySectionsRequest request)
            throws Exception {
        MultipartFile file = request.getFileInput();
        String pageNumbers = request.getPageNumbers();
@@ -101,66 +103,68 @@ public class SplitPdfBySectionsController {
                    return WebResponseUtils.baosToWebResponse(baos, filename + ".pdf");
                }
            } else {
-                TempFile zipTempFile = new TempFile(tempFileManager, ".zip");
-                try (ZipOutputStream zipOut =
-                        new ZipOutputStream(Files.newOutputStream(zipTempFile.getPath()))) {
-                    for (int pageIndex = 0;
-                            pageIndex < sourceDocument.getNumberOfPages();
-                            pageIndex++) {
-                        int pageNum = pageIndex + 1;
-                        if (pagesToSplit.contains(pageIndex)) {
-                            for (int i = 0; i < horiz; i++) {
-                                for (int j = 0; j < verti; j++) {
-                                    try (PDDocument subDoc =
-                                            pdfDocumentFactory.createNewDocument()) {
-                                        LayerUtility subLayerUtility = new LayerUtility(subDoc);
-                                        addSingleSectionToTarget(
-                                                sourceDocument,
-                                                pageIndex,
-                                                subDoc,
-                                                subLayerUtility,
-                                                i,
-                                                j,
-                                                horiz,
-                                                verti);
-                                        int sectionNum = i * verti + j + 1;
-                                        String entryName =
-                                                filename
-                                                        + "_"
-                                                        + pageNum
-                                                        + "_"
-                                                        + sectionNum
-                                                        + ".pdf";
-                                        saveDocToZip(subDoc, zipOut, entryName);
-                                    } catch (IOException e) {
-                                        log.error(
-                                                "Error creating section {} for page {}",
-                                                (i * verti + j + 1),
-                                                pageNum,
-                                                e);
-                                        throw e;
+                try (TempFile zipTempFile = new TempFile(tempFileManager, ".zip")) {
+                    try (ZipOutputStream zipOut =
+                            new ZipOutputStream(Files.newOutputStream(zipTempFile.getPath()))) {
+                        for (int pageIndex = 0;
+                                pageIndex < sourceDocument.getNumberOfPages();
+                                pageIndex++) {
+                            int pageNum = pageIndex + 1;
+                            if (pagesToSplit.contains(pageIndex)) {
+                                for (int i = 0; i < horiz; i++) {
+                                    for (int j = 0; j < verti; j++) {
+                                        try (PDDocument subDoc =
+                                                pdfDocumentFactory.createNewDocument()) {
+                                            LayerUtility subLayerUtility = new LayerUtility(subDoc);
+                                            addSingleSectionToTarget(
+                                                    sourceDocument,
+                                                    pageIndex,
+                                                    subDoc,
+                                                    subLayerUtility,
+                                                    i,
+                                                    j,
+                                                    horiz,
+                                                    verti);
+                                            int sectionNum = i * verti + j + 1;
+                                            String entryName =
+                                                    filename
+                                                            + "_"
+                                                            + pageNum
+                                                            + "_"
+                                                            + sectionNum
+                                                            + ".pdf";
+                                            saveDocToZip(subDoc, zipOut, entryName);
+                                        } catch (IOException e) {
+                                            log.error(
+                                                    "Error creating section {} for page {}",
+                                                    (i * verti + j + 1),
+                                                    pageNum,
+                                                    e);
+                                            throw e;
+                                        }
                                    }
                                }
-                            }
-                        } else {
-                            try (PDDocument subDoc = pdfDocumentFactory.createNewDocument()) {
-                                LayerUtility subLayerUtility = new LayerUtility(subDoc);
-                                addPageToTarget(sourceDocument, pageIndex, subDoc, subLayerUtility);
-                                String entryName = filename + "_" + pageNum + "_1.pdf";
-                                saveDocToZip(subDoc, zipOut, entryName);
-                            } catch (IOException e) {
-                                log.error("Error processing unsplit page {}", pageNum, e);
-                                throw e;
+                            } else {
+                                try (PDDocument subDoc = pdfDocumentFactory.createNewDocument()) {
+                                    LayerUtility subLayerUtility = new LayerUtility(subDoc);
+                                    addPageToTarget(
+                                            sourceDocument, pageIndex, subDoc, subLayerUtility);
+                                    String entryName = filename + "_" + pageNum + "_1.pdf";
+                                    saveDocToZip(subDoc, zipOut, entryName);
+                                } catch (IOException e) {
+                                    log.error("Error processing unsplit page {}", pageNum, e);
+                                    throw e;
+                                }
                            }
                        }
+                    } catch (IOException e) {
+                        log.error("Error creating ZIP file with split PDF sections", e);
+                        throw e;
                    }
-                } catch (IOException e) {
-                    log.error("Error creating ZIP file with split PDF sections", e);
-                    throw e;
+                    byte[] zipBytes = Files.readAllBytes(zipTempFile.getPath());
+                    return WebResponseUtils.bytesToWebResponse(
+                            zipBytes, filename + ".zip", MediaType.APPLICATION_OCTET_STREAM);
                }
-                byte[] zipBytes = Files.readAllBytes(zipTempFile.getPath());
-                return WebResponseUtils.bytesToWebResponse(
-                        zipBytes, filename + ".zip", MediaType.APPLICATION_OCTET_STREAM);
            }
        } catch (Exception e) {
            log.error("Error splitting PDF file: {}", file.getOriginalFilename(), e);
@@ -16,9 +16,6 @@ import org.springframework.core.io.ResourceLoader;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.GetMapping;

-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import io.swagger.v3.oas.annotations.Operation;

 import lombok.Data;
@@ -35,6 +32,9 @@ import stirling.software.common.service.UserServiceInterface;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;

+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.ObjectMapper;
+
@Slf4j
@UiDataApi
 public class UIDataController {
@@ -44,18 +44,21 @@ public class UIDataController {
    private final UserServiceInterface userService;
    private final ResourceLoader resourceLoader;
    private final RuntimePathConfig runtimePathConfig;
+    private final ObjectMapper objectMapper;

    public UIDataController(
            ApplicationProperties applicationProperties,
            SharedSignatureService signatureService,
            @Autowired(required = false) UserServiceInterface userService,
            ResourceLoader resourceLoader,
-            RuntimePathConfig runtimePathConfig) {
+            RuntimePathConfig runtimePathConfig,
+            ObjectMapper objectMapper) {
        this.applicationProperties = applicationProperties;
        this.signatureService = signatureService;
        this.userService = userService;
        this.resourceLoader = resourceLoader;
        this.runtimePathConfig = runtimePathConfig;
+        this.objectMapper = objectMapper;
    }

    @GetMapping("/footer-info")
@@ -93,9 +96,8 @@ public class UIDataController {

        try (InputStream is = resource.getInputStream()) {
            String json = new String(is.readAllBytes(), StandardCharsets.UTF_8);
-            ObjectMapper mapper = new ObjectMapper();
            Map<String, List<Dependency>> licenseData =
-                    mapper.readValue(json, new TypeReference<>() {});
+                    objectMapper.readValue(json, new TypeReference<>() {});
            data.setDependencies(licenseData.get("dependencies"));
        } catch (IOException e) {
            log.error("Failed to load licenses data", e);
@@ -127,8 +129,8 @@ public class UIDataController {

                for (String config : pipelineConfigs) {
                    Map<String, Object> jsonContent =
-                            new ObjectMapper()
-                                    .readValue(config, new TypeReference<Map<String, Object>>() {});
+                            objectMapper.readValue(
+                                    config, new TypeReference<Map<String, Object>>() {});
                    String name = (String) jsonContent.get("name");
                    if (name == null || name.length() < 1) {
                        String filename =
@@ -44,7 +44,7 @@ public class ConvertMarkdownToPdf {
    @Operation(
            summary = "Convert a Markdown file to PDF",
            description =
-                    "This endpoint takes a Markdown file input, converts it to HTML, and then to"
+                    "This endpoint takes a Markdown file or ZIP (containing Markdown + images) input, converts it to HTML, and then to"
                            + " PDF format. Input:MARKDOWN Output:PDF Type:SISO")
    public ResponseEntity<byte[]> markdownToPdf(@ModelAttribute GeneralFile generalFile)
            throws Exception {
@@ -52,40 +52,187 @@ public class ConvertMarkdownToPdf {

        if (fileInput == null) {
            throw ExceptionUtils.createIllegalArgumentException(
-                    "error.fileFormatRequired", "File must be in {0} format", "Markdown");
+                    "error.fileFormatRequired", "File must be in {0} format", "Markdown or ZIP");
        }

        String originalFilename = Filenames.toSimpleFileName(fileInput.getOriginalFilename());
-        if (originalFilename == null || !originalFilename.endsWith(".md")) {
+        if (originalFilename == null) {
            throw ExceptionUtils.createIllegalArgumentException(
-                    "error.fileFormatRequired", "File must be in {0} format", ".md");
+                    "error.fileFormatRequired", "File must be in {0} format", ".md or .zip");
        }

-        // Convert Markdown to HTML using CommonMark
-        List<Extension> extensions = List.of(TablesExtension.create());
-        Parser parser = Parser.builder().extensions(extensions).build();
+        boolean isZip = originalFilename.toLowerCase().endsWith(".zip");
+        boolean isMarkdown = originalFilename.toLowerCase().endsWith(".md");

-        Node document = parser.parse(new String(fileInput.getBytes()));
-        HtmlRenderer renderer =
-                HtmlRenderer.builder()
-                        .attributeProviderFactory(context -> new TableAttributeProvider())
-                        .extensions(extensions)
-                        .build();
+        if (!isZip && !isMarkdown) {
+            throw ExceptionUtils.createIllegalArgumentException(
+                    "error.fileFormatRequired", "File must be in {0} format", ".md or .zip");
+        }

