Merge branch 'dev' into feature-ai

[ci skip]

.codecov.yml

@@ -1,7 +1,6 @@
-# https://docs.codecov.com/docs/codecovyml-reference#codecov
 codecov:
   require_ci_to_pass: true
-# https://docs.codecov.com/docs/components
+  # https://docs.codecov.com/docs/components
 component_management:
   individual_components:
     - component_id: backend
@@ -10,70 +9,26 @@ component_management:
     - component_id: frontend
       paths:
         - src-ui/**
-# https://docs.codecov.com/docs/flags#step-2-flag-management-in-yaml
+# https://docs.codecov.com/docs/pull-request-comments
-# https://docs.codecov.com/docs/carryforward-flags
-flags:
-  # Backend Python versions
-  backend-python-3.10:
-    paths:
-      - src/**
-    carryforward: true
-  backend-python-3.11:
-    paths:
-      - src/**
-    carryforward: true
-  backend-python-3.12:
-    paths:
-      - src/**
-    carryforward: true
-  # Frontend (shards merge into single flag)
-  frontend-node-24.x:
-    paths:
-      - src-ui/**
-    carryforward: true
 comment:
   layout: "header, diff, components, flags, files"
+  # https://docs.codecov.com/docs/javascript-bundle-analysis
   require_bundle_changes: true
   bundle_change_threshold: "50Kb"
 coverage:
-  # https://docs.codecov.com/docs/commit-status
   status:
     project:
-      backend:
+      default:
-        flags:
-          - backend-python-3.10
-          - backend-python-3.11
-          - backend-python-3.12
-        paths:
-          - src/**
         # https://docs.codecov.com/docs/commit-status#threshold
         threshold: 1%
-        removed_code_behavior: adjust_base
-      frontend:
-        flags:
-          - frontend-node-24.x
-        paths:
-          - src-ui/**
-        threshold: 1%
-        removed_code_behavior: adjust_base
     patch:
-      backend:
+      default:
-        flags:
+        # For the changed lines only, target 100% covered, but
-          - backend-python-3.10
+        # allow as low as 75%
-          - backend-python-3.11
-          - backend-python-3.12
-        paths:
-          - src/**
-        target: 100%
-        threshold: 25%
-      frontend:
-        flags:
-          - frontend-node-24.x
-        paths:
-          - src-ui/**
         target: 100%
         threshold: 25%
 # https://docs.codecov.com/docs/javascript-bundle-analysis
 bundle_analysis:
+  # Fail if the bundle size increases by more than 1MB
   warning_threshold: "1MB"
   status: true

.devcontainer/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM --platform=$BUILDPLATFORM docker.io/node:24-trixie-slim as main-app
+FROM --platform=$BUILDPLATFORM docker.io/node:20-bookworm-slim as main-app
 
 ARG DEBIAN_FRONTEND=noninteractive
 
@@ -8,17 +8,16 @@ ARG DEBIAN_FRONTEND=noninteractive
 ARG TARGETARCH
 
 # Can be workflow provided, defaults set for manual building
-ARG JBIG2ENC_VERSION=0.30
+ARG JBIG2ENC_VERSION=0.29
+ARG QPDF_VERSION=11.9.0
+ARG GS_VERSION=10.03.1
 
 # Set Python environment variables
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
     # Ignore warning from Whitenoise
     PYTHONWARNINGS="ignore:::django.http.response:517" \
-    PNGX_CONTAINERIZED=1 \
+    PNGX_CONTAINERIZED=1
-    # https://docs.astral.sh/uv/reference/settings/#link-mode
-    UV_LINK_MODE=copy \
-    UV_CACHE_DIR=/cache/uv/
 
 #
 # Begin installation and configuration
@@ -84,15 +83,37 @@ RUN set -eux \
     && apt-get update \
     && apt-get install --yes --quiet ${PYTHON_PACKAGES}
 
-COPY --from=ghcr.io/astral-sh/uv:0.9.10 /uv /bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.7.8 /uv /bin/uv
 
 
 RUN set -eux \
   && echo "Installing pre-built updates" \
+    && echo "Installing qpdf ${QPDF_VERSION}" \
+      && curl --fail --silent --show-error --location \
+        --output libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/qpdf-${QPDF_VERSION}/libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+      && curl --fail --silent --show-error --location \
+        --output qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/qpdf-${QPDF_VERSION}/qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+      && dpkg --install ./libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+      && dpkg --install ./qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+    && echo "Installing Ghostscript ${GS_VERSION}" \
+      && curl --fail --silent --show-error --location \
+          --output libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+          https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+      && curl --fail --silent --show-error --location \
+          --output ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+          https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+      && curl --fail --silent --show-error --location \
+          --output libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
+          https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
+        && dpkg --install ./libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
+        && dpkg --install ./libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+        && dpkg --install ./ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
     && echo "Installing jbig2enc" \
       && curl --fail --silent --show-error --location \
         --output jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
-        https://github.com/paperless-ngx/builder/releases/download/jbig2enc-trixie-v${JBIG2ENC_VERSION}/jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/jbig2enc-${JBIG2ENC_VERSION}/jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
       && dpkg --install ./jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb
 
 # setup docker-specific things
@@ -106,7 +127,6 @@ COPY [ \
 
 RUN set -eux \
   && echo "Configuring ImageMagick" \
-    && mkdir -p /etc/ImageMagick-6 \
     && mv paperless-policy.xml /etc/ImageMagick-6/policy.xml
 
 
@@ -122,7 +142,7 @@ ARG BUILD_PACKAGES="\
   pkg-config"
 
 # hadolint ignore=DL3042
-RUN --mount=type=cache,target=/cache/uv/,id=uv-cache \
+RUN --mount=type=cache,target=/root/.cache/uv,id=pip-cache \
   set -eux \
   && echo "Installing build system packages" \
     && apt-get update \

.editorconfig

@@ -11,10 +11,6 @@ end_of_line = lf
 charset = utf-8
 max_line_length = 79
 
-[*.sh]
-indent_style = tab
-indent_size = 1
-
 [{*.html,*.css,*.js}]
 max_line_length = off
 

.github/PULL_REQUEST_TEMPLATE.md

@@ -35,8 +35,8 @@ NOTE: PRs that do not address the following will not be merged, please do not sk
 
 - [ ] I have read & agree with the [contributing guidelines](https://github.com/paperless-ngx/paperless-ngx/blob/main/CONTRIBUTING.md).
 - [ ] If applicable, I have included testing coverage for new code in this PR, for [backend](https://docs.paperless-ngx.com/development/#testing) and / or [front-end](https://docs.paperless-ngx.com/development/#testing-and-code-style) changes.
-- [ ] If applicable, I have tested my code for breaking changes & regressions on both mobile & desktop devices, using the latest version of major browsers.
+- [ ] If applicable, I have tested my code for new features & regressions on both mobile & desktop devices, using the latest version of major browsers.
 - [ ] If applicable, I have checked that all tests pass, see [documentation](https://docs.paperless-ngx.com/development/#back-end-development).
 - [ ] I have run all `pre-commit` hooks, see [documentation](https://docs.paperless-ngx.com/development/#code-formatting-with-pre-commit-hooks).
 - [ ] I have made corresponding changes to the documentation as needed.
-- [ ] In the description of the PR above I have disclosed the use of AI tools in the coding of this PR.
+- [ ] I have checked my modifications for any breaking changes.

.github/dependabot.yml

@@ -41,56 +41,30 @@ updates:
       - "backend"
       - "dependencies"
     groups:
-      # Development & CI/CD Tooling
       development:
         patterns:
           - "*pytest*"
           - "ruff"
           - "mkdocs-material"
           - "pre-commit*"
-      # Django & DRF Ecosystem
+      django:
-      django-ecosystem:
         patterns:
           - "*django*"
           - "drf-*"
-          - "djangorestframework"
+      major-versions:
-          - "whitenoise"
-          - "bleach"
-          - "jinja2"
-      # Async, Task Queuing & Caching
-      async-tasks:
-        patterns:
-          - "celery*"
-          - "channels*"
-          - "flower"
-          - "redis"
-      # Document, PDF, and OCR Processing
-      document-processing:
-        patterns:
-          - "ocrmypdf"
-          - "pdf2image"
-          - "pyzbar"
-          - "zxing-cpp"
-          - "tika-client"
-          - "gotenberg-client"
-          - "python-magic"
-          - "python-gnupg"
-      # Data, NLP, and Search
-      data-nlp-search:
-        patterns:
-          - "nltk"
-          - "scikit-learn"
-          - "langdetect"
-          - "rapidfuzz"
-          - "whoosh-reloaded"
-      # Utilities (Patch Updates)
-      utilities-patch:
         update-types:
-          - "patch"
+          - "major"
-      # Utilities (Minor Updates)
+      small-changes:
-      utilities-minor:
         update-types:
           - "minor"
+          - "patch"
+        exclude-patterns:
+          - "*django*"
+          - "drf-*"
+      pre-built:
+        patterns:
+          - psycopg*
+          - zxing-cpp
   # Enable updates for GitHub Actions
   - package-ecosystem: "github-actions"
     target-branch: "dev"

.github/release-drafter.yml

@@ -44,7 +44,6 @@ include-labels:
   - 'notable'
 exclude-labels:
   - 'skip-changelog'
-filter-by-commitish: true
 category-template: '### $TITLE'
 change-template: '- $TITLE @$AUTHOR ([#$NUMBER]($URL))'
 change-title-escapes: '\<*_&#@'

.github/workflows/ci-backend.yml

@@ -1,104 +0,0 @@
-name: Backend Tests
-on:
-  push:
-    branches-ignore:
-      - 'translations**'
-    paths:
-      - 'src/**'
-      - 'pyproject.toml'
-      - 'uv.lock'
-      - 'docker/compose/docker-compose.ci-test.yml'
-      - '.github/workflows/ci-backend.yml'
-  pull_request:
-    branches-ignore:
-      - 'translations**'
-    paths:
-      - 'src/**'
-      - 'pyproject.toml'
-      - 'uv.lock'
-      - 'docker/compose/docker-compose.ci-test.yml'
-      - '.github/workflows/ci-backend.yml'
-  workflow_dispatch:
-concurrency:
-  group: backend-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-env:
-  DEFAULT_UV_VERSION: "0.9.x"
-  NLTK_DATA: "/usr/share/nltk_data"
-jobs:
-  test:
-    name: "Python ${{ matrix.python-version }}"
-    runs-on: ubuntu-24.04
-    strategy:
-      matrix:
-        python-version: ['3.10', '3.11', '3.12']
-      fail-fast: false
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Start containers
-        run: |
-          docker compose --file docker/compose/docker-compose.ci-test.yml pull --quiet
-          docker compose --file docker/compose/docker-compose.ci-test.yml up --detach
-      - name: Set up Python
-        id: setup-python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "${{ matrix.python-version }}"
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.DEFAULT_UV_VERSION }}
-          enable-cache: true
-          python-version: ${{ steps.setup-python.outputs.python-version }}
-      - name: Install system dependencies
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -qq --no-install-recommends \
-            unpaper tesseract-ocr imagemagick ghostscript libzbar0 poppler-utils
-      - name: Configure ImageMagick
-        run: |
-          sudo cp docker/rootfs/etc/ImageMagick-6/paperless-policy.xml /etc/ImageMagick-6/policy.xml
-      - name: Install Python dependencies
-        run: |
-          uv sync \
-            --python ${{ steps.setup-python.outputs.python-version }} \
-            --group testing \
-            --frozen
-      - name: List installed Python dependencies
-        run: |
-          uv pip list
-      - name: Install NLTK data
-        run: |
-          uv run python -m nltk.downloader punkt punkt_tab snowball_data stopwords -d ${{ env.NLTK_DATA }}
-      - name: Run tests
-        env:
-          NLTK_DATA: ${{ env.NLTK_DATA }}
-          PAPERLESS_CI_TEST: 1
-          PAPERLESS_MAIL_TEST_HOST: ${{ secrets.TEST_MAIL_HOST }}
-          PAPERLESS_MAIL_TEST_USER: ${{ secrets.TEST_MAIL_USER }}
-          PAPERLESS_MAIL_TEST_PASSWD: ${{ secrets.TEST_MAIL_PASSWD }}
-        run: |
-          uv run \
-            --python ${{ steps.setup-python.outputs.python-version }} \
-            --dev \
-            --frozen \
-            pytest
-      - name: Upload test results to Codecov
-        if: always()
-        uses: codecov/codecov-action@v5
-        with:
-          flags: backend-python-${{ matrix.python-version }}
-          files: junit.xml
-          report_type: test_results
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v5
-        with:
-          flags: backend-python-${{ matrix.python-version }}
-          files: coverage.xml
-          report_type: coverage
-      - name: Stop containers
-        if: always()
-        run: |
-          docker compose --file docker/compose/docker-compose.ci-test.yml logs
-          docker compose --file docker/compose/docker-compose.ci-test.yml down

.github/workflows/ci-docker.yml

@@ -1,251 +0,0 @@
-name: Docker Build
-on:
-  push:
-    tags:
-      - 'v[0-9]+.[0-9]+.[0-9]+'
-      - 'v[0-9]+.[0-9]+.[0-9]+-beta.rc[0-9]+'
-    branches:
-      - dev
-      - beta
-  pull_request:
-    branches:
-      - dev
-      - main
-  workflow_dispatch:
-concurrency:
-  group: docker-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-env:
-  REGISTRY: ghcr.io
-jobs:
-  build-arch:
-    name: Build ${{ matrix.arch }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: ubuntu-24.04
-            arch: amd64
-            platform: linux/amd64
-          - runner: ubuntu-24.04-arm
-            arch: arm64
-            platform: linux/arm64
-    runs-on: ${{ matrix.runner }}
-    permissions:
-      contents: read
-      packages: write
-    outputs:
-      should-push: ${{ steps.check-push.outputs.should-push }}
-      push-external: ${{ steps.check-push.outputs.push-external }}
-      repository: ${{ steps.repo.outputs.name }}
-      ref-name: ${{ steps.ref.outputs.name }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6.0.1
-      - name: Determine ref name
-        id: ref
-        run: |
-          ref_name="${GITHUB_HEAD_REF:-$GITHUB_REF_NAME}"
-          # Sanitize by replacing / with - for cache keys
-          cache_ref="${ref_name//\//-}"
-
-          echo "ref_name=${ref_name}"
-          echo "cache_ref=${cache_ref}"
-
-          echo "name=${ref_name}" >> $GITHUB_OUTPUT
-          echo "cache-ref=${cache_ref}" >> $GITHUB_OUTPUT
-      - name: Check push permissions
-        id: check-push
-        env:
-          REF_NAME: ${{ steps.ref.outputs.name }}
-        run: |
-          # should-push: Should we push to GHCR?
-          # True for:
-          #   1. Pushes (tags/dev/beta) - filtered via the workflow triggers
-          #   2. Internal PRs where the branch name starts with 'feature-' - filtered here when a PR is synced
-
-          should_push="false"
-
-          if [[ "${{ github.event_name }}" == "push" ]]; then
-            should_push="true"
-          elif [[ "${{ github.event_name }}" == "pull_request" && "${{ github.event.pull_request.head.repo.full_name }}" == "${{ github.repository }}" ]]; then
-            if [[ "${REF_NAME}" == feature-* || "${REF_NAME}" == fix-* ]]; then
-              should_push="true"
-            fi
-          fi
-
-          echo "should-push=${should_push}"
-          echo "should-push=${should_push}" >> $GITHUB_OUTPUT
-
-          # push-external: Should we also push to Docker Hub and Quay.io?
-          # Only for main repo on dev/beta branches or version tags
-          push_external="false"
-          if [[ "${should_push}" == "true" && "${{ github.repository_owner }}" == "paperless-ngx" ]]; then
-            case "${REF_NAME}" in
-              dev|beta)
-                push_external="true"
-                ;;
-            esac
-            case "${{ github.ref }}" in
-              refs/tags/v*|*beta.rc*)
-                push_external="true"
-                ;;
-            esac
-          fi
-          echo "push-external=${push_external}"
-          echo "push-external=${push_external}" >> $GITHUB_OUTPUT
-      - name: Set repository name
-        id: repo
-        run: |
-          repo_name="${{ github.repository }}"
-          repo_name="${repo_name,,}"
-
-          echo "repository=${repo_name}"
-          echo "name=${repo_name}" >> $GITHUB_OUTPUT
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.12.0
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3.6.0
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Maximize space
-        run: |
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf /usr/local/share/boost
-          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
-      - name: Docker metadata
-        id: docker-meta
-        uses: docker/metadata-action@v5.10.0
-        with:
-          images: |
-            ${{ env.REGISTRY }}/${{ steps.repo.outputs.name }}
-          tags: |
-            type=ref,event=branch
-            type=raw,value=${{ steps.ref.outputs.name }},enable=${{ github.event_name == 'pull_request' }}
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-      - name: Build and push by digest
-        id: build
-        uses: docker/build-push-action@v6.18.0
-        with:
-          context: .
-          file: ./Dockerfile
-          platforms: ${{ matrix.platform }}
-          labels: ${{ steps.docker-meta.outputs.labels }}
-          build-args: |
-            PNGX_TAG_VERSION=${{ steps.docker-meta.outputs.version }}
-          outputs: type=image,name=${{ env.REGISTRY }}/${{ steps.repo.outputs.name }},push-by-digest=true,name-canonical=true,push=${{ steps.check-push.outputs.should-push }}
-          cache-from: |
-            type=registry,ref=${{ env.REGISTRY }}/${{ steps.repo.outputs.name }}/cache/app:${{ steps.ref.outputs.cache-ref }}-${{ matrix.arch }}
-            type=registry,ref=${{ env.REGISTRY }}/${{ steps.repo.outputs.name }}/cache/app:dev-${{ matrix.arch }}
-          cache-to: ${{ steps.check-push.outputs.should-push == 'true' && format('type=registry,mode=max,ref={0}/{1}/cache/app:{2}-{3}', env.REGISTRY, steps.repo.outputs.name, steps.ref.outputs.cache-ref, matrix.arch) || '' }}
-      - name: Export digest
-        if: steps.check-push.outputs.should-push == 'true'
-        run: |
-          mkdir -p /tmp/digests
-          digest="${{ steps.build.outputs.digest }}"
-          echo "digest=${digest}"
-          touch "/tmp/digests/${digest#sha256:}"
-      - name: Upload digest
-        if: steps.check-push.outputs.should-push == 'true'
-        uses: actions/upload-artifact@v6.0.0
-        with:
-          name: digests-${{ matrix.arch }}
-          path: /tmp/digests/*
-          if-no-files-found: error
-          retention-days: 1
-  merge-and-push:
-    name: Merge and Push Manifest
-    runs-on: ubuntu-24.04
-    needs: build-arch
-    if: needs.build-arch.outputs.should-push == 'true'
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Download digests
-        uses: actions/download-artifact@v7.0.0
-        with:
-          path: /tmp/digests
-          pattern: digests-*
-          merge-multiple: true
-      - name: List digests
-        run: |
-          echo "Downloaded digests:"
-          ls -la /tmp/digests/
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.12.0
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3.6.0
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Login to Docker Hub
-        if: needs.build-arch.outputs.push-external == 'true'
-        uses: docker/login-action@v3.6.0
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Login to Quay.io
-        if: needs.build-arch.outputs.push-external == 'true'
-        uses: docker/login-action@v3.6.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_USERNAME }}
-          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
-      - name: Docker metadata
-        id: docker-meta
-        uses: docker/metadata-action@v5.10.0
-        with:
-          images: |
-            ${{ env.REGISTRY }}/${{ needs.build-arch.outputs.repository }}
-          tags: |
-            type=ref,event=branch
-            type=raw,value=${{ needs.build-arch.outputs.ref-name }},enable=${{ github.event_name == 'pull_request' }}
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-      - name: Create manifest list and push
-        working-directory: /tmp/digests
-        env:
-          REPOSITORY: ${{ needs.build-arch.outputs.repository }}
-        run: |
-          tags=$(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "${DOCKER_METADATA_OUTPUT_JSON}")
-
-          digests=""
-          for digest in *; do
-            digests+="${{ env.REGISTRY }}/${REPOSITORY}@sha256:${digest} "
-          done
-
-          echo "Creating manifest with tags: ${tags}"
-          echo "From digests: ${digests}"
-
-          docker buildx imagetools create ${tags} ${digests}
-      - name: Inspect image
-        run: |
-          docker buildx imagetools inspect ${{ fromJSON(steps.docker-meta.outputs.json).tags[0] }}
-      - name: Copy to Docker Hub
-        if: needs.build-arch.outputs.push-external == 'true'
-        env:
-          TAGS: ${{ steps.docker-meta.outputs.tags }}
-          GHCR_REPO: ${{ env.REGISTRY }}/${{ needs.build-arch.outputs.repository }}
-        run: |
-          for tag in ${TAGS}; do
-            dockerhub_tag="${tag/${GHCR_REPO}/docker.io/paperlessngx/paperless-ngx}"
-            echo "Copying ${tag} to ${dockerhub_tag}"
-            skopeo copy --all "docker://${tag}" "docker://${dockerhub_tag}"
-          done
-      - name: Copy to Quay.io
-        if: needs.build-arch.outputs.push-external == 'true'
-        env:
-          TAGS: ${{ steps.docker-meta.outputs.tags }}
-          GHCR_REPO: ${{ env.REGISTRY }}/${{ needs.build-arch.outputs.repository }}
-        run: |
-          for tag in ${TAGS}; do
-            quay_tag="${tag/${GHCR_REPO}/quay.io/paperlessngx/paperless-ngx}"
-            echo "Copying ${tag} to ${quay_tag}"
-            skopeo copy --all "docker://${tag}" "docker://${quay_tag}"
-          done

.github/workflows/ci-docs.yml

@@ -1,88 +0,0 @@
-name: Documentation
-on:
-  push:
-    branches:
-      - main
-      - dev
-    paths:
-      - 'docs/**'
-      - 'mkdocs.yml'
-      - '.github/workflows/ci-docs.yml'
-  pull_request:
-    paths:
-      - 'docs/**'
-      - 'mkdocs.yml'
-      - '.github/workflows/ci-docs.yml'
-  workflow_dispatch:
-concurrency:
-  group: docs-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-env:
-  DEFAULT_UV_VERSION: "0.9.x"
-  DEFAULT_PYTHON_VERSION: "3.11"
-jobs:
-  build:
-    name: Build Documentation
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Set up Python
-        id: setup-python
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.DEFAULT_UV_VERSION }}
-          enable-cache: true
-          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
-      - name: Install Python dependencies
-        run: |
-          uv sync --python ${{ steps.setup-python.outputs.python-version }} --dev --frozen
-      - name: Build documentation
-        run: |
-          uv run \
-            --python ${{ steps.setup-python.outputs.python-version }} \
-            --dev \
-            --frozen \
-            mkdocs build --config-file ./mkdocs.yml
-      - name: Upload artifact
-        uses: actions/upload-artifact@v6
-        with:
-          name: documentation
-          path: site/
-          retention-days: 7
-  deploy:
-    name: Deploy Documentation
-    needs: build
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Set up Python
-        id: setup-python
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.DEFAULT_UV_VERSION }}
-          enable-cache: true
-          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
-      - name: Install Python dependencies
-        run: |
-          uv sync --python ${{ steps.setup-python.outputs.python-version }} --dev --frozen
-      - name: Deploy documentation
-        run: |
-          echo "docs.paperless-ngx.com" > "${{ github.workspace }}/docs/CNAME"
-          git config --global user.name "${{ github.actor }}"
-          git config --global user.email "${{ github.actor }}@users.noreply.github.com"
-          uv run \
-            --python ${{ steps.setup-python.outputs.python-version }} \
-            --dev \
-            --frozen \
-            mkdocs gh-deploy --force --no-history

