Merge branch 'main' into codex/verify-entry-points-for-security-issues

Harden URL fetch validation and size parsing
2026-01-22 20:36:07 +00:00 · 2026-01-06 20:24:37 +00:00
765 changed files with 285711 additions and 315717 deletions
@@ -1,52 +1,75 @@
-# Version control
-.git/
+# Node modules and build artifacts
+node_modules
+frontend/node_modules
+frontend/dist
+frontend/build
+frontend/.vite
+frontend/.tauri
+frontend/src-tauri/target
+
+# Gradle build artifacts
+.gradle
+build
+bin
+target
+out
+
+# Git
+.git
 .gitignore

-# Build outputs
-build/
-*/build/
-**/build/
-out/
-target/
-
-# Gradle caches (local, not what's in the container)
-.gradle/
-**/.gradle/
-
-# Node / frontend
-node_modules/
-**/node_modules/
-.npm/
-.yarn/
-
-# IDE and editor
-.idea/
-.vscode/
+# IDE
+.vscode
+.idea
 *.iml
-*.ipr
 *.iws
+*.ipr

-# Logs and temp files
+# Logs
 *.log
-*.tmp
-*.pid
-.DS_Store
-Thumbs.db
+logs

-# Docker itself
-Dockerfile*
-.dockerignore
-
-# CI / CD configs (not needed in build context)
-.github/
-.circleci/
-.gitlab-ci.yml
-
-# Test reports
-**/test-results/
-**/jacoco/
-
-# Local env
+# Environment files
 .env
 .env.*
 !.env.example
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Java compiled files
+*.class
+*.jar
+*.war
+*.ear
+
+# Test reports
+test-results
+coverage
+
+# Docker
+docker-compose.override.yml
+.dockerignore
+
+# Temporary files
+tmp
+temp
+*.tmp
+*.swp
+*~
+
+# Runtime database and config files (locked by running app)
+app/core/configs/**
+stirling/**
+stirling-pdf-DB*.mv.db
+stirling-pdf-DB*.trace.db
+
+# Documentation
+*.md
+!README.md
+docs
+
+# CI/CD
+.github
+.gitlab-ci.yml
@@ -59,8 +59,8 @@ def find_duplicate_keys(file_path, keys=None, prefix=""):
    return duplicates


-# Maximum size for TOML files (e.g., 1 MB)
-MAX_FILE_SIZE = 1000 * 1024
+# Maximum size for TOML files (e.g., 570 KB)
+MAX_FILE_SIZE = 570 * 1024


 def parse_toml_file(file_path):
@@ -259,27 +259,10 @@ def check_for_differences(reference_file, file_list, branch, actor):
                report.append(
                    f"    - **_Extra keys in `{locale_dir}/{basename_current_file}`_**: `{missing_keys_str}` that are not present in **_`{basename_reference_file}`_**."
                )
-                report.append("")
-                report.append("    Use the following command to remove them:")
-                report.append(
-                    f"    `python scripts/translations/translation_merger.py {locale_dir} remove-unused`"
-                )
-                report.append("")
            if extra_keys_list:
                report.append(
                    f"    - **_Missing keys in `{locale_dir}/{basename_current_file}`_**: `{extra_keys_str}` that are not present in **_`{basename_reference_file}`_**."
                )
-                report.append("")
-                report.append("    Use the following command to add them:")
-                report.append(
-                    f"    `python scripts/translations/translation_merger.py {locale_dir} add-missing`"
-                )
-                report.append("")
-
-            if missing_keys_list or extra_keys_list:
-                report.append(
-                    "    See: https://github.com/Stirling-Tools/Stirling-PDF/tree/main/scripts/translations#2-translation_mergerpy"
-                )
        else:
            report.append("2. **Test Status:** ✅ **_Passed_**")

@@ -9,7 +9,7 @@
 # CVE-2025-6176 mitigation: pin brotli to a specific commit
 brotli @ git+https://github.com/google/brotli.git@028fb5a23661f123017c060daa546b55cf4bde29
    # via
-    #   -r requirements_dev.in
+    #   -r .github/scripts/requirements_dev.in
    #   fonttools
 cffi==2.0.0 \
    --hash=sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb \
@@ -97,9 +97,9 @@ cffi==2.0.0 \
    --hash=sha256:fc7de24befaeae77ba923797c7c87834c73648a05a4bde34b3b7e5588973a453 \
    --hash=sha256:fe562eb1a64e67dd297ccc4f5addea2501664954f2692b69a76449ec7913ecbf
    # via weasyprint
-cfgv==3.5.0 \
-    --hash=sha256:a8dc6b26ad22ff227d2634a65cb388215ce6cc96bbcc5cfde7641ae87e8dacc0 \
-    --hash=sha256:d5b1034354820651caa73ede66a6294d6e95c1b00acc5e9b098e917404669132
+cfgv==3.4.0 \
+    --hash=sha256:b7265b1f29fd3316bfcd2b330d63d024f2bfd8bcb8b0272f8e19a504856c48f9 \
+    --hash=sha256:e52591d4c5f5dead8e0f673fb16db7949d2cfb3f7da4582893288f0ded8fe560
    # via pre-commit
 cssselect2==0.8.0 \
    --hash=sha256:46fc70ebc41ced7a32cd42d58b1884d72ade23d21e5a4eaaf022401c13f0e76e \
@@ -109,269 +109,259 @@ distlib==0.4.0 \
    --hash=sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16 \
    --hash=sha256:feec40075be03a04501a973d81f633735b4b69f98b05450592310c0f401a4e0d
    # via virtualenv
-filelock==3.20.3 \
-    --hash=sha256:18c57ee915c7ec61cff0ecf7f0f869936c7c30191bb0cf406f1341778d0834e1 \
-    --hash=sha256:4b0dda527ee31078689fc205ec4f1c1bf7d56cf88b6dc9426c4f230e46c2dce1
+filelock==3.20.0 \
+    --hash=sha256:339b4732ffda5cd79b13f4e2711a31b0365ce445d95d243bb996273d072546a2 \
+    --hash=sha256:711e943b4ec6be42e1d4e6690b48dc175c822967466bb31c0c293f34334c13f4
    # via virtualenv
-fonttools==4.61.1 \
-    --hash=sha256:0de30bfe7745c0d1ffa2b0b7048fb7123ad0d71107e10ee090fa0b16b9452e87 \
-    --hash=sha256:10d88e55330e092940584774ee5e8a6971b01fc2f4d3466a1d6c158230880796 \
-    --hash=sha256:11f35ad7805edba3aac1a3710d104592df59f4b957e30108ae0ba6c10b11dd75 \
-    --hash=sha256:15acc09befd16a0fb8a8f62bc147e1a82817542d72184acca9ce6e0aeda9fa6d \
-    --hash=sha256:17d2bf5d541add43822bcf0c43d7d847b160c9bb01d15d5007d84e2217aaa371 \
-    --hash=sha256:2180f14c141d2f0f3da43f3a81bc8aa4684860f6b0e6f9e165a4831f24e6a23b \
-    --hash=sha256:21e7c8d76f62ab13c9472ccf74515ca5b9a761d1bde3265152a6dc58700d895b \
-    --hash=sha256:41a7170d042e8c0024703ed13b71893519a1a6d6e18e933e3ec7507a2c26a4b2 \
-    --hash=sha256:41ed4b5ec103bd306bb68f81dc166e77409e5209443e5773cb4ed837bcc9b0d3 \
-    --hash=sha256:497c31ce314219888c0e2fce5ad9178ca83fe5230b01a5006726cdf3ac9f24d9 \
-    --hash=sha256:4c1b526c8d3f615a7b1867f38a9410849c8f4aef078535742198e942fba0e9bd \
-    --hash=sha256:4d7092bb38c53bbc78e9255a59158b150bcdc115a1e3b3ce0b5f267dc35dd63c \
-    --hash=sha256:4f5686e1fe5fce75d82d93c47a438a25bf0d1319d2843a926f741140b2b16e0c \
-    --hash=sha256:58b0ee0ab5b1fc9921eccfe11d1435added19d6494dde14e323f25ad2bc30c56 \
-    --hash=sha256:5ce02f38a754f207f2f06557523cd39a06438ba3aafc0639c477ac409fc64e37 \
-    --hash=sha256:5fade934607a523614726119164ff621e8c30e8fa1ffffbbd358662056ba69f0 \
-    --hash=sha256:5fe9fd43882620017add5eabb781ebfbc6998ee49b35bd7f8f79af1f9f99a958 \
-    --hash=sha256:64102ca87e84261419c3747a0d20f396eb024bdbeb04c2bfb37e2891f5fadcb5 \
-    --hash=sha256:664c5a68ec406f6b1547946683008576ef8b38275608e1cee6c061828171c118 \
-    --hash=sha256:6675329885c44657f826ef01d9e4fb33b9158e9d93c537d84ad8399539bc6f69 \
-    --hash=sha256:75c1a6dfac6abd407634420c93864a1e274ebc1c7531346d9254c0d8f6ca00f9 \
-    --hash=sha256:75da8f28eff26defba42c52986de97b22106cb8f26515b7c22443ebc9c2d3261 \
-    --hash=sha256:77efb033d8d7ff233385f30c62c7c79271c8885d5c9657d967ede124671bbdfb \
-    --hash=sha256:78a7d3ab09dc47ac1a363a493e6112d8cabed7ba7caad5f54dbe2f08676d1b47 \
-    --hash=sha256:7c7db70d57e5e1089a274cbb2b1fd635c9a24de809a231b154965d415d6c6d24 \
-    --hash=sha256:8c56c488ab471628ff3bfa80964372fc13504ece601e0d97a78ee74126b2045c \
-    --hash=sha256:91669ccac46bbc1d09e9273546181919064e8df73488ea087dcac3e2968df9ba \
-    --hash=sha256:9b666a475a65f4e839d3d10473fad6d47e0a9db14a2f4a224029c5bfde58ad2c \
-    --hash=sha256:9cfef3ab326780c04d6646f68d4b4742aae222e8b8ea1d627c74e38afcbc9d91 \
-    --hash=sha256:a13fc8aeb24bad755eea8f7f9d409438eb94e82cf86b08fe77a03fbc8f6a96b1 \
-    --hash=sha256:a75c301f96db737e1c5ed5fd7d77d9c34466de16095a266509e13da09751bd19 \
-    --hash=sha256:a76d4cb80f41ba94a6691264be76435e5f72f2cb3cab0b092a6212855f71c2f6 \
-    --hash=sha256:aed04cabe26f30c1647ef0e8fbb207516fd40fe9472e9439695f5c6998e60ac5 \
-    --hash=sha256:b148b56f5de675ee16d45e769e69f87623a4944f7443850bf9a9376e628a89d2 \
-    --hash=sha256:b501c862d4901792adaec7c25b1ecc749e2662543f68bb194c42ba18d6eec98d \
-    --hash=sha256:b846a1fcf8beadeb9ea4f44ec5bdde393e2f1569e17d700bfc49cd69bde75881 \
-    --hash=sha256:b931ae8f62db78861b0ff1ac017851764602288575d65b8e8ff1963fed419063 \
-    --hash=sha256:c33ab3ca9d3ccd581d58e989d67554e42d8d4ded94ab3ade3508455fe70e65f7 \
-    --hash=sha256:c6604b735bb12fef8e0efd5578c9fb5d3d8532d5001ea13a19cddf295673ee09 \
-    --hash=sha256:d8db08051fc9e7d8bc622f2112511b8107d8f27cd89e2f64ec45e9825e8288da \
-    --hash=sha256:d9203500f7c63545b4ce3799319fe4d9feb1a1b89b28d3cb5abd11b9dd64147e \
-    --hash=sha256:dc492779501fa723b04d0ab1f5be046797fee17d27700476edc7ee9ae535a61e \
-    --hash=sha256:e6bcdf33aec38d16508ce61fd81838f24c83c90a1d1b8c68982857038673d6b8 \
-    --hash=sha256:e76ce097e3c57c4bcb67c5aa24a0ecdbd9f74ea9219997a707a4061fbe2707aa \
-    --hash=sha256:eff1ac3cc66c2ac7cda1e64b4e2f3ffef474b7335f92fc3833fc632d595fcee6 \
-    --hash=sha256:f3cb4a569029b9f291f88aafc927dd53683757e640081ca8c412781ea144565e \
-    --hash=sha256:f79b168428351d11e10c5aeb61a74e1851ec221081299f4cf56036a95431c43a \
-    --hash=sha256:fa646ecec9528bef693415c79a86e733c70a4965dd938e9a226b0fc64c9d2e6c \
-    --hash=sha256:fe2efccb324948a11dd09d22136fe2ac8a97d6c1347cf0b58a911dcd529f66b7 \
-    --hash=sha256:fff4f534200a04b4a36e7ae3cb74493afe807b517a09e99cb4faa89a34ed6ecd
+fonttools==4.60.1 \
+    --hash=sha256:022beaea4b73a70295b688f817ddc24ed3e3418b5036ffcd5658141184ef0d0c \
+    --hash=sha256:026290e4ec76583881763fac284aca67365e0be9f13a7fb137257096114cb3bc \
+    --hash=sha256:0b0835ed15dd5b40d726bb61c846a688f5b4ce2208ec68779bc81860adb5851a \
+    --hash=sha256:0eae96373e4b7c9e45d099d7a523444e3554360927225c1cdae221a58a45b856 \
+    --hash=sha256:122e1a8ada290423c493491d002f622b1992b1ab0b488c68e31c413390dc7eb2 \
+    --hash=sha256:1410155d0e764a4615774e5c2c6fc516259fe3eca5882f034eb9bfdbee056259 \
+    --hash=sha256:145daa14bf24824b677b9357c5e44fd8895c2a8f53596e1b9ea3496081dc692c \
+    --hash=sha256:1525796c3ffe27bb6268ed2a1bb0dcf214d561dfaf04728abf01489eb5339dce \
+    --hash=sha256:154cb6ee417e417bf5f7c42fe25858c9140c26f647c7347c06f0cc2d47eff003 \
+    --hash=sha256:2299df884c11162617a66b7c316957d74a18e3758c0274762d2cc87df7bc0272 \
+    --hash=sha256:2409d5fb7b55fd70f715e6d34e7a6e4f7511b8ad29a49d6df225ee76da76dd77 \
+    --hash=sha256:268ecda8ca6cb5c4f044b1fb9b3b376e8cd1b361cef275082429dc4174907038 \
+    --hash=sha256:282dafa55f9659e8999110bd8ed422ebe1c8aecd0dc396550b038e6c9a08b8ea \
+    --hash=sha256:2ee06fc57512144d8b0445194c2da9f190f61ad51e230f14836286470c99f854 \
+    --hash=sha256:3630e86c484263eaac71d117085d509cbcf7b18f677906824e4bace598fb70d2 \
+    --hash=sha256:398447f3d8c0c786cbf1209711e79080a40761eb44b27cdafffb48f52bcec258 \
+    --hash=sha256:4ba4bd646e86de16160f0fb72e31c3b9b7d0721c3e5b26b9fa2fc931dfdb2652 \
+    --hash=sha256:5664fd1a9ea7f244487ac8f10340c4e37664675e8667d6fee420766e0fb3cf08 \
+    --hash=sha256:583b7f8e3c49486e4d489ad1deacfb8d5be54a8ef34d6df824f6a171f8511d99 \
+    --hash=sha256:596ecaca36367027d525b3b426d8a8208169d09edcf8c7506aceb3a38bfb55c7 \
+    --hash=sha256:5c1015318e4fec75dd4943ad5f6a206d9727adf97410d58b7e32ab644a807914 \
+    --hash=sha256:66929e2ea2810c6533a5184f938502cfdaea4bc3efb7130d8cc02e1c1b4108d6 \
+    --hash=sha256:6ec722ee589e89a89f5b7574f5c45604030aa6ae24cb2c751e2707193b466fed \
+    --hash=sha256:6f68576bb4bbf6060c7ab047b1574a1ebe5c50a17de62830079967b211059ebb \
+    --hash=sha256:7473a8ed9ed09aeaa191301244a5a9dbe46fe0bf54f9d6cd21d83044c3321217 \
+    --hash=sha256:7b0c6d57ab00dae9529f3faf187f2254ea0aa1e04215cf2f1a8ec277c96661bc \
+    --hash=sha256:7b4c32e232a71f63a5d00259ca3d88345ce2a43295bb049d21061f338124246f \
+    --hash=sha256:8177ec9676ea6e1793c8a084a90b65a9f778771998eb919d05db6d4b1c0b114c \
+    --hash=sha256:839565cbf14645952d933853e8ade66a463684ed6ed6c9345d0faf1f0e868877 \
+    --hash=sha256:875cb7764708b3132637f6c5fb385b16eeba0f7ac9fa45a69d35e09b47045801 \
+    --hash=sha256:8a44788d9d91df72d1a5eac49b31aeb887a5f4aab761b4cffc4196c74907ea85 \
+    --hash=sha256:8b4eb332f9501cb1cd3d4d099374a1e1306783ff95489a1026bde9eb02ccc34a \
+    --hash=sha256:906306ac7afe2156fcf0042173d6ebbb05416af70f6b370967b47f8f00103bbb \
+    --hash=sha256:992775c9fbe2cf794786fa0ffca7f09f564ba3499b8fe9f2f80bd7197db60383 \
+    --hash=sha256:996a4d1834524adbb423385d5a629b868ef9d774670856c63c9a0408a3063401 \
+    --hash=sha256:9a52f254ce051e196b8fe2af4634c2d2f02c981756c6464dc192f1b6050b4e28 \
+    --hash=sha256:9d0ced62b59e0430b3690dbc5373df1c2aa7585e9a8ce38eff87f0fd993c5b01 \
+    --hash=sha256:a140761c4ff63d0cb9256ac752f230460ee225ccef4ad8f68affc723c88e2036 \
+    --hash=sha256:a184b2ea57b13680ab6d5fbde99ccef152c95c06746cb7718c583abd8f945ccc \
+    --hash=sha256:a3db56f153bd4c5c2b619ab02c5db5192e222150ce5a1bc10f16164714bc39ac \
+    --hash=sha256:a46b2f450bc79e06ef3b6394f0c68660529ed51692606ad7f953fc2e448bc903 \
+    --hash=sha256:a884aef09d45ba1206712c7dbda5829562d3fea7726935d3289d343232ecb0d3 \
+    --hash=sha256:b2cf105cee600d2de04ca3cfa1f74f1127f8455b71dbad02b9da6ec266e116d6 \
+    --hash=sha256:b33a7884fabd72bdf5f910d0cf46be50dce86a0362a65cfc746a4168c67eb96c \
+    --hash=sha256:b42d86938e8dda1cd9a1a87a6d82f1818eaf933348429653559a458d027446da \
+    --hash=sha256:b6379e7546ba4ae4b18f8ae2b9bc5960936007a1c0e30b342f662577e8bc3299 \
+    --hash=sha256:c7420a2696a44650120cdd269a5d2e56a477e2bfa9d95e86229059beb1c19e15 \
+    --hash=sha256:c8651e0d4b3bdeda6602b85fdc2abbefc1b41e573ecb37b6779c4ca50753a199 \
+    --hash=sha256:d066ea419f719ed87bc2c99a4a4bfd77c2e5949cb724588b9dd58f3fd90b92bf \
+    --hash=sha256:e6c58beb17380f7c2ea181ea11e7db8c0ceb474c9dd45f48e71e2cb577d146a1 \
+    --hash=sha256:e852d9dda9f93ad3651ae1e3bb770eac544ec93c3807888798eccddf84596537 \
+    --hash=sha256:ec3681a0cb34c255d76dd9d865a55f260164adb9fa02628415cdc2d43ee2c05d \
+    --hash=sha256:ee0c0b3b35b34f782afc673d503167157094a16f442ace7c6c5e0ca80b08f50c \
+    --hash=sha256:eedacb5c5d22b7097482fa834bda0dafa3d914a4e829ec83cdea2a01f8c813c4 \
+    --hash=sha256:ef00af0439ebfee806b25f24c8f92109157ff3fac5731dc7867957812e87b8d9 \
+    --hash=sha256:f0e8817c7d1a0c2eedebf57ef9a9896f3ea23324769a9a2061a80fe8852705ed \
+    --hash=sha256:f3d5be054c461d6a2268831f04091dc82753176f6ea06dc6047a5e168265a987 \
+    --hash=sha256:f4b5c37a5f40e4d733d3bbaaef082149bee5a5ea3156a785ff64d949bd1353fa
    # via weasyprint
-identify==2.6.16 \
-    --hash=sha256:391ee4d77741d994189522896270b787aed8670389bfd60f326d677d64a6dfb0 \
-    --hash=sha256:846857203b5511bbe94d5a352a48ef2359532bc8f6727b5544077a0dcfb24980
+identify==2.6.15 \
+    --hash=sha256:1181ef7608e00704db228516541eb83a88a9f94433a8c80bb9b5bd54b1d81757 \
+    --hash=sha256:e4f4864b96c6557ef2a1e1c951771838f4edc9df3a72ec7118b338801b11c7bf
    # via pre-commit
-nodeenv==1.10.0 \
-    --hash=sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827 \
-    --hash=sha256:996c191ad80897d076bdfba80a41994c2b47c68e224c542b48feba42ba00f8bb
+nodeenv==1.9.1 \
+    --hash=sha256:6ec12890a2dab7946721edbfbcd91f3319c6ccc9aec47be7c7e6b7011ee6645f \
+    --hash=sha256:ba11c9782d29c27c70ffbdda2d7415098754709be8a7056d79a737cd901155c9
    # via pre-commit
-numpy==2.4.1 \
-    --hash=sha256:0093e85df2960d7e4049664b26afc58b03236e967fb942354deef3208857a04c \
-    --hash=sha256:09aa8a87e45b55a1c2c205d42e2808849ece5c484b2aab11fecabec3841cafba \
-    --hash=sha256:0cce2a669e3c8ba02ee563c7835f92c153cf02edff1ae05e1823f1dde21b16a5 \
-    --hash=sha256:0e6e8f9d9ecf95399982019c01223dc130542960a12edfa8edd1122dfa66a8a8 \
-    --hash=sha256:0f118ce6b972080ba0758c6087c3617b5ba243d806268623dc34216d69099ba0 \
-    --hash=sha256:178de8f87948163d98a4c9ab5bee4ce6519ca918926ec8df195af582de28544d \
-    --hash=sha256:18e14c4d09d55eef39a6ab5b08406e84bc6869c1e34eef45564804f90b7e0574 \
-    --hash=sha256:2023ef86243690c2791fd6353e5b4848eedaa88ca8a2d129f462049f6d484696 \
-    --hash=sha256:20d4649c773f66cc2fc36f663e091f57c3b7655f936a4c681b4250855d1da8f5 \
-    --hash=sha256:2302dc0224c1cbc49bb94f7064f3f923a971bfae45c33870dcbff63a2a550505 \
-    --hash=sha256:26f0bcd9c79a00e339565b303badc74d3ea2bd6d52191eeca5f95936cad107d0 \
-    --hash=sha256:297c72b1b98100c2e8f873d5d35fb551fce7040ade83d67dd51d38c8d42a2162 \
-    --hash=sha256:2f44de05659b67d20499cbc96d49f2650769afcb398b79b324bb6e297bfe3844 \
-    --hash=sha256:2ffd257026eb1b34352e749d7cc1678b5eeec3e329ad8c9965a797e08ccba205 \
-    --hash=sha256:382ad67d99ef49024f11d1ce5dcb5ad8432446e4246a4b014418ba3a1175a1f4 \
-    --hash=sha256:3869ea1ee1a1edc16c29bbe3a2f2a4e515cc3a44d43903ad41e0cacdbaf733dc \
-    --hash=sha256:3d1a100e48cb266090a031397863ff8a30050ceefd798f686ff92c67a486753d \
-    --hash=sha256:423797bdab2eeefbe608d7c1ec7b2b4fd3c58d51460f1ee26c7500a1d9c9ee93 \
-    --hash=sha256:42d7dd5fa36d16d52a84f821eb96031836fd405ee6955dd732f2023724d0aa01 \
-    --hash=sha256:49e792ec351315e16da54b543db06ca8a86985ab682602d90c60ef4ff4db2a9c \
-    --hash=sha256:4e53170557d37ae404bf8d542ca5b7c629d6efa1117dac6a83e394142ea0a43f \
-    --hash=sha256:4f1b68ff47680c2925f8063402a693ede215f0257f02596b1318ecdfb1d79e33 \
-    --hash=sha256:4f9c360ecef085e5841c539a9a12b883dff005fbd7ce46722f5e9cef52634d82 \
-    --hash=sha256:529050522e983e00a6c1c6b67411083630de8b57f65e853d7b03d9281b8694d2 \
-    --hash=sha256:52b5f61bdb323b566b528899cc7db2ba5d1015bda7ea811a8bcf3c89c331fa42 \
-    --hash=sha256:538bf4ec353709c765ff75ae616c34d3c3dca1a68312727e8f2676ea644f8509 \
-    --hash=sha256:5adf01965456a664fc727ed69cc71848f28d063217c63e1a0e200a118d5eec9a \
-    --hash=sha256:5b55aa56165b17aaf15520beb9cbd33c9039810e0d9643dd4379e44294c7303e \
-    --hash=sha256:5d558123217a83b2d1ba316b986e9248a1ed1971ad495963d555ccd75dcb1556 \
-    --hash=sha256:5de60946f14ebe15e713a6f22850c2372fa72f4ff9a432ab44aa90edcadaa65a \
-    --hash=sha256:62fea415f83ad8fdb6c20840578e5fbaf5ddd65e0ec6c3c47eda0f69da172510 \
-    --hash=sha256:6436cffb4f2bf26c974344439439c95e152c9a527013f26b3577be6c2ca64295 \
-    --hash=sha256:6461de5113088b399d655d45c3897fa188766415d0f568f175ab071c8873bd73 \
-    --hash=sha256:69e7419c9012c4aaf695109564e3387f1259f001b4326dfa55907b098af082d3 \
-    --hash=sha256:71abbea030f2cfc3092a0ff9f8c8fdefdc5e0bf7d9d9c99663538bb0ecdac0b9 \
-    --hash=sha256:7211b95ca365519d3596a1d8688a95874cc94219d417504d9ecb2df99fa7bfa8 \
-    --hash=sha256:727c6c3275ddefa0dc078524a85e064c057b4f4e71ca5ca29a19163c607be745 \
-    --hash=sha256:79e9e06c4c2379db47f3f6fc7a8652e7498251789bf8ff5bd43bf478ef314ca2 \
-    --hash=sha256:7ad270f438cbdd402c364980317fb6b117d9ec5e226fff5b4148dd9aa9fc6e02 \
-    --hash=sha256:7d5d7999df434a038d75a748275cd6c0094b0ecdb0837342b332a82defc4dc4d \
-    --hash=sha256:8097529164c0f3e32bb89412a0905d9100bf434d9692d9fc275e18dcf53c9344 \
-    --hash=sha256:82c55962006156aeef1629b953fd359064aa47e4d82cfc8e67f0918f7da3344f \
-    --hash=sha256:8361ea4220d763e54cff2fbe7d8c93526b744f7cd9ddab47afeff7e14e8503be \
-    --hash=sha256:899d2c18024984814ac7e83f8f49d8e8180e2fbe1b2e252f2e7f1d06bea92425 \
-    --hash=sha256:8ad35f20be147a204e28b6a0575fbf3540c5e5f802634d4258d55b1ff5facce1 \
-    --hash=sha256:8f085da926c0d491ffff3096f91078cc97ea67e7e6b65e490bc8dcda65663be2 \
-    --hash=sha256:9171a42fcad32dcf3fa86f0a4faa5e9f8facefdb276f54b8b390d90447cff4e2 \
-    --hash=sha256:92a0e65272fd60bfa0d9278e0484c2f52fe03b97aedc02b357f33fe752c52ffb \
-    --hash=sha256:941c2a93313d030f219f3a71fd3d91a728b82979a5e8034eb2e60d394a2b83f9 \
-    --hash=sha256:98b35775e03ab7f868908b524fc0a84d38932d8daf7b7e1c3c3a1b6c7a2c9f15 \
-    --hash=sha256:a1ceafc5042451a858231588a104093474c6a5c57dcc724841f5c888d237d690 \
-    --hash=sha256:a73044b752f5d34d4232f25f18160a1cc418ea4507f5f11e299d8ac36875f8a0 \
-    --hash=sha256:a7870e8c5fc11aef57d6fea4b4085e537a3a60ad2cdd14322ed531fdca68d261 \
-    --hash=sha256:a92f227dbcdc9e4c3e193add1a189a9909947d4f8504c576f4a732fd0b54240a \
-    --hash=sha256:ac08c63cb7779b85e9d5318e6c3518b424bc1f364ac4cb2c6136f12e5ff2dccc \
-    --hash=sha256:b6bcf39112e956594b3331316d90c90c90fb961e39696bda97b89462f5f3943f \
-    --hash=sha256:c0faba4a331195bfa96f93dd9dfaa10b2c7aa8cda3a02b7fd635e588fe821bf5 \
-    --hash=sha256:ce9ce141a505053b3c7bce3216071f3bf5c182b8b28930f14cd24d43932cd2df \
-    --hash=sha256:cf6470d91d34bf669f61d515499859fa7a4c2f7c36434afb70e82df7217933f9 \
-    --hash=sha256:d3703409aac693fa82c0aee023a1ae06a6e9d065dba10f5e8e80f642f1e9d0a2 \
-    --hash=sha256:d3e3087f53e2b4428766b54932644d148613c5a595150533ae7f00dab2f319a8 \
-    --hash=sha256:d3f8f0df9f4b8be57b3bf74a1d087fec68f927a2fab68231fdb442bf2c12e426 \
-    --hash=sha256:d797454e37570cfd61143b73b8debd623c3c0952959adb817dd310a483d58a1b \
-    --hash=sha256:e1a27bb1b2dee45a2a53f5ca6ff2d1a7f135287883a1689e930d44d1ff296c87 \
-    --hash=sha256:e3bd2cb07841166420d2fa7146c96ce00cb3410664cbc1a6be028e456c4ee220 \
-    --hash=sha256:e7b6b5e28bbd47b7532698e5db2fe1db693d84b58c254e4389d99a27bb9b8f6b \
-    --hash=sha256:e867df947d427cdd7a60e3e271729090b0f0df80f5f10ab7dd436f40811699c3 \
-    --hash=sha256:ea66d2b41ca4a1630aae5507ee0a71647d3124d1741980138aa8f28f44dac36e \
-    --hash=sha256:edee228f76ee2dab4579fad6f51f6a305de09d444280109e0f75df247ff21501 \
-    --hash=sha256:f0a90aba7d521e6954670550e561a4cb925713bd944445dbe9e729b71f6cabee \
-    --hash=sha256:f93bc6892fe7b0663e5ffa83b61aab510aacffd58c16e012bb9352d489d90cb7 \
-    --hash=sha256:fb1461c99de4d040666ca0444057b06541e5642f800b71c56e6ea92d6a853a0c
+numpy==2.2.6 \
+    --hash=sha256:038613e9fb8c72b0a41f025a7e4c3f0b7a1b5d768ece4796b674c8f3fe13efff \
+    --hash=sha256:0678000bb9ac1475cd454c6b8c799206af8107e310843532b04d49649c717a47 \
+    --hash=sha256:0811bb762109d9708cca4d0b13c4f67146e3c3b7cf8d34018c722adb2d957c84 \
+    --hash=sha256:0b605b275d7bd0c640cad4e5d30fa701a8d59302e127e5f79138ad62762c3e3d \
+    --hash=sha256:0bca768cd85ae743b2affdc762d617eddf3bcf8724435498a1e80132d04879e6 \
+    --hash=sha256:1bc23a79bfabc5d056d106f9befb8d50c31ced2fbc70eedb8155aec74a45798f \
+    --hash=sha256:287cc3162b6f01463ccd86be154f284d0893d2b3ed7292439ea97eafa8170e0b \
+    --hash=sha256:37c0ca431f82cd5fa716eca9506aefcabc247fb27ba69c5062a6d3ade8cf8f49 \
+    --hash=sha256:37e990a01ae6ec7fe7fa1c26c55ecb672dd98b19c3d0e1d1f326fa13cb38d163 \
+    --hash=sha256:389d771b1623ec92636b0786bc4ae56abafad4a4c513d36a55dce14bd9ce8571 \
+    --hash=sha256:3d70692235e759f260c3d837193090014aebdf026dfd167834bcba43e30c2a42 \
+    --hash=sha256:41c5a21f4a04fa86436124d388f6ed60a9343a6f767fced1a8a71c3fbca038ff \
+    --hash=sha256:481b49095335f8eed42e39e8041327c05b0f6f4780488f61286ed3c01368d491 \
+    --hash=sha256:4eeaae00d789f66c7a25ac5f34b71a7035bb474e679f410e5e1a94deb24cf2d4 \
+    --hash=sha256:55a4d33fa519660d69614a9fad433be87e5252f4b03850642f88993f7b2ca566 \
+    --hash=sha256:5a6429d4be8ca66d889b7cf70f536a397dc45ba6faeb5f8c5427935d9592e9cf \
+    --hash=sha256:5bd4fc3ac8926b3819797a7c0e2631eb889b4118a9898c84f585a54d475b7e40 \
+    --hash=sha256:5beb72339d9d4fa36522fc63802f469b13cdbe4fdab4a288f0c441b74272ebfd \
+    --hash=sha256:6031dd6dfecc0cf9f668681a37648373bddd6421fff6c66ec1624eed0180ee06 \
+    --hash=sha256:71594f7c51a18e728451bb50cc60a3ce4e6538822731b2933209a1f3614e9282 \
+    --hash=sha256:74d4531beb257d2c3f4b261bfb0fc09e0f9ebb8842d82a7b4209415896adc680 \
+    --hash=sha256:7befc596a7dc9da8a337f79802ee8adb30a552a94f792b9c9d18c840055907db \
+    --hash=sha256:894b3a42502226a1cac872f840030665f33326fc3dac8e57c607905773cdcde3 \
+    --hash=sha256:8e41fd67c52b86603a91c1a505ebaef50b3314de0213461c7a6e99c9a3beff90 \
+    --hash=sha256:8e9ace4a37db23421249ed236fdcdd457d671e25146786dfc96835cd951aa7c1 \
+    --hash=sha256:8fc377d995680230e83241d8a96def29f204b5782f371c532579b4f20607a289 \
+    --hash=sha256:9551a499bf125c1d4f9e250377c1ee2eddd02e01eac6644c080162c0c51778ab \
+    --hash=sha256:b0544343a702fa80c95ad5d3d608ea3599dd54d4632df855e4c8d24eb6ecfa1c \
+    --hash=sha256:b093dd74e50a8cba3e873868d9e93a85b78e0daf2e98c6797566ad8044e8363d \
+    --hash=sha256:b412caa66f72040e6d268491a59f2c43bf03eb6c96dd8f0307829feb7fa2b6fb \
+    --hash=sha256:b4f13750ce79751586ae2eb824ba7e1e8dba64784086c98cdbbcc6a42112ce0d \
+    --hash=sha256:b64d8d4d17135e00c8e346e0a738deb17e754230d7e0810ac5012750bbd85a5a \
+    --hash=sha256:ba10f8411898fc418a521833e014a77d3ca01c15b0c6cdcce6a0d2897e6dbbdf \
+    --hash=sha256:bd48227a919f1bafbdda0583705e547892342c26fb127219d60a5c36882609d1 \
+    --hash=sha256:c1f9540be57940698ed329904db803cf7a402f3fc200bfe599334c9bd84a40b2 \
+    --hash=sha256:c820a93b0255bc360f53eca31a0e676fd1101f673dda8da93454a12e23fc5f7a \
+    --hash=sha256:ce47521a4754c8f4593837384bd3424880629f718d87c5d44f8ed763edd63543 \
+    --hash=sha256:d042d24c90c41b54fd506da306759e06e568864df8ec17ccc17e9e884634fd00 \
+    --hash=sha256:de749064336d37e340f640b05f24e9e3dd678c57318c7289d222a8a2f543e90c \
+    --hash=sha256:e1dda9c7e08dc141e0247a5b8f49cf05984955246a327d4c48bda16821947b2f \
+    --hash=sha256:e29554e2bef54a90aa5cc07da6ce955accb83f21ab5de01a62c8478897b264fd \
+    --hash=sha256:e3143e4451880bed956e706a3220b4e5cf6172ef05fcc397f6f36a550b1dd868 \
+    --hash=sha256:e8213002e427c69c45a52bbd94163084025f533a55a59d6f9c5b820774ef3303 \
+    --hash=sha256:efd28d4e9cd7d7a8d39074a4d44c63eda73401580c5c76acda2ce969e0a38e83 \
+    --hash=sha256:f0fd6321b839904e15c46e0d257fdd101dd7f530fe03fd6359c1ea63738703f3 \
+    --hash=sha256:f1372f041402e37e5e633e586f62aa53de2eac8d98cbfb822806ce4bbefcb74d \
+    --hash=sha256:f2618db89be1b4e05f7a1a847a9c1c0abd63e63a1607d892dd54668dd92faf87 \
+    --hash=sha256:f447e6acb680fd307f40d3da4852208af94afdfab89cf850986c3ca00562f4fa \
+    --hash=sha256:f92729c95468a2f4f15e9bb94c432a9229d0d50de67304399627a943201baa2f \
+    --hash=sha256:f9f1adb22318e121c5c69a09142811a201ef17ab257a1e66ca3025065b7f53ae \
+    --hash=sha256:fc0c5673685c508a142ca65209b4e79ed6740a4ed6b2267dbba90f34b0b3cfda \
+    --hash=sha256:fc7b73d02efb0e18c000e9ad8b83480dfcd5dfd11065997ed4c6747470ae8915 \
+    --hash=sha256:fd83c01228a688733f1ded5201c678f0c53ecc1006ffbc404db9f7a899ac6249 \
+    --hash=sha256:fe27749d33bb772c80dcd84ae7e8df2adc920ae8297400dabec45f0dedb3f6de \
+    --hash=sha256:fee4236c876c4e8369388054d02d0e9bb84821feb1a64dd59e137e6511a551f8
    # via opencv-python-headless
-opencv-python-headless==4.13.0.90 \
-    --hash=sha256:0e0c8c9f620802fddc4fa7f471a1d263c7b0dca16cd9e7e2f996bb8bd2128c0c \
-    --hash=sha256:12a28674f215542c9bf93338de1b5bffd76996d32da9acb9e739fdb9c8bbd738 \
-    --hash=sha256:32255203040dc98803be96362e13f9e4bce20146898222d2e5c242f80de50da5 \
-    --hash=sha256:96060fc57a1abb1144b0b8129e2ff3bfcdd0ccd8e8bd05bd85256ff4ed587d3b \
-    --hash=sha256:dbc1f4625e5af3a80ebdbd84380227c0f445228588f2521b11af47710caca1ba \
-    --hash=sha256:e13790342591557050157713af17a7435ac1b50c65282715093c9297fa045d8f \
-    --hash=sha256:eba38bc255d0b7d1969c5bcc90a060ca2b61a3403b613872c750bfa5dfe9e03b \
-    --hash=sha256:f46b17ea0aa7e4124ca6ad71143f89233ae9557f61d2326bcdb34329a1ddf9bd
-    # via -r requirements_dev.in
+opencv-python-headless==4.12.0.88 \
+    --hash=sha256:1e58d664809b3350c1123484dd441e1667cd7bed3086db1b9ea1b6f6cb20b50e \
+    --hash=sha256:236c8df54a90f4d02076e6f9c1cc763d794542e886c576a6fee46ec8ff75a7a9 \
+    --hash=sha256:365bb2e486b50feffc2d07a405b953a8f3e8eaa63865bc650034e5c71e7a5154 \
+    --hash=sha256:86b413bdd6c6bf497832e346cd5371995de148e579b9774f8eba686dee3f5528 \
+    --hash=sha256:aeb4b13ecb8b4a0beb2668ea07928160ea7c2cd2d9b5ef571bbee6bafe9cc8d0 \
+    --hash=sha256:cfdc017ddf2e59b6c2f53bc12d74b6b0be7ded4ec59083ea70763921af2b6c09 \
+    --hash=sha256:fde2cf5c51e4def5f2132d78e0c08f9c14783cd67356922182c6845b9af87dbd
+    # via -r .github/scripts/requirements_dev.in
 pdf2image==1.17.0 \
    --hash=sha256:eaa959bc116b420dd7ec415fcae49b98100dda3dd18cd2fdfa86d09f112f6d57 \
    --hash=sha256:ecdd58d7afb810dffe21ef2b1bbc057ef434dabbac6c33778a38a3f7744a27e2
-    # via -r requirements_dev.in
-pillow==12.1.1 \
-    --hash=sha256:02f84dfad02693676692746df05b89cf25597560db2857363a208e393429f5e9 \
-    --hash=sha256:0330d233c1a0ead844fc097a7d16c0abff4c12e856c0b325f231820fee1f39da \
-    --hash=sha256:03edcc34d688572014ff223c125a3f77fb08091e4607e7745002fc214070b35f \
-    --hash=sha256:097690ba1f2efdeb165a20469d59d8bb03c55fb6621eb2041a060ae8ea3e9642 \
-    --hash=sha256:178aa072084bd88ec759052feca8e56cbb14a60b39322b99a049e58090479713 \
-    --hash=sha256:18e5bddd742a44b7e6b1e773ab5db102bd7a94c32555ba656e76d319d19c3850 \
-    --hash=sha256:1a9b0ee305220b392e1124a764ee4265bd063e54a751a6b62eff69992f457fa9 \
-    --hash=sha256:1f1625b72740fdda5d77b4def688eb8fd6490975d06b909fd19f13f391e077e0 \
-    --hash=sha256:1f1be78ce9466a7ee64bfda57bdba0f7cc499d9794d518b854816c41bf0aa4e9 \
-    --hash=sha256:1f90cff8aa76835cba5769f0b3121a22bd4eb9e6884cfe338216e557a9a548b8 \
-    --hash=sha256:21329ec8c96c6e979cd0dfd29406c40c1d52521a90544463057d2aaa937d66a6 \
-    --hash=sha256:2815a87ab27848db0321fb78c7f0b2c8649dee134b7f2b80c6a45c6831d75ccd \
-    --hash=sha256:2c1fc0f2ca5f96a3c8407e41cca26a16e46b21060fe6d5b099d2cb01412222f5 \
-    --hash=sha256:2e0c664be47252947d870ac0d327fea7e63985a08794758aa8af5b6cb6ec0c9c \
-    --hash=sha256:339ffdcb7cbeaa08221cd401d517d4b1fe7a9ed5d400e4a8039719238620ca35 \
-    --hash=sha256:344cf1e3dab3be4b1fa08e449323d98a2a3f819ad20f4b22e77a0ede31f0faa1 \
-    --hash=sha256:36341d06738a9f66c8287cf8b876d24b18db9bd8740fa0672c74e259ad408cff \
-    --hash=sha256:365b10bb9417dd4498c0e3b128018c4a624dc11c7b97d8cc54effe3b096f4c38 \
-    --hash=sha256:3a5cbdcddad0af3da87cb16b60d23648bc3b51967eb07223e9fed77a82b457c4 \
-    --hash=sha256:417423db963cb4be8bac3fc1204fe61610f6abeed1580a7a2cbb2fbda20f12af \
-    --hash=sha256:42fc1f4677106188ad9a55562bbade416f8b55456f522430fadab3cef7cd4e60 \
-    --hash=sha256:44ce27545b6efcf0fdbdceb31c9a5bdea9333e664cda58a7e674bb74608b3986 \
-    --hash=sha256:472a8d7ded663e6162dafdf20015c486a7009483ca671cece7a9279b512fcb13 \
-    --hash=sha256:47b94983da0c642de92ced1702c5b6c292a84bd3a8e1d1702ff923f183594717 \
-    --hash=sha256:495c302af3aad1ca67420ddd5c7bd480c8867ad173528767d906428057a11f0e \
-    --hash=sha256:4ceb838d4bd9dab43e06c363cab2eebf63846d6a4aeaea283bbdfd8f1a8ed58b \
-    --hash=sha256:50480dcd74fa63b8e78235957d302d98d98d82ccbfac4c7e12108ba9ecbdba15 \
-    --hash=sha256:518a48c2aab7ce596d3bf79d0e275661b846e86e4d0e7dec34712c30fe07f02a \
-    --hash=sha256:559b38da23606e68681337ad74622c4dbba02254fc9cb4488a305dd5975c7eeb \
-    --hash=sha256:578510d88c6229d735855e1f278aa305270438d36a05031dfaae5067cc8eb04d \
-    --hash=sha256:597bd9c8419bc7c6af5604e55847789b69123bbe25d65cc6ad3012b4f3c98d8b \
-    --hash=sha256:5a8eb7ed8d4198bccbd07058416eeec51686b498e784eda166395a23eb99138e \
-    --hash=sha256:5c0dd1636633e7e6a0afe7bf6a51a14992b7f8e60de5789018ebbdfae55b040a \
-    --hash=sha256:5cb1785d97b0c3d1d1a16bc1d710c4a0049daefc4935f3a8f31f827f4d3d2e7f \
-    --hash=sha256:5d1f9575a12bed9e9eedd9a4972834b08c97a352bd17955ccdebfeca5913fa0a \
-    --hash=sha256:5d8c41325b382c07799a3682c1c258469ea2ff97103c53717b7893862d0c98ce \
-    --hash=sha256:5dae5f21afb91322f2ff791895ddd8889e5e947ff59f71b46041c8ce6db790bc \
-    --hash=sha256:600fd103672b925fe62ed08e0d874ea34d692474df6f4bf7ebe148b30f89f39f \
-    --hash=sha256:6408a7b064595afcab0a49393a413732a35788f2a5092fdc6266952ed67de586 \
-    --hash=sha256:652a2c9ccfb556235b2b501a3a7cf3742148cd22e04b5625c5fe057ea3e3191f \
-    --hash=sha256:665e1b916b043cef294bc54d47bf02d87e13f769bc4bc5fa225a24b3a6c5aca9 \
-    --hash=sha256:691ab2ac363b8217f7d31b3497108fb1f50faab2f75dfb03284ec2f217e87bf8 \
-    --hash=sha256:6c52f062424c523d6c4db85518774cc3d50f5539dd6eed32b8f6229b26f24d40 \
-    --hash=sha256:6c6db3b84c87d48d0088943bf33440e0c42370b99b1c2a7989216f7b42eede60 \
-    --hash=sha256:7311c0a0dcadb89b36b7025dfd8326ecfa36964e29913074d47382706e516a7c \
-    --hash=sha256:7aac39bcf8d4770d089588a2e1dd111cbaa42df5a94be3114222057d68336bd0 \
-    --hash=sha256:7b03048319bfc6170e93bd60728a1af51d3dd7704935feb228c4d4faab35d334 \
-    --hash=sha256:7e7976bf1910a8116b523b9f9f58bf410f3e8aa330cd9a2bb2953f9266ab49af \
-    --hash=sha256:8089c852a56c2966cf18835db62d9b34fef7ba74c726ad943928d494fa7f4735 \
-    --hash=sha256:86172b0831b82ce4f7877f280055892b31179e1576aa00d0df3bb1bbf8c3e524 \
-    --hash=sha256:89b54027a766529136a06cfebeecb3a04900397a3590fd252160b888479517bf \
-    --hash=sha256:89c7e895002bbe49cdc5426150377cbbc04767d7547ed145473f496dfa40408b \
-    --hash=sha256:8b7e5304e34942bf62e15184219a7b5ad4ff7f3bb5cca4d984f37df1a0e1aee2 \
-    --hash=sha256:8fd420ef0c52c88b5a035a0886f367748c72147b2b8f384c9d12656678dfdfa9 \
-    --hash=sha256:98edb152429ab62a1818039744d8fbb3ccab98a7c29fc3d5fcef158f3f1f68b7 \
-    --hash=sha256:99c1506ea77c11531d75e3a412832a13a71c7ebc8192ab9e4b2e355555920e3e \
-    --hash=sha256:9ad8fa5937ab05218e2b6a4cff30295ad35afd2f83ac592e68c0d871bb0fdbc4 \
-    --hash=sha256:9f51079765661884a486727f0729d29054242f74b46186026582b4e4769918e4 \
-    --hash=sha256:a003d7422449f6d1e3a34e3dd4110c22148336918ddbfc6a32581cd54b2e0b2b \
-    --hash=sha256:a0b1cd6232e2b618adcc54d9882e4e662a089d5768cd188f7c245b4c8c44a397 \
-    --hash=sha256:a285e3eb7a5a45a2ff504e31f4a8d1b12ef62e84e5411c6804a42197c1cf586c \
-    --hash=sha256:a37691702ed687799de29a518d63d4682d9016932db66d4e90c345831b02fb4e \
-    --hash=sha256:a550ae29b95c6dc13cf69e2c9dc5747f814c54eeb2e32d683e5e93af56caa029 \
-    --hash=sha256:ab174cd7d29a62dd139c44bf74b698039328f45cb03b4596c43473a46656b2f3 \
-    --hash=sha256:ab323b787d6e18b3d91a72fc99b1a2c28651e4358749842b8f8dfacd28ef2052 \
-    --hash=sha256:adebb5bee0f0af4909c30db0d890c773d1a92ffe83da908e2e9e720f8edf3984 \
-    --hash=sha256:aee2810642b2898bb187ced9b349e95d2a7272930796e022efaf12e99dccd293 \
-    --hash=sha256:af9a332e572978f0218686636610555ae3defd1633597be015ed50289a03c523 \
-    --hash=sha256:b574c51cf7d5d62e9be37ba446224b59a2da26dc4c1bb2ecbe936a4fb1a7cb7f \
-    --hash=sha256:b66e95d05ba806247aaa1561f080abc7975daf715c30780ff92a20e4ec546e1b \
-    --hash=sha256:b81b5e3511211631b3f672a595e3221252c90af017e399056d0faabb9538aa80 \
-    --hash=sha256:b957b71c6b2387610f556a7eb0828afbe40b4a98036fc0d2acfa5a44a0c2036f \
-    --hash=sha256:bb66b7cc26f50977108790e2456b7921e773f23db5630261102233eb355a3b79 \
-    --hash=sha256:c6008de247150668a705a6338156efb92334113421ceecf7438a12c9a12dab23 \
-    --hash=sha256:c7697918b5be27424e9ce568193efd13d925c4481dd364e43f5dff72d33e10f8 \
-    --hash=sha256:cb9bb857b2d057c6dfc72ac5f3b44836924ba15721882ef103cecb40d002d80e \
-    --hash=sha256:cc7d296b5ea4d29e6570dabeaed58d31c3fea35a633a69679fb03d7664f43fb3 \
-    --hash=sha256:d242e8ac078781f1de88bf823d70c1a9b3c7950a44cdf4b7c012e22ccbcd8e4e \
-    --hash=sha256:d2912fd8114fc5545aa3a4b5576512f64c55a03f3ebcca4c10194d593d43ea36 \
-    --hash=sha256:d470ab1178551dd17fdba0fef463359c41aaa613cdcd7ff8373f54be629f9f8f \
-    --hash=sha256:d4ce8e329c93845720cd2014659ca67eac35f6433fd3050393d85f3ecef0dad5 \
-    --hash=sha256:d6e4571eedf43af33d0fc233a382a76e849badbccdf1ac438841308652a08e1f \
-    --hash=sha256:e65498daf4b583091ccbb2556c7000abf0f3349fcd57ef7adc9a84a394ed29f6 \
-    --hash=sha256:e879bb6cd5c73848ef3b2b48b8af9ff08c5b71ecda8048b7dd22d8a33f60be32 \
-    --hash=sha256:e9e8064fb1cc019296958595f6db671fba95209e3ceb0c4734c9baf97de04b20 \
-    --hash=sha256:f7ed2c6543bad5a7d5530eb9e78c53132f93dfa44a28492db88b41cdab885202 \
-    --hash=sha256:f95c00d5d6700b2b890479664a06e754974848afaae5e21beb4d83c106923fd0 \
-    --hash=sha256:f975aa7ef9684ce7e2c18a3aa8f8e2106ce1e46b94ab713d156b2898811651d3 \
-    --hash=sha256:fbfa2a7c10cc2623f412753cddf391c7f971c52ca40a3f65dc5039b2939e8563 \
-    --hash=sha256:fc354a04072b765eccf2204f588a7a532c9511e8b9c7f900e1b64e3e33487090 \
-    --hash=sha256:fc44ef1f3de4f45b50ccf9136999d71abb99dca7706bc75d222ed350b9fd2289
+    # via -r .github/scripts/requirements_dev.in
+pillow==12.0.0 \
+    --hash=sha256:0869154a2d0546545cde61d1789a6524319fc1897d9ee31218eae7a60ccc5643 \
+    --hash=sha256:09f2d0abef9e4e2f349305a4f8cc784a8a6c2f58a8c4892eea13b10a943bd26e \
+    --hash=sha256:0b817e7035ea7f6b942c13aa03bb554fc44fea70838ea21f8eb31c638326584e \
+    --hash=sha256:0fd00cac9c03256c8b2ff58f162ebcd2587ad3e1f2e397eab718c47e24d231cc \
+    --hash=sha256:110486b79f2d112cf6add83b28b627e369219388f64ef2f960fef9ebaf54c642 \
+    --hash=sha256:1979f4566bb96c1e50a62d9831e2ea2d1211761e5662afc545fa766f996632f6 \
+    --hash=sha256:1ac11e8ea4f611c3c0147424eae514028b5e9077dd99ab91e1bd7bc33ff145e1 \
+    --hash=sha256:1b1b133e6e16105f524a8dec491e0586d072948ce15c9b914e41cdadd209052b \
+    --hash=sha256:1ee80a59f6ce048ae13cda1abf7fbd2a34ab9ee7d401c46be3ca685d1999a399 \
+    --hash=sha256:21f241bdd5080a15bc86d3466a9f6074a9c2c2b314100dd896ac81ee6db2f1ba \
+    --hash=sha256:266cd5f2b63ff316d5a1bba46268e603c9caf5606d44f38c2873c380950576ad \
+    --hash=sha256:26d9f7d2b604cd23aba3e9faf795787456ac25634d82cd060556998e39c6fa47 \
+    --hash=sha256:27f95b12453d165099c84f8a8bfdfd46b9e4bda9e0e4b65f0635430027f55739 \
+    --hash=sha256:2c54c1a783d6d60595d3514f0efe9b37c8808746a66920315bfd34a938d7994b \
+    --hash=sha256:2fa5f0b6716fc88f11380b88b31fe591a06c6315e955c096c35715788b339e3f \
+    --hash=sha256:32ed80ea8a90ee3e6fa08c21e2e091bba6eda8eccc83dbc34c95169507a91f10 \
+    --hash=sha256:3830c769decf88f1289680a59d4f4c46c72573446352e2befec9a8512104fa52 \
+    --hash=sha256:38df9b4bfd3db902c9c2bd369bcacaf9d935b2fff73709429d95cc41554f7b3d \
+    --hash=sha256:3adfb466bbc544b926d50fe8f4a4e6abd8c6bffd28a26177594e6e9b2b76572b \
+    --hash=sha256:3e42edad50b6909089750e65c91aa09aaf1e0a71310d383f11321b27c224ed8a \
+    --hash=sha256:4078242472387600b2ce8d93ade8899c12bf33fa89e55ec89fe126e9d6d5d9e9 \
+    --hash=sha256:455247ac8a4cfb7b9bc45b7e432d10421aea9fc2e74d285ba4072688a74c2e9d \
+    --hash=sha256:4cc6b3b2efff105c6a1656cfe59da4fdde2cda9af1c5e0b58529b24525d0a098 \
+    --hash=sha256:4cf7fed4b4580601c4345ceb5d4cbf5a980d030fd5ad07c4d2ec589f95f09905 \
+    --hash=sha256:5193fde9a5f23c331ea26d0cf171fbf67e3f247585f50c08b3e205c7aeb4589b \
+    --hash=sha256:5269cc1caeedb67e6f7269a42014f381f45e2e7cd42d834ede3c703a1d915fe3 \
+    --hash=sha256:53561a4ddc36facb432fae7a9d8afbfaf94795414f5cdc5fc52f28c1dca90371 \
+    --hash=sha256:55f818bd74fe2f11d4d7cbc65880a843c4075e0ac7226bc1a23261dbea531953 \
+    --hash=sha256:58eea5ebe51504057dd95c5b77d21700b77615ab0243d8152793dc00eb4faf01 \
+    --hash=sha256:5d5c411a8eaa2299322b647cd932586b1427367fd3184ffbb8f7a219ea2041ca \
+    --hash=sha256:6846bd2d116ff42cba6b646edf5bf61d37e5cbd256425fa089fee4ff5c07a99e \
+    --hash=sha256:6ace95230bfb7cd79ef66caa064bbe2f2a1e63d93471c3a2e1f1348d9f22d6b7 \
+    --hash=sha256:6e51b71417049ad6ab14c49608b4a24d8fb3fe605e5dfabfe523b58064dc3d27 \
+    --hash=sha256:71db6b4c1653045dacc1585c1b0d184004f0d7e694c7b34ac165ca70c0838082 \
+    --hash=sha256:7438839e9e053ef79f7112c881cef684013855016f928b168b81ed5835f3e75e \
+    --hash=sha256:759de84a33be3b178a64c8ba28ad5c135900359e85fb662bc6e403ad4407791d \
+    --hash=sha256:792a2c0be4dcc18af9d4a2dfd8a11a17d5e25274a1062b0ec1c2d79c76f3e7f8 \
+    --hash=sha256:7d87ef5795da03d742bf49439f9ca4d027cde49c82c5371ba52464aee266699a \
+    --hash=sha256:7dfb439562f234f7d57b1ac6bc8fe7f838a4bd49c79230e0f6a1da93e82f1fad \
+    --hash=sha256:7fa22993bac7b77b78cae22bad1e2a987ddf0d9015c63358032f84a53f23cdc3 \
+    --hash=sha256:805ebf596939e48dbb2e4922a1d3852cfc25c38160751ce02da93058b48d252a \
+    --hash=sha256:82240051c6ca513c616f7f9da06e871f61bfd7805f566275841af15015b8f98d \
+    --hash=sha256:87d4f8125c9988bfbed67af47dd7a953e2fc7b0cc1e7800ec6d2080d490bb353 \
+    --hash=sha256:8d8ca2b210ada074d57fcee40c30446c9562e542fc46aedc19baf758a93532ee \
+    --hash=sha256:8dc232e39d409036af549c86f24aed8273a40ffa459981146829a324e0848b4b \
+    --hash=sha256:90387104ee8400a7b4598253b4c406f8958f59fcf983a6cea2b50d59f7d63d0b \
+    --hash=sha256:905b0365b210c73afb0ebe9101a32572152dfd1c144c7e28968a331b9217b94a \
+    --hash=sha256:99353a06902c2e43b43e8ff74ee65a7d90307d82370604746738a1e0661ccca7 \
+    --hash=sha256:99a7f72fb6249302aa62245680754862a44179b545ded638cf1fef59befb57ef \
+    --hash=sha256:9f0b04c6b8584c2c193babcccc908b38ed29524b29dd464bc8801bf10d746a3a \
+    --hash=sha256:9fe611163f6303d1619bbcb653540a4d60f9e55e622d60a3108be0d5b441017a \
+    --hash=sha256:a3475b96f5908b3b16c47533daaa87380c491357d197564e0ba34ae75c0f3257 \
+    --hash=sha256:a6597ff2b61d121172f5844b53f21467f7082f5fb385a9a29c01414463f93b07 \
+    --hash=sha256:a7921c5a6d31b3d756ec980f2f47c0cfdbce0fc48c22a39347a895f41f4a6ea4 \
+    --hash=sha256:aa5129de4e174daccbc59d0a3b6d20eaf24417d59851c07ebb37aeb02947987c \
+    --hash=sha256:aeaefa96c768fc66818730b952a862235d68825c178f1b3ffd4efd7ad2edcb7c \
+    --hash=sha256:afbefa430092f71a9593a99ab6a4e7538bc9eabbf7bf94f91510d3503943edc4 \
+    --hash=sha256:aff9e4d82d082ff9513bdd6acd4f5bd359f5b2c870907d2b0a9c5e10d40c88fe \
+    --hash=sha256:b22bd8c974942477156be55a768f7aa37c46904c175be4e158b6a86e3a6b7ca8 \
+    --hash=sha256:b290fd8aa38422444d4b50d579de197557f182ef1068b75f5aa8558638b8d0a5 \
+    --hash=sha256:b2e4b27a6e15b04832fe9bf292b94b5ca156016bbc1ea9c2c20098a0320d6cf6 \
+    --hash=sha256:b583dc9070312190192631373c6c8ed277254aa6e6084b74bdd0a6d3b221608e \
+    --hash=sha256:b87843e225e74576437fd5b6a4c2205d422754f84a06942cfaf1dc32243e45a8 \
+    --hash=sha256:bc91a56697869546d1b8f0a3ff35224557ae7f881050e99f615e0119bf934b4e \
+    --hash=sha256:bd87e140e45399c818fac4247880b9ce719e4783d767e030a883a970be632275 \
+    --hash=sha256:bde737cff1a975b70652b62d626f7785e0480918dece11e8fef3c0cf057351c3 \
+    --hash=sha256:bdee52571a343d721fb2eb3b090a82d959ff37fc631e3f70422e0c2e029f3e76 \
+    --hash=sha256:bee2a6db3a7242ea309aa7ee8e2780726fed67ff4e5b40169f2c940e7eb09227 \
+    --hash=sha256:beeae3f27f62308f1ddbcfb0690bf44b10732f2ef43758f169d5e9303165d3f9 \
+    --hash=sha256:c50f36a62a22d350c96e49ad02d0da41dbd17ddc2e29750dbdba4323f85eb4a5 \
+    --hash=sha256:c607c90ba67533e1b2355b821fef6764d1dd2cbe26b8c1005ae84f7aea25ff79 \
+    --hash=sha256:c7b2a63fd6d5246349f3d3f37b14430d73ee7e8173154461785e43036ffa96ca \
+    --hash=sha256:c828a1ae702fc712978bda0320ba1b9893d99be0badf2647f693cc01cf0f04fa \
+    --hash=sha256:c85de1136429c524e55cfa4e033b4a7940ac5c8ee4d9401cc2d1bf48154bbc7b \
+    --hash=sha256:c98fa880d695de164b4135a52fd2e9cd7b7c90a9d8ac5e9e443a24a95ef9248e \
+    --hash=sha256:cae81479f77420d217def5f54b5b9d279804d17e982e0f2fa19b1d1e14ab5197 \
+    --hash=sha256:d034140032870024e6b9892c692fe2968493790dd57208b2c37e3fb35f6df3ab \
+    --hash=sha256:d120c38a42c234dc9a8c5de7ceaaf899cf33561956acb4941653f8bdc657aa79 \
+    --hash=sha256:d4827615da15cd59784ce39d3388275ec093ae3ee8d7f0c089b76fa87af756c2 \
+    --hash=sha256:d49e2314c373f4c2b39446fb1a45ed333c850e09d0c59ac79b72eb3b95397363 \
+    --hash=sha256:d52610d51e265a51518692045e372a4c363056130d922a7351429ac9f27e70b0 \
+    --hash=sha256:d64317d2587c70324b79861babb9c09f71fbb780bad212018874b2c013d8600e \
+    --hash=sha256:d77153e14b709fd8b8af6f66a3afbb9ed6e9fc5ccf0b6b7e1ced7b036a228782 \
+    --hash=sha256:d7e091d464ac59d2c7ad8e7e08105eaf9dafbc3883fd7265ffccc2baad6ac925 \
+    --hash=sha256:dd333073e0cacdc3089525c7df7d39b211bcdf31fc2824e49d01c6b6187b07d0 \
+    --hash=sha256:e5d8efac84c9afcb40914ab49ba063d94f5dbdf5066db4482c66a992f47a3a3b \
+    --hash=sha256:f135c702ac42262573fe9714dfe99c944b4ba307af5eb507abef1667e2cbbced \
+    --hash=sha256:f13711b1a5ba512d647a0e4ba79280d3a9a045aaf7e0cc6fbe96b91d4cdf6b0c \
+    --hash=sha256:f4f1231b7dec408e8670264ce63e9c71409d9583dd21d32c163e25213ee2a344 \
+    --hash=sha256:fa3ed2a29a9e9d2d488b4da81dcb54720ac3104a20bf0bd273f1e4648aff5af9 \
+    --hash=sha256:fb3096c30df99fd01c7bf8e544f392103d0795b9f98ba71a8054bcbf56b255f1
    # via
-    #   -r requirements_dev.in
+    #   -r .github/scripts/requirements_dev.in
    #   pdf2image
    #   weasyprint
-platformdirs==4.5.1 \
-    --hash=sha256:61d5cdcc6065745cdd94f0f878977f8de9437be93de97c1c12f853c9c0cdcbda \
-    --hash=sha256:d03afa3963c806a9bed9d5125c8f4cb2fdaf74a55ab60e5d59b3fde758104d31
+platformdirs==4.5.0 \
+    --hash=sha256:70ddccdd7c99fc5942e9fc25636a8b34d04c24b335100223152c2803e4063312 \
+    --hash=sha256:e578a81bb873cbb89a41fcc904c7ef523cc18284b7e3b3ccf06aca1403b7ebd3
    # via virtualenv
-pre-commit==4.5.1 \
-    --hash=sha256:3b3afd891e97337708c1674210f8eba659b52a38ea5f822ff142d10786221f77 \
-    --hash=sha256:eb545fcff725875197837263e977ea257a402056661f09dae08e4b149b030a61
-    # via -r requirements_dev.in
-pycparser==3.0 \
-    --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \
-    --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
+pre-commit==4.3.0 \
+    --hash=sha256:2b0747ad7e6e967169136edffee14c16e148a778a54e4f967921aa1ebf2308d8 \
+    --hash=sha256:499fe450cc9d42e9d58e606262795ecb64dd05438943c62b66f6a8673da30b16
+    # via -r .github/scripts/requirements_dev.in
+pycparser==2.23 \
+    --hash=sha256:78816d4f24add8f10a06d6f05b4d424ad9e96cfebf68a4ddc99c65c0720d00c2 \
+    --hash=sha256:e5c6e8d3fbad53479cab09ac03729e0a9faf2bee3db8208a550daf5af81a5934
    # via cffi
-pydyf==0.12.1 \
-    --hash=sha256:ea25b4e1fe7911195cb57067560daaa266639184e8335365cc3ee5214e7eaadc \
-    --hash=sha256:fbd7e759541ac725c29c506612003de393249b94310ea78ae44cb1d04b220095
+pydyf==0.11.0 \
+    --hash=sha256:0aaf9e2ebbe786ec7a78ec3fbffa4cdcecde53fd6f563221d53c6bc1328848a3 \
+    --hash=sha256:394dddf619cca9d0c55715e3c55ea121a9bf9cbc780cdc1201a2427917b86b64
    # via weasyprint
 pyphen==0.17.2 \
    --hash=sha256:3a07fb017cb2341e1d9ff31b8634efb1ae4dc4b130468c7c39dd3d32e7c3affd \
@@ -452,9 +442,9 @@ pyyaml==6.0.3 \
    --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \
    --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0
    # via pre-commit
-tinycss2==1.5.1 \
-    --hash=sha256:3415ba0f5839c062696996998176c4a3751d18b7edaaeeb658c9ce21ec150661 \
-    --hash=sha256:d339d2b616ba90ccce58da8495a78f46e55d4d25f9fd71dfd526f07e7d53f957
+tinycss2==1.4.0 \
+    --hash=sha256:10c0972f6fc0fbee87c3edb76549357415e94548c1ae10ebccdea16fb404a9b7 \
+    --hash=sha256:3a49cf47b7675da0b15d0c6e1df8df4ebd96e9394bb905a5775adb0d884c5289
    # via
    #   cssselect2
    #   weasyprint
@@ -462,18 +452,18 @@ tinyhtml5==2.0.0 \
    --hash=sha256:086f998833da24c300c414d9fe81d9b368fd04cb9d2596a008421cbc705fcfcc \
    --hash=sha256:13683277c5b176d070f82d099d977194b7a1e26815b016114f581a74bbfbf47e
    # via weasyprint
-unoserver==3.6 \
-    --hash=sha256:25c360fa194396a89cb79b4edd2735f8e4f0fd8531e59db3952114585bd7df05 \
-    --hash=sha256:e446bcb3638c51880f002aaeecab1cf74dfa9df81035f027f7ff2e081b6d7015
-    # via -r requirements_dev.in
-virtualenv==20.36.1 \
-    --hash=sha256:575a8d6b124ef88f6f51d56d656132389f961062a9177016a50e4f507bbcc19f \
-    --hash=sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba
+unoserver==3.4 \
+    --hash=sha256:3dcf2204013def1d1ddd3671f38b11346bdf349fef9728277462666a8a634419 \
+    --hash=sha256:64c24d33d4f65d680a2d9f676518cb28e7fd6c1f9d9a745c33e4a4cb59afdfcd
+    # via -r .github/scripts/requirements_dev.in
+virtualenv==20.35.4 \
+    --hash=sha256:643d3914d73d3eeb0c552cbb12d7e82adf0e504dbf86a3182f8771a153a1971c \
+    --hash=sha256:c21c9cede36c9753eeade68ba7d523529f228a403463376cf821eaae2b650f1b
    # via pre-commit
-weasyprint==68.0 \
-    --hash=sha256:447f40898b747cb44ac31a5d493d512e7441fd56e13f63744c099383bbf9cda9 \
-    --hash=sha256:c2cb40c71b50837c5971f00171c9e4078e8c9912dd7c217f3e90e068f11e8aa1
-    # via -r requirements_dev.in
+weasyprint==66.0 \
+    --hash=sha256:82b0783b726fcd318e2c977dcdddca76515b30044bc7a830cc4fbe717582a6d0 \
+    --hash=sha256:da71dc87dc129ac9cffdc65e5477e90365ab9dbae45c744014ec1d06303dde40
+    # via -r .github/scripts/requirements_dev.in
 webencodings==0.5.1 \
    --hash=sha256:a0af1213f3c2226497a97e2b3aa01a7e4bee4f403f95be16fc9acd2947514a78 \
    --hash=sha256:b36a1c245f2d304965eb4e0a82848379241dc04b865afcc4aab16748587e1923
@@ -481,27 +471,86 @@ webencodings==0.5.1 \
    #   cssselect2
    #   tinycss2
    #   tinyhtml5
-zopfli==0.4.0 \
-    --hash=sha256:03181d48e719fcb6cf8340189c61e8f9883d8bbbdf76bf5212a74457f7d083c1 \
-    --hash=sha256:18b5f1570f64d4988482e4466f10ef5f2a30f687c19ad62a64560f2152dc89eb \
-    --hash=sha256:25e4863b8dc30e5d5309f87c106b0b7d3da4ed0e340b8a52b36d4471e797589f \
-    --hash=sha256:7d66337be6d5613dec55213e9ac28f378c41e2cc04fbad4a10748e4df774ca85 \
-    --hash=sha256:9097e8e1dfdb7f5aea5464e469946857e80502b6d29ba1b232450916bd4a74d1 \
-    --hash=sha256:a8ee992b2549e090cd3f0178bf606dd41a29e0613a04cdf5054224662c72dce6 \
-    --hash=sha256:b72a010d205d00b2855acc2302772067362f9ab5a012e3550662aec60d28e6b3 \
-    --hash=sha256:b8bdb41fbfdc4738b7bdc09ed7c1e951579fae192391a5e694d59bb186cdbec7 \
-    --hash=sha256:c3ba02a9a6ca90481d2b2f68bab038b310d63a1e3b5ae305e95a6599787ed941 \
-    --hash=sha256:d1b98ad47c434ef213444a03ef2f826eeec100144d64f6a57504b9893d3931ce \
-    --hash=sha256:f67d04280065e24cb9a4174cb6b3d1f763687f8cb2963aa135ad8f57c6995f5a \
-    --hash=sha256:f94e4dd7d76b4fe9f5d9229372be20d7f786164eea5152d1af1c34298c3d5975
+zopfli==0.2.3.post1 \
+    --hash=sha256:0aa5f90d6298bda02a95bc8dc8c3c19004d5a4e44bda00b67ca7431d857b4b54 \
+    --hash=sha256:0cc20b02a9531559945324c38302fd4ba763311632d0ec8a1a0aa9c10ea363e6 \
+    --hash=sha256:1d8cc06605519e82b16df090e17cb3990d1158861b2872c3117f1168777b81e4 \
+    --hash=sha256:1f990634fd5c5c8ced8edddd8bd45fab565123b4194d6841e01811292650acae \
+    --hash=sha256:2345e713260a350bea0b01a816a469ea356bc2d63d009a0d777691ecbbcf7493 \
+    --hash=sha256:2768c877f76c8a0e7519b1c86c93757f3c01492ddde55751e9988afb7eff64e1 \
+    --hash=sha256:29ea74e72ffa6e291b8c6f2504ce6c146b4fe990c724c1450eb8e4c27fd31431 \
+    --hash=sha256:34a99592f3d9eb6f737616b5bd74b48a589fdb3cb59a01a50d636ea81d6af272 \
+    --hash=sha256:3654bfc927bc478b1c3f3ff5056ed7b20a1a37fa108ca503256d0a699c03bbb1 \
+    --hash=sha256:3657e416ffb8f31d9d3424af12122bb251befae109f2e271d87d825c92fc5b7b \
+    --hash=sha256:37d011e92f7b9622742c905fdbed9920a1d0361df84142807ea2a528419dea7f \
+    --hash=sha256:3827170de28faf144992d3d4dcf8f3998fe3c8a6a6f4a08f1d42c2ec6119d2bb \
+    --hash=sha256:39e576f93576c5c223b41d9c780bbb91fd6db4babf3223d2a4fe7bf568e2b5a8 \
+    --hash=sha256:3a89277ed5f8c0fb2d0b46d669aa0633123aa7381f1f6118c12f15e0fb48f8ca \
+    --hash=sha256:3c163911f8bad94b3e1db0a572e7c28ba681a0c91d0002ea1e4fa9264c21ef17 \
+    --hash=sha256:3f0197b6aa6eb3086ae9e66d6dd86c4d502b6c68b0ec490496348ae8c05ecaef \
+    --hash=sha256:48dba9251060289101343110ab47c0756f66f809bb4d1ddbb6d5c7e7752115c5 \
+    --hash=sha256:4915a41375bdee4db749ecd07d985a0486eb688a6619f713b7bf6fbfd145e960 \
+    --hash=sha256:4c1226a7e2c7105ac31503a9bb97454743f55d88164d6d46bc138051b77f609b \
+    --hash=sha256:4e50ffac74842c1c1018b9b73875a0d0a877c066ab06bf7cccbaa84af97e754f \
+    --hash=sha256:518f1f4ed35dd69ce06b552f84e6d081f07c552b4c661c5312d950a0b764a58a \
+    --hash=sha256:5aad740b4d4fcbaaae4887823925166ffd062db3b248b3f432198fc287381d1a \
+    --hash=sha256:5f272186e03ad55e7af09ab78055535c201b1a0bcc2944edb1768298d9c483a4 \
+    --hash=sha256:5fcfc0dc2761e4fcc15ad5d273b4d58c2e8e059d3214a7390d4d3c8e2aee644e \
+    --hash=sha256:60db20f06c3d4c5934b16cfa62a2cc5c3f0686bffe0071ed7804d3c31ab1a04e \
+    --hash=sha256:615a8ac9dda265e9cc38b2a76c3142e4a9f30fea4a79c85f670850783bc6feb4 \
+    --hash=sha256:6482db9876c68faac2d20a96b566ffbf65ddaadd97b222e4e73641f4f8722fc4 \
+    --hash=sha256:6617fb10f9e4393b331941861d73afb119cd847e88e4974bdbe8068ceef3f73f \
+    --hash=sha256:676919fba7311125244eb0c4393679ac5fe856e5864a15d122bd815205369fa0 \
+    --hash=sha256:6c2d2bc8129707e34c51f9352c4636ca313b52350bbb7e04637c46c1818a2a70 \
+    --hash=sha256:71390dbd3fbf6ebea9a5d85ffed8c26ee1453ee09248e9b88486e30e0397b775 \
+    --hash=sha256:716cdbfc57bfd3d3e31a58e6246e8190e6849b7dbb7c4ce39ef8bbf0edb8f6d5 \
+    --hash=sha256:75a26a2307b10745a83b660c404416e984ee6fca515ec7f0765f69af3ce08072 \
+    --hash=sha256:7be5cc6732eb7b4df17305d8a7b293223f934a31783a874a01164703bc1be6cd \
+    --hash=sha256:7cce242b5df12b2b172489daf19c32e5577dd2fac659eb4b17f6a6efb446fd5c \
+    --hash=sha256:81c341d9bb87a6dbbb0d45d6e272aca80c7c97b4b210f9b6e233bf8b87242f29 \
+    --hash=sha256:89899641d4de97dbad8e0cde690040d078b6aea04066dacaab98e0b5a23573f2 \
+    --hash=sha256:8d5ab297d660b75c159190ce6d73035502310e40fd35170aed7d1a1aea7ddd65 \
+    --hash=sha256:8fbe5bcf10d01aab3513550f284c09fef32f342b36f56bfae2120a9c4d12c130 \
+    --hash=sha256:91a2327a4d7e77471fa4fbb26991c6de4a738c6fc6a33e09bb25f56a870a4b7b \
+    --hash=sha256:95a260cafd56b8fffa679918937401c80bb38e1681c448b988022e4c3610965d \
+    --hash=sha256:96484dc0f48be1c5d7ae9f38ed1ce41e3675fd506b27c11a6607f14b49101e99 \
+    --hash=sha256:9a6aec38a989bad7ddd1ef53f1265699e49e294d08231b5313d61293f3cd6237 \
+    --hash=sha256:9ba214f4f45bec195ee8559651154d3ac2932470b9d91c5715fc29c013349f8c \
+    --hash=sha256:9f4a7ec2770e6af05f5a02733fd3900f30a9cd58e5d6d3727e14c5bcd6e7d587 \
+    --hash=sha256:a1cf720896d2ce998bc8e051d4b4ce0d8bec007aab6243102e8e1d22a0b2fb3f \
+    --hash=sha256:a241a68581d34d67b40c425cce3d1fd211c092f99d9250947824ccba9f491949 \
+    --hash=sha256:a53b18797cdef27e019db595d66c4b077325afe2fd62145953275f53d84ce40c \
+    --hash=sha256:a82fc2dbebe6eb908b9c665e71496f8525c1bc4d2e3a7a7722ef2b128b6227c8 \
+    --hash=sha256:a86eb88e06bd87e1fff31dac878965c26b0c26db59ddcf78bb0379a954b120de \
+    --hash=sha256:aa588b21044f8a74e423d8c8a4c7fc9988501878aacced793467010039c50734 \
+    --hash=sha256:b05296e8bc88c92e2b21e0a9bae4740c1551ee613c1d93a51fd28a7a0b2b6fbb \
+    --hash=sha256:b0ec13f352ea5ae0fc91f98a48540512eed0767d0ec4f7f3cb92d92797983d18 \
+    --hash=sha256:b3df42f52502438ee973042cc551877d24619fa1cd38ef7b7e9ac74200daca8b \
+    --hash=sha256:b78008a69300d929ca2efeffec951b64a312e9a811e265ea4a907ab546d79fa6 \
+    --hash=sha256:b9026a21b6d41eb0e2e63f5bc1242c3fcc43ecb770963cda99a4307863dac12e \
+    --hash=sha256:bbe429fc50686bb2a2608a30843e36fbaa123462a5284f136c7d9e0145220bfd \
+    --hash=sha256:bfa1eb759e07d8b7aa7a310a2bc535e127ee70addf90dc8d4b946b593c3e51a8 \
+    --hash=sha256:c1e0ed5d84ffa2d677cc9582fc01e61dab2e7ef8b8996e055f0a76167b1b94df \
+    --hash=sha256:c4278d1873ce6e803e5d4f8d702fd3026bd67fca744aa98881324d1157ddf748 \
+    --hash=sha256:cac2b37ab21c2b36a10b685b1893ebd6b0f83ae26004838ac817680881576567 \
+    --hash=sha256:cbe6df25807227519debd1a57ab236f5f6bad441500e85b13903e51f93a43214 \
+    --hash=sha256:cd2c002f160502608dcc822ed2441a0f4509c52e86fcfd1a09e937278ed1ca14 \
+    --hash=sha256:e0137dd64a493ba6a4be37405cfd6febe650a98cc1e9dca8f6b8c63b1db11b41 \
+    --hash=sha256:e63d558847166543c2c9789e6f985400a520b7eacc4b99181668b2c3aeadd352 \
+    --hash=sha256:eb45a34f23da4f8bc712b6376ca5396914b0b7c09adbb001dad964eb7f3132f8 \
+    --hash=sha256:ecb7572df5372abce8073df078207d9d1749f20b8b136089916a4a0868d56051 \
+    --hash=sha256:f12000a6accdd4bf0a3fa6eaa1b1c7a7bc80af0a2edf3f89d770d3dcce1d0e22 \
+    --hash=sha256:f7d69c1a7168ad0e9cb864e8663acb232986a0c9c9cb9801f56bf6214f53a54d \
+    --hash=sha256:f815fcc2b2a457977724bad97fb4854022980f51ce7b136925e336b530545ae1 \
+    --hash=sha256:fc39f5c27f962ec8660d8d20c24762431131b5d8c672b44b0a54cf2b5bcde9b9
    # via fonttools

