From 60fff188a641eb31af0505b4f16d283390693c6f Mon Sep 17 00:00:00 2001 From: Ludy Date: Wed, 24 Jun 2026 10:15:08 +0200 Subject: [PATCH 1/4] fix(team): hide users already assigned to the selected team (#6760) # Description of Changes # Description of Changes - What was changed - Filtered the "Add Member to Team" user picker so users who are already members of the selected target team are no longer shown. - Applied the same filtering in both team management entry points: - `TeamsSection` - `TeamDetailsSection` - Kept users in other teams visible, so they can still be moved into the selected team. - Why the change was made - The modal was showing users who were already part of the target team, which made the action misleading and allowed redundant selection. - Hiding already-assigned users keeps the UI aligned with the actual action: adding new members to the team before: image after: image --- ## Checklist ### General - [ ] I have read the [Contribution Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md) - [ ] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md) (if applicable) - [ ] I have read the [How to add new languages to Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md) (if applicable) - [ ] I have performed a self-review of my own code - [ ] My changes generate no new warnings ### Documentation - [ ] I have updated relevant docs on [Stirling-PDF's doc repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/) (if functionality has heavily changed) - [ ] I have read the section [Add New Translation Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags) (for new translation tags only) ### Translations (if applicable) - [ ] I ran [`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md) ### UI Changes (if applicable) - [ ] Screenshots or videos demonstrating the UI changes are attached (e.g., as comments or direct attachments in the PR) ### Testing (if applicable) - [ ] I have run `task check` to verify linters, typechecks, and tests pass - [ ] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing) for more details. --- .../config/configSections/TeamDetailsSection.tsx | 10 +++++++--- .../shared/config/configSections/TeamsSection.tsx | 10 +++++++--- 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/TeamDetailsSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/TeamDetailsSection.tsx index 5363525cfb..90f4fda9e0 100644 --- a/frontend/editor/src/proprietary/components/shared/config/configSections/TeamDetailsSection.tsx +++ b/frontend/editor/src/proprietary/components/shared/config/configSections/TeamDetailsSection.tsx @@ -55,6 +55,9 @@ export default function TeamDetailsSection({ const [selectedUserId, setSelectedUserId] = useState(""); const [selectedTeamId, setSelectedTeamId] = useState(""); const [processing, setProcessing] = useState(false); + const availableUsersForTeam = team + ? availableUsers.filter((user) => user.team?.id !== team.id) + : []; // License information const [licenseInfo, setLicenseInfo] = useState<{ @@ -725,7 +728,7 @@ export default function TeamDetailsSection({ placeholder={t( "workspace.teams.addMemberToTeam.selectUserPlaceholder", )} - data={availableUsers.map((user) => ({ + data={availableUsersForTeam.map((user) => ({ value: user.id.toString(), label: `${user.username}${user.team ? ` (${t("workspace.teams.addMemberToTeam.currentlyIn")} ${user.team.name})` : ""}`, }))} @@ -739,8 +742,9 @@ export default function TeamDetailsSection({ /> {selectedUserId && - availableUsers.find((u) => u.id.toString() === selectedUserId) - ?.team && ( + availableUsersForTeam.find( + (u) => u.id.toString() === selectedUserId, + )?.team && ( {t("workspace.teams.addMemberToTeam.willBeMoved")} diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/TeamsSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/TeamsSection.tsx index 9904e32755..e3cd79be02 100644 --- a/frontend/editor/src/proprietary/components/shared/config/configSections/TeamsSection.tsx +++ b/frontend/editor/src/proprietary/components/shared/config/configSections/TeamsSection.tsx @@ -46,6 +46,9 @@ export default function TeamsSection() { const [newTeamName, setNewTeamName] = useState(""); const [renameTeamName, setRenameTeamName] = useState(""); const [selectedUserId, setSelectedUserId] = useState(""); + const availableUsersForSelectedTeam = selectedTeam + ? availableUsers.filter((user) => user.team?.id !