.github/workflows/ci-frontend.yml

@@ -1,189 +0,0 @@
-name: Frontend Tests
-on:
-  push:
-    branches-ignore:
-      - 'translations**'
-    paths:
-      - 'src-ui/**'
-      - '.github/workflows/ci-frontend.yml'
-  pull_request:
-    branches-ignore:
-      - 'translations**'
-    paths:
-      - 'src-ui/**'
-      - '.github/workflows/ci-frontend.yml'
-  workflow_dispatch:
-concurrency:
-  group: frontend-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-jobs:
-  install-dependencies:
-    name: Install Dependencies
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10
-      - name: Use Node.js 24
-        uses: actions/setup-node@v6
-        with:
-          node-version: 24.x
-          cache: 'pnpm'
-          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
-      - name: Cache frontend dependencies
-        id: cache-frontend-deps
-        uses: actions/cache@v5
-        with:
-          path: |
-            ~/.pnpm-store
-            ~/.cache
-          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
-      - name: Install dependencies
-        run: cd src-ui && pnpm install
-  lint:
-    name: Lint
-    needs: install-dependencies
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10
-      - name: Use Node.js 24
-        uses: actions/setup-node@v6
-        with:
-          node-version: 24.x
-          cache: 'pnpm'
-          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
-      - name: Cache frontend dependencies
-        uses: actions/cache@v5
-        with:
-          path: |
-            ~/.pnpm-store
-            ~/.cache
-          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
-      - name: Re-link Angular CLI
-        run: cd src-ui && pnpm link @angular/cli
-      - name: Run lint
-        run: cd src-ui && pnpm run lint
-  unit-tests:
-    name: "Unit Tests (${{ matrix.shard-index }}/${{ matrix.shard-count }})"
-    needs: install-dependencies
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        node-version: [24.x]
-        shard-index: [1, 2, 3, 4]
-        shard-count: [4]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10
-      - name: Use Node.js 24
-        uses: actions/setup-node@v6
-        with:
-          node-version: 24.x
-          cache: 'pnpm'
-          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
-      - name: Cache frontend dependencies
-        uses: actions/cache@v5
-        with:
-          path: |
-            ~/.pnpm-store
-            ~/.cache
-          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
-      - name: Re-link Angular CLI
-        run: cd src-ui && pnpm link @angular/cli
-      - name: Run Jest unit tests
-        run: cd src-ui && pnpm run test --max-workers=2 --shard=${{ matrix.shard-index }}/${{ matrix.shard-count }}
-      - name: Upload test results to Codecov
-        if: always()
-        uses: codecov/codecov-action@v5
-        with:
-          flags: frontend-node-${{ matrix.node-version }}
-          directory: src-ui/
-          report_type: test_results
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v5
-        with:
-          flags: frontend-node-${{ matrix.node-version }}
-          directory: src-ui/coverage/
-  e2e-tests:
-    name: "E2E Tests (${{ matrix.shard-index }}/${{ matrix.shard-count }})"
-    needs: install-dependencies
-    runs-on: ubuntu-24.04
-    container: mcr.microsoft.com/playwright:v1.57.0-noble
-    env:
-      PLAYWRIGHT_BROWSERS_PATH: /ms-playwright
-      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
-    strategy:
-      fail-fast: false
-      matrix:
-        node-version: [24.x]
-        shard-index: [1, 2]
-        shard-count: [2]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10
-      - name: Use Node.js 24
-        uses: actions/setup-node@v6
-        with:
-          node-version: 24.x
-          cache: 'pnpm'
-          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
-      - name: Cache frontend dependencies
-        uses: actions/cache@v5
-        with:
-          path: |
-            ~/.pnpm-store
-            ~/.cache
-          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
-      - name: Re-link Angular CLI
-        run: cd src-ui && pnpm link @angular/cli
-      - name: Install dependencies
-        run: cd src-ui && pnpm install --no-frozen-lockfile
-      - name: Run Playwright E2E tests
-        run: cd src-ui && pnpm exec playwright test --shard ${{ matrix.shard-index }}/${{ matrix.shard-count }}
-  bundle-analysis:
-    name: Bundle Analysis
-    needs: [unit-tests, e2e-tests]
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10
-      - name: Use Node.js 24
-        uses: actions/setup-node@v6
-        with:
-          node-version: 24.x
-          cache: 'pnpm'
-          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
-      - name: Cache frontend dependencies
-        uses: actions/cache@v5
-        with:
-          path: |
-            ~/.pnpm-store
-            ~/.cache
-          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
-      - name: Re-link Angular CLI
-        run: cd src-ui && pnpm link @angular/cli
-      - name: Build and analyze
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-        run: cd src-ui && pnpm run build --configuration=production

.github/workflows/ci-lint.yml

@@ -1,24 +0,0 @@
-name: Lint
-on:
-  push:
-    branches-ignore:
-      - 'translations**'
-  pull_request:
-    branches-ignore:
-      - 'translations**'
-concurrency:
-  group: lint-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-jobs:
-  pre-commit:
-    name: Pre-commit Checks
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Install Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.11"
-      - name: Run pre-commit
-        uses: pre-commit/action@v3.0.1

.github/workflows/ci-release.yml

@@ -1,237 +0,0 @@
-name: Release
-on:
-  push:
-    tags:
-      - 'v[0-9]+.[0-9]+.[0-9]+'
-      - 'v[0-9]+.[0-9]+.[0-9]+-beta.rc[0-9]+'
-concurrency:
-  group: release-${{ github.ref }}
-  cancel-in-progress: false
-env:
-  DEFAULT_UV_VERSION: "0.9.x"
-  DEFAULT_PYTHON_VERSION: "3.11"
-jobs:
-  wait-for-docker:
-    name: Wait for Docker Build
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Wait for Docker build
-        uses: lewagon/wait-on-check-action@v1.4.1
-        with:
-          ref: ${{ github.sha }}
-          check-name: 'Build Docker Image'
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          wait-interval: 60
-  build-release:
-    name: Build Release
-    needs: wait-for-docker
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      # ---- Frontend Build ----
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10
-      - name: Use Node.js 24
-        uses: actions/setup-node@v6
-        with:
-          node-version: 24.x
-          cache: 'pnpm'
-          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
-      - name: Install frontend dependencies
-        run: cd src-ui && pnpm install
-      - name: Build frontend
-        run: cd src-ui && pnpm run build --configuration production
-      # ---- Backend Setup ----
-      - name: Set up Python
-        id: setup-python
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.DEFAULT_UV_VERSION }}
-          enable-cache: true
-          python-version: ${{ steps.setup-python.outputs.python-version }}
-      - name: Install Python dependencies
-        run: |
-          uv sync --python ${{ steps.setup-python.outputs.python-version }} --dev --frozen
-      - name: Install system dependencies
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -qq --no-install-recommends gettext liblept5
-      # ---- Build Documentation ----
-      - name: Build documentation
-        run: |
-          uv run \
-            --python ${{ steps.setup-python.outputs.python-version }} \
-            --dev \
-            --frozen \
-            mkdocs build --config-file ./mkdocs.yml
-      # ---- Prepare Release ----
-      - name: Generate requirements file
-        run: |
-          uv export --quiet --no-dev --all-extras --format requirements-txt --output-file requirements.txt
-      - name: Compile messages
-        run: |
-          cd src/
-          uv run \
-            --python ${{ steps.setup-python.outputs.python-version }} \
-            manage.py compilemessages
-      - name: Collect static files
-        run: |
-          cd src/
-          uv run \
-            --python ${{ steps.setup-python.outputs.python-version }} \
-            manage.py collectstatic --no-input --clear
-      - name: Assemble release package
-        run: |
-          mkdir -p dist/paperless-ngx/scripts
-
-          for file_name in .dockerignore \
-                          .env \
-                          Dockerfile \
-                          pyproject.toml \
-                          uv.lock \
-                          requirements.txt \
-                          LICENSE \
-                          README.md \
-                          paperless.conf.example
-          do
-            cp --verbose ${file_name} dist/paperless-ngx/
-          done
-          mv dist/paperless-ngx/paperless.conf.example dist/paperless-ngx/paperless.conf
-
-          cp --recursive docker/ dist/paperless-ngx/docker
-          cp scripts/*.service scripts/*.sh scripts/*.socket dist/paperless-ngx/scripts/
-          cp --recursive src/ dist/paperless-ngx/src
-          cp --recursive site/ dist/paperless-ngx/docs
-          mv static dist/paperless-ngx/
-
-          find dist/paperless-ngx -name "__pycache__" -type d -exec rm -rf {} +
-      - name: Create release archive
-        run: |
-          cd dist
-          sudo chown -R 1000:1000 paperless-ngx/
-          tar -cJf paperless-ngx.tar.xz paperless-ngx/
-      - name: Upload release artifact
-        uses: actions/upload-artifact@v6
-        with:
-          name: release
-          path: dist/paperless-ngx.tar.xz
-          retention-days: 7
-  publish-release:
-    name: Publish Release
-    needs: build-release
-    runs-on: ubuntu-24.04
-    outputs:
-      prerelease: ${{ steps.get-version.outputs.prerelease }}
-      changelog: ${{ steps.create-release.outputs.body }}
-      version: ${{ steps.get-version.outputs.version }}
-    steps:
-      - name: Download release artifact
-        uses: actions/download-artifact@v7
-        with:
-          name: release
-          path: ./
-      - name: Get version info
-        id: get-version
-        run: |
-          echo "version=${{ github.ref_name }}" >> $GITHUB_OUTPUT
-          if [[ "${{ github.ref_name }}" == *"-beta.rc"* ]]; then
-            echo "prerelease=true" >> $GITHUB_OUTPUT
-          else
-            echo "prerelease=false" >> $GITHUB_OUTPUT
-          fi
-      - name: Create release and changelog
-        id: create-release
-        uses: release-drafter/release-drafter@v6
-        with:
-          name: Paperless-ngx ${{ steps.get-version.outputs.version }}
-          tag: ${{ steps.get-version.outputs.version }}
-          version: ${{ steps.get-version.outputs.version }}
-          prerelease: ${{ steps.get-version.outputs.prerelease }}
-          publish: true
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Upload release archive
-        uses: shogo82148/actions-upload-release-asset@v1
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          upload_url: ${{ steps.create-release.outputs.upload_url }}
-          asset_path: ./paperless-ngx.tar.xz
-          asset_name: paperless-ngx-${{ steps.get-version.outputs.version }}.tar.xz
-          asset_content_type: application/x-xz
-  # ---------------------------------------------------------------------------
-  # Append changelog to docs (only on non-prerelease)
-  # ---------------------------------------------------------------------------
-  append-changelog:
-    name: Append Changelog
-    needs: publish-release
-    if: needs.publish-release.outputs.prerelease == 'false'
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          ref: main
-      - name: Set up Python
-        id: setup-python
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.DEFAULT_UV_VERSION }}
-          enable-cache: true
-          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
-      - name: Update changelog
-        working-directory: docs
-        run: |
-          git branch ${{ needs.publish-release.outputs.version }}-changelog
-          git checkout ${{ needs.publish-release.outputs.version }}-changelog
-
-          echo -e "# Changelog\n\n${{ needs.publish-release.outputs.changelog }}\n" > changelog-new.md
-
-          echo "Manually linking usernames"
-          sed -i -r 's|@([a-zA-Z0-9_]+) \(\[#|[@\1](https://github.com/\1) ([#|g' changelog-new.md
-
-          echo "Removing unneeded comment tags"
-          sed -i -r 's|@<!---->|@|g' changelog-new.md
-
-          CURRENT_CHANGELOG=$(tail --lines +2 changelog.md)
-          echo -e "$CURRENT_CHANGELOG" >> changelog-new.md
-          mv changelog-new.md changelog.md
-
-          uv run \
-            --python ${{ steps.setup-python.outputs.python-version }} \
-            --dev \
-            pre-commit run --files changelog.md || true
-
-          git config --global user.name "github-actions"
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git commit -am "Changelog ${{ needs.publish-release.outputs.version }} - GHA"
-          git push origin ${{ needs.publish-release.outputs.version }}-changelog
-      - name: Create pull request
-        uses: actions/github-script@v8
-        with:
-          script: |
-            const { repo, owner } = context.repo;
-            const result = await github.rest.pulls.create({
-              title: 'Documentation: Add ${{ needs.publish-release.outputs.version }} changelog',
-              owner,
-              repo,
-              head: '${{ needs.publish-release.outputs.version }}-changelog',
-              base: 'main',
-              body: 'This PR is auto-generated by CI.'
-            });
-            github.rest.issues.addLabels({
-              owner,
-              repo,
-              issue_number: result.data.number,
-              labels: ['documentation', 'skip-changelog']
-            });

.github/workflows/ci.yml

@@ -0,0 +1,675 @@
+name: ci
+on:
+  push:
+    tags:
+      # https://semver.org/#spec-item-2
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+      # https://semver.org/#spec-item-9
+      - 'v[0-9]+.[0-9]+.[0-9]+-beta.rc[0-9]+'
+    branches-ignore:
+      - 'translations**'
+  pull_request:
+    branches-ignore:
+      - 'translations**'
+env:
+  DEFAULT_UV_VERSION: "0.9.x"
+  # This is the default version of Python to use in most steps which aren't specific
+  DEFAULT_PYTHON_VERSION: "3.11"
+  NLTK_DATA: "/usr/share/nltk_data"
+jobs:
+  detect-duplicate:
+    name: Detect Duplicate Run
+    runs-on: ubuntu-24.04
+    outputs:
+      should_run: ${{ steps.check.outputs.should_run }}
+    steps:
+      - name: Check if workflow should run
+        id: check
+        uses: actions/github-script@v8
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            if (context.eventName !== 'push') {
+              core.info('Not a push event; running workflow.');
+              core.setOutput('should_run', 'true');
+              return;
+            }
+
+            const ref = context.ref || '';
+            if (!ref.startsWith('refs/heads/')) {
+              core.info('Push is not to a branch; running workflow.');
+              core.setOutput('should_run', 'true');
+              return;
+            }
+
+            const branch = ref.substring('refs/heads/'.length);
+            const { owner, repo } = context.repo;
+            const prs = await github.paginate(github.rest.pulls.list, {
+              owner,
+              repo,
+              state: 'open',
+              head: `${owner}:${branch}`,
+              per_page: 100,
+            });
+
+            if (prs.length === 0) {
+              core.info(`No open PR found for ${branch}; running workflow.`);
+              core.setOutput('should_run', 'true');
+            } else {
+              core.info(`Found ${prs.length} open PR(s) for ${branch}; skipping duplicate push run.`);
+              core.setOutput('should_run', 'false');
+            }
+  pre-commit:
+    needs:
+      - detect-duplicate
+    if: needs.detect-duplicate.outputs.should_run == 'true'
+    name: Linting Checks
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+      - name: Install python
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
+      - name: Check files
+        uses: pre-commit/action@v3.0.1
+  documentation:
+    name: "Build & Deploy Documentation"
+    runs-on: ubuntu-24.04
+    needs:
+      - pre-commit
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+      - name: Set up Python
+        id: setup-python
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          version: ${{ env.DEFAULT_UV_VERSION }}
+          enable-cache: true
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
+      - name: Install Python dependencies
+        run: |
+          uv sync --python ${{ steps.setup-python.outputs.python-version }} --dev --frozen
+      - name: Make documentation
+        run: |
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            --dev \
+            --frozen \
+            mkdocs build --config-file ./mkdocs.yml
+      - name: Deploy documentation
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: |
+          echo "docs.paperless-ngx.com" > "${{ github.workspace }}/docs/CNAME"
+          git config --global user.name "${{ github.actor }}"
+          git config --global user.email "${{ github.actor }}@users.noreply.github.com"
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            --dev \
+            --frozen \
+            mkdocs gh-deploy --force --no-history
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: documentation
+          path: site/
+          retention-days: 7
+  tests-backend:
+    name: "Backend Tests (Python ${{ matrix.python-version }})"
+    runs-on: ubuntu-24.04
+    needs:
+      - pre-commit
+    strategy:
+      matrix:
+        python-version: ['3.10', '3.11', '3.12']
+      fail-fast: false
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+      - name: Start containers
+        run: |
+          docker compose --file ${{ github.workspace }}/docker/compose/docker-compose.ci-test.yml pull --quiet
+          docker compose --file ${{ github.workspace }}/docker/compose/docker-compose.ci-test.yml up --detach
+      - name: Set up Python
+        id: setup-python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "${{ matrix.python-version }}"
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          version: ${{ env.DEFAULT_UV_VERSION }}
+          enable-cache: true
+          python-version: ${{ steps.setup-python.outputs.python-version }}
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -qq --no-install-recommends unpaper tesseract-ocr imagemagick ghostscript libzbar0 poppler-utils
+      - name: Configure ImageMagick
+        run: |
+          sudo cp docker/rootfs/etc/ImageMagick-6/paperless-policy.xml /etc/ImageMagick-6/policy.xml
+      - name: Install Python dependencies
+        run: |
+          uv sync \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            --group testing \
+            --frozen
+      - name: List installed Python dependencies
+        run: |
+          uv pip list
+      - name: Install or update NLTK dependencies
+        run: uv run python -m nltk.downloader punkt punkt_tab snowball_data stopwords -d ${{ env.NLTK_DATA }}
+      - name: Tests
+        env:
+          NLTK_DATA: ${{ env.NLTK_DATA }}
+          PAPERLESS_CI_TEST: 1
+          # Enable paperless_mail testing against real server
+          PAPERLESS_MAIL_TEST_HOST: ${{ secrets.TEST_MAIL_HOST }}
+          PAPERLESS_MAIL_TEST_USER: ${{ secrets.TEST_MAIL_USER }}
+          PAPERLESS_MAIL_TEST_PASSWD: ${{ secrets.TEST_MAIL_PASSWD }}
+        run: |
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            --dev \
+            --frozen \
+            pytest
+      - name: Upload backend test results to Codecov
+        if: always()
+        uses: codecov/codecov-action@v5
+        with:
+          flags: backend-python-${{ matrix.python-version }}
+          files: junit.xml
+          report_type: test_results
+      - name: Upload backend coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          flags: backend-python-${{ matrix.python-version }}
+          files: coverage.xml
+      - name: Stop containers
+        if: always()
+        run: |
+          docker compose --file ${{ github.workspace }}/docker/compose/docker-compose.ci-test.yml logs
+          docker compose --file ${{ github.workspace }}/docker/compose/docker-compose.ci-test.yml down
+  install-frontend-dependencies:
+    name: "Install Frontend Dependencies"
+    runs-on: ubuntu-24.04
+    needs:
+      - pre-commit
+    steps:
+      - uses: actions/checkout@v5
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+      - name: Use Node.js 20
+        uses: actions/setup-node@v5
+        with:
+          node-version: 20.x
+          cache: 'pnpm'
+          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
+      - name: Cache frontend dependencies
+        id: cache-frontend-deps
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.pnpm-store
+            ~/.cache
+          key: ${{ runner.os }}-frontenddeps-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
+      - name: Install dependencies
+        run: cd src-ui && pnpm install
+  tests-frontend:
+    name: "Frontend Unit Tests (Node ${{ matrix.node-version }} - ${{ matrix.shard-index }}/${{ matrix.shard-count }})"
+    runs-on: ubuntu-24.04
+    needs:
+      - install-frontend-dependencies
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: [20.x]
+        shard-index: [1, 2, 3, 4]
+        shard-count: [4]
+    steps:
+      - uses: actions/checkout@v5
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+      - name: Use Node.js 20
+        uses: actions/setup-node@v5
+        with:
+          node-version: 20.x
+          cache: 'pnpm'
+          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
+      - name: Cache frontend dependencies
+        id: cache-frontend-deps
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.pnpm-store
+            ~/.cache
+          key: ${{ runner.os }}-frontenddeps-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
+      - name: Re-link Angular cli
+        run: cd src-ui && pnpm link @angular/cli
+      - name: Linting checks
+        run: cd src-ui && pnpm run lint
+      - name: Run Jest unit tests
+        run: cd src-ui && pnpm run test --max-workers=2 --shard=${{ matrix.shard-index }}/${{ matrix.shard-count }}
+      - name: Upload frontend test results to Codecov
+        if: always()
+        uses: codecov/codecov-action@v5
+        with:
+          flags: frontend-node-${{ matrix.node-version }}
+          directory: src-ui/
+          report_type: test_results
+      - name: Upload frontend coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          flags: frontend-node-${{ matrix.node-version }}
+          directory: src-ui/coverage/
+  tests-frontend-e2e:
+    name: "Frontend E2E Tests (Node ${{ matrix.node-version }} - ${{ matrix.shard-index }}/${{ matrix.shard-count }})"
+    runs-on: ubuntu-24.04
+    needs:
+      - install-frontend-dependencies
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: [20.x]
+        shard-index: [1, 2]
+        shard-count: [2]
+    steps:
+      - uses: actions/checkout@v5
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+      - name: Use Node.js 20
+        uses: actions/setup-node@v5
+        with:
+          node-version: 20.x
+          cache: 'pnpm'
+          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
+      - name: Cache frontend dependencies
+        id: cache-frontend-deps
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.pnpm-store
+            ~/.cache
+          key: ${{ runner.os }}-frontenddeps-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
+      - name: Re-link Angular cli
+        run: cd src-ui && pnpm link @angular/cli
+      - name: Cache Playwright browsers
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: ${{ runner.os }}-playwright-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-playwright-
+      - name: Install Playwright system dependencies
+        run: npx playwright install-deps
+      - name: Install dependencies
+        run: cd src-ui && pnpm install --no-frozen-lockfile
+      - name: Install Playwright
+        run: cd src-ui && pnpm exec playwright install
+      - name: Run Playwright e2e tests
+        run: cd src-ui && pnpm exec playwright test --shard ${{ matrix.shard-index }}/${{ matrix.shard-count }}
+  frontend-bundle-analysis:
+    name: "Frontend Bundle Analysis"
+    runs-on: ubuntu-24.04
+    needs:
+      - tests-frontend
+      - tests-frontend-e2e
+    steps:
+      - uses: actions/checkout@v5
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+      - name: Use Node.js 20
+        uses: actions/setup-node@v5
+        with:
+          node-version: 20.x
+          cache: 'pnpm'
+          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
+      - name: Cache frontend dependencies
+        id: cache-frontend-deps
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.pnpm-store
+            ~/.cache
+          key: ${{ runner.os }}-frontenddeps-${{ hashFiles('src-ui/package-lock.json') }}
+      - name: Re-link Angular cli
+        run: cd src-ui && pnpm link @angular/cli
+      - name: Build frontend and upload analysis
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+        run: cd src-ui && pnpm run build --configuration=production
+  build-docker-image:
+    name: Build Docker image for ${{ github.ref_name }}
+    runs-on: ubuntu-24.04
+    if: github.event_name == 'push' && (startsWith(github.ref, 'refs/heads/feature-') || startsWith(github.ref, 'refs/heads/fix-') || github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/beta' || contains(github.ref, 'beta.rc') || startsWith(github.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/heads/l10n_'))
+    concurrency:
+      group: ${{ github.workflow }}-build-docker-image-${{ github.ref_name }}
+      cancel-in-progress: true
+    needs:
+      - tests-backend
+      - tests-frontend
+      - tests-frontend-e2e
+    steps:
+      - name: Check pushing to Docker Hub
+        id: push-other-places
+        # Only push to Dockerhub from the main repo AND the ref is either:
+        #  main
+        #  dev
+        #  beta
+        #  a tag
+        # Otherwise forks would require a Docker Hub account and secrets setup
+        run: |
+          if [[ ${{ github.repository_owner }} == "paperless-ngx" && ( ${{ github.ref_name }} == "dev" || ${{ github.ref_name }} == "beta" || ${{ startsWith(github.ref, 'refs/tags/v') }} == "true" ) ]] ; then
+            echo "Enabling DockerHub image push"
+            echo "enable=true" >> $GITHUB_OUTPUT
+          else
+            echo "Not pushing to DockerHub"
+            echo "enable=false" >> $GITHUB_OUTPUT
+          fi
+      - name: Set ghcr repository name
+        id: set-ghcr-repository
+        run: |
+          ghcr_name=$(echo "${{ github.repository }}" | awk '{ print tolower($0) }')
+          echo "Name is ${ghcr_name}"
+          echo "ghcr-repository=${ghcr_name}" >> $GITHUB_OUTPUT
+      - name: Gather Docker metadata
+        id: docker-meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}
+            name=paperlessngx/paperless-ngx,enable=${{ steps.push-other-places.outputs.enable }}
+            name=quay.io/paperlessngx/paperless-ngx,enable=${{ steps.push-other-places.outputs.enable }}
+          tags: |
+            # Tag branches with branch name
+            type=ref,event=branch
+            # Process semver tags
+            # For a tag x.y.z or vX.Y.Z, output an x.y.z and x.y image tag
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+      - name: Checkout
+        uses: actions/checkout@v5
+      # If https://github.com/docker/buildx/issues/1044 is resolved,
+      # the append input with a native arm64 arch could be used to
+      # significantly speed up building
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: arm64
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        # Don't attempt to login if not pushing to Docker Hub
+        if: steps.push-other-places.outputs.enable == 'true'
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to Quay.io
+        uses: docker/login-action@v3
+        # Don't attempt to login if not pushing to Quay.io
+        if: steps.push-other-places.outputs.enable == 'true'
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_USERNAME }}
+          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.docker-meta.outputs.tags }}
+          labels: ${{ steps.docker-meta.outputs.labels }}
+          build-args: |
+            PNGX_TAG_VERSION=${{ steps.docker-meta.outputs.version }}
+          # Get cache layers from this branch, then dev
+          # This allows new branches to get at least some cache benefits, generally from dev
+          cache-from: |
+            type=registry,ref=ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}/builder/cache/app:${{ github.ref_name }}
+            type=registry,ref=ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}/builder/cache/app:dev
+          cache-to: |
+            type=registry,mode=max,ref=ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}/builder/cache/app:${{ github.ref_name }}
+      - name: Inspect image
+        run: |
+          docker buildx imagetools inspect ${{ fromJSON(steps.docker-meta.outputs.json).tags[0] }}
+      - name: Export frontend artifact from docker
+        run: |
+          docker create --name frontend-extract ${{ fromJSON(steps.docker-meta.outputs.json).tags[0] }}
+          docker cp frontend-extract:/usr/src/paperless/src/documents/static/frontend src/documents/static/frontend/
+      - name: Upload frontend artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: frontend-compiled
+          path: src/documents/static/frontend/
+          retention-days: 7
+  build-release:
+    name: "Build Release"
+    needs:
+      - build-docker-image
+      - documentation
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+      - name: Set up Python
+        id: setup-python
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          version: ${{ env.DEFAULT_UV_VERSION }}
+          enable-cache: true
+          python-version: ${{ steps.setup-python.outputs.python-version }}
+      - name: Install Python dependencies
+        run: |
+          uv sync --python ${{ steps.setup-python.outputs.python-version }} --dev --frozen
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -qq --no-install-recommends gettext liblept5
+      - name: Download frontend artifact
+        uses: actions/download-artifact@v5
+        with:
+          name: frontend-compiled
+          path: src/documents/static/frontend/
+      - name: Download documentation artifact
+        uses: actions/download-artifact@v5
+        with:
+          name: documentation
+          path: docs/_build/html/
+      - name: Generate requirements file
+        run: |
+          uv export --quiet --no-dev --all-extras --format requirements-txt --output-file requirements.txt
+      - name: Compile messages
+        run: |
+          cd src/
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            manage.py compilemessages
+      - name: Collect static files
+        run: |
+          cd src/
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            manage.py collectstatic --no-input
+      - name: Move files
+        run: |
+          echo "Making dist folders"
+          for directory in dist \
+                          dist/paperless-ngx \
+                          dist/paperless-ngx/scripts;
+          do
+            mkdir --verbose --parents ${directory}
+          done
+
+          echo "Copying basic files"
+          for file_name in .dockerignore \
+                          .env \
+                          Dockerfile \
+                          pyproject.toml \
+                          uv.lock \
+                          requirements.txt \
+                          LICENSE \
+                          README.md \
+                          paperless.conf.example
+          do
+            cp --verbose ${file_name} dist/paperless-ngx/
+          done
+          mv --verbose dist/paperless-ngx/paperless.conf.example dist/paperless-ngx/paperless.conf
+
+          echo "Copying Docker related files"
+          cp --recursive docker/ dist/paperless-ngx/docker
+
+          echo "Copying startup scripts"
+          cp --verbose scripts/*.service scripts/*.sh scripts/*.socket dist/paperless-ngx/scripts/
+
+          echo "Copying source files"
+          cp --recursive src/ dist/paperless-ngx/src
+          echo "Copying documentation"
+          cp --recursive docs/_build/html/ dist/paperless-ngx/docs
+
+          mv --verbose static dist/paperless-ngx
+      - name: Make release package
+        run: |
+          echo "Creating release archive"
+          cd dist
+          sudo chown -R 1000:1000 paperless-ngx/
+          tar -cJf paperless-ngx.tar.xz paperless-ngx/
+      - name: Upload release artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: release
+          path: dist/paperless-ngx.tar.xz
+          retention-days: 7
+  publish-release:
+    name: "Publish Release"
+    runs-on: ubuntu-24.04
+    outputs:
+      prerelease: ${{ steps.get_version.outputs.prerelease }}
+      changelog: ${{ steps.create-release.outputs.body }}
+      version: ${{ steps.get_version.outputs.version }}
+    needs:
+      - build-release
+    if: github.ref_type == 'tag' && (startsWith(github.ref_name, 'v') || contains(github.ref_name, '-beta.rc'))
+    steps:
+      - name: Download release artifact
+        uses: actions/download-artifact@v5
+        with:
+          name: release
+          path: ./
+      - name: Get version
+        id: get_version
+        run: |
+          echo "version=${{ github.ref_name }}" >> $GITHUB_OUTPUT
+          if [[ ${{ contains(github.ref_name, '-beta.rc') }} == 'true' ]]; then
+            echo "prerelease=true" >> $GITHUB_OUTPUT
+          else
+            echo "prerelease=false" >> $GITHUB_OUTPUT
+          fi
+      - name: Create Release and Changelog
+        id: create-release
+        uses: release-drafter/release-drafter@v6
+        with:
+          name: Paperless-ngx ${{ steps.get_version.outputs.version }}
+          tag: ${{ steps.get_version.outputs.version }}
+          version: ${{ steps.get_version.outputs.version }}
+          prerelease: ${{ steps.get_version.outputs.prerelease }}
+          publish: true # ensures release is not marked as draft
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Upload release archive
+        id: upload-release-asset
+        uses: shogo82148/actions-upload-release-asset@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          upload_url: ${{ steps.create-release.outputs.upload_url }}
+          asset_path: ./paperless-ngx.tar.xz
+          asset_name: paperless-ngx-${{ steps.get_version.outputs.version }}.tar.xz
+          asset_content_type: application/x-xz
+  append-changelog:
+    name: "Append Changelog"
+    runs-on: ubuntu-24.04
+    needs:
+      - publish-release
+    if: needs.publish-release.outputs.prerelease == 'false'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          ref: main
+      - name: Set up Python
+        id: setup-python
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          version: ${{ env.DEFAULT_UV_VERSION }}
+          enable-cache: true
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
+      - name: Append Changelog to docs
+        id: append-Changelog
+        working-directory: docs
+        run: |
+          git branch ${{ needs.publish-release.outputs.version }}-changelog
+          git checkout ${{ needs.publish-release.outputs.version }}-changelog
+          echo -e "# Changelog\n\n${{ needs.publish-release.outputs.changelog }}\n" > changelog-new.md
+          echo "Manually linking usernames"
+          sed -i -r 's|@([a-zA-Z0-9_]+) \(\[#|[@\1](https://github.com/\1) ([#|g' changelog-new.md
+          echo "Removing unneeded comment tags"
+          sed -i -r 's|@<!---->|@|g' changelog-new.md
+          CURRENT_CHANGELOG=`tail --lines +2 changelog.md`
+          echo -e "$CURRENT_CHANGELOG" >> changelog-new.md
+          mv changelog-new.md changelog.md
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            --dev \
+            pre-commit run --files changelog.md || true
+          git config --global user.name "github-actions"
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git commit -am "Changelog ${{ needs.publish-release.outputs.version }} - GHA"
+          git push origin ${{ needs.publish-release.outputs.version }}-changelog
+      - name: Create Pull Request
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const { repo, owner } = context.repo;
+            const result = await github.rest.pulls.create({
+              title: 'Documentation: Add ${{ needs.publish-release.outputs.version }} changelog',
+              owner,
+              repo,
+              head: '${{ needs.publish-release.outputs.version }}-changelog',
+              base: 'main',
+              body: 'This PR is auto-generated by CI.'
+            });
+            github.rest.issues.addLabels({
+              owner,
+              repo,
+              issue_number: result.data.number,
+              labels: ['documentation', 'skip-changelog']
+            });