 # The following packages are considered to be unsafe in a requirements file:
-pip==26.0 \
-    --hash=sha256:3ce220a0a17915972fbf1ab451baae1521c4539e778b28127efa79b974aff0fa \
-    --hash=sha256:98436feffb9e31bc9339cf369fd55d3331b1580b6a6f1173bacacddcf9c34754
-    # via -r requirements_dev.in
-setuptools==80.10.2 \
-    --hash=sha256:8b0e9d10c784bf7d262c4e5ec5d4ec94127ce206e8738f29a437945fbc219b70 \
-    --hash=sha256:95b30ddfb717250edb492926c92b5221f7ef3fbcc2b07579bcd4a27da21d0173
-    # via -r requirements_dev.in
+pip==25.3 \
+    --hash=sha256:8d0538dbbd7babbd207f261ed969c65de439f6bc9e5dbd3b3b9a77f25d95f343 \
+    --hash=sha256:9655943313a94722b7774661c21049070f6bbb0a1516bf02f7c8d5d9201514cd
+    # via -r .github/scripts/requirements_dev.in
+setuptools==80.9.0 \
+    --hash=sha256:062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922 \
+    --hash=sha256:f36b47402ecde768dbfafc46e8e4207b4360c654f1f3bb84475f0a28628fb19c
+    # via -r .github/scripts/requirements_dev.in
@@ -12,25 +12,25 @@ distlib==0.4.0 \
    --hash=sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16 \
    --hash=sha256:feec40075be03a04501a973d81f633735b4b69f98b05450592310c0f401a4e0d
    # via virtualenv
-filelock==3.20.3 \
-    --hash=sha256:18c57ee915c7ec61cff0ecf7f0f869936c7c30191bb0cf406f1341778d0834e1 \
-    --hash=sha256:4b0dda527ee31078689fc205ec4f1c1bf7d56cf88b6dc9426c4f230e46c2dce1
+filelock==3.20.0 \
+    --hash=sha256:339b4732ffda5cd79b13f4e2711a31b0365ce445d95d243bb996273d072546a2 \
+    --hash=sha256:711e943b4ec6be42e1d4e6690b48dc175c822967466bb31c0c293f34334c13f4
    # via virtualenv
-identify==2.6.16 \
-    --hash=sha256:391ee4d77741d994189522896270b787aed8670389bfd60f326d677d64a6dfb0 \
-    --hash=sha256:846857203b5511bbe94d5a352a48ef2359532bc8f6727b5544077a0dcfb24980
+identify==2.6.15 \
+    --hash=sha256:1181ef7608e00704db228516541eb83a88a9f94433a8c80bb9b5bd54b1d81757 \
+    --hash=sha256:e4f4864b96c6557ef2a1e1c951771838f4edc9df3a72ec7118b338801b11c7bf
    # via pre-commit
-nodeenv==1.10.0 \
-    --hash=sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827 \
-    --hash=sha256:996c191ad80897d076bdfba80a41994c2b47c68e224c542b48feba42ba00f8bb
+nodeenv==1.9.1 \
+    --hash=sha256:6ec12890a2dab7946721edbfbcd91f3319c6ccc9aec47be7c7e6b7011ee6645f \
+    --hash=sha256:ba11c9782d29c27c70ffbdda2d7415098754709be8a7056d79a737cd901155c9
    # via pre-commit
-platformdirs==4.5.1 \
-    --hash=sha256:61d5cdcc6065745cdd94f0f878977f8de9437be93de97c1c12f853c9c0cdcbda \
-    --hash=sha256:d03afa3963c806a9bed9d5125c8f4cb2fdaf74a55ab60e5d59b3fde758104d31
+platformdirs==4.5.0 \
+    --hash=sha256:70ddccdd7c99fc5942e9fc25636a8b34d04c24b335100223152c2803e4063312 \
+    --hash=sha256:e578a81bb873cbb89a41fcc904c7ef523cc18284b7e3b3ccf06aca1403b7ebd3
    # via virtualenv
-pre-commit==4.5.1 \
-    --hash=sha256:3b3afd891e97337708c1674210f8eba659b52a38ea5f822ff142d10786221f77 \
-    --hash=sha256:eb545fcff725875197837263e977ea257a402056661f09dae08e4b149b030a61
+pre-commit==4.5.0 \
+    --hash=sha256:25e2ce09595174d9c97860a95609f9f852c0614ba602de3561e267547f2335e1 \
+    --hash=sha256:dc5a065e932b19fc1d4c653c6939068fe54325af8e741e74e88db4d28a4dd66b
    # via -r .github/scripts/requirements_pre_commit.in
 pyyaml==6.0.3 \
    --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
@@ -107,7 +107,7 @@ pyyaml==6.0.3 \
    --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \
    --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0
    # via pre-commit
-virtualenv==20.36.1 \
-    --hash=sha256:575a8d6b124ef88f6f51d56d656132389f961062a9177016a50e4f507bbcc19f \
-    --hash=sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba
+virtualenv==20.35.4 \
+    --hash=sha256:643d3914d73d3eeb0c552cbb12d7e82adf0e504dbf86a3182f8771a153a1971c \
+    --hash=sha256:c21c9cede36c9753eeade68ba7d523529f228a403463376cf821eaae2b650f1b
    # via pre-commit
@@ -8,7 +8,7 @@ tomli-w==1.2.0 \
    --hash=sha256:188306098d013b691fcadc011abd66727d3c414c571bb01b1a174ba8c983cf90 \
    --hash=sha256:2dd14fac5a47c27be9cd4c976af5a12d87fb1f0b4512f81d69cce3b35ae25021
    # via -r .github/scripts/requirements_sync_readme.in
-tomlkit==0.14.0 \
-    --hash=sha256:592064ed85b40fa213469f81ac584f67a4f2992509a7c3ea2d632208623a3680 \
-    --hash=sha256:cf00efca415dbd57575befb1f6634c4f42d2d87dbba376128adb42c121b87064
+tomlkit==0.13.3 \
+    --hash=sha256:430cf247ee57df2b94ee3fbe588e71d362a941ebb545dec29b53961d61add2a1 \
+    --hash=sha256:c89c649d79ee40629a9fda55f8ace8c6a1b42deb912b2a8fd8d942ddadb606b0
    # via -r .github/scripts/requirements_sync_readme.in
@@ -116,7 +116,7 @@ jobs:
          egress-policy: audit

      - name: Checkout main repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          repository: ${{ github.repository }}
          ref: main
@@ -172,7 +172,7 @@ jobs:
            return newComment.id;

      - name: Checkout PR
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          repository: ${{ needs.check-pr.outputs.pr_repository }}
          ref: ${{ needs.check-pr.outputs.pr_ref }}
@@ -189,7 +189,7 @@ jobs:
          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT

      - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}
@@ -231,8 +231,6 @@ jobs:
          context: .
          file: ./docker/embedded/Dockerfile
          push: true
-          cache-from: type=gha,scope=stirling-pdf-latest
-          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
          build-args: VERSION_TAG=v2-alpha
          platforms: linux/amd64
@@ -364,7 +362,7 @@ jobs:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Setup GitHub App Bot
        if: github.actor != 'dependabot[bot]'
@@ -45,7 +45,7 @@ jobs:
          egress-policy: audit

      - name: Checkout PR
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Setup GitHub App Bot
        if: github.actor != 'dependabot[bot]'
@@ -133,7 +133,7 @@ jobs:
          egress-policy: audit

      - name: Checkout PR
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Setup GitHub App Bot
        if: github.actor != 'dependabot[bot]'
@@ -145,19 +145,19 @@ jobs:
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

      - name: Checkout PR
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: refs/pull/${{ needs.check-comment.outputs.pr_number }}/merge
          token: ${{ steps.setup-bot.outputs.token }}

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
-          java-version: "25"
+          java-version: "21"
          distribution: "temurin"

      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
          gradle-version: 8.14

@@ -179,7 +179,7 @@ jobs:
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}
@@ -190,8 +190,6 @@ jobs:
          context: .
          file: ./docker/embedded/Dockerfile
          push: true
-          cache-from: type=gha,scope=stirling-pdf-latest
-          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
          build-args: VERSION_TAG=alpha
          platforms: linux/amd64
@@ -377,7 +375,7 @@ jobs:
          egress-policy: audit

      - name: Check out the repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Setup GitHub App Bot
        id: setup-bot
@@ -26,7 +26,7 @@ jobs:
          egress-policy: audit