== selectedTeam.id) + : []; useEffect(() => { fetchTeams(); @@ -604,7 +607,7 @@ export default function TeamsSection() { placeholder={t( "workspace.teams.addMemberToTeam.selectUserPlaceholder", )} - data={availableUsers.map((user) => ({ + data={availableUsersForSelectedTeam.map((user) => ({ value: user.id.toString(), label: `${user.username}${user.team ? ` (${t("workspace.teams.addMemberToTeam.currentlyIn")} ${user.team.name})` : ""}`, }))} @@ -618,8 +621,9 @@ export default function TeamsSection() { /> {selectedUserId && - availableUsers.find((u) => u.id.toString() === selectedUserId) - ?.team && ( + availableUsersForSelectedTeam.find( + (u) => u.id.toString() === selectedUserId, + )?.team && ( {t("workspace.teams.addMemberToTeam.willBeMoved")} From 8a0b12b5abbe366118af5cdc9e030f81bbeeb643 Mon Sep 17 00:00:00 2001 From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com> Date: Wed, 24 Jun 2026 09:21:28 +0100 Subject: [PATCH 2/4] Remove ffmpeg from published Docker images (#6791) ## Summary Published Docker images (`stirling-pdf:latest`, `:2.13.1`) still shipped the full `ffmpeg` package even though it was disabled in source back in #6053. **Root cause:** `push-docker.yml` passed a hardcoded `BASE_VERSION=1.0.0` build-arg for the regular image, overriding the Dockerfile's `ARG BASE_VERSION=1.0.2` default. Base `1.0.0` is the original base that still does the explicit `ffmpeg` apt install, so the published image never picked up the removal. --- .github/aur/stirling-pdf-desktop/PKGBUILD | 2 +- .github/aur/stirling-pdf-server-bin/PKGBUILD | 2 +- .github/workflows/push-docker.yml | 2 +- build.gradle | 2 +- frontend/editor/src-tauri/tauri.conf.json | 2 +- frontend/editor/src/core/testing/serverExperienceSimulations.ts | 2 +- .../src/proprietary/testing/serverExperienceSimulations.ts | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/aur/stirling-pdf-desktop/PKGBUILD b/.github/aur/stirling-pdf-desktop/PKGBUILD index d35c874238..5a8563e942 100644 --- a/.github/aur/stirling-pdf-desktop/PKGBUILD +++ b/.github/aur/stirling-pdf-desktop/PKGBUILD @@ -1,6 +1,6 @@ # Maintainer: Stirling PDF Inc pkgname=stirling-pdf-desktop -pkgver=2.13.1 +pkgver=2.13.2 pkgrel=1 pkgdesc="Locally hosted, web-based PDF manipulation tool (Tauri desktop app, official Stirling PDF Inc build)" arch=('x86_64') diff --git a/.github/aur/stirling-pdf-server-bin/PKGBUILD b/.github/aur/stirling-pdf-server-bin/PKGBUILD index 2e71087c7c..6ed6757b92 100644 --- a/.github/aur/stirling-pdf-server-bin/PKGBUILD +++ b/.github/aur/stirling-pdf-server-bin/PKGBUILD @@ -1,6 +1,6 @@ # Maintainer: Stirling PDF Inc pkgname=stirling-pdf-server-bin -pkgver=2.13.1 +pkgver=2.13.2 pkgrel=1 pkgdesc="Locally hosted, web-based PDF manipulation tool (server JAR, prebuilt)" arch=('any') diff --git a/.github/workflows/push-docker.yml b/.github/workflows/push-docker.yml index ad7653eab3..1f38f0ef57 100644 --- a/.github/workflows/push-docker.yml +++ b/.github/workflows/push-docker.yml @@ -155,9 +155,9 @@ jobs: cache-to: type=gha,mode=max,scope=stirling-pdf-latest tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} + # No BASE_VERSION pin: inherit the Dockerfile ARG default (single source of truth). build-args: | VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }} - BASE_VERSION=1.0.0 platforms: linux/amd64,linux/arm64/v8 provenance: true sbom: true diff --git a/build.gradle b/build.gradle index b8423fc920..6b324598f3 100644 --- a/build.gradle +++ b/build.gradle @@ -78,7 +78,7 @@ springBoot { allprojects { group = 'stirling.software' - version = '2.13.1' + version = '2.13.2' configurations.configureEach { exclude group: "org.springframework.boot", module: "spring-boot-starter-tomcat" diff --git a/frontend/editor/src-tauri/tauri.conf.json b/frontend/editor/src-tauri/tauri.conf.json index 55dba6de7d..3eb545c231 100644 --- a/frontend/editor/src-tauri/tauri.conf.json +++ b/frontend/editor/src-tauri/tauri.conf.json @@ -1,7 +1,7 @@ { "$schema": "../node_modules/@tauri-apps/cli/config.schema.json", "productName": "Stirling-PDF", - "version": "2.13.1", + "version": "2.13.2", "identifier": "stirling.pdf.dev", "build": { "frontendDist": "../dist", diff --git a/frontend/editor/src/core/testing/serverExperienceSimulations.ts b/frontend/editor/src/core/testing/serverExperienceSimulations.ts index 8338efb9e9..2e9db84852 100644 --- a/frontend/editor/src/core/testing/serverExperienceSimulations.ts +++ b/frontend/editor/src/core/testing/serverExperienceSimulations.ts @@ -38,7 +38,7 @@ const FREE_LICENSE_INFO: LicenseInfo = { const BASE_NO_LOGIN_CONFIG: AppConfig = { enableAnalytics: true, - appVersion: "2.13.1", + appVersion: "2.13.2", serverCertificateEnabled: false, enableAlphaFunctionality: false, serverPort: 8080, diff --git a/frontend/editor/src/proprietary/testing/serverExperienceSimulations.ts b/frontend/editor/src/proprietary/testing/serverExperienceSimulations.ts index 1e19f4be0c..65d611fc09 100644 --- a/frontend/editor/src/proprietary/testing/serverExperienceSimulations.ts +++ b/frontend/editor/src/proprietary/testing/serverExperienceSimulations.ts @@ -48,7 +48,7 @@ const FREE_LICENSE_INFO: LicenseInfo = { const BASE_NO_LOGIN_CONFIG: AppConfig = { enableAnalytics: true, - appVersion: "2.13.1", + appVersion: "2.13.2", serverCertificateEnabled: false, enableAlphaFunctionality: false, enableDesktopInstallSlide: true, From e35594f946835dcb7ac5dd32693cda18cb2244f8 Mon Sep 17 00:00:00 2001 From: Ludy Date: Wed, 24 Jun 2026 10:34:59 +0200 Subject: [PATCH 3/4] chore(build): centralize Gradle dependency version management (#6499) # Description of Changes This change centralizes several dependency version declarations into shared Gradle version properties and updates module build files to reference those properties instead of hardcoded version strings. ### What was changed - Added centralized version properties in the root `build.gradle` for: - commons-io - commons-lang3 - rhino - okhttp BOM - gson - guava - bucket4j - archunit - batik - jpdfium - JWT - AWS SDK - Testcontainers - Replaced hardcoded dependency versions across multiple modules with shared version variables. - Updated `resolutionStrategy.force` declarations to use centralized version properties. - Updated dependency constraints and BOM references to use shared version variables. - Removed module-specific duplicate version declarations from `app/proprietary/build.gradle`. - Standardized dependency declarations across `common`, `core`, `proprietary`, and `saas` modules. ## Why the change was made - Reduce duplication of dependency version definitions. - Simplify future dependency upgrades and maintenance. - Ensure consistent dependency versions across all modules. - Improve readability and reduce the risk of version drift between subprojects. - Make security-related dependency overrides easier to maintain from a single location. --- ## Checklist ### General - [ ] I have read the [Contribution Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md) - [ ] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md) (if applicable) - [ ] I have read the [How to add new languages to Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md) (if applicable) - [ ] I have performed a self-review of my own code - [ ] My changes generate no new warnings ### Documentation - [ ] I have updated relevant docs on [Stirling-PDF's doc repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/) (if functionality has heavily changed) - [ ] I have read the section [Add New Translation Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags) (for new translation tags only) ### Translations (if applicable) - [ ] I ran [`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md) ### UI Changes (if applicable) - [ ] Screenshots or videos demonstrating the UI changes are attached (e.g., as comments or direct attachments in the PR) ### Testing (if applicable) - [ ] I have run `task check` to verify linters, typechecks, and tests pass - [ ] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing) for more details. --- app/common/build.gradle | 12 ++++++------ app/core/build.gradle | 13 ++++++------- app/proprietary/build.gradle | 32 +++++++++++++------------------- app/saas/build.gradle | 2 +- build.gradle | 30 +++++++++++++++++++++--------- 5 files changed, 47 insertions(+), 42 deletions(-) diff --git a/app/common/build.gradle b/app/common/build.gradle index 170f964af4..516edd4897 100644 --- a/app/common/build.gradle +++ b/app/common/build.gradle @@ -29,13 +29,13 @@ spotless { } } dependencies { - api 'com.google.guava:guava:33.6.0-jre' + api "com.google.guava:guava:${guavaVersion}" api 'org.springframework.boot:spring-boot-starter-webmvc' api 'org.springframework.boot:spring-boot-starter-aspectj' api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20260313.1' api 'com.fathzer:javaluator:3.0.6' api 'com.posthog.java:posthog:1.2.0' - api 'org.apache.commons:commons-lang3:3.20.0' + api "org.apache.commons:commons-lang3:${commonsLang3}" api 'com.drewnoakes:metadata-extractor:2.20.0' // Image metadata extractor api 'com.vladsch.flexmark:flexmark-html2md-converter:0.64.8' api "org.apache.pdfbox:pdfbox:$pdfboxVersion" @@ -60,7 +60,7 @@ dependencies { exclude group: 'com.google.code.gson', module: 'gson' } - api 'com.stirling:jpdfium:1.0.2' + api "com.stirling:jpdfium:${jpdfiumVersion}" // -PjpdfiumPlatforms=all| def jpdfiumPlatformsProp = (project.findProperty('jpdfiumPlatforms') ?: 'all').toString().trim() @@ -75,12 +75,12 @@ dependencies { } logger.lifecycle("JPDFium native platforms: ${jpdfiumPlatforms.join(', ')}") jpdfiumPlatforms.each { platform -> - runtimeOnly "com.stirling:jpdfium-natives-${platform}:1.0.2" + runtimeOnly "com.stirling:jpdfium-natives-${platform}:${jpdfiumVersion}" } // Bucket4j (local in-process token bucket for RateLimitStore default impl) - implementation 