audit stuff

2026-01-04 23:47:49 +00:00
174 changed files with 3934 additions and 8561 deletions
@@ -2,17 +2,20 @@
 * @Frooodle @Ludy87 @jbrunton96 @ConnorYoh

 # Backend
-/app/** @DarioGii @Frooodle @Ludy87 @jbrunton96 @ConnorYoh @balazs-szucs
+/app/** @DarioGii @Frooodle @Ludy87 @jbrunton96 @ConnorYoh
+
+#V1 frontend
+/app/core/src/main/resources/static/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87
+/app/core/src/main/resources/templates/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87

 #V2 frontend
-/frontend/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @balazs-szucs
-/app/core/src/main/resources/static/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87 @balazs-szucs
+/frontend/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle

 #V2 docker
-/docker/backend/** @Frooodle @Ludy87 @DarioGii
+/docker/backend/** @Frooodle @Ludy87 @DarioGii @Ludy87
 /docker/frontend/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87
 /docker/compose/** @reecebrowne @ConnorYoh @EthanHealy01 @DarioGii @jbrunton96 @Frooodle @Ludy87


 #GHA (All users)
-/.github/** @reecebrowne @ConnorYoh @EthanHealy01 @DarioGii @jbrunton96 @Frooodle @Ludy87 @balazs-szucs
+/.github/** @reecebrowne @ConnorYoh @EthanHealy01 @DarioGii @jbrunton96 @Frooodle @Ludy87
@@ -26,18 +26,6 @@ on:
  release:
    types: [created]

-# cancel in-progress jobs if a new job is triggered
-# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
-# or a pull request is updated.
-# It helps to save resources and time by ensuring that only the latest commit is built and tested
-# This is particularly useful for long-running jobs that may take a while to complete.
-# The `group` is set to a combination of the workflow name, event name, and branch name.
-# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
-# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref_name || github.ref }}
-  cancel-in-progress: true
-
 permissions:
  contents: read

@@ -87,15 +75,15 @@ jobs:
                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
                ;;
              "linux")
-                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b appimage","name":"linux-x86_64-appimage"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b deb","name":"linux-x86_64-deb"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b rpm","name":"linux-x86_64-rpm"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
                ;;
              *)
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b appimage","name":"linux-x86_64-appimage"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b deb","name":"linux-x86_64-deb"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b rpm","name":"linux-x86_64-rpm"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
                ;;
            esac
          else
            # For push/release events, build all platforms
-            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b appimage","name":"linux-x86_64-appimage"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b deb","name":"linux-x86_64-deb"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b rpm","name":"linux-x86_64-rpm"}]}' >> $GITHUB_OUTPUT
+            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
          fi

  build-jars:
@@ -182,60 +170,10 @@ jobs:
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Install dependencies (ubuntu only)
-        if: matrix.platform == 'ubuntu-22.04' && matrix.name != 'linux-x86_64-appimage'
+        if: matrix.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
-          # Dependencies explanation:
-          # - libwebkit2gtk-4.1-dev: WebKit engine for Tauri v2 (4.0 was for v1)
-          # - libappindicator3-dev: System tray support
-          # - librsvg2-dev: SVG rendering
-          # - patchelf: Required for AppImage packaging
-          # - libxdo-dev: Keyboard/mouse automation
-          # - libasound2-dev: Audio support
-          # - libopenblas-dev: GPU acceleration support
-          # - libx11-dev: X11 development files for window system interaction
-          # - libxtst-dev: X11 testing extensions for input simulation
-          # - libxrandr-dev: X11 RandR extension for display configuration
-          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libxdo-dev libasound2-dev libopenblas-dev libx11-dev libxtst-dev libxrandr-dev
-
-      - name: Install macOS DMG tooling
-        if: startsWith(matrix.platform, 'macos')
-        run: |
-          brew list create-dmg >/dev/null 2>&1 || brew install create-dmg
-
-      - name: Install dependencies (appimage only)
-        if: matrix.platform == 'ubuntu-22.04' && matrix.name == 'linux-x86_64-appimage'
-        run: |
-          sudo apt-get update
-
-          sudo apt-get install -y \
-            build-essential \
-            curl \
-            wget \
-            file \
-            libgtk-3-dev \
-            libxdo-dev \
-            libssl-dev \
-            libappindicator3-dev \
-            librsvg2-dev \
-            openjdk-17-jre-headless \
-            patchelf
-            
-          mkdir -p /tmp/ubuntu-packages
-          cd /tmp/ubuntu-packages
-          wget https://launchpadlibrarian.net/723972773/libwebkit2gtk-4.1-0_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download libwebkit2gtk-4.1-0"; exit 1; }
-          wget https://launchpadlibrarian.net/723972761/libwebkit2gtk-4.1-dev_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download libwebkit2gtk-4.1-dev"; exit 1; }
-          wget https://launchpadlibrarian.net/723972770/libjavascriptcoregtk-4.1-0_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download libjavascriptcoregtk-4.1-0"; exit 1; }
-          wget https://launchpadlibrarian.net/723972746/libjavascriptcoregtk-4.1-dev_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download libjavascriptcoregtk-4.1-dev"; exit 1; }
-          wget https://launchpadlibrarian.net/723972735/gir1.2-javascriptcoregtk-4.1_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download gir1.2-javascriptcoregtk-4.1"; exit 1; }
-          wget https://launchpadlibrarian.net/723972739/gir1.2-webkit2-4.1_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download gir1.2-webkit2-4.1"; exit 1; }
-          wget https://launchpadlibrarian.net/606433947/libicu70_70.1-2ubuntu1_amd64.deb || { echo "Failed to download libicu70"; exit 1; }
-          wget https://launchpadlibrarian.net/606433941/libicu-dev_70.1-2ubuntu1_amd64.deb || { echo "Failed to download libicu-dev"; exit 1; }
-          wget https://launchpadlibrarian.net/606433945/icu-devtools_70.1-2ubuntu1_amd64.deb || { echo "Failed to download icu-devtools"; exit 1; }
-          wget https://launchpadlibrarian.net/595623693/libjpeg8_8c-2ubuntu10_amd64.deb || { echo "Failed to download libjpeg8"; exit 1; }
-          wget https://launchpadlibrarian.net/587202140/libjpeg-turbo8_2.1.2-0ubuntu1_amd64.deb || { echo "Failed to download libjpeg-turbo8"; exit 1; }
-          wget https://launchpadlibrarian.net/592959859/xdg-desktop-portal-gtk_1.14.0-1build1_amd64.deb || { echo "Failed to download xdg-desktop-portal-gtk"; exit 1; }
-          sudo apt-get install -y /tmp/ubuntu-packages/*.deb
+          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev

      - name: Setup Node.js
        uses: actions/setup-node@v4
@@ -443,35 +381,6 @@ jobs:
          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
          echo "Certificate imported successfully."

-      - name: Check DMG creation dependencies (macOS only)
-        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
-        run: |
-          echo "🔍 Checking DMG creation dependencies on ${{ matrix.platform }}..."
-          echo "hdiutil version: $(hdiutil --version || echo 'NOT FOUND')"
-          echo "create-dmg availability: $(which create-dmg || echo 'NOT FOUND')"
-          echo "Available disk space: $(df -h /tmp | tail -1)"
-          echo "macOS version: $(sw_vers -productVersion)"
-          echo "Available tools:"
-          ls -la /usr/bin/hd* || echo "No hd* tools found"
-
-      - name: Generate temporary GPG key for AppImage
-        if: matrix.platform == 'ubuntu-22.04' && matrix.name == 'linux-x86_64-appimage'
-        run: |
-          cat >keyparams <<EOF
-          %no-protection
-          Key-Type: RSA
-          Key-Length: 2048
-          Name-Real: CI AppImage Signer
-          Name-Email: ci-appimage@example.invalid
-          Expire-Date: 0
-          %commit
-          EOF
-          gpg --batch --generate-key keyparams
-          export GPG_FINGERPRINT=$(gpg --batch --with-colons --list-secret-keys | awk -F: '/^fpr:/ {print $10; exit}')
-          echo "GPG_FINGERPRINT=$GPG_FINGERPRINT" >> $GITHUB_ENV
-          echo "Generated temporary GPG key:"
-          gpg --list-secret-keys --keyid-format=long
-
      - name: Build Tauri app
        uses: tauri-apps/tauri-action@v0
        env:
@@ -495,15 +404,6 @@ jobs:
          tauriScript: npx tauri
          args: ${{ matrix.args }}

-      - name: Cleanup temporary GPG key
-        if: matrix.platform == 'ubuntu-22.04' && matrix.name == 'linux-x86_64-appimage'
-        run: |
-          if [ -n "${GPG_FINGERPRINT:-}" ]; then
-            gpg --batch --yes --delete-secret-keys "$GPG_FINGERPRINT" || true
-            gpg --batch --yes --delete-keys "$GPG_FINGERPRINT" || true
-          fi
-          rm -f keyparams
-
      # Sign with DigiCert KeyLocker (post-build)
      - name: Sign Windows binaries with DigiCert KeyLocker
        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
@@ -609,13 +509,10 @@ jobs:
            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
-            # find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
-          elif [ "${{ matrix.platform }}" = "ubuntu-22.04" ]; then
-            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.rpm" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.rpm" \;
-            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
+            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
          else
-            echo "Unknown platform: ${{ matrix.platform }}"
+            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
          fi

      - name: Upload build artifacts
@@ -670,11 +567,10 @@ jobs:
          tag_name: v${{ needs.determine-matrix.outputs.version }}
          generate_release_notes: true
          files: |
-            ./artifacts/**/Stirling-PDF-*.jar
-            ./artifacts/**/Stirling-PDF-*.msi
-            ./artifacts/**/Stirling-PDF-*.dmg
-            ./artifacts/**/Stirling-PDF-*.deb
-            ./artifacts/**/Stirling-PDF-*.rpm
-            ./artifacts/**/Stirling-PDF-*.AppImage
+            ./artifacts/**/*.jar
+            ./artifacts/**/*.msi
+            ./artifacts/**/*.dmg
+            ./artifacts/**/*.deb
+            ./artifacts/**/*.AppImage
          draft: false
          prerelease: false
@@ -0,0 +1,245 @@
+name: Push Docker Image - V2 Branch
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - V2-master
+
+# cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  push:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
+    runs-on: ubuntu-24.04-8core
+    permissions:
+      packages: write
+      id-token: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        with:
+          gradle-version: 8.14
+
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+
+      - name: Get version number
+        id: versionNumber
+        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
+
+      - name: Install cosign
+        if: github.ref == 'refs/heads/V2-master'
+        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
+        with:
+          cosign-release: "v2.4.1"
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_API }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+
+      - name: Convert repository owner to lowercase
+        id: repoowner
+        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
+
+      - name: Generate tags for latest (V2-master branch - production)
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        if: github.ref == 'refs/heads/V2-master'
+        with:
+          images: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
+            type=raw,value=latest
+
+      - name: Generate tags for latest (V1_V2_merge branch - test)
+        id: meta-test
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        if: github.ref == 'refs/heads/V1_V2_merge'
+        with:
+          images: |
+            ghcr.io/stirling-tools/stirling-pdf-test
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
+            type=raw,value=latest
+
+      - name: Build and push Unified Dockerfile (latest variant)
+        id: build-push-latest
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./docker/embedded/Dockerfile
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.tags || steps.meta-test.outputs.tags }}
+          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.labels || steps.meta-test.outputs.labels }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Sign regular images
+        if: github.ref == 'refs/heads/V2-master'
+        env:
+          DIGEST: ${{ steps.build-push-latest.outputs.digest }}
+          TAGS: ${{ steps.meta.outputs.tags }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: |
+          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
+            cosign sign --yes \
+              --key env://COSIGN_PRIVATE_KEY \
+              "${tag}@${DIGEST}"
+          done
+
+      - name: Generate tags for latest-fat (V2-master branch - production)
+        id: meta-fat
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        if: github.ref == 'refs/heads/V2-master'
+        with:
+          images: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
+            type=raw,value=latest-fat
+
+      - name: Generate tags for latest-fat (V1_V2_merge branch - test)
+        id: meta-fat-test
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        if: github.ref == 'refs/heads/V1_V2_merge'
+        with:
+          images: |
+            ghcr.io/stirling-tools/stirling-pdf-test
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
+            type=raw,value=latest-fat
+
+      - name: Build and push Unified Dockerfile (fat variant)
+        id: build-push-fat
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./docker/embedded/Dockerfile.fat
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.tags || steps.meta-fat-test.outputs.tags }}
+          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.labels || steps.meta-fat-test.outputs.labels }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Sign fat images
+        if: github.ref == 'refs/heads/V2-master'
+        env:
+          DIGEST: ${{ steps.build-push-fat.outputs.digest }}
+          TAGS: ${{ steps.meta-fat.outputs.tags }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: |
+          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
+            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
+          done
+
+      - name: Generate tags for ultra-lite (V2-master branch - production)
+        id: meta-lite
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        if: github.ref == 'refs/heads/V2-master'
+        with:
+          images: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
+            type=raw,value=latest-ultra-lite
+
+      - name: Generate tags for ultra-lite (V1_V2_merge branch - test)
+        id: meta-lite-test
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        if: github.ref == 'refs/heads/V1_V2_merge'
+        with:
+          images: |
+            ghcr.io/stirling-tools/stirling-pdf-test
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
+            type=raw,value=latest-ultra-lite
+
+      - name: Build and push Unified Dockerfile (ultra-lite variant)
+        id: build-push-lite
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./docker/embedded/Dockerfile.ultra-lite
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.tags || steps.meta-lite-test.outputs.tags }}
+          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.labels || steps.meta-lite-test.outputs.labels }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Sign ultra-lite images
+        if: github.ref == 'refs/heads/V2-master'
+        env:
+          DIGEST: ${{ steps.build-push-lite.outputs.digest }}
+          TAGS: ${{ steps.meta-lite.outputs.tags }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: |
+          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
+            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
+          done
@@ -6,8 +6,6 @@ on:
    branches:
      - master
      - main
-      - V2-master
-      - testMain

 # cancel in-progress jobs if a new job is triggered
 # This is useful to avoid running multiple builds for the same branch if a new commit is pushed
@@ -27,7 +25,7 @@ permissions:
 jobs:
  push:
    if: ${{ vars.CI_PROFILE != 'lite' }}
-    runs-on: ubuntu-24.04-8core
+    runs-on: ubuntu-latest
    permissions:
      packages: write
      id-token: write
@@ -49,6 +47,18 @@ jobs:
        with:
          gradle-version: 8.14

+      - name: Run Gradle Command
+        run: ./gradlew clean build
+        env:
+          DISABLE_ADDITIONAL_FEATURES: true
+          STIRLING_PDF_DESKTOP_UI: false
+
+      - name: Install cosign
+        if: github.ref == 'refs/heads/master'
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        with:
+          cosign-release: "v2.4.1"
+
      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
@@ -57,12 +67,6 @@ jobs:
        id: versionNumber
        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT

-      - name: Install cosign
-        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
-        with:
-          cosign-release: "v2.4.1"
-
      - name: Login to Docker Hub
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
@@ -83,9 +87,10 @@ jobs:
        id: repoowner
        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT

-      - name: Generate tags for latest
+      - name: Generate tags
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        if: github.ref != 'refs/heads/main'
        with:
          images: |
            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -93,13 +98,13 @@ jobs:
            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }},enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-            type=raw,value=alpha,enable=${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/testMain' }}
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }},enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}

-      - name: Build and push Unified Dockerfile (latest variant)
-        id: build-push-latest
+      - name: Build and push main Dockerfile
+        id: build-push-regular
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        if: github.ref != 'refs/heads/main'
        with:
          builder: ${{ steps.buildx.outputs.name }}
          context: .
@@ -115,9 +120,9 @@ jobs:
          sbom: true

      - name: Sign regular images
-        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
+        if: github.ref == 'refs/heads/master'
        env:
-          DIGEST: ${{ steps.build-push-latest.outputs.digest }}
+          DIGEST: ${{ steps.build-push-regular.outputs.digest }}
          TAGS: ${{ steps.meta.outputs.tags }}
          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
@@ -128,10 +133,10 @@ jobs:
              "${tag}@${DIGEST}"
          done

-      - name: Generate tags for latest-fat
-        id: meta-fat
+      - name: Generate tags ultra-lite
+        id: meta2
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
+        if: github.ref != 'refs/heads/main'
        with:
          images: |
            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -139,13 +144,43 @@ jobs:
            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-            type=raw,value=latest-fat,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite,enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=latest-ultra-lite,enable=${{ github.ref == 'refs/heads/master' }}

-      - name: Build and push Unified Dockerfile (fat variant)
+      - name: Build and push Dockerfile-ultra-lite
+        id: build-push-lite
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        if: github.ref != 'refs/heads/main'
+        with:
+          context: .
+          file: ./docker/embedded/Dockerfile.ultra-lite
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ steps.meta2.outputs.tags }}
+          labels: ${{ steps.meta2.outputs.labels }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Generate tags fat
+        id: meta3
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        with:
+          images: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat,enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=latest-fat,enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=alpha,enable=${{ github.ref == 'refs/heads/main' }}
+
+      - name: Build and push main Dockerfile fat
        id: build-push-fat
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
        with:
          builder: ${{ steps.buildx.outputs.name }}
          context: .
@@ -153,62 +188,18 @@ jobs:
          push: true
          cache-from: type=gha
          cache-to: type=gha,mode=max
-          tags: ${{ steps.meta-fat.outputs.tags }}
-          labels: ${{ steps.meta-fat.outputs.labels }}
+          tags: ${{ steps.meta3.outputs.tags }}
+          labels: ${{ steps.meta3.outputs.labels }}
          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
          platforms: linux/amd64,linux/arm64/v8
          provenance: true
          sbom: true

      - name: Sign fat images
-        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
+        if: github.ref == 'refs/heads/master'
        env:
          DIGEST: ${{ steps.build-push-fat.outputs.digest }}
-          TAGS: ${{ steps.meta-fat.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-          done
-
-      - name: Generate tags for ultra-lite
-        id: meta-lite
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-            type=raw,value=latest-ultra-lite,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-
-      - name: Build and push Unified Dockerfile (ultra-lite variant)
-        id: build-push-lite
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/embedded/Dockerfile.ultra-lite
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ steps.meta-lite.outputs.tags }}
-          labels: ${{ steps.meta-lite.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign ultra-lite images
-        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
-        env:
-          DIGEST: ${{ steps.build-push-lite.outputs.digest }}
-          TAGS: ${{ steps.meta-lite.outputs.tags }}
+          TAGS: ${{ steps.meta3.outputs.tags }}
          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
        run: |
@@ -23,18 +23,6 @@ on:
  push:
    branches: [main]

-# cancel in-progress jobs if a new job is triggered
-# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
-# or a pull request is updated.
-# It helps to save resources and time by ensuring that only the latest commit is built and tested
-# This is particularly useful for long-running jobs that may take a while to complete.
-# The `group` is set to a combination of the workflow name, event name, and branch name.
-# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
-# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref_name || github.ref }}
-  cancel-in-progress: true
-
 permissions:
  contents: read

@@ -45,11 +33,6 @@ jobs:
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
      - name: Determine build matrix
        id: set-matrix
        run: |
@@ -62,15 +45,15 @@ jobs:
                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
                ;;
              "linux")
-                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b appimage","name":"linux-x86_64-appimage"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b deb","name":"linux-x86_64-deb"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b rpm","name":"linux-x86_64-rpm"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
                ;;
              *)
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b appimage","name":"linux-x86_64-appimage"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b deb","name":"linux-x86_64-deb"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b rpm","name":"linux-x86_64-rpm"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
                ;;
            esac
          else
            # For PR/push events, build all platforms
-            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b appimage","name":"linux-x86_64-appimage"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b deb","name":"linux-x86_64-deb"},{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu -b rpm","name":"linux-x86_64-rpm"}]}' >> $GITHUB_OUTPUT
+            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
          fi

  build:
@@ -91,61 +74,11 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

-      - name: install dependencies (ubuntu only)
-        if: matrix.platform == 'ubuntu-22.04' && matrix.name != 'linux-x86_64-appimage'
+      - name: Install dependencies (ubuntu only)
+        if: matrix.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
-          # Dependencies explanation:
-          # - libwebkit2gtk-4.1-dev: WebKit engine for Tauri v2 (4.0 was for v1)
-          # - libappindicator3-dev: System tray support
-          # - librsvg2-dev: SVG rendering
-          # - patchelf: Required for AppImage packaging
-          # - libxdo-dev: Keyboard/mouse automation
-          # - libasound2-dev: Audio support
-          # - libopenblas-dev: GPU acceleration support
-          # - libx11-dev: X11 development files for window system interaction
-          # - libxtst-dev: X11 testing extensions for input simulation
-          # - libxrandr-dev: X11 RandR extension for display configuration
-          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libxdo-dev libasound2-dev libopenblas-dev libx11-dev libxtst-dev libxrandr-dev
-
-      - name: Install macOS DMG tooling
-        if: startsWith(matrix.platform, 'macos')
-        run: |
-          brew list create-dmg >/dev/null 2>&1 || brew install create-dmg
-
-      - name: Install dependencies (appimage only)
-        if: matrix.platform == 'ubuntu-22.04' && matrix.name == 'linux-x86_64-appimage'
-        run: |
-          sudo apt-get update
-
-          sudo apt-get install -y \
-            build-essential \
-            curl \
-            wget \
-            file \
-            libgtk-3-dev \
-            libxdo-dev \
-            libssl-dev \
-            libappindicator3-dev \
-            librsvg2-dev \
-            openjdk-17-jre-headless \
-            patchelf
-            
-          mkdir -p /tmp/ubuntu-packages
-          cd /tmp/ubuntu-packages
-          wget https://launchpadlibrarian.net/723972773/libwebkit2gtk-4.1-0_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download libwebkit2gtk-4.1-0"; exit 1; }
-          wget https://launchpadlibrarian.net/723972761/libwebkit2gtk-4.1-dev_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download libwebkit2gtk-4.1-dev"; exit 1; }
-          wget https://launchpadlibrarian.net/723972770/libjavascriptcoregtk-4.1-0_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download libjavascriptcoregtk-4.1-0"; exit 1; }
-          wget https://launchpadlibrarian.net/723972746/libjavascriptcoregtk-4.1-dev_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download libjavascriptcoregtk-4.1-dev"; exit 1; }
-          wget https://launchpadlibrarian.net/723972735/gir1.2-javascriptcoregtk-4.1_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download gir1.2-javascriptcoregtk-4.1"; exit 1; }
-          wget https://launchpadlibrarian.net/723972739/gir1.2-webkit2-4.1_2.44.0-0ubuntu0.22.04.1_amd64.deb || { echo "Failed to download gir1.2-webkit2-4.1"; exit 1; }
-          wget https://launchpadlibrarian.net/606433947/libicu70_70.1-2ubuntu1_amd64.deb || { echo "Failed to download libicu70"; exit 1; }
-          wget https://launchpadlibrarian.net/606433941/libicu-dev_70.1-2ubuntu1_amd64.deb || { echo "Failed to download libicu-dev"; exit 1; }
-          wget https://launchpadlibrarian.net/606433945/icu-devtools_70.1-2ubuntu1_amd64.deb || { echo "Failed to download icu-devtools"; exit 1; }
-          wget https://launchpadlibrarian.net/595623693/libjpeg8_8c-2ubuntu10_amd64.deb || { echo "Failed to download libjpeg8"; exit 1; }
-          wget https://launchpadlibrarian.net/587202140/libjpeg-turbo8_2.1.2-0ubuntu1_amd64.deb || { echo "Failed to download libjpeg-turbo8"; exit 1; }
-          wget https://launchpadlibrarian.net/592959859/xdg-desktop-portal-gtk_1.14.0-1build1_amd64.deb || { echo "Failed to download xdg-desktop-portal-gtk"; exit 1; }
-          sudo apt-get install -y /tmp/ubuntu-packages/*.deb
+          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev

      - name: Setup Node.js
        uses: actions/setup-node@v4
@@ -166,18 +99,6 @@ jobs:
          java-version: "21"
          distribution: "temurin"

-      - name: Make libjvm discoverable (appimage only)
-        if: matrix.platform == 'ubuntu-22.04' && matrix.name == 'linux-x86_64-appimage'
-        run: |
-          JAVA_LIBJVM="$JAVA_HOME/lib/server/libjvm.so"
-          if [ -f "$JAVA_LIBJVM" ]; then
-            sudo ln -sf "$JAVA_LIBJVM" /usr/lib/libjvm.so
-            echo "Linked libjvm from $JAVA_LIBJVM"
-          else
-            echo "libjvm not found at $JAVA_LIBJVM"
-            exit 1
-          fi
-
      - name: Build Java backend with JLink
        working-directory: ./
        shell: bash
@@ -253,7 +174,7 @@ jobs:

      - name: Install frontend dependencies
        working-directory: ./frontend
-        run: npm ci
+        run: npm install

      # DigiCert KeyLocker Setup (Cloud HSM)
      - name: Setup DigiCert KeyLocker
@@ -377,24 +298,6 @@ jobs:
          echo "Available tools:"
          ls -la /usr/bin/hd* || echo "No hd* tools found"

-      - name: Generate temporary GPG key for AppImage
-        if: matrix.platform == 'ubuntu-22.04' && matrix.name == 'linux-x86_64-appimage'
-        run: |
-          cat >keyparams <<EOF
-          %no-protection
-          Key-Type: RSA
-          Key-Length: 2048
-          Name-Real: CI AppImage Signer
-          Name-Email: ci-appimage@example.invalid
-          Expire-Date: 0
-          %commit
-          EOF
-          gpg --batch --generate-key keyparams
-          export GPG_FINGERPRINT=$(gpg --batch --with-colons --list-secret-keys | awk -F: '/^fpr:/ {print $10; exit}')
-          echo "GPG_FINGERPRINT=$GPG_FINGERPRINT" >> $GITHUB_ENV
-          echo "Generated temporary GPG key:"
-          gpg --list-secret-keys --keyid-format=long
-
      - name: Build Tauri app
        uses: tauri-apps/tauri-action@v0
        env:
@@ -405,33 +308,19 @@ jobs:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          # APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
+          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
-          # Enable Windows signing only when ALL of the following are true:
-          #   - The build is running on the Windows platform (matrix.platform == 'windows-latest')
-          #   - The build is triggered from the main branch (github.ref == 'refs/heads/main')
-          #   - The DigiCert KeyLocker HSM is NOT being used (env.SM_API_KEY == '')
-          #   - A Windows certificate is available (env.WINDOWS_CERTIFICATE != '')
-          # If all conditions are met, SIGN=1 (enable signing); otherwise, SIGN=0 (disable signing).
-          SIGN: ${{ (matrix.platform == 'windows-latest' && github.ref == 'refs/heads/main' && env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
+          # Only enable Windows signing in Tauri when on main
+          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
          CI: true
        with:
          projectPath: ./frontend
          tauriScript: npx tauri
          args: ${{ matrix.args }}

-      - name: Cleanup temporary GPG key
-        if: matrix.platform == 'ubuntu-22.04' && matrix.name == 'linux-x86_64-appimage'
-        run: |
-          if [ -n "${GPG_FINGERPRINT:-}" ]; then
-            gpg --batch --yes --delete-secret-keys "$GPG_FINGERPRINT" || true
-            gpg --batch --yes --delete-keys "$GPG_FINGERPRINT" || true
-          fi
-          rm -f keyparams
-
      # Sign with DigiCert KeyLocker (post-build)
      - name: Sign Windows binaries with DigiCert KeyLocker
        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
@@ -618,13 +507,10 @@ jobs:
            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
-            # find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
-          elif [ "${{ matrix.platform }}" = "ubuntu-22.04" ]; then
-            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.rpm" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.rpm" \;
-            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
+            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
          else
-            echo "Unknown platform: ${{ matrix.platform }}"
+            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
          fi

      - name: Verify Windows Code Signature
@@ -709,21 +595,18 @@ jobs:
            fi
          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
            echo "Checking for macOS artifacts..."
-            find . -name "*.dmg" | head -5
-            if [ $(find . -name "*.dmg" | wc -l) -eq 0 ]; then
+            find . -name "*.dmg" -o -name "*.app" | head -5
+            if [ $(find . -name "*.dmg" -o -name "*.app" | wc -l) -eq 0 ]; then
              echo "❌ No macOS artifacts found"
              exit 1
            fi
-          elif [ "${{ matrix.platform }}" = "ubuntu-22.04" ]; then
+          else
            echo "Checking for Linux artifacts..."
-            find . -name "*.deb" -o -name "*.AppImage" -o -name "*.rpm" | head -5
-            if [ $(find . -name "*.deb" -o -name "*.AppImage" -o -name "*.rpm" | wc -l) -eq 0 ]; then
+            find . -name "*.deb" -o -name "*.AppImage" | head -5
+            if [ $(find . -name "*.deb" -o -name "*.AppImage" | wc -l) -eq 0 ]; then
              echo "❌ No Linux artifacts found"
              exit 1
            fi
-          else
-            echo "Unknown platform: ${{ matrix.platform }}"
-            exit 1
          fi

          echo "✅ Build artifacts found for ${{ matrix.name }}"
@@ -733,7 +616,7 @@ jobs:
        run: |
          cd ./frontend/src-tauri/target
          echo "Artifact sizes for ${{ matrix.name }}:"
-          find . -name "*.exe" -o -name "*.dmg" -o -name "*.deb" -o -name "*.AppImage"  -o -name "*.rpm" -o -name "*.msi" | while read file; do
+          find . -name "*.exe" -o -name "*.dmg" -o -name "*.deb" -o -name "*.AppImage" -o -name "*.msi" | while read file; do
            if [ -f "$file" ]; then
              size=$(stat -c%s "$file" 2>/dev/null || stat -f%z "$file" 2>/dev/null || echo "unknown")
              echo "$file: $size bytes"
@@ -37,7 +37,6 @@ dependencies {
    api 'com.drewnoakes:metadata-extractor:2.19.0' // Image metadata extractor
    api 'com.vladsch.flexmark:flexmark-html2md-converter:0.64.8'
    api "org.apache.pdfbox:pdfbox:$pdfboxVersion"
-    api "org.apache.pdfbox:pdfbox-io:$pdfboxVersion"
    api "org.apache.pdfbox:xmpbox:$pdfboxVersion"
    api "org.apache.pdfbox:preflight:$pdfboxVersion"
    api 'com.github.junrar:junrar:7.5.7' // RAR archive support for CBR files
@@ -699,6 +699,7 @@ public class ApplicationProperties {
                private boolean enabled = true;
                private int level = 2; // 0=OFF, 1=BASIC, 2=STANDARD, 3=VERBOSE
                private int retentionDays = 90;
+                private boolean logIpAddresses = false; // Privacy: IP logging disabled by default
            }

            @Data
@@ -129,12 +129,7 @@ public class CbrUtils {
                                        new PDRectangle(pdImage.getWidth(), pdImage.getHeight()));
                        document.addPage(page);
                        try (PDPageContentStream contentStream =
-                                new PDPageContentStream(
-                                        document,
-                                        page,
-                                        PDPageContentStream.AppendMode.OVERWRITE,
-                                        true,
-                                        true)) {
+                                new PDPageContentStream(document, page)) {
                            contentStream.drawImage(pdImage, 0, 0);
                        }
                    } catch (IOException e) {
@@ -97,12 +97,7 @@ public class CbzUtils {
                                        new PDRectangle(pdImage.getWidth(), pdImage.getHeight()));
                        document.addPage(page);
                        try (PDPageContentStream contentStream =
-                                new PDPageContentStream(
-                                        document,
-                                        page,
-                                        PDPageContentStream.AppendMode.OVERWRITE,
-                                        true,
-                                        true)) {
+                                new PDPageContentStream(document, page)) {
                            contentStream.drawImage(pdImage, 0, 0);
                        }
                    } catch (IOException e) {
@@ -41,7 +41,7 @@ import lombok.extern.slf4j.Slf4j;
 * <pre>{@code
 * // In service layer - create exception with ExceptionUtils
 * try {
- *     PDDocument doc = Loader.loadPDF(file);
+ *     PDDocument doc = PDDocument.load(file);
 * } catch (IOException e) {
 *     throw ExceptionUtils.createPdfCorruptedException("during load", e);
 * }
@@ -60,7 +60,6 @@ public class PdfToCbrUtils {

    private static byte[] createCbrFromPdf(PDDocument document, int dpi) throws IOException {
        PDFRenderer pdfRenderer = new PDFRenderer(document);
-        pdfRenderer.setSubsamplingAllowed(true); // Enable subsampling to reduce memory usage

        Path tempDir = Files.createTempDirectory("stirling-pdf-cbr-");
        List<Path> generatedImages = new ArrayList<>();
@@ -55,7 +55,6 @@ public class PdfToCbzUtils {

    private static byte[] createCbzFromPdf(PDDocument document, int dpi) throws IOException {
        PDFRenderer pdfRenderer = new PDFRenderer(document);
-        pdfRenderer.setSubsamplingAllowed(true); // Enable subsampling to reduce memory usage

        try (ByteArrayOutputStream cbzOutputStream = new ByteArrayOutputStream();
                ZipOutputStream zipOut = new ZipOutputStream(cbzOutputStream)) {
@@ -119,11 +119,11 @@ public class PdfUtils {

    public boolean hasTextOnPage(PDPage page, String phrase) throws IOException {
        PDFTextStripper textStripper = new PDFTextStripper();
-        try (PDDocument tempDoc = new PDDocument()) {
-            tempDoc.addPage(page);
-            String pageText = textStripper.getText(tempDoc);
-            return pageText.contains(phrase);
-        }
+        PDDocument tempDoc = new PDDocument();
+        tempDoc.addPage(page);
+        String pageText = textStripper.getText(tempDoc);
+        tempDoc.close();
+        return pageText.contains(phrase);
    }

    public byte[] convertFromPdf(
@@ -153,8 +153,7 @@ public class PdfUtils {
                    maxSafeDpi);
        }