-        String htmlContent = renderer.render(document);
+        byte[] pdfBytes;
+        String outputFilename;
+
+        if (isZip) {
+            // Handle ZIP file containing markdown + images
+            try (TempDirectory tempDir = new TempDirectory(tempFileManager)) {
+                // Extract ZIP to temp directory
+                java.nio.file.Path tempDirPath = tempDir.getPath();
+                try (java.util.zip.ZipInputStream zipIn =
+                        io.github.pixee.security.ZipSecurity.createHardenedInputStream(
+                                new java.io.ByteArrayInputStream(fileInput.getBytes()))) {
+                    java.util.zip.ZipEntry entry;
+                    while ((entry = zipIn.getNextEntry()) != null) {
+                        if (!entry.isDirectory()) {
+                            java.nio.file.Path filePath =
+                                    tempDirPath.resolve(entry.getName()).normalize();
+                            if (!filePath.startsWith(tempDirPath)) {
+                                throw new java.io.IOException(
+                                        "ZIP entry is outside of target directory: "
+                                                + entry.getName());
+                            }
+                            java.nio.file.Files.createDirectories(filePath.getParent());
+                            java.nio.file.Files.copy(zipIn, filePath);
+                        }
+                        zipIn.closeEntry();
+                    }
+                }
+
+                // Find the markdown file (look for .md files, prefer index.md or first one)
+                java.io.File markdownFile = findMarkdownFile(tempDirPath.toFile());
+                if (markdownFile == null) {
+                    throw ExceptionUtils.createIllegalArgumentException(
+                            "error.fileFormatRequired",
+                            "ZIP must contain at least one {0} file",
+                            ".md");
+                }
+
+                // Read and convert markdown to HTML
+                String markdownContent = java.nio.file.Files.readString(markdownFile.toPath());
+                List<Extension> extensions = List.of(TablesExtension.create());
+                Parser parser = Parser.builder().extensions(extensions).build();
+                Node document = parser.parse(markdownContent);
+                HtmlRenderer renderer =
+                        HtmlRenderer.builder()
+                                .attributeProviderFactory(context -> new TableAttributeProvider())
+                                .extensions(extensions)
+                                .build();
+                String htmlContent = renderer.render(document);
+
+                // Create a new ZIP with HTML + images for WeasyPrint
+                byte[] htmlZipBytes = createHtmlZip(htmlContent, tempDirPath.toFile());
+
+                // Use FileToPdf which already supports ZIP files with images
+                pdfBytes =
+                        FileToPdf.convertHtmlToPdf(
+                                runtimePathConfig.getWeasyPrintPath(),
+                                null,
+                                htmlZipBytes,
+                                "package.zip",
+                                tempFileManager,
+                                customHtmlSanitizer);
+
+                outputFilename =
+                        GeneralUtils.generateFilename(
+                                originalFilename.substring(0, originalFilename.lastIndexOf('.')),
+                                ".pdf");
+            }
+        } else {
+            // Handle plain markdown file (no images)
+            List<Extension> extensions = List.of(TablesExtension.create());
+            Parser parser = Parser.builder().extensions(extensions).build();
+
+            Node document = parser.parse(new String(fileInput.getBytes()));
+            HtmlRenderer renderer =
+                    HtmlRenderer.builder()
+                            .attributeProviderFactory(context -> new TableAttributeProvider())
+                            .extensions(extensions)
+                            .build();
+
+            String htmlContent = renderer.render(document);
+
+            pdfBytes =
+                    FileToPdf.convertHtmlToPdf(
+                            runtimePathConfig.getWeasyPrintPath(),
+                            null,
+                            htmlContent.getBytes(),
+                            "converted.html",
+                            tempFileManager,
+                            customHtmlSanitizer);
+
+            outputFilename = GeneralUtils.generateFilename(originalFilename, ".pdf");
+        }

-        byte[] pdfBytes =
-                FileToPdf.convertHtmlToPdf(
-                        runtimePathConfig.getWeasyPrintPath(),
-                        null,
-                        htmlContent.getBytes(),
-                        "converted.html",
-                        tempFileManager,
-                        customHtmlSanitizer);
        pdfBytes = pdfDocumentFactory.createNewBytesBasedOnOldDocument(pdfBytes);
-        String outputFilename = GeneralUtils.generateFilename(originalFilename, ".pdf");
        return WebResponseUtils.bytesToWebResponse(pdfBytes, outputFilename);
    }
+
+    /**
+     * Finds a markdown file in the directory. Prefers index.md, otherwise returns the first .md
+     * file found.
+     */
+    private java.io.File findMarkdownFile(java.io.File directory) throws java.io.IOException {
+        java.io.File indexMd = new java.io.File(directory, "index.md");
+        if (indexMd.exists()) {
+            return indexMd;
+        }
+
+        // Search for any .md file
+        try (java.util.stream.Stream<java.nio.file.Path> paths =
+                java.nio.file.Files.walk(directory.toPath())) {
+            return paths.filter(p -> p.toString().toLowerCase().endsWith(".md"))
+                    .findFirst()
+                    .map(java.nio.file.Path::toFile)
+                    .orElse(null);
+        }
+    }
+
+    /**
+     * Creates a ZIP file containing the HTML content and all other files (images) from the
+     * directory.
+     */
+    private byte[] createHtmlZip(String htmlContent, java.io.File sourceDir)
+            throws java.io.IOException {
+        java.io.ByteArrayOutputStream baos = new java.io.ByteArrayOutputStream();
+
+        try (java.util.zip.ZipOutputStream zos = new java.util.zip.ZipOutputStream(baos)) {
+            // Add HTML file to root
+            java.util.zip.ZipEntry htmlEntry = new java.util.zip.ZipEntry("index.html");
+            zos.putNextEntry(htmlEntry);
+            zos.write(htmlContent.getBytes(java.nio.charset.StandardCharsets.UTF_8));
+            zos.closeEntry();
+
+            // Add all other files (images, etc.)
+            addDirectoryToZip(zos, sourceDir.toPath(), sourceDir.toPath());
+        }
+
+        return baos.toByteArray();
+    }
+
+    /** Recursively adds files from a directory to a ZIP, excluding .md files. */
+    private void addDirectoryToZip(
+            java.util.zip.ZipOutputStream zos,
+            java.nio.file.Path sourceDir,
+            java.nio.file.Path rootDir)
+            throws java.io.IOException {
+        try (java.util.stream.Stream<java.nio.file.Path> paths =
+                java.nio.file.Files.walk(sourceDir, 1)) {
+            for (java.nio.file.Path path : paths.toList()) {
+                if (java.nio.file.Files.isDirectory(path)) {
+                    if (!path.equals(sourceDir)) {
+                        addDirectoryToZip(zos, path, rootDir);
+                    }
+                } else if (!path.toString().toLowerCase().endsWith(".md")) {
+                    // Add file to ZIP, maintaining relative path structure
+                    java.nio.file.Path relativePath = rootDir.relativize(path);
+                    java.util.zip.ZipEntry entry =
+                            new java.util.zip.ZipEntry(relativePath.toString());
+                    zos.putNextEntry(entry);
+                    java.nio.file.Files.copy(path, zos);
+                    zos.closeEntry();
+                }
+            }
+        }
+    }
 }

 class TableAttributeProvider implements AttributeProvider {
@@ -91,22 +91,32 @@ public class ConvertOfficeController {

        Path libreOfficeProfile = null;
        try {
-            ProcessExecutorResult result;
-            // Run Unoconvert command
-            if (isUnoconvertAvailable()) {
-                // Unoconvert: schreibe direkt in outputPath innerhalb des workDir
-                List<String> command = new ArrayList<>();
-                command.add(runtimePathConfig.getUnoConvertPath());
-                command.add("--convert-to");
-                command.add("pdf");
-                command.add(inputPath.toString());
-                command.add(outputPath.toString());
+            ProcessExecutorResult result = null;
+            IOException unoconvertException = null;

-                result =
-                        ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
-                                .runCommandWithOutputHandling(command);
-            } // Run soffice command
-            else {
+            // Try unoconvert first if available
+            if (isUnoconvertAvailable()) {
+                try {
+                    List<String> command = new ArrayList<>();
+                    command.add(runtimePathConfig.getUnoConvertPath());
+                    command.add("--convert-to");
+                    command.add("pdf");
+                    command.add(inputPath.toString());
+                    command.add(outputPath.toString());
+
+                    result =
+                            ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
+                                    .runCommandWithOutputHandling(command);
+                } catch (IOException e) {
+                    unoconvertException = e;
+                    log.warn(
+                            "Unoconvert command failed ({}). Falling back to soffice command.",
+                            e.getMessage());
+                }
+            }
+
+            // Fallback to soffice if unoconvert was unavailable or failed
+            if (result == null) {
                libreOfficeProfile = Files.createTempDirectory("libreoffice_profile_");
                List<String> command = new ArrayList<>();
                command.add(runtimePathConfig.getSOfficePath());
@@ -114,14 +124,21 @@ public class ConvertOfficeController {
                command.add("--headless");
                command.add("--nologo");
                command.add("--convert-to");
-                command.add("pdf:writer_pdf_Export");
+                command.add("pdf");
                command.add("--outdir");
                command.add(workDir.toString());
                command.add(inputPath.toString());

-                result =
-                        ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
-                                .runCommandWithOutputHandling(command);
+                try {
+                    result =
+                            ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
+                                    .runCommandWithOutputHandling(command);
+                } catch (IOException e) {
+                    if (unoconvertException != null) {
+                        e.addSuppressed(unoconvertException);
+                    }
+                    throw e;
+                }
            }

