Merge branch 'dev' into feature-remote-ocr-2

2025-12-29 13:48:09 -06:00 · 2025-11-02 08:14:04 -08:00 · 2025-10-29 11:13:53 -07:00 · 2025-10-27 21:22:42 -07:00 · 2025-10-26 07:41:51 -07:00 · 2025-10-24 16:48:07 -07:00
257 changed files with 15888 additions and 48268 deletions
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1

-FROM --platform=$BUILDPLATFORM docker.io/node:20-trixie-slim as main-app
+FROM --platform=$BUILDPLATFORM docker.io/node:20-bookworm-slim as main-app

 ARG DEBIAN_FRONTEND=noninteractive

@@ -8,17 +8,16 @@ ARG DEBIAN_FRONTEND=noninteractive
 ARG TARGETARCH

 # Can be workflow provided, defaults set for manual building
-ARG JBIG2ENC_VERSION=0.30
+ARG JBIG2ENC_VERSION=0.29
+ARG QPDF_VERSION=11.9.0
+ARG GS_VERSION=10.03.1

 # Set Python environment variables
 ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    # Ignore warning from Whitenoise
    PYTHONWARNINGS="ignore:::django.http.response:517" \
-    PNGX_CONTAINERIZED=1 \
-    # https://docs.astral.sh/uv/reference/settings/#link-mode
-    UV_LINK_MODE=copy \
-    UV_CACHE_DIR=/cache/uv/
+    PNGX_CONTAINERIZED=1

 #
 # Begin installation and configuration
@@ -84,15 +83,37 @@ RUN set -eux \
    && apt-get update \
    && apt-get install --yes --quiet ${PYTHON_PACKAGES}

-COPY --from=ghcr.io/astral-sh/uv:0.9.10 /uv /bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.7.8 /uv /bin/uv


 RUN set -eux \
  && echo "Installing pre-built updates" \
+    && echo "Installing qpdf ${QPDF_VERSION}" \
+      && curl --fail --silent --show-error --location \
+        --output libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/qpdf-${QPDF_VERSION}/libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+      && curl --fail --silent --show-error --location \
+        --output qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/qpdf-${QPDF_VERSION}/qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+      && dpkg --install ./libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+      && dpkg --install ./qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+    && echo "Installing Ghostscript ${GS_VERSION}" \
+      && curl --fail --silent --show-error --location \
+          --output libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+          https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+      && curl --fail --silent --show-error --location \
+          --output ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+          https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+      && curl --fail --silent --show-error --location \
+          --output libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
+          https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
+        && dpkg --install ./libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
+        && dpkg --install ./libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+        && dpkg --install ./ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
    && echo "Installing jbig2enc" \
      && curl --fail --silent --show-error --location \
        --output jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
-        https://github.com/paperless-ngx/builder/releases/download/jbig2enc-trixie-v${JBIG2ENC_VERSION}/jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/jbig2enc-${JBIG2ENC_VERSION}/jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
      && dpkg --install ./jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb

 # setup docker-specific things
@@ -106,7 +127,6 @@ COPY [ \

 RUN set -eux \
  && echo "Configuring ImageMagick" \
-    && mkdir -p /etc/ImageMagick-6 \
    && mv paperless-policy.xml /etc/ImageMagick-6/policy.xml


@@ -122,7 +142,7 @@ ARG BUILD_PACKAGES="\
  pkg-config"

 # hadolint ignore=DL3042
-RUN --mount=type=cache,target=/cache/uv/,id=uv-cache \
+RUN --mount=type=cache,target=/root/.cache/uv,id=pip-cache \
  set -eux \
  && echo "Installing build system packages" \
    && apt-get update \
--- a/.editorconfig
+++ b/.editorconfig
@@ -11,10 +11,6 @@ end_of_line = lf
 charset = utf-8
 max_line_length = 79

-[*.sh]
-indent_style = tab
-indent_size = 1
-
 [{*.html,*.css,*.js}]
 max_line_length = off

--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -35,8 +35,8 @@ NOTE: PRs that do not address the following will not be merged, please do not sk

 - [ ] I have read & agree with the [contributing guidelines](https://github.com/paperless-ngx/paperless-ngx/blob/main/CONTRIBUTING.md).
 - [ ] If applicable, I have included testing coverage for new code in this PR, for [backend](https://docs.paperless-ngx.com/development/#testing) and / or [front-end](https://docs.paperless-ngx.com/development/#testing-and-code-style) changes.
- [ ] If applicable, I have tested my code for breaking changes & regressions on both mobile & desktop devices, using the latest version of major browsers.
+- [ ] If applicable, I have tested my code for new features & regressions on both mobile & desktop devices, using the latest version of major browsers.
 - [ ] If applicable, I have checked that all tests pass, see [documentation](https://docs.paperless-ngx.com/development/#back-end-development).
 - [ ] I have run all `pre-commit` hooks, see [documentation](https://docs.paperless-ngx.com/development/#code-formatting-with-pre-commit-hooks).
 - [ ] I have made corresponding changes to the documentation as needed.
- [ ] In the description of the PR above I have disclosed the use of AI tools in the coding of this PR.
+- [ ] I have checked my modifications for any breaking changes.
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -41,56 +41,30 @@ updates:
      - "backend"
      - "dependencies"
    groups:
-      # Development & CI/CD Tooling
      development:
        patterns:
          - "*pytest*"
          - "ruff"
          - "mkdocs-material"
          - "pre-commit*"
-      # Django & DRF Ecosystem
-      django-ecosystem:
+      django:
        patterns:
          - "*django*"
          - "drf-*"
-          - "djangorestframework"
-          - "whitenoise"
-          - "bleach"
-          - "jinja2"
-      # Async, Task Queuing & Caching
-      async-tasks:
-        patterns:
-          - "celery*"
-          - "channels*"
-          - "flower"
-          - "redis"
-      # Document, PDF, and OCR Processing
-      document-processing:
-        patterns:
-          - "ocrmypdf"
-          - "pdf2image"
-          - "pyzbar"
-          - "zxing-cpp"
-          - "tika-client"
-          - "gotenberg-client"
-          - "python-magic"
-          - "python-gnupg"
-      # Data, NLP, and Search
-      data-nlp-search:
-        patterns:
-          - "nltk"
-          - "scikit-learn"
-          - "langdetect"
-          - "rapidfuzz"
-          - "whoosh-reloaded"
-      # Utilities (Patch Updates)
-      utilities-patch:
+      major-versions:
        update-types:
-          - "patch"
-      # Utilities (Minor Updates)
-      utilities-minor:
+          - "major"
+      small-changes:
        update-types:
          - "minor"
+          - "patch"
+        exclude-patterns:
+          - "*django*"
+          - "drf-*"
+      pre-built:
+        patterns:
+          - psycopg*
+          - zxing-cpp
  # Enable updates for GitHub Actions
  - package-ecosystem: "github-actions"
    target-branch: "dev"
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -67,7 +67,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
      - name: Install python
        uses: actions/setup-python@v6
        with:
@@ -81,14 +81,14 @@ jobs:
      - pre-commit
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
      - name: Set up Python
        id: setup-python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@v6
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
@@ -115,7 +115,7 @@ jobs:
            --frozen \
            mkdocs gh-deploy --force --no-history
      - name: Upload artifact
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
        with:
          name: documentation
          path: site/
@@ -131,7 +131,7 @@ jobs:
      fail-fast: false
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
      - name: Start containers
        run: |
          docker compose --file ${{ github.workspace }}/docker/compose/docker-compose.ci-test.yml pull --quiet
@@ -142,7 +142,7 @@ jobs:
        with:
          python-version: "${{ matrix.python-version }}"
      - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@v6
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
@@ -202,13 +202,13 @@ jobs:
    needs:
      - pre-commit
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10
      - name: Use Node.js 20
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v5
        with:
          node-version: 20.x
          cache: 'pnpm'
@@ -235,13 +235,13 @@ jobs:
        shard-index: [1, 2, 3, 4]
        shard-count: [4]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10
      - name: Use Node.js 20
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v5
        with:
          node-version: 20.x
          cache: 'pnpm'
@@ -275,12 +275,8 @@ jobs:
  tests-frontend-e2e:
    name: "Frontend E2E Tests (Node ${{ matrix.node-version }} - ${{ matrix.shard-index }}/${{ matrix.shard-count }})"
    runs-on: ubuntu-24.04
-    container: mcr.microsoft.com/playwright:v1.57.0-noble
    needs:
      - install-frontend-dependencies
-    env:
-      PLAYWRIGHT_BROWSERS_PATH: /ms-playwright
-      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
    strategy:
      fail-fast: false
      matrix:
@@ -288,13 +284,13 @@ jobs:
        shard-index: [1, 2]
        shard-count: [2]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10
      - name: Use Node.js 20
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v5
        with:
          node-version: 20.x
          cache: 'pnpm'
@@ -309,8 +305,19 @@ jobs:
          key: ${{ runner.os }}-frontenddeps-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
      - name: Re-link Angular cli
        run: cd src-ui && pnpm link @angular/cli
+      - name: Cache Playwright browsers
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: ${{ runner.os }}-playwright-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-playwright-
+      - name: Install Playwright system dependencies
+        run: npx playwright install-deps
      - name: Install dependencies
        run: cd src-ui && pnpm install --no-frozen-lockfile
+      - name: Install Playwright
+        run: cd src-ui && pnpm exec playwright install
      - name: Run Playwright e2e tests
        run: cd src-ui && pnpm exec playwright test --shard ${{ matrix.shard-index }}/${{ matrix.shard-count }}
  frontend-bundle-analysis:
@@ -320,13 +327,13 @@ jobs:
      - tests-frontend
      - tests-frontend-e2e
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10
      - name: Use Node.js 20
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v5
        with:
          node-version: 20.x
          cache: 'pnpm'
@@ -346,9 +353,9 @@ jobs:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        run: cd src-ui && pnpm run build --configuration=production
  build-docker-image:
-    name: Build Docker image for ${{ github.event_name == 'pull_request' && github.head_ref || github.ref_name }}
+    name: Build Docker image for ${{ github.ref_name }}
    runs-on: ubuntu-24.04
-    if: (github.event_name == 'push' && (startsWith(github.ref, 'refs/heads/feature-') || startsWith(github.ref, 'refs/heads/fix-') || github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/beta' || contains(github.ref, 'beta.rc') || startsWith(github.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/heads/l10n_'))) || (github.event_name == 'pull_request' && (startsWith(github.head_ref, 'feature-') || startsWith(github.head_ref, 'fix-') || github.head_ref == 'dev' || github.head_ref == 'beta' || contains(github.head_ref, 'beta.rc') || startsWith(github.head_ref, 'l10n_')))
+    if: github.event_name == 'push' && (startsWith(github.ref, 'refs/heads/feature-') || startsWith(github.ref, 'refs/heads/fix-') || github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/beta' || contains(github.ref, 'beta.rc') || startsWith(github.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/heads/l10n_'))
    concurrency:
      group: ${{ github.workflow }}-build-docker-image-${{ github.ref_name }}
      cancel-in-progress: true
@@ -357,23 +364,6 @@ jobs:
      - tests-frontend
      - tests-frontend-e2e
    steps:
-      - name: Prepare build variables
-        id: build-vars
-        uses: actions/github-script@v8
-        with:
-          result-encoding: string
-          script: |
-            const isPR = context.eventName === 'pull_request';
-            const defaultRefName = context.ref.replace('refs/heads/', '');
-            const headRef = isPR ? context.payload.pull_request.head.ref : defaultRefName;
-            const buildRef = isPR ? `refs/heads/${headRef}` : context.ref;
-            const buildCacheKey = headRef.split('/').join('-');
-            const canPush = context.eventName === 'push' || (isPR && context.payload.pull_request.head.repo.full_name === `${context.repo.owner}/${context.repo.repo}`);
-
-            core.setOutput('build-ref', buildRef);
-            core.setOutput('build-ref-name', headRef);
-            core.setOutput('build-cache-key', buildCacheKey);
-            core.setOutput('can-push', canPush ? 'true' : 'false');
      - name: Check pushing to Docker Hub
        id: push-other-places
        # Only push to Dockerhub from the main repo AND the ref is either:
@@ -382,11 +372,8 @@ jobs:
        #  beta
        #  a tag
        # Otherwise forks would require a Docker Hub account and secrets setup
-        env:
-          BUILD_REF: ${{ steps.build-vars.outputs.build-ref }}
-          BUILD_REF_NAME: ${{ steps.build-vars.outputs.build-ref-name }}
        run: |
-          if [[ ${{ github.repository_owner }} == "paperless-ngx" && ( "$BUILD_REF_NAME" == "dev" || "$BUILD_REF_NAME" == "beta" || $BUILD_REF == refs/tags/v* || $BUILD_REF == *beta.rc* ) ]] ; then
+          if [[ ${{ github.repository_owner }} == "paperless-ngx" && ( ${{ github.ref_name }} == "dev" || ${{ github.ref_name }} == "beta" || ${{ startsWith(github.ref, 'refs/tags/v') }} == "true" ) ]] ; then
            echo "Enabling DockerHub image push"
            echo "enable=true" >> $GITHUB_OUTPUT
          else
@@ -410,14 +397,12 @@ jobs:
          tags: |
            # Tag branches with branch name
            type=ref,event=branch
-            # Pull requests need a sanitized branch tag for pushing images
-            type=raw,value=${{ steps.build-vars.outputs.build-cache-key }},enable=${{ github.event_name == 'pull_request' }}
            # Process semver tags
            # For a tag x.y.z or vX.Y.Z, output an x.y.z and x.y image tag
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
      # If https://github.com/docker/buildx/issues/1044 is resolved,
      # the append input with a native arm64 arch could be used to
      # significantly speed up building
@@ -454,7 +439,7 @@ jobs:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
-          push: ${{ steps.build-vars.outputs.can-push == 'true' }}
+          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.docker-meta.outputs.tags }}
          labels: ${{ steps.docker-meta.outputs.labels }}
          build-args: |
@@ -462,21 +447,19 @@ jobs:
          # Get cache layers from this branch, then dev
          # This allows new branches to get at least some cache benefits, generally from dev
          cache-from: |
-            type=registry,ref=ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}/builder/cache/app:${{ steps.build-vars.outputs.build-cache-key }}
+            type=registry,ref=ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}/builder/cache/app:${{ github.ref_name }}
            type=registry,ref=ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}/builder/cache/app:dev
-          cache-to: ${{ steps.build-vars.outputs.can-push == 'true' && format('type=registry,mode=max,ref=ghcr.io/{0}/builder/cache/app:{1}', steps.set-ghcr-repository.outputs.ghcr-repository, steps.build-vars.outputs.build-cache-key) || '' }}
+          cache-to: |
+            type=registry,mode=max,ref=ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}/builder/cache/app:${{ github.ref_name }}
      - name: Inspect image
-        if: steps.build-vars.outputs.can-push == 'true'
        run: |
          docker buildx imagetools inspect ${{ fromJSON(steps.docker-meta.outputs.json).tags[0] }}
      - name: Export frontend artifact from docker
-        if: steps.build-vars.outputs.can-push == 'true'
        run: |
          docker create --name frontend-extract ${{ fromJSON(steps.docker-meta.outputs.json).tags[0] }}
          docker cp frontend-extract:/usr/src/paperless/src/documents/static/frontend src/documents/static/frontend/
      - name: Upload frontend artifact
-        if: steps.build-vars.outputs.can-push == 'true'
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
        with:
          name: frontend-compiled
          path: src/documents/static/frontend/
@@ -486,18 +469,17 @@ jobs:
    needs:
      - build-docker-image
      - documentation
-    if: github.event_name == 'push'
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
      - name: Set up Python
        id: setup-python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@v6
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
@@ -510,12 +492,12 @@ jobs:
          sudo apt-get update -qq
          sudo apt-get install -qq --no-install-recommends gettext liblept5
      - name: Download frontend artifact
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v5
        with:
          name: frontend-compiled
          path: src/documents/static/frontend/
      - name: Download documentation artifact
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v5
        with:
          name: documentation
          path: docs/_build/html/
@@ -578,7 +560,7 @@ jobs:
          sudo chown -R 1000:1000 paperless-ngx/
          tar -cJf paperless-ngx.tar.xz paperless-ngx/
      - name: Upload release artifact
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
        with:
          name: release
          path: dist/paperless-ngx.tar.xz
@@ -595,7 +577,7 @@ jobs:
    if: github.ref_type == 'tag' && (startsWith(github.ref_name, 'v') || contains(github.ref_name, '-beta.rc'))
    steps:
      - name: Download release artifact
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v5
        with:
          name: release
          path: ./
@@ -636,7 +618,7 @@ jobs:
    if: needs.publish-release.outputs.prerelease == 'false'
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
        with:
          ref: main
      - name: Set up Python
@@ -645,7 +627,7 @@ jobs:
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@v6
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
--- a/.github/workflows/cleanup-tags.yml
+++ b/.github/workflows/cleanup-tags.yml
@@ -27,7 +27,7 @@ jobs:
    steps:
      - name: Clean temporary images
        if: "${{ env.TOKEN != '' }}"
-        uses: stumpylog/image-cleaner-action/ephemeral@v0.12.0
+        uses: stumpylog/image-cleaner-action/ephemeral@v0.11.0
        with:
          token: "${{ env.TOKEN }}"
          owner: "${{ github.repository_owner }}"
@@ -53,7 +53,7 @@ jobs:
    steps:
      - name: Clean untagged images
        if: "${{ env.TOKEN != '' }}"
-        uses: stumpylog/image-cleaner-action/untagged@v0.12.0
+        uses: stumpylog/image-cleaner-action/untagged@v0.11.0
        with:
          token: "${{ env.TOKEN }}"
          owner: "${{ github.repository_owner }}"
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -34,10 +34,10 @@ jobs:
        # Learn more about CodeQL language support at https://git.io/codeql-language-support
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          # If you wish to specify custom queries, you can do so here or in a config file.
@@ -45,4 +45,4 @@ jobs:
          # Prefix the list here with "+" to use these queries and those in the config file.
          # queries: ./path/to/local/query, your-org/your-repo/queries@main
      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v3
--- a/.github/workflows/crowdin.yml
+++ b/.github/workflows/crowdin.yml
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
        with:
          token: ${{ secrets.PNGX_BOT_PAT }}
      - name: crowdin action
--- a/.github/workflows/translate-strings.yml
+++ b/.github/workflows/translate-strings.yml
@@ -11,7 +11,7 @@ jobs:
      contents: write
    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
        with:
          token: ${{ secrets.PNGX_BOT_PAT }}
          ref: ${{ github.head_ref }}
@@ -23,7 +23,7 @@ jobs:
          sudo apt-get update -qq
          sudo apt-get install -qq --no-install-recommends gettext
      - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@v6
        with:
          enable-cache: true
      - name: Install backend python dependencies
@@ -38,7 +38,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 20
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v5
        with:
          node-version: 20.x
          cache: 'pnpm'
@@ -61,7 +61,7 @@ jobs:
          cd src-ui
          pnpm run ng extract-i18n
      - name: Commit changes
-        uses: stefanzweifel/git-auto-commit-action@v7
+        uses: stefanzweifel/git-auto-commit-action@v6
        with:
          file_pattern: 'src-ui/messages.xlf src/locale/en_US/LC_MESSAGES/django.po'
          commit_message: "Auto translate strings"
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -49,12 +49,12 @@ repos:
          - 'prettier-plugin-organize-imports@4.1.0'
  # Python hooks
  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.5
+    rev: v0.14.0
    hooks:
      - id: ruff-check
      - id: ruff-format
  - repo: https://github.com/tox-dev/pyproject-fmt
-    rev: "v2.11.1"
+    rev: "v2.11.0"
    hooks:
      - id: pyproject-fmt
  # Dockerfile hooks
@@ -64,11 +64,11 @@ repos:
      - id: hadolint
  # Shell script hooks
  - repo: https://github.com/lovesegfault/beautysh
-    rev: v6.4.2
+    rev: v6.2.1
    hooks:
      - id: beautysh
-        types: [file]
-        files: (\.sh$|/run$|/finish$)
+        additional_dependencies:
+          - setuptools
        args:
          - "--tab"
  - repo: https://github.com/shellcheck-py/shellcheck-py
@@ -76,7 +76,7 @@ repos:
    hooks:
      - id: shellcheck
  - repo: https://github.com/google/yamlfmt
-    rev: v0.20.0
+    rev: v0.18.0
    hooks:
      - id: yamlfmt
        exclude: "^src-ui/pnpm-lock.yaml"
--- a/25
+++ b/25
@@ -5,7 +5,7 @@
 # Purpose: Compiles the frontend
 # Notes:
 #  - Does PNPM stuff with Typescript and such
-FROM --platform=$BUILDPLATFORM docker.io/node:20-trixie-slim AS compile-frontend
+FROM --platform=$BUILDPLATFORM docker.io/node:20-bookworm-slim AS compile-frontend