-        try (PDDocument document = pdfDocumentFactory.load(inputStream);
-                ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
+        try (PDDocument document = pdfDocumentFactory.load(inputStream)) {
            PDFRenderer pdfRenderer = new PDFRenderer(document);
            pdfRenderer.setSubsamplingAllowed(true);
            if (!includeAnnotations) {
@@ -162,6 +161,9 @@ public class PdfUtils {
            }
            int pageCount = document.getNumberOfPages();

+            // Create a ByteArrayOutputStream to save the image(s) to
+            ByteArrayOutputStream baos = new ByteArrayOutputStream();
+
            if (singleImage) {
                if ("tiff".equals(imageType.toLowerCase(Locale.ROOT))
                        || "tif".equals(imageType.toLowerCase(Locale.ROOT))) {
@@ -398,61 +400,55 @@ public class PdfUtils {
     */
    public PDDocument convertPdfToPdfImage(PDDocument document) throws IOException {
        PDDocument imageDocument = new PDDocument();
-        try {
-            PDFRenderer pdfRenderer = new PDFRenderer(document);
-            pdfRenderer.setSubsamplingAllowed(true);
-            for (int page = 0; page < document.getNumberOfPages(); ++page) {
-                final int pageIndex = page;
-                BufferedImage bim;
+        PDFRenderer pdfRenderer = new PDFRenderer(document);
+        pdfRenderer.setSubsamplingAllowed(true);
+        for (int page = 0; page < document.getNumberOfPages(); ++page) {
+            final int pageIndex = page;
+            BufferedImage bim;

-                // Use global maximum DPI setting, fallback to 300 if not set
-                int renderDpi = 300; // Default fallback
-                ApplicationProperties properties =
-                        ApplicationContextProvider.getBean(ApplicationProperties.class);
-                if (properties != null && properties.getSystem() != null) {
-                    renderDpi = properties.getSystem().getMaxDPI();
-                }
-                final int dpi = renderDpi;
-
-                try {
-                    bim =
-                            ExceptionUtils.handleOomRendering(
-                                    pageIndex + 1,
-                                    dpi,
-                                    () ->
-                                            pdfRenderer.renderImageWithDPI(
-                                                    pageIndex, dpi, ImageType.RGB));
-                } catch (IllegalArgumentException e) {
-                    if (e.getMessage() != null
-                            && e.getMessage().contains("Maximum size of image exceeded")) {
-                        throw ExceptionUtils.createIllegalArgumentException(
-                                "error.pageTooBigFor300Dpi",
-                                "PDF page {0} is too large to render at 300 DPI. The resulting image"
-                                        + " would exceed Java's maximum array size. Please use a lower DPI"
-                                        + " value for PDF-to-image conversion.",
-                                pageIndex + 1);
-                    }
-                    throw e;
-                }
-                PDPage originalPage = document.getPage(page);
-
-                float width = originalPage.getMediaBox().getWidth();
-                float height = originalPage.getMediaBox().getHeight();
-
-                PDPage newPage = new PDPage(new PDRectangle(width, height));
-                imageDocument.addPage(newPage);
-                PDImageXObject pdImage = LosslessFactory.createFromImage(imageDocument, bim);
-                try (PDPageContentStream contentStream =
-                        new PDPageContentStream(
-                                imageDocument, newPage, AppendMode.APPEND, true, true)) {
-                    contentStream.drawImage(pdImage, 0, 0, width, height);
-                }
-                bim.flush();
+            // Use global maximum DPI setting, fallback to 300 if not set
+            int renderDpi = 300; // Default fallback
+            ApplicationProperties properties =
+                    ApplicationContextProvider.getBean(ApplicationProperties.class);
+            if (properties != null && properties.getSystem() != null) {
+                renderDpi = properties.getSystem().getMaxDPI();
            }
-            return imageDocument;
-        } catch (Exception e) {
-            throw e;
+            final int dpi = renderDpi;
+
+            try {
+                bim =
+                        ExceptionUtils.handleOomRendering(
+                                pageIndex + 1,
+                                dpi,
+                                () ->
+                                        pdfRenderer.renderImageWithDPI(
+                                                pageIndex, dpi, ImageType.RGB));
+            } catch (IllegalArgumentException e) {
+                if (e.getMessage() != null
+                        && e.getMessage().contains("Maximum size of image exceeded")) {
+                    throw ExceptionUtils.createIllegalArgumentException(
+                            "error.pageTooBigFor300Dpi",
+                            "PDF page {0} is too large to render at 300 DPI. The resulting image"
+                                    + " would exceed Java's maximum array size. Please use a lower DPI"
+                                    + " value for PDF-to-image conversion.",
+                            pageIndex + 1);
+                }
+                throw e;
+            }
+            PDPage originalPage = document.getPage(page);
+
+            float width = originalPage.getMediaBox().getWidth();
+            float height = originalPage.getMediaBox().getHeight();
+
+            PDPage newPage = new PDPage(new PDRectangle(width, height));
+            imageDocument.addPage(newPage);
+            PDImageXObject pdImage = LosslessFactory.createFromImage(imageDocument, bim);
+            PDPageContentStream contentStream =
+                    new PDPageContentStream(imageDocument, newPage, AppendMode.APPEND, true, true);
+            contentStream.drawImage(pdImage, 0, 0, width, height);
+            contentStream.close();
        }
+        return imageDocument;
    }

    private BufferedImage prepareImageForPdfToImage(int maxWidth, int height, String imageType) {
@@ -69,6 +69,7 @@ public class WebResponseUtils {
        // Open Byte Array and save document to it
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        document.save(baos);
+        document.close();

        return baosToWebResponse(baos, docName);
    }
@@ -146,18 +146,13 @@ public class CustomColorReplaceStrategy extends ReplaceAndInvertColorStrategy {
            // Save the modified PDF to a ByteArrayOutputStream
            ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
            document.save(byteArrayOutputStream);
+            document.close();

            // Prepare the modified PDF for download
            ByteArrayInputStream inputStream =
                    new ByteArrayInputStream(byteArrayOutputStream.toByteArray());
            InputStreamResource resource = new InputStreamResource(inputStream);
            return resource;
-        } finally {
-            try {
-                Files.deleteIfExists(file.toPath());
-            } catch (IOException e) {
-                log.warn("Failed to delete temporary file: {}", file.getAbsolutePath(), e);
-            }
        }
    }

@@ -7,7 +7,6 @@ import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
 import java.nio.file.Files;
-import java.nio.file.Path;

 import javax.imageio.ImageIO;

@@ -20,14 +19,11 @@ import org.apache.pdfbox.rendering.PDFRenderer;
 import org.springframework.core.io.InputStreamResource;
 import org.springframework.web.multipart.MultipartFile;

-import lombok.extern.slf4j.Slf4j;
-
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.api.misc.ReplaceAndInvert;
 import stirling.software.common.util.ApplicationContextProvider;
 import stirling.software.common.util.ExceptionUtils;

-@Slf4j
 public class InvertFullColorStrategy extends ReplaceAndInvertColorStrategy {

    public InvertFullColorStrategy(MultipartFile file, ReplaceAndInvert replaceAndInvert) {
@@ -47,8 +43,6 @@ public class InvertFullColorStrategy extends ReplaceAndInvertColorStrategy {
            try (PDDocument document = Loader.loadPDF(tempFile.getFile())) {
                // Render each page and invert colors
                PDFRenderer pdfRenderer = new PDFRenderer(document);
-                pdfRenderer.setSubsamplingAllowed(
-                        true); // Enable subsampling to reduce memory usage
                for (int page = 0; page < document.getNumberOfPages(); page++) {
                    BufferedImage image;

@@ -79,27 +73,12 @@ public class InvertFullColorStrategy extends ReplaceAndInvertColorStrategy {
                        PDImageXObject pdImage =
                                PDImageXObject.createFromFileByContent(tempImageFile, document);

-                        // Delete temp file immediately after loading into memory to prevent disk
-                        // exhaustion
-                        // The file content is now in the PDImageXObject, so the file is no longer
-                        // needed
-                        try {
-                            Files.deleteIfExists(tempImageFile.toPath());
-                            tempImageFile = null; // Mark as deleted to avoid double deletion
-                        } catch (IOException e) {
-                            log.warn(
-                                    "Failed to delete temporary image file: {}",
-                                    tempImageFile.getAbsolutePath(),
-                                    e);
-                        }
-
                        try (PDPageContentStream contentStream =
                                new PDPageContentStream(
                                        document,
                                        pdPage,
                                        PDPageContentStream.AppendMode.OVERWRITE,
-                                        true,
-                                        true)) { // resetContext=true ensures clean graphics state
+                                        true)) {
                            contentStream.drawImage(
                                    pdImage,
                                    0,
@@ -108,16 +87,8 @@ public class InvertFullColorStrategy extends ReplaceAndInvertColorStrategy {
                                    pdPage.getMediaBox().getHeight());
                        }
                    } finally {
-                        // Safety net: ensure temp file is deleted even if an exception occurred
                        if (tempImageFile != null && tempImageFile.exists()) {
-                            try {
-                                Files.deleteIfExists(tempImageFile.toPath());
-                            } catch (IOException e) {
-                                log.warn(
-                                        "Failed to delete temporary image file: {}",
-                                        tempImageFile.getAbsolutePath(),
-                                        e);
-                            }
+                            Files.delete(tempImageFile.toPath());
                        }
                    }
                }
@@ -157,10 +128,7 @@ public class InvertFullColorStrategy extends ReplaceAndInvertColorStrategy {

    // Helper method to convert BufferedImage to InputStream
    private File convertToBufferedImageTpFile(BufferedImage image) throws IOException {
-        // Use Files.createTempFile instead of File.createTempFile for better security and modern
-        // Java practices
-        Path tempPath = Files.createTempFile("image", ".png");
-        File file = tempPath.toFile();
+        File file = File.createTempFile("image", ".png");
        ImageIO.write(image, "png", file);
        return file;
    }
@@ -92,7 +92,8 @@ public class WebResponseUtilsTest {

    @Test
    public void testPdfDocToWebResponse() {
-        try (PDDocument document = new PDDocument()) {
+        try {
+            PDDocument document = new PDDocument();
            document.addPage(new org.apache.pdfbox.pdmodel.PDPage());
            String docName = "sample.pdf";

@@ -141,10 +141,10 @@ public class SPDFApplication {
        String backendUrl = appConfig.getBackendUrl();
        String contextPath = appConfig.getContextPath();
        String serverPort = appConfig.getServerPort();
-        baseUrlStatic = normalizeBackendUrl(backendUrl, serverPort);
+        baseUrlStatic = backendUrl;
        contextPathStatic = contextPath;
        serverPortStatic = serverPort;
-        String url = buildFullUrl(baseUrlStatic, getStaticPort(), contextPathStatic);
+        String url = backendUrl + ":" + getStaticPort() + contextPath;

        // Log Tauri mode information
        if (Boolean.parseBoolean(System.getProperty("STIRLING_PDF_TAURI_MODE", "false"))) {
@@ -210,7 +210,7 @@ public class SPDFApplication {

    private static void printStartupLogs() {
        log.info("Stirling-PDF Started.");
-        String url = buildFullUrl(baseUrlStatic, getStaticPort(), contextPathStatic);
+        String url = baseUrlStatic + ":" + getStaticPort() + contextPathStatic;
        log.info("Navigate to {}", url);
    }

@@ -258,79 +258,4 @@ public class SPDFApplication {
    public static String getStaticContextPath() {
        return contextPathStatic;
    }
-
-    private static String buildFullUrl(String backendUrl, String port, String contextPath) {
-        String normalizedBase = normalizeBackendUrl(backendUrl, port);
-
-        String normalizedContextPath =
-                (contextPath == null || contextPath.isBlank() || "/".equals(contextPath))
-                        ? "/"
-                        : (contextPath.startsWith("/") ? contextPath : "/" + contextPath);
-
-        return normalizedBase + normalizedContextPath;
-    }
-
-    private static String normalizeBackendUrl(String backendUrl, String port) {
-        String trimmedBase =
-                (backendUrl == null || backendUrl.isBlank())
-                        ? "http://localhost"
-                        : backendUrl.trim().replaceAll("/+$", "");
-        boolean hasScheme = trimmedBase.matches("^[a-zA-Z][a-zA-Z0-9+.-]*://.*");
-        String baseForParsing = hasScheme ? trimmedBase : "http://" + trimmedBase;
-        Integer parsedPort = parsePort(port);
-
-        try {
-            java.net.URI uri = new java.net.URI(baseForParsing);
-            String scheme = uri.getScheme() == null ? "http" : uri.getScheme();
-            String host = uri.getHost();
-            if (host == null) {
-                return appendPortFallback(trimmedBase, parsedPort);
-            }
-
-            boolean defaultHttp =
-                    "http".equalsIgnoreCase(scheme) && Integer.valueOf(80).equals(parsedPort);
-            boolean defaultHttps =
-                    "https".equalsIgnoreCase(scheme) && Integer.valueOf(443).equals(parsedPort);
-
-            int effectivePort = uri.getPort();
-            if (effectivePort == -1 && parsedPort != null && !defaultHttp && !defaultHttps) {
-                effectivePort = parsedPort;
-            }
-
-            java.net.URI rebuilt =
-                    new java.net.URI(
-                            scheme,
-                            uri.getUserInfo(),
-                            host,
-                            effectivePort,
-                            uri.getPath(),
-                            uri.getQuery(),
-                            uri.getFragment());
-            return rebuilt.toString();
-        } catch (java.net.URISyntaxException e) {
-            return appendPortFallback(trimmedBase, parsedPort);
-        }
-    }
-
-    private static Integer parsePort(String port) {
-        if (port == null || port.isBlank()) {
-            return null;
-        }
-        try {
-            int parsed = Integer.parseInt(port);
-            return parsed > 0 ? parsed : null;
-        } catch (NumberFormatException e) {
-            return null;
-        }
-    }
-
-    private static String appendPortFallback(String trimmedBase, Integer port) {
-        if (port == null) {
-            return trimmedBase;
-        }
-        if (trimmedBase.matches(".+:\\d+$")) {
-            return trimmedBase;
-        }
-        return trimmedBase + ":" + port;
-    }
 }
@@ -29,7 +29,6 @@ import lombok.RequiredArgsConstructor;
 import stirling.software.SPDF.model.api.general.BookletImpositionRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.service.CustomPDFDocumentFactory;
-import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.WebResponseUtils;

@RestController
@@ -69,33 +68,33 @@ public class BookletImpositionController {
                    "Booklet printing uses 2 pages per side (landscape). For 4-up, use the N-up feature.");
        }

-        try (PDDocument sourceDocument = pdfDocumentFactory.load(file)) {
-            int totalPages = sourceDocument.getNumberOfPages();
+        PDDocument sourceDocument = pdfDocumentFactory.load(file);
+        int totalPages = sourceDocument.getNumberOfPages();

-            // Create proper booklet with signature-based page ordering
-            try (PDDocument newDocument =
-                    createSaddleBooklet(
-                            sourceDocument,
-                            totalPages,
-                            addBorder,
-                            spineLocation,
-                            addGutter,
-                            gutterSize,
-                            doubleSided,
-                            duplexPass,
-                            flipOnShortEdge)) {
+        // Create proper booklet with signature-based page ordering
+        PDDocument newDocument =
+                createSaddleBooklet(
+                        sourceDocument,
+                        totalPages,
+                        addBorder,
+                        spineLocation,
+                        addGutter,
+                        gutterSize,
+                        doubleSided,
+                        duplexPass,
+                        flipOnShortEdge);

-                ByteArrayOutputStream baos = new ByteArrayOutputStream();
-                newDocument.save(baos);
+        sourceDocument.close();

-                byte[] result = baos.toByteArray();
-                return WebResponseUtils.bytesToWebResponse(
-                        result,
-                        GeneralUtils.generateFilename(
-                                Filenames.toSimpleFileName(file.getOriginalFilename()),
-                                "_booklet.pdf"));
-            }
-        }
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        newDocument.save(baos);
+        newDocument.close();
+
+        byte[] result = baos.toByteArray();
+        return WebResponseUtils.bytesToWebResponse(
+                result,
+                Filenames.toSimpleFileName(file.getOriginalFilename()).replaceFirst("[.][^.]+$", "")
+                        + "_booklet.pdf");
    }

    private static int padToMultipleOf4(int n) {
@@ -155,7 +155,6 @@ public class CropController {
            try (PDDocument newDocument =
                    pdfDocumentFactory.createNewDocumentBasedOnOldDocument(sourceDocument)) {
                PDFRenderer renderer = new PDFRenderer(sourceDocument);
-                renderer.setSubsamplingAllowed(true); // Enable subsampling to reduce memory usage
                LayerUtility layerUtility = new LayerUtility(newDocument);

                for (int i = 0; i < sourceDocument.getNumberOfPages(); i++) {
@@ -3,7 +3,6 @@ package stirling.software.SPDF.controller.api;
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
-import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Comparator;
@@ -28,6 +27,7 @@ import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;

 import io.swagger.v3.oas.annotations.Operation;

@@ -277,7 +277,7 @@ public class MergeController {
                    "This endpoint merges multiple PDF files into a single PDF file. The merged"
                            + " file will contain all pages from the input files in the order they were"
                            + " provided. Input:PDF Output:PDF Type:MISO")
-    public ResponseEntity<byte[]> mergePdfs(
+    public ResponseEntity<StreamingResponseBody> mergePdfs(
            @ModelAttribute MergePdfsRequest request,
            @RequestParam(value = "fileOrder", required = false) String fileOrder)
            throws IOException {
@@ -304,6 +304,8 @@ public class MergeController {
                            request.getSortType())); // Sort files based on requested sort type
        }

+        ResponseEntity<StreamingResponseBody> response;
+
        try (TempFile mt = new TempFile(tempFileManager, ".pdf")) {

            PDFMergerUtility mergerUtility = new PDFMergerUtility();
@@ -397,7 +399,7 @@ public class MergeController {
        String mergedFileName =
                GeneralUtils.generateFilename(firstFilename, "_merged_unsigned.pdf");

-        byte[] pdfBytes = Files.readAllBytes(outputTempFile.getPath());
-        return WebResponseUtils.bytesToWebResponse(pdfBytes, mergedFileName);
+        response = WebResponseUtils.pdfFileToWebResponse(outputTempFile, mergedFileName);
+        return response;
    }
 }
@@ -70,109 +70,108 @@ public class MultiPageLayoutController {
                        : (int) Math.sqrt(pagesPerSheet);
        int rows = pagesPerSheet == 2 || pagesPerSheet == 3 ? 1 : (int) Math.sqrt(pagesPerSheet);

-        try (PDDocument sourceDocument = pdfDocumentFactory.load(file)) {
-            try (PDDocument newDocument =
-                    pdfDocumentFactory.createNewDocumentBasedOnOldDocument(sourceDocument)) {
-                int totalPages = sourceDocument.getNumberOfPages();
-                LayerUtility layerUtility = new LayerUtility(newDocument);
+        PDDocument sourceDocument = pdfDocumentFactory.load(file);
+        PDDocument newDocument =
+                pdfDocumentFactory.createNewDocumentBasedOnOldDocument(sourceDocument);
+        PDPage newPage = new PDPage(PDRectangle.A4);
+        newDocument.addPage(newPage);

-                // Calculate cell dimensions once (all output pages are A4) - declare outside try
-                // blocks
-                float cellWidth = PDRectangle.A4.getWidth() / cols;
-                float cellHeight = PDRectangle.A4.getHeight() / rows;
+        int totalPages = sourceDocument.getNumberOfPages();
+        float cellWidth = newPage.getMediaBox().getWidth() / cols;
+        float cellHeight = newPage.getMediaBox().getHeight() / rows;

-                // Process pages in groups of pagesPerSheet, creating a new page and content stream
-                // for each group
-                for (int i = 0; i < totalPages; i += pagesPerSheet) {
-                    // Create a new output page for each group of pagesPerSheet
-                    PDPage newPage = new PDPage(PDRectangle.A4);
-                    newDocument.addPage(newPage);
+        PDPageContentStream contentStream =
+                new PDPageContentStream(
+                        newDocument, newPage, PDPageContentStream.AppendMode.APPEND, true, true);
+        LayerUtility layerUtility = new LayerUtility(newDocument);

-                    // Use try-with-resources for each content stream to ensure proper cleanup
-                    // resetContext=true: Start with a clean graphics state for new content
-                    try (PDPageContentStream contentStream =
-                            new PDPageContentStream(
-                                    newDocument,
-                                    newPage,
-                                    PDPageContentStream.AppendMode.APPEND,
-                                    true,
-                                    true)) {
-                        float borderThickness = 1.5f; // Specify border thickness as required
-                        contentStream.setLineWidth(borderThickness);
-                        contentStream.setStrokingColor(Color.BLACK);
+        float borderThickness = 1.5f; // Specify border thickness as required
+        contentStream.setLineWidth(borderThickness);
+        contentStream.setStrokingColor(Color.BLACK);

-                        // Process all pages in this group
-                        for (int j = 0; j < pagesPerSheet && (i + j) < totalPages; j++) {
-                            int pageIndex = i + j;
-                            PDPage sourcePage = sourceDocument.getPage(pageIndex);
-                            PDRectangle rect = sourcePage.getMediaBox();
-                            float scaleWidth = cellWidth / rect.getWidth();
-                            float scaleHeight = cellHeight / rect.getHeight();
-                            float scale = Math.min(scaleWidth, scaleHeight);
-
-                            int adjustedPageIndex = j % pagesPerSheet;
-                            int rowIndex = adjustedPageIndex / cols;
-                            int colIndex = adjustedPageIndex % cols;
-
-                            float x =
-                                    colIndex * cellWidth
-                                            + (cellWidth - rect.getWidth() * scale) / 2;
-                            float y =
-                                    newPage.getMediaBox().getHeight()
-                                            - ((rowIndex + 1) * cellHeight
-                                                    - (cellHeight - rect.getHeight() * scale) / 2);
-
-                            contentStream.saveGraphicsState();
-                            contentStream.transform(Matrix.getTranslateInstance(x, y));
-                            contentStream.transform(Matrix.getScaleInstance(scale, scale));
-
-                            PDFormXObject formXObject =
-                                    layerUtility.importPageAsForm(sourceDocument, pageIndex);
-                            contentStream.drawForm(formXObject);
-
-                            contentStream.restoreGraphicsState();
-
-                            if (addBorder) {
-                                // Draw border around each page
-                                float borderX = colIndex * cellWidth;
-                                float borderY =
-                                        newPage.getMediaBox().getHeight()
-                                                - (rowIndex + 1) * cellHeight;
-                                contentStream.addRect(borderX, borderY, cellWidth, cellHeight);
-                                contentStream.stroke();
-                            }
-                        }
-                    } // contentStream is automatically closed here
-                }
-
-                // If any source page is rotated, skip form copying/transformation entirely
-                boolean hasRotation = GeneralFormCopyUtils.hasAnyRotatedPage(sourceDocument);
-                if (hasRotation) {
-                    log.info("Source document has rotated pages; skipping form field copying.");
-                } else {
-                    try {
-                        GeneralFormCopyUtils.copyAndTransformFormFields(
-                                sourceDocument,
+        for (int i = 0; i < totalPages; i++) {
+            if (i != 0 && i % pagesPerSheet == 0) {
+                // Close the current content stream and create a new page and content stream
+                contentStream.close();
+                newPage = new PDPage(PDRectangle.A4);
+                newDocument.addPage(newPage);
+                contentStream =
+                        new PDPageContentStream(
                                newDocument,
-                                totalPages,
-                                pagesPerSheet,
-                                cols,
-                                rows,
-                                cellWidth,
-                                cellHeight);
-                    } catch (Exception e) {
-                        log.warn("Failed to copy and transform form fields: {}", e.getMessage(), e);
-                    }
-                }
+                                newPage,
+                                PDPageContentStream.AppendMode.APPEND,
+                                true,
+                                true);
+            }

-                ByteArrayOutputStream baos = new ByteArrayOutputStream();
-                newDocument.save(baos);
-                byte[] result = baos.toByteArray();
-                return WebResponseUtils.bytesToWebResponse(
-                        result,
-                        GeneralUtils.generateFilename(
-                                file.getOriginalFilename(), "_multi_page_layout.pdf"));
-            } // newDocument is closed here
-        } // sourceDocument is closed here
+            PDPage sourcePage = sourceDocument.getPage(i);
+            PDRectangle rect = sourcePage.getMediaBox();
+            float scaleWidth = cellWidth / rect.getWidth();
+            float scaleHeight = cellHeight / rect.getHeight();
+            float scale = Math.min(scaleWidth, scaleHeight);
+
+            int adjustedPageIndex =
+                    i % pagesPerSheet; // Close the current content stream and create a new
+            // page and content stream
+            int rowIndex = adjustedPageIndex / cols;
+            int colIndex = adjustedPageIndex % cols;
+
+            float x = colIndex * cellWidth + (cellWidth - rect.getWidth() * scale) / 2;
+            float y =
+                    newPage.getMediaBox().getHeight()
+                            - ((rowIndex + 1) * cellHeight
+                                    - (cellHeight - rect.getHeight() * scale) / 2);
+
+            contentStream.saveGraphicsState();
+            contentStream.transform(Matrix.getTranslateInstance(x, y));
+            contentStream.transform(Matrix.getScaleInstance(scale, scale));
+
+            PDFormXObject formXObject = layerUtility.importPageAsForm(sourceDocument, i);
+            contentStream.drawForm(formXObject);
+
+            contentStream.restoreGraphicsState();
+
+            if (addBorder) {
+                // Draw border around each page
+                float borderX = colIndex * cellWidth;
+                float borderY = newPage.getMediaBox().getHeight() - (rowIndex + 1) * cellHeight;
+                contentStream.addRect(borderX, borderY, cellWidth, cellHeight);
+                contentStream.stroke();
+            }
+        }
+
+        contentStream.close();
+
+        // If any source page is rotated, skip form copying/transformation entirely
+        boolean hasRotation = GeneralFormCopyUtils.hasAnyRotatedPage(sourceDocument);
+        if (hasRotation) {
+            log.info("Source document has rotated pages; skipping form field copying.");
+        } else {
+            try {
+                GeneralFormCopyUtils.copyAndTransformFormFields(
+                        sourceDocument,
+                        newDocument,
+                        totalPages,
+                        pagesPerSheet,
+                        cols,
+                        rows,
+                        cellWidth,
+                        cellHeight);
+            } catch (Exception e) {
+                log.warn("Failed to copy and transform form fields: {}", e.getMessage(), e);
+            }
+        }
+
+        sourceDocument.close();
+
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        newDocument.save(baos);
+        newDocument.close();
+
+        byte[] result = baos.toByteArray();
+        return WebResponseUtils.bytesToWebResponse(
+                result,
+                GeneralUtils.generateFilename(
+                        file.getOriginalFilename(), "_multi_page_layout.pdf"));
    }
 }
@@ -53,28 +53,25 @@ public class PdfImageRemovalController {
                    "This endpoint remove images from file to reduce the file size.Input:PDF"
                            + " Output:PDF Type:SISO")
    public ResponseEntity<byte[]> removeImages(@ModelAttribute PDFFile file) throws IOException {
-        // Load the PDF document with proper resource management
-        try (PDDocument document = pdfDocumentFactory.load(file)) {
+        // Load the PDF document
+        PDDocument document = pdfDocumentFactory.load(file);

-            // Remove images from the PDF document using the service
-            try (PDDocument modifiedDocument =
-                    pdfImageRemovalService.removeImagesFromPdf(document)) {
+        // Remove images from the PDF document using the service
+        PDDocument modifiedDocument = pdfImageRemovalService.removeImagesFromPdf(document);

-                // Create a ByteArrayOutputStream to hold the modified PDF data
-                ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
+        // Create a ByteArrayOutputStream to hold the modified PDF data
+        ByteArrayOutputStream outputStream = new ByteArrayOutputStream();

-                // Save the modified PDF document to the output stream
-                modifiedDocument.save(outputStream);
+        // Save the modified PDF document to the output stream
+        modifiedDocument.save(outputStream);
+        modifiedDocument.close();

-                // Generate a new filename for the modified PDF
-                String mergedFileName =
-                        GeneralUtils.generateFilename(
-                                file.getFileInput().getOriginalFilename(), "_images_removed.pdf");
+        // Generate a new filename for the modified PDF
+        String mergedFileName =
+                GeneralUtils.generateFilename(
+                        file.getFileInput().getOriginalFilename(), "_images_removed.pdf");

-                // Convert the byte array to a web response and return it
-                return WebResponseUtils.bytesToWebResponse(
-                        outputStream.toByteArray(), mergedFileName);
-            }
-        }
+        // Convert the byte array to a web response and return it
+        return WebResponseUtils.bytesToWebResponse(outputStream.toByteArray(), mergedFileName);
    }
 }
@@ -50,25 +50,23 @@ public class RearrangePagesPDFController {
        MultipartFile pdfFile = request.getFileInput();
        String pagesToDelete = request.getPageNumbers();

-        try (PDDocument document = pdfDocumentFactory.load(pdfFile)) {
+        PDDocument document = pdfDocumentFactory.load(pdfFile);

-            // Split the page order string into an array of page numbers or range of numbers
-            String[] pageOrderArr = pagesToDelete.split(",");
+        // Split the page order string into an array of page numbers or range of numbers
+        String[] pageOrderArr = pagesToDelete.split(",");

-            List<Integer> pagesToRemove =
-                    GeneralUtils.parsePageList(pageOrderArr, document.getNumberOfPages(), false);
+        List<Integer> pagesToRemove =
+                GeneralUtils.parsePageList(pageOrderArr, document.getNumberOfPages(), false);

-            Collections.sort(pagesToRemove);
+        Collections.sort(pagesToRemove);

-            for (int i = pagesToRemove.size() - 1; i >= 0; i--) {
-                int pageIndex = pagesToRemove.get(i);
-                document.removePage(pageIndex);
-            }
-            return WebResponseUtils.pdfDocToWebResponse(
-                    document,
-                    GeneralUtils.generateFilename(
-                            pdfFile.getOriginalFilename(), "_removed_pages.pdf"));
+        for (int i = pagesToRemove.size() - 1; i >= 0; i--) {
+            int pageIndex = pagesToRemove.get(i);
+            document.removePage(pageIndex);
        }
+        return WebResponseUtils.pdfDocToWebResponse(
+                document,
+                GeneralUtils.generateFilename(pdfFile.getOriginalFilename(), "_removed_pages.pdf"));
    }

    private List<Integer> removeFirst(int totalPages) {
@@ -245,43 +243,41 @@ public class RearrangePagesPDFController {
        String pageOrder = request.getPageNumbers();
        String sortType = request.getCustomMode();
        try {
-            // Load the input PDF with proper resource management
-            try (PDDocument document = pdfDocumentFactory.load(pdfFile)) {
+            // Load the input PDF
+            PDDocument document = pdfDocumentFactory.load(pdfFile);

-                // Split the page order string into an array of page numbers or range of numbers
-                String[] pageOrderArr = pageOrder != null ? pageOrder.split(",") : new String[0];
-                int totalPages = document.getNumberOfPages();
-                List<Integer> newPageOrder;
-                if (sortType != null
-                        && !sortType.isEmpty()
-                        && !"custom".equals(sortType.toLowerCase(Locale.ROOT))) {
-                    newPageOrder = processSortTypes(sortType, totalPages, pageOrder);
-                } else {
-                    newPageOrder = GeneralUtils.parsePageList(pageOrderArr, totalPages, false);
-                }
-                log.info("newPageOrder = {}", newPageOrder);
-                log.info("totalPages = {}", totalPages);
-                // Create a new list to hold the pages in the new order
-                List<PDPage> newPages = new ArrayList<>();
-                for (int i = 0; i < newPageOrder.size(); i++) {
-                    newPages.add(document.getPage(newPageOrder.get(i)));
-                }
-
-                // Create a new document based on the original one
-                try (PDDocument rearrangedDocument =
-                        pdfDocumentFactory.createNewDocumentBasedOnOldDocument(document)) {
-
-                    // Add the pages in the new order
-                    for (PDPage page : newPages) {
-                        rearrangedDocument.addPage(page);
-                    }
-
-                    return WebResponseUtils.pdfDocToWebResponse(
-                            rearrangedDocument,
-                            GeneralUtils.generateFilename(
-                                    pdfFile.getOriginalFilename(), "_rearranged.pdf"));
-                }
+            // Split the page order string into an array of page numbers or range of numbers
+            String[] pageOrderArr = pageOrder != null ? pageOrder.split(",") : new String[0];
+            int totalPages = document.getNumberOfPages();
+            List<Integer> newPageOrder;
+            if (sortType != null
+                    && !sortType.isEmpty()
+                    && !"custom".equals(sortType.toLowerCase(Locale.ROOT))) {
+                newPageOrder = processSortTypes(sortType, totalPages, pageOrder);
+            } else {
+                newPageOrder = GeneralUtils.parsePageList(pageOrderArr, totalPages, false);
            }
+            log.info("newPageOrder = {}", newPageOrder);
+            log.info("totalPages = {}", totalPages);
+            // Create a new list to hold the pages in the new order
+            List<PDPage> newPages = new ArrayList<>();
+            for (int i = 0; i < newPageOrder.size(); i++) {
+                newPages.add(document.getPage(newPageOrder.get(i)));
+            }
+
+            // Create a new document based on the original one
+            PDDocument rearrangedDocument =
+                    pdfDocumentFactory.createNewDocumentBasedOnOldDocument(document);
+
+            // Add the pages in the new order
+            for (PDPage page : newPages) {
+                rearrangedDocument.addPage(page);
+            }
+
+            return WebResponseUtils.pdfDocToWebResponse(
+                    rearrangedDocument,
+                    GeneralUtils.generateFilename(
+                            pdfFile.getOriginalFilename(), "_rearranged.pdf"));
        } catch (IOException e) {
            ExceptionUtils.logException("document rearrangement", e);
            throw e;
@@ -47,20 +47,19 @@ public class RotationController {
                    "error.angleNotMultipleOf90", "Angle must be a multiple of 90");
        }

