Updates to the Trixie base image instead of Bookworm

Chore(deps): Bump django-cors-headers from 4.8.0 to 4.9.0 (#10907 )
Bumps [django-cors-headers](https://github.com/adamchainz/django-cors-headers) from 4.8.0 to 4.9.0. - [Changelog](https://github.com/adamchainz/django-cors-headers/blob/main/CHANGELOG.rst) - [Commits](https://github.com/adamchainz/django-cors-headers/compare/4.8.0...4.9.0) --- updated-dependencies: - dependency-name: django-cors-headers dependency-version: 4.9.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-28 03:46:06 -05:00 · 2025-09-26 13:01:19 -07:00 · 2025-09-26 12:21:18 -07:00 · 2025-09-26 18:42:28 +00:00 · 2025-09-26 10:01:31 -07:00 · 2025-09-25 00:45:36 -07:00
8 changed files with 704 additions and 683 deletions
--- a/.github/workflows/build-and-release.yml
+++ b/.github/workflows/build-and-release.yml
@@ -1,430 +0,0 @@
-name: 'Build and Release'
-on:
-  workflow_run:
-    workflows:
-      - ci
-    types:
-      - completed
-permissions:
-  contents: write
-  packages: write
-  pull-requests: write
-env:
-  DEFAULT_UV_VERSION: "0.8.x"
-  DEFAULT_PYTHON_VERSION: "3.11"
-  NLTK_DATA: "/usr/share/nltk_data"
-jobs:
-  prepare:
-    if: >-
-      github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push'
-    name: Prepare build context
-    runs-on: ubuntu-24.04
-    outputs:
-      should-build: ${{ steps.determine.outputs.should-build }}
-      ref: ${{ steps.determine.outputs.ref }}
-      ref-name: ${{ steps.determine.outputs.ref-name }}
-      sha: ${{ steps.determine.outputs.sha }}
-      is-tag: ${{ steps.determine.outputs.is-tag }}
-      is-release-target: ${{ steps.determine.outputs.is-release-target }}
-      is-beta-rc: ${{ steps.determine.outputs.is-beta-rc }}
-    steps:
-      - name: Determine ref information
-        id: determine
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const run = context.payload.workflow_run;
-            const owner = context.repo.owner;
-            const repo = context.repo.repo;
-            const sha = run.head_sha;
-            const branch = run.head_branch;
-
-            let ref = undefined;
-            let refName = undefined;
-
-            if (branch) {
-              ref = `refs/heads/${branch}`;
-              refName = branch;
-            } else {
-              const iterator = github.paginate.iterator(
-                github.rest.repos.listTags,
-                {
-                  owner,
-                  repo,
-                  per_page: 100,
-                },
-              );
-
-              for await (const { data } of iterator) {
-                const match = data.find((tag) => tag.commit?.sha === sha);
-                if (match) {
-                  ref = `refs/tags/${match.name}`;
-                  refName = match.name;
-                  break;
-                }
-              }
-            }
-
-            const outputs = {
-              shouldBuild: false,
-              ref: ref ?? '',
-              refName: refName ?? '',
-              sha,
-              isTag: ref?.startsWith('refs/tags/') ?? false,
-              isReleaseTarget: false,
-              isBetaRc: false,
-            };
-
-            if (!ref || !refName) {
-              core.info('No matching ref found for workflow run; skipping post-CI workflow.');
-            } else {
-              const allowed =
-                ref.startsWith('refs/heads/feature-') ||
-                ref.startsWith('refs/heads/fix-') ||
-                ref.startsWith('refs/heads/l10n_') ||
-                ref === 'refs/heads/dev' ||
-                ref === 'refs/heads/beta' ||
-                ref.includes('beta.rc') ||
-                ref.startsWith('refs/tags/v');
-
-              const isBetaRc = refName.includes('beta.rc');
-              const isReleaseTarget = outputs.isTag && (refName.startsWith('v') || isBetaRc);
-
-              outputs.shouldBuild = allowed;
-              outputs.isReleaseTarget = isReleaseTarget;
-              outputs.isBetaRc = isBetaRc;
-            }
-
-            core.setOutput('should-build', outputs.shouldBuild ? 'true' : 'false');
-            core.setOutput('ref', outputs.ref);
-            core.setOutput('ref-name', outputs.refName);
-            core.setOutput('sha', outputs.sha);
-            core.setOutput('is-tag', outputs.isTag ? 'true' : 'false');
-            core.setOutput('is-release-target', outputs.isReleaseTarget ? 'true' : 'false');
-            core.setOutput('is-beta-rc', outputs.isBetaRc ? 'true' : 'false');
-  build-docker-image:
-    needs: prepare
-    if: needs.prepare.outputs.should-build == 'true'
-    name: Build Docker image for ${{ needs.prepare.outputs.ref-name }}
-    runs-on: ubuntu-24.04
-    concurrency:
-      group: ${{ github.workflow }}-build-docker-image-${{ needs.prepare.outputs.ref-name || needs.prepare.outputs.sha }}
-      cancel-in-progress: true
-    env:
-      REF: ${{ needs.prepare.outputs.ref }}
-      REF_NAME: ${{ needs.prepare.outputs.ref-name }}
-      SHA: ${{ needs.prepare.outputs.sha }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          ref: ${{ env.SHA }}
-      - name: Check pushing to Docker Hub
-        id: push-other-places
-        env:
-          REPOSITORY_OWNER: ${{ github.repository_owner }}
-          REF_NAME: ${{ env.REF_NAME }}
-          REF: ${{ env.REF }}
-        run: |
-          if [[ "$REPOSITORY_OWNER" == "paperless-ngx" ]] && \
-             ([[ "$REF_NAME" == "dev" ]] || [[ "$REF_NAME" == "beta" ]] || [[ "$REF" == refs/tags/v* ]]); then
-            echo "Enabling DockerHub image push"
-            echo "enable=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "Not pushing to DockerHub"
-            echo "enable=false" >> "$GITHUB_OUTPUT"
-          fi
-      - name: Set ghcr repository name
-        id: set-ghcr-repository
-        run: |
-          ghcr_name=$(echo "${{ github.repository }}" | awk '{ print tolower($0) }')
-          echo "Name is ${ghcr_name}"
-          echo "ghcr-repository=${ghcr_name}" >> "$GITHUB_OUTPUT"
-      - name: Gather Docker metadata
-        id: docker-meta
-        uses: docker/metadata-action@v5
-        env:
-          GITHUB_REF: ${{ env.REF }}
-          GITHUB_REF_NAME: ${{ env.REF_NAME }}
-          GITHUB_SHA: ${{ env.SHA }}
-        with:
-          images: |
-            ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}
-            name=paperlessngx/paperless-ngx,enable=${{ steps.push-other-places.outputs.enable }}
-            name=quay.io/paperlessngx/paperless-ngx,enable=${{ steps.push-other-places.outputs.enable }}
-          tags: |
-            type=ref,event=branch
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-        with:
-          platforms: arm64
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Login to Docker Hub
-        if: steps.push-other-places.outputs.enable == 'true'
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Login to Quay.io
-        if: steps.push-other-places.outputs.enable == 'true'
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_USERNAME }}
-          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./Dockerfile
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.docker-meta.outputs.tags }}
-          labels: ${{ steps.docker-meta.outputs.labels }}
-          build-args: |
-            PNGX_TAG_VERSION=${{ steps.docker-meta.outputs.version }}
-          cache-from: |
-            type=registry,ref=ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}/builder/cache/app:${{ env.REF_NAME }}
-            type=registry,ref=ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}/builder/cache/app:dev
-          cache-to: |
-            type=registry,mode=max,ref=ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}/builder/cache/app:${{ env.REF_NAME }}
-      - name: Inspect image
-        run: |
-          docker buildx imagetools inspect ${{ fromJSON(steps.docker-meta.outputs.json).tags[0] }}
-      - name: Export frontend artifact from docker
-        run: |
-          docker create --name frontend-extract ${{ fromJSON(steps.docker-meta.outputs.json).tags[0] }}
-          docker cp frontend-extract:/usr/src/paperless/src/documents/static/frontend src/documents/static/frontend/
