Aelira Core 0.12.1 & 0.12.2: Large Course Decks, Richer PDF Triage, and Node 26 LTS

Real Course Materials Aren’t Toy Documents

Higher education accessibility tools often work cleanly on 5-page sample PDFs and simple Word documents. But when faculty upload actual course materials—such as an engineering deck spanning 200 slides with diagrams, speaker notes, and embedded charts—the realities of document packaging quickly emerge.

Over the past 48 hours, we shipped two patch releases for Aelira Core: v0.12.1 and v0.12.2. Together, they eliminate practical friction points for university teams processing heavy document pipelines, bring granular categorization to PDF scanner findings, respect motion accessibility preferences, and modernize our runtime to Node.js 26 LTS.

Here is a breakdown of what changed and why it matters.

---

1. Dedicated 10,000-Part Archive Limits for Large Office Decks

Office Open XML documents (.docx, .pptx, .xlsx) are zip archives under the hood. Every slide, relationship table, note page, and embedded image is stored as an individual internal part.

A lecture deck with 200 slides, speaker notes, and an image on each slide easily exceeds 1,000 internal XML parts. Previously, our security upload validator enforced a uniform 1,000-file limit across all zip archives to defend against archive-bomb denial of service attacks. Because sanitization rebuilds preserve valid document structure without dropping legitimate slides, these large academic decks were rated high-risk and refused before scanning could begin.

In v0.12.2, Word, Excel, and PowerPoint files now operate under a dedicated 10,000-part limit—sufficient for large university decks of roughly 2,000 slides. Files exceeding 10,000 parts are refused with explicit advice to divide the document. Other zip archives continue to enforce the 1,000-file threshold, and strict compression-ratio checks remain active across all formats.

2. First-Class Categorization for PDF Findings

In previous releases, PDF scanner findings recorded rules, severity, and messages, but omitted explicit category tags. As a result, the Issues dashboard grouped almost all PDF findings under "Other," making it difficult for accessibility teams to filter large audit runs by specific workstreams.

With v0.12.2, PDF scanner findings now record their authoritative categories directly:

• Alt Text: Missing or uninformative image descriptions
• Reading Order: Structural sequence and column layout mismatches
• Contrast: Low text and foreground contrast ratios
• Forms & Links: Unlabelled inputs, missing tab orders, and vague anchor text
• Structure: Missing structure trees, untagged lists, tables, and mathematics
• Language & Title: Missing /Lang attributes and document titles

Accessibility officers and instructional designers can now filter, prioritize, and assign PDF findings alongside Word and PowerPoint tasks using the same familiar categories.

3. Respecting Reduced Motion in Scanner Analytics

Accessibility applies to our own interfaces as much as the files we inspect. In v0.12.1, the scan analysis page now detects and honours the operating system's prefers-reduced-motion setting.

When reduced motion is enabled, compliance scores appear immediately without the count-up spinning animation, and severity distribution charts render statically. Furthermore, during animated count-ups for standard users, score labels, ring colors, and values are synchronized continuously, preventing low numbers from briefly appearing beside "High Compliance" badges.

4. Polished Review Evidence PDFs

The review evidence PDF provides verifiable audit trails for compliance documentation. In these updates:

• Long SHA-256 source and working-file digests now wrap inside the metadata table in clean monospaced font rather than overflowing the table border.
• Matterhorn Protocol checkpoints are now scoped strictly to PDF audits rather than appearing on Word or PowerPoint summaries.
• The summary label has been updated from "Total Issues Found" to "Review Items Recorded" to reflect review scope accurately.
• Header branding displays the clean Aelira wordmark without marketing taglines, keeping evidence records strictly factual.

5. Runtime Security and Node.js 26 LTS

Both releases update foundational dependencies across the container stack:

• Node.js 26 LTS: The API container now runs Pa11y on Node.js 26.13.0 (incorporating 26.12.1 security fixes and OpenSSL 3.5.9), and the dashboard container builds against node:26-alpine.
• ImageMagick Security: The reviewed ImageMagick package in the API image moves to Debian 8:7.1.1.43+dfsg1-1+deb13u13 from trixie-security, remediating twelve previously disclosed security advisories.

---

Upgrading

Both v0.12.1 and v0.12.2 are drop-in patch releases requiring no database schema migrations. Self-hosted deployments can pull the updated image tags directly from GHCR:

docker compose pull
docker compose up -d

Full release notes and SBOM artifacts are available on GitHub.