      - name: Checkout PR
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Setup GitHub App Bot
        if: github.actor != 'dependabot[bot]'
@@ -23,7 +23,7 @@ jobs:
        with:
          egress-policy: audit

-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0

@@ -87,7 +87,7 @@ jobs:
      - name: AI PR Title Analysis
        if: steps.actor.outputs.is_repo_dev == 'true'
        id: ai-title-analysis
-        uses: actions/ai-inference@a6101c89c6feaecc585efdd8d461f18bb7896f20 # v2.0.5
+        uses: actions/ai-inference@334892bb203895caaed82ec52d23c1ed9385151e # v2.0.4
        with:
          model: openai/gpt-4o
          system-prompt-file: ".github/config/system-prompt.txt"
@@ -20,7 +20,7 @@ jobs:
        with:
          egress-policy: audit

-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Setup GitHub App Bot
        id: setup-bot
@@ -36,7 +36,7 @@ jobs:
        with:
          egress-policy: audit
      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Check for file changes
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
@@ -52,7 +52,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        jdk-version: [21, 25]
+        jdk-version: [17, 21]
        spring-security: [true, false]
    steps:
      - name: Harden Runner
@@ -60,28 +60,18 @@ jobs:
        with:
          egress-policy: audit
      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Set up JDK ${{ matrix.jdk-version }}
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
          java-version: ${{ matrix.jdk-version }}
          distribution: "temurin"

-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-${{ matrix.jdk-version }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
          gradle-version: 8.14
-          cache-disabled: true

      - name: Build with Gradle and spring security ${{ matrix.spring-security }}
        run: ./gradlew build -PnoSpotless
@@ -111,7 +101,7 @@ jobs:

      - name: Upload Test Reports
        if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: test-reports-jdk-${{ matrix.jdk-version }}-spring-security-${{ matrix.spring-security }}
          path: |
@@ -145,28 +135,18 @@ jobs:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Set up JDK 21
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
-          java-version: "25"
+          java-version: "21"
          distribution: "temurin"

-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
          gradle-version: 8.14
-          cache-disabled: true

      - name: Generate OpenAPI documentation
        run: ./gradlew :stirling-pdf:generateOpenApiDocs
@@ -177,7 +157,7 @@ jobs:
          DISABLE_ADDITIONAL_FEATURES: true

      - name: Upload OpenAPI Documentation
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: openapi-docs
          path: ./SwaggerDoc.json
@@ -192,9 +172,9 @@ jobs:
        with:
          egress-policy: audit
      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      - name: Set up Node.js
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
        with:
          node-version: "22"
          cache: "npm"
@@ -210,12 +190,110 @@ jobs:
      - name: Run frontend tests
        run: cd frontend && npm run test -- --run
      - name: Upload frontend build artifacts
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: frontend-build
          path: frontend/dist/
          retention-days: 3

+  sync-versions:
+    if: needs.files-changed.outputs.build == 'true'
+    needs: [files-changed, build]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        with:
+          gradle-version: 8.14
+
+      - name: Run version sync
+        run: ./gradlew syncAppVersion --build-cache
+
+      - name: Check if version files have changed
+        id: git-check
+        run: |
+          if [[ -n $(git status --porcelain) ]]; then
+            echo "changes=true" >> $GITHUB_OUTPUT
+          else
+            echo "changes=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Post comment on PR
+        if: steps.git-check.outputs.changes == 'true' && github.event_name != 'workflow_dispatch'
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          github-token: ${{ steps.setup-bot.outputs.token }}
+          script: |
+            const { GITHUB_REPOSITORY } = process.env;
+            const [repoOwner, repoName] = GITHUB_REPOSITORY.split('/');
+            const issueNumber = context.issue.number;
+
+            // Find existing comment
+            const comments = await github.rest.issues.listComments({
+              owner: repoOwner,
+              repo: repoName,
+              issue_number: issueNumber
+            });
+
+            const comment = comments.data.find(c => c.body.includes("## ⚠️ Version Differences"));
+
+            const commentBody = `## ⚠️ Version Differences
+
+            The versions in the following files do not match the version defined in \`build.gradle\`.
+
+            Running \`./gradlew syncAppVersion\` or \`./gradlew build\` will automatically update these files:
+
+            \`frontend/src-tauri/tauri.conf.json\`, \`frontend/src/proprietary/testing/serverExperienceSimulations.ts\`, \`frontend/src/core/testing/serverExperienceSimulations.ts\`
+
+            Please run \`./gradlew syncAppVersion\` or \`./gradlew build\`!`;
+
+            // Only update or create comments by the action user
+            const expectedActor = "${{ steps.setup-bot.outputs.app-slug }}[bot]";
+
+            if (comment && comment.user.login === expectedActor) {
+              // Update existing comment
+              await github.rest.issues.updateComment({
+                owner: repoOwner,
+                repo: repoName,
+                comment_id: comment.id,
+                body: commentBody
+              });
+              console.log("Updated existing comment.");
+            } else if (!comment) {
+              // Create new comment if no existing comment is found
+              await github.rest.issues.createComment({
+                owner: repoOwner,
+                repo: repoName,
+                issue_number: issueNumber,
+                body: commentBody
+              });
+            } else {
+              console.log("Comment update attempt denied. Actor does not match.");
+            }
+
  check-licence:
    if: needs.files-changed.outputs.build == 'true'
    needs: [files-changed, build]
@@ -227,36 +305,21 @@ jobs:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
-          java-version: "25"
+          java-version: "21"
          distribution: "temurin"

-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
          gradle-version: 8.14
-          cache-disabled: true

      - name: check the licenses for compatibility
-        # NOTE: --no-parallel is intentional here. Running the checkLicense task in parallel with other
-        # Gradle tasks has been observed to cause intermittent failures with the dependency license
-        # checking plugin on this Gradle version. Disabling parallel execution trades some build speed
-        # for more reliable, deterministic license checks. If upgrading Gradle or the plugin, consider
-        # re-evaluating whether this flag is still required before removing it.
-        run: ./gradlew checkLicense --no-parallel
+        run: ./gradlew checkLicense
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
@@ -264,7 +327,7 @@ jobs:

      - name: FAILED - check the licenses for compatibility
        if: failure()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: dependencies-without-allowed-license.json
          path: build/reports/dependency-license/dependencies-without-allowed-license.json
@@ -288,10 +351,6 @@ jobs:
    #     )

    runs-on: ubuntu-latest
-    permissions:
-      actions: write
-      contents: read
-      checks: write

    steps:
      - name: Harden Runner
@@ -300,36 +359,22 @@ jobs:
          egress-policy: audit

      - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
-          java-version: "25"
+          java-version: "21"
          distribution: "temurin"

-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
          gradle-version: 8.14
-          cache-disabled: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

-      # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for docker buildx type=gha cache backend.
-      - name: Expose GitHub runtime for Buildx cache
-        uses: crazy-max/ghaction-github-runtime@v3
-
      - name: Install Docker Compose
        run: |
          sudo curl -SL "https://github.com/docker/compose/releases/download/v2.39.4/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
@@ -345,7 +390,6 @@ jobs:
      - name: Pip requirements
        run: |
          pip install --require-hashes -r ./testing/cucumber/requirements.txt
-          pip install behave-html-formatter

      - name: Run Docker Compose Tests
        run: |
@@ -358,24 +402,6 @@ jobs:
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}

-      - name: Upload Cucumber Report
-        if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
-        with:
-          name: cucumber-report
-          path: testing/cucumber/report.html
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Cucumber Test Report
-        if: always()
-        uses: dorny/test-reporter@b082adf0eced0765477756c2a610396589b8c637 # v2.5.0
-        with:
-          name: Cucumber Tests
-          path: testing/cucumber/junit/*.xml
-          reporter: java-junit
-          fail-on-error: false
-
  test-build-docker-images:
    if: github.event_name == 'pull_request' && needs.files-changed.outputs.project == 'true'
    needs: [files-changed, build, check-generateOpenApiDocs, check-licence]
@@ -386,13 +412,10 @@ jobs:
        include:
          - docker-rev: docker/embedded/Dockerfile
            artifact-suffix: Dockerfile
-            cache-scope: stirling-pdf-latest
          - docker-rev: docker/embedded/Dockerfile.ultra-lite
            artifact-suffix: Dockerfile.ultra-lite
-            cache-scope: stirling-pdf-ultra-lite
          - docker-rev: docker/embedded/Dockerfile.fat
            artifact-suffix: Dockerfile.fat
-            cache-scope: stirling-pdf-fat
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
@@ -400,7 +423,7 @@ jobs:
          egress-policy: audit

      - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Free disk space on runner
        run: |
@@ -409,26 +432,16 @@ jobs:
          docker system prune -af || true
          echo "Disk space after cleanup:" && df -h

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
-          java-version: "25"
+          java-version: "21"
          distribution: "temurin"

-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
          gradle-version: 8.14
-          cache-disabled: true

      - name: Build application
        run: ./gradlew build
@@ -453,15 +466,15 @@ jobs:
          context: .
          file: ./${{ matrix.docker-rev }}
          push: false
-          cache-from: type=gha,scope=${{ matrix.cache-scope }}
-          cache-to: type=gha,mode=max,scope=${{ matrix.cache-scope }}
+          cache-from: type=gha,scope=${{ matrix.artifact-suffix }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.artifact-suffix }}
          platforms: linux/amd64,linux/arm64/v8
          provenance: true
          sbom: true

      - name: Upload Reports
        if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: reports-docker-${{ matrix.artifact-suffix }}
          path: |
@@ -32,7 +32,7 @@ jobs:
          egress-policy: audit

      - name: Checkout main branch first
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Setup GitHub App Bot
        id: setup-bot
@@ -22,7 +22,7 @@ jobs:
          egress-policy: audit

      - name: "Checkout Repository"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      - name: "Dependency Review"
        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
        with:
@@ -23,7 +23,7 @@ jobs:
          egress-policy: audit

      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
@@ -85,7 +85,7 @@ jobs:
          fi

      - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}
@@ -97,8 +97,6 @@ jobs:
          context: .
          file: ./docker/frontend/Dockerfile
          push: true
-          cache-from: type=gha,scope=stirling-v2-frontend
-          cache-to: type=gha,mode=max,scope=stirling-v2-frontend
          tags: |
            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-latest
@@ -112,8 +110,6 @@ jobs:
          context: .
          file: ./docker/backend/Dockerfile
          push: true
-          cache-from: type=gha,scope=stirling-v2-backend
-          cache-to: type=gha,mode=max,scope=stirling-v2-backend
          tags: |
            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-latest
@@ -30,7 +30,7 @@ jobs:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Check for file changes
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
@@ -54,7 +54,7 @@ jobs:
          egress-policy: audit

      - name: Checkout PR head (default)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -69,7 +69,7 @@ jobs:

      - name: Checkout BASE branch (safe script)
        if: github.event_name == 'pull_request'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{ github.event.pull_request.base.sha }}
          path: base
@@ -77,7 +77,7 @@ jobs:
          persist-credentials: false

      - name: Set up Node.js
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
        with:
          node-version: "22"
          cache: "npm"
@@ -273,7 +273,7 @@ jobs:
      - name: Create Pull Request (Push only)
        id: cpr
        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
        with:
          token: ${{ steps.setup-bot.outputs.token }}
          commit-message: "Update Frontend 3rd Party Licenses"
@@ -317,7 +317,7 @@ jobs:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -330,26 +330,21 @@ jobs:
          app-id: ${{ secrets.GH_APP_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
-          java-version: "25"
+          java-version: "21"
          distribution: "temurin"

      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
          gradle-version: 8.14

      - name: Check licenses and generate report
        id: license-check
        run: |
-          # NOTE: --no-parallel is intentional here. Running the license-checking tasks in parallel has
-          # previously caused intermittent concurrency issues in CI (e.g. flaky failures in the license
-          # plugin/Gradle when multiple projects are evaluated concurrently). Disabling parallelism trades
-          # some build speed for more reliable license reports. If the underlying issues are resolved in
-          # future Gradle or plugin versions, this flag can be reconsidered.
-          ./gradlew checkLicense generateLicenseReport --no-parallel || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV
+          ./gradlew checkLicense generateLicenseReport || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
@@ -369,7 +364,7 @@ jobs:

      - name: Upload artifact on license issues
        if: env.LICENSE_WARNINGS_EXIST == 'true'
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: backend-dependencies-without-allowed-license.json
          path: build/reports/dependency-license/dependencies-without-allowed-license.json
@@ -495,7 +490,7 @@ jobs:
      - name: Create Pull Request (push only)
        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
        id: cpr
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
        with:
          token: ${{ steps.setup-bot.outputs.token }}
          commit-message: "Update Backend 3rd Party Licenses"
@@ -20,7 +20,7 @@ jobs:
          egress-policy: audit

      - name: Check out the repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Run Labeler
        uses: crazy-max/ghaction-github-labeler@24d110aa46a59976b8a7f35518cb7f14f434c916 # v5.3.0
@@ -21,6 +21,8 @@ on:
          - windows
          - macos
          - linux
+  push:
+    branches: [main, V2-master]
  release:
    types: [created]

@@ -40,26 +42,16 @@ jobs:
        with:
          egress-policy: audit

-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
-          java-version: "25"
+          java-version: "21"
          distribution: "temurin"

-      - name: Cache Gradle dependencies
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-
-
      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
          gradle-version: 8.14

@@ -123,22 +115,22 @@ jobs:
        with:
          egress-policy: audit

-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
-          java-version: "25"
+          java-version: "21"
          distribution: "temurin"

      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
          gradle-version: 8.14

      - name: Setup Node.js
        if: matrix.variant.build_frontend == true
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: "npm"
@@ -162,7 +154,7 @@ jobs:
          cp app/core/build/libs/stirling-pdf-${{ needs.determine-matrix.outputs.version }}.jar ./jar-dist/Stirling-PDF${{ matrix.variant.file_suffix }}.jar

      - name: Upload JAR artifacts
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: jar${{ matrix.variant.file_suffix }}
          path: ./jar-dist/*.jar
@@ -184,7 +176,7 @@ jobs:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Install dependencies (ubuntu only)
        if: matrix.platform == 'ubuntu-22.04'
@@ -193,26 +185,26 @@ jobs:
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev

      - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json

      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
-          java-version: "25"
+          java-version: "21"
          distribution: "temurin"

      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
          gradle-version: 8.14

@@ -299,7 +291,7 @@ jobs:
      - name: Setup DigiCert KeyLocker
        id: digicert-setup
        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
-        uses: digicert/ssm-code-signing@af7f4b07694120e514fe5b19f0598af3c20256e3 # v1.2.0
+        uses: digicert/ssm-code-signing@v1.1.0
        env:
          SM_API_KEY: ${{ secrets.SM_API_KEY }}
          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
@@ -407,7 +399,7 @@ jobs:
          echo "Certificate imported successfully."

      - name: Build Tauri app
-        uses: tauri-apps/tauri-action@51a9f1156b33df106d827c3a78f8f894946c5faa # v0.5.25
+        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
@@ -541,7 +533,7 @@ jobs:
          fi

      - name: Upload build artifacts
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: Stirling-PDF-${{ matrix.name }}
          path: ./dist/*
@@ -26,10 +26,9 @@ jobs:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0
-          persist-credentials: false

      - name: Setup GitHub App Bot
        id: setup-bot
@@ -49,24 +48,17 @@ jobs:
        run: |
          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_pre_commit.txt

-      - name: Run Pre-Commit
-        run: |
-          pre-commit run ruff --all-files -c .pre-commit-config.yaml
-          pre-commit run ruff-format --all-files -c .pre-commit-config.yaml
-          pre-commit run codespell --all-files -c .pre-commit-config.yaml
-          pre-commit run gitleaks --all-files -c .pre-commit-config.yaml
-          pre-commit run end-of-file-fixer --all-files -c .pre-commit-config.yaml
-          pre-commit run trailing-whitespace --all-files -c .pre-commit-config.yaml
+      - run: pre-commit run --all-files -c .pre-commit-config.yaml
        continue-on-error: true

      - name: Set up JDK 21
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
          java-version: 21
          distribution: "temurin"

      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
          gradle-version: 8.14

@@ -84,7 +76,7 @@ jobs:

      - name: Create Pull Request
        if: env.CHANGES_DETECTED == 'true'
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
        with:
          token: ${{ steps.setup-bot.outputs.token }}
          commit-message: ":file_folder: pre-commit"
@@ -37,26 +37,16 @@ jobs:
        with:
          egress-policy: audit

-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
-          java-version: "25"
+          java-version: "21"
          distribution: "temurin"

-      - name: Cache Gradle dependencies
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-
-
      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
          gradle-version: 8.14

@@ -85,13 +75,13 @@ jobs:
          cosign-release: "v2.4.1"

      - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -126,8 +116,8 @@ jobs:
          context: .
          file: ./docker/embedded/Dockerfile
          push: true
-          cache-from: type=gha,scope=stirling-pdf-latest
-          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
@@ -172,8 +162,8 @@ jobs:
          context: .
          file: ./docker/embedded/Dockerfile.fat
          push: true
-          cache-from: type=gha,scope=stirling-pdf-fat
-          cache-to: type=gha,mode=max,scope=stirling-pdf-fat
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
          tags: ${{ steps.meta-fat.outputs.tags }}
          labels: ${{ steps.meta-fat.outputs.labels }}
          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
@@ -216,8 +206,8 @@ jobs:
          context: .
          file: ./docker/embedded/Dockerfile.ultra-lite
          push: true
-          cache-from: type=gha,scope=stirling-pdf-ultra-lite
-          cache-to: type=gha,mode=max,scope=stirling-pdf-ultra-lite
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
          tags: ${{ steps.meta-lite.outputs.tags }}
          labels: ${{ steps.meta-lite.outputs.labels }}
          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
@@ -40,7 +40,7 @@ jobs:
          egress-policy: audit

      - name: "Checkout code"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

@@ -67,7 +67,7 @@ jobs:
      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
      # format to the repository Actions tab.
      - name: "Upload artifact"
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: SARIF file
          path: results.sarif
@@ -31,16 +31,16 @@ jobs:
        with:
          egress-policy: audit

-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
-          java-version: "25"
+          java-version: "21"
          distribution: "temurin"

      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
          gradle-version: 8.14

@@ -39,9 +39,7 @@ jobs:
        with:
          egress-policy: audit

-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Setup GitHub App Bot
        id: setup-bot
@@ -57,16 +55,12 @@ jobs:
          cache: "pip" # caching pip dependencies

      - name: Install Python dependencies
-        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt -r ./.github/scripts/requirements_pre_commit.txt
+        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt

      - name: Sync translation TOML files
        run: |
          python .github/scripts/check_language_toml.py --reference-file "frontend/public/locales/en-GB/translation.toml" --branch main

-      - name: pre-commit run
-        run: |
-          pre-commit run toml-sort-fix --all-files
-
      - name: Commit translation files
        run: |
          git add frontend/public/locales/*/translation.toml
@@ -83,7 +77,7 @@ jobs:

      - name: Create Pull Request
        if: always()
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
        with:
          token: ${{ steps.setup-bot.outputs.token }}
          commit-message: Update files
@@ -15,19 +15,16 @@ on:
          - linux
  pull_request:
    branches: [main, V2-tauri-windows]
-    types: [opened, reopened, synchronize, ready_for_review]
    paths:
      - "frontend/src-tauri/**"
      - "frontend/src/desktop/**"
      - "frontend/tsconfig.desktop.json"
-      - "frontend/package.json"
-      - "frontend/package-lock.json"
-      - "frontend/vite.config.ts"
      - ".github/workflows/tauri-build.yml"
+  push:
+    branches: [main]

 permissions:
  contents: read
-  pull-requests: write

 jobs:
  determine-matrix:
@@ -36,11 +33,6 @@ jobs:
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
-        with:
-          egress-policy: audit
-
      - name: Determine build matrix
        id: set-matrix
        run: |
@@ -80,7 +72,7 @@ jobs:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Install dependencies (ubuntu only)
        if: matrix.platform == 'ubuntu-22.04'
@@ -89,26 +81,26 @@ jobs:
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev

      - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json

      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

      - name: Set up JDK 21
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
        with:
          java-version: "21"
          distribution: "temurin"

      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
          gradle-version: 8.14

@@ -196,7 +188,7 @@ jobs:
      - name: Setup DigiCert KeyLocker
        id: digicert-setup
        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        uses: digicert/ssm-code-signing@af7f4b07694120e514fe5b19f0598af3c20256e3 # v1.2.0
+        uses: digicert/ssm-code-signing@v1.1.0
        env:
          SM_API_KEY: ${{ secrets.SM_API_KEY }}
          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
@@ -315,7 +307,7 @@ jobs:
          ls -la /usr/bin/hd* || echo "No hd* tools found"

      - name: Build Tauri app
-        uses: tauri-apps/tauri-action@51a9f1156b33df106d827c3a78f8f894946c5faa # v0.5.25
+        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
@@ -329,7 +321,6 @@ jobs:
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
-          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL }}
          # Only enable Windows signing in Tauri when on main
          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
          CI: true
@@ -590,7 +581,7 @@ jobs:
          }

      - name: Upload artifacts
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: Stirling-PDF-${{ matrix.name }}
          path: ./dist/*
@@ -643,110 +634,11 @@ jobs:
            fi
          done

-  pr-comment:
-    needs: build
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request' && needs.build.result == 'success'
-    permissions:
-      pull-requests: write
-    steps:
-      - name: Harden the runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
-        with:
-          egress-policy: audit
-
-      - name: Post/Update PR Comment with Download Links
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const owner = context.repo.owner;
-            const repo = context.repo.repo;
-            const prNumber = context.issue.number;
-            const runId = context.runId;
-
-            // Fetch artifacts for this workflow run
-            const { data: artifactsList } = await github.rest.actions.listWorkflowRunArtifacts({
-              owner,
-              repo,
-              run_id: runId
-            });
-
-            // Map of expected artifact names to display info
-            const artifactMap = {
-              'Stirling-PDF-windows-x86_64': { icon: '🪟', platform: 'Windows x64', files: '.exe, .msi' },
-              'Stirling-PDF-macos-aarch64': { icon: '🍎', platform: 'macOS ARM64', files: '.dmg' },
-              'Stirling-PDF-macos-x86_64': { icon: '🍎', platform: 'macOS Intel', files: '.dmg' },
-              'Stirling-PDF-linux-x86_64': { icon: '🐧', platform: 'Linux x64', files: '.deb, .AppImage' }
-            };
-
-            let commentBody = `## 📦 Tauri Desktop Builds Ready!\n\n`;
-            commentBody += `The desktop applications have been built and are ready for testing.\n\n`;
-            commentBody += `### Download Artifacts:\n\n`;
-
-            // Add links for each found artifact
-            let foundArtifacts = 0;
-            for (const artifact of artifactsList.artifacts) {
-              const info = artifactMap[artifact.name];
-              if (info) {
-                foundArtifacts++;
-                // GitHub doesn't provide direct download URLs via API, but we can link to the artifact on the Actions page
-                const artifactUrl = `https://github.com/${owner}/${repo}/actions/runs/${runId}/artifacts/${artifact.id}`;
-                commentBody += `${info.icon} **${info.platform}**: [Download ${artifact.name}](${artifactUrl}) `;
-                commentBody += `(${info.files}) - ${(artifact.size_in_bytes / 1024 / 1024).toFixed(1)} MB\n`;
-              }
-            }
-
-            if (foundArtifacts === 0) {
-              commentBody += `⚠️ **Warning**: No artifacts found in workflow run.\n`;
-              commentBody += `[View workflow run](https://github.com/${owner}/${repo}/actions/runs/${runId})\n`;
-            }
-
-            commentBody += `\n---\n`;
-            commentBody += `_Built from commit ${context.sha.substring(0, 7)}_\n`;
-            commentBody += `_Artifacts expire in 7 days_`;
-
-            // Find existing comment
-            const { data: comments } = await github.rest.issues.listComments({
-              owner,
-              repo,
-              issue_number: prNumber
-            });
-
-            const botComment = comments.find(comment =>
-              comment.user.type === 'Bot' &&
-              comment.body.includes('📦 Tauri Desktop Builds Ready!')
-            );
-
-            if (botComment) {
-              // Update existing comment
-              await github.rest.issues.updateComment({
-                owner,
-                repo,
-                comment_id: botComment.id,
-                body: commentBody
-              });
-              console.log('Updated existing comment');
-            } else {
-              // Create new comment
-              await github.rest.issues.createComment({
-                owner,
-                repo,
-                issue_number: prNumber,
-                body: commentBody
-              });
-              console.log('Created new comment');
-            }
-
  report:
    needs: build
    runs-on: ubuntu-latest
    if: always()
    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
-        with:
-          egress-policy: audit
-
      - name: Report build results
        run: |
          if [ "${{ needs.build.result }}" = "success" ]; then
@@ -30,16 +30,16 @@ jobs:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Set up JDK 21
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
          java-version: "21"
          distribution: "temurin"

      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
          gradle-version: 8.14

@@ -61,7 +61,7 @@ jobs:
          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT

      - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}
@@ -72,8 +72,6 @@ jobs:
          context: .
          file: ./docker/embedded/Dockerfile
          push: true
-          cache-from: type=gha,scope=stirling-pdf-latest
-          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
          platforms: linux/amd64
@@ -130,12 +128,7 @@ jobs:
    outputs:
      frontend: ${{ steps.changes.outputs.frontend }}
    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Check for file changes
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
@@ -154,10 +147,10 @@ jobs:
        with:
          egress-policy: audit

-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Set up Node
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
        with:
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json
@@ -149,7 +149,6 @@ app/proprietary/build
 common/build
 proprietary/build
 stirling-pdf/build
-frontend/src-tauri/provisioner/target

 # Byte-compiled / optimized / DLL files
 __pycache__/
@@ -244,3 +243,4 @@ docs/type3/signatures/

 # Type3 sample PDFs (development only)
 **/type3/samples/
+
@@ -1,6 +1,6 @@
 repos:
  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.14
+    rev: v0.14.8
    hooks:
      - id: ruff
        args:
@@ -16,11 +16,11 @@ repos:
    hooks:
      - id: codespell
        args:
-          - --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist
+          - --ignore-words-list=thirdParty,tabEl,tabEls
          - --skip="./.*,*.csv,*.json,*.ambr"
          - --quiet-level=2
        files: \.(html|css|js|py|md)$
-        exclude: (.vscode|.devcontainer|app/core/src/main/resources|app/proprietary/src/main/resources|frontend/public/vendor|Dockerfile|.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js)
+        exclude: (.vscode|.devcontainer|app/core/src/main/resources|app/proprietary/src/main/resources|Dockerfile|.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js)
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.30.0
    hooks:
@@ -34,12 +34,6 @@ repos:
      - id: trailing-whitespace
        files: ^.*(\.js|\.java|\.py|\.yml)$
        exclude: ^(.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js|\.github/workflows/.*$)
-  - repo: https://github.com/pappasam/toml-sort
-    rev: v0.24.3
-    hooks:
-      - id: toml-sort-fix
-        files: frontend/public/locales/.*\.toml$
-        args: ['--in-place', '--all', '--ignore-case']
  # - repo: https://github.com/thibaudcolas/pre-commit-stylelint
  #   rev: v16.21.1
  #   hooks:
@@ -13,7 +13,7 @@
    "vscjava.vscode-spring-boot-dashboard", // Spring Boot dashboard for managing and visualizing Spring Boot applications
    "EditorConfig.EditorConfig", // EditorConfig support for maintaining consistent coding styles
    "ms-azuretools.vscode-docker", // Docker extension for Visual Studio Code
-    "GitHub.copilot-chat", // GitHub Copilot AI pair programmer for Visual Studio Code
+    "GitHub.copilot", // GitHub Copilot AI pair programmer for Visual Studio Code
    "GitHub.vscode-pull-request-github", // GitHub Pull Requests extension for Visual Studio Code
    "charliermarsh.ruff", // Ruff code formatter for Python to follow the Ruff Style Guide
    "yzhang.markdown-all-in-one", // Markdown All-in-One extension for enhanced Markdown editing
@@ -30,91 +30,6 @@ Set `DOCKER_ENABLE_SECURITY=true` environment variable to enable security featur
  - **Web Server**: `npm run build` then serve dist/ folder
  - **Development**: `npm run tauri-dev` for desktop dev mode

-#### Import Paths - CRITICAL
-**ALWAYS use `@app/*` for imports.** Do not use `@core/*` or `@proprietary/*` unless explicitly wrapping/extending a lower layer implementation.
-
-```typescript
-// ✅ CORRECT - Use @app/* for all imports
-import { AppLayout } from "@app/components/AppLayout";
-import { useFileContext } from "@app/contexts/FileContext";
-import { FileContext } from "@app/contexts/FileContext";
-
-// ❌ WRONG - Do not use @core/* or @proprietary/* in normal code
-import { AppLayout } from "@core/components/AppLayout";
-import { useFileContext } from "@proprietary/contexts/FileContext";
-```
-
-**Only use explicit aliases when:**
- Building layer-specific override that wraps a lower layer's component
- Example: `import { AppProviders as CoreAppProviders } from "@core/components/AppProviders"` when creating proprietary/AppProviders.tsx that extends the core version
-
-The `@app/*` alias automatically resolves to the correct layer based on build target (core/proprietary/desktop) and handles the fallback cascade.
-
-#### Component Override Pattern (Stub/Shadow)
-Use this pattern for desktop-specific or proprietary-specific features WITHOUT runtime checks or conditionals.
-
-**How it works:**
-1. Core defines stub component (returns null or no-op)
-2. Desktop/proprietary overrides with same path/name
-3. Core imports via `@app/*` - higher layer "shadows" core in those builds
-4. No `@ts-ignore`, no `isTauri()` checks, no runtime conditionals!
-
-**Example - Desktop-specific footer:**
-
-```typescript
-// core/components/rightRail/RightRailFooterExtensions.tsx (stub)
-interface RightRailFooterExtensionsProps {
-  className?: string;
-}
-
-export function RightRailFooterExtensions(_props: RightRailFooterExtensionsProps) {
-  return null; // Stub - does nothing in web builds
-}
-```
-
-```typescript
-// desktop/components/rightRail/RightRailFooterExtensions.tsx (real implementation)
-import { Box } from '@mantine/core';
-import { BackendHealthIndicator } from '@app/components/BackendHealthIndicator';
-
-interface RightRailFooterExtensionsProps {
-  className?: string;
-}
-
-export function RightRailFooterExtensions({ className }: RightRailFooterExtensionsProps) {
-  return (
-    <Box className={className}>
-      <BackendHealthIndicator />
-    </Box>
-  );
-}
-```
-
-```typescript
-// core/components/shared/RightRail.tsx (usage - works in ALL builds)
-import { RightRailFooterExtensions } from '@app/components/rightRail/RightRailFooterExtensions';
-
-export function RightRail() {
-  return (
-    <div>
-      {/* In web builds: renders nothing (stub returns null) */}
-      {/* In desktop builds: renders BackendHealthIndicator */}
-      <RightRailFooterExtensions className="right-rail-footer" />
-    </div>
-  );
-}
-```
-
-**Build resolution:**
- **Core build**: `@app/*` → `core/*` → Gets stub (returns null)
- **Desktop build**: `@app/*` → `desktop/*` → Gets real implementation (shadows core)
-
-**Benefits:**
- No runtime checks or feature flags
- Type-safe across all builds
- Clean, readable code
- Build-time optimization (dead code elimination)
-
 #### Multi-Tool Workflow Architecture
 Frontend designed for **stateful document processing**:
 - Users upload PDFs once, then chain tools (split → merge → compress → view)
@@ -122,7 +37,7 @@ Frontend designed for **stateful document processing**:
 - No file reloading between tools - performance critical for large PDFs (up to 100GB+)

 #### FileContext - Central State Management
-**Location**: `frontend/src/core/contexts/FileContext.tsx`
+**Location**: `src/contexts/FileContext.tsx`
 - **Active files**: Currently loaded PDFs and their variants
 - **Tool navigation**: Current mode (viewer/pageEditor/fileEditor/toolName)
 - **Memory management**: PDF document cleanup, blob URL lifecycle, Web Worker management
@@ -147,7 +62,7 @@ Without cleanup: browser crashes with memory leaks.

 **Architecture**: Modular hook-based system with clear separation of concerns:

- **useToolOperation** (`frontend/src/core/hooks/tools/shared/useToolOperation.ts`): Main orchestrator hook
+- **useToolOperation** (`frontend/src/hooks/tools/shared/useToolOperation.ts`): Main orchestrator hook
  - Coordinates all tool operations with consistent interface
  - Integrates with FileContext for operation tracking
  - Handles validation, error handling, and UI state management
@@ -232,34 +147,8 @@ return useToolOperation({
 - **Pipeline System**: Automated PDF processing workflows via `PipelineController`
 - **Security Layer**: Authentication, authorization, and user management (when enabled)

-### Frontend Directory Structure
-The frontend is organized with a clear separation of concerns:
-
- **`frontend/src/core/`**: Main application code (shared, production-ready components)
-  - **`core/components/`**: React components organized by feature
-    - `core/components/tools/`: Individual PDF tool implementations
-    - `core/components/viewer/`: PDF viewer components
-    - `core/components/pageEditor/`: Page manipulation UI
-    - `core/components/tooltips/`: Help tooltips for tools
-    - `core/components/shared/`: Reusable UI components
-  - **`core/contexts/`**: React Context providers
-    - `FileContext.tsx`: Central file state management
-    - `file/`: File reducer and selectors
-    - `toolWorkflow/`: Tool workflow state
-  - **`core/hooks/`**: Custom React hooks
-    - `hooks/tools/`: Tool-specific operation hooks (one directory per tool)
-    - `hooks/tools/shared/`: Shared hook utilities (useToolOperation, etc.)
-  - **`core/constants/`**: Application constants and configuration
-  - **`core/data/`**: Static data (tool taxonomy, etc.)
-  - **`core/services/`**: Business logic services (PDF processing, storage, etc.)
-
- **`frontend/src/desktop/`**: Desktop-specific (Tauri) code
- **`frontend/src/proprietary/`**: Proprietary/licensed features
- **`frontend/src-tauri/`**: Tauri (Rust) native desktop application code
- **`frontend/public/`**: Static assets served directly
-  - `public/locales/`: Translation JSON files
-
 ### Component Architecture
+- **React Components**: Located in `frontend/src/components/` and `frontend/src/tools/`
 - **Static Assets**: CSS, JS, and resources in `src/main/resources/static/` (legacy) + `frontend/public/` (modern)
 - **Internationalization**:
  - Backend: `messages_*.properties` files
@@ -310,11 +199,11 @@ The frontend is organized with a clear separation of concerns:

 - **Java Version**: Minimum JDK 17, supports and recommends JDK 21
 - **Lombok**: Used extensively - ensure IDE plugin is installed
+- **Desktop Mode**: Set `STIRLING_PDF_DESKTOP_UI=true` for desktop application mode
 - **File Persistence**:
  - **Backend**: Designed to be stateless - files are processed in memory/temp locations only
  - **Frontend**: Uses IndexedDB for client-side file storage and caching (with thumbnails)
 - **Security**: When `DOCKER_ENABLE_SECURITY=false`, security-related classes are excluded from compilation
- **Import Paths**: ALWAYS use `@app/*` for imports - never use `@core/*` or `@proprietary/*` unless explicitly wrapping/extending a lower layer
 - **FileContext**: All file operations MUST go through FileContext - never bypass with direct File handling
 - **Memory Management**: Manual cleanup required for PDF.js documents and blob URLs - don't remove cleanup code
 - **Tool Development**: New tools should follow `useToolOperation` hook pattern (see `useCompressOperation.ts`)
@@ -27,9 +27,9 @@ spotless {
    }
 }
 dependencies {
-    api 'org.springframework.boot:spring-boot-starter-webmvc'
-    api 'org.springframework.boot:spring-boot-starter-aspectj'
-    api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20260102.1'
+    api 'org.springframework.boot:spring-boot-starter-web'
+    api 'org.springframework.boot:spring-boot-starter-aop'
+    api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20240325.1'
    api 'com.fathzer:javaluator:3.0.6'
    api 'com.posthog.java:posthog:1.2.0'
    api 'org.apache.commons:commons-lang3:3.20.0'
@@ -39,10 +39,10 @@ dependencies {
    api "org.apache.pdfbox:pdfbox-io:$pdfboxVersion"
    api "org.apache.pdfbox:xmpbox:$pdfboxVersion"
    api "org.apache.pdfbox:preflight:$pdfboxVersion"
-    api 'com.github.junrar:junrar:7.5.8' // RAR archive support for CBR files
+    api 'com.github.junrar:junrar:7.5.7' // RAR archive support for CBR files
    api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
    api 'org.snakeyaml:snakeyaml-engine:3.0.1'
-    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.1"
+    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.15"
    // Simple Java Mail for EML/MSG parsing (replaces direct Angus Mail usage)
    api 'org.simplejavamail:simple-java-mail:8.12.6'
    api 'org.simplejavamail:outlook-module:8.12.6' // MSG file support
@@ -303,23 +303,22 @@ public class EndpointConfiguration {
        // Adding endpoints to "PageOps" group
        addEndpointToGroup("PageOps", "remove-pages");
        addEndpointToGroup("PageOps", "merge-pdfs");
-        addEndpointToGroup("PageOps", "split-pages");
-        addEndpointToGroup("PageOps", "rearrange-pages");
+        addEndpointToGroup("PageOps", "split-pdfs");
+        addEndpointToGroup("PageOps", "pdf-organizer");
        addEndpointToGroup("PageOps", "rotate-pdf");
        addEndpointToGroup("PageOps", "multi-page-layout");
        addEndpointToGroup("PageOps", "booklet-imposition");
        addEndpointToGroup("PageOps", "scale-pages");
        addEndpointToGroup("PageOps", "crop");
+        addEndpointToGroup("PageOps", "extract-page");
        addEndpointToGroup("PageOps", "pdf-to-single-page");
        addEndpointToGroup("PageOps", "auto-split-pdf");
        addEndpointToGroup("PageOps", "split-by-size-or-count");
        addEndpointToGroup("PageOps", "overlay-pdf");
        addEndpointToGroup("PageOps", "split-pdf-by-sections");
        addEndpointToGroup("PageOps", "split-pdf-by-chapters");
-        addEndpointToGroup("PageOps", "add-page-numbers");
-        addEndpointToGroup("PageOps", "extract-pages");

-        // Adding endpoints to "Convert" group (Frontend has 15 convert endpoints)
+        // Adding endpoints to "Convert" group
        addEndpointToGroup("Convert", "pdf-to-img");
        addEndpointToGroup("Convert", "img-to-pdf");
        addEndpointToGroup("Convert", "pdf-to-pdfa");
@@ -335,8 +334,6 @@ public class EndpointConfiguration {
        addEndpointToGroup("Convert", "pdf-to-csv");
        addEndpointToGroup("Convert", "pdf-to-markdown");
        addEndpointToGroup("Convert", "eml-to-pdf");
-        addEndpointToGroup("Convert", "pdf-to-epub");
-        // Backend-only endpoints (not in frontend tool registry)
        addEndpointToGroup("Convert", "pdf-to-vector");
        addEndpointToGroup("Convert", "vector-to-pdf");
        addEndpointToGroup("Convert", "pdf-to-video");
@@ -344,7 +341,6 @@ public class EndpointConfiguration {
        addEndpointToGroup("Convert", "pdf-to-cbz");
        addEndpointToGroup("Convert", "pdf-to-json");
        addEndpointToGroup("Convert", "json-to-pdf");
-        addEndpointToGroup("Convert", "pdf-to-rtf");

        // Adding endpoints to "Security" group
        addEndpointToGroup("Security", "add-password");
@@ -355,60 +351,51 @@ public class EndpointConfiguration {
        addEndpointToGroup("Security", "remove-cert-sign");
        addEndpointToGroup("Security", "sanitize-pdf");
        addEndpointToGroup("Security", "auto-redact");
-        addEndpointToGroup("Security", "validate-signature");
-        addEndpointToGroup("Security", "add-stamp");
-        addEndpointToGroup("Security", "unlock-pdf-forms");
-        // Backend-only endpoints (not in frontend tool registry endpoints)
        addEndpointToGroup("Security", "redact");
+        addEndpointToGroup("Security", "validate-signature");
        addEndpointToGroup("Security", "verify-pdf");
+        addEndpointToGroup("Security", "stamp");
        addEndpointToGroup("Security", "sign");

        // Adding endpoints to "Other" group
        addEndpointToGroup("Other", "ocr-pdf");
+        addEndpointToGroup("Other", "add-image");
        addEndpointToGroup("Other", "extract-images");
-        addEndpointToGroup("Other", "update-metadata");
+        addEndpointToGroup("Other", "change-metadata");
        addEndpointToGroup("Other", "flatten");
+        addEndpointToGroup("Other", "unlock-pdf-forms");
        addEndpointToGroup("Other", REMOVE_BLANKS);
        addEndpointToGroup("Other", "remove-annotations");
+        addEndpointToGroup("Other", "compare");
+        addEndpointToGroup("Other", "add-page-numbers");
        addEndpointToGroup("Other", "get-info-on-pdf");
        addEndpointToGroup("Other", "remove-image-pdf");
        addEndpointToGroup("Other", "add-attachments");
-        addEndpointToGroup("Other", "replace-invert-pdf");
-        addEndpointToGroup("Other", "edit-table-of-contents");
-        addEndpointToGroup("Other", "text-editor-pdf");
-        // Backend-only endpoints (not in frontend tool registry endpoints)
-        addEndpointToGroup("Other", "add-image");
-        addEndpointToGroup("Other", "compare");
        addEndpointToGroup("Other", "view-pdf");
+        addEndpointToGroup("Other", "replace-and-invert-color-pdf");
        addEndpointToGroup("Other", "multi-tool");
+
+        // Adding form-related endpoints to "Other" group
        addEndpointToGroup("Other", "fields");
        addEndpointToGroup("Other", "modify-fields");
        addEndpointToGroup("Other", "delete-fields");
        addEndpointToGroup("Other", "fill");

        // Adding endpoints to "Advance" group
+        addEndpointToGroup("Advance", "adjust-contrast");
        addEndpointToGroup("Advance", "compress-pdf");
        addEndpointToGroup("Advance", "extract-image-scans");
        addEndpointToGroup("Advance", "repair");
        addEndpointToGroup("Advance", "auto-rename");
+        addEndpointToGroup("Advance", "pipeline");
        addEndpointToGroup("Advance", "scanner-effect");
+        addEndpointToGroup("Advance", "auto-split-pdf");
+        addEndpointToGroup("Advance", "show-javascript");
+        addEndpointToGroup("Advance", "split-by-size-or-count");
        addEndpointToGroup("Advance", "overlay-pdf");
-        // Backend-only endpoints
-        addEndpointToGroup("Advance", "adjust-contrast");
-
-        // Adding endpoints to "Automation" group
-        addEndpointToGroup("Automation", "handleData");
-        addEndpointToGroup("Automation", "automate"); // Alias for handleData (user-friendly name)
-        addEndpointToGroup("Automation", "pipeline");
-
-        // Adding endpoints to "DeveloperTools" group
-        addEndpointToGroup("DeveloperTools", "show-javascript");
-
-        // Adding endpoints to "DeveloperDocs" group (fake endpoints for link-only tools)
-        addEndpointToGroup("DeveloperDocs", "dev-api-docs");
-        addEndpointToGroup("DeveloperDocs", "dev-folder-scanning-docs");
-        addEndpointToGroup("DeveloperDocs", "dev-sso-guide-docs");
-        addEndpointToGroup("DeveloperDocs", "dev-airgapped-docs");
+        addEndpointToGroup("Advance", "split-pdf-by-sections");
+        addEndpointToGroup("Advance", "edit-table-of-contents");
+        addEndpointToGroup("Advance", "split-pdf-by-chapters");