-      - name: Upload frontend artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: frontend-compiled
-          path: src/documents/static/frontend/
-          retention-days: 7
-  build-release:
-    needs:
-      - prepare
-      - build-docker-image
-    if: needs.prepare.outputs.should-build == 'true'
-    name: Build release bundle
-    runs-on: ubuntu-24.04
-    env:
-      REF_NAME: ${{ needs.prepare.outputs.ref-name }}
-      SHA: ${{ needs.prepare.outputs.sha }}
-      CI_RUN_ID: ${{ github.event.workflow_run.id }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          ref: ${{ env.SHA }}
-      - name: Set up Python
-        id: setup-python
-        uses: actions/setup-python@v5
-        with:
-          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
-      - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: ${{ env.DEFAULT_UV_VERSION }}
-          enable-cache: true
-          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
-      - name: Install Python dependencies
-        run: |
-          uv sync --python ${{ steps.setup-python.outputs.python-version }} --dev --frozen
-      - name: Install system dependencies
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -qq --no-install-recommends gettext liblept5
-      - name: Download frontend artifact
-        uses: actions/download-artifact@v5
-        with:
-          name: frontend-compiled
-          path: src/documents/static/frontend/
-      - name: Download documentation artifact
-        uses: actions/download-artifact@v5
-        with:
-          name: documentation
-          path: docs/_build/html/
-          run-id: ${{ env.CI_RUN_ID }}
-      - name: Generate requirements file
-        run: |
-          uv export --quiet --no-dev --all-extras --format requirements-txt --output-file requirements.txt
-      - name: Compile messages
-        run: |
-          cd src/
-          uv run \
-            --python ${{ steps.setup-python.outputs.python-version }} \
-            manage.py compilemessages
-      - name: Collect static files
-        run: |
-          cd src/
-          uv run \
-            --python ${{ steps.setup-python.outputs.python-version }} \
-            manage.py collectstatic --no-input
-      - name: Move files
-        run: |
-          echo "Making dist folders"
-          for directory in dist \
-                          dist/paperless-ngx \
-                          dist/paperless-ngx/scripts;
-          do
-            mkdir --verbose --parents ${directory}
-          done
-
-          echo "Copying basic files"
-          for file_name in .dockerignore \
-                          .env \
-                          Dockerfile \
-                          pyproject.toml \
-                          uv.lock \
-                          requirements.txt \
-                          LICENSE \
-                          README.md \
-                          paperless.conf.example
-          do
-            cp --verbose ${file_name} dist/paperless-ngx/
-          done
-          mv --verbose dist/paperless-ngx/paperless.conf.example dist/paperless-ngx/paperless.conf
-
-          echo "Copying Docker related files"
-          cp --recursive docker/ dist/paperless-ngx/docker
-
-          echo "Copying startup scripts"
-          cp --verbose scripts/*.service scripts/*.sh scripts/*.socket dist/paperless-ngx/scripts/
-
-          echo "Copying source files"
-          cp --recursive src/ dist/paperless-ngx/src
-          echo "Copying documentation"
-          cp --recursive docs/_build/html/ dist/paperless-ngx/docs
-
-          mv --verbose static dist/paperless-ngx
-      - name: Make release package
-        run: |
-          echo "Creating release archive"
-          cd dist
-          sudo chown -R 1000:1000 paperless-ngx/
-          tar -cJf paperless-ngx.tar.xz paperless-ngx/
-      - name: Upload release artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: release
-          path: dist/paperless-ngx.tar.xz
-          retention-days: 7
-  publish-release:
-    needs:
-      - prepare
-      - build-release
-    if: needs.prepare.outputs.is-release-target == 'true'
-    name: Publish release
-    runs-on: ubuntu-24.04
-    outputs:
-      prerelease: ${{ steps.get_version.outputs.prerelease }}
-      changelog: ${{ steps.create-release.outputs.body }}
-      version: ${{ steps.get_version.outputs.version }}
-    steps:
-      - name: Download release artifact
-        uses: actions/download-artifact@v5
-        with:
-          name: release
-          path: ./
-      - name: Get version
-        id: get_version
-        run: |
-          echo "version=${{ needs.prepare.outputs.ref-name }}" >> "$GITHUB_OUTPUT"
-          if [[ ${{ needs.prepare.outputs.is-beta-rc }} == 'true' ]]; then
-            echo "prerelease=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "prerelease=false" >> "$GITHUB_OUTPUT"
-          fi
-      - name: Create Release and Changelog
-        id: create-release
-        uses: release-drafter/release-drafter@v6
-        with:
-          name: Paperless-ngx ${{ steps.get_version.outputs.version }}
-          tag: ${{ steps.get_version.outputs.version }}
-          version: ${{ steps.get_version.outputs.version }}
-          prerelease: ${{ steps.get_version.outputs.prerelease }}
-          publish: true
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Upload release archive
-        id: upload-release-asset
-        uses: shogo82148/actions-upload-release-asset@v1
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          upload_url: ${{ steps.create-release.outputs.upload_url }}
-          asset_path: ./paperless-ngx.tar.xz
-          asset_name: paperless-ngx-${{ steps.get_version.outputs.version }}.tar.xz
-          asset_content_type: application/x-xz
-  append-changelog:
-    needs:
-      - publish-release
-    if: needs.publish-release.outputs.prerelease == 'false'
-    name: Append changelog to docs
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          ref: main
-      - name: Set up Python
-        id: setup-python
-        uses: actions/setup-python@v5
-        with:
-          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
-      - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: ${{ env.DEFAULT_UV_VERSION }}
-          enable-cache: true
-          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
-      - name: Append Changelog to docs
-        id: append-Changelog
-        working-directory: docs
-        run: |
-          git branch ${{ needs.publish-release.outputs.version }}-changelog
-          git checkout ${{ needs.publish-release.outputs.version }}-changelog
-          echo -e "# Changelog\n\n${{ needs.publish-release.outputs.changelog }}\n" > changelog-new.md
-          echo "Manually linking usernames"
-          sed -i -r 's|@([a-zA-Z0-9_]+) \(\[#|[@\1](https://github.com/\1) ([#|g' changelog-new.md
-          echo "Removing unneeded comment tags"
-          sed -i -r 's|@<!---->|@|g' changelog-new.md
-          CURRENT_CHANGELOG=`tail --lines +2 changelog.md`
-          echo -e "$CURRENT_CHANGELOG" >> changelog-new.md
-          mv changelog-new.md changelog.md
-          uv run \
-            --python ${{ steps.setup-python.outputs.python-version }} \
-            --dev \
-            pre-commit run --files changelog.md || true
-          git config --global user.name "github-actions"
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git commit -am "Changelog ${{ needs.publish-release.outputs.version }} - GHA"
-          git push origin ${{ needs.publish-release.outputs.version }}-changelog
-      - name: Create Pull Request
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const { repo, owner } = context.repo;
-            const result = await github.rest.pulls.create({
-              title: 'Documentation: Add ${{ needs.publish-release.outputs.version }} changelog',
-              owner,
-              repo,
-              head: '${{ needs.publish-release.outputs.version }}-changelog',
-              base: 'main',
-              body: 'This PR is auto-generated by CI.'