.github/workflows/cleanup-tags.yml

@@ -27,7 +27,7 @@ jobs:
     steps:
       - name: Clean temporary images
         if: "${{ env.TOKEN != '' }}"
-        uses: stumpylog/image-cleaner-action/ephemeral@v0.12.0
+        uses: stumpylog/image-cleaner-action/ephemeral@v0.11.0
         with:
           token: "${{ env.TOKEN }}"
           owner: "${{ github.repository_owner }}"
@@ -53,7 +53,7 @@ jobs:
     steps:
       - name: Clean untagged images
         if: "${{ env.TOKEN != '' }}"
-        uses: stumpylog/image-cleaner-action/untagged@v0.12.0
+        uses: stumpylog/image-cleaner-action/untagged@v0.11.0
         with:
           token: "${{ env.TOKEN }}"
           owner: "${{ github.repository_owner }}"

.github/workflows/codeql-analysis.yml

@@ -34,10 +34,10 @@ jobs:
         # Learn more about CodeQL language support at https://git.io/codeql-language-support
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v3
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -45,4 +45,4 @@ jobs:
           # Prefix the list here with "+" to use these queries and those in the config file.
           # queries: ./path/to/local/query, your-org/your-repo/queries@main
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v3

.github/workflows/crowdin.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
         with:
           token: ${{ secrets.PNGX_BOT_PAT }}
       - name: crowdin action

.github/workflows/repo-maintenance.yml

@@ -37,7 +37,7 @@ jobs:
     if: github.repository_owner == 'paperless-ngx'
     runs-on: ubuntu-24.04
     steps:
-      - uses: dessant/lock-threads@v6
+      - uses: dessant/lock-threads@v5
         with:
           issue-inactive-days: '30'
           pr-inactive-days: '30'

.github/workflows/translate-strings.yml

@@ -11,12 +11,10 @@ jobs:
       contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
-        env:
-          GH_REF: ${{ github.ref }} # sonar rule:githubactions:S7630 - avoid injection
         with:
           token: ${{ secrets.PNGX_BOT_PAT }}
-          ref: ${{ env.GH_REF }}
+          ref: ${{ github.head_ref }}
       - name: Set up Python
         id: setup-python
         uses: actions/setup-python@v6
@@ -25,7 +23,7 @@ jobs:
           sudo apt-get update -qq
           sudo apt-get install -qq --no-install-recommends gettext
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@v6
         with:
           enable-cache: true
       - name: Install backend python dependencies
@@ -39,15 +37,15 @@ jobs:
         uses: pnpm/action-setup@v4
         with:
           version: 10
-      - name: Use Node.js 24
+      - name: Use Node.js 20
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v5
         with:
-          node-version: 24.x
+          node-version: 20.x
           cache: 'pnpm'
           cache-dependency-path: 'src-ui/pnpm-lock.yaml'
       - name: Cache frontend dependencies
         id: cache-frontend-deps
-        uses: actions/cache@v5
+        uses: actions/cache@v4
         with:
           path: |
             ~/.pnpm-store
@@ -63,7 +61,7 @@ jobs:
           cd src-ui
           pnpm run ng extract-i18n
       - name: Commit changes
-        uses: stefanzweifel/git-auto-commit-action@v7
+        uses: stefanzweifel/git-auto-commit-action@v6
         with:
           file_pattern: 'src-ui/messages.xlf src/locale/en_US/LC_MESSAGES/django.po'
           commit_message: "Auto translate strings"

.pre-commit-config.yaml

@@ -49,12 +49,12 @@ repos:
           - 'prettier-plugin-organize-imports@4.1.0'
   # Python hooks
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.5
+    rev: v0.14.0
     hooks:
       - id: ruff-check
       - id: ruff-format
   - repo: https://github.com/tox-dev/pyproject-fmt
-    rev: "v2.11.1"
+    rev: "v2.11.0"
     hooks:
       - id: pyproject-fmt
   # Dockerfile hooks
@@ -64,11 +64,11 @@ repos:
       - id: hadolint
   # Shell script hooks
   - repo: https://github.com/lovesegfault/beautysh
-    rev: v6.4.2
+    rev: v6.2.1
     hooks:
       - id: beautysh
-        types: [file]
+        additional_dependencies:
-        files: (\.sh$|/run$|/finish$)
+          - setuptools
         args:
           - "--tab"
   - repo: https://github.com/shellcheck-py/shellcheck-py
@@ -76,7 +76,7 @@ repos:
     hooks:
       - id: shellcheck
   - repo: https://github.com/google/yamlfmt
-    rev: v0.20.0
+    rev: v0.18.0
     hooks:
       - id: yamlfmt
         exclude: "^src-ui/pnpm-lock.yaml"

Dockerfile

@@ -5,12 +5,14 @@
 # Purpose: Compiles the frontend
 # Notes:
 #  - Does PNPM stuff with Typescript and such
-FROM --platform=$BUILDPLATFORM docker.io/node:24-trixie-slim AS compile-frontend
+FROM --platform=$BUILDPLATFORM docker.io/node:20-bookworm-slim AS compile-frontend
 
 COPY ./src-ui /src/src-ui
 
 WORKDIR /src/src-ui
 RUN set -eux \
+  && npm update -g pnpm \
+  && npm install -g corepack@latest \
   && corepack enable \
   && pnpm install
 
@@ -30,7 +32,7 @@ RUN set -eux \
 # Purpose: Installs s6-overlay and rootfs
 # Comments:
 #  - Don't leave anything extra in here either
-FROM ghcr.io/astral-sh/uv:0.9.26-python3.12-trixie-slim AS s6-overlay-base
+FROM ghcr.io/astral-sh/uv:0.9.4-python3.12-bookworm-slim AS s6-overlay-base
 
 WORKDIR /usr/src/s6
 
@@ -100,6 +102,8 @@ ARG TARGETARCH
 
 # Can be workflow provided, defaults set for manual building
 ARG JBIG2ENC_VERSION=0.30
+ARG QPDF_VERSION=11.9.0
+ARG GS_VERSION=10.03.1
 
 # Set Python environment variables
 ENV PYTHONDONTWRITEBYTECODE=1 \
@@ -108,7 +112,8 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONWARNINGS="ignore:::django.http.response:517" \
     PNGX_CONTAINERIZED=1 \
     # https://docs.astral.sh/uv/reference/settings/#link-mode
-    UV_LINK_MODE=copy
+    UV_LINK_MODE=copy \
+    UV_CACHE_DIR=/cache/uv/
 
 #
 # Begin installation and configuration
@@ -165,8 +170,20 @@ RUN set -eux \
     && apt-get update \
     && apt-get install --yes --quiet --no-install-recommends ${RUNTIME_PACKAGES} \
     && echo "Installing pre-built updates" \
-      && curl --fail --silent --no-progress-meter --show-error --location --remote-name-all \
+      && curl --fail --silent --no-progress-meter --show-error --location --remote-name-all --parallel --parallel-max 4 \
-        https://github.com/paperless-ngx/builder/releases/download/jbig2enc-trixie-v${JBIG2ENC_VERSION}/jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/qpdf-${QPDF_VERSION}/libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/qpdf-${QPDF_VERSION}/qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
+        https://github.com/paperless-ngx/builder/releases/download/jbig2enc-${JBIG2ENC_VERSION}/jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
+      && echo "Installing qpdf ${QPDF_VERSION}" \
+        && dpkg --install ./libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+        && dpkg --install ./qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+      && echo "Installing Ghostscript ${GS_VERSION}" \
+        && dpkg --install ./libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
+        && dpkg --install ./libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+        && dpkg --install ./ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
       && echo "Installing jbig2enc" \
         && dpkg --install ./jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
       && echo "Configuring imagemagick" \
@@ -190,17 +207,14 @@ ARG BUILD_PACKAGES="\
   pkg-config"
 
 # hadolint ignore=DL3042
-RUN set -eux \
+RUN --mount=type=cache,target=${UV_CACHE_DIR},id=python-cache \
+  set -eux \
   && echo "Installing build system packages" \
     && apt-get update \
     && apt-get install --yes --quiet --no-install-recommends ${BUILD_PACKAGES} \
   && echo "Installing Python requirements" \
     && uv export --quiet --no-dev --all-extras --format requirements-txt --output-file requirements.txt \
-    && uv pip install --no-cache --system --no-python-downloads --python-preference system \
+    && uv pip install --system --no-python-downloads --python-preference system --requirements requirements.txt \
-      --index https://pypi.org/simple \
-      --index https://download.pytorch.org/whl/cpu \
-      --index-strategy unsafe-best-match \
-      --requirements requirements.txt \
   && echo "Installing NLTK data" \
     && python3 -W ignore::RuntimeWarning -m nltk.downloader -d "/usr/share/nltk_data" snowball_data \
     && python3 -W ignore::RuntimeWarning -m nltk.downloader -d "/usr/share/nltk_data" stopwords \
@@ -240,8 +254,7 @@ RUN set -eux \
     && chown --from root:root --changes --recursive paperless:paperless /usr/src/paperless \
   && echo "Collecting static files" \
     && s6-setuidgid paperless python3 manage.py collectstatic --clear --no-input --link \
-    && s6-setuidgid paperless python3 manage.py compilemessages \
+    && s6-setuidgid paperless python3 manage.py compilemessages
-    && /usr/local/bin/deduplicate.py --verbose /usr/src/paperless/static/
 
 VOLUME ["/usr/src/paperless/data", \
         "/usr/src/paperless/media", \

docker/compose/docker-compose.ci-test.yml

@@ -4,7 +4,7 @@
 # correct networking for the tests
 services:
   gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.25
+    image: docker.io/gotenberg/gotenberg:8.24
     hostname: gotenberg
     container_name: gotenberg
     network_mode: host

docker/compose/docker-compose.mariadb-tika.yml

@@ -72,7 +72,7 @@ services:
       PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
       PAPERLESS_TIKA_ENDPOINT: http://tika:9998
   gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.25
+    image: docker.io/gotenberg/gotenberg:8.24
     restart: unless-stopped
     # The gotenberg chromium route is used to convert .eml files. We do not
     # want to allow external content like tracking pixels or even javascript.

docker/compose/docker-compose.postgres-tika.yml

@@ -66,7 +66,7 @@ services:
       PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
       PAPERLESS_TIKA_ENDPOINT: http://tika:9998
   gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.25
+    image: docker.io/gotenberg/gotenberg:8.24
     restart: unless-stopped
     # The gotenberg chromium route is used to convert .eml files. We do not
     # want to allow external content like tracking pixels or even javascript.

docker/compose/docker-compose.sqlite-tika.yml

@@ -55,7 +55,7 @@ services:
       PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
       PAPERLESS_TIKA_ENDPOINT: http://tika:9998
   gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.25
+    image: docker.io/gotenberg/gotenberg:8.24
     restart: unless-stopped
     # The gotenberg chromium route is used to convert .eml files. We do not
     # want to allow external content like tracking pixels or even javascript.

docker/install_management_commands.sh

@@ -4,7 +4,8 @@
 
 set -eu
 
-for command in document_archiver \
+for command in decrypt_documents \
+	document_archiver \
 	document_exporter \
 	document_importer \
 	mail_fetcher \

docker/rootfs/etc/s6-overlay/s6-rc.d/init-env-file/run

@@ -29,5 +29,5 @@ if find /run/s6/container_environment/*"_FILE" -maxdepth 1 > /dev/null 2>&1; the
 		fi
 	done
 else
-	echo "${log_prefix} No *_FILE environment found"
+		echo "${log_prefix} No *_FILE environment found"
 fi

docker/rootfs/etc/s6-overlay/s6-rc.d/init-wait-for-db/run

@@ -1,66 +1,70 @@
 #!/command/with-contenv /usr/bin/bash
 # shellcheck shell=bash
-# vim: set ft=bash ts=4 sw=4 sts=4 et :
 
-set -euo pipefail
+declare -r log_prefix="[init-db-wait]"
-
-declare -r LOG_PREFIX="[init-db-wait]"
-
-declare -ri TIMEOUT=60
-declare -i ATTEMPT=0
-declare -i DELAY=0
-declare -i STARTED_AT=${EPOCHSECONDS:?EPOCHSECONDS var unset}
-
-delay_next_attempt() {
-	local -i elapsed=$(( EPOCHSECONDS - STARTED_AT ))
-	local -ri remaining=$(( TIMEOUT - elapsed ))
-
-	if (( remaining <= 0 )); then
-		echo "${LOG_PREFIX} Unable to connect after $elapsed seconds."
-		exit 1
-	fi
-
-	DELAY+=1
-
-	# clamp to remaining time
-	if (( DELAY > remaining )); then
-		DELAY=$remaining
-	fi
-
-	ATTEMPT+=1
-	echo "${LOG_PREFIX} Attempt $ATTEMPT failed! Trying again in $DELAY seconds..."
-	sleep "$DELAY"
-}
 
 wait_for_postgres() {
-	echo "${LOG_PREFIX} Waiting for PostgreSQL to start..."
+	local attempt_num=1
+	local -r max_attempts=5
+
+	echo "${log_prefix} Waiting for PostgreSQL to start..."
 
 	local -r host="${PAPERLESS_DBHOST:-localhost}"
 	local -r port="${PAPERLESS_DBPORT:-5432}"
 	local -r user="${PAPERLESS_DBUSER:-paperless}"
 
-	while ! pg_isready -h "${host}" -p "${port}" --username "${user}"; do
+	# Disable warning, host and port can't have spaces
-		delay_next_attempt
+	# shellcheck disable=SC2086
+	while [ ! "$(pg_isready -h ${host} -p ${port} --username ${user})" ]; do
+
+		if [ $attempt_num -eq $max_attempts ]; then
+			echo "${log_prefix} Unable to connect to database."
+			exit 1
+		else
+			echo "${log_prefix} Attempt $attempt_num failed! Trying again in 5 seconds..."
+		fi
+
+		attempt_num=$(("$attempt_num" + 1))
+		sleep 5
 	done
-	echo "${LOG_PREFIX} Connected to PostgreSQL"
+	# Extra in case this is a first start
+	sleep 5
+	echo "Connected to PostgreSQL"
 }
 
 wait_for_mariadb() {
-	echo "${LOG_PREFIX} Waiting for MariaDB to start..."
+	echo "${log_prefix} Waiting for MariaDB to start..."
 
-	local -r host="${PAPERLESS_DBHOST:-localhost}"
+	local -r host="${PAPERLESS_DBHOST:=localhost}"
-	local -r port="${PAPERLESS_DBPORT:-3306}"
+	local -r port="${PAPERLESS_DBPORT:=3306}"
 
-	while ! mariadb-admin --host="${host}" --port="${port}" --skip-ssl ping --silent >/dev/null 2>&1; do
+	local attempt_num=1
-		delay_next_attempt
+	local -r max_attempts=5
+
+	# Disable warning, host and port can't have spaces
+	# shellcheck disable=SC2086
+	while ! true > /dev/tcp/$host/$port; do
+
+		if [ $attempt_num -eq $max_attempts ]; then
+			echo "${log_prefix} Unable to connect to database."
+			exit 1
+		else
+			echo "${log_prefix} Attempt $attempt_num failed! Trying again in 5 seconds..."
+
+		fi
+
+		attempt_num=$(("$attempt_num" + 1))
+		sleep 5
 	done
-	echo "${LOG_PREFIX} Connected to MariaDB"
+	echo "Connected to MariaDB"
 }
 
-if [[ "${PAPERLESS_DBENGINE:-}" == "mariadb" ]]; then
+if [[ "${PAPERLESS_DBENGINE}" == "mariadb" ]]; then
+	echo "${log_prefix} Waiting for MariaDB to report ready"
 	wait_for_mariadb
-elif [[ -n "${PAPERLESS_DBHOST:-}" ]]; then
+elif [[ -n "${PAPERLESS_DBHOST}" ]]; then
+	echo "${log_prefix} Waiting for postgresql to report ready"
 	wait_for_postgres
 fi
 
-echo "${LOG_PREFIX} Database is ready"
+	echo "${log_prefix} Database is ready"

docker/rootfs/etc/s6-overlay/s6-rc.d/svc-webserver/run

@@ -10,11 +10,11 @@ export GRANIAN_WORKERS=${GRANIAN_WORKERS:-${PAPERLESS_WEBSERVER_WORKERS:-1}}
 
 # Only set GRANIAN_URL_PATH_PREFIX if PAPERLESS_FORCE_SCRIPT_NAME is set
 if [[ -n "${PAPERLESS_FORCE_SCRIPT_NAME}" ]]; then
-	export GRANIAN_URL_PATH_PREFIX=${PAPERLESS_FORCE_SCRIPT_NAME}
+  export GRANIAN_URL_PATH_PREFIX=${PAPERLESS_FORCE_SCRIPT_NAME}
 fi
 
 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	exec granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
+  exec granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
 else
-	exec s6-setuidgid paperless granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
+  exec s6-setuidgid paperless granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
 fi

docker/rootfs/usr/local/bin/decrypt_documents

@@ -0,0 +1,14 @@
+#!/command/with-contenv /usr/bin/bash
+# shellcheck shell=bash
+
+set -e
+
+cd "${PAPERLESS_SRC_DIR}"
+
+if [[ $(id -u) == 0 ]]; then
+	s6-setuidgid paperless python3 manage.py decrypt_documents "$@"
+elif [[ $(id -un) == "paperless" ]]; then
+	python3 manage.py decrypt_documents "$@"
+else
+	echo "Unknown user."
+fi

docker/rootfs/usr/local/bin/deduplicate.py

@@ -1,167 +0,0 @@
-#!/usr/bin/env python3
-"""
-File deduplication script that replaces identical files with symlinks.
-Uses SHA256 hashing to identify duplicate files.
-"""
-
-import hashlib
-from collections import defaultdict
-from pathlib import Path
-
-import click
-import humanize
-
-
-def calculate_sha256(filepath: Path) -> str | None:
-    sha256_hash = hashlib.sha256()
-    try:
-        with filepath.open("rb") as f:
-            # Read file in chunks to handle large files efficiently
-            while chunk := f.read(65536):  # 64KB chunks
-                sha256_hash.update(chunk)
-        return sha256_hash.hexdigest()
-    except OSError as e:
-        click.echo(f"Error reading {filepath}: {e}", err=True)
-        return None
-
-
-def find_duplicate_files(directory: Path) -> dict[str, list[Path]]:
-    """
-    Recursively scan directory and group files by their SHA256 hash.
-    Returns a dictionary mapping hash -> list of file paths.
-    """
-    hash_to_files: dict[str, list[Path]] = defaultdict(list)
-
-    for filepath in directory.rglob("*"):
-        # Skip symlinks
-        if filepath.is_symlink():
-            continue
-
-        # Skip if not a regular file
-        if not filepath.is_file():
-            continue
-
-        file_hash = calculate_sha256(filepath)
-        if file_hash:
-            hash_to_files[file_hash].append(filepath)
-
-    # Filter to only return hashes with duplicates
-    return {h: files for h, files in hash_to_files.items() if len(files) > 1}
-
-
-def replace_with_symlinks(
-    duplicate_groups: dict[str, list[Path]],
-    *,
-    dry_run: bool = False,
-) -> tuple[int, int]:
-    """
-    Replace duplicate files with symlinks to the first occurrence.
-    Returns (number_of_files_replaced, space_saved_in_bytes).
-    """
-    total_duplicates = 0
-    space_saved = 0
-
-    for file_hash, file_list in duplicate_groups.items():
-        # Keep the first file as the original, replace others with symlinks
-        original_file = file_list[0]
-        duplicates = file_list[1:]
-
-        click.echo(f"Found {len(duplicates)} duplicate(s) of: {original_file}")
-
-        for duplicate in duplicates:
-            try:
-                # Get file size before deletion
-                file_size = duplicate.stat().st_size
-
-                if dry_run:
-                    click.echo(f"  [DRY RUN] Would replace: {duplicate}")
-                else:
-                    # Remove the duplicate file
-                    duplicate.unlink()
-
-                    # Create relative symlink if possible, otherwise absolute
-                    try:
-                        # Try to create a relative symlink
-                        rel_path = original_file.relative_to(duplicate.parent)
-                        duplicate.symlink_to(rel_path)
-                        click.echo(f"  Replaced: {duplicate} -> {rel_path}")
-                    except ValueError:
-                        # Fall back to absolute path
-                        duplicate.symlink_to(original_file.resolve())
-                        click.echo(f"  Replaced: {duplicate} -> {original_file}")
-
-                    space_saved += file_size
-
-                total_duplicates += 1
-
-            except OSError as e:
-                click.echo(f"  Error replacing {duplicate}: {e}", err=True)
-
-    return total_duplicates, space_saved
-
-
-@click.command()
-@click.argument(
-    "directory",
-    type=click.Path(
-        exists=True,
-        file_okay=False,
-        dir_okay=True,
-        readable=True,
-        path_type=Path,
-    ),
-)
-@click.option(
-    "--dry-run",
-    is_flag=True,
-    help="Show what would be done without making changes",
-)
-@click.option("--verbose", "-v", is_flag=True, help="Show verbose output")
-def deduplicate(directory: Path, *, dry_run: bool, verbose: bool) -> None:
-    """
-    Recursively search DIRECTORY for identical files and replace them with symlinks.
-
-    Uses SHA256 hashing to identify duplicate files. The first occurrence of each
-    unique file is kept, and all duplicates are replaced with symlinks pointing to it.
-    """
-    directory = directory.resolve()
-
-    click.echo(f"Scanning directory: {directory}")
-    if dry_run:
-        click.echo("Running in DRY RUN mode - no changes will be made")
-
-    # Find all duplicate files
-    click.echo("Calculating file hashes...")
-    duplicate_groups = find_duplicate_files(directory)
-
-    if not duplicate_groups:
-        click.echo("No duplicate files found!")
-        return
-
-    total_files = sum(len(files) - 1 for files in duplicate_groups.values())
-    click.echo(
-        f"Found {len(duplicate_groups)} group(s) of duplicates "
-        f"({total_files} files to deduplicate)",
-    )
-
-    if verbose:
-        for file_hash, files in duplicate_groups.items():
-            click.echo(f"Hash: {file_hash}")
-            for f in files:
-                click.echo(f"  - {f}")
-
-    # Replace duplicates with symlinks
-    click.echo("Processing duplicates...")
-    num_replaced, space_saved = replace_with_symlinks(duplicate_groups, dry_run=dry_run)
-
-    # Summary
-    click.echo(
-        f"{'Would replace' if dry_run else 'Replaced'} "
-        f"{num_replaced} duplicate file(s)",
-    )
-    if not dry_run:
-        click.echo(f"Space saved: {humanize.naturalsize(space_saved, binary=True)}")
-
-
-if __name__ == "__main__":
-    deduplicate()

docs/administration.md

@@ -580,6 +580,36 @@ document.
     documents, such as encrypted PDF documents. The archiver will skip over
     these documents each time it sees them.
 