        // CLI
        addEndpointToGroup("CLI", "compress-pdf");
@@ -449,8 +436,8 @@ public class EndpointConfiguration {
        // Java
        addEndpointToGroup("Java", "merge-pdfs");
        addEndpointToGroup("Java", "remove-pages");
-        addEndpointToGroup("Java", "split-pages");
-        addEndpointToGroup("Java", "rearrange-pages");
+        addEndpointToGroup("Java", "split-pdfs");
+        addEndpointToGroup("Java", "pdf-organizer");
        addEndpointToGroup("Java", "rotate-pdf");
        addEndpointToGroup("Java", "pdf-to-img");
        addEndpointToGroup("Java", "img-to-pdf");
@@ -458,10 +445,9 @@ public class EndpointConfiguration {
        addEndpointToGroup("Java", "remove-password");
        addEndpointToGroup("Java", "change-permissions");
        addEndpointToGroup("Java", "add-watermark");
-        addEndpointToGroup("Java", "add-stamp");
        addEndpointToGroup("Java", "add-image");
        addEndpointToGroup("Java", "extract-images");
-        addEndpointToGroup("Java", "update-metadata");
+        addEndpointToGroup("Java", "change-metadata");
        addEndpointToGroup("Java", "cert-sign");
        addEndpointToGroup("Java", "remove-cert-sign");
        addEndpointToGroup("Java", "multi-page-layout");
@@ -473,6 +459,7 @@ public class EndpointConfiguration {
        addEndpointToGroup("Java", "sanitize-pdf");
        addEndpointToGroup("Java", "crop");
        addEndpointToGroup("Java", "get-info-on-pdf");
+        addEndpointToGroup("Java", "extract-page");
        addEndpointToGroup("Java", "pdf-to-single-page");
        addEndpointToGroup("Java", "markdown-to-pdf");
        addEndpointToGroup("Java", "show-javascript");
@@ -482,9 +469,7 @@ public class EndpointConfiguration {
        addEndpointToGroup("Java", "split-by-size-or-count");
        addEndpointToGroup("Java", "overlay-pdf");
        addEndpointToGroup("Java", "split-pdf-by-sections");
-        addEndpointToGroup("Java", "split-pdf-by-chapters");
        addEndpointToGroup("Java", REMOVE_BLANKS);
-        addEndpointToGroup("Java", "remove-annotations");
        addEndpointToGroup("Java", "pdf-to-text");
        addEndpointToGroup("Java", "remove-image-pdf");
        addEndpointToGroup("Java", "pdf-to-markdown");
@@ -494,24 +479,15 @@ public class EndpointConfiguration {
        addEndpointToGroup("Java", "pdf-to-cbz");
        addEndpointToGroup("Java", "pdf-to-json");
        addEndpointToGroup("Java", "json-to-pdf");
+        addEndpointToGroup("rar", "pdf-to-cbr");
        addEndpointToGroup("Java", "pdf-to-video");
        addEndpointToGroup("Java", "verify-pdf");
-        addEndpointToGroup("Java", "flatten");
-        addEndpointToGroup("Java", "unlock-pdf-forms");
-        addEndpointToGroup("Java", "validate-signature");
-        addEndpointToGroup("Java", "text-editor-pdf");
-        addEndpointToGroup("Java", "edit-table-of-contents");
-        addEndpointToGroup("Java", "pdf-to-epub");
-        addEndpointToGroup("Java", "eml-to-pdf");
-        addEndpointToGroup("Java", "handleData");
-        addEndpointToGroup("rar", "pdf-to-cbr");

        // Javascript
-        addEndpointToGroup("Javascript", "rearrange-pages");
+        addEndpointToGroup("Javascript", "pdf-organizer");
        addEndpointToGroup("Javascript", "sign");
        addEndpointToGroup("Javascript", "compare");
        addEndpointToGroup("Javascript", "adjust-contrast");
-        addEndpointToGroup("Javascript", "text-editor-pdf");

        /* qpdf */
        addEndpointToGroup("qpdf", "repair");
@@ -522,7 +498,6 @@ public class EndpointConfiguration {
        addEndpointToGroup("Ghostscript", "compress-pdf");
        addEndpointToGroup("Ghostscript", "crop");
        addEndpointToGroup("Ghostscript", "replace-invert-pdf");
-        addEndpointToGroup("Ghostscript", "scanner-effect");
        addEndpointToGroup("Ghostscript", "pdf-to-vector");
        addEndpointToGroup("Ghostscript", "vector-to-pdf");

@@ -541,8 +516,6 @@ public class EndpointConfiguration {
        addEndpointAlternative("compress-pdf", "qpdf");
        addEndpointAlternative("compress-pdf", "Ghostscript");
        addEndpointAlternative("compress-pdf", "Java");
-        addEndpointAlternative("crop", "Ghostscript");
-        addEndpointAlternative("crop", "Java");
        addEndpointAlternative("ocr-pdf", "tesseract");
        addEndpointAlternative("ocr-pdf", "OCRmyPDF");

@@ -571,9 +544,6 @@ public class EndpointConfiguration {
        // Pdftohtml dependent endpoints
        addEndpointToGroup("Pdftohtml", "pdf-to-html");
        addEndpointToGroup("Pdftohtml", "pdf-to-markdown");
-
-        // Calibre dependent endpoints
-        addEndpointToGroup("Calibre", "pdf-to-epub");
    }

    private void processEnvironmentConfigs() {
@@ -606,12 +576,6 @@ public class EndpointConfiguration {
        return endpointGroups.getOrDefault(group, new HashSet<>());
    }

-    public Set<String> getAllEndpoints() {
-        return endpointGroups.values().stream()
-                .flatMap(Set::stream)
-                .collect(java.util.stream.Collectors.toSet());
-    }
-
    private boolean isToolGroup(String group) {
        return "qpdf".equals(group)
                || "OCRmyPDF".equals(group)
@@ -1,6 +1,8 @@
 package stirling.software.common.configuration;

 import java.io.File;
+import java.nio.file.Paths;
+import java.util.Locale;

 import lombok.extern.slf4j.Slf4j;

@@ -59,6 +61,28 @@ public class InstallationPathConfig {
    }

    private static String initializeBasePath() {
+        if (Boolean.parseBoolean(System.getProperty("STIRLING_PDF_DESKTOP_UI", "false"))) {
+            String os = System.getProperty("os.name").toLowerCase(Locale.ROOT);
+            if (os.contains("win")) {
+                return Paths.get(
+                                System.getenv("APPDATA"), // parent path
+                                "Stirling-PDF")
+                        + File.separator;
+            } else if (os.contains("mac")) {
+                return Paths.get(
+                                System.getProperty("user.home"),
+                                "Library",
+                                "Application Support",
+                                "Stirling-PDF")
+                        + File.separator;
+            } else {
+                return Paths.get(
+                                System.getProperty("user.home"), // parent path
+                                ".config",
+                                "Stirling-PDF")
+                        + File.separator;
+            }
+        }
        return "." + File.separator;
    }

@@ -1,14 +1,10 @@
 package stirling.software.common.configuration;

 import java.nio.file.Files;
-import java.nio.file.InvalidPathException;
 import java.nio.file.Path;
-import java.nio.file.Paths;
 import java.util.ArrayList;
 import java.util.Collections;
-import java.util.LinkedHashSet;
 import java.util.List;
-import java.util.Set;

 import org.apache.commons.lang3.StringUtils;
 import org.springframework.context.annotation.Configuration;
@@ -45,7 +41,6 @@ public class RuntimePathConfig {

    // Pipeline paths
    private final String pipelineWatchedFoldersPath;
-    private final List<String> pipelineWatchedFoldersPaths;
    private final String pipelineFinishedFoldersPath;
    private final String pipelineDefaultWebUiConfigs;
    private final String pipelinePath;
@@ -54,27 +49,20 @@ public class RuntimePathConfig {
        this.properties = properties;
        this.basePath = InstallationPathConfig.getPath();

+        this.pipelinePath = Path.of(basePath, "pipeline").toString();
+        String defaultWatchedFolders = Path.of(this.pipelinePath, "watchedFolders").toString();
+        String defaultFinishedFolders = Path.of(this.pipelinePath, "finishedFolders").toString();
+        String defaultWebUIConfigs = Path.of(this.pipelinePath, "defaultWebUIConfigs").toString();
+
        System system = properties.getSystem();
        CustomPaths customPaths = system.getCustomPaths();

        Pipeline pipeline = customPaths.getPipeline();

-        this.pipelinePath =
+        this.pipelineWatchedFoldersPath =
                resolvePath(
-                        Path.of(basePath, "pipeline").toString(),
-                        pipeline != null ? pipeline.getPipelineDir() : null);
-        String defaultWatchedFolders = Path.of(this.pipelinePath, "watchedFolders").toString();
-        String defaultFinishedFolders = Path.of(this.pipelinePath, "finishedFolders").toString();
-        String defaultWebUIConfigs = Path.of(this.pipelinePath, "defaultWebUIConfigs").toString();
-
-        List<String> watchedFoldersDirs =
-                sanitizePathList(pipeline != null ? pipeline.getWatchedFoldersDirs() : null);
-        this.pipelineWatchedFoldersPaths =
-                resolveWatchedFolderPaths(
                        defaultWatchedFolders,
-                        watchedFoldersDirs,
                        pipeline != null ? pipeline.getWatchedFoldersDir() : null);
-        this.pipelineWatchedFoldersPath = this.pipelineWatchedFoldersPaths.get(0);
        this.pipelineFinishedFoldersPath =
                resolvePath(
                        defaultFinishedFolders,
@@ -84,16 +72,13 @@ public class RuntimePathConfig {
                        defaultWebUIConfigs,
                        pipeline != null ? pipeline.getWebUIConfigsDir() : null);

-        // Validate path conflicts after all paths are resolved
-        validatePipelinePaths();
-
        boolean isDocker = isRunningInDocker();

        // Initialize Operation paths
        String defaultWeasyPrintPath = isDocker ? "/opt/venv/bin/weasyprint" : "weasyprint";
-        String defaultUnoConvertPath = isDocker ? "/usr/local/bin/unoconvert" : "unoconvert";
+        String defaultUnoConvertPath = isDocker ? "/opt/venv/bin/unoconvert" : "unoconvert";
        String defaultCalibrePath = isDocker ? "/opt/calibre/ebook-convert" : "ebook-convert";
-        String defaultOcrMyPdfPath = isDocker ? "/opt/venv/bin/ocrmypdf" : "ocrmypdf";
+        String defaultOcrMyPdfPath = isDocker ? "/usr/bin/ocrmypdf" : "ocrmypdf";
        String defaultSOfficePath = isDocker ? "/usr/bin/soffice" : "soffice";

        Operations operations = customPaths.getOperations();
@@ -144,140 +129,6 @@ public class RuntimePathConfig {
        return StringUtils.isNotBlank(customPath) ? customPath : defaultPath;
    }

-    private List<String> resolveWatchedFolderPaths(
-            String defaultPath, List<String> watchedFoldersDirs, String legacyWatchedFolder) {
-        List<String> rawPaths = new ArrayList<>();
-
-        // Collect paths from new config
-        if (watchedFoldersDirs != null && !watchedFoldersDirs.isEmpty()) {
-            rawPaths.addAll(watchedFoldersDirs);
-        }
-        // Fall back to legacy config
-        else if (StringUtils.isNotBlank(legacyWatchedFolder)) {
-            rawPaths.add(legacyWatchedFolder);
-        }
-        // Fall back to default
-        else {
-            rawPaths.add(defaultPath);
-        }
-
-        // Validate, normalize, and deduplicate paths
-        List<String> validatedPaths = validateAndNormalizePaths(rawPaths);
-
-        // Ensure we have at least one valid path (critical for system to function)
-        if (validatedPaths.isEmpty()) {
-            log.warn(
-                    "No valid watched folder paths configured, falling back to default: {}",
-                    defaultPath);
-            validatedPaths.add(defaultPath);
-        }
-
-        // Detect overlapping paths (warning only, not blocking)
-        detectOverlappingPaths(validatedPaths);
-
-        return validatedPaths;
-    }
-
-    private List<String> sanitizePathList(List<String> paths) {
-        if (paths == null || paths.isEmpty()) {
-            return Collections.emptyList();
-        }
-        List<String> sanitized = new ArrayList<>();
-        for (String path : paths) {
-            if (StringUtils.isNotBlank(path)) {
-                sanitized.add(path.trim());
-            }
-        }
-        return sanitized;
-    }
-
-    private List<String> validateAndNormalizePaths(List<String> paths) {
-        Set<String> normalizedPaths = new LinkedHashSet<>(); // Preserves order, prevents duplicates
-
-        for (String pathStr : paths) {
-            if (StringUtils.isBlank(pathStr)) {
-                continue;
-            }
-
-            try {
-                // Normalize to absolute path
-                Path path = Paths.get(pathStr.trim()).toAbsolutePath().normalize();
-                String normalizedPath = path.toString();
-
-                // Check for duplicates
-                if (normalizedPaths.contains(normalizedPath)) {
-                    log.debug("Skipping duplicate watched folder path: {}", pathStr);
-                    continue;
-                }
-
-                normalizedPaths.add(normalizedPath);
-                log.info("Registered watched folder path: {}", normalizedPath);
-
-            } catch (InvalidPathException e) {
-                log.error(
-                        "Invalid watched folder path '{}' - skipping: {}", pathStr, e.getMessage());
-            }
-        }
-
-        return new ArrayList<>(normalizedPaths);
-    }
-
-    private void detectOverlappingPaths(List<String> paths) {
-        for (int i = 0; i < paths.size(); i++) {
-            Path path1 = Paths.get(paths.get(i));
-            for (int j = i + 1; j < paths.size(); j++) {
-                Path path2 = Paths.get(paths.get(j));
-
-                // Check if one path is a parent of the other
-                if (path1.startsWith(path2)) {
-                    log.warn(
-                            "Watched folder path '{}' is nested inside '{}' - this may cause duplicate processing",
-                            path1,
-                            path2);
-                } else if (path2.startsWith(path1)) {
-                    log.warn(
-                            "Watched folder path '{}' is nested inside '{}' - this may cause duplicate processing",
-                            path2,
-                            path1);
-                }
-            }
-        }
-    }
-
-    private void validatePipelinePaths() {
-        try {
-            Path finishedPath = Paths.get(pipelineFinishedFoldersPath).toAbsolutePath().normalize();
-
-            for (String watchedPathStr : pipelineWatchedFoldersPaths) {
-                Path watchedPath = Paths.get(watchedPathStr).toAbsolutePath().normalize();
-
-                // Check if watched folder is same as finished folder
-                if (watchedPath.equals(finishedPath)) {
-                    log.error(
-                            "CRITICAL: Watched folder '{}' is the same as finished folder '{}' - this will cause processing loops!",
-                            watchedPath,
-                            finishedPath);
-                }
-                // Check if watched folder contains finished folder
-                else if (finishedPath.startsWith(watchedPath)) {
-                    log.warn(
-                            "Finished folder '{}' is nested inside watched folder '{}' - this may cause issues",
-                            finishedPath,
-                            watchedPath);
-                }
-                // Check if finished folder contains watched folder
-                else if (watchedPath.startsWith(finishedPath)) {
-                    log.error(
-                            "CRITICAL: Watched folder '{}' is nested inside finished folder '{}' - this will cause processing loops!",
-                            watchedPath,
-                            finishedPath);
-                }
-            }
-        } catch (Exception e) {
-            log.error("Error validating pipeline paths: {}", e.getMessage());
-        }
-    }
-
    private boolean isRunningInDocker() {
        return Files.exists(Path.of("/.dockerenv"));
    }
@@ -1,23 +0,0 @@
-package stirling.software.common.configuration;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.scheduling.TaskScheduler;
-import org.springframework.scheduling.concurrent.SimpleAsyncTaskScheduler;
-
-/**
- * Configures the scheduler used by all {@code @Scheduled} methods. Uses virtual threads so that
- * long-running scheduled tasks (e.g. cleanup, license checks, file monitoring) never block each
- * other — each runs on its own lightweight virtual thread.
- */
-@Configuration
-public class SchedulingConfig {
-
-    @Bean
-    public TaskScheduler taskScheduler() {
-        SimpleAsyncTaskScheduler scheduler = new SimpleAsyncTaskScheduler();
-        scheduler.setVirtualThreads(true);
-        scheduler.setThreadNamePrefix("scheduled-vt-");
-        return scheduler;
-    }
-}
@@ -1,49 +0,0 @@
-package stirling.software.common.constants;
-
-/**
- * Centralized constants for JWT token management.
- *
- * <p>These defaults are used when configuration values are not explicitly set.
- */
-public final class JwtConstants {
-
-    private JwtConstants() {
-        throw new UnsupportedOperationException("Utility class");
-    }
-
-    /** Default JWT access token lifetime in minutes (24 hours). */
-    public static final int DEFAULT_TOKEN_EXPIRY_MINUTES = 1440;
-
-    /** Default desktop client token lifetime in minutes (30 days). */
-    public static final int DEFAULT_DESKTOP_TOKEN_EXPIRY_MINUTES = 43200;
-
-    /**
-     * Default refresh grace period in minutes.
-     *
-     * <p>Allows refresh of expired tokens within this window after expiration.
-     */
-    public static final int DEFAULT_REFRESH_GRACE_MINUTES = 15;
-
-    /**
-     * Default allowed clock skew in seconds.
-     *
-     * <p>Tolerates small time drift between client and server clocks during validation.
-     */
-    public static final int DEFAULT_CLOCK_SKEW_SECONDS = 60;
-
-    /** Milliseconds per minute. */
-    public static final long MILLIS_PER_MINUTE = 60_000L;
-
-    /** Seconds per minute. */
-    public static final long SECONDS_PER_MINUTE = 60L;
-
-    /** JWT issuer identifier. */
-    public static final String ISSUER = "https://stirling.com";
-
-    /**
-     * Maximum refresh attempts allowed within the grace period window.
-     *
-     * <p>Prevents abuse of expired tokens by limiting refresh attempts.
-     */
-    public static final int MAX_REFRESH_ATTEMPTS_IN_GRACE = 3;
-}
@@ -29,8 +29,6 @@ import org.springframework.stereotype.Component;
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonProperty;

-import jakarta.annotation.PostConstruct;
-
 import lombok.Data;
 import lombok.Getter;
 import lombok.Setter;
@@ -39,7 +37,6 @@ import lombok.extern.slf4j.Slf4j;

 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.configuration.YamlPropertySourceFactory;
-import stirling.software.common.constants.JwtConstants;
 import stirling.software.common.model.exception.UnsupportedProviderException;
 import stirling.software.common.model.oauth2.GitHubProvider;
 import stirling.software.common.model.oauth2.GoogleProvider;
@@ -101,52 +98,6 @@ public class ApplicationProperties {
        return propertySource;
    }

-    /**
-     * Initialize fileUploadLimit from environment variables if not set in settings.yml. Supports
-     * SYSTEMFILEUPLOADLIMIT (format: "100MB") and SYSTEM_MAXFILESIZE (format: "100" in MB).
-     */
-    @PostConstruct
-    public void initializeFileUploadLimitFromEnv() {
-        // Only override if fileUploadLimit is not already set in settings.yml
-        if (system.getFileUploadLimit() == null || system.getFileUploadLimit().isEmpty()) {
-            String fileUploadLimit = null;
-
-            // Check SYSTEMFILEUPLOADLIMIT first (format: "100MB", "1GB", etc.)
-            String systemFileUploadLimit = java.lang.System.getenv("SYSTEMFILEUPLOADLIMIT");
-            if (systemFileUploadLimit != null && !systemFileUploadLimit.trim().isEmpty()) {
-                fileUploadLimit = systemFileUploadLimit.trim();
-                log.info("Setting fileUploadLimit from SYSTEMFILEUPLOADLIMIT: {}", fileUploadLimit);
-            } else {
-                // Check SYSTEM_MAXFILESIZE (format: number in MB, e.g., "100")
-                String systemMaxFileSize = java.lang.System.getenv("SYSTEM_MAXFILESIZE");
-                if (systemMaxFileSize != null && !systemMaxFileSize.trim().isEmpty()) {
-                    try {
-                        // Validate it's a number
-                        long sizeInMB = Long.parseLong(systemMaxFileSize.trim());
-                        if (sizeInMB > 0 && sizeInMB <= 999) {
-                            fileUploadLimit = sizeInMB + "MB";
-                            log.info(
-                                    "Setting fileUploadLimit from SYSTEM_MAXFILESIZE: {}MB",
-                                    sizeInMB);
-                        } else {
-                            log.warn(
-                                    "SYSTEM_MAXFILESIZE value {} is out of valid range (1-999), ignoring",
-                                    sizeInMB);
-                        }
-                    } catch (NumberFormatException e) {
-                        log.warn(
-                                "SYSTEM_MAXFILESIZE value '{}' is not a valid number, ignoring",
-                                systemMaxFileSize);
-                    }
-                }
-            }
-
-            if (fileUploadLimit != null) {
-                system.setFileUploadLimit(fileUploadLimit);
-            }
-        }
-    }
-
    @Data
    public static class AutoPipeline {
        private String outputFolder;
@@ -213,7 +164,6 @@ public class ApplicationProperties {
        private String customGlobalAPIKey;
        private Jwt jwt = new Jwt();
        private Validation validation = new Validation();
-        private String xFrameOptions = "DENY";

        public Boolean isAltLogin() {
            return saml2.getEnabled() || oauth2.getEnabled();
@@ -394,107 +344,12 @@ public class ApplicationProperties {
            }
        }

-        /**
-         * JWT token configuration.
-         *
-         * <p><b>BREAKING CHANGE (v2.0):</b> Default token expiry increased from 12 hours (720
-         * minutes) to 24 hours (1440 minutes). If you require the previous behavior, explicitly set
-         * {@code tokenExpiryMinutes: 720} in your configuration.
-         */
        @Data
        public static class Jwt {
            private boolean enableKeystore = true;
            private boolean enableKeyRotation = false;
            private boolean enableKeyCleanup = true;
-
-            /**
-             * JWT access token lifetime in minutes for web clients.
-             *
-             * <p>Default: {@value JwtConstants#DEFAULT_TOKEN_EXPIRY_MINUTES} minutes (24 hours).
-             *
-             * <p><b>BREAKING CHANGE:</b> Previously hardcoded to 720 minutes (12 hours). Now
-             * defaults to 1440 minutes (24 hours).
-             */
-            private int tokenExpiryMinutes = JwtConstants.DEFAULT_TOKEN_EXPIRY_MINUTES;
-
-            /**
-             * JWT access token lifetime in minutes for desktop clients (Tauri app).
-             *
-             * <p>Desktop clients are automatically detected via User-Agent header and receive
-             * longer-lived tokens because they run on personal devices with OS-level encrypted
-             * storage (macOS Keychain, Windows Credential Manager, Linux Secret Service).
-             *
-             * <p>This provides better UX (login once per month) while maintaining security through
-             * device encryption and secure storage, matching the behavior of popular desktop apps
-             * like Slack, Discord, VS Code, etc.
-             *
-             * <p>Default: 43200 minutes (30 days).
-             */
-            private int desktopTokenExpiryMinutes = 43200;
-
-            /**
-             * Allowed clock skew in seconds for JWT validation.
-             *
-             * <p>Tolerates small time drift between client and server clocks. Tokens that are
-             * slightly expired or slightly in the future (within this window) will still be
-             * accepted.
-             *
-             * <p>Default: {@value JwtConstants#DEFAULT_CLOCK_SKEW_SECONDS} seconds.
-             */
-            private int allowedClockSkewSeconds = JwtConstants.DEFAULT_CLOCK_SKEW_SECONDS;
-
-            /**
-             * Grace period in minutes for refreshing expired tokens.
-             *
-             * <p>Allows token refresh using an expired access token if the token expired within
-             * this many minutes. This provides better UX by allowing users to refresh slightly
-             * expired tokens without re-authentication.
-             *
-             * <p>Rate limiting is applied to prevent abuse of expired tokens within the grace
-             * window (max {@value JwtConstants#MAX_REFRESH_ATTEMPTS_IN_GRACE} attempts).
-             *
-             * <p>Default: {@value JwtConstants#DEFAULT_REFRESH_GRACE_MINUTES} minutes.
-             */
-            private int refreshGraceMinutes = JwtConstants.DEFAULT_REFRESH_GRACE_MINUTES;
-
-            /**
-             * Calculate number of days to retain old JWT signing keys.
-             *
-             * <p>Automatically calculated based on the longest token lifetime plus a proportional
-             * safety buffer. Keys must be retained for at least as long as the tokens they signed
-             * remain valid, otherwise token verification will fail.
-             *
-             * <p>Formula: ceil((maxTokenExpiry + 10% buffer + refreshGrace + clockSkew) / 1440)
-             *
-             * <p>The buffer includes:
-             *
-             * <ul>
-             *   <li>10% of token lifetime (scales with token duration)
-             *   <li>Token refresh grace period ({@link #refreshGraceMinutes})
-             *   <li>Clock skew tolerance ({@link #allowedClockSkewSeconds} converted to minutes)
-             * </ul>
-             *
-             * @return calculated key retention period in days
-             */
-            public int getKeyRetentionDays() {
-                final int MINUTES_PER_DAY = 1440;
-                final double BUFFER_PERCENTAGE = 0.10; // 10% buffer
-
-                int maxTokenExpiryMinutes = Math.max(tokenExpiryMinutes, desktopTokenExpiryMinutes);
-
-                // Add 10% buffer (scales with token lifetime)
-                int bufferMinutes = (int) Math.ceil(maxTokenExpiryMinutes * BUFFER_PERCENTAGE);
-
-                // Add refresh grace period
-                bufferMinutes += refreshGraceMinutes;
-
-                // Add clock skew (convert seconds to minutes, round up)
-                bufferMinutes += (int) Math.ceil(allowedClockSkewSeconds / 60.0);
-
-                // Total retention in minutes, convert to days (round up)
-                int totalMinutes = maxTokenExpiryMinutes + bufferMinutes;
-                return (int) Math.ceil(totalMinutes / (double) MINUTES_PER_DAY);
-            }
+            private int keyRetentionDays = 7;
        }

        @Data
@@ -603,9 +458,7 @@ public class ApplicationProperties {

        @Data
        public static class Pipeline {
-            private String pipelineDir;
            private String watchedFoldersDir;
-            private List<String> watchedFoldersDirs = new ArrayList<>();
            private String finishedFoldersDir;
            private String webUIConfigsDir;
        }
@@ -712,8 +565,6 @@ public class ApplicationProperties {
        private String appNameNavbar;
        private List<String> languages;
        private String logoStyle = "classic"; // Options: "classic" (default) or "modern"
-        private boolean defaultHideUnavailableTools = false;
-        private boolean defaultHideUnavailableConversions = false;

        public String getAppNameNavbar() {
            return appNameNavbar != null && !appNameNavbar.trim().isEmpty() ? appNameNavbar : null;
@@ -1,98 +0,0 @@
-package stirling.software.common.model;
-
-import java.util.List;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-
-import io.swagger.v3.oas.annotations.media.Schema;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-/** Form field information with coordinates for interactive form viewer. */
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-@JsonInclude(JsonInclude.Include.NON_NULL)
-@Schema(description = "Form field with coordinates and metadata")
-public class FormFieldWithCoordinates {
-
-    @Schema(description = "Fully qualified field name", example = "form1.firstName")
-    private String name;
-
-    @Schema(description = "Display label for the field", example = "First Name")
-    private String label;
-
-    @Schema(description = "Field type: text, checkbox, radio, combobox, listbox, button, signature")
-    private String type;
-
-    @Schema(description = "Current field value")
-    private String value;
-
-    @Schema(
-            description =
-                    "Available options (export values) for choice fields"
-                            + " (dropdown, radio, listbox)")
-    private List<String> options;
-
-    @Schema(
-            description =
-                    "Human-readable display labels for choice field options,"
-                            + " parallel to the 'options' list. Null when identical to options.")
-    private List<String> displayOptions;
-
-    @Schema(description = "Whether the field is required")
-    private boolean required;
-
-    @Schema(description = "Whether the field is read-only")
-    private boolean readOnly;
-
-    @Schema(description = "Whether this is a multi-select list box")
-    private boolean multiSelect;
-
-    @Schema(description = "Whether this is a multi-line text field")
-    private boolean multiline;
-
-    @Schema(description = "Tooltip/alternate name for the field")
-    private String tooltip;
-
-    @Schema(description = "Widget coordinates on each page (fields can have multiple widgets)")
-    private List<WidgetCoordinates> widgets;
-
-    /**
-     * Coordinates for a single widget annotation (visual representation of the field). A field can
-     * have multiple widgets if it appears on multiple pages.
-     */
-    @Data
-    @Builder
-    @NoArgsConstructor
-    @AllArgsConstructor
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    @Schema(description = "Widget coordinates in PDF space")
-    public static class WidgetCoordinates {
-
-        @Schema(description = "Page index (0-based)", example = "0")
-        private int pageIndex;
-
-        @Schema(description = "X coordinate in PDF points (lower-left origin)")
-        private float x;
-
-        @Schema(description = "Y coordinate in PDF points (lower-left origin)")
-        private float y;
-
-        @Schema(description = "Width in PDF points")
-        private float width;
-
-        @Schema(description = "Height in PDF points")
-        private float height;
-
-        @Schema(description = "Export value for this widget (radio/checkbox buttons only)")
-        private String exportValue;
-
-        @Schema(description = "Font size in PDF points")
-        private Float fontSize;
-    }
-}
@@ -35,7 +35,7 @@ public class JobExecutorService {
    private final HttpServletRequest request;
    private final ResourceMonitor resourceMonitor;
    private final JobQueue jobQueue;
-    private final ExecutorService executor = ExecutorFactory.newVirtualThreadExecutor();
+    private final ExecutorService executor = ExecutorFactory.newVirtualOrCachedThreadExecutor();
    private final long effectiveTimeoutMs;

    @Autowired(required = false)
@@ -254,13 +254,10 @@ public class JobExecutorService {
                return ResponseEntity.internalServerError()
                        .body(Map.of("error", "Job timed out after " + timeoutToUse + " ms"));
            } catch (RuntimeException e) {
-                // Check if this is a typed exception that should be handled by
-                // GlobalExceptionHandler (either directly or wrapped)
+                // Check if this is a wrapped typed exception that should be handled by
+                // GlobalExceptionHandler
                Throwable cause = e.getCause();
-                if (e instanceof IllegalArgumentException
-                        || cause
-                                instanceof
-                                stirling.software.common.util.ExceptionUtils.BaseAppException
+                if (cause instanceof stirling.software.common.util.ExceptionUtils.BaseAppException
                        || cause
                                instanceof
                                stirling.software.common.util.ExceptionUtils
@@ -44,10 +44,8 @@ public class JobQueue implements SmartLifecycle {

    private volatile BlockingQueue<QueuedJob> jobQueue;
    private final Map<String, QueuedJob> jobMap = new ConcurrentHashMap<>();
-    private final ScheduledExecutorService scheduler =
-            Executors.newSingleThreadScheduledExecutor(
-                    Thread.ofVirtual().name("job-queue-scheduler-", 0).factory());
-    private final ExecutorService jobExecutor = ExecutorFactory.newVirtualThreadExecutor();
+    private final ScheduledExecutorService scheduler = Executors.newSingleThreadScheduledExecutor();
+    private final ExecutorService jobExecutor = ExecutorFactory.newVirtualOrCachedThreadExecutor();
    private final Object queueLock = new Object(); // Lock for synchronizing queue operations

    private boolean shuttingDown = false;
@@ -1,29 +0,0 @@
-package stirling.software.common.service;
-
-/**
- * Interface for checking license status dynamically. Implementation provided by proprietary module
- * when available.
- */
-public interface LicenseServiceInterface {
-
-    /**
-     * Get the license type as a string.
-     *
-     * @return "NORMAL", "SERVER", or "ENTERPRISE"
-     */
-    String getLicenseTypeName();
-
-    /**
-     * Check if running Pro or higher (SERVER or ENTERPRISE license).
-     *
-     * @return true if SERVER or ENTERPRISE license is active
-     */
-    boolean isRunningProOrHigher();
-
-    /**
-     * Check if running Enterprise edition.
-     *
-     * @return true if ENTERPRISE license is active
-     */
-    boolean isRunningEE();
-}
@@ -9,7 +9,6 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
-import java.util.regex.Pattern;

 import org.springframework.scheduling.annotation.Scheduled;
 import org.springframework.stereotype.Service;
@@ -26,9 +25,6 @@ import lombok.extern.slf4j.Slf4j;
 public class MobileScannerService {

    private static final long SESSION_TIMEOUT_MS = 10 * 60 * 1000; // 10 minutes
-    private static final Pattern FILENAME_SANITIZE_PATTERN = Pattern.compile("[^a-zA-Z0-9._-]");
-    private static final Pattern SESSION_ID_VALIDATION_PATTERN = Pattern.compile("[a-zA-Z0-9-]+");
-    private static final Pattern FILE_EXTENSION_PATTERN = Pattern.compile("[.][^.]+$");
    private final Map<String, SessionData> activeSessions = new ConcurrentHashMap<>();
    private final Path tempDirectory;

@@ -125,8 +121,7 @@ public class MobileScannerService {
            // Handle duplicate filenames
            int counter = 1;
            while (Files.exists(filePath)) {
-                String nameWithoutExt =
-                        FILE_EXTENSION_PATTERN.matcher(safeFilename).replaceFirst("");
+                String nameWithoutExt = safeFilename.replaceFirst("[.][^.]+$", "");
                String ext =
                        safeFilename.contains(".")
                                ? safeFilename.substring(safeFilename.lastIndexOf("."))
@@ -276,14 +271,14 @@ public class MobileScannerService {
            throw new IllegalArgumentException("Session ID cannot be empty");
        }
        // Basic validation: alphanumeric and hyphens only
-        if (!SESSION_ID_VALIDATION_PATTERN.matcher(sessionId).matches()) {
+        if (!sessionId.matches("[a-zA-Z0-9-]+")) {
            throw new IllegalArgumentException("Invalid session ID format");
        }
    }

    private String sanitizeFilename(String filename) {
        // Remove path traversal attempts and dangerous characters
-        String sanitized = FILENAME_SANITIZE_PATTERN.matcher(filename).replaceAll("_");
+        String sanitized = filename.replaceAll("[^a-zA-Z0-9._-]", "_");
        // Ensure we have a non-empty, safe filename
        if (sanitized.isBlank()) {
            sanitized = "upload-" + System.currentTimeMillis();
@@ -169,10 +169,7 @@ public class PdfMetadataService {
                            .getAuthor();

            if (userService != null) {
-                String username = userService.getCurrentUsername();
-                if (username != null) {
-                    author = author.replace("username", username);
-                }
+                author = author.replace("username", userService.getCurrentUsername());
            }
        }
        pdf.getDocumentInformation().setAuthor(author);
@@ -43,9 +43,7 @@ public class ResourceMonitor {
    @Value("${stirling.resource.monitor.interval-ms:60000}")
    private long monitorIntervalMs = 60000; // 60 seconds

-    private final ScheduledExecutorService scheduler =
-            Executors.newSingleThreadScheduledExecutor(
-                    Thread.ofVirtual().name("resource-monitor-", 0).factory());
+    private final ScheduledExecutorService scheduler = Executors.newSingleThreadScheduledExecutor();
    private final MemoryMXBean memoryMXBean = ManagementFactory.getMemoryMXBean();
    private final OperatingSystemMXBean osMXBean = ManagementFactory.getOperatingSystemMXBean();

@@ -42,8 +42,7 @@ public class TaskManager {

    private final FileStorage fileStorage;
    private final ScheduledExecutorService cleanupExecutor =
-            Executors.newSingleThreadScheduledExecutor(
-                    Thread.ofVirtual().name("task-cleanup-", 0).factory());
+            Executors.newSingleThreadScheduledExecutor();

    /** Initialize the task manager and start the cleanup scheduler */
    public TaskManager(FileStorage fileStorage) {
@@ -2,28 +2,30 @@ package stirling.software.common.util;

 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
-import java.util.concurrent.ScheduledExecutorService;

-/**
- * Factory for creating executors backed by virtual threads (Java 21+). Virtual threads are
- * lightweight, managed by the JVM, and ideal for I/O-bound tasks. They eliminate the need for
- * thread pool sizing since thousands can run concurrently with minimal overhead.
- */
-public final class ExecutorFactory {
+import lombok.extern.slf4j.Slf4j;

-    private ExecutorFactory() {}
-
-    /** Creates an {@link ExecutorService} that starts a new virtual thread for each task. */
-    public static ExecutorService newVirtualThreadExecutor() {
-        return Executors.newVirtualThreadPerTaskExecutor();
-    }
+@Slf4j
+public class ExecutorFactory {

    /**
-     * Creates a {@link ScheduledExecutorService} backed by a single virtual thread. Useful for
-     * periodic/delayed tasks that should not pin a platform thread.
+     * Creates an ExecutorService using virtual threads if available (Java 21+), or falls back to a
+     * cached thread pool on older Java versions.
     */
-    public static ScheduledExecutorService newSingleVirtualThreadScheduledExecutor() {
-        return Executors.newSingleThreadScheduledExecutor(
-                Thread.ofVirtual().name("scheduled-vt-", 0).factory());
+    public static ExecutorService newVirtualOrCachedThreadExecutor() {
+        try {
+            ExecutorService executor =
+                    (ExecutorService)
+                            Executors.class
+                                    .getMethod("newVirtualThreadPerTaskExecutor")
+                                    .invoke(null);
+            return executor;
+        } catch (NoSuchMethodException e) {
+            log.debug("Virtual threads not available; falling back to cached thread pool.");
+        } catch (Exception e) {
+            log.debug("Error initializing virtual thread executor: {}", e.getMessage(), e);
+        }
+
+        return Executors.newCachedThreadPool();
    }
 }
@@ -29,7 +29,7 @@ public class FileMonitor {
    private final ConcurrentHashMap.KeySetView<Path, Boolean> readyForProcessingFiles;
    private final WatchService watchService;
    private final Predicate<Path> pathFilter;
-    private final List<Path> rootDirs;
+    private final Path rootDir;
    private Set<Path> stagingFiles;

    /**
@@ -47,39 +47,8 @@ public class FileMonitor {
        this.pathFilter = pathFilter;
        this.readyForProcessingFiles = ConcurrentHashMap.newKeySet();
        this.watchService = FileSystems.getDefault().newWatchService();
-
-        List<String> watchedFoldersDirs = runtimePathConfig.getPipelineWatchedFoldersPaths();
-        List<Path> validRootDirs = new ArrayList<>();
-
-        for (String pathStr : watchedFoldersDirs) {
-            try {
-                Path path = Path.of(pathStr);
-                validRootDirs.add(path);
-                log.info("Monitoring directory: {}", path);
-            } catch (Exception e) {
-                log.error(
-                        "Failed to initialize monitoring for path '{}': {}",
-                        pathStr,
-                        e.getMessage());
-            }
-        }
-
-        this.rootDirs = Collections.unmodifiableList(validRootDirs);
-
-        if (this.rootDirs.isEmpty()) {
-            log.error("No valid directories to monitor - FileMonitor will not function");
-        } else {
-            // Register directories eagerly so the first @Scheduled tick does not warn.
-            for (Path rootDir : this.rootDirs) {
-                if (Files.exists(rootDir)) {
-                    try {
-                        recursivelyRegisterEntry(rootDir);
-                    } catch (IOException e) {
-                        log.error("Failed to register monitoring for {}", rootDir, e);
-                    }
-                }
-            }
-        }
+        log.info("Monitoring directory: {}", runtimePathConfig.getPipelineWatchedFoldersPath());
+        this.rootDir = Path.of(runtimePathConfig.getPipelineWatchedFoldersPath());
    }

    private boolean shouldNotProcess(Path path) {
@@ -116,15 +85,13 @@ public class FileMonitor {
        readyForProcessingFiles.clear();

        if (path2KeyMapping.isEmpty()) {
-            log.warn("Not monitoring any directories; attempting to re-register root paths.");
-            for (Path rootDir : rootDirs) {
-                if (Files.exists(
-                        rootDir)) { // if the root directory exists, re-register the root directory
-                    try {
-                        recursivelyRegisterEntry(rootDir);
-                    } catch (IOException e) {
-                        log.error("unable to register monitoring for {}", rootDir, e);
-                    }
+            log.warn("not monitoring any directory, even the root directory itself: {}", rootDir);
+            if (Files.exists(
+                    rootDir)) { // if the root directory exists, re-register the root directory
+                try {
+                    recursivelyRegisterEntry(rootDir);
+                } catch (IOException e) {
+                    log.error("unable to register monitoring", e);
                }
            }
        }
@@ -100,13 +100,6 @@ public class FileToPdf {
                while (entry != null) {
                    Path filePath =
                            tempUnzippedDir.getPath().resolve(sanitizeZipFilename(entry.getName()));
-                    Path normalizedTargetDir =
-                            tempUnzippedDir.getPath().toAbsolutePath().normalize();
-                    Path normalizedFilePath = filePath.toAbsolutePath().normalize();
-                    if (!normalizedFilePath.startsWith(normalizedTargetDir)) {
-                        throw new IOException(
-                                "Zip entry path escapes target directory: " + entry.getName());
-                    }
                    if (!entry.isDirectory()) {
                        Files.createDirectories(filePath.getParent());
                        if (entry.getName().toLowerCase(Locale.ROOT).endsWith(".html")
@@ -337,6 +337,33 @@ public class GeneralUtils {
        }
    }

+    /**
+     * Checks whether a URL is safe for server-side fetches without making a network request.
+     *
+     * @param urlStr the URL to validate
+     * @return {@code true} if the URL uses http/https and resolves to a non-sensitive address
+     */
+    public boolean isUrlAllowedForServerFetch(String urlStr) {
+        if (urlStr == null || urlStr.isBlank()) {
+            return false;
+        }
+        try {
+            URL url = URI.create(urlStr).toURL();
+            String protocol = url.getProtocol();
+            if (!"http".equals(protocol) && !"https".equals(protocol)) {
+                return false;
+            }
+            String host = url.getHost();
+            if (host == null || host.isBlank()) {
+                return false;
+            }
+            return !isDisallowedNetworkLocation(host);
+        } catch (Exception e) {
+            log.debug("URL {} is not allowed for server fetch: {}", urlStr, e.getMessage());
+            return false;
+        }
+    }
+
    /**
     * Determines whether the specified host resolves to a disallowed network location, such as
     * local, private, multicast, or reserved ranges. Excessive DNS results are also blocked.
@@ -567,6 +594,7 @@ public class GeneralUtils {
                    default -> toBytes(value, 2); // Default to MB
                };
            }
+            return bytes;
        } catch (NumberFormatException e) {
            log.warn("Failed to parse size string '{}': {}", sizeStr, e.getMessage());
            return null;
@@ -613,6 +641,44 @@ public class GeneralUtils {
        return unit != null && VALID_SIZE_UNITS.contains(unit.toUpperCase(Locale.ROOT));
    }

+    private Long parseSizeToBytes(String sizeStr, String defaultUnit) {
+        if (sizeStr.endsWith("TB")) {
+            return convertDecimalToBytes(sizeStr.substring(0, sizeStr.length() - 2), 1024L * 1024L
+                    * 1024L * 1024L);
+        } else if (sizeStr.endsWith("GB")) {
+            return convertDecimalToBytes(
+                    sizeStr.substring(0, sizeStr.length() - 2), 1024L * 1024L * 1024L);
+        } else if (sizeStr.endsWith("MB")) {
+            return convertDecimalToBytes(sizeStr.substring(0, sizeStr.length() - 2), 1024L * 1024L);
+        } else if (sizeStr.endsWith("KB")) {
+            return convertDecimalToBytes(sizeStr.substring(0, sizeStr.length() - 2), 1024L);
+        } else if (!sizeStr.isEmpty() && sizeStr.charAt(sizeStr.length() - 1) == 'B') {
+            return convertDecimalToBytes(sizeStr.substring(0, sizeStr.length() - 1), 1L);
+        }
+        // Use provided default unit or fall back to MB
+        String unit = defaultUnit != null ? defaultUnit.toUpperCase(Locale.ROOT) : "MB";
+        return switch (unit) {
+            case "TB" -> convertDecimalToBytes(sizeStr, 1024L * 1024L * 1024L * 1024L);
+            case "GB" -> convertDecimalToBytes(sizeStr, 1024L * 1024L * 1024L);
+            case "MB" -> convertDecimalToBytes(sizeStr, 1024L * 1024L);
+            case "KB" -> convertDecimalToBytes(sizeStr, 1024L);
+            case "B" -> convertDecimalToBytes(sizeStr, 1L);
+            default -> convertDecimalToBytes(sizeStr, 1024L * 1024L); // Default to MB
+        };
+    }
+
+    private Long convertDecimalToBytes(String value, long multiplier) {
+        BigDecimal parsed = new BigDecimal(value);
+        if (parsed.signum() < 0) {
+            return null;
+        }
+        BigDecimal bytes = parsed.multiply(BigDecimal.valueOf(multiplier));
+        if (bytes.compareTo(BigDecimal.valueOf(Long.MAX_VALUE)) > 0) {
+            return null;
+        }
+        return bytes.setScale(0, RoundingMode.DOWN).longValue();
+    }
+
    /* Enhanced byte formatting with TB/PB support and better precision. */
    public String formatBytes(long bytes) {
        if (bytes < 0) {
@@ -649,10 +715,8 @@ public class GeneralUtils {
    }

    public List<Integer> parsePageList(String[] pages, int totalPages, boolean oneBased) {
-        // Use LinkedHashSet to prevent duplicates from inflating size and triggering maxSize guard
-        Set<Integer> result = new LinkedHashSet<>();
+        List<Integer> result = new ArrayList<>();
        int offset = oneBased ? 1 : 0;
-        int maxSize = Math.max(1000, totalPages * 3);
        for (String page : pages) {
            if ("all".equalsIgnoreCase(page)) {

