Fix posthog import

Any task that changes file type or produces more/fewer files than the
input are now consumed as root files not incremented versions of the
input.

.dockerignore

@@ -1,75 +1,52 @@
-# Node modules and build artifacts
-node_modules
-frontend/node_modules
-frontend/dist
-frontend/build
-frontend/.vite
-frontend/.tauri
-frontend/src-tauri/target
-
-# Gradle build artifacts
-.gradle
-build
-bin
-target
-out
-
-# Git
-.git
+# Version control
+.git/
 .gitignore
 
-# IDE
-.vscode
-.idea
+# Build outputs
+build/
+*/build/
+**/build/
+out/
+target/
+
+# Gradle caches (local, not what's in the container)
+.gradle/
+**/.gradle/
+
+# Node / frontend
+node_modules/
+**/node_modules/
+.npm/
+.yarn/
+
+# IDE and editor
+.idea/
+.vscode/
 *.iml
-*.iws
 *.ipr
+*.iws
 
-# Logs
+# Logs and temp files
 *.log
-logs
-
-# Environment files
-.env
-.env.*
-!.env.example
-
-# OS files
+*.tmp
+*.pid
 .DS_Store
 Thumbs.db
 
-# Java compiled files
-*.class
-*.jar
-*.war
-*.ear
-
-# Test reports
-test-results
-coverage
-
-# Docker
-docker-compose.override.yml
+# Docker itself
+Dockerfile*
 .dockerignore
 
-# Temporary files
-tmp
-temp
-*.tmp
-*.swp
-*~
-
-# Runtime database and config files (locked by running app)
-app/core/configs/**
-stirling/**
-stirling-pdf-DB*.mv.db
-stirling-pdf-DB*.trace.db
-
-# Documentation
-*.md
-!README.md
-docs
-
-# CI/CD
-.github
+# CI / CD configs (not needed in build context)
+.github/
+.circleci/
 .gitlab-ci.yml
+
+# Test reports
+**/test-results/
+**/jacoco/
+
+# Local env
+.env
+.env.*
+!.env.example

.github/dependabot.yml

@@ -68,3 +68,8 @@ updates:
     schedule:
       interval: "weekly"
     rebase-strategy: "auto"
+
+  - package-ecosystem: cargo
+    directory: /frontend/src-tauri/provisioner
+    schedule:
+      interval: daily

.github/scripts/requirements_dev.txt

@@ -9,7 +9,7 @@
 # CVE-2025-6176 mitigation: pin brotli to a specific commit
 brotli @ git+https://github.com/google/brotli.git@028fb5a23661f123017c060daa546b55cf4bde29
     # via
-    #   -r .github/scripts/requirements_dev.in
+    #   -r requirements_dev.in
     #   fonttools
 cffi==2.0.0 \
     --hash=sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb \
@@ -256,105 +256,105 @@ opencv-python-headless==4.13.0.90 \
     --hash=sha256:e13790342591557050157713af17a7435ac1b50c65282715093c9297fa045d8f \
     --hash=sha256:eba38bc255d0b7d1969c5bcc90a060ca2b61a3403b613872c750bfa5dfe9e03b \
     --hash=sha256:f46b17ea0aa7e4124ca6ad71143f89233ae9557f61d2326bcdb34329a1ddf9bd
-    # via -r .github/scripts/requirements_dev.in
+    # via -r requirements_dev.in
 pdf2image==1.17.0 \
     --hash=sha256:eaa959bc116b420dd7ec415fcae49b98100dda3dd18cd2fdfa86d09f112f6d57 \
     --hash=sha256:ecdd58d7afb810dffe21ef2b1bbc057ef434dabbac6c33778a38a3f7744a27e2
-    # via -r .github/scripts/requirements_dev.in
-pillow==12.1.0 \
-    --hash=sha256:00162e9ca6d22b7c3ee8e61faa3c3253cd19b6a37f126cad04f2f88b306f557d \
-    --hash=sha256:079af2fb0c599c2ec144ba2c02766d1b55498e373b3ac64687e43849fbbef5bc \
-    --hash=sha256:0b022eaaf709541b391ee069f0022ee5b36c709df71986e3f7be312e46f42c84 \
-    --hash=sha256:0c27407a2d1b96774cbc4a7594129cc027339fd800cd081e44497722ea1179de \
-    --hash=sha256:0ddedfaa8b5f0b4ffbc2fa87b556dc59f6bb4ecb14a53b33f9189713ae8053c0 \
-    --hash=sha256:0deedf2ea233722476b3a81e8cdfbad786f7adbed5d848469fa59fe52396e4ef \
-    --hash=sha256:0ed07dca4a8464bada6139ab38f5382f83e5f111698caf3191cb8dbf27d908b4 \
-    --hash=sha256:0fde7ec5538ab5095cc02df38ee99b0443ff0e1c847a045554cf5f9af1f4aa82 \
-    --hash=sha256:15c794d74303828eaa957ff8070846d0efe8c630901a1c753fdc63850e19ecd9 \
-    --hash=sha256:1a949604f73eb07a8adab38c4fe50791f9919344398bdc8ac6b307f755fc7030 \
-    --hash=sha256:1f345e7bc9d7f368887c712aa5054558bad44d2a301ddf9248599f4161abc7c0 \
-    --hash=sha256:1fcc52d86ce7a34fd17cb04e87cfdb164648a3662a6f20565910a99653d66c18 \
-    --hash=sha256:21e686a21078b0f9cb8c8a961d99e6a4ddb88e0fc5ea6e130172ddddc2e5221a \
-    --hash=sha256:2415373395a831f53933c23ce051021e79c8cd7979822d8cc478547a3f4da8ef \
-    --hash=sha256:277518bf4fe74aa91489e1b20577473b19ee70fb97c374aa50830b279f25841b \
-    --hash=sha256:27b9baecb428899db6c0de572d6d305cfaf38ca1596b5c0542a5182e3e74e8c6 \
-    --hash=sha256:29a4cef9cb672363926f0470afc516dbf7305a14d8c54f7abbb5c199cd8f8179 \
-    --hash=sha256:3413c2ae377550f5487991d444428f1a8ae92784aac79caa8b1e3b89b175f77e \
-    --hash=sha256:351889afef0f485b84078ea40fe33727a0492b9af3904661b0abbafee0355b72 \
-    --hash=sha256:3ffaa2f0659e2f740473bcf03c702c39a8d4b2b7ffc629052028764324842c64 \
-    --hash=sha256:40a8e3b9e8773876d6e30daed22f016509e3987bab61b3b7fe309d7019a87451 \
-    --hash=sha256:414b9a78e14ffeb98128863314e62c3f24b8a86081066625700b7985b3f529bd \
-    --hash=sha256:43aca0a55ce1eefc0aefa6253661cb54571857b1a7b2964bd8a1e3ef4b729924 \
-    --hash=sha256:43b4899cfd091a9693a1278c4982f3e50f7fb7cff5153b05174b4afc9593b616 \
-    --hash=sha256:461f9dfdafa394c59cd6d818bdfdbab4028b83b02caadaff0ffd433faf4c9a7a \
-    --hash=sha256:4f9f6a650743f0ddee5593ac9e954ba1bdbc5e150bc066586d4f26127853ab94 \
-    --hash=sha256:53d8b764726d3af1a138dd353116f774e3862ec7e3794e0c8781e30db0f35dfc \
-    --hash=sha256:565c986f4b45c020f5421a4cea13ef294dde9509a8577f29b2fc5edc7587fff8 \
-    --hash=sha256:5c5ae0a06e9ea030ab786b0251b32c7e4ce10e58d983c0d5c56029455180b5b9 \
-    --hash=sha256:5cb7bc1966d031aec37ddb9dcf15c2da5b2e9f7cc3ca7c54473a20a927e1eb91 \
-    --hash=sha256:5da841d81b1a05ef940a8567da92decaa15bc4d7dedb540a8c219ad83d91808a \
-    --hash=sha256:5fee4c04aad8932da9f8f710af2c1a15a83582cfb884152a9caa79d4efcdbf9c \
-    --hash=sha256:609e89d9f90b581c8d16358c9087df76024cf058fa693dd3e1e1620823f39670 \
-    --hash=sha256:6258f3260986990ba2fa8a874f8b6e808cf5abb51a94015ca3dc3c68aa4f30ea \
-    --hash=sha256:64efdf00c09e31efd754448a383ea241f55a994fd079866b92d2bbff598aad91 \
-    --hash=sha256:65b80c1ee7e14a87d6a068dd3b0aea268ffcabfe0498d38661b00c5b4b22e74c \
-    --hash=sha256:6741e6f3074a35e47c77b23a4e4f2d90db3ed905cb1c5e6e0d49bff2045632bc \
-    --hash=sha256:681088909d7e8fa9e31b9799aaa59ba5234c58e5e4f1951b4c4d1082a2e980e0 \
-    --hash=sha256:6b7a9d1db5dad90e2991645874f708e87d9a3c370c243c2d7684d28f7e133e6b \
-    --hash=sha256:7315f9137087c4e0ee73a761b163fc9aa3b19f5f606a7fc08d83fd3e4379af65 \
-    --hash=sha256:742aea052cf5ab5034a53c3846165bc3ce88d7c38e954120db0ab867ca242661 \
-    --hash=sha256:75af0b4c229ac519b155028fa1be632d812a519abba9b46b20e50c6caa184f19 \
-    --hash=sha256:7b5dd7cbae20285cdb597b10eb5a2c13aa9de6cde9bb64a3c1317427b1db1ae1 \
-    --hash=sha256:7d6daa89a00b58c37cb1747ec9fb7ac3bc5ffd5949f5888657dfddde6d1312e0 \
-    --hash=sha256:800429ac32c9b72909c671aaf17ecd13110f823ddb7db4dfef412a5587c2c24e \
-    --hash=sha256:806f3987ffe10e867bab0ddad45df1148a2b98221798457fa097ad85d6e8bc75 \
-    --hash=sha256:808b99604f7873c800c4840f55ff389936ef1948e4e87645eaf3fccbc8477ac4 \
-    --hash=sha256:80941e6d573197a0c28f394753de529bb436b1ca990ed6e765cf42426abc39f8 \
-    --hash=sha256:84cabc7095dd535ca934d57e9ce2a72ffd216e435a84acb06b2277b1de2689bd \
-    --hash=sha256:8637e29d13f478bc4f153d8daa9ffb16455f0a6cb287da1b432fdad2bfbd66c7 \
-    --hash=sha256:896866d2d436563fa2a43a9d72f417874f16b5545955c54a64941e87c1376c61 \
-    --hash=sha256:8e178e3e99d3c0ea8fc64b88447f7cac8ccf058af422a6cedc690d0eadd98c51 \
-    --hash=sha256:907bfa8a9cb790748a9aa4513e37c88c59660da3bcfffbd24a7d9e6abf224551 \
-    --hash=sha256:9212d6b86917a2300669511ed094a9406888362e085f2431a7da985a6b124f45 \
-    --hash=sha256:92a7fe4225365c5e3a8e598982269c6d6698d3e783b3b1ae979e7819f9cd55c1 \
-    --hash=sha256:935b9d1aed48fcfb3f838caac506f38e29621b44ccc4f8a64d575cb1b2a88644 \
-    --hash=sha256:97e9993d5ed946aba26baf9c1e8cf18adbab584b99f452ee72f7ee8acb882796 \
-    --hash=sha256:983976c2ab753166dc66d36af6e8ec15bb511e4a25856e2227e5f7e00a160587 \
-    --hash=sha256:9f5fefaca968e700ad1a4a9de98bf0869a94e397fe3524c4c9450c1445252304 \
-    --hash=sha256:a332ac4ccb84b6dde65dbace8431f3af08874bf9770719d32a635c4ef411b18b \
-    --hash=sha256:a40905599d8079e09f25027423aed94f2823adaf2868940de991e53a449e14a8 \
-    --hash=sha256:a6dfc2af5b082b635af6e08e0d1f9f1c4e04d17d4e2ca0ef96131e85eda6eb17 \
-    --hash=sha256:a786bf667724d84aa29b5db1c61b7bfdde380202aaca12c3461afd6b71743171 \
-    --hash=sha256:a83e0850cb8f5ac975291ebfc4170ba481f41a28065277f7f735c202cd8e0af3 \
-    --hash=sha256:aa0c9cc0b82b14766a99fbe6084409972266e82f459821cd26997a488a7261a7 \
-    --hash=sha256:b17fbdbe01c196e7e159aacb889e091f28e61020a8abeac07b68079b6e626988 \
-    --hash=sha256:b63e13dd27da389ed9475b3d28510f0f954bca0041e8e551b2a4eb1eab56a39a \
-    --hash=sha256:b6e53e82ec2db0717eabb276aa56cf4e500c9a7cec2c2e189b55c24f65a3e8c0 \
-    --hash=sha256:bb0984b30e973f7e2884362b7d23d0a348c7143ee559f38ef3eaab640144204c \
-    --hash=sha256:bc11908616c8a283cf7d664f77411a5ed2a02009b0097ff8abbba5e79128ccf2 \
-    --hash=sha256:bdec5e43377761c5dbca620efb69a77f6855c5a379e32ac5b158f54c84212b14 \
-    --hash=sha256:bef9768cab184e7ae6e559c032e95ba8d07b3023c289f79a2bd36e8bf85605a5 \
-    --hash=sha256:c990547452ee2800d8506c4150280757f88532f3de2a58e3022e9b179107862a \
-    --hash=sha256:ca94b6aac0d7af2a10ba08c0f888b3d5114439b6b3ef39968378723622fed377 \
-    --hash=sha256:cad302dc10fac357d3467a74a9561c90609768a6f73a1923b0fd851b6486f8b0 \
-    --hash=sha256:d0a7735df32ccbcc98b98a1ac785cc4b19b580be1bdf0aeb5c03223220ea09d5 \
-    --hash=sha256:d70347c8a5b7ccd803ec0c85c8709f036e6348f1e6a5bf048ecd9c64d3550b8b \
-    --hash=sha256:d70534cea9e7966169ad29a903b99fc507e932069a881d0965a1a84bb57f6c6d \
-    --hash=sha256:db44d5c160a90df2d24a24760bbd37607d53da0b34fb546c4c232af7192298ac \
-    --hash=sha256:e115c15e3bc727b1ca3e641a909f77f8ca72a64fff150f666fcc85e57701c26c \
-    --hash=sha256:e2479c7f02f9d505682dc47df8c0ea1fc5e264c4d1629a5d63fe3e2334b89554 \
-    --hash=sha256:e5dcbe95016e88437ecf33544ba5db21ef1b8dd6e1b434a2cb2a3d605299e643 \
-    --hash=sha256:e6bdb408f7c9dd2a5ff2b14a3b0bb6d4deb29fb9961e6eb3ae2031ae9a5cec13 \
-    --hash=sha256:e75d3dba8fc1ddfec0cd752108f93b83b4f8d6ab40e524a95d35f016b9683b09 \
-    --hash=sha256:efdc140e7b63b8f739d09a99033aa430accce485ff78e6d311973a67b6bf3208 \
-    --hash=sha256:f10c98f49227ed8383d28174ee95155a675c4ed7f85e2e573b04414f7e371bda \
-    --hash=sha256:f188028b5af6b8fb2e9a76ac0f841a575bd1bd396e46ef0840d9b88a48fdbcea \
-    --hash=sha256:f188d580bd870cda1e15183790d1cc2fa78f666e76077d103edf048eed9c356e \
-    --hash=sha256:f45bd71d1fa5e5749587613037b172e0b3b23159d1c00ef2fc920da6f470e6f0 \
-    --hash=sha256:f61333d817698bdcdd0f9d7793e365ac3d2a21c1f1eb02b32ad6aefb8d8ea831 \
-    --hash=sha256:fb125d860738a09d363a88daa0f59c4533529a90e564785e20fe875b200b6dbd
+    # via -r requirements_dev.in
+pillow==12.1.1 \
+    --hash=sha256:02f84dfad02693676692746df05b89cf25597560db2857363a208e393429f5e9 \
+    --hash=sha256:0330d233c1a0ead844fc097a7d16c0abff4c12e856c0b325f231820fee1f39da \
+    --hash=sha256:03edcc34d688572014ff223c125a3f77fb08091e4607e7745002fc214070b35f \
+    --hash=sha256:097690ba1f2efdeb165a20469d59d8bb03c55fb6621eb2041a060ae8ea3e9642 \
+    --hash=sha256:178aa072084bd88ec759052feca8e56cbb14a60b39322b99a049e58090479713 \
+    --hash=sha256:18e5bddd742a44b7e6b1e773ab5db102bd7a94c32555ba656e76d319d19c3850 \
+    --hash=sha256:1a9b0ee305220b392e1124a764ee4265bd063e54a751a6b62eff69992f457fa9 \
+    --hash=sha256:1f1625b72740fdda5d77b4def688eb8fd6490975d06b909fd19f13f391e077e0 \
+    --hash=sha256:1f1be78ce9466a7ee64bfda57bdba0f7cc499d9794d518b854816c41bf0aa4e9 \
+    --hash=sha256:1f90cff8aa76835cba5769f0b3121a22bd4eb9e6884cfe338216e557a9a548b8 \
+    --hash=sha256:21329ec8c96c6e979cd0dfd29406c40c1d52521a90544463057d2aaa937d66a6 \
+    --hash=sha256:2815a87ab27848db0321fb78c7f0b2c8649dee134b7f2b80c6a45c6831d75ccd \
+    --hash=sha256:2c1fc0f2ca5f96a3c8407e41cca26a16e46b21060fe6d5b099d2cb01412222f5 \
+    --hash=sha256:2e0c664be47252947d870ac0d327fea7e63985a08794758aa8af5b6cb6ec0c9c \
+    --hash=sha256:339ffdcb7cbeaa08221cd401d517d4b1fe7a9ed5d400e4a8039719238620ca35 \
+    --hash=sha256:344cf1e3dab3be4b1fa08e449323d98a2a3f819ad20f4b22e77a0ede31f0faa1 \
+    --hash=sha256:36341d06738a9f66c8287cf8b876d24b18db9bd8740fa0672c74e259ad408cff \
+    --hash=sha256:365b10bb9417dd4498c0e3b128018c4a624dc11c7b97d8cc54effe3b096f4c38 \
+    --hash=sha256:3a5cbdcddad0af3da87cb16b60d23648bc3b51967eb07223e9fed77a82b457c4 \
+    --hash=sha256:417423db963cb4be8bac3fc1204fe61610f6abeed1580a7a2cbb2fbda20f12af \
+    --hash=sha256:42fc1f4677106188ad9a55562bbade416f8b55456f522430fadab3cef7cd4e60 \
+    --hash=sha256:44ce27545b6efcf0fdbdceb31c9a5bdea9333e664cda58a7e674bb74608b3986 \
+    --hash=sha256:472a8d7ded663e6162dafdf20015c486a7009483ca671cece7a9279b512fcb13 \
+    --hash=sha256:47b94983da0c642de92ced1702c5b6c292a84bd3a8e1d1702ff923f183594717 \
+    --hash=sha256:495c302af3aad1ca67420ddd5c7bd480c8867ad173528767d906428057a11f0e \
+    --hash=sha256:4ceb838d4bd9dab43e06c363cab2eebf63846d6a4aeaea283bbdfd8f1a8ed58b \
+    --hash=sha256:50480dcd74fa63b8e78235957d302d98d98d82ccbfac4c7e12108ba9ecbdba15 \
+    --hash=sha256:518a48c2aab7ce596d3bf79d0e275661b846e86e4d0e7dec34712c30fe07f02a \
+    --hash=sha256:559b38da23606e68681337ad74622c4dbba02254fc9cb4488a305dd5975c7eeb \
+    --hash=sha256:578510d88c6229d735855e1f278aa305270438d36a05031dfaae5067cc8eb04d \
+    --hash=sha256:597bd9c8419bc7c6af5604e55847789b69123bbe25d65cc6ad3012b4f3c98d8b \
+    --hash=sha256:5a8eb7ed8d4198bccbd07058416eeec51686b498e784eda166395a23eb99138e \
+    --hash=sha256:5c0dd1636633e7e6a0afe7bf6a51a14992b7f8e60de5789018ebbdfae55b040a \
+    --hash=sha256:5cb1785d97b0c3d1d1a16bc1d710c4a0049daefc4935f3a8f31f827f4d3d2e7f \
+    --hash=sha256:5d1f9575a12bed9e9eedd9a4972834b08c97a352bd17955ccdebfeca5913fa0a \
+    --hash=sha256:5d8c41325b382c07799a3682c1c258469ea2ff97103c53717b7893862d0c98ce \
+    --hash=sha256:5dae5f21afb91322f2ff791895ddd8889e5e947ff59f71b46041c8ce6db790bc \
+    --hash=sha256:600fd103672b925fe62ed08e0d874ea34d692474df6f4bf7ebe148b30f89f39f \
+    --hash=sha256:6408a7b064595afcab0a49393a413732a35788f2a5092fdc6266952ed67de586 \
+    --hash=sha256:652a2c9ccfb556235b2b501a3a7cf3742148cd22e04b5625c5fe057ea3e3191f \
+    --hash=sha256:665e1b916b043cef294bc54d47bf02d87e13f769bc4bc5fa225a24b3a6c5aca9 \
+    --hash=sha256:691ab2ac363b8217f7d31b3497108fb1f50faab2f75dfb03284ec2f217e87bf8 \
+    --hash=sha256:6c52f062424c523d6c4db85518774cc3d50f5539dd6eed32b8f6229b26f24d40 \
+    --hash=sha256:6c6db3b84c87d48d0088943bf33440e0c42370b99b1c2a7989216f7b42eede60 \
+    --hash=sha256:7311c0a0dcadb89b36b7025dfd8326ecfa36964e29913074d47382706e516a7c \
+    --hash=sha256:7aac39bcf8d4770d089588a2e1dd111cbaa42df5a94be3114222057d68336bd0 \
+    --hash=sha256:7b03048319bfc6170e93bd60728a1af51d3dd7704935feb228c4d4faab35d334 \
+    --hash=sha256:7e7976bf1910a8116b523b9f9f58bf410f3e8aa330cd9a2bb2953f9266ab49af \
+    --hash=sha256:8089c852a56c2966cf18835db62d9b34fef7ba74c726ad943928d494fa7f4735 \
+    --hash=sha256:86172b0831b82ce4f7877f280055892b31179e1576aa00d0df3bb1bbf8c3e524 \
+    --hash=sha256:89b54027a766529136a06cfebeecb3a04900397a3590fd252160b888479517bf \
+    --hash=sha256:89c7e895002bbe49cdc5426150377cbbc04767d7547ed145473f496dfa40408b \
+    --hash=sha256:8b7e5304e34942bf62e15184219a7b5ad4ff7f3bb5cca4d984f37df1a0e1aee2 \
+    --hash=sha256:8fd420ef0c52c88b5a035a0886f367748c72147b2b8f384c9d12656678dfdfa9 \
+    --hash=sha256:98edb152429ab62a1818039744d8fbb3ccab98a7c29fc3d5fcef158f3f1f68b7 \
+    --hash=sha256:99c1506ea77c11531d75e3a412832a13a71c7ebc8192ab9e4b2e355555920e3e \
+    --hash=sha256:9ad8fa5937ab05218e2b6a4cff30295ad35afd2f83ac592e68c0d871bb0fdbc4 \
+    --hash=sha256:9f51079765661884a486727f0729d29054242f74b46186026582b4e4769918e4 \
+    --hash=sha256:a003d7422449f6d1e3a34e3dd4110c22148336918ddbfc6a32581cd54b2e0b2b \
+    --hash=sha256:a0b1cd6232e2b618adcc54d9882e4e662a089d5768cd188f7c245b4c8c44a397 \
+    --hash=sha256:a285e3eb7a5a45a2ff504e31f4a8d1b12ef62e84e5411c6804a42197c1cf586c \
+    --hash=sha256:a37691702ed687799de29a518d63d4682d9016932db66d4e90c345831b02fb4e \
+    --hash=sha256:a550ae29b95c6dc13cf69e2c9dc5747f814c54eeb2e32d683e5e93af56caa029 \
+    --hash=sha256:ab174cd7d29a62dd139c44bf74b698039328f45cb03b4596c43473a46656b2f3 \
+    --hash=sha256:ab323b787d6e18b3d91a72fc99b1a2c28651e4358749842b8f8dfacd28ef2052 \
+    --hash=sha256:adebb5bee0f0af4909c30db0d890c773d1a92ffe83da908e2e9e720f8edf3984 \
+    --hash=sha256:aee2810642b2898bb187ced9b349e95d2a7272930796e022efaf12e99dccd293 \
+    --hash=sha256:af9a332e572978f0218686636610555ae3defd1633597be015ed50289a03c523 \
+    --hash=sha256:b574c51cf7d5d62e9be37ba446224b59a2da26dc4c1bb2ecbe936a4fb1a7cb7f \
+    --hash=sha256:b66e95d05ba806247aaa1561f080abc7975daf715c30780ff92a20e4ec546e1b \
+    --hash=sha256:b81b5e3511211631b3f672a595e3221252c90af017e399056d0faabb9538aa80 \
+    --hash=sha256:b957b71c6b2387610f556a7eb0828afbe40b4a98036fc0d2acfa5a44a0c2036f \
+    --hash=sha256:bb66b7cc26f50977108790e2456b7921e773f23db5630261102233eb355a3b79 \
+    --hash=sha256:c6008de247150668a705a6338156efb92334113421ceecf7438a12c9a12dab23 \
+    --hash=sha256:c7697918b5be27424e9ce568193efd13d925c4481dd364e43f5dff72d33e10f8 \
+    --hash=sha256:cb9bb857b2d057c6dfc72ac5f3b44836924ba15721882ef103cecb40d002d80e \
+    --hash=sha256:cc7d296b5ea4d29e6570dabeaed58d31c3fea35a633a69679fb03d7664f43fb3 \
+    --hash=sha256:d242e8ac078781f1de88bf823d70c1a9b3c7950a44cdf4b7c012e22ccbcd8e4e \
+    --hash=sha256:d2912fd8114fc5545aa3a4b5576512f64c55a03f3ebcca4c10194d593d43ea36 \
+    --hash=sha256:d470ab1178551dd17fdba0fef463359c41aaa613cdcd7ff8373f54be629f9f8f \
+    --hash=sha256:d4ce8e329c93845720cd2014659ca67eac35f6433fd3050393d85f3ecef0dad5 \
+    --hash=sha256:d6e4571eedf43af33d0fc233a382a76e849badbccdf1ac438841308652a08e1f \
+    --hash=sha256:e65498daf4b583091ccbb2556c7000abf0f3349fcd57ef7adc9a84a394ed29f6 \
+    --hash=sha256:e879bb6cd5c73848ef3b2b48b8af9ff08c5b71ecda8048b7dd22d8a33f60be32 \
+    --hash=sha256:e9e8064fb1cc019296958595f6db671fba95209e3ceb0c4734c9baf97de04b20 \
+    --hash=sha256:f7ed2c6543bad5a7d5530eb9e78c53132f93dfa44a28492db88b41cdab885202 \
+    --hash=sha256:f95c00d5d6700b2b890479664a06e754974848afaae5e21beb4d83c106923fd0 \
+    --hash=sha256:f975aa7ef9684ce7e2c18a3aa8f8e2106ce1e46b94ab713d156b2898811651d3 \
+    --hash=sha256:fbfa2a7c10cc2623f412753cddf391c7f971c52ca40a3f65dc5039b2939e8563 \
+    --hash=sha256:fc354a04072b765eccf2204f588a7a532c9511e8b9c7f900e1b64e3e33487090 \
+    --hash=sha256:fc44ef1f3de4f45b50ccf9136999d71abb99dca7706bc75d222ed350b9fd2289
     # via
-    #   -r .github/scripts/requirements_dev.in
+    #   -r requirements_dev.in
     #   pdf2image
     #   weasyprint
 platformdirs==4.5.1 \
@@ -364,7 +364,7 @@ platformdirs==4.5.1 \
 pre-commit==4.5.1 \
     --hash=sha256:3b3afd891e97337708c1674210f8eba659b52a38ea5f822ff142d10786221f77 \
     --hash=sha256:eb545fcff725875197837263e977ea257a402056661f09dae08e4b149b030a61
-    # via -r .github/scripts/requirements_dev.in
+    # via -r requirements_dev.in
 pycparser==3.0 \
     --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \
     --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
@@ -465,7 +465,7 @@ tinyhtml5==2.0.0 \
 unoserver==3.6 \
     --hash=sha256:25c360fa194396a89cb79b4edd2735f8e4f0fd8531e59db3952114585bd7df05 \
     --hash=sha256:e446bcb3638c51880f002aaeecab1cf74dfa9df81035f027f7ff2e081b6d7015
-    # via -r .github/scripts/requirements_dev.in
+    # via -r requirements_dev.in
 virtualenv==20.36.1 \
     --hash=sha256:575a8d6b124ef88f6f51d56d656132389f961062a9177016a50e4f507bbcc19f \
     --hash=sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba
@@ -473,7 +473,7 @@ virtualenv==20.36.1 \
 weasyprint==68.0 \
     --hash=sha256:447f40898b747cb44ac31a5d493d512e7441fd56e13f63744c099383bbf9cda9 \
     --hash=sha256:c2cb40c71b50837c5971f00171c9e4078e8c9912dd7c217f3e90e068f11e8aa1
-    # via -r .github/scripts/requirements_dev.in
+    # via -r requirements_dev.in
 webencodings==0.5.1 \
     --hash=sha256:a0af1213f3c2226497a97e2b3aa01a7e4bee4f403f95be16fc9acd2947514a78 \
     --hash=sha256:b36a1c245f2d304965eb4e0a82848379241dc04b865afcc4aab16748587e1923
@@ -500,8 +500,8 @@ zopfli==0.4.0 \
 pip==26.0 \
     --hash=sha256:3ce220a0a17915972fbf1ab451baae1521c4539e778b28127efa79b974aff0fa \
     --hash=sha256:98436feffb9e31bc9339cf369fd55d3331b1580b6a6f1173bacacddcf9c34754
-    # via -r .github/scripts/requirements_dev.in
+    # via -r requirements_dev.in
 setuptools==80.10.2 \
     --hash=sha256:8b0e9d10c784bf7d262c4e5ec5d4ec94127ce206e8738f29a437945fbc219b70 \
     --hash=sha256:95b30ddfb717250edb492926c92b5221f7ef3fbcc2b07579bcd4a27da21d0173
-    # via -r .github/scripts/requirements_dev.in
+    # via -r requirements_dev.in