+### Managing encryption {#encryption}
+
+!!! warning
+
+    Encryption was removed in [paperless-ng 0.9](changelog.md#paperless-ng-090)
+    because it did not really provide any additional security, the passphrase
+    was stored in a configuration file on the same system as the documents.
+    Furthermore, the entire text content of the documents is stored plain in
+    the database, even if your documents are encrypted. Filenames are not
+    encrypted as well. Finally, the web server provides transparent access to
+    your encrypted documents.
+
+    Consider running paperless on an encrypted filesystem instead, which
+    will then at least provide security against physical hardware theft.
+
+#### Enabling encryption
+
+Enabling encryption is no longer supported.
+
+#### Disabling encryption
+
+Basic usage to disable encryption of your document store:
+
+(Note: If `PAPERLESS_PASSPHRASE` isn't set already, you need to specify
+it here)
+
+```
+decrypt_documents [--passphrase SECR3TP4SSPHRA$E]
+```
+
 ### Detecting duplicates {#fuzzy_duplicate}
 
 Paperless already catches and prevents upload of exactly matching documents,

docs/advanced_usage.md

@@ -501,7 +501,7 @@ The `datetime` filter formats a datetime string or datetime object using Python'
 See the [strftime format code documentation](https://docs.python.org/3.13/library/datetime.html#strftime-and-strptime-format-codes)
 for the possible codes and their meanings.
 
-##### Date Localization {#date-localization}
+##### Date Localization
 
 The `localize_date` filter formats a date or datetime object into a localized string using Babel internationalization.
 This takes into account the provided locale for translation. Since this must be used on a date or datetime object,
@@ -851,8 +851,8 @@ followed by the even pages.
 
 It's important that the scan files get consumed in the correct order, and one at a time.
 You therefore need to make sure that Paperless is running while you upload the files into
-the directory; and if you're using polling, make sure that
+the directory; and if you're using [polling](configuration.md#polling), make sure that
-`CONSUMER_POLLING_INTERVAL` is set to a value lower than it takes for the second scan to appear,
+`CONSUMER_POLLING` is set to a value lower than it takes for the second scan to appear,
 like 5-10 or even lower.
 
 Another thing that might happen is that you start a double sided scan, but then forget

docs/api.md

@@ -294,13 +294,6 @@ The following methods are supported:
         -   `"delete_original": true` to delete the original documents after editing.
         -   `"update_document": true` to update the existing document with the edited PDF.
         -   `"include_metadata": true` to copy metadata from the original document to the edited document.
--   `remove_password`
-    -   Requires `parameters`:
-        -   `"password": "PASSWORD_STRING"` The password to remove from the PDF documents.
-    -   Optional `parameters`:
-        -   `"update_document": true` to replace the existing document with the password-less PDF.
-        -   `"delete_original": true` to delete the original document after editing.
-        -   `"include_metadata": true` to copy metadata from the original document to the new password-less document.
 -   `merge`
     -   No additional `parameters` required.
     -   The ordering of the merged document is determined by the list of IDs.

docs/changelog.md

@@ -1,286 +1,5 @@
 # Changelog
 
-## paperless-ngx 2.20.5
-
-### Bug Fixes
-
--   Fix: ensure horizontal scroll for long tag names in list, wrap tags without parent [@shamoon](https://github.com/shamoon) ([#11811](https://github.com/paperless-ngx/paperless-ngx/pull/11811))
--   Fix: use explicit order field for workflow actions [@shamoon](https://github.com/shamoon) [@stumpylog](https://github.com/stumpylog) ([#11781](https://github.com/paperless-ngx/paperless-ngx/pull/11781))
-
-### All App Changes
-
-<details>
-<summary>2 changes</summary>
-
--   Fix: ensure horizontal scroll for long tag names in list, wrap tags without parent [@shamoon](https://github.com/shamoon) ([#11811](https://github.com/paperless-ngx/paperless-ngx/pull/11811))
--   Fix: use explicit order field for workflow actions [@shamoon](https://github.com/shamoon) [@stumpylog](https://github.com/stumpylog) ([#11781](https://github.com/paperless-ngx/paperless-ngx/pull/11781))
-</details>
-
-## paperless-ngx 2.20.4
-
-### Security
-
--   Resolve [GHSA-28cf-xvcf-hw6m](https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-28cf-xvcf-hw6m)
-
-### Bug Fixes
-
--   Fix: propagate metadata override created value [@shamoon](https://github.com/shamoon) ([#11659](https://github.com/paperless-ngx/paperless-ngx/pull/11659))
--   Fix: support ordering by storage path name [@shamoon](https://github.com/shamoon) ([#11661](https://github.com/paperless-ngx/paperless-ngx/pull/11661))
--   Fix: validate cf integer values within PostgreSQL range [@shamoon](https://github.com/shamoon) ([#11666](https://github.com/paperless-ngx/paperless-ngx/pull/11666))
--   Fixhancement: add error handling and retry when opening index [@shamoon](https://github.com/shamoon) ([#11731](https://github.com/paperless-ngx/paperless-ngx/pull/11731))
--   Fix: fix recurring workflow to respect latest run time [@shamoon](https://github.com/shamoon) ([#11735](https://github.com/paperless-ngx/paperless-ngx/pull/11735))
-
-### All App Changes
-
-<details>
-<summary>5 changes</summary>
-
--   Fix: propagate metadata override created value [@shamoon](https://github.com/shamoon) ([#11659](https://github.com/paperless-ngx/paperless-ngx/pull/11659))
--   Fix: support ordering by storage path name [@shamoon](https://github.com/shamoon) ([#11661](https://github.com/paperless-ngx/paperless-ngx/pull/11661))
--   Fix: validate cf integer values within PostgreSQL range [@shamoon](https://github.com/shamoon) ([#11666](https://github.com/paperless-ngx/paperless-ngx/pull/11666))
--   Fixhancement: add error handling and retry when opening index [@shamoon](https://github.com/shamoon) ([#11731](https://github.com/paperless-ngx/paperless-ngx/pull/11731))
--   Fix: fix recurring workflow to respect latest run time [@shamoon](https://github.com/shamoon) ([#11735](https://github.com/paperless-ngx/paperless-ngx/pull/11735))
-</details>
-
-## paperless-ngx 2.20.3
-
-### Security
-
--   Resolve [GHSA-7cq3-mhxq-w946](https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-7cq3-mhxq-w946)
-
-## paperless-ngx 2.20.2
-
-### Security
-
--   Resolve [GHSA-6653-vcx4-69mc](https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-6653-vcx4-69mc)
--   Resolve [GHSA-24x5-wp64-9fcc](https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-24x5-wp64-9fcc)
-
-### Features / Enhancements
-
--   Tweakhancement: dim inactive users in users-groups list [@shamoon](https://github.com/shamoon) ([#11537](https://github.com/paperless-ngx/paperless-ngx/pull/11537))
-
-### Bug Fixes
-
--   Fix: Expanded SVG validation whitelist and additional checks [@stumpylog](https://github.com/stumpylog) ([#11590](https://github.com/paperless-ngx/paperless-ngx/pull/11590))
--   Fix: normalize allowed SVG tag and attribute names, add version [@shamoon](https://github.com/shamoon) ([#11586](https://github.com/paperless-ngx/paperless-ngx/pull/11586))
--   Fix: pass additional arguments to TagSerializer for permissions [@shamoon](https://github.com/shamoon) ([#11576](https://github.com/paperless-ngx/paperless-ngx/pull/11576))
-
-### Maintenance
-
--   Chore(deps): Bump actions/checkout from 5 to 6 in the actions group @[dependabot[bot]](https://github.com/apps/dependabot) ([#11515](https://github.com/paperless-ngx/paperless-ngx/pull/11515))
-
-### Dependencies
-
-<details>
-<summary>6 changes</summary>
-
--   Chore: update Angular dependencies to 20.3.15 [@shamoon](https://github.com/shamoon) ([#11568](https://github.com/paperless-ngx/paperless-ngx/pull/11568))
--   Chore(deps): Bump actions/checkout from 5 to 6 in the actions group @[dependabot[bot]](https://github.com/apps/dependabot) ([#11515](https://github.com/paperless-ngx/paperless-ngx/pull/11515))
--   Chore(deps-dev): Bump webpack from 5.102.1 to 5.103.0 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11513](https://github.com/paperless-ngx/paperless-ngx/pull/11513))
--   Chore(deps-dev): Bump @playwright/test from 1.56.1 to 1.57.0 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11514](https://github.com/paperless-ngx/paperless-ngx/pull/11514))
--   Chore(deps-dev): Bump the frontend-eslint-dependencies group in /src-ui with 3 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11512](https://github.com/paperless-ngx/paperless-ngx/pull/11512))
--   docker(deps): bump astral-sh/uv from 0.9.14-python3.12-trixie-slim to 0.9.15-python3.12-trixie-slim @[dependabot[bot]](https://github.com/apps/dependabot) ([#11533](https://github.com/paperless-ngx/paperless-ngx/pull/11533))
-</details>
-
-### All App Changes
-
-<details>
-<summary>12 changes</summary>
-
--   Fix: Expanded SVG validation whitelist and additional checks [@stumpylog](https://github.com/stumpylog) ([#11590](https://github.com/paperless-ngx/paperless-ngx/pull/11590))
--   Fixhancement: pass ordering to tag children [@shamoon](https://github.com/shamoon) ([#11556](https://github.com/paperless-ngx/paperless-ngx/pull/11556))
--   Performance: avoid unnecessary filename operations on bulk custom field updates [@shamoon](https://github.com/shamoon) ([#11558](https://github.com/paperless-ngx/paperless-ngx/pull/11558))
--   Fix: normalize allowed SVG tag and attribute names, add version [@shamoon](https://github.com/shamoon) ([#11586](https://github.com/paperless-ngx/paperless-ngx/pull/11586))
--   Chore: refactor workflows code [@shamoon](https://github.com/shamoon) ([#11563](https://github.com/paperless-ngx/paperless-ngx/pull/11563))
--   Fix: pass additional arguments to TagSerializer for permissions [@shamoon](https://github.com/shamoon) ([#11576](https://github.com/paperless-ngx/paperless-ngx/pull/11576))
--   Chore: update Angular dependencies to 20.3.15 [@shamoon](https://github.com/shamoon) ([#11568](https://github.com/paperless-ngx/paperless-ngx/pull/11568))
--   Chore(deps-dev): Bump webpack from 5.102.1 to 5.103.0 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11513](https://github.com/paperless-ngx/paperless-ngx/pull/11513))
--   Chore(deps-dev): Bump @playwright/test from 1.56.1 to 1.57.0 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11514](https://github.com/paperless-ngx/paperless-ngx/pull/11514))
--   Chore(deps-dev): Bump the frontend-eslint-dependencies group in /src-ui with 3 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11512](https://github.com/paperless-ngx/paperless-ngx/pull/11512))
--   Tweakhancement: dim inactive users in users-groups list [@shamoon](https://github.com/shamoon) ([#11537](https://github.com/paperless-ngx/paperless-ngx/pull/11537))
--   Chore: add some output of social login errors [@shamoon](https://github.com/shamoon) ([#11527](https://github.com/paperless-ngx/paperless-ngx/pull/11527))
-</details>
-
-## paperless-ngx 2.20.1
-
-### Bug Fixes
-
--   Fix: set search term when using advanced search from global search [@shamoon](https://github.com/shamoon) ([#11503](https://github.com/paperless-ngx/paperless-ngx/pull/11503))
--   Fix: change async handling of select custom field updates [@shamoon](https://github.com/shamoon) ([#11490](https://github.com/paperless-ngx/paperless-ngx/pull/11490))
--   Fix: skip SSL for MariaDB ping in init script [@danielrheinbay](https://github.com/danielrheinbay) ([#11491](https://github.com/paperless-ngx/paperless-ngx/pull/11491))
--   Fix: handle allauth groups location breaking change [@shamoon](https://github.com/shamoon) ([#11471](https://github.com/paperless-ngx/paperless-ngx/pull/11471))
-
-### Dependencies
-
--   docker(deps): Bump astral-sh/uv from 0.9.10-python3.12-trixie-slim to 0.9.11-python3.12-trixie-slim @[dependabot[bot]](https://github.com/apps/dependabot) ([#11450](https://github.com/paperless-ngx/paperless-ngx/pull/11450))
--   Chore(deps): Bump @angular/common from 20.3.12 to 20.3.14 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11481](https://github.com/paperless-ngx/paperless-ngx/pull/11481))
-
-### All App Changes
-
-<details>
-<summary>4 changes</summary>
-
--   Fix: set search term when using advanced search from global search [@shamoon](https://github.com/shamoon) ([#11503](https://github.com/paperless-ngx/paperless-ngx/pull/11503))
--   Fix: change async handling of select custom field updates [@shamoon](https://github.com/shamoon) ([#11490](https://github.com/paperless-ngx/paperless-ngx/pull/11490))
--   Chore(deps): Bump @angular/common from 20.3.12 to 20.3.14 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11481](https://github.com/paperless-ngx/paperless-ngx/pull/11481))
--   Fix: handle allauth groups location breaking change [@shamoon](https://github.com/shamoon) ([#11471](https://github.com/paperless-ngx/paperless-ngx/pull/11471))
-</details>
-
-## paperless-ngx 2.20.0
-
-### Notable Changes
-
--   Feature: Upgrade underlying Docker image to Trixie [@stumpylog](https://github.com/stumpylog) ([#10562](https://github.com/paperless-ngx/paperless-ngx/pull/10562))
-
-### Features / Enhancements
-
--   Feature: Upgrade underlying Docker image to Trixie [@stumpylog](https://github.com/stumpylog) ([#10562](https://github.com/paperless-ngx/paperless-ngx/pull/10562))
--   Fixhancement: more log viewer improvements [@shamoon](https://github.com/shamoon) ([#11426](https://github.com/paperless-ngx/paperless-ngx/pull/11426))
--   Performance: Replace duplicated static files with symlinks [@stumpylog](https://github.com/stumpylog) ([#11418](https://github.com/paperless-ngx/paperless-ngx/pull/11418))
--   Enhancement: add more relative dates, support modified [@shamoon](https://github.com/shamoon) ([#11411](https://github.com/paperless-ngx/paperless-ngx/pull/11411))
--   Performance: make move files after select custom field change async [@shamoon](https://github.com/shamoon) ([#11391](https://github.com/paperless-ngx/paperless-ngx/pull/11391))
--   Enhancement: Use a better check for the MariaDB server to be ready [@stumpylog](https://github.com/stumpylog) ([#11396](https://github.com/paperless-ngx/paperless-ngx/pull/11396))
--   Enhancement: speed-up docker container startup [@flrgh](https://github.com/flrgh) ([#11134](https://github.com/paperless-ngx/paperless-ngx/pull/11134))
-
-### Bug Fixes
-
--   Fix: prevent focus loss from change detection in cf query dropdown [@shamoon](https://github.com/shamoon) ([#11409](https://github.com/paperless-ngx/paperless-ngx/pull/11409))
--   Fix: sort editing filterable dropdowns sooner [@shamoon](https://github.com/shamoon) ([#11404](https://github.com/paperless-ngx/paperless-ngx/pull/11404))
--   Fix: support for custom field ordering w advanced search [@shamoon](https://github.com/shamoon) ([#11383](https://github.com/paperless-ngx/paperless-ngx/pull/11383))
-
-### Maintenance
-
--   Chore(deps): Bump the actions group with 7 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11259](https://github.com/paperless-ngx/paperless-ngx/pull/11259))
-
-### Dependencies
-
-<details>
-<summary>16 changes</summary>
-
--   Chore: Upgrades psycopg to 3.2.12 [@stumpylog](https://github.com/stumpylog) ([#11420](https://github.com/paperless-ngx/paperless-ngx/pull/11420))
--   Chore(deps-dev): Bump glob from 10.4.1 to 10.5.0 in /src/paperless_mail/templates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11413](https://github.com/paperless-ngx/paperless-ngx/pull/11413))
--   docker-compose(deps): bump gotenberg/gotenberg from 8.24 to 8.25 in /docker/compose @[dependabot[bot]](https://github.com/apps/dependabot) ([#11393](https://github.com/paperless-ngx/paperless-ngx/pull/11393))
--   Chore(deps): Bump the frontend-angular-dependencies group in /src-ui with 21 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11260](https://github.com/paperless-ngx/paperless-ngx/pull/11260))
--   Chore(deps-dev): Bump @playwright/test from 1.55.1 to 1.56.1 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11263](https://github.com/paperless-ngx/paperless-ngx/pull/11263))
--   Chore(deps-dev): Bump webpack from 5.102.0 to 5.102.1 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11264](https://github.com/paperless-ngx/paperless-ngx/pull/11264))
--   Chore(deps-dev): Bump the frontend-eslint-dependencies group in /src-ui with 4 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11262](https://github.com/paperless-ngx/paperless-ngx/pull/11262))
--   Chore(deps-dev): Bump jest-preset-angular from 15.0.2 to 15.0.3 in /src-ui in the frontend-jest-dependencies group @[dependabot[bot]](https://github.com/apps/dependabot) ([#11261](https://github.com/paperless-ngx/paperless-ngx/pull/11261))
--   Chore(deps-dev): Bump @types/node from 24.6.1 to 24.9.2 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11265](https://github.com/paperless-ngx/paperless-ngx/pull/11265))
--   Chore(deps): Bump the small-changes group across 1 directory with 11 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11337](https://github.com/paperless-ngx/paperless-ngx/pull/11337))
--   Chore(deps): Bump django-auditlog from 3.2.1 to 3.3.0 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11021](https://github.com/paperless-ngx/paperless-ngx/pull/11021))
--   Chore(deps): Bump the actions group with 7 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11259](https://github.com/paperless-ngx/paperless-ngx/pull/11259))
--   Chore(deps): Bump drf-spectacular-sidecar from 2025.9.1 to 2025.10.1 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11019](https://github.com/paperless-ngx/paperless-ngx/pull/11019))
--   Chore(deps): Bump django-filter from 25.1 to 25.2 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11020](https://github.com/paperless-ngx/paperless-ngx/pull/11020))
--   Chore(deps): Update django-allauth[mfa,socialaccount] requirement from ~=65.4.0 to ~=65.12.1 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11198](https://github.com/paperless-ngx/paperless-ngx/pull/11198))
--   docker(deps): bump astral-sh/uv from 0.9.9-python3.12-bookworm-slim to 0.9.10-python3.12-bookworm-slim @[dependabot[bot]](https://github.com/apps/dependabot) ([#11394](https://github.com/paperless-ngx/paperless-ngx/pull/11394))
-</details>
-
-### All App Changes
-
-<details>
-<summary>19 changes</summary>
-
--   Fixhancement: more log viewer improvements [@shamoon](https://github.com/shamoon) ([#11426](https://github.com/paperless-ngx/paperless-ngx/pull/11426))
--   Chore: Upgrades psycopg to 3.2.12 [@stumpylog](https://github.com/stumpylog) ([#11420](https://github.com/paperless-ngx/paperless-ngx/pull/11420))
--   Enhancement: add more relative dates, support modified [@shamoon](https://github.com/shamoon) ([#11411](https://github.com/paperless-ngx/paperless-ngx/pull/11411))
--   Chore(deps-dev): Bump glob from 10.4.1 to 10.5.0 in /src/paperless_mail/templates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11413](https://github.com/paperless-ngx/paperless-ngx/pull/11413))
--   Performance: make move files after select custom field change async [@shamoon](https://github.com/shamoon) ([#11391](https://github.com/paperless-ngx/paperless-ngx/pull/11391))
--   Fix: prevent focus loss from change detection in cf query dropdown [@shamoon](https://github.com/shamoon) ([#11409](https://github.com/paperless-ngx/paperless-ngx/pull/11409))
--   Fix: sort editing filterable dropdowns sooner [@shamoon](https://github.com/shamoon) ([#11404](https://github.com/paperless-ngx/paperless-ngx/pull/11404))
--   Chore(deps): Bump the frontend-angular-dependencies group in /src-ui with 21 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11260](https://github.com/paperless-ngx/paperless-ngx/pull/11260))
--   Chore(deps-dev): Bump @playwright/test from 1.55.1 to 1.56.1 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11263](https://github.com/paperless-ngx/paperless-ngx/pull/11263))
--   Chore(deps-dev): Bump webpack from 5.102.0 to 5.102.1 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11264](https://github.com/paperless-ngx/paperless-ngx/pull/11264))
--   Chore(deps-dev): Bump the frontend-eslint-dependencies group in /src-ui with 4 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11262](https://github.com/paperless-ngx/paperless-ngx/pull/11262))
--   Chore(deps-dev): Bump jest-preset-angular from 15.0.2 to 15.0.3 in /src-ui in the frontend-jest-dependencies group @[dependabot[bot]](https://github.com/apps/dependabot) ([#11261](https://github.com/paperless-ngx/paperless-ngx/pull/11261))
--   Chore(deps-dev): Bump @types/node from 24.6.1 to 24.9.2 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11265](https://github.com/paperless-ngx/paperless-ngx/pull/11265))
--   Chore(deps): Bump the small-changes group across 1 directory with 11 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11337](https://github.com/paperless-ngx/paperless-ngx/pull/11337))
--   Chore(deps): Bump django-auditlog from 3.2.1 to 3.3.0 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11021](https://github.com/paperless-ngx/paperless-ngx/pull/11021))
--   Chore(deps): Bump drf-spectacular-sidecar from 2025.9.1 to 2025.10.1 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11019](https://github.com/paperless-ngx/paperless-ngx/pull/11019))
--   Chore(deps): Bump django-filter from 25.1 to 25.2 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11020](https://github.com/paperless-ngx/paperless-ngx/pull/11020))
--   Chore(deps): Update django-allauth[mfa,socialaccount] requirement from ~=65.4.0 to ~=65.12.1 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11198](https://github.com/paperless-ngx/paperless-ngx/pull/11198))
--   Fix: support for custom field ordering w advanced search [@shamoon](https://github.com/shamoon) ([#11383](https://github.com/paperless-ngx/paperless-ngx/pull/11383))
-</details>
-
-## paperless-ngx 2.19.6
-
-### Bug Fixes
-
--   Chore: include password validation on user edit [@shamoon](https://github.com/shamoon) ([#11308](https://github.com/paperless-ngx/paperless-ngx/pull/11308))
--   Fix: include BASE_URL when constructing for workflows [@ebardsley](https://github.com/ebardsley) ([#11360](https://github.com/paperless-ngx/paperless-ngx/pull/11360))
--   Fixhancement: refactor email attachment logic [@shamoon](https://github.com/shamoon) ([#11336](https://github.com/paperless-ngx/paperless-ngx/pull/11336))
--   Fixhancement: trim whitespace for some text searches [@shamoon](https://github.com/shamoon) ([#11357](https://github.com/paperless-ngx/paperless-ngx/pull/11357))
--   Fix: update Outlook refresh token when refreshed [@shamoon](https://github.com/shamoon) ([#11341](https://github.com/paperless-ngx/paperless-ngx/pull/11341))
--   Fix: only cache remote version data for version checking [@shamoon](https://github.com/shamoon) ([#11320](https://github.com/paperless-ngx/paperless-ngx/pull/11320))
--   Fix: include replace none logic in storage path preview, improve jinja conditionals for empty metadata [@shamoon](https://github.com/shamoon) ([#11315](https://github.com/paperless-ngx/paperless-ngx/pull/11315))
-
-### Dependencies
-
--   docker(deps): bump astral-sh/uv from 0.9.7-python3.12-bookworm-slim to 0.9.9-python3.12-bookworm-slim @[dependabot[bot]](https://github.com/apps/dependabot) ([#11338](https://github.com/paperless-ngx/paperless-ngx/pull/11338))
-
-### All App Changes
-
-<details>
-<summary>7 changes</summary>
-
--   Fix: include BASE_URL when constructing for workflows [@ebardsley](https://github.com/ebardsley) ([#11360](https://github.com/paperless-ngx/paperless-ngx/pull/11360))
--   Fixhancement: refactor email attachment logic [@shamoon](https://github.com/shamoon) ([#11336](https://github.com/paperless-ngx/paperless-ngx/pull/11336))
--   Fixhancement: trim whitespace for some text searches [@shamoon](https://github.com/shamoon) ([#11357](https://github.com/paperless-ngx/paperless-ngx/pull/11357))
--   Fix: update Outlook refresh token when refreshed [@shamoon](https://github.com/shamoon) ([#11341](https://github.com/paperless-ngx/paperless-ngx/pull/11341))
--   Fix: only cache remote version data for version checking [@shamoon](https://github.com/shamoon) ([#11320](https://github.com/paperless-ngx/paperless-ngx/pull/11320))
--   Fix: include replace none logic in storage path preview, improve jinja conditionals for empty metadata [@shamoon](https://github.com/shamoon) ([#11315](https://github.com/paperless-ngx/paperless-ngx/pull/11315))
--   Chore: include password validation on user edit [@shamoon](https://github.com/shamoon) ([#11308](https://github.com/paperless-ngx/paperless-ngx/pull/11308))
-</details>
-
-## paperless-ngx 2.19.5
-
-### Bug Fixes
-
--   Fix: ensure custom field query propagation, change detection [@shamoon](https://github.com/shamoon) ([#11291](https://github.com/paperless-ngx/paperless-ngx/pull/11291))
-
-### Dependencies
-
--   docker(deps): Bump astral-sh/uv from 0.9.4-python3.12-bookworm-slim to 0.9.7-python3.12-bookworm-slim @[dependabot[bot]](https://github.com/apps/dependabot) ([#11283](https://github.com/paperless-ngx/paperless-ngx/pull/11283))
-
-### All App Changes
-
--   Fix: ensure custom field query propagation, change detection [@shamoon](https://github.com/shamoon) ([#11291](https://github.com/paperless-ngx/paperless-ngx/pull/11291))
-
-## paperless-ngx 2.19.4
-
-### Bug Fixes
-
--   Fix: use original_file when attaching docs to workflow emails with added trigger [@shamoon](https://github.com/shamoon) ([#11266](https://github.com/paperless-ngx/paperless-ngx/pull/11266))
--   Fix: mark 'Select' button in doc list for translation [@shamoon](https://github.com/shamoon) ([#11278](https://github.com/paperless-ngx/paperless-ngx/pull/11278))
--   Fix: respect fields parameter for created field [@shamoon](https://github.com/shamoon) ([#11251](https://github.com/paperless-ngx/paperless-ngx/pull/11251))
--   Fix: improve legibility of processed mail error popover in light mode [@shamoon](https://github.com/shamoon) ([#11258](https://github.com/paperless-ngx/paperless-ngx/pull/11258))
--   Fixhancement: truncate large logs, improve auto-scroll [@shamoon](https://github.com/shamoon) ([#11239](https://github.com/paperless-ngx/paperless-ngx/pull/11239))
--   Chore: add max-height and overflow to processedmail error popover [@shamoon](https://github.com/shamoon) ([#11252](https://github.com/paperless-ngx/paperless-ngx/pull/11252))
--   Fix: delay iframe DOM removal, handle onafterprint error for print in FF [@shamoon](https://github.com/shamoon) ([#11237](https://github.com/paperless-ngx/paperless-ngx/pull/11237))
--   Fix: de-deduplicate children in tag list when filtering [@shamoon](https://github.com/shamoon) ([#11229](https://github.com/paperless-ngx/paperless-ngx/pull/11229))
-
-### Performance
-
--   Performance: re-enable virtual scroll, bump ng-select [@shamoon](https://github.com/shamoon) ([#11279](https://github.com/paperless-ngx/paperless-ngx/pull/11279))
--   Performance: use virtual scroll container and log level parsing for logs view [@MickLesk](https://github.com/MickLesk) ([#11233](https://github.com/paperless-ngx/paperless-ngx/pull/11233))
-
-### All App Changes
-
-<details>
-<summary>11 changes</summary>
-
--   Performance: re-enable virtual scroll, bump ng-select [@shamoon](https://github.com/shamoon) ([#11279](https://github.com/paperless-ngx/paperless-ngx/pull/11279))
--   Fix: use original_file when attaching docs to workflow emails with added trigger [@shamoon](https://github.com/shamoon) ([#11266](https://github.com/paperless-ngx/paperless-ngx/pull/11266))
--   Fix: mark 'Select' button in doc list for translation [@shamoon](https://github.com/shamoon) ([#11278](https://github.com/paperless-ngx/paperless-ngx/pull/11278))
--   Fix: respect fields parameter for created field [@shamoon](https://github.com/shamoon) ([#11251](https://github.com/paperless-ngx/paperless-ngx/pull/11251))
--   Fix: improve legibility of processed mail error popover in light mode [@shamoon](https://github.com/shamoon) ([#11258](https://github.com/paperless-ngx/paperless-ngx/pull/11258))
--   Fixhancement: truncate large logs, improve auto-scroll [@shamoon](https://github.com/shamoon) ([#11239](https://github.com/paperless-ngx/paperless-ngx/pull/11239))
--   Chore: add max-height and overflow to processedmail error popover [@shamoon](https://github.com/shamoon) ([#11252](https://github.com/paperless-ngx/paperless-ngx/pull/11252))
--   Fix: delay iframe DOM removal, handle onafterprint error for print in FF [@shamoon](https://github.com/shamoon) ([#11237](https://github.com/paperless-ngx/paperless-ngx/pull/11237))
--   Performance: use virtual scroll container and log level parsing for logs view [@MickLesk](https://github.com/MickLesk) ([#11233](https://github.com/paperless-ngx/paperless-ngx/pull/11233))
--   Chore: cache Github version check for 15 minutes [@shamoon](https://github.com/shamoon) ([#11235](https://github.com/paperless-ngx/paperless-ngx/pull/11235))
--   Fix: de-deduplicate children in tag list when filtering [@shamoon](https://github.com/shamoon) ([#11229](https://github.com/paperless-ngx/paperless-ngx/pull/11229))
-</details>
-
 ## paperless-ngx 2.19.3
 