            // Check the result
@@ -0,0 +1,124 @@
+package stirling.software.SPDF.controller.api.converters;
+
+import java.io.ByteArrayOutputStream;
+import java.util.List;
+import java.util.Locale;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.poi.ss.usermodel.Cell;
+import org.apache.poi.ss.usermodel.Row;
+import org.apache.poi.ss.usermodel.Sheet;
+import org.apache.poi.ss.usermodel.Workbook;
+import org.apache.poi.ss.util.WorkbookUtil;
+import org.apache.poi.xssf.usermodel.XSSFWorkbook;
+import org.springframework.http.ContentDisposition;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.ModelAttribute;
+
+import io.swagger.v3.oas.annotations.Operation;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.model.api.PDFWithPageNums;
+import stirling.software.common.annotations.AutoJobPostMapping;
+import stirling.software.common.annotations.api.ConvertApi;
+import stirling.software.common.service.CustomPDFDocumentFactory;
+import stirling.software.common.util.GeneralUtils;
+
+import technology.tabula.ObjectExtractor;
+import technology.tabula.Page;
+import technology.tabula.RectangularTextContainer;
+import technology.tabula.Table;
+import technology.tabula.extractors.SpreadsheetExtractionAlgorithm;
+
+@ConvertApi
+@Slf4j
+@RequiredArgsConstructor
+public class ConvertPDFToExcelController {
+
+    private final CustomPDFDocumentFactory pdfDocumentFactory;
+
+    @AutoJobPostMapping(value = "/pdf/xlsx", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @Operation(
+            summary = "Convert a PDF to an Excel spreadsheet (XLSX)",
+            description =
+                    "Extracts tabular data from each page of a PDF and writes it into an Excel"
+                            + " workbook, one sheet per table. Input:PDF Output:XLSX Type:SISO")
+    public ResponseEntity<byte[]> pdfToExcel(@ModelAttribute PDFWithPageNums request)
+            throws Exception {
+        String baseName =
+                GeneralUtils.removeExtension(request.getFileInput().getOriginalFilename());
+
+        try (PDDocument document = pdfDocumentFactory.load(request);
+                XSSFWorkbook workbook = new XSSFWorkbook();
+                ObjectExtractor extractor = new ObjectExtractor(document)) {
+
+            List<Integer> pages = request.getPageNumbersList(document, true);
+            SpreadsheetExtractionAlgorithm sea = new SpreadsheetExtractionAlgorithm();
+            int sheetCount = 0;
+
+            for (int pageNum : pages) {
+                Page page = extractor.extract(pageNum);
+                List<Table> tables = sea.extract(page);
+
+                for (int tableIdx = 0; tableIdx < tables.size(); tableIdx++) {
+                    Table table = tables.get(tableIdx);
+                    String sheetName =
+                            tables.size() == 1
+                                    ? String.format(Locale.ROOT, "Page %d", pageNum)
+                                    : String.format(
+                                            Locale.ROOT, "Page %d Table %d", pageNum, tableIdx + 1);
+
+                    sheetName = getUniqueSheetName(workbook, sheetName);
+                    Sheet sheet = workbook.createSheet(sheetName);
+                    List<List<RectangularTextContainer>> rows = table.getRows();
+
+                    for (int rowIdx = 0; rowIdx < rows.size(); rowIdx++) {
+                        Row excelRow = sheet.createRow(rowIdx);
+                        List<RectangularTextContainer> cells = rows.get(rowIdx);
+                        for (int cellIdx = 0; cellIdx < cells.size(); cellIdx++) {
+                            Cell excelCell = excelRow.createCell(cellIdx);
+                            excelCell.setCellValue(cells.get(cellIdx).getText());
+                        }
+                    }
+                    sheetCount++;
+                }
+            }
+
+            if (sheetCount == 0) {
+                return ResponseEntity.noContent().build();
+            }
+
+            ByteArrayOutputStream baos = new ByteArrayOutputStream();
+            workbook.write(baos);
+
+            HttpHeaders headers = new HttpHeaders();
+            headers.setContentDisposition(
+                    ContentDisposition.builder("attachment").filename(baseName + ".xlsx").build());
+            headers.setContentType(
+                    MediaType.parseMediaType(
+                            "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"));
+
+            return ResponseEntity.ok().headers(headers).body(baos.toByteArray());
+        }
+    }
+
+    private String getUniqueSheetName(Workbook workbook, String baseName) {
+        String safeName = WorkbookUtil.createSafeSheetName(baseName);
+        String uniqueName = safeName;
+        int count = 1;
+        while (workbook.getSheet(uniqueName) != null) {
+            String suffix = " (" + count + ")";
+            if (safeName.length() + suffix.length() > 31) {
+                uniqueName = safeName.substring(0, 31 - suffix.length()) + suffix;
+            } else {
+                uniqueName = safeName + suffix;
+            }
+            count++;
+        }
+        return uniqueName;
+    }
+}
@@ -71,10 +71,12 @@ import org.apache.xmpbox.schema.PDFAIdentificationSchema;
 import org.apache.xmpbox.schema.XMPBasicSchema;
 import org.apache.xmpbox.xml.DomXmpParser;
 import org.apache.xmpbox.xml.XmpSerializer;
+import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.server.ResponseStatusException;

 import io.github.pixee.security.Filenames;
 import io.swagger.v3.oas.annotations.Operation;
@@ -99,6 +101,7 @@ public class ConvertPDFToPDFA {

    private static final Pattern NON_PRINTABLE_ASCII = Pattern.compile("[^\\x20-\\x7E]");
    private final RuntimePathConfig runtimePathConfig;
+    private final stirling.software.SPDF.service.VeraPDFService veraPDFService;

    private static final String ICC_RESOURCE_PATH = "/icc/sRGB2014.icc";
    private static final int PDFA_COMPATIBILITY_POLICY = 1;
@@ -587,7 +590,8 @@ public class ConvertPDFToPDFA {
        if (isPdfX) {
            return handlePdfXConversion(inputFile, outputFormat);
        } else {
-            return handlePdfAConversion(inputFile, outputFormat);
+            return handlePdfAConversion(
+                    inputFile, outputFormat, request.getStrict() != null && request.getStrict());
        }
    }

@@ -1793,7 +1797,7 @@ public class ConvertPDFToPDFA {
    }

    private ResponseEntity<byte[]> handlePdfAConversion(
-            MultipartFile inputFile, String outputFormat) throws Exception {
+            MultipartFile inputFile, String outputFormat, boolean strict) throws Exception {
        PdfaProfile profile = PdfaProfile.fromRequest(outputFormat);

        // Get the original filename without extension
@@ -1822,6 +1826,10 @@ public class ConvertPDFToPDFA {

                    validateAndWarnPdfA(converted, profile, "Ghostscript");

+                    if (strict) {
+                        verifyStrictCompliance(converted);
+                    }
+
                    return WebResponseUtils.bytesToWebResponse(
                            converted, outputFilename, MediaType.APPLICATION_PDF);
                } catch (IOException | InterruptedException e) {
@@ -1839,14 +1847,42 @@ public class ConvertPDFToPDFA {
            // Validate with PDFBox preflight and warn if issues found
            validateAndWarnPdfA(converted, profile, "PDFBox/LibreOffice");

+            if (strict) {
+                verifyStrictCompliance(converted);
+            }
+
            return WebResponseUtils.bytesToWebResponse(
                    converted, outputFilename, MediaType.APPLICATION_PDF);
-
        } finally {
            deleteQuietly(workingDir);
        }
    }

+    private void verifyStrictCompliance(byte[] pdfBytes) throws IOException {
+        try (InputStream is = new ByteArrayInputStream(pdfBytes)) {
+            List<stirling.software.SPDF.model.api.security.PDFVerificationResult> results =
+                    veraPDFService.validatePDF(is);
+            boolean isCompliant = results.stream().anyMatch(result -> result.isCompliant());
+            if (!isCompliant) {
+                String details =
+                        results.stream()
+                                .map(r -> r.getStandard() + ": " + r.getComplianceSummary())
+                                .collect(Collectors.joining("; "));
+                throw new ResponseStatusException(
+                        HttpStatus.BAD_REQUEST,
+                        "Strict PDF/A mode enabled: Conversion is not perfectly compliant. Details: "
+                                + details);
+            }
+        } catch (Exception e) {
+            if (e instanceof ResponseStatusException) {
+                throw (ResponseStatusException) e;
+            }
+            log.error("Error during strict PDF/A verification", e);
+            throw new ResponseStatusException(
+                    HttpStatus.INTERNAL_SERVER_ERROR, "Error during strict PDF/A verification");
+        }
+    }
+
    private Path sanitizePdfWithPdfBox(Path inputPdf, boolean addWhiteBackground) {
        try {
            Path sanitizedPath =
@@ -1,7 +1,9 @@
 package stirling.software.SPDF.controller.api.converters;

+import java.nio.charset.StandardCharsets;
 import java.util.Optional;
 import java.util.UUID;
+import java.util.regex.Pattern;

 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.MediaType;
@@ -36,6 +38,7 @@ import stirling.software.common.util.WebResponseUtils;
@RequiredArgsConstructor
 public class ConvertPdfJsonController {

+    private static final Pattern FILE_EXTENSION_PATTERN = Pattern.compile("[.][^.]+$");
    private final PdfJsonConversionService pdfJsonConversionService;

    @Autowired(required = false)
@@ -56,10 +59,13 @@ public class ConvertPdfJsonController {
        }

        byte[] jsonBytes = pdfJsonConversionService.convertPdfToJson(inputFile, lightweight);
+        logJsonResponse("pdf/text-editor", jsonBytes);
        String originalName = inputFile.getOriginalFilename();
        String baseName =
                (originalName != null && !originalName.isBlank())
-                        ? Filenames.toSimpleFileName(originalName).replaceFirst("[.][^.]+$", "")
+                        ? FILE_EXTENSION_PATTERN
+                                .matcher(Filenames.toSimpleFileName(originalName))
+                                .replaceFirst("")
                        : "document";
        String docName = baseName + ".json";
        return WebResponseUtils.bytesToWebResponse(jsonBytes, docName, MediaType.APPLICATION_JSON);
@@ -82,7 +88,9 @@ public class ConvertPdfJsonController {
        String originalName = jsonFile.getOriginalFilename();
        String baseName =
                (originalName != null && !originalName.isBlank())
-                        ? Filenames.toSimpleFileName(originalName).replaceFirst("[.][^.]+$", "")
+                        ? FILE_EXTENSION_PATTERN
+                                .matcher(Filenames.toSimpleFileName(originalName))
+                                .replaceFirst("")
                        : "document";
        String docName = baseName.endsWith(".pdf") ? baseName : baseName + ".pdf";
        return WebResponseUtils.bytesToWebResponse(pdfBytes, docName);
@@ -108,14 +116,17 @@ public class ConvertPdfJsonController {
        // Scope job to authenticated user if security is enabled
        String scopedJobKey = getScopedJobKey(baseJobId);

-        log.info("Extracting metadata for PDF, assigned jobId: {}", scopedJobKey);
+        log.debug("Extracting metadata for PDF, assigned jobId: {}", scopedJobKey);

        byte[] jsonBytes =
                pdfJsonConversionService.extractDocumentMetadata(inputFile, scopedJobKey);
+        logJsonResponse("pdf/text-editor/metadata", jsonBytes);
        String originalName = inputFile.getOriginalFilename();
        String baseName =
                (originalName != null && !originalName.isBlank())
-                        ? Filenames.toSimpleFileName(originalName).replaceFirst("[.][^.]+$", "")
+                        ? FILE_EXTENSION_PATTERN
+                                .matcher(Filenames.toSimpleFileName(originalName))
+                                .replaceFirst("")
                        : "document";
        String docName = baseName + "_metadata.json";