.github/workflows/PR-Auto-Deploy-V2.yml

@@ -231,6 +231,8 @@ jobs:
           context: .
           file: ./docker/embedded/Dockerfile
           push: true
+          cache-from: type=gha,scope=stirling-pdf-latest
+          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
           build-args: VERSION_TAG=v2-alpha
           platforms: linux/amd64

.github/workflows/PR-Demo-Comment-with-react.yml

@@ -150,10 +150,10 @@ jobs:
           ref: refs/pull/${{ needs.check-comment.outputs.pr_number }}/merge
           token: ${{ steps.setup-bot.outputs.token }}
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
       - name: Setup Gradle
@@ -190,6 +190,8 @@ jobs:
           context: .
           file: ./docker/embedded/Dockerfile
           push: true
+          cache-from: type=gha,scope=stirling-pdf-latest
+          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
           build-args: VERSION_TAG=alpha
           platforms: linux/amd64

.github/workflows/ai_pr_title_review.yml

@@ -87,7 +87,7 @@ jobs:
       - name: AI PR Title Analysis
         if: steps.actor.outputs.is_repo_dev == 'true'
         id: ai-title-analysis
-        uses: actions/ai-inference@a6101c89c6feaecc585efdd8d461f18bb7896f20 # v2.0.5
+        uses: actions/ai-inference@e09e65981758de8b2fdab13c2bfb7c7d5493b0b6 # v2.0.7
         with:
           model: openai/gpt-4o
           system-prompt-file: ".github/config/system-prompt.txt"

.github/workflows/build.yml

@@ -52,7 +52,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        jdk-version: [17, 21]
+        jdk-version: [21, 25]
         spring-security: [true, false]
     steps:
       - name: Harden Runner
@@ -68,10 +68,20 @@ jobs:
           java-version: ${{ matrix.jdk-version }}
           distribution: "temurin"
 
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-${{ matrix.jdk-version }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
           gradle-version: 8.14
+          cache-disabled: true
 
       - name: Build with Gradle and spring security ${{ matrix.spring-security }}
         run: ./gradlew build -PnoSpotless
@@ -137,16 +147,26 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
           gradle-version: 8.14
+          cache-disabled: true
 
       - name: Generate OpenAPI documentation
         run: ./gradlew :stirling-pdf:generateOpenApiDocs
@@ -174,7 +194,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up Node.js
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: "22"
           cache: "npm"
@@ -209,19 +229,34 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
           gradle-version: 8.14
+          cache-disabled: true
 
       - name: check the licenses for compatibility
-        run: ./gradlew checkLicense
+        # NOTE: --no-parallel is intentional here. Running the checkLicense task in parallel with other
+        # Gradle tasks has been observed to cause intermittent failures with the dependency license
+        # checking plugin on this Gradle version. Disabling parallel execution trades some build speed
+        # for more reliable, deterministic license checks. If upgrading Gradle or the plugin, consider
+        # re-evaluating whether this flag is still required before removing it.
+        run: ./gradlew checkLicense --no-parallel
         env:
           MAVEN_USER: ${{ secrets.MAVEN_USER }}
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
@@ -254,6 +289,8 @@ jobs:
 
     runs-on: ubuntu-latest
     permissions:
+      actions: write
+      contents: read
       checks: write
 
     steps:
@@ -265,20 +302,34 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
           gradle-version: 8.14
+          cache-disabled: true
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
+      # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for docker buildx type=gha cache backend.
+      - name: Expose GitHub runtime for Buildx cache
+        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124 # v3.1.0
+
       - name: Install Docker Compose
         run: |
           sudo curl -SL "https://github.com/docker/compose/releases/download/v2.39.4/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
@@ -335,10 +386,13 @@ jobs:
         include:
           - docker-rev: docker/embedded/Dockerfile
             artifact-suffix: Dockerfile
+            cache-scope: stirling-pdf-latest
           - docker-rev: docker/embedded/Dockerfile.ultra-lite
             artifact-suffix: Dockerfile.ultra-lite
+            cache-scope: stirling-pdf-ultra-lite
           - docker-rev: docker/embedded/Dockerfile.fat
             artifact-suffix: Dockerfile.fat
+            cache-scope: stirling-pdf-fat
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
@@ -355,16 +409,26 @@ jobs:
           docker system prune -af || true
           echo "Disk space after cleanup:" && df -h
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
           gradle-version: 8.14
+          cache-disabled: true
 
       - name: Build application
         run: ./gradlew build
@@ -389,8 +453,8 @@ jobs:
           context: .
           file: ./${{ matrix.docker-rev }}
           push: false
-          cache-from: type=gha,scope=${{ matrix.artifact-suffix }}
-          cache-to: type=gha,mode=max,scope=${{ matrix.artifact-suffix }}
+          cache-from: type=gha,scope=${{ matrix.cache-scope }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.cache-scope }}
           platforms: linux/amd64,linux/arm64/v8
           provenance: true
           sbom: true

.github/workflows/deploy-on-v2-commit.yml

@@ -97,6 +97,8 @@ jobs:
           context: .
           file: ./docker/frontend/Dockerfile
           push: true
+          cache-from: type=gha,scope=stirling-v2-frontend
+          cache-to: type=gha,mode=max,scope=stirling-v2-frontend
           tags: |
             ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
             ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-latest
@@ -110,6 +112,8 @@ jobs:
           context: .
           file: ./docker/backend/Dockerfile
           push: true
+          cache-from: type=gha,scope=stirling-v2-backend
+          cache-to: type=gha,mode=max,scope=stirling-v2-backend
           tags: |
             ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
             ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-latest

.github/workflows/frontend-backend-licenses-update.yml

@@ -77,7 +77,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: "22"
           cache: "npm"
@@ -330,10 +330,10 @@ jobs:
           app-id: ${{ secrets.GH_APP_ID }}
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
       - name: Setup Gradle
@@ -344,7 +344,12 @@ jobs:
       - name: Check licenses and generate report
         id: license-check
         run: |
-          ./gradlew checkLicense generateLicenseReport || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV
+          # NOTE: --no-parallel is intentional here. Running the license-checking tasks in parallel has
+          # previously caused intermittent concurrency issues in CI (e.g. flaky failures in the license
+          # plugin/Gradle when multiple projects are evaluated concurrently). Disabling parallelism trades
+          # some build speed for more reliable license reports. If the underlying issues are resolved in
+          # future Gradle or plugin versions, this flag can be reconsidered.
+          ./gradlew checkLicense generateLicenseReport --no-parallel || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV
         env:
           MAVEN_USER: ${{ secrets.MAVEN_USER }}
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}

.github/workflows/multiOSReleases.yml

@@ -21,8 +21,6 @@ on:
           - windows
           - macos
           - linux
-  push:
-    branches: [main, V2-master]
   release:
     types: [created]
 
@@ -44,12 +42,22 @@ jobs:
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
+      - name: Cache Gradle dependencies
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-
+
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
@@ -117,10 +125,10 @@ jobs:
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
       - name: Setup Gradle
@@ -130,7 +138,7 @@ jobs:
 
       - name: Setup Node.js
         if: matrix.variant.build_frontend == true
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 22
           cache: "npm"
@@ -185,7 +193,7 @@ jobs:
           sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
 
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 22
           cache: "npm"
@@ -197,10 +205,10 @@ jobs:
           toolchain: stable
           targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
       - name: Setup Gradle
@@ -291,7 +299,7 @@ jobs:
       - name: Setup DigiCert KeyLocker
         id: digicert-setup
         if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
-        uses: digicert/ssm-code-signing@af7f4b07694120e514fe5b19f0598af3c20256e3 # v1.2.0
+        uses: digicert/ssm-code-signing@1d820463733701cf1484c7eb5d7d24a15ca2c454 # v1.2.1
         env:
           SM_API_KEY: ${{ secrets.SM_API_KEY }}
           SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
@@ -411,8 +419,9 @@ jobs:
           APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
+          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY || 'sb_publishable_UHz2SVRF5mvdrPHWkRteyA_yNlZTkYb' }}
+          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL || 'https://app.stirlingpdf.com' }}
+          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
           # Only enable Windows signing in Tauri when on release or V2-master
           SIGN: ${{ (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
           CI: true

.github/workflows/pre_commit.yml

@@ -59,10 +59,10 @@ jobs:
           pre-commit run trailing-whitespace --all-files -c .pre-commit-config.yaml
         continue-on-error: true
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: 21
+          java-version: "25"
           distribution: "temurin"
 
       - name: Setup Gradle

.github/workflows/push-docker.yml

@@ -39,12 +39,22 @@ jobs:
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
+      - name: Cache Gradle dependencies
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-
+
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
@@ -116,8 +126,8 @@ jobs:
           context: .
           file: ./docker/embedded/Dockerfile
           push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=stirling-pdf-latest
+          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
@@ -162,8 +172,8 @@ jobs:
           context: .
           file: ./docker/embedded/Dockerfile.fat
           push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=stirling-pdf-fat
+          cache-to: type=gha,mode=max,scope=stirling-pdf-fat
           tags: ${{ steps.meta-fat.outputs.tags }}
           labels: ${{ steps.meta-fat.outputs.labels }}
           build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
@@ -206,8 +216,8 @@ jobs:
           context: .
           file: ./docker/embedded/Dockerfile.ultra-lite
           push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=stirling-pdf-ultra-lite
+          cache-to: type=gha,mode=max,scope=stirling-pdf-ultra-lite
           tags: ${{ steps.meta-lite.outputs.tags }}
           labels: ${{ steps.meta-lite.outputs.labels }}
           build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}

.github/workflows/scorecards.yml

@@ -75,6 +75,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.29.5
+        uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v3.29.5
         with:
           sarif_file: results.sarif

.github/workflows/swagger.yml

@@ -33,10 +33,10 @@ jobs:
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
       - name: Setup Gradle

.github/workflows/tauri-build.yml

@@ -14,14 +14,16 @@ on:
           - macos
           - linux
   pull_request:
-    branches: [main, V2-tauri-windows]
+    branches: [main]
+    types: [opened, reopened, synchronize, ready_for_review]
     paths:
       - "frontend/src-tauri/**"
       - "frontend/src/desktop/**"
       - "frontend/tsconfig.desktop.json"
+      - "frontend/package.json"
+      - "frontend/package-lock.json"
+      - "frontend/vite.config.ts"
       - ".github/workflows/tauri-build.yml"
-  push:
-    branches: [main]
 
 permissions:
   contents: read
@@ -41,27 +43,42 @@ jobs:
 
       - name: Determine build matrix
         id: set-matrix
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
         run: |
+          WINDOWS='{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}'
+          MACOS_ARM='{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"}'
+          MACOS_INTEL='{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}'
+          LINUX='{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}'
+
+          # Resolve requested platform (non-dispatch events always build all)
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            case "${{ github.event.inputs.platform }}" in
-              "windows")
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "macos")
-                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "linux")
-                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              *)
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-            esac
+            PLATFORM="${{ github.event.inputs.platform }}"
           else
-            # For PR/push events, build all platforms
-            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+            PLATFORM="all"
           fi
 
+          # Build candidate list
+          case "$PLATFORM" in
+            windows) ENTRIES=("$WINDOWS") ;;
+            macos)   ENTRIES=("$MACOS_ARM" "$MACOS_INTEL") ;;
+            linux)   ENTRIES=("$LINUX") ;;
+            *)       ENTRIES=("$WINDOWS" "$MACOS_ARM" "$MACOS_INTEL" "$LINUX") ;;
+          esac
+
+          # Drop macOS entries when Apple certificate secret is unavailable
+          if [ -z "$APPLE_CERTIFICATE" ]; then
+            echo "⚠️ APPLE_CERTIFICATE secret not available - skipping macOS builds"
+            FILTERED=()
+            for entry in "${ENTRIES[@]}"; do
+              [[ "$entry" != *'"macos'* ]] && FILTERED+=("$entry")
+            done
+            ENTRIES=("${FILTERED[@]}")
+          fi
+
+          JOINED=$(IFS=','; echo "${ENTRIES[*]}")
+          echo "matrix={\"include\":[$JOINED]}" >> $GITHUB_OUTPUT
+
   build:
     needs: determine-matrix
     strategy:
@@ -71,6 +88,7 @@ jobs:
     env:
       SM_API_KEY: ${{ secrets.SM_API_KEY }}
       WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+      APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
@@ -87,7 +105,7 @@ jobs:
           sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
 
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 22
           cache: "npm"
@@ -99,10 +117,10 @@ jobs:
           toolchain: stable
           targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
       - name: Setup Gradle
@@ -194,7 +212,7 @@ jobs:
       - name: Setup DigiCert KeyLocker
         id: digicert-setup
         if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        uses: digicert/ssm-code-signing@af7f4b07694120e514fe5b19f0598af3c20256e3 # v1.2.0
+        uses: digicert/ssm-code-signing@1d820463733701cf1484c7eb5d7d24a15ca2c454 # v1.2.1
         env:
           SM_API_KEY: ${{ secrets.SM_API_KEY }}
           SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
@@ -269,7 +287,7 @@ jobs:
           }
 
       - name: Import Apple Developer Certificate
-        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && env.APPLE_CERTIFICATE != ''
         env:
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -290,7 +308,7 @@ jobs:
           rm certificate.p12
 
       - name: Verify Certificate
-        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && env.APPLE_CERTIFICATE != ''
         run: |
           echo "Verifying Apple Developer Certificate..."
           KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
@@ -325,8 +343,9 @@ jobs:
           APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
+          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY || 'sb_publishable_UHz2SVRF5mvdrPHWkRteyA_yNlZTkYb' }}
+          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL || 'https://app.stirlingpdf.com' }}
+          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
           # Only enable Windows signing in Tauri when on main
           SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
           CI: true

.github/workflows/testdriver.yml

@@ -32,10 +32,10 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          java-version: "21"
+          java-version: "25"
           distribution: "temurin"
 
       - name: Setup Gradle
@@ -72,6 +72,8 @@ jobs:
           context: .
           file: ./docker/embedded/Dockerfile
           push: true
+          cache-from: type=gha,scope=stirling-pdf-latest
+          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
           build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
           platforms: linux/amd64
@@ -155,7 +157,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Node
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           cache: "npm"
           cache-dependency-path: frontend/package-lock.json

CLAUDE.md

@@ -308,7 +308,7 @@ The frontend is organized with a clear separation of concerns:
 
 ## Important Notes
 
-- **Java Version**: Minimum JDK 17, supports and recommends JDK 21
+- **Java Version**: Minimum JDK 21, supports and recommends JDK 25
 - **Lombok**: Used extensively - ensure IDE plugin is installed
 - **File Persistence**:
   - **Backend**: Designed to be stateless - files are processed in memory/temp locations only

DeveloperGuide.md

@@ -11,7 +11,7 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 **Stirling 2.0** is built using:
 
 **Backend:**
-- Spring Boot (Java 17+, JDK 21 recommended)
+- Spring Boot (Java 21+, JDK 25 recommended)
 - PDFBox for core PDF operations
 - LibreOffice for document conversions
 - qpdf for PDF optimization
@@ -44,7 +44,7 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 
 - Docker
 - Git
-- Java JDK 17 or later (JDK 21 recommended)
+- Java JDK 21 or later (JDK 25 recommended)
 - Node.js 18+ and npm (required for frontend development)
 - Gradle 7.0 or later (Included within the repo)
 - Rust and Cargo (required for Tauri desktop app development)
@@ -59,7 +59,7 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
    cd Stirling-PDF
    ```
 
-2. Install Docker and JDK17 if not already installed.
+2. Install Docker and JDK 21 (or JDK 25 recommended) if not already installed.
 
 3. Install a recommended Java IDE such as Eclipse, IntelliJ, or VSCode
    1. Only VSCode

app/common/build.gradle

@@ -5,10 +5,10 @@ bootRun {
 spotless {
     java {
         target 'src/**/java/**/*.java'
+        targetExclude 'src/main/java/org/apache/**'
         googleJavaFormat(googleJavaFormatVersion).aosp().reorderImports(false)
 
         importOrder("java", "javax", "org", "com", "net", "io", "jakarta", "lombok", "me", "stirling")
-        toggleOffOn()
         trimTrailingWhitespace()
         leadingTabsToSpaces()
         endWithNewline()
@@ -27,9 +27,10 @@ spotless {
     }
 }
 dependencies {
-    api 'org.springframework.boot:spring-boot-starter-web'
-    api 'org.springframework.boot:spring-boot-starter-aop'
-    api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20240325.1'
+    api 'com.google.guava:guava:33.4.8-jre'
+    api 'org.springframework.boot:spring-boot-starter-webmvc'
+    api 'org.springframework.boot:spring-boot-starter-aspectj'
+    api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20260102.1'
     api 'com.fathzer:javaluator:3.0.6'
     api 'com.posthog.java:posthog:1.2.0'
     api 'org.apache.commons:commons-lang3:3.20.0'
@@ -39,10 +40,10 @@ dependencies {
     api "org.apache.pdfbox:pdfbox-io:$pdfboxVersion"
     api "org.apache.pdfbox:xmpbox:$pdfboxVersion"
     api "org.apache.pdfbox:preflight:$pdfboxVersion"
-    api 'com.github.junrar:junrar:7.5.7' // RAR archive support for CBR files
+    api 'com.github.junrar:junrar:7.5.8' // RAR archive support for CBR files
     api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
     api 'org.snakeyaml:snakeyaml-engine:3.0.1'
-    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.15"
+    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.1"
     // Simple Java Mail for EML/MSG parsing (replaces direct Angus Mail usage)
     api 'org.simplejavamail:simple-java-mail:8.12.6'
     api 'org.simplejavamail:outlook-module:8.12.6' // MSG file support

app/common/src/main/java/stirling/software/SPDF/config/EndpointConfiguration.java

@@ -103,8 +103,9 @@ public class EndpointConfiguration {
 
         // Rule 2: Functional-group override - check if endpoint belongs to any disabled functional
         // group
-        for (String group : endpointGroups.keySet()) {
-            if (disabledGroups.contains(group) && endpointGroups.get(group).contains(endpoint)) {
+        for (Map.Entry<String, Set<String>> entry : endpointGroups.entrySet()) {
+            String group = entry.getKey();
+            if (disabledGroups.contains(group) && entry.getValue().contains(endpoint)) {
                 // Skip tool groups (qpdf, OCRmyPDF, Ghostscript, LibreOffice, etc.)
                 if (!isToolGroup(group)) {
                     log.debug(
@@ -131,10 +132,11 @@ public class EndpointConfiguration {
 
         // Rule 4: Single-dependency check - if no alternatives defined, check if endpoint belongs
         // to any disabled tool groups
-        for (String group : endpointGroups.keySet()) {
+        for (Map.Entry<String, Set<String>> entry : endpointGroups.entrySet()) {
+            String group = entry.getKey();
             if (isToolGroup(group)
                     && disabledGroups.contains(group)
-                    && endpointGroups.get(group).contains(endpoint)) {
+                    && entry.getValue().contains(endpoint)) {
                 log.debug(
                         "isEndpointEnabled('{}') -> false (single tool group '{}' disabled, no alternatives)",
                         original,
@@ -645,8 +647,9 @@ public class EndpointConfiguration {
         }
 
         // Check if endpoint belongs to any disabled functional group
-        for (String group : endpointGroups.keySet()) {
-            if (disabledGroups.contains(group) && endpointGroups.get(group).contains(endpoint)) {
+        for (Map.Entry<String, Set<String>> entry : endpointGroups.entrySet()) {
+            String group = entry.getKey();
+            if (disabledGroups.contains(group) && entry.getValue().contains(endpoint)) {
                 if (!isToolGroup(group)) {
                     return false;
                 }

app/common/src/main/java/stirling/software/common/aop/AutoJobAspect.java

@@ -2,12 +2,14 @@ package stirling.software.common.aop;
 
 import java.io.IOException;
 import java.time.Duration;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.TimeUnit;
+import java.util.HashMap;
+import java.util.Map;
 import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.Supplier;
 
 import org.aspectj.lang.ProceedingJoinPoint;
 import org.aspectj.lang.annotation.*;
+import org.slf4j.MDC;
 import org.springframework.core.annotation.Order;
 import org.springframework.stereotype.Component;
 import org.springframework.web.multipart.MultipartFile;
@@ -26,7 +28,7 @@ import stirling.software.common.service.JobExecutorService;
 @Component
 @RequiredArgsConstructor
 @Slf4j
-@Order(0) // Highest precedence - executes before audit aspects
+@Order(20) // Lower precedence - executes AFTER audit aspects populate MDC
 public class AutoJobAspect {
 
     private static final Duration RETRY_BASE_DELAY = Duration.ofMillis(100);
@@ -70,26 +72,29 @@ public class AutoJobAspect {
             // No retries needed, simple execution
             return jobExecutorService.runJobGeneric(
                     async,
-                    () -> {
-                        try {
-                            // Note: Progress tracking is handled in TaskManager/JobExecutorService
-                            // The trackProgress flag controls whether detailed progress is stored
-                            // for REST API queries, not WebSocket notifications
-                            return joinPoint.proceed(args);
-                        } catch (Throwable ex) {
-                            log.error(
-                                    "AutoJobAspect caught exception during job execution: {}",
-                                    ex.getMessage(),
-                                    ex);
-                            // Rethrow RuntimeException as-is to preserve exception type
-                            if (ex instanceof RuntimeException) {
-                                throw (RuntimeException) ex;
-                            }
-                            // Wrap checked exceptions - GlobalExceptionHandler will unwrap
-                            // BaseAppException
-                            throw new RuntimeException(ex);
-                        }
-                    },
+                    wrapWithMDC(
+                            () -> {
+                                try {
+                                    // Note: Progress tracking is handled in
+                                    // TaskManager/JobExecutorService
+                                    // The trackProgress flag controls whether detailed progress is
+                                    // stored
+                                    // for REST API queries, not WebSocket notifications
+                                    return joinPoint.proceed(args);
+                                } catch (Throwable ex) {
+                                    log.error(
+                                            "AutoJobAspect caught exception during job execution: {}",
+                                            ex.getMessage(),
+                                            ex);
+                                    // Rethrow RuntimeException as-is to preserve exception type
+                                    if (ex instanceof RuntimeException) {
+                                        throw (RuntimeException) ex;
+                                    }
+                                    // Wrap checked exceptions - GlobalExceptionHandler will unwrap
+                                    // BaseAppException
+                                    throw new RuntimeException(ex);
+                                }
+                            }),
                     timeout,
                     queueable,
                     resourceWeight);
@@ -123,114 +128,108 @@ public class AutoJobAspect {
 
         return jobExecutorService.runJobGeneric(
                 async,
-                () -> {
-                    // Use iterative approach instead of recursion to avoid stack overflow
-                    Throwable lastException = null;
+                wrapWithMDC(
+                        () -> {
+                            // Use iterative approach instead of recursion to avoid stack overflow
+                            Throwable lastException = null;
 
-                    // Attempt counter starts at 1 for first try
-                    for (int currentAttempt = 1; currentAttempt <= maxRetries; currentAttempt++) {
-                        try {
-                            if (trackProgress && async) {
-                                // Get jobId for progress tracking in TaskManager
-                                // This enables REST API progress queries, not WebSocket
-                                if (jobIdRef.get() == null) {
-                                    jobIdRef.set(getJobIdFromContext());
-                                }
-                                String jobId = jobIdRef.get();
-                                if (jobId != null) {
-                                    log.debug(
-                                            "Tracking progress for job {} (attempt {}/{})",
-                                            jobId,
+                            // Attempt counter starts at 1 for first try
+                            for (int currentAttempt = 1;
+                                    currentAttempt <= maxRetries;
+                                    currentAttempt++) {
+                                try {
+                                    if (trackProgress && async) {
+                                        // Get jobId for progress tracking in TaskManager
+                                        // This enables REST API progress queries, not WebSocket
+                                        if (jobIdRef.get() == null) {
+                                            jobIdRef.set(getJobIdFromContext());
+                                        }
+                                        String jobId = jobIdRef.get();
+                                        if (jobId != null) {
+                                            log.debug(
+                                                    "Tracking progress for job {} (attempt {}/{})",
+                                                    jobId,
+                                                    currentAttempt,
+                                                    maxRetries);
+                                            // Progress is tracked in TaskManager for REST API
+                                            // access
+                                            // No WebSocket notifications sent here
+                                        }
+                                    }
+
+                                    // Attempt to execute the operation
+                                    return joinPoint.proceed(args);
+
+                                } catch (Throwable ex) {
+                                    lastException = ex;
+                                    log.error(
+                                            "AutoJobAspect caught exception during job execution (attempt"
+                                                    + " {}/{}): {}",
                                             currentAttempt,
-                                            maxRetries);
-                                    // Progress is tracked in TaskManager for REST API access
-                                    // No WebSocket notifications sent here
-                                }
-                            }
+                                            maxRetries,
+                                            ex.getMessage(),
+                                            ex);
 
-                            // Attempt to execute the operation
-                            return joinPoint.proceed(args);
+                                    // Check if we should retry
+                                    if (currentAttempt < maxRetries) {
+                                        log.info(
+                                                "Retrying operation, attempt {}/{}",
+                                                currentAttempt + 1,
+                                                maxRetries);
 
-                        } catch (Throwable ex) {
-                            lastException = ex;
-                            log.error(
-                                    "AutoJobAspect caught exception during job execution (attempt"
-                                            + " {}/{}): {}",
-                                    currentAttempt,
-                                    maxRetries,
-                                    ex.getMessage(),
-                                    ex);
+                                        if (trackProgress && async) {
+                                            String jobId = jobIdRef.get();
+                                            if (jobId != null) {
+                                                log.debug(
+                                                        "Recording retry attempt for job {} in TaskManager",
+                                                        jobId);
+                                                // Retry info is tracked in TaskManager for REST API
+                                                // access
+                                            }
+                                        }
 