 ### Bug Fixes

docs/configuration.md

@@ -170,18 +170,11 @@ Available options are `postgresql` and `mariadb`.
 
     !!! note
 
-        A pool of 8-10 connections per worker is typically sufficient.
+        A small pool is typically sufficient — for example, a size of 4.
-        If you encounter error messages such as `couldn't get a connection`
+        Make sure your PostgreSQL server's max_connections setting is large enough to handle:
-        or database connection timeouts, you probably need to increase the pool size.
+        ```(Paperless workers + Celery workers) × pool size + safety margin```
-
+        For example, with 4 Paperless workers and 2 Celery workers, and a pool size of 4:
-    !!! warning
+        (4 + 2) × 4 + 10 = 34 connections required.
-        Make sure your PostgreSQL `max_connections` setting is large enough to handle the connection pools:
-        `(NB_PAPERLESS_WORKERS + NB_CELERY_WORKERS) × POOL_SIZE + SAFETY_MARGIN`. For example, with
-        4 Paperless workers and 2 Celery workers, and a pool size of 8:``(4 + 2) × 8 + 10 = 58`,
-        so `max_connections = 60` (or even more) is appropriate.
-
-        This assumes only Paperless-ngx connects to your PostgreSQL instance. If you have other applications,
-        you should increase `max_connections` accordingly.
 
 #### [`PAPERLESS_DB_READ_CACHE_ENABLED=<bool>`](#PAPERLESS_DB_READ_CACHE_ENABLED) {#PAPERLESS_DB_READ_CACHE_ENABLED}
 
@@ -1014,7 +1007,7 @@ still perform some basic text pre-processing before matching.
 
 : See also `PAPERLESS_NLTK_DIR`.
 
-    Defaults to true, enabling the feature.
+    Defaults to 1.
 
 #### [`PAPERLESS_DATE_PARSER_LANGUAGES=<lang>`](#PAPERLESS_DATE_PARSER_LANGUAGES) {#PAPERLESS_DATE_PARSER_LANGUAGES}
 
@@ -1061,27 +1054,17 @@ should be a valid crontab(5) expression describing when to run.
 
 #### [`PAPERLESS_SANITY_TASK_CRON=<cron expression>`](#PAPERLESS_SANITY_TASK_CRON) {#PAPERLESS_SANITY_TASK_CRON}
 
-: Configures the scheduled sanity checker frequency. The value should be a
+: Configures the scheduled sanity checker frequency.
-valid crontab(5) expression describing when to run.
 
 : If set to the string "disable", the sanity checker will not run automatically.
 
     Defaults to `30 0 * * sun` or Sunday at 30 minutes past midnight.
 
-#### [`PAPERLESS_WORKFLOW_SCHEDULED_TASK_CRON=<cron expression>`](#PAPERLESS_WORKFLOW_SCHEDULED_TASK_CRON) {#PAPERLESS_WORKFLOW_SCHEDULED_TASK_CRON}
-
-: Configures the scheduled workflow check frequency. The value should be a
-valid crontab(5) expression describing when to run.
-
-: If set to the string "disable", scheduled workflows will not run.
-
-    Defaults to `5 */1 * * *` or every hour at 5 minutes past the hour.
-
 #### [`PAPERLESS_ENABLE_COMPRESSION=<bool>`](#PAPERLESS_ENABLE_COMPRESSION) {#PAPERLESS_ENABLE_COMPRESSION}
 
 : Enables compression of the responses from the webserver.
 
-: Defaults to true, enabling compression.
+: Defaults to 1, enabling compression.
 
     !!! note
 
@@ -1175,45 +1158,21 @@ don't exist yet.
 
 #### [`PAPERLESS_CONSUMER_IGNORE_PATTERNS=<json>`](#PAPERLESS_CONSUMER_IGNORE_PATTERNS) {#PAPERLESS_CONSUMER_IGNORE_PATTERNS}
 
-: Additional regex patterns for files to ignore in the consumption directory. Patterns are matched against filenames only (not full paths)
+: By default, paperless ignores certain files and folders in the
-using Python's `re.match()`, which anchors at the start of the filename.
+consumption directory, such as system files created by the Mac OS
+or hidden folders some tools use to store data.
 
-    See the [watchfiles documentation](https://watchfiles.helpmanual.io/api/filters/#watchfiles.BaseFilter.ignore_entity_patterns)
+    This can be adjusted by configuring a custom json array with
+    patterns to exclude.
 
-    This setting is for additional patterns beyond the built-in defaults. Common system files and directories are already ignored automatically.
+    For example, `.DS_STORE/*` will ignore any files found in a folder
-    The patterns will be compiled via Python's standard `re` module.
+    named `.DS_STORE`, including `.DS_STORE/bar.pdf` and `foo/.DS_STORE/bar.pdf`
 
-    Example custom patterns:
+    A pattern like `._*` will ignore anything starting with `._`, including:
+    `._foo.pdf` and `._bar/foo.pdf`
 
-    ```json
+    Defaults to
-    ["^temp_", "\\.bak$", "^~"]
+    `[".DS_Store", ".DS_STORE", "._*", ".stfolder/*", ".stversions/*", ".localized/*", "desktop.ini", "@eaDir/*", "Thumbs.db"]`.
-    ```
-
-    This would ignore:
-
-    - Files starting with `temp_` (e.g., `temp_scan.pdf`)
-    - Files ending with `.bak` (e.g., `document.pdf.bak`)
-    - Files starting with `~` (e.g., `~$document.docx`)
-
-    Defaults to `[]` (empty list, uses only built-in defaults).
-
-    The default ignores are `[.DS_Store, .DS_STORE, ._*, desktop.ini, Thumbs.db]` and cannot be overridden.
-
-#### [`PAPERLESS_CONSUMER_IGNORE_DIRS=<json>`](#PAPERLESS_CONSUMER_IGNORE_DIRS) {#PAPERLESS_CONSUMER_IGNORE_DIRS}
-
-: Additional directory names to ignore in the consumption directory. Directories matching these names (and all their contents) will be skipped.
-
-    This setting is for additional directories beyond the built-in defaults. Matching is done by directory name only, not full path.
-
-    Example:
-
-    ```json
-    ["temp", "incoming", ".hidden"]
-    ```
-
-    Defaults to `[]` (empty list, uses only built-in defaults).
-
-    The default ignores are `[.stfolder, .stversions, .localized, @eaDir, .Spotlight-V100, .Trashes, __MACOSX]` and cannot be overridden.
 
 #### [`PAPERLESS_CONSUMER_BARCODE_SCANNER=<string>`](#PAPERLESS_CONSUMER_BARCODE_SCANNER) {#PAPERLESS_CONSUMER_BARCODE_SCANNER}
 
@@ -1312,25 +1271,6 @@ within your documents.
 
     Defaults to false.
 
-#### [`PAPERLESS_CONSUMER_POLLING_INTERVAL=<num>`](#PAPERLESS_CONSUMER_POLLING_INTERVAL) {#PAPERLESS_CONSUMER_POLLING_INTERVAL}
-
-: Configures how the consumer detects new files in the consumption directory.
-
-    When set to `0` (default), paperless uses native filesystem notifications for efficient, immediate detection of new files.
-
-    When set to a positive number, paperless polls the consumption directory at that interval in seconds. Use polling for network filesystems (NFS, SMB/CIFS) where native notifications may not work reliably.
-
-    Defaults to 0.
-
-#### [`PAPERLESS_CONSUMER_STABILITY_DELAY=<num>`](#PAPERLESS_CONSUMER_STABILITY_DELAY) {#PAPERLESS_CONSUMER_STABILITY_DELAY}
-
-: Sets the time in seconds that a file must remain unchanged (same size and modification time) before paperless will begin consuming it.
-
-    Increase this value if you experience issues with files being consumed before they are fully written, particularly on slower network storage or
-    with certain scanner quirks
-
-    Defaults to 5.0 seconds.
-
 ## Workflow webhooks
 
 #### [`PAPERLESS_WEBHOOKS_ALLOWED_SCHEMES=<str>`](#PAPERLESS_WEBHOOKS_ALLOWED_SCHEMES) {#PAPERLESS_WEBHOOKS_ALLOWED_SCHEMES}
@@ -1355,6 +1295,49 @@ ports.
 
     Defaults to true, which allows internal requests.
 
+### Polling {#polling}
+
+#### [`PAPERLESS_CONSUMER_POLLING=<num>`](#PAPERLESS_CONSUMER_POLLING) {#PAPERLESS_CONSUMER_POLLING}
+
+: If paperless won't find documents added to your consume folder, it
+might not be able to automatically detect filesystem changes. In
+that case, specify a polling interval in seconds here, which will
+then cause paperless to periodically check your consumption
+directory for changes. This will also disable listening for file
+system changes with `inotify`.
+
+    Defaults to 0, which disables polling and uses filesystem
+    notifications.
+
+#### [`PAPERLESS_CONSUMER_POLLING_RETRY_COUNT=<num>`](#PAPERLESS_CONSUMER_POLLING_RETRY_COUNT) {#PAPERLESS_CONSUMER_POLLING_RETRY_COUNT}
+
+: If consumer polling is enabled, sets the maximum number of times
+paperless will check for a file to remain unmodified. If a file's
+modification time and size are identical for two consecutive checks, it
+will be consumed.
+
+    Defaults to 5.
+
+#### [`PAPERLESS_CONSUMER_POLLING_DELAY=<num>`](#PAPERLESS_CONSUMER_POLLING_DELAY) {#PAPERLESS_CONSUMER_POLLING_DELAY}
+
+: If consumer polling is enabled, sets the delay in seconds between
+each check (above) paperless will do while waiting for a file to
+remain unmodified.
+
+    Defaults to 5.
+
+### iNotify {#inotify}
+
+#### [`PAPERLESS_CONSUMER_INOTIFY_DELAY=<num>`](#PAPERLESS_CONSUMER_INOTIFY_DELAY) {#PAPERLESS_CONSUMER_INOTIFY_DELAY}
+
+: Sets the time in seconds the consumer will wait for additional
+events from inotify before the consumer will consider a file ready
+and begin consumption. Certain scanners or network setups may
+generate multiple events for a single file, leading to multiple
+consumers working on the same file. Configure this to prevent that.
+
+    Defaults to 0.5 seconds.
+
 ## Incoming Mail {#incoming_mail}
 
 ### Email OAuth {#email_oauth}
@@ -1812,26 +1795,6 @@ password. All of these options come from their similarly-named [Django settings]
 
 : Defaults to false.
 
-## Remote OCR
-
-#### [`PAPERLESS_REMOTE_OCR_ENGINE=<str>`](#PAPERLESS_REMOTE_OCR_ENGINE) {#PAPERLESS_REMOTE_OCR_ENGINE}
-
-: The remote OCR engine to use. Currently only Azure AI is supported as "azureai".
-
-    Defaults to None, which disables remote OCR.
-
-#### [`PAPERLESS_REMOTE_OCR_API_KEY=<str>`](#PAPERLESS_REMOTE_OCR_API_KEY) {#PAPERLESS_REMOTE_OCR_API_KEY}
-
-: The API key to use for the remote OCR engine.
-
-    Defaults to None.
-
-#### [`PAPERLESS_REMOTE_OCR_ENDPOINT=<str>`](#PAPERLESS_REMOTE_OCR_ENDPOINT) {#PAPERLESS_REMOTE_OCR_ENDPOINT}
-
-: The endpoint to use for the remote OCR engine. This is required for Azure AI.
-
-    Defaults to None.
-
 ## AI {#ai}
 
 #### [`PAPERLESS_AI_ENABLED=<bool>`](#PAPERLESS_AI_ENABLED) {#PAPERLESS_AI_ENABLED}
@@ -1853,7 +1816,7 @@ suggestions. This setting is required to be set to true in order to use the AI f
 
     Defaults to None.
 
-#### [`PAPERLESS_AI_LLM_BACKEND=<str>`](#PAPERLESS_AI_LLM_BACKEND) {#PAPERLESS_AI_LLM_BACKEND}
+#### [`PAPERLESS_AI_BACKEND=<str>`](#PAPERLESS_AI_BACKEND) {#PAPERLESS_AI_BACKEND}
 
 : The AI backend to use. This can be either "openai" or "ollama". If set to "ollama", the AI
 features will be run locally on your machine. If set to "openai", the AI features will be run
@@ -1873,19 +1836,19 @@ using the OpenAI API. This setting is required to be set to use the AI features.
 #### [`PAPERLESS_AI_LLM_MODEL=<str>`](#PAPERLESS_AI_LLM_MODEL) {#PAPERLESS_AI_LLM_MODEL}
 
 : The model to use for the AI backend, i.e. "gpt-3.5-turbo", "gpt-4" or any of the models supported by the
-current backend. If not supplied, defaults to "gpt-3.5-turbo" for OpenAI and "llama3.1" for Ollama.
+current backend. If not supplied, defaults to "gpt-3.5-turbo" for OpenAI and "llama3" for Ollama.
 
     Defaults to None.
 
 #### [`PAPERLESS_AI_LLM_API_KEY=<str>`](#PAPERLESS_AI_LLM_API_KEY) {#PAPERLESS_AI_LLM_API_KEY}
 
-: The API key to use for the AI backend. This is required for the OpenAI backend (optional for others).
+: The API key to use for the AI backend. This is required for the OpenAI backend only.
 
     Defaults to None.
 
 #### [`PAPERLESS_AI_LLM_ENDPOINT=<str>`](#PAPERLESS_AI_LLM_ENDPOINT) {#PAPERLESS_AI_LLM_ENDPOINT}
 
-: The endpoint / url to use for the AI backend. This is required for the Ollama backend (optional for others).
+: The endpoint / url to use for the AI backend. This is required for the Ollama backend only.
 
     Defaults to None.
 

docs/development.md

@@ -175,7 +175,7 @@ To add a new development package `uv add --dev <package>`
 
 ## Front end development
 
-The front end is built using AngularJS. In order to get started, you need Node.js (version 24+) and
+The front end is built using AngularJS. In order to get started, you need Node.js (version 14.15+) and
 `pnpm`.
 
 !!! note

docs/index.md

@@ -27,8 +27,7 @@ physical documents into a searchable online archive so you can keep, well, _less
 -   **Organize and index** your scanned documents with tags, correspondents, types, and more.
 -   _Your_ data is stored locally on _your_ server and is never transmitted or shared in any way, unless you explicitly choose to do so.
 -   Performs **OCR** on your documents, adding searchable and selectable text, even to documents scanned with only images.
-    -   Utilizes the open-source Tesseract engine to recognize more than 100 languages.
+-   Utilizes the open-source Tesseract engine to recognize more than 100 languages.
-    -   _New!_ Supports remote OCR with Azure AI (opt-in).
 -   Documents are saved as PDF/A format which is designed for long term storage, alongside the unaltered originals.
 -   Uses machine-learning to automatically add tags, correspondents and document types to your documents.
 -   **New**: Paperless-ngx can now leverage AI (Large Language Models or LLMs) for document suggestions. This is an optional feature that can be enabled (and is disabled by default).

docs/migration.md

@@ -1,25 +0,0 @@
-# v3 Migration Guide
-
-## Consumer Settings Changes
-
-The v3 consumer command uses a [different library](https://watchfiles.helpmanual.io/) to unify
-the watching for new files in the consume directory. For the user, this removes several configuration options related to delays and retries
-and replaces with a single unified setting. It also adjusts how the consumer ignore filtering happens, replaced `fnmatch` with `regex` and
-separating the directory ignore from the file ignore.
-
-### Summary
-
-| Old Setting                    | New Setting                                                                         | Notes                                                                                |
-| ------------------------------ | ----------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
-| `CONSUMER_POLLING`             | [`CONSUMER_POLLING_INTERVAL`](configuration.md#PAPERLESS_CONSUMER_POLLING_INTERVAL) | Renamed for clarity                                                                  |
-| `CONSUMER_INOTIFY_DELAY`       | [`CONSUMER_STABILITY_DELAY`](configuration.md#PAPERLESS_CONSUMER_STABILITY_DELAY)   | Unified for all modes                                                                |
-| `CONSUMER_POLLING_DELAY`       | _Removed_                                                                           | Use `CONSUMER_STABILITY_DELAY`                                                       |
-| `CONSUMER_POLLING_RETRY_COUNT` | _Removed_                                                                           | Automatic with stability tracking                                                    |
-| `CONSUMER_IGNORE_PATTERNS`     | [`CONSUMER_IGNORE_PATTERNS`](configuration.md#PAPERLESS_CONSUMER_IGNORE_PATTERNS)   | **Now regex, not fnmatch**; user patterns are added to (not replacing) default ones  |
-| _New_                          | [`CONSUMER_IGNORE_DIRS`](configuration.md#PAPERLESS_CONSUMER_IGNORE_DIRS)           | Additional directories to ignore; user entries are added to (not replacing) defaults |
-
-## Encryption Support
-
-Document and thumbnail encryption is no longer supported. This was previously deprecated in [paperless-ng 0.9.3](https://github.com/paperless-ngx/paperless-ngx/blob/dev/docs/changelog.md#paperless-ng-093)
-
-Users must decrypt their document using the `decrypt_documents` command before upgrading.

docs/setup.md

@@ -124,7 +124,8 @@ account. The script essentially automatically performs the steps described in [D
         system notifications with `inotify`. When storing the consumption
         directory on such a file system, paperless will not pick up new
         files with the default configuration. You will need to use
-        [`PAPERLESS_CONSUMER_POLLING_INTERVAL`](configuration.md#PAPERLESS_CONSUMER_POLLING_INTERVAL), which will disable inotify.
+        [`PAPERLESS_CONSUMER_POLLING`](configuration.md#PAPERLESS_CONSUMER_POLLING), which will disable inotify. See
+        [here](configuration.md#polling).
 
 5.  Run `docker compose pull`. This will pull the image from the GitHub container registry
     by default but you can change the image to pull from Docker Hub by changing the `image`
@@ -325,7 +326,7 @@ are released, dependency support is confirmed, etc.
 
     !!! warning
 
-        Ensure your Redis instance [is secured](https://redis.io/docs/latest/operate/oss_and_stack/management/security/).
+        Ensure your Redis instance [is secured](https://redis.io/docs/getting-started/#securing-redis).
 
 7.  Create the following directories if they are missing:
 

docs/troubleshooting.md

@@ -46,9 +46,9 @@ run:
 If you notice that the consumer will only pickup files in the
 consumption directory at startup, but won't find any other files added
 later, you will need to enable filesystem polling with the configuration
-option [`PAPERLESS_CONSUMER_POLLING_INTERVAL`](configuration.md#PAPERLESS_CONSUMER_POLLING_INTERVAL).
+option [`PAPERLESS_CONSUMER_POLLING`](configuration.md#PAPERLESS_CONSUMER_POLLING).
 
-This will disable automatic listening for filesystem changes and
+This will disable listening to filesystem changes with inotify and
 paperless will manually check the consumption directory for changes
 instead.
 
@@ -234,9 +234,47 @@ FileNotFoundError: [Errno 2] No such file or directory: '/tmp/ocrmypdf.io.yhk3zb
 
 This probably indicates paperless tried to consume the same file twice.
 This can happen for a number of reasons, depending on how documents are
-placed into the consume folder, such as how a scanner may modify a file multiple times as it scans.
+placed into the consume folder. If paperless is using inotify (the
-Try adjusting the
+default) to check for documents, try adjusting the
-[file stability delay](configuration.md#PAPERLESS_CONSUMER_STABILITY_DELAY) to a larger value.
+[inotify configuration](configuration.md#inotify). If polling is enabled, try adjusting the
+[polling configuration](configuration.md#polling).
+
+## Consumer fails waiting for file to remain unmodified.
+
+You might find messages like these in your log files:
+
+```
+[ERROR] [paperless.management.consumer] Timeout while waiting on file /usr/src/paperless/src/../consume/SCN_0001.pdf to remain unmodified.
+```
+
+This indicates paperless timed out while waiting for the file to be
+completely written to the consume folder. Adjusting
+[polling configuration](configuration.md#polling) values should resolve the issue.
+
+!!! note
+
+    The user will need to manually move the file out of the consume folder
+    and back in, for the initial failing file to be consumed.
+
+## Consumer fails reporting "OS reports file as busy still".
+
+You might find messages like these in your log files:
+
+```
+[WARNING] [paperless.management.consumer] Not consuming file /usr/src/paperless/src/../consume/SCN_0001.pdf: OS reports file as busy still
+```
+
+This indicates paperless was unable to open the file, as the OS reported
+the file as still being in use. To prevent a crash, paperless did not
+try to consume the file. If paperless is using inotify (the default) to
+check for documents, try adjusting the
+[inotify configuration](configuration.md#inotify). If polling is enabled, try adjusting the
+[polling configuration](configuration.md#polling).
+
+!!! note
+
+    The user will need to manually move the file out of the consume folder
+    and back in, for the initial failing file to be consumed.
 
 ## Log reports "Creating PaperlessTask failed".
 

docs/usage.md

@@ -465,10 +465,6 @@ flowchart TD
     'Updated'
     trigger(s)"}
 
-    scheduled{"Documents
-    matching
-    trigger(s)"}
-
     A[New Document] --> consumption
     consumption --> |Yes| C[Workflow Actions Run]
     consumption --> |No| D
@@ -481,11 +477,6 @@ flowchart TD
     updated --> |Yes| J[Workflow Actions Run]
     updated --> |No| K
     J --> K[Document Saved]
-    L[Scheduled Task Check<br/>hourly at :05] --> M[Get All Scheduled Triggers]
-    M --> scheduled
-    scheduled --> |Yes| N[Workflow Actions Run]
-    scheduled --> |No| O[Document Saved]
-    N --> O
 ```
 
 #### Filters {#workflow-trigger-filters}
@@ -565,7 +556,7 @@ This allows for complex logic to be used to generate the title, including [logic
 and [filters](https://jinja.palletsprojects.com/en/3.1.x/templates/#id11).
 The template is provided as a string.
 