-        // Load the PDF document with proper resource management
-        try (PDDocument document = pdfDocumentFactory.load(request)) {
+        // Load the PDF document
+        PDDocument document = pdfDocumentFactory.load(request);

-            // Get the list of pages in the document
-            PDPageTree pages = document.getPages();
+        // Get the list of pages in the document
+        PDPageTree pages = document.getPages();

-            for (PDPage page : pages) {
-                page.setRotation(page.getRotation() + angle);
-            }
-
-            // Return the rotated PDF as a response
-            return WebResponseUtils.pdfDocToWebResponse(
-                    document,
-                    GeneralUtils.generateFilename(pdfFile.getOriginalFilename(), "_rotated.pdf"));
+        for (PDPage page : pages) {
+            page.setRotation(page.getRotation() + angle);
        }
+
+        // Return the rotated PDF as a response
+        return WebResponseUtils.pdfDocToWebResponse(
+                document,
+                GeneralUtils.generateFilename(pdfFile.getOriginalFilename(), "_rotated.pdf"));
    }
 }
@@ -1,10 +1,9 @@
 package stirling.software.SPDF.controller.api;

-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
+import java.io.OutputStream;
 import java.nio.file.Files;
 import java.util.*;
-import java.util.stream.IntStream;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipOutputStream;

@@ -19,37 +18,38 @@ import org.apache.pdfbox.util.Matrix;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;

 import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;

 import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;

-import stirling.software.SPDF.config.swagger.MultiFileResponse;
 import stirling.software.SPDF.model.SplitTypes;
 import stirling.software.SPDF.model.api.SplitPdfBySectionsRequest;
-import stirling.software.common.annotations.AutoJobPostMapping;
-import stirling.software.common.annotations.api.GeneralApi;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
+import stirling.software.common.util.PDFService;
 import stirling.software.common.util.TempFile;
 import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;

-@GeneralApi
-@Slf4j
+@RestController
+@RequestMapping("/api/v1/general")
+@Tag(name = "General", description = "General APIs")
@RequiredArgsConstructor
 public class SplitPdfBySectionsController {

    private final CustomPDFDocumentFactory pdfDocumentFactory;
    private final TempFileManager tempFileManager;
+    private final PDFService pdfService;

-    @AutoJobPostMapping(
-            consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
-            value = "/split-pdf-by-sections")
-    @MultiFileResponse
+    @PostMapping(value = "/split-pdf-by-sections", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
    @Operation(
            summary = "Split PDF pages into smaller sections",
            description =
@@ -57,8 +57,8 @@ public class SplitPdfBySectionsController {
                            + " which page to split, and how to split"
                            + " ( halves, thirds, quarters, etc.), both vertically and horizontally."
                            + " Input:PDF Output:ZIP-PDF Type:SISO")
-    public ResponseEntity<byte[]> splitPdf(@ModelAttribute SplitPdfBySectionsRequest request)
-            throws Exception {
+    public ResponseEntity<StreamingResponseBody> splitPdf(
+            @ModelAttribute SplitPdfBySectionsRequest request) throws Exception {
        MultipartFile file = request.getFileInput();
        String pageNumbers = request.getPageNumbers();
        SplitTypes splitMode =
@@ -77,10 +77,9 @@ public class SplitPdfBySectionsController {
            String filename = GeneralUtils.generateFilename(file.getOriginalFilename(), "_split");

            if (merge) {
-                try (PDDocument mergedDoc =
-                                pdfDocumentFactory.createNewDocumentBasedOnOldDocument(
-                                        sourceDocument);
-                        ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
+                TempFile tempFile = new TempFile(tempFileManager, ".pdf");
+                try (PDDocument mergedDoc = pdfDocumentFactory.createNewDocument();
+                        OutputStream out = Files.newOutputStream(tempFile.getPath())) {
                    LayerUtility layerUtility = new LayerUtility(mergedDoc);
                    for (int pageIndex = 0;
                            pageIndex < sourceDocument.getNumberOfPages();
@@ -97,9 +96,9 @@ public class SplitPdfBySectionsController {
                            addPageToTarget(sourceDocument, pageIndex, mergedDoc, layerUtility);
                        }
                    }
-                    mergedDoc.save(baos);
-                    return WebResponseUtils.baosToWebResponse(baos, filename + ".pdf");
+                    mergedDoc.save(out);
                }
+                return WebResponseUtils.pdfFileToWebResponse(tempFile, filename + ".pdf");
            } else {
                TempFile zipTempFile = new TempFile(tempFileManager, ".zip");
                try (ZipOutputStream zipOut =
@@ -132,13 +131,6 @@ public class SplitPdfBySectionsController {
                                                        + sectionNum
                                                        + ".pdf";
                                        saveDocToZip(subDoc, zipOut, entryName);
-                                    } catch (IOException e) {
-                                        log.error(
-                                                "Error creating section {} for page {}",
-                                                (i * verti + j + 1),
-                                                pageNum,
-                                                e);
-                                        throw e;
                                    }
                                }
                            }
@@ -148,23 +140,12 @@ public class SplitPdfBySectionsController {
                                addPageToTarget(sourceDocument, pageIndex, subDoc, subLayerUtility);
                                String entryName = filename + "_" + pageNum + "_1.pdf";
                                saveDocToZip(subDoc, zipOut, entryName);
-                            } catch (IOException e) {
-                                log.error("Error processing unsplit page {}", pageNum, e);
-                                throw e;
                            }
                        }
                    }
-                } catch (IOException e) {
-                    log.error("Error creating ZIP file with split PDF sections", e);
-                    throw e;
                }
-                byte[] zipBytes = Files.readAllBytes(zipTempFile.getPath());
-                return WebResponseUtils.bytesToWebResponse(
-                        zipBytes, filename + ".zip", MediaType.APPLICATION_OCTET_STREAM);
+                return WebResponseUtils.zipFileToWebResponse(zipTempFile, filename + ".zip");
            }
-        } catch (Exception e) {
-            log.error("Error splitting PDF file: {}", file.getOriginalFilename(), e);
-            throw e;
        }
    }

@@ -179,9 +160,6 @@ public class SplitPdfBySectionsController {
        try (PDPageContentStream contentStream =
                new PDPageContentStream(targetDoc, newPage, AppendMode.APPEND, true, true)) {
            contentStream.drawForm(form);
-        } catch (IOException e) {
-            log.error("Error adding page {} to target document", pageIndex, e);
-            throw e;
        }
    }

@@ -219,10 +197,6 @@ public class SplitPdfBySectionsController {
                    contentStream.transform(new Matrix(1, 0, 0, 1, translateX, translateY));
                    contentStream.drawForm(form);
                    contentStream.restoreGraphicsState();
-                } catch (IOException e) {
-                    log.error(
-                            "Error adding split section ({}, {}) for page {}", i, j, pageIndex, e);
-                    throw e;
                }
            }
        }
@@ -259,14 +233,6 @@ public class SplitPdfBySectionsController {
            contentStream.transform(new Matrix(1, 0, 0, 1, translateX, translateY));
            contentStream.drawForm(form);
            contentStream.restoreGraphicsState();
-        } catch (IOException e) {
-            log.error(
-                    "Error adding single section ({}, {}) for page {} to target",
-                    horizIndex,
-                    vertIndex,
-                    pageIndex,
-                    e);
-            throw e;
        }
    }

@@ -298,19 +264,27 @@ public class SplitPdfBySectionsController {
                break;

            case SPLIT_ALL:
-                pagesToSplit.addAll(IntStream.range(0, totalPages).boxed().toList());
+                for (int i = 0; i < totalPages; i++) {
+                    pagesToSplit.add(i);
+                }
                break;

            case SPLIT_ALL_EXCEPT_FIRST:
-                pagesToSplit.addAll(IntStream.range(1, totalPages).boxed().toList());
+                for (int i = 1; i < totalPages; i++) {
+                    pagesToSplit.add(i);
+                }
                break;

            case SPLIT_ALL_EXCEPT_LAST:
-                pagesToSplit.addAll(IntStream.range(0, totalPages - 1).boxed().toList());
+                for (int i = 0; i < totalPages - 1; i++) {
+                    pagesToSplit.add(i);
+                }
                break;

            case SPLIT_ALL_EXCEPT_FIRST_AND_LAST:
-                pagesToSplit.addAll(IntStream.range(1, totalPages - 1).boxed().toList());
+                for (int i = 1; i < totalPages - 1; i++) {
+                    pagesToSplit.add(i);
+                }
                break;

            default:
@@ -473,36 +473,34 @@ public class SplitPdfBySizeController {
            PDDocument document, ZipOutputStream zipOut, String baseFilename, int index)
            throws IOException {
        log.debug("Starting saveDocumentToZip for document part {}", index);
-        try (ByteArrayOutputStream outStream = new ByteArrayOutputStream()) {
+        ByteArrayOutputStream outStream = new ByteArrayOutputStream();

-            try (PDDocument doc = document) {
-                log.debug("Saving document part {} to byte array", index);
-                doc.save(outStream);
-                log.debug(
-                        "Successfully saved document part {} ({} bytes)", index, outStream.size());
-            } catch (Exception e) {
-                log.error("Error saving document part {} to byte array", index, e);
-                throw ExceptionUtils.createFileProcessingException("split", e);
-            }
+        try (PDDocument doc = document) {
+            log.debug("Saving document part {} to byte array", index);
+            doc.save(outStream);
+            log.debug("Successfully saved document part {} ({} bytes)", index, outStream.size());
+        } catch (Exception e) {
+            log.error("Error saving document part {} to byte array", index, e);
+            throw ExceptionUtils.createFileProcessingException("split", e);
+        }

-            try {
-                // Create a new zip entry
-                String entryName = baseFilename + "_" + index + ".pdf";
-                log.debug("Creating ZIP entry: {}", entryName);
-                ZipEntry zipEntry = new ZipEntry(entryName);
-                zipOut.putNextEntry(zipEntry);
+        try {
+            // Create a new zip entry
+            String entryName = baseFilename + "_" + index + ".pdf";
+            log.debug("Creating ZIP entry: {}", entryName);
+            ZipEntry zipEntry = new ZipEntry(entryName);
+            zipOut.putNextEntry(zipEntry);

-                byte[] bytes = outStream.toByteArray();
-                log.debug("Writing {} bytes to ZIP entry", bytes.length);
-                zipOut.write(bytes);
+            byte[] bytes = outStream.toByteArray();
+            log.debug("Writing {} bytes to ZIP entry", bytes.length);
+            zipOut.write(bytes);

-                log.debug("Closing ZIP entry");
-                zipOut.closeEntry();
-                log.debug("Successfully added document part {} to ZIP", index);
-            } catch (Exception e) {
-                log.error("Error adding document part {} to ZIP", index, e);
-                throw ExceptionUtils.createFileProcessingException("split", e);
-            }
+            log.debug("Closing ZIP entry");
+            zipOut.closeEntry();
+            log.debug("Successfully added document part {} to ZIP", index);
+        } catch (Exception e) {
+            log.error("Error adding document part {} to ZIP", index, e);
+            throw ExceptionUtils.createFileProcessingException("split", e);
        }
    }
 }
@@ -188,15 +188,15 @@ public class ConvertImgPDFController {
                    bodyBytes = Files.readAllBytes(webpFilePath);
                } else {
                    // Create a ZIP file containing all WebP images
-                    try (ByteArrayOutputStream zipOutputStream = new ByteArrayOutputStream();
-                            ZipOutputStream zos = new ZipOutputStream(zipOutputStream)) {
+                    ByteArrayOutputStream zipOutputStream = new ByteArrayOutputStream();
+                    try (ZipOutputStream zos = new ZipOutputStream(zipOutputStream)) {
                        for (Path webpFile : webpFiles) {
                            zos.putNextEntry(new ZipEntry(webpFile.getFileName().toString()));
                            Files.copy(webpFile, zos);
                            zos.closeEntry();
                        }
-                        bodyBytes = zipOutputStream.toByteArray();
                    }
+                    bodyBytes = zipOutputStream.toByteArray();
                }
                // Clean up the temporary files
                Files.deleteIfExists(tempFile);
@@ -196,12 +196,11 @@ public class ConvertOfficeController {
        try {
            file = convertToPdf(inputFile);

-            try (PDDocument doc = pdfDocumentFactory.load(file)) {
-                return WebResponseUtils.pdfDocToWebResponse(
-                        doc,
-                        GeneralUtils.generateFilename(
-                                inputFile.getOriginalFilename(), "_convertedToPDF.pdf"));
-            }
+            PDDocument doc = pdfDocumentFactory.load(file);
+            return WebResponseUtils.pdfDocToWebResponse(
+                    doc,
+                    GeneralUtils.generateFilename(
+                            inputFile.getOriginalFilename(), "_convertedToPDF.pdf"));
        } finally {
            if (file != null && file.getParent() != null) {
                FileUtils.deleteDirectory(file.getParentFile());
@@ -21,7 +21,6 @@ import org.apache.pdfbox.cos.COSArray;
 import org.apache.pdfbox.cos.COSBase;
 import org.apache.pdfbox.cos.COSDictionary;
 import org.apache.pdfbox.cos.COSName;
-import org.apache.pdfbox.cos.COSStream;
 import org.apache.pdfbox.io.RandomAccessRead;
 import org.apache.pdfbox.io.RandomAccessReadBufferedFile;
 import org.apache.pdfbox.pdfwriter.compress.CompressParameters;
@@ -52,7 +51,7 @@ import org.apache.pdfbox.pdmodel.graphics.image.LosslessFactory;
 import org.apache.pdfbox.pdmodel.graphics.image.PDImageXObject;
 import org.apache.pdfbox.pdmodel.graphics.optionalcontent.PDOptionalContentProperties;
 import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotation;
-import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationHighlight;
+import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationTextMarkup;
 import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationWidget;
 import org.apache.pdfbox.pdmodel.interactive.annotation.PDAppearanceDictionary;
 import org.apache.pdfbox.pdmodel.interactive.viewerpreferences.PDViewerPreferences;
@@ -379,6 +378,7 @@ public class ConvertPDFToPDFA {
        command.add("-sOutputICCProfile=" + colorProfiles.rgb().toAbsolutePath());
        command.add("-sDefaultRGBProfile=" + colorProfiles.rgb().toAbsolutePath());
        command.add("-sDefaultGrayProfile=" + colorProfiles.gray().toAbsolutePath());
+        command.add("-sDefaultCMYKProfile=" + colorProfiles.rgb().toAbsolutePath());

        // Font handling optimized for PDF/A CIDSet compliance
        command.add("-dEmbedAllFonts=true");
@@ -673,55 +673,25 @@ public class ConvertPDFToPDFA {
                    if (descriptor == null) continue;

                    // Check if this is a Type1 font
-                    boolean isType1 =
-                            isType1Font(font)
-                                    || descriptor.getFontFile() != null
-                                    || (descriptor.getFontFile2() == null
-                                            && descriptor.getFontFile3() == null);
+                    if (fontNameStr.contains("Type1")
+                            || descriptor.getFontFile() != null
+                            || (descriptor.getFontFile2() == null
+                                    && descriptor.getFontFile3() == null)) {

-                    if (isType1) {
-                        COSDictionary descDict = descriptor.getCOSObject();
-                        String existingCharSet = descDict.getString(COSName.CHAR_SET);
+                        String existingCharSet =
+                                descriptor.getCOSObject().getString(COSName.CHAR_SET);

-                        // Check if font is embedded and if CharSet might be invalid
-                        boolean fontEmbedded = font.isEmbedded();
-                        boolean hasFontFile =
-                                descriptor.getFontFile() != null
-                                        || descriptor.getFontFile2() != null
-                                        || descriptor.getFontFile3() != null;
-
-                        // For PDF/A compliance: if CharSet exists but font is subsetted or
-                        // we can't verify it matches the font file, remove it to avoid validation
-                        // errors
-                        if (existingCharSet != null && !existingCharSet.trim().isEmpty()) {
-                            // If the font appears to be subsetted (indicated by subset prefix in
-                            // name)
-                            // or if we can't verify the CharSet is correct, remove it
-                            if (fontNameStr.contains("+") || fontNameStr.contains("Subset")) {
-                                descDict.removeItem(COSName.CHAR_SET);
+                        String glyphSet = buildStandardType1GlyphSet();
+                        if (!glyphSet.isEmpty()) {
+                            if (existingCharSet == null
+                                    || existingCharSet.trim().isEmpty()
+                                    || countGlyphs(existingCharSet) < countGlyphs(glyphSet)) {
+                                descriptor.getCOSObject().setString(COSName.CHAR_SET, glyphSet);
                                log.debug(
-                                        "Removed potentially invalid CharSet from subsetted Type1 font: {}",
-                                        fontNameStr);
-                            } else if (!hasFontFile && fontEmbedded) {
-                                // Font is embedded but we can't verify CharSet, remove it
-                                descDict.removeItem(COSName.CHAR_SET);
-                                log.debug(
-                                        "Removed unverifiable CharSet from embedded Type1 font: {}",
-                                        fontNameStr);
-                            }
-                        } else if (existingCharSet == null || existingCharSet.trim().isEmpty()) {
-                            // Only add CharSet if font is not subsetted and we can verify it
-                            if (!fontNameStr.contains("+")
-                                    && !fontNameStr.contains("Subset")
-                                    && hasFontFile) {
-                                String glyphSet = buildStandardType1GlyphSet();
-                                if (!glyphSet.isEmpty()) {
-                                    descDict.setString(COSName.CHAR_SET, glyphSet);
-                                    log.debug(
-                                            "Added missing CharSet for Type1 font {} with {} glyphs",
-                                            fontNameStr,
-                                            countGlyphs(glyphSet));
-                                }
+                                        "Fixed CharSet for Type1 font {} with {} glyphs (was: {})",
+                                        fontNameStr,
+                                        countGlyphs(glyphSet),
+                                        existingCharSet != null ? countGlyphs(existingCharSet) : 0);
                            }
                        }
                    }
@@ -1241,7 +1211,7 @@ public class ConvertPDFToPDFA {
                List<PDAnnotation> annotations = page.getAnnotations();
                for (PDAnnotation annot : annotations) {
                    if (ANNOTATION_HIGHLIGHT.equals(annot.getSubtype())
-                            && annot instanceof PDAnnotationHighlight highlight) {
+                            && annot instanceof PDAnnotationTextMarkup highlight) {
                        float[] colorComponents =
                                highlight.getColor() != null
                                        ? highlight.getColor().getComponents()
@@ -1379,22 +1349,13 @@ public class ConvertPDFToPDFA {

            for (COSBase base : ocgArray) {
                if (base instanceof COSDictionary ocgDict) {
-                    // Ensure Name entry exists and is not empty
-                    String nameValue = ocgDict.getString(COSName.NAME);
-                    if (nameValue == null || nameValue.trim().isEmpty()) {
+                    if (!ocgDict.containsKey(COSName.NAME)) {
                        String newName = "Layer " + unnamedCount++;
                        ocgDict.setString(COSName.NAME, newName);
-                        log.debug("Fixed OCG missing or empty name, set to: {}", newName);
+                        log.debug("Fixed OCG missing name, set to: {}", newName);
                    }
                }
            }
-        } else if (ocgs instanceof COSDictionary ocgDict) {
-            // Handle case where OCGS is a single dictionary instead of array
-            String nameValue = ocgDict.getString(COSName.NAME);
-            if (nameValue == null || nameValue.trim().isEmpty()) {
-                ocgDict.setString(COSName.NAME, "Layer 1");
-                log.debug("Fixed single OCG missing or empty name");
-            }
        }
    }

@@ -1518,9 +1479,7 @@ public class ConvertPDFToPDFA {
        Path pdfaDefFile = createPdfaDefFile(workingDir, colorProfiles, profile);

        // Preprocess PDF for PDF/A compliance using the sanitizer
-        // We add a white background to ensure transparency is flattened correctly against white
-        // instead of black, addressing common PDF/A conversion issues.
-        Path sanitizedInputPdf = sanitizePdfWithPdfBox(inputPdf, true);
+        Path sanitizedInputPdf = sanitizePdfWithPdfBox(inputPdf);
        Path preprocessedPdf = sanitizedInputPdf != null ? sanitizedInputPdf : inputPdf;

        // For PDF/A-1, clean CIDSet issues that may cause validation failures
@@ -1541,14 +1500,11 @@ public class ConvertPDFToPDFA {
                    buildGhostscriptCommand(
                            inputForGs, outputPdf, colorProfiles, workingDir, profile, pdfaDefFile);

-            log.info("Running Ghostscript command: {}", String.join(" ", command));
-
            ProcessExecutorResult result =
                    ProcessExecutor.getInstance(ProcessExecutor.Processes.GHOSTSCRIPT)
                            .runCommandWithOutputHandling(command);

            if (result.getRc() != 0) {
-                log.error("Ghostscript failed with output: {}", result.getMessages());
                throw new IOException("Ghostscript exited with code " + result.getRc());
            }

@@ -1709,7 +1665,6 @@ public class ConvertPDFToPDFA {
    }

    private byte[] convertWithPdfBoxMethod(Path inputPath, PdfaProfile profile) throws Exception {
-        log.info("Starting PDFBox/LibreOffice conversion for PDF/A-{}", profile.getPart());
        Path tempInputFile = null;
        byte[] fileBytes;
        Path loPdfPath = null;
@@ -1765,20 +1720,17 @@ public class ConvertPDFToPDFA {
        ColorProfiles colorProfiles = prepareColorProfiles(workingDir);

        // Sanitize the PDF before PDF/X conversion for better Ghostscript compatibility
-        Path sanitizedInputPdf = sanitizePdfWithPdfBox(inputPdf, true);
+        Path sanitizedInputPdf = sanitizePdfWithPdfBox(inputPdf);
        Path inputForGs = sanitizedInputPdf != null ? sanitizedInputPdf : inputPdf;

        List<String> command =
                buildGhostscriptCommandX(inputForGs, outputPdf, colorProfiles, workingDir, profile);

-        log.info("Running Ghostscript PDF/X command: {}", String.join(" ", command));
-
        ProcessExecutorResult result =
                ProcessExecutor.getInstance(ProcessExecutor.Processes.GHOSTSCRIPT)
                        .runCommandWithOutputHandling(command);

        if (result.getRc() != 0) {
-            log.error("Ghostscript PDF/X failed with output: {}", result.getMessages());
            throw new IOException("Ghostscript exited with code " + result.getRc());
        }

@@ -1844,12 +1796,12 @@ public class ConvertPDFToPDFA {
        }
    }

-    private Path sanitizePdfWithPdfBox(Path inputPdf, boolean addWhiteBackground) {
+    private Path sanitizePdfWithPdfBox(Path inputPdf) {
        try {
            Path sanitizedPath =
                    inputPdf.getParent().resolve("sanitized_" + inputPdf.getFileName().toString());

-            sanitizeDocument(inputPdf, sanitizedPath, addWhiteBackground);
+            sanitizeDocument(inputPdf, sanitizedPath);

            log.info("PDF sanitized with PDFBox for better Ghostscript compatibility");
            return sanitizedPath;
@@ -1861,8 +1813,7 @@ public class ConvertPDFToPDFA {
        }
    }

-    private void sanitizeDocument(Path inputPath, Path outputPath, boolean addWhiteBackground)
-            throws IOException {
+    private void sanitizeDocument(Path inputPath, Path outputPath) throws IOException {
        try (PDDocument doc = Loader.loadPDF(inputPath.toFile())) {
            Map<String, DocumentSanitizer> sanitizers = new LinkedHashMap<>();
            sanitizers.put("Flatten highlight annotations", this::flattenHighlightsToContent);
@@ -1873,11 +1824,6 @@ public class ConvertPDFToPDFA {
            sanitizers.put("Ensure embedded file compliance", this::ensureEmbeddedFileCompliance);
            sanitizers.put(
                    "Fix optional content groups", ConvertPDFToPDFA::fixOptionalContentGroups);
-            sanitizers.put("Fix separation color spaces", this::fixSeparationColorSpaces);
-
-            if (addWhiteBackground) {
-                sanitizers.put("Add white background", this::addWhiteBackground);
-            }

            for (Map.Entry<String, DocumentSanitizer> entry : sanitizers.entrySet()) {
                try {
@@ -1895,191 +1841,6 @@ public class ConvertPDFToPDFA {
        }
    }

-    private void fixSeparationColorSpaces(PDDocument doc) throws IOException {
-        Map<String, COSBase> knownTintTransforms = new HashMap<>();
-        Set<COSBase> visitedResources = new HashSet<>();
-
-        // Process all pages first to collect all separation color spaces
-        for (PDPage page : doc.getPages()) {
-            PDResources resources = page.getResources();
-            processResourcesForSeparation(resources, knownTintTransforms, visitedResources);
-        }
-
-        // Process document-level resources if they exist
-        PDDocumentCatalog catalog = doc.getDocumentCatalog();
-        if (catalog != null) {
-            PDResources docResources =
-                    catalog.getAcroForm() != null
-                            ? catalog.getAcroForm().getDefaultResources()
-                            : null;
-            if (docResources != null) {
-                processResourcesForSeparation(docResources, knownTintTransforms, visitedResources);
-            }
-        }
-
-        // Second pass: ensure all separations with the same name use the same tintTransform
-        visitedResources.clear();
-        for (PDPage page : doc.getPages()) {
-            PDResources resources = page.getResources();
-            enforceSeparationConsistency(resources, knownTintTransforms, visitedResources);
-        }
-    }
-
-    private void processResourcesForSeparation(
-            PDResources resources,
-            Map<String, COSBase> knownTintTransforms,
-            Set<COSBase> visitedResources) {
-        if (resources == null) return;
-
-        // Prevent infinite recursion if resources are shared or cyclic
-        if (!visitedResources.add(resources.getCOSObject())) {
-            return;
-        }
-
-        // Check defined ColorSpaces
-        COSDictionary csDict =
-                (COSDictionary) resources.getCOSObject().getDictionaryObject(COSName.COLORSPACE);
-        if (csDict != null) {
-            for (COSName name : csDict.keySet()) {
-                COSBase csVal = csDict.getDictionaryObject(name);
-                checkAndFixSeparation(csVal, knownTintTransforms);
-            }
-        }
-
-        // Recursively check XObjects (Forms)
-        COSDictionary xObjDict =
-                (COSDictionary) resources.getCOSObject().getDictionaryObject(COSName.XOBJECT);
-        if (xObjDict != null) {
-            for (COSName name : xObjDict.keySet()) {
-                COSBase xObj = xObjDict.getDictionaryObject(name);
-                if (xObj instanceof COSStream stream) {
-                    COSName type = (COSName) stream.getDictionaryObject(COSName.SUBTYPE);
-                    if (COSName.FORM.equals(type)) {
-                        COSBase formRes = stream.getDictionaryObject(COSName.RESOURCES);
-                        if (formRes instanceof COSDictionary formResDict) {
-                            processResourcesForSeparation(
-                                    new PDResources(formResDict),
-                                    knownTintTransforms,
-                                    visitedResources);
-                        }
-                    }
-                }
-            }
-        }
-    }
-
-    private void checkAndFixSeparation(COSBase cs, Map<String, COSBase> knownTintTransforms) {
-        if (cs instanceof COSArray arr && arr.size() >= 4) {
-            COSBase type = arr.getObject(0);
-            if (COSName.SEPARATION.equals(type)) {
-                // Separation: [/Separation name altSpace tintTransform]
-                COSBase nameBase = arr.getObject(1);
-                if (nameBase instanceof COSName colorName) {
-                    String name = colorName.getName();
-                    COSBase tintTransform = arr.getObject(3);
-
-                    if (knownTintTransforms.containsKey(name)) {
-                        COSBase known = knownTintTransforms.get(name);
-                        // If objects are not identical (same reference), unify them
-                        if (known != tintTransform) {
-                            arr.set(3, known);
-                            log.debug("Unified TintTransform for Separation color: {}", name);
-                        }
-                    } else {
-                        // Store the first encountered tintTransform for this color name
-                        knownTintTransforms.put(name, tintTransform);
-                    }
-                }
-            }
-        }
-    }
-
-    private void enforceSeparationConsistency(
-            PDResources resources,
-            Map<String, COSBase> knownTintTransforms,
-            Set<COSBase> visitedResources) {
-        if (resources == null) return;
-
-        // Prevent infinite recursion
-        if (!visitedResources.add(resources.getCOSObject())) {
-            return;
-        }
-
-        // Check defined ColorSpaces
-        COSDictionary csDict =
-                (COSDictionary) resources.getCOSObject().getDictionaryObject(COSName.COLORSPACE);
-        if (csDict != null) {
-            for (COSName name : csDict.keySet()) {
-                COSBase csVal = csDict.getDictionaryObject(name);
-                enforceSeparationTintTransform(csVal, knownTintTransforms);
-            }
-        }
-
-        // Recursively check XObjects (Forms)
-        COSDictionary xObjDict =
-                (COSDictionary) resources.getCOSObject().getDictionaryObject(COSName.XOBJECT);
-        if (xObjDict != null) {
-            for (COSName name : xObjDict.keySet()) {
-                COSBase xObj = xObjDict.getDictionaryObject(name);
-                if (xObj instanceof COSStream stream) {
-                    COSName type = (COSName) stream.getDictionaryObject(COSName.SUBTYPE);
-                    if (COSName.FORM.equals(type)) {
-                        COSBase formRes = stream.getDictionaryObject(COSName.RESOURCES);
-                        if (formRes instanceof COSDictionary formResDict) {
-                            enforceSeparationConsistency(
-                                    new PDResources(formResDict),
-                                    knownTintTransforms,
-                                    visitedResources);
-                        }
-                    }
-                }
-            }
-        }
-    }
-
-    private void enforceSeparationTintTransform(
-            COSBase cs, Map<String, COSBase> knownTintTransforms) {
-        if (cs instanceof COSArray arr && arr.size() >= 4) {
-            COSBase type = arr.getObject(0);
-            if (COSName.SEPARATION.equals(type)) {
-                COSBase nameBase = arr.getObject(1);
-                if (nameBase instanceof COSName colorName) {
-                    String name = colorName.getName();
-                    COSBase tintTransform = arr.getObject(3);
-
-                    // Ensure all separations with the same name use the same tintTransform
-                    // reference
-                    if (knownTintTransforms.containsKey(name)) {
-                        COSBase known = knownTintTransforms.get(name);
-                        if (known != tintTransform) {
-                            arr.set(3, known);
-                            log.debug(
-                                    "Enforced consistent TintTransform for Separation color: {}",
-                                    name);
-                        }
-                    }
-                }
-            }
-        }
-    }
-
-    private void addWhiteBackground(PDDocument doc) throws IOException {
-        for (PDPage page : doc.getPages()) {
-            PDRectangle mediaBox = page.getMediaBox();
-            try (PDPageContentStream cs =
-                    new PDPageContentStream(
-                            doc, page, PDPageContentStream.AppendMode.PREPEND, true, true)) {
-                cs.setNonStrokingColor(Color.WHITE);
-                cs.addRect(
-                        mediaBox.getLowerLeftX(),
-                        mediaBox.getLowerLeftY(),
-                        mediaBox.getWidth(),
-                        mediaBox.getHeight());
-                cs.fill();
-            }
-        }
-    }
-
    private void flattenHighlightsToContent(PDDocument doc) throws IOException {
        for (PDPage page : doc.getPages()) {
            List<PDAnnotation> annotations = new ArrayList<>(page.getAnnotations());
@@ -2090,7 +1851,7 @@ public class ConvertPDFToPDFA {
                            doc, page, PDPageContentStream.AppendMode.PREPEND, true, true)) {

                for (PDAnnotation annot : annotations) {
-                    if (annot instanceof PDAnnotationHighlight highlight
+                    if (annot instanceof PDAnnotationTextMarkup highlight
                            && ANNOTATION_HIGHLIGHT.equals(annot.getSubtype())) {

                        PDColor color = highlight.getColor();
@@ -2212,7 +1973,7 @@ public class ConvertPDFToPDFA {
                return annot.getAppearance() != null;
            }

-            if (annot instanceof PDAnnotationHighlight) {
+            if (annot instanceof PDAnnotationTextMarkup) {
                return false; // Will be handled by flattening
            }

@@ -47,105 +47,102 @@ public class AutoRenameController {
        MultipartFile file = request.getFileInput();
        boolean useFirstTextAsFallback = Boolean.TRUE.equals(request.getUseFirstTextAsFallback());