@@ -152,7 +163,9 @@ public class ConvertPdfJsonController {

        String baseName =
                (filename != null && !filename.isBlank())
-                        ? Filenames.toSimpleFileName(filename).replaceFirst("[.][^.]+$", "")
+                        ? FILE_EXTENSION_PATTERN
+                                .matcher(Filenames.toSimpleFileName(filename))
+                                .replaceFirst("")
                        : Optional.ofNullable(document.getMetadata())
                                .map(PdfJsonMetadata::getTitle)
                                .filter(title -> title != null && !title.isBlank())
@@ -175,11 +188,33 @@ public class ConvertPdfJsonController {
        validateJobAccess(jobId);

        byte[] jsonBytes = pdfJsonConversionService.extractSinglePage(jobId, pageNumber);
+        logJsonResponse("pdf/text-editor/page", jsonBytes);
        String docName = "page_" + pageNumber + ".json";
        return WebResponseUtils.bytesToWebResponse(jsonBytes, docName, MediaType.APPLICATION_JSON);
    }

-    @AutoJobPostMapping(value = "/pdf/text-editor/clear-cache/{jobId}")
+    @GetMapping(value = "/pdf/text-editor/fonts/{jobId}/{pageNumber}")
+    @Operation(
+            summary = "Extract fonts used by a single cached page for text editor",
+            description =
+                    "Retrieves the font payloads used by a single page from a previously cached PDF document."
+                            + " Requires prior call to /pdf/text-editor/metadata. The jobId must belong to the"
+                            + " authenticated user. Output:JSON")
+    public ResponseEntity<byte[]> extractPageFonts(
+            @PathVariable String jobId, @PathVariable int pageNumber) throws Exception {
+
+        // Validate job ownership
+        validateJobAccess(jobId);
+
+        byte[] jsonBytes = pdfJsonConversionService.extractPageFonts(jobId, pageNumber);
+        logJsonResponse("pdf/text-editor/fonts/page", jsonBytes);
+        String docName = "page_fonts_" + pageNumber + ".json";
+        return WebResponseUtils.bytesToWebResponse(jsonBytes, docName, MediaType.APPLICATION_JSON);
+    }
+
+    @AutoJobPostMapping(
+            value = "/pdf/text-editor/clear-cache/{jobId}",
+            consumes = MediaType.ALL_VALUE)
    @Operation(
            summary = "Clear cached PDF document for text editor",
            description =
@@ -209,6 +244,188 @@ public class ConvertPdfJsonController {
        return baseJobId;
    }

+    private void logJsonResponse(String label, byte[] jsonBytes) {
+        if (jsonBytes == null) {
+            log.warn("Returning {} JSON response: null bytes", label);
+            return;
+        }
+
+        // Only perform expensive tail extraction if debug logging is enabled
+        if (log.isDebugEnabled()) {
+            int length = jsonBytes.length;
+            boolean endsWithJson =
+                    length > 0 && (jsonBytes[length - 1] == '}' || jsonBytes[length - 1] == ']');
+            String tail = "";
+            if (length > 0) {
+                int start = Math.max(0, length - 64);
+                tail = new String(jsonBytes, start, length - start, StandardCharsets.UTF_8);
+                tail = tail.replaceAll("[\\r\\n\\t]+", " ").replaceAll("[^\\x20-\\x7E]", "?");
+            }
+            log.debug(
+                    "Returning {} JSON response ({} bytes, endsWithJson={}, tail='{}')",
+                    label,
+                    length,
+                    endsWithJson,
+                    tail);
+        }
+
+        if (isPdfJsonDebugDumpEnabled()) {
+            try {
+                String tmpDir = System.getProperty("java.io.tmpdir");
+                String customDir = System.getenv("SPDF_PDFJSON_DUMP_DIR");
+                java.nio.file.Path dumpDir =
+                        customDir != null && !customDir.isBlank()
+                                ? java.nio.file.Path.of(customDir)
+                                : java.nio.file.Path.of(tmpDir);
+                java.nio.file.Path dumpPath =
+                        java.nio.file.Files.createTempFile(dumpDir, "pdfjson_", ".json");
+                java.nio.file.Files.write(dumpPath, jsonBytes);
+                log.debug("PDF JSON debug dump ({}): {}", label, dumpPath);
+            } catch (Exception ex) {
+                log.warn("Failed to write PDF JSON debug dump ({}): {}", label, ex.getMessage());
+            }
+        }
+
+        if (isPdfJsonRepeatScanEnabled()) {
+            logRepeatedJsonStrings(label, jsonBytes);
+        }
+    }
+
+    private boolean isPdfJsonDebugDumpEnabled() {
+        String env = System.getenv("SPDF_PDFJSON_DUMP");
+        if (env != null && env.equalsIgnoreCase("true")) {
+            return true;
+        }
+        return Boolean.getBoolean("spdf.pdfjson.dump");
+    }
+
+    private boolean isPdfJsonRepeatScanEnabled() {
+        String env = System.getenv("SPDF_PDFJSON_REPEAT_SCAN");
+        if (env != null && env.equalsIgnoreCase("true")) {
+            return true;
+        }
+        return Boolean.getBoolean("spdf.pdfjson.repeatScan");
+    }
+
+    private void logRepeatedJsonStrings(String label, byte[] jsonBytes) {
+        final int minLen = 12;
+        final int maxLen = 200;
+        final int maxUnique = 50000;
+        java.util.Map<String, Integer> counts = new java.util.HashMap<>();
+        boolean inString = false;
+        boolean escape = false;
+        boolean tooLong = false;
+        StringBuilder current = new StringBuilder(64);
+        boolean capped = false;
+
+        for (byte b : jsonBytes) {
+            char ch = (char) (b & 0xFF);
+            if (!inString) {
+                if (ch == '"') {
+                    inString = true;
+                    escape = false;
+                    tooLong = false;
+                    current.setLength(0);
+                }
+                continue;
+            }
+
+            if (escape) {
+                escape = false;
+                if (!tooLong && current.length() < maxLen) {
+                    current.append(ch);
+                }
+                continue;
+            }
+            if (ch == '\\') {
+                escape = true;
+                continue;
+            }
+            if (ch == '"') {
+                inString = false;
+                if (!tooLong) {
+                    int len = current.length();
+                    if (len >= minLen && len <= maxLen) {
+                        String value = current.toString();
+                        if (!looksLikeBase64(value)) {
+                            if (!capped || counts.containsKey(value)) {
+                                counts.merge(value, 1, Integer::sum);
+                                if (!capped && counts.size() >= maxUnique) {
+                                    capped = true;
+                                }
+                            }
+                        }
+                    }
+                }
+                continue;
+            }
+            if (!tooLong) {
+                if (current.length() < maxLen) {
+                    current.append(ch);
+                } else {
+                    tooLong = true;
+                }
+            }
+        }
+
+        java.util.List<java.util.Map.Entry<String, Integer>> top =
+                counts.entrySet().stream()
+                        .filter(e -> e.getValue() > 1)
+                        .sorted((a, b) -> Integer.compare(b.getValue(), a.getValue()))
+                        .limit(20)
+                        .toList();
+
+        if (!top.isEmpty()) {
+            String summary =
+                    top.stream()
+                            .map(
+                                    e ->
+                                            String.format(
+                                                    "\"%s\"(len=%d,count=%d)",
+                                                    truncateForLog(e.getKey()),
+                                                    e.getKey().length(),
+                                                    e.getValue()))
+                            .collect(java.util.stream.Collectors.joining("; "));
+            log.debug(
+                    "PDF JSON repeat scan ({}): top strings -> {}{}",
+                    label,
+                    summary,
+                    capped ? " (capped)" : "");
+        } else {
+            log.debug(
+                    "PDF JSON repeat scan ({}): no repeated strings found{}",
+                    label,
+                    capped ? " (capped)" : "");
+        }
+    }
+
+    private boolean looksLikeBase64(String value) {
+        if (value.length() < 32) {
+            return false;
+        }
+        int base64Chars = 0;
+        for (int i = 0; i < value.length(); i++) {
+            char c = value.charAt(i);
+            if ((c >= 'A' && c <= 'Z')
+                    || (c >= 'a' && c <= 'z')
+                    || (c >= '0' && c <= '9')
+                    || c == '+'
+                    || c == '/'
+                    || c == '=') {
+                base64Chars++;
+            }
+        }
+        return base64Chars >= value.length() * 0.9;
+    }
+
+    private String truncateForLog(String value) {
+        int max = 64;
+        if (value.length() <= max) {
+            return value.replaceAll("[\\r\\n\\t]+", " ");
+        }
+        return value.substring(0, max).replaceAll("[\\r\\n\\t]+", " ") + "...";
+    }
+
    /**
     * Validate that the current user has access to the given job.
     *
@@ -9,13 +9,13 @@ import org.springframework.web.bind.annotation.ControllerAdvice;
 import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.ResponseBody;

-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;

 import stirling.software.SPDF.exception.CacheUnavailableException;

+import tools.jackson.databind.ObjectMapper;
+
@ControllerAdvice(assignableTypes = ConvertPdfJsonController.class)
@Slf4j
@RequiredArgsConstructor
@@ -166,7 +166,7 @@ public class ConvertWebsiteToPDF {
    private String fetchRemoteHtml(String url) throws IOException, InterruptedException {
        HttpClient client =
                HttpClient.newBuilder()
-                        .followRedirects(HttpClient.Redirect.NORMAL)
+                        .followRedirects(HttpClient.Redirect.NEVER)
                        .connectTimeout(Duration.ofSeconds(10))
                        .build();

@@ -180,7 +180,7 @@ public class ConvertWebsiteToPDF {
        HttpResponse<String> response =
                client.send(request, HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));

-        if (response.statusCode() >= 400 || response.body() == null) {
+        if (response.statusCode() >= 300 || response.body() == null) {
            throw ExceptionUtils.createIOException(
                    "error.httpRequestFailed",
                    "Failed to retrieve remote HTML. Status: {0}",
@@ -1,12 +1,15 @@
-package stirling.software.proprietary.controller.api.form;
+package stirling.software.SPDF.controller.api.form;