@@ -668,12 +732,8 @@ public class GeneralUtils {
            } else {
                result.addAll(handlePart(page, totalPages, offset));
            }
-            if (result.size() > maxSize) {
-                throw new IllegalArgumentException(
-                        "Page list exceeds maximum allowed size of " + maxSize);
-            }
        }
-        return new ArrayList<>(result);
+        return result;
    }

    /*
@@ -107,65 +107,56 @@ public class PDFToFile {
            File[] outputFiles =
                    Objects.requireNonNull(tempOutputDir.getPath().toFile().listFiles());
            List<File> markdownFiles = new ArrayList<>();
-            List<File> imageFiles = new ArrayList<>();

-            // Convert HTML files to Markdown and collect image files
+            // Convert HTML files to Markdown
            for (File outputFile : outputFiles) {
                if (outputFile.getName().endsWith(".html")) {
                    String html = Files.readString(outputFile.toPath());
                    String markdown = htmlToMarkdownConverter.convert(html);

-                    // Update image references to point to images/ folder
-                    markdown = updateImageReferences(markdown);
-
                    String mdFileName = outputFile.getName().replace(".html", ".md");
                    File mdFile = new File(tempOutputDir.getPath().toFile(), mdFileName);
                    Files.writeString(mdFile.toPath(), markdown);
                    markdownFiles.add(mdFile);
-                } else if (!outputFile.getName().endsWith(".md")) {
-                    // Collect non-HTML, non-MD files as images/assets
-                    imageFiles.add(outputFile);
                }
            }

-            // Always create a ZIP file
-            fileName = pdfBaseName + "ToMarkdown.zip";
-            ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
+            // If there's only one markdown file, return it directly
+            if (markdownFiles.size() == 1) {
+                fileName = pdfBaseName + ".md";
+                fileBytes = Files.readAllBytes(markdownFiles.get(0).toPath());
+            } else {
+                // Multiple files - create a zip
+                fileName = pdfBaseName + "ToMarkdown.zip";
+                ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();

-            try (ZipOutputStream zipOutputStream = new ZipOutputStream(byteArrayOutputStream)) {
-                // Add markdown files to root of ZIP
-                for (File mdFile : markdownFiles) {
-                    ZipEntry mdEntry = new ZipEntry(mdFile.getName());
-                    zipOutputStream.putNextEntry(mdEntry);
-                    Files.copy(mdFile.toPath(), zipOutputStream);
-                    zipOutputStream.closeEntry();
+                try (ZipOutputStream zipOutputStream = new ZipOutputStream(byteArrayOutputStream)) {
+                    // Add markdown files
+                    for (File mdFile : markdownFiles) {
+                        ZipEntry mdEntry = new ZipEntry(mdFile.getName());
+                        zipOutputStream.putNextEntry(mdEntry);
+                        Files.copy(mdFile.toPath(), zipOutputStream);
+                        zipOutputStream.closeEntry();
+                    }
+
+                    // Add images and other assets
+                    for (File file : outputFiles) {
+                        if (!file.getName().endsWith(".html") && !file.getName().endsWith(".md")) {
+                            ZipEntry assetEntry = new ZipEntry(file.getName());
+                            zipOutputStream.putNextEntry(assetEntry);
+                            Files.copy(file.toPath(), zipOutputStream);
+                            zipOutputStream.closeEntry();
+                        }
+                    }
                }

-                // Add images and other assets to images/ folder
-                for (File imageFile : imageFiles) {
-                    ZipEntry assetEntry = new ZipEntry("images/" + imageFile.getName());
-                    zipOutputStream.putNextEntry(assetEntry);
-                    Files.copy(imageFile.toPath(), zipOutputStream);
-                    zipOutputStream.closeEntry();
-                }
+                fileBytes = byteArrayOutputStream.toByteArray();
            }
-
-            fileBytes = byteArrayOutputStream.toByteArray();
        }
        return WebResponseUtils.bytesToWebResponse(
                fileBytes, fileName, MediaType.APPLICATION_OCTET_STREAM);
    }

-    /**
-     * Updates image references in markdown to point to the images/ folder. Matches patterns like
-     * ![alt](filename.png) and converts to ![alt](images/filename.png)
-     */
-    private String updateImageReferences(String markdown) {
-        // Match markdown image syntax: ![alt text](image.png)
-        // Only update if the path doesn't already start with images/
-        return markdown.replaceAll("(!\\[.*?\\])\\((?!images/)([^/)][^)]*?)\\)", "$1(images/$2)");
-    }
-
    public ResponseEntity<byte[]> processPdfToHtml(MultipartFile inputFile)
            throws IOException, InterruptedException {
        if (!MediaType.APPLICATION_PDF_VALUE.equals(inputFile.getContentType())) {
@@ -574,39 +574,34 @@ public class PdfUtils {
            boolean everyPage)
            throws IOException {

-        try (PDDocument document = pdfDocumentFactory.load(pdfBytes)) {
-            // Get the first page of the PDF
-            int pages = document.getNumberOfPages();
-            for (int i = 0; i < pages; i++) {
-                PDPage page = document.getPage(i);
-                try (PDPageContentStream contentStream =
-                        new PDPageContentStream(
-                                document,
-                                page,
-                                PDPageContentStream.AppendMode.APPEND,
-                                true,
-                                true)) {
-                    // Create an image object from the image bytes
-                    PDImageXObject image =
-                            PDImageXObject.createFromByteArray(document, imageBytes, "");
-                    // Draw the image onto the page at the specified x and y coordinates
-                    contentStream.drawImage(image, x, y);
-                    log.info("Image successfully overlaid onto PDF");
-                    if (!everyPage && i == 0) {
-                        break;
-                    }
-                } catch (IOException e) {
-                    // Log an error message if there is an issue overlaying the image onto the PDF
-                    log.error("Error overlaying image onto PDF", e);
-                    throw e;
+        PDDocument document = pdfDocumentFactory.load(pdfBytes);
+
+        // Get the first page of the PDF
+        int pages = document.getNumberOfPages();
+        for (int i = 0; i < pages; i++) {
+            PDPage page = document.getPage(i);
+            try (PDPageContentStream contentStream =
+                    new PDPageContentStream(
+                            document, page, PDPageContentStream.AppendMode.APPEND, true, true)) {
+                // Create an image object from the image bytes
+                PDImageXObject image = PDImageXObject.createFromByteArray(document, imageBytes, "");
+                // Draw the image onto the page at the specified x and y coordinates
+                contentStream.drawImage(image, x, y);
+                log.info("Image successfully overlaid onto PDF");
+                if (!everyPage && i == 0) {
+                    break;
                }
+            } catch (IOException e) {
+                // Log an error message if there is an issue overlaying the image onto the PDF
+                log.error("Error overlaying image onto PDF", e);
+                throw e;
            }
-            // Create a ByteArrayOutputStream to save the PDF to
-            ByteArrayOutputStream baos = new ByteArrayOutputStream();
-            document.save(baos);
-            log.info("PDF successfully saved to byte array");
-            return baos.toByteArray();
        }
+        // Create a ByteArrayOutputStream to save the PDF to
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        document.save(baos);
+        log.info("PDF successfully saved to byte array");
+        return baos.toByteArray();
    }

    public boolean containsTextInFile(PDDocument pdfDocument, String text, String pagesToCheck)
@@ -226,54 +226,50 @@ public class ProcessExecutor {
            List<String> outputLines = new ArrayList<>();

            Thread errorReaderThread =
-                    Thread.ofVirtual()
-                            .unstarted(
-                                    () -> {
-                                        try (BufferedReader errorReader =
-                                                new BufferedReader(
-                                                        new InputStreamReader(
-                                                                process.getErrorStream(),
-                                                                StandardCharsets.UTF_8))) {
-                                            String line;
-                                            while ((line =
-                                                            BoundedLineReader.readLine(
-                                                                    errorReader, 5_000_000))
-                                                    != null) {
-                                                errorLines.add(line);
-                                                if (liveUpdates) log.info(line);
-                                            }
-                                        } catch (InterruptedIOException e) {
-                                            log.warn(
-                                                    "Error reader thread was interrupted due to timeout.");
-                                        } catch (IOException e) {
-                                            log.error("exception", e);
-                                        }
-                                    });
+                    new Thread(
+                            () -> {
+                                try (BufferedReader errorReader =
+                                        new BufferedReader(
+                                                new InputStreamReader(
+                                                        process.getErrorStream(),
+                                                        StandardCharsets.UTF_8))) {
+                                    String line;
+                                    while ((line =
+                                                    BoundedLineReader.readLine(
+                                                            errorReader, 5_000_000))
+                                            != null) {
+                                        errorLines.add(line);
+                                        if (liveUpdates) log.info(line);
+                                    }
+                                } catch (InterruptedIOException e) {
+                                    log.warn("Error reader thread was interrupted due to timeout.");
+                                } catch (IOException e) {
+                                    log.error("exception", e);
+                                }
+                            });

            Thread outputReaderThread =
-                    Thread.ofVirtual()
-                            .unstarted(
-                                    () -> {
-                                        try (BufferedReader outputReader =
-                                                new BufferedReader(
-                                                        new InputStreamReader(
-                                                                process.getInputStream(),
-                                                                StandardCharsets.UTF_8))) {
-                                            String line;
-                                            while ((line =
-                                                            BoundedLineReader.readLine(
-                                                                    outputReader, 5_000_000))
-                                                    != null) {
-                                                outputLines.add(line);
-                                                if (liveUpdates) log.info(line);
-                                            }
-                                        } catch (InterruptedIOException e) {
-                                            log.warn(
-                                                    "Error reader thread was interrupted due to timeout.");
-                                        } catch (IOException e) {
-                                            log.error("exception", e);
-                                        }
-                                    });
+                    new Thread(
+                            () -> {
+                                try (BufferedReader outputReader =
+                                        new BufferedReader(
+                                                new InputStreamReader(
+                                                        process.getInputStream(),
+                                                        StandardCharsets.UTF_8))) {
+                                    String line;
+                                    while ((line =
+                                                    BoundedLineReader.readLine(
+                                                            outputReader, 5_000_000))
+                                            != null) {
+                                        outputLines.add(line);
+                                        if (liveUpdates) log.info(line);
+                                    }
+                                } catch (InterruptedIOException e) {
+                                    log.warn("Error reader thread was interrupted due to timeout.");
+                                } catch (IOException e) {
+                                    log.error("exception", e);
+                                }
+                            });

            errorReaderThread.start();
            outputReaderThread.start();
@@ -374,7 +370,7 @@ public class ProcessExecutor {
            }
            // Match common unoconvert variants (but NOT soffice)
            String lowerBasename = basename.toLowerCase(java.util.Locale.ROOT);
-            if (lowerBasename.contains("unoconvert") || "unoconv".equals(lowerBasename)) {
+            if (lowerBasename.contains("unoconvert") || lowerBasename.equals("unoconv")) {
                return true;
            }
        }
@@ -47,7 +47,6 @@ public class SvgSanitizer {
    private static final Pattern DATA_SCRIPT_PATTERN =
            Pattern.compile(
                    "^\\s*data\\s*:[^,]*(?:script|javascript|vbscript)", Pattern.CASE_INSENSITIVE);
-    private static final Pattern NULL_BYTE_PATTERN = Pattern.compile("\u0000");
    private final SsrfProtectionService ssrfProtectionService;
    private final ApplicationProperties applicationProperties;

@@ -86,7 +85,7 @@ public class SvgSanitizer {
        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();

        factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
-        factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+
        factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
        factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
        factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
@@ -211,7 +210,7 @@ public class SvgSanitizer {

        String result = url.trim();

-        result = NULL_BYTE_PATTERN.matcher(result).replaceAll("");
+        result = result.replaceAll("\u0000", "");

        for (int i = 0; i < 3; i++) {
            try {
@@ -4,23 +4,18 @@ import java.beans.PropertyEditorSupport;
 import java.util.ArrayList;
 import java.util.List;

+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
 import lombok.extern.slf4j.Slf4j;

 import stirling.software.common.model.api.security.RedactionArea;

-import tools.jackson.core.type.TypeReference;
-import tools.jackson.databind.DeserializationFeature;
-import tools.jackson.databind.ObjectMapper;
-import tools.jackson.databind.json.JsonMapper;
-
@Slf4j
 public class StringToArrayListPropertyEditor extends PropertyEditorSupport {

-    private final ObjectMapper objectMapper =
-            JsonMapper.builder()
-                    .enable(DeserializationFeature.ACCEPT_SINGLE_VALUE_AS_ARRAY)
-                    .disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)
-                    .build();
+    private final ObjectMapper objectMapper = new ObjectMapper();

    @Override
    public void setAsText(String text) throws IllegalArgumentException {
@@ -29,6 +24,7 @@ public class StringToArrayListPropertyEditor extends PropertyEditorSupport {
            return;
        }
        try {
+            objectMapper.configure(DeserializationFeature.ACCEPT_SINGLE_VALUE_AS_ARRAY, true);
            TypeReference<ArrayList<RedactionArea>> typeRef = new TypeReference<>() {};
            List<RedactionArea> list = objectMapper.readValue(text, typeRef);
            setValue(list);
@@ -4,13 +4,12 @@ import java.beans.PropertyEditorSupport;
 import java.util.HashMap;
 import java.util.Map;

-import tools.jackson.core.type.TypeReference;
-import tools.jackson.databind.ObjectMapper;
-import tools.jackson.databind.json.JsonMapper;
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;

 public class StringToMapPropertyEditor extends PropertyEditorSupport {

-    private final ObjectMapper objectMapper = JsonMapper.builder().build();
+    private final ObjectMapper objectMapper = new ObjectMapper();

    @Override
    public void setAsText(String text) throws IllegalArgumentException {
@@ -12,12 +12,11 @@ class SpyPDFDocumentFactory extends CustomPDFDocumentFactory {
    public StrategyType lastStrategyUsed;

    public SpyPDFDocumentFactory(PdfMetadataService service) {
-        super(service); // TempFileManager falls back to Files.createTempFile in tests
+        super(service);
    }

    @Override
-    protected StreamCacheCreateFunction getStreamCacheFunction(
-            long contentSize, MemorySnapshot mem) {
+    public StreamCacheCreateFunction getStreamCacheFunction(long contentSize) {
        StrategyType type;
        if (contentSize < 10 * 1024 * 1024) {
            type = StrategyType.MEMORY_ONLY;
@@ -27,6 +26,6 @@ class SpyPDFDocumentFactory extends CustomPDFDocumentFactory {
            type = StrategyType.TEMP_FILE;
        }
        this.lastStrategyUsed = type;
-        return super.getStreamCacheFunction(contentSize, mem);
+        return super.getStreamCacheFunction(contentSize); // delegate to real behavior
    }
 }
@@ -9,7 +9,6 @@ import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.attribute.FileTime;
 import java.time.Instant;
-import java.util.List;
 import java.util.function.Predicate;

 import org.junit.jupiter.api.BeforeEach;
@@ -35,8 +34,7 @@ class FileMonitorTest {

    @BeforeEach
    void setUp() throws IOException {
-        when(runtimePathConfig.getPipelineWatchedFoldersPaths())
-                .thenReturn(List.of(tempDir.toString()));
+        when(runtimePathConfig.getPipelineWatchedFoldersPath()).thenReturn(tempDir.toString());

        // This mock is used in all tests except testPathFilter
        // We use lenient to avoid UnnecessaryStubbingException in that test
@@ -153,12 +153,11 @@ class PDFToFileTest {
                            MediaType.APPLICATION_PDF_VALUE,
                            "Fake PDF content".getBytes());

-            // Create a mock HTML output file with image references
+            // Create a mock HTML output file
            Path htmlOutputFile = tempDir.resolve("test.html");
            Files.write(
                    htmlOutputFile,
-                    "<html><body><h1>Test</h1><p>This is a test.</p><img src=\"image1.png\" /></body></html>"
-                            .getBytes());
+                    "<html><body><h1>Test</h1><p>This is a test.</p></body></html>".getBytes());

            // Setup ProcessExecutor mock
            mockedStaticProcessExecutor
@@ -175,61 +174,18 @@ class PDFToFileTest {
                                Files.copy(
                                        htmlOutputFile, Path.of(outputDir.getPath(), "test.html"));

-                                // Create a mock image file
-                                Files.write(
-                                        Path.of(outputDir.getPath(), "image1.png"),
-                                        "Fake image data".getBytes());
-
                                return mockExecutorResult;
                            });

            // Execute the method
            ResponseEntity<byte[]> response = pdfToFile.processPdfToMarkdown(pdfFile);

-            // Verify - should now return a ZIP file instead of plain markdown
+            // Verify
            assertEquals(HttpStatus.OK, response.getStatusCode());
            assertNotNull(response.getBody());
            assertTrue(response.getBody().length > 0);
-
-            // Verify content disposition indicates a ZIP file
            assertTrue(
-                    response.getHeaders()
-                            .getContentDisposition()
-                            .toString()
-                            .contains("ToMarkdown.zip"));
-
-            // Verify the content by unzipping it
-            try (ZipInputStream zipStream =
-                    ZipSecurity.createHardenedInputStream(
-                            new java.io.ByteArrayInputStream(response.getBody()))) {
-                ZipEntry entry;
-                boolean foundMdFile = false;
-                boolean foundImageInFolder = false;
-                String markdownContent = null;
-
-                while ((entry = zipStream.getNextEntry()) != null) {
-                    if (entry.getName().endsWith(".md")) {
-                        foundMdFile = true;
-                        // Read markdown content to verify image references
-                        markdownContent =
-                                new String(
-                                        zipStream.readAllBytes(),
-                                        java.nio.charset.StandardCharsets.UTF_8);
-                    } else if (entry.getName().startsWith("images/")
-                            && entry.getName().endsWith(".png")) {
-                        foundImageInFolder = true;
-                    }
-                    zipStream.closeEntry();
-                }
-
-                assertTrue(foundMdFile, "ZIP should contain Markdown file");
-                assertTrue(foundImageInFolder, "ZIP should contain image in images/ folder");
-                assertNotNull(markdownContent, "Markdown content should be present");
-                // Verify markdown references images with images/ prefix
-                assertTrue(
-                        markdownContent.contains("images/"),
-                        "Markdown should reference images with images/ prefix");
-            }
+                    response.getHeaders().getContentDisposition().toString().contains("test.md"));
        }
    }

@@ -300,15 +256,14 @@ class PDFToFileTest {
                while ((entry = zipStream.getNextEntry()) != null) {
                    if (entry.getName().endsWith(".md")) {
                        foundMdFiles = true;
-                    } else if (entry.getName().startsWith("images/")
-                            && entry.getName().endsWith(".png")) {
+                    } else if (entry.getName().endsWith(".png")) {
                        foundImage = true;
                    }
                    zipStream.closeEntry();
                }

                assertTrue(foundMdFiles, "ZIP should contain Markdown files");
-                assertTrue(foundImage, "ZIP should contain image files in images/ folder");
+                assertTrue(foundImage, "ZIP should contain image files");
            }
        }
    }
@@ -121,19 +121,17 @@ public class UnoServerPoolTest {

        // Try to acquire a third endpoint in separate thread (should block)
        Thread blockingThread =
-                Thread.ofVirtual()
-                        .unstarted(
-                                () -> {
-                                    try {
-                                        acquireLatch.countDown(); // Signal we're about to block
-                                        UnoServerPool.UnoServerLease lease3 =
-                                                pool.acquireEndpoint();
-                                        acquired.incrementAndGet();
-                                        lease3.close();
-                                    } catch (InterruptedException e) {
-                                        Thread.currentThread().interrupt();
-                                    }
-                                });
+                new Thread(
+                        () -> {
+                            try {
+                                acquireLatch.countDown(); // Signal we're about to block
+                                UnoServerPool.UnoServerLease lease3 = pool.acquireEndpoint();
+                                acquired.incrementAndGet();
+                                lease3.close();
+                            } catch (InterruptedException e) {
+                                Thread.currentThread().interrupt();
+                            }
+                        });

        blockingThread.start();
        acquireLatch.await(); // Wait for thread to start
@@ -143,21 +143,11 @@ class StringToArrayListPropertyEditorTest {
    }

    @Test
-    void testSetAsText_UnknownProperties() {
-        // Arrange - this JSON contains properties not in RedactionArea
-        // With FAIL_ON_UNKNOWN_PROPERTIES disabled, this should ignore the unknown properties
+    void testSetAsText_InvalidStructure() {
+        // Arrange - this JSON doesn't match RedactionArea structure
        String json = "[{\"invalid\":\"structure\"}]";

-        // Act
-        editor.setAsText(json);
-        Object value = editor.getValue();
-
-        // Assert
-        assertNotNull(value, "Value should not be null");
-        assertInstanceOf(List.class, value, "Value should be a List");
-
-        @SuppressWarnings("unchecked")
-        List<RedactionArea> list = (List<RedactionArea>) value;
-        assertEquals(1, list.size(), "List should have 1 entry (empty object)");
+        // Act & Assert
+        assertThrows(IllegalArgumentException.class, () -> editor.setAsText(json));
    }
 }
@@ -38,6 +38,13 @@ spotless {
 }

 dependencies {
+    if (System.getenv('STIRLING_PDF_DESKTOP_UI') != 'false'
+        || (project.hasProperty('STIRLING_PDF_DESKTOP_UI')
+        && project.getProperty('STIRLING_PDF_DESKTOP_UI') != 'false')) {
+        implementation 'org.openjfx:javafx-controls:21'
+        implementation 'org.openjfx:javafx-swing:21'
+    }
+
    if (System.getenv('DISABLE_ADDITIONAL_FEATURES') != 'true'
        || (project.hasProperty('DISABLE_ADDITIONAL_FEATURES')
        && System.getProperty('DISABLE_ADDITIONAL_FEATURES') != 'true')) {
@@ -46,23 +53,8 @@ dependencies {

    implementation project(':common')
    implementation 'org.springframework.boot:spring-boot-starter-jetty'
-    implementation 'org.eclipse.jetty.http2:jetty-http2-server'
-    implementation ('org.telegram:telegrambots:6.9.7.1') {
-        // Grizzly server + Jersey JAX-RS stack: only used for webhook mode;
-        // Stirling-PDF uses long-polling mode so these are dead weight (~3 MB)
-        exclude group: 'org.glassfish.jersey.inject'
-        exclude group: 'org.glassfish.jersey.media'
-        exclude group: 'org.glassfish.jersey.containers'
-        exclude group: 'org.glassfish.jersey.core'
-        exclude group: 'org.glassfish.jersey.ext'
-        exclude group: 'org.glassfish.grizzly'
-        exclude group: 'org.glassfish.hk2'
-        exclude group: 'org.glassfish.hk2.external'
-        exclude group: 'org.javassist', module: 'javassist'
-        // Old javax JAX-RS Jackson bindings (not needed, project uses jakarta)
-        exclude group: 'com.fasterxml.jackson.jaxrs'
-        exclude group: 'com.fasterxml.jackson.module', module: 'jackson-module-jaxb-annotations'
-    }
+    implementation 'com.posthog.java:posthog:1.2.0'
+    implementation 'org.telegram:telegrambots:6.9.7.1'
    implementation 'commons-io:commons-io:2.21.0'
    implementation "org.bouncycastle:bcprov-jdk18on:$bouncycastleVersion"
    implementation "org.bouncycastle:bcpkix-jdk18on:$bouncycastleVersion"
@@ -76,14 +68,11 @@ dependencies {
    implementation "org.apache.pdfbox:xmpbox:$pdfboxVersion"

    implementation 'org.verapdf:validation-model:1.28.2'
-    // CVE-2025-66453: Explicit rhino 1.7.15 to override verapdf's 1.7.13
-    implementation 'org.mozilla:rhino:1.9.1'

    // veraPDF still uses javax.xml.bind, not the new jakarta namespace
    implementation 'javax.xml.bind:jaxb-api:2.3.1'
    implementation 'com.sun.xml.bind:jaxb-impl:2.3.9'
    implementation 'com.sun.xml.bind:jaxb-core:2.3.0.1'
-    implementation 'org.apache.poi:poi-ooxml:5.5.1'

    // https://mvnrepository.com/artifact/technology.tabula/tabula
    implementation ('technology.tabula:tabula:1.0.5')  {
@@ -91,15 +80,11 @@ dependencies {
        exclude group: 'org.bouncycastle', module: 'bcprov-jdk15on'
        exclude group: 'com.google.code.gson', module: 'gson'
    }
-    // CVE-2022-25647: Explicit gson 2.8.9 to prevent unsafe deserialization (tabula would pull 2.8.7)
-    implementation 'com.google.code.gson:gson:2.13.2'
    implementation 'org.apache.pdfbox:jbig2-imageio:3.0.4'
    implementation 'com.opencsv:opencsv:5.12.0' // https://mvnrepository.com/artifact/com.opencsv/opencsv
-    implementation 'org.apache.poi:poi-ooxml:5.5.1'

-    // Batik only bridge module needed (transitively pulls anim, gvt, util, css, dom, svg-dom)
-    // Replaces batik-all which included unused codec, svggen, transcoder, script modules
-    implementation 'org.apache.xmlgraphics:batik-bridge:1.19'
+    // Batik
+    implementation 'org.apache.xmlgraphics:batik-all:1.19'

    // PDFBox Graphics2D bridge for Batik SVG to PDF conversion
    implementation 'de.rototor.pdfbox:graphics2d:3.0.5'
@@ -130,8 +115,19 @@ sourceSets {
        resources {
            srcDirs += ['../configs']
        }
+        java {
+            if (System.getenv('STIRLING_PDF_DESKTOP_UI') == 'false') {
+                exclude 'stirling/software/SPDF/UI/impl/**'
+            }
+
+        }
    }
    test {
+        java {
+            if (System.getenv('STIRLING_PDF_DESKTOP_UI') == 'false') {
+                exclude 'stirling/software/SPDF/UI/impl/**'
+            }
+        }
    }

 }
@@ -190,7 +186,6 @@ def generatedFrontendPaths = [
 ]

 tasks.register('npmInstall', Exec) {
-    doNotTrackState("node_modules contains symlinks that Gradle cannot snapshot on Windows/WSL")
    enabled = buildWithFrontend
    group = 'frontend'
    description = 'Install frontend dependencies'
@@ -237,7 +232,6 @@ tasks.register('npmInstall', Exec) {
 }

 tasks.register('npmBuild', Exec) {
-    doNotTrackState("Frontend build depends on untracked npmInstall task")
    enabled = buildWithFrontend
    group = 'frontend'
    description = 'Build frontend application'
@@ -245,7 +239,6 @@ tasks.register('npmBuild', Exec) {
    commandLine = Os.isFamily(Os.FAMILY_WINDOWS) ? ['cmd', '/c', 'npm', 'run', 'build'] : ['npm', 'run', 'build']
    dependsOn npmInstall
    inputs.dir(new File(frontendDir, 'src'))
-    inputs.dir(new File(frontendDir, 'public'))
    inputs.file(new File(frontendDir, 'package.json'))
    outputs.dir(frontendDistDir)

@@ -49,8 +49,8 @@ public class LibreOfficeListener {
        process = SystemCommand.runCommand(Runtime.getRuntime(), "unoconv --listener");
        lastActivityTime = System.currentTimeMillis();

-        // Start a virtual thread to monitor the activity timeout
-        executorService = Executors.newVirtualThreadPerTaskExecutor();
+        // Start a background thread to monitor the activity timeout
+        executorService = Executors.newSingleThreadExecutor();
        executorService.submit(
                () -> {
                    while (true) {
@@ -9,11 +9,10 @@ import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Properties;
-import java.util.regex.Pattern;

 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
-import org.springframework.boot.context.event.ApplicationReadyEvent;
+import org.springframework.boot.web.context.WebServerInitializedEvent;
 import org.springframework.context.event.EventListener;
 import org.springframework.core.env.Environment;
 import org.springframework.scheduling.annotation.EnableScheduling;
@@ -21,6 +20,7 @@ import org.springframework.scheduling.annotation.EnableScheduling;
 import io.github.pixee.security.SystemCommand;

 import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;

 import lombok.extern.slf4j.Slf4j;

@@ -28,6 +28,7 @@ import stirling.software.common.configuration.AppConfig;
 import stirling.software.common.configuration.ConfigInitializer;
 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.util.UrlUtils;

@Slf4j
@EnableScheduling
@@ -39,10 +40,6 @@ import stirling.software.common.model.ApplicationProperties;
        })
 public class SPDFApplication {

-    private static final Pattern PORT_SUFFIX_PATTERN = Pattern.compile(".+:\\d+$");
-    private static final Pattern URL_SCHEME_PATTERN =
-            Pattern.compile("^[a-zA-Z][a-zA-Z0-9+.-]*://.*");
-    private static final Pattern TRAILING_SLASH_PATTERN = Pattern.compile("/+$");
    private static String serverPortStatic;
    private static String baseUrlStatic;
    private static String contextPathStatic;
@@ -63,6 +60,19 @@ public class SPDFApplication {

        Properties props = new Properties();

+        if (Boolean.parseBoolean(System.getProperty("STIRLING_PDF_DESKTOP_UI", "false"))) {
+            System.setProperty("java.awt.headless", "false");
+            app.setHeadless(false);
+            props.put("java.awt.headless", "false");
+            props.put("spring.main.web-application-type", "servlet");
+
+            int desiredPort = 8080;
+            String port = UrlUtils.findAvailablePort(desiredPort);
+            props.put("server.port", port);
+            System.setProperty("server.port", port);
+            log.info("Desktop UI mode: Using port {}", port);
+        }
+
        app.setAdditionalProfiles(getActiveProfile(args));

        ConfigInitializer initializer = new ConfigInitializer();
@@ -143,6 +153,13 @@ public class SPDFApplication {
                    "Running in Tauri mode. Parent process PID: {}",
                    parentPid != null ? parentPid : "not set");
        }
+        // Desktop UI initialization removed - webBrowser dependency eliminated
+        // Keep backwards compatibility for STIRLING_PDF_DESKTOP_UI system property
+        if (Boolean.parseBoolean(System.getProperty("STIRLING_PDF_DESKTOP_UI", "false"))) {
+            log.info("Desktop UI mode enabled, but WebBrowser functionality has been removed");
+            // webBrowser.initWebUI(url); // Removed - desktop UI eliminated
+        }
+
        // Standard browser opening logic
        String browserOpenEnv = env.getProperty("BROWSER_OPEN");
        boolean browserOpen = browserOpenEnv != null && "true".equalsIgnoreCase(browserOpenEnv);
@@ -175,15 +192,20 @@ public class SPDFApplication {
        }
    }

+    @PreDestroy
+    public void cleanup() {
+        // webBrowser cleanup removed - desktop UI eliminated
+        // if (webBrowser != null) {
+        //     webBrowser.cleanup();
+        // }
+    }
+
    @EventListener
-    public void onApplicationReady(ApplicationReadyEvent event) {
-        String port =
-                event.getApplicationContext().getEnvironment().getProperty("local.server.port");
-        if (port != null) {
-            serverPortStatic = port;
-        }
+    public void onWebServerInitialized(WebServerInitializedEvent event) {
+        int actualPort = event.getWebServer().getPort();
+        serverPortStatic = String.valueOf(actualPort);
        // Log the actual runtime port for Tauri to parse
-        log.info("Stirling-PDF running on port: {}", serverPortStatic);
+        log.info("Stirling-PDF running on port: {}", actualPort);
    }

    private static void printStartupLogs() {
@@ -252,8 +274,8 @@ public class SPDFApplication {
        String trimmedBase =
                (backendUrl == null || backendUrl.isBlank())
                        ? "http://localhost"
-                        : TRAILING_SLASH_PATTERN.matcher(backendUrl.trim()).replaceAll("");
-        boolean hasScheme = URL_SCHEME_PATTERN.matcher(trimmedBase).matches();
+                        : backendUrl.trim().replaceAll("/+$", "");
+        boolean hasScheme = trimmedBase.matches("^[a-zA-Z][a-zA-Z0-9+.-]*://.*");
        String baseForParsing = hasScheme ? trimmedBase : "http://" + trimmedBase;
        Integer parsedPort = parsePort(port);

@@ -306,7 +328,7 @@ public class SPDFApplication {
        if (port == null) {
            return trimmedBase;
        }
-        if (PORT_SUFFIX_PATTERN.matcher(trimmedBase).matches()) {
+        if (trimmedBase.matches(".+:\\d+$")) {
            return trimmedBase;
        }
        return trimmedBase + ":" + port;
@@ -51,7 +51,9 @@ public class ExternalAppDepConfig {
     */
    private final Map<String, List<String>> commandToGroupMapping;

-    private final ExecutorService pool = Executors.newVirtualThreadPerTaskExecutor();
+    private final ExecutorService pool =
+            Executors.newFixedThreadPool(
+                    Math.max(2, Runtime.getRuntime().availableProcessors() / 2));

    public ExternalAppDepConfig(
            EndpointConfiguration endpointConfiguration, RuntimePathConfig runtimePathConfig) {
@@ -116,8 +118,7 @@ public class ExternalAppDepConfig {

            for (String group : affectedGroups) {
                List<String> affectedFeatures = getAffectedFeatures(group);
-                endpointConfiguration.disableGroup(
-                        group, EndpointConfiguration.DisableReason.DEPENDENCY);
+                endpointConfiguration.disableGroup(group);
                log.warn(
                        "Missing dependency: {} - Disabling group: {} (Affected features: {})",
                        command,
@@ -142,8 +143,7 @@ public class ExternalAppDepConfig {
                                    commandToGroupMapping.getOrDefault(
                                            command, List.of("Weasyprint"));
                            for (String group : affectedGroups) {
-                                endpointConfiguration.disableGroup(
-                                        group, EndpointConfiguration.DisableReason.DEPENDENCY);
+                                endpointConfiguration.disableGroup(group);
                            }
                            log.warn(
                                    "WeasyPrint version {} is below required {} - disabling"
@@ -172,8 +172,7 @@ public class ExternalAppDepConfig {
                            List<String> affectedGroups =
                                    commandToGroupMapping.getOrDefault(command, List.of("qpdf"));
                            for (String group : affectedGroups) {
-                                endpointConfiguration.disableGroup(
-                                        group, EndpointConfiguration.DisableReason.DEPENDENCY);
+                                endpointConfiguration.disableGroup(group);
                            }
                            log.warn(
                                    "qpdf version {} is below required {} - disabling group(s): {}",
@@ -227,8 +226,7 @@ public class ExternalAppDepConfig {
        int ec = runAndWait(List.of(python, "-c", "import cv2"), DEFAULT_TIMEOUT).exitCode();
        if (ec != 0) {
            List<String> openCVFeatures = getAffectedFeatures("OpenCV");
-            endpointConfiguration.disableGroup(
-                    "OpenCV", EndpointConfiguration.DisableReason.DEPENDENCY);
+            endpointConfiguration.disableGroup("OpenCV");
            log.warn(
                    "OpenCV not available in Python - Disabling OpenCV features: {}",
                    String.join(", ", openCVFeatures));
@@ -238,10 +236,8 @@ public class ExternalAppDepConfig {
    private void disablePythonAndOpenCV(String reason) {
        List<String> pythonFeatures = getAffectedFeatures("Python");
        List<String> openCVFeatures = getAffectedFeatures("OpenCV");
-        endpointConfiguration.disableGroup(
-                "Python", EndpointConfiguration.DisableReason.DEPENDENCY);
-        endpointConfiguration.disableGroup(
-                "OpenCV", EndpointConfiguration.DisableReason.DEPENDENCY);
+        endpointConfiguration.disableGroup("Python");
+        endpointConfiguration.disableGroup("OpenCV");
        log.warn(
                "Missing dependency: Python (reason: {}) - Disabling Python features: {} and OpenCV"
                        + " features: {}",
@@ -1,79 +0,0 @@
-package stirling.software.SPDF.config;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.servlet.MultipartConfigFactory;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.context.annotation.DependsOn;
-import org.springframework.util.unit.DataSize;
-
-import jakarta.servlet.MultipartConfigElement;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.SPDF.controller.web.UploadLimitService;
-
-/**
- * Configuration for Spring multipart file upload settings. Synchronizes multipart limits with
- * fileUploadLimit from settings.yml or environment variables (SYSTEMFILEUPLOADLIMIT or
- * SYSTEM_MAXFILESIZE).
- */
-@Configuration
-@Slf4j
-public class MultipartConfiguration {
-
-    @Autowired private UploadLimitService uploadLimitService;
-
-    /**
-     * Creates MultipartConfigElement that respects fileUploadLimit from settings.yml or environment
-     * variables (SYSTEMFILEUPLOADLIMIT or SYSTEM_MAXFILESIZE). Depends on ApplicationProperties
-     * being initialized so @PostConstruct has run.
-     */
-    @Bean
-    @DependsOn("applicationProperties")
-    public MultipartConfigElement multipartConfigElement() {
-        MultipartConfigFactory factory = new MultipartConfigFactory();
-
-        // First check if SPRING_SERVLET_MULTIPART_MAX_FILE_SIZE is explicitly set
-        String springMaxFileSize =
-                java.lang.System.getenv("SPRING_SERVLET_MULTIPART_MAX_FILE_SIZE");
-        long uploadLimitBytes = 0;
-
-        if (springMaxFileSize != null && !springMaxFileSize.trim().isEmpty()) {
-            // Parse the Spring property format (e.g., "2000MB")
-            try {
-                DataSize dataSize = DataSize.parse(springMaxFileSize.trim());
-                uploadLimitBytes = dataSize.toBytes();
-                log.info("Using SPRING_SERVLET_MULTIPART_MAX_FILE_SIZE: {}", springMaxFileSize);
-            } catch (Exception e) {
-                log.warn(
-                        "Failed to parse SPRING_SERVLET_MULTIPART_MAX_FILE_SIZE: {}",
-                        springMaxFileSize,
-                        e);
-            }
-        }
-
-        // If not set via Spring property, use UploadLimitService which reads from
-        // fileUploadLimit (set from SYSTEMFILEUPLOADLIMIT/SYSTEM_MAXFILESIZE or settings.yml)
-        if (uploadLimitBytes == 0) {
-            uploadLimitBytes = uploadLimitService.getUploadLimit();
-            if (uploadLimitBytes > 0) {
-                log.info(
-                        "Using fileUploadLimit setting: {}",
-                        uploadLimitService.getReadableUploadLimit());
-            }
-        }
-
-        // If still no limit, use default of 2000MB
-        if (uploadLimitBytes == 0) {
-            uploadLimitBytes = 2000L * 1024 * 1024; // 2000MB default
-            log.info("Using default multipart file upload limit: 2000MB");
-        }
-
-        // Set max file size and max request size to the same value
-        factory.setMaxFileSize(DataSize.ofBytes(uploadLimitBytes));
-        factory.setMaxRequestSize(DataSize.ofBytes(uploadLimitBytes));
-
-        return factory.createMultipartConfig();
-    }
-}
@@ -54,8 +54,8 @@ public class TauriProcessMonitor {
        scheduler =
                Executors.newSingleThreadScheduledExecutor(
                        r -> {
-                            Thread t =
-                                    Thread.ofVirtual().name("tauri-process-monitor").unstarted(r);
+                            Thread t = new Thread(r, "tauri-process-monitor");
+                            t.setDaemon(true);
                            return t;
                        });

@@ -82,9 +82,6 @@ public class WebMvcConfig implements WebMvcConfigurer {
            logger.info("Tauri mode detected - enabling CORS for Tauri protocols (v1 and v2)");
            registry.addMapping("/**")
                    .allowedOriginPatterns(
-                            "http://localhost:*",
-                            "https://localhost:*",
-                            "tauri://*", // Add this for Tauri apps
                            "tauri://localhost",
                            "http://tauri.localhost",
                            "https://tauri.localhost")
@@ -109,29 +106,16 @@ public class WebMvcConfig implements WebMvcConfigurer {
                    .allowCredentials(true)
                    .maxAge(3600);
        } else if (hasConfiguredOrigins) {
-            // Use user-configured origins + always include Tauri origins for desktop app support
+            // Use user-configured origins
            logger.info(
                    "Configuring CORS with allowed origins: {}",
                    applicationProperties.getSystem().getCorsAllowedOrigins());

-            // Combine user-configured origins with Tauri origins
-            java.util.List<String> allOrigins =
-                    new java.util.ArrayList<>(
-                            applicationProperties.getSystem().getCorsAllowedOrigins());
-
-            // Always include Tauri origins for desktop app compatibility
-            // Tauri v1 uses tauri://localhost, v2 uses http(s)://tauri.localhost
-            if (!allOrigins.contains("tauri://localhost")) {
-                allOrigins.add("tauri://localhost");
-            }
-            if (!allOrigins.contains("http://tauri.localhost")) {
-                allOrigins.add("http://tauri.localhost");
-            }
-            if (!allOrigins.contains("https://tauri.localhost")) {
-                allOrigins.add("https://tauri.localhost");
-            }
-
-            String[] allowedOrigins = allOrigins.toArray(new String[0]);
+            String[] allowedOrigins =
+                    applicationProperties
+                            .getSystem()
+                            .getCorsAllowedOrigins()
+                            .toArray(new String[0]);

            registry.addMapping("/**")
                    .allowedOriginPatterns(allowedOrigins)
@@ -157,8 +141,8 @@ public class WebMvcConfig implements WebMvcConfigurer {
                    .maxAge(3600);
        } else {
            // Default to allowing all origins when nothing is configured
-            logger.debug(
-                    "No CORS allowed origins configured in settings.yml (system.corsAllowedOrigins); WebMvcConfig allowing all origins.");
+            logger.info(
+                    "No CORS allowed origins configured in settings.yml (system.corsAllowedOrigins); allowing all origins.");
            registry.addMapping("/**")
                    .allowedOriginPatterns("*")
                    .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")
@@ -8,12 +8,10 @@ import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDDocumentInformation;
 import org.apache.pdfbox.pdmodel.PDPage;
 import org.apache.pdfbox.pdmodel.PDPageTree;
-import org.apache.pdfbox.pdmodel.PDResources;
 import org.apache.pdfbox.pdmodel.encryption.PDEncryption;
 import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotation;
 import org.apache.pdfbox.pdmodel.interactive.form.PDAcroForm;
 import org.springframework.http.MediaType;
-import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.*;

 import io.swagger.v3.oas.annotations.Operation;
@@ -37,9 +35,9 @@ public class AnalysisController {
    @Operation(
            summary = "Get PDF page count",
            description = "Returns total number of pages in PDF. Input:PDF Output:JSON Type:SISO")
-    public ResponseEntity<?> getPageCount(@ModelAttribute PDFFile file) throws IOException {
+    public Map<String, Integer> getPageCount(@ModelAttribute PDFFile file) throws IOException {
        try (PDDocument document = pdfDocumentFactory.load(file.getFileInput())) {
-            return ResponseEntity.ok(Map.of("pageCount", document.getNumberOfPages()));
+            return Map.of("pageCount", document.getNumberOfPages());
        }
    }

@@ -48,13 +46,13 @@ public class AnalysisController {
    @Operation(
            summary = "Get basic PDF information",
            description = "Returns page count, version, file size. Input:PDF Output:JSON Type:SISO")
-    public ResponseEntity<?> getBasicInfo(@ModelAttribute PDFFile file) throws IOException {
+    public Map<String, Object> getBasicInfo(@ModelAttribute PDFFile file) throws IOException {
        try (PDDocument document = pdfDocumentFactory.load(file.getFileInput())) {
            Map<String, Object> info = new HashMap<>();
            info.put("pageCount", document.getNumberOfPages());
            info.put("pdfVersion", document.getVersion());
            info.put("fileSize", file.getFileInput().getSize());
-            return ResponseEntity.ok(info);
+            return info;
        }
    }

@@ -65,7 +63,7 @@ public class AnalysisController {
    @Operation(
            summary = "Get PDF document properties",
            description = "Returns title, author, subject, etc. Input:PDF Output:JSON Type:SISO")
-    public ResponseEntity<?> getDocumentProperties(@ModelAttribute PDFFile file)
+    public Map<String, String> getDocumentProperties(@ModelAttribute PDFFile file)
            throws IOException {
        // Load the document in read-only mode to prevent modifications and ensure the integrity of
        // the original file.
@@ -78,15 +76,9 @@ public class AnalysisController {
            properties.put("keywords", info.getKeywords());
            properties.put("creator", info.getCreator());
            properties.put("producer", info.getProducer());
-            properties.put(
-                    "creationDate",
-                    info.getCreationDate() != null ? info.getCreationDate().toString() : null);
-            properties.put(
-                    "modificationDate",
-                    info.getModificationDate() != null
-                            ? info.getModificationDate().toString()
-                            : null);
-            return ResponseEntity.ok(properties);
+            properties.put("creationDate", info.getCreationDate().toString());
+            properties.put("modificationDate", info.getModificationDate().toString());
+            return properties;
        }
    }