-        try (PDDocument document = pdfDocumentFactory.load(file)) {
-            PDFTextStripper reader =
-                    new PDFTextStripper() {
-                        List<LineInfo> lineInfos = new ArrayList<>();
-                        StringBuilder lineBuilder = new StringBuilder();
-                        float lastY = -1;
-                        float maxFontSizeInLine = 0.0f;
-                        int lineCount = 0;
+        PDDocument document = pdfDocumentFactory.load(file);
+        PDFTextStripper reader =
+                new PDFTextStripper() {
+                    List<LineInfo> lineInfos = new ArrayList<>();
+                    StringBuilder lineBuilder = new StringBuilder();
+                    float lastY = -1;
+                    float maxFontSizeInLine = 0.0f;
+                    int lineCount = 0;

-                        @Override
-                        protected void processTextPosition(TextPosition text) {
-                            if (lastY != text.getY() && lineCount < LINE_LIMIT) {
-                                processLine();
-                                lineBuilder = new StringBuilder(text.getUnicode());
+                    @Override
+                    protected void processTextPosition(TextPosition text) {
+                        if (lastY != text.getY() && lineCount < LINE_LIMIT) {
+                            processLine();
+                            lineBuilder = new StringBuilder(text.getUnicode());
+                            maxFontSizeInLine = text.getFontSizeInPt();
+                            lastY = text.getY();
+                            lineCount++;
+                        } else if (lineCount < LINE_LIMIT) {
+                            lineBuilder.append(text.getUnicode());
+                            if (text.getFontSizeInPt() > maxFontSizeInLine) {
                                maxFontSizeInLine = text.getFontSizeInPt();
-                                lastY = text.getY();
-                                lineCount++;
-                            } else if (lineCount < LINE_LIMIT) {
-                                lineBuilder.append(text.getUnicode());
-                                if (text.getFontSizeInPt() > maxFontSizeInLine) {
-                                    maxFontSizeInLine = text.getFontSizeInPt();
-                                }
                            }
                        }
+                    }

-                        private void processLine() {
-                            if (!lineBuilder.isEmpty() && lineCount < LINE_LIMIT) {
-                                lineInfos.add(
-                                        new LineInfo(lineBuilder.toString(), maxFontSizeInLine));
+                    private void processLine() {
+                        if (!lineBuilder.isEmpty() && lineCount < LINE_LIMIT) {
+                            lineInfos.add(new LineInfo(lineBuilder.toString(), maxFontSizeInLine));
+                        }
+                    }
+
+                    @Override
+                    public String getText(PDDocument doc) throws IOException {
+                        this.lineInfos.clear();
+                        this.lineBuilder = new StringBuilder();
+                        this.lastY = -1;
+                        this.maxFontSizeInLine = 0.0f;
+                        this.lineCount = 0;
+                        super.getText(doc);
+                        processLine(); // Process the last line
+
+                        // Merge lines with same font size
+                        List<LineInfo> mergedLineInfos = new ArrayList<>();
+                        for (int i = 0; i < lineInfos.size(); i++) {
+                            StringBuilder mergedText = new StringBuilder(lineInfos.get(i).text);
+                            float fontSize = lineInfos.get(i).fontSize;
+                            while (i + 1 < lineInfos.size()
+                                    && lineInfos.get(i + 1).fontSize == fontSize) {
+                                mergedText.append(" ").append(lineInfos.get(i + 1).text);
+                                i++;
                            }
+                            mergedLineInfos.add(new LineInfo(mergedText.toString(), fontSize));
                        }

-                        @Override
-                        public String getText(PDDocument doc) throws IOException {
-                            this.lineInfos.clear();
-                            this.lineBuilder = new StringBuilder();
-                            this.lastY = -1;
-                            this.maxFontSizeInLine = 0.0f;
-                            this.lineCount = 0;
-                            super.getText(doc);
-                            processLine(); // Process the last line
+                        // Sort lines by font size in descending order and get the first one
+                        mergedLineInfos.sort(
+                                Comparator.comparing((LineInfo li) -> li.fontSize).reversed());
+                        String title =
+                                mergedLineInfos.isEmpty() ? null : mergedLineInfos.get(0).text;

-                            // Merge lines with same font size
-                            List<LineInfo> mergedLineInfos = new ArrayList<>();
-                            for (int i = 0; i < lineInfos.size(); i++) {
-                                StringBuilder mergedText = new StringBuilder(lineInfos.get(i).text);
-                                float fontSize = lineInfos.get(i).fontSize;
-                                while (i + 1 < lineInfos.size()
-                                        && lineInfos.get(i + 1).fontSize == fontSize) {
-                                    mergedText.append(" ").append(lineInfos.get(i + 1).text);
-                                    i++;
-                                }
-                                mergedLineInfos.add(new LineInfo(mergedText.toString(), fontSize));
-                            }
+                        return title != null
+                                ? title
+                                : (useFirstTextAsFallback
+                                        ? (mergedLineInfos.isEmpty()
+                                                ? null
+                                                : mergedLineInfos.get(mergedLineInfos.size() - 1)
+                                                        .text)
+                                        : null);
+                    }

-                            // Sort lines by font size in descending order and get the first one
-                            mergedLineInfos.sort(
-                                    Comparator.comparing((LineInfo li) -> li.fontSize).reversed());
-                            String title =
-                                    mergedLineInfos.isEmpty() ? null : mergedLineInfos.get(0).text;
+                    class LineInfo {
+                        String text;
+                        float fontSize;

-                            return title != null
-                                    ? title
-                                    : (useFirstTextAsFallback
-                                            ? (mergedLineInfos.isEmpty()
-                                                    ? null
-                                                    : mergedLineInfos.get(
-                                                                    mergedLineInfos.size() - 1)
-                                                            .text)
-                                            : null);
+                        LineInfo(String text, float fontSize) {
+                            this.text = text;
+                            this.fontSize = fontSize;
                        }
+                    }
+                };

-                        class LineInfo {
-                            String text;
-                            float fontSize;
+        String header = reader.getText(document);

-                            LineInfo(String text, float fontSize) {
-                                this.text = text;
-                                this.fontSize = fontSize;
-                            }
-                        }
-                    };
-
-            String header = reader.getText(document);
-
-            // Sanitize the header string by removing characters not allowed in a filename.
-            if (header != null && header.length() < 255) {
-                header =
-                        RegexPatternUtils.getInstance()
-                                .getSafeFilenamePattern()
-                                .matcher(header)
-                                .replaceAll("")
-                                .trim();
-                return WebResponseUtils.pdfDocToWebResponse(document, header + ".pdf");
-            } else {
-                log.info("File has no good title to be found");
-                return WebResponseUtils.pdfDocToWebResponse(
-                        document, Filenames.toSimpleFileName(file.getOriginalFilename()));
-            }
+        // Sanitize the header string by removing characters not allowed in a filename.
+        if (header != null && header.length() < 255) {
+            header =
+                    RegexPatternUtils.getInstance()
+                            .getSafeFilenamePattern()
+                            .matcher(header)
+                            .replaceAll("")
+                            .trim();
+            return WebResponseUtils.pdfDocToWebResponse(document, header + ".pdf");
+        } else {
+            log.info("File has no good title to be found");
+            return WebResponseUtils.pdfDocToWebResponse(
+                    document, Filenames.toSimpleFileName(file.getOriginalFilename()));
        }
    }
 }
@@ -1100,9 +1100,8 @@ public class CompressController {
                            inputFile.getOriginalFilename(), "_Optimized.pdf");

            try {
-                try (PDDocument document = pdfDocumentFactory.load(currentFile.toFile())) {
-                    return WebResponseUtils.pdfDocToWebResponse(document, outputFilename);
-                }
+                return WebResponseUtils.pdfDocToWebResponse(
+                        pdfDocumentFactory.load(currentFile.toFile()), outputFilename);
            } catch (IOException e) {
                throw ExceptionUtils.handlePdfException(e, "PDF optimization");
            }
@@ -49,103 +49,93 @@ public class FlattenController {
    public ResponseEntity<byte[]> flatten(@ModelAttribute FlattenRequest request) throws Exception {
        MultipartFile file = request.getFileInput();

-        try (PDDocument document = pdfDocumentFactory.load(file)) {
-            Boolean flattenOnlyForms = request.getFlattenOnlyForms();
+        PDDocument document = pdfDocumentFactory.load(file);
+        Boolean flattenOnlyForms = request.getFlattenOnlyForms();

-            if (Boolean.TRUE.equals(flattenOnlyForms)) {
-                PDAcroForm acroForm = document.getDocumentCatalog().getAcroForm();
-                if (acroForm != null) {
-                    acroForm.flatten();
-                }
-                return WebResponseUtils.pdfDocToWebResponse(
-                        document, Filenames.toSimpleFileName(file.getOriginalFilename()));
-            } else {
-                // flatten whole page aka convert each page to image and re-add it (making text
-                // unselectable)
-                PDFRenderer pdfRenderer = new PDFRenderer(document);
-                pdfRenderer.setSubsamplingAllowed(
-                        true); // Enable subsampling to reduce memory usage
+        if (Boolean.TRUE.equals(flattenOnlyForms)) {
+            PDAcroForm acroForm = document.getDocumentCatalog().getAcroForm();
+            if (acroForm != null) {
+                acroForm.flatten();
+            }
+            return WebResponseUtils.pdfDocToWebResponse(
+                    document, Filenames.toSimpleFileName(file.getOriginalFilename()));
+        } else {
+            // flatten whole page aka convert each page to image and re-add it (making text
+            // unselectable)
+            PDFRenderer pdfRenderer = new PDFRenderer(document);
+            PDDocument newDocument =
+                    pdfDocumentFactory.createNewDocumentBasedOnOldDocument(document);

-                try (PDDocument newDocument =
-                        pdfDocumentFactory.createNewDocumentBasedOnOldDocument(document)) {
+            int defaultRenderDpi = 100; // Default fallback
+            ApplicationProperties properties =
+                    ApplicationContextProvider.getBean(ApplicationProperties.class);
+            Integer configuredMaxDpi = null;
+            if (properties != null && properties.getSystem() != null) {
+                configuredMaxDpi = properties.getSystem().getMaxDPI();
+            }

-                    int defaultRenderDpi = 100; // Default fallback
-                    ApplicationProperties properties =
-                            ApplicationContextProvider.getBean(ApplicationProperties.class);
-                    Integer configuredMaxDpi = null;
-                    if (properties != null && properties.getSystem() != null) {
-                        configuredMaxDpi = properties.getSystem().getMaxDPI();
+            int maxDpi =
+                    (configuredMaxDpi != null && configuredMaxDpi > 0)
+                            ? configuredMaxDpi
+                            : defaultRenderDpi;
+
+            Integer requestedDpi = request.getRenderDpi();
+            int renderDpiTemp = maxDpi;
+            if (requestedDpi != null) {
+                renderDpiTemp = Math.min(requestedDpi, maxDpi);
+                renderDpiTemp = Math.max(renderDpiTemp, 72);
+            }
+            final int renderDpi = renderDpiTemp;
+
+            int numPages = document.getNumberOfPages();
+            for (int i = 0; i < numPages; i++) {
+                final int pageIndex = i;
+                BufferedImage image = null;
+                try {
+                    // Validate dimensions BEFORE rendering to prevent OOM
+                    ExceptionUtils.validateRenderingDimensions(
+                            document.getPage(pageIndex), pageIndex + 1, renderDpi);
+
+                    // Wrap entire rendering operation to catch OutOfMemoryError from any depth
+                    image =
+                            ExceptionUtils.handleOomRendering(
+                                    pageIndex + 1,
+                                    renderDpi,
+                                    () ->
+                                            pdfRenderer.renderImageWithDPI(
+                                                    pageIndex, renderDpi, ImageType.RGB));
+
+                    PDPage page = new PDPage();
+                    page.setMediaBox(document.getPage(i).getMediaBox());
+                    newDocument.addPage(page);
+                    try (PDPageContentStream contentStream =
+                            new PDPageContentStream(newDocument, page)) {
+                        PDImageXObject pdImage = JPEGFactory.createFromImage(newDocument, image);
+                        float pageWidth = page.getMediaBox().getWidth();
+                        float pageHeight = page.getMediaBox().getHeight();
+
+                        contentStream.drawImage(pdImage, 0, 0, pageWidth, pageHeight);
                    }
-
-                    int maxDpi =
-                            (configuredMaxDpi != null && configuredMaxDpi > 0)
-                                    ? configuredMaxDpi
-                                    : defaultRenderDpi;
-
-                    Integer requestedDpi = request.getRenderDpi();
-                    int renderDpiTemp = maxDpi;
-                    if (requestedDpi != null) {
-                        renderDpiTemp = Math.min(requestedDpi, maxDpi);
-                        renderDpiTemp = Math.max(renderDpiTemp, 72);
-                    }
-                    final int renderDpi = renderDpiTemp;
-
-                    int numPages = document.getNumberOfPages();
-                    for (int i = 0; i < numPages; i++) {
-                        final int pageIndex = i;
-                        BufferedImage image = null;
-                        try {
-                            // Validate dimensions BEFORE rendering to prevent OOM
-                            ExceptionUtils.validateRenderingDimensions(
-                                    document.getPage(pageIndex), pageIndex + 1, renderDpi);
-
-                            // Wrap entire rendering operation to catch OutOfMemoryError from any
-                            // depth
-                            image =
-                                    ExceptionUtils.handleOomRendering(
-                                            pageIndex + 1,
-                                            renderDpi,
-                                            () ->
-                                                    pdfRenderer.renderImageWithDPI(
-                                                            pageIndex, renderDpi, ImageType.RGB));
-
-                            PDPage page = new PDPage();
-                            page.setMediaBox(document.getPage(i).getMediaBox());
-                            newDocument.addPage(page);
-                            // resetContext=true: Ensure clean graphics state when overwriting.
-                            try (PDPageContentStream contentStream =
-                                    new PDPageContentStream(
-                                            newDocument,
-                                            page,
-                                            PDPageContentStream.AppendMode.OVERWRITE,
-                                            true,
-                                            true)) {
-                                PDImageXObject pdImage =
-                                        JPEGFactory.createFromImage(newDocument, image);
-                                float pageWidth = page.getMediaBox().getWidth();
-                                float pageHeight = page.getMediaBox().getHeight();
-
-                                contentStream.drawImage(pdImage, 0, 0, pageWidth, pageHeight);
-                            }
-                        } catch (ExceptionUtils.OutOfMemoryDpiException e) {
-                            // Re-throw OutOfMemoryDpiException to be handled by
-                            // GlobalExceptionHandler
-                            throw e;
-                        } catch (IOException e) {
-                            log.error("IOException during page processing: ", e);
-                            // Continue processing other pages
-                        } catch (OutOfMemoryError e) {
-                            // Catch any OutOfMemoryError that escaped the inner try block
-                            throw ExceptionUtils.createOutOfMemoryDpiException(i + 1, renderDpi, e);
-                        } finally {
-                            // Help GC by clearing the image reference
-                            image = null;
-                        }
-                    }
-                    return WebResponseUtils.pdfDocToWebResponse(
-                            newDocument, Filenames.toSimpleFileName(file.getOriginalFilename()));
+                } catch (ExceptionUtils.OutOfMemoryDpiException e) {
+                    // Re-throw OutOfMemoryDpiException to be handled by GlobalExceptionHandler
+                    newDocument.close();
+                    document.close();
+                    throw e;
+                } catch (IOException e) {
+                    log.error("IOException during page processing: ", e);
+                    // Continue processing other pages
+                } catch (OutOfMemoryError e) {
+                    // Catch any OutOfMemoryError that escaped the inner try block
+                    newDocument.close();
+                    document.close();
+                    throw ExceptionUtils.createOutOfMemoryDpiException(i + 1, renderDpi, e);
+                } finally {
+                    // Help GC by clearing the image reference
+                    image = null;
                }
            }
+            return WebResponseUtils.pdfDocToWebResponse(
+                    newDocument, Filenames.toSimpleFileName(file.getOriginalFilename()));
        }
    }
 }
@@ -84,102 +84,93 @@ public class MetadataController {
        if (allRequestParams == null) {
            allRequestParams = new java.util.HashMap<String, String>();
        }
-        // Load the PDF file into a PDDocument with proper resource management
-        try (PDDocument document = pdfDocumentFactory.load(pdfFile, true)) {
+        // Load the PDF file into a PDDocument
+        PDDocument document = pdfDocumentFactory.load(pdfFile, true);

-            // Get the document information from the PDF
-            PDDocumentInformation info = document.getDocumentInformation();
+        // Get the document information from the PDF
+        PDDocumentInformation info = document.getDocumentInformation();

-            // Check if each metadata value is "undefined" and set it to null if it is
-            author = checkUndefined(author);
-            creationDate = checkUndefined(creationDate);
-            creator = checkUndefined(creator);
-            keywords = checkUndefined(keywords);
-            modificationDate = checkUndefined(modificationDate);
-            producer = checkUndefined(producer);
-            subject = checkUndefined(subject);
-            title = checkUndefined(title);
-            trapped = checkUndefined(trapped);
+        // Check if each metadata value is "undefined" and set it to null if it is
+        author = checkUndefined(author);
+        creationDate = checkUndefined(creationDate);
+        creator = checkUndefined(creator);
+        keywords = checkUndefined(keywords);
+        modificationDate = checkUndefined(modificationDate);
+        producer = checkUndefined(producer);
+        subject = checkUndefined(subject);
+        title = checkUndefined(title);
+        trapped = checkUndefined(trapped);

-            // If the "deleteAll" flag is set, remove all metadata from the document
-            // information
-            if (deleteAll) {
-                for (String key : info.getMetadataKeys()) {
-                    info.setCustomMetadataValue(key, null);
-                }
-                // Remove metadata from the PDF history
-                document.getDocumentCatalog()
-                        .getCOSObject()
-                        .removeItem(COSName.getPDFName("Metadata"));
-                document.getDocumentCatalog()
-                        .getCOSObject()
-                        .removeItem(COSName.getPDFName("PieceInfo"));
-                author = null;
-                creationDate = null;
-                creator = null;
-                keywords = null;
-                modificationDate = null;
-                producer = null;
-                subject = null;
-                title = null;
-                trapped = null;
-            } else {
-                // Iterate through the request parameters and set the metadata values
-                for (Entry<String, String> entry : allRequestParams.entrySet()) {
-                    String key = entry.getKey();
-                    // Check if the key is a standard metadata key
-                    if (!"Author".equalsIgnoreCase(key)
-                            && !"CreationDate".equalsIgnoreCase(key)
-                            && !"Creator".equalsIgnoreCase(key)
-                            && !"Keywords".equalsIgnoreCase(key)
-                            && !"modificationDate".equalsIgnoreCase(key)
-                            && !"Producer".equalsIgnoreCase(key)
-                            && !"Subject".equalsIgnoreCase(key)
-                            && !"Title".equalsIgnoreCase(key)
-                            && !"Trapped".equalsIgnoreCase(key)
-                            && !key.contains("customKey")
-                            && !key.contains("customValue")) {
-                        info.setCustomMetadataValue(key, entry.getValue());
-                    } else if (key.contains("customKey")) {
-                        try {
-                            int number =
-                                    Integer.parseInt(
-                                            RegexPatternUtils.getInstance()
-                                                    .getNumericExtractionPattern()
-                                                    .matcher(key)
-                                                    .replaceAll(""));
-                            String customKey = entry.getValue();
-                            String customValue = allRequestParams.get("customValue" + number);
-                            info.setCustomMetadataValue(customKey, customValue);
-                        } catch (NumberFormatException e) {
-                            // Skip invalid custom key entries that don't have valid numeric
-                            // suffixes
-                            log.warn("Skipping invalid custom key '{}': {}", key, e.getMessage());
-                        }
-                    }
+        // If the "deleteAll" flag is set, remove all metadata from the document
+        // information
+        if (deleteAll) {
+            for (String key : info.getMetadataKeys()) {
+                info.setCustomMetadataValue(key, null);
+            }
+            // Remove metadata from the PDF history
+            document.getDocumentCatalog().getCOSObject().removeItem(COSName.getPDFName("Metadata"));
+            document.getDocumentCatalog()
+                    .getCOSObject()
+                    .removeItem(COSName.getPDFName("PieceInfo"));
+            author = null;
+            creationDate = null;
+            creator = null;
+            keywords = null;
+            modificationDate = null;
+            producer = null;
+            subject = null;
+            title = null;
+            trapped = null;
+        } else {
+            // Iterate through the request parameters and set the metadata values
+            for (Entry<String, String> entry : allRequestParams.entrySet()) {
+                String key = entry.getKey();
+                // Check if the key is a standard metadata key
+                if (!"Author".equalsIgnoreCase(key)
+                        && !"CreationDate".equalsIgnoreCase(key)
+                        && !"Creator".equalsIgnoreCase(key)
+                        && !"Keywords".equalsIgnoreCase(key)
+                        && !"modificationDate".equalsIgnoreCase(key)
+                        && !"Producer".equalsIgnoreCase(key)
+                        && !"Subject".equalsIgnoreCase(key)
+                        && !"Title".equalsIgnoreCase(key)
+                        && !"Trapped".equalsIgnoreCase(key)
+                        && !key.contains("customKey")
+                        && !key.contains("customValue")) {
+                    info.setCustomMetadataValue(key, entry.getValue());
+                } else if (key.contains("customKey")) {
+                    int number =
+                            Integer.parseInt(
+                                    RegexPatternUtils.getInstance()
+                                            .getNumericExtractionPattern()
+                                            .matcher(key)
+                                            .replaceAll(""));
+                    String customKey = entry.getValue();
+                    String customValue = allRequestParams.get("customValue" + number);
+                    info.setCustomMetadataValue(customKey, customValue);
                }
            }
-            // Set creation date using utility method
-            Calendar creationDateCal = PdfMetadataService.parseToCalendar(creationDate);
-            info.setCreationDate(creationDateCal);
-
-            // Set modification date using utility method
-            Calendar modificationDateCal = PdfMetadataService.parseToCalendar(modificationDate);
-            info.setModificationDate(modificationDateCal);
-            info.setCreator(creator);
-            info.setKeywords(keywords);
-            info.setAuthor(author);
-            info.setProducer(producer);
-            info.setSubject(subject);
-            info.setTitle(title);
-            info.setTrapped(trapped);
-
-            document.setDocumentInformation(info);
-            return WebResponseUtils.pdfDocToWebResponse(
-                    document,
-                    GeneralUtils.removeExtension(
-                                    Filenames.toSimpleFileName(pdfFile.getOriginalFilename()))
-                            + "_metadata.pdf");
        }
+        // Set creation date using utility method
+        Calendar creationDateCal = PdfMetadataService.parseToCalendar(creationDate);
+        info.setCreationDate(creationDateCal);
+
+        // Set modification date using utility method
+        Calendar modificationDateCal = PdfMetadataService.parseToCalendar(modificationDate);
+        info.setModificationDate(modificationDateCal);
+        info.setCreator(creator);
+        info.setKeywords(keywords);
+        info.setAuthor(author);
+        info.setProducer(producer);
+        info.setSubject(subject);
+        info.setTitle(title);
+        info.setTrapped(trapped);
+
+        document.setDocumentInformation(info);
+        return WebResponseUtils.pdfDocToWebResponse(
+                document,
+                GeneralUtils.removeExtension(
+                                Filenames.toSimpleFileName(pdfFile.getOriginalFilename()))
+                        + "_metadata.pdf");
    }
 }
@@ -15,7 +15,6 @@ import java.util.zip.ZipOutputStream;

 import javax.imageio.ImageIO;

-import org.apache.pdfbox.io.IOUtils;
 import org.apache.pdfbox.multipdf.PDFMergerUtility;
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
@@ -327,8 +326,6 @@ public class OCRController {

            try (PDDocument document = pdfDocumentFactory.load(tempInputFile.toFile())) {
                PDFRenderer pdfRenderer = new PDFRenderer(document);
-                pdfRenderer.setSubsamplingAllowed(
-                        true); // Enable subsampling to reduce memory usage
                int pageCount = document.getNumberOfPages();

                for (int pageNum = 0; pageNum < pageCount; pageNum++) {
@@ -418,7 +415,7 @@ public class OCRController {
            }

            // Merge all pages into final PDF
-            merger.mergeDocuments(IOUtils.createTempFileOnlyStreamCache());
+            merger.mergeDocuments(null);

            // Copy final output to the expected location
            Files.copy(
@@ -65,114 +65,113 @@ public class PageNumbersController {
            }
        }

-        try (PDDocument document = pdfDocumentFactory.load(file)) {
-            float marginFactor =
-                    switch (customMargin == null ? "" : customMargin.toLowerCase(Locale.ROOT)) {
-                        case "small" -> 0.02f;
-                        case "large" -> 0.05f;
-                        case "x-large" -> 0.075f;
-                        case "medium" -> 0.035f;
-                        default -> 0.035f;
+        PDDocument document = pdfDocumentFactory.load(file);
+
+        float marginFactor =
+                switch (customMargin == null ? "" : customMargin.toLowerCase(Locale.ROOT)) {
+                    case "small" -> 0.02f;
+                    case "large" -> 0.05f;
+                    case "x-large" -> 0.075f;
+                    case "medium" -> 0.035f;
+                    default -> 0.035f;
+                };
+
+        if (pagesToNumber == null || pagesToNumber.isEmpty()) {
+            pagesToNumber = "all";
+        }
+        if (customText == null || customText.isEmpty()) {
+            customText = "{n}";
+        }
+
+        final String baseFilename =
+                Filenames.toSimpleFileName(file.getOriginalFilename())
+                        .replaceFirst("[.][^.]+$", "");
+
+        List<Integer> pagesToNumberList =
+                GeneralUtils.parsePageList(pagesToNumber.split(","), document.getNumberOfPages());
+
+        // Clamp position to 1..9 (1 = top-left, 9 = bottom-right)
+        int pos = Math.max(1, Math.min(9, position));
+
+        for (int i : pagesToNumberList) {
+            PDPage page = document.getPage(i);
+            PDRectangle pageSize = page.getMediaBox();
+
+            String text =
+                    customText
+                            .replace("{n}", String.valueOf(pageNumber))
+                            .replace("{total}", String.valueOf(document.getNumberOfPages()))
+                            .replace(
+                                    "{filename}",
+                                    GeneralUtils.removeExtension(
+                                            Filenames.toSimpleFileName(
+                                                    file.getOriginalFilename())));
+
+            PDType1Font currentFont =
+                    switch (fontType == null ? "" : fontType.toLowerCase(Locale.ROOT)) {
+                        case "courier" -> new PDType1Font(Standard14Fonts.FontName.COURIER);
+                        case "times" -> new PDType1Font(Standard14Fonts.FontName.TIMES_ROMAN);
+                        default -> new PDType1Font(Standard14Fonts.FontName.HELVETICA);
                    };

-            if (pagesToNumber == null || pagesToNumber.isEmpty()) {
-                pagesToNumber = "all";
-            }
-            if (customText == null || customText.isEmpty()) {
-                customText = "{n}";
+            // Text dimensions and font metrics
+            float textWidth = currentFont.getStringWidth(text) / 1000f * fontSize;
+            float ascent = currentFont.getFontDescriptor().getAscent() / 1000f * fontSize;
+            float descent = currentFont.getFontDescriptor().getDescent() / 1000f * fontSize;
+
+            // Derive column/row in range 1..3 (1 = left/top, 2 = center/middle, 3 = right/bottom)
+            int col = ((pos - 1) % 3) + 1; // 1 = left, 2 = center, 3 = right
+            int row = ((pos - 1) / 3) + 1; // 1 = top, 2 = middle, 3 = bottom
+
+            // Anchor coordinates with margin
+            float leftX = pageSize.getLowerLeftX() + marginFactor * pageSize.getWidth();
+            float midX = pageSize.getLowerLeftX() + pageSize.getWidth() / 2f;
+            float rightX = pageSize.getUpperRightX() - marginFactor * pageSize.getWidth();
+
+            float botY = pageSize.getLowerLeftY() + marginFactor * pageSize.getHeight();
+            float midY = pageSize.getLowerLeftY() + pageSize.getHeight() / 2f;
+            float topY = pageSize.getUpperRightY() - marginFactor * pageSize.getHeight();
+
+            // Horizontal alignment: left = anchor, center = centered, right = right-aligned
+            float x =
+                    switch (col) {
+                        case 1 -> leftX;
+                        case 2 -> midX - textWidth / 2f;
+                        default -> rightX - textWidth;
+                    };
+
+            // Vertical alignment (baseline!):
+            // top    = align text top at topY,
+            // middle = optical middle using ascent/descent,
+            // bottom = baseline at botY
+            float y =
+                    switch (row) {
+                        case 1 -> topY - ascent;
+                        case 2 -> midY - (ascent + descent) / 2f;
+                        default -> botY;
+                    };
+
+            try (PDPageContentStream contentStream =
+                    new PDPageContentStream(
+                            document, page, PDPageContentStream.AppendMode.APPEND, true, true)) {
+                contentStream.beginText();
+                contentStream.setFont(currentFont, fontSize);
+                contentStream.setNonStrokingColor(color);
+                contentStream.newLineAtOffset(x, y);
+                contentStream.showText(text);
+                contentStream.endText();
            }

-            List<Integer> pagesToNumberList =
-                    GeneralUtils.parsePageList(
-                            pagesToNumber.split(","), document.getNumberOfPages());
-
-            // Clamp position to 1..9 (1 = top-left, 9 = bottom-right)
-            int pos = Math.max(1, Math.min(9, position));
-
-            for (int i : pagesToNumberList) {
-                PDPage page = document.getPage(i);
-                PDRectangle pageSize = page.getMediaBox();
-
-                String text =
-                        customText
-                                .replace("{n}", String.valueOf(pageNumber))
-                                .replace("{total}", String.valueOf(document.getNumberOfPages()))
-                                .replace(
-                                        "{filename}",
-                                        GeneralUtils.removeExtension(
-                                                Filenames.toSimpleFileName(
-                                                        file.getOriginalFilename())));
-
-                PDType1Font currentFont =
-                        switch (fontType == null ? "" : fontType.toLowerCase(Locale.ROOT)) {
-                            case "courier" -> new PDType1Font(Standard14Fonts.FontName.COURIER);
-                            case "times" -> new PDType1Font(Standard14Fonts.FontName.TIMES_ROMAN);
-                            default -> new PDType1Font(Standard14Fonts.FontName.HELVETICA);
-                        };
-
-                // Text dimensions and font metrics
-                float textWidth = currentFont.getStringWidth(text) / 1000f * fontSize;
-                float ascent = currentFont.getFontDescriptor().getAscent() / 1000f * fontSize;
-                float descent = currentFont.getFontDescriptor().getDescent() / 1000f * fontSize;
-
-                // Derive column/row in range 1..3 (1 = left/top, 2 = center/middle, 3 =
-                // right/bottom)
-                int col = ((pos - 1) % 3) + 1; // 1 = left, 2 = center, 3 = right
-                int row = ((pos - 1) / 3) + 1; // 1 = top, 2 = middle, 3 = bottom
-
-                // Anchor coordinates with margin
-                float leftX = pageSize.getLowerLeftX() + marginFactor * pageSize.getWidth();
-                float midX = pageSize.getLowerLeftX() + pageSize.getWidth() / 2f;
-                float rightX = pageSize.getUpperRightX() - marginFactor * pageSize.getWidth();
-
-                float botY = pageSize.getLowerLeftY() + marginFactor * pageSize.getHeight();
-                float midY = pageSize.getLowerLeftY() + pageSize.getHeight() / 2f;
-                float topY = pageSize.getUpperRightY() - marginFactor * pageSize.getHeight();
-
-                // Horizontal alignment: left = anchor, center = centered, right = right-aligned
-                float x =
-                        switch (col) {
-                            case 1 -> leftX;
-                            case 2 -> midX - textWidth / 2f;
-                            default -> rightX - textWidth;
-                        };
-
-                // Vertical alignment (baseline!):
-                // top    = align text top at topY,
-                // middle = optical middle using ascent/descent,
-                // bottom = baseline at botY
-                float y =
-                        switch (row) {
-                            case 1 -> topY - ascent;
-                            case 2 -> midY - (ascent + descent) / 2f;
-                            default -> botY;
-                        };
-
-                try (PDPageContentStream contentStream =
-                        new PDPageContentStream(
-                                document,
-                                page,
-                                PDPageContentStream.AppendMode.APPEND,
-                                true,
-                                true)) {
-                    contentStream.beginText();
-                    contentStream.setFont(currentFont, fontSize);
-                    contentStream.setNonStrokingColor(color);
-                    contentStream.newLineAtOffset(x, y);
-                    contentStream.showText(text);
-                    contentStream.endText();
-                }
-
-                pageNumber++;
-            }
-
-            ByteArrayOutputStream baos = new ByteArrayOutputStream();
-            document.save(baos);
-
-            return WebResponseUtils.bytesToWebResponse(
-                    baos.toByteArray(),
-                    GeneralUtils.generateFilename(
-                            file.getOriginalFilename(), "_page_numbers_added.pdf"));
+            pageNumber++;
        }
+
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        document.save(baos);
+        document.close();
+
+        return WebResponseUtils.bytesToWebResponse(
+                baos.toByteArray(),
+                GeneralUtils.generateFilename(
+                        file.getOriginalFilename(), "_page_numbers_added.pdf"));
    }
 }
@@ -7,10 +7,7 @@ import java.awt.print.Printable;
 import java.awt.print.PrinterException;
 import java.awt.print.PrinterJob;
 import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
 import java.nio.file.Paths;
-import java.nio.file.StandardCopyOption;
 import java.util.Arrays;
 import java.util.Locale;