 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
+import java.io.StringWriter;
 import java.nio.charset.StandardCharsets;
 import java.util.List;
 import java.util.Map;

 import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.poi.ss.usermodel.*;
+import org.apache.poi.xssf.usermodel.XSSFWorkbook;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -16,7 +19,7 @@ import org.springframework.web.bind.annotation.RequestPart;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.multipart.MultipartFile;

-import com.fasterxml.jackson.databind.ObjectMapper;
+import com.opencsv.CSVWriter;

 import io.github.pixee.security.Filenames;
 import io.swagger.v3.oas.annotations.Operation;
@@ -27,10 +30,14 @@ import io.swagger.v3.oas.annotations.tags.Tag;

 import lombok.RequiredArgsConstructor;

+import stirling.software.common.model.FormFieldWithCoordinates;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.ExceptionUtils;
+import stirling.software.common.util.FormUtils;
 import stirling.software.common.util.WebResponseUtils;
-import stirling.software.proprietary.util.FormUtils;
+
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.ObjectMapper;

@RestController
@RequestMapping("/api/v1/form")
@@ -104,12 +111,151 @@ public class FormFillController {

        requirePdf(file);
        try (PDDocument document = pdfDocumentFactory.load(file, true)) {
+            FormUtils.repairMissingWidgetPageReferences(document);
            FormUtils.FormFieldExtraction extraction =
                    FormUtils.extractFieldsWithTemplate(document);
            return ResponseEntity.ok(extraction);
        }
    }

+    @PostMapping(value = "/fields-with-coordinates", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @Operation(
+            summary = "Inspect PDF form fields with widget coordinates",
+            description =
+                    "Returns metadata describing each field in the provided PDF form, "
+                            + "including precise widget coordinates for interactive rendering")
+    public ResponseEntity<List<FormFieldWithCoordinates>> listFieldsWithCoordinates(
+            @Parameter(
+                            description = "The input PDF file",
+                            required = true,
+                            content =
+                                    @Content(
+                                            mediaType = MediaType.APPLICATION_PDF_VALUE,
+                                            schema = @Schema(type = "string", format = "binary")))
+                    @RequestParam("file")
+                    MultipartFile file)
+            throws IOException {
+
+        requirePdf(file);
+        try (PDDocument document = pdfDocumentFactory.load(file, true)) {
+            FormUtils.repairMissingWidgetPageReferences(document);
+            List<FormFieldWithCoordinates> fields =
+                    FormUtils.extractFormFieldsWithCoordinates(document);
+            return ResponseEntity.ok(fields);
+        }
+    }
+
+    @PostMapping(value = "/extract-csv", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @Operation(
+            summary = "Extract form fields as CSV",
+            description =
+                    "Returns a CSV file containing all form field names and their current values")
+    public ResponseEntity<byte[]> extractCsv(
+            @Parameter(
+                            description = "The input PDF file",
+                            required = true,
+                            content =
+                                    @Content(
+                                            mediaType = MediaType.APPLICATION_PDF_VALUE,
+                                            schema = @Schema(type = "string", format = "binary")))
+                    @RequestParam("file")
+                    MultipartFile file,
+            @RequestParam(value = "data", required = false) MultipartFile data)
+            throws IOException {
+
+        requirePdf(file);
+        try (PDDocument document = pdfDocumentFactory.load(file, true);
+                StringWriter sw = new StringWriter()) {
+
+            FormUtils.repairMissingWidgetPageReferences(document);
+
+            if (data != null && !data.isEmpty()) {
+                Map<String, String> values =
+                        objectMapper.readValue(
+                                data.getInputStream(), new TypeReference<Map<String, String>>() {});
+                FormUtils.applyFieldValues(document, values, false);
+            }
+
+            List<FormUtils.FormFieldInfo> fields = FormUtils.extractFormFields(document);
+
+            try (CSVWriter csvWriter = new CSVWriter(sw)) {
+                String[] header = {"Field Name", "Value"};
+                csvWriter.writeNext(header);
+
+                for (FormUtils.FormFieldInfo field : fields) {
+                    csvWriter.writeNext(new String[] {field.name(), field.value()});
+                }
+            }
+
+            byte[] csvBytes = sw.toString().getBytes(StandardCharsets.UTF_8);
+            String baseName = buildBaseName(file, "extracted");
+            return WebResponseUtils.bytesToWebResponse(
+                    csvBytes, baseName + ".csv", MediaType.parseMediaType("text/csv"));
+        }
+    }
+
+    @PostMapping(value = "/extract-xlsx", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @Operation(
+            summary = "Extract form fields as XLSX",
+            description =
+                    "Returns an Excel (XLSX) file containing all form field names and their current values")
+    public ResponseEntity<byte[]> extractXlsx(
+            @Parameter(
+                            description = "The input PDF file",
+                            required = true,
+                            content =
+                                    @Content(
+                                            mediaType = MediaType.APPLICATION_PDF_VALUE,
+                                            schema = @Schema(type = "string", format = "binary")))
+                    @RequestParam("file")
+                    MultipartFile file,
+            @RequestParam(value = "data", required = false) MultipartFile data)
+            throws IOException {
+
+        requirePdf(file);
+        try (PDDocument document = pdfDocumentFactory.load(file, true);
+                Workbook workbook = new XSSFWorkbook();
+                ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
+
+            FormUtils.repairMissingWidgetPageReferences(document);
+
+            if (data != null && !data.isEmpty()) {
+                Map<String, String> values =
+                        objectMapper.readValue(
+                                data.getInputStream(), new TypeReference<Map<String, String>>() {});
+                FormUtils.applyFieldValues(document, values, false);
+            }
+
+            List<FormUtils.FormFieldInfo> fields = FormUtils.extractFormFields(document);
+            Sheet sheet = workbook.createSheet("Form Fields");
+
+            // Header row
+            Row headerRow = sheet.createRow(0);
+            headerRow.createCell(0).setCellValue("Field Name");
+            headerRow.createCell(1).setCellValue("Value");
+
+            // Data rows
+            int rowNum = 1;
+            for (FormUtils.FormFieldInfo field : fields) {
+                Row row = sheet.createRow(rowNum++);
+                row.createCell(0).setCellValue(field.name());
+                row.createCell(1).setCellValue(FormUtils.safeValue(field.value()));
+            }
+
+            // Auto-size columns
+            sheet.autoSizeColumn(0);
+            sheet.autoSizeColumn(1);
+
+            workbook.write(baos);
+            String baseName = buildBaseName(file, "extracted");
+            return WebResponseUtils.bytesToWebResponse(
+                    baos.toByteArray(),
+                    baseName + ".xlsx",
+                    MediaType.parseMediaType(
+                            "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"));
+        }
+    }
+
    @PostMapping(value = "/modify-fields", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
    @Operation(
            summary = "Modify existing form fields",
@@ -215,6 +361,7 @@ public class FormFillController {

        String baseName = buildBaseName(file, suffix);
        try (PDDocument document = pdfDocumentFactory.load(file)) {
+            FormUtils.repairMissingWidgetPageReferences(document);
            processor.accept(document);
            return saveDocument(document, baseName);
        }
@@ -1,6 +1,5 @@
-package stirling.software.proprietary.controller.api.form;
+package stirling.software.SPDF.controller.api.form;

-import java.io.IOException;
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.LinkedHashSet;
@@ -8,12 +7,13 @@ import java.util.List;
 import java.util.Map;
 import java.util.Set;

-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import stirling.software.common.util.ExceptionUtils;
-import stirling.software.proprietary.util.FormUtils;
+import stirling.software.common.util.FormUtils;
+
+import tools.jackson.core.JacksonException;
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;

 final class FormPayloadParser {

@@ -32,8 +32,7 @@ final class FormPayloadParser {

    private FormPayloadParser() {}

-    static Map<String, Object> parseValueMap(ObjectMapper objectMapper, String json)
-            throws IOException {
+    static Map<String, Object> parseValueMap(ObjectMapper objectMapper, String json) {
        if (json == null || json.isBlank()) {
            return Map.of();
        }
@@ -41,7 +40,7 @@ final class FormPayloadParser {
        JsonNode root;
        try {
            root = objectMapper.readTree(json);
-        } catch (IOException e) {
+        } catch (JacksonException e) {
            // Fallback to legacy direct map parse (will throw again if invalid)
            return objectMapper.readValue(json, MAP_TYPE);
        }
@@ -88,14 +87,14 @@ final class FormPayloadParser {
    }

    static List<FormUtils.ModifyFormFieldDefinition> parseModificationDefinitions(
-            ObjectMapper objectMapper, String json) throws IOException {
+            ObjectMapper objectMapper, String json) {
        if (json == null || json.isBlank()) {
            return List.of();
        }
        return objectMapper.readValue(json, MODIFY_FIELD_LIST_TYPE);
    }

-    static List<String> parseNameList(ObjectMapper objectMapper, String json) throws IOException {
+    static List<String> parseNameList(ObjectMapper objectMapper, String json) {
        if (json == null || json.isBlank()) {
            return List.of();
        }
@@ -119,7 +118,7 @@ final class FormPayloadParser {
                }
            }
        } else if (root.isTextual()) {
-            final String single = trimToNull(root.asText());
+            final String single = trimToNull(root.asText(""));
            if (single != null) {
                names.add(single);
            }
@@ -131,7 +130,7 @@ final class FormPayloadParser {

        try {
            return objectMapper.readValue(json, STRING_LIST_TYPE);
-        } catch (IOException e) {
+        } catch (JacksonException e) {
            throw ExceptionUtils.createIllegalArgumentException(
                    "error.invalidFormat",
                    "Invalid {0} format: {1}",
@@ -199,7 +198,7 @@ final class FormPayloadParser {
            return null;
        }
        if (node.isTextual()) {
-            return trimToEmpty(node.asText());
+            return trimToEmpty(node.asText(""));
        }
        if (node.isNumber()) {
            return node.numberValue().toString();
@@ -208,7 +207,7 @@ final class FormPayloadParser {
            return Boolean.toString(node.booleanValue());
        }
        // Fallback for other scalar-like nodes
-        return trimToEmpty(node.asText());
+        return trimToEmpty(node.asText(""));
    }

    private static void collectNames(JsonNode arrayNode, Set<String> sink) {
@@ -229,7 +228,7 @@ final class FormPayloadParser {
        }

        if (node.isTextual()) {
-            return trimToNull(node.asText());
+            return trimToNull(node.asText(""));
        }

        if (node.isObject()) {
@@ -264,8 +263,8 @@ final class FormPayloadParser {
    private static Map<String, Object> objectToLinkedMap(JsonNode objectNode) {
        final Map<String, Object> result = new LinkedHashMap<>();
        objectNode
-                .fieldNames()
-                .forEachRemaining(
+                .propertyNames()
+                .forEach(
                        key -> {
                            final JsonNode v = objectNode.get(key);
                            if (v == null || v.isNull()) {
@@ -1,5 +1,6 @@
 package stirling.software.SPDF.controller.api.misc;