 COPY ./src-ui /src/src-ui

@@ -32,7 +32,7 @@ RUN set -eux \
 # Purpose: Installs s6-overlay and rootfs
 # Comments:
 #  - Don't leave anything extra in here either
-FROM ghcr.io/astral-sh/uv:0.9.15-python3.12-trixie-slim AS s6-overlay-base
+FROM ghcr.io/astral-sh/uv:0.9.4-python3.12-bookworm-slim AS s6-overlay-base

 WORKDIR /usr/src/s6

@@ -102,6 +102,8 @@ ARG TARGETARCH

 # Can be workflow provided, defaults set for manual building
 ARG JBIG2ENC_VERSION=0.30
+ARG QPDF_VERSION=11.9.0
+ARG GS_VERSION=10.03.1

 # Set Python environment variables
 ENV PYTHONDONTWRITEBYTECODE=1 \
@@ -168,8 +170,20 @@ RUN set -eux \
    && apt-get update \
    && apt-get install --yes --quiet --no-install-recommends ${RUNTIME_PACKAGES} \
    && echo "Installing pre-built updates" \
-      && curl --fail --silent --no-progress-meter --show-error --location --remote-name-all \
-        https://github.com/paperless-ngx/builder/releases/download/jbig2enc-trixie-v${JBIG2ENC_VERSION}/jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
+      && curl --fail --silent --no-progress-meter --show-error --location --remote-name-all --parallel --parallel-max 4 \
+        https://github.com/paperless-ngx/builder/releases/download/qpdf-${QPDF_VERSION}/libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/qpdf-${QPDF_VERSION}/qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
+        https://github.com/paperless-ngx/builder/releases/download/jbig2enc-${JBIG2ENC_VERSION}/jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
+      && echo "Installing qpdf ${QPDF_VERSION}" \
+        && dpkg --install ./libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+        && dpkg --install ./qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+      && echo "Installing Ghostscript ${GS_VERSION}" \
+        && dpkg --install ./libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
+        && dpkg --install ./libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+        && dpkg --install ./ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
      && echo "Installing jbig2enc" \
        && dpkg --install ./jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
      && echo "Configuring imagemagick" \
@@ -240,8 +254,7 @@ RUN set -eux \
    && chown --from root:root --changes --recursive paperless:paperless /usr/src/paperless \
  && echo "Collecting static files" \
    && s6-setuidgid paperless python3 manage.py collectstatic --clear --no-input --link \
-    && s6-setuidgid paperless python3 manage.py compilemessages \
-    && /usr/local/bin/deduplicate.py --verbose /usr/src/paperless/static/
+    && s6-setuidgid paperless python3 manage.py compilemessages

 VOLUME ["/usr/src/paperless/data", \
        "/usr/src/paperless/media", \
--- a/docker/compose/docker-compose.ci-test.yml
+++ b/docker/compose/docker-compose.ci-test.yml
@@ -4,7 +4,7 @@
 # correct networking for the tests
 services:
  gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.25
+    image: docker.io/gotenberg/gotenberg:8.24
    hostname: gotenberg
    container_name: gotenberg
    network_mode: host
--- a/docker/compose/docker-compose.mariadb-tika.yml
+++ b/docker/compose/docker-compose.mariadb-tika.yml
@@ -72,7 +72,7 @@ services:
      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
  gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.25
+    image: docker.io/gotenberg/gotenberg:8.24
    restart: unless-stopped
    # The gotenberg chromium route is used to convert .eml files. We do not
    # want to allow external content like tracking pixels or even javascript.
--- a/docker/compose/docker-compose.postgres-tika.yml
+++ b/docker/compose/docker-compose.postgres-tika.yml
@@ -66,7 +66,7 @@ services:
      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
  gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.25
+    image: docker.io/gotenberg/gotenberg:8.24
    restart: unless-stopped
    # The gotenberg chromium route is used to convert .eml files. We do not
    # want to allow external content like tracking pixels or even javascript.
--- a/docker/compose/docker-compose.sqlite-tika.yml
+++ b/docker/compose/docker-compose.sqlite-tika.yml
@@ -55,7 +55,7 @@ services:
      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
  gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.25
+    image: docker.io/gotenberg/gotenberg:8.24
    restart: unless-stopped
    # The gotenberg chromium route is used to convert .eml files. We do not
    # want to allow external content like tracking pixels or even javascript.
--- a/docker/rootfs/etc/s6-overlay/s6-rc.d/init-env-file/run
+++ b/docker/rootfs/etc/s6-overlay/s6-rc.d/init-env-file/run
@@ -29,5 +29,5 @@ if find /run/s6/container_environment/*"_FILE" -maxdepth 1 > /dev/null 2>&1; the
 		fi
 	done
 else
-	echo "${log_prefix} No *_FILE environment found"
+		echo "${log_prefix} No *_FILE environment found"
 fi
--- a/docker/rootfs/etc/s6-overlay/s6-rc.d/init-wait-for-db/run
+++ b/docker/rootfs/etc/s6-overlay/s6-rc.d/init-wait-for-db/run
@@ -1,66 +1,70 @@
 #!/command/with-contenv /usr/bin/bash
 # shellcheck shell=bash
-# vim: set ft=bash ts=4 sw=4 sts=4 et :

-set -euo pipefail
-
-declare -r LOG_PREFIX="[init-db-wait]"
-
-declare -ri TIMEOUT=60
-declare -i ATTEMPT=0
-declare -i DELAY=0
-declare -i STARTED_AT=${EPOCHSECONDS:?EPOCHSECONDS var unset}
-
-delay_next_attempt() {
-	local -i elapsed=$(( EPOCHSECONDS - STARTED_AT ))
-	local -ri remaining=$(( TIMEOUT - elapsed ))
-
-	if (( remaining <= 0 )); then
-		echo "${LOG_PREFIX} Unable to connect after $elapsed seconds."
-		exit 1
-	fi
-
-	DELAY+=1
-
-	# clamp to remaining time
-	if (( DELAY > remaining )); then
-		DELAY=$remaining
-	fi
-
-	ATTEMPT+=1
-	echo "${LOG_PREFIX} Attempt $ATTEMPT failed! Trying again in $DELAY seconds..."
-	sleep "$DELAY"
-}
+declare -r log_prefix="[init-db-wait]"

 wait_for_postgres() {
-	echo "${LOG_PREFIX} Waiting for PostgreSQL to start..."
+	local attempt_num=1
+	local -r max_attempts=5
+
+	echo "${log_prefix} Waiting for PostgreSQL to start..."

 	local -r host="${PAPERLESS_DBHOST:-localhost}"
 	local -r port="${PAPERLESS_DBPORT:-5432}"
 	local -r user="${PAPERLESS_DBUSER:-paperless}"

-	while ! pg_isready -h "${host}" -p "${port}" --username "${user}"; do
-		delay_next_attempt
+	# Disable warning, host and port can't have spaces
+	# shellcheck disable=SC2086
+	while [ ! "$(pg_isready -h ${host} -p ${port} --username ${user})" ]; do
+
+		if [ $attempt_num -eq $max_attempts ]; then
+			echo "${log_prefix} Unable to connect to database."
+			exit 1
+		else
+			echo "${log_prefix} Attempt $attempt_num failed! Trying again in 5 seconds..."
+		fi
+
+		attempt_num=$(("$attempt_num" + 1))
+		sleep 5
 	done
-	echo "${LOG_PREFIX} Connected to PostgreSQL"
+	# Extra in case this is a first start
+	sleep 5
+	echo "Connected to PostgreSQL"
 }

 wait_for_mariadb() {
-	echo "${LOG_PREFIX} Waiting for MariaDB to start..."
+	echo "${log_prefix} Waiting for MariaDB to start..."

-	local -r host="${PAPERLESS_DBHOST:-localhost}"
-	local -r port="${PAPERLESS_DBPORT:-3306}"
+	local -r host="${PAPERLESS_DBHOST:=localhost}"
+	local -r port="${PAPERLESS_DBPORT:=3306}"

-	while ! mariadb-admin --host="${host}" --port="${port}" --skip-ssl ping --silent >/dev/null 2>&1; do
-		delay_next_attempt
+	local attempt_num=1
+	local -r max_attempts=5
+
+	# Disable warning, host and port can't have spaces
+	# shellcheck disable=SC2086
+	while ! true > /dev/tcp/$host/$port; do
+
+		if [ $attempt_num -eq $max_attempts ]; then
+			echo "${log_prefix} Unable to connect to database."
+			exit 1
+		else
+			echo "${log_prefix} Attempt $attempt_num failed! Trying again in 5 seconds..."
+
+		fi
+
+		attempt_num=$(("$attempt_num" + 1))
+		sleep 5
 	done
-	echo "${LOG_PREFIX} Connected to MariaDB"
+	echo "Connected to MariaDB"
 }

-if [[ "${PAPERLESS_DBENGINE:-}" == "mariadb" ]]; then
+if [[ "${PAPERLESS_DBENGINE}" == "mariadb" ]]; then
+	echo "${log_prefix} Waiting for MariaDB to report ready"
 	wait_for_mariadb
-elif [[ -n "${PAPERLESS_DBHOST:-}" ]]; then
+elif [[ -n "${PAPERLESS_DBHOST}" ]]; then
+	echo "${log_prefix} Waiting for postgresql to report ready"
 	wait_for_postgres
 fi

-echo "${LOG_PREFIX} Database is ready"
+	echo "${log_prefix} Database is ready"
--- a/docker/rootfs/etc/s6-overlay/s6-rc.d/svc-webserver/run
+++ b/docker/rootfs/etc/s6-overlay/s6-rc.d/svc-webserver/run
@@ -10,11 +10,11 @@ export GRANIAN_WORKERS=${GRANIAN_WORKERS:-${PAPERLESS_WEBSERVER_WORKERS:-1}}

 # Only set GRANIAN_URL_PATH_PREFIX if PAPERLESS_FORCE_SCRIPT_NAME is set
 if [[ -n "${PAPERLESS_FORCE_SCRIPT_NAME}" ]]; then
-	export GRANIAN_URL_PATH_PREFIX=${PAPERLESS_FORCE_SCRIPT_NAME}
+  export GRANIAN_URL_PATH_PREFIX=${PAPERLESS_FORCE_SCRIPT_NAME}
 fi

 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	exec granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
+  exec granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
 else
-	exec s6-setuidgid paperless granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
+  exec s6-setuidgid paperless granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
 fi
--- a/docker/rootfs/usr/local/bin/deduplicate.py
+++ b/docker/rootfs/usr/local/bin/deduplicate.py
@@ -1,167 +0,0 @@
-#!/usr/bin/env python3
-"""
-File deduplication script that replaces identical files with symlinks.
-Uses SHA256 hashing to identify duplicate files.
-"""
-
-import hashlib
-from collections import defaultdict
-from pathlib import Path
-
-import click
-import humanize
-
-
-def calculate_sha256(filepath: Path) -> str | None:
-    sha256_hash = hashlib.sha256()
-    try:
-        with filepath.open("rb") as f:
-            # Read file in chunks to handle large files efficiently
-            while chunk := f.read(65536):  # 64KB chunks
-                sha256_hash.update(chunk)
-        return sha256_hash.hexdigest()
-    except OSError as e:
-        click.echo(f"Error reading {filepath}: {e}", err=True)
-        return None
-
-
-def find_duplicate_files(directory: Path) -> dict[str, list[Path]]:
-    """
-    Recursively scan directory and group files by their SHA256 hash.
-    Returns a dictionary mapping hash -> list of file paths.
-    """
-    hash_to_files: dict[str, list[Path]] = defaultdict(list)
-
-    for filepath in directory.rglob("*"):
-        # Skip symlinks
-        if filepath.is_symlink():
-            continue
-
-        # Skip if not a regular file
-        if not filepath.is_file():
-            continue
-
-        file_hash = calculate_sha256(filepath)
-        if file_hash:
-            hash_to_files[file_hash].append(filepath)
-
-    # Filter to only return hashes with duplicates
-    return {h: files for h, files in hash_to_files.items() if len(files) > 1}
-
-
-def replace_with_symlinks(
-    duplicate_groups: dict[str, list[Path]],
-    *,
-    dry_run: bool = False,
-) -> tuple[int, int]:
-    """
-    Replace duplicate files with symlinks to the first occurrence.
-    Returns (number_of_files_replaced, space_saved_in_bytes).
-    """
-    total_duplicates = 0
-    space_saved = 0
-
-    for file_hash, file_list in duplicate_groups.items():
-        # Keep the first file as the original, replace others with symlinks
-        original_file = file_list[0]
-        duplicates = file_list[1:]
-
-        click.echo(f"Found {len(duplicates)} duplicate(s) of: {original_file}")
-
-        for duplicate in duplicates:
-            try:
-                # Get file size before deletion
-                file_size = duplicate.stat().st_size
-
-                if dry_run:
-                    click.echo(f"  [DRY RUN] Would replace: {duplicate}")
-                else:
-                    # Remove the duplicate file
-                    duplicate.unlink()
-
-                    # Create relative symlink if possible, otherwise absolute
-                    try:
-                        # Try to create a relative symlink
-                        rel_path = original_file.relative_to(duplicate.parent)
-                        duplicate.symlink_to(rel_path)
-                        click.echo(f"  Replaced: {duplicate} -> {rel_path}")
-                    except ValueError:
-                        # Fall back to absolute path
-                        duplicate.symlink_to(original_file.resolve())
-                        click.echo(f"  Replaced: {duplicate} -> {original_file}")
-
-                    space_saved += file_size
-
-                total_duplicates += 1
-
-            except OSError as e:
-                click.echo(f"  Error replacing {duplicate}: {e}", err=True)
-
-    return total_duplicates, space_saved
-
-
-@click.command()
-@click.argument(
-    "directory",
-    type=click.Path(
-        exists=True,
-        file_okay=False,
-        dir_okay=True,
-        readable=True,
-        path_type=Path,
-    ),
-)
-@click.option(
-    "--dry-run",
-    is_flag=True,
-    help="Show what would be done without making changes",
-)
-@click.option("--verbose", "-v", is_flag=True, help="Show verbose output")
-def deduplicate(directory: Path, *, dry_run: bool, verbose: bool) -> None:
-    """
-    Recursively search DIRECTORY for identical files and replace them with symlinks.
-
-    Uses SHA256 hashing to identify duplicate files. The first occurrence of each
-    unique file is kept, and all duplicates are replaced with symlinks pointing to it.
-    """
-    directory = directory.resolve()
-
-    click.echo(f"Scanning directory: {directory}")
-    if dry_run:
-        click.echo("Running in DRY RUN mode - no changes will be made")
-
-    # Find all duplicate files
-    click.echo("Calculating file hashes...")
-    duplicate_groups = find_duplicate_files(directory)
-
-    if not duplicate_groups:
-        click.echo("No duplicate files found!")
-        return
-
-    total_files = sum(len(files) - 1 for files in duplicate_groups.values())
-    click.echo(
-        f"Found {len(duplicate_groups)} group(s) of duplicates "
-        f"({total_files} files to deduplicate)",
-    )
-
-    if verbose:
-        for file_hash, files in duplicate_groups.items():
-            click.echo(f"Hash: {file_hash}")
-            for f in files:
-                click.echo(f"  - {f}")
-
-    # Replace duplicates with symlinks
-    click.echo("Processing duplicates...")
-    num_replaced, space_saved = replace_with_symlinks(duplicate_groups, dry_run=dry_run)
-
-    # Summary
-    click.echo(
-        f"{'Would replace' if dry_run else 'Replaced'} "
-        f"{num_replaced} duplicate file(s)",
-    )
-    if not dry_run:
-        click.echo(f"Space saved: {humanize.naturalsize(space_saved, binary=True)}")
-
-
-if __name__ == "__main__":
-    deduplicate()
--- a/docs/api.md
+++ b/docs/api.md
@@ -294,13 +294,6 @@ The following methods are supported:
        -   `"delete_original": true` to delete the original documents after editing.
        -   `"update_document": true` to update the existing document with the edited PDF.
        -   `"include_metadata": true` to copy metadata from the original document to the edited document.
-   `remove_password`
-    -   Requires `parameters`:
-        -   `"password": "PASSWORD_STRING"` The password to remove from the PDF documents.
-    -   Optional `parameters`:
-        -   `"update_document": true` to replace the existing document with the password-less PDF.
-        -   `"delete_original": true` to delete the original document after editing.
-        -   `"include_metadata": true` to copy metadata from the original document to the new password-less document.
 -   `merge`
    -   No additional `parameters` required.
    -   The ordering of the merged document is determined by the list of IDs.
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -1,235 +1,5 @@
 # Changelog