@@ -95,7 +87,8 @@ public class AnalysisController {
    @Operation(
            summary = "Get page dimensions for all pages",
            description = "Returns width and height of each page. Input:PDF Output:JSON Type:SISO")
-    public ResponseEntity<?> getPageDimensions(@ModelAttribute PDFFile file) throws IOException {
+    public List<Map<String, Float>> getPageDimensions(@ModelAttribute PDFFile file)
+            throws IOException {
        try (PDDocument document = pdfDocumentFactory.load(file.getFileInput())) {
            List<Map<String, Float>> dimensions = new ArrayList<>();
            PDPageTree pages = document.getPages();
@@ -106,7 +99,7 @@ public class AnalysisController {
                pageDim.put("height", page.getBBox().getHeight());
                dimensions.add(pageDim);
            }
-            return ResponseEntity.ok(dimensions);
+            return dimensions;
        }
    }

@@ -116,7 +109,7 @@ public class AnalysisController {
            summary = "Get form field information",
            description =
                    "Returns count and details of form fields. Input:PDF Output:JSON Type:SISO")
-    public ResponseEntity<?> getFormFields(@ModelAttribute PDFFile file) throws IOException {
+    public Map<String, Object> getFormFields(@ModelAttribute PDFFile file) throws IOException {
        try (PDDocument document = pdfDocumentFactory.load(file.getFileInput())) {
            Map<String, Object> formInfo = new HashMap<>();
            PDAcroForm form = document.getDocumentCatalog().getAcroForm();
@@ -130,7 +123,7 @@ public class AnalysisController {
                formInfo.put("hasXFA", false);
                formInfo.put("isSignaturesExist", false);
            }
-            return ResponseEntity.ok(formInfo);
+            return formInfo;
        }
    }

@@ -139,7 +132,7 @@ public class AnalysisController {
    @Operation(
            summary = "Get annotation information",
            description = "Returns count and types of annotations. Input:PDF Output:JSON Type:SISO")
-    public ResponseEntity<?> getAnnotationInfo(@ModelAttribute PDFFile file) throws IOException {
+    public Map<String, Object> getAnnotationInfo(@ModelAttribute PDFFile file) throws IOException {
        try (PDDocument document = pdfDocumentFactory.load(file.getFileInput())) {
            Map<String, Object> annotInfo = new HashMap<>();
            int totalAnnotations = 0;
@@ -155,7 +148,7 @@ public class AnalysisController {

            annotInfo.put("totalCount", totalAnnotations);
            annotInfo.put("typeBreakdown", annotationTypes);
-            return ResponseEntity.ok(annotInfo);
+            return annotInfo;
        }
    }

@@ -165,23 +158,20 @@ public class AnalysisController {
            summary = "Get font information",
            description =
                    "Returns list of fonts used in the document. Input:PDF Output:JSON Type:SISO")
-    public ResponseEntity<?> getFontInfo(@ModelAttribute PDFFile file) throws IOException {
+    public Map<String, Object> getFontInfo(@ModelAttribute PDFFile file) throws IOException {
        try (PDDocument document = pdfDocumentFactory.load(file.getFileInput())) {
            Map<String, Object> fontInfo = new HashMap<>();
            Set<String> fontNames = new HashSet<>();

            for (PDPage page : document.getPages()) {
-                PDResources resources = page.getResources();
-                if (resources != null) {
-                    for (COSName font : resources.getFontNames()) {
-                        fontNames.add(font.getName());
-                    }
+                for (COSName font : page.getResources().getFontNames()) {
+                    fontNames.add(font.getName());
                }
            }

            fontInfo.put("fontCount", fontNames.size());
            fontInfo.put("fonts", fontNames);
-            return ResponseEntity.ok(fontInfo);
+            return fontInfo;
        }
    }

@@ -191,7 +181,7 @@ public class AnalysisController {
            summary = "Get security information",
            description =
                    "Returns encryption and permission details. Input:PDF Output:JSON Type:SISO")
-    public ResponseEntity<?> getSecurityInfo(@ModelAttribute PDFFile file) throws IOException {
+    public Map<String, Object> getSecurityInfo(@ModelAttribute PDFFile file) throws IOException {
        try (PDDocument document = pdfDocumentFactory.load(file.getFileInput())) {
            Map<String, Object> securityInfo = new HashMap<>();
            PDEncryption encryption = document.getEncryption();
@@ -218,7 +208,7 @@ public class AnalysisController {
                securityInfo.put("isEncrypted", false);
            }

-            return ResponseEntity.ok(securityInfo);
+            return securityInfo;
        }
    }
 }
@@ -15,6 +15,9 @@ import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.multipart.MultipartFile;

+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
 import io.swagger.v3.oas.annotations.Operation;

 import lombok.Getter;
@@ -29,9 +32,6 @@ import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.WebResponseUtils;

-import tools.jackson.core.type.TypeReference;
-import tools.jackson.databind.ObjectMapper;
-
@GeneralApi
@Slf4j
@RequiredArgsConstructor
@@ -46,18 +46,18 @@ public class EditTableOfContentsController {
    @Operation(
            summary = "Extract PDF Bookmarks",
            description = "Extracts bookmarks/table of contents from a PDF document as JSON.")
-    public ResponseEntity<List<Map<String, Object>>> extractBookmarks(
-            @RequestParam("file") MultipartFile file) throws Exception {
+    @ResponseBody
+    public List<Map<String, Object>> extractBookmarks(@RequestParam("file") MultipartFile file)
+            throws Exception {
        try (PDDocument document = pdfDocumentFactory.load(file)) {
            PDDocumentOutline outline = document.getDocumentCatalog().getDocumentOutline();

            if (outline == null) {
                log.info("No outline/bookmarks found in PDF");
-                return ResponseEntity.ok(new ArrayList<>());
+                return new ArrayList<>();
            }

-            List<Map<String, Object>> bookmarks = extractBookmarkItems(document, outline);
-            return ResponseEntity.ok(bookmarks);
+            return extractBookmarkItems(document, outline);
        }
    }

@@ -8,7 +8,6 @@ import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Comparator;
 import java.util.List;
-import java.util.regex.Pattern;

 import org.apache.pdfbox.multipdf.PDFMergerUtility;
 import org.apache.pdfbox.pdmodel.PDDocument;
@@ -52,7 +51,6 @@ import stirling.software.common.util.WebResponseUtils;
@RequiredArgsConstructor
 public class MergeController {

-    private static final Pattern QUOTE_WRAP_PATTERN = Pattern.compile("^\"|\"$");
    private final CustomPDFDocumentFactory pdfDocumentFactory;
    private final TempFileManager tempFileManager;

@@ -175,7 +173,7 @@ public class MergeController {
                String[] parts = inside.split(",");
                String[] result = new String[parts.length];
                for (int i = 0; i < parts.length; i++) {
-                    result[i] = QUOTE_WRAP_PATTERN.matcher(parts[i].trim()).replaceAll("");
+                    result[i] = parts[i].trim().replaceAll("^\"|\"$", "");
                }
                return result;
            }
@@ -399,12 +397,7 @@ public class MergeController {
        String mergedFileName =
                GeneralUtils.generateFilename(firstFilename, "_merged_unsigned.pdf");

-        byte[] pdfBytes;
-        try {
-            pdfBytes = Files.readAllBytes(outputTempFile.getPath());
-        } finally {
-            outputTempFile.close();
-        }
+        byte[] pdfBytes = Files.readAllBytes(outputTempFile.getPath());
        return WebResponseUtils.bytesToWebResponse(pdfBytes, mergedFileName);
    }
 }
@@ -194,7 +194,7 @@ public class PdfOverlayController {
            // Load the overlay document to check its page count
            try (PDDocument overlayPdf = Loader.loadPDF(overlayFile)) {
                int overlayPageCount = overlayPdf.getNumberOfPages();
-                for (int j = 0; j < repeatCount && currentPage <= basePageCount; j++) {
+                for (int j = 0; j < repeatCount; j++) {
                    for (int page = 0; page < overlayPageCount; page++) {
                        if (currentPage > basePageCount) break;
                        overlayGuide.put(currentPage++, overlayFile.getAbsolutePath());
@@ -1,271 +0,0 @@
-package stirling.software.SPDF.controller.api;
-
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.util.HashMap;
-import java.util.Map;
-import java.util.zip.ZipEntry;
-import java.util.zip.ZipOutputStream;
-
-import org.apache.pdfbox.multipdf.LayerUtility;
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.PDPage;
-import org.apache.pdfbox.pdmodel.PDPageContentStream;
-import org.apache.pdfbox.pdmodel.common.PDRectangle;
-import org.apache.pdfbox.pdmodel.graphics.form.PDFormXObject;
-import org.apache.pdfbox.util.Matrix;
-import org.springframework.http.MediaType;
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.ModelAttribute;
-import org.springframework.web.multipart.MultipartFile;
-
-import io.swagger.v3.oas.annotations.Operation;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.SPDF.config.swagger.MultiFileResponse;
-import stirling.software.SPDF.model.api.general.PosterPdfRequest;
-import stirling.software.common.annotations.AutoJobPostMapping;
-import stirling.software.common.annotations.api.GeneralApi;
-import stirling.software.common.service.CustomPDFDocumentFactory;
-import stirling.software.common.util.ExceptionUtils;
-import stirling.software.common.util.GeneralUtils;
-import stirling.software.common.util.WebResponseUtils;
-
-@GeneralApi
-@Slf4j
-@RequiredArgsConstructor
-public class PosterPdfController {
-
-    private final CustomPDFDocumentFactory pdfDocumentFactory;
-
-    @AutoJobPostMapping(
-            value = "/split-for-poster-print",
-            consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
-    @MultiFileResponse
-    @Operation(
-            summary = "Split large PDF pages into smaller printable chunks",
-            description =
-                    "This endpoint splits large or oddly-sized PDF pages into smaller chunks "
-                            + "suitable for printing on standard paper sizes (e.g., A4, Letter). "
-                            + "Divides each page into a grid of smaller pages using Apache PDFBox. "
-                            + "Input: PDF Output: ZIP-PDF Type: SISO")
-    public ResponseEntity<byte[]> posterPdf(@ModelAttribute PosterPdfRequest request)
-            throws Exception {
-
-        log.debug("Starting PDF poster split process with request: {}", request);
-        MultipartFile file = request.getFileInput();
-
-        String filename = GeneralUtils.generateFilename(file.getOriginalFilename(), "");
-        log.debug("Base filename for output: {}", filename);
-
-        try (PDDocument sourceDocument = pdfDocumentFactory.load(file);
-                PDDocument outputDocument =
-                        pdfDocumentFactory.createNewDocumentBasedOnOldDocument(sourceDocument);
-                ByteArrayOutputStream pdfOutputStream = new ByteArrayOutputStream();
-                ByteArrayOutputStream zipOutputStream = new ByteArrayOutputStream()) {
-
-            // Get target page size
-            PDRectangle targetPageSize = getTargetPageSize(request.getPageSize());
-            log.debug(
-                    "Target page size: {} ({}x{})",
-                    request.getPageSize(),
-                    targetPageSize.getWidth(),
-                    targetPageSize.getHeight());
-
-            // Create LayerUtility for importing pages as forms
-            LayerUtility layerUtility = new LayerUtility(outputDocument);
-
-            int totalPages = sourceDocument.getNumberOfPages();
-            int xFactor = request.getXFactor();
-            int yFactor = request.getYFactor();
-            boolean rightToLeft = request.isRightToLeft();
-
-            log.debug(
-                    "Processing {} pages with grid {}x{}, RTL={}",
-                    totalPages,
-                    xFactor,
-                    yFactor,
-                    rightToLeft);
-
-            // Process each page
-            for (int pageIndex = 0; pageIndex < totalPages; pageIndex++) {
-                PDPage sourcePage = sourceDocument.getPage(pageIndex);
-
-                // Get both MediaBox and CropBox
-                PDRectangle mediaBox = sourcePage.getMediaBox();
-                PDRectangle cropBox = sourcePage.getCropBox();
-
-                // If no CropBox is set, use MediaBox
-                if (cropBox == null) {
-                    cropBox = mediaBox;
-                }
-
-                // Save original boxes for restoration
-                PDRectangle originalMediaBox = sourcePage.getMediaBox();
-                PDRectangle originalCropBox = sourcePage.getCropBox();
-
-                // Normalize the page: set MediaBox to CropBox
-                // This ensures the form's coordinate space starts at (0, 0)
-                // instead of having an offset from the original MediaBox
-                sourcePage.setMediaBox(cropBox);
-                sourcePage.setCropBox(cropBox);
-
-                // Handle page rotation
-                int rotation = sourcePage.getRotation();
-                float sourceWidth = cropBox.getWidth();
-                float sourceHeight = cropBox.getHeight();
-
-                // Swap dimensions if rotated 90 or 270 degrees
-                if (rotation == 90 || rotation == 270) {
-                    float temp = sourceWidth;
-                    sourceWidth = sourceHeight;
-                    sourceHeight = temp;
-                }
-
-                log.debug(
-                        "Page {}: Normalized to CropBox dimensions {}x{}, rotation {}",
-                        pageIndex,
-                        sourceWidth,
-                        sourceHeight,
-                        rotation);
-
-                // Import source page as form (now with normalized coordinate space)
-                PDFormXObject form = layerUtility.importPageAsForm(sourceDocument, pageIndex);
-
-                // Restore original boxes
-                sourcePage.setMediaBox(originalMediaBox);
-                sourcePage.setCropBox(originalCropBox);
-
-                // Calculate cell dimensions in source page coordinates
-                float cellWidth = sourceWidth / xFactor;
-                float cellHeight = sourceHeight / yFactor;
-
-                // Create grid cells (rows × columns)
-                for (int row = 0; row < yFactor; row++) {
-                    for (int col = 0; col < xFactor; col++) {
-                        // Apply RTL ordering for columns if enabled
-                        int actualCol = rightToLeft ? (xFactor - 1 - col) : col;
-
-                        // Calculate crop rectangle in source coordinates
-                        // PDF coordinates start at bottom-left
-                        float cropX = actualCol * cellWidth;
-                        // For Y: invert so row 0 shows TOP (following SplitPdfBySectionsController
-                        // pattern)
-                        float cropY = (yFactor - 1 - row) * cellHeight;
-
-                        // Create new output page with target size
-                        PDPage outputPage = new PDPage(targetPageSize);
-                        outputDocument.addPage(outputPage);
-
-                        try (PDPageContentStream contentStream =
-                                new PDPageContentStream(
-                                        outputDocument,
-                                        outputPage,
-                                        PDPageContentStream.AppendMode.APPEND,
-                                        true,
-                                        true)) {
-
-                            // Calculate uniform scale to fit cell into target page
-                            // Scale UP if cell is smaller than target, scale DOWN if larger
-                            float scaleX = targetPageSize.getWidth() / cellWidth;
-                            float scaleY = targetPageSize.getHeight() / cellHeight;
-                            float scale = Math.min(scaleX, scaleY);
-
-                            // Center the scaled content on the target page
-                            float scaledCellWidth = cellWidth * scale;
-                            float scaledCellHeight = cellHeight * scale;
-                            float offsetX = (targetPageSize.getWidth() - scaledCellWidth) / 2;
-                            float offsetY = (targetPageSize.getHeight() - scaledCellHeight) / 2;
-
-                            // Apply transformations
-                            contentStream.saveGraphicsState();
-
-                            // Translate to center position
-                            contentStream.transform(Matrix.getTranslateInstance(offsetX, offsetY));
-
-                            // Scale uniformly
-                            contentStream.transform(Matrix.getScaleInstance(scale, scale));
-
-                            // Translate to show only the desired grid cell
-                            // IMPORTANT: The PDFormXObject's BBox already matches the CropBox
-                            // (including its offset), so we only need to translate by cropX/cropY
-                            // relative to the CropBox origin, NOT the MediaBox origin
-                            contentStream.transform(Matrix.getTranslateInstance(-cropX, -cropY));
-
-                            // Draw the form
-                            contentStream.drawForm(form);
-
-                            contentStream.restoreGraphicsState();
-                        }
-
-                        log.trace(
-                                "Created output page for grid cell [{},{}] of page {}: cropX={}, cropY={}, translate=({}, {})",
-                                row,
-                                actualCol,
-                                pageIndex,
-                                cropX,
-                                cropY,
-                                -cropX,
-                                -cropY);
-                    }
-                }
-            }
-
-            // Save output PDF
-            outputDocument.save(pdfOutputStream);
-            byte[] pdfData = pdfOutputStream.toByteArray();
-
-            log.debug(
-                    "Generated output PDF with {} pages ({} bytes)",
-                    outputDocument.getNumberOfPages(),
-                    pdfData.length);
-
-            // Create ZIP file with the result
-            try (ZipOutputStream zipOut = new ZipOutputStream(zipOutputStream)) {
-                ZipEntry zipEntry = new ZipEntry(filename + "_poster.pdf");
-                zipOut.putNextEntry(zipEntry);
-                zipOut.write(pdfData);
-                zipOut.closeEntry();
-            }
-
-            byte[] zipData = zipOutputStream.toByteArray();
-            log.debug("Successfully created ZIP with {} bytes", zipData.length);
-
-            return WebResponseUtils.bytesToWebResponse(
-                    zipData, filename + "_poster.zip", MediaType.APPLICATION_OCTET_STREAM);
-
-        } catch (IOException e) {
-            ExceptionUtils.logException("PDF poster split process", e);
-            throw e;
-        }
-    }
-
-    /**
-     * Maps page size string to PDRectangle.
-     *
-     * @param pageSize the page size name (e.g., "A4", "Letter")
-     * @return the corresponding PDRectangle
-     * @throws IllegalArgumentException if page size is not supported
-     */
-    private PDRectangle getTargetPageSize(String pageSize) {
-        Map<String, PDRectangle> sizeMap = new HashMap<>();
-        sizeMap.put("A4", PDRectangle.A4);
-        sizeMap.put("Letter", PDRectangle.LETTER);
-        sizeMap.put("A3", PDRectangle.A3);
-        sizeMap.put("A5", PDRectangle.A5);
-        sizeMap.put("Legal", PDRectangle.LEGAL);
-        sizeMap.put("Tabloid", new PDRectangle(792, 1224)); // 11x17 inches
-
-        PDRectangle size = sizeMap.get(pageSize);
-        if (size == null) {
-            throw ExceptionUtils.createIllegalArgumentException(
-                    "error.invalidPageSize",
-                    "Invalid page size: {0}",
-                    pageSize,
-                    String.join(", ", sizeMap.keySet()));
-        }
-        return size;
-    }
-}
@@ -191,14 +191,6 @@ public class RearrangePagesPDFController {
        if (duplicateCount < 1) {
            duplicateCount = 2; // Default to 2 if invalid input
        }
-        int maxDuplicateCount = Math.max(100, totalPages * 3);
-        if (duplicateCount > maxDuplicateCount) {
-            throw ExceptionUtils.createIllegalArgumentException(
-                    "error.invalidFormat",
-                    "Invalid {0} format: {1}",
-                    "duplicateCount",
-                    "must not exceed " + maxDuplicateCount);
-        }

        // For each page in the document
        for (int pageNum = 0; pageNum < totalPages; pageNum++) {
@@ -23,8 +23,6 @@ import org.springframework.web.multipart.MultipartFile;

 import io.swagger.v3.oas.annotations.Operation;

-import jakarta.validation.Valid;
-
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;

@@ -59,7 +57,7 @@ public class SplitPdfBySectionsController {
                            + " which page to split, and how to split"
                            + " ( halves, thirds, quarters, etc.), both vertically and horizontally."
                            + " Input:PDF Output:ZIP-PDF Type:SISO")
-    public ResponseEntity<byte[]> splitPdf(@Valid @ModelAttribute SplitPdfBySectionsRequest request)
+    public ResponseEntity<byte[]> splitPdf(@ModelAttribute SplitPdfBySectionsRequest request)
            throws Exception {
        MultipartFile file = request.getFileInput();
        String pageNumbers = request.getPageNumbers();
@@ -103,68 +101,66 @@ public class SplitPdfBySectionsController {
                    return WebResponseUtils.baosToWebResponse(baos, filename + ".pdf");
                }
            } else {
-                try (TempFile zipTempFile = new TempFile(tempFileManager, ".zip")) {
-                    try (ZipOutputStream zipOut =
-                            new ZipOutputStream(Files.newOutputStream(zipTempFile.getPath()))) {
-                        for (int pageIndex = 0;
-                                pageIndex < sourceDocument.getNumberOfPages();
-                                pageIndex++) {
-                            int pageNum = pageIndex + 1;
-                            if (pagesToSplit.contains(pageIndex)) {
-                                for (int i = 0; i < horiz; i++) {
-                                    for (int j = 0; j < verti; j++) {
-                                        try (PDDocument subDoc =
-                                                pdfDocumentFactory.createNewDocument()) {
-                                            LayerUtility subLayerUtility = new LayerUtility(subDoc);
-                                            addSingleSectionToTarget(
-                                                    sourceDocument,
-                                                    pageIndex,
-                                                    subDoc,
-                                                    subLayerUtility,
-                                                    i,
-                                                    j,
-                                                    horiz,
-                                                    verti);
-                                            int sectionNum = i * verti + j + 1;
-                                            String entryName =
-                                                    filename
-                                                            + "_"
-                                                            + pageNum
-                                                            + "_"
-                                                            + sectionNum
-                                                            + ".pdf";
-                                            saveDocToZip(subDoc, zipOut, entryName);
-                                        } catch (IOException e) {
-                                            log.error(
-                                                    "Error creating section {} for page {}",
-                                                    (i * verti + j + 1),
-                                                    pageNum,
-                                                    e);
-                                            throw e;
-                                        }
+                TempFile zipTempFile = new TempFile(tempFileManager, ".zip");
+                try (ZipOutputStream zipOut =
+                        new ZipOutputStream(Files.newOutputStream(zipTempFile.getPath()))) {
+                    for (int pageIndex = 0;
+                            pageIndex < sourceDocument.getNumberOfPages();
+                            pageIndex++) {
+                        int pageNum = pageIndex + 1;
+                        if (pagesToSplit.contains(pageIndex)) {
+                            for (int i = 0; i < horiz; i++) {
+                                for (int j = 0; j < verti; j++) {
+                                    try (PDDocument subDoc =
+                                            pdfDocumentFactory.createNewDocument()) {
+                                        LayerUtility subLayerUtility = new LayerUtility(subDoc);
+                                        addSingleSectionToTarget(
+                                                sourceDocument,
+                                                pageIndex,
+                                                subDoc,
+                                                subLayerUtility,
+                                                i,
+                                                j,
+                                                horiz,
+                                                verti);
+                                        int sectionNum = i * verti + j + 1;
+                                        String entryName =
+                                                filename
+                                                        + "_"
+                                                        + pageNum
+                                                        + "_"
+                                                        + sectionNum
+                                                        + ".pdf";
+                                        saveDocToZip(subDoc, zipOut, entryName);
+                                    } catch (IOException e) {
+                                        log.error(
+                                                "Error creating section {} for page {}",
+                                                (i * verti + j + 1),
+                                                pageNum,
+                                                e);
+                                        throw e;
                                    }
                                }
-                            } else {
-                                try (PDDocument subDoc = pdfDocumentFactory.createNewDocument()) {
-                                    LayerUtility subLayerUtility = new LayerUtility(subDoc);
-                                    addPageToTarget(
-                                            sourceDocument, pageIndex, subDoc, subLayerUtility);
-                                    String entryName = filename + "_" + pageNum + "_1.pdf";
-                                    saveDocToZip(subDoc, zipOut, entryName);
-                                } catch (IOException e) {
-                                    log.error("Error processing unsplit page {}", pageNum, e);
-                                    throw e;
-                                }
+                            }
+                        } else {
+                            try (PDDocument subDoc = pdfDocumentFactory.createNewDocument()) {
+                                LayerUtility subLayerUtility = new LayerUtility(subDoc);
+                                addPageToTarget(sourceDocument, pageIndex, subDoc, subLayerUtility);
+                                String entryName = filename + "_" + pageNum + "_1.pdf";
+                                saveDocToZip(subDoc, zipOut, entryName);
+                            } catch (IOException e) {
+                                log.error("Error processing unsplit page {}", pageNum, e);
+                                throw e;
                            }
                        }
-                    } catch (IOException e) {
-                        log.error("Error creating ZIP file with split PDF sections", e);
-                        throw e;
                    }
-                    byte[] zipBytes = Files.readAllBytes(zipTempFile.getPath());
-                    return WebResponseUtils.bytesToWebResponse(
-                            zipBytes, filename + ".zip", MediaType.APPLICATION_OCTET_STREAM);
+                } catch (IOException e) {
+                    log.error("Error creating ZIP file with split PDF sections", e);
+                    throw e;
                }
+                byte[] zipBytes = Files.readAllBytes(zipTempFile.getPath());
+                return WebResponseUtils.bytesToWebResponse(
+                        zipBytes, filename + ".zip", MediaType.APPLICATION_OCTET_STREAM);
            }
        } catch (Exception e) {
            log.error("Error splitting PDF file: {}", file.getOriginalFilename(), e);
@@ -82,7 +82,13 @@ public class SplitPdfBySizeController {

                        if (type == 0) {
                            log.debug("Processing split by size");
-                            long maxBytes = GeneralUtils.convertSizeToBytes(value);
+                            Long maxBytes = GeneralUtils.convertSizeToBytes(value);
+                            if (maxBytes == null || maxBytes <= 0) {
+                                throw ExceptionUtils.createIllegalArgumentException(
+                                        "error.invalidArgument",
+                                        "Invalid argument: {0}",
+                                        "split value: " + value);
+                            }
                            log.debug("Max bytes per document: {}", maxBytes);
                            handleSplitBySize(sourceDocument, maxBytes, zipOut, filename);
                        } else if (type == 1) {
@@ -16,6 +16,9 @@ import org.springframework.core.io.ResourceLoader;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.GetMapping;

+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
 import io.swagger.v3.oas.annotations.Operation;

 import lombok.Data;
@@ -32,9 +35,6 @@ import stirling.software.common.service.UserServiceInterface;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;

-import tools.jackson.core.type.TypeReference;
-import tools.jackson.databind.ObjectMapper;
-
@Slf4j
@UiDataApi
 public class UIDataController {
@@ -44,21 +44,18 @@ public class UIDataController {
    private final UserServiceInterface userService;
    private final ResourceLoader resourceLoader;
    private final RuntimePathConfig runtimePathConfig;
-    private final ObjectMapper objectMapper;

    public UIDataController(
            ApplicationProperties applicationProperties,
            SharedSignatureService signatureService,
            @Autowired(required = false) UserServiceInterface userService,
            ResourceLoader resourceLoader,
-            RuntimePathConfig runtimePathConfig,
-            ObjectMapper objectMapper) {
+            RuntimePathConfig runtimePathConfig) {
        this.applicationProperties = applicationProperties;
        this.signatureService = signatureService;
        this.userService = userService;
        this.resourceLoader = resourceLoader;
        this.runtimePathConfig = runtimePathConfig;
-        this.objectMapper = objectMapper;
    }

    @GetMapping("/footer-info")
@@ -96,8 +93,9 @@ public class UIDataController {

        try (InputStream is = resource.getInputStream()) {
            String json = new String(is.readAllBytes(), StandardCharsets.UTF_8);
+            ObjectMapper mapper = new ObjectMapper();
            Map<String, List<Dependency>> licenseData =
-                    objectMapper.readValue(json, new TypeReference<>() {});
+                    mapper.readValue(json, new TypeReference<>() {});
            data.setDependencies(licenseData.get("dependencies"));
        } catch (IOException e) {
            log.error("Failed to load licenses data", e);
@@ -129,8 +127,8 @@ public class UIDataController {

                for (String config : pipelineConfigs) {
                    Map<String, Object> jsonContent =
-                            objectMapper.readValue(
-                                    config, new TypeReference<Map<String, Object>>() {});
+                            new ObjectMapper()
+                                    .readValue(config, new TypeReference<Map<String, Object>>() {});
                    String name = (String) jsonContent.get("name");
                    if (name == null || name.length() < 1) {
                        String filename =
@@ -168,8 +166,7 @@ public class UIDataController {
    public ResponseEntity<SignData> getSignData() {
        String username = "";
        if (userService != null) {
-            String currentUsername = userService.getCurrentUsername();
-            username = currentUsername != null ? currentUsername : "";
+            username = userService.getCurrentUsername();
        }

        List<SignatureFile> signatures = signatureService.getAvailableSignatures(username);
@@ -44,7 +44,7 @@ public class ConvertMarkdownToPdf {
    @Operation(
            summary = "Convert a Markdown file to PDF",
            description =
-                    "This endpoint takes a Markdown file or ZIP (containing Markdown + images) input, converts it to HTML, and then to"
+                    "This endpoint takes a Markdown file input, converts it to HTML, and then to"
                            + " PDF format. Input:MARKDOWN Output:PDF Type:SISO")
    public ResponseEntity<byte[]> markdownToPdf(@ModelAttribute GeneralFile generalFile)
            throws Exception {
@@ -52,187 +52,40 @@ public class ConvertMarkdownToPdf {

        if (fileInput == null) {
            throw ExceptionUtils.createIllegalArgumentException(
-                    "error.fileFormatRequired", "File must be in {0} format", "Markdown or ZIP");
+                    "error.fileFormatRequired", "File must be in {0} format", "Markdown");
        }

        String originalFilename = Filenames.toSimpleFileName(fileInput.getOriginalFilename());
-        if (originalFilename == null) {
+        if (originalFilename == null || !originalFilename.endsWith(".md")) {
            throw ExceptionUtils.createIllegalArgumentException(
-                    "error.fileFormatRequired", "File must be in {0} format", ".md or .zip");
+                    "error.fileFormatRequired", "File must be in {0} format", ".md");
        }

-        boolean isZip = originalFilename.toLowerCase().endsWith(".zip");
-        boolean isMarkdown = originalFilename.toLowerCase().endsWith(".md");
+        // Convert Markdown to HTML using CommonMark
+        List<Extension> extensions = List.of(TablesExtension.create());
+        Parser parser = Parser.builder().extensions(extensions).build();

-        if (!isZip && !isMarkdown) {
-            throw ExceptionUtils.createIllegalArgumentException(
-                    "error.fileFormatRequired", "File must be in {0} format", ".md or .zip");
-        }
+        Node document = parser.parse(new String(fileInput.getBytes()));
+        HtmlRenderer renderer =
+                HtmlRenderer.builder()
+                        .attributeProviderFactory(context -> new TableAttributeProvider())
+                        .extensions(extensions)
+                        .build();

-        byte[] pdfBytes;
-        String outputFilename;
-
-        if (isZip) {
-            // Handle ZIP file containing markdown + images
-            try (TempDirectory tempDir = new TempDirectory(tempFileManager)) {
-                // Extract ZIP to temp directory
-                java.nio.file.Path tempDirPath = tempDir.getPath();
-                try (java.util.zip.ZipInputStream zipIn =
-                        io.github.pixee.security.ZipSecurity.createHardenedInputStream(
-                                new java.io.ByteArrayInputStream(fileInput.getBytes()))) {
-                    java.util.zip.ZipEntry entry;
-                    while ((entry = zipIn.getNextEntry()) != null) {
-                        if (!entry.isDirectory()) {
-                            java.nio.file.Path filePath =
-                                    tempDirPath.resolve(entry.getName()).normalize();
-                            if (!filePath.startsWith(tempDirPath)) {
-                                throw new java.io.IOException(
-                                        "ZIP entry is outside of target directory: "
-                                                + entry.getName());
-                            }
-                            java.nio.file.Files.createDirectories(filePath.getParent());
-                            java.nio.file.Files.copy(zipIn, filePath);
-                        }
-                        zipIn.closeEntry();
-                    }
-                }
-
-                // Find the markdown file (look for .md files, prefer index.md or first one)
-                java.io.File markdownFile = findMarkdownFile(tempDirPath.toFile());
-                if (markdownFile == null) {
-                    throw ExceptionUtils.createIllegalArgumentException(
-                            "error.fileFormatRequired",
-                            "ZIP must contain at least one {0} file",
-                            ".md");
-                }
-
-                // Read and convert markdown to HTML
-                String markdownContent = java.nio.file.Files.readString(markdownFile.toPath());
-                List<Extension> extensions = List.of(TablesExtension.create());
-                Parser parser = Parser.builder().extensions(extensions).build();
-                Node document = parser.parse(markdownContent);
-                HtmlRenderer renderer =
-                        HtmlRenderer.builder()
-                                .attributeProviderFactory(context -> new TableAttributeProvider())
-                                .extensions(extensions)
-                                .build();
-                String htmlContent = renderer.render(document);
-
-                // Create a new ZIP with HTML + images for WeasyPrint
-                byte[] htmlZipBytes = createHtmlZip(htmlContent, tempDirPath.toFile());
-
-                // Use FileToPdf which already supports ZIP files with images
-                pdfBytes =
-                        FileToPdf.convertHtmlToPdf(
-                                runtimePathConfig.getWeasyPrintPath(),
-                                null,
-                                htmlZipBytes,
-                                "package.zip",
-                                tempFileManager,
-                                customHtmlSanitizer);
-
-                outputFilename =
-                        GeneralUtils.generateFilename(
-                                originalFilename.substring(0, originalFilename.lastIndexOf('.')),
-                                ".pdf");
-            }
-        } else {
-            // Handle plain markdown file (no images)
-            List<Extension> extensions = List.of(TablesExtension.create());
-            Parser parser = Parser.builder().extensions(extensions).build();
-
-            Node document = parser.parse(new String(fileInput.getBytes()));
-            HtmlRenderer renderer =
-                    HtmlRenderer.builder()
-                            .attributeProviderFactory(context -> new TableAttributeProvider())
-                            .extensions(extensions)
-                            .build();
-
-            String htmlContent = renderer.render(document);
-
-            pdfBytes =
-                    FileToPdf.convertHtmlToPdf(
-                            runtimePathConfig.getWeasyPrintPath(),
-                            null,
-                            htmlContent.getBytes(),
-                            "converted.html",
-                            tempFileManager,
-                            customHtmlSanitizer);
-
-            outputFilename = GeneralUtils.generateFilename(originalFilename, ".pdf");
-        }
+        String htmlContent = renderer.render(document);

+        byte[] pdfBytes =
+                FileToPdf.convertHtmlToPdf(
+                        runtimePathConfig.getWeasyPrintPath(),
+                        null,
+                        htmlContent.getBytes(),
+                        "converted.html",
+                        tempFileManager,
+                        customHtmlSanitizer);
        pdfBytes = pdfDocumentFactory.createNewBytesBasedOnOldDocument(pdfBytes);
+        String outputFilename = GeneralUtils.generateFilename(originalFilename, ".pdf");
        return WebResponseUtils.bytesToWebResponse(pdfBytes, outputFilename);
    }
-
-    /**
-     * Finds a markdown file in the directory. Prefers index.md, otherwise returns the first .md
-     * file found.
-     */
-    private java.io.File findMarkdownFile(java.io.File directory) throws java.io.IOException {
-        java.io.File indexMd = new java.io.File(directory, "index.md");
-        if (indexMd.exists()) {
-            return indexMd;
-        }
-
-        // Search for any .md file
-        try (java.util.stream.Stream<java.nio.file.Path> paths =
-                java.nio.file.Files.walk(directory.toPath())) {
-            return paths.filter(p -> p.toString().toLowerCase().endsWith(".md"))
-                    .findFirst()
-                    .map(java.nio.file.Path::toFile)
-                    .orElse(null);
-        }
-    }
-
-    /**
-     * Creates a ZIP file containing the HTML content and all other files (images) from the
-     * directory.
-     */
-    private byte[] createHtmlZip(String htmlContent, java.io.File sourceDir)
-            throws java.io.IOException {
-        java.io.ByteArrayOutputStream baos = new java.io.ByteArrayOutputStream();
-
-        try (java.util.zip.ZipOutputStream zos = new java.util.zip.ZipOutputStream(baos)) {
-            // Add HTML file to root
-            java.util.zip.ZipEntry htmlEntry = new java.util.zip.ZipEntry("index.html");
-            zos.putNextEntry(htmlEntry);
-            zos.write(htmlContent.getBytes(java.nio.charset.StandardCharsets.UTF_8));
-            zos.closeEntry();
-
-            // Add all other files (images, etc.)
-            addDirectoryToZip(zos, sourceDir.toPath(), sourceDir.toPath());
-        }
-
-        return baos.toByteArray();
-    }
-
-    /** Recursively adds files from a directory to a ZIP, excluding .md files. */
-    private void addDirectoryToZip(
-            java.util.zip.ZipOutputStream zos,
-            java.nio.file.Path sourceDir,
-            java.nio.file.Path rootDir)
-            throws java.io.IOException {
-        try (java.util.stream.Stream<java.nio.file.Path> paths =
-                java.nio.file.Files.walk(sourceDir, 1)) {
-            for (java.nio.file.Path path : paths.toList()) {
-                if (java.nio.file.Files.isDirectory(path)) {
-                    if (!path.equals(sourceDir)) {
-                        addDirectoryToZip(zos, path, rootDir);
-                    }
-                } else if (!path.toString().toLowerCase().endsWith(".md")) {
-                    // Add file to ZIP, maintaining relative path structure
-                    java.nio.file.Path relativePath = rootDir.relativize(path);
-                    java.util.zip.ZipEntry entry =
-                            new java.util.zip.ZipEntry(relativePath.toString());
-                    zos.putNextEntry(entry);
-                    java.nio.file.Files.copy(path, zos);
-                    zos.closeEntry();
-                }
-            }
-        }
-    }
 }

 class TableAttributeProvider implements AttributeProvider {
@@ -91,32 +91,22 @@ public class ConvertOfficeController {

        Path libreOfficeProfile = null;
        try {
-            ProcessExecutorResult result = null;
-            IOException unoconvertException = null;
-
-            // Try unoconvert first if available
+            ProcessExecutorResult result;
+            // Run Unoconvert command
            if (isUnoconvertAvailable()) {
-                try {
-                    List<String> command = new ArrayList<>();
-                    command.add(runtimePathConfig.getUnoConvertPath());
-                    command.add("--convert-to");
-                    command.add("pdf");
-                    command.add(inputPath.toString());
-                    command.add(outputPath.toString());
+                // Unoconvert: schreibe direkt in outputPath innerhalb des workDir
+                List<String> command = new ArrayList<>();
+                command.add(runtimePathConfig.getUnoConvertPath());
+                command.add("--convert-to");
+                command.add("pdf");
+                command.add(inputPath.toString());
+                command.add(outputPath.toString());

-                    result =
-                            ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
-                                    .runCommandWithOutputHandling(command);
-                } catch (IOException e) {
-                    unoconvertException = e;
-                    log.warn(
-                            "Unoconvert command failed ({}). Falling back to soffice command.",
-                            e.getMessage());
-                }
-            }
-
-            // Fallback to soffice if unoconvert was unavailable or failed
-            if (result == null) {
+                result =
+                        ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
+                                .runCommandWithOutputHandling(command);
+            } // Run soffice command
+            else {
                libreOfficeProfile = Files.createTempDirectory("libreoffice_profile_");
                List<String> command = new ArrayList<>();
                command.add(runtimePathConfig.getSOfficePath());
@@ -124,21 +114,14 @@ public class ConvertOfficeController {
                command.add("--headless");
                command.add("--nologo");
                command.add("--convert-to");
-                command.add("pdf");
+                command.add("pdf:writer_pdf_Export");
                command.add("--outdir");
                command.add(workDir.toString());
                command.add(inputPath.toString());

-                try {
-                    result =
-                            ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
-                                    .runCommandWithOutputHandling(command);
-                } catch (IOException e) {
-                    if (unoconvertException != null) {
-                        e.addSuppressed(unoconvertException);
-                    }
-                    throw e;
-                }
+                result =
+                        ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
+                                .runCommandWithOutputHandling(command);
            }

            // Check the result
@@ -1,124 +0,0 @@
-package stirling.software.SPDF.controller.api.converters;
-
-import java.io.ByteArrayOutputStream;
-import java.util.List;
-import java.util.Locale;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.poi.ss.usermodel.Cell;
-import org.apache.poi.ss.usermodel.Row;
-import org.apache.poi.ss.usermodel.Sheet;
-import org.apache.poi.ss.usermodel.Workbook;
-import org.apache.poi.ss.util.WorkbookUtil;
-import org.apache.poi.xssf.usermodel.XSSFWorkbook;
-import org.springframework.http.ContentDisposition;
-import org.springframework.http.HttpHeaders;
-import org.springframework.http.MediaType;
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.ModelAttribute;
-
-import io.swagger.v3.oas.annotations.Operation;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.SPDF.model.api.PDFWithPageNums;
-import stirling.software.common.annotations.AutoJobPostMapping;
-import stirling.software.common.annotations.api.ConvertApi;
-import stirling.software.common.service.CustomPDFDocumentFactory;
-import stirling.software.common.util.GeneralUtils;
-
-import technology.tabula.ObjectExtractor;
-import technology.tabula.Page;
-import technology.tabula.RectangularTextContainer;
-import technology.tabula.Table;
-import technology.tabula.extractors.SpreadsheetExtractionAlgorithm;
-
-@ConvertApi
-@Slf4j
-@RequiredArgsConstructor
-public class ConvertPDFToExcelController {
-
-    private final CustomPDFDocumentFactory pdfDocumentFactory;
-
-    @AutoJobPostMapping(value = "/pdf/xlsx", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
-    @Operation(
-            summary = "Convert a PDF to an Excel spreadsheet (XLSX)",
-            description =
-                    "Extracts tabular data from each page of a PDF and writes it into an Excel"
-                            + " workbook, one sheet per table. Input:PDF Output:XLSX Type:SISO")
-    public ResponseEntity<byte[]> pdfToExcel(@ModelAttribute PDFWithPageNums request)
-            throws Exception {
-        String baseName =
-                GeneralUtils.removeExtension(request.getFileInput().getOriginalFilename());
-
-        try (PDDocument document = pdfDocumentFactory.load(request);
-                XSSFWorkbook workbook = new XSSFWorkbook();
-                ObjectExtractor extractor = new ObjectExtractor(document)) {
-
-            List<Integer> pages = request.getPageNumbersList(document, true);
-            SpreadsheetExtractionAlgorithm sea = new SpreadsheetExtractionAlgorithm();
-            int sheetCount = 0;
-
-            for (int pageNum : pages) {
-                Page page = extractor.extract(pageNum);
-                List<Table> tables = sea.extract(page);
-
-                for (int tableIdx = 0; tableIdx < tables.size(); tableIdx++) {
-                    Table table = tables.get(tableIdx);
-                    String sheetName =
-                            tables.size() == 1
-                                    ? String.format(Locale.ROOT, "Page %d", pageNum)
-                                    : String.format(
-                                            Locale.ROOT, "Page %d Table %d", pageNum, tableIdx + 1);
-
-                    sheetName = getUniqueSheetName(workbook, sheetName);
-                    Sheet sheet = workbook.createSheet(sheetName);
-                    List<List<RectangularTextContainer>> rows = table.getRows();
-
-                    for (int rowIdx = 0; rowIdx < rows.size(); rowIdx++) {
-                        Row excelRow = sheet.createRow(rowIdx);
-                        List<RectangularTextContainer> cells = rows.get(rowIdx);
-                        for (int cellIdx = 0; cellIdx < cells.size(); cellIdx++) {
-                            Cell excelCell = excelRow.createCell(cellIdx);
-                            excelCell.setCellValue(cells.get(cellIdx).getText());
-                        }
-                    }
-                    sheetCount++;
-                }
-            }
-
-            if (sheetCount == 0) {
-                return ResponseEntity.noContent().build();
-            }
-
-            ByteArrayOutputStream baos = new ByteArrayOutputStream();
-            workbook.write(baos);
-
-            HttpHeaders headers = new HttpHeaders();
-            headers.setContentDisposition(
-                    ContentDisposition.builder("attachment").filename(baseName + ".xlsx").build());
-            headers.setContentType(
-                    MediaType.parseMediaType(
-                            "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"));
-
-            return ResponseEntity.ok().headers(headers).body(baos.toByteArray());
-        }
-    }
-
-    private String getUniqueSheetName(Workbook workbook, String baseName) {
-        String safeName = WorkbookUtil.createSafeSheetName(baseName);
-        String uniqueName = safeName;
-        int count = 1;
-        while (workbook.getSheet(uniqueName) != null) {
-            String suffix = " (" + count + ")";
-            if (safeName.length() + suffix.length() > 31) {
-                uniqueName = safeName.substring(0, 31 - suffix.length()) + suffix;
-            } else {
-                uniqueName = safeName + suffix;
-            }
-            count++;
-        }
-        return uniqueName;
-    }
-}
@@ -71,12 +71,10 @@ import org.apache.xmpbox.schema.PDFAIdentificationSchema;
 import org.apache.xmpbox.schema.XMPBasicSchema;
 import org.apache.xmpbox.xml.DomXmpParser;
 import org.apache.xmpbox.xml.XmpSerializer;
-import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
-import org.springframework.web.server.ResponseStatusException;

 import io.github.pixee.security.Filenames;
 import io.swagger.v3.oas.annotations.Operation;
@@ -101,7 +99,6 @@ public class ConvertPDFToPDFA {

    private static final Pattern NON_PRINTABLE_ASCII = Pattern.compile("[^\\x20-\\x7E]");
    private final RuntimePathConfig runtimePathConfig;
-    private final stirling.software.SPDF.service.VeraPDFService veraPDFService;

    private static final String ICC_RESOURCE_PATH = "/icc/sRGB2014.icc";
    private static final int PDFA_COMPATIBILITY_POLICY = 1;
@@ -482,22 +479,15 @@ public class ConvertPDFToPDFA {
        command.add("-dCompatibilityLevel=" + profile.getCompatibilityLevel());
        command.add("-sDEVICE=pdfwrite");
        command.add("-sColorConversionStrategy=RGB");
+        command.add("-dProcessColorModel=/DeviceRGB");
        command.add("-sOutputICCProfile=" + colorProfiles.rgb().toAbsolutePath());
        command.add("-sDefaultRGBProfile=" + colorProfiles.rgb().toAbsolutePath());
        command.add("-sDefaultGrayProfile=" + colorProfiles.gray().toAbsolutePath());
        command.add("-dEmbedAllFonts=true");
-        command.add("-dSubsetFonts=true");
+        command.add("-dSubsetFonts=false"); // Embed complete fonts to avoid incomplete glyphs
        command.add("-dCompressFonts=true");
        command.add("-dNOSUBSTFONTS=false"); // Allow font substitution for problematic fonts
-
-        // Explicitly tune downsampling/compression for high-quality print
-        command.add("-dColorImageDownsampleType=/Bicubic");
-        command.add("-dColorImageResolution=300");
-        command.add("-dGrayImageDownsampleType=/Bicubic");
-        command.add("-dGrayImageResolution=300");
-        command.add("-dMonoImageDownsampleType=/Bicubic");
-        command.add("-dMonoImageResolution=1200");
-
+        command.add("-dPDFSETTINGS=/prepress");
        command.add("-dNOPAUSE");
        command.add("-dBATCH");
        command.add("-dNOOUTERSAVE");
@@ -590,8 +580,7 @@ public class ConvertPDFToPDFA {
        if (isPdfX) {
            return handlePdfXConversion(inputFile, outputFormat);
        } else {
-            return handlePdfAConversion(
-                    inputFile, outputFormat, request.getStrict() != null && request.getStrict());
+            return handlePdfAConversion(inputFile, outputFormat);
        }
    }