-Using Jinja2 Templates is also useful for [Date localization](advanced_usage.md#date-localization) in the title.
+Using Jinja2 Templates is also useful for [Date localization](advanced_usage.md#Date-Localization) in the title.
 
 The available inputs differ depending on the type of workflow trigger.
 This is because at the time of consumption (when the text is to be set), no automatic tags etc. have been
@@ -584,7 +575,6 @@ applied. You can use the following placeholders in the template with any trigger
 -   `{{added_time}}`: added time in HH:MM format
 -   `{{original_filename}}`: original file name without extension
 -   `{{filename}}`: current file name without extension
--   `{{doc_title}}`: current document title
 
 The following placeholders are only available for "added" or "updated" triggers
 
@@ -597,7 +587,6 @@ The following placeholders are only available for "added" or "updated" triggers
 -   `{{created_day}}`: created day
 -   `{{created_time}}`: created time in HH:MM format
 -   `{{doc_url}}`: URL to the document in the web UI. Requires the `PAPERLESS_URL` setting to be set.
--   `{{doc_id}}`: Document ID
 
 ##### Examples
 
@@ -924,21 +913,6 @@ how regularly you intend to scan documents and use paperless.
     performed the task associated with the document, move it to the
     inbox.
 
-## Remote OCR
-
-!!! important
-
-    This feature is disabled by default and will always remain strictly "opt-in".
-
-Paperless-ngx supports performing OCR on documents using remote services. At the moment, this is limited to
-[Microsoft's Azure "Document Intelligence" service](https://azure.microsoft.com/en-us/products/ai-services/ai-document-intelligence).
-This is of course a paid service (with a free tier) which requires an Azure account and subscription. Azure AI is not affiliated with
-Paperless-ngx in any way. When enabled, Paperless-ngx will automatically send appropriate documents to Azure for OCR processing, bypassing
-the local OCR engine. See the [configuration](configuration.md#PAPERLESS_REMOTE_OCR_ENGINE) options for more details.
-
-Additionally, when using a commercial service with this feature, consider both potential costs as well as any associated file size
-or page limitations (e.g. with a free tier).
-
 ## Architecture
 
 Paperless-ngx consists of the following components:

mkdocs.yml

@@ -69,9 +69,8 @@ nav:
   - development.md
   - 'FAQs': faq.md
   - troubleshooting.md
-  - 'Migration to v3': migration.md
   - changelog.md
-copyright: Copyright © 2016 - 2026 Daniel Quinn, Jonas Winkler, and the Paperless-ngx team
+copyright: Copyright © 2016 - 2023 Daniel Quinn, Jonas Winkler, and the Paperless-ngx team
 extra:
   social:
     - icon: fontawesome/brands/github

paperless.conf.example

@@ -55,10 +55,10 @@
 #PAPERLESS_TASK_WORKERS=1
 #PAPERLESS_THREADS_PER_WORKER=1
 #PAPERLESS_TIME_ZONE=UTC
-#PAPERLESS_CONSUMER_POLLING_INTERVAL=10
+#PAPERLESS_CONSUMER_POLLING=10
 #PAPERLESS_CONSUMER_DELETE_DUPLICATES=false
 #PAPERLESS_CONSUMER_RECURSIVE=false
-#PAPERLESS_CONSUMER_IGNORE_PATTERNS=[]  # Defaults are built in; add filename regexes, e.g. ["^\\.DS_Store$", "^desktop\\.ini$"]
+#PAPERLESS_CONSUMER_IGNORE_PATTERNS=[".DS_STORE/*", "._*", ".stfolder/*", ".stversions/*", ".localized/*", "desktop.ini"]
 #PAPERLESS_CONSUMER_SUBDIRS_AS_TAGS=false
 #PAPERLESS_CONSUMER_ENABLE_BARCODES=false
 #PAPERLESS_CONSUMER_BARCODE_STRING=PATCHT

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "paperless-ngx"
-version = "2.20.5"
+version = "2.19.3"
 description = "A community-supported supercharged document management system: scan, index and archive all your physical documents"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -16,9 +16,8 @@ classifiers = [
 # This will allow testing to not install a webserver, mysql, etc
 
 dependencies = [
-  "azure-ai-documentintelligence>=1.0.2",
   "babel>=2.17",
-  "bleach~=6.3.0",
+  "bleach~=6.2.0",
   "celery[redis]~=5.5.1",
   "channels~=4.2",
   "channels-redis~=4.2",
@@ -27,8 +26,8 @@ dependencies = [
   # WARNING: django does not use semver.
   #          Only patch versions are guaranteed to not introduce breaking changes.
   "django~=5.2.5",
-  "django-allauth[mfa,socialaccount]~=65.13.1",
+  "django-allauth[mfa,socialaccount]~=65.4.0",
-  "django-auditlog~=3.4.1",
+  "django-auditlog~=3.2.1",
   "django-cachalot~=2.8.0",
   "django-celery-results~=2.6.0",
   "django-compression-middleware~=0.5.0",
@@ -42,43 +41,42 @@ dependencies = [
   "djangorestframework~=3.16",
   "djangorestframework-guardian~=0.4.0",
   "drf-spectacular~=0.28",
-  "drf-spectacular-sidecar~=2025.10.1",
+  "drf-spectacular-sidecar~=2025.9.1",
   "drf-writable-nested~=0.7.1",
   "faiss-cpu>=1.10",
   "filelock~=3.20.0",
   "flower~=2.0.1",
-  "gotenberg-client~=0.13.1",
+  "gotenberg-client~=0.12.0",
   "httpx-oauth~=0.16",
   "imap-tools~=1.11.0",
+  "inotifyrecursive~=0.3",
   "jinja2~=3.1.5",
   "langdetect~=1.0.9",
-  "llama-index-core>=0.14.12",
+  "llama-index-core>=0.12.33.post1",
-  "llama-index-embeddings-huggingface>=0.6.1",
+  "llama-index-embeddings-huggingface>=0.5.3",
-  "llama-index-embeddings-openai>=0.5.1",
+  "llama-index-embeddings-openai>=0.3.1",
-  "llama-index-llms-ollama>=0.9.1",
+  "llama-index-llms-ollama>=0.5.4",
-  "llama-index-llms-openai>=0.6.13",
+  "llama-index-llms-openai>=0.3.38",
-  "llama-index-vector-stores-faiss>=0.5.2",
+  "llama-index-vector-stores-faiss>=0.3",
   "nltk~=3.9.1",
-  "ocrmypdf~=16.13.0",
+  "ocrmypdf~=16.11.0",
   "openai>=1.76",
   "pathvalidate~=3.3.1",
   "pdf2image~=1.17.0",
   "python-dateutil~=2.9.0",
-  "python-dotenv~=1.2.1",
+  "python-dotenv~=1.1.0",
   "python-gnupg~=0.5.4",
   "python-ipware~=3.0.0",
   "python-magic~=0.4.27",
   "pyzbar~=0.1.9",
   "rapidfuzz~=3.14.0",
   "redis[hiredis]~=5.2.1",
-  "regex>=2025.9.18",
   "scikit-learn~=1.7.0",
   "sentence-transformers>=4.1",
   "setproctitle~=1.3.4",
   "tika-client~=0.10.0",
-  "torch~=2.9.1",
   "tqdm~=4.67.1",
-  "watchfiles>=1.1.1",
+  "watchdog~=6.0",
   "whitenoise~=6.9",
   "whoosh-reloaded>=2.7.5",
   "zxing-cpp~=2.3.0",
@@ -88,10 +86,10 @@ optional-dependencies.mariadb = [
   "mysqlclient~=2.2.7",
 ]
 optional-dependencies.postgres = [
-  "psycopg[c,pool]==3.2.12",
+  "psycopg[c,pool]==3.2.9",
   # Direct dependency for proper resolution of the pre-built wheels
-  "psycopg-c==3.2.12",
+  "psycopg-c==3.2.9",
-  "psycopg-pool==3.3",
+  "psycopg-pool==3.2.6",
 ]
 optional-dependencies.webserver = [
   "granian[uvloop]~=2.5.1",
@@ -107,7 +105,7 @@ dev = [
 
 docs = [
   "mkdocs-glightbox~=0.5.1",
-  "mkdocs-material~=9.7.0",
+  "mkdocs-material~=9.6.4",
 ]
 
 testing = [
@@ -126,7 +124,7 @@ testing = [
 ]
 
 lint = [
-  "pre-commit~=4.5.1",
+  "pre-commit~=4.3.0",
   "pre-commit-uv~=4.2.0",
   "ruff~=0.14.0",
 ]
@@ -161,23 +159,14 @@ environments = [
 [tool.uv.sources]
 # Markers are chosen to select these almost exclusively when building the Docker image
 psycopg-c = [
-  { url = "https://github.com/paperless-ngx/builder/releases/download/psycopg-bookworm-3.2.12/psycopg_c-3.2.12-cp312-cp312-linux_x86_64.whl", marker = "sys_platform == 'linux' and platform_machine == 'x86_64' and python_version == '3.12'" },
+  { url = "https://github.com/paperless-ngx/builder/releases/download/psycopg-3.2.9/psycopg_c-3.2.9-cp312-cp312-linux_x86_64.whl", marker = "sys_platform == 'linux' and platform_machine == 'x86_64' and python_version == '3.12'" },
-  { url = "https://github.com/paperless-ngx/builder/releases/download/psycopg-bookworm-3.2.12/psycopg_c-3.2.12-cp312-cp312-linux_aarch64.whl", marker = "sys_platform == 'linux' and platform_machine == 'aarch64' and python_version == '3.12'" },
+  { url = "https://github.com/paperless-ngx/builder/releases/download/psycopg-3.2.9/psycopg_c-3.2.9-cp312-cp312-linux_aarch64.whl", marker = "sys_platform == 'linux' and platform_machine == 'aarch64' and python_version == '3.12'" },
 ]
 zxing-cpp = [
   { url = "https://github.com/paperless-ngx/builder/releases/download/zxing-2.3.0/zxing_cpp-2.3.0-cp312-cp312-linux_x86_64.whl", marker = "sys_platform == 'linux' and platform_machine == 'x86_64' and python_version == '3.12'" },
   { url = "https://github.com/paperless-ngx/builder/releases/download/zxing-2.3.0/zxing_cpp-2.3.0-cp312-cp312-linux_aarch64.whl", marker = "sys_platform == 'linux' and platform_machine == 'aarch64' and python_version == '3.12'" },
 ]
 
-torch = [
-  { index = "pytorch-cpu" },
-]
-
-[[tool.uv.index]]
-name = "pytorch-cpu"
-url = "https://download.pytorch.org/whl/cpu"
-explicit = true
-
 [tool.ruff]
 target-version = "py310"
 line-length = 88
@@ -272,7 +261,6 @@ testpaths = [
   "src/paperless_tesseract/tests/",
   "src/paperless_tika/tests",
   "src/paperless_text/tests/",
-  "src/paperless_remote/tests/",
   "src/paperless_ai/tests",
 ]
 addopts = [

src-ui/angular.json

@@ -31,7 +31,6 @@
           "fi-FI": "src/locale/messages.fi_FI.xlf",
           "fr-FR": "src/locale/messages.fr_FR.xlf",
           "hu-HU": "src/locale/messages.hu_HU.xlf",
-          "id-ID": "src/locale/messages.id_ID.xlf",
           "it-IT": "src/locale/messages.it_IT.xlf",
           "ja-JP": "src/locale/messages.ja_JP.xlf",
           "lb-LU": "src/locale/messages.lb_LU.xlf",
@@ -156,7 +155,16 @@
           "builder": "@angular-builders/jest:run",
           "options": {
             "tsConfig": "tsconfig.spec.json",
-            "zoneless": false
+            "assets": [
+              "src/favicon.ico",
+              "src/apple-touch-icon.png",
+              "src/assets",
+              "src/manifest.webmanifest"
+            ],
+            "styles": [
+              "src/styles.scss"
+            ],
+            "scripts": []
           }
         },
         "lint": {

src-ui/jest.config.js

@@ -1,23 +1,5 @@
-const { createEsmPreset } = require('jest-preset-angular/presets')
-
-const esmPreset = createEsmPreset({
-  tsconfig: '<rootDir>/tsconfig.spec.json',
-  stringifyContentPathRegex: '\\.(html|svg)$',
-})
-
 module.exports = {
-  ...esmPreset,
+  preset: 'jest-preset-angular',
-  transform: {
-    ...esmPreset.transform,
-    '^.+\\.(ts|js|mjs|html|svg)$': [
-      'jest-preset-angular',
-      {
-        tsconfig: '<rootDir>/tsconfig.spec.json',
-        stringifyContentPathRegex: '\\.(html|svg)$',
-        useESM: true,
-      },
-    ],
-  },
   setupFilesAfterEnv: ['<rootDir>/setup-jest.ts'],
   testPathIgnorePatterns: [
     '/node_modules/',
@@ -26,10 +8,9 @@ module.exports = {
     'abstract-paperless-service',
   ],
   transformIgnorePatterns: [
-    'node_modules/(?!.*(\\.mjs$|tslib|lodash-es|@angular/common/locales/.*\\.js$))',
+    `<rootDir>/node_modules/.pnpm/(?!.*\\.mjs$|lodash-es|@angular\\+common.*locales)`,
   ],
   moduleNameMapper: {
-    ...esmPreset.moduleNameMapper,
     '^src/(.*)': '<rootDir>/src/$1',
   },
   workerIdleMemoryLimit: '512MB',

src-ui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paperless-ngx-ui",
-  "version": "2.20.5",
+  "version": "2.19.3",
   "scripts": {
     "preinstall": "npx only-allow pnpm",
     "ng": "ng",
@@ -11,17 +11,17 @@
   },
   "private": true,
   "dependencies": {
-    "@angular/cdk": "^21.0.6",
+    "@angular/cdk": "^20.2.6",
-    "@angular/common": "~21.0.8",
+    "@angular/common": "~20.3.2",
-    "@angular/compiler": "~21.0.8",
+    "@angular/compiler": "~20.3.2",
-    "@angular/core": "~21.0.8",
+    "@angular/core": "~20.3.2",
-    "@angular/forms": "~21.0.8",
+    "@angular/forms": "~20.3.2",
-    "@angular/localize": "~21.0.8",
+    "@angular/localize": "~20.3.2",
-    "@angular/platform-browser": "~21.0.8",
+    "@angular/platform-browser": "~20.3.2",
-    "@angular/platform-browser-dynamic": "~21.0.8",
+    "@angular/platform-browser-dynamic": "~20.3.2",
-    "@angular/router": "~21.0.8",
+    "@angular/router": "~20.3.2",
-    "@ng-bootstrap/ng-bootstrap": "^20.0.0",
+    "@ng-bootstrap/ng-bootstrap": "^19.0.1",
-    "@ng-select/ng-select": "^21.1.4",
+    "@ng-select/ng-select": "^20.2.2",
     "@ngneat/dirty-check-forms": "^3.0.3",
     "@popperjs/core": "^2.11.8",
     "bootstrap": "^5.3.8",
@@ -30,8 +30,8 @@
     "ng2-pdf-viewer": "^10.4.0",
     "ngx-bootstrap-icons": "^1.9.3",
     "ngx-color": "^10.1.0",
-    "ngx-cookie-service": "^21.1.0",
+    "ngx-cookie-service": "^20.1.0",
-    "ngx-device-detector": "^11.0.0",
+    "ngx-device-detector": "^10.1.0",
     "ngx-ui-tour-ng-bootstrap": "^17.0.1",
     "rxjs": "^7.8.2",
     "tslib": "^2.8.1",
@@ -40,35 +40,35 @@
     "zone.js": "^0.15.1"
   },
   "devDependencies": {
-    "@angular-builders/custom-webpack": "^21.0.0-beta.1",
+    "@angular-builders/custom-webpack": "^20.0.0",
-    "@angular-builders/jest": "^21.0.0-beta.1",
+    "@angular-builders/jest": "^20.0.0",
-    "@angular-devkit/core": "^21.0.5",
+    "@angular-devkit/core": "^20.3.3",
-    "@angular-devkit/schematics": "^21.0.5",
+    "@angular-devkit/schematics": "^20.3.3",
-    "@angular-eslint/builder": "21.1.0",
+    "@angular-eslint/builder": "20.3.0",
-    "@angular-eslint/eslint-plugin": "21.1.0",
+    "@angular-eslint/eslint-plugin": "20.3.0",
-    "@angular-eslint/eslint-plugin-template": "21.1.0",
+    "@angular-eslint/eslint-plugin-template": "20.3.0",
-    "@angular-eslint/schematics": "21.1.0",
+    "@angular-eslint/schematics": "20.3.0",
-    "@angular-eslint/template-parser": "21.1.0",
+    "@angular-eslint/template-parser": "20.3.0",
-    "@angular/build": "^21.0.5",
+    "@angular/build": "^20.3.3",
-    "@angular/cli": "~21.0.5",
+    "@angular/cli": "~20.3.3",
-    "@angular/compiler-cli": "~21.0.8",
+    "@angular/compiler-cli": "~20.3.2",
     "@codecov/webpack-plugin": "^1.9.1",
-    "@playwright/test": "^1.57.0",
+    "@playwright/test": "^1.55.1",
     "@types/jest": "^30.0.0",
-    "@types/node": "^24.10.1",
+    "@types/node": "^24.6.1",
-    "@typescript-eslint/eslint-plugin": "^8.48.1",
+    "@typescript-eslint/eslint-plugin": "^8.45.0",
-    "@typescript-eslint/parser": "^8.48.1",
+    "@typescript-eslint/parser": "^8.45.0",
-    "@typescript-eslint/utils": "^8.48.1",
+    "@typescript-eslint/utils": "^8.45.0",
-    "eslint": "^9.39.1",
+    "eslint": "^9.36.0",
     "jest": "30.2.0",
     "jest-environment-jsdom": "^30.2.0",
     "jest-junit": "^16.0.0",
-    "jest-preset-angular": "^16.0.0",
+    "jest-preset-angular": "^15.0.2",
     "jest-websocket-mock": "^2.5.0",
     "prettier-plugin-organize-imports": "^4.3.0",
     "ts-node": "~10.9.1",
-    "typescript": "^5.9.3",
+    "typescript": "^5.8.3",
-    "webpack": "^5.103.0"
+    "webpack": "^5.102.0"
   },
   "packageManager": "pnpm@10.17.1",
   "pnpm": {

src-ui/setup-jest.ts

@@ -28,7 +28,6 @@ import localeFa from '@angular/common/locales/fa'
 import localeFi from '@angular/common/locales/fi'
 import localeFr from '@angular/common/locales/fr'
 import localeHu from '@angular/common/locales/hu'
-import localeId from '@angular/common/locales/id'
 import localeIt from '@angular/common/locales/it'
 import localeJa from '@angular/common/locales/ja'
 import localeKo from '@angular/common/locales/ko'
@@ -64,7 +63,6 @@ registerLocaleData(localeFa)
 registerLocaleData(localeFi)
 registerLocaleData(localeFr)
 registerLocaleData(localeHu)
-registerLocaleData(localeId)
 registerLocaleData(localeIt)
 registerLocaleData(localeJa)
 registerLocaleData(localeKo)
@@ -147,10 +145,6 @@ HTMLCanvasElement.prototype.getContext = <
   typeof HTMLCanvasElement.prototype.getContext
 >jest.fn()
 
-if (!HTMLElement.prototype.scrollTo) {
-  HTMLElement.prototype.scrollTo = jest.fn()
-}
-
 jest.mock('uuid', () => ({
   v4: jest.fn(() =>
     'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (char: string) => {

src-ui/src/app/components/admin/logs/logs.component.html

@@ -3,23 +3,9 @@
   i18n-title
   info="Review the log files for the application and for email checking."
   i18n-info>
-  <div class="input-group input-group-sm align-items-center">
+  <div class="form-check form-switch">
-    <div class="input-group input-group-sm me-3">
+    <input class="form-check-input" type="checkbox" role="switch" [(ngModel)]="autoRefreshEnabled">
-      <span class="input-group-text text-muted" i18n>Show</span>
+    <label class="form-check-label" for="autoRefreshSwitch" i18n>Auto refresh</label>
-      <input
-        class="form-control"
-        type="number"
-        min="100"
-        step="100"
-        [(ngModel)]="limit"
-        (ngModelChange)="onLimitChange($event)"
-        style="width: 100px;">
-      <span class="input-group-text text-muted" i18n>lines</span>
-    </div>
-    <div class="form-check form-switch mt-1">
-      <input class="form-check-input" type="checkbox" role="switch" [(ngModel)]="autoRefreshEnabled">
-      <label class="form-check-label" for="autoRefreshSwitch" i18n>Auto refresh</label>
-    </div>
   </div>
 </pngx-page-header>
 