-## paperless-ngx 2.20.3
-
-## paperless-ngx 2.20.2
-
-### Features / Enhancements
-
-   Tweakhancement: dim inactive users in users-groups list [@shamoon](https://github.com/shamoon) ([#11537](https://github.com/paperless-ngx/paperless-ngx/pull/11537))
-
-### Bug Fixes
-
-   Fix: Expanded SVG validation whitelist and additional checks [@stumpylog](https://github.com/stumpylog) ([#11590](https://github.com/paperless-ngx/paperless-ngx/pull/11590))
-   Fix: normalize allowed SVG tag and attribute names, add version [@shamoon](https://github.com/shamoon) ([#11586](https://github.com/paperless-ngx/paperless-ngx/pull/11586))
-   Fix: pass additional arguments to TagSerializer for permissions [@shamoon](https://github.com/shamoon) ([#11576](https://github.com/paperless-ngx/paperless-ngx/pull/11576))
-
-### Maintenance
-
-   Chore(deps): Bump actions/checkout from 5 to 6 in the actions group @[dependabot[bot]](https://github.com/apps/dependabot) ([#11515](https://github.com/paperless-ngx/paperless-ngx/pull/11515))
-
-### Dependencies
-
-<details>
-<summary>6 changes</summary>
-
-   Chore: update Angular dependencies to 20.3.15 [@shamoon](https://github.com/shamoon) ([#11568](https://github.com/paperless-ngx/paperless-ngx/pull/11568))
-   Chore(deps): Bump actions/checkout from 5 to 6 in the actions group @[dependabot[bot]](https://github.com/apps/dependabot) ([#11515](https://github.com/paperless-ngx/paperless-ngx/pull/11515))
-   Chore(deps-dev): Bump webpack from 5.102.1 to 5.103.0 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11513](https://github.com/paperless-ngx/paperless-ngx/pull/11513))
-   Chore(deps-dev): Bump @playwright/test from 1.56.1 to 1.57.0 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11514](https://github.com/paperless-ngx/paperless-ngx/pull/11514))
-   Chore(deps-dev): Bump the frontend-eslint-dependencies group in /src-ui with 3 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11512](https://github.com/paperless-ngx/paperless-ngx/pull/11512))
-   docker(deps): bump astral-sh/uv from 0.9.14-python3.12-trixie-slim to 0.9.15-python3.12-trixie-slim @[dependabot[bot]](https://github.com/apps/dependabot) ([#11533](https://github.com/paperless-ngx/paperless-ngx/pull/11533))
-</details>
-
-### All App Changes
-
-<details>
-<summary>12 changes</summary>
-
-   Fix: Expanded SVG validation whitelist and additional checks [@stumpylog](https://github.com/stumpylog) ([#11590](https://github.com/paperless-ngx/paperless-ngx/pull/11590))
-   Fixhancement: pass ordering to tag children [@shamoon](https://github.com/shamoon) ([#11556](https://github.com/paperless-ngx/paperless-ngx/pull/11556))
-   Performance: avoid unnecessary filename operations on bulk custom field updates [@shamoon](https://github.com/shamoon) ([#11558](https://github.com/paperless-ngx/paperless-ngx/pull/11558))
-   Fix: normalize allowed SVG tag and attribute names, add version [@shamoon](https://github.com/shamoon) ([#11586](https://github.com/paperless-ngx/paperless-ngx/pull/11586))
-   Chore: refactor workflows code [@shamoon](https://github.com/shamoon) ([#11563](https://github.com/paperless-ngx/paperless-ngx/pull/11563))
-   Fix: pass additional arguments to TagSerializer for permissions [@shamoon](https://github.com/shamoon) ([#11576](https://github.com/paperless-ngx/paperless-ngx/pull/11576))
-   Chore: update Angular dependencies to 20.3.15 [@shamoon](https://github.com/shamoon) ([#11568](https://github.com/paperless-ngx/paperless-ngx/pull/11568))
-   Chore(deps-dev): Bump webpack from 5.102.1 to 5.103.0 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11513](https://github.com/paperless-ngx/paperless-ngx/pull/11513))
-   Chore(deps-dev): Bump @playwright/test from 1.56.1 to 1.57.0 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11514](https://github.com/paperless-ngx/paperless-ngx/pull/11514))
-   Chore(deps-dev): Bump the frontend-eslint-dependencies group in /src-ui with 3 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11512](https://github.com/paperless-ngx/paperless-ngx/pull/11512))
-   Tweakhancement: dim inactive users in users-groups list [@shamoon](https://github.com/shamoon) ([#11537](https://github.com/paperless-ngx/paperless-ngx/pull/11537))
-   Chore: add some output of social login errors [@shamoon](https://github.com/shamoon) ([#11527](https://github.com/paperless-ngx/paperless-ngx/pull/11527))
-</details>
-
-## paperless-ngx 2.20.1
-
-### Bug Fixes
-
-   Fix: set search term when using advanced search from global search [@shamoon](https://github.com/shamoon) ([#11503](https://github.com/paperless-ngx/paperless-ngx/pull/11503))
-   Fix: change async handling of select custom field updates [@shamoon](https://github.com/shamoon) ([#11490](https://github.com/paperless-ngx/paperless-ngx/pull/11490))
-   Fix: skip SSL for MariaDB ping in init script [@danielrheinbay](https://github.com/danielrheinbay) ([#11491](https://github.com/paperless-ngx/paperless-ngx/pull/11491))
-   Fix: handle allauth groups location breaking change [@shamoon](https://github.com/shamoon) ([#11471](https://github.com/paperless-ngx/paperless-ngx/pull/11471))
-
-### Dependencies
-
-   docker(deps): Bump astral-sh/uv from 0.9.10-python3.12-trixie-slim to 0.9.11-python3.12-trixie-slim @[dependabot[bot]](https://github.com/apps/dependabot) ([#11450](https://github.com/paperless-ngx/paperless-ngx/pull/11450))
-   Chore(deps): Bump @angular/common from 20.3.12 to 20.3.14 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11481](https://github.com/paperless-ngx/paperless-ngx/pull/11481))
-
-### All App Changes
-
-<details>
-<summary>4 changes</summary>
-
-   Fix: set search term when using advanced search from global search [@shamoon](https://github.com/shamoon) ([#11503](https://github.com/paperless-ngx/paperless-ngx/pull/11503))
-   Fix: change async handling of select custom field updates [@shamoon](https://github.com/shamoon) ([#11490](https://github.com/paperless-ngx/paperless-ngx/pull/11490))
-   Chore(deps): Bump @angular/common from 20.3.12 to 20.3.14 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11481](https://github.com/paperless-ngx/paperless-ngx/pull/11481))
-   Fix: handle allauth groups location breaking change [@shamoon](https://github.com/shamoon) ([#11471](https://github.com/paperless-ngx/paperless-ngx/pull/11471))
-</details>
-
-## paperless-ngx 2.20.0
-
-### Notable Changes
-
-   Feature: Upgrade underlying Docker image to Trixie [@stumpylog](https://github.com/stumpylog) ([#10562](https://github.com/paperless-ngx/paperless-ngx/pull/10562))
-
-### Features / Enhancements
-
-   Feature: Upgrade underlying Docker image to Trixie [@stumpylog](https://github.com/stumpylog) ([#10562](https://github.com/paperless-ngx/paperless-ngx/pull/10562))
-   Fixhancement: more log viewer improvements [@shamoon](https://github.com/shamoon) ([#11426](https://github.com/paperless-ngx/paperless-ngx/pull/11426))
-   Performance: Replace duplicated static files with symlinks [@stumpylog](https://github.com/stumpylog) ([#11418](https://github.com/paperless-ngx/paperless-ngx/pull/11418))
-   Enhancement: add more relative dates, support modified [@shamoon](https://github.com/shamoon) ([#11411](https://github.com/paperless-ngx/paperless-ngx/pull/11411))
-   Performance: make move files after select custom field change async [@shamoon](https://github.com/shamoon) ([#11391](https://github.com/paperless-ngx/paperless-ngx/pull/11391))
-   Enhancement: Use a better check for the MariaDB server to be ready [@stumpylog](https://github.com/stumpylog) ([#11396](https://github.com/paperless-ngx/paperless-ngx/pull/11396))
-   Enhancement: speed-up docker container startup [@flrgh](https://github.com/flrgh) ([#11134](https://github.com/paperless-ngx/paperless-ngx/pull/11134))
-
-### Bug Fixes
-
-   Fix: prevent focus loss from change detection in cf query dropdown [@shamoon](https://github.com/shamoon) ([#11409](https://github.com/paperless-ngx/paperless-ngx/pull/11409))
-   Fix: sort editing filterable dropdowns sooner [@shamoon](https://github.com/shamoon) ([#11404](https://github.com/paperless-ngx/paperless-ngx/pull/11404))
-   Fix: support for custom field ordering w advanced search [@shamoon](https://github.com/shamoon) ([#11383](https://github.com/paperless-ngx/paperless-ngx/pull/11383))
-
-### Maintenance
-
-   Chore(deps): Bump the actions group with 7 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11259](https://github.com/paperless-ngx/paperless-ngx/pull/11259))
-
-### Dependencies
-
-<details>
-<summary>16 changes</summary>
-
-   Chore: Upgrades psycopg to 3.2.12 [@stumpylog](https://github.com/stumpylog) ([#11420](https://github.com/paperless-ngx/paperless-ngx/pull/11420))
-   Chore(deps-dev): Bump glob from 10.4.1 to 10.5.0 in /src/paperless_mail/templates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11413](https://github.com/paperless-ngx/paperless-ngx/pull/11413))
-   docker-compose(deps): bump gotenberg/gotenberg from 8.24 to 8.25 in /docker/compose @[dependabot[bot]](https://github.com/apps/dependabot) ([#11393](https://github.com/paperless-ngx/paperless-ngx/pull/11393))
-   Chore(deps): Bump the frontend-angular-dependencies group in /src-ui with 21 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11260](https://github.com/paperless-ngx/paperless-ngx/pull/11260))
-   Chore(deps-dev): Bump @playwright/test from 1.55.1 to 1.56.1 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11263](https://github.com/paperless-ngx/paperless-ngx/pull/11263))
-   Chore(deps-dev): Bump webpack from 5.102.0 to 5.102.1 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11264](https://github.com/paperless-ngx/paperless-ngx/pull/11264))
-   Chore(deps-dev): Bump the frontend-eslint-dependencies group in /src-ui with 4 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11262](https://github.com/paperless-ngx/paperless-ngx/pull/11262))
-   Chore(deps-dev): Bump jest-preset-angular from 15.0.2 to 15.0.3 in /src-ui in the frontend-jest-dependencies group @[dependabot[bot]](https://github.com/apps/dependabot) ([#11261](https://github.com/paperless-ngx/paperless-ngx/pull/11261))
-   Chore(deps-dev): Bump @types/node from 24.6.1 to 24.9.2 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11265](https://github.com/paperless-ngx/paperless-ngx/pull/11265))
-   Chore(deps): Bump the small-changes group across 1 directory with 11 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11337](https://github.com/paperless-ngx/paperless-ngx/pull/11337))
-   Chore(deps): Bump django-auditlog from 3.2.1 to 3.3.0 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11021](https://github.com/paperless-ngx/paperless-ngx/pull/11021))
-   Chore(deps): Bump the actions group with 7 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11259](https://github.com/paperless-ngx/paperless-ngx/pull/11259))
-   Chore(deps): Bump drf-spectacular-sidecar from 2025.9.1 to 2025.10.1 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11019](https://github.com/paperless-ngx/paperless-ngx/pull/11019))
-   Chore(deps): Bump django-filter from 25.1 to 25.2 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11020](https://github.com/paperless-ngx/paperless-ngx/pull/11020))
-   Chore(deps): Update django-allauth[mfa,socialaccount] requirement from ~=65.4.0 to ~=65.12.1 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11198](https://github.com/paperless-ngx/paperless-ngx/pull/11198))
-   docker(deps): bump astral-sh/uv from 0.9.9-python3.12-bookworm-slim to 0.9.10-python3.12-bookworm-slim @[dependabot[bot]](https://github.com/apps/dependabot) ([#11394](https://github.com/paperless-ngx/paperless-ngx/pull/11394))
-</details>
-
-### All App Changes
-
-<details>
-<summary>19 changes</summary>
-
-   Fixhancement: more log viewer improvements [@shamoon](https://github.com/shamoon) ([#11426](https://github.com/paperless-ngx/paperless-ngx/pull/11426))
-   Chore: Upgrades psycopg to 3.2.12 [@stumpylog](https://github.com/stumpylog) ([#11420](https://github.com/paperless-ngx/paperless-ngx/pull/11420))
-   Enhancement: add more relative dates, support modified [@shamoon](https://github.com/shamoon) ([#11411](https://github.com/paperless-ngx/paperless-ngx/pull/11411))
-   Chore(deps-dev): Bump glob from 10.4.1 to 10.5.0 in /src/paperless_mail/templates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11413](https://github.com/paperless-ngx/paperless-ngx/pull/11413))
-   Performance: make move files after select custom field change async [@shamoon](https://github.com/shamoon) ([#11391](https://github.com/paperless-ngx/paperless-ngx/pull/11391))
-   Fix: prevent focus loss from change detection in cf query dropdown [@shamoon](https://github.com/shamoon) ([#11409](https://github.com/paperless-ngx/paperless-ngx/pull/11409))
-   Fix: sort editing filterable dropdowns sooner [@shamoon](https://github.com/shamoon) ([#11404](https://github.com/paperless-ngx/paperless-ngx/pull/11404))
-   Chore(deps): Bump the frontend-angular-dependencies group in /src-ui with 21 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11260](https://github.com/paperless-ngx/paperless-ngx/pull/11260))
-   Chore(deps-dev): Bump @playwright/test from 1.55.1 to 1.56.1 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11263](https://github.com/paperless-ngx/paperless-ngx/pull/11263))
-   Chore(deps-dev): Bump webpack from 5.102.0 to 5.102.1 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11264](https://github.com/paperless-ngx/paperless-ngx/pull/11264))
-   Chore(deps-dev): Bump the frontend-eslint-dependencies group in /src-ui with 4 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11262](https://github.com/paperless-ngx/paperless-ngx/pull/11262))
-   Chore(deps-dev): Bump jest-preset-angular from 15.0.2 to 15.0.3 in /src-ui in the frontend-jest-dependencies group @[dependabot[bot]](https://github.com/apps/dependabot) ([#11261](https://github.com/paperless-ngx/paperless-ngx/pull/11261))
-   Chore(deps-dev): Bump @types/node from 24.6.1 to 24.9.2 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11265](https://github.com/paperless-ngx/paperless-ngx/pull/11265))
-   Chore(deps): Bump the small-changes group across 1 directory with 11 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11337](https://github.com/paperless-ngx/paperless-ngx/pull/11337))
-   Chore(deps): Bump django-auditlog from 3.2.1 to 3.3.0 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11021](https://github.com/paperless-ngx/paperless-ngx/pull/11021))
-   Chore(deps): Bump drf-spectacular-sidecar from 2025.9.1 to 2025.10.1 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11019](https://github.com/paperless-ngx/paperless-ngx/pull/11019))
-   Chore(deps): Bump django-filter from 25.1 to 25.2 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11020](https://github.com/paperless-ngx/paperless-ngx/pull/11020))
-   Chore(deps): Update django-allauth[mfa,socialaccount] requirement from ~=65.4.0 to ~=65.12.1 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11198](https://github.com/paperless-ngx/paperless-ngx/pull/11198))
-   Fix: support for custom field ordering w advanced search [@shamoon](https://github.com/shamoon) ([#11383](https://github.com/paperless-ngx/paperless-ngx/pull/11383))
-</details>
-
-## paperless-ngx 2.19.6
-
-### Bug Fixes
-
-   Chore: include password validation on user edit [@shamoon](https://github.com/shamoon) ([#11308](https://github.com/paperless-ngx/paperless-ngx/pull/11308))
-   Fix: include BASE_URL when constructing for workflows [@ebardsley](https://github.com/ebardsley) ([#11360](https://github.com/paperless-ngx/paperless-ngx/pull/11360))
-   Fixhancement: refactor email attachment logic [@shamoon](https://github.com/shamoon) ([#11336](https://github.com/paperless-ngx/paperless-ngx/pull/11336))
-   Fixhancement: trim whitespace for some text searches [@shamoon](https://github.com/shamoon) ([#11357](https://github.com/paperless-ngx/paperless-ngx/pull/11357))
-   Fix: update Outlook refresh token when refreshed [@shamoon](https://github.com/shamoon) ([#11341](https://github.com/paperless-ngx/paperless-ngx/pull/11341))
-   Fix: only cache remote version data for version checking [@shamoon](https://github.com/shamoon) ([#11320](https://github.com/paperless-ngx/paperless-ngx/pull/11320))
-   Fix: include replace none logic in storage path preview, improve jinja conditionals for empty metadata [@shamoon](https://github.com/shamoon) ([#11315](https://github.com/paperless-ngx/paperless-ngx/pull/11315))
-
-### Dependencies
-
-   docker(deps): bump astral-sh/uv from 0.9.7-python3.12-bookworm-slim to 0.9.9-python3.12-bookworm-slim @[dependabot[bot]](https://github.com/apps/dependabot) ([#11338](https://github.com/paperless-ngx/paperless-ngx/pull/11338))
-
-### All App Changes
-
-<details>
-<summary>7 changes</summary>
-
-   Fix: include BASE_URL when constructing for workflows [@ebardsley](https://github.com/ebardsley) ([#11360](https://github.com/paperless-ngx/paperless-ngx/pull/11360))
-   Fixhancement: refactor email attachment logic [@shamoon](https://github.com/shamoon) ([#11336](https://github.com/paperless-ngx/paperless-ngx/pull/11336))
-   Fixhancement: trim whitespace for some text searches [@shamoon](https://github.com/shamoon) ([#11357](https://github.com/paperless-ngx/paperless-ngx/pull/11357))
-   Fix: update Outlook refresh token when refreshed [@shamoon](https://github.com/shamoon) ([#11341](https://github.com/paperless-ngx/paperless-ngx/pull/11341))
-   Fix: only cache remote version data for version checking [@shamoon](https://github.com/shamoon) ([#11320](https://github.com/paperless-ngx/paperless-ngx/pull/11320))
-   Fix: include replace none logic in storage path preview, improve jinja conditionals for empty metadata [@shamoon](https://github.com/shamoon) ([#11315](https://github.com/paperless-ngx/paperless-ngx/pull/11315))
-   Chore: include password validation on user edit [@shamoon](https://github.com/shamoon) ([#11308](https://github.com/paperless-ngx/paperless-ngx/pull/11308))
-</details>
-
-## paperless-ngx 2.19.5
-
-### Bug Fixes
-
-   Fix: ensure custom field query propagation, change detection [@shamoon](https://github.com/shamoon) ([#11291](https://github.com/paperless-ngx/paperless-ngx/pull/11291))
-
-### Dependencies
-
-   docker(deps): Bump astral-sh/uv from 0.9.4-python3.12-bookworm-slim to 0.9.7-python3.12-bookworm-slim @[dependabot[bot]](https://github.com/apps/dependabot) ([#11283](https://github.com/paperless-ngx/paperless-ngx/pull/11283))
-
-### All App Changes
-
-   Fix: ensure custom field query propagation, change detection [@shamoon](https://github.com/shamoon) ([#11291](https://github.com/paperless-ngx/paperless-ngx/pull/11291))
-
-## paperless-ngx 2.19.4
-
-### Bug Fixes
-
-   Fix: use original_file when attaching docs to workflow emails with added trigger [@shamoon](https://github.com/shamoon) ([#11266](https://github.com/paperless-ngx/paperless-ngx/pull/11266))
-   Fix: mark 'Select' button in doc list for translation [@shamoon](https://github.com/shamoon) ([#11278](https://github.com/paperless-ngx/paperless-ngx/pull/11278))
-   Fix: respect fields parameter for created field [@shamoon](https://github.com/shamoon) ([#11251](https://github.com/paperless-ngx/paperless-ngx/pull/11251))
-   Fix: improve legibility of processed mail error popover in light mode [@shamoon](https://github.com/shamoon) ([#11258](https://github.com/paperless-ngx/paperless-ngx/pull/11258))
-   Fixhancement: truncate large logs, improve auto-scroll [@shamoon](https://github.com/shamoon) ([#11239](https://github.com/paperless-ngx/paperless-ngx/pull/11239))
-   Chore: add max-height and overflow to processedmail error popover [@shamoon](https://github.com/shamoon) ([#11252](https://github.com/paperless-ngx/paperless-ngx/pull/11252))
-   Fix: delay iframe DOM removal, handle onafterprint error for print in FF [@shamoon](https://github.com/shamoon) ([#11237](https://github.com/paperless-ngx/paperless-ngx/pull/11237))
-   Fix: de-deduplicate children in tag list when filtering [@shamoon](https://github.com/shamoon) ([#11229](https://github.com/paperless-ngx/paperless-ngx/pull/11229))
-
-### Performance
-
-   Performance: re-enable virtual scroll, bump ng-select [@shamoon](https://github.com/shamoon) ([#11279](https://github.com/paperless-ngx/paperless-ngx/pull/11279))
-   Performance: use virtual scroll container and log level parsing for logs view [@MickLesk](https://github.com/MickLesk) ([#11233](https://github.com/paperless-ngx/paperless-ngx/pull/11233))
-
-### All App Changes
-
-<details>
-<summary>11 changes</summary>
-
-   Performance: re-enable virtual scroll, bump ng-select [@shamoon](https://github.com/shamoon) ([#11279](https://github.com/paperless-ngx/paperless-ngx/pull/11279))
-   Fix: use original_file when attaching docs to workflow emails with added trigger [@shamoon](https://github.com/shamoon) ([#11266](https://github.com/paperless-ngx/paperless-ngx/pull/11266))
-   Fix: mark 'Select' button in doc list for translation [@shamoon](https://github.com/shamoon) ([#11278](https://github.com/paperless-ngx/paperless-ngx/pull/11278))
-   Fix: respect fields parameter for created field [@shamoon](https://github.com/shamoon) ([#11251](https://github.com/paperless-ngx/paperless-ngx/pull/11251))
-   Fix: improve legibility of processed mail error popover in light mode [@shamoon](https://github.com/shamoon) ([#11258](https://github.com/paperless-ngx/paperless-ngx/pull/11258))
-   Fixhancement: truncate large logs, improve auto-scroll [@shamoon](https://github.com/shamoon) ([#11239](https://github.com/paperless-ngx/paperless-ngx/pull/11239))
-   Chore: add max-height and overflow to processedmail error popover [@shamoon](https://github.com/shamoon) ([#11252](https://github.com/paperless-ngx/paperless-ngx/pull/11252))
-   Fix: delay iframe DOM removal, handle onafterprint error for print in FF [@shamoon](https://github.com/shamoon) ([#11237](https://github.com/paperless-ngx/paperless-ngx/pull/11237))
-   Performance: use virtual scroll container and log level parsing for logs view [@MickLesk](https://github.com/MickLesk) ([#11233](https://github.com/paperless-ngx/paperless-ngx/pull/11233))
-   Chore: cache Github version check for 15 minutes [@shamoon](https://github.com/shamoon) ([#11235](https://github.com/paperless-ngx/paperless-ngx/pull/11235))
-   Fix: de-deduplicate children in tag list when filtering [@shamoon](https://github.com/shamoon) ([#11229](https://github.com/paperless-ngx/paperless-ngx/pull/11229))
-</details>
-
 ## paperless-ngx 2.19.3

 ### Bug Fixes
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -1007,7 +1007,7 @@ still perform some basic text pre-processing before matching.

 : See also `PAPERLESS_NLTK_DIR`.

-    Defaults to true, enabling the feature.
+    Defaults to 1.

 #### [`PAPERLESS_DATE_PARSER_LANGUAGES=<lang>`](#PAPERLESS_DATE_PARSER_LANGUAGES) {#PAPERLESS_DATE_PARSER_LANGUAGES}

@@ -1054,27 +1054,17 @@ should be a valid crontab(5) expression describing when to run.

 #### [`PAPERLESS_SANITY_TASK_CRON=<cron expression>`](#PAPERLESS_SANITY_TASK_CRON) {#PAPERLESS_SANITY_TASK_CRON}

-: Configures the scheduled sanity checker frequency. The value should be a
-valid crontab(5) expression describing when to run.
+: Configures the scheduled sanity checker frequency.

 : If set to the string "disable", the sanity checker will not run automatically.

    Defaults to `30 0 * * sun` or Sunday at 30 minutes past midnight.

-#### [`PAPERLESS_WORKFLOW_SCHEDULED_TASK_CRON=<cron expression>`](#PAPERLESS_WORKFLOW_SCHEDULED_TASK_CRON) {#PAPERLESS_WORKFLOW_SCHEDULED_TASK_CRON}
-
-: Configures the scheduled workflow check frequency. The value should be a
-valid crontab(5) expression describing when to run.
-
-: If set to the string "disable", scheduled workflows will not run.
-
-    Defaults to `5 */1 * * *` or every hour at 5 minutes past the hour.
-
 #### [`PAPERLESS_ENABLE_COMPRESSION=<bool>`](#PAPERLESS_ENABLE_COMPRESSION) {#PAPERLESS_ENABLE_COMPRESSION}

 : Enables compression of the responses from the webserver.