@@ -1797,7 +1786,7 @@ public class ConvertPDFToPDFA {
    }

    private ResponseEntity<byte[]> handlePdfAConversion(
-            MultipartFile inputFile, String outputFormat, boolean strict) throws Exception {
+            MultipartFile inputFile, String outputFormat) throws Exception {
        PdfaProfile profile = PdfaProfile.fromRequest(outputFormat);

        // Get the original filename without extension
@@ -1826,10 +1815,6 @@ public class ConvertPDFToPDFA {

                    validateAndWarnPdfA(converted, profile, "Ghostscript");

-                    if (strict) {
-                        verifyStrictCompliance(converted);
-                    }
-
                    return WebResponseUtils.bytesToWebResponse(
                            converted, outputFilename, MediaType.APPLICATION_PDF);
                } catch (IOException | InterruptedException e) {
@@ -1847,42 +1832,14 @@ public class ConvertPDFToPDFA {
            // Validate with PDFBox preflight and warn if issues found
            validateAndWarnPdfA(converted, profile, "PDFBox/LibreOffice");

-            if (strict) {
-                verifyStrictCompliance(converted);
-            }
-
            return WebResponseUtils.bytesToWebResponse(
                    converted, outputFilename, MediaType.APPLICATION_PDF);
+
        } finally {
            deleteQuietly(workingDir);
        }
    }

-    private void verifyStrictCompliance(byte[] pdfBytes) throws IOException {
-        try (InputStream is = new ByteArrayInputStream(pdfBytes)) {
-            List<stirling.software.SPDF.model.api.security.PDFVerificationResult> results =
-                    veraPDFService.validatePDF(is);
-            boolean isCompliant = results.stream().anyMatch(result -> result.isCompliant());
-            if (!isCompliant) {
-                String details =
-                        results.stream()
-                                .map(r -> r.getStandard() + ": " + r.getComplianceSummary())
-                                .collect(Collectors.joining("; "));
-                throw new ResponseStatusException(
-                        HttpStatus.BAD_REQUEST,
-                        "Strict PDF/A mode enabled: Conversion is not perfectly compliant. Details: "
-                                + details);
-            }
-        } catch (Exception e) {
-            if (e instanceof ResponseStatusException) {
-                throw (ResponseStatusException) e;
-            }
-            log.error("Error during strict PDF/A verification", e);
-            throw new ResponseStatusException(
-                    HttpStatus.INTERNAL_SERVER_ERROR, "Error during strict PDF/A verification");
-        }
-    }
-
    private Path sanitizePdfWithPdfBox(Path inputPdf, boolean addWhiteBackground) {
        try {
            Path sanitizedPath =
@@ -2488,7 +2445,9 @@ public class ConvertPDFToPDFA {

    @Getter
    private enum PdfXProfile {
-        PDF_X("PDF/X", "_PDFX.pdf", "1.6", "2008", "pdfx");
+        PDF_X_1("PDF/X-1", "_PDFX-1.pdf", "1.3", "2001", "pdfx-1", "pdfx"),
+        PDF_X_3("PDF/X-3", "_PDFX-3.pdf", "1.3", "2003", "pdfx-3"),
+        PDF_X_4("PDF/X-4", "_PDFX-4.pdf", "1.4", "2008", "pdfx-4");

        private final String displayName;
        private final String suffix;
@@ -2514,7 +2473,7 @@ public class ConvertPDFToPDFA {

        static PdfXProfile fromRequest(String requestToken) {
            if (requestToken == null) {
-                return PDF_X;
+                return PDF_X_4;
            }
            String normalized = requestToken.trim().toLowerCase(Locale.ROOT);
            Optional<PdfXProfile> match =
@@ -2522,7 +2481,7 @@ public class ConvertPDFToPDFA {
                            .filter(profile -> profile.requestTokens.contains(normalized))
                            .findFirst();

-            return match.orElse(PDF_X);
+            return match.orElse(PDF_X_4);
        }

        String outputSuffix() {
@@ -1,9 +1,7 @@
 package stirling.software.SPDF.controller.api.converters;

-import java.nio.charset.StandardCharsets;
 import java.util.Optional;
 import java.util.UUID;
-import java.util.regex.Pattern;

 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.MediaType;
@@ -38,7 +36,6 @@ import stirling.software.common.util.WebResponseUtils;
@RequiredArgsConstructor
 public class ConvertPdfJsonController {

-    private static final Pattern FILE_EXTENSION_PATTERN = Pattern.compile("[.][^.]+$");
    private final PdfJsonConversionService pdfJsonConversionService;

    @Autowired(required = false)
@@ -59,13 +56,10 @@ public class ConvertPdfJsonController {
        }

        byte[] jsonBytes = pdfJsonConversionService.convertPdfToJson(inputFile, lightweight);
-        logJsonResponse("pdf/text-editor", jsonBytes);
        String originalName = inputFile.getOriginalFilename();
        String baseName =
                (originalName != null && !originalName.isBlank())
-                        ? FILE_EXTENSION_PATTERN
-                                .matcher(Filenames.toSimpleFileName(originalName))
-                                .replaceFirst("")
+                        ? Filenames.toSimpleFileName(originalName).replaceFirst("[.][^.]+$", "")
                        : "document";
        String docName = baseName + ".json";
        return WebResponseUtils.bytesToWebResponse(jsonBytes, docName, MediaType.APPLICATION_JSON);
@@ -88,9 +82,7 @@ public class ConvertPdfJsonController {
        String originalName = jsonFile.getOriginalFilename();
        String baseName =
                (originalName != null && !originalName.isBlank())
-                        ? FILE_EXTENSION_PATTERN
-                                .matcher(Filenames.toSimpleFileName(originalName))
-                                .replaceFirst("")
+                        ? Filenames.toSimpleFileName(originalName).replaceFirst("[.][^.]+$", "")
                        : "document";
        String docName = baseName.endsWith(".pdf") ? baseName : baseName + ".pdf";
        return WebResponseUtils.bytesToWebResponse(pdfBytes, docName);
@@ -116,17 +108,14 @@ public class ConvertPdfJsonController {
        // Scope job to authenticated user if security is enabled
        String scopedJobKey = getScopedJobKey(baseJobId);

-        log.debug("Extracting metadata for PDF, assigned jobId: {}", scopedJobKey);
+        log.info("Extracting metadata for PDF, assigned jobId: {}", scopedJobKey);

        byte[] jsonBytes =
                pdfJsonConversionService.extractDocumentMetadata(inputFile, scopedJobKey);
-        logJsonResponse("pdf/text-editor/metadata", jsonBytes);
        String originalName = inputFile.getOriginalFilename();
        String baseName =
                (originalName != null && !originalName.isBlank())
-                        ? FILE_EXTENSION_PATTERN
-                                .matcher(Filenames.toSimpleFileName(originalName))
-                                .replaceFirst("")
+                        ? Filenames.toSimpleFileName(originalName).replaceFirst("[.][^.]+$", "")
                        : "document";
        String docName = baseName + "_metadata.json";

@@ -163,9 +152,7 @@ public class ConvertPdfJsonController {

        String baseName =
                (filename != null && !filename.isBlank())
-                        ? FILE_EXTENSION_PATTERN
-                                .matcher(Filenames.toSimpleFileName(filename))
-                                .replaceFirst("")
+                        ? Filenames.toSimpleFileName(filename).replaceFirst("[.][^.]+$", "")
                        : Optional.ofNullable(document.getMetadata())
                                .map(PdfJsonMetadata::getTitle)
                                .filter(title -> title != null && !title.isBlank())
@@ -188,33 +175,11 @@ public class ConvertPdfJsonController {
        validateJobAccess(jobId);

        byte[] jsonBytes = pdfJsonConversionService.extractSinglePage(jobId, pageNumber);
-        logJsonResponse("pdf/text-editor/page", jsonBytes);
        String docName = "page_" + pageNumber + ".json";
        return WebResponseUtils.bytesToWebResponse(jsonBytes, docName, MediaType.APPLICATION_JSON);
    }

-    @GetMapping(value = "/pdf/text-editor/fonts/{jobId}/{pageNumber}")
-    @Operation(
-            summary = "Extract fonts used by a single cached page for text editor",
-            description =
-                    "Retrieves the font payloads used by a single page from a previously cached PDF document."
-                            + " Requires prior call to /pdf/text-editor/metadata. The jobId must belong to the"
-                            + " authenticated user. Output:JSON")
-    public ResponseEntity<byte[]> extractPageFonts(
-            @PathVariable String jobId, @PathVariable int pageNumber) throws Exception {
-
-        // Validate job ownership
-        validateJobAccess(jobId);
-
-        byte[] jsonBytes = pdfJsonConversionService.extractPageFonts(jobId, pageNumber);
-        logJsonResponse("pdf/text-editor/fonts/page", jsonBytes);
-        String docName = "page_fonts_" + pageNumber + ".json";
-        return WebResponseUtils.bytesToWebResponse(jsonBytes, docName, MediaType.APPLICATION_JSON);
-    }
-
-    @AutoJobPostMapping(
-            value = "/pdf/text-editor/clear-cache/{jobId}",
-            consumes = MediaType.ALL_VALUE)
+    @AutoJobPostMapping(value = "/pdf/text-editor/clear-cache/{jobId}")
    @Operation(
            summary = "Clear cached PDF document for text editor",
            description =
@@ -244,188 +209,6 @@ public class ConvertPdfJsonController {
        return baseJobId;
    }

-    private void logJsonResponse(String label, byte[] jsonBytes) {
-        if (jsonBytes == null) {
-            log.warn("Returning {} JSON response: null bytes", label);
-            return;
-        }
-
-        // Only perform expensive tail extraction if debug logging is enabled
-        if (log.isDebugEnabled()) {
-            int length = jsonBytes.length;
-            boolean endsWithJson =
-                    length > 0 && (jsonBytes[length - 1] == '}' || jsonBytes[length - 1] == ']');
-            String tail = "";
-            if (length > 0) {
-                int start = Math.max(0, length - 64);
-                tail = new String(jsonBytes, start, length - start, StandardCharsets.UTF_8);
-                tail = tail.replaceAll("[\\r\\n\\t]+", " ").replaceAll("[^\\x20-\\x7E]", "?");
-            }
-            log.debug(
-                    "Returning {} JSON response ({} bytes, endsWithJson={}, tail='{}')",
-                    label,
-                    length,
-                    endsWithJson,
-                    tail);
-        }
-
-        if (isPdfJsonDebugDumpEnabled()) {
-            try {
-                String tmpDir = System.getProperty("java.io.tmpdir");
-                String customDir = System.getenv("SPDF_PDFJSON_DUMP_DIR");
-                java.nio.file.Path dumpDir =
-                        customDir != null && !customDir.isBlank()
-                                ? java.nio.file.Path.of(customDir)
-                                : java.nio.file.Path.of(tmpDir);
-                java.nio.file.Path dumpPath =
-                        java.nio.file.Files.createTempFile(dumpDir, "pdfjson_", ".json");
-                java.nio.file.Files.write(dumpPath, jsonBytes);
-                log.debug("PDF JSON debug dump ({}): {}", label, dumpPath);
-            } catch (Exception ex) {
-                log.warn("Failed to write PDF JSON debug dump ({}): {}", label, ex.getMessage());
-            }
-        }
-
-        if (isPdfJsonRepeatScanEnabled()) {
-            logRepeatedJsonStrings(label, jsonBytes);
-        }
-    }
-
-    private boolean isPdfJsonDebugDumpEnabled() {
-        String env = System.getenv("SPDF_PDFJSON_DUMP");
-        if (env != null && env.equalsIgnoreCase("true")) {
-            return true;
-        }
-        return Boolean.getBoolean("spdf.pdfjson.dump");
-    }
-
-    private boolean isPdfJsonRepeatScanEnabled() {
-        String env = System.getenv("SPDF_PDFJSON_REPEAT_SCAN");
-        if (env != null && env.equalsIgnoreCase("true")) {
-            return true;
-        }
-        return Boolean.getBoolean("spdf.pdfjson.repeatScan");
-    }
-
-    private void logRepeatedJsonStrings(String label, byte[] jsonBytes) {
-        final int minLen = 12;
-        final int maxLen = 200;
-        final int maxUnique = 50000;
-        java.util.Map<String, Integer> counts = new java.util.HashMap<>();
-        boolean inString = false;
-        boolean escape = false;
-        boolean tooLong = false;
-        StringBuilder current = new StringBuilder(64);
-        boolean capped = false;
-
-        for (byte b : jsonBytes) {
-            char ch = (char) (b & 0xFF);
-            if (!inString) {
-                if (ch == '"') {
-                    inString = true;
-                    escape = false;
-                    tooLong = false;
-                    current.setLength(0);
-                }
-                continue;
-            }
-
-            if (escape) {
-                escape = false;
-                if (!tooLong && current.length() < maxLen) {
-                    current.append(ch);
-                }
-                continue;
-            }
-            if (ch == '\\') {
-                escape = true;
-                continue;
-            }
-            if (ch == '"') {
-                inString = false;
-                if (!tooLong) {
-                    int len = current.length();
-                    if (len >= minLen && len <= maxLen) {
-                        String value = current.toString();
-                        if (!looksLikeBase64(value)) {
-                            if (!capped || counts.containsKey(value)) {
-                                counts.merge(value, 1, Integer::sum);
-                                if (!capped && counts.size() >= maxUnique) {
-                                    capped = true;
-                                }
-                            }
-                        }
-                    }
-                }
-                continue;
-            }
-            if (!tooLong) {
-                if (current.length() < maxLen) {
-                    current.append(ch);
-                } else {
-                    tooLong = true;
-                }
-            }
-        }
-
-        java.util.List<java.util.Map.Entry<String, Integer>> top =
-                counts.entrySet().stream()
-                        .filter(e -> e.getValue() > 1)
-                        .sorted((a, b) -> Integer.compare(b.getValue(), a.getValue()))
-                        .limit(20)
-                        .toList();
-
-        if (!top.isEmpty()) {
-            String summary =
-                    top.stream()
-                            .map(
-                                    e ->
-                                            String.format(
-                                                    "\"%s\"(len=%d,count=%d)",
-                                                    truncateForLog(e.getKey()),
-                                                    e.getKey().length(),
-                                                    e.getValue()))
-                            .collect(java.util.stream.Collectors.joining("; "));
-            log.debug(
-                    "PDF JSON repeat scan ({}): top strings -> {}{}",
-                    label,
-                    summary,
-                    capped ? " (capped)" : "");
-        } else {
-            log.debug(
-                    "PDF JSON repeat scan ({}): no repeated strings found{}",
-                    label,
-                    capped ? " (capped)" : "");
-        }
-    }
-
-    private boolean looksLikeBase64(String value) {
-        if (value.length() < 32) {
-            return false;
-        }
-        int base64Chars = 0;
-        for (int i = 0; i < value.length(); i++) {
-            char c = value.charAt(i);
-            if ((c >= 'A' && c <= 'Z')
-                    || (c >= 'a' && c <= 'z')
-                    || (c >= '0' && c <= '9')
-                    || c == '+'
-                    || c == '/'
-                    || c == '=') {
-                base64Chars++;
-            }
-        }
-        return base64Chars >= value.length() * 0.9;
-    }
-
-    private String truncateForLog(String value) {
-        int max = 64;
-        if (value.length() <= max) {
-            return value.replaceAll("[\\r\\n\\t]+", " ");
-        }
-        return value.substring(0, max).replaceAll("[\\r\\n\\t]+", " ") + "...";
-    }
-
    /**
     * Validate that the current user has access to the given job.
     *
@@ -9,13 +9,13 @@ import org.springframework.web.bind.annotation.ControllerAdvice;
 import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.ResponseBody;

+import com.fasterxml.jackson.databind.ObjectMapper;
+
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;

 import stirling.software.SPDF.exception.CacheUnavailableException;

-import tools.jackson.databind.ObjectMapper;
-
@ControllerAdvice(assignableTypes = ConvertPdfJsonController.class)
@Slf4j
@RequiredArgsConstructor
@@ -54,6 +54,7 @@ public class ConvertWebsiteToPDF {
            Pattern.compile("(?<![a-z0-9_])file\\s*:(?:/{1,3}|%2f|%5c|%3a|&#x2f;|&#47;)");

    private static final Pattern NUMERIC_HTML_ENTITY_PATTERN = Pattern.compile("&#(x?[0-9a-f]+);");
+    private static final int MAX_REDIRECTS = 5;

    @AutoJobPostMapping(consumes = MediaType.MULTIPART_FORM_DATA_VALUE, value = "/url/pdf")
    @Operation(
@@ -86,6 +87,12 @@ public class ConvertWebsiteToPDF {
                                .queryParam("error", "error.invalidUrlFormat")
                                .build()
                                .toUri();
+            } else if (!GeneralUtils.isUrlAllowedForServerFetch(URL)) {
+                location =
+                        uriComponentsBuilder
+                                .queryParam("error", "error.invalidUrlFormat")
+                                .build()
+                                .toUri();
            } else if (!GeneralUtils.isURLReachable(URL)) {
                // validate the URL is reachable
                location =
@@ -170,25 +177,56 @@ public class ConvertWebsiteToPDF {
                        .connectTimeout(Duration.ofSeconds(10))
                        .build();

-        HttpRequest request =
-                HttpRequest.newBuilder(URI.create(url))
-                        .timeout(Duration.ofSeconds(20))
-                        .GET()
-                        .header("User-Agent", "Stirling-PDF/URL-to-PDF")
-                        .build();
+        URI currentUri = URI.create(url);
+        for (int redirectCount = 0; redirectCount <= MAX_REDIRECTS; redirectCount++) {
+            String currentUrl = currentUri.toString();
+            if (!GeneralUtils.isUrlAllowedForServerFetch(currentUrl)) {
+                throw ExceptionUtils.createIOException(
+                        "error.invalidUrlFormat",
+                        "Disallowed URL target: {0}",
+                        null,
+                        currentUrl);
+            }

-        HttpResponse<String> response =
-                client.send(request, HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));
+            HttpRequest request =
+                    HttpRequest.newBuilder(currentUri)
+                            .timeout(Duration.ofSeconds(20))
+                            .GET()
+                            .header("User-Agent", "Stirling-PDF/URL-to-PDF")
+                            .build();

-        if (response.statusCode() >= 300 || response.body() == null) {
-            throw ExceptionUtils.createIOException(
-                    "error.httpRequestFailed",
-                    "Failed to retrieve remote HTML. Status: {0}",
-                    null,
-                    response.statusCode());
+            HttpResponse<String> response =
+                    client.send(
+                            request, HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));
+
+            int statusCode = response.statusCode();
+            if (statusCode >= 300 && statusCode < 400) {
+                String location = response.headers().firstValue("location").orElse(null);
+                if (location == null || location.isBlank()) {
+                    throw ExceptionUtils.createIOException(
+                            "error.httpRequestFailed",
+                            "Redirect response missing Location header",
+                            null);
+                }
+                currentUri = currentUri.resolve(location);
+                continue;
+            }
+
+            if (statusCode >= 400 || response.body() == null) {
+                throw ExceptionUtils.createIOException(
+                        "error.httpRequestFailed",
+                        "Failed to retrieve remote HTML. Status: {0}",
+                        null,
+                        statusCode);
+            }
+
+            return response.body();
        }

-        return response.body();
+        throw ExceptionUtils.createIOException(
+                "error.httpRequestFailed",
+                "Too many redirects while retrieving remote HTML",
+                null);
    }

    private boolean containsDisallowedUriScheme(String htmlContent) {
@@ -948,6 +948,12 @@ public class CompressController {
        boolean autoMode = false;
        if (expectedOutputSizeString != null && expectedOutputSizeString.length() > 1) {
            expectedOutputSize = GeneralUtils.convertSizeToBytes(expectedOutputSizeString);
+            if (expectedOutputSize == null || expectedOutputSize <= 0) {
+                throw ExceptionUtils.createIllegalArgumentException(
+                        "error.invalidArgument",
+                        "Invalid argument: {0}",
+                        "expected output size: " + expectedOutputSizeString);
+            }
            autoMode = true;
        }

@@ -1,6 +1,5 @@
 package stirling.software.SPDF.controller.api.misc;

-import java.util.Collection;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -12,6 +11,9 @@ import org.springframework.web.bind.annotation.RequestParam;

 import io.swagger.v3.oas.annotations.Hidden;

+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Size;
+
 import lombok.extern.slf4j.Slf4j;

 import stirling.software.SPDF.config.EndpointConfiguration;
@@ -33,7 +35,6 @@ public class ConfigController {
    private final EndpointConfiguration endpointConfiguration;
    private final ServerCertificateServiceInterface serverCertificateService;
    private final UserServiceInterface userService;
-    private final stirling.software.common.service.LicenseServiceInterface licenseService;
    private final stirling.software.SPDF.config.ExternalAppDepConfig externalAppDepConfig;

    public ConfigController(
@@ -44,66 +45,15 @@ public class ConfigController {
                    ServerCertificateServiceInterface serverCertificateService,
            @org.springframework.beans.factory.annotation.Autowired(required = false)
                    UserServiceInterface userService,
-            @org.springframework.beans.factory.annotation.Autowired(required = false)
-                    stirling.software.common.service.LicenseServiceInterface licenseService,
            stirling.software.SPDF.config.ExternalAppDepConfig externalAppDepConfig) {
        this.applicationProperties = applicationProperties;
        this.applicationContext = applicationContext;
        this.endpointConfiguration = endpointConfiguration;
        this.serverCertificateService = serverCertificateService;
        this.userService = userService;
-        this.licenseService = licenseService;
        this.externalAppDepConfig = externalAppDepConfig;
    }

-    /**
-     * Get current license type dynamically instead of from cached bean. This ensures the frontend
-     * sees updated license status after admin changes the license key.
-     */
-    private String getCurrentLicenseType() {
-        // Use LicenseService for fresh license status if available
-        if (licenseService != null) {
-            return licenseService.getLicenseTypeName();
-        }
-
-        // Fallback to cached bean if service not available
-        if (applicationContext.containsBean("license")) {
-            return applicationContext.getBean("license", String.class);
-        }
-
-        return null;
-    }
-
-    /** Check if running Pro or higher (SERVER or ENTERPRISE license) dynamically. */
-    private Boolean isRunningProOrHigher() {
-        // Use LicenseService for fresh license status if available
-        if (licenseService != null) {
-            return licenseService.isRunningProOrHigher();
-        }
-
-        // Fallback to cached bean
-        if (applicationContext.containsBean("runningProOrHigher")) {
-            return applicationContext.getBean("runningProOrHigher", Boolean.class);
-        }
-
-        return null;
-    }
-
-    /** Check if running Enterprise edition dynamically. */
-    private Boolean isRunningEE() {
-        // Use LicenseService for fresh license status if available
-        if (licenseService != null) {
-            return licenseService.isRunningEE();
-        }
-
-        // Fallback to cached bean
-        if (applicationContext.containsBean("runningEE")) {
-            return applicationContext.getBean("runningEE", Boolean.class);
-        }
-
-        return null;
-    }
-
    @GetMapping("/app-config")
    public ResponseEntity<Map<String, Object>> getAppConfig() {
        Map<String, Object> configData = new HashMap<>();
@@ -151,14 +101,6 @@ public class ConfigController {
            configData.put("logoStyle", applicationProperties.getUi().getLogoStyle());
            configData.put("defaultLocale", applicationProperties.getSystem().getDefaultLocale());

-            // User preference defaults
-            configData.put(
-                    "defaultHideUnavailableTools",
-                    applicationProperties.getUi().isDefaultHideUnavailableTools());
-            configData.put(
-                    "defaultHideUnavailableConversions",
-                    applicationProperties.getUi().isDefaultHideUnavailableConversions());
-
            // Security settings
            // enableLogin requires both the config flag AND proprietary features to be loaded
            // If userService is null, proprietary module isn't loaded
@@ -170,16 +112,6 @@ public class ConfigController {
                    "showSettingsWhenNoLogin",
                    applicationProperties.getSystem().isShowSettingsWhenNoLogin());

-            // SSO Provider settings
-            boolean enableOAuth =
-                    applicationProperties.getSecurity().getOauth2() != null
-                            && applicationProperties.getSecurity().getOauth2().getEnabled();
-            boolean enableSaml =
-                    applicationProperties.getSecurity().getSaml2() != null
-                            && applicationProperties.getSecurity().getSaml2().getEnabled();
-            configData.put("enableOAuth", enableOAuth);
-            configData.put("enableSaml", enableSaml);
-
            // Mail settings - check both SMTP enabled AND invites enabled
            boolean smtpEnabled = applicationProperties.getMail().isEnabled();
            boolean invitesEnabled = applicationProperties.getMail().isEnableInvites();
@@ -243,23 +175,19 @@ public class ConfigController {
                    applicationProperties.getLegal().getAccessibilityStatement());

            // Try to get EEAppConfig values if available
-            // Get these dynamically to reflect current license status (not cached at startup)
            try {
-                Boolean runningProOrHigher = isRunningProOrHigher();
-                if (runningProOrHigher != null) {
-                    configData.put("runningProOrHigher", runningProOrHigher);
+                if (applicationContext.containsBean("runningProOrHigher")) {
+                    configData.put(
+                            "runningProOrHigher",
+                            applicationContext.getBean("runningProOrHigher", Boolean.class));
                }
-
-                Boolean runningEE = isRunningEE();
-                if (runningEE != null) {
-                    configData.put("runningEE", runningEE);
+                if (applicationContext.containsBean("runningEE")) {
+                    configData.put(
+                            "runningEE", applicationContext.getBean("runningEE", Boolean.class));
                }
-
-                String licenseType = getCurrentLicenseType();
-                if (licenseType != null) {
-                    configData.put("license", licenseType);
+                if (applicationContext.containsBean("license")) {
+                    configData.put("license", applicationContext.getBean("license", String.class));
                }
-
                if (applicationContext.containsBean("SSOAutoLogin")) {
                    configData.put(
                            "SSOAutoLogin",
@@ -318,13 +246,11 @@ public class ConfigController {

    @GetMapping("/endpoints-availability")
    public ResponseEntity<Map<String, EndpointAvailability>> getEndpointAvailability(
-            @RequestParam(name = "endpoints", required = false) List<String> endpoints) {
-        Collection<String> toCheck =
-                (endpoints == null || endpoints.isEmpty())
-                        ? endpointConfiguration.getAllEndpoints()
-                        : endpoints;
+            @RequestParam(name = "endpoints")
+                    @Size(min = 1, max = 100, message = "Must provide between 1 and 100 endpoints")
+                    List<@NotBlank String> endpoints) {
        Map<String, EndpointAvailability> result = new HashMap<>();
-        for (String endpoint : toCheck) {
+        for (String endpoint : endpoints) {
            String trimmedEndpoint = endpoint.trim();
            result.put(
                    trimmedEndpoint,
@@ -82,8 +82,9 @@ public class ExtractImagesController {
        Set<byte[]> processedImages = new HashSet<>();

        if (useMultithreading) {
-            // Virtual thread executor — lightweight threads ideal for I/O-bound image extraction
-            ExecutorService executor = Executors.newVirtualThreadPerTaskExecutor();
+            // Executor service to handle multithreading
+            ExecutorService executor =
+                    Executors.newFixedThreadPool(Runtime.getRuntime().availableProcessors());
            Set<Future<Void>> futures = new HashSet<>();

            // Safely iterate over each page, handling corrupt PDFs where page count might be wrong
@@ -246,12 +246,10 @@ public class OCRController {
            command.add("--clean-final");
        }
        if (ocrType != null && !ocrType.isEmpty()) {
-            if ("force-ocr".equals(ocrType)) {
-                command.add("--force-ocr");
-            } else {
-                // Default for 'Normal' and 'skip-text': use --skip-text
-                // ocrmypdf 17+ requires explicit flag when PDF already contains text
+            if ("skip-text".equals(ocrType)) {
                command.add("--skip-text");
+            } else if ("force-ocr".equals(ocrType)) {
+                command.add("--force-ocr");
            }
        }
        command.add("--invalidate-digital-signatures");
@@ -380,12 +378,11 @@ public class OCRController {
                        List<String> command = new ArrayList<>();
                        command.add("tesseract");
                        command.add(imagePath.toString());
-                        String outputBase =
+                        command.add(
                                new File(
                                                tempOutputDir,
                                                String.format(Locale.ROOT, "page_%d", pageNum))
-                                        .toString();
-                        command.add(outputBase);
+                                        .toString());
                        command.add("-l");
                        command.add(String.join("+", selectedLanguages));
                        command.add("pdf"); // Always output PDF
@@ -403,18 +400,6 @@ public class OCRController {
                                    result.getRc());
                        }

-                        // Verify the OCR'd PDF was created
-                        if (!pageOutputPath.exists()) {
-                            log.warn(
-                                    "Tesseract did not create expected output file: {}. Page may be blank or unreadable.",
-                                    pageOutputPath.getAbsolutePath());
-                            // Save original page without OCR as fallback
-                            try (PDDocument pageDoc = new PDDocument()) {
-                                pageDoc.addPage(page);
-                                pageDoc.save(pageOutputPath);
-                            }
-                        }
-
                        // Add OCR'd PDF to merger
                        merger.addSource(pageOutputPath);
                    } else {
@@ -55,45 +55,45 @@ public class OverlayImageController {

            boolean isSvg = SvgOverlayUtil.isSvgImage(imageBytes);

-            try (PDDocument document = pdfDocumentFactory.load(pdfBytes)) {
-                int pages = document.getNumberOfPages();
-                for (int i = 0; i < pages; i++) {
-                    PDPage page = document.getPage(i);
+            PDDocument document = pdfDocumentFactory.load(pdfBytes);

-                    if (isSvg) {
-                        SvgOverlayUtil.overlaySvgOnPage(document, page, imageBytes, x, y);
-                    } else {
-                        try (PDPageContentStream contentStream =
-                                new PDPageContentStream(
-                                        document,
-                                        page,
-                                        PDPageContentStream.AppendMode.APPEND,
-                                        true,
-                                        true)) {
-                            PDImageXObject image =
-                                    PDImageXObject.createFromByteArray(document, imageBytes, "");
-                            contentStream.drawImage(image, x, y);
-                            log.info("Image successfully overlaid onto PDF page {}", i);
-                        }
-                    }
+            int pages = document.getNumberOfPages();
+            for (int i = 0; i < pages; i++) {
+                PDPage page = document.getPage(i);

-                    if (!everyPage && i == 0) {
-                        break;
+                if (isSvg) {
+                    SvgOverlayUtil.overlaySvgOnPage(document, page, imageBytes, x, y);
+                } else {
+                    try (PDPageContentStream contentStream =
+                            new PDPageContentStream(
+                                    document,
+                                    page,
+                                    PDPageContentStream.AppendMode.APPEND,
+                                    true,
+                                    true)) {
+                        PDImageXObject image =
+                                PDImageXObject.createFromByteArray(document, imageBytes, "");
+                        contentStream.drawImage(image, x, y);
+                        log.info("Image successfully overlaid onto PDF page {}", i);
                    }
                }

-                ByteArrayOutputStream baos = new ByteArrayOutputStream();
-                document.save(baos);
-
-                byte[] result = baos.toByteArray();
-                log.info("PDF with overlaid image successfully created");
-
-                return WebResponseUtils.bytesToWebResponse(
-                        result,
-                        GeneralUtils.generateFilename(
-                                pdfFile.getOriginalFilename(), "_overlayed.pdf"));
+                if (!everyPage && i == 0) {
+                    break;
+                }
            }

+            ByteArrayOutputStream baos = new ByteArrayOutputStream();
+            document.save(baos);
+            document.close();
+
+            byte[] result = baos.toByteArray();
+            log.info("PDF with overlaid image successfully created");
+
+            return WebResponseUtils.bytesToWebResponse(
+                    result,
+                    GeneralUtils.generateFilename(pdfFile.getOriginalFilename(), "_overlayed.pdf"));
+
        } catch (IOException e) {
            log.error("Failed to add image to PDF", e);
            return new ResponseEntity<>(HttpStatus.BAD_REQUEST);
@@ -52,17 +52,9 @@ public class PageNumbersController {
        int pageNumber = request.getStartingNumber();
        String pagesToNumber = request.getPagesToNumber();
        String customText = request.getCustomText();
-        int zeroPad = request.getZeroPad();
        float fontSize = request.getFontSize();
        String fontType = request.getFontType();
        String fontColor = request.getFontColor();
-        // compute padded number string where requested
-        String formatN;
-        if (zeroPad > 0) {
-            formatN = String.format("%%0%dd", Math.max(0, zeroPad));
-        } else {
-            formatN = "%d";
-        }

        Color color = Color.BLACK;
        if (fontColor != null && !fontColor.trim().isEmpty()) {
@@ -101,10 +93,9 @@ public class PageNumbersController {
                PDPage page = document.getPage(i);
                PDRectangle pageSize = page.getMediaBox();

-                String nFormatted = String.format(formatN, pageNumber);
                String text =
                        customText
-                                .replace("{n}", nFormatted)
+                                .replace("{n}", String.valueOf(pageNumber))
                                .replace("{total}", String.valueOf(document.getNumberOfPages()))
                                .replace(
                                        "{filename}",
@@ -7,13 +7,11 @@ import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
-import java.time.LocalDateTime;
+import java.time.LocalDate;
+import java.time.LocalTime;
 import java.time.format.DateTimeFormatter;
 import java.util.List;
 import java.util.Locale;
-import java.util.UUID;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;

 import javax.imageio.ImageIO;

@@ -57,17 +55,9 @@ import stirling.software.common.util.WebResponseUtils;
@RequiredArgsConstructor
 public class StampController {

-    private static final Pattern NEWLINE_PATTERN = Pattern.compile("\\r?\\n");
    private final CustomPDFDocumentFactory pdfDocumentFactory;
    private final TempFileManager tempFileManager;

-    private static final int MAX_DATE_FORMAT_LENGTH = 50;
-    private static final Pattern SAFE_DATE_FORMAT_PATTERN =
-            Pattern.compile("^[yMdHhmsS/\\-:\\s.,'+EGuwWDFzZXa]+$");
-    private static final Pattern CUSTOM_DATE_PATTERN = Pattern.compile("@date\\{([^}]{1,50})\\}");
-    // Placeholder for escaped @ symbol (using Unicode private use area)
-    private static final String ESCAPED_AT_PLACEHOLDER = "\uE000ESCAPED_AT\uE000";
-
    /**
     * Initialize data binder for multipart file uploads. This method registers a custom editor for
     * MultipartFile to handle file uploads. It sets the MultipartFile to null if the uploaded file
@@ -176,9 +166,7 @@ public class StampController {
                                overrideX,
                                overrideY,
                                margin,
-                                customColor,
-                                pageIndex,
-                                pdfFileName);
+                                customColor);
                    } else if ("image".equalsIgnoreCase(stampType)) {
                        addImageStamp(
                                contentStream,
@@ -213,11 +201,9 @@ public class StampController {
            float fontSize,
            String alphabet,
            float overrideX, // X override
-            float overrideY, // Y override
+            float overrideY,
            float margin,
-            String colorString,
-            int currentPageNumber,
-            String filename)
+            String colorString) // Y override
            throws IOException {
        String resourceDir;
        PDFont font = new PDType1Font(Standard14Fonts.FontName.HELVETICA);
@@ -245,6 +231,8 @@ public class StampController {
            }
        }

+        contentStream.setFont(font, fontSize);
+
        Color redactColor;
        try {
            if (!colorString.startsWith("#")) {
@@ -252,54 +240,45 @@ public class StampController {
            }
            redactColor = Color.decode(colorString);
        } catch (NumberFormatException e) {
+
            redactColor = Color.LIGHT_GRAY;
        }

        contentStream.setNonStrokingColor(redactColor);

+        PDRectangle pageSize = page.getMediaBox();
+        float x, y;
+
+        if (overrideX >= 0 && overrideY >= 0) {
+            // Use override values if provided
+            x = overrideX;
+            y = overrideY;
+        } else {
+            x = calculatePositionX(pageSize, position, fontSize, font, fontSize, stampText, margin);
+            y =
+                    calculatePositionY(
+                            pageSize, position, calculateTextCapHeight(font, fontSize), margin);
+        }
+
+        String currentDate = LocalDate.now().toString();
+        String currentTime = LocalTime.now().format(DateTimeFormatter.ofPattern("HH:mm:ss"));
+
        int pageCount = document.getNumberOfPages();

        String processedStampText =
-                processStampText(stampText, currentPageNumber, pageCount, filename, document);
+                stampText
+                        .replace("@date", currentDate)
+                        .replace("@time", currentTime)
+                        .replace("@page_count", String.valueOf(pageCount));

-        String normalizedText =
-                RegexPatternUtils.getInstance()
-                        .getEscapedNewlinePattern()
-                        .matcher(processedStampText)
-                        .replaceAll("\n");
-        String[] lines = NEWLINE_PATTERN.split(normalizedText);
-
-        PDRectangle pageSize = page.getMediaBox();
-
-        // Use fontSize directly (default 40 if not specified)
-        float effectiveFontSize = fontSize > 0 ? fontSize : 40f;
-
-        contentStream.setFont(font, effectiveFontSize);
+        // Split the stampText into multiple lines
+        String[] lines =
+                RegexPatternUtils.getInstance().getEscapedNewlinePattern().split(stampText);

        // Calculate dynamic line height based on font ascent and descent
        float ascent = font.getFontDescriptor().getAscent();
        float descent = font.getFontDescriptor().getDescent();
-        float lineHeight = ((ascent - descent) / 1000) * effectiveFontSize;
-
-        float maxLineWidth = 0;
-        for (String line : lines) {
-            float lineWidth = calculateTextWidth(line, font, effectiveFontSize);
-            if (lineWidth > maxLineWidth) {
-                maxLineWidth = lineWidth;
-            }
-        }
-
-        float totalTextHeight = lines.length * lineHeight;
-
-        float x, y;
-
-        if (overrideX >= 0 && overrideY >= 0) {
-            x = overrideX;
-            y = overrideY;
-        } else {
-            x = calculatePositionX(pageSize, position, maxLineWidth, margin);
-            y = calculatePositionY(pageSize, position, totalTextHeight, margin);
-        }
+        float lineHeight = ((ascent - descent) / 1000) * fontSize;

        contentStream.beginText();
        for (int i = 0; i < lines.length; i++) {
@@ -312,140 +291,6 @@ public class StampController {
        contentStream.endText();
    }

-    /**
-     * Process stamp text by replacing all @commands with their actual values. Supported commands:
-     *
-     * <p>Date & Time:
-     *
-     * <ul>
-     *   <li>@date - Current date (YYYY-MM-DD)
-     *   <li>@time - Current time (HH:mm:ss)
-     *   <li>@datetime - Current date and time (YYYY-MM-DD HH:mm:ss)
-     *   <li>@date{format} - Custom date/time format (e.g., @date{dd/MM/yyyy})
-     *   <li>@year - Current year (4 digits)
-     *   <li>@month - Current month (01-12)
-     *   <li>@day - Current day of month (01-31)
-     * </ul>
-     *
-     * <p>Page Information:
-     *
-     * <ul>
-     *   <li>@page_number or @page - Current page number
-     *   <li>@total_pages or @page_count - Total number of pages
-     * </ul>
-     *
-     * <p>File Information:
-     *
-     * <ul>
-     *   <li>@filename - Original filename (without extension)
-     *   <li>@filename_full - Original filename (with extension)
-     * </ul>
-     *
-     * <p>Document Metadata:
-     *
-     * <ul>
-     *   <li>@author - Document author (from PDF metadata)
-     *   <li>@title - Document title (from PDF metadata)
-     *   <li>@subject - Document subject (from PDF metadata)
-     * </ul>
-     *
-     * <p>Other:
-     *
-     * <ul>
-     *   <li>@uuid - Short unique identifier (8 characters)
-     * </ul>
-     */
-    private String processStampText(
-            String stampText,
-            int currentPageNumber,
-            int totalPages,
-            String filename,
-            PDDocument document) {
-        if (stampText == null || stampText.isEmpty()) {
-            return "";
-        }
-
-        // Handle escaped @@ sequences first - replace with placeholder to preserve literal @
-        String result = stampText.replace("@@", ESCAPED_AT_PLACEHOLDER);
-
-        LocalDateTime now = LocalDateTime.now();
-        String currentDate = now.toLocalDate().toString();
-        String currentTime = now.toLocalTime().format(DateTimeFormatter.ofPattern("HH:mm:ss"));
-        String currentDateTime = now.format(DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss"));
-
-        String filenameWithoutExt = filename != null ? filename : "";
-        if (filename != null && filename.contains(".")) {
-            int lastDot = filename.lastIndexOf('.');
-            if (lastDot > 0) { // Ensure there's actually a name before the dot
-                filenameWithoutExt = filename.substring(0, lastDot);
-            }
-        }
-
-        String author = "";
-        String title = "";
-        String subject = "";
-        if (document != null && document.getDocumentInformation() != null) {
-            var info = document.getDocumentInformation();
-            author = info.getAuthor() != null ? info.getAuthor() : "";
-            title = info.getTitle() != null ? info.getTitle() : "";
-            subject = info.getSubject() != null ? info.getSubject() : "";
-        }
-
-        String uuid = UUID.randomUUID().toString().substring(0, 8);
-
-        // Process @date{format} with custom format first (must be before simple @date)
-        Matcher matcher = CUSTOM_DATE_PATTERN.matcher(result);
-        StringBuilder sb = new StringBuilder();
-        while (matcher.find()) {
-            String format = matcher.group(1);
-            String replacement = processCustomDateFormat(format, now);
-            matcher.appendReplacement(sb, Matcher.quoteReplacement(replacement));
-        }
-        matcher.appendTail(sb);
-        result = sb.toString();
-
-        result =
-                result.replace("@datetime", currentDateTime)
-                        .replace("@date", currentDate)
-                        .replace("@time", currentTime)
-                        .replace("@year", String.valueOf(now.getYear()))
-                        .replace("@month", String.format("%02d", now.getMonthValue()))
-                        .replace("@day", String.format("%02d", now.getDayOfMonth()))
-                        .replace("@page_number", String.valueOf(currentPageNumber))
-                        .replace(
-                                "@page_count", String.valueOf(totalPages)) // Must come before @page
-                        .replace("@total_pages", String.valueOf(totalPages))
-                        .replace(
-                                "@page",
-                                String.valueOf(currentPageNumber)) // Must come after @page_count
-                        .replace("@filename_full", filename != null ? filename : "")
-                        .replace("@filename", filenameWithoutExt)
-                        .replace("@author", author)
-                        .replace("@title", title)
-                        .replace("@subject", subject)
-                        .replace("@uuid", uuid);
-
-        result = result.replace(ESCAPED_AT_PLACEHOLDER, "@");
-
-        return result;
-    }
-
-    private String processCustomDateFormat(String format, LocalDateTime now) {
-        if (format == null || format.length() > MAX_DATE_FORMAT_LENGTH) {
-            return "[invalid format: too long]";
-        }
-
-        if (!SAFE_DATE_FORMAT_PATTERN.matcher(format).matches()) {
-            return "[invalid format]";
-        }
-
-        try {
-            return now.format(DateTimeFormatter.ofPattern(format));
-        } catch (IllegalArgumentException e) {
-            return "[invalid format: " + format + "]";
-        }
-    }
-
    private void addImageStamp(
            PDPageContentStream contentStream,
            MultipartFile stampImage,
@@ -482,8 +327,8 @@ public class StampController {
            x = overrideX;
            y = overrideY;
        } else {
-            x = calculatePositionX(pageSize, position, desiredPhysicalWidth, margin);
-            y = calculatePositionY(pageSize, position, desiredPhysicalHeight, margin);
+            x = calculatePositionX(pageSize, position, desiredPhysicalWidth, null, 0, null, margin);
+            y = calculatePositionY(pageSize, position, fontSize, margin);
        }

        contentStream.saveGraphicsState();
@@ -494,14 +339,23 @@ public class StampController {
    }

    private float calculatePositionX(
-            PDRectangle pageSize, int position, float contentWidth, float margin) {
+            PDRectangle pageSize,
+            int position,
+            float contentWidth,
+            PDFont font,
+            float fontSize,
+            String text,
+            float margin)
+            throws IOException {
+        float actualWidth =
+                (text != null) ? calculateTextWidth(text, font, fontSize) : contentWidth;
        return switch (position % 3) {
            case 1: // Left
                yield pageSize.getLowerLeftX() + margin;
            case 2: // Center
-                yield (pageSize.getWidth() - contentWidth) / 2;
+                yield (pageSize.getWidth() - actualWidth) / 2;
            case 0: // Right
-                yield pageSize.getUpperRightX() - contentWidth - margin;
+                yield pageSize.getUpperRightX() - actualWidth - margin;
            default:
                yield 0;
        };
@@ -510,12 +364,12 @@ public class StampController {
    private float calculatePositionY(
            PDRectangle pageSize, int position, float height, float margin) {
        return switch ((position - 1) / 3) {
-            case 0: // Top - first line near the top
-                yield pageSize.getUpperRightY() - margin;
-            case 1: // Middle - center of text block at page center
-                yield (pageSize.getHeight() + height) / 2;
-            case 2: // Bottom - first line positioned so last line is at bottom margin
-                yield pageSize.getLowerLeftY() + margin + height;
+            case 0: // Top
+                yield pageSize.getUpperRightY() - height - margin;
+            case 1: // Middle
+                yield (pageSize.getHeight() - height) / 2;
+            case 2: // Bottom
+                yield pageSize.getLowerLeftY() + margin;
            default:
                yield 0;
        };
@@ -524,4 +378,8 @@ public class StampController {
    private float calculateTextWidth(String text, PDFont font, float fontSize) throws IOException {
        return font.getStringWidth(text) / 1000 * fontSize;
    }
+
+    private float calculateTextCapHeight(PDFont font, float fontSize) {
+        return font.getFontDescriptor().getCapHeight() / 1000 * fontSize;
+    }
 }
@@ -14,6 +14,10 @@ import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;