@@ -80,19 +77,11 @@ public class PrintFileController {
            log.info("Selected Printer: {}", selectedService.getName());

            if (MediaType.APPLICATION_PDF_VALUE.equals(contentType)) {
-                // Use Stream-to-File pattern: write to temp file first, then load from file
-                Path tempFile = Files.createTempFile("print-", ".pdf");
-                try {
-                    Files.copy(
-                            file.getInputStream(), tempFile, StandardCopyOption.REPLACE_EXISTING);
-                    try (PDDocument document = Loader.loadPDF(tempFile.toFile())) {
-                        PrinterJob job = PrinterJob.getPrinterJob();
-                        job.setPrintService(selectedService);
-                        job.setPageable(new PDFPageable(document));
-                        job.print();
-                    }
-                } finally {
-                    Files.deleteIfExists(tempFile);
+                try (PDDocument document = Loader.loadPDF(file.getBytes())) {
+                    PrinterJob job = PrinterJob.getPrinterJob();
+                    job.setPrintService(selectedService);
+                    job.setPageable(new PDFPageable(document));
+                    job.print();
                }
            } else if (contentType.startsWith("image/")) {
                try (var inputStream = file.getInputStream()) {
@@ -463,13 +463,7 @@ public class ScannerEffectController {
            PDPage newPage = new PDPage(new PDRectangle(page.origW, page.origH));
            document.addPage(newPage);

-            try (PDPageContentStream contentStream =
-                    new PDPageContentStream(
-                            document,
-                            newPage,
-                            PDPageContentStream.AppendMode.OVERWRITE,
-                            true,
-                            true)) {
+            try (PDPageContentStream contentStream = new PDPageContentStream(document, newPage)) {
                PDImageXObject pdImage = LosslessFactory.createFromImage(document, page.image);
                contentStream.drawImage(
                        pdImage, page.offsetX, page.offsetY, page.drawW, page.drawH);
@@ -134,65 +134,60 @@ public class StampController {
                };

        // Load the input PDF
-        try (PDDocument document = pdfDocumentFactory.load(pdfFile)) {
+        PDDocument document = pdfDocumentFactory.load(pdfFile);

-            List<Integer> pageNumbers = request.getPageNumbersList(document, true);
+        List<Integer> pageNumbers = request.getPageNumbersList(document, true);

-            for (int pageIndex : pageNumbers) {
-                int zeroBasedIndex = pageIndex - 1;
-                if (zeroBasedIndex >= 0 && zeroBasedIndex < document.getNumberOfPages()) {
-                    PDPage page = document.getPage(zeroBasedIndex);
-                    PDRectangle pageSize = page.getMediaBox();
-                    float margin = marginFactor * (pageSize.getWidth() + pageSize.getHeight()) / 2;
+        for (int pageIndex : pageNumbers) {
+            int zeroBasedIndex = pageIndex - 1;
+            if (zeroBasedIndex >= 0 && zeroBasedIndex < document.getNumberOfPages()) {
+                PDPage page = document.getPage(zeroBasedIndex);
+                PDRectangle pageSize = page.getMediaBox();
+                float margin = marginFactor * (pageSize.getWidth() + pageSize.getHeight()) / 2;

-                    PDPageContentStream contentStream =
-                            new PDPageContentStream(
-                                    document,
-                                    page,
-                                    PDPageContentStream.AppendMode.APPEND,
-                                    true,
-                                    true);
+                PDPageContentStream contentStream =
+                        new PDPageContentStream(
+                                document, page, PDPageContentStream.AppendMode.APPEND, true, true);

-                    PDExtendedGraphicsState graphicsState = new PDExtendedGraphicsState();
-                    graphicsState.setNonStrokingAlphaConstant(opacity);
-                    contentStream.setGraphicsStateParameters(graphicsState);
+                PDExtendedGraphicsState graphicsState = new PDExtendedGraphicsState();
+                graphicsState.setNonStrokingAlphaConstant(opacity);
+                contentStream.setGraphicsStateParameters(graphicsState);

-                    if ("text".equalsIgnoreCase(stampType)) {
-                        addTextStamp(
-                                contentStream,
-                                stampText,
-                                document,
-                                page,
-                                rotation,
-                                position,
-                                fontSize,
-                                alphabet,
-                                overrideX,
-                                overrideY,
-                                margin,
-                                customColor);
-                    } else if ("image".equalsIgnoreCase(stampType)) {
-                        addImageStamp(
-                                contentStream,
-                                stampImage,
-                                document,
-                                page,
-                                rotation,
-                                position,
-                                fontSize,
-                                overrideX,
-                                overrideY,
-                                margin);
-                    }
-
-                    contentStream.close();
+                if ("text".equalsIgnoreCase(stampType)) {
+                    addTextStamp(
+                            contentStream,
+                            stampText,
+                            document,
+                            page,
+                            rotation,
+                            position,
+                            fontSize,
+                            alphabet,
+                            overrideX,
+                            overrideY,
+                            margin,
+                            customColor);
+                } else if ("image".equalsIgnoreCase(stampType)) {
+                    addImageStamp(
+                            contentStream,
+                            stampImage,
+                            document,
+                            page,
+                            rotation,
+                            position,
+                            fontSize,
+                            overrideX,
+                            overrideY,
+                            margin);
                }
+
+                contentStream.close();
            }
-            // Return the stamped PDF as a response
-            return WebResponseUtils.pdfDocToWebResponse(
-                    document,
-                    GeneralUtils.generateFilename(pdfFile.getOriginalFilename(), "_stamped.pdf"));
        }
+        // Return the stamped PDF as a response
+        return WebResponseUtils.pdfDocToWebResponse(
+                document,
+                GeneralUtils.generateFilename(pdfFile.getOriginalFilename(), "_stamped.pdf"));
    }

    private void addTextStamp(
@@ -139,12 +139,11 @@ public class CertSignController {
                    signatureOptions.setPage(pageNumber);

                    doc.addSignature(signature, instance, signatureOptions);
-                    doc.saveIncremental(output);
                }
            } else {
                doc.addSignature(signature, instance);
-                doc.saveIncremental(output);
            }
+            doc.saveIncremental(output);
        } catch (Exception e) {
            ExceptionUtils.logException("PDF signing", e);
        }
@@ -3,8 +3,6 @@ package stirling.software.SPDF.controller.api.security;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
 import java.time.Instant;
 import java.time.ZoneId;
 import java.time.ZonedDateTime;
@@ -16,8 +14,7 @@ import java.util.regex.Pattern;
 import org.apache.pdfbox.cos.COSInputStream;
 import org.apache.pdfbox.cos.COSName;
 import org.apache.pdfbox.cos.COSString;
-import org.apache.pdfbox.io.RandomAccessRead;
-import org.apache.pdfbox.io.RandomAccessReadBufferedFile;
+import org.apache.pdfbox.io.RandomAccessReadBuffer;
 import org.apache.pdfbox.pdmodel.*;
 import org.apache.pdfbox.pdmodel.common.PDMetadata;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
@@ -201,20 +198,10 @@ public class GetInfoOnPDF {
            return false;
        }

-        // Use Stream-to-File pattern: save to temp file instead of loading into memory
-        // This prevents OutOfMemoryError on large PDFs
-        Path tempFile = null;
-        try {
-            tempFile = Files.createTempFile("preflight-", ".pdf");
+        try (ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
+            document.save(baos);

-            // Save document to temp file (avoids loading entire document into memory)
-            try (var outputStream = Files.newOutputStream(tempFile)) {
-                document.save(outputStream);
-            }
-
-            // Use RandomAccessReadBufferedFile for efficient file-based reading
-            // This avoids Windows file locking issues that occur with memory-mapped files
-            try (RandomAccessRead source = new RandomAccessReadBufferedFile(tempFile.toFile())) {
+            try (RandomAccessReadBuffer source = new RandomAccessReadBuffer(baos.toByteArray())) {
                PreflightParser parser = new PreflightParser(source);

                try (PDDocument parsedDocument = parser.parse()) {
@@ -256,19 +243,6 @@ public class GetInfoOnPDF {
            log.debug("IOException during PDF/A validation: {}", e.getMessage());
        } catch (Exception e) {
            log.debug("Unexpected error during PDF/A validation: {}", e.getMessage());
-        } finally {
-            // Explicitly clean up temp file to prevent disk exhaustion
-            // This must be in finally block to ensure cleanup even on exceptions
-            if (tempFile != null) {
-                try {
-                    Files.deleteIfExists(tempFile);
-                } catch (IOException e) {
-                    log.warn(
-                            "Failed to delete temp file during PDF/A validation cleanup: {}",
-                            tempFile,
-                            e);
-                }
-            }
        }

        return false;
@@ -42,17 +42,25 @@ public class PasswordController {
        MultipartFile fileInput = request.getFileInput();
        String password = request.getPassword();

-        try (PDDocument document = pdfDocumentFactory.load(fileInput, password)) {
+        PDDocument document;
+        try {
+            document = pdfDocumentFactory.load(fileInput, password);
+        } catch (IOException e) {
+            // Handle password errors specifically
+            if (ExceptionUtils.isPasswordError(e)) {
+                throw ExceptionUtils.createPdfPasswordException(e);
+            }
+            throw ExceptionUtils.handlePdfException(e);
+        }
+
+        try {
            document.setAllSecurityToBeRemoved(true);
            return WebResponseUtils.pdfDocToWebResponse(
                    document,
                    GeneralUtils.generateFilename(
                            fileInput.getOriginalFilename(), "_password_removed.pdf"));
        } catch (IOException e) {
-            // Handle password errors specifically
-            if (ExceptionUtils.isPasswordError(e)) {
-                throw ExceptionUtils.createPdfPasswordException(e);
-            }
+            document.close();
            ExceptionUtils.logException("password removal", e);
            throw ExceptionUtils.handlePdfException(e);
        }
@@ -83,36 +91,31 @@ public class PasswordController {
        boolean preventPrinting = Boolean.TRUE.equals(request.getPreventPrinting());
        boolean preventPrintingFaithful = Boolean.TRUE.equals(request.getPreventPrintingFaithful());

-        try (PDDocument document = pdfDocumentFactory.load(fileInput)) {
-            AccessPermission ap = new AccessPermission();
-            ap.setCanAssembleDocument(!preventAssembly);
-            ap.setCanExtractContent(!preventExtractContent);
-            ap.setCanExtractForAccessibility(!preventExtractForAccessibility);
-            ap.setCanFillInForm(!preventFillInForm);
-            ap.setCanModify(!preventModify);
-            ap.setCanModifyAnnotations(!preventModifyAnnotations);
-            ap.setCanPrint(!preventPrinting);
-            ap.setCanPrintFaithful(!preventPrintingFaithful);
-            StandardProtectionPolicy spp =
-                    new StandardProtectionPolicy(ownerPassword, password, ap);
+        PDDocument document = pdfDocumentFactory.load(fileInput);
+        AccessPermission ap = new AccessPermission();
+        ap.setCanAssembleDocument(!preventAssembly);
+        ap.setCanExtractContent(!preventExtractContent);
+        ap.setCanExtractForAccessibility(!preventExtractForAccessibility);
+        ap.setCanFillInForm(!preventFillInForm);
+        ap.setCanModify(!preventModify);
+        ap.setCanModifyAnnotations(!preventModifyAnnotations);
+        ap.setCanPrint(!preventPrinting);
+        ap.setCanPrintFaithful(!preventPrintingFaithful);
+        StandardProtectionPolicy spp = new StandardProtectionPolicy(ownerPassword, password, ap);

-            if ((ownerPassword != null && ownerPassword.length() > 0)
-                    || (password != null && password.length() > 0)) {
-                spp.setEncryptionKeyLength(keyLength);
-            }
-            spp.setPermissions(ap);
-            document.protect(spp);
+        if (!"".equals(ownerPassword) || !"".equals(password)) {
+            spp.setEncryptionKeyLength(keyLength);
+        }
+        spp.setPermissions(ap);
+        document.protect(spp);

-            if ((ownerPassword == null || ownerPassword.length() == 0)
-                    && (password == null || password.length() == 0))
-                return WebResponseUtils.pdfDocToWebResponse(
-                        document,
-                        GeneralUtils.generateFilename(
-                                fileInput.getOriginalFilename(), "_permissions.pdf"));
+        if ("".equals(ownerPassword) && "".equals(password))
            return WebResponseUtils.pdfDocToWebResponse(
                    document,
                    GeneralUtils.generateFilename(
-                            fileInput.getOriginalFilename(), "_passworded.pdf"));
-        }
+                            fileInput.getOriginalFilename(), "_permissions.pdf"));
+        return WebResponseUtils.pdfDocToWebResponse(
+                document,
+                GeneralUtils.generateFilename(fileInput.getOriginalFilename(), "_passworded.pdf"));
    }
 }
@@ -41,29 +41,28 @@ public class RemoveCertSignController {
            throws Exception {
        MultipartFile pdf = request.getFileInput();

-        // Load the PDF document with proper resource management
-        try (PDDocument document = pdfDocumentFactory.load(pdf)) {
+        // Load the PDF document
+        PDDocument document = pdfDocumentFactory.load(pdf);

-            // Get the document catalog
-            PDDocumentCatalog catalog = document.getDocumentCatalog();
+        // Get the document catalog
+        PDDocumentCatalog catalog = document.getDocumentCatalog();

-            // Get the AcroForm
-            PDAcroForm acroForm = catalog.getAcroForm();
-            if (acroForm != null) {
-                // Remove signature fields safely
-                List<PDField> fieldsToRemove =
-                        acroForm.getFields().stream()
-                                .filter(field -> field instanceof PDSignatureField)
-                                .toList();
+        // Get the AcroForm
+        PDAcroForm acroForm = catalog.getAcroForm();
+        if (acroForm != null) {
+            // Remove signature fields safely
+            List<PDField> fieldsToRemove =
+                    acroForm.getFields().stream()
+                            .filter(field -> field instanceof PDSignatureField)
+                            .toList();

-                if (!fieldsToRemove.isEmpty()) {
-                    acroForm.flatten(fieldsToRemove, false);
-                }
+            if (!fieldsToRemove.isEmpty()) {
+                acroForm.flatten(fieldsToRemove, false);
            }
-            // Return the modified PDF as a response
-            return WebResponseUtils.pdfDocToWebResponse(
-                    document,
-                    GeneralUtils.generateFilename(pdf.getOriginalFilename(), "_unsigned.pdf"));
        }
+        // Return the modified PDF as a response
+        return WebResponseUtils.pdfDocToWebResponse(
+                document,
+                GeneralUtils.generateFilename(pdf.getOriginalFilename(), "_unsigned.pdf"));
    }
 }
@@ -67,40 +67,39 @@ public class SanitizeController {
        boolean removeLinks = Boolean.TRUE.equals(request.getRemoveLinks());
        boolean removeFonts = Boolean.TRUE.equals(request.getRemoveFonts());

-        try (PDDocument document = pdfDocumentFactory.load(inputFile, true)) {
-            if (removeJavaScript) {
-                sanitizeJavaScript(document);
-            }
-
-            if (removeEmbeddedFiles) {
-                sanitizeEmbeddedFiles(document);
-            }
-
-            if (removeXMPMetadata) {
-                sanitizeXMPMetadata(document);
-            }
-
-            if (removeMetadata) {
-                sanitizeDocumentInfoMetadata(document);
-            }
-
-            if (removeLinks) {
-                sanitizeLinks(document);
-            }
-
-            if (removeFonts) {
-                sanitizeFonts(document);
-            }
-
-            // Save the sanitized document to output stream
-            ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
-            document.save(outputStream);
-
-            return WebResponseUtils.bytesToWebResponse(
-                    outputStream.toByteArray(),
-                    GeneralUtils.generateFilename(
-                            inputFile.getOriginalFilename(), "_sanitized.pdf"));
+        PDDocument document = pdfDocumentFactory.load(inputFile, true);
+        if (removeJavaScript) {
+            sanitizeJavaScript(document);
        }
+
+        if (removeEmbeddedFiles) {
+            sanitizeEmbeddedFiles(document);
+        }
+
+        if (removeXMPMetadata) {
+            sanitizeXMPMetadata(document);
+        }
+
+        if (removeMetadata) {
+            sanitizeDocumentInfoMetadata(document);
+        }
+
+        if (removeLinks) {
+            sanitizeLinks(document);
+        }
+
+        if (removeFonts) {
+            sanitizeFonts(document);
+        }
+
+        // Save the sanitized document to output stream
+        ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
+        document.save(outputStream);
+        document.close();
+
+        return WebResponseUtils.bytesToWebResponse(
+                outputStream.toByteArray(),
+                GeneralUtils.generateFilename(inputFile.getOriginalFilename(), "_sanitized.pdf"));
    }

    private static void sanitizeJavaScript(PDDocument document) throws IOException {
@@ -98,67 +98,60 @@ public class WatermarkController {
        String customColor = request.getCustomColor();
        boolean convertPdfToImage = Boolean.TRUE.equals(request.getConvertPDFToImage());

-        // Load the input PDF with proper resource management
-        try (PDDocument document = pdfDocumentFactory.load(pdfFile)) {
+        // Load the input PDF
+        PDDocument document = pdfDocumentFactory.load(pdfFile);

-            // Create a page in the document
-            for (PDPage page : document.getPages()) {
-                // Get the page's content stream
-                try (PDPageContentStream contentStream =
-                        new PDPageContentStream(
-                                document,
-                                page,
-                                PDPageContentStream.AppendMode.APPEND,
-                                true,
-                                true)) {
+        // Create a page in the document
+        for (PDPage page : document.getPages()) {

-                    // Set transparency
-                    PDExtendedGraphicsState graphicsState = new PDExtendedGraphicsState();
-                    graphicsState.setNonStrokingAlphaConstant(opacity);
-                    contentStream.setGraphicsStateParameters(graphicsState);
+            // Get the page's content stream
+            PDPageContentStream contentStream =
+                    new PDPageContentStream(
+                            document, page, PDPageContentStream.AppendMode.APPEND, true, true);

-                    if ("text".equalsIgnoreCase(watermarkType)) {
-                        addTextWatermark(
-                                contentStream,
-                                watermarkText,
-                                document,
-                                page,
-                                rotation,
-                                widthSpacer,
-                                heightSpacer,
-                                fontSize,
-                                alphabet,
-                                customColor);
-                    } else if ("image".equalsIgnoreCase(watermarkType)) {
-                        addImageWatermark(
-                                contentStream,
-                                watermarkImage,
-                                document,
-                                page,
-                                rotation,
-                                widthSpacer,
-                                heightSpacer,
-                                fontSize);
-                    }
-                }
-            }
+            // Set transparency
+            PDExtendedGraphicsState graphicsState = new PDExtendedGraphicsState();
+            graphicsState.setNonStrokingAlphaConstant(opacity);
+            contentStream.setGraphicsStateParameters(graphicsState);

-            if (convertPdfToImage) {
-                try (PDDocument convertedPdf = PdfUtils.convertPdfToPdfImage(document)) {
-                    // Return the watermarked PDF as a response
-                    return WebResponseUtils.pdfDocToWebResponse(
-                            convertedPdf,
-                            GeneralUtils.generateFilename(
-                                    pdfFile.getOriginalFilename(), "_watermarked.pdf"));
-                }
-            } else {
-                // Return the watermarked PDF as a response
-                return WebResponseUtils.pdfDocToWebResponse(
+            if ("text".equalsIgnoreCase(watermarkType)) {
+                addTextWatermark(
+                        contentStream,
+                        watermarkText,
                        document,
-                        GeneralUtils.generateFilename(
-                                pdfFile.getOriginalFilename(), "_watermarked.pdf"));
+                        page,
+                        rotation,
+                        widthSpacer,
+                        heightSpacer,
+                        fontSize,
+                        alphabet,
+                        customColor);
+            } else if ("image".equalsIgnoreCase(watermarkType)) {
+                addImageWatermark(
+                        contentStream,
+                        watermarkImage,
+                        document,
+                        page,
+                        rotation,
+                        widthSpacer,
+                        heightSpacer,
+                        fontSize);
            }
+
+            // Close the content stream
+            contentStream.close();
        }
+
+        if (convertPdfToImage) {
+            PDDocument convertedPdf = PdfUtils.convertPdfToPdfImage(document);
+            document.close();
+            document = convertedPdf;
+        }
+
+        // Return the watermarked PDF as a response
+        return WebResponseUtils.pdfDocToWebResponse(
+                document,
+                GeneralUtils.generateFilename(pdfFile.getOriginalFilename(), "_watermarked.pdf"));
    }

    private void addTextWatermark(
@@ -15,106 +15,84 @@ import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.util.HtmlUtils;
-import org.springframework.web.util.JavaScriptUtils;

 import jakarta.annotation.PostConstruct;
 import jakarta.servlet.http.HttpServletRequest;

+import lombok.extern.slf4j.Slf4j;
+
 import stirling.software.common.configuration.InstallationPathConfig;

+@Slf4j
@Controller
 public class ReactRoutingController {

-    private static final org.slf4j.Logger log =
-            org.slf4j.LoggerFactory.getLogger(ReactRoutingController.class);
-
    @Value("${server.servlet.context-path:/}")
    private String contextPath;

    private String cachedIndexHtml;
-    private String cachedCallbackHtml;
    private boolean indexHtmlExists = false;
    private boolean useExternalIndexHtml = false;
-    private boolean loggedMissingIndex = false;

    @PostConstruct
    public void init() {
        log.info("Static files custom path: {}", InstallationPathConfig.getStaticPath());

-        // Always initialize callback HTML (used for OAuth desktop flow)
-        this.cachedCallbackHtml = buildCallbackHtml();
-
        // Check for external index.html first (customFiles/static/)
        Path externalIndexPath = Paths.get(InstallationPathConfig.getStaticPath(), "index.html");
        log.debug("Checking for custom index.html at: {}", externalIndexPath);
        if (Files.exists(externalIndexPath) && Files.isReadable(externalIndexPath)) {
            log.info("Using custom index.html from: {}", externalIndexPath);
-            this.cachedIndexHtml = processIndexHtml();
-            this.indexHtmlExists = true;
-            this.useExternalIndexHtml = true;
-            return;
+            try {
+                this.cachedIndexHtml = processIndexHtml();
+                this.indexHtmlExists = true;
+                this.useExternalIndexHtml = true;
+                return;
+            } catch (IOException e) {
+                log.warn("Failed to load custom index.html, falling back to classpath", e);
+            }
        }

        // Fall back to classpath index.html
        ClassPathResource resource = new ClassPathResource("static/index.html");
        if (resource.exists()) {
-            this.cachedIndexHtml = processIndexHtml();
-            this.indexHtmlExists = true;
-            this.useExternalIndexHtml = false;
-            return;
-        }
-
-        // Neither external nor classpath index.html exists - cache fallback once
-        this.cachedIndexHtml = buildFallbackHtml();
-        this.indexHtmlExists = true;
-        this.useExternalIndexHtml = false;
-        this.loggedMissingIndex = true;
-        log.warn(
-                "index.html not found in classpath or custom path; using lightweight fallback page");
-    }
-
-    private String processIndexHtml() {
-        try {
-            Resource resource = getIndexHtmlResource();
-
-            if (!resource.exists()) {
-                if (!loggedMissingIndex) {
-                    log.warn("index.html not found, using lightweight fallback page");
-                    loggedMissingIndex = true;
-                }
-                return buildFallbackHtml();
+            try {
+                this.cachedIndexHtml = processIndexHtml();
+                this.indexHtmlExists = true;
+                this.useExternalIndexHtml = false;
+            } catch (IOException e) {
+                // Failed to cache, will process on each request
+                log.warn("Failed to cache index.html", e);
+                this.indexHtmlExists = false;
            }
-
-            try (InputStream inputStream = resource.getInputStream()) {
-                String html = new String(inputStream.readAllBytes(), StandardCharsets.UTF_8);
-
-                // Replace %BASE_URL% with the actual context path for base href
-                String baseUrl = contextPath.endsWith("/") ? contextPath : contextPath + "/";
-                html = html.replace("%BASE_URL%", baseUrl);
-                // Also rewrite any existing <base> tag (Vite may have baked one in)
-                html =
-                        html.replaceFirst(
-                                "<base href=\\\"[^\\\"]*\\\"\\s*/?>",
-                                "<base href=\\\"" + baseUrl + "\\\" />");
-
-                // Inject context path as a global variable for API calls
-                String contextPathScript =
-                        "<script>window.STIRLING_PDF_API_BASE_URL = '" + baseUrl + "';</script>";
-                html = html.replace("</head>", contextPathScript + "</head>");
-
-                return html;
-            }
-        } catch (Exception ex) {
-            if (!loggedMissingIndex) {
-                log.warn("index.html not found, using lightweight fallback page", ex);
-                loggedMissingIndex = true;
-            }
-            return buildFallbackHtml();
        }
    }

-    private Resource getIndexHtmlResource() {
+    private String processIndexHtml() throws IOException {
+        Resource resource = getIndexHtmlResource();
+
+        try (InputStream inputStream = resource.getInputStream()) {
+            String html = new String(inputStream.readAllBytes(), StandardCharsets.UTF_8);
+
+            // Replace %BASE_URL% with the actual context path for base href
+            String baseUrl = contextPath.endsWith("/") ? contextPath : contextPath + "/";
+            html = html.replace("%BASE_URL%", baseUrl);
+            // Also rewrite any existing <base> tag (Vite may have baked one in)
+            html =
+                    html.replaceFirst(
+                            "<base href=\\\"[^\\\"]*\\\"\\s*/?>",
+                            "<base href=\\\"" + baseUrl + "\\\" />");
+
+            // Inject context path as a global variable for API calls
+            String contextPathScript =
+                    "<script>window.STIRLING_PDF_API_BASE_URL = '" + baseUrl + "';</script>";
+            html = html.replace("</head>", contextPathScript + "</head>");
+
+            return html;
+        }
+    }
+
+    private Resource getIndexHtmlResource() throws IOException {
        // Check external location first
        Path externalIndexPath = Paths.get(InstallationPathConfig.getStaticPath(), "index.html");
        if (Files.exists(externalIndexPath) && Files.isReadable(externalIndexPath)) {
@@ -128,28 +106,12 @@ public class ReactRoutingController {
    @GetMapping(
            value = {"/", "/index.html"},
            produces = MediaType.TEXT_HTML_VALUE)
-    public ResponseEntity<String> serveIndexHtml(HttpServletRequest request) {
-        try {
-            if (indexHtmlExists && cachedIndexHtml != null) {
-                return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(cachedIndexHtml);
-            }
-            // Fallback: process on each request (dev mode or cache failed)
-            return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(processIndexHtml());
-        } catch (Exception ex) {
-            log.error("Failed to serve index.html, returning fallback", ex);
-            return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(buildFallbackHtml());
+    public ResponseEntity<String> serveIndexHtml(HttpServletRequest request) throws IOException {
+        if (indexHtmlExists && cachedIndexHtml != null) {
+            return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(cachedIndexHtml);
        }
-    }
-
-    @GetMapping(value = "/auth/callback", produces = MediaType.TEXT_HTML_VALUE)
-    public ResponseEntity<String> serveAuthCallback(HttpServletRequest request) {
-        return serveIndexHtml(request);
-    }
-
-    @GetMapping(value = "/auth/callback/tauri", produces = MediaType.TEXT_HTML_VALUE)
-    public ResponseEntity<String> serveTauriAuthCallback(HttpServletRequest request) {
-        // cachedCallbackHtml is always initialized in @PostConstruct
-        return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(cachedCallbackHtml);
+        // Fallback: process on each request (dev mode or cache failed)
+        return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(processIndexHtml());
    }

    @GetMapping(
@@ -164,309 +126,4 @@ public class ReactRoutingController {
            throws IOException {
        return serveIndexHtml(request);
    }
-
-    private String buildFallbackHtml() {
-        String baseUrl = contextPath.endsWith("/") ? contextPath : contextPath + "/";
-
-        // Escape for HTML attribute context
-        String escapedBaseUrlHtml = HtmlUtils.htmlEscape(baseUrl);
-
-        // Escape for JavaScript string context
-        String escapedBaseUrlJs = JavaScriptUtils.javaScriptEscape(baseUrl);
-
-        String serverUrl = "(window.location.origin + '" + escapedBaseUrlJs + "')";
-        return """
-                <!doctype html>
-                <html>
-                  <head>
-                    <meta charset="utf-8" />
-                    <base href="%s" />
-                    <title>Stirling PDF</title>
-                    <script>
-                      // Minimal handler for SSO callback when index.html is missing (desktop fallback)
-                      (function() {
-                        const baseUrl = '%s';
-                        window.STIRLING_PDF_API_BASE_URL = baseUrl;
-                        const hashParams = new URLSearchParams(window.location.hash.replace(/^#/, ''));
-                        const searchParams = new URLSearchParams(window.location.search);
-                        const token = hashParams.get('access_token') || hashParams.get('token') || searchParams.get('access_token');
-                        const serverUrl = %s;
-
-                        if (token) {
-                          // Extract nonce from URL to send back to desktop app for validation
-                          const nonceFromUrl = hashParams.get('nonce') || searchParams.get('nonce');
-
-                          console.log('[Fallback Auth] Token received, sending to desktop app via deep link');
-
-                          // Send token + nonce via deep link to desktop app
-                          // Desktop app will validate nonce before accepting token
-                          try {
-                            const encodedToken = encodeURIComponent(token);
-                            const encodedServer = encodeURIComponent(serverUrl);
-                            const encodedNonce = nonceFromUrl ? encodeURIComponent(nonceFromUrl) : '';
-                            const deepLink = `stirlingpdf://auth/sso-complete?server=${encodedServer}#access_token=${encodedToken}&nonce=${encodedNonce}&type=sso-selfhosted`;
-                            window.location.href = deepLink;
-                            return;
-                          } catch (_) {
-                            // ignore deep link errors
-                          }
-                        }
-
-                        // No redirect to avoid loops when index.html is missing
-                      })();
-                    </script>
-                  </head>
-                  <body>
-                    <p>Stirling PDF is running.</p>
-                  </body>
-                </html>
-                """
-                .formatted(escapedBaseUrlHtml, escapedBaseUrlJs, serverUrl);
-    }
-
-    private String buildCallbackHtml() {
-        String baseUrl = contextPath.endsWith("/") ? contextPath : contextPath + "/";
-
-        // Escape for HTML attribute context
-        String escapedBaseUrlHtml = HtmlUtils.htmlEscape(baseUrl);
-
-        // Escape for JavaScript string context
-        String escapedBaseUrlJs = JavaScriptUtils.javaScriptEscape(baseUrl);
-
-        String serverUrl = "(window.location.origin + '" + escapedBaseUrlJs + "')";
-        return """
-                <!doctype html>
-                <html>
-                  <head>
-                    <meta charset="utf-8" />
-                    <base href="%s" />
-                    <title>Authentication Complete</title>
-                    <style>
-                      * {
-                        margin: 0;
-                        padding: 0;
-                        box-sizing: border-box;
-                      }
-
-                      body {
-                        font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
-                        text-align: center;
-                        padding: 50px 20px;
-                        background: #f5f5f5;
-                        min-height: 100vh;
-                        display: flex;
-                        align-items: center;
-                        justify-content: center;
-                      }
-
-                      .container {
-                        background: #ffffff;
-                        border-radius: 12px;
-                        padding: 40px;
-                        max-width: 420px;
-                        width: 100%%;
-                        box-shadow: 0 2px 8px rgba(0, 0, 0, 0.1);
-                        border: 1px solid #e5e7eb;
-                        color: #1a1a1a;
-                      }
-
-                      .icon {
-                        font-size: 48px;
-                        margin-bottom: 16px;
-                        color: #2e7d32;
-                      }
-
-                      .icon.error {
-                        color: #d32f2f;
-                      }
-
-                      h1 {
-                        font-size: 24px;
-                        font-weight: 600;
-                        margin-bottom: 12px;
-                        color: #1a1a1a;
-                      }
-
-                      p {
-                        color: #666;
-                        line-height: 1.6;
-                        font-size: 15px;
-                      }
-
-                      .error-details {
-                        background: #ffebee;
-                        border: 1px solid #ffcdd2;
-                        padding: 16px;
-                        border-radius: 8px;
-                        margin-top: 20px;
-                        font-size: 14px;
-                        color: #c62828;
-                        word-break: break-word;
-                        text-align: left;
-                        line-height: 1.5;
-                        display: none;
-                      }
-
-                      @media (prefers-color-scheme: dark) {
-                        body {
-                          background: #1a1a1a;
-                          color: #e0e0e0;
-                        }
-
-                        .container {
-                          background: #2d2d2d;
-                          box-shadow: 0 2px 8px rgba(0, 0, 0, 0.3);
-                          border-color: #374151;
-                          color: #e5e7eb;
-                        }
-
-                        .icon {
-                          color: #66bb6a;
-                        }
-
-                        .icon.error {
-                          color: #ef5350;
-                        }
-
-                        h1 {
-                          color: #f5f5f5;
-                        }
-
-                        p {
-                          color: #b0b0b0;
-                        }
-
-                        .error-details {
-                          background: #3d2020;
-                          border: 1px solid #5d3030;
-                          color: #ef9a9a;
-                        }
-                      }
-
-                      @media (max-width: 480px) {
-                        body {
-                          padding: 20px 16px;
-                        }
-
-                        .container {
-                          padding: 32px 24px;
-                        }
-
-                        h1 {
-                          font-size: 20px;
-                        }
-
-                        .icon {
-                          font-size: 40px;
-                        }
-                      }
-                    </style>
-                    <script>
-                      (function() {
-                        const run = () => {
-                          const hashParams = new URLSearchParams(window.location.hash.replace(/^#/, ''));
-                          const searchParams = new URLSearchParams(window.location.search);
-                          const token = hashParams.get('access_token') || hashParams.get('token') || searchParams.get('access_token');
-                          const errorCode = searchParams.get('errorOAuth')
-                            || searchParams.get('error')
-                            || hashParams.get('error')
-                            || searchParams.get('error_description')
-                            || hashParams.get('error_description');
-                          const serverUrl = %s;
-                          const iconEl = document.getElementById('auth-icon');
-                          const titleEl = document.getElementById('auth-title');
-                          const messageEl = document.getElementById('auth-message');
-                          const detailsEl = document.getElementById('auth-error-details');
-
-                          const sendDeepLink = (type, value, key) => {
-                            try {
-                              const encodedValue = encodeURIComponent(value || '');
-                              const encodedServer = encodeURIComponent(serverUrl);
-                              const hashKey = key || 'access_token';
-                              const deepLink = `stirlingpdf://auth/sso-complete?server=${encodedServer}#${hashKey}=${encodedValue}&type=${type}`;
-                              window.location.href = deepLink;
-                            } catch (_) {
-                              // ignore deep link errors
-                            }
-                          };
-
-                          const showError = (message, details) => {
-                            if (iconEl) {
-                              iconEl.textContent = '✗';
-                              iconEl.classList.add('error');
-                            }
-                            if (titleEl) {
-                              titleEl.textContent = 'Authentication failed';
-                            }
-                            if (messageEl) {
-                              messageEl.textContent = message;
-                            }
-                            if (detailsEl && details) {
-                              detailsEl.textContent = details;
-                              detailsEl.style.display = 'block';
-                            }
-                          };
-
-                          if (token) {
-                            // Extract nonce from URL to send back to desktop app for validation
-                            // (System browser doesn't have access to desktop app's sessionStorage)
-                            const nonceFromUrl = hashParams.get('nonce') || searchParams.get('nonce');
-
-                            console.log('[Auth Callback] Token received, sending to desktop app via deep link');
-
-                            // Send token + nonce via deep link to desktop app
-                            // Desktop app will validate nonce before accepting token
-                            setTimeout(() => {
-                              try {
-                                const encodedToken = encodeURIComponent(token);
-                                const encodedServer = encodeURIComponent(serverUrl);
-                                const encodedNonce = nonceFromUrl ? encodeURIComponent(nonceFromUrl) : '';
-                                const deepLink = `stirlingpdf://auth/sso-complete?server=${encodedServer}#access_token=${encodedToken}&nonce=${encodedNonce}&type=sso-selfhosted`;
-                                window.location.href = deepLink;
-                              } catch (err) {
-                                console.error('[Auth Callback] Failed to trigger deep link:', err);
-                              }
-                            }, 200);
-
-                            return;
-                          }
-
-                          if (errorCode) {
-                            const isCancelled = errorCode === 'access_denied';
-                            sendDeepLink('sso-error', errorCode, 'error');
-                            showError(
-                              isCancelled
-                                ? 'Authentication was cancelled. You can close this window and return to the app.'
-                                : 'Authentication was not successful. You can close this window and return to the app.',
-                              errorCode
-                            );
-                            return;
-                          }
-
-                          showError(
-                            'Authentication did not complete. You can close this window and try again.',
-                            'missing_token'
-                          );
-                        };
-
-                        if (document.readyState === 'loading') {
-                          document.addEventListener('DOMContentLoaded', run);
-                        } else {
-                          run();
-                        }
-                      })();
-                    </script>
-                  </head>
-                  <body>
-                    <div class="container">
-                      <div class="icon" id="auth-icon">&#10003;</div>
-                      <h1 id="auth-title">Authentication complete</h1>
-                      <p id="auth-message">You can close this window and return to Stirling PDF.</p>
-                      <div class="error-details" id="auth-error-details"></div>
-                    </div>
-                  </body>
-                </html>
-                """
-                .formatted(escapedBaseUrlHtml, serverUrl);
-    }
 }
@@ -80,7 +80,7 @@ import stirling.software.common.util.RegexPatternUtils;
 * <pre>{@code
 * // In controllers/services - use ExceptionUtils to create typed exceptions:
 * try {
- *     PDDocument doc = Loader.loadPDF(file);
+ *     PDDocument doc = PDDocument.load(file);
 * } catch (IOException e) {
 *     throw ExceptionUtils.createPdfCorruptedException("during load", e);
 * }
@@ -1117,34 +1117,6 @@ public class GlobalExceptionHandler {
            return handleBaseApp((BaseAppException) processedException, request);
        }

-        // Check if this is a NoSuchFileException (temp file was deleted prematurely)
-        if (ex instanceof java.nio.file.NoSuchFileException) {
-            log.error(
-                    "Temporary file not found at {}: {}",
-                    request.getRequestURI(),
-                    ex.getMessage(),
-                    ex);
-
-            String message =
-                    getLocalizedMessage(
-                            "error.tempFileNotFound.detail",
-                            "The temporary file was not found. This may indicate a processing error or cleanup issue. Please try again.");
-            String title =
-                    getLocalizedMessage("error.tempFileNotFound.title", "Temporary File Not Found");
-
-            ProblemDetail problemDetail =
-                    createBaseProblemDetail(HttpStatus.INTERNAL_SERVER_ERROR, message, request);
-            problemDetail.setType(URI.create("https://stirlingpdf.com/errors/temp-file-not-found"));
-            problemDetail.setTitle(title);
-            problemDetail.setProperty("title", title);
-            problemDetail.setProperty("errorCode", "E999");
-            problemDetail.setProperty(
-                    "hint.1",
-                    "This error usually occurs when temporary files are cleaned up before processing completes.");
-            problemDetail.setProperty("hint.2", "Try submitting your request again.");
-            return new ResponseEntity<>(problemDetail, HttpStatus.INTERNAL_SERVER_ERROR);
-        }
-
        log.error("IO error at {}: {}", request.getRequestURI(), ex.getMessage(), ex);

        String message =
@@ -1189,19 +1161,9 @@ public class GlobalExceptionHandler {
     */
    @ExceptionHandler(Exception.class)
    public ResponseEntity<ProblemDetail> handleGenericException(
-            Exception ex, HttpServletRequest request, HttpServletResponse response) {
+            Exception ex, HttpServletRequest request) {
        log.error("Unexpected error at {}: {}", request.getRequestURI(), ex.getMessage(), ex);

-        // If response is already committed (e.g., during streaming), we can't send an error
-        // response
-        // Log the error and return null to let Spring handle it gracefully
-        if (response.isCommitted()) {
-            log.warn(
-                    "Cannot send error response because response is already committed for URI: {}",
-                    request.getRequestURI());
-            return null; // Spring will handle gracefully
-        }
-
        String userMessage =
                getLocalizedMessage(
                        "error.unexpected",
@@ -220,9 +220,6 @@ public class Type3FontLibrary {
    }

    private byte[] loadResourceBytes(String location) throws IOException {
-        if (location == null || location.isBlank()) {
-            throw new IOException("Resource location is null or blank");
-        }
        String resolved = resolveLocation(location);
        Resource resource = resourceLoader.getResource(resolved);
        if (!resource.exists()) {
@@ -97,6 +97,7 @@ premium:
      enabled: true # Enable audit logging
      level: 2 # Audit logging level: 0=OFF, 1=BASIC, 2=STANDARD, 3=VERBOSE
      retentionDays: 90 # Number of days to retain audit logs
+      logIpAddresses: false # Log client IP addresses (privacy-sensitive)
    databaseNotifications:
      backups:
        successful: false # set to 'true' to enable email notifications for successful database backups
@@ -55,7 +55,7 @@ public class SPDFApplicationTest {

        sPDFApplication.init();

-        assertEquals("http://localhost:8080", SPDFApplication.getStaticBaseUrl());
+        assertEquals("http://localhost", SPDFApplication.getStaticBaseUrl());
        assertEquals("/app", SPDFApplication.getStaticContextPath());
        assertEquals("8080", SPDFApplication.getStaticPort());
    }
@@ -49,13 +49,38 @@ public class AuditAspect {
        Map<String, Object> auditData =
                AuditUtils.createBaseAuditData(joinPoint, auditedAnnotation.level());

-        // Add HTTP information if we're in a web context
-        ServletRequestAttributes attrs =
-                (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
-        if (attrs != null) {
-            HttpServletRequest req = attrs.getRequest();
-            String path = req.getRequestURI();
-            String httpMethod = req.getMethod();
+        // Try to find HttpServletRequest from method arguments first (for Security handlers)
+        HttpServletRequest request = null;
+        for (Object arg : joinPoint.getArgs()) {
+            if (arg instanceof HttpServletRequest) {
+                request = (HttpServletRequest) arg;
+                break;
+            }
+        }
+
+        // Fall back to RequestContextHolder if not in method args
+        if (request == null) {
+            ServletRequestAttributes attrs =
+                    (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
+            if (attrs != null) {
+                request = attrs.getRequest();
+            }
+        }
+
+        // Capture principal, origin, and IP early (before any async execution)
+        // Extract IP directly from the request we already have (more reliable than
+        // RequestContextHolder)
+        String capturedPrincipal = auditService.captureCurrentPrincipal();
+        String capturedOrigin = auditService.captureCurrentOrigin();
+        String capturedIp = null;
+        if (request != null && auditConfig.isLogIpAddresses()) {
+            capturedIp = AuditUtils.extractClientIp(request);
+        }
+
+        // Add HTTP information if we have a valid request
+        if (request != null) {
+            String path = request.getRequestURI();
+            String httpMethod = request.getMethod();
            AuditUtils.addHttpData(auditData, httpMethod, path, auditedAnnotation.level());
            AuditUtils.addFileData(auditData, joinPoint, auditedAnnotation.level());
        }
@@ -101,20 +126,43 @@ public class AuditAspect {
            // Re-throw the exception
            throw ex;
        } finally {
-            // Add timing information - use isHttpRequest=false to ensure we get timing for non-HTTP
-            // methods
-            HttpServletResponse resp = attrs != null ? attrs.getResponse() : null;
-            boolean isHttpRequest = attrs != null;
-            AuditUtils.addTimingData(
-                    auditData, startTime, resp, auditedAnnotation.level(), isHttpRequest);
+            // Find HttpServletResponse from method arguments first
+            HttpServletResponse response = null;
+            for (Object arg : joinPoint.getArgs()) {
+                if (arg instanceof HttpServletResponse) {
+                    response = (HttpServletResponse) arg;
+                    break;
+                }
+            }
+
+            // Fall back to RequestContextHolder for response (most controllers don't have it in
+            // args)
+            if (response == null) {
+                ServletRequestAttributes attrs =
+                        (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
+                if (attrs != null) {
+                    response = attrs.getResponse();
+                }
+            }
+
+            // Add timing directly (like ControllerAuditAspect) when we have a request
+            if (auditedAnnotation.level().includes(AuditLevel.STANDARD)) {
+                auditData.put("latencyMs", System.currentTimeMillis() - startTime);
+                if (response != null) {
+                    try {
+                        auditData.put("statusCode", response.getStatus());
+                    } catch (Exception e) {
+                        // Ignore
+                    }
+                }
+            }

            // Resolve the event type based on annotation and context
            String httpMethod = null;
            String path = null;
-            if (attrs != null) {
-                HttpServletRequest req = attrs.getRequest();
-                httpMethod = req.getMethod();
-                path = req.getRequestURI();
+            if (request != null) {
+                httpMethod = request.getMethod();
+                path = request.getRequestURI();
            }

            AuditEventType eventType =
@@ -128,11 +176,24 @@ public class AuditAspect {
            // Check if we should use string type instead
            String typeString = auditedAnnotation.typeString();
            if (eventType == AuditEventType.HTTP_REQUEST && StringUtils.isNotEmpty(typeString)) {
-                // Use the string type (for backward compatibility)
-                auditService.audit(typeString, auditData, auditedAnnotation.level());
+                // Use the string type (for backward compatibility) with captured principal, origin,
+                // and IP
+                auditService.audit(
+                        capturedPrincipal,
+                        capturedOrigin,
+                        capturedIp,
+                        typeString,
+                        auditData,
+                        auditedAnnotation.level());
            } else {
-                // Use the enum type (preferred)
-                auditService.audit(eventType, auditData, auditedAnnotation.level());
+                // Use the enum type (preferred) with captured principal, origin, and IP
+                auditService.audit(
+                        capturedPrincipal,
+                        capturedOrigin,
+                        capturedIp,
+                        eventType,
+                        auditData,
+                        auditedAnnotation.level());
            }
        }
    }
@@ -48,17 +48,6 @@ public class AuditUtils {
            ProceedingJoinPoint joinPoint, AuditLevel auditLevel) {
        Map<String, Object> data = new HashMap<>();

-        // Common data for all levels
-        data.put("timestamp", Instant.now().toString());
-
-        // Add principal if available
-        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
-        if (auth != null && auth.getName() != null) {
-            data.put("principal", auth.getName());
-        } else {
-            data.put("principal", "system");
-        }
-
        // Add class name and method name only at VERBOSE level
        if (auditLevel.includes(AuditLevel.VERBOSE)) {
            data.put("className", joinPoint.getTarget().getClass().getName());
@@ -102,7 +91,6 @@ public class AuditUtils {

        // STANDARD level HTTP data
        if (auditLevel.includes(AuditLevel.STANDARD)) {
-            data.put("clientIp", req.getRemoteAddr());
            data.put(
                    "sessionId",
                    req.getSession(false) != null ? req.getSession(false).getId() : null);
@@ -424,4 +412,38 @@ public class AuditUtils {
                && !RequestUriUtils.isTrackableResource(
                        request.getContextPath(), request.getRequestURI());
    }
+
+    /**
+     * Extract client IP address from HTTP request, preferring forwarded headers for use behind
+     * proxies/load balancers. Truncates to 45 characters to fit database column constraints.
+     *
+     * @param request The HTTP request (may be null)
+     * @return The client IP address, or null if not available
+     */
+    public static String extractClientIp(HttpServletRequest request) {
+        if (request == null) {
+            return null;
+        }
+
+        // Prefer X-Forwarded-For header (used by most proxies/load balancers)
+        String xff = request.getHeader("X-Forwarded-For");
+        if (xff != null && !xff.isBlank()) {
+            // X-Forwarded-For can be a comma-separated list: "client, proxy1, proxy2"
+            // Take the first (client) IP
+            String first = xff.split(",")[0].trim();
+            return first.length() > 45 ? first.substring(0, 45) : first;
+        }
+
+        // Try X-Real-IP header (used by some reverse proxies like nginx)
+        String realIp = request.getHeader("X-Real-IP");
+        if (realIp != null && !realIp.isBlank()) {
+            return realIp.length() > 45 ? realIp.substring(0, 45) : realIp;
+        }
+
+        // Fall back to remote address
+        String remoteAddr = request.getRemoteAddr();
+        return remoteAddr != null && remoteAddr.length() > 45
+                ? remoteAddr.substring(0, 45)
+                : remoteAddr;
+    }
 }
@@ -25,6 +25,7 @@ import jakarta.servlet.http.HttpServletResponse;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;

+import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.proprietary.config.AuditConfigurationProperties;
 import stirling.software.proprietary.service.AuditService;

@@ -37,7 +38,7 @@ import stirling.software.proprietary.service.AuditService;
@Slf4j
@RequiredArgsConstructor
@org.springframework.core.annotation.Order(
-        10) // Lower precedence (higher number) - executes after AutoJobAspect
+        0) // Highest precedence - runs on request thread before AutoJobAspect
 public class ControllerAuditAspect {

    private final AuditService auditService;
@@ -121,6 +122,16 @@ public class ControllerAuditAspect {
        HttpServletRequest req = attrs != null ? attrs.getRequest() : null;
        HttpServletResponse resp = attrs != null ? attrs.getResponse() : null;

+        // Capture principal, origin, and IP (runs on request thread before AutoJobAspect)
+        String capturedPrincipal = auditService.captureCurrentPrincipal();
+        String capturedOrigin = auditService.captureCurrentOrigin();
+        // Extract IP directly from the request we already have (more reliable than
+        // RequestContextHolder)
+        String capturedIp = null;
+        if (req != null && auditConfig.isLogIpAddresses()) {
+            capturedIp = AuditUtils.extractClientIp(req);
+        }
+
        long start = System.currentTimeMillis();

        // Use AuditUtils to create the base audit data
@@ -176,13 +187,15 @@ public class ControllerAuditAspect {
                String typeString = auditedAnnotation.typeString();
                if (eventType == AuditEventType.HTTP_REQUEST
                        && StringUtils.isNotEmpty(typeString)) {
-                    auditService.audit(typeString, data, level);
+                    auditService.audit(
+                            capturedPrincipal, capturedOrigin, capturedIp, typeString, data, level);
                    return result;
                }
            }

-            // Use the enum type
-            auditService.audit(eventType, data, level);
+            // Use the enum type with captured principal, origin, and IP
+            auditService.audit(
+                    capturedPrincipal, capturedOrigin, capturedIp, eventType, data, level);
        }
        return result;
    }
@@ -194,6 +207,14 @@ public class ControllerAuditAspect {
        RequestMapping cm = method.getDeclaringClass().getAnnotation(RequestMapping.class);
        if (cm != null && cm.value().length > 0) base = cm.value()[0];
        String mp = "";
+
+        // First check for AutoJobPostMapping (which is also a POST)
+        AutoJobPostMapping autoJob = method.getAnnotation(AutoJobPostMapping.class);
+        if (autoJob != null && autoJob.value().length > 0) {
+            return base + autoJob.value()[0];
+        }
+
+        // Fall back to standard mappings
        Annotation ann =
                switch (httpMethod) {
                    case "GET" -> method.getAnnotation(GetMapping.class);
@@ -23,6 +23,7 @@ public class AuditConfigurationProperties {
    private final boolean enabled;
    private final int level;
    private final int retentionDays;
+    private final boolean logIpAddresses;

    public AuditConfigurationProperties(ApplicationProperties applicationProperties) {
        ApplicationProperties.Premium.EnterpriseFeatures.Audit auditConfig =
@@ -37,11 +38,15 @@ public class AuditConfigurationProperties {
        // Retention days (0 means infinite)
        this.retentionDays = auditConfig.getRetentionDays();

+        // IP address logging (default false for privacy)
+        this.logIpAddresses = auditConfig.isLogIpAddresses();
+
        log.debug(
-                "Initialized audit configuration: enabled={}, level={}, retentionDays={} (0=infinite)",
+                "Initialized audit configuration: enabled={}, level={}, retentionDays={} (0=infinite), logIpAddresses={}",
                this.enabled,
                this.level,
-                this.retentionDays);
+                this.retentionDays,
+                this.logIpAddresses);
    }

    /**
@@ -9,6 +9,8 @@ import org.springframework.boot.actuate.audit.AuditEvent;
 import org.springframework.boot.actuate.audit.AuditEventRepository;
 import org.springframework.context.annotation.Primary;
 import org.springframework.scheduling.annotation.Async;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.stereotype.Component;
 import org.springframework.util.CollectionUtils;

@@ -49,6 +51,23 @@ public class CustomAuditEventRepository implements AuditEventRepository {
            if (clean.isEmpty() || (clean.size() == 1 && clean.containsKey("details"))) {
                return;
            }
+
+            // Extract origin and IP from the data map (set by AuditService before async call)
+            String origin = "SYSTEM"; // default
+            String ipAddress = null;
+
+            if (clean.containsKey("__origin") || clean.containsKey("__ipAddress")) {
+                clean = new java.util.HashMap<>(clean);
+
+                if (clean.containsKey("__origin")) {
+                    origin = String.valueOf(clean.remove("__origin"));
+                }
+
+                if (clean.containsKey("__ipAddress")) {
+                    ipAddress = String.valueOf(clean.remove("__ipAddress"));
+                }
+            }
+
            String rid = MDC.get("requestId");

            if (rid != null) {
@@ -59,16 +78,60 @@ public class CustomAuditEventRepository implements AuditEventRepository {
            String auditEventData = mapper.writeValueAsString(clean);
            log.debug("AuditEvent data (JSON): {}", auditEventData);

+            String principalName = extractPrincipalName(ev.getPrincipal());
+
+            if (principalName.length() > 255) {
+                log.warn(
+                        "Principal length {} exceeds 255 characters, truncating: {}",
+                        principalName.length(),
+                        principalName.substring(0, Math.min(50, principalName.length())) + "...");
+                principalName = principalName.substring(0, 255);
+            }
+            if (ev.getType().length() > 255) {
+                log.warn(
+                        "Type length {} exceeds 255 characters: {}",
+                        ev.getType().length(),
+                        ev.getType());
+            }
+
            PersistentAuditEvent ent =
                    PersistentAuditEvent.builder()
-                            .principal(ev.getPrincipal())
+                            .principal(principalName)
                            .type(ev.getType())
                            .data(auditEventData)
                            .timestamp(ev.getTimestamp())
+                            .ipAddress(ipAddress)
+                            .origin(origin)
                            .build();
            repo.save(ent);
        } catch (Exception e) {
            e.printStackTrace(); // fail-open
        }
    }
+
+    /**
+     * Extracts a meaningful principal name from the audit event principal. Uses lightweight
+     * approach to avoid performance impact on high-volume audit events.
+     */
+    private String extractPrincipalName(String principal) {
+        if (principal == null || principal.isEmpty()) {
+            return "anonymous";
+        }
+
+        // Quick check for JWT tokens (they start with "eyJ")
+        if (principal.startsWith("eyJ")) {
+            Authentication auth = SecurityContextHolder.getContext().getAuthentication();
+            if (auth != null && auth.isAuthenticated()) {
+                String name = auth.getName();
+                if (name != null && !name.startsWith("eyJ")) {
+                    return name.length() > 255 ? name.substring(0, 255) : name;
+                }
+            }
+
+            // Unverified/failed JWT; don't trust token content
+            return "authentication-failure";
+        }
+
+        return principal.length() > 255 ? principal.substring(0, 255) : principal;
+    }
 }
@@ -13,6 +13,7 @@ import lombok.*;
            @jakarta.persistence.Index(name = "idx_audit_timestamp", columnList = "timestamp"),
            @jakarta.persistence.Index(name = "idx_audit_principal", columnList = "principal"),
            @jakarta.persistence.Index(name = "idx_audit_type", columnList = "type"),
+            @jakarta.persistence.Index(name = "idx_audit_origin", columnList = "origin"),
            @jakarta.persistence.Index(
                    name = "idx_audit_principal_type",
                    columnList = "principal,type"),
@@ -33,7 +34,14 @@ public class PersistentAuditEvent {
    private String principal;
    private String type;

-    @Lob private String data; // JSON blob
+    @Column(columnDefinition = "TEXT")
+    private String data; // JSON blob

    private Instant timestamp;
+
+    @Column(length = 45) // Max length for IPv6 (xxx:xxx:xxx:xxx:xxx:xxx:xxx:xxx)
+    private String ipAddress;
+
+    @Column(length = 10) // "WEB", "API", or "SYSTEM"
+    private String origin;
 }
@@ -18,7 +18,6 @@ import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.crypto.password.PasswordEncoder;
-import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
 import org.springframework.security.saml2.provider.service.authentication.OpenSaml4AuthenticationProvider;
 import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
 import org.springframework.security.saml2.provider.service.web.authentication.OpenSaml4AuthenticationRequestResolver;
@@ -47,7 +46,6 @@ import stirling.software.proprietary.security.filter.JwtAuthenticationFilter;
 import stirling.software.proprietary.security.filter.UserAuthenticationFilter;
 import stirling.software.proprietary.security.oauth2.CustomOAuth2AuthenticationFailureHandler;
 import stirling.software.proprietary.security.oauth2.CustomOAuth2AuthenticationSuccessHandler;
-import stirling.software.proprietary.security.oauth2.TauriAuthorizationRequestResolver;
 import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticationFailureHandler;
 import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticationSuccessHandler;
 import stirling.software.proprietary.security.saml2.CustomSaml2ResponseAuthenticationConverter;
@@ -84,7 +82,6 @@ public class SecurityConfiguration {
    private final OpenSaml4AuthenticationRequestResolver saml2AuthenticationRequestResolver;
    private final stirling.software.proprietary.service.UserLicenseSettingsService
            licenseSettingsService;
-    private final ClientRegistrationRepository clientRegistrationRepository;

    public SecurityConfiguration(
            PersistentLoginRepository persistentLoginRepository,
@@ -105,7 +102,6 @@ public class SecurityConfiguration {
                    RelyingPartyRegistrationRepository saml2RelyingPartyRegistrations,
            @Autowired(required = false)
                    OpenSaml4AuthenticationRequestResolver saml2AuthenticationRequestResolver,
-            @Autowired(required = false) ClientRegistrationRepository clientRegistrationRepository,
            stirling.software.proprietary.service.UserLicenseSettingsService
                    licenseSettingsService) {
        this.userDetailsService = userDetailsService;
@@ -124,7 +120,6 @@ public class SecurityConfiguration {
        this.oAuth2userAuthoritiesMapper = oAuth2userAuthoritiesMapper;
        this.saml2RelyingPartyRegistrations = saml2RelyingPartyRegistrations;
        this.saml2AuthenticationRequestResolver = saml2AuthenticationRequestResolver;
-        this.clientRegistrationRepository = clientRegistrationRepository;
        this.licenseSettingsService = licenseSettingsService;
    }

@@ -295,15 +290,6 @@ public class SecurityConfiguration {
                http.oauth2Login(
                        oauth2 -> {
                            oauth2.loginPage("/login")
-                                    .authorizationEndpoint(
-                                            authorizationEndpoint -> {
-                                                if (clientRegistrationRepository != null) {
-                                                    authorizationEndpoint
-                                                            .authorizationRequestResolver(
-                                                                    new TauriAuthorizationRequestResolver(
-                                                                            clientRegistrationRepository));
-                                                }
-                                            })
                                    .successHandler(
                                            new CustomOAuth2AuthenticationSuccessHandler(
                                                    loginAttemptService,
@@ -1,11 +1,7 @@
 package stirling.software.proprietary.security.oauth2;

 import java.io.IOException;
-import java.net.URLEncoder;
-import java.nio.charset.StandardCharsets;

-import org.springframework.http.HttpHeaders;
-import org.springframework.http.ResponseCookie;
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.authentication.DisabledException;
 import org.springframework.security.authentication.LockedException;
@@ -64,66 +60,9 @@ public class CustomOAuth2AuthenticationFailureHandler
                    "OAuth2 Authentication error: {}",
                    errorCode != null ? errorCode : exception.getMessage(),
                    exception);
-            String errorValue = errorCode != null ? errorCode : "oauth2AuthenticationError";
-            clearRedirectCookie(response);
-            boolean tauriState = TauriOAuthUtils.isTauriState(request);
-            String redirectUrl;
-            if (tauriState) {
-                String basePath =
-                        TauriOAuthUtils.defaultTauriCallbackPath(request.getContextPath());
-                redirectUrl = basePath;
-                String stateParam = request.getParameter("state");
-                if (stateParam != null && !stateParam.isBlank()) {
-                    redirectUrl = appendQueryParam(redirectUrl, "state", stateParam);
-                    // Extract and pass nonce for CSRF validation
-                    String nonce = TauriOAuthUtils.extractNonceFromState(stateParam);
-                    if (nonce != null) {
-                        redirectUrl = appendQueryParam(redirectUrl, "nonce", nonce);
-                    }
-                }
-                redirectUrl = appendQueryParam(redirectUrl, "errorOAuth", errorValue);
-            } else {
-                redirectUrl = buildFailureRedirectUrl(request, errorValue);
-            }
-            getRedirectStrategy().sendRedirect(request, response, redirectUrl);
-            return;
+            getRedirectStrategy().sendRedirect(request, response, "/login?errorOAuth=" + errorCode);
        }
        log.error("Unhandled authentication exception", exception);
        super.onAuthenticationFailure(request, response, exception);
    }
-
-    private String buildFailureRedirectUrl(HttpServletRequest request, String errorValue) {
-        String contextPath = request.getContextPath();
-        String cookiePath = TauriOAuthUtils.extractRedirectPathFromCookie(request);
-        String redirectPath =
-                cookiePath != null ? cookiePath : TauriOAuthUtils.defaultCallbackPath(contextPath);
-        if (TauriOAuthUtils.isTauriState(request)) {
-            redirectPath = appendQueryParam(redirectPath, "tauri", "1");
-        }
-        String resolvedPath =
-                redirectPath.startsWith("/")
-                        ? TauriOAuthUtils.normalizeContextPath(contextPath) + redirectPath
-                        : TauriOAuthUtils.normalizeContextPath(contextPath) + "/" + redirectPath;
-        return appendQueryParam(resolvedPath, "errorOAuth", errorValue);
-    }
-
-    private void clearRedirectCookie(HttpServletResponse response) {
-        ResponseCookie cookie =
-                ResponseCookie.from(TauriOAuthUtils.SPA_REDIRECT_COOKIE, "")
-                        .path("/")
-                        .sameSite("Lax")
-                        .maxAge(0)
-                        .build();
-        response.addHeader(HttpHeaders.SET_COOKIE, cookie.toString());
-    }
-
-    private String appendQueryParam(String path, String key, String value) {
-        if (path == null || path.isBlank()) {
-            return path;
-        }
-        String separator = path.contains("?") ? "&" : "?";
-        String encodedKey = URLEncoder.encode(key, StandardCharsets.UTF_8);
-        String encodedValue = value == null ? "" : URLEncoder.encode(value, StandardCharsets.UTF_8);
-        return path + separator + encodedKey + "=" + encodedValue;
-    }
 }
@@ -4,6 +4,8 @@ import static stirling.software.proprietary.security.model.AuthenticationType.OA
 import static stirling.software.proprietary.security.model.AuthenticationType.SSO;

 import java.io.IOException;
+import java.net.URLDecoder;
+import java.nio.charset.StandardCharsets;
 import java.sql.SQLException;
 import java.util.Map;
 import java.util.Optional;
@@ -19,6 +21,7 @@ import org.springframework.security.web.authentication.SavedRequestAwareAuthenti
 import org.springframework.security.web.savedrequest.SavedRequest;

 import jakarta.servlet.ServletException;
+import jakarta.servlet.http.Cookie;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import jakarta.servlet.http.HttpSession;
@@ -42,6 +45,9 @@ import stirling.software.proprietary.security.service.UserService;
 public class CustomOAuth2AuthenticationSuccessHandler
        extends SavedRequestAwareAuthenticationSuccessHandler {

+    private static final String SPA_REDIRECT_COOKIE = "stirling_redirect_path";
+    private static final String DEFAULT_CALLBACK_PATH = "/auth/callback";
+
    private final LoginAttemptService loginAttemptService;
    private final ApplicationProperties.Security.OAUTH2 oauth2Properties;
    private final UserService userService;
@@ -204,28 +210,39 @@ public class CustomOAuth2AuthenticationSuccessHandler
                                        resolveOriginFromReferer(request)
                                                .orElseGet(() -> buildOriginFromRequest(request)));
        clearRedirectCookie(response);
-
-        // Extract nonce from state for CSRF validation in callback
-        String nonce = TauriOAuthUtils.extractNonceFromRequest(request);
-        String url = origin + redirectPath + "#access_token=" + jwt;
-        if (nonce != null) {
-            url +=
-                    "&nonce="
-                            + java.net.URLEncoder.encode(
-                                    nonce, java.nio.charset.StandardCharsets.UTF_8);
-        }
-        return url;
+        return origin + redirectPath + "#access_token=" + jwt;
    }

    private String resolveRedirectPath(HttpServletRequest request, String contextPath) {
-        if (TauriOAuthUtils.isTauriState(request)) {
-            return TauriOAuthUtils.defaultTauriCallbackPath(contextPath);
+        return extractRedirectPathFromCookie(request)
+                .filter(path -> path.startsWith("/"))
+                .orElseGet(() -> defaultCallbackPath(contextPath));
+    }
+
+    private Optional<String> extractRedirectPathFromCookie(HttpServletRequest request) {
+        Cookie[] cookies = request.getCookies();
+        if (cookies == null) {
+            return Optional.empty();
        }
-        String cookiePath = TauriOAuthUtils.extractRedirectPathFromCookie(request);
-        if (cookiePath != null && cookiePath.startsWith("/")) {
-            return cookiePath;
+        for (Cookie cookie : cookies) {
+            if (SPA_REDIRECT_COOKIE.equals(cookie.getName())) {
+                String value = URLDecoder.decode(cookie.getValue(), StandardCharsets.UTF_8).trim();
+                if (!value.isEmpty()) {
+                    return Optional.of(value);
+                }
+            }
        }
-        return TauriOAuthUtils.defaultCallbackPath(contextPath);
+        return Optional.empty();
+    }
+
+    private String defaultCallbackPath(String contextPath) {
+        if (contextPath == null
+                || contextPath.isBlank()
+                || "/".equals(contextPath)
+                || "\\".equals(contextPath)) {
+            return DEFAULT_CALLBACK_PATH;
+        }
+        return contextPath + DEFAULT_CALLBACK_PATH;
    }

    private Optional<String> resolveForwardedOrigin(HttpServletRequest request) {
@@ -309,7 +326,7 @@ public class CustomOAuth2AuthenticationSuccessHandler

    private void clearRedirectCookie(HttpServletResponse response) {
        ResponseCookie cookie =
-                ResponseCookie.from(TauriOAuthUtils.SPA_REDIRECT_COOKIE, "")
+                ResponseCookie.from(SPA_REDIRECT_COOKIE, "")
                        .path("/")
                        .sameSite("Lax")
                        .maxAge(0)
@@ -1,58 +0,0 @@
-package stirling.software.proprietary.security.oauth2;
-
-import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
-import org.springframework.security.oauth2.client.web.DefaultOAuth2AuthorizationRequestResolver;
-import org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestResolver;
-import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest;
-
-import jakarta.servlet.http.HttpServletRequest;
-
-public class TauriAuthorizationRequestResolver implements OAuth2AuthorizationRequestResolver {
-
-    private static final String TAURI_STATE_PREFIX = "tauri:";
-
-    private final OAuth2AuthorizationRequestResolver delegate;
-
-    public TauriAuthorizationRequestResolver(
-            ClientRegistrationRepository clientRegistrationRepository) {
-        this.delegate =
-                new DefaultOAuth2AuthorizationRequestResolver(
-                        clientRegistrationRepository, "/oauth2/authorization");
-    }
-
-    @Override
-    public OAuth2AuthorizationRequest resolve(HttpServletRequest request) {
-        return customize(request, delegate.resolve(request));
-    }
-
-    @Override
-    public OAuth2AuthorizationRequest resolve(
-            HttpServletRequest request, String clientRegistrationId) {
-        return customize(request, delegate.resolve(request, clientRegistrationId));
-    }
-
-    private OAuth2AuthorizationRequest customize(
-            HttpServletRequest request, OAuth2AuthorizationRequest authorizationRequest) {
-        if (authorizationRequest == null) {
-            return null;
-        }
-        String tauriParam = request.getParameter("tauri");
-        if (!"1".equals(tauriParam)) {
-            return authorizationRequest;
-        }
-
-        String state = authorizationRequest.getState();
-        if (state == null || state.startsWith(TAURI_STATE_PREFIX)) {
-            return authorizationRequest;
-        }
-
-        // Extract nonce from request for CSRF protection
-        String nonce = request.getParameter("nonce");
-        String customState = TAURI_STATE_PREFIX + state;
-        if (nonce != null && !nonce.isBlank()) {
-            customState = customState + ":" + nonce;
-        }
-
-        return OAuth2AuthorizationRequest.from(authorizationRequest).state(customState).build();
-    }
-}
@@ -1,122 +0,0 @@
-package stirling.software.proprietary.security.oauth2;
-
-import jakarta.servlet.http.Cookie;
-import jakarta.servlet.http.HttpServletRequest;
-
-/**
- * Utility class for Tauri desktop OAuth flow handling. Centralizes common logic for OAuth state
- * management, nonce validation, and callback path construction.
- */
-public final class TauriOAuthUtils {
-
-    public static final String TAURI_STATE_PREFIX = "tauri:";
-    public static final String SPA_REDIRECT_COOKIE = "stirling_redirect_path";
-    public static final String DEFAULT_CALLBACK_PATH = "/auth/callback";
-    public static final String TAURI_CALLBACK_SUFFIX = "/tauri";
-
-    private TauriOAuthUtils() {
-        // Utility class - prevent instantiation
-    }
-
-    /**
-     * Extracts nonce from OAuth state parameter for CSRF validation. State format:
-     * tauri:<original-state>:<nonce>
-     *
-     * @param state The state parameter value
-     * @return The nonce if present, null otherwise
-     */
-    public static String extractNonceFromState(String state) {
-        if (state == null || !state.startsWith(TAURI_STATE_PREFIX)) {
-            return null;
-        }
-        // Split by ':' and get the last part (nonce)
-        String[] parts = state.split(":");
-        if (parts.length >= 3) {
-            return parts[parts.length - 1];
-        }
-        return null;
-    }
-
-    /**
-     * Extracts nonce from request's state parameter.
-     *
-     * @param request The HTTP request
-     * @return The nonce if present, null otherwise
-     */
-    public static String extractNonceFromRequest(HttpServletRequest request) {
-        String state = request.getParameter("state");
-        return extractNonceFromState(state);
-    }
-
-    /**
-     * Checks if the request has a Tauri state parameter (desktop OAuth flow).
-     *
-     * @param request The HTTP request
-     * @return true if this is a Tauri desktop OAuth flow, false otherwise
-     */
-    public static boolean isTauriState(HttpServletRequest request) {
-        String state = request.getParameter("state");
-        return state != null && state.startsWith(TAURI_STATE_PREFIX);
-    }
-
-    /**
-     * Builds the default callback path for the given context path.
-     *
-     * @param contextPath The application context path
-     * @return The full callback path
-     */
-    public static String defaultCallbackPath(String contextPath) {
-        if (contextPath == null
-                || contextPath.isBlank()
-                || "/".equals(contextPath)
-                || "\\".equals(contextPath)) {
-            return DEFAULT_CALLBACK_PATH;
-        }
-        return contextPath + DEFAULT_CALLBACK_PATH;
-    }
-
-    /**
-     * Builds the Tauri-specific callback path (includes /tauri suffix).
-     *
-     * @param contextPath The application context path
-     * @return The full Tauri callback path
-     */
-    public static String defaultTauriCallbackPath(String contextPath) {
-        return defaultCallbackPath(contextPath) + TAURI_CALLBACK_SUFFIX;
-    }
-
-    /**
-     * Normalizes context path by removing trailing slashes and handling empty/root paths.
-     *
-     * @param contextPath The context path to normalize
-     * @return Normalized context path (empty string for root)
-     */
-    public static String normalizeContextPath(String contextPath) {
-        if (contextPath == null || contextPath.isBlank() || "/".equals(contextPath)) {
-            return "";
-        }
-        return contextPath;
-    }
-
-    /**
-     * Finds the SPA redirect cookie value from the request.
-     *
-     * @param request The HTTP request
-     * @return The redirect path from cookie, or null if not found
-     */
-    public static String extractRedirectPathFromCookie(HttpServletRequest request) {
-        Cookie[] cookies = request.getCookies();
-        if (cookies == null) {
-            return null;
-        }
-        for (Cookie cookie : cookies) {
-            if (SPA_REDIRECT_COOKIE.equals(cookie.getName())) {
-                String value =
-                        java.net.URLDecoder.decode(
-                                cookie.getValue(), java.nio.charset.StandardCharsets.UTF_8);
-                return value.trim().isEmpty() ? null : value.trim();
-            }
-        }
-        return null;
-    }
-}
@@ -14,6 +14,7 @@ import lombok.extern.slf4j.Slf4j;
 import stirling.software.proprietary.audit.AuditEventType;
 import stirling.software.proprietary.audit.AuditLevel;
 import stirling.software.proprietary.config.AuditConfigurationProperties;
+import stirling.software.proprietary.security.model.ApiKeyAuthenticationToken;

 /**
 * Service for creating manual audit events throughout the application. This provides easy access to
@@ -53,7 +54,12 @@ public class AuditService {
        }

        String principal = getCurrentUsername();
-        repository.add(new AuditEvent(principal, type.name(), data));
+
+        // Add origin to the data map (captured here before async execution)
+        Map<String, Object> enrichedData = new java.util.HashMap<>(data);
+        enrichedData.put("__origin", determineOrigin());
+
+        repository.add(new AuditEvent(principal, type.name(), enrichedData));
    }

    /**
@@ -115,7 +121,12 @@ public class AuditService {
        }

        String principal = getCurrentUsername();
-        repository.add(new AuditEvent(principal, type, data));
+
+        // Add origin to the data map (captured here before async execution)
+        Map<String, Object> enrichedData = new java.util.HashMap<>(data);
+        enrichedData.put("__origin", determineOrigin());
+
+        repository.add(new AuditEvent(principal, type, enrichedData));
    }

    /**
@@ -161,9 +172,106 @@ public class AuditService {
        audit(principal, type, data, AuditLevel.STANDARD);
    }

+    /**
+     * Record an audit event with pre-captured principal, origin, and IP (for use by audit aspects).
+     */
+    public void audit(
+            String principal,
+            String origin,
+            String ipAddress,
+            AuditEventType type,
+            Map<String, Object> data,
+            AuditLevel level) {
+        if (!auditConfig.isEnabled()
+                || !auditConfig.getAuditLevel().includes(level)
+                || !runningEE) {
+            return;
+        }
+
+        // Add origin and IP to the data map (already captured before async)
+        Map<String, Object> enrichedData = new java.util.HashMap<>(data);
+        enrichedData.put("__origin", origin);
+        if (ipAddress != null) {
+            enrichedData.put("__ipAddress", ipAddress);
+        }
+
+        repository.add(new AuditEvent(principal, type.name(), enrichedData));
+    }
+
+    /**
+     * Record an audit event with pre-captured principal, origin, and IP using string type (for
+     * backward compatibility).
+     */
+    public void audit(
+            String principal,
+            String origin,
+            String ipAddress,
+            String type,
+            Map<String, Object> data,
+            AuditLevel level) {
+        if (!auditConfig.isEnabled()
+                || !auditConfig.getAuditLevel().includes(level)
+                || !runningEE) {
+            return;
+        }
+
+        // Add origin and IP to the data map (already captured before async)
+        Map<String, Object> enrichedData = new java.util.HashMap<>(data);
+        enrichedData.put("__origin", origin);
+        if (ipAddress != null) {
+            enrichedData.put("__ipAddress", ipAddress);
+        }
+
+        repository.add(new AuditEvent(principal, type, enrichedData));
+    }
+
    /** Get the current authenticated username or "system" if none */
    private String getCurrentUsername() {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        return (auth != null && auth.getName() != null) ? auth.getName() : "system";
    }
+
+    /**
+     * Captures the current principal for later use (avoids SecurityContext issues in async/thread
+     * changes). Public so audit aspects can capture early before thread context changes.
+     */
+    public String captureCurrentPrincipal() {
+        return getCurrentUsername();
+    }
+
+    /**
+     * Captures the current origin for later use (avoids SecurityContext issues in async/thread
+     * changes). Public so audit aspects can capture early before thread context changes.
+     */
+    public String captureCurrentOrigin() {
+        return determineOrigin();
+    }
+
+    /**
+     * Determines the origin of the request: API (X-API-KEY), WEB (JWT), or SYSTEM (no auth).
+     * IMPORTANT: This must be called in the request thread before async execution.
+     *
+     * @return "API", "WEB", or "SYSTEM"
+     */
+    private String determineOrigin() {
+        try {
+            Authentication auth = SecurityContextHolder.getContext().getAuthentication();
+
+            // Check if authenticated via API key
+            if (auth instanceof ApiKeyAuthenticationToken) {
+                return "API";
+            }
+
+            // Check if authenticated via JWT (web user)
+            if (auth != null && auth.isAuthenticated() && !"anonymousUser".equals(auth.getName())) {
+                return "WEB";
+            }
+
+            // System or unauthenticated
+            return "SYSTEM";
+        } catch (Exception e) {
+            log.debug("Could not determine origin for audit event", e);
+            return "SYSTEM";
+        }
+    }
 }
@@ -292,7 +292,6 @@ public class FormUtils {
        }

        PDFRenderer renderer = new PDFRenderer(document);
-        renderer.setSubsamplingAllowed(true); // Enable subsampling to reduce memory usage
        ApplicationProperties properties =
                ApplicationContextProvider.getBean(ApplicationProperties.class);

@@ -1,47 +0,0 @@
-package stirling.software.proprietary.security.oauth2;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-
-import org.junit.jupiter.api.Test;
-import org.springframework.mock.web.MockHttpServletRequest;
-import org.springframework.mock.web.MockHttpServletResponse;
-import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
-import org.springframework.security.oauth2.core.OAuth2Error;
-
-class CustomOAuth2AuthenticationFailureHandlerTest {
-
-    @Test
-    void redirectsToTauriCallbackWhenStateMarked() throws Exception {
-        CustomOAuth2AuthenticationFailureHandler handler =
-                new CustomOAuth2AuthenticationFailureHandler();
-        MockHttpServletRequest request = new MockHttpServletRequest();
-        request.setContextPath("");
-        request.setParameter("state", "tauri:abc");
-        MockHttpServletResponse response = new MockHttpServletResponse();
-
-        handler.onAuthenticationFailure(
-                request,
-                response,
-                new OAuth2AuthenticationException(new OAuth2Error("access_denied")));
-
-        assertEquals(
-                "/auth/callback/tauri?state=tauri%3Aabc&errorOAuth=access_denied",
-                response.getRedirectedUrl());
-    }
-
-    @Test
-    void redirectsToDefaultCallbackWithoutTauriState() throws Exception {
-        CustomOAuth2AuthenticationFailureHandler handler =
-                new CustomOAuth2AuthenticationFailureHandler();
-        MockHttpServletRequest request = new MockHttpServletRequest();
-        request.setContextPath("");
-        MockHttpServletResponse response = new MockHttpServletResponse();
-
-        handler.onAuthenticationFailure(
-                request,
-                response,
-                new OAuth2AuthenticationException(new OAuth2Error("access_denied")));
-
-        assertEquals("/auth/callback?errorOAuth=access_denied", response.getRedirectedUrl());
-    }
-}
@@ -1,79 +0,0 @@
-package stirling.software.proprietary.security.oauth2;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
-
-import java.util.List;
-import java.util.Map;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.junit.jupiter.MockitoExtension;
-import org.springframework.mock.web.MockHttpServletRequest;
-import org.springframework.mock.web.MockHttpServletResponse;
-import org.springframework.security.core.authority.SimpleGrantedAuthority;
-import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
-import org.springframework.security.oauth2.core.user.DefaultOAuth2User;
-
-import stirling.software.common.model.ApplicationProperties;
-import stirling.software.proprietary.security.service.JwtServiceInterface;
-import stirling.software.proprietary.security.service.LoginAttemptService;
-import stirling.software.proprietary.security.service.UserService;
-import stirling.software.proprietary.service.UserLicenseSettingsService;
-
-@ExtendWith(MockitoExtension.class)
-class CustomOAuth2AuthenticationSuccessHandlerTest {
-
-    @Test
-    void redirectsToTauriCallbackWhenStateMarked() throws Exception {
-        LoginAttemptService loginAttemptService = mock(LoginAttemptService.class);
-        UserService userService = mock(UserService.class);
-        JwtServiceInterface jwtService = mock(JwtServiceInterface.class);
-        UserLicenseSettingsService licenseSettingsService = mock(UserLicenseSettingsService.class);
-
-        ApplicationProperties.Security.OAUTH2 oauth2Props =
-                new ApplicationProperties.Security.OAUTH2();
-        oauth2Props.setAutoCreateUser(true);
-        oauth2Props.setBlockRegistration(false);
-
-        CustomOAuth2AuthenticationSuccessHandler handler =
-                new CustomOAuth2AuthenticationSuccessHandler(
-                        loginAttemptService,
-                        oauth2Props,
-                        userService,
-                        jwtService,
-                        licenseSettingsService);
-
-        when(userService.usernameExistsIgnoreCase("user")).thenReturn(false);
-        when(licenseSettingsService.isOAuthEligible(null)).thenReturn(true);
-        when(userService.isUserDisabled("user")).thenReturn(false);
-        when(jwtService.isJwtEnabled()).thenReturn(true);
-        when(jwtService.generateToken(
-                        org.mockito.Mockito.any(
-                                org.springframework.security.core.Authentication.class),
-                        org.mockito.Mockito.anyMap()))
-                .thenReturn("jwt");
-
-        Map<String, Object> attributes = Map.of("sub", "provider-sub", "name", "user");
-        DefaultOAuth2User oauthUser =
-                new DefaultOAuth2User(
-                        List.of(new SimpleGrantedAuthority("ROLE_USER")), attributes, "name");
-        OAuth2AuthenticationToken authentication =
-                new OAuth2AuthenticationToken(oauthUser, oauthUser.getAuthorities(), "google");
-
-        MockHttpServletRequest request = new MockHttpServletRequest();
-        request.setContextPath("");
-        request.setScheme("http");
-        request.setServerName("localhost");
-        request.setServerPort(8080);
-        request.setParameter("state", "tauri:abc");
-        MockHttpServletResponse response = new MockHttpServletResponse();
-
-        handler.onAuthenticationSuccess(request, response, authentication);
-
-        assertEquals(
-                "http://localhost:8080/auth/callback/tauri#access_token=jwt",
-                response.getRedirectedUrl());
-    }
-}
@@ -1,62 +0,0 @@
-package stirling.software.proprietary.security.oauth2;
-
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import org.junit.jupiter.api.Test;
-import org.springframework.mock.web.MockHttpServletRequest;
-import org.springframework.security.oauth2.client.registration.ClientRegistration;
-import org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository;
-import org.springframework.security.oauth2.core.AuthorizationGrantType;
-import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest;
-
-class TauriAuthorizationRequestResolverTest {
-
-    private TauriAuthorizationRequestResolver buildResolver() {
-        ClientRegistration registration =
-                ClientRegistration.withRegistrationId("google")
-                        .clientId("client-id")
-                        .clientSecret("client-secret")
-                        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
-                        .authorizationUri("https://accounts.example.com/o/oauth2/auth")
-                        .tokenUri("https://accounts.example.com/o/oauth2/token")
-                        .redirectUri("http://localhost:8080/login/oauth2/code/google")
-                        .userInfoUri("https://accounts.example.com/userinfo")
-                        .userNameAttributeName("sub")
-                        .clientName("Google")
-                        .scope("email")
-                        .build();
-
-        return new TauriAuthorizationRequestResolver(
-                new InMemoryClientRegistrationRepository(registration));
-    }
-
-    private MockHttpServletRequest buildRequest(boolean tauri) {
-        MockHttpServletRequest request =
-                new MockHttpServletRequest("GET", "/oauth2/authorization/google");
-        request.setServletPath("/oauth2/authorization/google");
-        if (tauri) {
-            request.setParameter("tauri", "1");
-        }
-        return request;
-    }
-
-    @Test
-    void resolve_prefixesStateWhenTauriParamPresent() {
-        TauriAuthorizationRequestResolver resolver = buildResolver();
-        OAuth2AuthorizationRequest authRequest = resolver.resolve(buildRequest(true));
-        assertNotNull(authRequest);
-        assertNotNull(authRequest.getState());
-        assertTrue(authRequest.getState().startsWith("tauri:"));
-    }
-
-    @Test
-    void resolve_doesNotPrefixStateWithoutTauriParam() {
-        TauriAuthorizationRequestResolver resolver = buildResolver();
-        OAuth2AuthorizationRequest authRequest = resolver.resolve(buildRequest(false));
-        assertNotNull(authRequest);
-        assertNotNull(authRequest.getState());
-        assertFalse(authRequest.getState().startsWith("tauri:"));
-    }
-}
@@ -1,135 +0,0 @@
-package stirling.software.proprietary.security.oauth2;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-import org.junit.jupiter.api.Test;
-import org.springframework.mock.web.MockHttpServletRequest;
-
-class TauriOAuthUtilsTest {
-
-    @Test
-    void extractNonceFromState_validState() {
-        String state = "tauri:original-state-12345:test-nonce-uuid";
-        String nonce = TauriOAuthUtils.extractNonceFromState(state);
-        assertEquals("test-nonce-uuid", nonce);
-    }
-
-    @Test
-    void extractNonceFromState_stateWithColonInNonce() {
-        String state = "tauri:original:complex:nonce-with-colon";
-        String nonce = TauriOAuthUtils.extractNonceFromState(state);
-        assertEquals("nonce-with-colon", nonce);
-    }
-
-    @Test
-    void extractNonceFromState_noNonce() {
-        String state = "tauri:original-state";
-        String nonce = TauriOAuthUtils.extractNonceFromState(state);
-        assertNull(nonce);
-    }
-
-    @Test
-    void extractNonceFromState_notTauriState() {
-        String state = "regular-state:with-colons";
-        String nonce = TauriOAuthUtils.extractNonceFromState(state);
-        assertNull(nonce);
-    }
-
-    @Test
-    void extractNonceFromState_nullState() {
-        String nonce = TauriOAuthUtils.extractNonceFromState(null);
-        assertNull(nonce);
-    }
-
-    @Test
-    void extractNonceFromRequest_validRequest() {
-        MockHttpServletRequest request = new MockHttpServletRequest();
-        request.setParameter("state", "tauri:abc:nonce-123");
-
-        String nonce = TauriOAuthUtils.extractNonceFromRequest(request);
-        assertEquals("nonce-123", nonce);
-    }
-
-    @Test
-    void isTauriState_validTauriState() {
-        MockHttpServletRequest request = new MockHttpServletRequest();
-        request.setParameter("state", "tauri:original-state");
-
-        assertTrue(TauriOAuthUtils.isTauriState(request));
-    }
-
-    @Test
-    void isTauriState_notTauriState() {
-        MockHttpServletRequest request = new MockHttpServletRequest();
-        request.setParameter("state", "regular-state");
-
-        assertFalse(TauriOAuthUtils.isTauriState(request));
-    }
-
-    @Test
-    void isTauriState_noState() {
-        MockHttpServletRequest request = new MockHttpServletRequest();
-
-        assertFalse(TauriOAuthUtils.isTauriState(request));
-    }
-
-    @Test
-    void defaultCallbackPath_rootContext() {
-        assertEquals("/auth/callback", TauriOAuthUtils.defaultCallbackPath("/"));
-        assertEquals("/auth/callback", TauriOAuthUtils.defaultCallbackPath(""));
-        assertEquals("/auth/callback", TauriOAuthUtils.defaultCallbackPath(null));
-    }
-
-    @Test
-    void defaultCallbackPath_withContext() {
-        assertEquals("/myapp/auth/callback", TauriOAuthUtils.defaultCallbackPath("/myapp"));
-    }
-
-    @Test
-    void defaultTauriCallbackPath_rootContext() {
-        assertEquals("/auth/callback/tauri", TauriOAuthUtils.defaultTauriCallbackPath("/"));
-    }
-
-    @Test
-    void defaultTauriCallbackPath_withContext() {
-        assertEquals(
-                "/myapp/auth/callback/tauri", TauriOAuthUtils.defaultTauriCallbackPath("/myapp"));
-    }
-
-    @Test
-    void normalizeContextPath_rootPaths() {
-        assertEquals("", TauriOAuthUtils.normalizeContextPath("/"));
-        assertEquals("", TauriOAuthUtils.normalizeContextPath(""));
-        assertEquals("", TauriOAuthUtils.normalizeContextPath(null));
-    }
-
-    @Test
-    void normalizeContextPath_withPath() {
-        assertEquals("/myapp", TauriOAuthUtils.normalizeContextPath("/myapp"));
-    }
-
-    @Test
-    void extractRedirectPathFromCookie_noCookies() {
-        MockHttpServletRequest request = new MockHttpServletRequest();
-        assertNull(TauriOAuthUtils.extractRedirectPathFromCookie(request));
-    }
-
-    @Test
-    void extractRedirectPathFromCookie_withCookie() {
-        MockHttpServletRequest request = new MockHttpServletRequest();
-        request.setCookies(
-                new jakarta.servlet.http.Cookie(
-                        TauriOAuthUtils.SPA_REDIRECT_COOKIE, "/auth/callback"));
-
-        assertEquals("/auth/callback", TauriOAuthUtils.extractRedirectPathFromCookie(request));
-    }
-
-    @Test
-    void extractRedirectPathFromCookie_emptyCookie() {
-        MockHttpServletRequest request = new MockHttpServletRequest();
-        request.setCookies(
-                new jakarta.servlet.http.Cookie(TauriOAuthUtils.SPA_REDIRECT_COOKIE, ""));
-
-        assertNull(TauriOAuthUtils.extractRedirectPathFromCookie(request));
-    }
-}
@@ -66,7 +66,7 @@ COPY docker/unified/entrypoint.sh /entrypoint.sh

 # Environment Variables
 ENV VERSION_TAG=$VERSION_TAG \
-    JAVA_BASE_OPTS="-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/configs/heap_dumps -XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70" \
+    JAVA_BASE_OPTS="-XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70" \
    JAVA_CUSTOM_OPTS="" \
    HOME=/home/stirlingpdfuser \
    PUID=1000 \
@@ -129,7 +129,7 @@ RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/a
    ln -s /usr/lib/libreoffice/program/unohelper.py /opt/venv/lib/python3.12/site-packages/ && \
    ln -s /usr/lib/libreoffice/program /opt/venv/lib/python3.12/site-packages/LibreOffice && \
    mv /usr/share/tessdata /usr/share/tessdata-original && \
-    mkdir -p $HOME /configs /configs/heap_dumps /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf /pipeline/watchedFolders /pipeline/finishedFolders && \
+    mkdir -p $HOME /configs /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf /pipeline/watchedFolders /pipeline/finishedFolders && \
    mkdir -p /var/lib/nginx/tmp /var/log/nginx && \
    fc-cache -f -v && \
    chmod +x /scripts/* && \
@@ -66,7 +66,7 @@ COPY docker/unified/entrypoint.sh /entrypoint.sh
 # Environment Variables
 ENV DISABLE_ADDITIONAL_FEATURES=false \
    VERSION_TAG=$VERSION_TAG \
-    JAVA_BASE_OPTS="-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/configs/heap_dumps -XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70" \
+    JAVA_BASE_OPTS="-XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70" \
    JAVA_CUSTOM_OPTS="" \
    HOME=/home/stirlingpdfuser \
    PUID=1000 \
@@ -95,7 +95,7 @@ RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/a
    su-exec \
    openjdk21-jre \
    nginx && \
-    mkdir -p $HOME /configs /configs/heap_dumps /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf /pipeline/watchedFolders /pipeline/finishedFolders && \
+    mkdir -p $HOME /configs /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf /pipeline/watchedFolders /pipeline/finishedFolders && \
    mkdir -p /usr/share/fonts/opentype/noto /var/lib/nginx/tmp /var/log/nginx && \
    chmod +x /scripts/*.sh && \
    chmod +x /entrypoint.sh && \
@@ -128,8 +128,7 @@ LABEL org.opencontainers.image.keywords="PDF, manipulation, backend, API, Spring
 # ==============================================================================
 ENV VERSION_TAG=$VERSION_TAG \
    DISABLE_ADDITIONAL_FEATURES=true \
-    JAVA_BASE_OPTS="-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/configs/heap_dumps \
-    -XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 \
+    JAVA_BASE_OPTS="-XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 \
    -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 \
    -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70 \
    -Djava.awt.headless=true" \
@@ -167,7 +166,7 @@ ENV PATH="/opt/venv/bin:/opt/unoserver-venv/bin:${PATH}"
 # ==============================================================================
 RUN set -eux; \
    chmod +x /scripts/*; \
-    mkdir -p /configs /configs/heap_dumps /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf; \
+    mkdir -p /configs /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf; \
    chown -R stirlingpdfuser:stirlingpdfgroup \
    /home/stirlingpdfuser /configs /logs /customFiles /pipeline /tmp/stirling-pdf \
    /app.jar /restart-helper.jar /usr/share/fonts/truetype /scripts; \
@@ -127,8 +127,7 @@ LABEL org.opencontainers.image.keywords="PDF, manipulation, merge, split, conver
 # ==============================================================================
 ENV VERSION_TAG=$VERSION_TAG \
    DISABLE_ADDITIONAL_FEATURES=true \
-    JAVA_BASE_OPTS="-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/configs/heap_dumps \
-    -XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 \
+    JAVA_BASE_OPTS="-XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 \
    -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 \
    -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70 \
    -Djava.awt.headless=true" \
@@ -168,7 +167,7 @@ ENV PATH="/opt/venv/bin:/opt/unoserver-venv/bin:${PATH}"
 # ==============================================================================
 RUN set -eux; \
    chmod +x /scripts/*; \
-    mkdir -p /configs /configs/heap_dumps /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf; \
+    mkdir -p /configs /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf; \
    chown -R stirlingpdfuser:stirlingpdfgroup \
    /home/stirlingpdfuser /configs /logs /customFiles /pipeline /tmp/stirling-pdf \
    /app.jar /restart-helper.jar /usr/share/fonts/truetype /scripts; \
@@ -34,7 +34,7 @@ ARG VERSION_TAG
 # Set Environment Variables
 ENV HOME=/home/stirlingpdfuser \
    VERSION_TAG=$VERSION_TAG \
-    JAVA_BASE_OPTS="-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/configs/heap_dumps -XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70" \
+    JAVA_BASE_OPTS="-XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70" \
    JAVA_CUSTOM_OPTS="" \
    PUID=1000 \
    PGID=1000 \
@@ -71,7 +71,7 @@ RUN apk add --no-cache bash \
        ghostscript \
        fontforge && \
    # User permissions
-    mkdir -p /configs /configs/heap_dumps /logs /customFiles /usr/share/fonts/opentype/noto /tmp/stirling-pdf /pipeline/watchedFolders /pipeline/finishedFolders && \
+    mkdir -p /configs /logs /customFiles /usr/share/fonts/opentype/noto /tmp/stirling-pdf /pipeline/watchedFolders /pipeline/finishedFolders && \
    chmod +x /scripts/*.sh && \
    addgroup -S stirlingpdfgroup && adduser -S stirlingpdfuser -G stirlingpdfgroup && \
    chown -R stirlingpdfuser:stirlingpdfgroup $HOME /scripts /pipeline /configs /customFiles /pipeline /tmp/stirling-pdf && \
@@ -4,7 +4,7 @@ services:
      context: ../..
      dockerfile: docker/backend/Dockerfile.fat
    container_name: stirling-pdf-backend-fat
-    restart: unless-stopped
+    restart: on-failure:5
    deploy:
      resources:
        limits:
@@ -42,7 +42,7 @@ services:
      context: ../..
      dockerfile: docker/frontend/Dockerfile
    container_name: stirling-pdf-frontend-fat
-    restart: unless-stopped
+    restart: on-failure:5
    ports:
      - "3000:80"
    environment:
@@ -4,7 +4,7 @@ services:
      context: ../..
      dockerfile: docker/backend/Dockerfile.ultra-lite
    container_name: stirling-pdf-backend-ultra-lite
-    restart: unless-stopped
+    restart: on-failure:5
    deploy:
      resources:
        limits:
@@ -39,7 +39,7 @@ services:
      context: ../..
      dockerfile: docker/frontend/Dockerfile
    container_name: stirling-pdf-frontend-ultra-lite
-    restart: unless-stopped
+    restart: on-failure:5
    ports:
      - "3000:80"
    environment:
@@ -4,7 +4,7 @@ services:
      context: ../..
      dockerfile: docker/backend/Dockerfile
    container_name: stirling-pdf-backend
-    restart: unless-stopped
+    restart: on-failure:5
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8080/api/v1/info/status | grep -q 'UP'"]
      interval: 5s
@@ -37,7 +37,7 @@ services:
      context: ../..
      dockerfile: docker/frontend/Dockerfile
    container_name: stirling-pdf-frontend
-    restart: unless-stopped
+    restart: on-failure:5
    ports:
      - "3000:80"
    environment:
@@ -54,7 +54,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
    tesseract-ocr tesseract-ocr-eng tesseract-ocr-deu tesseract-ocr-fra \
    tesseract-ocr-por tesseract-ocr-chi-sim \
    libcairo2 libpango-1.0-0 libpangoft2-1.0-0 libgdk-pixbuf-2.0-0 \
-    gosu unpaper qpdf \
+    gosu unpaper \
    # AWT headless support (required for some Java graphics operations)
    libfreetype6 libfontconfig1 libx11-6 libxt6 libxext6 libxrender1 libxtst6 libxi6 \
    libxinerama1 libxkbcommon0 libxkbfile1 libsm6 libice6 \
@@ -133,7 +133,7 @@ LABEL org.opencontainers.image.keywords="PDF, manipulation, API, Spring Boot, Re
 # Runtime environment variables
 # ==============================================================================
 ENV VERSION_TAG=$VERSION_TAG \
-    JAVA_BASE_OPTS="-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/configs/heap_dumps -XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70 -Djava.awt.headless=true" \
+    JAVA_BASE_OPTS="-XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70 -Djava.awt.headless=true" \
    JAVA_CUSTOM_OPTS="" \
    HOME=/home/stirlingpdfuser \
    PUID=${PUID} \
@@ -168,7 +168,7 @@ ENV PATH="/opt/venv/bin:/opt/unoserver-venv/bin:${PATH}"
 # ==============================================================================
 RUN set -eux; \
    chmod +x /scripts/*; \
-    mkdir -p /configs /configs/heap_dumps /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf; \
+    mkdir -p /configs /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf; \
    chown -R stirlingpdfuser:stirlingpdfgroup \
    /home/stirlingpdfuser /configs /logs /customFiles /pipeline /tmp/stirling-pdf \
    /app.jar /restart-helper.jar /usr/share/fonts/truetype /scripts; \
@@ -54,7 +54,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
    tesseract-ocr tesseract-ocr-eng tesseract-ocr-deu tesseract-ocr-fra \
    tesseract-ocr-por tesseract-ocr-chi-sim \
    libcairo2 libpango-1.0-0 libpangoft2-1.0-0 libgdk-pixbuf-2.0-0 \
-    gosu unpaper qpdf \
+    gosu unpaper \
    # Extra fonts for fat/air-gapped version
    fonts-dejavu fonts-liberation fonts-noto fonts-noto-cjk fonts-noto-color-emoji \
    fonts-freefont-ttf fonts-terminus fonts-linuxlibertine \
@@ -136,7 +136,7 @@ LABEL org.opencontainers.image.keywords="PDF, manipulation, fat, air-gapped, API
 # Runtime environment variables
 # ==============================================================================
 ENV VERSION_TAG=$VERSION_TAG \
-    JAVA_BASE_OPTS="-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/configs/heap_dumps -XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70 -Djava.awt.headless=true" \
+    JAVA_BASE_OPTS="-XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70 -Djava.awt.headless=true" \
    JAVA_CUSTOM_OPTS="" \
    HOME=/home/stirlingpdfuser \
    PUID=${PUID} \
@@ -173,7 +173,7 @@ ENV PATH="/opt/venv/bin:/opt/unoserver-venv/bin:${PATH}"
 # ==============================================================================
 RUN set -eux; \
    chmod +x /scripts/*; \
-    mkdir -p /configs /configs/heap_dumps /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf; \
+    mkdir -p /configs /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf; \
    chown -R stirlingpdfuser:stirlingpdfgroup \
    /home/stirlingpdfuser /configs /logs /customFiles /pipeline /tmp/stirling-pdf \
    /app.jar /restart-helper.jar /usr/share/fonts/truetype /scripts; \
@@ -63,7 +63,7 @@ COPY --from=build /app/build/libs/restart-helper.jar /restart-helper.jar