-                            // Check if we should retry
-                            if (currentAttempt < maxRetries) {
-                                log.info(
-                                        "Retrying operation, attempt {}/{}",
-                                        currentAttempt + 1,
-                                        maxRetries);
+                                        // Use sleep for retry delay
+                                        // For sync jobs, both sleep and async are blocking at this
+                                        // point
+                                        // For async jobs, the delay occurs in the executor thread
+                                        long delayMs = RETRY_BASE_DELAY.toMillis() * currentAttempt;
 
-                                if (trackProgress && async) {
-                                    String jobId = jobIdRef.get();
-                                    if (jobId != null) {
-                                        log.debug(
-                                                "Recording retry attempt for job {} in TaskManager",
-                                                jobId);
-                                        // Retry info is tracked in TaskManager for REST API access
+                                        try {
+                                            Thread.sleep(delayMs);
+                                        } catch (InterruptedException e) {
+                                            Thread.currentThread().interrupt();
+                                            log.debug(
+                                                    "Retry delay interrupted for attempt {}/{}",
+                                                    currentAttempt,
+                                                    maxRetries);
+                                            break;
+                                        }
+                                    } else {
+                                        // No more retries, we'll throw the exception after the loop
+                                        break;
                                     }
                                 }
-
-                                // Use non-blocking delay for all retry attempts to avoid blocking
-                                // threads
-                                // For sync jobs this avoids starving the tomcat thread pool under
-                                // load
-                                long delayMs = RETRY_BASE_DELAY.toMillis() * currentAttempt;
-
-                                // Execute the retry after a delay through the JobExecutorService
-                                // rather than blocking the current thread with sleep
-                                CompletableFuture<Object> delayedRetry = new CompletableFuture<>();
-
-                                // Use a delayed executor for non-blocking delay
-                                CompletableFuture.delayedExecutor(delayMs, TimeUnit.MILLISECONDS)
-                                        .execute(
-                                                () -> {
-                                                    // Continue the retry loop in the next iteration
-                                                    // We can't return from here directly since
-                                                    // we're in a Runnable
-                                                    delayedRetry.complete(null);
-                                                });
-
-                                // Wait for the delay to complete before continuing
-                                try {
-                                    delayedRetry.join();
-                                } catch (Exception e) {
-                                    Thread.currentThread().interrupt();
-                                    break;
-                                }
-                            } else {
-                                // No more retries, we'll throw the exception after the loop
-                                break;
                             }
-                        }
-                    }
 
-                    // If we get here, all retries failed
-                    if (lastException != null) {
-                        // Rethrow RuntimeException as-is to preserve exception type
-                        if (lastException instanceof RuntimeException) {
-                            throw (RuntimeException) lastException;
-                        }
-                        // Wrap checked exceptions - GlobalExceptionHandler will unwrap
-                        // BaseAppException
-                        throw new RuntimeException(
-                                "Job failed after "
-                                        + maxRetries
-                                        + " attempts: "
-                                        + lastException.getMessage(),
-                                lastException);
-                    }
+                            // If we get here, all retries failed
+                            if (lastException != null) {
+                                // Rethrow RuntimeException as-is to preserve exception type
+                                if (lastException instanceof RuntimeException) {
+                                    throw (RuntimeException) lastException;
+                                }
+                                // Wrap checked exceptions - GlobalExceptionHandler will unwrap
+                                // BaseAppException
+                                throw new RuntimeException(
+                                        "Job failed after "
+                                                + maxRetries
+                                                + " attempts: "
+                                                + lastException.getMessage(),
+                                        lastException);
+                            }
 
-                    // This should never happen if lastException is properly tracked
-                    throw new RuntimeException("Job failed but no exception was recorded");
-                },
+                            // This should never happen if lastException is properly tracked
+                            throw new RuntimeException("Job failed but no exception was recorded");
+                        }),
                 timeout,
                 queueable,
                 resourceWeight);
@@ -299,4 +298,32 @@ public class AutoJobAspect {
             return null;
         }
     }
+
+    /**
+     * Wraps a supplier to propagate MDC context to background threads. Captures MDC on request
+     * thread and restores it in the background thread. Ensures proper cleanup to prevent context
+     * leakage across jobs in thread pools.
+     */
+    private <T> Supplier<T> wrapWithMDC(Supplier<T> supplier) {
+        final Map<String, String> captured = MDC.getCopyOfContextMap();
+        return () -> {
+            final Map<String, String> previous = MDC.getCopyOfContextMap();
+            try {
+                // Set the captured context (or clear if none was captured)
+                if (captured != null) {
+                    MDC.setContextMap(new HashMap<>(captured));
+                } else {
+                    MDC.clear();
+                }
+                return supplier.get();
+            } finally {
+                // Restore previous state (or clear if there was none)
+                if (previous != null) {
+                    MDC.setContextMap(previous);
+                } else {
+                    MDC.clear();
+                }
+            }
+        };
+    }
 }

app/common/src/main/java/stirling/software/common/configuration/RuntimePathConfig.java

@@ -91,9 +91,9 @@ public class RuntimePathConfig {
 
         // Initialize Operation paths
         String defaultWeasyPrintPath = isDocker ? "/opt/venv/bin/weasyprint" : "weasyprint";
-        String defaultUnoConvertPath = isDocker ? "/opt/venv/bin/unoconvert" : "unoconvert";
+        String defaultUnoConvertPath = isDocker ? "/usr/local/bin/unoconvert" : "unoconvert";
         String defaultCalibrePath = isDocker ? "/opt/calibre/ebook-convert" : "ebook-convert";
-        String defaultOcrMyPdfPath = isDocker ? "/usr/bin/ocrmypdf" : "ocrmypdf";
+        String defaultOcrMyPdfPath = isDocker ? "/opt/venv/bin/ocrmypdf" : "ocrmypdf";
         String defaultSOfficePath = isDocker ? "/usr/bin/soffice" : "soffice";
 
         Operations operations = customPaths.getOperations();

app/common/src/main/java/stirling/software/common/configuration/SchedulingConfig.java

@@ -0,0 +1,23 @@
+package stirling.software.common.configuration;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.scheduling.TaskScheduler;
+import org.springframework.scheduling.concurrent.SimpleAsyncTaskScheduler;
+
+/**
+ * Configures the scheduler used by all {@code @Scheduled} methods. Uses virtual threads so that
+ * long-running scheduled tasks (e.g. cleanup, license checks, file monitoring) never block each
+ * other — each runs on its own lightweight virtual thread.
+ */
+@Configuration
+public class SchedulingConfig {
+
+    @Bean
+    public TaskScheduler taskScheduler() {
+        SimpleAsyncTaskScheduler scheduler = new SimpleAsyncTaskScheduler();
+        scheduler.setVirtualThreads(true);
+        scheduler.setThreadNamePrefix("scheduled-vt-");
+        return scheduler;
+    }
+}

app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java

@@ -365,11 +365,11 @@ public class ApplicationProperties {
             }
 
             public boolean isSettingsValid() {
-                return !ValidationUtils.isStringEmpty(this.getIssuer())
-                        && !ValidationUtils.isStringEmpty(this.getClientId())
-                        && !ValidationUtils.isStringEmpty(this.getClientSecret())
-                        && !ValidationUtils.isCollectionEmpty(this.getScopes())
-                        && !ValidationUtils.isStringEmpty(this.getUseAsUsername());
+                return !ValidationUtils.isStringEmpty(this.issuer)
+                        && !ValidationUtils.isStringEmpty(this.clientId)
+                        && !ValidationUtils.isStringEmpty(this.clientSecret)
+                        && !ValidationUtils.isCollectionEmpty(this.scopes)
+                        && !ValidationUtils.isStringEmpty(this.useAsUsername);
             }
 
             @Data
@@ -575,19 +575,17 @@ public class ApplicationProperties {
         }
 
         public boolean isAnalyticsEnabled() {
-            return this.getEnableAnalytics() != null && this.getEnableAnalytics();
+            return this.enableAnalytics != null && this.enableAnalytics;
         }
 
         public boolean isPosthogEnabled() {
             // Treat null as enabled when analytics is enabled
-            return this.isAnalyticsEnabled()
-                    && (this.getEnablePosthog() == null || this.getEnablePosthog());
+            return this.isAnalyticsEnabled() && (this.enablePosthog == null || this.enablePosthog);
         }
 
         public boolean isScarfEnabled() {
             // Treat null as enabled when analytics is enabled
-            return this.isAnalyticsEnabled()
-                    && (this.getEnableScarf() == null || this.getEnableScarf());
+            return this.isAnalyticsEnabled() && (this.enableScarf == null || this.enableScarf);
         }
     }
 
@@ -698,7 +696,8 @@ public class ApplicationProperties {
 
         @Override
         public String toString() {
-            return """
+            return
+                    """
             Driver {
               driverName='%s'
             }
@@ -714,6 +713,7 @@ public class ApplicationProperties {
         private String logoStyle = "classic"; // Options: "classic" (default) or "modern"
         private boolean defaultHideUnavailableTools = false;
         private boolean defaultHideUnavailableConversions = false;
+        private HideDisabledTools hideDisabledTools = new HideDisabledTools();
 
         public String getAppNameNavbar() {
             return appNameNavbar != null && !appNameNavbar.trim().isEmpty() ? appNameNavbar : null;
@@ -726,6 +726,12 @@ public class ApplicationProperties {
             }
             return "classic"; // default
         }
+
+        @Data
+        public static class HideDisabledTools {
+            private boolean googleDrive = false;
+            private boolean mobileQRScanner = false;
+        }
     }
 
     @Data
@@ -913,6 +919,15 @@ public class ApplicationProperties {
             private boolean ssoAutoLogin;
             private boolean database;
             private CustomMetadata customMetadata = new CustomMetadata();
+            private GoogleDrive googleDrive = new GoogleDrive();
+
+            @Data
+            public static class GoogleDrive {
+                private boolean enabled = false;
+                private String clientId = "";
+                private String apiKey = "";
+                private String appId = "";
+            }
 
             @Data
             public static class CustomMetadata {
@@ -962,6 +977,12 @@ public class ApplicationProperties {
                 private boolean enabled = true;
                 private int level = 2; // 0=OFF, 1=BASIC, 2=STANDARD, 3=VERBOSE
                 private int retentionDays = 90;
+                private boolean captureFileHash =
+                        false; // Capture SHA-256 hash of files (increases processing time)
+                private boolean capturePdfAuthor =
+                        false; // Capture PDF author metadata (increases processing time)
+                private boolean captureOperationResults =
+                        false; // Capture operation return values (not recommended, high volume)
             }
 
             @Data

app/common/src/main/java/stirling/software/common/model/enumeration/Role.java

@@ -42,7 +42,7 @@ public enum Role {
         // Using the fromString method to get the Role enum based on the roleId
         Role role = fromString(roleId);
         // Return the roleName of the found Role enum
-        return role.getRoleName();
+        return role.roleName;
     }
 
     // Method to retrieve all role IDs and role names
@@ -50,14 +50,14 @@ public enum Role {
         // Using LinkedHashMap to preserve order
         Map<String, String> roleDetails = new LinkedHashMap<>();
         for (Role role : Role.values()) {
-            roleDetails.put(role.getRoleId(), role.getRoleName());
+            roleDetails.put(role.roleId, role.roleName);
         }
         return roleDetails;
     }
 
     public static Role fromString(String roleId) {
         for (Role role : Role.values()) {
-            if (role.getRoleId().equalsIgnoreCase(roleId)) {
+            if (role.roleId.equalsIgnoreCase(roleId)) {
                 return role;
             }
         }

app/common/src/main/java/stirling/software/common/model/oauth2/Provider.java

@@ -117,13 +117,13 @@ public class Provider {
                 + ", clientName="
                 + getClientName()
                 + ", clientId="
-                + getClientId()
+                + clientId
                 + ", clientSecret="
-                + (getClientSecret() != null && !getClientSecret().isEmpty() ? "*****" : "NULL")
+                + (clientSecret != null && !clientSecret.isEmpty() ? "*****" : "NULL")
                 + ", scopes="
                 + getScopes()
                 + ", useAsUsername="
-                + getUseAsUsername()
+                + useAsUsername
                 + "]";
     }
 }

app/common/src/main/java/stirling/software/common/service/FileStorage.java

@@ -1,6 +1,8 @@
 package stirling.software.common.service;
 
+import java.io.BufferedInputStream;
 import java.io.IOException;
+import java.io.InputStream;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.UUID;
@@ -21,6 +23,9 @@ import lombok.extern.slf4j.Slf4j;
 @Slf4j
 public class FileStorage {
 
+    /** Holds the result of a stream-to-disk store operation: the file ID and the bytes written. */
+    public record StoredFile(String fileId, long size) {}
+
     @Value("${stirling.tempDir:/tmp/stirling-files}")
     private String tempDirPath;
 
@@ -104,6 +109,40 @@ public class FileStorage {
         return Files.readAllBytes(filePath);
     }
 
+    /**
+     * Retrieve a file by its ID as a streaming InputStream. The caller is responsible for closing
+     * the returned stream.
+     *
+     * @param fileId The ID of the file to retrieve
+     * @return A buffered InputStream for the file
+     * @throws IOException If the file doesn't exist or can't be read
+     */
+    public InputStream retrieveInputStream(String fileId) throws IOException {
+        Path filePath = getFilePath(fileId);
+        // Let Files.newInputStream throw NoSuchFileException naturally — avoids TOCTOU race
+        // between exists-check and open when another thread may delete concurrently.
+        return new BufferedInputStream(Files.newInputStream(filePath));
+    }
+
+    /**
+     * Store data from an InputStream as a file and return its unique ID and byte count. Streams
+     * directly to disk without buffering the entire content in heap.
+     *
+     * @param inputStream The input stream to read from
+     * @param originalName The original name of the file (unused, kept for API symmetry)
+     * @return A {@link StoredFile} containing the file ID and the number of bytes written
+     * @throws IOException If there is an error storing the file
+     */
+    public StoredFile storeInputStream(InputStream inputStream, String originalName)
+            throws IOException {
+        String fileId = generateFileId();
+        Path filePath = getFilePath(fileId);
+        Files.createDirectories(filePath.getParent());
+        long size = Files.copy(inputStream, filePath);
+        log.debug("Stored input stream with ID: {}", fileId);
+        return new StoredFile(fileId, size);
+    }
+
     /**
      * Delete a file by its ID
      *

app/common/src/main/java/stirling/software/common/service/JobExecutorService.java

@@ -35,7 +35,7 @@ public class JobExecutorService {
     private final HttpServletRequest request;
     private final ResourceMonitor resourceMonitor;
     private final JobQueue jobQueue;
-    private final ExecutorService executor = ExecutorFactory.newVirtualOrCachedThreadExecutor();
+    private final ExecutorService executor = ExecutorFactory.newVirtualThreadExecutor();
     private final long effectiveTimeoutMs;
 
     @Autowired(required = false)
@@ -316,7 +316,7 @@ public class JobExecutorService {
                             filename =
                                     disposition.substring(
                                             disposition.indexOf("filename=") + 9,
-                                            disposition.lastIndexOf("\""));
+                                            disposition.lastIndexOf('"'));
                         }
                     }
 

app/common/src/main/java/stirling/software/common/service/JobQueue.java

@@ -44,8 +44,10 @@ public class JobQueue implements SmartLifecycle {
 
     private volatile BlockingQueue<QueuedJob> jobQueue;
     private final Map<String, QueuedJob> jobMap = new ConcurrentHashMap<>();
-    private final ScheduledExecutorService scheduler = Executors.newSingleThreadScheduledExecutor();
-    private final ExecutorService jobExecutor = ExecutorFactory.newVirtualOrCachedThreadExecutor();
+    private final ScheduledExecutorService scheduler =
+            Executors.newSingleThreadScheduledExecutor(
+                    Thread.ofVirtual().name("job-queue-scheduler-", 0).factory());
+    private final ExecutorService jobExecutor = ExecutorFactory.newVirtualThreadExecutor();
     private final Object queueLock = new Object(); // Lock for synchronizing queue operations
 
     private boolean shuttingDown = false;

app/common/src/main/java/stirling/software/common/service/MobileScannerService.java

@@ -129,7 +129,7 @@ public class MobileScannerService {
                         FILE_EXTENSION_PATTERN.matcher(safeFilename).replaceFirst("");
                 String ext =
                         safeFilename.contains(".")
-                                ? safeFilename.substring(safeFilename.lastIndexOf("."))
+                                ? safeFilename.substring(safeFilename.lastIndexOf('.'))
                                 : "";
                 safeFilename = nameWithoutExt + "-" + counter + ext;
                 filePath = sessionDir.resolve(safeFilename).normalize().toAbsolutePath();

app/common/src/main/java/stirling/software/common/service/PdfMetadataService.java

@@ -169,7 +169,10 @@ public class PdfMetadataService {
                             .getAuthor();
 
             if (userService != null) {
-                author = author.replace("username", userService.getCurrentUsername());
+                String username = userService.getCurrentUsername();
+                if (username != null) {
+                    author = author.replace("username", username);
+                }
             }
         }
         pdf.getDocumentInformation().setAuthor(author);

app/common/src/main/java/stirling/software/common/service/ResourceMonitor.java

@@ -43,7 +43,9 @@ public class ResourceMonitor {
     @Value("${stirling.resource.monitor.interval-ms:60000}")
     private long monitorIntervalMs = 60000; // 60 seconds
 
-    private final ScheduledExecutorService scheduler = Executors.newSingleThreadScheduledExecutor();
+    private final ScheduledExecutorService scheduler =
+            Executors.newSingleThreadScheduledExecutor(
+                    Thread.ofVirtual().name("resource-monitor-", 0).factory());
     private final MemoryMXBean memoryMXBean = ManagementFactory.getMemoryMXBean();
     private final OperatingSystemMXBean osMXBean = ManagementFactory.getOperatingSystemMXBean();
 

app/common/src/main/java/stirling/software/common/service/TaskManager.java

@@ -1,8 +1,8 @@
 package stirling.software.common.service;
 
-import java.io.ByteArrayInputStream;
-import java.io.ByteArrayOutputStream;
+import java.io.BufferedInputStream;
 import java.io.IOException;
+import java.io.InputStream;
 import java.time.LocalDateTime;
 import java.time.temporal.ChronoUnit;
 import java.util.ArrayList;
@@ -19,7 +19,6 @@ import java.util.zip.ZipInputStream;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.MediaType;
 import org.springframework.stereotype.Service;
-import org.springframework.web.multipart.MultipartFile;
 
 import io.github.pixee.security.ZipSecurity;
 
@@ -42,7 +41,8 @@ public class TaskManager {
 
     private final FileStorage fileStorage;
     private final ScheduledExecutorService cleanupExecutor =
-            Executors.newSingleThreadScheduledExecutor();
+            Executors.newSingleThreadScheduledExecutor(
+                    Thread.ofVirtual().name("task-cleanup-", 0).factory());
 
     /** Initialize the task manager and start the cleanup scheduler */
     public TaskManager(FileStorage fileStorage) {
@@ -362,39 +362,29 @@ public class TaskManager {
             String zipFileId, String originalZipFileName) throws IOException {
         List<ResultFile> extractedFiles = new ArrayList<>();
 
-        MultipartFile zipFile = fileStorage.retrieveFile(zipFileId);
-
-        try (ZipInputStream zipIn =
-                ZipSecurity.createHardenedInputStream(
-                        new ByteArrayInputStream(zipFile.getBytes()))) {
+        try (InputStream fileStream = fileStorage.retrieveInputStream(zipFileId);
+                ZipInputStream zipIn =
+                        ZipSecurity.createHardenedInputStream(
+                                new BufferedInputStream(fileStream))) {
             ZipEntry entry;
             while ((entry = zipIn.getNextEntry()) != null) {
                 if (!entry.isDirectory()) {
-                    // Use buffered reading for memory safety
-                    ByteArrayOutputStream out = new ByteArrayOutputStream();
-                    byte[] buffer = new byte[4096];
-                    int bytesRead;
-                    while ((bytesRead = zipIn.read(buffer)) != -1) {
-                        out.write(buffer, 0, bytesRead);
-                    }
-                    byte[] fileContent = out.toByteArray();
-
                     String contentType = determineContentType(entry.getName());
-                    String individualFileId = fileStorage.storeBytes(fileContent, entry.getName());
+                    // storeInputStream returns the fileId and byte count — no extra stat needed
+                    FileStorage.StoredFile stored =
+                            fileStorage.storeInputStream(zipIn, entry.getName());
 
                     ResultFile resultFile =
                             ResultFile.builder()
-                                    .fileId(individualFileId)
+                                    .fileId(stored.fileId())
                                     .fileName(entry.getName())
                                     .contentType(contentType)
-                                    .fileSize(fileContent.length)
+                                    .fileSize(stored.size())
                                     .build();
 
                     extractedFiles.add(resultFile);
                     log.debug(
-                            "Extracted file: {} (size: {} bytes)",
-                            entry.getName(),
-                            fileContent.length);
+                            "Extracted file: {} (size: {} bytes)", entry.getName(), stored.size());
                 }
                 zipIn.closeEntry();
             }
@@ -466,4 +456,24 @@ public class TaskManager {
         }
         return null;
     }
+
+    /**
+     * Find the job key that owns a given file ID.
+     *
+     * @param fileId file identifier to look up
+     * @return scoped job key if found, otherwise null
+     */
+    public String findJobKeyByFileId(String fileId) {
+        for (Map.Entry<String, JobResult> entry : jobResults.entrySet()) {
+            JobResult jobResult = entry.getValue();
+            if (jobResult.hasFiles()) {
+                for (ResultFile resultFile : jobResult.getAllResultFiles()) {
+                    if (fileId.equals(resultFile.getFileId())) {
+                        return entry.getKey();
+                    }
+                }
+            }
+        }
+        return null;
+    }
 }

app/common/src/main/java/stirling/software/common/util/CbzUtils.java

@@ -4,6 +4,7 @@ import java.io.BufferedInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Comparator;
 import java.util.Enumeration;
@@ -30,15 +31,7 @@ import stirling.software.common.service.CustomPDFDocumentFactory;
 @UtilityClass
 public class CbzUtils {
 
-    public byte[] convertCbzToPdf(
-            MultipartFile cbzFile,
-            CustomPDFDocumentFactory pdfDocumentFactory,
-            TempFileManager tempFileManager)
-            throws IOException {
-        return convertCbzToPdf(cbzFile, pdfDocumentFactory, tempFileManager, false);
-    }
-
-    public byte[] convertCbzToPdf(
+    public TempFile convertCbzToPdf(
             MultipartFile cbzFile,
             CustomPDFDocumentFactory pdfDocumentFactory,
             TempFileManager tempFileManager,
@@ -64,70 +57,90 @@ public class CbzUtils {
 
             try (PDDocument document = pdfDocumentFactory.createNewDocument();
                     ZipFile zipFile = new ZipFile(tempFile.getFile())) {
+
+                // Pass 1: collect sorted image names (cheap just strings, no image data)
+                List<String> sortedImageNames = new ArrayList<>();
                 Enumeration<? extends ZipEntry> entries = zipFile.entries();
-                List<ImageEntryData> imageEntries = new ArrayList<>();
                 while (entries.hasMoreElements()) {
                     ZipEntry entry = entries.nextElement();
                     if (!entry.isDirectory() && isImageFile(entry.getName())) {
-                        try (InputStream is = zipFile.getInputStream(entry)) {
-                            ByteArrayOutputStream baos = new ByteArrayOutputStream();
-                            is.transferTo(baos);
-                            imageEntries.add(
-                                    new ImageEntryData(entry.getName(), baos.toByteArray()));
-                        } catch (IOException e) {
-                            log.warn("Error reading image {}: {}", entry.getName(), e.getMessage());
-                        }
+                        sortedImageNames.add(entry.getName());
                     }
                 }
+                sortedImageNames.sort(new NaturalOrderComparator());
 
-                imageEntries.sort(
-                        Comparator.comparing(ImageEntryData::name, new NaturalOrderComparator()));
-
-                if (imageEntries.isEmpty()) {
+                if (sortedImageNames.isEmpty()) {
                     throw ExceptionUtils.createCbzNoImagesException();
                 }
 
-                for (ImageEntryData imageEntry : imageEntries) {
-                    try {
-                        PDImageXObject pdImage =
-                                PDImageXObject.createFromByteArray(
-                                        document, imageEntry.data(), imageEntry.name());
-                        PDPage page =
-                                new PDPage(
-                                        new PDRectangle(pdImage.getWidth(), pdImage.getHeight()));
-                        document.addPage(page);
-                        try (PDPageContentStream contentStream =
-                                new PDPageContentStream(
-                                        document,
-                                        page,
-                                        PDPageContentStream.AppendMode.OVERWRITE,
-                                        true,
-                                        true)) {
-                            contentStream.drawImage(pdImage, 0, 0);
+                // Pass 2: load ONE image at a time peak memory = max(single image)
+                for (String imageName : sortedImageNames) {
+                    ZipEntry entry = zipFile.getEntry(imageName);
+                    try (InputStream is = zipFile.getInputStream(entry)) {
+                        ByteArrayOutputStream imgBaos = new ByteArrayOutputStream();
+                        is.transferTo(imgBaos);
+                        byte[] imageBytes = imgBaos.toByteArray();
+                        try {
+                            PDImageXObject pdImage =
+                                    PDImageXObject.createFromByteArray(
+                                            document, imageBytes, imageName);
+                            PDPage page =
+                                    new PDPage(
+                                            new PDRectangle(
+                                                    pdImage.getWidth(), pdImage.getHeight()));
+                            document.addPage(page);
+                            try (PDPageContentStream contentStream =
+                                    new PDPageContentStream(
+                                            document,
+                                            page,
+                                            PDPageContentStream.AppendMode.OVERWRITE,
+                                            true,
+                                            true)) {
+                                contentStream.drawImage(pdImage, 0, 0);
+                            }
+                        } catch (IOException e) {
+                            log.warn("Error processing image {}: {}", imageName, e.getMessage());
                         }
+                        // imageBytes eligible for GC after each iteration
                     } catch (IOException e) {
-                        log.warn(
-                                "Error processing image {}: {}", imageEntry.name(), e.getMessage());
+                        log.warn("Error reading image {}: {}", imageName, e.getMessage());
                     }
                 }
 
                 if (document.getNumberOfPages() == 0) {
                     throw ExceptionUtils.createCbzCorruptedImagesException();
                 }
-                ByteArrayOutputStream baos = new ByteArrayOutputStream();
-                document.save(baos);
-                byte[] pdfBytes = baos.toByteArray();
 
-                // Apply Ghostscript optimization if requested
-                if (optimizeForEbook) {
-                    try {
-                        return GeneralUtils.optimizePdfWithGhostscript(pdfBytes);
-                    } catch (IOException e) {
-                        log.warn("Ghostscript optimization failed, returning unoptimized PDF", e);
+                // Write to TempFile (not BAOS)
+                TempFile pdfTempFile = new TempFile(tempFileManager, ".pdf");
+                try {
+                    document.save(pdfTempFile.getFile());
+
+                    if (optimizeForEbook) {
+                        try {
+                            byte[] pdfBytes = Files.readAllBytes(pdfTempFile.getPath());
+                            byte[] optimized = GeneralUtils.optimizePdfWithGhostscript(pdfBytes);
+                            pdfTempFile.close();
+                            TempFile optimizedFile = new TempFile(tempFileManager, ".pdf");
+                            try {
+                                Files.write(optimizedFile.getPath(), optimized);
+                                return optimizedFile;
+                            } catch (Exception e) {
+                                optimizedFile.close();
+                                throw e;
+                            }
+                        } catch (IOException e) {
+                            log.warn(
+                                    "Ghostscript optimization failed, returning unoptimized PDF",
+                                    e);
+                        }
                     }
-                }
 
-                return pdfBytes;
+                    return pdfTempFile;
+                } catch (Exception e) {
+                    pdfTempFile.close();
+                    throw e;
+                }
             }
         }
     }
@@ -175,8 +188,6 @@ public class CbzUtils {
         return RegexPatternUtils.getInstance().getImageFilePattern().matcher(filename).matches();
     }
 
-    private record ImageEntryData(String name, byte[] data) {}
-
     private class NaturalOrderComparator implements Comparator<String> {
         @Override
         public int compare(String s1, String s2) {

app/common/src/main/java/stirling/software/common/util/ExecutorFactory.java

@@ -2,30 +2,28 @@ package stirling.software.common.util;
 
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
 
-import lombok.extern.slf4j.Slf4j;
+/**
+ * Factory for creating executors backed by virtual threads (Java 21+). Virtual threads are
+ * lightweight, managed by the JVM, and ideal for I/O-bound tasks. They eliminate the need for
+ * thread pool sizing since thousands can run concurrently with minimal overhead.
+ */
+public final class ExecutorFactory {
 
-@Slf4j
-public class ExecutorFactory {
+    private ExecutorFactory() {}
+
+    /** Creates an {@link ExecutorService} that starts a new virtual thread for each task. */
+    public static ExecutorService newVirtualThreadExecutor() {
+        return Executors.newVirtualThreadPerTaskExecutor();
+    }
 
     /**
-     * Creates an ExecutorService using virtual threads if available (Java 21+), or falls back to a
-     * cached thread pool on older Java versions.
+     * Creates a {@link ScheduledExecutorService} backed by a single virtual thread. Useful for
+     * periodic/delayed tasks that should not pin a platform thread.
      */
-    public static ExecutorService newVirtualOrCachedThreadExecutor() {
-        try {
-            ExecutorService executor =
-                    (ExecutorService)
-                            Executors.class
-                                    .getMethod("newVirtualThreadPerTaskExecutor")
-                                    .invoke(null);
-            return executor;
-        } catch (NoSuchMethodException e) {
-            log.debug("Virtual threads not available; falling back to cached thread pool.");
-        } catch (Exception e) {
-            log.debug("Error initializing virtual thread executor: {}", e.getMessage(), e);
-        }
-
-        return Executors.newCachedThreadPool();
+    public static ScheduledExecutorService newSingleVirtualThreadScheduledExecutor() {
+        return Executors.newSingleThreadScheduledExecutor(
+                Thread.ofVirtual().name("scheduled-vt-", 0).factory());
     }
 }

app/common/src/main/java/stirling/software/common/util/FileMonitor.java

@@ -68,6 +68,17 @@ public class FileMonitor {
 
         if (this.rootDirs.isEmpty()) {
             log.error("No valid directories to monitor - FileMonitor will not function");
+        } else {
+            // Register directories eagerly so the first @Scheduled tick does not warn.
+            for (Path rootDir : this.rootDirs) {
+                if (Files.exists(rootDir)) {
+                    try {
+                        recursivelyRegisterEntry(rootDir);
+                    } catch (IOException e) {
+                        log.error("Failed to register monitoring for {}", rootDir, e);
+                    }
+                }
+            }
         }
     }
 

app/common/src/main/java/stirling/software/common/util/FileToPdf.java

@@ -44,9 +44,7 @@ public class FileToPdf {
                             sanitizeHtmlContent(
                                     new String(fileBytes, StandardCharsets.UTF_8),
                                     customHtmlSanitizer);
-                    Files.write(
-                            tempInputFile.getPath(),
-                            sanitizedHtml.getBytes(StandardCharsets.UTF_8));
+                    Files.writeString(tempInputFile.getPath(), sanitizedHtml);
                 } else if (fileName.toLowerCase(Locale.ROOT).endsWith(".zip")) {
                     Files.write(tempInputFile.getPath(), fileBytes);
                     sanitizeHtmlFilesInZip(
@@ -100,6 +98,13 @@ public class FileToPdf {
                 while (entry != null) {
                     Path filePath =
                             tempUnzippedDir.getPath().resolve(sanitizeZipFilename(entry.getName()));
+                    Path normalizedTargetDir =
+                            tempUnzippedDir.getPath().toAbsolutePath().normalize();
+                    Path normalizedFilePath = filePath.toAbsolutePath().normalize();
+                    if (!normalizedFilePath.startsWith(normalizedTargetDir)) {
+                        throw new IOException(
+                                "Zip entry path escapes target directory: " + entry.getName());
+                    }
                     if (!entry.isDirectory()) {
                         Files.createDirectories(filePath.getParent());
                         if (entry.getName().toLowerCase(Locale.ROOT).endsWith(".html")
@@ -108,8 +113,7 @@ public class FileToPdf {
                                     new String(zipIn.readAllBytes(), StandardCharsets.UTF_8);
                             String sanitizedContent =
                                     sanitizeHtmlContent(content, customHtmlSanitizer);
-                            Files.write(
-                                    filePath, sanitizedContent.getBytes(StandardCharsets.UTF_8));
+                            Files.writeString(filePath, sanitizedContent);
                         } else {
                             Files.copy(zipIn, filePath);
                         }

app/common/src/main/java/stirling/software/common/util/FormUtils.java

@@ -17,6 +17,7 @@ import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
+import java.util.regex.Pattern;
 
 import org.apache.pdfbox.cos.COSArray;
 import org.apache.pdfbox.cos.COSBase;
@@ -74,6 +75,10 @@ public class FormUtils {
      */
     private static final float SAME_LINE_THRESHOLD_PT = 10.0f;
 
+    private static final Pattern HEX_UUID_PATTERN =
+            Pattern.compile("^[0-9a-fA-F]{8}[0-9a-fA-F]{24,}$");
+    private static final Pattern WHITESPACE_PATTERN = Pattern.compile("\\s+");
+
     /**
      * Returns a normalized logical type string for the supplied PDFBox field instance. Centralized
      * so all callers share identical mapping logic.
@@ -1357,7 +1362,7 @@ public class FormUtils {
             if (da != null && !da.isBlank()) {
                 // Standard DA looks like: /Helv 12 Tf 0 g
                 // We want the number before 'Tf'
-                String[] tokens = da.split("\\s+");
+                String[] tokens = WHITESPACE_PATTERN.split(da);
                 for (int i = 0; i < tokens.length; i++) {
                     if ("Tf".equals(tokens[i]) && i > 0) {
                         try {
@@ -1457,9 +1462,8 @@ public class FormUtils {
         // Detect UUID-like hex strings (e.g. "cdc47b7041524571 7b2d93017fe77bf7")
         // Standard UUIDs are 32 hex characters; require at least that to avoid
         // false positives on short hex-like field names.
-        String nospaces = simplified.replaceAll("\\s+", "");
-        if (nospaces.length() >= 32 && nospaces.matches("^[0-9a-fA-F]{8}[0-9a-fA-F]{24,}$"))
-            return true;
+        String nospaces = WHITESPACE_PATTERN.matcher(simplified).replaceAll("");
+        if (nospaces.length() >= 32 && HEX_UUID_PATTERN.matcher(nospaces).matches()) return true;
 
         return patterns.getGenericFieldNamePattern().matcher(simplified).matches()
                 || patterns.getSimpleFormFieldPattern().matcher(simplified).matches()

app/common/src/main/java/stirling/software/common/util/GeneralUtils.java

@@ -649,7 +649,8 @@ public class GeneralUtils {
     }
 
     public List<Integer> parsePageList(String[] pages, int totalPages, boolean oneBased) {
-        List<Integer> result = new ArrayList<>();
+        // Use LinkedHashSet to prevent duplicates from inflating size and triggering maxSize guard
+        Set<Integer> result = new LinkedHashSet<>();
         int offset = oneBased ? 1 : 0;
         int maxSize = Math.max(1000, totalPages * 3);
         for (String page : pages) {
@@ -672,7 +673,7 @@ public class GeneralUtils {
                         "Page list exceeds maximum allowed size of " + maxSize);
             }
         }
-        return result;
+        return new ArrayList<>(result);
     }
 
     /*
@@ -872,6 +873,36 @@ public class GeneralUtils {
         settingsYaml.saveOverride(settingsPath);
     }
 
+    /**
+     * Updates multiple settings in a single transaction. This ensures that nested settings (e.g.,
+     * oauth2.client.google.*) don't lose sibling values when partial updates are made.
+     *
+     * <p>Instead of multiple read-update-write cycles (which could cause race conditions), this
+     * method loads the YAML once, applies all updates, and saves once.
+     *
+     * @param settingsMap Map of dotted-notation keys to values to update
+     * @throws IOException if file read/write fails
+     */
+    public void updateSettingsTransactional(Map<String, Object> settingsMap) throws IOException {
+        if (settingsMap == null || settingsMap.isEmpty()) {
+            return;
+        }
+
+        Path settingsPath = Paths.get(InstallationPathConfig.getSettingsPath());
+        YamlHelper settingsYaml = new YamlHelper(settingsPath);
+
+        // Apply all updates to the same YamlHelper instance
+        for (Map.Entry<String, Object> entry : settingsMap.entrySet()) {
+            String key = entry.getKey();
+            Object value = entry.getValue();
+            String[] keyArray = key.split("\\.");
+            settingsYaml.updateValue(Arrays.asList(keyArray), value);
+        }
+
+        // Save only once after all updates are applied
+        settingsYaml.saveOverride(settingsPath);
+    }
+
     /*
      * Machine fingerprint generation with better error logging and fallbacks.
      *

app/common/src/main/java/stirling/software/common/util/PDFToFile.java

@@ -10,6 +10,7 @@ import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Objects;
+import java.util.regex.Pattern;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipOutputStream;
 
@@ -33,6 +34,8 @@ import stirling.software.common.util.ProcessExecutor.ProcessExecutorResult;
 @Slf4j
 public class PDFToFile {
 
+    private static final Pattern PATTERN =
+            Pattern.compile("(!\\[.*?\\])\\((?!images/)([^/)][^)]*?)\\)");
     private final TempFileManager tempFileManager;
     private final RuntimePathConfig runtimePathConfig;
 
@@ -163,7 +166,7 @@ public class PDFToFile {
     private String updateImageReferences(String markdown) {
         // Match markdown image syntax: ![alt text](image.png)
         // Only update if the path doesn't already start with images/
-        return markdown.replaceAll("(!\\[.*?\\])\\((?!images/)([^/)][^)]*?)\\)", "$1(images/$2)");
+        return PATTERN.matcher(markdown).replaceAll("$1(images/$2)");
     }
 
     public ResponseEntity<byte[]> processPdfToHtml(MultipartFile inputFile)

app/common/src/main/java/stirling/software/common/util/PdfToCbzUtils.java

@@ -1,8 +1,8 @@
 package stirling.software.common.util;
 
 import java.awt.image.BufferedImage;
-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.Locale;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipOutputStream;
@@ -22,8 +22,11 @@ import stirling.software.common.service.CustomPDFDocumentFactory;
 @Slf4j
 public class PdfToCbzUtils {
 
-    public static byte[] convertPdfToCbz(
-            MultipartFile pdfFile, int dpi, CustomPDFDocumentFactory pdfDocumentFactory)
+    public static TempFile convertPdfToCbz(
+            MultipartFile pdfFile,
+            int dpi,
+            CustomPDFDocumentFactory pdfDocumentFactory,
+            TempFileManager tempFileManager)
             throws IOException {
 
         validatePdfFile(pdfFile);
@@ -33,7 +36,7 @@ public class PdfToCbzUtils {
                 throw ExceptionUtils.createPdfNoPages();
             }
 
-            return createCbzFromPdf(document, dpi);
+            return createCbzFromPdf(document, dpi, tempFileManager);
         }
     }
 
@@ -53,46 +56,49 @@ public class PdfToCbzUtils {
         }
     }
 
-    private static byte[] createCbzFromPdf(PDDocument document, int dpi) throws IOException {
+    private static TempFile createCbzFromPdf(
+            PDDocument document, int dpi, TempFileManager tempFileManager) throws IOException {
         PDFRenderer pdfRenderer = new PDFRenderer(document);
         pdfRenderer.setSubsamplingAllowed(true); // Enable subsampling to reduce memory usage
 
-        try (ByteArrayOutputStream cbzOutputStream = new ByteArrayOutputStream();
-                ZipOutputStream zipOut = new ZipOutputStream(cbzOutputStream)) {
+        TempFile cbzTempFile = new TempFile(tempFileManager, ".cbz");
+        try {
+            try (ZipOutputStream zipOut =
+                    new ZipOutputStream(Files.newOutputStream(cbzTempFile.getPath()))) {
 
-            int totalPages = document.getNumberOfPages();
+                int totalPages = document.getNumberOfPages();
 
-            for (int pageIndex = 0; pageIndex < totalPages; pageIndex++) {
-                final int currentPage = pageIndex;
-                try {
-                    BufferedImage image =
-                            ExceptionUtils.handleOomRendering(
-                                    currentPage + 1,
-                                    dpi,
-                                    () ->
-                                            pdfRenderer.renderImageWithDPI(
-                                                    currentPage, dpi, ImageType.RGB));
+                for (int pageIndex = 0; pageIndex < totalPages; pageIndex++) {
+                    final int currentPage = pageIndex;
+                    try {
+                        BufferedImage image =
+                                ExceptionUtils.handleOomRendering(
+                                        currentPage + 1,
+                                        dpi,
+                                        () ->
+                                                pdfRenderer.renderImageWithDPI(
+                                                        currentPage, dpi, ImageType.RGB));
 
-                    String imageFilename =
-                            String.format(Locale.ROOT, "page_%03d.png", currentPage + 1);
-                    ZipEntry zipEntry = new ZipEntry(imageFilename);
-                    zipOut.putNextEntry(zipEntry);
+                        String imageFilename =
+                                String.format(Locale.ROOT, "page_%03d.png", currentPage + 1);
+                        zipOut.putNextEntry(new ZipEntry(imageFilename));
+                        ImageIO.write(image, "PNG", zipOut);
+                        zipOut.closeEntry();
 
-                    ImageIO.write(image, "PNG", zipOut);
-                    zipOut.closeEntry();
-
-                } catch (ExceptionUtils.OutOfMemoryDpiException e) {
-                    // Re-throw OOM exceptions without wrapping
-                    throw e;
-                } catch (IOException e) {
-                    // Wrap other IOExceptions with context
-                    throw ExceptionUtils.createFileProcessingException(
-                            "CBZ creation for page " + (currentPage + 1), e);
+                    } catch (ExceptionUtils.OutOfMemoryDpiException e) {
+                        // Re-throw OOM exceptions without wrapping
+                        throw e;
+                    } catch (IOException e) {
+                        // Wrap other IOExceptions with context
+                        throw ExceptionUtils.createFileProcessingException(
+                                "CBZ creation for page " + (currentPage + 1), e);
+                    }
                 }
             }
-
-            zipOut.finish();
-            return cbzOutputStream.toByteArray();
+            return cbzTempFile;
+        } catch (Exception e) {
+            cbzTempFile.close();
+            throw e;
         }
     }
 

app/common/src/main/java/stirling/software/common/util/PdfUtils.java

@@ -219,58 +219,31 @@ public class PdfUtils {
                     int maxWidth = 0;
                     int totalHeight = 0;
 
-                    BufferedImage pdfSizeImage = null;
-                    int pdfSizeImageIndex = -1;
-
-                    // Using a map to store the rendered dimensions of each page size
-                    // to avoid rendering the same page sizes multiple times
+                    // Using a map to store the calculated dimensions of each page size
                     HashMap<PdfRenderSettingsKey, PdfImageDimensionValue> pageSizes =
                             new HashMap<>();
                     for (int i = 0; i < pageCount; ++i) {
-                        final int pageIndex = i;
                         PDPage page = document.getPage(i);
-                        PDRectangle mediaBox = page.getMediaBox();
+                        PDRectangle cropBox = page.getCropBox();
                         int rotation = page.getRotation();
                         PdfRenderSettingsKey settings =
                                 new PdfRenderSettingsKey(
-                                        mediaBox.getWidth(), mediaBox.getHeight(), rotation);
+                                        cropBox.getWidth(), cropBox.getHeight(), rotation);
                         PdfImageDimensionValue dimension = pageSizes.get(settings);
                         if (dimension == null) {
-                            // Render the image to get the dimensions
-                            try {
-                                // Validate dimensions before rendering
-                                ExceptionUtils.validateRenderingDimensions(
-                                        page, pageIndex + 1, DPI);
-
-                                pdfSizeImage =
-                                        ExceptionUtils.handleOomRendering(
-                                                pageIndex + 1,
-                                                DPI,
-                                                () ->
-                                                        pdfRenderer.renderImageWithDPI(
-                                                                pageIndex, DPI, colorType));
-                            } catch (IllegalArgumentException e) {
-                                if (e.getMessage() != null
-                                        && e.getMessage()
-                                                .contains("Maximum size of image exceeded")) {
-                                    throw ExceptionUtils.createIllegalArgumentException(
-                                            "error.pageTooBigExceedsArray",
-                                            "PDF page {0} is too large to render at {1} DPI. The"
-                                                    + " resulting image would exceed Java's maximum"
-                                                    + " array size. Please try a lower DPI value"
-                                                    + " (recommended: 150 or less).",
-                                            i + 1,
-                                            DPI);
-                                }
-                                throw e;
+                            float scale = DPI / 72f;
+                            int widthPx = (int) Math.max(Math.floor(cropBox.getWidth() * scale), 1);
+                            int heightPx =
+                                    (int) Math.max(Math.floor(cropBox.getHeight() * scale), 1);
+                            if (rotation == 90 || rotation == 270) {
+                                int tmp = widthPx;
+                                widthPx = heightPx;
+                                heightPx = tmp;
                             }
-                            pdfSizeImageIndex = i;
-                            dimension =
-                                    new PdfImageDimensionValue(
-                                            pdfSizeImage.getWidth(), pdfSizeImage.getHeight());
+                            dimension = new PdfImageDimensionValue(widthPx, heightPx);
                             pageSizes.put(settings, dimension);
-                            if (pdfSizeImage.getWidth() > maxWidth) {
-                                maxWidth = pdfSizeImage.getWidth();
+                            if (widthPx > maxWidth) {
+                                maxWidth = widthPx;
                             }
                         }
                         totalHeight += dimension.height();
@@ -284,40 +257,32 @@ public class PdfUtils {
                     int currentHeight = 0;
                     BufferedImage pageImage;
 
-                    // Check if the first image is the last rendered image
-                    boolean firstImageAlreadyRendered = pdfSizeImageIndex == 0;
-
                     for (int i = 0; i < pageCount; ++i) {
                         final int pageIndex = i;
-                        if (firstImageAlreadyRendered && i == 0) {
-                            pageImage = pdfSizeImage;
-                        } else {
-                            try {
-                                // Validate dimensions before rendering
-                                ExceptionUtils.validateRenderingDimensions(
-                                        document.getPage(pageIndex), pageIndex + 1, DPI);
+                        try {
+                            // Validate dimensions before rendering
+                            ExceptionUtils.validateRenderingDimensions(
+                                    document.getPage(pageIndex), pageIndex + 1, DPI);
 
-                                pageImage =
-                                        ExceptionUtils.handleOomRendering(
-                                                pageIndex + 1,
-                                                DPI,
-                                                () ->
-                                                        pdfRenderer.renderImageWithDPI(
-                                                                pageIndex, DPI, colorType));
-                            } catch (IllegalArgumentException e) {
-                                if (e.getMessage() != null
-                                        && e.getMessage()
-                                                .contains("Maximum size of image exceeded")) {
-                                    throw ExceptionUtils.createIllegalArgumentException(
-                                            "error.pageTooBigForDpi",
-                                            "PDF page {0} is too large to render at {1} DPI. Please"
-                                                    + " try a lower DPI value (recommended: 150 or"
-                                                    + " less).",
-                                            i + 1,
-                                            DPI);
-                                }
-                                throw e;
+                            pageImage =
+                                    ExceptionUtils.handleOomRendering(
+                                            pageIndex + 1,
+                                            DPI,
+                                            () ->
+                                                    pdfRenderer.renderImageWithDPI(
+                                                            pageIndex, DPI, colorType));
+                        } catch (IllegalArgumentException e) {
+                            if (e.getMessage() != null
+                                    && e.getMessage().contains("Maximum size of image exceeded")) {
+                                throw ExceptionUtils.createIllegalArgumentException(
+                                        "error.pageTooBigForDpi",
+                                        "PDF page {0} is too large to render at {1} DPI. Please"
+                                                + " try a lower DPI value (recommended: 150 or"
+                                                + " less).",
+                                        i + 1,
+                                        DPI);
                             }
+                            throw e;
                         }
 
                         // Calculate the x-coordinate to center the image

app/common/src/main/java/stirling/software/common/util/ProcessExecutor.java

@@ -226,50 +226,54 @@ public class ProcessExecutor {
             List<String> outputLines = new ArrayList<>();
 
             Thread errorReaderThread =
-                    new Thread(
-                            () -> {
-                                try (BufferedReader errorReader =
-                                        new BufferedReader(
-                                                new InputStreamReader(
-                                                        process.getErrorStream(),
-                                                        StandardCharsets.UTF_8))) {
-                                    String line;
-                                    while ((line =
-                                                    BoundedLineReader.readLine(
-                                                            errorReader, 5_000_000))
-                                            != null) {
-                                        errorLines.add(line);
-                                        if (liveUpdates) log.info(line);
-                                    }
-                                } catch (InterruptedIOException e) {
-                                    log.warn("Error reader thread was interrupted due to timeout.");
-                                } catch (IOException e) {
-                                    log.error("exception", e);
-                                }
-                            });
+                    Thread.ofVirtual()
+                            .unstarted(
+                                    () -> {
+                                        try (BufferedReader errorReader =
+                                                new BufferedReader(
+                                                        new InputStreamReader(
+                                                                process.getErrorStream(),
+                                                                StandardCharsets.UTF_8))) {
+                                            String line;
+                                            while ((line =
+                                                            BoundedLineReader.readLine(
+                                                                    errorReader, 5_000_000))
+                                                    != null) {
+                                                errorLines.add(line);
+                                                if (liveUpdates) log.info(line);
+                                            }
+                                        } catch (InterruptedIOException e) {
+                                            log.warn(
+                                                    "Error reader thread was interrupted due to timeout.");
+                                        } catch (IOException e) {
+                                            log.error("exception", e);
+                                        }
+                                    });
 
             Thread outputReaderThread =
-                    new Thread(
-                            () -> {
-                                try (BufferedReader outputReader =
-                                        new BufferedReader(
-                                                new InputStreamReader(
-                                                        process.getInputStream(),
-                                                        StandardCharsets.UTF_8))) {
-                                    String line;
-                                    while ((line =
-                                                    BoundedLineReader.readLine(
-                                                            outputReader, 5_000_000))
-                                            != null) {
-                                        outputLines.add(line);
-                                        if (liveUpdates) log.info(line);
-                                    }
-                                } catch (InterruptedIOException e) {
-                                    log.warn("Error reader thread was interrupted due to timeout.");
-                                } catch (IOException e) {
-                                    log.error("exception", e);
-                                }
-                            });
+                    Thread.ofVirtual()
+                            .unstarted(
+                                    () -> {
+                                        try (BufferedReader outputReader =
+                                                new BufferedReader(
+                                                        new InputStreamReader(
+                                                                process.getInputStream(),
+                                                                StandardCharsets.UTF_8))) {
+                                            String line;
+                                            while ((line =
+                                                            BoundedLineReader.readLine(
+                                                                    outputReader, 5_000_000))
+                                                    != null) {
+                                                outputLines.add(line);
+                                                if (liveUpdates) log.info(line);
+                                            }
+                                        } catch (InterruptedIOException e) {
+                                            log.warn(
+                                                    "Error reader thread was interrupted due to timeout.");
+                                        } catch (IOException e) {
+                                            log.error("exception", e);
+                                        }
+                                    });
 
             errorReaderThread.start();
             outputReaderThread.start();
@@ -370,7 +374,7 @@ public class ProcessExecutor {
             }
             // Match common unoconvert variants (but NOT soffice)
             String lowerBasename = basename.toLowerCase(java.util.Locale.ROOT);
-            if (lowerBasename.contains("unoconvert") || lowerBasename.equals("unoconv")) {
+            if (lowerBasename.contains("unoconvert") || "unoconv".equals(lowerBasename)) {
                 return true;
             }
         }

app/common/src/main/java/stirling/software/common/util/SvgSanitizer.java

@@ -86,7 +86,7 @@ public class SvgSanitizer {
         DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
 
         factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
-
+        factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
         factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
         factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
         factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);

app/common/src/main/java/stirling/software/common/util/YamlHelper.java

@@ -191,7 +191,7 @@ public class YamlHelper {
             mappingNode.getValue().clear();
             mappingNode.getValue().addAll(updatedTuples);
         }
-        setNewNode(node);
+        updatedRootNode = node;
 
         return updated;
     }

app/common/src/main/java/stirling/software/common/util/misc/ReplaceAndInvertColorStrategy.java

@@ -19,7 +19,7 @@ public abstract class ReplaceAndInvertColorStrategy extends PDFFile {
 
     public ReplaceAndInvertColorStrategy(MultipartFile file, ReplaceAndInvert replaceAndInvert) {
         setFileInput(file);
-        setReplaceAndInvert(replaceAndInvert);
+        this.replaceAndInvert = replaceAndInvert;
     }
 
     public abstract InputStreamResource replace() throws IOException;

app/common/src/main/java/stirling/software/common/util/propertyeditor/StringToArrayListPropertyEditor.java

@@ -4,18 +4,23 @@ import java.beans.PropertyEditorSupport;
 import java.util.ArrayList;
 import java.util.List;
 
-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.DeserializationFeature;
-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.model.api.security.RedactionArea;
 
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.DeserializationFeature;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
+
 @Slf4j
 public class StringToArrayListPropertyEditor extends PropertyEditorSupport {
 
-    private final ObjectMapper objectMapper = new ObjectMapper();
+    private final ObjectMapper objectMapper =
+            JsonMapper.builder()
+                    .enable(DeserializationFeature.ACCEPT_SINGLE_VALUE_AS_ARRAY)
+                    .disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)
+                    .build();
 
     @Override
     public void setAsText(String text) throws IllegalArgumentException {
@@ -24,7 +29,6 @@ public class StringToArrayListPropertyEditor extends PropertyEditorSupport {
             return;
         }
         try {
-            objectMapper.configure(DeserializationFeature.ACCEPT_SINGLE_VALUE_AS_ARRAY, true);
             TypeReference<ArrayList<RedactionArea>> typeRef = new TypeReference<>() {};
             List<RedactionArea> list = objectMapper.readValue(text, typeRef);
             setValue(list);

app/common/src/main/java/stirling/software/common/util/propertyeditor/StringToMapPropertyEditor.java

@@ -4,12 +4,13 @@ import java.beans.PropertyEditorSupport;
 import java.util.HashMap;
 import java.util.Map;
 
-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.ObjectMapper;
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
 
 public class StringToMapPropertyEditor extends PropertyEditorSupport {
 
-    private final ObjectMapper objectMapper = new ObjectMapper();
+    private final ObjectMapper objectMapper = JsonMapper.builder().build();
 
     @Override
     public void setAsText(String text) throws IllegalArgumentException {

app/common/src/test/java/stirling/software/common/service/SpyPDFDocumentFactory.java

@@ -12,11 +12,12 @@ class SpyPDFDocumentFactory extends CustomPDFDocumentFactory {
     public StrategyType lastStrategyUsed;
 
     public SpyPDFDocumentFactory(PdfMetadataService service) {
-        super(service);
+        super(service); // TempFileManager falls back to Files.createTempFile in tests
     }
 