@@ -41,23 +27,16 @@
   }
 </ul>
 
-<div #logContainer class="bg-dark text-light font-monospace log-container p-3" (scroll)="onScroll()">
+<div [ngbNavOutlet]="nav" class="mt-2"></div>
-  @if (loading && !logFiles.length) {
+
+<div class="bg-dark p-3 text-light font-monospace log-container" #logContainer>
+  @if (loading && logFiles.length) {
     <div>
       <div class="spinner-border spinner-border-sm me-2" role="status"></div>
       <ng-container i18n>Loading...</ng-container>
     </div>
-  } @else {
+  }
-    @for (log of logs; track log) {
+  @for (log of logs; track $index) {
-      <p class="m-0 p-0" [ngClass]="'log-entry-' + log.level">{{log.message}}</p>
+    <p class="m-0 p-0 log-entry-{{getLogLevel(log)}}">{{log}}</p>
-    }
   }
 </div>
-<button
-  type="button"
-  class="btn btn-sm btn-secondary jump-to-bottom position-fixed bottom-0 end-0 m-5"
-  [class.visible]="showJumpToBottom"
-  (click)="scrollToBottom()"
->
-  ↓ <span i18n>Jump to bottom</span>
-</button>

src-ui/src/app/components/admin/logs/logs.component.scss

@@ -16,21 +16,11 @@
 }
 
 .log-container {
-  height: calc(100vh - 190px);
+  overflow-y: scroll;
-  overflow-y: auto;
+  height: calc(100vh - 200px);
+  top: 70px;
 
   p {
     white-space: pre-wrap;
   }
 }
-
-.jump-to-bottom {
-  opacity: 0;
-  pointer-events: none;
-  transition: opacity 120ms ease-in-out;
-}
-
-.jump-to-bottom.visible {
-  opacity: 1;
-  pointer-events: auto;
-}

src-ui/src/app/components/admin/logs/logs.component.spec.ts

@@ -1,8 +1,3 @@
-import {
-  CdkVirtualScrollViewport,
-  ScrollingModule,
-} from '@angular/cdk/scrolling'
-import { CommonModule } from '@angular/common'
 import { provideHttpClient, withInterceptorsFromDi } from '@angular/common/http'
 import { provideHttpClientTesting } from '@angular/common/http/testing'
 import { ComponentFixture, TestBed } from '@angular/core/testing'
@@ -43,9 +38,6 @@ describe('LogsComponent', () => {
         NgxBootstrapIconsModule.pick(allIcons),
         LogsComponent,
         PageHeaderComponent,
-        CommonModule,
-        CdkVirtualScrollViewport,
-        ScrollingModule,
       ],
       providers: [
         provideHttpClient(withInterceptorsFromDi()),
@@ -62,12 +54,13 @@ describe('LogsComponent', () => {
     fixture = TestBed.createComponent(LogsComponent)
     component = fixture.componentInstance
     reloadSpy = jest.spyOn(component, 'reloadLogs')
+    window.HTMLElement.prototype.scroll = function () {} // mock scroll
     jest.useFakeTimers()
     fixture.detectChanges()
   })
 
   it('should display logs with first log initially', () => {
-    expect(logSpy).toHaveBeenCalledWith('paperless', 5000)
+    expect(logSpy).toHaveBeenCalledWith('paperless')
     fixture.detectChanges()
     expect(fixture.debugElement.nativeElement.textContent).toContain(
       paperless_logs[0]
@@ -78,7 +71,7 @@ describe('LogsComponent', () => {
     fixture.debugElement
       .queryAll(By.directive(NgbNavLink))[1]
       .nativeElement.dispatchEvent(new MouseEvent('click'))
-    expect(logSpy).toHaveBeenCalledWith('mail', 5000)
+    expect(logSpy).toHaveBeenCalledWith('mail')
   })
 
   it('should handle error with no logs', () => {
@@ -90,10 +83,6 @@ describe('LogsComponent', () => {
   })
 
   it('should auto refresh, allow toggle', () => {
-    jest
-      .spyOn(CdkVirtualScrollViewport.prototype, 'scrollToIndex')
-      .mockImplementation(() => undefined)
-
     jest.advanceTimersByTime(6000)
     expect(reloadSpy).toHaveBeenCalledTimes(2)
 
@@ -101,20 +90,4 @@ describe('LogsComponent', () => {
     jest.advanceTimersByTime(6000)
     expect(reloadSpy).toHaveBeenCalledTimes(2)
   })
-
-  it('should debounce limit changes before reloading logs', () => {
-    const initialCalls = reloadSpy.mock.calls.length
-    component.onLimitChange(6000)
-    jest.advanceTimersByTime(299)
-    expect(reloadSpy).toHaveBeenCalledTimes(initialCalls)
-    jest.advanceTimersByTime(1)
-    expect(reloadSpy).toHaveBeenCalledTimes(initialCalls + 1)
-  })
-
-  it('should update jump to bottom visibility on scroll', () => {
-    component.showJumpToBottom = false
-    jest.spyOn(component as any, 'isNearBottom').mockReturnValue(false)
-    component.onScroll()
-    expect(component.showJumpToBottom).toBe(true)
-  })
 })

src-ui/src/app/components/admin/logs/logs.component.ts

@@ -1,4 +1,3 @@
-import { CommonModule } from '@angular/common'
 import {
   ChangeDetectorRef,
   Component,
@@ -10,7 +9,7 @@ import {
 } from '@angular/core'
 import { FormsModule, ReactiveFormsModule } from '@angular/forms'
 import { NgbNavModule } from '@ng-bootstrap/ng-bootstrap'
-import { Subject, debounceTime, filter, takeUntil, timer } from 'rxjs'
+import { filter, takeUntil, timer } from 'rxjs'
 import { LogService } from 'src/app/services/rest/log.service'
 import { PageHeaderComponent } from '../../common/page-header/page-header.component'
 import { LoadingComponentWithPermissions } from '../../loading-component/loading.component'
@@ -22,7 +21,6 @@ import { LoadingComponentWithPermissions } from '../../loading-component/loading
   imports: [
     PageHeaderComponent,
     NgbNavModule,
-    CommonModule,
     FormsModule,
     ReactiveFormsModule,
   ],
@@ -34,7 +32,7 @@ export class LogsComponent
   private logService = inject(LogService)
   private changedetectorRef = inject(ChangeDetectorRef)
 
-  public logs: Array<{ message: string; level: number }> = []
+  public logs: string[] = []
 
   public logFiles: string[] = []
 
@@ -42,19 +40,9 @@ export class LogsComponent
 
   public autoRefreshEnabled: boolean = true
 
-  public limit: number = 5000
+  @ViewChild('logContainer') logContainer: ElementRef
-
-  public showJumpToBottom = false
-
-  private readonly limitChange$ = new Subject<number>()
-
-  @ViewChild('logContainer') logContainer: ElementRef<HTMLElement>
 
   ngOnInit(): void {
-    this.limitChange$
-      .pipe(debounceTime(300), takeUntil(this.unsubscribeNotifier))
-      .subscribe(() => this.reloadLogs())
-
     this.logService
       .list()
       .pipe(takeUntil(this.unsubscribeNotifier))
@@ -80,37 +68,16 @@ export class LogsComponent
     super.ngOnDestroy()
   }
 
-  onLimitChange(limit: number): void {
-    this.limitChange$.next(limit)
-  }
-
   reloadLogs() {
     this.loading = true
-    const shouldStickToBottom = this.isNearBottom()
     this.logService
-      .get(this.activeLog, this.limit)
+      .get(this.activeLog)
       .pipe(takeUntil(this.unsubscribeNotifier))
       .subscribe({
         next: (result) => {
+          this.logs = result
           this.loading = false
-          const parsed = this.parseLogsWithLevel(result)
+          this.scrollToBottom()
-          const hasChanges =
-            parsed.length !== this.logs.length ||
-            parsed.some((log, idx) => {
-              const current = this.logs[idx]
-              return (
-                !current ||
-                current.message !== log.message ||
-                current.level !== log.level
-              )
-            })
-          if (hasChanges) {
-            this.logs = parsed
-            if (shouldStickToBottom) {
-              this.scrollToBottom()
-            }
-            this.showJumpToBottom = !shouldStickToBottom
-          }
         },
         error: () => {
           this.logs = []
@@ -133,35 +100,12 @@ export class LogsComponent
     }
   }
 
-  private parseLogsWithLevel(
-    logs: string[]
-  ): Array<{ message: string; level: number }> {
-    return logs.map((log) => ({
-      message: log,
-      level: this.getLogLevel(log),
-    }))
-  }
-
   scrollToBottom(): void {
-    const viewport = this.logContainer?.nativeElement
-    if (!viewport) {
-      return
-    }
     this.changedetectorRef.detectChanges()
-    viewport.scrollTop = viewport.scrollHeight
+    this.logContainer?.nativeElement.scroll({
-    this.showJumpToBottom = false
+      top: this.logContainer.nativeElement.scrollHeight,
-  }
+      left: 0,
-
+      behavior: 'auto',
-  private isNearBottom(): boolean {
+    })
-    if (!this.logContainer?.nativeElement) return true
-    const distanceFromBottom =
-      this.logContainer.nativeElement.scrollHeight -
-      this.logContainer.nativeElement.scrollTop -
-      this.logContainer.nativeElement.clientHeight
-    return distanceFromBottom <= 40
-  }
-
-  onScroll(): void {
-    this.showJumpToBottom = !this.isNearBottom()
   }
 }

src-ui/src/app/components/admin/settings/settings.component.spec.ts

@@ -28,6 +28,7 @@ import { IfOwnerDirective } from 'src/app/directives/if-owner.directive'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { PermissionsGuard } from 'src/app/guards/permissions.guard'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { PermissionsService } from 'src/app/services/permissions.service'
 import { GroupService } from 'src/app/services/rest/group.service'
 import { SavedViewService } from 'src/app/services/rest/saved-view.service'
@@ -131,6 +132,7 @@ describe('SettingsComponent', () => {
         ConfirmDialogComponent,
         CheckComponent,
         ColorComponent,
+        SafeHtmlPipe,
         SelectComponent,
         TextComponent,
         NumberComponent,

src-ui/src/app/components/admin/trash/trash.component.spec.ts

@@ -11,6 +11,7 @@ import {
 } from '@ng-bootstrap/ng-bootstrap'
 import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
 import { of, throwError } from 'rxjs'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { ToastService } from 'src/app/services/toast.service'
 import { TrashService } from 'src/app/services/trash.service'
 import { ConfirmDialogComponent } from '../../common/confirm-dialog/confirm-dialog.component'
@@ -52,6 +53,7 @@ describe('TrashComponent', () => {
         TrashComponent,
         PageHeaderComponent,
         ConfirmDialogComponent,
+        SafeHtmlPipe,
       ],
     }).compileComponents()
 

src-ui/src/app/components/admin/users-groups/users-groups.component.html

@@ -26,7 +26,7 @@
     @for (user of users; track user) {
       <li class="list-group-item">
         <div class="row">
-          <div class="col d-flex align-items-center" [class.opacity-50]="!user.is_active"><button class="btn btn-link p-0 text-start" type="button" (click)="editUser(user)" [disabled]="!permissionsService.currentUserCan(PermissionAction.Change, PermissionType.User)">{{user.username}}</button></div>
+          <div class="col d-flex align-items-center"><button class="btn btn-link p-0 text-start" type="button" (click)="editUser(user)" [disabled]="!permissionsService.currentUserCan(PermissionAction.Change, PermissionType.User)">{{user.username}}</button></div>
           <div class="col d-flex align-items-center">{{user.first_name}} {{user.last_name}}</div>
           <div class="col d-flex align-items-center">{{user.groups?.map(getGroupName, this).join(', ')}}</div>
           <div class="col">

src-ui/src/app/components/app-frame/app-frame.component.html

@@ -71,15 +71,13 @@
     <nav id="sidebarMenu" class="d-md-block bg-light sidebar collapse"
       [ngClass]="slimSidebarEnabled ? 'slim' : 'col-md-3 col-lg-2 col-xxxl-1'" [class.animating]="slimSidebarAnimating"
       [ngbCollapse]="isMenuCollapsed">
-      @if (canSaveSettings) {
+      <button class="btn btn-sm btn-dark sidebar-slim-toggler" (click)="toggleSlimSidebar()">
-        <button class="btn btn-sm btn-dark sidebar-slim-toggler" (click)="toggleSlimSidebar()">
+        @if (slimSidebarEnabled) {
-          @if (slimSidebarEnabled) {
+          <i-bs width="0.9em" height="0.9em" name="chevron-double-right"></i-bs>
-            <i-bs width="0.9em" height="0.9em" name="chevron-double-right"></i-bs>
+        } @else {
-          } @else {
+          <i-bs width="0.9em" height="0.9em" name="chevron-double-left"></i-bs>
-            <i-bs width="0.9em" height="0.9em" name="chevron-double-left"></i-bs>
+        }
-          }
+      </button>
-        </button>
-      }
       <div class="sidebar-sticky pt-3 d-flex flex-column justify-space-around">
         <ul class="nav flex-column">
           <li class="nav-item app-link">

src-ui/src/app/components/app-frame/app-frame.component.ts

@@ -154,19 +154,6 @@ export class AppFrameComponent
     return this.settingsService.get(SETTINGS_KEYS.APP_TITLE)
   }
 
-  get canSaveSettings(): boolean {
-    return (
-      this.permissionsService.currentUserCan(
-        PermissionAction.Change,
-        PermissionType.UISettings
-      ) &&
-      this.permissionsService.currentUserCan(
-        PermissionAction.Add,
-        PermissionType.UISettings
-      )
-    )
-  }
-
   get slimSidebarEnabled(): boolean {
     return this.settingsService.get(SETTINGS_KEYS.SLIM_SIDEBAR)
   }

src-ui/src/app/components/app-frame/global-search/global-search.component.ts

@@ -411,9 +411,6 @@ export class GlobalSearchComponent implements OnInit {
     const ruleType = this.useAdvancedForFullSearch
       ? FILTER_FULLTEXT_QUERY
       : FILTER_TITLE_CONTENT
-    this.documentService.searchQuery = this.useAdvancedForFullSearch
-      ? this.query
-      : ''
     this.documentListViewService.quickFilter([
       { rule_type: ruleType, value: this.query },
     ])

src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.html

@@ -8,7 +8,7 @@
     <p><b>{{messageBold}}</b></p>
   }
   @if (message) {
-    <p class="mb-0" [innerHTML]="message"></p>
+    <p class="mb-0" [innerHTML]="message | safeHtml"></p>
   }
 </div>
 <div class="modal-footer">

src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.spec.ts

@@ -1,6 +1,7 @@
 import { ComponentFixture, TestBed } from '@angular/core/testing'
 import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
 import { Subject } from 'rxjs'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { ConfirmDialogComponent } from './confirm-dialog.component'
 
 describe('ConfirmDialogComponent', () => {
@@ -10,8 +11,8 @@ describe('ConfirmDialogComponent', () => {
 
   beforeEach(async () => {
     TestBed.configureTestingModule({
-      providers: [NgbActiveModal],
+      providers: [NgbActiveModal, SafeHtmlPipe],
-      imports: [ConfirmDialogComponent],
+      imports: [ConfirmDialogComponent, SafeHtmlPipe],
     }).compileComponents()
 
     modal = TestBed.inject(NgbActiveModal)

src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.ts

@@ -2,13 +2,14 @@ import { DecimalPipe } from '@angular/common'
 import { Component, EventEmitter, Input, Output, inject } from '@angular/core'
 import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
 import { Subject } from 'rxjs'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { LoadingComponentWithPermissions } from '../../loading-component/loading.component'
 
 @Component({
   selector: 'pngx-confirm-dialog',
   templateUrl: './confirm-dialog.component.html',
   styleUrls: ['./confirm-dialog.component.scss'],
-  imports: [DecimalPipe],
+  imports: [DecimalPipe, SafeHtmlPipe],
 })
 export class ConfirmDialogComponent extends LoadingComponentWithPermissions {
   activeModal = inject(NgbActiveModal)

src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.html

@@ -1,75 +0,0 @@
-<div class="modal-header">
-  <h4 class="modal-title" id="modal-basic-title">{{title}}</h4>
-  <button type="button" class="btn-close" aria-label="Close" (click)="cancel()">
-  </button>
-</div>
-<div class="modal-body">
-  @if (message) {
-    <p class="mb-3" [innerHTML]="message"></p>
-  }
-  <div class="btn-group mb-3" role="group">
-    <input
-      type="radio"
-      class="btn-check"
-      name="passwordRemoveMode"
-      id="removeReplace"
-      [(ngModel)]="updateDocument"
-      [value]="true"
-      (ngModelChange)="onUpdateDocumentChange($event)"
-    />
-    <label class="btn btn-outline-primary btn-sm" for="removeReplace">
-      <i-bs name="pencil"></i-bs>
-      <span class="ms-2" i18n>Replace current document</span>
-    </label>
-    <input
-      type="radio"
-      class="btn-check"
-      name="passwordRemoveMode"
-      id="removeCreate"
-      [(ngModel)]="updateDocument"
-      [value]="false"
-      (ngModelChange)="onUpdateDocumentChange($event)"
-    />
-    <label class="btn btn-outline-primary btn-sm" for="removeCreate">
-      <i-bs name="plus"></i-bs>
-      <span class="ms-2" i18n>Create new document</span>
-    </label>
-  </div>
-  @if (!updateDocument) {
-    <div class="d-flex flex-column flex-md-row w-100 gap-3 align-items-center">
-      <div class="form-group d-flex">
-        <div class="form-check">
-          <input class="form-check-input" type="checkbox" id="copyMetaRemove" [(ngModel)]="includeMetadata" />
-          <label class="form-check-label" for="copyMetaRemove" i18n> Copy metadata
-          </label>
-        </div>
-        <div class="form-check ms-3">
-          <input class="form-check-input" type="checkbox" id="deleteOriginalRemove" [(ngModel)]="deleteOriginal" />
-          <label class="form-check-label" for="deleteOriginalRemove" i18n> Delete original</label>
-        </div>
-      </div>
-    </div>
-  }
-</div>
-<div class="modal-footer flex-nowrap gap-2">
-  <button
-    type="button"
-    class="btn"
-    [class]="cancelBtnClass"
-    (click)="cancel()"
-    [disabled]="!buttonsEnabled"
-  >
-    <span class="d-inline-block" style="padding-bottom: 1px;">
-      {{cancelBtnCaption}}
-    </span>
-  </button>
-  <button
-    type="button"
-    class="btn"
-    [class]="btnClass"
-    (click)="confirm()"
-    [disabled]="!confirmButtonEnabled || !buttonsEnabled"
-  >
-    {{btnCaption}}
-  </button>
-</div>

src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.spec.ts

@@ -1,53 +0,0 @@
-import { ComponentFixture, TestBed } from '@angular/core/testing'
-import { By } from '@angular/platform-browser'
-import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
-import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
-import { PasswordRemovalConfirmDialogComponent } from './password-removal-confirm-dialog.component'
-
-describe('PasswordRemovalConfirmDialogComponent', () => {
-  let component: PasswordRemovalConfirmDialogComponent
-  let fixture: ComponentFixture<PasswordRemovalConfirmDialogComponent>
-
-  beforeEach(async () => {
-    await TestBed.configureTestingModule({
-      providers: [NgbActiveModal],
-      imports: [
-        NgxBootstrapIconsModule.pick(allIcons),
-        PasswordRemovalConfirmDialogComponent,
-      ],
-    }).compileComponents()
-
-    fixture = TestBed.createComponent(PasswordRemovalConfirmDialogComponent)
-    component = fixture.componentInstance
-    fixture.detectChanges()
-  })
-
-  it('should default to replacing the document', () => {
-    expect(component.updateDocument).toBe(true)
-    expect(
-      fixture.debugElement.query(By.css('#removeReplace')).nativeElement.checked
-    ).toBe(true)
-  })
-
-  it('should allow creating a new document with metadata and delete toggle', () => {
-    component.onUpdateDocumentChange(false)
-    fixture.detectChanges()
-
-    expect(component.updateDocument).toBe(false)
-    expect(fixture.debugElement.query(By.css('#copyMetaRemove'))).not.toBeNull()
-
-    component.includeMetadata = false
-    component.deleteOriginal = true
-    component.onUpdateDocumentChange(true)
-    expect(component.updateDocument).toBe(true)
-    expect(component.includeMetadata).toBe(true)
-    expect(component.deleteOriginal).toBe(false)
-  })
-
-  it('should emit confirm when confirmed', () => {
-    let confirmed = false
-    component.confirmClicked.subscribe(() => (confirmed = true))
-    component.confirm()
-    expect(confirmed).toBe(true)
-  })
-})

src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.ts

@@ -1,38 +0,0 @@
-import { Component, Input } from '@angular/core'
-import { FormsModule } from '@angular/forms'
-import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
-import { ConfirmDialogComponent } from '../confirm-dialog.component'
-
-@Component({
-  selector: 'pngx-password-removal-confirm-dialog',
-  templateUrl: './password-removal-confirm-dialog.component.html',
-  styleUrls: ['./password-removal-confirm-dialog.component.scss'],
-  imports: [FormsModule, NgxBootstrapIconsModule],
-})
-export class PasswordRemovalConfirmDialogComponent extends ConfirmDialogComponent {
-  updateDocument: boolean = true
-  includeMetadata: boolean = true
-  deleteOriginal: boolean = false
-
-  @Input()
-  override title = $localize`Remove password protection`
-
-  @Input()
-  override message =
-    $localize`Create an unprotected copy or replace the existing file.`
-
-  @Input()
-  override btnCaption = $localize`Start`
-
-  constructor() {
-    super()
-  }
-
-  onUpdateDocumentChange(updateDocument: boolean) {
-    this.updateDocument = updateDocument
-    if (this.updateDocument) {
-      this.deleteOriginal = false
-      this.includeMetadata = true
-    }
-  }
-}

src-ui/src/app/components/common/confirm-dialog/rotate-confirm-dialog/rotate-confirm-dialog.component.html

@@ -28,10 +28,10 @@
 <div class="modal-footer flex-nowrap">
     <div class="col">
         @if (message) {
-            <p>{{message}}</p>
+            <p [innerHTML]="message | safeHtml"></p>
         }
         @if (messageBold) {
-          <p class="mb-0 small"><b>{{messageBold}}</b></p>
+          <p class="mb-0 small"><b [innerHTML]="messageBold | safeHtml"></b></p>
         }
     </div>
     <button type="button" class="btn" [class]="cancelBtnClass" (click)="cancel()" [disabled]="!buttonsEnabled">

src-ui/src/app/components/common/confirm-dialog/rotate-confirm-dialog/rotate-confirm-dialog.component.spec.ts

@@ -3,6 +3,7 @@ import { provideHttpClientTesting } from '@angular/common/http/testing'
 import { ComponentFixture, TestBed } from '@angular/core/testing'
 import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
 import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { RotateConfirmDialogComponent } from './rotate-confirm-dialog.component'
 
 describe('RotateConfirmDialogComponent', () => {
@@ -14,9 +15,11 @@ describe('RotateConfirmDialogComponent', () => {
       imports: [
         NgxBootstrapIconsModule.pick(allIcons),
         RotateConfirmDialogComponent,
+        SafeHtmlPipe,
       ],
       providers: [
         NgbActiveModal,
+        SafeHtmlPipe,
         provideHttpClient(withInterceptorsFromDi()),
         provideHttpClientTesting(),
       ],

src-ui/src/app/components/common/confirm-dialog/rotate-confirm-dialog/rotate-confirm-dialog.component.ts

@@ -1,6 +1,7 @@
 import { NgStyle } from '@angular/common'
 import { Component, inject } from '@angular/core'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { DocumentService } from 'src/app/services/rest/document.service'
 import { ConfirmDialogComponent } from '../confirm-dialog.component'
 
@@ -8,7 +9,7 @@ import { ConfirmDialogComponent } from '../confirm-dialog.component'
   selector: 'pngx-rotate-confirm-dialog',
   templateUrl: './rotate-confirm-dialog.component.html',
   styleUrl: './rotate-confirm-dialog.component.scss',
-  imports: [NgStyle, NgxBootstrapIconsModule],
+  imports: [NgStyle, NgxBootstrapIconsModule, SafeHtmlPipe],
 })
 export class RotateConfirmDialogComponent extends ConfirmDialogComponent {
   documentService = inject(DocumentService)

src-ui/src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html

@@ -63,7 +63,6 @@
       bindValue="id"
       [(ngModel)]="atom.value"
       [disabled]="disabled"
-      [virtualScroll]="getSelectOptionsForField(atom.field)?.length > 100"
       (mousedown)="$event.stopImmediatePropagation()"
     ></ng-select>
   } @else if (getCustomFieldByID(atom.field)?.data_type === CustomFieldDataType.DocumentLink) {

src-ui/src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.spec.ts

@@ -354,13 +354,5 @@ describe('CustomFieldsQueryDropdownComponent', () => {
       model.removeElement(atom)
       expect(completeSpy).toHaveBeenCalled()
     })
-
-    it('should subscribe to existing elements when queries are assigned', () => {
-      const expression = new CustomFieldQueryExpression()
-      const nextSpy = jest.spyOn(model.changed, 'next')
-      model.queries = [expression]
-      expression.changed.next(expression)
-      expect(nextSpy).toHaveBeenCalledWith(model)
-    })
   })
 })

src-ui/src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts

@@ -17,7 +17,7 @@ import {
 } from '@ng-bootstrap/ng-bootstrap'
 import { NgSelectComponent, NgSelectModule } from '@ng-select/ng-select'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
-import { first, Subject, Subscription, takeUntil } from 'rxjs'
+import { first, Subject, takeUntil } from 'rxjs'
 import { CustomField, CustomFieldDataType } from 'src/app/data/custom-field'
 import {
   CUSTOM_FIELD_QUERY_MAX_ATOMS,
@@ -41,27 +41,10 @@ import { ClearableBadgeComponent } from '../clearable-badge/clearable-badge.comp
 import { DocumentLinkComponent } from '../input/document-link/document-link.component'
 
 export class CustomFieldQueriesModel {
-  private _queries: CustomFieldQueryElement[] = []
+  public queries: CustomFieldQueryElement[] = []
-  private rootSubscriptions: Subscription[] = []
 
   public readonly changed = new Subject<CustomFieldQueriesModel>()
 