+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.JsonMappingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
 import io.swagger.v3.oas.annotations.Operation;

 import lombok.RequiredArgsConstructor;
@@ -30,10 +34,6 @@ import stirling.software.common.service.PostHogService;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.WebResponseUtils;

-import tools.jackson.core.JacksonException;
-import tools.jackson.databind.DatabindException;
-import tools.jackson.databind.ObjectMapper;
-
@PipelineApi
@Slf4j
@RequiredArgsConstructor
@@ -54,7 +54,7 @@ public class PipelineController {
                            + "Users provide files and a JSON configuration defining the sequence of operations to perform. "
                            + "Input:PDF Output:PDF/ZIP Type:MIMO")
    public ResponseEntity<byte[]> handleData(@ModelAttribute HandleDataRequest request)
-            throws DatabindException, JacksonException {
+            throws JsonMappingException, JsonProcessingException {
        MultipartFile[] files = request.getFileInput();
        String jsonString = request.getJson();
        if (files == null) {
@@ -3,7 +3,6 @@ package stirling.software.SPDF.controller.api.pipeline;
 import java.io.*;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.FileSystemException;
-import java.nio.file.FileVisitOption;
 import java.nio.file.FileVisitResult;
 import java.nio.file.Files;
 import java.nio.file.Path;
@@ -15,19 +14,19 @@ import java.time.LocalDate;
 import java.time.LocalTime;
 import java.time.format.DateTimeFormatter;
 import java.util.ArrayList;
-import java.util.EnumSet;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Locale;
 import java.util.Map;
 import java.util.Optional;
-import java.util.regex.Pattern;
 import java.util.stream.Stream;

 import org.springframework.core.io.Resource;
 import org.springframework.scheduling.annotation.Scheduled;
 import org.springframework.stereotype.Service;

+import com.fasterxml.jackson.databind.ObjectMapper;
+
 import lombok.extern.slf4j.Slf4j;

 import stirling.software.SPDF.model.PipelineConfig;
@@ -38,27 +37,18 @@ import stirling.software.common.configuration.RuntimePathConfig;
 import stirling.software.common.service.PostHogService;
 import stirling.software.common.util.FileMonitor;

-import tools.jackson.databind.ObjectMapper;
-
@Service
@Slf4j
 public class PipelineDirectoryProcessor {

-    private static final int MAX_DIRECTORY_DEPTH = 50; // Prevent excessive recursion
-    private static final Pattern WATCHED_FOLDERS_PATTERN = Pattern.compile("\\\\?watchedFolders");
-
    private final ObjectMapper objectMapper;
    private final ApiDocService apiDocService;
    private final PipelineProcessor processor;
    private final FileMonitor fileMonitor;
    private final PostHogService postHogService;
-    private final List<String> watchedFoldersDirs;
+    private final String watchedFoldersDir;
    private final String finishedFoldersDir;

-    // Track processed directories in current scan to prevent duplicates
-    private final ThreadLocal<java.util.Set<Path>> processedDirsInScan =
-            ThreadLocal.withInitial(java.util.HashSet::new);
-
    public PipelineDirectoryProcessor(
            ObjectMapper objectMapper,
            ApiDocService apiDocService,
@@ -71,26 +61,13 @@ public class PipelineDirectoryProcessor {
        this.processor = processor;
        this.fileMonitor = fileMonitor;
        this.postHogService = postHogService;
-        this.watchedFoldersDirs = runtimePathConfig.getPipelineWatchedFoldersPaths();
+        this.watchedFoldersDir = runtimePathConfig.getPipelineWatchedFoldersPath();
        this.finishedFoldersDir = runtimePathConfig.getPipelineFinishedFoldersPath();
    }

    @Scheduled(fixedRate = 60000)
    public void scanFolders() {
-        // Clear the processed directories set for this scan cycle
-        processedDirsInScan.get().clear();
-
-        try {
-            for (String watchedFoldersDir : watchedFoldersDirs) {
-                scanWatchedFolder(Paths.get(watchedFoldersDir).toAbsolutePath());
-            }
-        } finally {
-            // Clean up ThreadLocal to prevent memory leaks
-            processedDirsInScan.remove();
-        }
-    }
-
-    private void scanWatchedFolder(Path watchedFolderPath) {
+        Path watchedFolderPath = Paths.get(watchedFoldersDir).toAbsolutePath();
        if (!Files.exists(watchedFolderPath)) {
            try {
                Files.createDirectories(watchedFolderPath);
@@ -101,34 +78,16 @@ public class PipelineDirectoryProcessor {
            }
        }

-        // Validate the path is a directory and readable
-        if (!Files.isDirectory(watchedFolderPath)) {
-            log.error("Path is not a directory: {}", watchedFolderPath);
-            return;
-        }
-        if (!Files.isReadable(watchedFolderPath)) {
-            log.error("Directory is not readable: {}", watchedFolderPath);
-            return;
-        }
-
        try {
-            // Use FOLLOW_LINKS to follow symlinks, with max depth to prevent infinite loops
            Files.walkFileTree(
                    watchedFolderPath,
-                    EnumSet.of(FileVisitOption.FOLLOW_LINKS),
-                    MAX_DIRECTORY_DEPTH,
                    new SimpleFileVisitor<>() {
                        @Override
                        public FileVisitResult preVisitDirectory(
                                Path dir, BasicFileAttributes attrs) {
                            try {
-                                String dirName =
-                                        dir.getFileName() != null
-                                                ? dir.getFileName().toString()
-                                                : "";
                                // Skip root directory and "processing" subdirectories
-                                if (!dir.equals(watchedFolderPath)
-                                        && !"processing".equals(dirName)) {
+                                if (!dir.equals(watchedFolderPath) && !dir.endsWith("processing")) {
                                    handleDirectory(dir);
                                }
                            } catch (Exception e) {
@@ -139,11 +98,8 @@ public class PipelineDirectoryProcessor {

                        @Override
                        public FileVisitResult visitFileFailed(Path path, IOException exc) {
-                            // Handle broken symlinks, permission issues, or inaccessible
-                            // directories
-                            if (exc != null) {
-                                log.debug("Cannot access path '{}': {}", path, exc.getMessage());
-                            }
+                            // Handle broken symlinks or inaccessible directories
+                            log.error("Error accessing path: {}", path, exc);
                            return FileVisitResult.CONTINUE;
                        }
                    });
@@ -153,17 +109,6 @@ public class PipelineDirectoryProcessor {
    }

    public void handleDirectory(Path dir) throws IOException {
-        // Normalize path to absolute to prevent duplicate processing from different path
-        // representations
-        Path normalizedDir = dir.toAbsolutePath().normalize();
-
-        // Check if we've already processed this directory in this scan cycle
-        java.util.Set<Path> processedDirs = processedDirsInScan.get();
-        if (!processedDirs.add(normalizedDir)) {
-            log.debug("Directory already processed in this scan cycle: {}", normalizedDir);
-            return;
-        }
-
        log.info("Handling directory: {}", dir);
        Path processingDir = createProcessingDirectory(dir);
        Optional<Path> jsonFileOptional = findJsonFile(dir);
@@ -435,12 +380,10 @@ public class PipelineDirectoryProcessor {

    private Path determineOutputPath(PipelineConfig config, Path dir) {
        String outputDir =
-                WATCHED_FOLDERS_PATTERN
-                        .matcher(
-                                config.getOutputDir()
-                                        .replace("{outputFolder}", finishedFoldersDir)
-                                        .replace("{folderName}", dir.toString()))
-                        .replaceAll("");
+                config.getOutputDir()
+                        .replace("{outputFolder}", finishedFoldersDir)
+                        .replace("{folderName}", dir.toString())
+                        .replaceAll("\\\\?watchedFolders", "");
        return Paths.get(outputDir).isAbsolute() ? Paths.get(outputDir) : Paths.get(".", outputDir);
    }

@@ -3,15 +3,21 @@ package stirling.software.SPDF.controller.api.security;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.time.Instant;
 import java.time.ZoneId;
 import java.time.ZonedDateTime;
 import java.time.format.DateTimeFormatter;
 import java.util.*;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;

 import org.apache.pdfbox.cos.COSInputStream;
 import org.apache.pdfbox.cos.COSName;
 import org.apache.pdfbox.cos.COSString;
+import org.apache.pdfbox.io.RandomAccessRead;
+import org.apache.pdfbox.io.RandomAccessReadBufferedFile;
 import org.apache.pdfbox.pdmodel.*;
 import org.apache.pdfbox.pdmodel.common.PDMetadata;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
@@ -29,7 +35,8 @@ import org.apache.pdfbox.pdmodel.graphics.form.PDFormXObject;
 import org.apache.pdfbox.pdmodel.graphics.image.PDImageXObject;
 import org.apache.pdfbox.pdmodel.graphics.optionalcontent.PDOptionalContentGroup;
 import org.apache.pdfbox.pdmodel.graphics.optionalcontent.PDOptionalContentProperties;
-import org.apache.pdfbox.pdmodel.interactive.action.*;
+import org.apache.pdfbox.pdmodel.interactive.action.PDActionJavaScript;
+import org.apache.pdfbox.pdmodel.interactive.action.PDActionURI;
 import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotation;
 import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationFileAttachment;
 import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationLink;
@@ -37,8 +44,14 @@ import org.apache.pdfbox.pdmodel.interactive.documentnavigation.outline.PDOutlin
 import org.apache.pdfbox.pdmodel.interactive.documentnavigation.outline.PDOutlineNode;
 import org.apache.pdfbox.pdmodel.interactive.form.PDAcroForm;
 import org.apache.pdfbox.pdmodel.interactive.form.PDField;
+import org.apache.pdfbox.preflight.PreflightDocument;
+import org.apache.pdfbox.preflight.ValidationResult;
+import org.apache.pdfbox.preflight.exception.SyntaxValidationException;
+import org.apache.pdfbox.preflight.exception.ValidationException;
+import org.apache.pdfbox.preflight.parser.PreflightParser;
 import org.apache.pdfbox.text.PDFTextStripper;
 import org.apache.xmpbox.XMPMetadata;
+import org.apache.xmpbox.schema.PDFAIdentificationSchema;
 import org.apache.xmpbox.xml.DomXmpParser;
 import org.apache.xmpbox.xml.XmpParsingException;
 import org.apache.xmpbox.xml.XmpSerializer;
@@ -47,13 +60,15 @@ import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;

+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ArrayNode;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+
 import io.swagger.v3.oas.annotations.Operation;

 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;

-import stirling.software.SPDF.model.api.security.PDFVerificationResult;
-import stirling.software.SPDF.service.VeraPDFService;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.SecurityApi;
 import stirling.software.common.model.api.PDFFile;
@@ -62,11 +77,6 @@ import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.RegexPatternUtils;
 import stirling.software.common.util.WebResponseUtils;

-import tools.jackson.databind.ObjectMapper;
-import tools.jackson.databind.json.JsonMapper;
-import tools.jackson.databind.node.ArrayNode;
-import tools.jackson.databind.node.ObjectNode;
-
@SecurityApi
@Slf4j
@RequiredArgsConstructor
@@ -78,10 +88,9 @@ public class GetInfoOnPDF {
    private static final String PAGE_PREFIX = "Page ";
    private static final long MAX_FILE_SIZE = 100L * 1024 * 1024;

-    private static final ObjectMapper objectMapper = JsonMapper.builder().build();
+    private static final ObjectMapper objectMapper = new ObjectMapper();

    private final CustomPDFDocumentFactory pdfDocumentFactory;
-    private final VeraPDFService veraPDFService;

    private static void addOutlinesToArray(PDOutlineItem outline, ArrayNode arrayNode) {
        if (outline == null) return;
@@ -98,8 +107,214 @@ public class GetInfoOnPDF {
        }
    }

+    public static boolean checkForStandard(PDDocument document, String standardKeyword) {
+        if ("PDF/A".equalsIgnoreCase(standardKeyword)) {
+            return getPdfAConformanceLevel(document) != null;
+        }
+
+        return checkStandardInMetadata(document, standardKeyword);
+    }
+
+    public static String getPdfAConformanceLevel(PDDocument document) {
+        if (document == null || document.isEncrypted()) {
+            return null;
+        }
+
+        return getPdfAVersionFromMetadata(document);
+    }
+
+    private static String getPdfAVersionFromMetadata(PDDocument document) {
+        try {
+            PDMetadata pdMetadata = document.getDocumentCatalog().getMetadata();
+            if (pdMetadata != null) {
+                try (COSInputStream metaStream = pdMetadata.createInputStream()) {
+                    DomXmpParser domXmpParser = new DomXmpParser();
+                    XMPMetadata xmpMeta = domXmpParser.parse(metaStream);
+
+                    PDFAIdentificationSchema pdfId = xmpMeta.getPDFAIdentificationSchema();
+                    if (pdfId != null) {
+                        Integer part = pdfId.getPart();
+                        String conformance = pdfId.getConformance();
+
+                        if (part != null && conformance != null) {
+                            return part + conformance.toUpperCase(Locale.ROOT);
+                        }
+                    } else {
+                        try (COSInputStream rawStream = pdMetadata.createInputStream()) {
+                            byte[] metadataBytes = rawStream.readAllBytes();
+                            String rawMetadata = new String(metadataBytes, StandardCharsets.UTF_8);
+                            String extracted = extractPdfAVersionFromRawXml(rawMetadata);
+                            if (extracted != null) {
+                                return extracted;
+                            }
+                        }
+                    }
+                } catch (XmpParsingException e) {
+                    log.debug("XMP parsing failed, trying raw metadata search: {}", e.getMessage());
+                    try (COSInputStream metaStream = pdMetadata.createInputStream()) {
+                        byte[] metadataBytes = metaStream.readAllBytes();
+                        String rawMetadata = new String(metadataBytes, StandardCharsets.UTF_8);
+                        String extracted = extractPdfAVersionFromRawXml(rawMetadata);
+                        if (extracted != null) {
+                            return extracted;
+                        }
+                    }
+                }
+            }
+        } catch (Exception e) {
+            log.debug("Error reading PDF/A metadata: {}", e.getMessage());
+        }
+
+        return null;
+    }
+
+    private static String extractPdfAVersionFromRawXml(String rawXml) {
+        if (rawXml == null || rawXml.isEmpty()) {
+            return null;
+        }
+
+        try {
+            Pattern partPattern = RegexPatternUtils.getInstance().getPdfAidPartPattern();
+            Pattern confPattern = RegexPatternUtils.getInstance().getPdfAidConformancePattern();
+
+            Matcher partMatcher = partPattern.matcher(rawXml);
+            Matcher confMatcher = confPattern.matcher(rawXml);
+
+            if (partMatcher.find() && confMatcher.find()) {
+                String part = partMatcher.group(1);
+                String conformance = confMatcher.group(1).toUpperCase(Locale.ROOT);
+                return part + conformance;
+            }
+        } catch (Exception e) {
+            log.debug("Error parsing raw XMP for PDF/A version: {}", e.getMessage());
+        }
+
+        return null;
+    }
+
+    private static boolean validatePdfAWithPreflight(PDDocument document, String version) {
+        if (document == null || document.isEncrypted()) {
+            return false;
+        }
+
+        // Use Stream-to-File pattern: save to temp file instead of loading into memory
+        // This prevents OutOfMemoryError on large PDFs
+        Path tempFile = null;
+        try {
+            tempFile = Files.createTempFile("preflight-", ".pdf");
+
+            // Save document to temp file (avoids loading entire document into memory)
+            try (var outputStream = Files.newOutputStream(tempFile)) {
+                document.save(outputStream);
+            }
+
+            // Use RandomAccessReadBufferedFile for efficient file-based reading
+            // This avoids Windows file locking issues that occur with memory-mapped files
+            try (RandomAccessRead source = new RandomAccessReadBufferedFile(tempFile.toFile())) {
+                PreflightParser parser = new PreflightParser(source);
+
+                try (PDDocument parsedDocument = parser.parse()) {
+                    if (!(parsedDocument instanceof PreflightDocument preflightDocument)) {
+                        log.debug(
+                                "Parsed document is not a PreflightDocument; unable to validate claimed PDF/A {}",
+                                version);
+                        return false;
+                    }
+
+                    try {
+                        ValidationResult result = preflightDocument.validate();
+                        if (!result.isValid() && log.isDebugEnabled()) {
+                            log.debug(
+                                    "PDF/A validation found {} errors for claimed version {}",
+                                    result.getErrorsList().size(),
+                                    version);
+                            int logged = 0;
+                            for (ValidationResult.ValidationError error : result.getErrorsList()) {
+                                log.debug(
+                                        "  Error {}: {}", error.getErrorCode(), error.getDetails());
+                                if (++logged >= MAX_LOGGED_ERRORS) {
+                                    break;
+                                }
+                            }
+                        }
+                        return result.isValid();
+                    } catch (ValidationException e) {
+                        log.debug(
+                                "Validation exception during PDF/A validation: {}", e.getMessage());
+                    }
+                } catch (SyntaxValidationException e) {
+                    log.debug(
+                            "Syntax validation failed during PDF/A validation: {}", e.getMessage());
+                    return false;
+                }
+            }
+        } catch (IOException e) {
+            log.debug("IOException during PDF/A validation: {}", e.getMessage());
+        } catch (Exception e) {
+            log.debug("Unexpected error during PDF/A validation: {}", e.getMessage());
+        } finally {
+            // Explicitly clean up temp file to prevent disk exhaustion
+            // This must be in finally block to ensure cleanup even on exceptions
+            if (tempFile != null) {
+                try {
+                    Files.deleteIfExists(tempFile);
+                } catch (IOException e) {
+                    log.warn(
+                            "Failed to delete temp file during PDF/A validation cleanup: {}",
+                            tempFile,
+                            e);
+                }
+            }
+        }
+
+        return false;
+    }
+
+    private static boolean checkStandardInMetadata(PDDocument document, String standardKeyword) {
+        // Check XMP Metadata
+        try {
+            PDMetadata pdMetadata = document.getDocumentCatalog().getMetadata();
+            if (pdMetadata != null) {
+                try (COSInputStream metaStream = pdMetadata.createInputStream()) {
+                    // First try to read raw metadata as string to check for standard keywords
+                    byte[] metadataBytes = metaStream.readAllBytes();
+                    String rawMetadata = new String(metadataBytes, StandardCharsets.UTF_8);
+
+                    if (rawMetadata.contains(standardKeyword)) {
+                        return true;
+                    }
+                }
+
+                // If raw check doesn't find it, try parsing with XMP parser
+                try (COSInputStream metaStream = pdMetadata.createInputStream()) {
+                    try {
+                        DomXmpParser domXmpParser = new DomXmpParser();
+                        XMPMetadata xmpMeta = domXmpParser.parse(metaStream);
+
+                        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+                        new XmpSerializer().serialize(xmpMeta, baos, true);
+                        String xmpString = baos.toString(StandardCharsets.UTF_8);
+
+                        if (xmpString.contains(standardKeyword)) {
+                            return true;
+                        }
+                    } catch (XmpParsingException e) {
+                        // XMP parsing failed, but we already checked raw metadata above
+                        log.debug(
+                                "XMP parsing failed for standard check, but raw metadata was already checked: {}",
+                                e.getMessage());
+                    }
+                }
+            }
+        } catch (Exception e) {
+            ExceptionUtils.logException("PDF standard checking", e);
+        }
+
+        return false;
+    }
+
    private static ObjectNode generatePDFSummaryData(
-            PDDocument document, List<PDFVerificationResult> verificationResults) {
+            PDDocument document, String pdfaConformanceLevel, Boolean pdfaValidationPassed) {
        ObjectNode summaryData = objectMapper.createObjectNode();

        // Check if encrypted
@@ -127,16 +342,24 @@ public class GetInfoOnPDF {
        }

        // Check standard compliance
-        if (verificationResults != null && !verificationResults.isEmpty()) {
-            ArrayNode complianceArray = objectMapper.createArrayNode();
-            for (PDFVerificationResult result : verificationResults) {
-                ObjectNode complianceNode = objectMapper.createObjectNode();
-                complianceNode.put("Standard", result.getStandard());
-                complianceNode.put("Compliant", result.isCompliant());
-                complianceNode.put("Summary", result.getComplianceSummary());
-                complianceArray.add(complianceNode);
+        if (pdfaConformanceLevel != null) {
+            summaryData.put("standardCompliance", "PDF/A-" + pdfaConformanceLevel);
+            summaryData.put("standardPurpose", "long-term archiving");
+            if (pdfaValidationPassed != null) {
+                summaryData.put("standardValidationPassed", pdfaValidationPassed);
            }
-            summaryData.set("Compliance", complianceArray);
+        } else if (checkForStandard(document, "PDF/X")) {
+            summaryData.put("standardCompliance", "PDF/X");
+            summaryData.put("standardPurpose", "graphic exchange");
+        } else if (checkForStandard(document, "PDF/UA")) {
+            summaryData.put("standardCompliance", "PDF/UA");
+            summaryData.put("standardPurpose", "universal accessibility");
+        } else if (checkForStandard(document, "PDF/E")) {
+            summaryData.put("standardCompliance", "PDF/E");
+            summaryData.put("standardPurpose", "engineering workflows");
+        } else if (checkForStandard(document, "PDF/VT")) {
+            summaryData.put("standardCompliance", "PDF/VT");
+            summaryData.put("standardPurpose", "variable and transactional printing");
        }

        return summaryData;
@@ -364,113 +587,40 @@ public class GetInfoOnPDF {
        return docInfoNode;
    }

-    private static ObjectNode extractComplianceInfo(
-            PDDocument doc, List<PDFVerificationResult> verificationResults) {
+    private static ObjectNode extractComplianceInfo(PDDocument document) {
        ObjectNode compliancy = objectMapper.createObjectNode();

-        boolean isPdfA = false;
-        boolean isPdfUA = false;
-        boolean isPdfX = false;
-        boolean isPdfE = false;
-        boolean isPdfB = false;
-        String pdfAConformanceLevel = null;
+        try {
+            String pdfaConformanceLevel = getPdfAConformanceLevel(document);
+            boolean isPdfACompliant = pdfaConformanceLevel != null;
+            boolean isPdfXCompliant = checkForStandard(document, "PDF/X");
+            boolean isPdfECompliant = checkForStandard(document, "PDF/E");
+            boolean isPdfVTCompliant = checkForStandard(document, "PDF/VT");
+            boolean isPdfUACompliant = checkForStandard(document, "PDF/UA");
+            boolean isPdfBCompliant = checkForStandard(document, "PDF/B");
+            boolean isPdfSECCompliant = checkForStandard(document, "PDF/SEC");

-        if (verificationResults != null) {
-            for (PDFVerificationResult result : verificationResults) {
-                if (result == null) continue;
-                if (result.isCompliant()) {
-                    String std = result.getStandard().toLowerCase();
-                    if (std.contains("pdf_a") || std.contains("pdfa")) {
-                        isPdfA = true;
-                        String profile = result.getValidationProfile();
-                        if (profile != null) {
-                            if (profile.contains("1b")
-                                    || profile.contains("2b")
-                                    || profile.contains("3b")) {
-                                isPdfB = true;
-                            }
-                            // Simple extraction: remove "pdfa-" prefix
-                            pdfAConformanceLevel = profile.replace("pdfa-", "");
-                        }
-                    }
-                    if (std.contains("pdf_ua") || std.contains("pdfua")) isPdfUA = true;
-                    if (std.contains("pdf_x") || std.contains("pdfx")) isPdfX = true;
-                    if (std.contains("pdf_e") || std.contains("pdfe")) isPdfE = true;
-                }
+            compliancy.put("IsPDF/ACompliant", isPdfACompliant);
+            if (pdfaConformanceLevel != null) {
+                compliancy.put("PDF/AConformanceLevel", pdfaConformanceLevel);
+                Boolean pdfaValidationPassed =
+                        validatePdfAWithPreflight(document, pdfaConformanceLevel);
+                compliancy.put("IsPDF/AValidated", pdfaValidationPassed);
            }
-        }
+            compliancy.put("IsPDF/XCompliant", isPdfXCompliant);
+            compliancy.put("IsPDF/ECompliant", isPdfECompliant);
+            compliancy.put("IsPDF/VTCompliant", isPdfVTCompliant);
+            compliancy.put("IsPDF/UACompliant", isPdfUACompliant);
+            compliancy.put("IsPDF/BCompliant", isPdfBCompliant);
+            compliancy.put("IsPDF/SECCompliant", isPdfSECCompliant);

-        compliancy.put("IsPDF/ACompliant", isPdfA);
-        compliancy.put("IsPDF/UACompliant", isPdfUA);
-        compliancy.put("IsPDF/ECompliant", isPdfE);
-        compliancy.put("IsPDF/VTCompliant", false); // Not currently implemented
-        compliancy.put("IsPDF/BCompliant", isPdfB);
-        if (pdfAConformanceLevel != null) {
-            compliancy.put("PDF/AConformanceLevel", pdfAConformanceLevel);
-        }
-
-        compliancy.put("IsPDF/SECCompliant", isSECCompliant(doc));
-
-        if (verificationResults != null && !verificationResults.isEmpty()) {
-            // Keep original simple structure as backup or extra info
-            for (PDFVerificationResult result : verificationResults) {
-                if (result == null) continue;
-                String standard = result.getStandard();
-                boolean isCompliant = result.isCompliant();
-
-                if (standard != null) {
-                    // Avoid overwriting specific keys if collision, but here keys are distinct
-                    // enough
-                    compliancy.put(standard, isCompliant);
-                }
-            }
+        } catch (Exception e) {
+            log.error("Error extracting compliance info: {}", e.getMessage());
        }

        return compliancy;
    }

-    private static boolean isSECCompliant(PDDocument doc) {
-        try {
-            // 1. Check Encryption
-            if (doc.isEncrypted()) return false;
-
-            PDDocumentCatalog catalog = doc.getDocumentCatalog();
-
-            // 2. Check for JavaScript (Active Content)
-            if (catalog.getOpenAction() instanceof PDActionJavaScript) return false;
-            if (catalog.getNames() != null && catalog.getNames().getJavaScript() != null)
-                return false;
-
-            // Check for AcroForm
-            if (catalog.getAcroForm() != null) return false;
-
-            // 3. Check for Embedded Files
-            if (catalog.getNames() != null && catalog.getNames().getEmbeddedFiles() != null)
-                return false;
-
-            // 4. Check for External Links or Navigation Actions
-            for (PDPage page : doc.getPages()) {
-                for (PDAnnotation annotation : page.getAnnotations()) {
-                    if (annotation instanceof PDAnnotationLink) {
-                        PDAnnotationLink link = (PDAnnotationLink) annotation;
-                        PDAction action = link.getAction();
-                        if (action instanceof PDActionURI
-                                || action instanceof PDActionLaunch
-                                || action instanceof PDActionRemoteGoTo
-                                || action instanceof PDActionSubmitForm) {
-                            return false;
-                        }
-                    }
-                }
-            }
-
-            return true;
-        } catch (Exception e) {
-            log.error("Error checking SEC compliance: {}", e.getMessage());
-            return false;
-        }
-    }
-
    private static ObjectNode extractEncryptionInfo(PDDocument document) {
        ObjectNode encryption = objectMapper.createObjectNode();

@@ -1077,13 +1227,6 @@ public class GetInfoOnPDF {
            return createErrorResponse("Invalid PDF file: " + e.getMessage());
        }

-        List<PDFVerificationResult> verificationResults = null;
-        try {
-            verificationResults = veraPDFService.validatePDF(inputFile.getInputStream());
-        } catch (Exception e) {
-            log.error("VeraPDF validation failed", e);
-        }
-
        boolean readonly = true;

        try (PDDocument pdfBoxDoc = pdfDocumentFactory.load(inputFile, readonly)) {
@@ -1092,13 +1235,20 @@ public class GetInfoOnPDF {
            ObjectNode metadata = extractMetadata(pdfBoxDoc);
            ObjectNode basicInfo = extractBasicInfo(pdfBoxDoc, inputFile.getSize());
            ObjectNode docInfoNode = extractDocumentInfo(pdfBoxDoc);
-            ObjectNode compliancy = extractComplianceInfo(pdfBoxDoc, verificationResults);
+            ObjectNode compliancy = extractComplianceInfo(pdfBoxDoc);
            ObjectNode encryption = extractEncryptionInfo(pdfBoxDoc);
            ObjectNode permissionsNode = extractPermissions(pdfBoxDoc);
            ObjectNode other = extractOtherInfo(pdfBoxDoc);
            ObjectNode formFieldsNode = extractFormFields(pdfBoxDoc);

-            ObjectNode summaryData = generatePDFSummaryData(pdfBoxDoc, verificationResults);
+            // Generate summary data
+            String pdfaConformanceLevel = getPdfAConformanceLevel(pdfBoxDoc);
+            Boolean pdfaValidationPassed = null;
+            if (pdfaConformanceLevel != null) {
+                pdfaValidationPassed = validatePdfAWithPreflight(pdfBoxDoc, pdfaConformanceLevel);
+            }
+            ObjectNode summaryData =
+                    generatePDFSummaryData(pdfBoxDoc, pdfaConformanceLevel, pdfaValidationPassed);

            // Extract per-page information
            ObjectNode pageInfoParent = extractPerPageInfo(pdfBoxDoc);
@@ -33,8 +33,6 @@ import org.springframework.web.multipart.MultipartFile;

 import io.swagger.v3.oas.annotations.Operation;

-import jakarta.validation.Valid;
-
 import lombok.RequiredArgsConstructor;

 import stirling.software.SPDF.config.swagger.StandardPdfResponse;
@@ -73,7 +71,7 @@ public class WatermarkController {
                    "This endpoint adds a watermark to a given PDF file. Users can specify the"
                            + " watermark type (text or image), rotation, opacity, width spacer, and"
                            + " height spacer. Input:PDF Output:PDF Type:SISO")
-    public ResponseEntity<byte[]> addWatermark(@Valid @ModelAttribute AddWatermarkRequest request)
+    public ResponseEntity<byte[]> addWatermark(@ModelAttribute AddWatermarkRequest request)
            throws IOException, Exception {
        MultipartFile pdfFile = request.getFileInput();
        String pdfFileName = pdfFile.getOriginalFilename();
@@ -239,8 +237,8 @@ public class WatermarkController {

        // Calculating the number of rows and columns.

-        int watermarkRows = Math.min((int) (pageHeight / newWatermarkHeight + 1), 10_000);
-        int watermarkCols = Math.min((int) (pageWidth / newWatermarkWidth + 1), 10_000);
+        int watermarkRows = (int) (pageHeight / newWatermarkHeight + 1);
+        int watermarkCols = (int) (pageWidth / newWatermarkWidth + 1);

        // Add the text watermark
        for (int i = 0; i <= watermarkRows; i++) {
@@ -292,15 +290,9 @@ public class WatermarkController {
        float pageWidth = page.getMediaBox().getWidth();
        float pageHeight = page.getMediaBox().getHeight();
        int watermarkRows =
-                Math.min(
-                        (int)
-                                ((pageHeight + heightSpacer)
-                                        / (desiredPhysicalHeight + heightSpacer)),
-                        10_000);
+                (int) ((pageHeight + heightSpacer) / (desiredPhysicalHeight + heightSpacer));
        int watermarkCols =
-                Math.min(
-                        (int) ((pageWidth + widthSpacer) / (desiredPhysicalWidth + widthSpacer)),
-                        10_000);
+                (int) ((pageWidth + widthSpacer) / (desiredPhysicalWidth + widthSpacer));

        for (int i = 0; i < watermarkRows; i++) {
            for (int j = 0; j < watermarkCols; j++) {
@@ -1,7 +1,5 @@
 package stirling.software.SPDF.controller.web;

-import java.io.IOException;
-import java.io.InputStream;
 import java.time.Duration;
 import java.time.LocalDateTime;
 import java.util.*;
@@ -56,27 +54,10 @@ public class MetricsController {
        }
        Map<String, String> status = new HashMap<>();
        status.put("status", "UP");
-        String version = getClass().getPackage().getImplementationVersion();
-        if (version == null) {
-            version = getVersionFromProperties();
-        }
-        status.put("version", version);
+        status.put("version", getClass().getPackage().getImplementationVersion());
        return ResponseEntity.ok(status);
    }

-    private String getVersionFromProperties() {
-        try (InputStream is = getClass().getResourceAsStream("/version.properties")) {
-            if (is != null) {
-                Properties props = new Properties();
-                props.load(is);
-                return props.getProperty("version");
-            }
-        } catch (IOException e) {
-            log.error("Failed to load version.properties", e);
-        }
-        return null;
-    }
-
    @GetMapping("/load")
    @Operation(
            summary = "GET request count",
@@ -6,7 +6,6 @@ import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
-import java.util.regex.Pattern;

 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.core.io.ClassPathResource;
@@ -29,8 +28,6 @@ public class ReactRoutingController {

    private static final org.slf4j.Logger log =
            org.slf4j.LoggerFactory.getLogger(ReactRoutingController.class);
-    private static final Pattern BASE_HREF_PATTERN =
-            Pattern.compile("<base href=\\\"[^\\\"]*\\\"\\s*/?>");

    @Value("${server.servlet.context-path:/}")
    private String contextPath;
@@ -97,9 +94,9 @@ public class ReactRoutingController {
                html = html.replace("%BASE_URL%", baseUrl);
                // Also rewrite any existing <base> tag (Vite may have baked one in)
                html =
-                        BASE_HREF_PATTERN
-                                .matcher(html)
-                                .replaceFirst("<base href=\\\"" + baseUrl + "\\\" />");
+                        html.replaceFirst(
+                                "<base href=\\\"[^\\\"]*\\\"\\s*/?>",
+                                "<base href=\\\"" + baseUrl + "\\\" />");

                // Inject context path as a global variable for API calls
                String contextPathScript =
@@ -23,8 +23,6 @@ import org.springframework.web.multipart.MaxUploadSizeExceededException;
 import org.springframework.web.multipart.support.MissingServletRequestPartException;
 import org.springframework.web.servlet.NoHandlerFoundException;

-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;

@@ -192,31 +190,6 @@ public class GlobalExceptionHandler {
        return problemDetail;
    }

-    /**
-     * Checks whether the given IOException indicates that the client disconnected before the
-     * response could be written (broken pipe, connection reset, etc.). When this happens there is
-     * no point in serialising a {@link ProblemDetail} body because the socket is already closed —
-     * and attempting to do so may trigger a secondary {@code HttpMessageNotWritableException} if
-     * the response Content-Type was already committed as a non-JSON type (e.g. image/png).
-     */
-    private static boolean isClientDisconnectException(IOException ex) {
-        // Walk the causal chain — Jetty/Tomcat may wrap the low-level SocketException
-        Throwable current = ex;
-        while (current != null) {
-            String msg = current.getMessage();
-            if (msg != null) {
-                String lower = msg.toLowerCase(java.util.Locale.ROOT);
-                if (lower.contains("broken pipe")
-                        || lower.contains("connection reset")
-                        || lower.contains("an established connection was aborted")) {
-                    return true;
-                }
-            }
-            current = current.getCause();
-        }
-        return false;
-    }
-
    /**
     * Helper method to create a standardized ProblemDetail response for exceptions with error
     * codes.
@@ -868,24 +841,21 @@ public class GlobalExceptionHandler {
        response.setContentType("application/problem+json");
        response.setCharacterEncoding("UTF-8");

-        // Use ObjectMapper to properly escape JSON values and prevent XSS
-        ObjectMapper mapper = new ObjectMapper();
-        java.util.Map<String, Object> errorMap = new java.util.LinkedHashMap<>();
-        errorMap.put("type", "about:blank");
-        errorMap.put("title", "Not Acceptable");
-        errorMap.put("status", 406);
-        errorMap.put(
-                "detail",
-                "The requested resource could not be returned in an acceptable format. Error responses are returned as JSON.");
-        errorMap.put("instance", request.getRequestURI());
-        errorMap.put("timestamp", Instant.now().toString());
-        errorMap.put(
-                "hints",
-                java.util.Arrays.asList(
-                        "Error responses are always returned as application/json or application/problem+json",
-                        "Set Accept header to include application/json for proper error handling"));
+        String errorJson =
+                String.format(
+                        """
+                {
+                    "type": "about:blank",
+                    "title": "Not Acceptable",
+                    "status": 406,
+                    "detail": "The requested resource could not be returned in an acceptable format. Error responses are returned as JSON.",
+                    "instance": "%s",
+                    "timestamp": "%s",
+                    "hints": ["Error responses are always returned as application/json or application/problem+json", "Set Accept header to include application/json for proper error handling"]
+                }
+                """,
+                        request.getRequestURI(), Instant.now().toString());

-        String errorJson = mapper.writeValueAsString(errorMap);
        response.getWriter().write(errorJson);
        response.getWriter().flush();
    }
@@ -1137,15 +1107,6 @@ public class GlobalExceptionHandler {
    public ResponseEntity<ProblemDetail> handleIOException(
            IOException ex, HttpServletRequest request) {

-        // Broken pipe / connection reset means the client disconnected.
-        // Attempting to write a ProblemDetail response will fail because the
-        // response Content-Type may already be committed (e.g. image/png) and
-        // the client is gone anyway. Log at WARN and return an empty body.
-        if (isClientDisconnectException(ex)) {
-            log.warn("Client disconnected at {}: {}", request.getRequestURI(), ex.getMessage());
-            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).build();
-        }
-
        // Check if this is a PDF-specific error and wrap it appropriately
        IOException processedException =
                ExceptionUtils.handlePdfException(ex, request.getRequestURI());
@@ -3,9 +3,9 @@ package stirling.software.SPDF.model;
 import java.util.HashMap;
 import java.util.Map;

-import lombok.Getter;
+import com.fasterxml.jackson.databind.JsonNode;

-import tools.jackson.databind.JsonNode;
+import lombok.Getter;

 public class ApiEndpoint {
    private final String name;
@@ -18,10 +18,10 @@ public class ApiEndpoint {
        postNode.path("parameters")
                .forEach(
                        paramNode -> {
-                            String paramName = paramNode.path("name").asText("");
+                            String paramName = paramNode.path("name").asText();
                            parameters.put(paramName, paramNode);
                        });
-        this.description = postNode.path("description").asText("");
+        this.description = postNode.path("description").asText();
    }

    public boolean areParametersValid(Map<String, Object> providedParams) {
@@ -2,9 +2,6 @@ package stirling.software.SPDF.model.api;

 import io.swagger.v3.oas.annotations.media.Schema;

-import jakarta.validation.constraints.Max;
-import jakarta.validation.constraints.Min;
-
 import lombok.Data;
 import lombok.EqualsAndHashCode;

@@ -36,8 +33,6 @@ public class SplitPdfBySectionsRequest extends PDFFile {
            defaultValue = "0",
            minimum = "0",
            requiredMode = Schema.RequiredMode.REQUIRED)
-    @Min(value = 0, message = "Horizontal divisions must be non-negative")
-    @Max(value = 50, message = "Horizontal divisions must not exceed 50")
    private int horizontalDivisions;

    @Schema(
@@ -45,8 +40,6 @@ public class SplitPdfBySectionsRequest extends PDFFile {
            defaultValue = "1",
            minimum = "0",
            requiredMode = Schema.RequiredMode.REQUIRED)
-    @Min(value = 0, message = "Vertical divisions must be non-negative")
-    @Max(value = 50, message = "Vertical divisions must not exceed 50")
    private int verticalDivisions;

    @Schema(
@@ -14,11 +14,9 @@ public class PdfToPdfARequest extends PDFFile {
    @Schema(
            description = "The output format type (PDF/A or PDF/X)",
            requiredMode = Schema.RequiredMode.REQUIRED,
-            allowableValues = {"pdfa", "pdfa-1", "pdfa-2", "pdfa-2b", "pdfa-3", "pdfa-3b", "pdfx"})
+            allowableValues = {
+                "pdfa", "pdfa-1", "pdfa-2", "pdfa-2b", "pdfa-3", "pdfa-3b", "pdfx", "pdfx-1",
+                "pdfx-3", "pdfx-4"
+            })
    private String outputFormat;
-
-    @Schema(
-            description =
-                    "If true, the conversion will fail if the output is not perfectly compliant")
-    private Boolean strict = false;
 }
@@ -1,41 +0,0 @@
-package stirling.software.SPDF.model.api.general;
-
-import io.swagger.v3.oas.annotations.media.Schema;
-
-import lombok.Data;
-import lombok.EqualsAndHashCode;
-
-import stirling.software.common.model.api.PDFFile;
-
-@Data
-@EqualsAndHashCode(callSuper = true)
-public class PosterPdfRequest extends PDFFile {
-
-    @Schema(
-            description = "Target page size for output chunks (e.g., 'A4', 'Letter', 'A3')",
-            requiredMode = Schema.RequiredMode.REQUIRED,
-            allowableValues = {"A4", "Letter", "A3", "A5", "Legal", "Tabloid"})
-    private String pageSize = "A4";
-
-    @Schema(
-            description = "Horizontal decimation factor (how many columns to split into)",
-            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
-            defaultValue = "2",
-            minimum = "1",
-            maximum = "10")
-    private int xFactor = 2;
-
-    @Schema(
-            description = "Vertical decimation factor (how many rows to split into)",
-            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
-            defaultValue = "2",
-            minimum = "1",
-            maximum = "10")
-    private int yFactor = 2;
-
-    @Schema(
-            description = "Split right-to-left instead of left-to-right",
-            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
-            defaultValue = "false")
-    private boolean rightToLeft = false;
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Anthony StirlingandGitHub	c0a2b1d3f2	Merge branch 'main' into codex/verify-entry-points-for-security-issues	2026-01-22 20:36:07 +00:00
Anthony Stirling	5b6eca28ba	Harden URL fetch validation and size parsing	2026-01-06 20:24:37 +00:00