 # Environment Variables
 ENV VERSION_TAG=$VERSION_TAG \
-    JAVA_BASE_OPTS="-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/configs/heap_dumps -XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70" \
+    JAVA_BASE_OPTS="-XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70" \
    JAVA_CUSTOM_OPTS="" \
    HOME=/home/stirlingpdfuser \
    PUID=1000 \
@@ -89,7 +89,7 @@ RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/a
    shadow \
    su-exec \
    openjdk21-jre && \
-    mkdir -p $HOME /configs /configs/heap_dumps /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf && \
+    mkdir -p $HOME /configs /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /tmp/stirling-pdf && \
    mkdir -p /usr/share/fonts/opentype/noto && \
    chmod +x /scripts/*.sh && \
    # User permissions
@@ -33,4 +33,4 @@ services:
      METRICS_ENABLED: "true"
      SYSTEM_GOOGLEVISIBILITY: "true"
      SHOW_SURVEY: "true"
-    restart: unless-stopped
+    restart: on-failure:5
@@ -31,4 +31,4 @@ services:
      METRICS_ENABLED: "true"
      SYSTEM_GOOGLEVISIBILITY: "true"
      SHOW_SURVEY: "true"
-    restart: unless-stopped
+    restart: on-failure:5
@@ -26,4 +26,4 @@ services:
      METRICS_ENABLED: "true"
      SYSTEM_GOOGLEVISIBILITY: "true"
      SHOW_SURVEY: "true"
-    restart: unless-stopped
+    restart: on-failure:5
@@ -17,7 +17,6 @@
    "@embedpdf/plugin-loader": "^1.5.0",
    "@embedpdf/plugin-pan": "^1.5.0",
    "@embedpdf/plugin-print": "^1.5.0",
-    "@embedpdf/plugin-redaction": "^1.5.0",
    "@embedpdf/plugin-render": "^1.5.0",
    "@embedpdf/plugin-rotate": "^1.5.0",
    "@embedpdf/plugin-scroll": "^1.5.0",
@@ -43,10 +42,9 @@
    "@supabase/supabase-js": "^2.47.13",
    "@tailwindcss/postcss": "^4.1.13",
    "@tanstack/react-virtual": "^3.13.12",
-    "@tauri-apps/api": "^2.9.1",
+    "@tauri-apps/api": "^2.5.0",
    "@tauri-apps/plugin-fs": "^2.4.0",
    "@tauri-apps/plugin-http": "^2.5.4",
-    "@tauri-apps/plugin-shell": "^2.3.3",
    "autoprefixer": "^10.4.21",
    "axios": "^1.12.2",
    "globals": "^16.4.0",
@@ -78,10 +76,6 @@
    "preview": "vite preview",
    "tauri-dev": "tauri dev --no-watch",
    "tauri-build": "tauri build",
-    "tauri-build-dev": "tauri build --no-bundle",
-    "tauri-build-dev-mac": "tauri build --bundles app",
-    "tauri-build-dev-windows": "tauri build --bundles nsis",
-    "tauri-build-dev-linux": "tauri build --bundles appimage",
    "tauri-clean": "cd src-tauri && cargo clean && cd .. && rm -rf dist build",
    "typecheck": "npm run typecheck:proprietary",
    "typecheck:core": "tsc --noEmit --project tsconfig.core.json",
@@ -129,7 +123,7 @@
    "@iconify-json/material-symbols": "^1.2.48",
    "@iconify/utils": "^3.0.2",
    "@playwright/test": "^1.55.0",
-    "@tauri-apps/cli": "^2.9.5",
+    "@tauri-apps/cli": "^2.5.0",
    "@testing-library/dom": "^10.4.1",
    "@testing-library/jest-dom": "^6.8.0",
    "@testing-library/react": "^16.3.0",
@@ -1,11 +1,8 @@
 unsavedChanges = "You have unsaved changes to your PDF."
-pendingRedactionsTitle = "Unapplied Redactions"
-pendingRedactions = "You have unapplied redactions that will be lost."
 areYouSure = "Are you sure you want to leave?"
 unsavedChangesTitle = "Unsaved Changes"
 keepWorking = "Keep Working"
 discardChanges = "Discard & Leave"
-discardRedactions = "Discard & Leave"
 applyAndContinue = "Save & Leave"
 exportAndContinue = "Export & Continue"
 cancel = "Cancel"
@@ -531,8 +528,6 @@ accountSettings = "Account Settings"
 adminSettings = "Admin Settings - View and Add Users"
 userControlSettings = "User Control Settings"
 changeUsername = "Change Username"
-changeUsernameDescription = "Update your username. You will be logged out after updating."
-newUsernamePlaceholder = "Enter your new username"
 newUsername = "New Username"
 password = "Confirmation Password"
 oldPassword = "Old password"
@@ -3224,7 +3219,6 @@ title = "Redaction Method"
 mode = "Mode"
 automatic = "Automatic"
 automaticDesc = "Redact text based on search terms"
-automaticDisabledTooltip = "Select files in the file manager to redact multiple files at once"
 manual = "Manual"
 manualDesc = "Click and drag to redact specific areas"
 manualComingSoon = "Manual redaction coming soon"
@@ -3295,35 +3289,8 @@ text = "Only match complete words, not partial matches. 'John' won't match 'John
 title = "Convert to PDF-Image"
 text = "Converts the PDF to an image-based PDF after redaction. This ensures text behind redaction boxes is completely removed and unrecoverable."

-[redact.tooltip.manual.header]
-title = "Manual Redaction Controls"
-
-[redact.tooltip.manual.markText]
-title = "Mark Text Tool"
-text = "Select text directly on the PDF to mark it for redaction. Click and drag to highlight specific text that you want to redact."
-
-[redact.tooltip.manual.markArea]
-title = "Mark Area Tool"
-text = "Draw rectangular areas on the PDF to mark regions for redaction. Useful for redacting images, signatures, or irregular shapes."
-
-[redact.tooltip.manual.apply]
-title = "Apply Redactions"
-text = "After marking content, click 'Apply' to permanently redact all marked areas. The pending count shows how many redactions are ready to be applied."
-bullet1 = "Mark as many areas as needed before applying"
-bullet2 = "All pending redactions are applied at once"
-bullet3 = "Redactions cannot be undone after applying"
-
 [redact.manual]
-title = "Redaction Tools"
-instructions = "Select text or draw areas on the PDF to mark content for redaction."
-markText = "Mark Text"
-markArea = "Mark Area"
-pendingLabel = "Pending:"
-applyWarning = "⚠️ Permanent application, cannot be undone and the data underneath will be deleted"
-apply = "Apply"
-noMarks = "No redaction marks. Use the tools above to mark content for redaction."
 header = "Manual Redaction"
-controlsTitle = "Manual Redaction Controls"
 textBasedRedaction = "Text-based Redaction"
 pageBasedRedaction = "Page-based Redaction"
 convertPDFToImageLabel = "Convert PDF to PDF-Image (Used to remove text behind the box)"
@@ -4111,16 +4078,11 @@ language = "Language"
 toggleAnnotations = "Toggle Annotations Visibility"
 search = "Search PDF"
 panMode = "Pan Mode"
-applyRedactionsFirst = "Apply redactions first"
 rotateLeft = "Rotate Left"
 rotateRight = "Rotate Right"
 toggleSidebar = "Toggle Sidebar"
 toggleBookmarks = "Toggle Bookmarks"
 print = "Print PDF"
-draw = "Draw"
-redact = "Redact"
-exitRedaction = "Exit Redaction Mode"
-save = "Save"
 downloadAll = "Download All"
 saveAll = "Save All"

@@ -4194,7 +4156,6 @@ editSwitchToSelect = "Switch to Select & Edit to edit this annotation."
 undo = "Undo"
 redo = "Redo"
 applyChanges = "Apply Changes"
-saveChanges = "Save Changes"

 [search]
 title = "Search PDF"
@@ -6235,7 +6196,6 @@ connectingTo = "Connecting to:"
 submit = "Login"
 signInWith = "Sign in with"
 oauthPending = "Opening browser for authentication..."
-sso = "Single Sign-On"
 orContinueWith = "Or continue with email"
 serverRequirement = "Note: The server must have login enabled."
 showInstructions = "How to enable?"
@@ -4,9 +4,7 @@ version = "0.1.0"
 description = "Stirling-PDF Desktop Application"
 authors = ["Stirling-PDF Contributors"]
 license = ""
-repository = "https://github.com/Stirling-Tools/Stirling-PDF"
-homepage = "https://www.stirlingpdf.com"
-documentation = "https://docs.stirlingpdf.com"
+repository = ""
 edition = "2021"
 rust-version = "1.77.2"

@@ -20,37 +18,37 @@ name = "app_lib"
 crate-type = ["staticlib", "cdylib", "rlib"]

 [build-dependencies]
-tauri-build = { version = "2.5.3", features = [] }
+tauri-build = { version = "2.2.0", features = [] }

 [dependencies]
 serde_json = "1.0"
 serde = { version = "1.0", features = ["derive"] }
 log = "0.4"
-tauri = { version = "2.9.4", features = [ "devtools"] }
-tauri-plugin-log = "2.7.1"
-tauri-plugin-shell = "2.3.3"
+tauri = { version = "2.9.0", features = [ "devtools"] }
+tauri-plugin-log = "2.0.0-rc"
+tauri-plugin-shell = "2.1.0"
 tauri-plugin-fs = "2.4.4"
-tauri-plugin-http = "2.5.4"
+tauri-plugin-http = "2.4.4"
 tauri-plugin-single-instance = { version = "2.3.6", features = ["deep-link"] }
-tauri-plugin-store = "2.4.1"
-tauri-plugin-opener = "2.5.2"
-keyring = { version = "3.6.3", features = ["apple-native", "windows-native"] }
-tokio = { version = "1.48", features = ["time", "sync"] }
-reqwest = { version = "0.12", features = ["json"] }
+tauri-plugin-store = "2.1.0"
+tauri-plugin-opener = "2.0.0"
 tauri-plugin-deep-link = "2.4.5"
+keyring = { version = "3.6.1", features = ["apple-native", "windows-native"] }
+tokio = { version = "1.0", features = ["time", "sync"] }
+reqwest = { version = "0.11", features = ["json"] }
 tiny_http = "0.12"
 url = "2.5"
 urlencoding = "2.1"
 sha2 = "0.10"
 base64 = "0.22"
-rand = "0.9"
+rand = "0.8"

 [target.'cfg(target_os = "macos")'.dependencies]
 core-foundation = "0.10"
 core-services = "1.0"

 [target.'cfg(target_os = "windows")'.dependencies]
-windows = { version = "0.61", features = [
+windows = { version = "0.58", features = [
    "Win32_Foundation",
    "Win32_System_Com",
    "Win32_UI_Shell",
@@ -6,8 +6,8 @@ use tauri_plugin_store::StoreExt;
 use tiny_http::{Response, Server};
 use sha2::{Sha256, Digest};
 use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
-use rand::Rng;
-use rand::distr::Alphanumeric;
+use rand::{thread_rng, Rng};
+use rand::distributions::Alphanumeric;

 const STORE_FILE: &str = "connection.json";
 const USER_INFO_KEY: &str = "user_info";
@@ -85,14 +85,7 @@ pub async fn clear_auth_token(_app_handle: AppHandle) -> Result<(), String> {
    // Delete the token - ignore error if it doesn't exist
    match entry.delete_credential() {
        Ok(_) | Err(keyring::Error::NoEntry) => Ok(()),
-        Err(e) => {
-            log::warn!("Failed to delete keyring credential: {}. Attempting overwrite with empty token.", e);
-            // As a fallback, overwrite with an empty token so a stale value cannot be reused
-            match entry.set_password("") {
-                Ok(_) => Ok(()),
-                Err(e2) => Err(format!("Failed to clear token (delete + overwrite failed): {}", e2)),
-            }
-        },
+        Err(e) => Err(format!("Failed to clear token: {}", e)),
    }
 }

@@ -319,7 +312,7 @@ pub async fn login(

 /// Generate PKCE code_verifier (random 43-128 character string)
 fn generate_code_verifier() -> String {
-    rand::rng()
+    thread_rng()
        .sample_iter(&Alphanumeric)
        .take(128)
        .map(char::from)
@@ -40,33 +40,8 @@ fn dispatch_deep_link(app: &AppHandle, url: &str) {
  }
 }

-#[cfg(target_os = "linux")]
-fn configure_linux_webview() {
-  let mut applied_settings = Vec::new();
-
-  if std::env::var_os("WEBKIT_DISABLE_COMPOSITING_MODE").is_none() {
-    std::env::set_var("WEBKIT_DISABLE_COMPOSITING_MODE", "1");
-    applied_settings.push("WEBKIT_DISABLE_COMPOSITING_MODE=1 (software rendering)");
-  }
-
-  if std::env::var_os("WEBKIT_DISABLE_DMABUF_RENDERER").is_none() {
-    std::env::set_var("WEBKIT_DISABLE_DMABUF_RENDERER", "1");
-    applied_settings.push("WEBKIT_DISABLE_DMABUF_RENDERER=1 (fallback EGL renderer)");
-  }
-
-  if !applied_settings.is_empty() {
-    add_log(format!(
-      "🛠️ Applied Linux WebKit fallbacks to avoid EGL issues: {}",
-      applied_settings.join(", ")
-    ));
-  }
-}
-
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
-  #[cfg(target_os = "linux")]
-  configure_linux_webview();
-
  tauri::Builder::default()
    .plugin(
      tauri_plugin_log::Builder::new()
@@ -3,8 +3,7 @@ Version=1.0
 Type=Application
 Name=Stirling-PDF
 Comment=Locally hosted web application that allows you to perform various operations on PDF files
-TryExec={{exec}}
-Exec={{exec}} %F
+Exec=/usr/bin/stirling-pdf
 Icon={{icon}}
 Terminal=false
 MimeType=application/pdf;
@@ -13,4 +12,4 @@ Actions=open-file;

 [Desktop Action open-file]
 Name=Open PDF File
-Exec={{exec}} %F
+Exec=/usr/bin/stirling-pdf %F
@@ -25,8 +25,8 @@
        "targets": [
            "deb",
            "rpm",
-            "appimage",
            "dmg",
+            "app",
            "msi"
        ],
        "icon": [
@@ -57,12 +57,6 @@
        "linux": {
            "deb": {
                "desktopTemplate": "stirling-pdf.desktop"
-            },
-            "rpm": {
-                "desktopTemplate": "stirling-pdf.desktop"
-            },
-            "appimage": {
-                "bundleMediaFramework": false
            }
        },
        "windows": {
@@ -92,4 +86,4 @@
            }
        }
    }
-}
+}
@@ -22,7 +22,6 @@ import { useScarfTracking } from "@app/hooks/useScarfTracking";
 import { useAppInitialization } from "@app/hooks/useAppInitialization";
 import { useLogoAssets } from '@app/hooks/useLogoAssets';
 import AppConfigLoader from '@app/components/shared/AppConfigLoader';
-import { RedactionProvider } from "@app/contexts/RedactionContext";

 // Component to initialize scarf tracking (must be inside AppConfigProvider)
 function ScarfTrackingInitializer() {
@@ -97,7 +96,6 @@ export function AppProviders({ children, appConfigRetryOptions, appConfigProvide
                                <ViewerProvider>
                                  <PageEditorProvider>
                                    <SignatureProvider>
-                                      <RedactionProvider>
                                      <AnnotationProvider>
                                        <RightRailProvider>
                                          <TourOrchestrationProvider>
@@ -107,7 +105,6 @@ export function AppProviders({ children, appConfigRetryOptions, appConfigProvide
                                          </TourOrchestrationProvider>
                                        </RightRailProvider>
                                      </AnnotationProvider>
-                                      </RedactionProvider>
                                    </SignatureProvider>
                                  </PageEditorProvider>
                                </ViewerProvider>
@@ -43,7 +43,7 @@ const FileEditor = ({
  const { clearAllFileErrors } = fileContextActions;

  // Extract needed values from state (memoized to prevent infinite loops)
-  const activeStirlingFileStubs = useMemo(() => selectors.getStirlingFileStubs(), [state.files.byId, state.files.ids]);
+  const activeStirlingFileStubs = useMemo(() => selectors.getStirlingFileStubs(), [selectors.getFilesSignature()]);
  const selectedFileIds = state.ui.selectedFileIds;
  const totalItems = state.files.ids.length;
  const selectedCount = selectedFileIds.length;
@@ -365,7 +365,7 @@ const FileEditor = ({
      activateOnDrag={true}
    >
      <Box pos="relative" style={{ overflow: 'auto' }}>
-        <LoadingOverlay visible={state.ui.isProcessing} />
+        <LoadingOverlay visible={false} />

        <Box p="md">

@@ -1,5 +1,5 @@
 import React, { useState, useCallback, useRef, useMemo } from 'react';
-import { Text, ActionIcon, CheckboxIndicator, Tooltip, Modal, Button, Group, Stack, Loader } from '@mantine/core';
+import { Text, ActionIcon, CheckboxIndicator, Tooltip, Modal, Button, Group, Stack } from '@mantine/core';
 import { useIsMobile } from '@app/hooks/useIsMobile';
 import { alert } from '@app/components/toast';
 import { useTranslation } from 'react-i18next';
@@ -389,7 +389,7 @@ const FileEditorThumbnail = ({
        style={isSupported || hasError ? undefined : { filter: 'grayscale(80%)', opacity: 0.6 }}
      >
        <div className={styles.previewPaper}>
-          {file.thumbnailUrl ? (
+          {file.thumbnailUrl && (
            <PrivateContent>
              <img
                src={file.thumbnailUrl}
@@ -416,12 +416,7 @@ const FileEditorThumbnail = ({
              }}
            />
            </PrivateContent>
-          ) : file.type?.startsWith('application/pdf') ? (
-            <Stack align="center" justify="center" gap="xs" style={{ height: '100%' }}>
-              <Loader size="sm" />
-              <Text size="xs" c="dimmed">Loading thumbnail...</Text>
-            </Stack>
-          ) : null}
+          )}
        </div>

        {/* Drag handle (span wrapper so we can attach a ref reliably) */}
@@ -73,9 +73,9 @@ const FileDetails: React.FC<FileDetailsProps> = ({
  }

  return (
-    <Stack gap="lg" h={`calc(${modalHeight} - 2rem)`} justify="flex-start">
+    <Stack gap="lg" h={`calc(${modalHeight} - 2rem)`}>
      {/* Section 1: Thumbnail Preview */}
-      <Box style={{ width: '100%', height: 'min(35vh, 280px)', textAlign: 'center', flexShrink: 0 }}>
+      <Box style={{ width: '100%', height: `calc(${modalHeight} * 0.5 - 2rem)`, textAlign: 'center', padding: 'xs' }}>
        <FilePreview
          file={currentFile}
          thumbnail={getCurrentThumbnail()}
@@ -96,10 +96,12 @@ const FileDetails: React.FC<FileDetailsProps> = ({

      <Button
        size="md"
+        mb="xl"
        onClick={onOpenFiles}
        disabled={!hasSelection}
        fullWidth
        style={{
+          flexShrink: 0,
          backgroundColor: hasSelection ? 'var(--btn-open-file)' : 'var(--mantine-color-gray-4)',
          color: 'white'
        }}
@@ -18,13 +18,13 @@ const FileInfoCard: React.FC<FileInfoCardProps> = ({
  const { t } = useTranslation();

  return (
-    <Card withBorder p={0} mah={`calc(${modalHeight} * 0.45)`} style={{ overflow: 'hidden', flexShrink: 1, display: 'flex', flexDirection: 'column' }}>
-      <Box bg="gray.4" p="sm" style={{ borderTopLeftRadius: 'var(--mantine-radius-md)', borderTopRightRadius: 'var(--mantine-radius-md)', flexShrink: 0 }}>
+    <Card withBorder p={0} h={`calc(${modalHeight} * 0.32 - 1rem)`} style={{ flex: 1, overflow: 'hidden' }}>
+      <Box bg="gray.4" p="sm" style={{ borderTopLeftRadius: 'var(--mantine-radius-md)', borderTopRightRadius: 'var(--mantine-radius-md)' }}>
        <Text size="sm" fw={500} ta="center" c="white">
          {t('fileManager.details', 'File Details')}
        </Text>
      </Box>
-      <ScrollArea style={{ flex: 1, minHeight: 0 }} p="md">
+      <ScrollArea style={{ flex: 1 }} p="md">
        <Stack gap="sm">
          <Group justify="space-between" py="xs">
            <Text size="sm" c="dimmed">
@@ -1,10 +1,9 @@
-import { useCallback } from 'react';
 import { Box } from '@mantine/core';
 import { useRainbowThemeContext } from '@app/components/shared/RainbowThemeProvider';
 import { useToolWorkflow } from '@app/contexts/ToolWorkflowContext';
 import { useFileHandler } from '@app/hooks/useFileHandler';
 import { useFileState } from '@app/contexts/FileContext';
-import { useNavigationState, useNavigationActions, useNavigationGuard } from '@app/contexts/NavigationContext';
+import { useNavigationState, useNavigationActions } from '@app/contexts/NavigationContext';
 import { isBaseWorkbench } from '@app/types/workbench';
 import { useViewer } from '@app/contexts/ViewerContext';
 import { useAppConfig } from '@app/contexts/AppConfigContext';
@@ -52,21 +51,6 @@ export default function Workbench() {

  // Get active file index from ViewerContext
  const { activeFileIndex, setActiveFileIndex } = useViewer();
-  
-  // Get navigation guard for unsaved changes check when switching files
-  const { requestNavigation } = useNavigationGuard();
-
-  // Wrap file selection to check for unsaved changes before switching
-  // requestNavigation will show the modal if there are unsaved changes, otherwise navigate immediately
-  const handleFileSelect = useCallback((index: number) => {
-    // Don't do anything if selecting the same file
-    if (index === activeFileIndex) return;
-    
-    // requestNavigation handles the unsaved changes check internally
-    requestNavigation(() => {
-      setActiveFileIndex(index);
-    });
-  }, [activeFileIndex, requestNavigation, setActiveFileIndex]);

  const handlePreviewClose = () => {
    setPreviewFile(null);
@@ -198,7 +182,7 @@ export default function Workbench() {
            return { fileId: f.fileId, name: f.name, versionNumber: stub?.versionNumber };
          })}
          currentFileIndex={activeFileIndex}
-          onFileSelect={handleFileSelect}
+          onFileSelect={setActiveFileIndex}
        />
      )}

@@ -1,11 +1,10 @@
-import { Button, Group, Stack, Text, Tooltip } from "@mantine/core";
+import { Button, Group, Stack, Text } from "@mantine/core";
 import FitText from "@app/components/shared/FitText";

 export interface ButtonOption<T> {
  value: T;
  label: string;
  disabled?: boolean;
-  tooltip?: string;  // Tooltip shown on hover (useful for explaining why option is disabled)
 }

 interface ButtonSelectorProps<T> {
@@ -40,46 +39,33 @@ const ButtonSelector = <T extends string | number>({

      {/* Buttons */}
      <Group gap='4px'>
-        {options.map((option) => {
-          const isDisabled = disabled || option.disabled;
-          const button = (
-            <Button
-              variant={value === option.value ? 'filled' : 'outline'}
-              color={value === option.value ? 'var(--color-primary-500)' : 'var(--text-muted)'}
-              onClick={() => onChange(option.value)}
-              disabled={isDisabled}
-              className={buttonClassName}
-              style={{
-                flex: fullWidth ? 1 : undefined,
-                height: 'auto',
-                minHeight: '2.5rem',
-                fontSize: 'var(--mantine-font-size-sm)',
-                lineHeight: '1.4',
-                paddingTop: '0.5rem',
-                paddingBottom: '0.5rem'
-              }}
-            >
-              <FitText
-                text={option.label}
-                lines={1}
-                minimumFontScale={0.5}
-                fontSize={10}
-                className={textClassName}
-              />
-            </Button>
-          );
-
-          // Wrap with tooltip if provided (useful for disabled state explanations)
-          if (option.tooltip && isDisabled) {
-            return (
-              <Tooltip key={option.value} label={option.tooltip} position="top" withArrow>
-                <span style={{ flex: fullWidth ? 1 : undefined, display: 'flex' }}>{button}</span>
-              </Tooltip>
-            );
-          }
-
-          return <span key={option.value} style={{ flex: fullWidth ? 1 : undefined, display: 'flex' }}>{button}</span>;
-        })}
+        {options.map((option) => (
+          <Button
+            key={option.value}
+            variant={value === option.value ? 'filled' : 'outline'}
+            color={value === option.value ? 'var(--color-primary-500)' : 'var(--text-muted)'}
+            onClick={() => onChange(option.value)}
+            disabled={disabled || option.disabled}
+            className={buttonClassName}
+            style={{
+              flex: fullWidth ? 1 : undefined,
+              height: 'auto',
+              minHeight: '2.5rem',
+              fontSize: 'var(--mantine-font-size-sm)',
+              lineHeight: '1.4',
+              paddingTop: '0.5rem',
+              paddingBottom: '0.5rem'
+            }}
+          >
+            <FitText
+              text={option.label}
+              lines={1}
+              minimumFontScale={0.5}
+              fontSize={10}
+              className={textClassName}
+            />
+          </Button>
+        ))}
      </Group>
    </Stack>
  );
@@ -1,5 +1,5 @@
 import { useState } from "react";
-import { Card, Stack, Text, Group, Badge, Button, Box, Image, ThemeIcon, ActionIcon, Tooltip, Loader } from "@mantine/core";
+import { Card, Stack, Text, Group, Badge, Button, Box, Image, ThemeIcon, ActionIcon, Tooltip } from "@mantine/core";
 import { useTranslation } from "react-i18next";
 import PictureAsPdfIcon from "@mui/icons-material/PictureAsPdf";
 import StorageIcon from "@mui/icons-material/Storage";
@@ -29,10 +29,6 @@ const FileCard = ({ file, fileStub, onRemove, onDoubleClick, onView, onEdit, isS
  const thumb = fileStub?.thumbnailUrl || indexedDBThumb;
  const [isHovered, setIsHovered] = useState(false);

-  // Show loading state during hydration: PDF file without thumbnail yet
-  const isPdf = file.type === 'application/pdf';
-  const isHydrating = isPdf && !thumb && !isGenerating;
-
  return (
    <Card
      shadow="xs"
@@ -129,11 +125,24 @@ const FileCard = ({ file, fileStub, onRemove, onDoubleClick, onView, onEdit, isS
              fit="contain"
              radius="sm"
            />
-          ) : (isGenerating || isHydrating) ? (
-            <Stack align="center" justify="center" gap="xs">
-              <Loader size="sm" />
-              <Text size="xs" c="dimmed">Loading...</Text>
-            </Stack>
+          ) : isGenerating ? (
+            <div style={{
+              display: 'flex',
+              flexDirection: 'column',
+              alignItems: 'center',
+              justifyContent: 'center'
+            }}>
+              <div style={{
+                width: 20,
+                height: 20,
+                border: '2px solid #ddd',
+                borderTop: '2px solid #666',
+                borderRadius: '50%',
+                animation: 'spin 1s linear infinite',
+                marginBottom: 8
+              }} />
+              <Text size="xs" c="dimmed">Generating...</Text>
+            </div>
          ) : (
            <div style={{
              display: 'flex',
@@ -25,6 +25,9 @@ export default function Footer({
  const { t } = useTranslation();
  const { footerInfo } = useFooterInfo();

+  console.log('[Footer] Props analyticsEnabled:', analyticsEnabled);
+  console.log('[Footer] Fetched footerInfo:', footerInfo);
+
  // Use props if provided, otherwise fall back to fetched footer info
  const finalAnalyticsEnabled = analyticsEnabled ?? footerInfo?.analyticsEnabled ?? false;
  const finalPrivacyPolicy = privacyPolicy ?? footerInfo?.privacyPolicy;
@@ -33,6 +36,8 @@ export default function Footer({
  const finalCookiePolicy = cookiePolicy ?? footerInfo?.cookiePolicy;
  const finalImpressum = impressum ?? footerInfo?.impressum;

+  console.log('[Footer] Final analyticsEnabled:', finalAnalyticsEnabled);
+
  const { showCookiePreferences } = useCookieConsent({ analyticsEnabled: finalAnalyticsEnabled, forceLightMode });

  // Default URLs
@@ -4,16 +4,13 @@ import { useTranslation } from "react-i18next";
 import ArrowBackIcon from "@mui/icons-material/ArrowBack";
 import DeleteOutlineIcon from "@mui/icons-material/DeleteOutline";
 import CheckCircleOutlineIcon from "@mui/icons-material/CheckCircleOutline";
-import { Z_INDEX_TOAST } from "@app/styles/zIndex";

 interface NavigationWarningModalProps {
  onApplyAndContinue?: () => Promise<void>;
  onExportAndContinue?: () => Promise<void>;
-  /** Called when discarding - allows saving applied changes while discarding pending ones */
-  onDiscardAndContinue?: () => Promise<void>;
 }

-const NavigationWarningModal = ({ onApplyAndContinue, onExportAndContinue, onDiscardAndContinue }: NavigationWarningModalProps) => {
+const NavigationWarningModal = ({ onApplyAndContinue, onExportAndContinue }: NavigationWarningModalProps) => {
  const { t } = useTranslation();
  const { showNavigationWarning, hasUnsavedChanges, pendingNavigation, cancelNavigation, confirmNavigation, setHasUnsavedChanges } =
    useNavigationGuard();
@@ -22,11 +19,7 @@ const NavigationWarningModal = ({ onApplyAndContinue, onExportAndContinue, onDis
    cancelNavigation();
  };

-  const handleDiscardChanges = async () => {
-    // If a discard handler is provided, call it to save any already-applied changes, then discard the unsaved changes
-    if (onDiscardAndContinue) {
-      await onDiscardAndContinue();
-    }
+  const handleDiscardChanges = () => {
    setHasUnsavedChanges(false);
    confirmNavigation();
  };
@@ -39,15 +32,14 @@ const NavigationWarningModal = ({ onApplyAndContinue, onExportAndContinue, onDis
    confirmNavigation();
  };

-  const handleExportAndContinue = async () => {
+  const _handleExportAndContinue = async () => {
    if (onExportAndContinue) {
      await onExportAndContinue();
    }
    setHasUnsavedChanges(false);
    confirmNavigation();
  };
-
-  const BUTTON_WIDTH = "12rem";
+  const BUTTON_WIDTH = "10rem";

  // Only show modal if there are unsaved changes AND there's an actual pending navigation
  // This prevents the modal from showing due to spurious state updates
@@ -64,7 +56,6 @@ const NavigationWarningModal = ({ onApplyAndContinue, onExportAndContinue, onDis
      size="auto"
      closeOnClickOutside={true}
      closeOnEscape={true}
-      zIndex={Z_INDEX_TOAST}
    >
      <Stack>
        <Stack  ta="center"  p="md">
@@ -92,11 +83,6 @@ const NavigationWarningModal = ({ onApplyAndContinue, onExportAndContinue, onDis
                {t("applyAndContinue", "Apply & Leave")}
              </Button>
            )}
-            {onExportAndContinue && (
-              <Button variant="filled"  onClick={handleExportAndContinue} w={BUTTON_WIDTH} leftSection={<CheckCircleOutlineIcon fontSize="small" />}>
-                {t("exportAndContinue", "Export & Leave")}
-              </Button>
-            )}
          </Group>
        </Group>

@@ -113,11 +99,6 @@ const NavigationWarningModal = ({ onApplyAndContinue, onExportAndContinue, onDis
              {t("applyAndContinue", "Apply & Leave")}
            </Button>
          )}
-          {onExportAndContinue && (
-            <Button variant="filled" onClick={handleExportAndContinue} w={BUTTON_WIDTH} leftSection={<CheckCircleOutlineIcon fontSize="small" />}>
-              {t("exportAndContinue", "Export & Leave")}
-            </Button>
-          )}
        </Stack>
      </Stack>
    </Modal>
--- a/Show More
+++ b/Show More