'com.bucket4j:bucket4j_jdk17-core:8.19.0' + implementation "com.bucket4j:bucket4j_jdk17-core:${bucket4jVersion}" // ArchUnit: enforces module dependency direction (see ArchitectureTest) - testImplementation 'com.tngtech.archunit:archunit-junit5:1.4.2' + testImplementation "com.tngtech.archunit:archunit-junit5:${archunitVersion}" } diff --git a/app/core/build.gradle b/app/core/build.gradle index 21acdb36e0..d77fbdd438 100644 --- a/app/core/build.gradle +++ b/app/core/build.gradle @@ -67,7 +67,7 @@ dependencies { exclude group: 'com.fasterxml.jackson.jaxrs' exclude group: 'com.fasterxml.jackson.module', module: 'jackson-module-jaxb-annotations' } - implementation 'commons-io:commons-io:2.22.0' + implementation "commons-io:commons-io:$commonsIoVersion" implementation "org.bouncycastle:bcprov-jdk18on:$bouncycastleVersion" implementation "org.bouncycastle:bcpkix-jdk18on:$bouncycastleVersion" implementation 'io.micrometer:micrometer-core' @@ -81,25 +81,24 @@ dependencies { implementation 'org.verapdf:validation-model:1.28.2' // CVE-2025-66453: Explicit rhino 1.7.15 to override verapdf's 1.7.13 - implementation 'org.mozilla:rhino:1.9.1' + implementation "org.mozilla:rhino:${rhinoVersion}" // veraPDF still uses javax.xml.bind, not the new jakarta namespace implementation 'javax.xml.bind:jaxb-api:2.3.1' implementation 'com.sun.xml.bind:jaxb-impl:2.3.9' implementation 'com.sun.xml.bind:jaxb-core:4.0.7' - implementation 'org.apache.poi:poi-ooxml:5.5.1' - // CVE-2022-25647: Explicit gson 2.13.2 to prevent unsafe deserialization (tabula would pull 2.8.7) - implementation 'com.google.code.gson:gson:2.13.2' + // CVE-2022-25647: Explicit gson to prevent unsafe deserialization (tabula would pull 2.8.7) + implementation "com.google.code.gson:gson:${gsonVersion}" implementation 'org.apache.pdfbox:jbig2-imageio:3.0.4' implementation 'com.opencsv:opencsv:5.12.0' // https://mvnrepository.com/artifact/com.opencsv/opencsv implementation 'org.apache.poi:poi-ooxml:5.5.1' // Batik only bridge module needed (transitively pulls anim, gvt, util, css, dom, svg-dom) // Replaces batik-all which included unused codec, svggen, transcoder, script modules - implementation 'org.apache.xmlgraphics:batik-bridge:1.19' + implementation "org.apache.xmlgraphics:batik-bridge:${batikVersion}" // Required by TwelveMonkeys imageio-batik SPI (SVGImageReaderSpi) during ImageIO init - runtimeOnly 'org.apache.xmlgraphics:batik-transcoder:1.19' + runtimeOnly "org.apache.xmlgraphics:batik-transcoder:${batikVersion}" // PDFBox Graphics2D bridge for Batik SVG to PDF conversion implementation 'de.rototor.pdfbox:graphics2d:3.0.5' diff --git a/app/proprietary/build.gradle b/app/proprietary/build.gradle index 821def1fec..7fb12de5ce 100644 --- a/app/proprietary/build.gradle +++ b/app/proprietary/build.gradle @@ -3,12 +3,6 @@ repositories { maven { url = "https://build.shibboleth.net/maven/releases" } } -ext { - jwtVersion = '0.13.0' - awsSdkVersion = '2.44.12' - testcontainersMinioVersion = '1.21.4' -} - bootRun { enabled = false } @@ -41,7 +35,7 @@ spotless { } dependencies { implementation project(':common') - api 'com.google.guava:guava:33.6.0-jre' + api "com.google.guava:guava:${guavaVersion}" api 'org.springframework:spring-jdbc' api 'org.springframework:spring-webmvc' @@ -61,37 +55,37 @@ dependencies { api 'com.github.ben-manes.caffeine:caffeine' implementation 'org.springframework.boot:spring-boot-starter-data-redis' api 'io.swagger.core.v3:swagger-core-jakarta:2.2.46' - implementation 'com.bucket4j:bucket4j_jdk17-core:8.19.0' + implementation "com.bucket4j:bucket4j_jdk17-core:${bucket4jVersion}" // Lettuce-backed Bucket4j ProxyManager used by ValkeyRateLimitStore for cluster-wide // token-bucket rate limiting (parity with in-process Bucket4j semantics; no fixed-window // boundary doubling). - implementation 'com.bucket4j:bucket4j_jdk17-lettuce:8.19.0' + implementation "com.bucket4j:bucket4j_jdk17-lettuce:${bucket4jVersion}" // https://mvnrepository.com/artifact/com.bucket4j/bucket4j_jdk17 implementation "org.bouncycastle:bcprov-jdk18on:$bouncycastleVersion" - implementation 'com.google.code.gson:gson:2.13.2' + implementation "com.google.code.gson:gson:${gsonVersion}" api 'io.micrometer:micrometer-registry-prometheus' - api "io.jsonwebtoken:jjwt-api:$jwtVersion" - runtimeOnly "io.jsonwebtoken:jjwt-impl:$jwtVersion" - runtimeOnly "io.jsonwebtoken:jjwt-jackson:$jwtVersion" + api "io.jsonwebtoken:jjwt-api:${jwtVersion}" + runtimeOnly "io.jsonwebtoken:jjwt-impl:${jwtVersion}" + runtimeOnly "io.jsonwebtoken:jjwt-jackson:${jwtVersion}" runtimeOnly 'com.h2database:h2:2.3.232' // Don't upgrade h2database - file format incompatible with 2.4.x, would break existing user databases runtimeOnly 