     @Override
-    public StreamCacheCreateFunction getStreamCacheFunction(long contentSize) {
+    protected StreamCacheCreateFunction getStreamCacheFunction(
+            long contentSize, MemorySnapshot mem) {
         StrategyType type;
         if (contentSize < 10 * 1024 * 1024) {
             type = StrategyType.MEMORY_ONLY;
@@ -26,6 +27,6 @@ class SpyPDFDocumentFactory extends CustomPDFDocumentFactory {
             type = StrategyType.TEMP_FILE;
         }
         this.lastStrategyUsed = type;
-        return super.getStreamCacheFunction(contentSize); // delegate to real behavior
+        return super.getStreamCacheFunction(contentSize, mem);
     }
 }

app/common/src/test/java/stirling/software/common/util/UnoServerPoolTest.java

@@ -121,17 +121,19 @@ public class UnoServerPoolTest {
 
         // Try to acquire a third endpoint in separate thread (should block)
         Thread blockingThread =
-                new Thread(
-                        () -> {
-                            try {
-                                acquireLatch.countDown(); // Signal we're about to block
-                                UnoServerPool.UnoServerLease lease3 = pool.acquireEndpoint();
-                                acquired.incrementAndGet();
-                                lease3.close();
-                            } catch (InterruptedException e) {
-                                Thread.currentThread().interrupt();
-                            }
-                        });
+                Thread.ofVirtual()
+                        .unstarted(
+                                () -> {
+                                    try {
+                                        acquireLatch.countDown(); // Signal we're about to block
+                                        UnoServerPool.UnoServerLease lease3 =
+                                                pool.acquireEndpoint();
+                                        acquired.incrementAndGet();
+                                        lease3.close();
+                                    } catch (InterruptedException e) {
+                                        Thread.currentThread().interrupt();
+                                    }
+                                });
 
         blockingThread.start();
         acquireLatch.await(); // Wait for thread to start

app/common/src/test/java/stirling/software/common/util/propertyeditor/StringToArrayListPropertyEditorTest.java

@@ -143,11 +143,21 @@ class StringToArrayListPropertyEditorTest {
     }
 
     @Test
-    void testSetAsText_InvalidStructure() {
-        // Arrange - this JSON doesn't match RedactionArea structure
+    void testSetAsText_UnknownProperties() {
+        // Arrange - this JSON contains properties not in RedactionArea
+        // With FAIL_ON_UNKNOWN_PROPERTIES disabled, this should ignore the unknown properties
         String json = "[{\"invalid\":\"structure\"}]";
 
-        // Act & Assert
-        assertThrows(IllegalArgumentException.class, () -> editor.setAsText(json));
+        // Act
+        editor.setAsText(json);
+        Object value = editor.getValue();
+
+        // Assert
+        assertNotNull(value, "Value should not be null");
+        assertInstanceOf(List.class, value, "Value should be a List");
+
+        @SuppressWarnings("unchecked")
+        List<RedactionArea> list = (List<RedactionArea>) value;
+        assertEquals(1, list.size(), "List should have 1 entry (empty object)");
     }
 }

app/core/build.gradle

@@ -12,11 +12,10 @@ configurations {
 spotless {
     java {
         target 'src/**/java/**/*.java'
-        targetExclude 'src/main/resources/static/**'
+        targetExclude 'src/main/resources/static/**', 'src/main/java/org/apache/**'
         googleJavaFormat(googleJavaFormatVersion).aosp().reorderImports(false)
 
         importOrder("java", "javax", "org", "com", "net", "io", "jakarta", "lombok", "me", "stirling")
-        toggleOffOn()
         trimTrailingWhitespace()
         leadingTabsToSpaces()
         endWithNewline()
@@ -46,8 +45,23 @@ dependencies {
 
     implementation project(':common')
     implementation 'org.springframework.boot:spring-boot-starter-jetty'
-    implementation 'com.posthog.java:posthog:1.2.0'
-    implementation 'org.telegram:telegrambots:6.9.7.1'
+    implementation 'org.eclipse.jetty.http2:jetty-http2-server'
+    implementation ('org.telegram:telegrambots:6.9.7.1') {
+        // Grizzly server + Jersey JAX-RS stack: only used for webhook mode;
+        // Stirling-PDF uses long-polling mode so these are dead weight (~3 MB)
+        exclude group: 'org.glassfish.jersey.inject'
+        exclude group: 'org.glassfish.jersey.media'
+        exclude group: 'org.glassfish.jersey.containers'
+        exclude group: 'org.glassfish.jersey.core'
+        exclude group: 'org.glassfish.jersey.ext'
+        exclude group: 'org.glassfish.grizzly'
+        exclude group: 'org.glassfish.hk2'
+        exclude group: 'org.glassfish.hk2.external'
+        exclude group: 'org.javassist', module: 'javassist'
+        // Old javax JAX-RS Jackson bindings (not needed, project uses jakarta)
+        exclude group: 'com.fasterxml.jackson.jaxrs'
+        exclude group: 'com.fasterxml.jackson.module', module: 'jackson-module-jaxb-annotations'
+    }
     implementation 'commons-io:commons-io:2.21.0'
     implementation "org.bouncycastle:bcprov-jdk18on:$bouncycastleVersion"
     implementation "org.bouncycastle:bcpkix-jdk18on:$bouncycastleVersion"
@@ -61,11 +75,13 @@ dependencies {
     implementation "org.apache.pdfbox:xmpbox:$pdfboxVersion"
 
     implementation 'org.verapdf:validation-model:1.28.2'
+    // CVE-2025-66453: Explicit rhino 1.7.15 to override verapdf's 1.7.13
+    implementation 'org.mozilla:rhino:1.9.1'
 
     // veraPDF still uses javax.xml.bind, not the new jakarta namespace
     implementation 'javax.xml.bind:jaxb-api:2.3.1'
     implementation 'com.sun.xml.bind:jaxb-impl:2.3.9'
-    implementation 'com.sun.xml.bind:jaxb-core:2.3.0.1'
+    implementation 'com.sun.xml.bind:jaxb-core:4.0.6'
     implementation 'org.apache.poi:poi-ooxml:5.5.1'
 
     // https://mvnrepository.com/artifact/technology.tabula/tabula
@@ -74,12 +90,17 @@ dependencies {
         exclude group: 'org.bouncycastle', module: 'bcprov-jdk15on'
         exclude group: 'com.google.code.gson', module: 'gson'
     }
+    // CVE-2022-25647: Explicit gson 2.13.2 to prevent unsafe deserialization (tabula would pull 2.8.7)
+    implementation 'com.google.code.gson:gson:2.13.2'
     implementation 'org.apache.pdfbox:jbig2-imageio:3.0.4'
     implementation 'com.opencsv:opencsv:5.12.0' // https://mvnrepository.com/artifact/com.opencsv/opencsv
     implementation 'org.apache.poi:poi-ooxml:5.5.1'
 
-    // Batik
-    implementation 'org.apache.xmlgraphics:batik-all:1.19'
+    // Batik only bridge module needed (transitively pulls anim, gvt, util, css, dom, svg-dom)
+    // Replaces batik-all which included unused codec, svggen, transcoder, script modules
+    implementation 'org.apache.xmlgraphics:batik-bridge:1.19'
+    // Required by TwelveMonkeys imageio-batik SPI (SVGImageReaderSpi) during ImageIO init
+    runtimeOnly 'org.apache.xmlgraphics:batik-transcoder:1.19'
 
     // PDFBox Graphics2D bridge for Batik SVG to PDF conversion
     implementation 'de.rototor.pdfbox:graphics2d:3.0.5'

app/core/src/main/java/org/apache/pdfbox/examples/signature/CreateSignatureBase.java

@@ -88,10 +88,10 @@ public abstract class CreateSignatureBase implements SignatureInterface {
         Certificate cert = null;
         while (cert == null && aliases.hasMoreElements()) {
             alias = aliases.nextElement();
-            setPrivateKey((PrivateKey) keystore.getKey(alias, pin));
+            privateKey = (PrivateKey) keystore.getKey(alias, pin);
             Certificate[] certChain = keystore.getCertificateChain(alias);
             if (certChain != null) {
-                setCertificateChain(certChain);
+                certificateChain = certChain;
                 cert = certChain[0];
                 if (cert instanceof X509Certificate) {
                     // avoid expired certificate

app/core/src/main/java/stirling/software/SPDF/LibreOfficeListener.java

@@ -49,8 +49,8 @@ public class LibreOfficeListener {
         process = SystemCommand.runCommand(Runtime.getRuntime(), "unoconv --listener");
         lastActivityTime = System.currentTimeMillis();
 
-        // Start a background thread to monitor the activity timeout
-        executorService = Executors.newSingleThreadExecutor();
+        // Start a virtual thread to monitor the activity timeout
+        executorService = Executors.newVirtualThreadPerTaskExecutor();
         executorService.submit(
                 () -> {
                     while (true) {

app/core/src/main/java/stirling/software/SPDF/SPDFApplication.java

@@ -13,7 +13,7 @@ import java.util.regex.Pattern;
 
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
-import org.springframework.boot.web.context.WebServerInitializedEvent;
+import org.springframework.boot.context.event.ApplicationReadyEvent;
 import org.springframework.context.event.EventListener;
 import org.springframework.core.env.Environment;
 import org.springframework.scheduling.annotation.EnableScheduling;
@@ -134,7 +134,7 @@ public class SPDFApplication {
         baseUrlStatic = normalizeBackendUrl(backendUrl, serverPort);
         contextPathStatic = contextPath;
         serverPortStatic = serverPort;
-        String url = buildFullUrl(baseUrlStatic, getStaticPort(), contextPathStatic);
+        String url = buildFullUrl(baseUrlStatic, serverPortStatic, contextPathStatic);
 
         // Log Tauri mode information
         if (Boolean.parseBoolean(System.getProperty("STIRLING_PDF_TAURI_MODE", "false"))) {
@@ -176,16 +176,19 @@ public class SPDFApplication {
     }
 
     @EventListener
-    public void onWebServerInitialized(WebServerInitializedEvent event) {
-        int actualPort = event.getWebServer().getPort();
-        serverPortStatic = String.valueOf(actualPort);
+    public void onApplicationReady(ApplicationReadyEvent event) {
+        String port =
+                event.getApplicationContext().getEnvironment().getProperty("local.server.port");
+        if (port != null) {
+            serverPortStatic = port;
+        }
         // Log the actual runtime port for Tauri to parse
-        log.info("Stirling-PDF running on port: {}", actualPort);
+        log.info("Stirling-PDF running on port: {}", serverPortStatic);
     }
 
     private static void printStartupLogs() {
         log.info("Stirling-PDF Started.");
-        String url = buildFullUrl(baseUrlStatic, getStaticPort(), contextPathStatic);
+        String url = buildFullUrl(baseUrlStatic, serverPortStatic, contextPathStatic);
         log.info("Navigate to {}", url);
     }
 

app/core/src/main/java/stirling/software/SPDF/config/EndpointInspector.java

@@ -104,7 +104,7 @@ public class EndpointInspector implements ApplicationListener<ContextRefreshedEv
             String infoString = mappingInfo.toString();
             if (infoString.contains("{")) {
                 String patternsSection =
-                        infoString.substring(infoString.indexOf("{") + 1, infoString.indexOf("}"));
+                        infoString.substring(infoString.indexOf('{') + 1, infoString.indexOf('}'));
 
                 for (String pattern : patternsSection.split(",")) {
                     pattern = pattern.trim();

app/core/src/main/java/stirling/software/SPDF/config/ExternalAppDepConfig.java

@@ -51,9 +51,7 @@ public class ExternalAppDepConfig {
      */
     private final Map<String, List<String>> commandToGroupMapping;
 
-    private final ExecutorService pool =
-            Executors.newFixedThreadPool(
-                    Math.max(2, Runtime.getRuntime().availableProcessors() / 2));
+    private final ExecutorService pool = Executors.newVirtualThreadPerTaskExecutor();
 
     public ExternalAppDepConfig(
             EndpointConfiguration endpointConfiguration, RuntimePathConfig runtimePathConfig) {

app/core/src/main/java/stirling/software/SPDF/config/MultipartConfiguration.java

@@ -1,7 +1,7 @@
 package stirling.software.SPDF.config;
 
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.web.servlet.MultipartConfigFactory;
+import org.springframework.boot.servlet.MultipartConfigFactory;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.DependsOn;

app/core/src/main/java/stirling/software/SPDF/config/TauriProcessMonitor.java

@@ -54,8 +54,8 @@ public class TauriProcessMonitor {
         scheduler =
                 Executors.newSingleThreadScheduledExecutor(
                         r -> {
-                            Thread t = new Thread(r, "tauri-process-monitor");
-                            t.setDaemon(true);
+                            Thread t =
+                                    Thread.ofVirtual().name("tauri-process-monitor").unstarted(r);
                             return t;
                         });
 

app/core/src/main/java/stirling/software/SPDF/config/WebMvcConfig.java

@@ -82,6 +82,9 @@ public class WebMvcConfig implements WebMvcConfigurer {
             logger.info("Tauri mode detected - enabling CORS for Tauri protocols (v1 and v2)");
             registry.addMapping("/**")
                     .allowedOriginPatterns(
+                            "http://localhost:*",
+                            "https://localhost:*",
+                            "tauri://*", // Add this for Tauri apps
                             "tauri://localhost",
                             "http://tauri.localhost",
                             "https://tauri.localhost")
@@ -154,8 +157,8 @@ public class WebMvcConfig implements WebMvcConfigurer {
                     .maxAge(3600);
         } else {
             // Default to allowing all origins when nothing is configured
-            logger.info(
-                    "No CORS allowed origins configured in settings.yml (system.corsAllowedOrigins); allowing all origins.");
+            logger.debug(
+                    "No CORS allowed origins configured in settings.yml (system.corsAllowedOrigins); WebMvcConfig allowing all origins.");
             registry.addMapping("/**")
                     .allowedOriginPatterns("*")
                     .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")

app/core/src/main/java/stirling/software/SPDF/controller/api/CropController.java

@@ -24,6 +24,7 @@ import io.swagger.v3.oas.annotations.Operation;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.SPDF.config.EndpointConfiguration;
 import stirling.software.SPDF.model.api.general.CropPdfForm;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.GeneralApi;
@@ -118,6 +119,12 @@ public class CropController {
         return r >= threshold && g >= threshold && b >= threshold;
     }
 
+    private final EndpointConfiguration endpointConfiguration;
+
+    private boolean isGhostscriptEnabled() {
+        return endpointConfiguration.isGroupEnabled("Ghostscript");
+    }
+
     @AutoJobPostMapping(value = "/crop", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
     @Operation(
             summary = "Crops a PDF document",
@@ -137,7 +144,7 @@ public class CropController {
                     "Crop coordinates (x, y, width, height) are required when auto-crop is not enabled");
         }
 
-        if (request.isRemoveDataOutsideCrop()) {
+        if (request.isRemoveDataOutsideCrop() && isGhostscriptEnabled()) {
             return cropWithGhostscript(request);
         } else {
             return cropWithPDFBox(request);

app/core/src/main/java/stirling/software/SPDF/controller/api/EditTableOfContentsController.java

@@ -15,9 +15,6 @@ import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.multipart.MultipartFile;
 
-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import io.swagger.v3.oas.annotations.Operation;
 
 import lombok.Getter;
@@ -32,6 +29,9 @@ import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.WebResponseUtils;
 
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.ObjectMapper;
+
 @GeneralApi
 @Slf4j
 @RequiredArgsConstructor

app/core/src/main/java/stirling/software/SPDF/controller/api/PosterPdfController.java

@@ -1,7 +1,7 @@
 package stirling.software.SPDF.controller.api;
 
-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.zip.ZipEntry;
@@ -14,10 +14,10 @@ import org.apache.pdfbox.pdmodel.PDPageContentStream;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
 import org.apache.pdfbox.pdmodel.graphics.form.PDFormXObject;
 import org.apache.pdfbox.util.Matrix;
-import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
 
 import io.swagger.v3.oas.annotations.Operation;
 
@@ -31,6 +31,8 @@ import stirling.software.common.annotations.api.GeneralApi;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
+import stirling.software.common.util.TempFile;
+import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;
 
 @GeneralApi
@@ -39,10 +41,9 @@ import stirling.software.common.util.WebResponseUtils;
 public class PosterPdfController {
 
     private final CustomPDFDocumentFactory pdfDocumentFactory;
+    private final TempFileManager tempFileManager;
 
-    @AutoJobPostMapping(
-            value = "/split-for-poster-print",
-            consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @AutoJobPostMapping(value = "/split-for-poster-print", consumes = "multipart/form-data")
     @MultiFileResponse
     @Operation(
             summary = "Split large PDF pages into smaller printable chunks",
@@ -51,7 +52,7 @@ public class PosterPdfController {
                             + "suitable for printing on standard paper sizes (e.g., A4, Letter). "
                             + "Divides each page into a grid of smaller pages using Apache PDFBox. "
                             + "Input: PDF Output: ZIP-PDF Type: SISO")
-    public ResponseEntity<byte[]> posterPdf(@ModelAttribute PosterPdfRequest request)
+    public ResponseEntity<StreamingResponseBody> posterPdf(@ModelAttribute PosterPdfRequest request)
             throws Exception {
 
         log.debug("Starting PDF poster split process with request: {}", request);
@@ -60,184 +61,187 @@ public class PosterPdfController {
         String filename = GeneralUtils.generateFilename(file.getOriginalFilename(), "");
         log.debug("Base filename for output: {}", filename);
 
-        try (PDDocument sourceDocument = pdfDocumentFactory.load(file);
-                PDDocument outputDocument =
-                        pdfDocumentFactory.createNewDocumentBasedOnOldDocument(sourceDocument);
-                ByteArrayOutputStream pdfOutputStream = new ByteArrayOutputStream();
-                ByteArrayOutputStream zipOutputStream = new ByteArrayOutputStream()) {
+        TempFile zipTempFile = new TempFile(tempFileManager, ".zip");
+        try {
+            try (PDDocument sourceDocument = pdfDocumentFactory.load(file);
+                    PDDocument outputDocument =
+                            pdfDocumentFactory.createNewDocumentBasedOnOldDocument(sourceDocument);
+                    TempFile pdfTempFile = new TempFile(tempFileManager, ".pdf")) {
 
-            // Get target page size
-            PDRectangle targetPageSize = getTargetPageSize(request.getPageSize());
-            log.debug(
-                    "Target page size: {} ({}x{})",
-                    request.getPageSize(),
-                    targetPageSize.getWidth(),
-                    targetPageSize.getHeight());
+                // Get target page size
+                PDRectangle targetPageSize = getTargetPageSize(request.getPageSize());
+                log.debug(
+                        "Target page size: {} ({}x{})",
+                        request.getPageSize(),
+                        targetPageSize.getWidth(),
+                        targetPageSize.getHeight());
 
-            // Create LayerUtility for importing pages as forms
-            LayerUtility layerUtility = new LayerUtility(outputDocument);
+                // Create LayerUtility for importing pages as forms
+                LayerUtility layerUtility = new LayerUtility(outputDocument);
 
-            int totalPages = sourceDocument.getNumberOfPages();
-            int xFactor = request.getXFactor();
-            int yFactor = request.getYFactor();
-            boolean rightToLeft = request.isRightToLeft();
-
-            log.debug(
-                    "Processing {} pages with grid {}x{}, RTL={}",
-                    totalPages,
-                    xFactor,
-                    yFactor,
-                    rightToLeft);
-
-            // Process each page
-            for (int pageIndex = 0; pageIndex < totalPages; pageIndex++) {
-                PDPage sourcePage = sourceDocument.getPage(pageIndex);
-
-                // Get both MediaBox and CropBox
-                PDRectangle mediaBox = sourcePage.getMediaBox();
-                PDRectangle cropBox = sourcePage.getCropBox();
-
-                // If no CropBox is set, use MediaBox
-                if (cropBox == null) {
-                    cropBox = mediaBox;
-                }
-
-                // Save original boxes for restoration
-                PDRectangle originalMediaBox = sourcePage.getMediaBox();
-                PDRectangle originalCropBox = sourcePage.getCropBox();
-
-                // Normalize the page: set MediaBox to CropBox
-                // This ensures the form's coordinate space starts at (0, 0)
-                // instead of having an offset from the original MediaBox
-                sourcePage.setMediaBox(cropBox);
-                sourcePage.setCropBox(cropBox);
-
-                // Handle page rotation
-                int rotation = sourcePage.getRotation();
-                float sourceWidth = cropBox.getWidth();
-                float sourceHeight = cropBox.getHeight();
-
-                // Swap dimensions if rotated 90 or 270 degrees
-                if (rotation == 90 || rotation == 270) {
-                    float temp = sourceWidth;
-                    sourceWidth = sourceHeight;
-                    sourceHeight = temp;
-                }
+                int totalPages = sourceDocument.getNumberOfPages();
+                int xFactor = request.getXFactor();
+                int yFactor = request.getYFactor();
+                boolean rightToLeft = request.isRightToLeft();
 
                 log.debug(
-                        "Page {}: Normalized to CropBox dimensions {}x{}, rotation {}",
-                        pageIndex,
-                        sourceWidth,
-                        sourceHeight,
-                        rotation);
+                        "Processing {} pages with grid {}x{}, RTL={}",
+                        totalPages,
+                        xFactor,
+                        yFactor,
+                        rightToLeft);
 
-                // Import source page as form (now with normalized coordinate space)
-                PDFormXObject form = layerUtility.importPageAsForm(sourceDocument, pageIndex);
+                // Process each page
+                for (int pageIndex = 0; pageIndex < totalPages; pageIndex++) {
+                    PDPage sourcePage = sourceDocument.getPage(pageIndex);
 
-                // Restore original boxes
-                sourcePage.setMediaBox(originalMediaBox);
-                sourcePage.setCropBox(originalCropBox);
+                    // Get both MediaBox and CropBox
+                    PDRectangle mediaBox = sourcePage.getMediaBox();
+                    PDRectangle cropBox = sourcePage.getCropBox();
 
-                // Calculate cell dimensions in source page coordinates
-                float cellWidth = sourceWidth / xFactor;
-                float cellHeight = sourceHeight / yFactor;
+                    // If no CropBox is set, use MediaBox
+                    if (cropBox == null) {
+                        cropBox = mediaBox;
+                    }
 
-                // Create grid cells (rows × columns)
-                for (int row = 0; row < yFactor; row++) {
-                    for (int col = 0; col < xFactor; col++) {
-                        // Apply RTL ordering for columns if enabled
-                        int actualCol = rightToLeft ? (xFactor - 1 - col) : col;
+                    // Save original boxes for restoration
+                    PDRectangle originalMediaBox = sourcePage.getMediaBox();
+                    PDRectangle originalCropBox = sourcePage.getCropBox();
 
-                        // Calculate crop rectangle in source coordinates
-                        // PDF coordinates start at bottom-left
-                        float cropX = actualCol * cellWidth;
-                        // For Y: invert so row 0 shows TOP (following SplitPdfBySectionsController
-                        // pattern)
-                        float cropY = (yFactor - 1 - row) * cellHeight;
+                    // Normalize the page: set MediaBox to CropBox
+                    // This ensures the form's coordinate space starts at (0, 0)
+                    // instead of having an offset from the original MediaBox
+                    sourcePage.setMediaBox(cropBox);
+                    sourcePage.setCropBox(cropBox);
 
-                        // Create new output page with target size
-                        PDPage outputPage = new PDPage(targetPageSize);
-                        outputDocument.addPage(outputPage);
+                    // Handle page rotation
+                    int rotation = sourcePage.getRotation();
+                    float sourceWidth = cropBox.getWidth();
+                    float sourceHeight = cropBox.getHeight();
 
-                        try (PDPageContentStream contentStream =
-                                new PDPageContentStream(
-                                        outputDocument,
-                                        outputPage,
-                                        PDPageContentStream.AppendMode.APPEND,
-                                        true,
-                                        true)) {
+                    // Swap dimensions if rotated 90 or 270 degrees
+                    if (rotation == 90 || rotation == 270) {
+                        float temp = sourceWidth;
+                        sourceWidth = sourceHeight;
+                        sourceHeight = temp;
+                    }
 
-                            // Calculate uniform scale to fit cell into target page
-                            // Scale UP if cell is smaller than target, scale DOWN if larger
-                            float scaleX = targetPageSize.getWidth() / cellWidth;
-                            float scaleY = targetPageSize.getHeight() / cellHeight;
-                            float scale = Math.min(scaleX, scaleY);
+                    log.debug(
+                            "Page {}: Normalized to CropBox dimensions {}x{}, rotation {}",
+                            pageIndex,
+                            sourceWidth,
+                            sourceHeight,
+                            rotation);
 
-                            // Center the scaled content on the target page
-                            float scaledCellWidth = cellWidth * scale;
-                            float scaledCellHeight = cellHeight * scale;
-                            float offsetX = (targetPageSize.getWidth() - scaledCellWidth) / 2;
-                            float offsetY = (targetPageSize.getHeight() - scaledCellHeight) / 2;
+                    // Import source page as form (now with normalized coordinate space)
+                    PDFormXObject form = layerUtility.importPageAsForm(sourceDocument, pageIndex);
 
-                            // Apply transformations
-                            contentStream.saveGraphicsState();
+                    // Restore original boxes
+                    sourcePage.setMediaBox(originalMediaBox);
+                    sourcePage.setCropBox(originalCropBox);
 
-                            // Translate to center position
-                            contentStream.transform(Matrix.getTranslateInstance(offsetX, offsetY));
+                    // Calculate cell dimensions in source page coordinates
+                    float cellWidth = sourceWidth / xFactor;
+                    float cellHeight = sourceHeight / yFactor;
 
-                            // Scale uniformly
-                            contentStream.transform(Matrix.getScaleInstance(scale, scale));
+                    // Create grid cells (rows × columns)
+                    for (int row = 0; row < yFactor; row++) {
+                        for (int col = 0; col < xFactor; col++) {
+                            // Apply RTL ordering for columns if enabled
+                            int actualCol = rightToLeft ? (xFactor - 1 - col) : col;
 
-                            // Translate to show only the desired grid cell
-                            // IMPORTANT: The PDFormXObject's BBox already matches the CropBox
-                            // (including its offset), so we only need to translate by cropX/cropY
-                            // relative to the CropBox origin, NOT the MediaBox origin
-                            contentStream.transform(Matrix.getTranslateInstance(-cropX, -cropY));
+                            // Calculate crop rectangle in source coordinates
+                            // PDF coordinates start at bottom-left
+                            float cropX = actualCol * cellWidth;
+                            // For Y: invert so row 0 shows TOP (following
+                            // SplitPdfBySectionsController
+                            // pattern)
+                            float cropY = (yFactor - 1 - row) * cellHeight;
 
-                            // Draw the form
-                            contentStream.drawForm(form);
+                            // Create new output page with target size
+                            PDPage outputPage = new PDPage(targetPageSize);
+                            outputDocument.addPage(outputPage);
 