-  public get queries(): CustomFieldQueryElement[] {
-    return this._queries
-  }
-
-  public set queries(value: CustomFieldQueryElement[]) {
-    this.teardownRootSubscriptions()
-    this._queries = value ?? []
-    for (const element of this._queries) {
-      this.rootSubscriptions.push(
-        element.changed.subscribe(() => {
-          this.changed.next(this)
-        })
-      )
-    }
-  }
-
   public clear(fireEvent = true) {
     this.queries = []
     if (fireEvent) {
@@ -124,14 +107,14 @@ export class CustomFieldQueriesModel {
   public addExpression(
     expression: CustomFieldQueryExpression = new CustomFieldQueryExpression()
   ) {
-    if (this.queries.length === 0) {
+    if (this.queries.length > 0) {
-      this.queries = [expression]
+      ;(
-      return
+        (this.queries[0] as CustomFieldQueryExpression)
+          .value as CustomFieldQueryElement[]
+      ).push(expression)
+    } else {
+      this.queries.push(expression)
     }
-    ;(
-      (this.queries[0] as CustomFieldQueryExpression)
-        .value as CustomFieldQueryElement[]
-    ).push(expression)
     expression.changed.subscribe(() => {
       this.changed.next(this)
     })
@@ -183,13 +166,6 @@ export class CustomFieldQueriesModel {
       this.changed.next(this)
     }
   }
-
-  private teardownRootSubscriptions() {
-    for (const subscription of this.rootSubscriptions) {
-      subscription.unsubscribe()
-    }
-    this.rootSubscriptions = []
-  }
 }
 
 @Component({

src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.html

@@ -26,7 +26,7 @@
           i18n-placeholder
           (change)="onSetCreatedRelativeDate($event)">
           <ng-template ng-option-tmp let-item="item">
-            <ng-container [ngTemplateOutlet]="relativeDateOptionTemplate" [ngTemplateOutletContext]="{ $implicit: item }"></ng-container>
+            <div class="d-flex">{{ item.name }}<span class="ms-auto text-muted small">{{ item.date | customDate:'mediumDate' }} &ndash; <ng-container i18n>now</ng-container></span></div>
           </ng-template>
           </ng-select>
         </div>
@@ -102,7 +102,7 @@
             i18n-placeholder
             (change)="onSetAddedRelativeDate($event)">
             <ng-template ng-option-tmp let-item="item">
-              <ng-container [ngTemplateOutlet]="relativeDateOptionTemplate" [ngTemplateOutletContext]="{ $implicit: item }"></ng-container>
+              <div class="d-flex">{{ item.name }}<span class="ms-auto text-muted small">{{ item.date | customDate:'mediumDate' }} &ndash; <ng-container i18n>now</ng-container></span></div>
             </ng-template>
           </ng-select>
         </div>
@@ -158,16 +158,3 @@
     </div>
   </div>
 </div>
-
-<ng-template #relativeDateOptionTemplate let-item>
-  <div class="d-flex">
-    {{ item.name }}
-    <span class="ms-auto text-muted small">
-      @if (item.dateEnd) {
-        {{ item.date | customDate:'MMM d' }} &ndash; {{ item.dateEnd | customDate:'mediumDate' }}
-      } @else {
-        {{ item.date | customDate:'mediumDate' }} &ndash; <ng-container i18n>now</ng-container>
-      }
-    </span>
-  </div>
-</ng-template>

src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.ts

@@ -1,4 +1,4 @@
-import { NgClass, NgTemplateOutlet } from '@angular/common'
+import { NgClass } from '@angular/common'
 import {
   Component,
   EventEmitter,
@@ -42,10 +42,6 @@ export enum RelativeDate {
   THIS_MONTH = 6,
   TODAY = 7,
   YESTERDAY = 8,
-  PREVIOUS_WEEK = 9,
-  PREVIOUS_MONTH = 10,
-  PREVIOUS_QUARTER = 11,
-  PREVIOUS_YEAR = 12,
 }
 
 @Component({
@@ -63,7 +59,6 @@ export enum RelativeDate {
     FormsModule,
     ReactiveFormsModule,
     NgClass,
-    NgTemplateOutlet,
   ],
 })
 export class DatesDropdownComponent implements OnInit, OnDestroy {
@@ -116,46 +111,6 @@ export class DatesDropdownComponent implements OnInit, OnDestroy {
       name: $localize`Yesterday`,
       date: new Date().setDate(new Date().getDate() - 1),
     },
-    {
-      id: RelativeDate.PREVIOUS_WEEK,
-      name: $localize`Previous week`,
-      date: new Date(
-        new Date().getFullYear(),
-        new Date().getMonth(),
-        new Date().getDate() - new Date().getDay() - 6
-      ),
-      dateEnd: new Date(
-        new Date().getFullYear(),
-        new Date().getMonth(),
-        new Date().getDate() - new Date().getDay()
-      ),
-    },
-    {
-      id: RelativeDate.PREVIOUS_MONTH,
-      name: $localize`Previous month`,
-      date: new Date(new Date().getFullYear(), new Date().getMonth() - 1, 1),
-      dateEnd: new Date(new Date().getFullYear(), new Date().getMonth(), 0),
-    },
-    {
-      id: RelativeDate.PREVIOUS_QUARTER,
-      name: $localize`Previous quarter`,
-      date: new Date(
-        new Date().getFullYear(),
-        Math.floor(new Date().getMonth() / 3) * 3 - 3,
-        1
-      ),
-      dateEnd: new Date(
-        new Date().getFullYear(),
-        Math.floor(new Date().getMonth() / 3) * 3,
-        0
-      ),
-    },
-    {
-      id: RelativeDate.PREVIOUS_YEAR,
-      name: $localize`Previous year`,
-      date: new Date('1/1/' + (new Date().getFullYear() - 1)),
-      dateEnd: new Date('12/31/' + (new Date().getFullYear() - 1)),
-    },
   ]
 
   datePlaceHolder: string

src-ui/src/app/components/common/edit-dialog/custom-field-edit-dialog/custom-field-edit-dialog.component.spec.ts

@@ -10,6 +10,7 @@ import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
 import { CustomFieldDataType } from 'src/app/data/custom-field'
 import { IfOwnerDirective } from 'src/app/directives/if-owner.directive'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { SettingsService } from 'src/app/services/settings.service'
 import { SelectComponent } from '../../input/select/select.component'
 import { TextComponent } from '../../input/text/text.component'
@@ -34,6 +35,7 @@ describe('CustomFieldEditDialogComponent', () => {
         IfOwnerDirective,
         SelectComponent,
         TextComponent,
+        SafeHtmlPipe,
       ],
       providers: [
         NgbActiveModal,

src-ui/src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.spec.ts

@@ -11,6 +11,7 @@ import {
 } from 'src/app/data/mail-rule'
 import { IfOwnerDirective } from 'src/app/directives/if-owner.directive'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { CorrespondentService } from 'src/app/services/rest/correspondent.service'
 import { DocumentTypeService } from 'src/app/services/rest/document-type.service'
 import { MailAccountService } from 'src/app/services/rest/mail-account.service'
@@ -45,6 +46,7 @@ describe('MailRuleEditDialogComponent', () => {
         PermissionsFormComponent,
         NumberComponent,
         TagsComponent,
+        SafeHtmlPipe,
         CheckComponent,
         SwitchComponent,
       ],

src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.html

@@ -161,7 +161,7 @@
         <pngx-input-text i18n-title title="Filter filename" formControlName="filter_filename" horizontal="true" i18n-hint hint="Apply to documents that match this filename. Wildcards such as *.pdf or *invoice* are allowed. Case insensitive." [error]="error?.filter_filename"></pngx-input-text>
         @if (formGroup.get('type').value === WorkflowTriggerType.Consumption) {
           <pngx-input-select i18n-title title="Filter sources" [items]="sourceOptions" horizontal="true" [multiple]="true" formControlName="sources" [error]="error?.sources"></pngx-input-select>
-          <pngx-input-text i18n-title title="Filter path" formControlName="filter_path" horizontal="true" i18n-hint hint="Apply to documents that match this path. Wildcards specified as * are allowed. Case-normalized." [error]="error?.filter_path"></pngx-input-text>
+          <pngx-input-text i18n-title title="Filter path" formControlName="filter_path" horizontal="true" i18n-hint hint="Apply to documents that match this path. Wildcards specified as * are allowed. Case-normalized.</a>" [error]="error?.filter_path"></pngx-input-text>
           <pngx-input-select i18n-title title="Filter mail rule" [items]="mailRules" horizontal="true" [allowNull]="true" formControlName="filter_mailrule" i18n-hint hint="Apply to documents consumed via this mail rule." [error]="error?.filter_mailrule"></pngx-input-select>
         }
         @if (formGroup.get('type').value === WorkflowTriggerType.DocumentAdded || formGroup.get('type').value === WorkflowTriggerType.DocumentUpdated || formGroup.get('type').value === WorkflowTriggerType.Scheduled) {

src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.spec.ts

@@ -30,6 +30,7 @@ import {
 } from 'src/app/data/workflow-trigger'
 import { IfOwnerDirective } from 'src/app/directives/if-owner.directive'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { CorrespondentService } from 'src/app/services/rest/correspondent.service'
 import { CustomFieldsService } from 'src/app/services/rest/custom-fields.service'
 import { DocumentTypeService } from 'src/app/services/rest/document-type.service'
@@ -104,6 +105,7 @@ describe('WorkflowEditDialogComponent', () => {
         TagsComponent,
         PermissionsUserComponent,
         PermissionsGroupComponent,
+        SafeHtmlPipe,
         ConfirmButtonComponent,
       ],
       providers: [
@@ -252,7 +254,7 @@ describe('WorkflowEditDialogComponent', () => {
     expect(component.object.actions.length).toEqual(2)
   })
 
-  it('should update order on drag n drop', () => {
+  it('should update order and remove ids from actions on drag n drop', () => {
     const action1 = workflow.actions[0]
     const action2 = workflow.actions[1]
     component.object = workflow
@@ -261,6 +263,8 @@ describe('WorkflowEditDialogComponent', () => {
       WorkflowAction[]
     >)
     expect(component.object.actions).toEqual([action2, action1])
+    expect(action1.id).toBeNull()
+    expect(action2.id).toBeNull()
   })
 
   it('should not include auto matching in algorithms', () => {

src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts

@@ -1283,6 +1283,11 @@ export class WorkflowEditDialogComponent
     const actionField = this.actionFields.at(event.previousIndex)
     this.actionFields.removeAt(event.previousIndex)
     this.actionFields.insert(event.currentIndex, actionField)
+    // removing id will effectively re-create the actions in this order
+    this.object.actions.forEach((a) => (a.id = null))
+    this.actionFields.controls.forEach((c) =>
+      c.get('id').setValue(null, { emitEvent: false })
+    )
   }
 
   save(): void {

src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.spec.ts

@@ -631,47 +631,6 @@ describe('FilterableDropdownComponent & FilterableDropdownSelectionModel', () =>
     ])
   })
 
-  it('resorts items immediately when document count sorting enabled', () => {
-    const apple: Tag = { id: 55, name: 'Apple' }
-    const zebra: Tag = { id: 56, name: 'Zebra' }
-
-    selectionModel.documentCountSortingEnabled = true
-    selectionModel.items = [apple, zebra]
-    expect(selectionModel.items.map((item) => item?.id ?? null)).toEqual([
-      null,
-      apple.id,
-      zebra.id,
-    ])
-
-    selectionModel.documentCounts = [
-      { id: zebra.id, document_count: 5 },
-      { id: apple.id, document_count: 0 },
-    ]
-
-    expect(selectionModel.items.map((item) => item?.id ?? null)).toEqual([
-      null,
-      zebra.id,
-      apple.id,
-    ])
-  })
-
-  it('does not resort items by default when document counts are set', () => {
-    const first: Tag = { id: 57, name: 'First' }
-    const second: Tag = { id: 58, name: 'Second' }
-
-    selectionModel.items = [first, second]
-    selectionModel.documentCounts = [
-      { id: second.id, document_count: 10 },
-      { id: first.id, document_count: 0 },
-    ]
-
-    expect(selectionModel.items.map((item) => item?.id ?? null)).toEqual([
-      null,
-      first.id,
-      second.id,
-    ])
-  })
-
   it('uses fallback document counts when selection data is missing', () => {
     const fallbackRoot: Tag = {
       id: 50,

src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.ts

@@ -61,13 +61,8 @@ export class FilterableDropdownSelectionModel {
   temporaryIntersection: Intersection = this._intersection
 
   private _documentCounts: SelectionDataItem[] = []
-  public documentCountSortingEnabled = false
-
   public set documentCounts(counts: SelectionDataItem[]) {
     this._documentCounts = counts
-    if (this.documentCountSortingEnabled) {
-      this.sortItems()
-    }
   }
 
   private _items: MatchingModel[] = []
@@ -656,9 +651,8 @@ export class FilterableDropdownComponent
       this.selectionModel.changed.complete()
       model.items = this.selectionModel.items
       model.manyToOne = this.selectionModel.manyToOne
-      model.singleSelect = this._editing && !model.manyToOne
+      model.singleSelect = this.editing && !this.selectionModel.manyToOne
     }
-    model.documentCountSortingEnabled = this._editing
     model.changed.subscribe((updatedModel) => {
       this.selectionModelChange.next(updatedModel)
     })
@@ -688,21 +682,8 @@ export class FilterableDropdownComponent
   @Input()
   allowSelectNone: boolean = false
 
-  private _editing = false
-
   @Input()
-  set editing(value: boolean) {
+  editing = false
-    this._editing = value
-    if (this.selectionModel) {
-      this.selectionModel.singleSelect =
-        this._editing && !this.selectionModel.manyToOne
-      this.selectionModel.documentCountSortingEnabled = this._editing
-    }
-  }
-
-  get editing() {
-    return this._editing
-  }
 
   @Input()
   applyOnClose = false

src-ui/src/app/components/common/input/entries/entries.component.html

@@ -19,7 +19,7 @@
         </div>
       }
       @if (hint) {
-        <small class="form-text text-muted" [innerHTML]="hint"></small>
+        <small class="form-text text-muted" [innerHTML]="hint | safeHtml"></small>
       }
       <div class="invalid-feedback position-absolute top-100">
         {{error}}

src-ui/src/app/components/common/input/file/file.component.html

@@ -24,7 +24,7 @@
         }
         <input #inputField type="hidden" class="form-control small" [(ngModel)]="value" [disabled]="true">
         @if (hint) {
-            <small class="form-text text-muted" [innerHTML]="hint"></small>
+            <small class="form-text text-muted" [innerHTML]="hint | safeHtml"></small>
         }
         <div class="invalid-feedback position-absolute top-100">
             {{error}}

src-ui/src/app/components/common/input/password/password.component.html

@@ -18,7 +18,7 @@
       {{error}}
     </div>
     @if (hint) {
-      <small class="form-text text-muted" [innerHTML]="hint"></small>
+      <small class="form-text text-muted" [innerHTML]="hint | safeHtml"></small>
     }
   </div>
 </div>

src-ui/src/app/components/common/input/select/select.component.html

@@ -29,7 +29,6 @@
           [multiple]="multiple"
           [bindLabel]="bindLabel"
           bindValue="id"
-          [virtualScroll]="items?.length > 100"
           (change)="onChange(value)"
           (search)="onSearch($event)"
           (focus)="clearLastSearchTerm()"

src-ui/src/app/components/common/input/tags/tags.component.html

@@ -28,7 +28,7 @@
             </button>
           </ng-template>
           <ng-template ng-option-tmp let-item="item" let-index="index" let-search="searchTerm">
-            <div class="tag-option-row d-flex align-items-center" [class.w-auto]="!getTag(item.id)?.parent">
+            <div class="tag-option-row d-flex align-items-center">
               @if (item.id && tags) {
                 @if (getTag(item.id)?.parent) {
                   <i-bs name="list-nested" class="me-1"></i-bs>

src-ui/src/app/components/common/input/tags/tags.component.scss

@@ -22,8 +22,8 @@
 }
 
 // Dropdown hierarchy reveal for ng-select options
-:host ::ng-deep .ng-dropdown-panel .ng-option {
+::ng-deep .ng-dropdown-panel .ng-option {
-  overflow-x: auto !important;
+  overflow-x: scroll;
 
   .tag-option-row {
     font-size: 1rem;
@@ -41,12 +41,12 @@
   }
 }
 
-:host ::ng-deep .ng-dropdown-panel .ng-option:hover .hierarchy-reveal,
+::ng-deep .ng-dropdown-panel .ng-option:hover .hierarchy-reveal,
-:host ::ng-deep .ng-dropdown-panel .ng-option.ng-option-marked .hierarchy-reveal {
+::ng-deep .ng-dropdown-panel .ng-option.ng-option-marked .hierarchy-reveal {
   max-width: 1000px;
 }
 
 ::ng-deep .ng-dropdown-panel .ng-option:hover .hierarchy-indicator,
-:host ::ng-deep .ng-dropdown-panel .ng-option.ng-option-marked .hierarchy-indicator {
+::ng-deep .ng-dropdown-panel .ng-option.ng-option-marked .hierarchy-indicator {
   background: transparent;
 }

src-ui/src/app/components/common/input/tags/tags.component.spec.ts

@@ -106,7 +106,6 @@ describe('TagsComponent', () => {
 
     modalService = TestBed.inject(NgbModal)
     settingsService = TestBed.inject(SettingsService)
-    settingsService.currentUser = { id: 1 }
     fixture = TestBed.createComponent(TagsComponent)
     fixture.debugElement.injector.get(NG_VALUE_ACCESSOR)
     component = fixture.componentInstance
@@ -139,7 +138,7 @@ describe('TagsComponent', () => {
     settingsService.currentUser = { id: 1 }
     let activeInstances: NgbModalRef[]
     modalService.activeInstances.subscribe((v) => (activeInstances = v))
-    component.select.filter('foobar')
+    component.select.searchTerm = 'foobar'
     component.createTag()
     expect(modalService.hasOpenModals()).toBeTruthy()
     expect(activeInstances[0].componentInstance.object.name).toEqual('foobar')

src-ui/src/app/components/common/input/tags/tags.component.ts

@@ -169,7 +169,7 @@ export class TagsComponent implements OnInit, ControlValueAccessor {
     if (name) modal.componentInstance.object = { name: name }
     else if (this.select.searchTerm)
       modal.componentInstance.object = { name: this.select.searchTerm }
-    this.select.filter(null)
+    this.select.searchTerm = null
     this.select.detectChanges()
     return firstValueFrom(
       (modal.componentInstance as TagEditDialogComponent).succeeded.pipe(

src-ui/src/app/components/common/input/text/text.component.html

@@ -13,7 +13,7 @@
       <div class="position-relative" [class.col-md-9]="horizontal">
         <input #inputField type="text" class="form-control" [class.is-invalid]="error" [id]="inputId" [(ngModel)]="value" (change)="onChange(value)" [disabled]="disabled" [autocomplete]="autocomplete" [placeholder]="placeholder">
         @if (hint) {
-          <small class="form-text text-muted" [innerHTML]="hint"></small>
+          <small class="form-text text-muted" [innerHTML]="hint | safeHtml"></small>
         }
         @if (getSuggestion()?.length > 0) {
           <small>

src-ui/src/app/components/common/input/text/text.component.ts

@@ -6,6 +6,7 @@ import {
 } from '@angular/forms'
 import { RouterLink } from '@angular/router'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { AbstractInputComponent } from '../abstract-input'
 
 @Component({
@@ -22,6 +23,7 @@ import { AbstractInputComponent } from '../abstract-input'
   imports: [
     FormsModule,
     ReactiveFormsModule,
+    SafeHtmlPipe,
     NgxBootstrapIconsModule,
     RouterLink,
   ],

src-ui/src/app/components/common/input/textarea/textarea.component.html

@@ -23,7 +23,7 @@
           rows="4">
         </textarea>
         @if (hint) {
-          <small class="form-text text-muted" [innerHTML]="hint"></small>
+          <small class="form-text text-muted" [innerHTML]="hint | safeHtml"></small>
         }
         <div class="invalid-feedback position-absolute top-100">
           {{error}}

src-ui/src/app/components/common/input/textarea/textarea.component.ts

@@ -5,6 +5,7 @@ import {
   ReactiveFormsModule,
 } from '@angular/forms'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { AbstractInputComponent } from '../abstract-input'
 
 @Component({
@@ -18,7 +19,12 @@ import { AbstractInputComponent } from '../abstract-input'
   selector: 'pngx-input-textarea',
   templateUrl: './textarea.component.html',
   styleUrls: ['./textarea.component.scss'],
-  imports: [FormsModule, ReactiveFormsModule, NgxBootstrapIconsModule],
+  imports: [
+    FormsModule,
+    ReactiveFormsModule,
+    SafeHtmlPipe,
+    NgxBootstrapIconsModule,
+  ],
 })
 export class TextAreaComponent extends AbstractInputComponent<string> {
   @Input()

src-ui/src/app/components/common/input/url/url.component.html

@@ -19,7 +19,7 @@
         </div>
       </div>
       @if (hint) {
-        <small class="form-text text-muted" [innerHTML]="hint"></small>
+        <small class="form-text text-muted" [innerHTML]="hint | safeHtml"></small>
       }
     </div>
   </div>

src-ui/src/app/components/common/permissions-dialog/permissions-dialog.component.spec.ts

@@ -5,6 +5,7 @@ import { FormsModule, ReactiveFormsModule } from '@angular/forms'
 import { NgbActiveModal, NgbModule } from '@ng-bootstrap/ng-bootstrap'
 import { NgSelectModule } from '@ng-select/ng-select'
 import { of } from 'rxjs'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { UserService } from 'src/app/services/rest/user.service'
 import { PermissionsFormComponent } from '../input/permissions/permissions-form/permissions-form.component'
 import { PermissionsGroupComponent } from '../input/permissions/permissions-group/permissions-group.component'
@@ -40,6 +41,7 @@ describe('PermissionsDialogComponent', () => {
         ReactiveFormsModule,
         NgbModule,
         PermissionsDialogComponent,
+        SafeHtmlPipe,
         SelectComponent,
         SwitchComponent,
         PermissionsFormComponent,

src-ui/src/app/components/common/preview-popup/preview-popup.component.html

@@ -14,7 +14,7 @@
         @if (previewText) {
           <div class="bg-light p-3 overflow-auto whitespace-preserve" width="100%">{{previewText}}</div>
         } @else {
-          <object [data]="previewUrl | safeUrl" width="100%" class="bg-light" [class.p-2]="!isPdf"></object>
+          <object [data]="previewURL | safeUrl" width="100%" class="bg-light" [class.p-2]="!isPdf"></object>
         }
       } @else {
         @if (requiresPassword) {
@@ -24,7 +24,7 @@
         }
         @if (!requiresPassword) {
           <pdf-viewer
-            [src]="previewUrl"
+            [src]="previewURL"
             [original-size]="false"
             [show-borders]="false"
             [show-all]="true"

src-ui/src/app/components/common/preview-popup/preview-popup.component.ts

@@ -71,7 +71,7 @@ export class PreviewPopupComponent implements OnDestroy {
     return (this.isPdf && this.useNativePdfViewer) || !this.isPdf
   }
 
-  get previewUrl() {
+  get previewURL() {
     return this.documentService.getPreviewUrl(this.document.id)
   }
 
@@ -93,7 +93,7 @@ export class PreviewPopupComponent implements OnDestroy {
   init() {
     if (this.document.mime_type?.includes('text')) {
       this.http
-        .get(this.previewUrl, { responseType: 'text' })
+        .get(this.previewURL, { responseType: 'text' })
         .pipe(first(), takeUntil(this.unsubscribeNotifier))
         .subscribe({
           next: (res) => {
@@ -126,6 +126,10 @@ export class PreviewPopupComponent implements OnDestroy {
     }
   }
 
+  get previewUrl() {
+    return this.documentService.getPreviewUrl(this.document.id)
+  }
+
   mouseEnterPreview() {
     this.mouseOnPreview = true
     if (!this.popover.isOpen()) {

src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.html

@@ -110,9 +110,7 @@
                       <div class="visually-hidden" i18n>Loading...</div>
                     } @else if (totpSettings) {
                       <figure class="figure">
-                        @if (qrSvgDataUrl) {
+                        <div class="bg-white d-inline-block" [innerHTML]="totpSettings.qr_svg | safeHtml"></div>
-                          <img class="bg-white d-inline-block" [src]="qrSvgDataUrl" alt="Authenticator QR code">
-                        }
                         <figcaption class="figure-caption text-end mt-2" i18n>Scan the QR code with your authenticator app and then enter the code below</figcaption>
                       </figure>
                       <p>

src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.ts

@@ -18,6 +18,7 @@ import {
   SocialAccountProvider,
   TotpSettings,
 } from 'src/app/data/user-profile'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { ProfileService } from 'src/app/services/profile.service'
 import { ToastService } from 'src/app/services/toast.service'
 import { setLocationHref } from 'src/app/utils/navigation'
@@ -36,6 +37,7 @@ import { TextComponent } from '../input/text/text.component'
     PasswordComponent,
     FormsModule,
     ReactiveFormsModule,
+    SafeHtmlPipe,
     NgbAccordionModule,
     NgbPopoverModule,
     NgxBootstrapIconsModule,
@@ -87,13 +89,6 @@ export class ProfileEditDialogComponent
   public socialAccounts: SocialAccount[] = []
   public socialAccountProviders: SocialAccountProvider[] = []
 
-  get qrSvgDataUrl(): string | null {
-    if (!this.totpSettings?.qr_svg) {
-      return null
-    }
-    return `data:image/svg+xml;utf8,${encodeURIComponent(this.totpSettings.qr_svg)}`
-  }
-
   ngOnInit(): void {
     this.networkActive = true
     this.profileService
@@ -188,7 +183,6 @@ export class ProfileEditDialogComponent
       this.newPassword && this.currentPassword !== this.newPassword
     const profile = Object.assign({}, this.form.value)
     delete profile.totp_code
-    this.error = null
     this.networkActive = true
     this.profileService
       .update(profile)
@@ -210,7 +204,6 @@ export class ProfileEditDialogComponent
         },
         error: (error) => {
           this.toastService.showError($localize`Error saving profile`, error)
-          this.error = error?.error
           this.networkActive = false
         },
       })