'org.postgresql:postgresql:42.7.11' implementation('com.coveo:saml-client:5.0.0') { exclude group: 'org.opensaml', module: 'opensaml-core' } - implementation "software.amazon.awssdk:s3:$awsSdkVersion" - implementation "software.amazon.awssdk:url-connection-client:$awsSdkVersion" + implementation "software.amazon.awssdk:s3:${awsSdkVersion}" + implementation "software.amazon.awssdk:url-connection-client:${awsSdkVersion}" // Testcontainers: real MinIO/LocalStack (S3) and Valkey for integration tests in CI without // manually-started instances. Tests skip cleanly when Docker is unavailable. - testImplementation "org.testcontainers:testcontainers:$testcontainersMinioVersion" - testImplementation "org.testcontainers:minio:$testcontainersMinioVersion" - testImplementation "org.testcontainers:localstack:$testcontainersMinioVersion" - testImplementation "org.testcontainers:junit-jupiter:$testcontainersMinioVersion" + testImplementation "org.testcontainers:testcontainers:${testcontainersMinioVersion}" + testImplementation "org.testcontainers:minio:${testcontainersMinioVersion}" + testImplementation "org.testcontainers:localstack:${testcontainersMinioVersion}" + testImplementation "org.testcontainers:junit-jupiter:${testcontainersMinioVersion}" } tasks.register('prepareKotlinBuildScriptModel') {} diff --git a/app/saas/build.gradle b/app/saas/build.gradle index 560ad58f5f..d6ae305def 100644 --- a/app/saas/build.gradle +++ b/app/saas/build.gradle @@ -41,5 +41,5 @@ dependencies { api 'org.flywaydb:flyway-core' runtimeOnly 'org.flywaydb:flyway-database-postgresql' - testImplementation 'com.tngtech.archunit:archunit-junit5:1.4.2' + testImplementation "com.tngtech.archunit:archunit-junit5:${archunitVersion}" } diff --git a/build.gradle b/build.gradle index 6b324598f3..3b91ca502c 100644 --- a/build.gradle +++ b/build.gradle @@ -30,6 +30,19 @@ ext { commonmarkVersion = "0.28.0" googleJavaFormatVersion = "1.28.0" logback = "1.5.32" + commonsIoVersion = "2.22.0" + commonsLang3 = "3.20.0" + rhinoVersion = "1.9.1" + okhttpBomVersion = "5.3.2" + gsonVersion = "2.14.0" + guavaVersion = "33.6.0-jre" + bucket4jVersion = "8.19.0" + archunitVersion = "1.4.2" + batikVersion = "1.19" + jpdfiumVersion = "1.0.2" + jwtVersion = "0.13.0" + awsSdkVersion = "2.44.12" + testcontainersMinioVersion = "1.21.4" // junit-platform-launcher version managed by Spring Boot BOM modernJavaVersion = 25 } @@ -203,12 +216,12 @@ subprojects { // - CVE-2022-25647: gson 2.8.9+ (explicit dependency overrides tabula 2.8.7) // - CVE-2025-66453: rhino 1.7.15 (explicit dependency overrides verapdf 1.7.13) // Fallback strategy force declarations for additional safety: - resolutionStrategy.force 'com.google.code.gson:gson:2.13.2' - resolutionStrategy.force 'org.mozilla:rhino:1.9.1' + resolutionStrategy.force "com.google.code.gson:gson:${gsonVersion}" + resolutionStrategy.force "org.mozilla:rhino:${rhinoVersion}" // CVE-2025-48924: commons-lang3 3.20.0 DoS prevention - resolutionStrategy.force 'org.apache.commons:commons-lang3:3.20.0' - // CVE-2024-47554: commons-io 2.21.0 DoS prevention - resolutionStrategy.force 'commons-io:commons-io:2.21.0' + resolutionStrategy.force "org.apache.commons:commons-lang3:${commonsLang3}" + // CVE-2024-47554: commons-io DoS prevention + resolutionStrategy.force "commons-io:commons-io:${commonsIoVersion}" // Keep BouncyCastle modules aligned to avoid runtime linkage errors resolutionStrategy.force "org.bouncycastle:bcprov-jdk18on:${bouncycastleVersion}" resolutionStrategy.force "org.bouncycastle:bcpkix-jdk18on:${bouncycastleVersion}" @@ -221,7 +234,7 @@ subprojects { } dependencies { // Override BOM-managed commons-lang3 for CVE-2025-48924 fix - dependency 'org.apache.commons:commons-lang3:3.20.0' + dependency "org.apache.commons:commons-lang3:$commonsLang3" } } @@ -243,7 +256,7 @@ subprojects { testRuntimeOnly 'org.mockito:mockito-inline:5.2.0' testRuntimeOnly "org.junit.platform:junit-platform-launcher" - testImplementation platform("com.squareup.okhttp3:okhttp-bom:5.3.2") + testImplementation platform("com.squareup.okhttp3:okhttp-bom:${okhttpBomVersion}") testImplementation "com.squareup.okhttp3:mockwebserver" } @@ -599,7 +612,7 @@ dependencies { testImplementation 'org.springframework.boot:spring-boot-starter-test' testRuntimeOnly "org.junit.platform:junit-platform-launcher" - testImplementation platform("com.squareup.okhttp3:okhttp-bom:5.3.2") + testImplementation platform("com.squareup.okhttp3:okhttp-bom:${okhttpBomVersion}") testImplementation "com.squareup.okhttp3:mockwebserver" } @@ -670,7 +683,6 @@ tasks.register('buildRestartHelper', Jar) { } } - tasks.withType(Test).configureEach { // maxParallelForks: parallelise JUnit across cores // Half of available CPUs is a safe