-                            contentStream.restoreGraphicsState();
+                            try (PDPageContentStream contentStream =
+                                    new PDPageContentStream(
+                                            outputDocument,
+                                            outputPage,
+                                            PDPageContentStream.AppendMode.APPEND,
+                                            true,
+                                            true)) {
+
+                                // Calculate uniform scale to fit cell into target page
+                                // Scale UP if cell is smaller than target, scale DOWN if larger
+                                float scaleX = targetPageSize.getWidth() / cellWidth;
+                                float scaleY = targetPageSize.getHeight() / cellHeight;
+                                float scale = Math.min(scaleX, scaleY);
+
+                                // Center the scaled content on the target page
+                                float scaledCellWidth = cellWidth * scale;
+                                float scaledCellHeight = cellHeight * scale;
+                                float offsetX = (targetPageSize.getWidth() - scaledCellWidth) / 2;
+                                float offsetY = (targetPageSize.getHeight() - scaledCellHeight) / 2;
+
+                                // Apply transformations
+                                contentStream.saveGraphicsState();
+
+                                // Translate to center position
+                                contentStream.transform(
+                                        Matrix.getTranslateInstance(offsetX, offsetY));
+
+                                // Scale uniformly
+                                contentStream.transform(Matrix.getScaleInstance(scale, scale));
+
+                                // Translate to show only the desired grid cell
+                                // IMPORTANT: The PDFormXObject's BBox already matches the CropBox
+                                // (including its offset), so we only need to translate by
+                                // cropX/cropY
+                                // relative to the CropBox origin, NOT the MediaBox origin
+                                contentStream.transform(
+                                        Matrix.getTranslateInstance(-cropX, -cropY));
+
+                                // Draw the form
+                                contentStream.drawForm(form);
+
+                                contentStream.restoreGraphicsState();
+                            }
+
+                            log.trace(
+                                    "Created output page for grid cell [{},{}] of page {}: cropX={}, cropY={}, translate=({}, {})",
+                                    row,
+                                    actualCol,
+                                    pageIndex,
+                                    cropX,
+                                    cropY,
+                                    -cropX,
+                                    -cropY);
                         }
-
-                        log.trace(
-                                "Created output page for grid cell [{},{}] of page {}: cropX={}, cropY={}, translate=({}, {})",
-                                row,
-                                actualCol,
-                                pageIndex,
-                                cropX,
-                                cropY,
-                                -cropX,
-                                -cropY);
                     }
                 }
+
+                // Save output PDF to intermediate TempFile
+                outputDocument.save(pdfTempFile.getFile());
+                log.debug("Generated output PDF with {} pages", outputDocument.getNumberOfPages());
+
+                // Create ZIP from the PDF TempFile, streaming directly to zip TempFile
+                try (ZipOutputStream zipOut =
+                        new ZipOutputStream(Files.newOutputStream(zipTempFile.getPath()))) {
+                    zipOut.putNextEntry(new ZipEntry(filename + "_poster.pdf"));
+                    Files.copy(pdfTempFile.getPath(), zipOut);
+                    zipOut.closeEntry();
+                }
+                // pdfTempFile auto-closed and deleted here (end of inner try-with-resources)
             }
 
-            // Save output PDF
-            outputDocument.save(pdfOutputStream);
-            byte[] pdfData = pdfOutputStream.toByteArray();
-
-            log.debug(
-                    "Generated output PDF with {} pages ({} bytes)",
-                    outputDocument.getNumberOfPages(),
-                    pdfData.length);
-
-            // Create ZIP file with the result
-            try (ZipOutputStream zipOut = new ZipOutputStream(zipOutputStream)) {
-                ZipEntry zipEntry = new ZipEntry(filename + "_poster.pdf");
-                zipOut.putNextEntry(zipEntry);
-                zipOut.write(pdfData);
-                zipOut.closeEntry();
-            }
-
-            byte[] zipData = zipOutputStream.toByteArray();
-            log.debug("Successfully created ZIP with {} bytes", zipData.length);
-
-            return WebResponseUtils.bytesToWebResponse(
-                    zipData, filename + "_poster.zip", MediaType.APPLICATION_OCTET_STREAM);
+            log.debug("Successfully created ZIP");
+            return WebResponseUtils.zipFileToWebResponse(zipTempFile, filename + "_poster.zip");
 
         } catch (IOException e) {
             ExceptionUtils.logException("PDF poster split process", e);
+            zipTempFile.close();
+            throw e;
+        } catch (Exception e) {
+            zipTempFile.close();
             throw e;
         }
     }

app/core/src/main/java/stirling/software/SPDF/controller/api/SplitPDFController.java

@@ -1,6 +1,5 @@
 package stirling.software.SPDF.controller.api;
 
-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.util.ArrayList;
@@ -10,11 +9,11 @@ import java.util.zip.ZipEntry;
 import java.util.zip.ZipOutputStream;
 
 import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.PDPage;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
 
 import io.swagger.v3.oas.annotations.Operation;
 
@@ -49,83 +48,60 @@ public class SplitPDFController {
                             + " specified page numbers or ranges. Users can specify pages using"
                             + " individual numbers, ranges, or 'all' for every page. Input:PDF"
                             + " Output:PDF Type:SIMO")
-    public ResponseEntity<byte[]> splitPdf(@ModelAttribute PDFWithPageNums request)
+    public ResponseEntity<StreamingResponseBody> splitPdf(@ModelAttribute PDFWithPageNums request)
             throws IOException {
 
         MultipartFile file = request.getFileInput();
-
-        try (TempFile outputTempFile = new TempFile(tempFileManager, ".zip");
-                PDDocument document = pdfDocumentFactory.load(file)) {
-
-            List<ByteArrayOutputStream> splitDocumentsBoas = new ArrayList<>();
-
-            int totalPages = document.getNumberOfPages();
-            List<Integer> pageNumbers = request.getPageNumbersList(document, false);
-            if (!pageNumbers.contains(totalPages - 1)) {
-                // Create a mutable ArrayList so we can add to it
-                pageNumbers = new ArrayList<>(pageNumbers);
-                pageNumbers.add(totalPages - 1);
-            }
-
-            log.debug(
-                    "Splitting PDF into pages: {}",
-                    pageNumbers.stream().map(String::valueOf).collect(Collectors.joining(",")));
-
-            splitDocumentsBoas = new ArrayList<>(pageNumbers.size());
-            int previousPageNumber = 0;
-            for (int splitPoint : pageNumbers) {
-                try (PDDocument splitDocument =
-                                pdfDocumentFactory.createNewDocumentBasedOnOldDocument(document);
-                        ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
-                    for (int i = previousPageNumber; i <= splitPoint; i++) {
-                        PDPage page = document.getPage(i);
-                        splitDocument.addPage(page);
-                        log.debug("Adding page {} to split document", i);
-                    }
-                    previousPageNumber = splitPoint + 1;
-
-                    // Transfer metadata to split pdf
-                    // PdfMetadataService.setMetadataToPdf(splitDocument, metadata);
-
-                    splitDocument.save(baos);
-                    splitDocumentsBoas.add(baos);
-                } catch (Exception e) {
-                    ExceptionUtils.logException("document splitting and saving", e);
-                    throw e;
+        TempFile outputTempFile = new TempFile(tempFileManager, ".zip");
+        try {
+            try (PDDocument document = pdfDocumentFactory.load(file)) {
+                int totalPages = document.getNumberOfPages();
+                List<Integer> pageNumbers = request.getPageNumbersList(document, false);
+                if (!pageNumbers.contains(totalPages - 1)) {
+                    pageNumbers = new ArrayList<>(pageNumbers);
+                    pageNumbers.add(totalPages - 1);
                 }
-            }
 
-            String baseFilename = GeneralUtils.removeExtension(file.getOriginalFilename());
+                log.debug(
+                        "Splitting PDF into pages: {}",
+                        pageNumbers.stream().map(String::valueOf).collect(Collectors.joining(",")));
 
-            try (ZipOutputStream zipOut =
-                    new ZipOutputStream(Files.newOutputStream(outputTempFile.getPath()))) {
-                int splitDocumentsSize = splitDocumentsBoas.size();
-                for (int i = 0; i < splitDocumentsSize; i++) {
-                    StringBuilder sb = new StringBuilder(baseFilename.length() + 10);
-                    sb.append(baseFilename).append('_').append(i + 1).append(".pdf");
-                    String fileName = sb.toString();
+                String baseFilename = GeneralUtils.removeExtension(file.getOriginalFilename());
+                try (ZipOutputStream zipOut =
+                        new ZipOutputStream(Files.newOutputStream(outputTempFile.getPath()))) {
+                    int previousPageNumber = 0;
+                    for (int splitIndex = 0; splitIndex < pageNumbers.size(); splitIndex++) {
+                        int splitPoint = pageNumbers.get(splitIndex);
+                        try (PDDocument splitDocument =
+                                pdfDocumentFactory.createNewDocumentBasedOnOldDocument(document)) {
+                            for (int i = previousPageNumber; i <= splitPoint; i++) {
+                                splitDocument.addPage(document.getPage(i));
+                                log.debug("Adding page {} to split document", i);
+                            }
+                            previousPageNumber = splitPoint + 1;
 
-                    ByteArrayOutputStream baos = splitDocumentsBoas.get(i);
-                    byte[] pdf = baos.toByteArray();
-
-                    ZipEntry pdfEntry = new ZipEntry(fileName);
-                    zipOut.putNextEntry(pdfEntry);
-                    zipOut.write(pdf);
-                    zipOut.closeEntry();
-
-                    log.debug("Wrote split document {} to zip file", fileName);
+                            String fileName = baseFilename + "_" + (splitIndex + 1) + ".pdf";
+                            zipOut.putNextEntry(new ZipEntry(fileName));
+                            splitDocument.save(zipOut);
+                            zipOut.closeEntry();
+                            log.debug("Wrote split document {} to zip file", fileName);
+                        } catch (Exception e) {
+                            ExceptionUtils.logException("document splitting and saving", e);
+                            throw e;
+                        }
+                    }
                 }
             }
 
             log.debug(
                     "Successfully created zip file with split documents: {}",
                     outputTempFile.getPath().toString());
-            byte[] data = Files.readAllBytes(outputTempFile.getPath());
-
             String zipFilename =
                     GeneralUtils.generateFilename(file.getOriginalFilename(), "_split.zip");
-            return WebResponseUtils.bytesToWebResponse(
-                    data, zipFilename, MediaType.APPLICATION_OCTET_STREAM);
+            return WebResponseUtils.zipFileToWebResponse(outputTempFile, zipFilename);
+        } catch (Exception e) {
+            outputTempFile.close();
+            throw e;
         }
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/SplitPdfByChaptersController.java

@@ -1,8 +1,6 @@
 package stirling.software.SPDF.controller.api;
 
-import java.io.ByteArrayOutputStream;
 import java.nio.file.Files;
-import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Locale;
@@ -17,6 +15,7 @@ import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
 
 import io.swagger.v3.oas.annotations.Operation;
 
@@ -36,6 +35,8 @@ import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.service.PdfMetadataService;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
+import stirling.software.common.util.TempFile;
+import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;
 
 @GeneralApi
@@ -47,6 +48,8 @@ public class SplitPdfByChaptersController {
 
     private final CustomPDFDocumentFactory pdfDocumentFactory;
 
+    private final TempFileManager tempFileManager;
+
     private static List<Bookmark> extractOutlineItems(
             PDDocument sourceDocument,
             PDOutlineItem current,
@@ -122,22 +125,19 @@ public class SplitPdfByChaptersController {
     @Operation(
             summary = "Split PDFs by Chapters",
             description = "Splits a PDF into chapters and returns a ZIP file.")
-    public ResponseEntity<byte[]> splitPdf(@ModelAttribute SplitPdfByChaptersRequest request)
-            throws Exception {
+    public ResponseEntity<StreamingResponseBody> splitPdf(
+            @ModelAttribute SplitPdfByChaptersRequest request) throws Exception {
         MultipartFile file = request.getFileInput();
-        PDDocument sourceDocument = null;
-        Path zipFile = null;
 
-        try {
-            boolean includeMetadata = Boolean.TRUE.equals(request.getIncludeMetadata());
-            Integer bookmarkLevel =
-                    request.getBookmarkLevel(); // levels start from 0 (top most bookmarks)
-            if (bookmarkLevel < 0) {
-                throw ExceptionUtils.createIllegalArgumentException(
-                        "error.invalidArgument", "Invalid argument: {0}", "bookmark level");
-            }
-            sourceDocument = pdfDocumentFactory.load(file);
+        boolean includeMetadata = Boolean.TRUE.equals(request.getIncludeMetadata());
+        Integer bookmarkLevel =
+                request.getBookmarkLevel(); // levels start from 0 (top most bookmarks)
+        if (bookmarkLevel < 0) {
+            throw ExceptionUtils.createIllegalArgumentException(
+                    "error.invalidArgument", "Invalid argument: {0}", "bookmark level");
+        }
 
+        try (PDDocument sourceDocument = pdfDocumentFactory.load(file)) {
             PDDocumentOutline outline = sourceDocument.getDocumentCatalog().getDocumentOutline();
 
             if (outline == null) {
@@ -157,12 +157,10 @@ public class SplitPdfByChaptersController {
                                 bookmarkLevel);
                 // to handle last page edge case
                 bookmarks.get(bookmarks.size() - 1).setEndPage(sourceDocument.getNumberOfPages());
-                Bookmark lastBookmark = bookmarks.get(bookmarks.size() - 1);
 
             } catch (Exception e) {
                 ExceptionUtils.logException("outline extraction", e);
-                return ResponseEntity.internalServerError()
-                        .body("Unable to extract outline items".getBytes());
+                throw e;
             }
 
             boolean allowDuplicates = Boolean.TRUE.equals(request.getAllowDuplicates());
@@ -181,29 +179,10 @@ public class SplitPdfByChaptersController {
                         bookmark.getStartPage(),
                         bookmark.getEndPage());
             }
-            List<ByteArrayOutputStream> splitDocumentsBoas =
-                    getSplitDocumentsBoas(sourceDocument, bookmarks, includeMetadata);
-
-            zipFile = createZipFile(bookmarks, splitDocumentsBoas);
-
-            byte[] data = Files.readAllBytes(zipFile);
-            Files.deleteIfExists(zipFile);
 
+            TempFile zipTempFile = createZipFile(sourceDocument, bookmarks, includeMetadata);
             String filename = GeneralUtils.generateFilename(file.getOriginalFilename(), "");
-            sourceDocument.close();
-            return WebResponseUtils.bytesToWebResponse(
-                    data, filename + ".zip", MediaType.APPLICATION_OCTET_STREAM);
-        } finally {
-            try {
-                if (sourceDocument != null) {
-                    sourceDocument.close();
-                }
-                if (zipFile != null) {
-                    Files.deleteIfExists(zipFile);
-                }
-            } catch (Exception e) {
-                log.error("Error while cleaning up resources", e);
-            }
+            return WebResponseUtils.zipFileToWebResponse(zipTempFile, filename + ".zip");
         }
     }
 
@@ -232,72 +211,55 @@ public class SplitPdfByChaptersController {
         return bookmarks;
     }
 
-    private Path createZipFile(
-            List<Bookmark> bookmarks, List<ByteArrayOutputStream> splitDocumentsBoas)
-            throws Exception {
-        Path zipFile = Files.createTempFile("split_documents", ".zip");
-        String fileNumberFormatter = "%0" + (Integer.toString(bookmarks.size()).length()) + "d ";
-        try (ZipOutputStream zipOut = new ZipOutputStream(Files.newOutputStream(zipFile))) {
-            for (int i = 0; i < splitDocumentsBoas.size(); i++) {
-
-                // split files will be named as "[FILE_NUMBER] [BOOKMARK_TITLE].pdf"
-
-                String fileName =
-                        String.format(Locale.ROOT, fileNumberFormatter, i)
-                                + bookmarks.get(i).getTitle()
-                                + ".pdf";
-                ByteArrayOutputStream baos = splitDocumentsBoas.get(i);
-                byte[] pdf = baos.toByteArray();
-
-                ZipEntry pdfEntry = new ZipEntry(fileName);
-                zipOut.putNextEntry(pdfEntry);
-                zipOut.write(pdf);
-                zipOut.closeEntry();
-
-                log.debug("Wrote split document {} to zip file", fileName);
-            }
-        } catch (Exception e) {
-            log.error("Failed writing to zip", e);
-            throw e;
-        }
-
-        log.info("Successfully created zip file with split documents: {}", zipFile);
-        return zipFile;
-    }
-
-    public List<ByteArrayOutputStream> getSplitDocumentsBoas(
+    private TempFile createZipFile(
             PDDocument sourceDocument, List<Bookmark> bookmarks, boolean includeMetadata)
             throws Exception {
-        List<ByteArrayOutputStream> splitDocumentsBoas = new ArrayList<>();
-        PdfMetadata metadata = null;
-        if (includeMetadata) {
-            metadata = pdfMetadataService.extractMetadataFromPdf(sourceDocument);
-        }
-        for (Bookmark bookmark : bookmarks) {
-            try (PDDocument splitDocument = new PDDocument()) {
-                boolean isSinglePage = (bookmark.getStartPage() == bookmark.getEndPage());
+        PdfMetadata metadata =
+                includeMetadata ? pdfMetadataService.extractMetadataFromPdf(sourceDocument) : null;
+        String fileNumberFormatter = "%0" + (Integer.toString(bookmarks.size()).length()) + "d ";
+        TempFile zipTempFile = new TempFile(tempFileManager, ".zip");
+        try {
+            try (ZipOutputStream zipOut =
+                    new ZipOutputStream(Files.newOutputStream(zipTempFile.getPath()))) {
+                for (int i = 0; i < bookmarks.size(); i++) {
+                    Bookmark bookmark = bookmarks.get(i);
+                    try (PDDocument splitDocument = new PDDocument()) {
+                        boolean isSinglePage = (bookmark.getStartPage() == bookmark.getEndPage());
 
-                for (int i = bookmark.getStartPage();
-                        i < bookmark.getEndPage() + (isSinglePage ? 1 : 0);
-                        i++) {
-                    PDPage page = sourceDocument.getPage(i);
-                    splitDocument.addPage(page);
-                    log.debug("Adding page {} to split document", i);
+                        for (int pg = bookmark.getStartPage();
+                                pg < bookmark.getEndPage() + (isSinglePage ? 1 : 0);
+                                pg++) {
+                            PDPage page = sourceDocument.getPage(pg);
+                            splitDocument.addPage(page);
+                            log.debug("Adding page {} to split document", pg);
+                        }
+                        if (includeMetadata) {
+                            pdfMetadataService.setMetadataToPdf(splitDocument, metadata);
+                        }
+
+                        // split files will be named as "[FILE_NUMBER] [BOOKMARK_TITLE].pdf"
+                        String fileName =
+                                String.format(Locale.ROOT, fileNumberFormatter, i)
+                                        + bookmark.getTitle()
+                                        + ".pdf";
+                        zipOut.putNextEntry(new ZipEntry(fileName));
+                        splitDocument.save(zipOut);
+                        zipOut.closeEntry();
+                        log.debug("Wrote split document {} to zip file", fileName);
+                    } catch (Exception e) {
+                        ExceptionUtils.logException("document splitting and saving", e);
+                        throw e;
+                    }
                 }
-                ByteArrayOutputStream baos = new ByteArrayOutputStream();
-                if (includeMetadata) {
-                    pdfMetadataService.setMetadataToPdf(splitDocument, metadata);
-                }
-
-                splitDocument.save(baos);
-
-                splitDocumentsBoas.add(baos);
-            } catch (Exception e) {
-                ExceptionUtils.logException("document splitting and saving", e);
-                throw e;
             }
+            log.info(
+                    "Successfully created zip file with split documents: {}",
+                    zipTempFile.getPath());
+            return zipTempFile;
+        } catch (Exception e) {
+            zipTempFile.close();
+            throw e;
         }
-        return splitDocumentsBoas;
     }
 }
 

app/core/src/main/java/stirling/software/SPDF/controller/api/SplitPdfBySizeController.java

@@ -3,7 +3,6 @@ package stirling.software.SPDF.controller.api;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.file.Files;
-import java.nio.file.Path;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipOutputStream;
 
@@ -13,9 +12,11 @@ import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
 
 import io.swagger.v3.oas.annotations.Operation;
 
+import lombok.Getter;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
@@ -50,8 +51,8 @@ public class SplitPdfBySizeController {
                             + " if 10MB and each page is 1MB and you enter 2MB then 5 docs each 2MB"
                             + " (rounded so that it accepts 1.9MB but not 2.1MB) Input:PDF"
                             + " Output:ZIP-PDF Type:SISO")
-    public ResponseEntity<byte[]> autoSplitPdf(@ModelAttribute SplitPdfBySizeOrCountRequest request)
-            throws Exception {
+    public ResponseEntity<StreamingResponseBody> autoSplitPdf(
+            @ModelAttribute SplitPdfBySizeOrCountRequest request) throws Exception {
 
         log.debug("Starting PDF split process with request: {}", request);
         MultipartFile file = request.getFileInput();
@@ -59,63 +60,51 @@ public class SplitPdfBySizeController {
         String filename = GeneralUtils.generateFilename(file.getOriginalFilename(), "");
         log.debug("Base filename for output: {}", filename);
 
-        try (TempFile zipTempFile = new TempFile(tempFileManager, ".zip")) {
-            Path managedZipPath = zipTempFile.getPath();
-            log.debug("Created temporary managed zip file: {}", managedZipPath);
-            try {
-                log.debug("Reading input file bytes");
-                byte[] pdfBytes = file.getBytes();
-                log.debug("Successfully read {} bytes from input file", pdfBytes.length);
+        TempFile zipTempFile = new TempFile(tempFileManager, ".zip");
+        try {
+            log.debug("Created temporary managed zip file: {}", zipTempFile.getPath());
+            log.debug("Creating ZIP output stream");
+            try (ZipOutputStream zipOut =
+                            new ZipOutputStream(Files.newOutputStream(zipTempFile.getPath()));
+                    PDDocument sourceDocument = pdfDocumentFactory.load(file)) {
+                log.debug(
+                        "Successfully loaded PDF with {} pages", sourceDocument.getNumberOfPages());
 
-                log.debug("Creating ZIP output stream");
-                try (ZipOutputStream zipOut =
-                        new ZipOutputStream(Files.newOutputStream(managedZipPath))) {
-                    log.debug("Loading PDF document");
-                    try (PDDocument sourceDocument = pdfDocumentFactory.load(pdfBytes)) {
-                        log.debug(
-                                "Successfully loaded PDF with {} pages",
-                                sourceDocument.getNumberOfPages());
+                int type = request.getSplitType();
+                String value = request.getSplitValue();
+                log.debug("Split type: {}, Split value: {}", type, value);
 
-                        int type = request.getSplitType();
-                        String value = request.getSplitValue();
-                        log.debug("Split type: {}, Split value: {}", type, value);
-
-                        if (type == 0) {
-                            log.debug("Processing split by size");
-                            long maxBytes = GeneralUtils.convertSizeToBytes(value);
-                            log.debug("Max bytes per document: {}", maxBytes);
-                            handleSplitBySize(sourceDocument, maxBytes, zipOut, filename);
-                        } else if (type == 1) {
-                            log.debug("Processing split by page count");
-                            int pageCount = Integer.parseInt(value);
-                            log.debug("Pages per document: {}", pageCount);
-                            handleSplitByPageCount(sourceDocument, pageCount, zipOut, filename);
-                        } else if (type == 2) {
-                            log.debug("Processing split by document count");
-                            int documentCount = Integer.parseInt(value);
-                            log.debug("Total number of documents: {}", documentCount);
-                            handleSplitByDocCount(sourceDocument, documentCount, zipOut, filename);
-                        } else {
-                            log.error("Invalid split type: {}", type);
-                            throw ExceptionUtils.createIllegalArgumentException(
-                                    "error.invalidArgument",
-                                    "Invalid argument: {0}",
-                                    "split type: " + type);
-                        }
-                        log.debug("PDF splitting completed successfully");
-                    }
+                if (type == 0) {
+                    log.debug("Processing split by size");
+                    long maxBytes = GeneralUtils.convertSizeToBytes(value);
+                    log.debug("Max bytes per document: {}", maxBytes);
+                    handleSplitBySize(sourceDocument, maxBytes, zipOut, filename);
+                } else if (type == 1) {
+                    log.debug("Processing split by page count");
+                    int pageCount = Integer.parseInt(value);
+                    log.debug("Pages per document: {}", pageCount);
+                    handleSplitByPageCount(sourceDocument, pageCount, zipOut, filename);
+                } else if (type == 2) {
+                    log.debug("Processing split by document count");
+                    int documentCount = Integer.parseInt(value);
+                    log.debug("Total number of documents: {}", documentCount);
+                    handleSplitByDocCount(sourceDocument, documentCount, zipOut, filename);
+                } else {
+                    log.error("Invalid split type: {}", type);
+                    throw ExceptionUtils.createIllegalArgumentException(
+                            "error.invalidArgument",
+                            "Invalid argument: {0}",
+                            "split type: " + type);
                 }
-
-                byte[] data = Files.readAllBytes(managedZipPath);
-                log.debug("Successfully read {} bytes from ZIP file", data.length);
-
-                log.debug("Returning response with {} bytes of data", data.length);
-                return WebResponseUtils.bytesToWebResponse(
-                        data, filename + ".zip", MediaType.APPLICATION_OCTET_STREAM);
-            } catch (Exception e) {
-                ExceptionUtils.logException("PDF splitting process", e);
-                throw e; // Re-throw to ensure proper error response
+                log.debug("PDF splitting completed successfully");
             }
+
+            log.debug("Returning streaming response for zip file");
+            return WebResponseUtils.zipFileToWebResponse(zipTempFile, filename + ".zip");
+        } catch (Exception e) {
+            ExceptionUtils.logException("PDF splitting process", e);
+            zipTempFile.close();
+            throw e;
         }
     }
 
@@ -124,6 +113,7 @@ public class SplitPdfBySizeController {
             throws IOException {
         log.debug("Starting handleSplitBySize with maxBytes={}", maxBytes);
 
+        @Getter
         class DocHolder implements AutoCloseable {
             private PDDocument doc;
 
@@ -131,10 +121,6 @@ public class SplitPdfBySizeController {
                 this.doc = doc;
             }
 
-            public PDDocument getDoc() {
-                return doc;
-            }
-
             public void setDoc(PDDocument doc) {
                 if (this.doc != null) {
                     try {

app/core/src/main/java/stirling/software/SPDF/controller/api/UIDataController.java

@@ -16,9 +16,6 @@ import org.springframework.core.io.ResourceLoader;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.GetMapping;
 
-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import io.swagger.v3.oas.annotations.Operation;
 
 import lombok.Data;
@@ -35,6 +32,9 @@ import stirling.software.common.service.UserServiceInterface;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
 
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.ObjectMapper;
+
 @Slf4j
 @UiDataApi
 public class UIDataController {
@@ -44,18 +44,21 @@ public class UIDataController {
     private final UserServiceInterface userService;
     private final ResourceLoader resourceLoader;
     private final RuntimePathConfig runtimePathConfig;
+    private final ObjectMapper objectMapper;
 
     public UIDataController(
             ApplicationProperties applicationProperties,
             SharedSignatureService signatureService,
             @Autowired(required = false) UserServiceInterface userService,
             ResourceLoader resourceLoader,
-            RuntimePathConfig runtimePathConfig) {
+            RuntimePathConfig runtimePathConfig,
+            ObjectMapper objectMapper) {
         this.applicationProperties = applicationProperties;
         this.signatureService = signatureService;
         this.userService = userService;
         this.resourceLoader = resourceLoader;
         this.runtimePathConfig = runtimePathConfig;
+        this.objectMapper = objectMapper;
     }
 
     @GetMapping("/footer-info")
@@ -93,9 +96,8 @@ public class UIDataController {
 
         try (InputStream is = resource.getInputStream()) {
             String json = new String(is.readAllBytes(), StandardCharsets.UTF_8);
-            ObjectMapper mapper = new ObjectMapper();
             Map<String, List<Dependency>> licenseData =
-                    mapper.readValue(json, new TypeReference<>() {});
+                    objectMapper.readValue(json, new TypeReference<>() {});
             data.setDependencies(licenseData.get("dependencies"));
         } catch (IOException e) {
             log.error("Failed to load licenses data", e);
@@ -127,8 +129,8 @@ public class UIDataController {
 
                 for (String config : pipelineConfigs) {
                     Map<String, Object> jsonContent =
-                            new ObjectMapper()
-                                    .readValue(config, new TypeReference<Map<String, Object>>() {});
+                            objectMapper.readValue(
+                                    config, new TypeReference<Map<String, Object>>() {});
                     String name = (String) jsonContent.get("name");
                     if (name == null || name.length() < 1) {
                         String filename =

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertImgPDFController.java

@@ -22,6 +22,7 @@ import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
 
 import io.swagger.v3.oas.annotations.Operation;
 
@@ -51,6 +52,7 @@ import stirling.software.common.util.PdfUtils;
 import stirling.software.common.util.ProcessExecutor;
 import stirling.software.common.util.ProcessExecutor.ProcessExecutorResult;
 import stirling.software.common.util.RegexPatternUtils;
+import stirling.software.common.util.TempFile;
 import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;
 
@@ -78,7 +80,7 @@ public class ConvertImgPDFController {
                     "This endpoint converts a PDF file to image(s) with the specified image format,"
                             + " color type, and DPI. Users can choose to get a single image or multiple"
                             + " images.  Input:PDF Output:Image Type:SI-Conditional")
-    public ResponseEntity<byte[]> convertToImage(@ModelAttribute ConvertToImageRequest request)
+    public ResponseEntity<?> convertToImage(@ModelAttribute ConvertToImageRequest request)
             throws Exception {
         MultipartFile file = request.getFileInput();
         String imageFormat = request.getImageFormat();
@@ -180,28 +182,33 @@ public class ConvertImgPDFController {
                             "No WebP files were created. " + resultProcess.getMessages());
                 }
 
-                byte[] bodyBytes = new byte[0];
-
                 if (webpFiles.size() == 1) {
-                    // Return the single WebP file directly
                     Path webpFilePath = webpFiles.get(0);
-                    bodyBytes = Files.readAllBytes(webpFilePath);
+                    byte[] webpBytes = Files.readAllBytes(webpFilePath);
+                    Files.deleteIfExists(tempFile);
+                    tempFile = null;
+                    FileUtils.deleteDirectory(tempOutputDir.toFile());
+                    tempOutputDir = null;
+                    String docName = filename + "." + imageFormat;
+                    MediaType mediaType = MediaType.parseMediaType(getMediaType(imageFormat));
+                    return WebResponseUtils.bytesToWebResponse(webpBytes, docName, mediaType);
                 } else {
-                    // Create a ZIP file containing all WebP images
-                    try (ByteArrayOutputStream zipOutputStream = new ByteArrayOutputStream();
-                            ZipOutputStream zos = new ZipOutputStream(zipOutputStream)) {
+                    ByteArrayOutputStream zipBAOS = new ByteArrayOutputStream();
+                    try (ZipOutputStream zos = new ZipOutputStream(zipBAOS)) {
                         for (Path webpFile : webpFiles) {
                             zos.putNextEntry(new ZipEntry(webpFile.getFileName().toString()));
                             Files.copy(webpFile, zos);
                             zos.closeEntry();
                         }
-                        bodyBytes = zipOutputStream.toByteArray();
                     }
+                    Files.deleteIfExists(tempFile);
+                    tempFile = null;
+                    FileUtils.deleteDirectory(tempOutputDir.toFile());
+                    tempOutputDir = null;
+                    String zipFilename = filename + "_convertedToImages.zip";
+                    return WebResponseUtils.bytesToWebResponse(
+                            zipBAOS.toByteArray(), zipFilename, MediaType.APPLICATION_OCTET_STREAM);
                 }
-                // Clean up the temporary files
-                Files.deleteIfExists(tempFile);
-                if (tempOutputDir != null) FileUtils.deleteDirectory(tempOutputDir.toFile());
-                result = bodyBytes;
             }
 
             if (singleImage) {
@@ -267,8 +274,8 @@ public class ConvertImgPDFController {
             description =
                     "This endpoint converts a CBZ (ZIP) comic book archive to a PDF file. "
                             + "Input:CBZ Output:PDF Type:SISO")
-    public ResponseEntity<?> convertCbzToPdf(@ModelAttribute ConvertCbzToPdfRequest request)
-            throws IOException {
+    public ResponseEntity<StreamingResponseBody> convertCbzToPdf(
+            @ModelAttribute ConvertCbzToPdfRequest request) throws IOException {
         MultipartFile file = request.getFileInput();
         boolean optimizeForEbook = request.isOptimizeForEbook();
 
@@ -278,13 +285,13 @@ public class ConvertImgPDFController {
             optimizeForEbook = false;
         }
 
-        byte[] pdfBytes =
+        TempFile pdfFile =
                 CbzUtils.convertCbzToPdf(
                         file, pdfDocumentFactory, tempFileManager, optimizeForEbook);
 
         String filename = createConvertedFilename(file.getOriginalFilename(), "_converted.pdf");
 
-        return WebResponseUtils.bytesToWebResponse(pdfBytes, filename);
+        return WebResponseUtils.pdfFileToWebResponse(pdfFile, filename);
     }
 
     @AutoJobPostMapping(consumes = MediaType.MULTIPART_FORM_DATA_VALUE, value = "/pdf/cbz")
@@ -293,8 +300,8 @@ public class ConvertImgPDFController {
             description =
                     "This endpoint converts a PDF file to a CBZ (ZIP) comic book archive. "
                             + "Input:PDF Output:CBZ Type:SISO")
-    public ResponseEntity<?> convertPdfToCbz(@ModelAttribute ConvertPdfToCbzRequest request)
-            throws IOException {
+    public ResponseEntity<StreamingResponseBody> convertPdfToCbz(
+            @ModelAttribute ConvertPdfToCbzRequest request) throws IOException {
         MultipartFile file = request.getFileInput();
         int dpi = request.getDpi();
 
@@ -302,12 +309,12 @@ public class ConvertImgPDFController {
             dpi = 300;
         }
 
-        byte[] cbzBytes = PdfToCbzUtils.convertPdfToCbz(file, dpi, pdfDocumentFactory);
+        TempFile cbzFile =
+                PdfToCbzUtils.convertPdfToCbz(file, dpi, pdfDocumentFactory, tempFileManager);
 
         String filename = createConvertedFilename(file.getOriginalFilename(), "_converted.cbz");
 
-        return WebResponseUtils.bytesToWebResponse(
-                cbzBytes, filename, MediaType.APPLICATION_OCTET_STREAM);
+        return WebResponseUtils.zipFileToWebResponse(cbzFile, filename);
     }
 
     @AutoJobPostMapping(consumes = MediaType.MULTIPART_FORM_DATA_VALUE, value = "/cbr/pdf")

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertOfficeController.java

@@ -91,22 +91,32 @@ public class ConvertOfficeController {
 
         Path libreOfficeProfile = null;
         try {
-            ProcessExecutorResult result;
-            // Run Unoconvert command
-            if (isUnoconvertAvailable()) {
-                // Unoconvert: schreibe direkt in outputPath innerhalb des workDir
-                List<String> command = new ArrayList<>();
-                command.add(runtimePathConfig.getUnoConvertPath());
-                command.add("--convert-to");
-                command.add("pdf");
-                command.add(inputPath.toString());
-                command.add(outputPath.toString());
+            ProcessExecutorResult result = null;
+            IOException unoconvertException = null;
 
-                result =
-                        ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
-                                .runCommandWithOutputHandling(command);
-            } // Run soffice command
-            else {
+            // Try unoconvert first if available
+            if (isUnoconvertAvailable()) {
+                try {
+                    List<String> command = new ArrayList<>();
+                    command.add(runtimePathConfig.getUnoConvertPath());
+                    command.add("--convert-to");
+                    command.add("pdf");
+                    command.add(inputPath.toString());
+                    command.add(outputPath.toString());
+
+                    result =
+                            ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
+                                    .runCommandWithOutputHandling(command);
+                } catch (IOException e) {
+                    unoconvertException = e;
+                    log.warn(
+                            "Unoconvert command failed ({}). Falling back to soffice command.",
+                            e.getMessage());
+                }
+            }
+
+            // Fallback to soffice if unoconvert was unavailable or failed
+            if (result == null) {
                 libreOfficeProfile = Files.createTempDirectory("libreoffice_profile_");
                 List<String> command = new ArrayList<>();
                 command.add(runtimePathConfig.getSOfficePath());
@@ -114,14 +124,21 @@ public class ConvertOfficeController {
                 command.add("--headless");
                 command.add("--nologo");
                 command.add("--convert-to");
-                command.add("pdf:writer_pdf_Export");
+                command.add("pdf");
                 command.add("--outdir");
                 command.add(workDir.toString());
                 command.add(inputPath.toString());
 
-                result =
-                        ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
-                                .runCommandWithOutputHandling(command);
+                try {
+                    result =
+                            ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
+                                    .runCommandWithOutputHandling(command);
+                } catch (IOException e) {
+                    if (unoconvertException != null) {
+                        e.addSuppressed(unoconvertException);
+                    }
+                    throw e;
+                }
             }
 
             // Check the result

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertPDFToEpubController.java

@@ -54,6 +54,12 @@ public class ConvertPDFToEpubController {
         command.add(inputPath.toString());
         command.add(outputPath.toString());
 
+        // Use pdftohtml engine (poppler) for PDF input instead of calibre's Qt-based engine.
+        // This avoids the Qt WebEngine dependency for PDF parsing and uses the lighter
+        // poppler-utils pdftohtml binary which is already available in the container.
+        command.add("--pdf-engine");
+        command.add("pdftohtml");
+
         // Golden defaults
         command.add("--enable-heuristics");
         command.add("--insert-blank-line");

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertPDFToExcelController.java

@@ -70,10 +70,7 @@ public class ConvertPDFToExcelController {
                             tables.size() == 1
                                     ? String.format(Locale.ROOT, "Page %d", pageNum)
                                     : String.format(
-                                            Locale.ROOT,
-                                            "Page %d Table %d",
-                                            pageNum,
-                                            tableIdx + 1);
+                                            Locale.ROOT, "Page %d Table %d", pageNum, tableIdx + 1);
 
                     sheetName = getUniqueSheetName(workbook, sheetName);
                     Sheet sheet = workbook.createSheet(sheetName);

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertPdfJsonController.java

@@ -39,6 +39,8 @@ import stirling.software.common.util.WebResponseUtils;
 public class ConvertPdfJsonController {
 
     private static final Pattern FILE_EXTENSION_PATTERN = Pattern.compile("[.][^.]+$");
+    private static final Pattern WHITESPACE_PATTERN = Pattern.compile("[\\r\\n\\t]+");
+    private static final Pattern NON_PRINTABLE_PATTERN = Pattern.compile("[^\\x20-\\x7E]");
     private final PdfJsonConversionService pdfJsonConversionService;
 
     @Autowired(required = false)
@@ -259,7 +261,10 @@ public class ConvertPdfJsonController {
             if (length > 0) {
                 int start = Math.max(0, length - 64);
                 tail = new String(jsonBytes, start, length - start, StandardCharsets.UTF_8);
-                tail = tail.replaceAll("[\\r\\n\\t]+", " ").replaceAll("[^\\x20-\\x7E]", "?");
+                tail =
+                        NON_PRINTABLE_PATTERN
+                                .matcher(WHITESPACE_PATTERN.matcher(tail).replaceAll(" "))
+                                .replaceAll("?");
             }
             log.debug(
                     "Returning {} JSON response ({} bytes, endsWithJson={}, tail='{}')",
@@ -421,9 +426,9 @@ public class ConvertPdfJsonController {
     private String truncateForLog(String value) {
         int max = 64;
         if (value.length() <= max) {
-            return value.replaceAll("[\\r\\n\\t]+", " ");
+            return WHITESPACE_PATTERN.matcher(value).replaceAll(" ");
         }
-        return value.substring(0, max).replaceAll("[\\r\\n\\t]+", " ") + "...";
+        return WHITESPACE_PATTERN.matcher(value.substring(0, max)).replaceAll(" ") + "...";
     }
 
     /**

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertPdfJsonExceptionHandler.java

@@ -9,13 +9,13 @@ import org.springframework.web.bind.annotation.ControllerAdvice;
 import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.ResponseBody;
 
-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.exception.CacheUnavailableException;
 
+import tools.jackson.databind.ObjectMapper;
+
 @ControllerAdvice(assignableTypes = ConvertPdfJsonController.class)
 @Slf4j
 @RequiredArgsConstructor

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertWebsiteToPDF.java

@@ -166,7 +166,7 @@ public class ConvertWebsiteToPDF {
     private String fetchRemoteHtml(String url) throws IOException, InterruptedException {
         HttpClient client =
                 HttpClient.newBuilder()
-                        .followRedirects(HttpClient.Redirect.NORMAL)
+                        .followRedirects(HttpClient.Redirect.NEVER)
                         .connectTimeout(Duration.ofSeconds(10))
                         .build();
 
@@ -180,7 +180,7 @@ public class ConvertWebsiteToPDF {
         HttpResponse<String> response =
                 client.send(request, HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));
 
-        if (response.statusCode() >= 400 || response.body() == null) {
+        if (response.statusCode() >= 300 || response.body() == null) {
             throw ExceptionUtils.createIOException(
                     "error.httpRequestFailed",
                     "Failed to retrieve remote HTML. Status: {0}",

app/core/src/main/java/stirling/software/SPDF/controller/api/form/FormFillController.java

@@ -19,8 +19,6 @@ import org.springframework.web.bind.annotation.RequestPart;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.multipart.MultipartFile;
 
-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.ObjectMapper;
 import com.opencsv.CSVWriter;
 
 import io.github.pixee.security.Filenames;
@@ -38,6 +36,9 @@ import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.FormUtils;
 import stirling.software.common.util.WebResponseUtils;
 
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.ObjectMapper;
+
 @RestController
 @RequestMapping("/api/v1/form")
 @Tag(

app/core/src/main/java/stirling/software/SPDF/controller/api/form/FormPayloadParser.java

@@ -1,6 +1,5 @@
 package stirling.software.SPDF.controller.api.form;
 
-import java.io.IOException;
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.LinkedHashSet;
@@ -8,13 +7,14 @@ import java.util.List;
 import java.util.Map;
 import java.util.Set;
 
-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.FormUtils;
 
+import tools.jackson.core.JacksonException;
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;
+
 final class FormPayloadParser {
 
     private static final String KEY_FIELDS = "fields";
@@ -32,8 +32,7 @@ final class FormPayloadParser {
 
     private FormPayloadParser() {}
 
-    static Map<String, Object> parseValueMap(ObjectMapper objectMapper, String json)
-            throws IOException {
+    static Map<String, Object> parseValueMap(ObjectMapper objectMapper, String json) {
         if (json == null || json.isBlank()) {
             return Map.of();
         }
@@ -41,7 +40,7 @@ final class FormPayloadParser {
         JsonNode root;
         try {
             root = objectMapper.readTree(json);
-        } catch (IOException e) {
+        } catch (JacksonException e) {
             // Fallback to legacy direct map parse (will throw again if invalid)
             return objectMapper.readValue(json, MAP_TYPE);
         }
@@ -88,14 +87,14 @@ final class FormPayloadParser {
     }
 
     static List<FormUtils.ModifyFormFieldDefinition> parseModificationDefinitions(
-            ObjectMapper objectMapper, String json) throws IOException {
+            ObjectMapper objectMapper, String json) {
         if (json == null || json.isBlank()) {
             return List.of();
         }
         return objectMapper.readValue(json, MODIFY_FIELD_LIST_TYPE);
     }
 
-    static List<String> parseNameList(ObjectMapper objectMapper, String json) throws IOException {
+    static List<String> parseNameList(ObjectMapper objectMapper, String json) {
         if (json == null || json.isBlank()) {
             return List.of();
         }
@@ -119,7 +118,7 @@ final class FormPayloadParser {
                 }
             }
         } else if (root.isTextual()) {
-            final String single = trimToNull(root.asText());
+            final String single = trimToNull(root.asText(""));
             if (single != null) {
                 names.add(single);
             }
@@ -131,7 +130,7 @@ final class FormPayloadParser {
 
         try {
             return objectMapper.readValue(json, STRING_LIST_TYPE);
-        } catch (IOException e) {
+        } catch (JacksonException e) {
             throw ExceptionUtils.createIllegalArgumentException(
                     "error.invalidFormat",
                     "Invalid {0} format: {1}",
@@ -199,7 +198,7 @@ final class FormPayloadParser {
             return null;
         }
         if (node.isTextual()) {
-            return trimToEmpty(node.asText());
+            return trimToEmpty(node.asText(""));
         }
         if (node.isNumber()) {
             return node.numberValue().toString();
@@ -208,7 +207,7 @@ final class FormPayloadParser {
             return Boolean.toString(node.booleanValue());
         }
         // Fallback for other scalar-like nodes
-        return trimToEmpty(node.asText());
+        return trimToEmpty(node.asText(""));
     }
 
     private static void collectNames(JsonNode arrayNode, Set<String> sink) {
@@ -229,7 +228,7 @@ final class FormPayloadParser {
         }
 
         if (node.isTextual()) {
-            return trimToNull(node.asText());
+            return trimToNull(node.asText(""));
         }
 
         if (node.isObject()) {
@@ -264,8 +263,8 @@ final class FormPayloadParser {
     private static Map<String, Object> objectToLinkedMap(JsonNode objectNode) {
         final Map<String, Object> result = new LinkedHashMap<>();
         objectNode
-                .fieldNames()
-                .forEachRemaining(
+                .propertyNames()
+                .forEach(
                         key -> {
                             final JsonNode v = objectNode.get(key);
                             if (v == null || v.isNull()) {

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/ConfigController.java

@@ -159,6 +159,24 @@ public class ConfigController {
                     "defaultHideUnavailableConversions",
                     applicationProperties.getUi().isDefaultHideUnavailableConversions());
 
+            // Hide disabled tools settings
+            configData.put(
+                    "hideDisabledToolsGoogleDrive",
+                    applicationProperties.getUi().getHideDisabledTools().isGoogleDrive());
+            configData.put(
+                    "hideDisabledToolsMobileQRScanner",
+                    applicationProperties.getUi().getHideDisabledTools().isMobileQRScanner());
+
+            // Google Drive backend settings (only if enabled)
+            ApplicationProperties.Premium.ProFeatures.GoogleDrive googleDrive =
+                    applicationProperties.getPremium().getProFeatures().getGoogleDrive();
+            if (googleDrive.isEnabled()) {
+                configData.put("googleDriveEnabled", true);
+                configData.put("googleDriveClientId", googleDrive.getClientId());
+                configData.put("googleDriveApiKey", googleDrive.getApiKey());
+                configData.put("googleDriveAppId", googleDrive.getAppId());
+            }
+
             // Security settings
             // enableLogin requires both the config flag AND proprietary features to be loaded
             // If userService is null, proprietary module isn't loaded

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/ExtractImageScansController.java

@@ -67,7 +67,7 @@ public class ExtractImageScansController {
         MultipartFile inputFile = request.getFileInput();
 
         String fileName = inputFile.getOriginalFilename();
-        String extension = fileName.substring(fileName.lastIndexOf(".") + 1);
+        String extension = fileName.substring(fileName.lastIndexOf('.') + 1);
 
         List<String> images = new ArrayList<>();
 

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/ExtractImagesController.java

@@ -5,6 +5,7 @@ import java.awt.image.BufferedImage;
 import java.awt.image.RenderedImage;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.util.Arrays;
@@ -28,6 +29,7 @@ import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
 
 import io.swagger.v3.oas.annotations.Operation;
 
@@ -42,6 +44,8 @@ import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.ImageProcessingUtils;
+import stirling.software.common.util.TempFile;
+import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;
 
 @MiscApi
@@ -50,6 +54,7 @@ import stirling.software.common.util.WebResponseUtils;
 public class ExtractImagesController {
 
     private final CustomPDFDocumentFactory pdfDocumentFactory;
+    private final TempFileManager tempFileManager;
 
     @AutoJobPostMapping(consumes = MediaType.MULTIPART_FORM_DATA_VALUE, value = "/extract-images")
     @MultiFileResponse
@@ -59,112 +64,115 @@ public class ExtractImagesController {
                     "This endpoint extracts images from a given PDF file and returns them in a zip"
                             + " file. Users can specify the output image format. Input:PDF"
                             + " Output:IMAGE/ZIP Type:SIMO")
-    public ResponseEntity<byte[]> extractImages(@ModelAttribute PDFExtractImagesRequest request)
+    public ResponseEntity<StreamingResponseBody> extractImages(
+            @ModelAttribute PDFExtractImagesRequest request)
             throws IOException, InterruptedException, ExecutionException {
         MultipartFile file = request.getFileInput();
         String format = request.getFormat();
         boolean allowDuplicates = Boolean.TRUE.equals(request.getAllowDuplicates());
-        PDDocument document = pdfDocumentFactory.load(file);
-
-        // Determine if multithreading should be used based on PDF size or number of pages
-        boolean useMultithreading = shouldUseMultithreading(file, document);
-
-        // Create ByteArrayOutputStream to write zip file to byte array
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-
-        // Create ZipOutputStream to create zip file
-        ZipOutputStream zos = new ZipOutputStream(baos);
-
-        // Set compression level
-        zos.setLevel(Deflater.BEST_COMPRESSION);
 
         String filename = GeneralUtils.removeExtension(file.getOriginalFilename());
         Set<byte[]> processedImages = new HashSet<>();
 
-        if (useMultithreading) {
-            // Executor service to handle multithreading
-            ExecutorService executor =
-                    Executors.newFixedThreadPool(Runtime.getRuntime().availableProcessors());
-            Set<Future<Void>> futures = new HashSet<>();
+        TempFile zipTempFile = new TempFile(tempFileManager, ".zip");
+        try (ZipOutputStream zos =
+                        new ZipOutputStream(Files.newOutputStream(zipTempFile.getPath()));
+                PDDocument document = pdfDocumentFactory.load(file)) {
 
-            // Safely iterate over each page, handling corrupt PDFs where page count might be wrong
-            try {
-                int pageCount = document.getPages().getCount();
-                log.debug("Document reports {} pages", pageCount);
+            // Set compression level
+            zos.setLevel(Deflater.BEST_COMPRESSION);
 
-                int consecutiveFailures = 0;
+            // Determine if multithreading should be used based on PDF size or number of pages
+            boolean useMultithreading = shouldUseMultithreading(file, document);
 
-                for (int pgNum = 0; pgNum < pageCount; pgNum++) {
-                    try {
-                        PDPage page = document.getPage(pgNum);
-                        consecutiveFailures = 0; // Reset on success
-                        final int currentPageNum = pgNum + 1; // Convert to 1-based page numbering
-                        Future<Void> future =
-                                executor.submit(
-                                        () -> {
-                                            try {
-                                                // Call the image extraction method for each page
-                                                extractImagesFromPage(
-                                                        page,
-                                                        format,
-                                                        filename,
-                                                        currentPageNum,
-                                                        processedImages,
-                                                        zos,
-                                                        allowDuplicates);
-                                            } catch (Exception e) {
-                                                // Log the error and continue processing other pages
-                                                ExceptionUtils.logException(
-                                                        "image extraction from page "
-                                                                + currentPageNum,
-                                                        e);
-                                            }
+            if (useMultithreading) {
+                ExecutorService executor = Executors.newVirtualThreadPerTaskExecutor();
+                Set<Future<Void>> futures = new HashSet<>();
 
-                                            return null; // Callable requires a return type
-                                        });
+                try {
+                    int pageCount = document.getPages().getCount();
+                    log.debug("Document reports {} pages", pageCount);
 
-                        // Add the Future object to the list to track completion
-                        futures.add(future);
-                    } catch (Exception e) {
-                        consecutiveFailures++;
-                        ExceptionUtils.logException("page access for page " + (pgNum + 1), e);
+                    int consecutiveFailures = 0;
 
-                        if (consecutiveFailures >= 3) {
-                            log.warn("Stopping page iteration after 3 consecutive failures");
-                            break;
+                    for (int pgNum = 0; pgNum < pageCount; pgNum++) {
+                        try {
+                            PDPage page = document.getPage(pgNum);
+                            consecutiveFailures = 0; // Reset on success
+                            final int currentPageNum =
+                                    pgNum + 1; // Convert to 1-based page numbering
+                            Future<Void> future =
+                                    executor.submit(
+                                            () -> {
+                                                try {
+                                                    // Call the image extraction method for each
+                                                    // page
+                                                    extractImagesFromPage(
+                                                            page,
+                                                            format,
+                                                            filename,
+                                                            currentPageNum,
+                                                            processedImages,
+                                                            zos,
+                                                            allowDuplicates);
+                                                } catch (Exception e) {
+                                                    // Log the error and continue processing other
+                                                    // pages
+                                                    ExceptionUtils.logException(
+                                                            "image extraction from page "
+                                                                    + currentPageNum,
+                                                            e);
+                                                }
+
+                                                return null; // Callable requires a return type
+                                            });
+
+                            // Add the Future object to the list to track completion
+                            futures.add(future);
+                        } catch (Exception e) {
+                            consecutiveFailures++;
+                            ExceptionUtils.logException("page access for page " + (pgNum + 1), e);
+
+                            if (consecutiveFailures >= 3) {
+                                log.warn("Stopping page iteration after 3 consecutive failures");
+                                break;
+                            }
                         }
                     }
+                } catch (Exception e) {
+                    ExceptionUtils.logException("page count determination", e);
+                    throw e;
                 }
-            } catch (Exception e) {
-                ExceptionUtils.logException("page count determination", e);
-                throw e;
-            }
 
-            // Wait for all tasks to complete
-            for (Future<Void> future : futures) {
-                future.get();
-            }
+                // Wait for all tasks to complete
+                for (Future<Void> future : futures) {
+                    future.get();
+                }
 
-            // Close executor service
-            executor.shutdown();
-        } else {
-            // Single-threaded extraction
-            for (int pgNum = 0; pgNum < document.getPages().getCount(); pgNum++) {
-                PDPage page = document.getPage(pgNum);
-                extractImagesFromPage(
-                        page, format, filename, pgNum + 1, processedImages, zos, allowDuplicates);
+                // Close executor service
+                executor.shutdown();
+            } else {
+                // Single-threaded extraction
+                for (int pgNum = 0; pgNum < document.getPages().getCount(); pgNum++) {
+                    PDPage page = document.getPage(pgNum);
+                    extractImagesFromPage(
+                            page,
+                            format,
+                            filename,
+                            pgNum + 1,
+                            processedImages,
+                            zos,
+                            allowDuplicates);
+                }
             }
+            // document and zos closed by try-with-resources
+        } catch (Exception e) {
+            zipTempFile.close();
+            throw e;
         }
 
-        // Close PDDocument and ZipOutputStream
-        document.close();
-        zos.close();
-
-        // Create ByteArrayResource from byte array
-        byte[] zipContents = baos.toByteArray();
-
-        return WebResponseUtils.baosToWebResponse(
-                baos, filename + "_extracted-images.zip", MediaType.APPLICATION_OCTET_STREAM);
+        return WebResponseUtils.zipFileToWebResponse(
+                zipTempFile, filename + "_extracted-images.zip");
     }
 
     private boolean shouldUseMultithreading(MultipartFile file, PDDocument document) {
@@ -215,13 +223,17 @@ public class ExtractImagesController {
                     // Convert to standard RGB colorspace if needed
                     BufferedImage bufferedImage = convertToRGB(renderedImage, format);
 
-                    // Write image to zip file
+                    // Encode image outside the lock to allow parallel encoding across threads
                     String imageName = filename + "_page_" + pageNum + "_" + count++ + "." + format;
+                    ByteArrayOutputStream imageBaos = new ByteArrayOutputStream();
+                    ImageIO.write(bufferedImage, format, imageBaos);
+                    byte[] imageData = imageBaos.toByteArray();
+
+                    // Write encoded bytes to zip under lock (ZipOutputStream requires
+                    // serialization)
                     synchronized (zos) {
                         zos.putNextEntry(new ZipEntry(imageName));
-                        ByteArrayOutputStream imageBaos = new ByteArrayOutputStream();
-                        ImageIO.write(bufferedImage, format, imageBaos);
-                        zos.write(imageBaos.toByteArray());
+                        zos.write(imageData);
                         zos.closeEntry();
                     }
                 }

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/OCRController.java

@@ -94,7 +94,7 @@ public class OCRController {
             throws IOException, InterruptedException {
         MultipartFile inputFile = request.getFileInput();
         List<String> selectedLanguages = request.getLanguages();
-        Boolean sidecar = request.isSidecar();
+        boolean sidecar = request.isSidecar();
         Boolean deskew = request.isDeskew();
         Boolean clean = request.isClean();
         Boolean cleanFinal = request.isCleanFinal();
@@ -246,10 +246,12 @@ public class OCRController {
             command.add("--clean-final");
         }
         if (ocrType != null && !ocrType.isEmpty()) {
-            if ("skip-text".equals(ocrType)) {
-                command.add("--skip-text");
-            } else if ("force-ocr".equals(ocrType)) {
+            if ("force-ocr".equals(ocrType)) {
                 command.add("--force-ocr");
+            } else {
+                // Default for 'Normal' and 'skip-text': use --skip-text
+                // ocrmypdf 17+ requires explicit flag when PDF already contains text
+                command.add("--skip-text");
             }
         }
         command.add("--invalidate-digital-signatures");
@@ -378,11 +380,12 @@ public class OCRController {
                         List<String> command = new ArrayList<>();
                         command.add("tesseract");
                         command.add(imagePath.toString());
-                        command.add(
+                        String outputBase =
                                 new File(
                                                 tempOutputDir,
                                                 String.format(Locale.ROOT, "page_%d", pageNum))
-                                        .toString());
+                                        .toString();
+                        command.add(outputBase);
                         command.add("-l");
                         command.add(String.join("+", selectedLanguages));
                         command.add("pdf"); // Always output PDF
@@ -400,6 +403,18 @@ public class OCRController {
                                     result.getRc());
                         }
 
+                        // Verify the OCR'd PDF was created
+                        if (!pageOutputPath.exists()) {
+                            log.warn(
+                                    "Tesseract did not create expected output file: {}. Page may be blank or unreadable.",
+                                    pageOutputPath.getAbsolutePath());
+                            // Save original page without OCR as fallback
+                            try (PDDocument pageDoc = new PDDocument()) {
+                                pageDoc.addPage(page);
+                                pageDoc.save(pageOutputPath);
+                            }
+                        }
+
                         // Add OCR'd PDF to merger
                         merger.addSource(pageOutputPath);
                     } else {

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/StampController.java

@@ -233,7 +233,7 @@ public class StampController {
                 };
 
         ClassPathResource classPathResource = new ClassPathResource(resourceDir);
-        String fileExtension = resourceDir.substring(resourceDir.lastIndexOf("."));
+        String fileExtension = resourceDir.substring(resourceDir.lastIndexOf('.'));
 
         // Use TempFile with try-with-resources for automatic cleanup
         try (TempFile tempFileWrapper = new TempFile(tempFileManager, fileExtension)) {

app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineController.java

@@ -1,7 +1,7 @@
 package stirling.software.SPDF.controller.api.pipeline;
 
-import java.io.ByteArrayOutputStream;
 import java.io.InputStream;
+import java.nio.file.Files;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -13,10 +13,7 @@ import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
-
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.JsonMappingException;
-import com.fasterxml.jackson.databind.ObjectMapper;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
 
 import io.swagger.v3.oas.annotations.Operation;
 
@@ -32,8 +29,14 @@ import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.PipelineApi;
 import stirling.software.common.service.PostHogService;
 import stirling.software.common.util.GeneralUtils;
+import stirling.software.common.util.TempFile;
+import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;
 
+import tools.jackson.core.JacksonException;
+import tools.jackson.databind.DatabindException;
+import tools.jackson.databind.ObjectMapper;
+
 @PipelineApi
 @Slf4j
 @RequiredArgsConstructor
@@ -45,6 +48,8 @@ public class PipelineController {
 
     private final PostHogService postHogService;
 
+    private final TempFileManager tempFileManager;
+
     @AutoJobPostMapping(value = "/handleData", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
     @MultiFileResponse
     @Operation(
@@ -53,8 +58,8 @@ public class PipelineController {
                     "This endpoint processes multiple PDF files through a configurable pipeline of operations. "
                             + "Users provide files and a JSON configuration defining the sequence of operations to perform. "
                             + "Input:PDF Output:PDF/ZIP Type:MIMO")
-    public ResponseEntity<byte[]> handleData(@ModelAttribute HandleDataRequest request)
-            throws JsonMappingException, JsonProcessingException {
+    public ResponseEntity<StreamingResponseBody> handleData(
+            @ModelAttribute HandleDataRequest request) throws DatabindException, JacksonException {
         MultipartFile[] files = request.getFileInput();
         String jsonString = request.getJson();
         if (files == null) {
@@ -80,51 +85,56 @@ public class PipelineController {
             PipelineResult result = processor.runPipelineAgainstFiles(inputFiles, config);
             List<Resource> outputFiles = result.getOutputFiles();
             if (outputFiles != null && outputFiles.size() == 1) {
-                // If there is only one file, return it directly
+                // If there is only one file, return it directly — stream without int-overflow
                 Resource singleFile = outputFiles.get(0);
-                InputStream is = singleFile.getInputStream();
-                byte[] bytes = new byte[(int) singleFile.contentLength()];
-                is.read(bytes);
-                is.close();
-                log.info("Returning single file response...");
-                return WebResponseUtils.bytesToWebResponse(
-                        bytes, singleFile.getFilename(), MediaType.APPLICATION_OCTET_STREAM);
+                TempFile singleTempFile = new TempFile(tempFileManager, ".out");
+                try {
+                    try (InputStream is = singleFile.getInputStream()) {
+                        is.transferTo(Files.newOutputStream(singleTempFile.getPath()));
+                    }
+                    log.info("Returning single file response...");
+                    return WebResponseUtils.fileToWebResponse(
+                            singleTempFile,
+                            singleFile.getFilename(),
+                            MediaType.APPLICATION_OCTET_STREAM);
+                } catch (Exception e) {
+                    singleTempFile.close();
+                    throw e;
+                }
             } else if (outputFiles == null) {
                 return null;
             }
-            // Create a ByteArrayOutputStream to hold the zip
-            ByteArrayOutputStream baos = new ByteArrayOutputStream();
-            ZipOutputStream zipOut = new ZipOutputStream(baos);
-            // A map to keep track of filenames and their counts
-            Map<String, Integer> filenameCount = new HashMap<>();
-            // Loop through each file and add it to the zip
-            for (Resource file : outputFiles) {
-                String originalFilename = file.getFilename();
-                String filename = originalFilename;
-                // Check if the filename already exists, and modify it if necessary
-                if (filenameCount.containsKey(originalFilename)) {
-                    int count = filenameCount.get(originalFilename);
-                    assert originalFilename != null;
-                    filename = GeneralUtils.generateFilename(originalFilename, "(" + count + ")");
-                    filenameCount.put(originalFilename, count + 1);
-                } else {
-                    filenameCount.put(originalFilename, 1);
+            // Multiple files: stream into a zip TempFile
+            TempFile zipTempFile = new TempFile(tempFileManager, ".zip");
+            try {
+                Map<String, Integer> filenameCount = new HashMap<>();
+                try (ZipOutputStream zipOut =
+                        new ZipOutputStream(Files.newOutputStream(zipTempFile.getPath()))) {
+                    for (Resource file : outputFiles) {
+                        String originalFilename = file.getFilename();
+                        String filename = originalFilename;
+                        if (filenameCount.containsKey(originalFilename)) {
+                            int count = filenameCount.get(originalFilename);
+                            filename =
+                                    GeneralUtils.generateFilename(
+                                            originalFilename, "(" + count + ")");
+                            filenameCount.put(originalFilename, count + 1);
+                        } else {
+                            filenameCount.put(originalFilename, 1);
+                        }
+                        zipOut.putNextEntry(new ZipEntry(filename));
+                        try (InputStream is = file.getInputStream()) {
+                            is.transferTo(zipOut);
+                        }
+                        zipOut.closeEntry();
+                    }
                 }
-                ZipEntry zipEntry = new ZipEntry(filename);
-                zipOut.putNextEntry(zipEntry);
-                // Read the file into a byte array
-                InputStream is = file.getInputStream();
-                byte[] bytes = new byte[(int) file.contentLength()];
-                is.read(bytes);
-                // Write the bytes of the file to the zip
-                zipOut.write(bytes, 0, bytes.length);
-                zipOut.closeEntry();
-                is.close();
+                log.info("Returning zipped file response...");
+                return WebResponseUtils.zipFileToWebResponse(zipTempFile, "output.zip");
+            } catch (Exception e) {
+                zipTempFile.close();
+                throw e;
             }
-            zipOut.close();
-            log.info("Returning zipped file response...");
-            return WebResponseUtils.baosToWebResponse(
-                    baos, "output.zip", MediaType.APPLICATION_OCTET_STREAM);
         } catch (Exception e) {
             log.error("Error handling data: ", e);
             return null;

app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineDirectoryProcessor.java

@@ -28,8 +28,6 @@ import org.springframework.core.io.Resource;
 import org.springframework.scheduling.annotation.Scheduled;
 import org.springframework.stereotype.Service;
 
-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.model.PipelineConfig;
@@ -40,6 +38,8 @@ import stirling.software.common.configuration.RuntimePathConfig;
 import stirling.software.common.service.PostHogService;
 import stirling.software.common.util.FileMonitor;
 
+import tools.jackson.databind.ObjectMapper;
+
 @Service
 @Slf4j
 public class PipelineDirectoryProcessor {
@@ -254,7 +254,7 @@ public class PipelineDirectoryProcessor {
                                         String extension =
                                                 filename.contains(".")
                                                         ? filename.substring(
-                                                                        filename.lastIndexOf(".")
+                                                                        filename.lastIndexOf('.')
                                                                                 + 1)
                                                                 .toLowerCase(Locale.ROOT)
                                                         : "";

app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java

@@ -67,7 +67,7 @@ public class PipelineProcessor {
 
     public static String removeTrailingNaming(String filename) {
         // Splitting filename into name and extension
-        int dotIndex = filename.lastIndexOf(".");
+        int dotIndex = filename.lastIndexOf('.');
         if (dotIndex == -1) {
             // No extension found
             return filename;
@@ -75,7 +75,7 @@ public class PipelineProcessor {
         String name = filename.substring(0, dotIndex);
         String extension = filename.substring(dotIndex);
         // Finding the last underscore
-        int underscoreIndex = name.lastIndexOf("_");
+        int underscoreIndex = name.lastIndexOf('_');
         if (underscoreIndex == -1) {
             // No underscore found
             return filename;
@@ -173,7 +173,7 @@ public class PipelineProcessor {
                         String providedExtension = "no extension";
                         if (filename != null && filename.contains(".")) {
                             providedExtension =
-                                    filename.substring(filename.lastIndexOf("."))
+                                    filename.substring(filename.lastIndexOf('.'))
                                             .toLowerCase(Locale.ROOT);
                         }
 
@@ -248,7 +248,7 @@ public class PipelineProcessor {
                                                 String filename = file.getFilename();
                                                 if (filename != null && filename.contains(".")) {
                                                     return filename.substring(
-                                                                    filename.lastIndexOf("."))
+                                                                    filename.lastIndexOf('.'))
                                                             .toLowerCase(Locale.ROOT);
                                                 }
                                                 return "no extension";
@@ -450,7 +450,21 @@ public class PipelineProcessor {
         return isZip(data, null);
     }
 
+    private static final int MAX_UNZIP_DEPTH = 10;
+
     private List<Resource> unzip(Resource data, PipelineResult result) throws IOException {
+        return unzip(data, result, 0);
+    }
+
+    private List<Resource> unzip(Resource data, PipelineResult result, int depth)
+            throws IOException {
+        if (depth > MAX_UNZIP_DEPTH) {
+            log.warn(
+                    "ZIP nesting depth {} exceeds limit {}, treating as file",
+                    depth,
+                    MAX_UNZIP_DEPTH);
+            return List.of(data);
+        }
         log.info("Unzipping data of length: {}", data.contentLength());
         List<Resource> unzippedFiles = new ArrayList<>();
         try (InputStream bais = data.getInputStream();
@@ -481,7 +495,7 @@ public class PipelineProcessor {
                 // If the unzipped file is a zip file, unzip it
                 if (isZip(fileResource, filename)) {
                     log.info("File {} is a zip file. Unzipping...", filename);
-                    unzippedFiles.addAll(unzip(fileResource, result));
+                    unzippedFiles.addAll(unzip(fileResource, result, depth + 1));
                 } else {
                     unzippedFiles.add(fileResource);
                 }

app/core/src/main/java/stirling/software/SPDF/controller/api/security/GetInfoOnPDF.java

@@ -47,10 +47,6 @@ import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
 
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.node.ArrayNode;
-import com.fasterxml.jackson.databind.node.ObjectNode;
-
 import io.swagger.v3.oas.annotations.Operation;
 
 import lombok.RequiredArgsConstructor;
@@ -66,6 +62,11 @@ import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.RegexPatternUtils;
 import stirling.software.common.util.WebResponseUtils;
 
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
+import tools.jackson.databind.node.ArrayNode;
+import tools.jackson.databind.node.ObjectNode;
+
 @SecurityApi
 @Slf4j
 @RequiredArgsConstructor
@@ -77,7 +78,7 @@ public class GetInfoOnPDF {
     private static final String PAGE_PREFIX = "Page ";
     private static final long MAX_FILE_SIZE = 100L * 1024 * 1024;
 
-    private static final ObjectMapper objectMapper = new ObjectMapper();
+    private static final ObjectMapper objectMapper = JsonMapper.builder().build();
 
     private final CustomPDFDocumentFactory pdfDocumentFactory;
     private final VeraPDFService veraPDFService;

app/core/src/main/java/stirling/software/SPDF/controller/api/security/WatermarkController.java

@@ -188,7 +188,7 @@ public class WatermarkController {
                 };
 
         ClassPathResource classPathResource = new ClassPathResource(resourceDir);
-        String fileExtension = resourceDir.substring(resourceDir.lastIndexOf("."));
+        String fileExtension = resourceDir.substring(resourceDir.lastIndexOf('.'));
         File tempFile = Files.createTempFile("NotoSansFont", fileExtension).toFile();
         try (InputStream is = classPathResource.getInputStream();
                 FileOutputStream os = new FileOutputStream(tempFile)) {

app/core/src/main/java/stirling/software/SPDF/controller/web/MetricsController.java

@@ -1,5 +1,7 @@
 package stirling.software.SPDF.controller.web;
 
+import java.io.IOException;
+import java.io.InputStream;
 import java.time.Duration;
 import java.time.LocalDateTime;
 import java.util.*;
@@ -49,15 +51,42 @@ public class MetricsController {
             description =
                     "This endpoint returns the status of the application and its version number.")
     public ResponseEntity<?> getStatus() {
-        if (!metricsEnabled) {
-            return ResponseEntity.status(HttpStatus.FORBIDDEN).body("This endpoint is disabled.");
-        }
+        return getApplicationStatus();
+    }
+
+    @GetMapping("/health")
+    @Operation(
+            summary = "Application health check",
+            description =
+                    "This endpoint returns the health status of the application and its version number. Mirrors /api/v1/info/status.")
+    public ResponseEntity<?> getHealth() {
+        return getApplicationStatus();
+    }
+
+    private ResponseEntity<?> getApplicationStatus() {
         Map<String, String> status = new HashMap<>();
         status.put("status", "UP");
-        status.put("version", getClass().getPackage().getImplementationVersion());
+        String version = getClass().getPackage().getImplementationVersion();
+        if (version == null) {
+            version = getVersionFromProperties();
+        }
+        status.put("version", version);
         return ResponseEntity.ok(status);
     }
 
+    private String getVersionFromProperties() {
+        try (InputStream is = getClass().getResourceAsStream("/version.properties")) {
+            if (is != null) {
+                Properties props = new Properties();
+                props.load(is);
+                return props.getProperty("version");
+            }
+        } catch (IOException e) {
+            log.error("Failed to load version.properties", e);
+        }
+        return null;
+    }
+
     @GetMapping("/load")
     @Operation(
             summary = "GET request count",

app/core/src/main/java/stirling/software/SPDF/exception/GlobalExceptionHandler.java

@@ -3,6 +3,7 @@ package stirling.software.SPDF.exception;
 import java.io.IOException;
 import java.net.URI;
 import java.time.Instant;
+import java.util.LinkedHashMap;
 import java.util.List;
 
 import org.springframework.context.MessageSource;
@@ -33,6 +34,8 @@ import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.ExceptionUtils.*;
 import stirling.software.common.util.RegexPatternUtils;
 
+import tools.jackson.databind.ObjectMapper;
+
 /**
  * Returns RFC 7807 Problem Details for HTTP APIs, ensuring consistent error responses across the
  * application.
@@ -190,6 +193,31 @@ public class GlobalExceptionHandler {
         return problemDetail;
     }
 
+    /**
+     * Checks whether the given IOException indicates that the client disconnected before the
+     * response could be written (broken pipe, connection reset, etc.). When this happens there is
+     * no point in serialising a {@link ProblemDetail} body because the socket is already closed —
+     * and attempting to do so may trigger a secondary {@code HttpMessageNotWritableException} if
+     * the response Content-Type was already committed as a non-JSON type (e.g. image/png).
+     */
+    private static boolean isClientDisconnectException(IOException ex) {
+        // Walk the causal chain — Jetty/Tomcat may wrap the low-level SocketException
+        Throwable current = ex;
+        while (current != null) {
+            String msg = current.getMessage();
+            if (msg != null) {
+                String lower = msg.toLowerCase(java.util.Locale.ROOT);
+                if (lower.contains("broken pipe")
+                        || lower.contains("connection reset")
+                        || lower.contains("an established connection was aborted")) {
+                    return true;
+                }
+            }
+            current = current.getCause();
+        }
+        return false;
+    }
+
     /**
      * Helper method to create a standardized ProblemDetail response for exceptions with error
      * codes.
@@ -841,21 +869,24 @@ public class GlobalExceptionHandler {
         response.setContentType("application/problem+json");
         response.setCharacterEncoding("UTF-8");
 
-        String errorJson =
-                String.format(
-                        """
-                {
-                    "type": "about:blank",
-                    "title": "Not Acceptable",
-                    "status": 406,
-                    "detail": "The requested resource could not be returned in an acceptable format. Error responses are returned as JSON.",
-                    "instance": "%s",
-                    "timestamp": "%s",
-                    "hints": ["Error responses are always returned as application/json or application/problem+json", "Set Accept header to include application/json for proper error handling"]
-                }
-                """,
-                        request.getRequestURI(), Instant.now().toString());
+        // Use ObjectMapper to properly escape JSON values and prevent XSS
+        ObjectMapper mapper = new ObjectMapper();
+        java.util.Map<String, Object> errorMap = new LinkedHashMap<>();
+        errorMap.put("type", "about:blank");
+        errorMap.put("title", "Not Acceptable");
+        errorMap.put("status", 406);
+        errorMap.put(
+                "detail",
+                "The requested resource could not be returned in an acceptable format. Error responses are returned as JSON.");
+        errorMap.put("instance", request.getRequestURI());
+        errorMap.put("timestamp", Instant.now().toString());
+        errorMap.put(
+                "hints",
+                java.util.Arrays.asList(
+                        "Error responses are always returned as application/json or application/problem+json",
+                        "Set Accept header to include application/json for proper error handling"));
 
+        String errorJson = mapper.writeValueAsString(errorMap);
         response.getWriter().write(errorJson);
         response.getWriter().flush();
     }
@@ -1107,6 +1138,15 @@ public class GlobalExceptionHandler {
     public ResponseEntity<ProblemDetail> handleIOException(
             IOException ex, HttpServletRequest request) {
 
+        // Broken pipe / connection reset means the client disconnected.
+        // Attempting to write a ProblemDetail response will fail because the
+        // response Content-Type may already be committed (e.g. image/png) and
+        // the client is gone anyway. Log at WARN and return an empty body.
+        if (isClientDisconnectException(ex)) {
+            log.warn("Client disconnected at {}: {}", request.getRequestURI(), ex.getMessage());
+            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).build();
+        }
+
         // Check if this is a PDF-specific error and wrap it appropriately
         IOException processedException =
                 ExceptionUtils.handlePdfException(ex, request.getRequestURI());

app/core/src/main/java/stirling/software/SPDF/model/ApiEndpoint.java

@@ -3,10 +3,10 @@ package stirling.software.SPDF.model;
 import java.util.HashMap;
 import java.util.Map;
 
-import com.fasterxml.jackson.databind.JsonNode;
-
 import lombok.Getter;
 
+import tools.jackson.databind.JsonNode;
+
 public class ApiEndpoint {
     private final String name;
     private Map<String, JsonNode> parameters;
@@ -18,15 +18,16 @@ public class ApiEndpoint {
         postNode.path("parameters")
                 .forEach(
                         paramNode -> {
-                            String paramName = paramNode.path("name").asText();
+                            String paramName = paramNode.path("name").asText("");
                             parameters.put(paramName, paramNode);
                         });
-        this.description = postNode.path("description").asText();
+        this.description = postNode.path("description").asText("");
     }
 
     public boolean areParametersValid(Map<String, Object> providedParams) {
-        for (String requiredParam : parameters.keySet()) {
-            if (!providedParams.containsKey(requiredParam)) {
+        for (Map.Entry<String, JsonNode> entry : parameters.entrySet()) {
+            boolean isRequired = entry.getValue().path("required").asBoolean(false);
+            if (isRequired && !providedParams.containsKey(entry.getKey())) {
                 return false;
             }
         }

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonAnnotation.java

@@ -1,7 +1,5 @@
 package stirling.software.SPDF.model.json;
 
-import java.util.List;
-
 import com.fasterxml.jackson.annotation.JsonInclude;
 
 import lombok.AllArgsConstructor;
@@ -27,13 +25,13 @@ public class PdfJsonAnnotation {
     private String contents;
 
     /** Annotation rectangle [x1, y1, x2, y2] */
-    private List<Float> rect;
+    private float[] rect;
 
     /** Annotation appearance characteristics */
     private String appearanceState;
 
     /** Color components (e.g., [r, g, b] for RGB) */
-    private List<Float> color;
+    private float[] color;
 
     /** Annotation flags (print, hidden, etc.) */
     private Integer flags;

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonDocument.java

@@ -14,7 +14,7 @@ import lombok.NoArgsConstructor;
 @Builder
 @NoArgsConstructor
 @AllArgsConstructor
-@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonInclude(JsonInclude.Include.NON_DEFAULT)
 public class PdfJsonDocument {
 
     private PdfJsonMetadata metadata;
@@ -23,7 +23,7 @@ public class PdfJsonDocument {
     private String xmpMetadata;
 
     /** Indicates that images should be loaded lazily via API rather than embedded in the JSON. */
-    private Boolean lazyImages;
+    private boolean lazyImages;
 
     @Builder.Default private List<PdfJsonFont> fonts = new ArrayList<>();
 

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonFontConversionCandidate.java

@@ -1,7 +1,5 @@
 package stirling.software.SPDF.model.json;
 
-import java.util.List;
-
 import com.fasterxml.jackson.annotation.JsonInclude;
 
 import lombok.AllArgsConstructor;
@@ -65,5 +63,5 @@ public class PdfJsonFontConversionCandidate {
     private String diagnostics;
 
     /** Known unicode/codepoint coverage derived from the conversion strategy. */
-    private List<Integer> glyphCoverage;
+    private int[] glyphCoverage;
 }

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonFormField.java

@@ -45,13 +45,13 @@ public class PdfJsonFormField {
     private Integer pageNumber;
 
     /** Field rectangle [x1, y1, x2, y2] on the page */
-    private List<Float> rect;
+    private float[] rect;
 
     /** For choice fields: list of options */
     private List<String> options;
 
     /** For choice fields: selected indices */
-    private List<Integer> selectedIndices;
+    private int[] selectedIndices;
 
     /** For button fields: whether it's checked */
     private Boolean checked;

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonImageElement.java

@@ -1,8 +1,5 @@
 package stirling.software.SPDF.model.json;
 
-import java.util.ArrayList;
-import java.util.List;
-
 import com.fasterxml.jackson.annotation.JsonInclude;
 
 import lombok.AllArgsConstructor;
@@ -30,7 +27,7 @@ public class PdfJsonImageElement {
     private Float right;
     private Float top;
     private Float bottom;
-    @Builder.Default private List<Float> transform = new ArrayList<>();
+    private float[] transform;
     private Integer zOrder;
     private String imageData;
     private String imageFormat;

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonPageDimension.java

@@ -11,10 +11,10 @@ import lombok.NoArgsConstructor;
 @Builder
 @NoArgsConstructor
 @AllArgsConstructor
-@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonInclude(JsonInclude.Include.NON_DEFAULT)
 public class PdfJsonPageDimension {
-    private Integer pageNumber;
-    private Float width;
-    private Float height;
-    private Integer rotation;
+    private int pageNumber;
+    private float width;
+    private float height;
+    private int rotation;
 }

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonTextColor.java

@@ -1,7 +1,5 @@
 package stirling.software.SPDF.model.json;
 
-import java.util.List;
-
 import com.fasterxml.jackson.annotation.JsonInclude;
 
 import lombok.AllArgsConstructor;
@@ -17,5 +15,5 @@ import lombok.NoArgsConstructor;
 public class PdfJsonTextColor {
 
     private String colorSpace;
-    private List<Float> components;
+    private float[] components;
 }

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonTextElement.java

@@ -1,7 +1,5 @@
 package stirling.software.SPDF.model.json;
 
-import java.util.List;
-
 import com.fasterxml.jackson.annotation.JsonInclude;
 
 import lombok.AllArgsConstructor;
@@ -32,10 +30,10 @@ public class PdfJsonTextElement {
     private Float y;
     private Float width;
     private Float height;
-    private List<Float> textMatrix;
+    private float[] textMatrix;
     private PdfJsonTextColor fillColor;
     private PdfJsonTextColor strokeColor;
     private Integer renderingMode;
     private Boolean fallbackUsed;
-    private List<Integer> charCodes;
+    private int[] charCodes;
 }

app/core/src/main/java/stirling/software/SPDF/service/ApiDocService.java

@@ -15,9 +15,6 @@ import org.springframework.http.ResponseEntity;
 import org.springframework.stereotype.Service;
 import org.springframework.web.client.RestTemplate;
 
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import jakarta.servlet.ServletContext;
 
 import lombok.extern.slf4j.Slf4j;
@@ -28,6 +25,9 @@ import stirling.software.common.model.enumeration.Role;
 import stirling.software.common.service.UserServiceInterface;
 import stirling.software.common.util.RegexPatternUtils;
 
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;
+
 @Service
 @Slf4j
 public class ApiDocService {
@@ -36,12 +36,15 @@ public class ApiDocService {
 
     private final ServletContext servletContext;
     private final UserServiceInterface userService;
+    private final ObjectMapper objectMapper;
     Map<String, List<String>> outputToFileTypes = new HashMap<>();
     JsonNode apiDocsJsonRootNode;
 
     public ApiDocService(
+            ObjectMapper objectMapper,
             ServletContext servletContext,
             @Autowired(required = false) UserServiceInterface userService) {
+        this.objectMapper = objectMapper;
         this.servletContext = servletContext;
         this.userService = userService;
     }
@@ -116,8 +119,7 @@ public class ApiDocService {
             ResponseEntity<String> response =
                     restTemplate.exchange(getApiDocsUrl(), HttpMethod.GET, entity, String.class);
             apiDocsJson = response.getBody();
-            ObjectMapper mapper = new ObjectMapper();
-            apiDocsJsonRootNode = mapper.readTree(apiDocsJson);
+            apiDocsJsonRootNode = objectMapper.readTree(apiDocsJson);
             JsonNode paths = apiDocsJsonRootNode.path("paths");
             paths.propertyStream()
                     .forEach(

app/core/src/main/java/stirling/software/SPDF/service/CertificateValidationService.java

@@ -427,7 +427,8 @@ public class CertificateValidationService {
             try (InputStream certStream =
                     getClass().getClassLoader().getResourceAsStream("certs/cacert.pem")) {
                 if (certStream == null) {
-                    log.warn("Bundled Mozilla CA certificate file not found in resources");
+                    log.debug(
+                            "Bundled Mozilla CA certificate file not found in resources — using Java system trust store only");
                     return;
                 }
 
@@ -611,9 +612,11 @@ public class CertificateValidationService {
      */
     private int parseSecuritySettingsXML(InputStream xmlStream) throws Exception {
         DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+        factory.setFeature(javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, true);
         factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
         factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
         factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+        factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
         factory.setXIncludeAware(false);
         factory.setExpandEntityReferences(false);
 
@@ -837,9 +840,11 @@ public class CertificateValidationService {
         DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
         factory.setNamespaceAware(true);
         // Secure processing hardening
+        factory.setFeature(javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, true);
         factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
         factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
         factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+        factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
         factory.setXIncludeAware(false);
         factory.setExpandEntityReferences(false);
         return factory;