-            });
-            github.rest.issues.addLabels({
-              owner,
-              repo,
-              issue_number: result.data.number,
-              labels: ['documentation', 'skip-changelog']
-            });
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,11 +17,52 @@ env:
  DEFAULT_PYTHON_VERSION: "3.11"
  NLTK_DATA: "/usr/share/nltk_data"
 jobs:
+  detect-duplicate:
+    name: Detect Duplicate Run
+    runs-on: ubuntu-24.04
+    outputs:
+      should_run: ${{ steps.check.outputs.should_run }}
+    steps:
+      - name: Check if workflow should run
+        id: check
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            if (context.eventName !== 'push') {
+              core.info('Not a push event; running workflow.');
+              core.setOutput('should_run', 'true');
+              return;
+            }
+
+            const ref = context.ref || '';
+            if (!ref.startsWith('refs/heads/')) {
+              core.info('Push is not to a branch; running workflow.');
+              core.setOutput('should_run', 'true');
+              return;
+            }
+
+            const branch = ref.substring('refs/heads/'.length);
+            const { owner, repo } = context.repo;
+            const prs = await github.paginate(github.rest.pulls.list, {
+              owner,
+              repo,
+              state: 'open',
+              head: `${owner}:${branch}`,
+              per_page: 100,
+            });
+
+            if (prs.length === 0) {
+              core.info(`No open PR found for ${branch}; running workflow.`);
+              core.setOutput('should_run', 'true');
+            } else {
+              core.info(`Found ${prs.length} open PR(s) for ${branch}; skipping duplicate push run.`);
+              core.setOutput('should_run', 'false');
+            }
  pre-commit:
-    # We want to run on external PRs, but not on our own internal PRs as they'll be run
-    # by the push to the branch. Without this if check, checks are duplicated since
-    # internal PRs match both the push and pull_request events.
-    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
+    needs:
+      - detect-duplicate
+    if: needs.detect-duplicate.outputs.should_run == 'true'
    name: Linting Checks
    runs-on: ubuntu-24.04
    steps:
@@ -142,13 +183,11 @@ jobs:
        if: always()
        uses: codecov/test-results-action@v1
        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
          flags: backend-python-${{ matrix.python-version }}
          files: junit.xml
      - name: Upload backend coverage to Codecov
        uses: codecov/codecov-action@v5
        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
          flags: backend-python-${{ matrix.python-version }}
          files: coverage.xml
      - name: Stop containers
@@ -224,13 +263,11 @@ jobs:
        uses: codecov/test-results-action@v1
        if: always()
        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
          flags: frontend-node-${{ matrix.node-version }}
          directory: src-ui/
      - name: Upload frontend coverage to Codecov
        uses: codecov/codecov-action@v5
        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
          flags: frontend-node-${{ matrix.node-version }}
          directory: src-ui/coverage/
  tests-frontend-e2e:
@@ -313,3 +350,324 @@ jobs:
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        run: cd src-ui && pnpm run build --configuration=production
+  build-docker-image:
+    name: Build Docker image for ${{ github.ref_name }}
+    runs-on: ubuntu-24.04
+    if: github.event_name == 'push' && (startsWith(github.ref, 'refs/heads/feature-') || startsWith(github.ref, 'refs/heads/fix-') || github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/beta' || contains(github.ref, 'beta.rc') || startsWith(github.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/heads/l10n_'))
+    concurrency:
+      group: ${{ github.workflow }}-build-docker-image-${{ github.ref_name }}
+      cancel-in-progress: true
+    needs:
+      - tests-backend
+      - tests-frontend
+      - tests-frontend-e2e
+    steps:
+      - name: Check pushing to Docker Hub
+        id: push-other-places
+        # Only push to Dockerhub from the main repo AND the ref is either:
+        #  main
+        #  dev
+        #  beta
+        #  a tag
+        # Otherwise forks would require a Docker Hub account and secrets setup
+        run: |
+          if [[ ${{ github.repository_owner }} == "paperless-ngx" && ( ${{ github.ref_name }} == "dev" || ${{ github.ref_name }} == "beta" || ${{ startsWith(github.ref, 'refs/tags/v') }} == "true" ) ]] ; then
+            echo "Enabling DockerHub image push"
+            echo "enable=true" >> $GITHUB_OUTPUT
+          else
+            echo "Not pushing to DockerHub"
+            echo "enable=false" >> $GITHUB_OUTPUT
+          fi
+      - name: Set ghcr repository name
+        id: set-ghcr-repository
+        run: |
+          ghcr_name=$(echo "${{ github.repository }}" | awk '{ print tolower($0) }')
+          echo "Name is ${ghcr_name}"
+          echo "ghcr-repository=${ghcr_name}" >> $GITHUB_OUTPUT
+      - name: Gather Docker metadata
+        id: docker-meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}
+            name=paperlessngx/paperless-ngx,enable=${{ steps.push-other-places.outputs.enable }}
+            name=quay.io/paperlessngx/paperless-ngx,enable=${{ steps.push-other-places.outputs.enable }}
+          tags: |
+            # Tag branches with branch name
+            type=ref,event=branch
+            # Process semver tags
+            # For a tag x.y.z or vX.Y.Z, output an x.y.z and x.y image tag
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+      - name: Checkout
+        uses: actions/checkout@v5
+      # If https://github.com/docker/buildx/issues/1044 is resolved,
+      # the append input with a native arm64 arch could be used to
+      # significantly speed up building
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: arm64
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        # Don't attempt to login if not pushing to Docker Hub
+        if: steps.push-other-places.outputs.enable == 'true'
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to Quay.io
+        uses: docker/login-action@v3
+        # Don't attempt to login if not pushing to Quay.io
+        if: steps.push-other-places.outputs.enable == 'true'
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_USERNAME }}
+          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.docker-meta.outputs.tags }}
+          labels: ${{ steps.docker-meta.outputs.labels }}
+          build-args: |
+            PNGX_TAG_VERSION=${{ steps.docker-meta.outputs.version }}
+          # Get cache layers from this branch, then dev
+          # This allows new branches to get at least some cache benefits, generally from dev
+          cache-from: |
+            type=registry,ref=ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}/builder/cache/app:${{ github.ref_name }}
+            type=registry,ref=ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}/builder/cache/app:dev
+          cache-to: |
+            type=registry,mode=max,ref=ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}/builder/cache/app:${{ github.ref_name }}
+      - name: Inspect image
+        run: |
+          docker buildx imagetools inspect ${{ fromJSON(steps.docker-meta.outputs.json).tags[0] }}
+      - name: Export frontend artifact from docker
+        run: |
+          docker create --name frontend-extract ${{ fromJSON(steps.docker-meta.outputs.json).tags[0] }}