+import java.util.Collection;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -11,9 +12,6 @@ import org.springframework.web.bind.annotation.RequestParam;

 import io.swagger.v3.oas.annotations.Hidden;

-import jakarta.validation.constraints.NotBlank;
-import jakarta.validation.constraints.Size;
-
 import lombok.extern.slf4j.Slf4j;

 import stirling.software.SPDF.config.EndpointConfiguration;
@@ -35,6 +33,7 @@ public class ConfigController {
    private final EndpointConfiguration endpointConfiguration;
    private final ServerCertificateServiceInterface serverCertificateService;
    private final UserServiceInterface userService;
+    private final stirling.software.common.service.LicenseServiceInterface licenseService;
    private final stirling.software.SPDF.config.ExternalAppDepConfig externalAppDepConfig;

    public ConfigController(
@@ -45,15 +44,66 @@ public class ConfigController {
                    ServerCertificateServiceInterface serverCertificateService,
            @org.springframework.beans.factory.annotation.Autowired(required = false)
                    UserServiceInterface userService,
+            @org.springframework.beans.factory.annotation.Autowired(required = false)
+                    stirling.software.common.service.LicenseServiceInterface licenseService,
            stirling.software.SPDF.config.ExternalAppDepConfig externalAppDepConfig) {
        this.applicationProperties = applicationProperties;
        this.applicationContext = applicationContext;
        this.endpointConfiguration = endpointConfiguration;
        this.serverCertificateService = serverCertificateService;
        this.userService = userService;
+        this.licenseService = licenseService;
        this.externalAppDepConfig = externalAppDepConfig;
    }

+    /**
+     * Get current license type dynamically instead of from cached bean. This ensures the frontend
+     * sees updated license status after admin changes the license key.
+     */
+    private String getCurrentLicenseType() {
+        // Use LicenseService for fresh license status if available
+        if (licenseService != null) {
+            return licenseService.getLicenseTypeName();
+        }
+
+        // Fallback to cached bean if service not available
+        if (applicationContext.containsBean("license")) {
+            return applicationContext.getBean("license", String.class);
+        }
+
+        return null;
+    }
+
+    /** Check if running Pro or higher (SERVER or ENTERPRISE license) dynamically. */
+    private Boolean isRunningProOrHigher() {
+        // Use LicenseService for fresh license status if available
+        if (licenseService != null) {
+            return licenseService.isRunningProOrHigher();
+        }
+
+        // Fallback to cached bean
+        if (applicationContext.containsBean("runningProOrHigher")) {
+            return applicationContext.getBean("runningProOrHigher", Boolean.class);
+        }
+
+        return null;
+    }
+
+    /** Check if running Enterprise edition dynamically. */
+    private Boolean isRunningEE() {
+        // Use LicenseService for fresh license status if available
+        if (licenseService != null) {
+            return licenseService.isRunningEE();
+        }
+
+        // Fallback to cached bean
+        if (applicationContext.containsBean("runningEE")) {
+            return applicationContext.getBean("runningEE", Boolean.class);
+        }
+
+        return null;
+    }
+
    @GetMapping("/app-config")
    public ResponseEntity<Map<String, Object>> getAppConfig() {
        Map<String, Object> configData = new HashMap<>();
@@ -101,6 +151,14 @@ public class ConfigController {
            configData.put("logoStyle", applicationProperties.getUi().getLogoStyle());
            configData.put("defaultLocale", applicationProperties.getSystem().getDefaultLocale());

+            // User preference defaults
+            configData.put(
+                    "defaultHideUnavailableTools",
+                    applicationProperties.getUi().isDefaultHideUnavailableTools());
+            configData.put(
+                    "defaultHideUnavailableConversions",
+                    applicationProperties.getUi().isDefaultHideUnavailableConversions());
+
            // Security settings
            // enableLogin requires both the config flag AND proprietary features to be loaded
            // If userService is null, proprietary module isn't loaded
@@ -185,19 +243,23 @@ public class ConfigController {
                    applicationProperties.getLegal().getAccessibilityStatement());

            // Try to get EEAppConfig values if available
+            // Get these dynamically to reflect current license status (not cached at startup)
            try {
-                if (applicationContext.containsBean("runningProOrHigher")) {
-                    configData.put(
-                            "runningProOrHigher",
-                            applicationContext.getBean("runningProOrHigher", Boolean.class));
+                Boolean runningProOrHigher = isRunningProOrHigher();
+                if (runningProOrHigher != null) {
+                    configData.put("runningProOrHigher", runningProOrHigher);
                }
-                if (applicationContext.containsBean("runningEE")) {
-                    configData.put(
-                            "runningEE", applicationContext.getBean("runningEE", Boolean.class));
+
+                Boolean runningEE = isRunningEE();
+                if (runningEE != null) {
+                    configData.put("runningEE", runningEE);
                }
-                if (applicationContext.containsBean("license")) {
-                    configData.put("license", applicationContext.getBean("license", String.class));
+
+                String licenseType = getCurrentLicenseType();
+                if (licenseType != null) {
+                    configData.put("license", licenseType);
                }
+
                if (applicationContext.containsBean("SSOAutoLogin")) {
                    configData.put(
                            "SSOAutoLogin",
@@ -256,11 +318,13 @@ public class ConfigController {

    @GetMapping("/endpoints-availability")
    public ResponseEntity<Map<String, EndpointAvailability>> getEndpointAvailability(
-            @RequestParam(name = "endpoints")
-                    @Size(min = 1, max = 100, message = "Must provide between 1 and 100 endpoints")
-                    List<@NotBlank String> endpoints) {
+            @RequestParam(name = "endpoints", required = false) List<String> endpoints) {
+        Collection<String> toCheck =
+                (endpoints == null || endpoints.isEmpty())
+                        ? endpointConfiguration.getAllEndpoints()
+                        : endpoints;
        Map<String, EndpointAvailability> result = new HashMap<>();
-        for (String endpoint : endpoints) {
+        for (String endpoint : toCheck) {
            String trimmedEndpoint = endpoint.trim();
            result.put(
                    trimmedEndpoint,
@@ -82,9 +82,8 @@ public class ExtractImagesController {
        Set<byte[]> processedImages = new HashSet<>();

        if (useMultithreading) {
-            // Executor service to handle multithreading
-            ExecutorService executor =
-                    Executors.newFixedThreadPool(Runtime.getRuntime().availableProcessors());
+            // Virtual thread executor — lightweight threads ideal for I/O-bound image extraction
+            ExecutorService executor = Executors.newVirtualThreadPerTaskExecutor();
            Set<Future<Void>> futures = new HashSet<>();

            // Safely iterate over each page, handling corrupt PDFs where page count might be wrong
@@ -246,10 +246,12 @@ public class OCRController {
            command.add("--clean-final");
        }
        if (ocrType != null && !ocrType.isEmpty()) {
-            if ("skip-text".equals(ocrType)) {
-                command.add("--skip-text");
-            } else if ("force-ocr".equals(ocrType)) {
+            if ("force-ocr".equals(ocrType)) {
                command.add("--force-ocr");
+            } else {
+                // Default for 'Normal' and 'skip-text': use --skip-text
+                // ocrmypdf 17+ requires explicit flag when PDF already contains text
+                command.add("--skip-text");
            }
        }
        command.add("--invalidate-digital-signatures");
@@ -378,11 +380,12 @@ public class OCRController {
                        List<String> command = new ArrayList<>();
                        command.add("tesseract");
                        command.add(imagePath.toString());
-                        command.add(
+                        String outputBase =
                                new File(
                                                tempOutputDir,
                                                String.format(Locale.ROOT, "page_%d", pageNum))
-                                        .toString());
+                                        .toString();
+                        command.add(outputBase);
                        command.add("-l");
                        command.add(String.join("+", selectedLanguages));
                        command.add("pdf"); // Always output PDF
@@ -400,6 +403,18 @@ public class OCRController {
                                    result.getRc());
                        }

+                        // Verify the OCR'd PDF was created
+                        if (!pageOutputPath.exists()) {
+                            log.warn(
+                                    "Tesseract did not create expected output file: {}. Page may be blank or unreadable.",
+                                    pageOutputPath.getAbsolutePath());
+                            // Save original page without OCR as fallback
+                            try (PDDocument pageDoc = new PDDocument()) {
+                                pageDoc.addPage(page);
+                                pageDoc.save(pageOutputPath);
+                            }
+                        }
+
                        // Add OCR'd PDF to merger
                        merger.addSource(pageOutputPath);
                    } else {
@@ -55,45 +55,45 @@ public class OverlayImageController {

            boolean isSvg = SvgOverlayUtil.isSvgImage(imageBytes);

-            PDDocument document = pdfDocumentFactory.load(pdfBytes);
+            try (PDDocument document = pdfDocumentFactory.load(pdfBytes)) {
+                int pages = document.getNumberOfPages();
+                for (int i = 0; i < pages; i++) {
+                    PDPage page = document.getPage(i);

-            int pages = document.getNumberOfPages();
-            for (int i = 0; i < pages; i++) {
-                PDPage page = document.getPage(i);
+                    if (isSvg) {
+                        SvgOverlayUtil.overlaySvgOnPage(document, page, imageBytes, x, y);
+                    } else {
+                        try (PDPageContentStream contentStream =
+                                new PDPageContentStream(
+                                        document,
+                                        page,
+                                        PDPageContentStream.AppendMode.APPEND,
+                                        true,
+                                        true)) {
+                            PDImageXObject image =
+                                    PDImageXObject.createFromByteArray(document, imageBytes, "");
+                            contentStream.drawImage(image, x, y);
+                            log.info("Image successfully overlaid onto PDF page {}", i);
+                        }
+                    }

-                if (isSvg) {
-                    SvgOverlayUtil.overlaySvgOnPage(document, page, imageBytes, x, y);
-                } else {
-                    try (PDPageContentStream contentStream =
-                            new PDPageContentStream(
-                                    document,
-                                    page,
-                                    PDPageContentStream.AppendMode.APPEND,
-                                    true,
-                                    true)) {
-                        PDImageXObject image =
-                                PDImageXObject.createFromByteArray(document, imageBytes, "");
-                        contentStream.drawImage(image, x, y);
-                        log.info("Image successfully overlaid onto PDF page {}", i);
+                    if (!everyPage && i == 0) {
+                        break;
                    }
                }

-                if (!everyPage && i == 0) {
-                    break;
-                }
+                ByteArrayOutputStream baos = new ByteArrayOutputStream();
+                document.save(baos);
+
+                byte[] result = baos.toByteArray();
+                log.info("PDF with overlaid image successfully created");
+
+                return WebResponseUtils.bytesToWebResponse(
+                        result,
+                        GeneralUtils.generateFilename(
+                                pdfFile.getOriginalFilename(), "_overlayed.pdf"));
            }

-            ByteArrayOutputStream baos = new ByteArrayOutputStream();
-            document.save(baos);
-            document.close();
-
-            byte[] result = baos.toByteArray();
-            log.info("PDF with overlaid image successfully created");
-
-            return WebResponseUtils.bytesToWebResponse(
-                    result,
-                    GeneralUtils.generateFilename(pdfFile.getOriginalFilename(), "_overlayed.pdf"));
-
        } catch (IOException e) {
            log.error("Failed to add image to PDF", e);
            return new ResponseEntity<>(HttpStatus.BAD_REQUEST);
@@ -52,9 +52,17 @@ public class PageNumbersController {
        int pageNumber = request.getStartingNumber();
        String pagesToNumber = request.getPagesToNumber();
        String customText = request.getCustomText();
+        int zeroPad = request.getZeroPad();
        float fontSize = request.getFontSize();
        String fontType = request.getFontType();
        String fontColor = request.getFontColor();
+        // compute padded number string where requested
+        String formatN;
+        if (zeroPad > 0) {
+            formatN = String.format("%%0%dd", Math.max(0, zeroPad));
+        } else {
+            formatN = "%d";
+        }

        Color color = Color.BLACK;
        if (fontColor != null && !fontColor.trim().isEmpty()) {
@@ -93,9 +101,10 @@ public class PageNumbersController {
                PDPage page = document.getPage(i);
                PDRectangle pageSize = page.getMediaBox();

+                String nFormatted = String.format(formatN, pageNumber);
                String text =
                        customText
-                                .replace("{n}", String.valueOf(pageNumber))
+                                .replace("{n}", nFormatted)
                                .replace("{total}", String.valueOf(document.getNumberOfPages()))
                                .replace(
                                        "{filename}",
@@ -57,6 +57,7 @@ import stirling.software.common.util.WebResponseUtils;
@RequiredArgsConstructor
 public class StampController {

+    private static final Pattern NEWLINE_PATTERN = Pattern.compile("\\r?\\n");
    private final CustomPDFDocumentFactory pdfDocumentFactory;
    private final TempFileManager tempFileManager;

@@ -266,7 +267,7 @@ public class StampController {
                        .getEscapedNewlinePattern()
                        .matcher(processedStampText)
                        .replaceAll("\n");
-        String[] lines = normalizedText.split("\\r?\\n");
+        String[] lines = NEWLINE_PATTERN.split(normalizedText);

        PDRectangle pageSize = page.getMediaBox();

@@ -14,10 +14,6 @@ import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;

-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.JsonMappingException;
-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import io.swagger.v3.oas.annotations.Operation;

 import lombok.RequiredArgsConstructor;
@@ -34,6 +30,10 @@ import stirling.software.common.service.PostHogService;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.WebResponseUtils;

+import tools.jackson.core.JacksonException;
+import tools.jackson.databind.DatabindException;
+import tools.jackson.databind.ObjectMapper;
+
@PipelineApi
@Slf4j
@RequiredArgsConstructor
@@ -54,7 +54,7 @@ public class PipelineController {
                            + "Users provide files and a JSON configuration defining the sequence of operations to perform. "
                            + "Input:PDF Output:PDF/ZIP Type:MIMO")
    public ResponseEntity<byte[]> handleData(@ModelAttribute HandleDataRequest request)
-            throws JsonMappingException, JsonProcessingException {
+            throws DatabindException, JacksonException {
        MultipartFile[] files = request.getFileInput();
        String jsonString = request.getJson();
        if (files == null) {
@@ -21,14 +21,13 @@ import java.util.List;
 import java.util.Locale;
 import java.util.Map;
 import java.util.Optional;
+import java.util.regex.Pattern;
 import java.util.stream.Stream;

 import org.springframework.core.io.Resource;
 import org.springframework.scheduling.annotation.Scheduled;
 import org.springframework.stereotype.Service;

-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import lombok.extern.slf4j.Slf4j;

 import stirling.software.SPDF.model.PipelineConfig;
@@ -39,11 +38,14 @@ import stirling.software.common.configuration.RuntimePathConfig;
 import stirling.software.common.service.PostHogService;
 import stirling.software.common.util.FileMonitor;

+import tools.jackson.databind.ObjectMapper;
+
@Service
@Slf4j
 public class PipelineDirectoryProcessor {

    private static final int MAX_DIRECTORY_DEPTH = 50; // Prevent excessive recursion
+    private static final Pattern WATCHED_FOLDERS_PATTERN = Pattern.compile("\\\\?watchedFolders");

    private final ObjectMapper objectMapper;
    private final ApiDocService apiDocService;
@@ -433,10 +435,12 @@ public class PipelineDirectoryProcessor {

    private Path determineOutputPath(PipelineConfig config, Path dir) {
        String outputDir =
-                config.getOutputDir()
-                        .replace("{outputFolder}", finishedFoldersDir)
-                        .replace("{folderName}", dir.toString())
-                        .replaceAll("\\\\?watchedFolders", "");
+                WATCHED_FOLDERS_PATTERN
+                        .matcher(
+                                config.getOutputDir()
+                                        .replace("{outputFolder}", finishedFoldersDir)
+                                        .replace("{folderName}", dir.toString()))
+                        .replaceAll("");
        return Paths.get(outputDir).isAbsolute() ? Paths.get(outputDir) : Paths.get(".", outputDir);
    }

@@ -47,10 +47,6 @@ import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;

-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.node.ArrayNode;
-import com.fasterxml.jackson.databind.node.ObjectNode;
-
 import io.swagger.v3.oas.annotations.Operation;

 import lombok.RequiredArgsConstructor;
@@ -66,6 +62,11 @@ import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.RegexPatternUtils;
 import stirling.software.common.util.WebResponseUtils;

+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
+import tools.jackson.databind.node.ArrayNode;
+import tools.jackson.databind.node.ObjectNode;
+
@SecurityApi
@Slf4j
@RequiredArgsConstructor
@@ -77,7 +78,7 @@ public class GetInfoOnPDF {
    private static final String PAGE_PREFIX = "Page ";
    private static final long MAX_FILE_SIZE = 100L * 1024 * 1024;

-    private static final ObjectMapper objectMapper = new ObjectMapper();
+    private static final ObjectMapper objectMapper = JsonMapper.builder().build();

    private final CustomPDFDocumentFactory pdfDocumentFactory;
    private final VeraPDFService veraPDFService;
@@ -33,6 +33,8 @@ import org.springframework.web.multipart.MultipartFile;

 import io.swagger.v3.oas.annotations.Operation;

+import jakarta.validation.Valid;
+
 import lombok.RequiredArgsConstructor;

 import stirling.software.SPDF.config.swagger.StandardPdfResponse;
@@ -71,7 +73,7 @@ public class WatermarkController {
                    "This endpoint adds a watermark to a given PDF file. Users can specify the"
                            + " watermark type (text or image), rotation, opacity, width spacer, and"
                            + " height spacer. Input:PDF Output:PDF Type:SISO")
-    public ResponseEntity<byte[]> addWatermark(@ModelAttribute AddWatermarkRequest request)
+    public ResponseEntity<byte[]> addWatermark(@Valid @ModelAttribute AddWatermarkRequest request)
            throws IOException, Exception {
        MultipartFile pdfFile = request.getFileInput();
        String pdfFileName = pdfFile.getOriginalFilename();
@@ -237,8 +239,8 @@ public class WatermarkController {

        // Calculating the number of rows and columns.

-        int watermarkRows = (int) (pageHeight / newWatermarkHeight + 1);
-        int watermarkCols = (int) (pageWidth / newWatermarkWidth + 1);
+        int watermarkRows = Math.min((int) (pageHeight / newWatermarkHeight + 1), 10_000);
+        int watermarkCols = Math.min((int) (pageWidth / newWatermarkWidth + 1), 10_000);

        // Add the text watermark
        for (int i = 0; i <= watermarkRows; i++) {
@@ -290,9 +292,15 @@ public class WatermarkController {
        float pageWidth = page.getMediaBox().getWidth();
        float pageHeight = page.getMediaBox().getHeight();
        int watermarkRows =
-                (int) ((pageHeight + heightSpacer) / (desiredPhysicalHeight + heightSpacer));
+                Math.min(
+                        (int)
+                                ((pageHeight + heightSpacer)
+                                        / (desiredPhysicalHeight + heightSpacer)),
+                        10_000);
        int watermarkCols =
-                (int) ((pageWidth + widthSpacer) / (desiredPhysicalWidth + widthSpacer));
+                Math.min(
+                        (int) ((pageWidth + widthSpacer) / (desiredPhysicalWidth + widthSpacer)),
+                        10_000);

        for (int i = 0; i < watermarkRows; i++) {
            for (int j = 0; j < watermarkCols; j++) {
@@ -1,5 +1,7 @@
 package stirling.software.SPDF.controller.web;

+import java.io.IOException;
+import java.io.InputStream;
 import java.time.Duration;
 import java.time.LocalDateTime;
 import java.util.*;
@@ -54,10 +56,27 @@ public class MetricsController {
        }
        Map<String, String> status = new HashMap<>();
        status.put("status", "UP");
-        status.put("version", getClass().getPackage().getImplementationVersion());
+        String version = getClass().getPackage().getImplementationVersion();
+        if (version == null) {
+            version = getVersionFromProperties();
+        }
+        status.put("version", version);
        return ResponseEntity.ok(status);
    }

+    private String getVersionFromProperties() {
+        try (InputStream is = getClass().getResourceAsStream("/version.properties")) {
+            if (is != null) {
+                Properties props = new Properties();
+                props.load(is);
+                return props.getProperty("version");
+            }
+        } catch (IOException e) {
+            log.error("Failed to load version.properties", e);
+        }
+        return null;
+    }
+
    @GetMapping("/load")
    @Operation(
            summary = "GET request count",
@@ -6,6 +6,7 @@ import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
+import java.util.regex.Pattern;

 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.core.io.ClassPathResource;
@@ -28,6 +29,8 @@ public class ReactRoutingController {

    private static final org.slf4j.Logger log =
            org.slf4j.LoggerFactory.getLogger(ReactRoutingController.class);
+    private static final Pattern BASE_HREF_PATTERN =
+            Pattern.compile("<base href=\\\"[^\\\"]*\\\"\\s*/?>");

    @Value("${server.servlet.context-path:/}")
    private String contextPath;
@@ -94,9 +97,9 @@ public class ReactRoutingController {
                html = html.replace("%BASE_URL%", baseUrl);
                // Also rewrite any existing <base> tag (Vite may have baked one in)
                html =
-                        html.replaceFirst(
-                                "<base href=\\\"[^\\\"]*\\\"\\s*/?>",
-                                "<base href=\\\"" + baseUrl + "\\\" />");
+                        BASE_HREF_PATTERN
+                                .matcher(html)
+                                .replaceFirst("<base href=\\\"" + baseUrl + "\\\" />");

                // Inject context path as a global variable for API calls
                String contextPathScript =
@@ -23,6 +23,8 @@ import org.springframework.web.multipart.MaxUploadSizeExceededException;
 import org.springframework.web.multipart.support.MissingServletRequestPartException;
 import org.springframework.web.servlet.NoHandlerFoundException;

+import com.fasterxml.jackson.databind.ObjectMapper;
+
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;

@@ -190,6 +192,31 @@ public class GlobalExceptionHandler {
        return problemDetail;
    }

+    /**
+     * Checks whether the given IOException indicates that the client disconnected before the
+     * response could be written (broken pipe, connection reset, etc.). When this happens there is
+     * no point in serialising a {@link ProblemDetail} body because the socket is already closed —
+     * and attempting to do so may trigger a secondary {@code HttpMessageNotWritableException} if
+     * the response Content-Type was already committed as a non-JSON type (e.g. image/png).
+     */
+    private static boolean isClientDisconnectException(IOException ex) {
+        // Walk the causal chain — Jetty/Tomcat may wrap the low-level SocketException
+        Throwable current = ex;
+        while (current != null) {
+            String msg = current.getMessage();
+            if (msg != null) {
+                String lower = msg.toLowerCase(java.util.Locale.ROOT);
+                if (lower.contains("broken pipe")
+                        || lower.contains("connection reset")
+                        || lower.contains("an established connection was aborted")) {
+                    return true;
+                }
+            }
+            current = current.getCause();
+        }
+        return false;
+    }
+
    /**
     * Helper method to create a standardized ProblemDetail response for exceptions with error
     * codes.
@@ -841,21 +868,24 @@ public class GlobalExceptionHandler {
        response.setContentType("application/problem+json");
        response.setCharacterEncoding("UTF-8");

-        String errorJson =
-                String.format(
-                        """
-                {
-                    "type": "about:blank",
-                    "title": "Not Acceptable",
-                    "status": 406,
-                    "detail": "The requested resource could not be returned in an acceptable format. Error responses are returned as JSON.",
-                    "instance": "%s",
-                    "timestamp": "%s",
-                    "hints": ["Error responses are always returned as application/json or application/problem+json", "Set Accept header to include application/json for proper error handling"]
-                }
-                """,
-                        request.getRequestURI(), Instant.now().toString());
+        // Use ObjectMapper to properly escape JSON values and prevent XSS
+        ObjectMapper mapper = new ObjectMapper();
+        java.util.Map<String, Object> errorMap = new java.util.LinkedHashMap<>();
+        errorMap.put("type", "about:blank");
+        errorMap.put("title", "Not Acceptable");
+        errorMap.put("status", 406);
+        errorMap.put(
+                "detail",
+                "The requested resource could not be returned in an acceptable format. Error responses are returned as JSON.");
+        errorMap.put("instance", request.getRequestURI());
+        errorMap.put("timestamp", Instant.now().toString());
+        errorMap.put(
+                "hints",
+                java.util.Arrays.asList(
+                        "Error responses are always returned as application/json or application/problem+json",
+                        "Set Accept header to include application/json for proper error handling"));

+        String errorJson = mapper.writeValueAsString(errorMap);
        response.getWriter().write(errorJson);
        response.getWriter().flush();
    }
@@ -1107,6 +1137,15 @@ public class GlobalExceptionHandler {
    public ResponseEntity<ProblemDetail> handleIOException(
            IOException ex, HttpServletRequest request) {

+        // Broken pipe / connection reset means the client disconnected.
+        // Attempting to write a ProblemDetail response will fail because the
+        // response Content-Type may already be committed (e.g. image/png) and
+        // the client is gone anyway. Log at WARN and return an empty body.
+        if (isClientDisconnectException(ex)) {
+            log.warn("Client disconnected at {}: {}", request.getRequestURI(), ex.getMessage());
+            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).build();
+        }
+
        // Check if this is a PDF-specific error and wrap it appropriately
        IOException processedException =
                ExceptionUtils.handlePdfException(ex, request.getRequestURI());
@@ -3,10 +3,10 @@ package stirling.software.SPDF.model;
 import java.util.HashMap;
 import java.util.Map;

-import com.fasterxml.jackson.databind.JsonNode;
-
 import lombok.Getter;

+import tools.jackson.databind.JsonNode;
+
 public class ApiEndpoint {
    private final String name;
    private Map<String, JsonNode> parameters;
@@ -18,10 +18,10 @@ public class ApiEndpoint {
        postNode.path("parameters")
                .forEach(
                        paramNode -> {
-                            String paramName = paramNode.path("name").asText();
+                            String paramName = paramNode.path("name").asText("");
                            parameters.put(paramName, paramNode);
                        });
-        this.description = postNode.path("description").asText();
+        this.description = postNode.path("description").asText("");
    }

    public boolean areParametersValid(Map<String, Object> providedParams) {
@@ -2,6 +2,9 @@ package stirling.software.SPDF.model.api;

 import io.swagger.v3.oas.annotations.media.Schema;

+import jakarta.validation.constraints.Max;
+import jakarta.validation.constraints.Min;
+
 import lombok.Data;
 import lombok.EqualsAndHashCode;

@@ -33,6 +36,8 @@ public class SplitPdfBySectionsRequest extends PDFFile {
            defaultValue = "0",
            minimum = "0",
            requiredMode = Schema.RequiredMode.REQUIRED)
+    @Min(value = 0, message = "Horizontal divisions must be non-negative")
+    @Max(value = 50, message = "Horizontal divisions must not exceed 50")
    private int horizontalDivisions;

    @Schema(
@@ -40,6 +45,8 @@ public class SplitPdfBySectionsRequest extends PDFFile {
            defaultValue = "1",
            minimum = "0",
            requiredMode = Schema.RequiredMode.REQUIRED)
+    @Min(value = 0, message = "Vertical divisions must be non-negative")
+    @Max(value = 50, message = "Vertical divisions must not exceed 50")
    private int verticalDivisions;

    @Schema(
@@ -16,4 +16,9 @@ public class PdfToPdfARequest extends PDFFile {
            requiredMode = Schema.RequiredMode.REQUIRED,
            allowableValues = {"pdfa", "pdfa-1", "pdfa-2", "pdfa-2b", "pdfa-3", "pdfa-3b", "pdfx"})
    private String outputFormat;
+
+    @Schema(
+            description =
+                    "If true, the conversion will fail if the output is not perfectly compliant")
+    private Boolean strict = false;
 }
@@ -0,0 +1,41 @@
+package stirling.software.SPDF.model.api.general;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+
+import stirling.software.common.model.api.PDFFile;
+
+@Data
+@EqualsAndHashCode(callSuper = true)
+public class PosterPdfRequest extends PDFFile {
+
+    @Schema(
+            description = "Target page size for output chunks (e.g., 'A4', 'Letter', 'A3')",
+            requiredMode = Schema.RequiredMode.REQUIRED,
+            allowableValues = {"A4", "Letter", "A3", "A5", "Legal", "Tabloid"})
+    private String pageSize = "A4";
+
+    @Schema(
+            description = "Horizontal decimation factor (how many columns to split into)",
+            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
+            defaultValue = "2",
+            minimum = "1",
+            maximum = "10")
+    private int xFactor = 2;
+
+    @Schema(
+            description = "Vertical decimation factor (how many rows to split into)",
+            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
+            defaultValue = "2",
+            minimum = "1",
+            maximum = "10")
+    private int yFactor = 2;
+
+    @Schema(
+            description = "Split right-to-left instead of left-to-right",
+            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
+            defaultValue = "false")
+    private boolean rightToLeft = false;
+}
@@ -39,6 +39,14 @@ public class AddPageNumbersRequest extends PDFWithPageNums {
            requiredMode = RequiredMode.NOT_REQUIRED)
    private String fontColor;

+    @Schema(
+            description =
+                    "Zero-padding width for page numbers (Bates Stamping). Set to 0 to disable padding",
+            minimum = "0",
+            defaultValue = "0",
+            requiredMode = RequiredMode.NOT_REQUIRED)
+    private int zeroPad = 0;
+
    @Schema(
            description =
                    "Position: 1-9 representing positions on the page (1=top-left, 2=top-center,"
--- a/Show More
+++ b/Show More