default; bump if your tests are I/O-bound. From 26021425e3c429ef4eaa942bf165b71190c5eccb Mon Sep 17 00:00:00 2001 From: Ludy Date: Wed, 24 Jun 2026 10:36:05 +0200 Subject: [PATCH 4/4] chore(ci): upgrade Gradle to 9.6.0 across workflows, Docker builds, and wrapper (#6790) # Description of Changes ## What was changed - Updated all GitHub Actions workflows using Gradle from older versions (9.3.1 and 9.5.1) to Gradle 9.6.0. - Updated the Gradle Wrapper distribution URL to use Gradle 9.6.0. - Updated all Gradle-based Docker build stages to use the `gradle:9.6.0-jdk25` image and corresponding image digest. - Aligned CI, Docker, and local development environments on the same Gradle version. - Included the regenerated `gradlew` script changes produced by the Gradle wrapper update process. ## Why the change was made - Ensures consistent Gradle versions across local development, CI workflows, and Docker builds. - Takes advantage of the latest Gradle 9.6.0 improvements, fixes, and compatibility updates. - Reduces the risk of version mismatches causing build or deployment inconsistencies. - Simplifies maintenance by standardizing the build toolchain throughout the repository. --- ## Checklist ### General - [ ] I have read the [Contribution Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md) - [ ] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md) (if applicable) - [ ] I have read the [How to add new languages to Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md) (if applicable) - [ ] I have performed a self-review of my own code - [ ] My changes generate no new warnings ### Documentation - [ ] I have updated relevant docs on [Stirling-PDF's doc repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/) (if functionality has heavily changed) - [ ] I have read the section [Add New Translation Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags) (for new translation tags only) ### Translations (if applicable) - [ ] I ran [`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md) ### UI Changes (if applicable) - [ ] Screenshots or videos demonstrating the UI changes are attached (e.g., as comments or direct attachments in the PR) ### Testing (if applicable) - [ ] I have run `task check` to verify linters, typechecks, and tests pass - [ ] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing) for more details. --- .github/workflows/PR-Demo-Comment-with-react.yml | 2 +- .github/workflows/ai-engine.yml | 2 +- .github/workflows/backend-build.yml | 2 +- .github/workflows/check-licence.yml | 2 +- .github/workflows/check-openapi.yml | 2 +- .github/workflows/coverage-aggregate.yml | 2 +- .github/workflows/db-migration-test.yml | 2 +- .github/workflows/docker-compose-tests.yml | 2 +- .github/workflows/frontend-backend-licenses-update.yml | 2 +- .github/workflows/multiOSReleases.yml | 6 +++--- .github/workflows/push-docker.yml | 2 +- .github/workflows/swagger.yml | 2 +- .github/workflows/tauri-build.yml | 4 ++-- .github/workflows/test-build-docker.yml | 2 +- .github/workflows/testdriver.yml | 2 +- docker/backend/Dockerfile | 2 +- docker/embedded/Dockerfile | 2 +- docker/embedded/Dockerfile.fat | 2 +- docker/embedded/Dockerfile.ultra-lite | 2 +- gradle/wrapper/gradle-wrapper.properties | 2 +- gradlew | 4 ++-- 21 files changed, 25 insertions(+), 25 deletions(-) diff --git a/.github/workflows/PR-Demo-Comment-with-react.yml b/.github/workflows/PR-Demo-Comment-with-react.yml index 95afebfe4c..e478f95c89 100644 --- a/.github/workflows/PR-Demo-Comment-with-react.yml +++ b/.github/workflows/PR-Demo-Comment-with-react.yml @@ -222,7 +222,7 @@ jobs: - name: Setup Gradle uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: - gradle-version: 9.5.1 + gradle-version: 9.6.0 - name: Install Task uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0 diff --git a/.github/workflows/ai-engine.yml b/.github/workflows/ai-engine.yml index 33212b2330..03b172c4c3 100644 --- a/.github/workflows/ai-engine.yml +++ b/.github/workflows/ai-engine.yml @@ -43,7 +43,7 @@ jobs: - name: Setup Gradle uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: - gradle-version: 9.5.1 + gradle-version: 9.6.0 - name: Install Task uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0 diff --git a/.github/workflows/backend-build.yml b/.github/workflows/backend-build.yml index 0a252100a0..37a42c419f 100644 --- a/.github/workflows/backend-build.yml +++ b/.github/workflows/backend-build.yml @@ -58,7 +58,7 @@ jobs: - name: Setup Gradle uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: - gradle-version: 9.5.1 + gradle-version: 9.6.0 cache-disabled: true - name: Install Task diff --git a/.github/workflows/check-licence.yml b/.github/workflows/check-licence.yml index 1159c75dc6..b984f7d47d 