-: Defaults to true, enabling compression.
+: Defaults to 1, enabling compression.

    !!! note

@@ -1281,6 +1271,30 @@ within your documents.

    Defaults to false.

+## Workflow webhooks
+
+#### [`PAPERLESS_WEBHOOKS_ALLOWED_SCHEMES=<str>`](#PAPERLESS_WEBHOOKS_ALLOWED_SCHEMES) {#PAPERLESS_WEBHOOKS_ALLOWED_SCHEMES}
+
+: A comma-separated list of allowed schemes for webhooks. This setting
+controls which URL schemes are permitted for webhook URLs.
+
+    Defaults to `http,https`.
+
+#### [`PAPERLESS_WEBHOOKS_ALLOWED_PORTS=<str>`](#PAPERLESS_WEBHOOKS_ALLOWED_PORTS) {#PAPERLESS_WEBHOOKS_ALLOWED_PORTS}
+
+: A comma-separated list of allowed ports for webhooks. This setting
+controls which ports are permitted for webhook URLs. For example, if you
+set this to `80,443`, webhooks will only be sent to URLs that use these
+ports.
+
+    Defaults to empty list, which allows all ports.
+
+#### [`PAPERLESS_WEBHOOKS_ALLOW_INTERNAL_REQUESTS=<bool>`](#PAPERLESS_WEBHOOKS_ALLOW_INTERNAL_REQUESTS) {#PAPERLESS_WEBHOOKS_ALLOW_INTERNAL_REQUESTS}
+
+: If set to false, webhooks cannot be sent to internal URLs (e.g., localhost).
+
+    Defaults to true, which allows internal requests.
+
 ### Polling {#polling}

 #### [`PAPERLESS_CONSUMER_POLLING=<num>`](#PAPERLESS_CONSUMER_POLLING) {#PAPERLESS_CONSUMER_POLLING}
@@ -1324,30 +1338,6 @@ consumers working on the same file. Configure this to prevent that.

    Defaults to 0.5 seconds.

-## Workflow webhooks
-
-#### [`PAPERLESS_WEBHOOKS_ALLOWED_SCHEMES=<str>`](#PAPERLESS_WEBHOOKS_ALLOWED_SCHEMES) {#PAPERLESS_WEBHOOKS_ALLOWED_SCHEMES}
-
-: A comma-separated list of allowed schemes for webhooks. This setting
-controls which URL schemes are permitted for webhook URLs.
-
-    Defaults to `http,https`.
-
-#### [`PAPERLESS_WEBHOOKS_ALLOWED_PORTS=<str>`](#PAPERLESS_WEBHOOKS_ALLOWED_PORTS) {#PAPERLESS_WEBHOOKS_ALLOWED_PORTS}
-
-: A comma-separated list of allowed ports for webhooks. This setting
-controls which ports are permitted for webhook URLs. For example, if you
-set this to `80,443`, webhooks will only be sent to URLs that use these
-ports.
-
-    Defaults to empty list, which allows all ports.
-
-#### [`PAPERLESS_WEBHOOKS_ALLOW_INTERNAL_REQUESTS=<bool>`](#PAPERLESS_WEBHOOKS_ALLOW_INTERNAL_REQUESTS) {#PAPERLESS_WEBHOOKS_ALLOW_INTERNAL_REQUESTS}
-
-: If set to false, webhooks cannot be sent to internal URLs (e.g., localhost).
-
-    Defaults to true, which allows internal requests.
-
 ## Incoming Mail {#incoming_mail}

 ### Email OAuth {#email_oauth}
@@ -1804,3 +1794,23 @@ password. All of these options come from their similarly-named [Django settings]
 #### [`PAPERLESS_EMAIL_USE_SSL=<bool>`](#PAPERLESS_EMAIL_USE_SSL) {#PAPERLESS_EMAIL_USE_SSL}

 : Defaults to false.
+
+## Remote OCR
+
+#### [`PAPERLESS_REMOTE_OCR_ENGINE=<str>`](#PAPERLESS_REMOTE_OCR_ENGINE) {#PAPERLESS_REMOTE_OCR_ENGINE}
+
+: The remote OCR engine to use. Currently only Azure AI is supported as "azureai".
+
+    Defaults to None, which disables remote OCR.
+
+#### [`PAPERLESS_REMOTE_OCR_API_KEY=<str>`](#PAPERLESS_REMOTE_OCR_API_KEY) {#PAPERLESS_REMOTE_OCR_API_KEY}
+
+: The API key to use for the remote OCR engine.
+
+    Defaults to None.
+
+#### [`PAPERLESS_REMOTE_OCR_ENDPOINT=<str>`](#PAPERLESS_REMOTE_OCR_ENDPOINT) {#PAPERLESS_REMOTE_OCR_ENDPOINT}
+
+: The endpoint to use for the remote OCR engine. This is required for Azure AI.
+
+    Defaults to None.
--- a/docs/index.md
+++ b/docs/index.md
@@ -25,9 +25,10 @@ physical documents into a searchable online archive so you can keep, well, _less
 ## Features

 -   **Organize and index** your scanned documents with tags, correspondents, types, and more.
-   _Your_ data is stored locally on _your_ server and is never transmitted or shared in any way.
+-   _Your_ data is stored locally on _your_ server and is never transmitted or shared in any way, unless you explicitly choose to do so.
 -   Performs **OCR** on your documents, adding searchable and selectable text, even to documents scanned with only images.
-   Utilizes the open-source Tesseract engine to recognize more than 100 languages.
+    -   Utilizes the open-source Tesseract engine to recognize more than 100 languages.
+    -   _New!_ Supports remote OCR with Azure AI (opt-in).
 -   Documents are saved as PDF/A format which is designed for long term storage, alongside the unaltered originals.
 -   Uses machine-learning to automatically add tags, correspondents and document types to your documents.
 -   Supports PDF documents, images, plain text files, Office documents (Word, Excel, PowerPoint, and LibreOffice equivalents)[^1] and more.
--- a/docs/setup.md
+++ b/docs/setup.md
@@ -326,7 +326,7 @@ are released, dependency support is confirmed, etc.

    !!! warning

-        Ensure your Redis instance [is secured](https://redis.io/docs/latest/operate/oss_and_stack/management/security/).
+        Ensure your Redis instance [is secured](https://redis.io/docs/getting-started/#securing-redis).

 7.  Create the following directories if they are missing:

--- a/docs/usage.md
+++ b/docs/usage.md
@@ -443,10 +443,6 @@ flowchart TD
    'Updated'
    trigger(s)"}

-    scheduled{"Documents
-    matching
-    trigger(s)"}
-
    A[New Document] --> consumption
    consumption --> |Yes| C[Workflow Actions Run]
    consumption --> |No| D
@@ -459,11 +455,6 @@ flowchart TD
    updated --> |Yes| J[Workflow Actions Run]
    updated --> |No| K
    J --> K[Document Saved]
-    L[Scheduled Task Check<br/>hourly at :05] --> M[Get All Scheduled Triggers]
-    M --> scheduled
-    scheduled --> |Yes| N[Workflow Actions Run]
-    scheduled --> |No| O[Document Saved]
-    N --> O
 ```

 #### Filters {#workflow-trigger-filters}
@@ -562,7 +553,6 @@ applied. You can use the following placeholders in the template with any trigger
 -   `{{added_time}}`: added time in HH:MM format
 -   `{{original_filename}}`: original file name without extension
 -   `{{filename}}`: current file name without extension
-   `{{doc_title}}`: current document title

 The following placeholders are only available for "added" or "updated" triggers

@@ -901,6 +891,21 @@ how regularly you intend to scan documents and use paperless.
    performed the task associated with the document, move it to the
    inbox.

+## Remote OCR
+
+!!! important
+
+    This feature is disabled by default and will always remain strictly "opt-in".
+
+Paperless-ngx supports performing OCR on documents using remote services. At the moment, this is limited to
+[Microsoft's Azure "Document Intelligence" service](https://azure.microsoft.com/en-us/products/ai-services/ai-document-intelligence).
+This is of course a paid service (with a free tier) which requires an Azure account and subscription. Azure AI is not affiliated with
+Paperless-ngx in any way. When enabled, Paperless-ngx will automatically send appropriate documents to Azure for OCR processing, bypassing
+the local OCR engine. See the [configuration](configuration.md#PAPERLESS_REMOTE_OCR_ENGINE) options for more details.
+
+Additionally, when using a commercial service with this feature, consider both potential costs as well as any associated file size
+or page limitations (e.g. with a free tier).
+
 ## Architecture

 Paperless-ngx consists of the following components:
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "paperless-ngx"
-version = "2.20.3"
+version = "2.19.3"
 description = "A community-supported supercharged document management system: scan, index and archive all your physical documents"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -16,8 +16,9 @@ classifiers = [
 # This will allow testing to not install a webserver, mysql, etc

 dependencies = [
+  "azure-ai-documentintelligence>=1.0.2",
  "babel>=2.17",
-  "bleach~=6.3.0",
+  "bleach~=6.2.0",
  "celery[redis]~=5.5.1",
  "channels~=4.2",
  "channels-redis~=4.2",
@@ -26,8 +27,8 @@ dependencies = [
  # WARNING: django does not use semver.
  #          Only patch versions are guaranteed to not introduce breaking changes.
  "django~=5.2.5",
-  "django-allauth[mfa,socialaccount]~=65.12.1",
-  "django-auditlog~=3.3.0",
+  "django-allauth[mfa,socialaccount]~=65.4.0",
+  "django-auditlog~=3.2.1",
  "django-cachalot~=2.8.0",
  "django-celery-results~=2.6.0",
  "django-compression-middleware~=0.5.0",
@@ -41,7 +42,7 @@ dependencies = [
  "djangorestframework~=3.16",
  "djangorestframework-guardian~=0.4.0",
  "drf-spectacular~=0.28",
-  "drf-spectacular-sidecar~=2025.10.1",
+  "drf-spectacular-sidecar~=2025.9.1",
  "drf-writable-nested~=0.7.1",
  "filelock~=3.20.0",
  "flower~=2.0.1",
@@ -52,18 +53,17 @@ dependencies = [
  "jinja2~=3.1.5",
  "langdetect~=1.0.9",
  "nltk~=3.9.1",
-  "ocrmypdf~=16.12.0",
+  "ocrmypdf~=16.11.0",
  "pathvalidate~=3.3.1",
  "pdf2image~=1.17.0",
  "python-dateutil~=2.9.0",
-  "python-dotenv~=1.2.1",
+  "python-dotenv~=1.1.0",
  "python-gnupg~=0.5.4",
  "python-ipware~=3.0.0",
  "python-magic~=0.4.27",
  "pyzbar~=0.1.9",
  "rapidfuzz~=3.14.0",
  "redis[hiredis]~=5.2.1",
-  "regex>=2025.9.18",
  "scikit-learn~=1.7.0",
  "setproctitle~=1.3.4",
  "tika-client~=0.10.0",
@@ -78,10 +78,10 @@ optional-dependencies.mariadb = [
  "mysqlclient~=2.2.7",
 ]
 optional-dependencies.postgres = [
-  "psycopg[c,pool]==3.2.12",
+  "psycopg[c,pool]==3.2.9",
  # Direct dependency for proper resolution of the pre-built wheels
-  "psycopg-c==3.2.12",
-  "psycopg-pool==3.2.7",
+  "psycopg-c==3.2.9",
+  "psycopg-pool==3.2.6",
 ]
 optional-dependencies.webserver = [
  "granian[uvloop]~=2.5.1",
@@ -97,7 +97,7 @@ dev = [

 docs = [
  "mkdocs-glightbox~=0.5.1",
-  "mkdocs-material~=9.7.0",
+  "mkdocs-material~=9.6.4",
 ]

 testing = [
@@ -116,7 +116,7 @@ testing = [
 ]

 lint = [
-  "pre-commit~=4.4.0",
+  "pre-commit~=4.3.0",
  "pre-commit-uv~=4.2.0",
  "ruff~=0.14.0",
 ]
@@ -151,8 +151,8 @@ environments = [
 [tool.uv.sources]
 # Markers are chosen to select these almost exclusively when building the Docker image
 psycopg-c = [
-  { url = "https://github.com/paperless-ngx/builder/releases/download/psycopg-bookworm-3.2.12/psycopg_c-3.2.12-cp312-cp312-linux_x86_64.whl", marker = "sys_platform == 'linux' and platform_machine == 'x86_64' and python_version == '3.12'" },
-  { url = "https://github.com/paperless-ngx/builder/releases/download/psycopg-bookworm-3.2.12/psycopg_c-3.2.12-cp312-cp312-linux_aarch64.whl", marker = "sys_platform == 'linux' and platform_machine == 'aarch64' and python_version == '3.12'" },
+  { url = "https://github.com/paperless-ngx/builder/releases/download/psycopg-3.2.9/psycopg_c-3.2.9-cp312-cp312-linux_x86_64.whl", marker = "sys_platform == 'linux' and platform_machine == 'x86_64' and python_version == '3.12'" },
+  { url = "https://github.com/paperless-ngx/builder/releases/download/psycopg-3.2.9/psycopg_c-3.2.9-cp312-cp312-linux_aarch64.whl", marker = "sys_platform == 'linux' and platform_machine == 'aarch64' and python_version == '3.12'" },
 ]
 zxing-cpp = [
  { url = "https://github.com/paperless-ngx/builder/releases/download/zxing-2.3.0/zxing_cpp-2.3.0-cp312-cp312-linux_x86_64.whl", marker = "sys_platform == 'linux' and platform_machine == 'x86_64' and python_version == '3.12'" },
@@ -253,6 +253,7 @@ testpaths = [
  "src/paperless_tesseract/tests/",
  "src/paperless_tika/tests",
  "src/paperless_text/tests/",
+  "src/paperless_remote/tests/",
 ]
 addopts = [
  "--pythonwarnings=all",
--- a/src-ui/angular.json
+++ b/src-ui/angular.json
@@ -31,7 +31,6 @@
          "fi-FI": "src/locale/messages.fi_FI.xlf",
          "fr-FR": "src/locale/messages.fr_FR.xlf",
          "hu-HU": "src/locale/messages.hu_HU.xlf",
-          "id-ID": "src/locale/messages.id_ID.xlf",
          "it-IT": "src/locale/messages.it_IT.xlf",
          "ja-JP": "src/locale/messages.ja_JP.xlf",
          "lb-LU": "src/locale/messages.lb_LU.xlf",
--- a/src-ui/messages.xlf
+++ b/src-ui/messages.xlf
--- a/src-ui/package.json
+++ b/src-ui/package.json
@@ -1,6 +1,6 @@
 {
  "name": "paperless-ngx-ui",
-  "version": "2.20.3",
+  "version": "2.19.3",
  "scripts": {
    "preinstall": "npx only-allow pnpm",
    "ng": "ng",
@@ -11,17 +11,17 @@
  },
  "private": true,
  "dependencies": {
-    "@angular/cdk": "^20.2.13",
-    "@angular/common": "~20.3.15",
-    "@angular/compiler": "~20.3.15",
-    "@angular/core": "~20.3.15",
-    "@angular/forms": "~20.3.15",
-    "@angular/localize": "~20.3.15",
-    "@angular/platform-browser": "~20.3.15",
-    "@angular/platform-browser-dynamic": "~20.3.15",
-    "@angular/router": "~20.3.15",
+    "@angular/cdk": "^20.2.6",
+    "@angular/common": "~20.3.2",
+    "@angular/compiler": "~20.3.2",
+    "@angular/core": "~20.3.2",
+    "@angular/forms": "~20.3.2",
+    "@angular/localize": "~20.3.2",
+    "@angular/platform-browser": "~20.3.2",
+    "@angular/platform-browser-dynamic": "~20.3.2",
+    "@angular/router": "~20.3.2",
    "@ng-bootstrap/ng-bootstrap": "^19.0.1",
-    "@ng-select/ng-select": "^20.7.0",
+    "@ng-select/ng-select": "^20.2.2",
    "@ngneat/dirty-check-forms": "^3.0.3",
    "@popperjs/core": "^2.11.8",
    "bootstrap": "^5.3.8",
@@ -30,7 +30,7 @@
    "ng2-pdf-viewer": "^10.4.0",
    "ngx-bootstrap-icons": "^1.9.3",
    "ngx-color": "^10.1.0",
-    "ngx-cookie-service": "^20.1.1",
+    "ngx-cookie-service": "^20.1.0",
    "ngx-device-detector": "^10.1.0",
    "ngx-ui-tour-ng-bootstrap": "^17.0.1",
    "rxjs": "^7.8.2",
@@ -42,33 +42,33 @@
  "devDependencies": {
    "@angular-builders/custom-webpack": "^20.0.0",
    "@angular-builders/jest": "^20.0.0",
-    "@angular-devkit/core": "^20.3.13",
-    "@angular-devkit/schematics": "^20.3.13",
-    "@angular-eslint/builder": "20.6.0",
-    "@angular-eslint/eslint-plugin": "20.6.0",
-    "@angular-eslint/eslint-plugin-template": "20.6.0",
-    "@angular-eslint/schematics": "20.6.0",
-    "@angular-eslint/template-parser": "20.6.0",
-    "@angular/build": "^20.3.13",
-    "@angular/cli": "~20.3.13",
-    "@angular/compiler-cli": "~20.3.15",
+    "@angular-devkit/core": "^20.3.3",
+    "@angular-devkit/schematics": "^20.3.3",
+    "@angular-eslint/builder": "20.3.0",
+    "@angular-eslint/eslint-plugin": "20.3.0",
+    "@angular-eslint/eslint-plugin-template": "20.3.0",
+    "@angular-eslint/schematics": "20.3.0",
+    "@angular-eslint/template-parser": "20.3.0",
+    "@angular/build": "^20.3.3",
+    "@angular/cli": "~20.3.3",
+    "@angular/compiler-cli": "~20.3.2",
    "@codecov/webpack-plugin": "^1.9.1",
-    "@playwright/test": "^1.57.0",
+    "@playwright/test": "^1.55.1",
    "@types/jest": "^30.0.0",
-    "@types/node": "^24.10.1",
-    "@typescript-eslint/eslint-plugin": "^8.48.1",
-    "@typescript-eslint/parser": "^8.48.1",
-    "@typescript-eslint/utils": "^8.48.1",
-    "eslint": "^9.39.1",
+    "@types/node": "^24.6.1",
+    "@typescript-eslint/eslint-plugin": "^8.45.0",
+    "@typescript-eslint/parser": "^8.45.0",
+    "@typescript-eslint/utils": "^8.45.0",
+    "eslint": "^9.36.0",
    "jest": "30.2.0",
    "jest-environment-jsdom": "^30.2.0",
    "jest-junit": "^16.0.0",
-    "jest-preset-angular": "^15.0.3",
+    "jest-preset-angular": "^15.0.2",
    "jest-websocket-mock": "^2.5.0",
    "prettier-plugin-organize-imports": "^4.3.0",
    "ts-node": "~10.9.1",
    "typescript": "^5.8.3",
-    "webpack": "^5.103.0"
+    "webpack": "^5.102.0"
  },
  "packageManager": "pnpm@10.17.1",
  "pnpm": {
--- a/src-ui/pnpm-lock.yaml
+++ b/src-ui/pnpm-lock.yaml
--- a/src-ui/setup-jest.ts
+++ b/src-ui/setup-jest.ts
@@ -28,7 +28,6 @@ import localeFa from '@angular/common/locales/fa'
 import localeFi from '@angular/common/locales/fi'
 import localeFr from '@angular/common/locales/fr'
 import localeHu from '@angular/common/locales/hu'
-import localeId from '@angular/common/locales/id'
 import localeIt from '@angular/common/locales/it'
 import localeJa from '@angular/common/locales/ja'
 import localeKo from '@angular/common/locales/ko'
@@ -64,7 +63,6 @@ registerLocaleData(localeFa)
 registerLocaleData(localeFi)
 registerLocaleData(localeFr)
 registerLocaleData(localeHu)
-registerLocaleData(localeId)
 registerLocaleData(localeIt)
 registerLocaleData(localeJa)
 registerLocaleData(localeKo)
@@ -147,10 +145,6 @@ HTMLCanvasElement.prototype.getContext = <
  typeof HTMLCanvasElement.prototype.getContext
 >jest.fn()

-if (!HTMLElement.prototype.scrollTo) {
-  HTMLElement.prototype.scrollTo = jest.fn()
-}
-
 jest.mock('uuid', () => ({
  v4: jest.fn(() =>
    'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (char: string) => {
--- a/src-ui/src/app/components/admin/logs/logs.component.html
+++ b/src-ui/src/app/components/admin/logs/logs.component.html
@@ -41,23 +41,21 @@
  }
 </ul>

-<div #logContainer class="bg-dark text-light font-monospace log-container p-3" (scroll)="onScroll()">
-  @if (loading && !logFiles.length) {
+<div [ngbNavOutlet]="nav" class="mt-2"></div>
+
+<cdk-virtual-scroll-viewport
+  itemSize="20"
+  class="bg-dark p-3 text-light font-monospace log-container"
+  #logContainer>
+  @if (loading && logFiles.length) {
    <div>
      <div class="spinner-border spinner-border-sm me-2" role="status"></div>
      <ng-container i18n>Loading...</ng-container>
    </div>
-  } @else {
-    @for (log of logs; track log) {
-      <p class="m-0 p-0" [ngClass]="'log-entry-' + log.level">{{log.message}}</p>
-    }
  }
-</div>
-<button
-  type="button"
-  class="btn btn-sm btn-secondary jump-to-bottom position-fixed bottom-0 end-0 m-5"
-  [class.visible]="showJumpToBottom"
-  (click)="scrollToBottom()"
->
-  ↓ <span i18n>Jump to bottom</span>
-</button>
+  <p *cdkVirtualFor="let log of logs"
+     class="m-0 p-0"
+     [ngClass]="'log-entry-' + log.level">
+    {{log.message}}
+  </p>
+</cdk-virtual-scroll-viewport>
--- a/src-ui/src/app/components/admin/logs/logs.component.scss
+++ b/src-ui/src/app/components/admin/logs/logs.component.scss
@@ -16,21 +16,11 @@
 }

 .log-container {
-  height: calc(100vh - 190px);
-  overflow-y: auto;
+  overflow-y: scroll;
+  height: calc(100vh - 200px);
+  top: 0;

  p {
    white-space: pre-wrap;
  }
 }
-
-.jump-to-bottom {
-  opacity: 0;
-  pointer-events: none;
-  transition: opacity 120ms ease-in-out;
-}
-
-.jump-to-bottom.visible {
-  opacity: 1;
-  pointer-events: auto;
-}
--- a/src-ui/src/app/components/admin/logs/logs.component.spec.ts
+++ b/src-ui/src/app/components/admin/logs/logs.component.spec.ts
@@ -110,11 +110,4 @@ describe('LogsComponent', () => {
    jest.advanceTimersByTime(1)
    expect(reloadSpy).toHaveBeenCalledTimes(initialCalls + 1)
  })
-
-  it('should update jump to bottom visibility on scroll', () => {
-    component.showJumpToBottom = false
-    jest.spyOn(component as any, 'isNearBottom').mockReturnValue(false)
-    component.onScroll()
-    expect(component.showJumpToBottom).toBe(true)
-  })
 })
--- a/src-ui/src/app/components/admin/logs/logs.component.ts
+++ b/src-ui/src/app/components/admin/logs/logs.component.ts
@@ -1,8 +1,11 @@
+import {
+  CdkVirtualScrollViewport,
+  ScrollingModule,
+} from '@angular/cdk/scrolling'
 import { CommonModule } from '@angular/common'
 import {
  ChangeDetectorRef,
  Component,
-  ElementRef,
  OnDestroy,
  OnInit,
  ViewChild,
@@ -25,6 +28,8 @@ import { LoadingComponentWithPermissions } from '../../loading-component/loading
    CommonModule,
    FormsModule,
    ReactiveFormsModule,
+    CdkVirtualScrollViewport,
+    ScrollingModule,
  ],
 })
 export class LogsComponent
@@ -44,11 +49,9 @@ export class LogsComponent

  public limit: number = 5000

-  public showJumpToBottom = false
-
  private readonly limitChange$ = new Subject<number>()

-  @ViewChild('logContainer') logContainer: ElementRef<HTMLElement>
+  @ViewChild('logContainer') logContainer: CdkVirtualScrollViewport

  ngOnInit(): void {
    this.limitChange$
@@ -86,7 +89,6 @@ export class LogsComponent

  reloadLogs() {
    this.loading = true
-    const shouldStickToBottom = this.isNearBottom()
    this.logService
      .get(this.activeLog, this.limit)
      .pipe(takeUntil(this.unsubscribeNotifier))
@@ -106,10 +108,7 @@ export class LogsComponent
            })
          if (hasChanges) {
            this.logs = parsed
-            if (shouldStickToBottom) {
-              this.scrollToBottom()
-            }
-            this.showJumpToBottom = !shouldStickToBottom
+            this.scrollToBottom()
          }
        },
        error: () => {
@@ -143,25 +142,9 @@ export class LogsComponent
  }

  scrollToBottom(): void {
-    const viewport = this.logContainer?.nativeElement
-    if (!viewport) {
-      return
-    }
    this.changedetectorRef.detectChanges()
-    viewport.scrollTop = viewport.scrollHeight
-    this.showJumpToBottom = false
-  }
-
-  private isNearBottom(): boolean {
-    if (!this.logContainer?.nativeElement) return true
-    const distanceFromBottom =
-      this.logContainer.nativeElement.scrollHeight -
-      this.logContainer.nativeElement.scrollTop -
-      this.logContainer.nativeElement.clientHeight
-    return distanceFromBottom <= 40
-  }
-
-  onScroll(): void {
-    this.showJumpToBottom = !this.isNearBottom()
+    if (this.logContainer) {
+      this.logContainer.scrollToIndex(this.logs.length - 1)
+    }
  }
 }
--- a/src-ui/src/app/components/admin/settings/settings.component.spec.ts
+++ b/src-ui/src/app/components/admin/settings/settings.component.spec.ts
@@ -28,6 +28,7 @@ import { IfOwnerDirective } from 'src/app/directives/if-owner.directive'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { PermissionsGuard } from 'src/app/guards/permissions.guard'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { PermissionsService } from 'src/app/services/permissions.service'
 import { GroupService } from 'src/app/services/rest/group.service'
 import { SavedViewService } from 'src/app/services/rest/saved-view.service'
@@ -128,6 +129,7 @@ describe('SettingsComponent', () => {
        ConfirmDialogComponent,
        CheckComponent,
        ColorComponent,
+        SafeHtmlPipe,
        SelectComponent,
        TextComponent,
        NumberComponent,
--- a/src-ui/src/app/components/admin/trash/trash.component.spec.ts
+++ b/src-ui/src/app/components/admin/trash/trash.component.spec.ts
@@ -11,6 +11,7 @@ import {
 } from '@ng-bootstrap/ng-bootstrap'
 import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
 import { of, throwError } from 'rxjs'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { ToastService } from 'src/app/services/toast.service'
 import { TrashService } from 'src/app/services/trash.service'
 import { ConfirmDialogComponent } from '../../common/confirm-dialog/confirm-dialog.component'
@@ -52,6 +53,7 @@ describe('TrashComponent', () => {
        TrashComponent,
        PageHeaderComponent,
        ConfirmDialogComponent,
+        SafeHtmlPipe,
      ],
    }).compileComponents()

--- a/src-ui/src/app/components/admin/users-groups/users-groups.component.html
+++ b/src-ui/src/app/components/admin/users-groups/users-groups.component.html
@@ -26,7 +26,7 @@
    @for (user of users; track user) {
      <li class="list-group-item">
        <div class="row">
-          <div class="col d-flex align-items-center" [class.opacity-50]="!user.is_active"><button class="btn btn-link p-0 text-start" type="button" (click)="editUser(user)" [disabled]="!permissionsService.currentUserCan(PermissionAction.Change, PermissionType.User)">{{user.username}}</button></div>
+          <div class="col d-flex align-items-center"><button class="btn btn-link p-0 text-start" type="button" (click)="editUser(user)" [disabled]="!permissionsService.currentUserCan(PermissionAction.Change, PermissionType.User)">{{user.username}}</button></div>
          <div class="col d-flex align-items-center">{{user.first_name}} {{user.last_name}}</div>
          <div class="col d-flex align-items-center">{{user.groups?.map(getGroupName, this).join(', ')}}</div>
          <div class="col">
--- a/src-ui/src/app/components/app-frame/global-search/global-search.component.ts
+++ b/src-ui/src/app/components/app-frame/global-search/global-search.component.ts
@@ -411,9 +411,6 @@ export class GlobalSearchComponent implements OnInit {
    const ruleType = this.useAdvancedForFullSearch
      ? FILTER_FULLTEXT_QUERY
      : FILTER_TITLE_CONTENT
-    this.documentService.searchQuery = this.useAdvancedForFullSearch
-      ? this.query
-      : ''
    this.documentListViewService.quickFilter([
      { rule_type: ruleType, value: this.query },
    ])
--- a/src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.html
+++ b/src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.html
@@ -8,7 +8,7 @@
    <p><b>{{messageBold}}</b></p>
  }
  @if (message) {
-    <p class="mb-0" [innerHTML]="message"></p>
+    <p class="mb-0" [innerHTML]="message | safeHtml"></p>
  }
 </div>
 <div class="modal-footer">
--- a/src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.spec.ts
+++ b/src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.spec.ts
@@ -1,6 +1,7 @@
 import { ComponentFixture, TestBed } from '@angular/core/testing'
 import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
 import { Subject } from 'rxjs'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { ConfirmDialogComponent } from './confirm-dialog.component'

 describe('ConfirmDialogComponent', () => {
@@ -10,8 +11,8 @@ describe('ConfirmDialogComponent', () => {

  beforeEach(async () => {
    TestBed.configureTestingModule({
-      providers: [NgbActiveModal],
-      imports: [ConfirmDialogComponent],
+      providers: [NgbActiveModal, SafeHtmlPipe],
+      imports: [ConfirmDialogComponent, SafeHtmlPipe],
    }).compileComponents()

    modal = TestBed.inject(NgbActiveModal)
--- a/src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.ts
+++ b/src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.ts
@@ -2,13 +2,14 @@ import { DecimalPipe } from '@angular/common'
 import { Component, EventEmitter, Input, Output, inject } from '@angular/core'
 import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
 import { Subject } from 'rxjs'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { LoadingComponentWithPermissions } from '../../loading-component/loading.component'

@Component({
  selector: 'pngx-confirm-dialog',
  templateUrl: './confirm-dialog.component.html',
  styleUrls: ['./confirm-dialog.component.scss'],
-  imports: [DecimalPipe],
+  imports: [DecimalPipe, SafeHtmlPipe],
 })
 export class ConfirmDialogComponent extends LoadingComponentWithPermissions {
  activeModal = inject(NgbActiveModal)
--- a/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.html
+++ b/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.html
@@ -1,75 +0,0 @@
-<div class="modal-header">
-  <h4 class="modal-title" id="modal-basic-title">{{title}}</h4>
-  <button type="button" class="btn-close" aria-label="Close" (click)="cancel()">
-  </button>
-</div>
-<div class="modal-body">
-  @if (message) {
-    <p class="mb-3" [innerHTML]="message"></p>
-  }
-  <div class="btn-group mb-3" role="group">
-    <input
-      type="radio"
-      class="btn-check"
-      name="passwordRemoveMode"
-      id="removeReplace"
-      [(ngModel)]="updateDocument"
-      [value]="true"
-      (ngModelChange)="onUpdateDocumentChange($event)"
-    />
-    <label class="btn btn-outline-primary btn-sm" for="removeReplace">
-      <i-bs name="pencil"></i-bs>
-      <span class="ms-2" i18n>Replace current document</span>
-    </label>
-    <input
-      type="radio"
-      class="btn-check"
-      name="passwordRemoveMode"
-      id="removeCreate"
-      [(ngModel)]="updateDocument"
-      [value]="false"
-      (ngModelChange)="onUpdateDocumentChange($event)"
-    />
-    <label class="btn btn-outline-primary btn-sm" for="removeCreate">
-      <i-bs name="plus"></i-bs>
-      <span class="ms-2" i18n>Create new document</span>
-    </label>
-  </div>
-  @if (!updateDocument) {
-    <div class="d-flex flex-column flex-md-row w-100 gap-3 align-items-center">
-      <div class="form-group d-flex">
-        <div class="form-check">
-          <input class="form-check-input" type="checkbox" id="copyMetaRemove" [(ngModel)]="includeMetadata" />
-          <label class="form-check-label" for="copyMetaRemove" i18n> Copy metadata
-          </label>
-        </div>
-        <div class="form-check ms-3">
-          <input class="form-check-input" type="checkbox" id="deleteOriginalRemove" [(ngModel)]="deleteOriginal" />
-          <label class="form-check-label" for="deleteOriginalRemove" i18n> Delete original</label>
-        </div>
-      </div>
-    </div>
-  }
-</div>
-<div class="modal-footer flex-nowrap gap-2">
-  <button
-    type="button"
-    class="btn"
-    [class]="cancelBtnClass"
-    (click)="cancel()"
-    [disabled]="!buttonsEnabled"
-  >
-    <span class="d-inline-block" style="padding-bottom: 1px;">
-      {{cancelBtnCaption}}
-    </span>
-  </button>
-  <button
-    type="button"
-    class="btn"
-    [class]="btnClass"
-    (click)="confirm()"
-    [disabled]="!confirmButtonEnabled || !buttonsEnabled"
-  >
-    {{btnCaption}}
-  </button>
-</div>
--- a/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.scss
+++ b/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.scss
--- a/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.spec.ts
+++ b/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.spec.ts
@@ -1,53 +0,0 @@
-import { ComponentFixture, TestBed } from '@angular/core/testing'
-import { By } from '@angular/platform-browser'
-import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
-import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
-import { PasswordRemovalConfirmDialogComponent } from './password-removal-confirm-dialog.component'
-
-describe('PasswordRemovalConfirmDialogComponent', () => {
-  let component: PasswordRemovalConfirmDialogComponent
-  let fixture: ComponentFixture<PasswordRemovalConfirmDialogComponent>
-
-  beforeEach(async () => {
-    await TestBed.configureTestingModule({
-      providers: [NgbActiveModal],
-      imports: [
-        NgxBootstrapIconsModule.pick(allIcons),
-        PasswordRemovalConfirmDialogComponent,
-      ],
-    }).compileComponents()
-
-    fixture = TestBed.createComponent(PasswordRemovalConfirmDialogComponent)
-    component = fixture.componentInstance
-    fixture.detectChanges()
-  })
-
-  it('should default to replacing the document', () => {
-    expect(component.updateDocument).toBe(true)
-    expect(
-      fixture.debugElement.query(By.css('#removeReplace')).nativeElement.checked
-    ).toBe(true)
-  })
-
-  it('should allow creating a new document with metadata and delete toggle', () => {
-    component.onUpdateDocumentChange(false)
-    fixture.detectChanges()
-
-    expect(component.updateDocument).toBe(false)
-    expect(fixture.debugElement.query(By.css('#copyMetaRemove'))).not.toBeNull()
-
-    component.includeMetadata = false
-    component.deleteOriginal = true
-    component.onUpdateDocumentChange(true)
-    expect(component.updateDocument).toBe(true)
-    expect(component.includeMetadata).toBe(true)
-    expect(component.deleteOriginal).toBe(false)
-  })
-
-  it('should emit confirm when confirmed', () => {
-    let confirmed = false
-    component.confirmClicked.subscribe(() => (confirmed = true))
-    component.confirm()
-    expect(confirmed).toBe(true)
-  })
-})
--- a/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.ts
+++ b/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.ts
@@ -1,38 +0,0 @@
-import { Component, Input } from '@angular/core'
-import { FormsModule } from '@angular/forms'
-import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
-import { ConfirmDialogComponent } from '../confirm-dialog.component'
-
-@Component({
-  selector: 'pngx-password-removal-confirm-dialog',
-  templateUrl: './password-removal-confirm-dialog.component.html',
-  styleUrls: ['./password-removal-confirm-dialog.component.scss'],
-  imports: [FormsModule, NgxBootstrapIconsModule],
-})
-export class PasswordRemovalConfirmDialogComponent extends ConfirmDialogComponent {
-  updateDocument: boolean = true
-  includeMetadata: boolean = true
-  deleteOriginal: boolean = false
-
-  @Input()
-  override title = $localize`Remove password protection`
-
-  @Input()
-  override message =
-    $localize`Create an unprotected copy or replace the existing file.`
-
-  @Input()
-  override btnCaption = $localize`Start`
-
-  constructor() {
-    super()
-  }
-
-  onUpdateDocumentChange(updateDocument: boolean) {
-    this.updateDocument = updateDocument
-    if (this.updateDocument) {
-      this.deleteOriginal = false
-      this.includeMetadata = true
-    }
-  }
-}
--- a/src-ui/src/app/components/common/confirm-dialog/rotate-confirm-dialog/rotate-confirm-dialog.component.html
+++ b/src-ui/src/app/components/common/confirm-dialog/rotate-confirm-dialog/rotate-confirm-dialog.component.html
@@ -28,10 +28,10 @@
 <div class="modal-footer flex-nowrap">
    <div class="col">
        @if (message) {
-            <p>{{message}}</p>
+            <p [innerHTML]="message | safeHtml"></p>
        }
        @if (messageBold) {
-          <p class="mb-0 small"><b>{{messageBold}}</b></p>
+          <p class="mb-0 small"><b [innerHTML]="messageBold | safeHtml"></b></p>
        }
    </div>
    <button type="button" class="btn" [class]="cancelBtnClass" (click)="cancel()" [disabled]="!buttonsEnabled">
--- a/src-ui/src/app/components/common/confirm-dialog/rotate-confirm-dialog/rotate-confirm-dialog.component.spec.ts
+++ b/src-ui/src/app/components/common/confirm-dialog/rotate-confirm-dialog/rotate-confirm-dialog.component.spec.ts
@@ -3,6 +3,7 @@ import { provideHttpClientTesting } from '@angular/common/http/testing'
 import { ComponentFixture, TestBed } from '@angular/core/testing'
 import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
 import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { RotateConfirmDialogComponent } from './rotate-confirm-dialog.component'

 describe('RotateConfirmDialogComponent', () => {
@@ -14,9 +15,11 @@ describe('RotateConfirmDialogComponent', () => {
      imports: [
        NgxBootstrapIconsModule.pick(allIcons),
        RotateConfirmDialogComponent,
+        SafeHtmlPipe,
      ],
      providers: [
        NgbActiveModal,
+        SafeHtmlPipe,
        provideHttpClient(withInterceptorsFromDi()),
        provideHttpClientTesting(),
      ],
--- a/src-ui/src/app/components/common/confirm-dialog/rotate-confirm-dialog/rotate-confirm-dialog.component.ts
+++ b/src-ui/src/app/components/common/confirm-dialog/rotate-confirm-dialog/rotate-confirm-dialog.component.ts
@@ -1,6 +1,7 @@
 import { NgStyle } from '@angular/common'
 import { Component, inject } from '@angular/core'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { DocumentService } from 'src/app/services/rest/document.service'
 import { ConfirmDialogComponent } from '../confirm-dialog.component'

@@ -8,7 +9,7 @@ import { ConfirmDialogComponent } from '../confirm-dialog.component'
  selector: 'pngx-rotate-confirm-dialog',
  templateUrl: './rotate-confirm-dialog.component.html',
  styleUrl: './rotate-confirm-dialog.component.scss',
-  imports: [NgStyle, NgxBootstrapIconsModule],
+  imports: [NgStyle, NgxBootstrapIconsModule, SafeHtmlPipe],
 })
 export class RotateConfirmDialogComponent extends ConfirmDialogComponent {
  documentService = inject(DocumentService)
--- a/src-ui/src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html
+++ b/src-ui/src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html
@@ -63,7 +63,6 @@
      bindValue="id"
      [(ngModel)]="atom.value"
      [disabled]="disabled"
-      [virtualScroll]="getSelectOptionsForField(atom.field)?.length > 100"
      (mousedown)="$event.stopImmediatePropagation()"
    ></ng-select>
  } @else if (getCustomFieldByID(atom.field)?.data_type === CustomFieldDataType.DocumentLink) {
--- a/src-ui/src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.spec.ts
+++ b/src-ui/src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.spec.ts
@@ -354,13 +354,5 @@ describe('CustomFieldsQueryDropdownComponent', () => {
      model.removeElement(atom)
      expect(completeSpy).toHaveBeenCalled()
    })
-
-    it('should subscribe to existing elements when queries are assigned', () => {
-      const expression = new CustomFieldQueryExpression()
-      const nextSpy = jest.spyOn(model.changed, 'next')
-      model.queries = [expression]
-      expression.changed.next(expression)
-      expect(nextSpy).toHaveBeenCalledWith(model)
-    })
  })
 })
--- a/src-ui/src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts
+++ b/src-ui/src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts
@@ -17,7 +17,7 @@ import {
 } from '@ng-bootstrap/ng-bootstrap'
 import { NgSelectComponent, NgSelectModule } from '@ng-select/ng-select'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
-import { first, Subject, Subscription, takeUntil } from 'rxjs'
+import { first, Subject, takeUntil } from 'rxjs'
 import { CustomField, CustomFieldDataType } from 'src/app/data/custom-field'
 import {
  CUSTOM_FIELD_QUERY_MAX_ATOMS,
@@ -41,27 +41,10 @@ import { ClearableBadgeComponent } from '../clearable-badge/clearable-badge.comp
 import { DocumentLinkComponent } from '../input/document-link/document-link.component'

 export class CustomFieldQueriesModel {
-  private _queries: CustomFieldQueryElement[] = []
-  private rootSubscriptions: Subscription[] = []
+  public queries: CustomFieldQueryElement[] = []

  public readonly changed = new Subject<CustomFieldQueriesModel>()

-  public get queries(): CustomFieldQueryElement[] {
-    return this._queries
-  }
-
-  public set queries(value: CustomFieldQueryElement[]) {
-    this.teardownRootSubscriptions()
-    this._queries = value ?? []
-    for (const element of this._queries) {
-      this.rootSubscriptions.push(
-        element.changed.subscribe(() => {
-          this.changed.next(this)
-        })
-      )
-    }
-  }
-
  public clear(fireEvent = true) {
    this.queries = []
    if (fireEvent) {
@@ -124,14 +107,14 @@ export class CustomFieldQueriesModel {
  public addExpression(
    expression: CustomFieldQueryExpression = new CustomFieldQueryExpression()
  ) {
-    if (this.queries.length === 0) {
-      this.queries = [expression]
-      return
+    if (this.queries.length > 0) {
+      ;(
+        (this.queries[0] as CustomFieldQueryExpression)
+          .value as CustomFieldQueryElement[]
+      ).push(expression)
+    } else {
+      this.queries.push(expression)
    }
-    ;(
-      (this.queries[0] as CustomFieldQueryExpression)
-        .value as CustomFieldQueryElement[]
-    ).push(expression)
    expression.changed.subscribe(() => {
      this.changed.next(this)
    })
@@ -183,13 +166,6 @@ export class CustomFieldQueriesModel {
      this.changed.next(this)
    }
  }
-
-  private teardownRootSubscriptions() {
-    for (const subscription of this.rootSubscriptions) {
-      subscription.unsubscribe()
-    }
-    this.rootSubscriptions = []
-  }
 }

@Component({
--- a/src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.html
+++ b/src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.html
@@ -26,7 +26,7 @@
          i18n-placeholder
          (change)="onSetCreatedRelativeDate($event)">
          <ng-template ng-option-tmp let-item="item">
-            <ng-container [ngTemplateOutlet]="relativeDateOptionTemplate" [ngTemplateOutletContext]="{ $implicit: item }"></ng-container>
+            <div class="d-flex">{{ item.name }}<span class="ms-auto text-muted small">{{ item.date | customDate:'mediumDate' }} &ndash; <ng-container i18n>now</ng-container></span></div>
          </ng-template>
          </ng-select>
        </div>
@@ -102,7 +102,7 @@
            i18n-placeholder
            (change)="onSetAddedRelativeDate($event)">
            <ng-template ng-option-tmp let-item="item">
-              <ng-container [ngTemplateOutlet]="relativeDateOptionTemplate" [ngTemplateOutletContext]="{ $implicit: item }"></ng-container>
+              <div class="d-flex">{{ item.name }}<span class="ms-auto text-muted small">{{ item.date | customDate:'mediumDate' }} &ndash; <ng-container i18n>now</ng-container></span></div>
            </ng-template>
          </ng-select>
        </div>
@@ -158,16 +158,3 @@
    </div>
  </div>
 </div>
-
-<ng-template #relativeDateOptionTemplate let-item>
-  <div class="d-flex">
-    {{ item.name }}
-    <span class="ms-auto text-muted small">
-      @if (item.dateEnd) {
-        {{ item.date | customDate:'MMM d' }} &ndash; {{ item.dateEnd | customDate:'mediumDate' }}
-      } @else {
-        {{ item.date | customDate:'mediumDate' }} &ndash; <ng-container i18n>now</ng-container>
-      }
-    </span>
-  </div>
-</ng-template>
--- a/src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.ts
+++ b/src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.ts
@@ -1,4 +1,4 @@
-import { NgClass, NgTemplateOutlet } from '@angular/common'
+import { NgClass } from '@angular/common'
 import {
  Component,
  EventEmitter,
@@ -42,10 +42,6 @@ export enum RelativeDate {
  THIS_MONTH = 6,
  TODAY = 7,
  YESTERDAY = 8,
-  PREVIOUS_WEEK = 9,
-  PREVIOUS_MONTH = 10,
-  PREVIOUS_QUARTER = 11,
-  PREVIOUS_YEAR = 12,
 }

@Component({
@@ -63,7 +59,6 @@ export enum RelativeDate {
    FormsModule,
    ReactiveFormsModule,
    NgClass,
-    NgTemplateOutlet,
  ],
 })
 export class DatesDropdownComponent implements OnInit, OnDestroy {
@@ -116,46 +111,6 @@ export class DatesDropdownComponent implements OnInit, OnDestroy {
      name: $localize`Yesterday`,
      date: new Date().setDate(new Date().getDate() - 1),
    },
-    {
-      id: RelativeDate.PREVIOUS_WEEK,
-      name: $localize`Previous week`,
-      date: new Date(
-        new Date().getFullYear(),
-        new Date().getMonth(),
-        new Date().getDate() - new Date().getDay() - 6
-      ),
-      dateEnd: new Date(
-        new Date().getFullYear(),
-        new Date().getMonth(),
-        new Date().getDate() - new Date().getDay()
-      ),
-    },
-    {
-      id: RelativeDate.PREVIOUS_MONTH,
-      name: $localize`Previous month`,
-      date: new Date(new Date().getFullYear(), new Date().getMonth() - 1, 1),
-      dateEnd: new Date(new Date().getFullYear(), new Date().getMonth(), 0),
-    },
-    {
-      id: RelativeDate.PREVIOUS_QUARTER,
-      name: $localize`Previous quarter`,
-      date: new Date(
-        new Date().getFullYear(),
-        Math.floor(new Date().getMonth() / 3) * 3 - 3,
-        1
-      ),
-      dateEnd: new Date(
-        new Date().getFullYear(),
-        Math.floor(new Date().getMonth() / 3) * 3,
-        0
-      ),
-    },
-    {
-      id: RelativeDate.PREVIOUS_YEAR,
-      name: $localize`Previous year`,
-      date: new Date('1/1/' + (new Date().getFullYear() - 1)),
-      dateEnd: new Date('12/31/' + (new Date().getFullYear() - 1)),
-    },
  ]

  datePlaceHolder: string
--- a/src-ui/src/app/components/common/edit-dialog/custom-field-edit-dialog/custom-field-edit-dialog.component.spec.ts
+++ b/src-ui/src/app/components/common/edit-dialog/custom-field-edit-dialog/custom-field-edit-dialog.component.spec.ts
@@ -10,6 +10,7 @@ import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
 import { CustomFieldDataType } from 'src/app/data/custom-field'
 import { IfOwnerDirective } from 'src/app/directives/if-owner.directive'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { SettingsService } from 'src/app/services/settings.service'
 import { SelectComponent } from '../../input/select/select.component'
 import { TextComponent } from '../../input/text/text.component'
@@ -34,6 +35,7 @@ describe('CustomFieldEditDialogComponent', () => {
        IfOwnerDirective,
        SelectComponent,
        TextComponent,
+        SafeHtmlPipe,
      ],
      providers: [
        NgbActiveModal,
--- a/src-ui/src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.spec.ts
+++ b/src-ui/src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.spec.ts
@@ -11,6 +11,7 @@ import {
 } from 'src/app/data/mail-rule'
 import { IfOwnerDirective } from 'src/app/directives/if-owner.directive'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { CorrespondentService } from 'src/app/services/rest/correspondent.service'
 import { DocumentTypeService } from 'src/app/services/rest/document-type.service'
 import { MailAccountService } from 'src/app/services/rest/mail-account.service'
@@ -45,6 +46,7 @@ describe('MailRuleEditDialogComponent', () => {
        PermissionsFormComponent,
        NumberComponent,
        TagsComponent,
+        SafeHtmlPipe,
        CheckComponent,
        SwitchComponent,
      ],
--- a/src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.html
+++ b/src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.html
@@ -161,7 +161,7 @@
        <pngx-input-text i18n-title title="Filter filename" formControlName="filter_filename" horizontal="true" i18n-hint hint="Apply to documents that match this filename. Wildcards such as *.pdf or *invoice* are allowed. Case insensitive." [error]="error?.filter_filename"></pngx-input-text>
        @if (formGroup.get('type').value === WorkflowTriggerType.Consumption) {
          <pngx-input-select i18n-title title="Filter sources" [items]="sourceOptions" horizontal="true" [multiple]="true" formControlName="sources" [error]="error?.sources"></pngx-input-select>
-          <pngx-input-text i18n-title title="Filter path" formControlName="filter_path" horizontal="true" i18n-hint hint="Apply to documents that match this path. Wildcards specified as * are allowed. Case-normalized." [error]="error?.filter_path"></pngx-input-text>
+          <pngx-input-text i18n-title title="Filter path" formControlName="filter_path" horizontal="true" i18n-hint hint="Apply to documents that match this path. Wildcards specified as * are allowed. Case-normalized.</a>" [error]="error?.filter_path"></pngx-input-text>
          <pngx-input-select i18n-title title="Filter mail rule" [items]="mailRules" horizontal="true" [allowNull]="true" formControlName="filter_mailrule" i18n-hint hint="Apply to documents consumed via this mail rule." [error]="error?.filter_mailrule"></pngx-input-select>
        }
        @if (formGroup.get('type').value === WorkflowTriggerType.DocumentAdded || formGroup.get('type').value === WorkflowTriggerType.DocumentUpdated || formGroup.get('type').value === WorkflowTriggerType.Scheduled) {
@@ -430,22 +430,6 @@
          </div>
        </div>
      }
-      @case (WorkflowActionType.PasswordRemoval) {
-        <div class="row">
-          <div class="col">
-            <p class="small" i18n>
-              One or more passwords separated by commas or new lines. The workflow will try them in order until one succeeds.
-            </p>
-            <pngx-input-textarea
-              i18n-title
-              title="Passwords"
-              formControlName="passwords"
-              rows="4"
-              [error]="error?.actions?.[i]?.passwords"
-            ></pngx-input-textarea>
-          </div>
-        </div>
-      }
    }
  </div>
 </ng-template>
--- a/src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.spec.ts
+++ b/src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.spec.ts
@@ -30,6 +30,7 @@ import {
 } from 'src/app/data/workflow-trigger'
 import { IfOwnerDirective } from 'src/app/directives/if-owner.directive'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { CorrespondentService } from 'src/app/services/rest/correspondent.service'
 import { CustomFieldsService } from 'src/app/services/rest/custom-fields.service'
 import { DocumentTypeService } from 'src/app/services/rest/document-type.service'
@@ -104,6 +105,7 @@ describe('WorkflowEditDialogComponent', () => {
        TagsComponent,
        PermissionsUserComponent,
        PermissionsGroupComponent,
+        SafeHtmlPipe,
        ConfirmButtonComponent,
      ],
      providers: [
--- a/src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts
+++ b/src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts
@@ -139,10 +139,6 @@ export const WORKFLOW_ACTION_OPTIONS = [
    id: WorkflowActionType.Webhook,
    name: $localize`Webhook`,
  },
-  {
-    id: WorkflowActionType.PasswordRemoval,
-    name: $localize`Password removal`,
-  },
 ]

 export enum TriggerFilterType {
@@ -1137,7 +1133,6 @@ export class WorkflowEditDialogComponent
          headers: new FormControl(action.webhook?.headers),
          include_document: new FormControl(!!action.webhook?.include_document),
        }),
-        passwords: new FormControl(action.passwords),
      }),
      { emitEvent }
    )
--- a/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.spec.ts
+++ b/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.spec.ts
@@ -631,47 +631,6 @@ describe('FilterableDropdownComponent & FilterableDropdownSelectionModel', () =>
    ])
  })

-  it('resorts items immediately when document count sorting enabled', () => {
-    const apple: Tag = { id: 55, name: 'Apple' }
-    const zebra: Tag = { id: 56, name: 'Zebra' }
-
-    selectionModel.documentCountSortingEnabled = true
-    selectionModel.items = [apple, zebra]
-    expect(selectionModel.items.map((item) => item?.id ?? null)).toEqual([
-      null,
-      apple.id,
-      zebra.id,
-    ])
-
-    selectionModel.documentCounts = [
-      { id: zebra.id, document_count: 5 },
-      { id: apple.id, document_count: 0 },
-    ]
-
-    expect(selectionModel.items.map((item) => item?.id ?? null)).toEqual([
-      null,
-      zebra.id,
-      apple.id,
-    ])
-  })
-
-  it('does not resort items by default when document counts are set', () => {
-    const first: Tag = { id: 57, name: 'First' }
-    const second: Tag = { id: 58, name: 'Second' }
-
-    selectionModel.items = [first, second]
-    selectionModel.documentCounts = [
-      { id: second.id, document_count: 10 },
-      { id: first.id, document_count: 0 },
-    ]
-
-    expect(selectionModel.items.map((item) => item?.id ?? null)).toEqual([
-      null,
-      first.id,
-      second.id,
-    ])
-  })
-
  it('uses fallback document counts when selection data is missing', () => {
    const fallbackRoot: Tag = {
      id: 50,
--- a/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.ts
+++ b/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.ts
@@ -61,13 +61,8 @@ export class FilterableDropdownSelectionModel {
  temporaryIntersection: Intersection = this._intersection

  private _documentCounts: SelectionDataItem[] = []
-  public documentCountSortingEnabled = false
-
  public set documentCounts(counts: SelectionDataItem[]) {
    this._documentCounts = counts
-    if (this.documentCountSortingEnabled) {
-      this.sortItems()
-    }
  }

  private _items: MatchingModel[] = []
@@ -656,9 +651,8 @@ export class FilterableDropdownComponent
      this.selectionModel.changed.complete()
      model.items = this.selectionModel.items
      model.manyToOne = this.selectionModel.manyToOne
-      model.singleSelect = this._editing && !model.manyToOne
+      model.singleSelect = this.editing && !this.selectionModel.manyToOne
    }
-    model.documentCountSortingEnabled = this._editing
    model.changed.subscribe((updatedModel) => {
      this.selectionModelChange.next(updatedModel)
    })
@@ -688,21 +682,8 @@ export class FilterableDropdownComponent
  @Input()
  allowSelectNone: boolean = false

-  private _editing = false
-
  @Input()
-  set editing(value: boolean) {
-    this._editing = value
-    if (this.selectionModel) {
-      this.selectionModel.singleSelect =
-        this._editing && !this.selectionModel.manyToOne
-      this.selectionModel.documentCountSortingEnabled = this._editing
-    }
-  }
-
-  get editing() {
-    return this._editing
-  }
+  editing = false

  @Input()
  applyOnClose = false
--- a/src-ui/src/app/components/common/input/entries/entries.component.html
+++ b/src-ui/src/app/components/common/input/entries/entries.component.html
@@ -19,7 +19,7 @@
        </div>
      }
      @if (hint) {
-        <small class="form-text text-muted" [innerHTML]="hint"></small>
+        <small class="form-text text-muted" [innerHTML]="hint | safeHtml"></small>
      }
      <div class="invalid-feedback position-absolute top-100">
        {{error}}
--- a/src-ui/src/app/components/common/input/file/file.component.html
+++ b/src-ui/src/app/components/common/input/file/file.component.html
@@ -24,7 +24,7 @@
        }
        <input #inputField type="hidden" class="form-control small" [(ngModel)]="value" [disabled]="true">
        @if (hint) {
-            <small class="form-text text-muted" [innerHTML]="hint"></small>
+            <small class="form-text text-muted" [innerHTML]="hint | safeHtml"></small>
        }
        <div class="invalid-feedback position-absolute top-100">
            {{error}}
--- a/src-ui/src/app/components/common/input/password/password.component.html
+++ b/src-ui/src/app/components/common/input/password/password.component.html
@@ -12,6 +12,6 @@
    {{error}}
  </div>
  @if (hint) {
-    <small class="form-text text-muted" [innerHTML]="hint"></small>
+    <small class="form-text text-muted" [innerHTML]="hint | safeHtml"></small>
  }
 </div>
--- a/src-ui/src/app/components/common/input/select/select.component.html
+++ b/src-ui/src/app/components/common/input/select/select.component.html
@@ -29,7 +29,6 @@
          [multiple]="multiple"
          [bindLabel]="bindLabel"
          bindValue="id"
-          [virtualScroll]="items?.length > 100"
          (change)="onChange(value)"
          (search)="onSearch($event)"
          (focus)="clearLastSearchTerm()"
--- a/src-ui/src/app/components/common/input/tags/tags.component.spec.ts
+++ b/src-ui/src/app/components/common/input/tags/tags.component.spec.ts
@@ -106,7 +106,6 @@ describe('TagsComponent', () => {

    modalService = TestBed.inject(NgbModal)
    settingsService = TestBed.inject(SettingsService)
-    settingsService.currentUser = { id: 1 }
    fixture = TestBed.createComponent(TagsComponent)
    fixture.debugElement.injector.get(NG_VALUE_ACCESSOR)
    component = fixture.componentInstance
@@ -139,7 +138,7 @@ describe('TagsComponent', () => {
    settingsService.currentUser = { id: 1 }
    let activeInstances: NgbModalRef[]
    modalService.activeInstances.subscribe((v) => (activeInstances = v))
-    component.select.filter('foobar')
+    component.select.searchTerm = 'foobar'
    component.createTag()
    expect(modalService.hasOpenModals()).toBeTruthy()
    expect(activeInstances[0].componentInstance.object.name).toEqual('foobar')
--- a/src-ui/src/app/components/common/input/tags/tags.component.ts
+++ b/src-ui/src/app/components/common/input/tags/tags.component.ts
@@ -169,7 +169,7 @@ export class TagsComponent implements OnInit, ControlValueAccessor {
    if (name) modal.componentInstance.object = { name: name }
    else if (this.select.searchTerm)
      modal.componentInstance.object = { name: this.select.searchTerm }
-    this.select.filter(null)
+    this.select.searchTerm = null
    this.select.detectChanges()
    return firstValueFrom(
      (modal.componentInstance as TagEditDialogComponent).succeeded.pipe(
--- a/src-ui/src/app/components/common/input/text/text.component.html
+++ b/src-ui/src/app/components/common/input/text/text.component.html
@@ -13,7 +13,7 @@
      <div class="position-relative" [class.col-md-9]="horizontal">
        <input #inputField type="text" class="form-control" [class.is-invalid]="error" [id]="inputId" [(ngModel)]="value" (change)="onChange(value)" [disabled]="disabled" [autocomplete]="autocomplete" [placeholder]="placeholder">
        @if (hint) {
-          <small class="form-text text-muted" [innerHTML]="hint"></small>
+          <small class="form-text text-muted" [innerHTML]="hint | safeHtml"></small>
        }
        <div class="invalid-feedback position-absolute top-100">
          {{error}}
--- a/src-ui/src/app/components/common/input/text/text.component.ts
+++ b/src-ui/src/app/components/common/input/text/text.component.ts
@@ -5,6 +5,7 @@ import {
  ReactiveFormsModule,
 } from '@angular/forms'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { AbstractInputComponent } from '../abstract-input'

@Component({
@@ -18,7 +19,12 @@ import { AbstractInputComponent } from '../abstract-input'
  selector: 'pngx-input-text',
  templateUrl: './text.component.html',
  styleUrls: ['./text.component.scss'],
-  imports: [FormsModule, ReactiveFormsModule, NgxBootstrapIconsModule],
+  imports: [
+    FormsModule,
+    ReactiveFormsModule,
+    SafeHtmlPipe,
+    NgxBootstrapIconsModule,
+  ],
 })
 export class TextComponent extends AbstractInputComponent<string> {
  @Input()
--- a/src-ui/src/app/components/common/input/textarea/textarea.component.html
+++ b/src-ui/src/app/components/common/input/textarea/textarea.component.html
@@ -23,7 +23,7 @@
          rows="4">
        </textarea>
        @if (hint) {
-          <small class="form-text text-muted" [innerHTML]="hint"></small>
+          <small class="form-text text-muted" [innerHTML]="hint | safeHtml"></small>
        }
        <div class="invalid-feedback position-absolute top-100">
          {{error}}
--- a/src-ui/src/app/components/common/input/textarea/textarea.component.ts
+++ b/src-ui/src/app/components/common/input/textarea/textarea.component.ts
@@ -5,6 +5,7 @@ import {
  ReactiveFormsModule,
 } from '@angular/forms'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { AbstractInputComponent } from '../abstract-input'

@Component({
@@ -18,7 +19,12 @@ import { AbstractInputComponent } from '../abstract-input'
  selector: 'pngx-input-textarea',
  templateUrl: './textarea.component.html',
  styleUrls: ['./textarea.component.scss'],
-  imports: [FormsModule, ReactiveFormsModule, NgxBootstrapIconsModule],
+  imports: [
+    FormsModule,
+    ReactiveFormsModule,
+    SafeHtmlPipe,
+    NgxBootstrapIconsModule,
+  ],
 })
 export class TextAreaComponent extends AbstractInputComponent<string> {
  @Input()
--- a/src-ui/src/app/components/common/input/url/url.component.html
+++ b/src-ui/src/app/components/common/input/url/url.component.html
@@ -19,7 +19,7 @@
        </div>
      </div>
      @if (hint) {
-        <small class="form-text text-muted" [innerHTML]="hint"></small>
+        <small class="form-text text-muted" [innerHTML]="hint | safeHtml"></small>
      }
    </div>
  </div>
--- a/src-ui/src/app/components/common/permissions-dialog/permissions-dialog.component.spec.ts
+++ b/src-ui/src/app/components/common/permissions-dialog/permissions-dialog.component.spec.ts
@@ -5,6 +5,7 @@ import { FormsModule, ReactiveFormsModule } from '@angular/forms'
 import { NgbActiveModal, NgbModule } from '@ng-bootstrap/ng-bootstrap'
 import { NgSelectModule } from '@ng-select/ng-select'
 import { of } from 'rxjs'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { UserService } from 'src/app/services/rest/user.service'
 import { PermissionsFormComponent } from '../input/permissions/permissions-form/permissions-form.component'
 import { PermissionsGroupComponent } from '../input/permissions/permissions-group/permissions-group.component'
@@ -40,6 +41,7 @@ describe('PermissionsDialogComponent', () => {
        ReactiveFormsModule,
        NgbModule,
        PermissionsDialogComponent,
+        SafeHtmlPipe,
        SelectComponent,
        SwitchComponent,
        PermissionsFormComponent,
--- a/src-ui/src/app/components/common/preview-popup/preview-popup.component.html
+++ b/src-ui/src/app/components/common/preview-popup/preview-popup.component.html
@@ -14,7 +14,7 @@
        @if (previewText) {
          <div class="bg-light p-3 overflow-auto whitespace-preserve" width="100%">{{previewText}}</div>
        } @else {
-          <object [data]="previewUrl | safeUrl" width="100%" class="bg-light" [class.p-2]="!isPdf"></object>
+          <object [data]="previewURL | safeUrl" width="100%" class="bg-light" [class.p-2]="!isPdf"></object>
        }
      } @else {
        @if (requiresPassword) {
@@ -24,7 +24,7 @@
        }
        @if (!requiresPassword) {
          <pdf-viewer
-            [src]="previewUrl"
+            [src]="previewURL"
            [original-size]="false"
            [show-borders]="false"
            [show-all]="true"
--- a/src-ui/src/app/components/common/preview-popup/preview-popup.component.ts
+++ b/src-ui/src/app/components/common/preview-popup/preview-popup.component.ts
@@ -71,7 +71,7 @@ export class PreviewPopupComponent implements OnDestroy {
    return (this.isPdf && this.useNativePdfViewer) || !this.isPdf
  }

-  get previewUrl() {
+  get previewURL() {
    return this.documentService.getPreviewUrl(this.document.id)
  }

@@ -93,7 +93,7 @@ export class PreviewPopupComponent implements OnDestroy {
  init() {
    if (this.document.mime_type?.includes('text')) {
      this.http
-        .get(this.previewUrl, { responseType: 'text' })
+        .get(this.previewURL, { responseType: 'text' })
        .pipe(first(), takeUntil(this.unsubscribeNotifier))
        .subscribe({
          next: (res) => {
@@ -126,6 +126,10 @@ export class PreviewPopupComponent implements OnDestroy {
    }
  }

+  get previewUrl() {
+    return this.documentService.getPreviewUrl(this.document.id)
+  }
+
  mouseEnterPreview() {
    this.mouseOnPreview = true
    if (!this.popover.isOpen()) {
--- a/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.html
+++ b/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.html
@@ -110,9 +110,7 @@
                      <div class="visually-hidden" i18n>Loading...</div>
                    } @else if (totpSettings) {
                      <figure class="figure">
-                        @if (qrSvgDataUrl) {
-                          <img class="bg-white d-inline-block" [src]="qrSvgDataUrl" alt="Authenticator QR code">
-                        }
+                        <div class="bg-white d-inline-block" [innerHTML]="totpSettings.qr_svg | safeHtml"></div>
                        <figcaption class="figure-caption text-end mt-2" i18n>Scan the QR code with your authenticator app and then enter the code below</figcaption>
                      </figure>
                      <p>
--- a/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.ts
+++ b/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.ts
@@ -18,6 +18,7 @@ import {
  SocialAccountProvider,
  TotpSettings,
 } from 'src/app/data/user-profile'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { ProfileService } from 'src/app/services/profile.service'
 import { ToastService } from 'src/app/services/toast.service'
 import { setLocationHref } from 'src/app/utils/navigation'
@@ -36,6 +37,7 @@ import { TextComponent } from '../input/text/text.component'
    PasswordComponent,
    FormsModule,
    ReactiveFormsModule,
+    SafeHtmlPipe,
    NgbAccordionModule,
    NgbPopoverModule,
    NgxBootstrapIconsModule,
@@ -87,13 +89,6 @@ export class ProfileEditDialogComponent
  public socialAccounts: SocialAccount[] = []
  public socialAccountProviders: SocialAccountProvider[] = []

-  get qrSvgDataUrl(): string | null {
-    if (!this.totpSettings?.qr_svg) {
-      return null
-    }
-    return `data:image/svg+xml;utf8,${encodeURIComponent(this.totpSettings.qr_svg)}`
-  }
-
  ngOnInit(): void {
    this.networkActive = true
    this.profileService
@@ -188,7 +183,6 @@ export class ProfileEditDialogComponent
      this.newPassword && this.currentPassword !== this.newPassword
    const profile = Object.assign({}, this.form.value)
    delete profile.totp_code
-    this.error = null
    this.networkActive = true
    this.profileService
      .update(profile)
@@ -210,7 +204,6 @@ export class ProfileEditDialogComponent
        },
        error: (error) => {
          this.toastService.showError($localize`Error saving profile`, error)
-          this.error = error?.error
          this.networkActive = false
        },
      })
--- a/src-ui/src/app/components/document-detail/document-detail.component.html
+++ b/src-ui/src/app/components/document-detail/document-detail.component.html
@@ -65,12 +65,6 @@
      <button ngbDropdownItem (click)="editPdf()" [disabled]="!userIsOwner || !userCanEdit || originalContentRenderType !== ContentRenderType.PDF">
        <i-bs name="pencil"></i-bs>&nbsp;<ng-container i18n>PDF Editor</ng-container>
      </button>
-
-      @if (userIsOwner && (requiresPassword || password)) {
-        <button ngbDropdownItem (click)="removePassword()" [disabled]="!password">
-          <i-bs name="unlock"></i-bs>&nbsp;<ng-container i18n>Remove Password</ng-container>
-        </button>
-      }
    </div>
  </div>

@@ -385,7 +379,7 @@
 <ng-template #previewContent>
  <div class="thumb-preview position-absolute pe-none text-center" [class.fade]="previewLoaded">
    @if (showThumbnailOverlay) {
-      <img [src]="thumbUrl" class="mx-auto" [attr.width]="previewZoomScale === 'page-fit' ? 'auto' : '100%'" [attr.height]="previewZoomScale === 'page-fit' ? '100%' : 'auto'" alt="Document loading..." i18n-alt />
+      <img [src]="thumbUrl | safeUrl" class="mx-auto" [attr.width]="previewZoomScale === 'page-fit' ? 'auto' : '100%'" [attr.height]="previewZoomScale === 'page-fit' ? '100%' : 'auto'" alt="Document loading..." i18n-alt />
    }
    <div class="position-absolute top-0 start-0 m-2 p-2 d-flex align-items-center justify-content-center">
      <div>
@@ -420,7 +414,7 @@
      }
      @case (ContentRenderType.Image) {
        <div class="preview-sticky">
-          <img [src]="previewUrl" width="100%" height="100%" alt="{{title}}" />
+          <img [src]="previewUrl | safeUrl" width="100%" height="100%" alt="{{title}}" />
        </div>
      }
      @case (ContentRenderType.TIFF) {
--- a/src-ui/src/app/components/document-detail/document-detail.component.spec.ts
+++ b/src-ui/src/app/components/document-detail/document-detail.component.spec.ts
@@ -66,7 +66,6 @@ import { SettingsService } from 'src/app/services/settings.service'
 import { ToastService } from 'src/app/services/toast.service'
 import { environment } from 'src/environments/environment'
 import { ConfirmDialogComponent } from '../common/confirm-dialog/confirm-dialog.component'
-import { PasswordRemovalConfirmDialogComponent } from '../common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component'
 import { CustomFieldsDropdownComponent } from '../common/custom-fields-dropdown/custom-fields-dropdown.component'
 import {
  DocumentDetailComponent,
@@ -1210,88 +1209,6 @@ describe('DocumentDetailComponent', () => {
    expect(closeSpy).toHaveBeenCalled()
  })

-  it('should support removing password protection from pdfs', () => {
-    let modal: NgbModalRef
-    modalService.activeInstances.subscribe((m) => (modal = m[0]))
-    initNormally()
-    component.password = 'secret'
-    component.removePassword()
-    const dialog =
-      modal.componentInstance as PasswordRemovalConfirmDialogComponent
-    dialog.updateDocument = false
-    dialog.includeMetadata = false
-    dialog.deleteOriginal = true
-    dialog.confirm()
-    const req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/bulk_edit/`
-    )
-    expect(req.request.body).toEqual({
-      documents: [doc.id],
-      method: 'remove_password',
-      parameters: {
-        password: 'secret',
-        update_document: false,
-        include_metadata: false,
-        delete_original: true,
-      },
-    })
-    req.flush(true)
-  })
-
-  it('should require the current password before removing it', () => {
-    initNormally()
-    const errorSpy = jest.spyOn(toastService, 'showError')
-    component.requiresPassword = true
-    component.password = ''
-
-    component.removePassword()
-
-    expect(errorSpy).toHaveBeenCalled()
-    httpTestingController.expectNone(
-      `${environment.apiBaseUrl}documents/bulk_edit/`
-    )
-  })
-
-  it('should handle failures when removing password protection', () => {
-    let modal: NgbModalRef
-    modalService.activeInstances.subscribe((m) => (modal = m[0]))
-    initNormally()
-    const errorSpy = jest.spyOn(toastService, 'showError')
-    component.password = 'secret'
-
-    component.removePassword()
-    const dialog =
-      modal.componentInstance as PasswordRemovalConfirmDialogComponent
-    dialog.confirm()
-    const req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/bulk_edit/`
-    )
-    req.error(new ErrorEvent('failed'))
-
-    expect(errorSpy).toHaveBeenCalled()
-    expect(component.networkActive).toBe(false)
-    expect(dialog.buttonsEnabled).toBe(true)
-  })
-
-  it('should refresh the document when removing password in update mode', () => {
-    let modal: NgbModalRef
-    modalService.activeInstances.subscribe((m) => (modal = m[0]))
-    const refreshSpy = jest.spyOn(openDocumentsService, 'refreshDocument')
-    initNormally()
-    component.password = 'secret'
-
-    component.removePassword()
-    const dialog =
-      modal.componentInstance as PasswordRemovalConfirmDialogComponent
-    dialog.confirm()
-    const req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/bulk_edit/`
-    )
-    req.flush(true)
-
-    expect(refreshSpy).toHaveBeenCalledWith(doc.id)
-  })
-
  it('should support keyboard shortcuts', () => {
    initNormally()

--- a/src-ui/src/app/components/document-detail/document-detail.component.ts
+++ b/src-ui/src/app/components/document-detail/document-detail.component.ts
@@ -83,7 +83,6 @@ import { getFilenameFromContentDisposition } from 'src/app/utils/http'
 import { ISODateAdapter } from 'src/app/utils/ngb-iso-date-adapter'
 import * as UTIF from 'utif'
 import { ConfirmDialogComponent } from '../common/confirm-dialog/confirm-dialog.component'
-import { PasswordRemovalConfirmDialogComponent } from '../common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component'
 import { CustomFieldsDropdownComponent } from '../common/custom-fields-dropdown/custom-fields-dropdown.component'
 import { CorrespondentEditDialogComponent } from '../common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component'
 import { DocumentTypeEditDialogComponent } from '../common/edit-dialog/document-type-edit-dialog/document-type-edit-dialog.component'
@@ -176,7 +175,6 @@ export enum ZoomSetting {
    NgxBootstrapIconsModule,
    PdfViewerModule,
    TextAreaComponent,
-    PasswordRemovalConfirmDialogComponent,
  ],
 })
 export class DocumentDetailComponent
@@ -1430,63 +1428,6 @@ export class DocumentDetailComponent
      })
  }

-  removePassword() {
-    if (this.requiresPassword || !this.password) {
-      this.toastService.showError(
-        $localize`Please enter the current password before attempting to remove it.`
-      )
-      return
-    }
-    const modal = this.modalService.open(
-      PasswordRemovalConfirmDialogComponent,
-      {
-        backdrop: 'static',
-      }
-    )
-    modal.componentInstance.title = $localize`Remove password protection`
-    modal.componentInstance.message = $localize`Create an unprotected copy or replace the existing file.`
-    modal.componentInstance.btnCaption = $localize`Start`
-
-    modal.componentInstance.confirmClicked
-      .pipe(takeUntil(this.unsubscribeNotifier))
-      .subscribe(() => {
-        const dialog =
-          modal.componentInstance as PasswordRemovalConfirmDialogComponent
-        dialog.buttonsEnabled = false
-        this.networkActive = true
-        this.documentsService
-          .bulkEdit([this.document.id], 'remove_password', {
-            password: this.password,
-            update_document: dialog.updateDocument,
-            include_metadata: dialog.includeMetadata,
-            delete_original: dialog.deleteOriginal,
-          })
-          .pipe(first(), takeUntil(this.unsubscribeNotifier))
-          .subscribe({
-            next: () => {
-              this.toastService.showInfo(
-                $localize`Password removal operation for "${this.document.title}" will begin in the background.`
-              )
-              this.networkActive = false
-              modal.close()
-              if (!dialog.updateDocument && dialog.deleteOriginal) {
-                this.openDocumentService.closeDocument(this.document)
-              } else if (dialog.updateDocument) {
-                this.openDocumentService.refreshDocument(this.documentId)
-              }
-            },
-            error: (error) => {
-              dialog.buttonsEnabled = true
-              this.networkActive = false
-              this.toastService.showError(
-                $localize`Error executing password removal operation`,
-                error
-              )
-            },
-          })
-      })
-  }
-
  printDocument() {
    const printUrl = this.documentsService.getDownloadUrl(
      this.document.id,
--- a/src-ui/src/app/components/document-list/document-list.component.html
+++ b/src-ui/src/app/components/document-list/document-list.component.html
@@ -15,7 +15,7 @@
  </div>
  <div class="d-none d-sm-flex flex-fill me-3">
    <div class="input-group input-group-sm">
-      <span class="input-group-text border-0" i18n>Select:</span>
+      <span class="input-group-text border-0">Select:</span>
    </div>
    <div class="btn-group btn-group-sm flex-nowrap">
      @if (list.selected.size > 0) {
--- a/src-ui/src/app/components/document-list/document-list.component.spec.ts
+++ b/src-ui/src/app/components/document-list/document-list.component.spec.ts
@@ -36,6 +36,7 @@ import { PermissionsGuard } from 'src/app/guards/permissions.guard'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
 import { DocumentTitlePipe } from 'src/app/pipes/document-title.pipe'
 import { FilterPipe } from 'src/app/pipes/filter.pipe'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { UsernamePipe } from 'src/app/pipes/username.pipe'
 import { DocumentListViewService } from 'src/app/services/document-list-view.service'
 import { PermissionsService } from 'src/app/services/permissions.service'
@@ -102,6 +103,7 @@ describe('DocumentListComponent', () => {
        DatePipe,
        DocumentTitlePipe,
        UsernamePipe,
+        SafeHtmlPipe,
        PermissionsGuard,
        provideHttpClient(withInterceptorsFromDi()),
        provideHttpClientTesting(),
--- a/src-ui/src/app/components/document-list/filter-editor/filter-editor.component.ts
+++ b/src-ui/src/app/components/document-list/filter-editor/filter-editor.component.ts
@@ -173,22 +173,6 @@ const RELATIVE_DATE_QUERYSTRINGS = [
    relativeDate: RelativeDate.YESTERDAY,
    dateQuery: 'yesterday',
  },
-  {
-    relativeDate: RelativeDate.PREVIOUS_WEEK,
-    dateQuery: 'previous week',
-  },
-  {
-    relativeDate: RelativeDate.PREVIOUS_MONTH,
-    dateQuery: 'previous month',
-  },
-  {
-    relativeDate: RelativeDate.PREVIOUS_QUARTER,
-    dateQuery: 'previous quarter',
-  },
-  {
-    relativeDate: RelativeDate.PREVIOUS_YEAR,
-    dateQuery: 'previous year',
-  },
 ]

 const DEFAULT_TEXT_FILTER_TARGET_OPTIONS = [
@@ -416,9 +400,6 @@ export class FilterEditorComponent

  @Input()
  set filterRules(value: FilterRule[]) {
-    if (value === this._filterRules) {
-      return
-    }
    this._filterRules = value

    this.documentTypeSelectionModel.clear(false)
@@ -766,7 +747,7 @@ export class FilterEditorComponent
    ) {
      filterRules.push({
        rule_type: FILTER_TITLE_CONTENT,
-        value: this._textFilter.trim(),
+        value: this._textFilter,
      })
    }
    if (this._textFilter && this.textFilterTarget == TEXT_FILTER_TARGET_TITLE) {
@@ -824,7 +805,7 @@ export class FilterEditorComponent
    ) {
      filterRules.push({
        rule_type: FILTER_FULLTEXT_QUERY,
-        value: this._textFilter.trim(),
+        value: this._textFilter,
      })
    }
    if (
@@ -1117,13 +1098,7 @@ export class FilterEditorComponent
  rulesModified: boolean = false

  updateRules() {
-    const updatedRules = this.filterRules
-    this._filterRules = updatedRules
-    this.rulesModified = filterRulesDiffer(
-      this._unmodifiedFilterRules,
-      updatedRules
-    )
-    this.filterRulesChange.next(updatedRules)
+    this.filterRulesChange.next(this.filterRules)
  }

  get textFilter() {
--- a/src-ui/src/app/components/manage/mail/mail.component.spec.ts
+++ b/src-ui/src/app/components/manage/mail/mail.component.spec.ts
@@ -23,6 +23,7 @@ import { IfOwnerDirective } from 'src/app/directives/if-owner.directive'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { PermissionsGuard } from 'src/app/guards/permissions.guard'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { PermissionsService } from 'src/app/services/permissions.service'
 import { MailAccountService } from 'src/app/services/rest/mail-account.service'
 import { MailRuleService } from 'src/app/services/rest/mail-rule.service'
@@ -83,6 +84,7 @@ describe('MailComponent', () => {
        CustomDatePipe,
        ConfirmDialogComponent,
        CheckComponent,
+        SafeHtmlPipe,
        SelectComponent,
        TextComponent,
        PasswordComponent,
--- a/src-ui/src/app/components/manage/management-list/management-list.component.html
+++ b/src-ui/src/app/components/manage/management-list/management-list.component.html
@@ -94,14 +94,8 @@
    <td scope="row">{{ getDocumentCount(object) }}</td>
    @for (column of extraColumns; track column) {
      <td scope="row" [ngClass]="{ 'd-none d-sm-table-cell' : column.hideOnMobile }">
-        @if (column.badgeFn) {
-          <span
-            class="badge"
-            [style.color]="column.badgeFn.call(null, object)?.textColor"
-            [style.backgroundColor]="column.badgeFn.call(null, object)?.backgroundColor"
-          >
-            {{ column.badgeFn.call(null, object)?.text }}
-          </span>
+        @if (column.rendersHtml) {
+          <div [innerHtml]="column.valueFn.call(null, object) | safeHtml"></div>
        } @else if (column.monospace) {
          <span class="font-monospace">{{ column.valueFn.call(null, object) }}</span>
        } @else {
--- a/src-ui/src/app/components/manage/management-list/management-list.component.spec.ts
+++ b/src-ui/src/app/components/manage/management-list/management-list.component.spec.ts
@@ -33,6 +33,7 @@ import { Tag } from 'src/app/data/tag'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { SortableDirective } from 'src/app/directives/sortable.directive'
 import { PermissionsGuard } from 'src/app/guards/permissions.guard'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { DocumentListViewService } from 'src/app/services/document-list-view.service'
 import {
  PermissionAction,
@@ -92,6 +93,7 @@ describe('ManagementListComponent', () => {
        SortableDirective,
        PageHeaderComponent,
        IfPermissionsDirective,
+        SafeHtmlPipe,
        ConfirmDialogComponent,
        PermissionsDialogComponent,
      ],
--- a/src-ui/src/app/components/manage/management-list/management-list.component.ts
+++ b/src-ui/src/app/components/manage/management-list/management-list.component.ts
@@ -48,13 +48,9 @@ export interface ManagementListColumn {

  name: string

-  valueFn?: any
+  valueFn: any

-  badgeFn?: (object: any) => {
-    text: string
-    textColor?: string
-    backgroundColor?: string
-  }
+  rendersHtml?: boolean

  hideOnMobile?: boolean

--- a/src-ui/src/app/components/manage/storage-path-list/storage-path-list.component.spec.ts
+++ b/src-ui/src/app/components/manage/storage-path-list/storage-path-list.component.spec.ts
@@ -9,6 +9,7 @@ import { of } from 'rxjs'
 import { StoragePath } from 'src/app/data/storage-path'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { SortableDirective } from 'src/app/directives/sortable.directive'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { StoragePathService } from 'src/app/services/rest/storage-path.service'
 import { PageHeaderComponent } from '../../common/page-header/page-header.component'
 import { StoragePathListComponent } from './storage-path-list.component'
@@ -29,6 +30,7 @@ describe('StoragePathListComponent', () => {
        SortableDirective,
        PageHeaderComponent,
        IfPermissionsDirective,
+        SafeHtmlPipe,
      ],
      providers: [
        DatePipe,
--- a/src-ui/src/app/components/manage/storage-path-list/storage-path-list.component.ts
+++ b/src-ui/src/app/components/manage/storage-path-list/storage-path-list.component.ts
@@ -10,6 +10,7 @@ import { FILTER_HAS_STORAGE_PATH_ANY } from 'src/app/data/filter-rule-type'
 import { StoragePath } from 'src/app/data/storage-path'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { SortableDirective } from 'src/app/directives/sortable.directive'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { PermissionType } from 'src/app/services/permissions.service'
 import { StoragePathService } from 'src/app/services/rest/storage-path.service'
 import { StoragePathEditDialogComponent } from '../../common/edit-dialog/storage-path-edit-dialog/storage-path-edit-dialog.component'
@@ -25,6 +26,7 @@ import { ManagementListComponent } from '../management-list/management-list.comp
    PageHeaderComponent,
    TitleCasePipe,
    IfPermissionsDirective,
+    SafeHtmlPipe,
    FormsModule,
    ReactiveFormsModule,
    NgClass,
--- a/src-ui/src/app/components/manage/tag-list/tag-list.component.spec.ts
+++ b/src-ui/src/app/components/manage/tag-list/tag-list.component.spec.ts
@@ -8,6 +8,7 @@ import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
 import { of } from 'rxjs'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { SortableDirective } from 'src/app/directives/sortable.directive'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { TagService } from 'src/app/services/rest/tag.service'
 import { PageHeaderComponent } from '../../common/page-header/page-header.component'
 import { TagListComponent } from './tag-list.component'
@@ -29,6 +30,7 @@ describe('TagListComponent', () => {
        SortableDirective,
        PageHeaderComponent,
        IfPermissionsDirective,
+        SafeHtmlPipe,
      ],
      providers: [
        DatePipe,
--- a/src-ui/src/app/components/manage/tag-list/tag-list.component.ts
+++ b/src-ui/src/app/components/manage/tag-list/tag-list.component.ts
@@ -10,6 +10,7 @@ import { FILTER_HAS_TAGS_ALL } from 'src/app/data/filter-rule-type'
 import { Tag } from 'src/app/data/tag'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { SortableDirective } from 'src/app/directives/sortable.directive'
+import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { PermissionType } from 'src/app/services/permissions.service'
 import { TagService } from 'src/app/services/rest/tag.service'
 import { TagEditDialogComponent } from '../../common/edit-dialog/tag-edit-dialog/tag-edit-dialog.component'
@@ -25,6 +26,7 @@ import { ManagementListComponent } from '../management-list/management-list.comp
    PageHeaderComponent,
    TitleCasePipe,
    IfPermissionsDirective,
+    SafeHtmlPipe,
    FormsModule,
    ReactiveFormsModule,
    NgClass,
@@ -47,11 +49,10 @@ export class TagListComponent extends ManagementListComponent<Tag> {
      {
        key: 'color',
        name: $localize`Color`,
-        badgeFn: (t: Tag) => ({
-          text: t.color,
-          textColor: t.text_color,
-          backgroundColor: t.color,
-        }),
+        rendersHtml: true,
+        valueFn: (t: Tag) => {
+          return `<span class="badge" style="color: ${t.text_color}; background-color: ${t.color}">${t.color}</span>`
+        },
      },
    ]
  }
--- a/src-ui/src/app/data/workflow-action.ts
+++ b/src-ui/src/app/data/workflow-action.ts
@@ -5,7 +5,6 @@ export enum WorkflowActionType {
  Removal = 2,
  Email = 3,
  Webhook = 4,
-  PasswordRemoval = 5,
 }

 export interface WorkflowActionEmail extends ObjectWithId {
@@ -98,6 +97,4 @@ export interface WorkflowAction extends ObjectWithId {
  email?: WorkflowActionEmail

  webhook?: WorkflowActionWebhook
-
-  passwords?: string
 }
--- a/src-ui/src/app/pipes/safehtml.pipe.spec.ts
+++ b/src-ui/src/app/pipes/safehtml.pipe.spec.ts
@@ -0,0 +1,24 @@
+import { TestBed } from '@angular/core/testing'
+import { BrowserModule, DomSanitizer } from '@angular/platform-browser'
+import { SafeHtmlPipe } from './safehtml.pipe'
+
+describe('SafeHtmlPipe', () => {
+  let pipe: SafeHtmlPipe
+
+  beforeEach(() => {
+    TestBed.configureTestingModule({
+      providers: [SafeHtmlPipe],
+      imports: [BrowserModule],
+    })
+    pipe = TestBed.inject(SafeHtmlPipe)
+  })
+
+  it('should bypass security and trust the url', () => {
+    const html = '<div>some content</div>'
+    const domSanitizer = TestBed.inject(DomSanitizer)
+    const sanitizerSpy = jest.spyOn(domSanitizer, 'bypassSecurityTrustHtml')
+    let safeHtml = pipe.transform(html)
+    expect(safeHtml).not.toBeNull()
+    expect(sanitizerSpy).toHaveBeenCalled()
+  })
+})
--- a/src-ui/src/app/pipes/safehtml.pipe.ts
+++ b/src-ui/src/app/pipes/safehtml.pipe.ts
@@ -0,0 +1,13 @@
+import { Pipe, PipeTransform, inject } from '@angular/core'
+import { DomSanitizer } from '@angular/platform-browser'
+
+@Pipe({
+  name: 'safeHtml',
+})
+export class SafeHtmlPipe implements PipeTransform {
+  private sanitizer = inject(DomSanitizer)
+
+  transform(html) {
+    return this.sanitizer.bypassSecurityTrustHtml(html)
+  }
+}
--- a/src-ui/src/app/pipes/safeurl.pipe.spec.ts
+++ b/src-ui/src/app/pipes/safeurl.pipe.spec.ts
@@ -13,45 +13,20 @@ describe('SafeUrlPipe', () => {
    pipe = TestBed.inject(SafeUrlPipe)
  })

-  it('should trust only same-origin http/https urls', () => {
-    const origin = window.location.origin
-    const url = `${origin}/some/path`
+  it('should bypass security and trust the url', () => {
+    const url = 'https://example.com'
    const domSanitizer = TestBed.inject(DomSanitizer)
    const sanitizerSpy = jest.spyOn(
      domSanitizer,
      'bypassSecurityTrustResourceUrl'
    )

-    const safeResourceUrl = pipe.transform(url)
+    let safeResourceUrl = pipe.transform(url)
    expect(safeResourceUrl).not.toBeNull()
-    expect(sanitizerSpy).toHaveBeenCalledWith(url)
-  })
+    expect(sanitizerSpy).toHaveBeenCalled()

-  it('should return null for null or unsafe urls', () => {
-    const sanitizerSpy = jest.spyOn(
-      TestBed.inject(DomSanitizer),
-      'bypassSecurityTrustResourceUrl'
-    )
-
-    expect(pipe.transform(null)).toBeTruthy()
-    expect(sanitizerSpy).toHaveBeenCalledWith('')
-    expect(pipe.transform('javascript:alert(1)')).toBeTruthy()
-    expect(sanitizerSpy).toHaveBeenCalledWith('')
-    const otherOrigin =
-      window.location.origin === 'https://example.com'
-        ? 'https://evil.com'
-        : 'https://example.com'
-    expect(pipe.transform(`${otherOrigin}/file`)).toBeTruthy()
-    expect(sanitizerSpy).toHaveBeenCalledWith('')
-  })
-
-  it('should return null for malformed urls', () => {
-    const sanitizerSpy = jest.spyOn(
-      TestBed.inject(DomSanitizer),
-      'bypassSecurityTrustResourceUrl'
-    )
-
-    expect(pipe.transform('http://[invalid-url')).toBeTruthy()
-    expect(sanitizerSpy).toHaveBeenCalledWith('')
+    safeResourceUrl = pipe.transform(null)
+    expect(safeResourceUrl).not.toBeNull()
+    expect(sanitizerSpy).toHaveBeenCalled()
  })
 })
--- a/src-ui/src/app/pipes/safeurl.pipe.ts
+++ b/src-ui/src/app/pipes/safeurl.pipe.ts
@@ -1,6 +1,5 @@
 import { Pipe, PipeTransform, inject } from '@angular/core'
 import { DomSanitizer } from '@angular/platform-browser'
-import { environment } from 'src/environments/environment'

@Pipe({
  name: 'safeUrl',
@@ -8,23 +7,11 @@ import { environment } from 'src/environments/environment'
 export class SafeUrlPipe implements PipeTransform {
  private sanitizer = inject(DomSanitizer)

-  transform(url: string | null) {
-    if (!url) return this.sanitizer.bypassSecurityTrustResourceUrl('')
-    try {
-      const parsed = new URL(url, window.location.origin)
-      const allowedOrigins = new Set([
-        window.location.origin,
-        new URL(environment.apiBaseUrl).origin,
-      ])
-      const isHttp = ['http:', 'https:'].includes(parsed.protocol)
-      const originAllowed = allowedOrigins.has(parsed.origin)
-
-      if (!isHttp || !originAllowed) {
-        return this.sanitizer.bypassSecurityTrustResourceUrl('')
-      }
-      return this.sanitizer.bypassSecurityTrustResourceUrl(parsed.toString())
-    } catch {
+  transform(url) {
+    if (url == null) {
      return this.sanitizer.bypassSecurityTrustResourceUrl('')
+    } else {
+      return this.sanitizer.bypassSecurityTrustResourceUrl(url)
    }
  }
 }
--- a/src-ui/src/app/services/settings.service.ts
+++ b/src-ui/src/app/services/settings.service.ts
@@ -136,12 +136,6 @@ const LANGUAGE_OPTIONS = [
    englishName: 'Hungarian',
    dateInputFormat: 'yyyy.mm.dd',
  },
-  {
-    code: 'id-id',
-    name: $localize`Indonesian`,
-    englishName: 'Indonesian',
-    dateInputFormat: 'dd-mm-yyyy',
-  },
  {
    code: 'it-it',
    name: $localize`Italian`,
--- a/src-ui/src/app/utils/custom-field-query-element.spec.ts
+++ b/src-ui/src/app/utils/custom-field-query-element.spec.ts
@@ -1,3 +1,4 @@
+import { fakeAsync, tick } from '@angular/core/testing'
 import {
  CustomFieldQueryElementType,
  CustomFieldQueryLogicalOperator,
@@ -110,38 +111,13 @@ describe('CustomFieldQueryAtom', () => {
    expect(atom.serialize()).toEqual([1, 'operator', 'value'])
  })

-  it('should emit changed on value change immediately', () => {
+  it('should emit changed on value change after debounce', fakeAsync(() => {
    const atom = new CustomFieldQueryAtom()
    const changeSpy = jest.spyOn(atom.changed, 'next')
    atom.value = 'new value'
+    tick(1000)
    expect(changeSpy).toHaveBeenCalled()
-  })
-
-  it('should ignore duplicate array emissions', () => {
-    const atom = new CustomFieldQueryAtom()
-    atom.operator = CustomFieldQueryOperator.In
-    const changeSpy = jest.fn()
-    atom.changed.subscribe(changeSpy)
-
-    atom.value = [1, 2]
-    expect(changeSpy).toHaveBeenCalledTimes(1)
-
-    changeSpy.mockClear()
-    atom.value = [1, 2]
-    expect(changeSpy).not.toHaveBeenCalled()
-  })
-
-  it('should emit when array values differ while length matches', () => {
-    const atom = new CustomFieldQueryAtom()
-    atom.operator = CustomFieldQueryOperator.In
-    const changeSpy = jest.fn()
-    atom.changed.subscribe(changeSpy)
-
-    atom.value = [1, 2]
-    changeSpy.mockClear()
-    atom.value = [1, 3]
-    expect(changeSpy).toHaveBeenCalledTimes(1)
-  })
+  }))
 })

 describe('CustomFieldQueryExpression', () => {
--- a/src-ui/src/app/utils/custom-field-query-element.ts
+++ b/src-ui/src/app/utils/custom-field-query-element.ts
@@ -1,4 +1,4 @@
-import { Subject, distinctUntilChanged } from 'rxjs'
+import { Subject, debounceTime, distinctUntilChanged } from 'rxjs'
 import { v4 as uuidv4 } from 'uuid'
 import {
  CUSTOM_FIELD_QUERY_VALUE_TYPES_BY_OPERATOR,
@@ -110,22 +110,7 @@ export class CustomFieldQueryAtom extends CustomFieldQueryElement {

  protected override connectValueModelChanged(): void {
    this.valueModelChanged
-      .pipe(
-        distinctUntilChanged((previous, current) => {
-          if (Array.isArray(previous) && Array.isArray(current)) {
-            if (previous.length !== current.length) {
-              return false
-            }
-            for (let i = 0; i < previous.length; i++) {
-              if (previous[i] !== current[i]) {
-                return false
-              }
-            }
-            return true
-          }
-          return previous === current
-        })
-      )
+      .pipe(debounceTime(1000), distinctUntilChanged())
      .subscribe(() => {
        this.changed.next(this)
      })
--- a/src-ui/src/environments/environment.prod.ts
+++ b/src-ui/src/environments/environment.prod.ts
@@ -6,7 +6,7 @@ export const environment = {
  apiVersion: '9', // match src/paperless/settings.py
  appTitle: 'Paperless-ngx',
  tag: 'prod',
-  version: '2.20.3',
+  version: '2.19.3',
  webSocketHost: window.location.host,
  webSocketProtocol: window.location.protocol == 'https:' ? 'wss:' : 'ws:',
  webSocketBaseUrl: base_url.pathname + 'ws/',
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
shamoon	32bdf11f7f	Merge branch 'dev' into feature-remote-ocr-2	2025-11-02 08:14:04 -08:00
shamoon	0627ca69f5	Merge branch 'dev' into feature-remote-ocr-2	2025-10-29 11:13:53 -07:00
shamoon	f5525bbdff	Merge branch 'dev' into feature-remote-ocr-2	2025-10-27 21:22:42 -07:00
shamoon	a21a2a41a8	Merge branch 'dev' into feature-remote-ocr-2	2025-10-26 07:41:51 -07:00
shamoon	cc73ed8b86	Merge branch 'dev' into feature-remote-ocr-2	2025-10-24 16:48:07 -07:00
shamoon	0c706b2316	Merge branch 'dev' into feature-remote-ocr-2	2025-10-23 16:38:35 -07:00
shamoon	85b7b6874d	Merge branch 'dev' into feature-remote-ocr-2	2025-10-22 21:53:07 -07:00
shamoon	56b26185fa	Merge branch 'dev' into feature-remote-ocr-2	2025-10-21 08:23:20 -07:00
shamoon	6537fade7b	Merge branch 'dev' into feature-remote-ocr-2	2025-10-15 16:04:02 -07:00
shamoon	9f8090816f	Merge branch 'dev' into feature-remote-ocr-2	2025-10-09 12:54:58 -07:00
shamoon	1de7c52478	Merge branch 'dev' into feature-remote-ocr-2	2025-10-01 19:24:38 -07:00
shamoon	9aaaa6f069	Merge branch 'dev' into feature-remote-ocr-2	2025-09-30 09:14:56 -07:00
shamoon	c3a20b7797	Merge branch 'dev' into feature-remote-ocr-2	2025-09-28 15:06:37 -07:00
shamoon	476556379b	Merge branch 'dev' into feature-remote-ocr-2	2025-09-24 13:46:49 -07:00
shamoon	e5cafff043	Merge branch 'dev' into feature-remote-ocr-2	2025-09-22 13:42:55 -07:00
shamoon	8e0d574e99	Merge branch 'dev' into feature-remote-ocr-2	2025-09-21 16:18:13 -07:00
shamoon	8a5820328e	Sonar suggestions	2025-09-17 19:18:47 -07:00
shamoon	809d62a2f4	Merge branch 'dev' into feature-remote-ocr-2	2025-09-17 16:51:23 -07:00
shamoon	0d87f94b9b	Merge branch 'dev' into feature-remote-ocr-2	2025-09-14 14:01:35 -07:00
shamoon	315b90f8e5	Add typing to assertContainsStrings test util	2025-09-11 13:56:14 -07:00
shamoon	47b2d2964b	Use regular testcase instead of django, config check test	2025-09-11 13:52:10 -07:00
shamoon	e05639ae4e	tempdir already a path	2025-09-11 13:49:30 -07:00
shamoon	f400a8cb2f	Close client	2025-09-11 13:49:06 -07:00
shamoon	26abcf5612	Also ensure API key is set	2025-09-11 13:48:06 -07:00
shamoon	afde52430d	Merge branch 'dev' into feature-remote-ocr-2	2025-09-11 13:25:53 -07:00
shamoon	716f2da652	Merge branch 'dev' into feature-remote-ocr-2	2025-09-08 11:36:49 -07:00
shamoon	c54073b7c2	Merge branch 'dev' into feature-remote-ocr-2	2025-09-04 09:16:59 -07:00
shamoon	247e6f39dc	Merge branch 'dev' into feature-remote-ocr-2	2025-09-01 20:10:40 -07:00
shamoon	1e6dfc4481	Merge branch 'dev' into feature-remote-ocr-2	2025-08-26 13:30:39 -07:00
shamoon	7cc0750066	Add note on costs and limitations for Azure OCR	2025-08-24 05:47:07 -07:00
shamoon	bd6585d3b4	Merge branch 'dev' into feature-remote-ocr-2	2025-08-22 08:54:26 -07:00
shamoon	717e828a1d	Merge branch 'dev' into feature-remote-ocr-2	2025-08-17 21:25:14 -07:00
shamoon	07381d48e6	Merge branch 'dev' into feature-remote-ocr-2	2025-08-17 07:49:58 -07:00
shamoon	dd0ffaf312	Merge branch 'dev' into feature-remote-ocr-2	2025-08-11 10:48:36 -07:00
shamoon	264504affc	Fix consumer declaration file extensions	2025-08-10 05:32:52 -07:00
shamoon	4feedf2add	Merge branch 'dev' into feature-remote-ocr-2	2025-08-06 16:04:25 -04:00
shamoon	2f76cf9831	Merge branch 'dev' into feature-remote-ocr-2	2025-08-01 23:55:49 -04:00
shamoon	1002d37f6b	Update test_parser.py	2025-07-09 11:05:37 -07:00
shamoon	d260a94740	Update parsers.py	2025-07-09 11:02:57 -07:00
shamoon	88c69b83ea	Update index.md	2025-07-09 11:00:12 -07:00
shamoon	2557ee2014	Update docs to mention remote OCR with Azure AI	2025-07-09 09:53:30 -07:00
shamoon	3c75deed80	Add paperless_remote tests to testpaths	2025-07-08 14:19:45 -07:00
shamoon	d05343c927	Test fixes / coverage	2025-07-08 14:19:45 -07:00
shamoon	e7972b7eaf	Coverage	2025-07-08 14:19:45 -07:00
shamoon	75a091cc0d	Fix test	2025-07-08 14:19:44 -07:00
shamoon	dca74803fd	Use output_content_format poller.result to get clean content	2025-07-08 14:19:44 -07:00
shamoon	3cf3d868d0	Some docs	2025-07-08 14:19:43 -07:00
shamoon	bf4fc6604a	Test	2025-07-08 14:19:43 -07:00
shamoon	e8c1eb86fa	This actually works [ci skip]	2025-07-08 14:19:43 -07:00
shamoon	c3dad3cf69	Basic parse	2025-07-08 14:19:42 -07:00
shamoon	811bd66088	Ok, restart implementing this with just azure [ci skip]	2025-07-08 14:19:42 -07:00