+          docker cp frontend-extract:/usr/src/paperless/src/documents/static/frontend src/documents/static/frontend/
+      - name: Upload frontend artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: frontend-compiled
+          path: src/documents/static/frontend/
+          retention-days: 7
+  build-release:
+    name: "Build Release"
+    needs:
+      - build-docker-image
+      - documentation
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+      - name: Set up Python
+        id: setup-python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          version: ${{ env.DEFAULT_UV_VERSION }}
+          enable-cache: true
+          python-version: ${{ steps.setup-python.outputs.python-version }}
+      - name: Install Python dependencies
+        run: |
+          uv sync --python ${{ steps.setup-python.outputs.python-version }} --dev --frozen
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -qq --no-install-recommends gettext liblept5
+      - name: Download frontend artifact
+        uses: actions/download-artifact@v5
+        with:
+          name: frontend-compiled
+          path: src/documents/static/frontend/
+      - name: Download documentation artifact
+        uses: actions/download-artifact@v5
+        with:
+          name: documentation
+          path: docs/_build/html/
+      - name: Generate requirements file
+        run: |
+          uv export --quiet --no-dev --all-extras --format requirements-txt --output-file requirements.txt
+      - name: Compile messages
+        run: |
+          cd src/
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            manage.py compilemessages
+      - name: Collect static files
+        run: |
+          cd src/
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            manage.py collectstatic --no-input
+      - name: Move files
+        run: |
+          echo "Making dist folders"
+          for directory in dist \
+                          dist/paperless-ngx \
+                          dist/paperless-ngx/scripts;
+          do
+            mkdir --verbose --parents ${directory}
+          done
+
+          echo "Copying basic files"
+          for file_name in .dockerignore \
+                          .env \
+                          Dockerfile \
+                          pyproject.toml \
+                          uv.lock \
+                          requirements.txt \
+                          LICENSE \
+                          README.md \
+                          paperless.conf.example
+          do
+            cp --verbose ${file_name} dist/paperless-ngx/
+          done
+          mv --verbose dist/paperless-ngx/paperless.conf.example dist/paperless-ngx/paperless.conf
+
+          echo "Copying Docker related files"
+          cp --recursive docker/ dist/paperless-ngx/docker
+
+          echo "Copying startup scripts"
+          cp --verbose scripts/*.service scripts/*.sh scripts/*.socket dist/paperless-ngx/scripts/
+
+          echo "Copying source files"
+          cp --recursive src/ dist/paperless-ngx/src
+          echo "Copying documentation"
+          cp --recursive docs/_build/html/ dist/paperless-ngx/docs
+
+          mv --verbose static dist/paperless-ngx
+      - name: Make release package
+        run: |
+          echo "Creating release archive"
+          cd dist
+          sudo chown -R 1000:1000 paperless-ngx/
+          tar -cJf paperless-ngx.tar.xz paperless-ngx/
+      - name: Upload release artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: release
+          path: dist/paperless-ngx.tar.xz
+          retention-days: 7
+  publish-release:
+    name: "Publish Release"
+    runs-on: ubuntu-24.04
+    outputs:
+      prerelease: ${{ steps.get_version.outputs.prerelease }}
+      changelog: ${{ steps.create-release.outputs.body }}
+      version: ${{ steps.get_version.outputs.version }}
+    needs:
+      - build-release
+    if: github.ref_type == 'tag' && (startsWith(github.ref_name, 'v') || contains(github.ref_name, '-beta.rc'))
+    steps:
+      - name: Download release artifact
+        uses: actions/download-artifact@v5
+        with:
+          name: release
+          path: ./
+      - name: Get version
+        id: get_version
+        run: |
+          echo "version=${{ github.ref_name }}" >> $GITHUB_OUTPUT
+          if [[ ${{ contains(github.ref_name, '-beta.rc') }} == 'true' ]]; then
+            echo "prerelease=true" >> $GITHUB_OUTPUT
+          else
+            echo "prerelease=false" >> $GITHUB_OUTPUT
+          fi
+      - name: Create Release and Changelog
+        id: create-release
+        uses: release-drafter/release-drafter@v6
+        with:
+          name: Paperless-ngx ${{ steps.get_version.outputs.version }}
+          tag: ${{ steps.get_version.outputs.version }}
+          version: ${{ steps.get_version.outputs.version }}
+          prerelease: ${{ steps.get_version.outputs.prerelease }}
+          publish: true # ensures release is not marked as draft
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Upload release archive
+        id: upload-release-asset
+        uses: shogo82148/actions-upload-release-asset@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          upload_url: ${{ steps.create-release.outputs.upload_url }}
+          asset_path: ./paperless-ngx.tar.xz
+          asset_name: paperless-ngx-${{ steps.get_version.outputs.version }}.tar.xz
+          asset_content_type: application/x-xz
+  append-changelog:
+    name: "Append Changelog"
+    runs-on: ubuntu-24.04
+    needs:
+      - publish-release
+    if: needs.publish-release.outputs.prerelease == 'false'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          ref: main
+      - name: Set up Python
+        id: setup-python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          version: ${{ env.DEFAULT_UV_VERSION }}
+          enable-cache: true
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
+      - name: Append Changelog to docs
+        id: append-Changelog
+        working-directory: docs
+        run: |
+          git branch ${{ needs.publish-release.outputs.version }}-changelog
+          git checkout ${{ needs.publish-release.outputs.version }}-changelog
+          echo -e "# Changelog\n\n${{ needs.publish-release.outputs.changelog }}\n" > changelog-new.md
+          echo "Manually linking usernames"
+          sed -i -r 's|@([a-zA-Z0-9_]+) \(\[#|[@\1](https://github.com/\1) ([#|g' changelog-new.md
+          echo "Removing unneeded comment tags"
+          sed -i -r 's|@<!---->|@|g' changelog-new.md
+          CURRENT_CHANGELOG=`tail --lines +2 changelog.md`
+          echo -e "$CURRENT_CHANGELOG" >> changelog-new.md
+          mv changelog-new.md changelog.md
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            --dev \
+            pre-commit run --files changelog.md || true
+          git config --global user.name "github-actions"
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git commit -am "Changelog ${{ needs.publish-release.outputs.version }} - GHA"
+          git push origin ${{ needs.publish-release.outputs.version }}-changelog
+      - name: Create Pull Request
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { repo, owner } = context.repo;
+            const result = await github.rest.pulls.create({
+              title: 'Documentation: Add ${{ needs.publish-release.outputs.version }} changelog',
+              owner,
+              repo,
+              head: '${{ needs.publish-release.outputs.version }}-changelog',
+              base: 'main',
+              body: 'This PR is auto-generated by CI.'
+            });
+            github.rest.issues.addLabels({
+              owner,
+              repo,
+              issue_number: result.data.number,
+              labels: ['documentation', 'skip-changelog']
+            });
--- a/.github/workflows/codecov-comment.yml
+++ b/.github/workflows/codecov-comment.yml
@@ -1,220 +0,0 @@
-name: Codecov PR Comment
-on:
-  workflow_run:
-    workflows:
-      - ci
-    types:
-      - completed
-permissions:
-  contents: read
-  pull-requests: write
-jobs:
-  comment:
-    if: >-
-      github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Gather pull request context
-        id: pr
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const run = context.payload.workflow_run;
-            if (!run.pull_requests || run.pull_requests.length === 0) {
-              core.info('No associated pull request. Skipping.');
-              return { shouldRun: false };
-            }
-
-            const pr = run.pull_requests[0];
-            return {
-              shouldRun: true,
-              prNumber: pr.number,
-              headSha: run.head_sha,
-            };
-      - name: Fetch Codecov coverage
-        id: coverage
-        if: steps.pr.outputs.shouldRun == 'true'
-        uses: actions/github-script@v7
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-          COMMIT_SHA: ${{ steps.pr.outputs.headSha }}
-        with:
-          script: |
-            const token = process.env.CODECOV_TOKEN;
-            if (!token) {
-              core.warning('CODECOV_TOKEN secret is not available; skipping comment.');
-              core.setOutput('shouldComment', 'false');
-              return;
-            }
-
-            const commitSha = process.env.COMMIT_SHA;
-            const owner = context.repo.owner;
-            const repo = context.repo.repo;
-            const url = `https://codecov.io/api/v2/github/${owner}/repos/${repo}/commits/${commitSha}/report`;
-            const maxAttempts = 10;
-            const waitMs = 15000;
-            const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-
-            let data;
-            for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-              core.info(`Fetching Codecov report (attempt ${attempt}/${maxAttempts})`);
-              const response = await fetch(url, {
-                headers: {
-                  Authorization: `Bearer ${token}`,
-                  'Content-Type': 'application/json',
-                  Accept: 'application/json',
-                },
-              });
-
-              if (response.status === 404) {
-                core.info('Report not ready yet (404). Waiting before retrying.');
-                await sleep(waitMs);
-                continue;
-              }
-
-              if (!response.ok) {
-                const text = await response.text();
-                throw new Error(`Codecov API returned ${response.status}: ${text}`);
-              }
-
-              data = await response.json();
-              if (data && Object.keys(data).length > 0) {
-                break;
-              }
-
-              core.info('Report payload empty. Waiting before retrying.');
-              await sleep(waitMs);
-            }
-
-            if (!data) {
-              core.warning('Unable to retrieve Codecov report after multiple attempts.');
-              core.setOutput('shouldComment', 'false');
-              return;
-            }
-
-            const totals = data.report?.totals ?? data.commit?.totals ?? data.totals;
-            if (!totals) {
-              core.warning('Codecov response does not contain coverage totals.');
-              core.setOutput('shouldComment', 'false');
-              return;
-            }
-
-            const compareTotals = data.report?.compare?.totals ?? data.compare?.totals;
-            const flagsRaw = data.report?.totals_by_flag ?? data.report?.components ?? [];
-
-            const toNumber = (value) => {
-              if (value === null || value === undefined || value === '') {
-                return undefined;
-              }
-              const num = Number(value);
-              return Number.isFinite(num) ? num : undefined;
-            };
-
-            const coverage = toNumber(totals.coverage);
-            const baseCoverage = toNumber(compareTotals?.base_coverage ?? compareTotals?.base);
-            const delta = toNumber(
-              compareTotals?.coverage_change ??
-              compareTotals?.coverage_diff ??
-              totals.delta ??
-              totals.diff ??
-              totals.change,
-            );
-
-            const formatPercent = (value) => {
-              if (value === undefined) return '—';
-              return `${value.toFixed(2)}%`;
-            };
-
-            const formatDelta = (value) => {
-              if (value === undefined) return '—';
-              const sign = value >= 0 ? '+' : '';
-              return `${sign}${value.toFixed(2)}%`;
-            };
-
-            const shortSha = commitSha.slice(0, 7);
-            const lines = [
-              '<!-- codecov-coverage-comment -->',
-              '**Codecov Coverage**',
-              '',
-              `- Head \`${shortSha}\`: ${formatPercent(coverage)}`,
-            ];
-
-            if (baseCoverage !== undefined) {
-              lines.push(`- Base: ${formatPercent(baseCoverage)}`);
-            }
-
-            if (delta !== undefined) {
-              lines.push(`- Change: ${formatDelta(delta)}`);
-            }
-
-            const flagEntries = Array.isArray(flagsRaw)
-              ? flagsRaw
-              : Object.entries(flagsRaw).map(([name, totals]) => ({ name, totals }));
-
-            const flagRows = [];
-            for (const entry of flagEntries) {
-              const label = entry.flag ?? entry.name ?? entry.component ?? entry.id;
-              const entryTotals = entry.totals ?? entry;
-              const entryCoverage = toNumber(entryTotals?.coverage);
-              const entryDelta = toNumber(
-                entryTotals?.coverage_change ??
-                entryTotals?.coverage_diff ??
-                entryTotals?.delta ??
-                entryTotals?.diff,
-              );
-              if (!label || entryCoverage === undefined) {
-                continue;
-              }
-              flagRows.push(`| ${label} | ${formatPercent(entryCoverage)} | ${formatDelta(entryDelta)} |`);
-            }
-
-            if (flagRows.length) {
-              lines.push('');
-              lines.push('| Flag | Coverage | Change |');
-              lines.push('| --- | --- | --- |');
-              lines.push(...flagRows);
-            }
-
-            const commentBody = lines.join('\n');
-            const shouldComment = coverage !== undefined;
-            core.setOutput('shouldComment', shouldComment ? 'true' : 'false');
-            if (shouldComment) {
-              core.setOutput('commentBody', commentBody);
-            }
-      - name: Upsert coverage comment
-        if: steps.pr.outputs.shouldRun == 'true' && steps.coverage.outputs.shouldComment == 'true'
-        uses: actions/github-script@v7
-        env:
-          PR_NUMBER: ${{ steps.pr.outputs.prNumber }}
-          COMMENT_BODY: ${{ steps.coverage.outputs.commentBody }}
-        with:
-          script: |
-            const prNumber = Number(process.env.PR_NUMBER);
-            const body = process.env.COMMENT_BODY;
-            const marker = '<!-- codecov-coverage-comment -->';
-
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: prNumber,
-              per_page: 100,
-            });
-
-            const existing = comments.find((comment) => comment.body?.includes(marker));
-            if (existing) {
-              core.info(`Updating existing coverage comment (id: ${existing.id}).`);
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              core.info('Creating new coverage comment.');
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: prNumber,
-                body,
-              });
-            }
--- a/20
+++ b/20
@@ -5,7 +5,7 @@
 # Purpose: Compiles the frontend
 # Notes:
 #  - Does PNPM stuff with Typescript and such
-FROM --platform=$BUILDPLATFORM docker.io/node:20-bookworm-slim AS compile-frontend
+FROM --platform=$BUILDPLATFORM docker.io/node:20-trixie-slim AS compile-frontend

 COPY ./src-ui /src/src-ui

@@ -32,7 +32,7 @@ RUN set -eux \
 # Purpose: Installs s6-overlay and rootfs
 # Comments:
 #  - Don't leave anything extra in here either
-FROM ghcr.io/astral-sh/uv:0.8.17-python3.12-bookworm-slim AS s6-overlay-base
+FROM ghcr.io/astral-sh/uv:0.8.22-python3.12-bookworm-slim AS s6-overlay-base

 WORKDIR /usr/src/s6

@@ -170,20 +170,8 @@ RUN set -eux \
    && apt-get update \
    && apt-get install --yes --quiet --no-install-recommends ${RUNTIME_PACKAGES} \
    && echo "Installing pre-built updates" \
-      && curl --fail --silent --no-progress-meter --show-error --location --remote-name-all --parallel --parallel-max 4 \
-        https://github.com/paperless-ngx/builder/releases/download/qpdf-${QPDF_VERSION}/libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
-        https://github.com/paperless-ngx/builder/releases/download/qpdf-${QPDF_VERSION}/qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
-        https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
-        https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
-        https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
-        https://github.com/paperless-ngx/builder/releases/download/jbig2enc-${JBIG2ENC_VERSION}/jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
-      && echo "Installing qpdf ${QPDF_VERSION}" \
-        && dpkg --install ./libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
-        && dpkg --install ./qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
-      && echo "Installing Ghostscript ${GS_VERSION}" \
-        && dpkg --install ./libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
-        && dpkg --install ./libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
-        && dpkg --install ./ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+      && curl --fail --silent --no-progress-meter --show-error --location --remote-name-all \
+        https://github.com/paperless-ngx/builder/releases/download/jbig2enc-v${JBIG2ENC_VERSION}/jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
      && echo "Installing jbig2enc" \
        && dpkg --install ./jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
      && echo "Configuring imagemagick" \
--- a/dev.txt
+++ b/dev.txt
@@ -0,0 +1,319 @@
+adduser 3.134
+apt 2.6.1
+base-files 12.4+deb12u11
+base-passwd 3.6.1
+bash 5.2.15-2+b8
+bsdutils 1:2.38.1-5+deb12u3
+ca-certificates 20230311+deb12u1
+coreutils 9.1-1
+curl 7.88.1-10+deb12u12
+dash 0.5.12-2
+debconf 1.5.82
+debian-archive-keyring 2023.3+deb12u2
+debianutils 5.7-0.5~deb12u1
+diffutils 1:3.8-4
+dirmngr 2.2.40-1.1
+dpkg 1.21.22
+e2fsprogs 1.47.0-2
+file 1:5.44-3
+findutils 4.9.0-4
+fontconfig 2.14.1-4
+fontconfig-config 2.14.1-4
+fonts-liberation 1:1.07.4-11
+fonts-urw-base35 20200910-7
+gcc-12-base 12.2.0-14+deb12u1
+gettext 0.21-12
+gettext-base 0.21-12
+ghostscript 10.03.1~dfsg-1
+gnupg 2.2.40-1.1
+gnupg-l10n 2.2.40-1.1
+gnupg-utils 2.2.40-1.1
+gosu 1.14-1+b10
+gpg 2.2.40-1.1
+gpg-agent 2.2.40-1.1
+gpg-wks-client 2.2.40-1.1
+gpg-wks-server 2.2.40-1.1
+gpgconf 2.2.40-1.1
+gpgsm 2.2.40-1.1
+gpgv 2.2.40-1.1
+grep 3.8-5
+gzip 1.12-1
+hicolor-icon-theme 0.17-2
+hostname 3.23+nmu1
+icc-profiles-free 2.0.1+dfsg-1.1
+imagemagick 8:6.9.11.60+dfsg-1.6+deb12u3
+imagemagick-6-common 8:6.9.11.60+dfsg-1.6+deb12u3
+imagemagick-6.q16 8:6.9.11.60+dfsg-1.6+deb12u3
+init-system-helpers 1.65.2
+jbig2dec 0.19-3
+jbig2enc 0.30-1
+libacl1 2.3.1-3
+libaom3 3.6.0-1+deb12u1
+libapt-pkg6.0 2.6.1
+libarchive13 3.6.2-1+deb12u2
+libassuan0 2.5.5-5
+libattr1 1:2.5.1-4
+libaudit-common 1:3.0.9-1
+libaudit1 1:3.0.9-1
+libavahi-client3 0.8-10+deb12u1
+libavahi-common-data 0.8-10+deb12u1
+libavahi-common3 0.8-10+deb12u1
+libavcodec59 7:5.1.6-0+deb12u1
+libavformat59 7:5.1.6-0+deb12u1
+libavutil57 7:5.1.6-0+deb12u1
+libblkid1 2.38.1-5+deb12u3
+libbluray2 1:1.3.4-1
+libbrotli1 1.0.9-2+b6
+libbsd0 0.11.7-2
+libbz2-1.0 1.0.8-5+b1
+libc-bin 2.36-9+deb12u10
+libc6 2.36-9+deb12u10
+libcairo-gobject2 1.16.0-7
+libcairo2 1.16.0-7
+libcap-ng0 0.8.3-1+b3
+libcap2 1:2.66-4+deb12u1
+libchromaprint1 1.5.1-2+b1
+libcjson1 1.7.15-1+deb12u2
+libcodec2-1.0 1.0.5-1
+libcom-err2 1.47.0-2
+libconfig-inifiles-perl 3.000003-2
+libcrypt1 1:4.4.33-2
+libcups2 2.4.2-3+deb12u8
+libcurl4 7.88.1-10+deb12u12
+libdatrie1 0.2.13-2+b1
+libdav1d6 1.0.0-2+deb12u1
+libdb5.3 5.3.28+dfsg2-1
+libdbus-1-3 1.14.10-1~deb12u1
+libde265-0 1.0.11-1+deb12u2
+libdebconfclient0 0.270
+libdeflate0 1.14-1
+libdrm-common 2.4.114-1
+libdrm2 2.4.114-1+b1
+libedit2 3.1-20221030-2
+libexpat1 2.5.0-1+deb12u1
+libext2fs2 1.47.0-2
+libffi8 3.4.4-1
+libfftw3-double3 3.3.10-1
+libfontconfig1 2.14.1-4
+libfontenc1 1:1.1.4-1
+libfreetype6 2.12.1+dfsg-5+deb12u4
+libfribidi0 1.0.8-2.1
+libgcc-s1 12.2.0-14+deb12u1
+libgcrypt20 1.10.1-3
+libgdbm-compat4 1.23-3
+libgdbm6 1.23-3
+libgdk-pixbuf-2.0-0 2.42.10+dfsg-1+deb12u2
+libgdk-pixbuf2.0-common 2.42.10+dfsg-1+deb12u2
+libgif7 5.2.1-2.5
+libglib2.0-0 2.74.6-2+deb12u6
+libgme0 0.6.3-6
+libgmp10 2:6.2.1+dfsg1-1.1
+libgnutls30 3.7.9-2+deb12u5
+libgomp1 12.2.0-14+deb12u1
+libgpg-error0 1.46-1
+libgraphite2-3 1.3.14-1
+libgs-common 10.0.0~dfsg-11+deb12u7
+libgs10 10.03.1~dfsg-1
+libgs10-common 10.03.1~dfsg-1
+libgsm1 1.0.22-1
+libgssapi-krb5-2 1.20.1-2+deb12u3
+libharfbuzz0b 6.0.0+dfsg-3
+libheif1 1.15.1-1+deb12u1
+libhogweed6 3.8.1-2
+libhwy1 1.0.3-3+deb12u1
+libice6 2:1.0.10-1
+libicu72 72.1-3+deb12u1
+libidn12 1.41-1
+libidn2-0 2.3.3-1+b1
+libijs-0.35 0.35-15
+libimagequant0 2.17.0-1
+libjbig0 2.1-6.1
+libjbig2dec0 0.19-3
+libjpeg62-turbo 1:2.1.5-2
+libjxl0.7 0.7.0-10+deb12u1
+libk5crypto3 1.20.1-2+deb12u3
+libkeyutils1 1.6.3-2
+libkrb5-3 1.20.1-2+deb12u3
+libkrb5support0 1.20.1-2+deb12u3
+libksba8 1.6.3-2
+liblcms2-2 2.14-2
+libldap-2.5-0 2.5.13+dfsg-5
+liblept5 1.82.0-3+b3
+liblerc4 4.0.0+ds-2
+liblqr-1-0 0.4.2-2.1
+libltdl7 2.4.7-7~deb12u1
+liblz4-1 1.9.4-1
+liblzma5 5.4.1-1
+libmagic-mgc 1:5.44-3
+libmagic1 1:5.44-3
+libmagickcore-6.q16-6 8:6.9.11.60+dfsg-1.6+deb12u3
+libmagickwand-6.q16-6 8:6.9.11.60+dfsg-1.6+deb12u3
+libmariadb3 1:10.11.11-0+deb12u1
+libmbedcrypto7 2.28.3-1
+libmd0 1.0.4-2
+libmfx1 22.5.4-1
+libmount1 2.38.1-5+deb12u3
+libmp3lame0 3.100-6
+libmpg123-0 1.31.2-1+deb12u1
+libncurses6 6.4-4
+libncursesw6 6.4-4
+libnettle8 3.8.1-2
+libnghttp2-14 1.52.0-1+deb12u2
+libnorm1 1.5.9+dfsg-2
+libnpth0 1.6-3
+libnsl2 1.3.0-2
+libnspr4 2:4.35-1
+libnss3 2:3.87.1-1+deb12u1
+libnuma1 2.0.16-1
+libogg0 1.3.5-3
+libopenjp2-7 2.5.0-2+deb12u1
+libopenmpt0 0.6.9-1
+libopus0 1.3.1-3
+libp11-kit0 0.24.1-2
+libpam-modules 1.5.2-6+deb12u1
+libpam-modules-bin 1.5.2-6+deb12u1
+libpam-runtime 1.5.2-6+deb12u1
+libpam0g 1.5.2-6+deb12u1
+libpango-1.0-0 1.50.12+ds-1
+libpangocairo-1.0-0 1.50.12+ds-1
+libpangoft2-1.0-0 1.50.12+ds-1
+libpaper1 1.1.29
+libpcre2-8-0 10.42-1
+libperl5.36 5.36.0-7+deb12u2
+libpgm-5.3-0 5.3.128~dfsg-2
+libpixman-1-0 0.42.2-1
+libpng16-16 1.6.39-2
+libpoppler126 22.12.0-2+deb12u1
+libpq5 15.13-0+deb12u1
+libpsl5 0.21.2-1
+libqpdf29 11.9.0-1
+librabbitmq4 0.11.0-1+deb12u1
+librav1e0 0.5.1-6
+libreadline8 8.2-1.3
+librist4 0.2.7+dfsg-1
+librsvg2-2 2.54.7+dfsg-1~deb12u1
+librtmp1 2.4+20151223.gitfa8646d.1-2+b2
+libsasl2-2 2.1.28+dfsg-10
+libsasl2-modules-db 2.1.28+dfsg-10
+libseccomp2 2.5.4-1+deb12u1
+libselinux1 3.4-1+b6
+libsemanage-common 3.4-1
+libsemanage2 3.4-1+b5
+libsepol2 3.4-2.1
+libshine3 3.1.1-2
+libsm6 2:1.2.3-1
+libsmartcols1 2.38.1-5+deb12u3
+libsnappy1v5 1.1.9-3
+libsodium23 1.0.18-1
+libsoxr0 0.1.3-4
+libspeex1 1.2.1-2
+libsqlite3-0 3.40.1-2+deb12u1
+libsrt1.5-gnutls 1.5.1-1+deb12u1
+libss2 1.47.0-2
+libssh-gcrypt-4 0.10.6-0+deb12u1
+libssh2-1 1.10.0-3+b1
+libssl3 3.0.17-1~deb12u1
+libstdc++6 12.2.0-14+deb12u1
+libsvtav1enc1 1.4.1+dfsg-1
+libswresample4 7:5.1.6-0+deb12u1
+libsystemd0 252.38-1~deb12u1
+libtasn1-6 4.19.0-2+deb12u1
+libtesseract5 5.3.0-2
+libthai-data 0.1.29-1
+libthai0 0.1.29-1
+libtheora0 1.1.1+dfsg.1-16.1+b1
+libtiff6 4.5.0-6+deb12u2
+libtinfo6 6.4-4
+libtirpc-common 1.3.3+ds-1
+libtirpc3 1.3.3+ds-1
+libtwolame0 0.4.0-2
+libudev1 252.38-1~deb12u1
+libudfread0 1.1.2-1
+libunistring2 1.0-2
+libuuid1 2.38.1-5+deb12u3
+libv4l-0 1.22.1-5+b2
+libv4lconvert0 1.22.1-5+b2
+libva-drm2 2.17.0-1
+libva-x11-2 2.17.0-1
+libva2 2.17.0-1
+libvdpau1 1.5-2
+libvorbis0a 1.3.7-1
+libvorbisenc2 1.3.7-1
+libvorbisfile3 1.3.7-1
+libvpx7 1.12.0-1+deb12u4
+libwebp7 1.2.4-0.2+deb12u1
+libwebpdemux2 1.2.4-0.2+deb12u1
+libwebpmux3 1.2.4-0.2+deb12u1
+libx11-6 2:1.8.4-2+deb12u2
+libx11-data 2:1.8.4-2+deb12u2
+libx11-xcb1 2:1.8.4-2+deb12u2
+libx264-164 2:0.164.3095+gitbaee400-3
+libx265-199 3.5-2+b1
+libxau6 1:1.0.9-1
+libxcb-dri3-0 1.15-1
+libxcb-render0 1.15-1
+libxcb-shm0 1.15-1
+libxcb1 1.15-1
+libxdmcp6 1:1.1.2-3
+libxext6 2:1.3.4-1+b1
+libxfixes3 1:6.0.0-2
+libxml2 2.9.14+dfsg-1.3~deb12u2
+libxrender1 1:0.9.10-1.1
+libxslt1.1 1.1.35-1+deb12u1
+libxt6 1:1.2.1-1.1
+libxvidcore4 2:1.3.7-1
+libxxhash0 0.8.1-1
+libzbar0 0.23.92-7+deb12u1
+libzmq5 4.3.4-6
+libzstd1 1.5.4+dfsg2-5
+libzvbi-common 0.2.41-1
+libzvbi0 0.2.41-1
+login 1:4.13+dfsg1-1+deb12u1
+logsave 1.47.0-2
+mariadb-client 1:10.11.11-0+deb12u1
+mariadb-client-core 1:10.11.11-0+deb12u1
+mariadb-common 1:10.11.11-0+deb12u1
+mawk 1.3.4.20200120-3.1
+media-types 10.0.0
+mount 2.38.1-5+deb12u3
+mysql-common 5.8+1.1.0
+ncurses-base 6.4-4
+ncurses-bin 6.4-4
+netbase 6.4
+ocl-icd-libopencl1 2.3.1-1
+openssl 3.0.17-1~deb12u1
+passwd 1:4.13+dfsg1-1+deb12u1
+perl 5.36.0-7+deb12u2
+perl-base 5.36.0-7+deb12u2
+perl-modules-5.36 5.36.0-7+deb12u2
+pinentry-curses 1.2.1-1
+pngquant 2.17.0-1
+poppler-data 0.4.12-1
+poppler-utils 22.12.0-2+deb12u1
+postgresql-client 15+248
+postgresql-client-15 15.13-0+deb12u1
+postgresql-client-common 248
+qpdf 11.9.0-1
+readline-common 8.2-1.3
+sed 4.9-1
+sensible-utils 0.0.17+nmu1
+shared-mime-info 2.2-1
+sysvinit-utils 3.06-4
+tar 1.34+dfsg-1.2+deb12u1
+tesseract-ocr 5.3.0-2
+tesseract-ocr-deu 1:4.1.0-2
+tesseract-ocr-eng 1:4.1.0-2
+tesseract-ocr-fra 1:4.1.0-2
+tesseract-ocr-ita 1:4.1.0-2
+tesseract-ocr-osd 1:4.1.0-2
+tesseract-ocr-spa 1:4.1.0-2
+tzdata 2025b-0+deb12u1
+ucf 3.0043+nmu1+deb12u1
+unpaper 7.0.0-0.1
+usr-is-merged 37~deb12u1
+util-linux 2.38.1-5+deb12u3
+util-linux-extra 2.38.1-5+deb12u3
+x11-common 1:7.7+23
+xfonts-encodings 1:1.0.4-2.2
+xfonts-utils 1:7.7+6
+zlib1g 1:1.2.13.dfsg-1
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -30,7 +30,7 @@ dependencies = [
  "django-cachalot~=2.8.0",
  "django-celery-results~=2.6.0",
  "django-compression-middleware~=0.5.0",
-  "django-cors-headers~=4.8.0",
+  "django-cors-headers~=4.9.0",
  "django-extensions~=4.1",
  "django-filter~=25.1",
  "django-guardian~=3.1.2",
--- a/src-ui/src/app/components/common/edit-dialog/custom-field-edit-dialog/custom-field-edit-dialog.component.ts
+++ b/src-ui/src/app/components/common/edit-dialog/custom-field-edit-dialog/custom-field-edit-dialog.component.ts
@@ -177,10 +177,16 @@ export class CustomFieldEditDialogComponent
  }

  public removeSelectOption(index: number) {
-    this.selectOptions.removeAt(index)
-    this._allSelectOptions.splice(
-      index + (this.selectOptionsPage - 1) * SELECT_OPTION_PAGE_SIZE,
-      1
+    const globalIndex =
+      index + (this.selectOptionsPage - 1) * SELECT_OPTION_PAGE_SIZE
+    this._allSelectOptions.splice(globalIndex, 1)
+
+    const totalPages = Math.max(
+      1,
+      Math.ceil(this._allSelectOptions.length / SELECT_OPTION_PAGE_SIZE)
    )
+    const targetPage = Math.min(this.selectOptionsPage, totalPages)
+
+    this.selectOptionsPage = targetPage
  }
 }
--- a/uv.lock
+++ b/uv.lock
@@ -730,15 +730,15 @@ wheels = [

 [[package]]
 name = "django-cors-headers"
-version = "4.8.0"
+version = "4.9.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "asgiref", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
    { name = "django", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/89/8e/6225441edcfe179bf4861e9e67489e33375e0b66316c8d7b9edaae863d37/django_cors_headers-4.8.0.tar.gz", hash = "sha256:0a12a2efcd59a3cea741e44db8ab589e929949de5bc4cdf35a29c6ae77297686", size = 21425, upload-time = "2025-09-08T15:58:05.34Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/21/39/55822b15b7ec87410f34cd16ce04065ff390e50f9e29f31d6d116fc80456/django_cors_headers-4.9.0.tar.gz", hash = "sha256:fe5d7cb59fdc2c8c646ce84b727ac2bca8912a247e6e68e1fb507372178e59e8", size = 21458, upload-time = "2025-09-18T10:40:52.326Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/ac/b3/29ef49d6ff7800f323f3d98cde7777b3cfdda133de8feea84cffafea4578/django_cors_headers-4.8.0-py3-none-any.whl", hash = "sha256:3b883f4c6d07848673218456a5e070d8ab51f97341c1f27d0242ca167e7272ab", size = 12804, upload-time = "2025-09-08T15:58:03.882Z" },
+    { url = "https://files.pythonhosted.org/packages/30/d8/19ed1e47badf477d17fb177c1c19b5a21da0fd2d9f093f23be3fb86c5fab/django_cors_headers-4.9.0-py3-none-any.whl", hash = "sha256:15c7f20727f90044dcee2216a9fd7303741a864865f0c3657e28b7056f61b449", size = 12809, upload-time = "2025-09-18T10:40:50.843Z" },
 ]

 [[package]]
@@ -2182,7 +2182,7 @@ requires-dist = [
    { name = "django-cachalot", specifier = "~=2.8.0" },
    { name = "django-celery-results", specifier = "~=2.6.0" },
    { name = "django-compression-middleware", specifier = "~=0.5.0" },
-    { name = "django-cors-headers", specifier = "~=4.8.0" },
+    { name = "django-cors-headers", specifier = "~=4.9.0" },
    { name = "django-extensions", specifier = "~=4.1" },
    { name = "django-filter", specifier = "~=25.1" },
    { name = "django-guardian", specifier = "~=3.1.2" },
Author	SHA1	Message	Date
Trenton Holmes	afdb5d8a4b	Updates to the Trixie base image instead of Bookworm	2025-09-26 13:01:19 -07:00
dependabot[bot]	af544177d4	Chore(deps): Bump django-cors-headers from 4.8.0 to 4.9.0 (#10907 ) Bumps [django-cors-headers](https://github.com/adamchainz/django-cors-headers) from 4.8.0 to 4.9.0. - [Changelog](https://github.com/adamchainz/django-cors-headers/blob/main/CHANGELOG.rst) - [Commits](https://github.com/adamchainz/django-cors-headers/compare/4.8.0...4.9.0) --- updated-dependencies: - dependency-name: django-cors-headers dependency-version: 4.9.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-09-26 12:21:18 -07:00
dependabot[bot]	766af6a48a	docker(deps): bump astral-sh/uv (#10906 ) Bumps [astral-sh/uv](https://github.com/astral-sh/uv) from 0.8.17-python3.12-bookworm-slim to 0.8.19-python3.12-bookworm-slim. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](https://github.com/astral-sh/uv/compare/0.8.17...0.8.19) --- updated-dependencies: - dependency-name: astral-sh/uv dependency-version: 0.8.19-python3.12-bookworm-slim dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-09-26 18:42:28 +00:00
shamoon	e985051890	Chore: remove Codecov token from CI workflow (#10941 )	2025-09-26 10:01:31 -07:00
shamoon	764ad059d1	Revert "Chore: Enable SonarQube scanning (#10904 )" (#10934 ) This reverts commit `8d1f23e9d6`.	2025-09-25 00:45:36 -07:00
shamoon	5e47069934	Fix select option removal and pagination update (#10933 )	2025-09-25 00:42:43 -07:00