100644 --- a/.github/workflows/check-licence.yml +++ b/.github/workflows/check-licence.yml @@ -40,7 +40,7 @@ jobs: - name: Setup Gradle uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: - gradle-version: 9.5.1 + gradle-version: 9.6.0 cache-disabled: true - name: Install Task diff --git a/.github/workflows/check-openapi.yml b/.github/workflows/check-openapi.yml index 49c19433c3..46ce829a87 100644 --- a/.github/workflows/check-openapi.yml +++ b/.github/workflows/check-openapi.yml @@ -45,7 +45,7 @@ jobs: - name: Setup Gradle uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: - gradle-version: 9.5.1 + gradle-version: 9.6.0 cache-disabled: true - name: Install Task diff --git a/.github/workflows/coverage-aggregate.yml b/.github/workflows/coverage-aggregate.yml index 35c252c4bd..bbfaf09363 100644 --- a/.github/workflows/coverage-aggregate.yml +++ b/.github/workflows/coverage-aggregate.yml @@ -51,7 +51,7 @@ jobs: - name: Setup Gradle uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: - gradle-version: 9.3.1 + gradle-version: 9.6.0 cache-disabled: true - name: Set up Python diff --git a/.github/workflows/db-migration-test.yml b/.github/workflows/db-migration-test.yml index 114855c4bc..4b5ca8b674 100644 --- a/.github/workflows/db-migration-test.yml +++ b/.github/workflows/db-migration-test.yml @@ -48,7 +48,7 @@ jobs: - name: Setup Gradle uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: - gradle-version: 9.5.1 + gradle-version: 9.6.0 cache-disabled: true # No `-PnoSpotless` here yet because the upstream cache layer matches the diff --git a/.github/workflows/docker-compose-tests.yml b/.github/workflows/docker-compose-tests.yml index add65d6a8e..faa3c2a280 100644 --- a/.github/workflows/docker-compose-tests.yml +++ b/.github/workflows/docker-compose-tests.yml @@ -61,7 +61,7 @@ jobs: - name: Setup Gradle uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: - gradle-version: 9.5.1 + gradle-version: 9.6.0 cache-disabled: true - name: Set up Docker Buildx diff --git a/.github/workflows/frontend-backend-licenses-update.yml b/.github/workflows/frontend-backend-licenses-update.yml index 8bf89bf210..41d3f35c6e 100644 --- a/.github/workflows/frontend-backend-licenses-update.yml +++ b/.github/workflows/frontend-backend-licenses-update.yml @@ -349,7 +349,7 @@ jobs: - name: Setup Gradle uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: - gradle-version: 9.5.1 + gradle-version: 9.6.0 - name: Install Task uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0 diff --git a/.github/workflows/multiOSReleases.yml b/.github/workflows/multiOSReleases.yml index f29714d94e..f5fb743a3f 100644 --- a/.github/workflows/multiOSReleases.yml +++ b/.github/workflows/multiOSReleases.yml @@ -73,7 +73,7 @@ jobs: - name: Setup Gradle uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: - gradle-version: 9.5.1 + gradle-version: 9.6.0 - name: Install Task uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0 @@ -148,7 +148,7 @@ jobs: - name: Setup Gradle uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: - gradle-version: 9.5.1 + gradle-version: 9.6.0 - name: Setup Node.js if: matrix.variant.build_frontend == true @@ -252,7 +252,7 @@ jobs: - name: Setup Gradle uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: - gradle-version: 9.5.1 + gradle-version: 9.6.0 - name: Install Task uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0 diff --git a/.github/workflows/push-docker.yml b/.github/workflows/push-docker.yml index 1f38f0ef57..75b1aa60c8 100644 --- a/.github/workflows/push-docker.yml +++ b/.github/workflows/push-docker.yml @@ -78,7 +78,7 @@ jobs: - name: Setup Gradle uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: - gradle-version: 9.5.1 + gradle-version: 9.6.0 - name: Set up Docker Buildx id: buildx diff --git a/.github/workflows/swagger.yml b/.github/workflows/swagger.yml index 00c368c75f..9696aa419c 100644 --- a/.github/workflows/swagger.yml +++ b/.github/workflows/swagger.yml @@ -48,7 +48,7 @@ jobs: - name: Setup Gradle uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: - gradle-version: 9.5.1 + gradle-version: 9.6.0 - name: Generate Swagger documentation run: ./gradlew :stirling-pdf:generateOpenApiDocs diff --git a/.github/workflows/tauri-build.yml b/.github/workflows/tauri-build.yml index 65b1e40f36..944940e973 100644 --- a/.github/workflows/tauri-build.yml +++ b/.github/workflows/tauri-build.yml @@ -122,7 +122,7 @@ jobs: uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: workspaces: frontend/editor/src-tauri - # Stable key shared across workflows so the nightly warmer. + # Stable key shared across workflows so the nightly warmer. # rust-cache still appends OS + rustc + Cargo.lock. shared-key: tauri-${{ matrix.name }} save-if: ${{ github.ref == 'refs/heads/main' }} @@ -150,7 +150,7 @@ jobs: - name: Setup Gradle uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: - gradle-version: 9.5.1 + gradle-version: 9.6.0 - name: Setup Task uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0 diff --git a/.github/workflows/test-build-docker.yml b/.github/workflows/test-build-docker.yml index 0b692a008a..4fd00a494c 100644 --- a/.github/workflows/test-build-docker.yml +++ b/.github/workflows/test-build-docker.yml @@ -106,7 +106,7 @@ jobs: - name: Setup Gradle uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: - gradle-version: 9.5.1 + gradle-version: 9.6.0 cache-disabled: true - name: Install Task diff --git a/.github/workflows/testdriver.yml b/.github/workflows/testdriver.yml index 05fce0199c..e9774694e7 100644 --- a/.github/workflows/testdriver.yml +++ b/.github/workflows/testdriver.yml @@ -51,7 +51,7 @@ jobs: - name: Setup Gradle uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 with: - gradle-version: 9.5.1 + gradle-version: 9.6.0 - name: Build with Gradle run: ./gradlew build diff --git a/docker/backend/Dockerfile b/docker/backend/Dockerfile index 40abd00933..b2b7aa644b 100644 --- a/docker/backend/Dockerfile +++ b/docker/backend/Dockerfile @@ -4,7 +4,7 @@ ARG BASE_VERSION=1.0.2 ARG BASE_IMAGE=stirlingtools/stirling-pdf-base:${BASE_VERSION} # Stage 1: Build the Java application (backend only, no frontend) -FROM gradle:9.3.1-jdk25@sha256:85aec999629f4774a383cb792da4b598bdf5a7e69c4b9570bb70c0f919179183 AS app-build +FROM gradle:9.6.0-jdk25@sha256:e3905233ae349e72016daf8a0e19f085a1dd89ded8ec88b3d8335d3fd0b350f4 AS app-build # JDK 25+: --add-exports is no longer accepted via JAVA_TOOL_OPTIONS; use JDK_JAVA_OPTIONS instead ENV JDK_JAVA_OPTIONS="--add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED \ diff --git a/docker/embedded/Dockerfile b/docker/embedded/Dockerfile index 89ed06397a..7ea8201f59 100644 --- a/docker/embedded/Dockerfile +++ b/docker/embedded/Dockerfile @@ -5,7 +5,7 @@ ARG BASE_VERSION=1.0.2 ARG BASE_IMAGE=stirlingtools/stirling-pdf-base:${BASE_VERSION} # Stage 1: Build the Java application and frontend -FROM gradle:9.5.1-jdk25@sha256:8de3543f1772bb66be3b275893e5977b6d8bd2b0d25551faa5846a821d1f0600 AS app-build +FROM gradle:9.6.0-jdk25@sha256:e3905233ae349e72016daf8a0e19f085a1dd89ded8ec88b3d8335d3fd0b350f4 AS app-build ARG TASK_VERSION=3.49.1 RUN apt-get update \ diff --git a/docker/embedded/Dockerfile.fat b/docker/embedded/Dockerfile.fat index 0beb8406ec..71f2a12414 100644 --- a/docker/embedded/Dockerfile.fat +++ b/docker/embedded/Dockerfile.fat @@ -6,7 +6,7 @@ ARG BASE_VERSION=1.0.2 ARG BASE_IMAGE=stirlingtools/stirling-pdf-base:${BASE_VERSION} # Stage 1: Build the Java application and frontend -FROM gradle:9.5.1-jdk25@sha256:8de3543f1772bb66be3b275893e5977b6d8bd2b0d25551faa5846a821d1f0600 AS app-build +FROM gradle:9.6.0-jdk25@sha256:e3905233ae349e72016daf8a0e19f085a1dd89ded8ec88b3d8335d3fd0b350f4 AS app-build ARG TASK_VERSION=3.49.1 RUN apt-get update \ diff --git a/docker/embedded/Dockerfile.ultra-lite b/docker/embedded/Dockerfile.ultra-lite index 9f77716646..01048e864d 100644 --- a/docker/embedded/Dockerfile.ultra-lite +++ b/docker/embedded/Dockerfile.ultra-lite @@ -2,7 +2,7 @@ # Single JAR contains both frontend and backend with minimal dependencies # Stage 1: Build application with embedded frontend -FROM gradle:9.5.1-jdk25@sha256:8de3543f1772bb66be3b275893e5977b6d8bd2b0d25551faa5846a821d1f0600 AS build +FROM gradle:9.6.0-jdk25@sha256:e3905233ae349e72016daf8a0e19f085a1dd89ded8ec88b3d8335d3fd0b350f4 AS build # Install Node.js and npm for frontend build ARG TASK_VERSION=3.49.1 diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties index df6a6ad763..eb84db68da 100644 --- a/gradle/wrapper/gradle-wrapper.properties +++ b/gradle/wrapper/gradle-wrapper.properties @@ -1,6 +1,6 @@ distributionBase=GRADLE_USER_HOME distributionPath=wrapper/dists -distributionUrl=https\://services.gradle.org/distributions/gradle-9.5.1-bin.zip +distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.0-bin.zip networkTimeout=10000 retries=0 retryBackOffMs=500 diff --git a/gradlew b/gradlew index b9bb139f79..249efbb032 100755 --- a/gradlew +++ b/gradlew @@ -20,7 +20,7 @@ ############################################################################## # -# Gradle start up script for POSIX generated by Gradle. +# gradlew start up script for POSIX generated by Gradle. # # Important for running: # @@ -29,7 +29,7 @@ # bash, then to run this script, type that shell name before the whole # command line, like: # -# ksh Gradle +# ksh gradlew # # Busybox and similar reduced shells will NOT work, because this script # requires all of these POSIX shell features: