Re-works the testing to resolve warnings. See about CI?

Other things depend on this
Fixes the last tests and updates settings.py
2026-01-10 21:34:20 -06:00 · 2026-01-10 15:13:27 -08:00 · 2026-01-10 15:13:27 -08:00 · 2026-01-10 15:13:27 -08:00 · 2026-01-10 15:13:25 -08:00 · 2026-01-09 20:41:09 -08:00
293 changed files with 57803 additions and 23365 deletions
--- a/.codecov.yml
+++ b/.codecov.yml
@@ -9,6 +9,15 @@ component_management:
    - component_id: frontend
      paths:
        - src-ui/**
 flags:
  backend:
    paths:
      - src/**
    carryforward: true
  frontend:
    paths:
      - src-ui/**
    carryforward: true
 # https://docs.codecov.com/docs/pull-request-comments
 comment:
  layout: "header, diff, components, flags, files"
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
-FROM --platform=$BUILDPLATFORM docker.io/node:20-bookworm-slim as main-app
+FROM --platform=$BUILDPLATFORM docker.io/node:24-trixie-slim as main-app
 ARG DEBIAN_FRONTEND=noninteractive
@@ -8,16 +8,17 @@ ARG DEBIAN_FRONTEND=noninteractive
 ARG TARGETARCH
 # Can be workflow provided, defaults set for manual building
-ARG JBIG2ENC_VERSION=0.29
+ARG JBIG2ENC_VERSION=0.30
 ARG QPDF_VERSION=11.9.0
 ARG GS_VERSION=10.03.1
 # Set Python environment variables
 ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    # Ignore warning from Whitenoise
    PYTHONWARNINGS="ignore:::django.http.response:517" \
-    PNGX_CONTAINERIZED=1
+    PNGX_CONTAINERIZED=1 \
    # https://docs.astral.sh/uv/reference/settings/#link-mode
    UV_LINK_MODE=copy \
    UV_CACHE_DIR=/cache/uv/
 #
 # Begin installation and configuration
@@ -83,37 +84,15 @@ RUN set -eux \
    && apt-get update \
    && apt-get install --yes --quiet ${PYTHON_PACKAGES}
-COPY --from=ghcr.io/astral-sh/uv:0.7.8 /uv /bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.9.10 /uv /bin/uv
 RUN set -eux \
  && echo "Installing pre-built updates" \
    && echo "Installing qpdf ${QPDF_VERSION}" \
      && curl --fail --silent --show-error --location \
        --output libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
        https://github.com/paperless-ngx/builder/releases/download/qpdf-${QPDF_VERSION}/libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
      && curl --fail --silent --show-error --location \
        --output qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
        https://github.com/paperless-ngx/builder/releases/download/qpdf-${QPDF_VERSION}/qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
      && dpkg --install ./libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
      && dpkg --install ./qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
    && echo "Installing Ghostscript ${GS_VERSION}" \
      && curl --fail --silent --show-error --location \
          --output libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
          https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
      && curl --fail --silent --show-error --location \
          --output ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
          https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
      && curl --fail --silent --show-error --location \
          --output libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
          https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
        && dpkg --install ./libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
        && dpkg --install ./libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
        && dpkg --install ./ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
    && echo "Installing jbig2enc" \
      && curl --fail --silent --show-error --location \
        --output jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
-        https://github.com/paperless-ngx/builder/releases/download/jbig2enc-${JBIG2ENC_VERSION}/jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/jbig2enc-trixie-v${JBIG2ENC_VERSION}/jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
      && dpkg --install ./jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb
 # setup docker-specific things
@@ -127,6 +106,7 @@ COPY [ \
 RUN set -eux \
  && echo "Configuring ImageMagick" \
    && mkdir -p /etc/ImageMagick-6 \
    && mv paperless-policy.xml /etc/ImageMagick-6/policy.xml
@@ -142,7 +122,7 @@ ARG BUILD_PACKAGES="\
  pkg-config"
 # hadolint ignore=DL3042
-RUN --mount=type=cache,target=/root/.cache/uv,id=pip-cache \
+RUN --mount=type=cache,target=/cache/uv/,id=uv-cache \
  set -eux \
  && echo "Installing build system packages" \
    && apt-get update \
--- a/.editorconfig
+++ b/.editorconfig
@@ -11,6 +11,10 @@ end_of_line = lf
 charset = utf-8
 max_line_length = 79
 [*.sh]
 indent_style = tab
 indent_size = 1
 [{*.html,*.css,*.js}]
 max_line_length = off
--- a/.github/DISCUSSION_TEMPLATE/support.yml
+++ b/.github/DISCUSSION_TEMPLATE/support.yml
@@ -51,5 +51,5 @@ body:
    id: logs
    attributes:
      label: Relevant logs or output
-      description: If you have logs, errors that might help, paste it here.
+      description: If you have logs, errors that might help, paste it here. For example other containers or services (database, redis, etc).
      render: bash
--- a/.github/ISSUE_TEMPLATE/bug-report.yml
+++ b/.github/ISSUE_TEMPLATE/bug-report.yml
@@ -6,8 +6,8 @@ body:
  - type: markdown
    attributes:
      value: |
-        ### ⚠️ Please remember: issues are for *bugs*
+        ### ⚠️ Please remember: issues are for *bugs* only! ⚠️
-        That is, something you believe affects every single user of Paperless-ngx, not just you. If you're not sure, start with one of the other options below.
+        That is, something you believe affects every single user of Paperless-ngx (and the demo, for example), not just you. If you are not sure, start with one of the other options below.
        Also, note that **Paperless-ngx does not perform OCR or archive file creation itself**, those are handled by other tools. Problems with OCR or archive versions of specific files should likely be raised 'upstream', see https://github.com/ocrmypdf/OCRmyPDF/issues or https://github.com/tesseract-ocr/tesseract/issues
  - type: markdown
@@ -59,6 +59,12 @@ body:
      label: Browser logs
      description: Logs from the web browser related to your issue, if needed
      render: bash
  - type: textarea
    id: logs_services
    attributes:
      label: Services logs
      description: Logs from other services (or containers) related to your issue, if needed. For example, the database or redis logs.
      render: bash
  - type: input
    id: version
    attributes:
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -35,8 +35,8 @@ NOTE: PRs that do not address the following will not be merged, please do not sk
 - [ ] I have read & agree with the [contributing guidelines](https://github.com/paperless-ngx/paperless-ngx/blob/main/CONTRIBUTING.md).
 - [ ] If applicable, I have included testing coverage for new code in this PR, for [backend](https://docs.paperless-ngx.com/development/#testing) and / or [front-end](https://docs.paperless-ngx.com/development/#testing-and-code-style) changes.
- [ ] If applicable, I have tested my code for new features & regressions on both mobile & desktop devices, using the latest version of major browsers.
+- [ ] If applicable, I have tested my code for breaking changes & regressions on both mobile & desktop devices, using the latest version of major browsers.
 - [ ] If applicable, I have checked that all tests pass, see [documentation](https://docs.paperless-ngx.com/development/#back-end-development).
 - [ ] I have run all `pre-commit` hooks, see [documentation](https://docs.paperless-ngx.com/development/#code-formatting-with-pre-commit-hooks).
 - [ ] I have made corresponding changes to the documentation as needed.
- [ ] I have checked my modifications for any breaking changes.
+- [ ] In the description of the PR above I have disclosed the use of AI tools in the coding of this PR.
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -41,30 +41,56 @@ updates:
      - "backend"
      - "dependencies"
    groups:
      # Development & CI/CD Tooling
      development:
        patterns:
          - "*pytest*"
          - "ruff"
          - "mkdocs-material"
          - "pre-commit*"
-      django:
+      # Django & DRF Ecosystem
      django-ecosystem:
        patterns:
          - "*django*"
          - "drf-*"
-      major-versions:
+          - "djangorestframework"
          - "whitenoise"
          - "bleach"
          - "jinja2"
      # Async, Task Queuing & Caching
      async-tasks:
        patterns:
          - "celery*"
          - "channels*"
          - "flower"
          - "redis"
      # Document, PDF, and OCR Processing
      document-processing:
        patterns:
          - "ocrmypdf"
          - "pdf2image"
          - "pyzbar"
          - "zxing-cpp"
          - "tika-client"
          - "gotenberg-client"
          - "python-magic"
          - "python-gnupg"
      # Data, NLP, and Search
      data-nlp-search:
        patterns:
          - "nltk"
          - "scikit-learn"
          - "langdetect"
          - "rapidfuzz"
          - "whoosh-reloaded"
      # Utilities (Patch Updates)
      utilities-patch:
        update-types:
-          - "major"
+          - "patch"
-      small-changes:
+      # Utilities (Minor Updates)
      utilities-minor:
        update-types:
          - "minor"
          - "patch"
        exclude-patterns:
          - "*django*"
          - "drf-*"
      pre-built:
        patterns:
          - psycopg*
          - zxing-cpp
  # Enable updates for GitHub Actions
  - package-ecosystem: "github-actions"
    target-branch: "dev"
--- a/.github/workflows/ci-backend.yml
+++ b/.github/workflows/ci-backend.yml
@@ -0,0 +1,104 @@
 name: Backend Tests
 on:
  push:
    branches-ignore:
      - 'translations**'
    paths:
      - 'src/**'
      - 'pyproject.toml'
      - 'uv.lock'
      - 'docker/compose/docker-compose.ci-test.yml'
      - '.github/workflows/ci-backend.yml'
  pull_request:
    branches-ignore:
      - 'translations**'
    paths:
      - 'src/**'
      - 'pyproject.toml'
      - 'uv.lock'
      - 'docker/compose/docker-compose.ci-test.yml'
      - '.github/workflows/ci-backend.yml'
  workflow_dispatch:
 concurrency:
  group: backend-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true
 env:
  DEFAULT_UV_VERSION: "0.9.x"
  NLTK_DATA: "/usr/share/nltk_data"
 jobs:
  test:
    name: "Python ${{ matrix.python-version }}"
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        python-version: ['3.10', '3.11', '3.12']
      fail-fast: false
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Start containers
        run: |
          docker compose --file docker/compose/docker-compose.ci-test.yml pull --quiet
          docker compose --file docker/compose/docker-compose.ci-test.yml up --detach
      - name: Set up Python
        id: setup-python
        uses: actions/setup-python@v6
        with:
          python-version: "${{ matrix.python-version }}"
      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
          python-version: ${{ steps.setup-python.outputs.python-version }}
      - name: Install system dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -qq --no-install-recommends \
            unpaper tesseract-ocr imagemagick ghostscript libzbar0 poppler-utils
      - name: Configure ImageMagick
        run: |
          sudo cp docker/rootfs/etc/ImageMagick-6/paperless-policy.xml /etc/ImageMagick-6/policy.xml
      - name: Install Python dependencies
        run: |
          uv sync \
            --python ${{ steps.setup-python.outputs.python-version }} \
            --group testing \
            --frozen
      - name: List installed Python dependencies
        run: |
          uv pip list
      - name: Install NLTK data
        run: |
          uv run python -m nltk.downloader punkt punkt_tab snowball_data stopwords -d ${{ env.NLTK_DATA }}
      - name: Run tests
        env:
          NLTK_DATA: ${{ env.NLTK_DATA }}
          PAPERLESS_CI_TEST: 1
          PAPERLESS_MAIL_TEST_HOST: ${{ secrets.TEST_MAIL_HOST }}
          PAPERLESS_MAIL_TEST_USER: ${{ secrets.TEST_MAIL_USER }}
          PAPERLESS_MAIL_TEST_PASSWD: ${{ secrets.TEST_MAIL_PASSWD }}
        run: |
          uv run \
            --python ${{ steps.setup-python.outputs.python-version }} \
            --dev \
            --frozen \
            pytest
      - name: Upload test results to Codecov
        if: always()
        uses: codecov/codecov-action@v5
        with:
          flags: backend,backend-python-${{ matrix.python-version }}
          files: junit.xml
          report_type: test_results
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v5
        with:
          flags: backend,backend-python-${{ matrix.python-version }}
          files: coverage.xml
          report_type: coverage
      - name: Stop containers
        if: always()
        run: |
          docker compose --file docker/compose/docker-compose.ci-test.yml logs
          docker compose --file docker/compose/docker-compose.ci-test.yml down
--- a/.github/workflows/ci-docker.yml
+++ b/.github/workflows/ci-docker.yml
@@ -0,0 +1,233 @@
 name: Docker Build
 on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'
      - 'v[0-9]+.[0-9]+.[0-9]+-beta.rc[0-9]+'
    branches:
      - dev
      - beta
  pull_request:
    branches:
      - dev
      - main
  workflow_dispatch:
 concurrency:
  group: docker-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true
 env:
  REGISTRY: ghcr.io
 jobs:
  build-arch:
    name: Build ${{ matrix.arch }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-24.04
            arch: amd64
            platform: linux/amd64
          - runner: ubuntu-24.04-arm
            arch: arm64
            platform: linux/arm64
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
      packages: write
    outputs:
      can-push: ${{ steps.check-push.outputs.can-push }}
      push-external: ${{ steps.check-push.outputs.push-external }}
      repository: ${{ steps.repo.outputs.name }}
      ref-name: ${{ steps.ref.outputs.name }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.1
      - name: Determine ref name
        id: ref
        run: |
          ref_name="${GITHUB_HEAD_REF:-$GITHUB_REF_NAME}"
          # Sanitize by replacing / with - for cache keys
          cache_ref="${ref_name//\//-}"
          echo "ref_name=${ref_name}"
          echo "cache_ref=${cache_ref}"
          echo "name=${ref_name}" >> $GITHUB_OUTPUT
          echo "cache-ref=${cache_ref}" >> $GITHUB_OUTPUT
      - name: Check push permissions
        id: check-push
        env:
          REF_NAME: ${{ steps.ref.outputs.name }}
        run: |
          # can-push: Can we push to GHCR?
          # True for: pushes, or PRs from the same repo (not forks)
          can_push=${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
          echo "can-push=${can_push}"
          echo "can-push=${can_push}" >> $GITHUB_OUTPUT
          # push-external: Should we also push to Docker Hub and Quay.io?
          # Only for main repo on dev/beta branches or version tags
          push_external="false"
          if [[ "${can_push}" == "true" && "${{ github.repository_owner }}" == "paperless-ngx" ]]; then
            case "${REF_NAME}" in
              dev|beta)
                push_external="true"
                ;;
            esac
            case "${{ github.ref }}" in
              refs/tags/v*|*beta.rc*)
                push_external="true"
                ;;
            esac
          fi
          echo "push-external=${push_external}"
          echo "push-external=${push_external}" >> $GITHUB_OUTPUT
      - name: Set repository name
        id: repo
        run: |
          repo_name="${{ github.repository }}"
          repo_name="${repo_name,,}"
          echo "repository=${repo_name}"
          echo "name=${repo_name}" >> $GITHUB_OUTPUT
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3.12.0
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Docker metadata
        id: docker-meta
        uses: docker/metadata-action@v5.10.0
        with:
          images: |
            ${{ env.REGISTRY }}/${{ steps.repo.outputs.name }}
          tags: |
            type=ref,event=branch
            type=raw,value=${{ steps.ref.outputs.name }},enable=${{ github.event_name == 'pull_request' }}
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v6.18.0
        with:
          context: .
          file: ./Dockerfile
          platforms: ${{ matrix.platform }}
          labels: ${{ steps.docker-meta.outputs.labels }}
          build-args: |
            PNGX_TAG_VERSION=${{ steps.docker-meta.outputs.version }}
          outputs: type=image,name=${{ env.REGISTRY }}/${{ steps.repo.outputs.name }},push-by-digest=true,name-canonical=true,push=${{ steps.check-push.outputs.can-push }}
          cache-from: |
            type=registry,ref=${{ env.REGISTRY }}/${{ steps.repo.outputs.name }}/cache/app:${{ steps.ref.outputs.cache-ref }}-${{ matrix.arch }}
            type=registry,ref=${{ env.REGISTRY }}/${{ steps.repo.outputs.name }}/cache/app:dev-${{ matrix.arch }}
          cache-to: ${{ steps.check-push.outputs.can-push == 'true' && format('type=registry,mode=max,ref={0}/{1}/cache/app:{2}-{3}', env.REGISTRY, steps.repo.outputs.name, steps.ref.outputs.cache-ref, matrix.arch) || '' }}
      - name: Export digest
        if: steps.check-push.outputs.can-push == 'true'
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          echo "digest=${digest}"
          touch "/tmp/digests/${digest#sha256:}"
      - name: Upload digest
        if: steps.check-push.outputs.can-push == 'true'
        uses: actions/upload-artifact@v6.0.0
        with:
          name: digests-${{ matrix.arch }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1
  merge-and-push:
    name: Merge and Push Manifest
    runs-on: ubuntu-24.04
    needs: build-arch
    if: needs.build-arch.outputs.can-push == 'true'
    permissions:
      contents: read
      packages: write
    steps:
      - name: Download digests
        uses: actions/download-artifact@v7.0.0
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true
      - name: List digests
        run: |
          echo "Downloaded digests:"
          ls -la /tmp/digests/
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3.12.0
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to Docker Hub
        if: needs.build-arch.outputs.push-external == 'true'
        uses: docker/login-action@v3.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to Quay.io
        if: needs.build-arch.outputs.push-external == 'true'
        uses: docker/login-action@v3.6.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
      - name: Docker metadata
        id: docker-meta
        uses: docker/metadata-action@v5.10.0
        with:
          images: |
            ${{ env.REGISTRY }}/${{ needs.build-arch.outputs.repository }}
          tags: |
            type=ref,event=branch
            type=raw,value=${{ needs.build-arch.outputs.ref-name }},enable=${{ github.event_name == 'pull_request' }}
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
      - name: Create manifest list and push
        working-directory: /tmp/digests
        env:
          REPOSITORY: ${{ needs.build-arch.outputs.repository }}
        run: |
          tags=$(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "${DOCKER_METADATA_OUTPUT_JSON}")
          digests=""
          for digest in *; do
            digests+="${{ env.REGISTRY }}/${REPOSITORY}@sha256:${digest} "
          done
          echo "Creating manifest with tags: ${tags}"
          echo "From digests: ${digests}"
          docker buildx imagetools create ${tags} ${digests}
      - name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ fromJSON(steps.docker-meta.outputs.json).tags[0] }}
      - name: Copy to Docker Hub
        if: needs.build-arch.outputs.push-external == 'true'
        env:
          TAGS: ${{ steps.docker-meta.outputs.tags }}
          GHCR_REPO: ${{ env.REGISTRY }}/${{ needs.build-arch.outputs.repository }}
        run: |
          for tag in ${TAGS}; do
            dockerhub_tag="${tag/${GHCR_REPO}/docker.io/paperlessngx/paperless-ngx}"
            echo "Copying ${tag} to ${dockerhub_tag}"
            skopeo copy --all "docker://${tag}" "docker://${dockerhub_tag}"
          done
      - name: Copy to Quay.io
        if: needs.build-arch.outputs.push-external == 'true'
        env:
          TAGS: ${{ steps.docker-meta.outputs.tags }}
          GHCR_REPO: ${{ env.REGISTRY }}/${{ needs.build-arch.outputs.repository }}
        run: |
          for tag in ${TAGS}; do
            quay_tag="${tag/${GHCR_REPO}/quay.io/paperlessngx/paperless-ngx}"
            echo "Copying ${tag} to ${quay_tag}"
            skopeo copy --all "docker://${tag}" "docker://${quay_tag}"
          done
--- a/.github/workflows/ci-docs.yml
+++ b/.github/workflows/ci-docs.yml
@@ -0,0 +1,88 @@
 name: Documentation
 on:
  push:
    branches:
      - main
      - dev
    paths:
      - 'docs/**'
      - 'mkdocs.yml'
      - '.github/workflows/ci-docs.yml'
  pull_request:
    paths:
      - 'docs/**'
      - 'mkdocs.yml'
      - '.github/workflows/ci-docs.yml'
  workflow_dispatch:
 concurrency:
  group: docs-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true
 env:
  DEFAULT_UV_VERSION: "0.9.x"
  DEFAULT_PYTHON_VERSION: "3.11"
 jobs:
  build:
    name: Build Documentation
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Set up Python
        id: setup-python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install Python dependencies
        run: |
          uv sync --python ${{ steps.setup-python.outputs.python-version }} --dev --frozen
      - name: Build documentation
        run: |
          uv run \
            --python ${{ steps.setup-python.outputs.python-version }} \
            --dev \
            --frozen \
            mkdocs build --config-file ./mkdocs.yml
      - name: Upload artifact
        uses: actions/upload-artifact@v6
        with:
          name: documentation
          path: site/
          retention-days: 7
  deploy:
    name: Deploy Documentation
    needs: build
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Set up Python
        id: setup-python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install Python dependencies
        run: |
          uv sync --python ${{ steps.setup-python.outputs.python-version }} --dev --frozen
      - name: Deploy documentation
        run: |
          echo "docs.paperless-ngx.com" > "${{ github.workspace }}/docs/CNAME"
          git config --global user.name "${{ github.actor }}"
          git config --global user.email "${{ github.actor }}@users.noreply.github.com"
          uv run \
            --python ${{ steps.setup-python.outputs.python-version }} \
            --dev \
            --frozen \
            mkdocs gh-deploy --force --no-history
--- a/.github/workflows/ci-frontend.yml
+++ b/.github/workflows/ci-frontend.yml
@@ -0,0 +1,189 @@
 name: Frontend Tests
 on:
  push:
    branches-ignore:
      - 'translations**'
    paths:
      - 'src-ui/**'
      - '.github/workflows/ci-frontend.yml'
  pull_request:
    branches-ignore:
      - 'translations**'
    paths:
      - 'src-ui/**'
      - '.github/workflows/ci-frontend.yml'
  workflow_dispatch:
 concurrency:
  group: frontend-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true
 jobs:
  install-dependencies:
    name: Install Dependencies
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10
      - name: Use Node.js 24
        uses: actions/setup-node@v6
        with:
          node-version: 24.x
          cache: 'pnpm'
          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
      - name: Cache frontend dependencies
        id: cache-frontend-deps
        uses: actions/cache@v5
        with:
          path: |
            ~/.pnpm-store
            ~/.cache
          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
      - name: Install dependencies
        run: cd src-ui && pnpm install
  lint:
    name: Lint
    needs: install-dependencies
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10
      - name: Use Node.js 24
        uses: actions/setup-node@v6
        with:
          node-version: 24.x
          cache: 'pnpm'
          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
      - name: Cache frontend dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pnpm-store
            ~/.cache
          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
      - name: Re-link Angular CLI
        run: cd src-ui && pnpm link @angular/cli
      - name: Run lint
        run: cd src-ui && pnpm run lint
  unit-tests:
    name: "Unit Tests (${{ matrix.shard-index }}/${{ matrix.shard-count }})"
    needs: install-dependencies
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        node-version: [24.x]
        shard-index: [1, 2, 3, 4]
        shard-count: [4]
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10
      - name: Use Node.js 24
        uses: actions/setup-node@v6
        with:
          node-version: 24.x
          cache: 'pnpm'
          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
      - name: Cache frontend dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pnpm-store
            ~/.cache
          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
      - name: Re-link Angular CLI
        run: cd src-ui && pnpm link @angular/cli
      - name: Run Jest unit tests
        run: cd src-ui && pnpm run test --max-workers=2 --shard=${{ matrix.shard-index }}/${{ matrix.shard-count }}
      - name: Upload test results to Codecov
        if: always()
        uses: codecov/codecov-action@v5
        with:
          flags: frontend,frontend-node-${{ matrix.node-version }}
          directory: src-ui/
          report_type: test_results
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v5
        with:
          flags: frontend,frontend-node-${{ matrix.node-version }}
          directory: src-ui/coverage/
  e2e-tests:
    name: "E2E Tests (${{ matrix.shard-index }}/${{ matrix.shard-count }})"
    needs: install-dependencies
    runs-on: ubuntu-24.04
    container: mcr.microsoft.com/playwright:v1.57.0-noble
    env:
      PLAYWRIGHT_BROWSERS_PATH: /ms-playwright
      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
    strategy:
      fail-fast: false
      matrix:
        node-version: [24.x]
        shard-index: [1, 2]
        shard-count: [2]
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10
      - name: Use Node.js 24
        uses: actions/setup-node@v6
        with:
          node-version: 24.x
          cache: 'pnpm'
          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
      - name: Cache frontend dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pnpm-store
            ~/.cache
          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
      - name: Re-link Angular CLI
        run: cd src-ui && pnpm link @angular/cli
      - name: Install dependencies
        run: cd src-ui && pnpm install --no-frozen-lockfile
      - name: Run Playwright E2E tests
        run: cd src-ui && pnpm exec playwright test --shard ${{ matrix.shard-index }}/${{ matrix.shard-count }}
  bundle-analysis:
    name: Bundle Analysis
    needs: [unit-tests, e2e-tests]
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10
      - name: Use Node.js 24
        uses: actions/setup-node@v6
        with:
          node-version: 24.x
          cache: 'pnpm'
          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
      - name: Cache frontend dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pnpm-store
            ~/.cache
          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
      - name: Re-link Angular CLI
        run: cd src-ui && pnpm link @angular/cli
      - name: Build and analyze
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        run: cd src-ui && pnpm run build --configuration=production
--- a/.github/workflows/ci-lint.yml
+++ b/.github/workflows/ci-lint.yml
@@ -0,0 +1,24 @@
 name: Lint
 on:
  push:
    branches-ignore:
      - 'translations**'
  pull_request:
    branches-ignore:
      - 'translations**'
 concurrency:
  group: lint-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true
 jobs:
  pre-commit:
    name: Pre-commit Checks
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Install Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"
      - name: Run pre-commit
        uses: pre-commit/action@v3.0.1
--- a/.github/workflows/ci-release.yml
+++ b/.github/workflows/ci-release.yml
@@ -0,0 +1,237 @@
 name: Release
 on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'
      - 'v[0-9]+.[0-9]+.[0-9]+-beta.rc[0-9]+'
 concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false
 env:
  DEFAULT_UV_VERSION: "0.9.x"
  DEFAULT_PYTHON_VERSION: "3.11"
 jobs:
  wait-for-docker:
    name: Wait for Docker Build
    runs-on: ubuntu-24.04
    steps:
      - name: Wait for Docker build
        uses: lewagon/wait-on-check-action@v1.4.1
        with:
          ref: ${{ github.sha }}
          check-name: 'Build Docker Image'
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          wait-interval: 60
  build-release:
    name: Build Release
    needs: wait-for-docker
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      # ---- Frontend Build ----
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10
      - name: Use Node.js 24
        uses: actions/setup-node@v6
        with:
          node-version: 24.x
          cache: 'pnpm'
          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
      - name: Install frontend dependencies
        run: cd src-ui && pnpm install
      - name: Build frontend
        run: cd src-ui && pnpm run build --configuration production
      # ---- Backend Setup ----
      - name: Set up Python
        id: setup-python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
          python-version: ${{ steps.setup-python.outputs.python-version }}
      - name: Install Python dependencies
        run: |
          uv sync --python ${{ steps.setup-python.outputs.python-version }} --dev --frozen
      - name: Install system dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -qq --no-install-recommends gettext liblept5
      # ---- Build Documentation ----
      - name: Build documentation
        run: |
          uv run \
            --python ${{ steps.setup-python.outputs.python-version }} \
            --dev \
            --frozen \
            mkdocs build --config-file ./mkdocs.yml
      # ---- Prepare Release ----
      - name: Generate requirements file
        run: |
          uv export --quiet --no-dev --all-extras --format requirements-txt --output-file requirements.txt
      - name: Compile messages
        run: |
          cd src/
          uv run \
            --python ${{ steps.setup-python.outputs.python-version }} \
            manage.py compilemessages
      - name: Collect static files
        run: |
          cd src/
          uv run \
            --python ${{ steps.setup-python.outputs.python-version }} \
            manage.py collectstatic --no-input --clear
      - name: Assemble release package
        run: |
          mkdir -p dist/paperless-ngx/scripts
          for file_name in .dockerignore \
                          .env \
                          Dockerfile \
                          pyproject.toml \
                          uv.lock \
                          requirements.txt \
                          LICENSE \
                          README.md \
                          paperless.conf.example
          do
            cp --verbose ${file_name} dist/paperless-ngx/
          done
          mv dist/paperless-ngx/paperless.conf.example dist/paperless-ngx/paperless.conf
          cp --recursive docker/ dist/paperless-ngx/docker
          cp scripts/*.service scripts/*.sh scripts/*.socket dist/paperless-ngx/scripts/
          cp --recursive src/ dist/paperless-ngx/src
          cp --recursive site/ dist/paperless-ngx/docs
          mv static dist/paperless-ngx/
          find dist/paperless-ngx -name "__pycache__" -type d -exec rm -rf {} +
      - name: Create release archive
        run: |
          cd dist
          sudo chown -R 1000:1000 paperless-ngx/
          tar -cJf paperless-ngx.tar.xz paperless-ngx/
      - name: Upload release artifact
        uses: actions/upload-artifact@v6
        with:
          name: release
          path: dist/paperless-ngx.tar.xz
          retention-days: 7
  publish-release:
    name: Publish Release
    needs: build-release
    runs-on: ubuntu-24.04
    outputs:
      prerelease: ${{ steps.get-version.outputs.prerelease }}
      changelog: ${{ steps.create-release.outputs.body }}
      version: ${{ steps.get-version.outputs.version }}
    steps:
      - name: Download release artifact
        uses: actions/download-artifact@v7
        with:
          name: release
          path: ./
      - name: Get version info
        id: get-version
        run: |
          echo "version=${{ github.ref_name }}" >> $GITHUB_OUTPUT
          if [[ "${{ github.ref_name }}" == *"-beta.rc"* ]]; then
            echo "prerelease=true" >> $GITHUB_OUTPUT
          else
            echo "prerelease=false" >> $GITHUB_OUTPUT
          fi
      - name: Create release and changelog
        id: create-release
        uses: release-drafter/release-drafter@v6
        with:
          name: Paperless-ngx ${{ steps.get-version.outputs.version }}
          tag: ${{ steps.get-version.outputs.version }}
          version: ${{ steps.get-version.outputs.version }}
          prerelease: ${{ steps.get-version.outputs.prerelease }}
          publish: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Upload release archive
        uses: shogo82148/actions-upload-release-asset@v1
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          upload_url: ${{ steps.create-release.outputs.upload_url }}
          asset_path: ./paperless-ngx.tar.xz
          asset_name: paperless-ngx-${{ steps.get-version.outputs.version }}.tar.xz
          asset_content_type: application/x-xz
  # ---------------------------------------------------------------------------
  # Append changelog to docs (only on non-prerelease)
  # ---------------------------------------------------------------------------
  append-changelog:
    name: Append Changelog
    needs: publish-release
    if: needs.publish-release.outputs.prerelease == 'false'
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: main
      - name: Set up Python
        id: setup-python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Update changelog
        working-directory: docs
        run: |
          git branch ${{ needs.publish-release.outputs.version }}-changelog
          git checkout ${{ needs.publish-release.outputs.version }}-changelog
          echo -e "# Changelog\n\n${{ needs.publish-release.outputs.changelog }}\n" > changelog-new.md
          echo "Manually linking usernames"
          sed -i -r 's|@([a-zA-Z0-9_]+) \(\[#|[@\1](https://github.com/\1) ([#|g' changelog-new.md
          echo "Removing unneeded comment tags"
          sed -i -r 's|@<!---->|@|g' changelog-new.md
          CURRENT_CHANGELOG=$(tail --lines +2 changelog.md)
          echo -e "$CURRENT_CHANGELOG" >> changelog-new.md
          mv changelog-new.md changelog.md
          uv run \
            --python ${{ steps.setup-python.outputs.python-version }} \
            --dev \
            pre-commit run --files changelog.md || true
          git config --global user.name "github-actions"
          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git commit -am "Changelog ${{ needs.publish-release.outputs.version }} - GHA"
          git push origin ${{ needs.publish-release.outputs.version }}-changelog
      - name: Create pull request
        uses: actions/github-script@v8
        with:
          script: |
            const { repo, owner } = context.repo;
            const result = await github.rest.pulls.create({
              title: 'Documentation: Add ${{ needs.publish-release.outputs.version }} changelog',
              owner,
              repo,
              head: '${{ needs.publish-release.outputs.version }}-changelog',
              base: 'main',
              body: 'This PR is auto-generated by CI.'
            });
            github.rest.issues.addLabels({
              owner,
              repo,
              issue_number: result.data.number,
              labels: ['documentation', 'skip-changelog']
            });
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,673 +0,0 @@
 name: ci
 on:
  push:
    tags:
      # https://semver.org/#spec-item-2
      - 'v[0-9]+.[0-9]+.[0-9]+'
      # https://semver.org/#spec-item-9
      - 'v[0-9]+.[0-9]+.[0-9]+-beta.rc[0-9]+'
    branches-ignore:
      - 'translations**'
  pull_request:
    branches-ignore:
      - 'translations**'
 env:
  DEFAULT_UV_VERSION: "0.9.x"
  # This is the default version of Python to use in most steps which aren't specific
  DEFAULT_PYTHON_VERSION: "3.11"
  NLTK_DATA: "/usr/share/nltk_data"
 jobs:
  detect-duplicate:
    name: Detect Duplicate Run
    runs-on: ubuntu-24.04
    outputs:
      should_run: ${{ steps.check.outputs.should_run }}
    steps:
      - name: Check if workflow should run
        id: check
        uses: actions/github-script@v8
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            if (context.eventName !== 'push') {
              core.info('Not a push event; running workflow.');
              core.setOutput('should_run', 'true');
              return;
            }
            const ref = context.ref || '';
            if (!ref.startsWith('refs/heads/')) {
              core.info('Push is not to a branch; running workflow.');
              core.setOutput('should_run', 'true');
              return;
            }
            const branch = ref.substring('refs/heads/'.length);
            const { owner, repo } = context.repo;
            const prs = await github.paginate(github.rest.pulls.list, {
              owner,
              repo,
              state: 'open',
              head: `${owner}:${branch}`,
              per_page: 100,
            });
            if (prs.length === 0) {
              core.info(`No open PR found for ${branch}; running workflow.`);
              core.setOutput('should_run', 'true');
            } else {
              core.info(`Found ${prs.length} open PR(s) for ${branch}; skipping duplicate push run.`);
              core.setOutput('should_run', 'false');
            }
  pre-commit:
    needs:
      - detect-duplicate
    if: needs.detect-duplicate.outputs.should_run == 'true'
    name: Linting Checks
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
      - name: Install python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Check files
        uses: pre-commit/action@v3.0.1
  documentation:
    name: "Build & Deploy Documentation"
    runs-on: ubuntu-24.04
    needs:
      - pre-commit
    steps:
      - name: Checkout
        uses: actions/checkout@v5
      - name: Set up Python
        id: setup-python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
        uses: astral-sh/setup-uv@v6
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install Python dependencies
        run: |
          uv sync --python ${{ steps.setup-python.outputs.python-version }} --dev --frozen
      - name: Make documentation
        run: |
          uv run \
            --python ${{ steps.setup-python.outputs.python-version }} \
            --dev \
            --frozen \
            mkdocs build --config-file ./mkdocs.yml
      - name: Deploy documentation
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: |
          echo "docs.paperless-ngx.com" > "${{ github.workspace }}/docs/CNAME"
          git config --global user.name "${{ github.actor }}"
          git config --global user.email "${{ github.actor }}@users.noreply.github.com"
          uv run \
            --python ${{ steps.setup-python.outputs.python-version }} \
            --dev \
            --frozen \
            mkdocs gh-deploy --force --no-history
      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: documentation
          path: site/
          retention-days: 7
  tests-backend:
    name: "Backend Tests (Python ${{ matrix.python-version }})"
    runs-on: ubuntu-24.04
    needs:
      - pre-commit
    strategy:
      matrix:
        python-version: ['3.10', '3.11', '3.12']
      fail-fast: false
    steps:
      - name: Checkout
        uses: actions/checkout@v5
      - name: Start containers
        run: |
          docker compose --file ${{ github.workspace }}/docker/compose/docker-compose.ci-test.yml pull --quiet
          docker compose --file ${{ github.workspace }}/docker/compose/docker-compose.ci-test.yml up --detach
      - name: Set up Python
        id: setup-python
        uses: actions/setup-python@v6
        with:
          python-version: "${{ matrix.python-version }}"
      - name: Install uv
        uses: astral-sh/setup-uv@v6
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
          python-version: ${{ steps.setup-python.outputs.python-version }}
      - name: Install system dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -qq --no-install-recommends unpaper tesseract-ocr imagemagick ghostscript libzbar0 poppler-utils
      - name: Configure ImageMagick
        run: |
          sudo cp docker/rootfs/etc/ImageMagick-6/paperless-policy.xml /etc/ImageMagick-6/policy.xml
      - name: Install Python dependencies
        run: |
          uv sync \
            --python ${{ steps.setup-python.outputs.python-version }} \
            --group testing \
            --frozen
      - name: List installed Python dependencies
        run: |
          uv pip list
      - name: Install or update NLTK dependencies
        run: uv run python -m nltk.downloader punkt punkt_tab snowball_data stopwords -d ${{ env.NLTK_DATA }}
      - name: Tests
        env:
          NLTK_DATA: ${{ env.NLTK_DATA }}
          PAPERLESS_CI_TEST: 1
          # Enable paperless_mail testing against real server
          PAPERLESS_MAIL_TEST_HOST: ${{ secrets.TEST_MAIL_HOST }}
          PAPERLESS_MAIL_TEST_USER: ${{ secrets.TEST_MAIL_USER }}
          PAPERLESS_MAIL_TEST_PASSWD: ${{ secrets.TEST_MAIL_PASSWD }}
        run: |
          uv run \
            --python ${{ steps.setup-python.outputs.python-version }} \
            --dev \
            --frozen \
            pytest
      - name: Upload backend test results to Codecov
        if: always()
        uses: codecov/test-results-action@v1
        with:
          flags: backend-python-${{ matrix.python-version }}
          files: junit.xml
      - name: Upload backend coverage to Codecov
        uses: codecov/codecov-action@v5
        with:
          flags: backend-python-${{ matrix.python-version }}
          files: coverage.xml
      - name: Stop containers
        if: always()
        run: |
          docker compose --file ${{ github.workspace }}/docker/compose/docker-compose.ci-test.yml logs
          docker compose --file ${{ github.workspace }}/docker/compose/docker-compose.ci-test.yml down
  install-frontend-dependencies:
    name: "Install Frontend Dependencies"
    runs-on: ubuntu-24.04
    needs:
      - pre-commit
    steps:
      - uses: actions/checkout@v5
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10
      - name: Use Node.js 20
        uses: actions/setup-node@v5
        with:
          node-version: 20.x
          cache: 'pnpm'
          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
      - name: Cache frontend dependencies
        id: cache-frontend-deps
        uses: actions/cache@v4
        with:
          path: |
            ~/.pnpm-store
            ~/.cache
          key: ${{ runner.os }}-frontenddeps-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
      - name: Install dependencies
        run: cd src-ui && pnpm install
  tests-frontend:
    name: "Frontend Unit Tests (Node ${{ matrix.node-version }} - ${{ matrix.shard-index }}/${{ matrix.shard-count }})"
    runs-on: ubuntu-24.04
    needs:
      - install-frontend-dependencies
    strategy:
      fail-fast: false
      matrix:
        node-version: [20.x]
        shard-index: [1, 2, 3, 4]
        shard-count: [4]
    steps:
      - uses: actions/checkout@v5
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10
      - name: Use Node.js 20
        uses: actions/setup-node@v5
        with:
          node-version: 20.x
          cache: 'pnpm'
          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
      - name: Cache frontend dependencies
        id: cache-frontend-deps
        uses: actions/cache@v4
        with:
          path: |
            ~/.pnpm-store
            ~/.cache
          key: ${{ runner.os }}-frontenddeps-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
      - name: Re-link Angular cli
        run: cd src-ui && pnpm link @angular/cli
      - name: Linting checks
        run: cd src-ui && pnpm run lint
      - name: Run Jest unit tests
        run: cd src-ui && pnpm run test --max-workers=2 --shard=${{ matrix.shard-index }}/${{ matrix.shard-count }}
      - name: Upload frontend test results to Codecov
        uses: codecov/test-results-action@v1
        if: always()
        with:
          flags: frontend-node-${{ matrix.node-version }}
          directory: src-ui/
      - name: Upload frontend coverage to Codecov
        uses: codecov/codecov-action@v5
        with:
          flags: frontend-node-${{ matrix.node-version }}
          directory: src-ui/coverage/
  tests-frontend-e2e:
    name: "Frontend E2E Tests (Node ${{ matrix.node-version }} - ${{ matrix.shard-index }}/${{ matrix.shard-count }})"
    runs-on: ubuntu-24.04
    needs:
      - install-frontend-dependencies
    strategy:
      fail-fast: false
      matrix:
        node-version: [20.x]
        shard-index: [1, 2]
        shard-count: [2]
    steps:
      - uses: actions/checkout@v5
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10
      - name: Use Node.js 20
        uses: actions/setup-node@v5
        with:
          node-version: 20.x
          cache: 'pnpm'
          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
      - name: Cache frontend dependencies
        id: cache-frontend-deps
        uses: actions/cache@v4
        with:
          path: |
            ~/.pnpm-store
            ~/.cache
          key: ${{ runner.os }}-frontenddeps-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
      - name: Re-link Angular cli
        run: cd src-ui && pnpm link @angular/cli
      - name: Cache Playwright browsers
        uses: actions/cache@v4
        with:
          path: ~/.cache/ms-playwright
          key: ${{ runner.os }}-playwright-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-playwright-
      - name: Install Playwright system dependencies
        run: npx playwright install-deps
      - name: Install dependencies
        run: cd src-ui && pnpm install --no-frozen-lockfile
      - name: Install Playwright
        run: cd src-ui && pnpm exec playwright install
      - name: Run Playwright e2e tests
        run: cd src-ui && pnpm exec playwright test --shard ${{ matrix.shard-index }}/${{ matrix.shard-count }}
  frontend-bundle-analysis:
    name: "Frontend Bundle Analysis"
    runs-on: ubuntu-24.04
    needs:
      - tests-frontend
      - tests-frontend-e2e
    steps:
      - uses: actions/checkout@v5
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10
      - name: Use Node.js 20
        uses: actions/setup-node@v5
        with:
          node-version: 20.x
          cache: 'pnpm'
          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
      - name: Cache frontend dependencies
        id: cache-frontend-deps
        uses: actions/cache@v4
        with:
          path: |
            ~/.pnpm-store
            ~/.cache
          key: ${{ runner.os }}-frontenddeps-${{ hashFiles('src-ui/package-lock.json') }}
      - name: Re-link Angular cli
        run: cd src-ui && pnpm link @angular/cli
      - name: Build frontend and upload analysis
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        run: cd src-ui && pnpm run build --configuration=production
  build-docker-image:
    name: Build Docker image for ${{ github.ref_name }}
    runs-on: ubuntu-24.04
    if: github.event_name == 'push' && (startsWith(github.ref, 'refs/heads/feature-') || startsWith(github.ref, 'refs/heads/fix-') || github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/beta' || contains(github.ref, 'beta.rc') || startsWith(github.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/heads/l10n_'))
    concurrency:
      group: ${{ github.workflow }}-build-docker-image-${{ github.ref_name }}
      cancel-in-progress: true
    needs:
      - tests-backend
      - tests-frontend
      - tests-frontend-e2e
    steps:
      - name: Check pushing to Docker Hub
        id: push-other-places
        # Only push to Dockerhub from the main repo AND the ref is either:
        #  main
        #  dev
        #  beta
        #  a tag
        # Otherwise forks would require a Docker Hub account and secrets setup
        run: |
          if [[ ${{ github.repository_owner }} == "paperless-ngx" && ( ${{ github.ref_name }} == "dev" || ${{ github.ref_name }} == "beta" || ${{ startsWith(github.ref, 'refs/tags/v') }} == "true" ) ]] ; then
            echo "Enabling DockerHub image push"
            echo "enable=true" >> $GITHUB_OUTPUT
          else
            echo "Not pushing to DockerHub"
            echo "enable=false" >> $GITHUB_OUTPUT
          fi
      - name: Set ghcr repository name
        id: set-ghcr-repository
        run: |
          ghcr_name=$(echo "${{ github.repository }}" | awk '{ print tolower($0) }')
          echo "Name is ${ghcr_name}"
          echo "ghcr-repository=${ghcr_name}" >> $GITHUB_OUTPUT
      - name: Gather Docker metadata
        id: docker-meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}
            name=paperlessngx/paperless-ngx,enable=${{ steps.push-other-places.outputs.enable }}
            name=quay.io/paperlessngx/paperless-ngx,enable=${{ steps.push-other-places.outputs.enable }}
          tags: |
            # Tag branches with branch name
            type=ref,event=branch
            # Process semver tags
            # For a tag x.y.z or vX.Y.Z, output an x.y.z and x.y image tag
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
      - name: Checkout
        uses: actions/checkout@v5
      # If https://github.com/docker/buildx/issues/1044 is resolved,
      # the append input with a native arm64 arch could be used to
      # significantly speed up building
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        # Don't attempt to login if not pushing to Docker Hub
        if: steps.push-other-places.outputs.enable == 'true'
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to Quay.io
        uses: docker/login-action@v3
        # Don't attempt to login if not pushing to Quay.io
        if: steps.push-other-places.outputs.enable == 'true'
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.docker-meta.outputs.tags }}
          labels: ${{ steps.docker-meta.outputs.labels }}
          build-args: |
            PNGX_TAG_VERSION=${{ steps.docker-meta.outputs.version }}
          # Get cache layers from this branch, then dev
          # This allows new branches to get at least some cache benefits, generally from dev
          cache-from: |
            type=registry,ref=ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}/builder/cache/app:${{ github.ref_name }}
            type=registry,ref=ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}/builder/cache/app:dev
          cache-to: |
            type=registry,mode=max,ref=ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}/builder/cache/app:${{ github.ref_name }}
      - name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ fromJSON(steps.docker-meta.outputs.json).tags[0] }}
      - name: Export frontend artifact from docker
        run: |
          docker create --name frontend-extract ${{ fromJSON(steps.docker-meta.outputs.json).tags[0] }}
          docker cp frontend-extract:/usr/src/paperless/src/documents/static/frontend src/documents/static/frontend/
      - name: Upload frontend artifact
        uses: actions/upload-artifact@v4
        with:
          name: frontend-compiled
          path: src/documents/static/frontend/
          retention-days: 7
  build-release:
    name: "Build Release"
    needs:
      - build-docker-image
      - documentation
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v5
      - name: Set up Python
        id: setup-python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
        uses: astral-sh/setup-uv@v6
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
          python-version: ${{ steps.setup-python.outputs.python-version }}
      - name: Install Python dependencies
        run: |
          uv sync --python ${{ steps.setup-python.outputs.python-version }} --dev --frozen
      - name: Install system dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -qq --no-install-recommends gettext liblept5
      - name: Download frontend artifact
        uses: actions/download-artifact@v5
        with:
          name: frontend-compiled
          path: src/documents/static/frontend/
      - name: Download documentation artifact
        uses: actions/download-artifact@v5
        with:
          name: documentation
          path: docs/_build/html/
      - name: Generate requirements file
        run: |
          uv export --quiet --no-dev --all-extras --format requirements-txt --output-file requirements.txt
      - name: Compile messages
        run: |
          cd src/
          uv run \
            --python ${{ steps.setup-python.outputs.python-version }} \
            manage.py compilemessages
      - name: Collect static files
        run: |
          cd src/
          uv run \
            --python ${{ steps.setup-python.outputs.python-version }} \
            manage.py collectstatic --no-input
      - name: Move files
        run: |
          echo "Making dist folders"
          for directory in dist \
                          dist/paperless-ngx \
                          dist/paperless-ngx/scripts;
          do
            mkdir --verbose --parents ${directory}
          done
          echo "Copying basic files"
          for file_name in .dockerignore \
                          .env \
                          Dockerfile \
                          pyproject.toml \
                          uv.lock \
                          requirements.txt \
                          LICENSE \
                          README.md \
                          paperless.conf.example
          do
            cp --verbose ${file_name} dist/paperless-ngx/
          done
          mv --verbose dist/paperless-ngx/paperless.conf.example dist/paperless-ngx/paperless.conf
          echo "Copying Docker related files"
          cp --recursive docker/ dist/paperless-ngx/docker
          echo "Copying startup scripts"
          cp --verbose scripts/*.service scripts/*.sh scripts/*.socket dist/paperless-ngx/scripts/
          echo "Copying source files"
          cp --recursive src/ dist/paperless-ngx/src
          echo "Copying documentation"
          cp --recursive docs/_build/html/ dist/paperless-ngx/docs
          mv --verbose static dist/paperless-ngx
      - name: Make release package
        run: |
          echo "Creating release archive"
          cd dist
          sudo chown -R 1000:1000 paperless-ngx/
          tar -cJf paperless-ngx.tar.xz paperless-ngx/
      - name: Upload release artifact
        uses: actions/upload-artifact@v4
        with:
          name: release
          path: dist/paperless-ngx.tar.xz
          retention-days: 7
  publish-release:
    name: "Publish Release"
    runs-on: ubuntu-24.04
    outputs:
      prerelease: ${{ steps.get_version.outputs.prerelease }}
      changelog: ${{ steps.create-release.outputs.body }}
      version: ${{ steps.get_version.outputs.version }}
    needs:
      - build-release
    if: github.ref_type == 'tag' && (startsWith(github.ref_name, 'v') || contains(github.ref_name, '-beta.rc'))
    steps:
      - name: Download release artifact
        uses: actions/download-artifact@v5
        with:
          name: release
          path: ./
      - name: Get version
        id: get_version
        run: |
          echo "version=${{ github.ref_name }}" >> $GITHUB_OUTPUT
          if [[ ${{ contains(github.ref_name, '-beta.rc') }} == 'true' ]]; then
            echo "prerelease=true" >> $GITHUB_OUTPUT
          else
            echo "prerelease=false" >> $GITHUB_OUTPUT
          fi
      - name: Create Release and Changelog
        id: create-release
        uses: release-drafter/release-drafter@v6
        with:
          name: Paperless-ngx ${{ steps.get_version.outputs.version }}
          tag: ${{ steps.get_version.outputs.version }}
          version: ${{ steps.get_version.outputs.version }}
          prerelease: ${{ steps.get_version.outputs.prerelease }}
          publish: true # ensures release is not marked as draft
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Upload release archive
        id: upload-release-asset
        uses: shogo82148/actions-upload-release-asset@v1
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          upload_url: ${{ steps.create-release.outputs.upload_url }}
          asset_path: ./paperless-ngx.tar.xz
          asset_name: paperless-ngx-${{ steps.get_version.outputs.version }}.tar.xz
          asset_content_type: application/x-xz
  append-changelog:
    name: "Append Changelog"
    runs-on: ubuntu-24.04
    needs:
      - publish-release
    if: needs.publish-release.outputs.prerelease == 'false'
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          ref: main
      - name: Set up Python
        id: setup-python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
        uses: astral-sh/setup-uv@v6
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Append Changelog to docs
        id: append-Changelog
        working-directory: docs
        run: |
          git branch ${{ needs.publish-release.outputs.version }}-changelog
          git checkout ${{ needs.publish-release.outputs.version }}-changelog
          echo -e "# Changelog\n\n${{ needs.publish-release.outputs.changelog }}\n" > changelog-new.md
          echo "Manually linking usernames"
          sed -i -r 's|@([a-zA-Z0-9_]+) \(\[#|[@\1](https://github.com/\1) ([#|g' changelog-new.md
          echo "Removing unneeded comment tags"
          sed -i -r 's|@<!---->|@|g' changelog-new.md
          CURRENT_CHANGELOG=`tail --lines +2 changelog.md`
          echo -e "$CURRENT_CHANGELOG" >> changelog-new.md
          mv changelog-new.md changelog.md
          uv run \
            --python ${{ steps.setup-python.outputs.python-version }} \
            --dev \
            pre-commit run --files changelog.md || true
          git config --global user.name "github-actions"
          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git commit -am "Changelog ${{ needs.publish-release.outputs.version }} - GHA"
          git push origin ${{ needs.publish-release.outputs.version }}-changelog
      - name: Create Pull Request
        uses: actions/github-script@v8
        with:
          script: |
            const { repo, owner } = context.repo;
            const result = await github.rest.pulls.create({
              title: 'Documentation: Add ${{ needs.publish-release.outputs.version }} changelog',
              owner,
              repo,
              head: '${{ needs.publish-release.outputs.version }}-changelog',
              base: 'main',
              body: 'This PR is auto-generated by CI.'
            });
            github.rest.issues.addLabels({
              owner,
              repo,
              issue_number: result.data.number,
              labels: ['documentation', 'skip-changelog']
            });
--- a/.github/workflows/cleanup-tags.yml
+++ b/.github/workflows/cleanup-tags.yml
@@ -27,7 +27,7 @@ jobs:
    steps:
      - name: Clean temporary images
        if: "${{ env.TOKEN != '' }}"
-        uses: stumpylog/image-cleaner-action/ephemeral@v0.11.0
+        uses: stumpylog/image-cleaner-action/ephemeral@v0.12.0
        with:
          token: "${{ env.TOKEN }}"
          owner: "${{ github.repository_owner }}"
@@ -53,7 +53,7 @@ jobs:
    steps:
      - name: Clean untagged images
        if: "${{ env.TOKEN != '' }}"
-        uses: stumpylog/image-cleaner-action/untagged@v0.11.0
+        uses: stumpylog/image-cleaner-action/untagged@v0.12.0
        with:
          token: "${{ env.TOKEN }}"
          owner: "${{ github.repository_owner }}"
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -34,10 +34,10 @@ jobs:
        # Learn more about CodeQL language support at https://git.io/codeql-language-support
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          # If you wish to specify custom queries, you can do so here or in a config file.
@@ -45,4 +45,4 @@ jobs:
          # Prefix the list here with "+" to use these queries and those in the config file.
          # queries: ./path/to/local/query, your-org/your-repo/queries@main
      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
--- a/.github/workflows/crowdin.yml
+++ b/.github/workflows/crowdin.yml
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
        with:
          token: ${{ secrets.PNGX_BOT_PAT }}
      - name: crowdin action
--- a/.github/workflows/repo-maintenance.yml
+++ b/.github/workflows/repo-maintenance.yml
@@ -37,7 +37,7 @@ jobs:
    if: github.repository_owner == 'paperless-ngx'
    runs-on: ubuntu-24.04
    steps:
-      - uses: dessant/lock-threads@v5
+      - uses: dessant/lock-threads@v6
        with:
          issue-inactive-days: '30'
          pr-inactive-days: '30'
--- a/.github/workflows/translate-strings.yml
+++ b/.github/workflows/translate-strings.yml
@@ -11,10 +11,12 @@ jobs:
      contents: write
    steps:
      - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
        env:
          GH_REF: ${{ github.ref }} # sonar rule:githubactions:S7630 - avoid injection
        with:
          token: ${{ secrets.PNGX_BOT_PAT }}
-          ref: ${{ github.head_ref }}
+          ref: ${{ env.GH_REF }}
      - name: Set up Python
        id: setup-python
        uses: actions/setup-python@v6
@@ -23,7 +25,7 @@ jobs:
          sudo apt-get update -qq
          sudo apt-get install -qq --no-install-recommends gettext
      - name: Install uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
      - name: Install backend python dependencies
@@ -37,15 +39,15 @@ jobs:
        uses: pnpm/action-setup@v4
        with:
          version: 10
-      - name: Use Node.js 20
+      - name: Use Node.js 24
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
        with:
-          node-version: 20.x
+          node-version: 24.x
          cache: 'pnpm'
          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
      - name: Cache frontend dependencies
        id: cache-frontend-deps
-        uses: actions/cache@v4
+        uses: actions/cache@v5
        with:
          path: |
            ~/.pnpm-store
@@ -61,7 +63,7 @@ jobs:
          cd src-ui
          pnpm run ng extract-i18n
      - name: Commit changes
-        uses: stefanzweifel/git-auto-commit-action@v6
+        uses: stefanzweifel/git-auto-commit-action@v7
        with:
          file_pattern: 'src-ui/messages.xlf src/locale/en_US/LC_MESSAGES/django.po'
          commit_message: "Auto translate strings"
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -49,12 +49,12 @@ repos:
          - 'prettier-plugin-organize-imports@4.1.0'
  # Python hooks
  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.0
+    rev: v0.14.5
    hooks:
      - id: ruff-check
      - id: ruff-format
  - repo: https://github.com/tox-dev/pyproject-fmt
-    rev: "v2.11.0"
+    rev: "v2.11.1"
    hooks:
      - id: pyproject-fmt
  # Dockerfile hooks
@@ -64,11 +64,11 @@ repos:
      - id: hadolint
  # Shell script hooks
  - repo: https://github.com/lovesegfault/beautysh
-    rev: v6.2.1
+    rev: v6.4.2
    hooks:
      - id: beautysh
-        additional_dependencies:
+        types: [file]
-          - setuptools
+        files: (\.sh$|/run$|/finish$)
        args:
          - "--tab"
  - repo: https://github.com/shellcheck-py/shellcheck-py
@@ -76,7 +76,7 @@ repos:
    hooks:
      - id: shellcheck
  - repo: https://github.com/google/yamlfmt
-    rev: v0.18.0
+    rev: v0.20.0
    hooks:
      - id: yamlfmt
        exclude: "^src-ui/pnpm-lock.yaml"
--- a/35
+++ b/35
@@ -5,14 +5,12 @@
 # Purpose: Compiles the frontend
 # Notes:
 #  - Does PNPM stuff with Typescript and such
-FROM --platform=$BUILDPLATFORM docker.io/node:20-bookworm-slim AS compile-frontend
+FROM --platform=$BUILDPLATFORM docker.io/node:24-trixie-slim AS compile-frontend
 COPY ./src-ui /src/src-ui
 WORKDIR /src/src-ui
 RUN set -eux \
  && npm update -g pnpm \
  && npm install -g corepack@latest \
  && corepack enable \
  && pnpm install
@@ -32,7 +30,7 @@ RUN set -eux \
 # Purpose: Installs s6-overlay and rootfs
 # Comments:
 #  - Don't leave anything extra in here either
-FROM ghcr.io/astral-sh/uv:0.9.4-python3.12-bookworm-slim AS s6-overlay-base
+FROM ghcr.io/astral-sh/uv:0.9.15-python3.12-trixie-slim AS s6-overlay-base
 WORKDIR /usr/src/s6
@@ -102,8 +100,6 @@ ARG TARGETARCH
 # Can be workflow provided, defaults set for manual building
 ARG JBIG2ENC_VERSION=0.30
 ARG QPDF_VERSION=11.9.0
 ARG GS_VERSION=10.03.1
 # Set Python environment variables
 ENV PYTHONDONTWRITEBYTECODE=1 \
@@ -112,8 +108,7 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONWARNINGS="ignore:::django.http.response:517" \
    PNGX_CONTAINERIZED=1 \
    # https://docs.astral.sh/uv/reference/settings/#link-mode
-    UV_LINK_MODE=copy \
+    UV_LINK_MODE=copy
    UV_CACHE_DIR=/cache/uv/
 #
 # Begin installation and configuration
@@ -170,20 +165,8 @@ RUN set -eux \
    && apt-get update \
    && apt-get install --yes --quiet --no-install-recommends ${RUNTIME_PACKAGES} \
    && echo "Installing pre-built updates" \
-      && curl --fail --silent --no-progress-meter --show-error --location --remote-name-all --parallel --parallel-max 4 \
+      && curl --fail --silent --no-progress-meter --show-error --location --remote-name-all \
-        https://github.com/paperless-ngx/builder/releases/download/qpdf-${QPDF_VERSION}/libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/jbig2enc-trixie-v${JBIG2ENC_VERSION}/jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
        https://github.com/paperless-ngx/builder/releases/download/qpdf-${QPDF_VERSION}/qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
        https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
        https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
        https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
        https://github.com/paperless-ngx/builder/releases/download/jbig2enc-${JBIG2ENC_VERSION}/jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
      && echo "Installing qpdf ${QPDF_VERSION}" \
        && dpkg --install ./libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
        && dpkg --install ./qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
      && echo "Installing Ghostscript ${GS_VERSION}" \
        && dpkg --install ./libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
        && dpkg --install ./libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
        && dpkg --install ./ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
      && echo "Installing jbig2enc" \
        && dpkg --install ./jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
      && echo "Configuring imagemagick" \
@@ -207,14 +190,13 @@ ARG BUILD_PACKAGES="\
  pkg-config"
 # hadolint ignore=DL3042
-RUN --mount=type=cache,target=${UV_CACHE_DIR},id=python-cache \
+RUN set -eux \
  set -eux \
  && echo "Installing build system packages" \
    && apt-get update \
    && apt-get install --yes --quiet --no-install-recommends ${BUILD_PACKAGES} \
  && echo "Installing Python requirements" \
    && uv export --quiet --no-dev --all-extras --format requirements-txt --output-file requirements.txt \
-    && uv pip install --system --no-python-downloads --python-preference system --requirements requirements.txt \
+    && uv pip install --no-cache --system --no-python-downloads --python-preference system --requirements requirements.txt \
  && echo "Installing NLTK data" \
    && python3 -W ignore::RuntimeWarning -m nltk.downloader -d "/usr/share/nltk_data" snowball_data \
    && python3 -W ignore::RuntimeWarning -m nltk.downloader -d "/usr/share/nltk_data" stopwords \
@@ -254,7 +236,8 @@ RUN set -eux \
    && chown --from root:root --changes --recursive paperless:paperless /usr/src/paperless \
  && echo "Collecting static files" \
    && s6-setuidgid paperless python3 manage.py collectstatic --clear --no-input --link \
-    && s6-setuidgid paperless python3 manage.py compilemessages
+    && s6-setuidgid paperless python3 manage.py compilemessages \
    && /usr/local/bin/deduplicate.py --verbose /usr/src/paperless/static/
 VOLUME ["/usr/src/paperless/data", \
        "/usr/src/paperless/media", \
--- a/docker/compose/docker-compose.ci-test.yml
+++ b/docker/compose/docker-compose.ci-test.yml
@@ -4,7 +4,7 @@
 # correct networking for the tests
 services:
  gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.24
+    image: docker.io/gotenberg/gotenberg:8.25
    hostname: gotenberg
    container_name: gotenberg
    network_mode: host
--- a/docker/compose/docker-compose.mariadb-tika.yml
+++ b/docker/compose/docker-compose.mariadb-tika.yml
@@ -72,7 +72,7 @@ services:
      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
  gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.24
+    image: docker.io/gotenberg/gotenberg:8.25
    restart: unless-stopped
    # The gotenberg chromium route is used to convert .eml files. We do not
    # want to allow external content like tracking pixels or even javascript.
--- a/docker/compose/docker-compose.postgres-tika.yml
+++ b/docker/compose/docker-compose.postgres-tika.yml
@@ -66,7 +66,7 @@ services:
      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
  gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.24
+    image: docker.io/gotenberg/gotenberg:8.25
    restart: unless-stopped
    # The gotenberg chromium route is used to convert .eml files. We do not
    # want to allow external content like tracking pixels or even javascript.
--- a/docker/compose/docker-compose.sqlite-tika.yml
+++ b/docker/compose/docker-compose.sqlite-tika.yml
@@ -55,7 +55,7 @@ services:
      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
  gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.24
+    image: docker.io/gotenberg/gotenberg:8.25
    restart: unless-stopped
    # The gotenberg chromium route is used to convert .eml files. We do not
    # want to allow external content like tracking pixels or even javascript.
--- a/docker/rootfs/etc/s6-overlay/s6-rc.d/init-env-file/run
+++ b/docker/rootfs/etc/s6-overlay/s6-rc.d/init-env-file/run
@@ -29,5 +29,5 @@ if find /run/s6/container_environment/*"_FILE" -maxdepth 1 > /dev/null 2>&1; the
 		fi
 	done
 else
-		echo "${log_prefix} No *_FILE environment found"
+	echo "${log_prefix} No *_FILE environment found"
 fi
--- a/docker/rootfs/etc/s6-overlay/s6-rc.d/init-wait-for-db/run
+++ b/docker/rootfs/etc/s6-overlay/s6-rc.d/init-wait-for-db/run
@@ -1,70 +1,66 @@
 #!/command/with-contenv /usr/bin/bash
 # shellcheck shell=bash
 # vim: set ft=bash ts=4 sw=4 sts=4 et :
-declare -r log_prefix="[init-db-wait]"
+set -euo pipefail
 declare -r LOG_PREFIX="[init-db-wait]"
 declare -ri TIMEOUT=60
 declare -i ATTEMPT=0
 declare -i DELAY=0
 declare -i STARTED_AT=${EPOCHSECONDS:?EPOCHSECONDS var unset}
 delay_next_attempt() {
 	local -i elapsed=$(( EPOCHSECONDS - STARTED_AT ))
 	local -ri remaining=$(( TIMEOUT - elapsed ))
 	if (( remaining <= 0 )); then
 		echo "${LOG_PREFIX} Unable to connect after $elapsed seconds."
 		exit 1
 	fi
 	DELAY+=1
 	# clamp to remaining time
 	if (( DELAY > remaining )); then
 		DELAY=$remaining
 	fi
 	ATTEMPT+=1
 	echo "${LOG_PREFIX} Attempt $ATTEMPT failed! Trying again in $DELAY seconds..."
 	sleep "$DELAY"
 }
 wait_for_postgres() {
-	local attempt_num=1
+	echo "${LOG_PREFIX} Waiting for PostgreSQL to start..."
 	local -r max_attempts=5
 	echo "${log_prefix} Waiting for PostgreSQL to start..."
 	local -r host="${PAPERLESS_DBHOST:-localhost}"
 	local -r port="${PAPERLESS_DBPORT:-5432}"
 	local -r user="${PAPERLESS_DBUSER:-paperless}"
-	# Disable warning, host and port can't have spaces
+	while ! pg_isready -h "${host}" -p "${port}" --username "${user}"; do
-	# shellcheck disable=SC2086
+		delay_next_attempt
 	while [ ! "$(pg_isready -h ${host} -p ${port} --username ${user})" ]; do
 		if [ $attempt_num -eq $max_attempts ]; then
 			echo "${log_prefix} Unable to connect to database."
 			exit 1
 		else
 			echo "${log_prefix} Attempt $attempt_num failed! Trying again in 5 seconds..."
 		fi
 		attempt_num=$(("$attempt_num" + 1))
 		sleep 5
 	done
-	# Extra in case this is a first start
+	echo "${LOG_PREFIX} Connected to PostgreSQL"
 	sleep 5
 	echo "Connected to PostgreSQL"
 }
 wait_for_mariadb() {
-	echo "${log_prefix} Waiting for MariaDB to start..."
+	echo "${LOG_PREFIX} Waiting for MariaDB to start..."
-	local -r host="${PAPERLESS_DBHOST:=localhost}"
+	local -r host="${PAPERLESS_DBHOST:-localhost}"
-	local -r port="${PAPERLESS_DBPORT:=3306}"
+	local -r port="${PAPERLESS_DBPORT:-3306}"
-	local attempt_num=1
+	while ! mariadb-admin --host="${host}" --port="${port}" --skip-ssl ping --silent >/dev/null 2>&1; do
-	local -r max_attempts=5
+		delay_next_attempt
 	# Disable warning, host and port can't have spaces
 	# shellcheck disable=SC2086
 	while ! true > /dev/tcp/$host/$port; do
 		if [ $attempt_num -eq $max_attempts ]; then
 			echo "${log_prefix} Unable to connect to database."
 			exit 1
 		else
 			echo "${log_prefix} Attempt $attempt_num failed! Trying again in 5 seconds..."
 		fi
 		attempt_num=$(("$attempt_num" + 1))
 		sleep 5
 	done
-	echo "Connected to MariaDB"
+	echo "${LOG_PREFIX} Connected to MariaDB"
 }
-if [[ "${PAPERLESS_DBENGINE}" == "mariadb" ]]; then
+if [[ "${PAPERLESS_DBENGINE:-}" == "mariadb" ]]; then
 	echo "${log_prefix} Waiting for MariaDB to report ready"
 	wait_for_mariadb
-elif [[ -n "${PAPERLESS_DBHOST}" ]]; then
+elif [[ -n "${PAPERLESS_DBHOST:-}" ]]; then
 	echo "${log_prefix} Waiting for postgresql to report ready"
 	wait_for_postgres
 fi
-	echo "${log_prefix} Database is ready"
+echo "${LOG_PREFIX} Database is ready"
--- a/docker/rootfs/etc/s6-overlay/s6-rc.d/svc-webserver/run
+++ b/docker/rootfs/etc/s6-overlay/s6-rc.d/svc-webserver/run
@@ -10,11 +10,11 @@ export GRANIAN_WORKERS=${GRANIAN_WORKERS:-${PAPERLESS_WEBSERVER_WORKERS:-1}}
 # Only set GRANIAN_URL_PATH_PREFIX if PAPERLESS_FORCE_SCRIPT_NAME is set
 if [[ -n "${PAPERLESS_FORCE_SCRIPT_NAME}" ]]; then
-  export GRANIAN_URL_PATH_PREFIX=${PAPERLESS_FORCE_SCRIPT_NAME}
+	export GRANIAN_URL_PATH_PREFIX=${PAPERLESS_FORCE_SCRIPT_NAME}
 fi
 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-  exec granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
+	exec granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
 else
-  exec s6-setuidgid paperless granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
+	exec s6-setuidgid paperless granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
 fi
--- a/docker/rootfs/usr/local/bin/deduplicate.py
+++ b/docker/rootfs/usr/local/bin/deduplicate.py
@@ -0,0 +1,167 @@
 #!/usr/bin/env python3
 """
 File deduplication script that replaces identical files with symlinks.
 Uses SHA256 hashing to identify duplicate files.
 """
 import hashlib
 from collections import defaultdict
 from pathlib import Path
 import click
 import humanize
 def calculate_sha256(filepath: Path) -> str | None:
    sha256_hash = hashlib.sha256()
    try:
        with filepath.open("rb") as f:
            # Read file in chunks to handle large files efficiently
            while chunk := f.read(65536):  # 64KB chunks
                sha256_hash.update(chunk)
        return sha256_hash.hexdigest()
    except OSError as e:
        click.echo(f"Error reading {filepath}: {e}", err=True)
        return None
 def find_duplicate_files(directory: Path) -> dict[str, list[Path]]:
    """
    Recursively scan directory and group files by their SHA256 hash.
    Returns a dictionary mapping hash -> list of file paths.
    """
    hash_to_files: dict[str, list[Path]] = defaultdict(list)
    for filepath in directory.rglob("*"):
        # Skip symlinks
        if filepath.is_symlink():
            continue
        # Skip if not a regular file
        if not filepath.is_file():
            continue
        file_hash = calculate_sha256(filepath)
        if file_hash:
            hash_to_files[file_hash].append(filepath)
    # Filter to only return hashes with duplicates
    return {h: files for h, files in hash_to_files.items() if len(files) > 1}
 def replace_with_symlinks(
    duplicate_groups: dict[str, list[Path]],
    *,
    dry_run: bool = False,
 ) -> tuple[int, int]:
    """
    Replace duplicate files with symlinks to the first occurrence.
    Returns (number_of_files_replaced, space_saved_in_bytes).
    """
    total_duplicates = 0
    space_saved = 0
    for file_hash, file_list in duplicate_groups.items():
        # Keep the first file as the original, replace others with symlinks
        original_file = file_list[0]
        duplicates = file_list[1:]
        click.echo(f"Found {len(duplicates)} duplicate(s) of: {original_file}")
        for duplicate in duplicates:
            try:
                # Get file size before deletion
                file_size = duplicate.stat().st_size
                if dry_run:
                    click.echo(f"  [DRY RUN] Would replace: {duplicate}")
                else:
                    # Remove the duplicate file
                    duplicate.unlink()
                    # Create relative symlink if possible, otherwise absolute
                    try:
                        # Try to create a relative symlink
                        rel_path = original_file.relative_to(duplicate.parent)
                        duplicate.symlink_to(rel_path)
                        click.echo(f"  Replaced: {duplicate} -> {rel_path}")
                    except ValueError:
                        # Fall back to absolute path
                        duplicate.symlink_to(original_file.resolve())
                        click.echo(f"  Replaced: {duplicate} -> {original_file}")
                    space_saved += file_size
                total_duplicates += 1
            except OSError as e:
                click.echo(f"  Error replacing {duplicate}: {e}", err=True)
    return total_duplicates, space_saved
@click.command()
@click.argument(
    "directory",
    type=click.Path(
        exists=True,
        file_okay=False,
        dir_okay=True,
        readable=True,
        path_type=Path,
    ),
 )
@click.option(
    "--dry-run",
    is_flag=True,
    help="Show what would be done without making changes",
 )
@click.option("--verbose", "-v", is_flag=True, help="Show verbose output")
 def deduplicate(directory: Path, *, dry_run: bool, verbose: bool) -> None:
    """
    Recursively search DIRECTORY for identical files and replace them with symlinks.
    Uses SHA256 hashing to identify duplicate files. The first occurrence of each
    unique file is kept, and all duplicates are replaced with symlinks pointing to it.
    """
    directory = directory.resolve()
    click.echo(f"Scanning directory: {directory}")
    if dry_run:
        click.echo("Running in DRY RUN mode - no changes will be made")
    # Find all duplicate files
    click.echo("Calculating file hashes...")
    duplicate_groups = find_duplicate_files(directory)
    if not duplicate_groups:
        click.echo("No duplicate files found!")
        return
    total_files = sum(len(files) - 1 for files in duplicate_groups.values())
    click.echo(
        f"Found {len(duplicate_groups)} group(s) of duplicates "
        f"({total_files} files to deduplicate)",
    )
    if verbose:
        for file_hash, files in duplicate_groups.items():
            click.echo(f"Hash: {file_hash}")
            for f in files:
                click.echo(f"  - {f}")
    # Replace duplicates with symlinks
    click.echo("Processing duplicates...")
    num_replaced, space_saved = replace_with_symlinks(duplicate_groups, dry_run=dry_run)
    # Summary
    click.echo(
        f"{'Would replace' if dry_run else 'Replaced'} "
        f"{num_replaced} duplicate file(s)",
    )
    if not dry_run:
        click.echo(f"Space saved: {humanize.naturalsize(space_saved, binary=True)}")
 if __name__ == "__main__":
    deduplicate()
--- a/docs/api.md
+++ b/docs/api.md
@@ -294,6 +294,13 @@ The following methods are supported:
        -   `"delete_original": true` to delete the original documents after editing.
        -   `"update_document": true` to update the existing document with the edited PDF.
        -   `"include_metadata": true` to copy metadata from the original document to the edited document.
 -   `remove_password`
    -   Requires `parameters`:
        -   `"password": "PASSWORD_STRING"` The password to remove from the PDF documents.
    -   Optional `parameters`:
        -   `"update_document": true` to replace the existing document with the password-less PDF.
        -   `"delete_original": true` to delete the original document after editing.
        -   `"include_metadata": true` to copy metadata from the original document to the new password-less document.
 -   `merge`
    -   No additional `parameters` required.
    -   The ordering of the merged document is determined by the list of IDs.
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -1,5 +1,293 @@
 # Changelog
 ## paperless-ngx 2.20.3
 ## paperless-ngx 2.20.2
 ### Features / Enhancements
 -   Tweakhancement: dim inactive users in users-groups list [@shamoon](https://github.com/shamoon) ([#11537](https://github.com/paperless-ngx/paperless-ngx/pull/11537))
 ### Bug Fixes
 -   Fix: Expanded SVG validation whitelist and additional checks [@stumpylog](https://github.com/stumpylog) ([#11590](https://github.com/paperless-ngx/paperless-ngx/pull/11590))
 -   Fix: normalize allowed SVG tag and attribute names, add version [@shamoon](https://github.com/shamoon) ([#11586](https://github.com/paperless-ngx/paperless-ngx/pull/11586))
 -   Fix: pass additional arguments to TagSerializer for permissions [@shamoon](https://github.com/shamoon) ([#11576](https://github.com/paperless-ngx/paperless-ngx/pull/11576))
 ### Maintenance
 -   Chore(deps): Bump actions/checkout from 5 to 6 in the actions group @[dependabot[bot]](https://github.com/apps/dependabot) ([#11515](https://github.com/paperless-ngx/paperless-ngx/pull/11515))
 ### Dependencies
 <details>
 <summary>6 changes</summary>
 -   Chore: update Angular dependencies to 20.3.15 [@shamoon](https://github.com/shamoon) ([#11568](https://github.com/paperless-ngx/paperless-ngx/pull/11568))
 -   Chore(deps): Bump actions/checkout from 5 to 6 in the actions group @[dependabot[bot]](https://github.com/apps/dependabot) ([#11515](https://github.com/paperless-ngx/paperless-ngx/pull/11515))
 -   Chore(deps-dev): Bump webpack from 5.102.1 to 5.103.0 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11513](https://github.com/paperless-ngx/paperless-ngx/pull/11513))
 -   Chore(deps-dev): Bump @playwright/test from 1.56.1 to 1.57.0 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11514](https://github.com/paperless-ngx/paperless-ngx/pull/11514))
 -   Chore(deps-dev): Bump the frontend-eslint-dependencies group in /src-ui with 3 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11512](https://github.com/paperless-ngx/paperless-ngx/pull/11512))
 -   docker(deps): bump astral-sh/uv from 0.9.14-python3.12-trixie-slim to 0.9.15-python3.12-trixie-slim @[dependabot[bot]](https://github.com/apps/dependabot) ([#11533](https://github.com/paperless-ngx/paperless-ngx/pull/11533))
 </details>
 ### All App Changes
 <details>
 <summary>12 changes</summary>
 -   Fix: Expanded SVG validation whitelist and additional checks [@stumpylog](https://github.com/stumpylog) ([#11590](https://github.com/paperless-ngx/paperless-ngx/pull/11590))
 -   Fixhancement: pass ordering to tag children [@shamoon](https://github.com/shamoon) ([#11556](https://github.com/paperless-ngx/paperless-ngx/pull/11556))
 -   Performance: avoid unnecessary filename operations on bulk custom field updates [@shamoon](https://github.com/shamoon) ([#11558](https://github.com/paperless-ngx/paperless-ngx/pull/11558))
 -   Fix: normalize allowed SVG tag and attribute names, add version [@shamoon](https://github.com/shamoon) ([#11586](https://github.com/paperless-ngx/paperless-ngx/pull/11586))
 -   Chore: refactor workflows code [@shamoon](https://github.com/shamoon) ([#11563](https://github.com/paperless-ngx/paperless-ngx/pull/11563))
 -   Fix: pass additional arguments to TagSerializer for permissions [@shamoon](https://github.com/shamoon) ([#11576](https://github.com/paperless-ngx/paperless-ngx/pull/11576))
 -   Chore: update Angular dependencies to 20.3.15 [@shamoon](https://github.com/shamoon) ([#11568](https://github.com/paperless-ngx/paperless-ngx/pull/11568))
 -   Chore(deps-dev): Bump webpack from 5.102.1 to 5.103.0 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11513](https://github.com/paperless-ngx/paperless-ngx/pull/11513))
 -   Chore(deps-dev): Bump @playwright/test from 1.56.1 to 1.57.0 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11514](https://github.com/paperless-ngx/paperless-ngx/pull/11514))
 -   Chore(deps-dev): Bump the frontend-eslint-dependencies group in /src-ui with 3 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11512](https://github.com/paperless-ngx/paperless-ngx/pull/11512))
 -   Tweakhancement: dim inactive users in users-groups list [@shamoon](https://github.com/shamoon) ([#11537](https://github.com/paperless-ngx/paperless-ngx/pull/11537))
 -   Chore: add some output of social login errors [@shamoon](https://github.com/shamoon) ([#11527](https://github.com/paperless-ngx/paperless-ngx/pull/11527))
 </details>
 ## paperless-ngx 2.20.1
 ### Bug Fixes
 -   Fix: set search term when using advanced search from global search [@shamoon](https://github.com/shamoon) ([#11503](https://github.com/paperless-ngx/paperless-ngx/pull/11503))
 -   Fix: change async handling of select custom field updates [@shamoon](https://github.com/shamoon) ([#11490](https://github.com/paperless-ngx/paperless-ngx/pull/11490))
 -   Fix: skip SSL for MariaDB ping in init script [@danielrheinbay](https://github.com/danielrheinbay) ([#11491](https://github.com/paperless-ngx/paperless-ngx/pull/11491))
 -   Fix: handle allauth groups location breaking change [@shamoon](https://github.com/shamoon) ([#11471](https://github.com/paperless-ngx/paperless-ngx/pull/11471))
 ### Dependencies
 -   docker(deps): Bump astral-sh/uv from 0.9.10-python3.12-trixie-slim to 0.9.11-python3.12-trixie-slim @[dependabot[bot]](https://github.com/apps/dependabot) ([#11450](https://github.com/paperless-ngx/paperless-ngx/pull/11450))
 -   Chore(deps): Bump @angular/common from 20.3.12 to 20.3.14 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11481](https://github.com/paperless-ngx/paperless-ngx/pull/11481))
 ### All App Changes
 <details>
 <summary>4 changes</summary>
 -   Fix: set search term when using advanced search from global search [@shamoon](https://github.com/shamoon) ([#11503](https://github.com/paperless-ngx/paperless-ngx/pull/11503))
 -   Fix: change async handling of select custom field updates [@shamoon](https://github.com/shamoon) ([#11490](https://github.com/paperless-ngx/paperless-ngx/pull/11490))
 -   Chore(deps): Bump @angular/common from 20.3.12 to 20.3.14 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11481](https://github.com/paperless-ngx/paperless-ngx/pull/11481))
 -   Fix: handle allauth groups location breaking change [@shamoon](https://github.com/shamoon) ([#11471](https://github.com/paperless-ngx/paperless-ngx/pull/11471))
 </details>
 ## paperless-ngx 2.20.0
 ### Notable Changes
 -   Feature: Upgrade underlying Docker image to Trixie [@stumpylog](https://github.com/stumpylog) ([#10562](https://github.com/paperless-ngx/paperless-ngx/pull/10562))
 ### Features / Enhancements
 -   Feature: Upgrade underlying Docker image to Trixie [@stumpylog](https://github.com/stumpylog) ([#10562](https://github.com/paperless-ngx/paperless-ngx/pull/10562))
 -   Fixhancement: more log viewer improvements [@shamoon](https://github.com/shamoon) ([#11426](https://github.com/paperless-ngx/paperless-ngx/pull/11426))
 -   Performance: Replace duplicated static files with symlinks [@stumpylog](https://github.com/stumpylog) ([#11418](https://github.com/paperless-ngx/paperless-ngx/pull/11418))
 -   Enhancement: add more relative dates, support modified [@shamoon](https://github.com/shamoon) ([#11411](https://github.com/paperless-ngx/paperless-ngx/pull/11411))
 -   Performance: make move files after select custom field change async [@shamoon](https://github.com/shamoon) ([#11391](https://github.com/paperless-ngx/paperless-ngx/pull/11391))
 -   Enhancement: Use a better check for the MariaDB server to be ready [@stumpylog](https://github.com/stumpylog) ([#11396](https://github.com/paperless-ngx/paperless-ngx/pull/11396))
 -   Enhancement: speed-up docker container startup [@flrgh](https://github.com/flrgh) ([#11134](https://github.com/paperless-ngx/paperless-ngx/pull/11134))
 ### Bug Fixes
 -   Fix: prevent focus loss from change detection in cf query dropdown [@shamoon](https://github.com/shamoon) ([#11409](https://github.com/paperless-ngx/paperless-ngx/pull/11409))
 -   Fix: sort editing filterable dropdowns sooner [@shamoon](https://github.com/shamoon) ([#11404](https://github.com/paperless-ngx/paperless-ngx/pull/11404))
 -   Fix: support for custom field ordering w advanced search [@shamoon](https://github.com/shamoon) ([#11383](https://github.com/paperless-ngx/paperless-ngx/pull/11383))
 ### Maintenance
 -   Chore(deps): Bump the actions group with 7 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11259](https://github.com/paperless-ngx/paperless-ngx/pull/11259))
 ### Dependencies
 <details>
 <summary>16 changes</summary>
 -   Chore: Upgrades psycopg to 3.2.12 [@stumpylog](https://github.com/stumpylog) ([#11420](https://github.com/paperless-ngx/paperless-ngx/pull/11420))
 -   Chore(deps-dev): Bump glob from 10.4.1 to 10.5.0 in /src/paperless_mail/templates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11413](https://github.com/paperless-ngx/paperless-ngx/pull/11413))
 -   docker-compose(deps): bump gotenberg/gotenberg from 8.24 to 8.25 in /docker/compose @[dependabot[bot]](https://github.com/apps/dependabot) ([#11393](https://github.com/paperless-ngx/paperless-ngx/pull/11393))
 -   Chore(deps): Bump the frontend-angular-dependencies group in /src-ui with 21 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11260](https://github.com/paperless-ngx/paperless-ngx/pull/11260))
 -   Chore(deps-dev): Bump @playwright/test from 1.55.1 to 1.56.1 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11263](https://github.com/paperless-ngx/paperless-ngx/pull/11263))
 -   Chore(deps-dev): Bump webpack from 5.102.0 to 5.102.1 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11264](https://github.com/paperless-ngx/paperless-ngx/pull/11264))
 -   Chore(deps-dev): Bump the frontend-eslint-dependencies group in /src-ui with 4 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11262](https://github.com/paperless-ngx/paperless-ngx/pull/11262))
 -   Chore(deps-dev): Bump jest-preset-angular from 15.0.2 to 15.0.3 in /src-ui in the frontend-jest-dependencies group @[dependabot[bot]](https://github.com/apps/dependabot) ([#11261](https://github.com/paperless-ngx/paperless-ngx/pull/11261))
 -   Chore(deps-dev): Bump @types/node from 24.6.1 to 24.9.2 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11265](https://github.com/paperless-ngx/paperless-ngx/pull/11265))
 -   Chore(deps): Bump the small-changes group across 1 directory with 11 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11337](https://github.com/paperless-ngx/paperless-ngx/pull/11337))
 -   Chore(deps): Bump django-auditlog from 3.2.1 to 3.3.0 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11021](https://github.com/paperless-ngx/paperless-ngx/pull/11021))
 -   Chore(deps): Bump the actions group with 7 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11259](https://github.com/paperless-ngx/paperless-ngx/pull/11259))
 -   Chore(deps): Bump drf-spectacular-sidecar from 2025.9.1 to 2025.10.1 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11019](https://github.com/paperless-ngx/paperless-ngx/pull/11019))
 -   Chore(deps): Bump django-filter from 25.1 to 25.2 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11020](https://github.com/paperless-ngx/paperless-ngx/pull/11020))
 -   Chore(deps): Update django-allauth[mfa,socialaccount] requirement from ~=65.4.0 to ~=65.12.1 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11198](https://github.com/paperless-ngx/paperless-ngx/pull/11198))
 -   docker(deps): bump astral-sh/uv from 0.9.9-python3.12-bookworm-slim to 0.9.10-python3.12-bookworm-slim @[dependabot[bot]](https://github.com/apps/dependabot) ([#11394](https://github.com/paperless-ngx/paperless-ngx/pull/11394))
 </details>
 ### All App Changes
 <details>
 <summary>19 changes</summary>
 -   Fixhancement: more log viewer improvements [@shamoon](https://github.com/shamoon) ([#11426](https://github.com/paperless-ngx/paperless-ngx/pull/11426))
 -   Chore: Upgrades psycopg to 3.2.12 [@stumpylog](https://github.com/stumpylog) ([#11420](https://github.com/paperless-ngx/paperless-ngx/pull/11420))
 -   Enhancement: add more relative dates, support modified [@shamoon](https://github.com/shamoon) ([#11411](https://github.com/paperless-ngx/paperless-ngx/pull/11411))
 -   Chore(deps-dev): Bump glob from 10.4.1 to 10.5.0 in /src/paperless_mail/templates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11413](https://github.com/paperless-ngx/paperless-ngx/pull/11413))
 -   Performance: make move files after select custom field change async [@shamoon](https://github.com/shamoon) ([#11391](https://github.com/paperless-ngx/paperless-ngx/pull/11391))
 -   Fix: prevent focus loss from change detection in cf query dropdown [@shamoon](https://github.com/shamoon) ([#11409](https://github.com/paperless-ngx/paperless-ngx/pull/11409))
 -   Fix: sort editing filterable dropdowns sooner [@shamoon](https://github.com/shamoon) ([#11404](https://github.com/paperless-ngx/paperless-ngx/pull/11404))
 -   Chore(deps): Bump the frontend-angular-dependencies group in /src-ui with 21 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11260](https://github.com/paperless-ngx/paperless-ngx/pull/11260))
 -   Chore(deps-dev): Bump @playwright/test from 1.55.1 to 1.56.1 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11263](https://github.com/paperless-ngx/paperless-ngx/pull/11263))
 -   Chore(deps-dev): Bump webpack from 5.102.0 to 5.102.1 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11264](https://github.com/paperless-ngx/paperless-ngx/pull/11264))
 -   Chore(deps-dev): Bump the frontend-eslint-dependencies group in /src-ui with 4 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11262](https://github.com/paperless-ngx/paperless-ngx/pull/11262))
 -   Chore(deps-dev): Bump jest-preset-angular from 15.0.2 to 15.0.3 in /src-ui in the frontend-jest-dependencies group @[dependabot[bot]](https://github.com/apps/dependabot) ([#11261](https://github.com/paperless-ngx/paperless-ngx/pull/11261))
 -   Chore(deps-dev): Bump @types/node from 24.6.1 to 24.9.2 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#11265](https://github.com/paperless-ngx/paperless-ngx/pull/11265))
 -   Chore(deps): Bump the small-changes group across 1 directory with 11 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#11337](https://github.com/paperless-ngx/paperless-ngx/pull/11337))
 -   Chore(deps): Bump django-auditlog from 3.2.1 to 3.3.0 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11021](https://github.com/paperless-ngx/paperless-ngx/pull/11021))
 -   Chore(deps): Bump drf-spectacular-sidecar from 2025.9.1 to 2025.10.1 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11019](https://github.com/paperless-ngx/paperless-ngx/pull/11019))
 -   Chore(deps): Bump django-filter from 25.1 to 25.2 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11020](https://github.com/paperless-ngx/paperless-ngx/pull/11020))
 -   Chore(deps): Update django-allauth[mfa,socialaccount] requirement from ~=65.4.0 to ~=65.12.1 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11198](https://github.com/paperless-ngx/paperless-ngx/pull/11198))
 -   Fix: support for custom field ordering w advanced search [@shamoon](https://github.com/shamoon) ([#11383](https://github.com/paperless-ngx/paperless-ngx/pull/11383))
 </details>
 ## paperless-ngx 2.19.6
 ### Bug Fixes
 -   Chore: include password validation on user edit [@shamoon](https://github.com/shamoon) ([#11308](https://github.com/paperless-ngx/paperless-ngx/pull/11308))
 -   Fix: include BASE_URL when constructing for workflows [@ebardsley](https://github.com/ebardsley) ([#11360](https://github.com/paperless-ngx/paperless-ngx/pull/11360))
 -   Fixhancement: refactor email attachment logic [@shamoon](https://github.com/shamoon) ([#11336](https://github.com/paperless-ngx/paperless-ngx/pull/11336))
 -   Fixhancement: trim whitespace for some text searches [@shamoon](https://github.com/shamoon) ([#11357](https://github.com/paperless-ngx/paperless-ngx/pull/11357))
 -   Fix: update Outlook refresh token when refreshed [@shamoon](https://github.com/shamoon) ([#11341](https://github.com/paperless-ngx/paperless-ngx/pull/11341))
 -   Fix: only cache remote version data for version checking [@shamoon](https://github.com/shamoon) ([#11320](https://github.com/paperless-ngx/paperless-ngx/pull/11320))
 -   Fix: include replace none logic in storage path preview, improve jinja conditionals for empty metadata [@shamoon](https://github.com/shamoon) ([#11315](https://github.com/paperless-ngx/paperless-ngx/pull/11315))
 ### Dependencies
 -   docker(deps): bump astral-sh/uv from 0.9.7-python3.12-bookworm-slim to 0.9.9-python3.12-bookworm-slim @[dependabot[bot]](https://github.com/apps/dependabot) ([#11338](https://github.com/paperless-ngx/paperless-ngx/pull/11338))
 ### All App Changes
 <details>
 <summary>7 changes</summary>
 -   Fix: include BASE_URL when constructing for workflows [@ebardsley](https://github.com/ebardsley) ([#11360](https://github.com/paperless-ngx/paperless-ngx/pull/11360))
 -   Fixhancement: refactor email attachment logic [@shamoon](https://github.com/shamoon) ([#11336](https://github.com/paperless-ngx/paperless-ngx/pull/11336))
 -   Fixhancement: trim whitespace for some text searches [@shamoon](https://github.com/shamoon) ([#11357](https://github.com/paperless-ngx/paperless-ngx/pull/11357))
 -   Fix: update Outlook refresh token when refreshed [@shamoon](https://github.com/shamoon) ([#11341](https://github.com/paperless-ngx/paperless-ngx/pull/11341))
 -   Fix: only cache remote version data for version checking [@shamoon](https://github.com/shamoon) ([#11320](https://github.com/paperless-ngx/paperless-ngx/pull/11320))
 -   Fix: include replace none logic in storage path preview, improve jinja conditionals for empty metadata [@shamoon](https://github.com/shamoon) ([#11315](https://github.com/paperless-ngx/paperless-ngx/pull/11315))
 -   Chore: include password validation on user edit [@shamoon](https://github.com/shamoon) ([#11308](https://github.com/paperless-ngx/paperless-ngx/pull/11308))
 </details>
 ## paperless-ngx 2.19.5
 ### Bug Fixes
 -   Fix: ensure custom field query propagation, change detection [@shamoon](https://github.com/shamoon) ([#11291](https://github.com/paperless-ngx/paperless-ngx/pull/11291))
 ### Dependencies
 -   docker(deps): Bump astral-sh/uv from 0.9.4-python3.12-bookworm-slim to 0.9.7-python3.12-bookworm-slim @[dependabot[bot]](https://github.com/apps/dependabot) ([#11283](https://github.com/paperless-ngx/paperless-ngx/pull/11283))
 ### All App Changes
 -   Fix: ensure custom field query propagation, change detection [@shamoon](https://github.com/shamoon) ([#11291](https://github.com/paperless-ngx/paperless-ngx/pull/11291))
 ## paperless-ngx 2.19.4
 ### Bug Fixes
 -   Fix: use original_file when attaching docs to workflow emails with added trigger [@shamoon](https://github.com/shamoon) ([#11266](https://github.com/paperless-ngx/paperless-ngx/pull/11266))
 -   Fix: mark 'Select' button in doc list for translation [@shamoon](https://github.com/shamoon) ([#11278](https://github.com/paperless-ngx/paperless-ngx/pull/11278))
 -   Fix: respect fields parameter for created field [@shamoon](https://github.com/shamoon) ([#11251](https://github.com/paperless-ngx/paperless-ngx/pull/11251))
 -   Fix: improve legibility of processed mail error popover in light mode [@shamoon](https://github.com/shamoon) ([#11258](https://github.com/paperless-ngx/paperless-ngx/pull/11258))
 -   Fixhancement: truncate large logs, improve auto-scroll [@shamoon](https://github.com/shamoon) ([#11239](https://github.com/paperless-ngx/paperless-ngx/pull/11239))
 -   Chore: add max-height and overflow to processedmail error popover [@shamoon](https://github.com/shamoon) ([#11252](https://github.com/paperless-ngx/paperless-ngx/pull/11252))
 -   Fix: delay iframe DOM removal, handle onafterprint error for print in FF [@shamoon](https://github.com/shamoon) ([#11237](https://github.com/paperless-ngx/paperless-ngx/pull/11237))
 -   Fix: de-deduplicate children in tag list when filtering [@shamoon](https://github.com/shamoon) ([#11229](https://github.com/paperless-ngx/paperless-ngx/pull/11229))
 ### Performance
 -   Performance: re-enable virtual scroll, bump ng-select [@shamoon](https://github.com/shamoon) ([#11279](https://github.com/paperless-ngx/paperless-ngx/pull/11279))
 -   Performance: use virtual scroll container and log level parsing for logs view [@MickLesk](https://github.com/MickLesk) ([#11233](https://github.com/paperless-ngx/paperless-ngx/pull/11233))
 ### All App Changes
 <details>
 <summary>11 changes</summary>
 -   Performance: re-enable virtual scroll, bump ng-select [@shamoon](https://github.com/shamoon) ([#11279](https://github.com/paperless-ngx/paperless-ngx/pull/11279))
 -   Fix: use original_file when attaching docs to workflow emails with added trigger [@shamoon](https://github.com/shamoon) ([#11266](https://github.com/paperless-ngx/paperless-ngx/pull/11266))
 -   Fix: mark 'Select' button in doc list for translation [@shamoon](https://github.com/shamoon) ([#11278](https://github.com/paperless-ngx/paperless-ngx/pull/11278))
 -   Fix: respect fields parameter for created field [@shamoon](https://github.com/shamoon) ([#11251](https://github.com/paperless-ngx/paperless-ngx/pull/11251))
 -   Fix: improve legibility of processed mail error popover in light mode [@shamoon](https://github.com/shamoon) ([#11258](https://github.com/paperless-ngx/paperless-ngx/pull/11258))
 -   Fixhancement: truncate large logs, improve auto-scroll [@shamoon](https://github.com/shamoon) ([#11239](https://github.com/paperless-ngx/paperless-ngx/pull/11239))
 -   Chore: add max-height and overflow to processedmail error popover [@shamoon](https://github.com/shamoon) ([#11252](https://github.com/paperless-ngx/paperless-ngx/pull/11252))
 -   Fix: delay iframe DOM removal, handle onafterprint error for print in FF [@shamoon](https://github.com/shamoon) ([#11237](https://github.com/paperless-ngx/paperless-ngx/pull/11237))
 -   Performance: use virtual scroll container and log level parsing for logs view [@MickLesk](https://github.com/MickLesk) ([#11233](https://github.com/paperless-ngx/paperless-ngx/pull/11233))
 -   Chore: cache Github version check for 15 minutes [@shamoon](https://github.com/shamoon) ([#11235](https://github.com/paperless-ngx/paperless-ngx/pull/11235))
 -   Fix: de-deduplicate children in tag list when filtering [@shamoon](https://github.com/shamoon) ([#11229](https://github.com/paperless-ngx/paperless-ngx/pull/11229))
 </details>
 ## paperless-ngx 2.19.3
 ### Bug Fixes
 -   Fix: remove unnecessary permission requirements for new email endpoint [@shamoon](https://github.com/shamoon) ([#11215](https://github.com/paperless-ngx/paperless-ngx/pull/11215))
 -   Fix: refactor nested sorting in filterable dropdowns [@shamoon](https://github.com/shamoon) ([#11214](https://github.com/paperless-ngx/paperless-ngx/pull/11214))
 -   Fix: add root tag filtering for tag list page consistency, fix toggle all [@shamoon](https://github.com/shamoon) ([#11208](https://github.com/paperless-ngx/paperless-ngx/pull/11208))
 -   Fix: support ConsumableDocument in email attachments [@shamoon](https://github.com/shamoon) ([#11196](https://github.com/paperless-ngx/paperless-ngx/pull/11196))
 -   Fix: add missing import for ConfirmButtonComponent in user-edit-dialog [@shamoon](https://github.com/shamoon) ([#11167](https://github.com/paperless-ngx/paperless-ngx/pull/11167))
 -   Fix: resolve migration warning in 2.19.2 [@shamoon](https://github.com/shamoon) ([#11157](https://github.com/paperless-ngx/paperless-ngx/pull/11157))
 ### Changes
 -   Change: make workflow action only title draggable [@shamoon](https://github.com/shamoon) ([#11209](https://github.com/paperless-ngx/paperless-ngx/pull/11209))
 -   Change: change workflowrun to softdeletemodel [@shamoon](https://github.com/shamoon) ([#11194](https://github.com/paperless-ngx/paperless-ngx/pull/11194))
 ### Dependencies
 -   Chore(deps): Bump django from 5.2.6 to 5.2.7 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11200](https://github.com/paperless-ngx/paperless-ngx/pull/11200))
 ### All App Changes
 <details>
 <summary>9 changes</summary>
 -   Chore(deps): Bump django from 5.2.6 to 5.2.7 @[dependabot[bot]](https://github.com/apps/dependabot) ([#11200](https://github.com/paperless-ngx/paperless-ngx/pull/11200))
 -   Fix: remove unnecessary permission requirements for new email endpoint [@shamoon](https://github.com/shamoon) ([#11215](https://github.com/paperless-ngx/paperless-ngx/pull/11215))
 -   Fix: refactor nested sorting in filterable dropdowns [@shamoon](https://github.com/shamoon) ([#11214](https://github.com/paperless-ngx/paperless-ngx/pull/11214))
 -   Fix: add root tag filtering for tag list page consistency, fix toggle all [@shamoon](https://github.com/shamoon) ([#11208](https://github.com/paperless-ngx/paperless-ngx/pull/11208))
 -   Change: make workflow action only title draggable [@shamoon](https://github.com/shamoon) ([#11209](https://github.com/paperless-ngx/paperless-ngx/pull/11209))
 -   Change: change workflowrun to softdeletemodel [@shamoon](https://github.com/shamoon) ([#11194](https://github.com/paperless-ngx/paperless-ngx/pull/11194))
 -   Chore: Minor migration optimization for workflow titles [@stumpylog](https://github.com/stumpylog) ([#11197](https://github.com/paperless-ngx/paperless-ngx/pull/11197))
 -   Fix: support ConsumableDocument in email attachments [@shamoon](https://github.com/shamoon) ([#11196](https://github.com/paperless-ngx/paperless-ngx/pull/11196))
 -   Fix: add missing import for ConfirmButtonComponent in user-edit-dialog [@shamoon](https://github.com/shamoon) ([#11167](https://github.com/paperless-ngx/paperless-ngx/pull/11167))
 -   Fix: resolve migration warning in 2.19.2 [@shamoon](https://github.com/shamoon) ([#11157](https://github.com/paperless-ngx/paperless-ngx/pull/11157))
 </details>
 ## paperless-ngx 2.19.2
 ### Features / Enhancements
 -   Fixhancement: display loading status for tags instead of 'Private' [@shamoon](https://github.com/shamoon) ([#11140](https://github.com/paperless-ngx/paperless-ngx/pull/11140))
 ### Bug Fixes
 -   Fix: Remove edit requirement for bulk email, show based on setting [@shamoon](https://github.com/shamoon) ([#11149](https://github.com/paperless-ngx/paperless-ngx/pull/11149))
 -   Fix: handle undefined IDs in getOriginalObject [@shamoon](https://github.com/shamoon) ([#11147](https://github.com/paperless-ngx/paperless-ngx/pull/11147))
 ### All App Changes
 <details>
 <summary>3 changes</summary>
 -   Fix: Remove edit requirement for bulk email, show based on setting [@shamoon](https://github.com/shamoon) ([#11149](https://github.com/paperless-ngx/paperless-ngx/pull/11149))
 -   Fix: handle undefined IDs in getOriginalObject [@shamoon](https://github.com/shamoon) ([#11147](https://github.com/paperless-ngx/paperless-ngx/pull/11147))
 -   Fixhancement: display loading status for tags instead of 'Private' [@shamoon](https://github.com/shamoon) ([#11140](https://github.com/paperless-ngx/paperless-ngx/pull/11140))
 </details>
 ## paperless-ngx 2.19.1
 ### Bug Fixes
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -1007,7 +1007,7 @@ still perform some basic text pre-processing before matching.
 : See also `PAPERLESS_NLTK_DIR`.
-    Defaults to 1.
+    Defaults to true, enabling the feature.
 #### [`PAPERLESS_DATE_PARSER_LANGUAGES=<lang>`](#PAPERLESS_DATE_PARSER_LANGUAGES) {#PAPERLESS_DATE_PARSER_LANGUAGES}
@@ -1054,17 +1054,27 @@ should be a valid crontab(5) expression describing when to run.
 #### [`PAPERLESS_SANITY_TASK_CRON=<cron expression>`](#PAPERLESS_SANITY_TASK_CRON) {#PAPERLESS_SANITY_TASK_CRON}
-: Configures the scheduled sanity checker frequency.
+: Configures the scheduled sanity checker frequency. The value should be a
 valid crontab(5) expression describing when to run.
 : If set to the string "disable", the sanity checker will not run automatically.
    Defaults to `30 0 * * sun` or Sunday at 30 minutes past midnight.
 #### [`PAPERLESS_WORKFLOW_SCHEDULED_TASK_CRON=<cron expression>`](#PAPERLESS_WORKFLOW_SCHEDULED_TASK_CRON) {#PAPERLESS_WORKFLOW_SCHEDULED_TASK_CRON}
 : Configures the scheduled workflow check frequency. The value should be a
 valid crontab(5) expression describing when to run.
 : If set to the string "disable", scheduled workflows will not run.
    Defaults to `5 */1 * * *` or every hour at 5 minutes past the hour.
 #### [`PAPERLESS_ENABLE_COMPRESSION=<bool>`](#PAPERLESS_ENABLE_COMPRESSION) {#PAPERLESS_ENABLE_COMPRESSION}
 : Enables compression of the responses from the webserver.
-: Defaults to 1, enabling compression.
+: Defaults to true, enabling compression.
    !!! note
@@ -1271,30 +1281,6 @@ within your documents.
    Defaults to false.
 ## Workflow webhooks
 #### [`PAPERLESS_WEBHOOKS_ALLOWED_SCHEMES=<str>`](#PAPERLESS_WEBHOOKS_ALLOWED_SCHEMES) {#PAPERLESS_WEBHOOKS_ALLOWED_SCHEMES}
 : A comma-separated list of allowed schemes for webhooks. This setting
 controls which URL schemes are permitted for webhook URLs.
    Defaults to `http,https`.
 #### [`PAPERLESS_WEBHOOKS_ALLOWED_PORTS=<str>`](#PAPERLESS_WEBHOOKS_ALLOWED_PORTS) {#PAPERLESS_WEBHOOKS_ALLOWED_PORTS}
 : A comma-separated list of allowed ports for webhooks. This setting
 controls which ports are permitted for webhook URLs. For example, if you
 set this to `80,443`, webhooks will only be sent to URLs that use these
 ports.
    Defaults to empty list, which allows all ports.
 #### [`PAPERLESS_WEBHOOKS_ALLOW_INTERNAL_REQUESTS=<bool>`](#PAPERLESS_WEBHOOKS_ALLOW_INTERNAL_REQUESTS) {#PAPERLESS_WEBHOOKS_ALLOW_INTERNAL_REQUESTS}
 : If set to false, webhooks cannot be sent to internal URLs (e.g., localhost).
    Defaults to true, which allows internal requests.
 ### Polling {#polling}
 #### [`PAPERLESS_CONSUMER_POLLING=<num>`](#PAPERLESS_CONSUMER_POLLING) {#PAPERLESS_CONSUMER_POLLING}
@@ -1338,6 +1324,30 @@ consumers working on the same file. Configure this to prevent that.
    Defaults to 0.5 seconds.
 ## Workflow webhooks
 #### [`PAPERLESS_WEBHOOKS_ALLOWED_SCHEMES=<str>`](#PAPERLESS_WEBHOOKS_ALLOWED_SCHEMES) {#PAPERLESS_WEBHOOKS_ALLOWED_SCHEMES}
 : A comma-separated list of allowed schemes for webhooks. This setting
 controls which URL schemes are permitted for webhook URLs.
    Defaults to `http,https`.
 #### [`PAPERLESS_WEBHOOKS_ALLOWED_PORTS=<str>`](#PAPERLESS_WEBHOOKS_ALLOWED_PORTS) {#PAPERLESS_WEBHOOKS_ALLOWED_PORTS}
 : A comma-separated list of allowed ports for webhooks. This setting
 controls which ports are permitted for webhook URLs. For example, if you
 set this to `80,443`, webhooks will only be sent to URLs that use these
 ports.
    Defaults to empty list, which allows all ports.
 #### [`PAPERLESS_WEBHOOKS_ALLOW_INTERNAL_REQUESTS=<bool>`](#PAPERLESS_WEBHOOKS_ALLOW_INTERNAL_REQUESTS) {#PAPERLESS_WEBHOOKS_ALLOW_INTERNAL_REQUESTS}
 : If set to false, webhooks cannot be sent to internal URLs (e.g., localhost).
    Defaults to true, which allows internal requests.
 ## Incoming Mail {#incoming_mail}
 ### Email OAuth {#email_oauth}
@@ -1794,3 +1804,23 @@ password. All of these options come from their similarly-named [Django settings]
 #### [`PAPERLESS_EMAIL_USE_SSL=<bool>`](#PAPERLESS_EMAIL_USE_SSL) {#PAPERLESS_EMAIL_USE_SSL}
 : Defaults to false.
 ## Remote OCR
 #### [`PAPERLESS_REMOTE_OCR_ENGINE=<str>`](#PAPERLESS_REMOTE_OCR_ENGINE) {#PAPERLESS_REMOTE_OCR_ENGINE}
 : The remote OCR engine to use. Currently only Azure AI is supported as "azureai".
    Defaults to None, which disables remote OCR.
 #### [`PAPERLESS_REMOTE_OCR_API_KEY=<str>`](#PAPERLESS_REMOTE_OCR_API_KEY) {#PAPERLESS_REMOTE_OCR_API_KEY}
 : The API key to use for the remote OCR engine.
    Defaults to None.
 #### [`PAPERLESS_REMOTE_OCR_ENDPOINT=<str>`](#PAPERLESS_REMOTE_OCR_ENDPOINT) {#PAPERLESS_REMOTE_OCR_ENDPOINT}
 : The endpoint to use for the remote OCR engine. This is required for Azure AI.
    Defaults to None.
--- a/docs/development.md
+++ b/docs/development.md
@@ -175,7 +175,7 @@ To add a new development package `uv add --dev <package>`
 ## Front end development
-The front end is built using AngularJS. In order to get started, you need Node.js (version 14.15+) and
+The front end is built using AngularJS. In order to get started, you need Node.js (version 24+) and
 `pnpm`.
 !!! note
--- a/docs/index.md
+++ b/docs/index.md
@@ -25,9 +25,10 @@ physical documents into a searchable online archive so you can keep, well, _less
 ## Features
 -   **Organize and index** your scanned documents with tags, correspondents, types, and more.
-   _Your_ data is stored locally on _your_ server and is never transmitted or shared in any way.
+-   _Your_ data is stored locally on _your_ server and is never transmitted or shared in any way, unless you explicitly choose to do so.
 -   Performs **OCR** on your documents, adding searchable and selectable text, even to documents scanned with only images.
-   Utilizes the open-source Tesseract engine to recognize more than 100 languages.
+    -   Utilizes the open-source Tesseract engine to recognize more than 100 languages.
    -   _New!_ Supports remote OCR with Azure AI (opt-in).
 -   Documents are saved as PDF/A format which is designed for long term storage, alongside the unaltered originals.
 -   Uses machine-learning to automatically add tags, correspondents and document types to your documents.
 -   Supports PDF documents, images, plain text files, Office documents (Word, Excel, PowerPoint, and LibreOffice equivalents)[^1] and more.
--- a/docs/setup.md
+++ b/docs/setup.md
@@ -326,7 +326,7 @@ are released, dependency support is confirmed, etc.
    !!! warning
-        Ensure your Redis instance [is secured](https://redis.io/docs/getting-started/#securing-redis).
+        Ensure your Redis instance [is secured](https://redis.io/docs/latest/operate/oss_and_stack/management/security/).
 7.  Create the following directories if they are missing:
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -443,6 +443,10 @@ flowchart TD
    'Updated'
    trigger(s)"}
    scheduled{"Documents
    matching
    trigger(s)"}
    A[New Document] --> consumption
    consumption --> |Yes| C[Workflow Actions Run]
    consumption --> |No| D
@@ -455,6 +459,11 @@ flowchart TD
    updated --> |Yes| J[Workflow Actions Run]
    updated --> |No| K
    J --> K[Document Saved]
    L[Scheduled Task Check<br/>hourly at :05] --> M[Get All Scheduled Triggers]
    M --> scheduled
    scheduled --> |Yes| N[Workflow Actions Run]
    scheduled --> |No| O[Document Saved]
    N --> O
 ```
 #### Filters {#workflow-trigger-filters}
@@ -553,6 +562,7 @@ applied. You can use the following placeholders in the template with any trigger
 -   `{{added_time}}`: added time in HH:MM format
 -   `{{original_filename}}`: original file name without extension
 -   `{{filename}}`: current file name without extension
 -   `{{doc_title}}`: current document title
 The following placeholders are only available for "added" or "updated" triggers
@@ -891,6 +901,21 @@ how regularly you intend to scan documents and use paperless.
    performed the task associated with the document, move it to the
    inbox.
 ## Remote OCR
 !!! important
    This feature is disabled by default and will always remain strictly "opt-in".
 Paperless-ngx supports performing OCR on documents using remote services. At the moment, this is limited to
 [Microsoft's Azure "Document Intelligence" service](https://azure.microsoft.com/en-us/products/ai-services/ai-document-intelligence).
 This is of course a paid service (with a free tier) which requires an Azure account and subscription. Azure AI is not affiliated with
 Paperless-ngx in any way. When enabled, Paperless-ngx will automatically send appropriate documents to Azure for OCR processing, bypassing
 the local OCR engine. See the [configuration](configuration.md#PAPERLESS_REMOTE_OCR_ENGINE) options for more details.
 Additionally, when using a commercial service with this feature, consider both potential costs as well as any associated file size
 or page limitations (e.g. with a free tier).
 ## Architecture
 Paperless-ngx consists of the following components:
--- a/install-paperless-ngx.sh
+++ b/install-paperless-ngx.sh
@@ -374,7 +374,7 @@ fi
 # of the provided folder
 if [[ -n $DATABASE_FOLDER ]] ; then
 	if [[ "$DATABASE_BACKEND" == "postgres" ]] ; then
-		sed -i "s#- pgdata:/var/lib/postgresql/data#- $DATABASE_FOLDER:/var/lib/postgresql/data#g" docker-compose.yml
+		sed -i "s#- pgdata:/var/lib/postgresql#- $DATABASE_FOLDER:/var/lib/postgresql#g" docker-compose.yml
 		sed -i "/^\s*pgdata:/d" docker-compose.yml
 	elif [[ "$DATABASE_BACKEND" == "mariadb" ]]; then
 		sed -i "s#- dbdata:/var/lib/mysql#- $DATABASE_FOLDER:/var/lib/mysql#g" docker-compose.yml
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "paperless-ngx"
-version = "2.19.2"
+version = "2.20.3"
 description = "A community-supported supercharged document management system: scan, index and archive all your physical documents"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -16,8 +16,9 @@ classifiers = [
 # This will allow testing to not install a webserver, mysql, etc
 dependencies = [
  "azure-ai-documentintelligence>=1.0.2",
  "babel>=2.17",
-  "bleach~=6.2.0",
+  "bleach~=6.3.0",
  "celery[redis]~=5.5.1",
  "channels~=4.2",
  "channels-redis~=4.2",
@@ -26,8 +27,8 @@ dependencies = [
  # WARNING: django does not use semver.
  #          Only patch versions are guaranteed to not introduce breaking changes.
  "django~=5.2.5",
-  "django-allauth[mfa,socialaccount]~=65.4.0",
+  "django-allauth[mfa,socialaccount]~=65.12.1",
-  "django-auditlog~=3.2.1",
+  "django-auditlog~=3.3.0",
  "django-cachalot~=2.8.0",
  "django-celery-results~=2.6.0",
  "django-compression-middleware~=0.5.0",
@@ -41,33 +42,33 @@ dependencies = [
  "djangorestframework~=3.16",
  "djangorestframework-guardian~=0.4.0",
  "drf-spectacular~=0.28",
-  "drf-spectacular-sidecar~=2025.9.1",
+  "drf-spectacular-sidecar~=2025.10.1",
  "drf-writable-nested~=0.7.1",
  "filelock~=3.20.0",
  "flower~=2.0.1",
  "gotenberg-client~=0.12.0",
  "httpx-oauth~=0.16",
  "imap-tools~=1.11.0",
  "inotifyrecursive~=0.3",
  "jinja2~=3.1.5",
  "langdetect~=1.0.9",
  "nltk~=3.9.1",
-  "ocrmypdf~=16.11.0",
+  "ocrmypdf~=16.12.0",
  "pathvalidate~=3.3.1",
  "pdf2image~=1.17.0",
  "python-dateutil~=2.9.0",
-  "python-dotenv~=1.1.0",
+  "python-dotenv~=1.2.1",
  "python-gnupg~=0.5.4",
  "python-ipware~=3.0.0",
  "python-magic~=0.4.27",
  "pyzbar~=0.1.9",
  "rapidfuzz~=3.14.0",
  "redis[hiredis]~=5.2.1",
  "regex>=2025.9.18",
  "scikit-learn~=1.7.0",
  "setproctitle~=1.3.4",
  "tika-client~=0.10.0",
  "tqdm~=4.67.1",
-  "watchdog~=6.0",
+  "watchfiles>=1.1.1",
  "whitenoise~=6.9",
  "whoosh-reloaded>=2.7.5",
  "zxing-cpp~=2.3.0",
@@ -77,10 +78,10 @@ optional-dependencies.mariadb = [
  "mysqlclient~=2.2.7",
 ]
 optional-dependencies.postgres = [
-  "psycopg[c,pool]==3.2.9",
+  "psycopg[c,pool]==3.2.12",
  # Direct dependency for proper resolution of the pre-built wheels
-  "psycopg-c==3.2.9",
+  "psycopg-c==3.2.12",
-  "psycopg-pool==3.2.6",
+  "psycopg-pool==3.2.7",
 ]
 optional-dependencies.webserver = [
  "granian[uvloop]~=2.5.1",
@@ -96,7 +97,7 @@ dev = [
 docs = [
  "mkdocs-glightbox~=0.5.1",
-  "mkdocs-material~=9.6.4",
+  "mkdocs-material~=9.7.0",
 ]
 testing = [
@@ -115,7 +116,7 @@ testing = [
 ]
 lint = [
-  "pre-commit~=4.3.0",
+  "pre-commit~=4.4.0",
  "pre-commit-uv~=4.2.0",
  "ruff~=0.14.0",
 ]
@@ -150,8 +151,8 @@ environments = [
 [tool.uv.sources]
 # Markers are chosen to select these almost exclusively when building the Docker image
 psycopg-c = [
-  { url = "https://github.com/paperless-ngx/builder/releases/download/psycopg-3.2.9/psycopg_c-3.2.9-cp312-cp312-linux_x86_64.whl", marker = "sys_platform == 'linux' and platform_machine == 'x86_64' and python_version == '3.12'" },
+  { url = "https://github.com/paperless-ngx/builder/releases/download/psycopg-bookworm-3.2.12/psycopg_c-3.2.12-cp312-cp312-linux_x86_64.whl", marker = "sys_platform == 'linux' and platform_machine == 'x86_64' and python_version == '3.12'" },
-  { url = "https://github.com/paperless-ngx/builder/releases/download/psycopg-3.2.9/psycopg_c-3.2.9-cp312-cp312-linux_aarch64.whl", marker = "sys_platform == 'linux' and platform_machine == 'aarch64' and python_version == '3.12'" },
+  { url = "https://github.com/paperless-ngx/builder/releases/download/psycopg-bookworm-3.2.12/psycopg_c-3.2.12-cp312-cp312-linux_aarch64.whl", marker = "sys_platform == 'linux' and platform_machine == 'aarch64' and python_version == '3.12'" },
 ]
 zxing-cpp = [
  { url = "https://github.com/paperless-ngx/builder/releases/download/zxing-2.3.0/zxing_cpp-2.3.0-cp312-cp312-linux_x86_64.whl", marker = "sys_platform == 'linux' and platform_machine == 'x86_64' and python_version == '3.12'" },
@@ -252,6 +253,7 @@ testpaths = [
  "src/paperless_tesseract/tests/",
  "src/paperless_tika/tests",
  "src/paperless_text/tests/",
  "src/paperless_remote/tests/",
 ]
 addopts = [
  "--pythonwarnings=all",
--- a/src-ui/angular.json
+++ b/src-ui/angular.json
@@ -31,6 +31,7 @@
          "fi-FI": "src/locale/messages.fi_FI.xlf",
          "fr-FR": "src/locale/messages.fr_FR.xlf",
          "hu-HU": "src/locale/messages.hu_HU.xlf",
          "id-ID": "src/locale/messages.id_ID.xlf",
          "it-IT": "src/locale/messages.it_IT.xlf",
          "ja-JP": "src/locale/messages.ja_JP.xlf",
          "lb-LU": "src/locale/messages.lb_LU.xlf",
@@ -155,16 +156,7 @@
          "builder": "@angular-builders/jest:run",
          "options": {
            "tsConfig": "tsconfig.spec.json",
-            "assets": [
+            "zoneless": false
              "src/favicon.ico",
              "src/apple-touch-icon.png",
              "src/assets",
              "src/manifest.webmanifest"
            ],
            "styles": [
              "src/styles.scss"
            ],
            "scripts": []
          }
        },
        "lint": {
--- a/src-ui/jest.config.js
+++ b/src-ui/jest.config.js
@@ -1,5 +1,23 @@
 const { createEsmPreset } = require('jest-preset-angular/presets')
 const esmPreset = createEsmPreset({
  tsconfig: '<rootDir>/tsconfig.spec.json',
  stringifyContentPathRegex: '\\.(html|svg)$',
 })
 module.exports = {
-  preset: 'jest-preset-angular',
+  ...esmPreset,
  transform: {
    ...esmPreset.transform,
    '^.+\\.(ts|js|mjs|html|svg)$': [
      'jest-preset-angular',
      {
        tsconfig: '<rootDir>/tsconfig.spec.json',
        stringifyContentPathRegex: '\\.(html|svg)$',
        useESM: true,
      },
    ],
  },
  setupFilesAfterEnv: ['<rootDir>/setup-jest.ts'],
  testPathIgnorePatterns: [
    '/node_modules/',
@@ -8,9 +26,10 @@ module.exports = {
    'abstract-paperless-service',
  ],
  transformIgnorePatterns: [
-    `<rootDir>/node_modules/.pnpm/(?!.*\\.mjs$|lodash-es|@angular\\+common.*locales)`,
+    'node_modules/(?!.*(\\.mjs$|tslib|lodash-es|@angular/common/locales/.*\\.js$))',
  ],
  moduleNameMapper: {
    ...esmPreset.moduleNameMapper,
    '^src/(.*)': '<rootDir>/src/$1',
  },
  workerIdleMemoryLimit: '512MB',
--- a/src-ui/messages.xlf
+++ b/src-ui/messages.xlf
--- a/src-ui/package.json
+++ b/src-ui/package.json
@@ -1,6 +1,6 @@
 {
  "name": "paperless-ngx-ui",
-  "version": "2.19.2",
+  "version": "2.20.3",
  "scripts": {
    "preinstall": "npx only-allow pnpm",
    "ng": "ng",
@@ -11,17 +11,17 @@
  },
  "private": true,
  "dependencies": {
-    "@angular/cdk": "^20.2.6",
+    "@angular/cdk": "^21.0.6",
-    "@angular/common": "~20.3.2",
+    "@angular/common": "~21.0.8",
-    "@angular/compiler": "~20.3.2",
+    "@angular/compiler": "~21.0.8",
-    "@angular/core": "~20.3.2",
+    "@angular/core": "~21.0.8",
-    "@angular/forms": "~20.3.2",
+    "@angular/forms": "~21.0.8",
-    "@angular/localize": "~20.3.2",
+    "@angular/localize": "~21.0.8",
-    "@angular/platform-browser": "~20.3.2",
+    "@angular/platform-browser": "~21.0.8",
-    "@angular/platform-browser-dynamic": "~20.3.2",
+    "@angular/platform-browser-dynamic": "~21.0.8",
-    "@angular/router": "~20.3.2",
+    "@angular/router": "~21.0.8",
-    "@ng-bootstrap/ng-bootstrap": "^19.0.1",
+    "@ng-bootstrap/ng-bootstrap": "^20.0.0",
-    "@ng-select/ng-select": "^20.2.2",
+    "@ng-select/ng-select": "^21.1.4",
    "@ngneat/dirty-check-forms": "^3.0.3",
    "@popperjs/core": "^2.11.8",
    "bootstrap": "^5.3.8",
@@ -30,8 +30,8 @@
    "ng2-pdf-viewer": "^10.4.0",
    "ngx-bootstrap-icons": "^1.9.3",
    "ngx-color": "^10.1.0",
-    "ngx-cookie-service": "^20.1.0",
+    "ngx-cookie-service": "^21.1.0",
-    "ngx-device-detector": "^10.1.0",
+    "ngx-device-detector": "^11.0.0",
    "ngx-ui-tour-ng-bootstrap": "^17.0.1",
    "rxjs": "^7.8.2",
    "tslib": "^2.8.1",
@@ -40,35 +40,35 @@
    "zone.js": "^0.15.1"
  },
  "devDependencies": {
-    "@angular-builders/custom-webpack": "^20.0.0",
+    "@angular-builders/custom-webpack": "^21.0.0-beta.1",
-    "@angular-builders/jest": "^20.0.0",
+    "@angular-builders/jest": "^21.0.0-beta.1",
-    "@angular-devkit/core": "^20.3.3",
+    "@angular-devkit/core": "^21.0.5",
-    "@angular-devkit/schematics": "^20.3.3",
+    "@angular-devkit/schematics": "^21.0.5",
-    "@angular-eslint/builder": "20.3.0",
+    "@angular-eslint/builder": "21.1.0",
-    "@angular-eslint/eslint-plugin": "20.3.0",
+    "@angular-eslint/eslint-plugin": "21.1.0",
-    "@angular-eslint/eslint-plugin-template": "20.3.0",
+    "@angular-eslint/eslint-plugin-template": "21.1.0",
-    "@angular-eslint/schematics": "20.3.0",
+    "@angular-eslint/schematics": "21.1.0",
-    "@angular-eslint/template-parser": "20.3.0",
+    "@angular-eslint/template-parser": "21.1.0",
-    "@angular/build": "^20.3.3",
+    "@angular/build": "^21.0.5",
-    "@angular/cli": "~20.3.3",
+    "@angular/cli": "~21.0.5",
-    "@angular/compiler-cli": "~20.3.2",
+    "@angular/compiler-cli": "~21.0.8",
    "@codecov/webpack-plugin": "^1.9.1",
-    "@playwright/test": "^1.55.1",
+    "@playwright/test": "^1.57.0",
    "@types/jest": "^30.0.0",
-    "@types/node": "^24.6.1",
+    "@types/node": "^24.10.1",
-    "@typescript-eslint/eslint-plugin": "^8.45.0",
+    "@typescript-eslint/eslint-plugin": "^8.48.1",
-    "@typescript-eslint/parser": "^8.45.0",
+    "@typescript-eslint/parser": "^8.48.1",
-    "@typescript-eslint/utils": "^8.45.0",
+    "@typescript-eslint/utils": "^8.48.1",
-    "eslint": "^9.36.0",
+    "eslint": "^9.39.1",
    "jest": "30.2.0",
    "jest-environment-jsdom": "^30.2.0",
    "jest-junit": "^16.0.0",
-    "jest-preset-angular": "^15.0.2",
+    "jest-preset-angular": "^16.0.0",
    "jest-websocket-mock": "^2.5.0",
    "prettier-plugin-organize-imports": "^4.3.0",
    "ts-node": "~10.9.1",
-    "typescript": "^5.8.3",
+    "typescript": "^5.9.3",
-    "webpack": "^5.102.0"
+    "webpack": "^5.103.0"
  },
  "packageManager": "pnpm@10.17.1",
  "pnpm": {
--- a/src-ui/pnpm-lock.yaml
+++ b/src-ui/pnpm-lock.yaml
--- a/src-ui/setup-jest.ts
+++ b/src-ui/setup-jest.ts
@@ -28,6 +28,7 @@ import localeFa from '@angular/common/locales/fa'
 import localeFi from '@angular/common/locales/fi'
 import localeFr from '@angular/common/locales/fr'
 import localeHu from '@angular/common/locales/hu'
 import localeId from '@angular/common/locales/id'
 import localeIt from '@angular/common/locales/it'
 import localeJa from '@angular/common/locales/ja'
 import localeKo from '@angular/common/locales/ko'
@@ -63,6 +64,7 @@ registerLocaleData(localeFa)
 registerLocaleData(localeFi)
 registerLocaleData(localeFr)
 registerLocaleData(localeHu)
 registerLocaleData(localeId)
 registerLocaleData(localeIt)
 registerLocaleData(localeJa)
 registerLocaleData(localeKo)
@@ -145,6 +147,10 @@ HTMLCanvasElement.prototype.getContext = <
  typeof HTMLCanvasElement.prototype.getContext
 >jest.fn()
 if (!HTMLElement.prototype.scrollTo) {
  HTMLElement.prototype.scrollTo = jest.fn()
 }
 jest.mock('uuid', () => ({
  v4: jest.fn(() =>
    'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (char: string) => {
--- a/src-ui/src/app/components/admin/logs/logs.component.html
+++ b/src-ui/src/app/components/admin/logs/logs.component.html
@@ -3,9 +3,23 @@
  i18n-title
  info="Review the log files for the application and for email checking."
  i18n-info>
-  <div class="form-check form-switch">
+  <div class="input-group input-group-sm align-items-center">
-    <input class="form-check-input" type="checkbox" role="switch" [(ngModel)]="autoRefreshEnabled">
+    <div class="input-group input-group-sm me-3">
-    <label class="form-check-label" for="autoRefreshSwitch" i18n>Auto refresh</label>
+      <span class="input-group-text text-muted" i18n>Show</span>
      <input
        class="form-control"
        type="number"
        min="100"
        step="100"
        [(ngModel)]="limit"
        (ngModelChange)="onLimitChange($event)"
        style="width: 100px;">
      <span class="input-group-text text-muted" i18n>lines</span>
    </div>
    <div class="form-check form-switch mt-1">
      <input class="form-check-input" type="checkbox" role="switch" [(ngModel)]="autoRefreshEnabled">
      <label class="form-check-label" for="autoRefreshSwitch" i18n>Auto refresh</label>
    </div>
  </div>
 </pngx-page-header>
@@ -27,16 +41,23 @@
  }
 </ul>
-<div [ngbNavOutlet]="nav" class="mt-2"></div>
+<div #logContainer class="bg-dark text-light font-monospace log-container p-3" (scroll)="onScroll()">
-
+  @if (loading && !logFiles.length) {
 <div class="bg-dark p-3 text-light font-monospace log-container" #logContainer>
  @if (loading && logFiles.length) {
    <div>
      <div class="spinner-border spinner-border-sm me-2" role="status"></div>
      <ng-container i18n>Loading...</ng-container>
    </div>
-  }
+  } @else {
-  @for (log of logs; track $index) {
+    @for (log of logs; track log) {
-    <p class="m-0 p-0 log-entry-{{getLogLevel(log)}}">{{log}}</p>
+      <p class="m-0 p-0" [ngClass]="'log-entry-' + log.level">{{log.message}}</p>
    }
  }
 </div>
 <button
  type="button"
  class="btn btn-sm btn-secondary jump-to-bottom position-fixed bottom-0 end-0 m-5"
  [class.visible]="showJumpToBottom"
  (click)="scrollToBottom()"
 >
  ↓ <span i18n>Jump to bottom</span>
 </button>
--- a/src-ui/src/app/components/admin/logs/logs.component.scss
+++ b/src-ui/src/app/components/admin/logs/logs.component.scss
@@ -16,11 +16,21 @@
 }
 .log-container {
-  overflow-y: scroll;
+  height: calc(100vh - 190px);
-  height: calc(100vh - 200px);
+  overflow-y: auto;
  top: 70px;
  p {
    white-space: pre-wrap;
  }
 }
 .jump-to-bottom {
  opacity: 0;
  pointer-events: none;
  transition: opacity 120ms ease-in-out;
 }
 .jump-to-bottom.visible {
  opacity: 1;
  pointer-events: auto;
 }
--- a/src-ui/src/app/components/admin/logs/logs.component.spec.ts
+++ b/src-ui/src/app/components/admin/logs/logs.component.spec.ts
@@ -1,3 +1,8 @@
 import {
  CdkVirtualScrollViewport,
  ScrollingModule,
 } from '@angular/cdk/scrolling'
 import { CommonModule } from '@angular/common'
 import { provideHttpClient, withInterceptorsFromDi } from '@angular/common/http'
 import { provideHttpClientTesting } from '@angular/common/http/testing'
 import { ComponentFixture, TestBed } from '@angular/core/testing'
@@ -38,6 +43,9 @@ describe('LogsComponent', () => {
        NgxBootstrapIconsModule.pick(allIcons),
        LogsComponent,
        PageHeaderComponent,
        CommonModule,
        CdkVirtualScrollViewport,
        ScrollingModule,
      ],
      providers: [
        provideHttpClient(withInterceptorsFromDi()),
@@ -54,13 +62,12 @@ describe('LogsComponent', () => {
    fixture = TestBed.createComponent(LogsComponent)
    component = fixture.componentInstance
    reloadSpy = jest.spyOn(component, 'reloadLogs')
    window.HTMLElement.prototype.scroll = function () {} // mock scroll
    jest.useFakeTimers()
    fixture.detectChanges()
  })
  it('should display logs with first log initially', () => {
-    expect(logSpy).toHaveBeenCalledWith('paperless')
+    expect(logSpy).toHaveBeenCalledWith('paperless', 5000)
    fixture.detectChanges()
    expect(fixture.debugElement.nativeElement.textContent).toContain(
      paperless_logs[0]
@@ -71,7 +78,7 @@ describe('LogsComponent', () => {
    fixture.debugElement
      .queryAll(By.directive(NgbNavLink))[1]
      .nativeElement.dispatchEvent(new MouseEvent('click'))
-    expect(logSpy).toHaveBeenCalledWith('mail')
+    expect(logSpy).toHaveBeenCalledWith('mail', 5000)
  })
  it('should handle error with no logs', () => {
@@ -83,6 +90,10 @@ describe('LogsComponent', () => {
  })
  it('should auto refresh, allow toggle', () => {
    jest
      .spyOn(CdkVirtualScrollViewport.prototype, 'scrollToIndex')
      .mockImplementation(() => undefined)
    jest.advanceTimersByTime(6000)
    expect(reloadSpy).toHaveBeenCalledTimes(2)
@@ -90,4 +101,20 @@ describe('LogsComponent', () => {
    jest.advanceTimersByTime(6000)
    expect(reloadSpy).toHaveBeenCalledTimes(2)
  })
  it('should debounce limit changes before reloading logs', () => {
    const initialCalls = reloadSpy.mock.calls.length
    component.onLimitChange(6000)
    jest.advanceTimersByTime(299)
    expect(reloadSpy).toHaveBeenCalledTimes(initialCalls)
    jest.advanceTimersByTime(1)
    expect(reloadSpy).toHaveBeenCalledTimes(initialCalls + 1)
  })
  it('should update jump to bottom visibility on scroll', () => {
    component.showJumpToBottom = false
    jest.spyOn(component as any, 'isNearBottom').mockReturnValue(false)
    component.onScroll()
    expect(component.showJumpToBottom).toBe(true)
  })
 })
--- a/src-ui/src/app/components/admin/logs/logs.component.ts
+++ b/src-ui/src/app/components/admin/logs/logs.component.ts
@@ -1,3 +1,4 @@
 import { CommonModule } from '@angular/common'
 import {
  ChangeDetectorRef,
  Component,
@@ -9,7 +10,7 @@ import {
 } from '@angular/core'
 import { FormsModule, ReactiveFormsModule } from '@angular/forms'
 import { NgbNavModule } from '@ng-bootstrap/ng-bootstrap'
-import { filter, takeUntil, timer } from 'rxjs'
+import { Subject, debounceTime, filter, takeUntil, timer } from 'rxjs'
 import { LogService } from 'src/app/services/rest/log.service'
 import { PageHeaderComponent } from '../../common/page-header/page-header.component'
 import { LoadingComponentWithPermissions } from '../../loading-component/loading.component'
@@ -21,6 +22,7 @@ import { LoadingComponentWithPermissions } from '../../loading-component/loading
  imports: [
    PageHeaderComponent,
    NgbNavModule,
    CommonModule,
    FormsModule,
    ReactiveFormsModule,
  ],
@@ -32,7 +34,7 @@ export class LogsComponent
  private logService = inject(LogService)
  private changedetectorRef = inject(ChangeDetectorRef)
-  public logs: string[] = []
+  public logs: Array<{ message: string; level: number }> = []
  public logFiles: string[] = []
@@ -40,9 +42,19 @@ export class LogsComponent
  public autoRefreshEnabled: boolean = true
-  @ViewChild('logContainer') logContainer: ElementRef
+  public limit: number = 5000
  public showJumpToBottom = false
  private readonly limitChange$ = new Subject<number>()
  @ViewChild('logContainer') logContainer: ElementRef<HTMLElement>
  ngOnInit(): void {
    this.limitChange$
      .pipe(debounceTime(300), takeUntil(this.unsubscribeNotifier))
      .subscribe(() => this.reloadLogs())
    this.logService
      .list()
      .pipe(takeUntil(this.unsubscribeNotifier))
@@ -68,16 +80,37 @@ export class LogsComponent
    super.ngOnDestroy()
  }
  onLimitChange(limit: number): void {
    this.limitChange$.next(limit)
  }
  reloadLogs() {
    this.loading = true
    const shouldStickToBottom = this.isNearBottom()
    this.logService
-      .get(this.activeLog)
+      .get(this.activeLog, this.limit)
      .pipe(takeUntil(this.unsubscribeNotifier))
      .subscribe({
        next: (result) => {
          this.logs = result
          this.loading = false
-          this.scrollToBottom()
+          const parsed = this.parseLogsWithLevel(result)
          const hasChanges =
            parsed.length !== this.logs.length ||
            parsed.some((log, idx) => {
              const current = this.logs[idx]
              return (
                !current ||
                current.message !== log.message ||
                current.level !== log.level
              )
            })
          if (hasChanges) {
            this.logs = parsed
            if (shouldStickToBottom) {
              this.scrollToBottom()
            }
            this.showJumpToBottom = !shouldStickToBottom
          }
        },
        error: () => {
          this.logs = []
@@ -100,12 +133,35 @@ export class LogsComponent
    }
  }
  private parseLogsWithLevel(
    logs: string[]
  ): Array<{ message: string; level: number }> {
    return logs.map((log) => ({
      message: log,
      level: this.getLogLevel(log),
    }))
  }
  scrollToBottom(): void {
    const viewport = this.logContainer?.nativeElement
    if (!viewport) {
      return
    }
    this.changedetectorRef.detectChanges()
-    this.logContainer?.nativeElement.scroll({
+    viewport.scrollTop = viewport.scrollHeight
-      top: this.logContainer.nativeElement.scrollHeight,
+    this.showJumpToBottom = false
-      left: 0,
+  }
-      behavior: 'auto',
+
-    })
+  private isNearBottom(): boolean {
    if (!this.logContainer?.nativeElement) return true
    const distanceFromBottom =
      this.logContainer.nativeElement.scrollHeight -
      this.logContainer.nativeElement.scrollTop -
      this.logContainer.nativeElement.clientHeight
    return distanceFromBottom <= 40
  }
  onScroll(): void {
    this.showJumpToBottom = !this.isNearBottom()
  }
 }
--- a/src-ui/src/app/components/admin/settings/settings.component.spec.ts
+++ b/src-ui/src/app/components/admin/settings/settings.component.spec.ts
@@ -28,7 +28,6 @@ import { IfOwnerDirective } from 'src/app/directives/if-owner.directive'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { PermissionsGuard } from 'src/app/guards/permissions.guard'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
 import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { PermissionsService } from 'src/app/services/permissions.service'
 import { GroupService } from 'src/app/services/rest/group.service'
 import { SavedViewService } from 'src/app/services/rest/saved-view.service'
@@ -129,7 +128,6 @@ describe('SettingsComponent', () => {
        ConfirmDialogComponent,
        CheckComponent,
        ColorComponent,
        SafeHtmlPipe,
        SelectComponent,
        TextComponent,
        NumberComponent,
--- a/src-ui/src/app/components/admin/trash/trash.component.spec.ts
+++ b/src-ui/src/app/components/admin/trash/trash.component.spec.ts
@@ -11,7 +11,6 @@ import {
 } from '@ng-bootstrap/ng-bootstrap'
 import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
 import { of, throwError } from 'rxjs'
 import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { ToastService } from 'src/app/services/toast.service'
 import { TrashService } from 'src/app/services/trash.service'
 import { ConfirmDialogComponent } from '../../common/confirm-dialog/confirm-dialog.component'
@@ -53,7 +52,6 @@ describe('TrashComponent', () => {
        TrashComponent,
        PageHeaderComponent,
        ConfirmDialogComponent,
        SafeHtmlPipe,
      ],
    }).compileComponents()
--- a/src-ui/src/app/components/admin/users-groups/users-groups.component.html
+++ b/src-ui/src/app/components/admin/users-groups/users-groups.component.html
@@ -26,7 +26,7 @@
    @for (user of users; track user) {
      <li class="list-group-item">
        <div class="row">
-          <div class="col d-flex align-items-center"><button class="btn btn-link p-0 text-start" type="button" (click)="editUser(user)" [disabled]="!permissionsService.currentUserCan(PermissionAction.Change, PermissionType.User)">{{user.username}}</button></div>
+          <div class="col d-flex align-items-center" [class.opacity-50]="!user.is_active"><button class="btn btn-link p-0 text-start" type="button" (click)="editUser(user)" [disabled]="!permissionsService.currentUserCan(PermissionAction.Change, PermissionType.User)">{{user.username}}</button></div>
          <div class="col d-flex align-items-center">{{user.first_name}} {{user.last_name}}</div>
          <div class="col d-flex align-items-center">{{user.groups?.map(getGroupName, this).join(', ')}}</div>
          <div class="col">
--- a/src-ui/src/app/components/app-frame/app-frame.component.html
+++ b/src-ui/src/app/components/app-frame/app-frame.component.html
@@ -68,13 +68,15 @@
    <nav id="sidebarMenu" class="d-md-block bg-light sidebar collapse"
      [ngClass]="slimSidebarEnabled ? 'slim' : 'col-md-3 col-lg-2 col-xxxl-1'" [class.animating]="slimSidebarAnimating"
      [ngbCollapse]="isMenuCollapsed">
-      <button class="btn btn-sm btn-dark sidebar-slim-toggler" (click)="toggleSlimSidebar()">
+      @if (canSaveSettings) {
-        @if (slimSidebarEnabled) {
+        <button class="btn btn-sm btn-dark sidebar-slim-toggler" (click)="toggleSlimSidebar()">
-          <i-bs width="0.9em" height="0.9em" name="chevron-double-right"></i-bs>
+          @if (slimSidebarEnabled) {
-        } @else {
+            <i-bs width="0.9em" height="0.9em" name="chevron-double-right"></i-bs>
-          <i-bs width="0.9em" height="0.9em" name="chevron-double-left"></i-bs>
+          } @else {
-        }
+            <i-bs width="0.9em" height="0.9em" name="chevron-double-left"></i-bs>
-      </button>
+          }
        </button>
      }
      <div class="sidebar-sticky pt-3 d-flex flex-column justify-space-around">
        <ul class="nav flex-column">
          <li class="nav-item app-link">
--- a/src-ui/src/app/components/app-frame/app-frame.component.ts
+++ b/src-ui/src/app/components/app-frame/app-frame.component.ts
@@ -152,6 +152,19 @@ export class AppFrameComponent
    return this.settingsService.get(SETTINGS_KEYS.APP_TITLE)
  }
  get canSaveSettings(): boolean {
    return (
      this.permissionsService.currentUserCan(
        PermissionAction.Change,
        PermissionType.UISettings
      ) &&
      this.permissionsService.currentUserCan(
        PermissionAction.Add,
        PermissionType.UISettings
      )
    )
  }
  get slimSidebarEnabled(): boolean {
    return this.settingsService.get(SETTINGS_KEYS.SLIM_SIDEBAR)
  }
--- a/src-ui/src/app/components/app-frame/global-search/global-search.component.ts
+++ b/src-ui/src/app/components/app-frame/global-search/global-search.component.ts
@@ -411,6 +411,9 @@ export class GlobalSearchComponent implements OnInit {
    const ruleType = this.useAdvancedForFullSearch
      ? FILTER_FULLTEXT_QUERY
      : FILTER_TITLE_CONTENT
    this.documentService.searchQuery = this.useAdvancedForFullSearch
      ? this.query
      : ''
    this.documentListViewService.quickFilter([
      { rule_type: ruleType, value: this.query },
    ])
--- a/src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.html
+++ b/src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.html
@@ -8,7 +8,7 @@
    <p><b>{{messageBold}}</b></p>
  }
  @if (message) {
-    <p class="mb-0" [innerHTML]="message | safeHtml"></p>
+    <p class="mb-0" [innerHTML]="message"></p>
  }
 </div>
 <div class="modal-footer">
--- a/src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.spec.ts
+++ b/src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.spec.ts
@@ -1,7 +1,6 @@
 import { ComponentFixture, TestBed } from '@angular/core/testing'
 import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
 import { Subject } from 'rxjs'
 import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { ConfirmDialogComponent } from './confirm-dialog.component'
 describe('ConfirmDialogComponent', () => {
@@ -11,8 +10,8 @@ describe('ConfirmDialogComponent', () => {
  beforeEach(async () => {
    TestBed.configureTestingModule({
-      providers: [NgbActiveModal, SafeHtmlPipe],
+      providers: [NgbActiveModal],
-      imports: [ConfirmDialogComponent, SafeHtmlPipe],
+      imports: [ConfirmDialogComponent],
    }).compileComponents()
    modal = TestBed.inject(NgbActiveModal)
--- a/src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.ts
+++ b/src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.ts
@@ -2,14 +2,13 @@ import { DecimalPipe } from '@angular/common'
 import { Component, EventEmitter, Input, Output, inject } from '@angular/core'
 import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
 import { Subject } from 'rxjs'
 import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { LoadingComponentWithPermissions } from '../../loading-component/loading.component'
@Component({
  selector: 'pngx-confirm-dialog',
  templateUrl: './confirm-dialog.component.html',
  styleUrls: ['./confirm-dialog.component.scss'],
-  imports: [DecimalPipe, SafeHtmlPipe],
+  imports: [DecimalPipe],
 })
 export class ConfirmDialogComponent extends LoadingComponentWithPermissions {
  activeModal = inject(NgbActiveModal)
--- a/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.html
+++ b/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.html
@@ -0,0 +1,75 @@
 <div class="modal-header">
  <h4 class="modal-title" id="modal-basic-title">{{title}}</h4>
  <button type="button" class="btn-close" aria-label="Close" (click)="cancel()">
  </button>
 </div>
 <div class="modal-body">
  @if (message) {
    <p class="mb-3" [innerHTML]="message"></p>
  }
  <div class="btn-group mb-3" role="group">
    <input
      type="radio"
      class="btn-check"
      name="passwordRemoveMode"
      id="removeReplace"
      [(ngModel)]="updateDocument"
      [value]="true"
      (ngModelChange)="onUpdateDocumentChange($event)"
    />
    <label class="btn btn-outline-primary btn-sm" for="removeReplace">
      <i-bs name="pencil"></i-bs>
      <span class="ms-2" i18n>Replace current document</span>
    </label>
    <input
      type="radio"
      class="btn-check"
      name="passwordRemoveMode"
      id="removeCreate"
      [(ngModel)]="updateDocument"
      [value]="false"
      (ngModelChange)="onUpdateDocumentChange($event)"
    />
    <label class="btn btn-outline-primary btn-sm" for="removeCreate">
      <i-bs name="plus"></i-bs>
      <span class="ms-2" i18n>Create new document</span>
    </label>
  </div>
  @if (!updateDocument) {
    <div class="d-flex flex-column flex-md-row w-100 gap-3 align-items-center">
      <div class="form-group d-flex">
        <div class="form-check">
          <input class="form-check-input" type="checkbox" id="copyMetaRemove" [(ngModel)]="includeMetadata" />
          <label class="form-check-label" for="copyMetaRemove" i18n> Copy metadata
          </label>
        </div>
        <div class="form-check ms-3">
          <input class="form-check-input" type="checkbox" id="deleteOriginalRemove" [(ngModel)]="deleteOriginal" />
          <label class="form-check-label" for="deleteOriginalRemove" i18n> Delete original</label>
        </div>
      </div>
    </div>
  }
 </div>
 <div class="modal-footer flex-nowrap gap-2">
  <button
    type="button"
    class="btn"
    [class]="cancelBtnClass"
    (click)="cancel()"
    [disabled]="!buttonsEnabled"
  >
    <span class="d-inline-block" style="padding-bottom: 1px;">
      {{cancelBtnCaption}}
    </span>
  </button>
  <button
    type="button"
    class="btn"
    [class]="btnClass"
    (click)="confirm()"
    [disabled]="!confirmButtonEnabled || !buttonsEnabled"
  >
    {{btnCaption}}
  </button>
 </div>
--- a/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.scss
+++ b/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.scss
--- a/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.spec.ts
+++ b/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.spec.ts
@@ -0,0 +1,53 @@
 import { ComponentFixture, TestBed } from '@angular/core/testing'
 import { By } from '@angular/platform-browser'
 import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
 import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
 import { PasswordRemovalConfirmDialogComponent } from './password-removal-confirm-dialog.component'
 describe('PasswordRemovalConfirmDialogComponent', () => {
  let component: PasswordRemovalConfirmDialogComponent
  let fixture: ComponentFixture<PasswordRemovalConfirmDialogComponent>
  beforeEach(async () => {
    await TestBed.configureTestingModule({
      providers: [NgbActiveModal],
      imports: [
        NgxBootstrapIconsModule.pick(allIcons),
        PasswordRemovalConfirmDialogComponent,
      ],
    }).compileComponents()
    fixture = TestBed.createComponent(PasswordRemovalConfirmDialogComponent)
    component = fixture.componentInstance
    fixture.detectChanges()
  })
  it('should default to replacing the document', () => {
    expect(component.updateDocument).toBe(true)
    expect(
      fixture.debugElement.query(By.css('#removeReplace')).nativeElement.checked
    ).toBe(true)
  })
  it('should allow creating a new document with metadata and delete toggle', () => {
    component.onUpdateDocumentChange(false)
    fixture.detectChanges()
    expect(component.updateDocument).toBe(false)
    expect(fixture.debugElement.query(By.css('#copyMetaRemove'))).not.toBeNull()
    component.includeMetadata = false
    component.deleteOriginal = true
    component.onUpdateDocumentChange(true)
    expect(component.updateDocument).toBe(true)
    expect(component.includeMetadata).toBe(true)
    expect(component.deleteOriginal).toBe(false)
  })
  it('should emit confirm when confirmed', () => {
    let confirmed = false
    component.confirmClicked.subscribe(() => (confirmed = true))
    component.confirm()
    expect(confirmed).toBe(true)
  })
 })
--- a/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.ts
+++ b/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.ts
@@ -0,0 +1,38 @@
 import { Component, Input } from '@angular/core'
 import { FormsModule } from '@angular/forms'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
 import { ConfirmDialogComponent } from '../confirm-dialog.component'
@Component({
  selector: 'pngx-password-removal-confirm-dialog',
  templateUrl: './password-removal-confirm-dialog.component.html',
  styleUrls: ['./password-removal-confirm-dialog.component.scss'],
  imports: [FormsModule, NgxBootstrapIconsModule],
 })
 export class PasswordRemovalConfirmDialogComponent extends ConfirmDialogComponent {
  updateDocument: boolean = true
  includeMetadata: boolean = true
  deleteOriginal: boolean = false
  @Input()
  override title = $localize`Remove password protection`
  @Input()
  override message =
    $localize`Create an unprotected copy or replace the existing file.`
  @Input()
  override btnCaption = $localize`Start`
  constructor() {
    super()
  }
  onUpdateDocumentChange(updateDocument: boolean) {
    this.updateDocument = updateDocument
    if (this.updateDocument) {
      this.deleteOriginal = false
      this.includeMetadata = true
    }
  }
 }
--- a/src-ui/src/app/components/common/confirm-dialog/rotate-confirm-dialog/rotate-confirm-dialog.component.html
+++ b/src-ui/src/app/components/common/confirm-dialog/rotate-confirm-dialog/rotate-confirm-dialog.component.html
@@ -28,10 +28,10 @@
 <div class="modal-footer flex-nowrap">
    <div class="col">
        @if (message) {
-            <p [innerHTML]="message | safeHtml"></p>
+            <p>{{message}}</p>
        }
        @if (messageBold) {
-          <p class="mb-0 small"><b [innerHTML]="messageBold | safeHtml"></b></p>
+          <p class="mb-0 small"><b>{{messageBold}}</b></p>
        }
    </div>
    <button type="button" class="btn" [class]="cancelBtnClass" (click)="cancel()" [disabled]="!buttonsEnabled">
--- a/src-ui/src/app/components/common/confirm-dialog/rotate-confirm-dialog/rotate-confirm-dialog.component.spec.ts
+++ b/src-ui/src/app/components/common/confirm-dialog/rotate-confirm-dialog/rotate-confirm-dialog.component.spec.ts
@@ -3,7 +3,6 @@ import { provideHttpClientTesting } from '@angular/common/http/testing'
 import { ComponentFixture, TestBed } from '@angular/core/testing'
 import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
 import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
 import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { RotateConfirmDialogComponent } from './rotate-confirm-dialog.component'
 describe('RotateConfirmDialogComponent', () => {
@@ -15,11 +14,9 @@ describe('RotateConfirmDialogComponent', () => {
      imports: [
        NgxBootstrapIconsModule.pick(allIcons),
        RotateConfirmDialogComponent,
        SafeHtmlPipe,
      ],
      providers: [
        NgbActiveModal,
        SafeHtmlPipe,
        provideHttpClient(withInterceptorsFromDi()),
        provideHttpClientTesting(),
      ],
--- a/src-ui/src/app/components/common/confirm-dialog/rotate-confirm-dialog/rotate-confirm-dialog.component.ts
+++ b/src-ui/src/app/components/common/confirm-dialog/rotate-confirm-dialog/rotate-confirm-dialog.component.ts
@@ -1,7 +1,6 @@
 import { NgStyle } from '@angular/common'
 import { Component, inject } from '@angular/core'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
 import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { DocumentService } from 'src/app/services/rest/document.service'
 import { ConfirmDialogComponent } from '../confirm-dialog.component'
@@ -9,7 +8,7 @@ import { ConfirmDialogComponent } from '../confirm-dialog.component'
  selector: 'pngx-rotate-confirm-dialog',
  templateUrl: './rotate-confirm-dialog.component.html',
  styleUrl: './rotate-confirm-dialog.component.scss',
-  imports: [NgStyle, NgxBootstrapIconsModule, SafeHtmlPipe],
+  imports: [NgStyle, NgxBootstrapIconsModule],
 })
 export class RotateConfirmDialogComponent extends ConfirmDialogComponent {
  documentService = inject(DocumentService)
--- a/src-ui/src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html
+++ b/src-ui/src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html
@@ -63,6 +63,7 @@
      bindValue="id"
      [(ngModel)]="atom.value"
      [disabled]="disabled"
      [virtualScroll]="getSelectOptionsForField(atom.field)?.length > 100"
      (mousedown)="$event.stopImmediatePropagation()"
    ></ng-select>
  } @else if (getCustomFieldByID(atom.field)?.data_type === CustomFieldDataType.DocumentLink) {
--- a/src-ui/src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.spec.ts
+++ b/src-ui/src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.spec.ts
@@ -354,5 +354,13 @@ describe('CustomFieldsQueryDropdownComponent', () => {
      model.removeElement(atom)
      expect(completeSpy).toHaveBeenCalled()
    })
    it('should subscribe to existing elements when queries are assigned', () => {
      const expression = new CustomFieldQueryExpression()
      const nextSpy = jest.spyOn(model.changed, 'next')
      model.queries = [expression]
      expression.changed.next(expression)
      expect(nextSpy).toHaveBeenCalledWith(model)
    })
  })
 })
--- a/src-ui/src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts
+++ b/src-ui/src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts
@@ -17,7 +17,7 @@ import {
 } from '@ng-bootstrap/ng-bootstrap'
 import { NgSelectComponent, NgSelectModule } from '@ng-select/ng-select'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
-import { first, Subject, takeUntil } from 'rxjs'
+import { first, Subject, Subscription, takeUntil } from 'rxjs'
 import { CustomField, CustomFieldDataType } from 'src/app/data/custom-field'
 import {
  CUSTOM_FIELD_QUERY_MAX_ATOMS,
@@ -41,10 +41,27 @@ import { ClearableBadgeComponent } from '../clearable-badge/clearable-badge.comp
 import { DocumentLinkComponent } from '../input/document-link/document-link.component'
 export class CustomFieldQueriesModel {
-  public queries: CustomFieldQueryElement[] = []
+  private _queries: CustomFieldQueryElement[] = []
  private rootSubscriptions: Subscription[] = []
  public readonly changed = new Subject<CustomFieldQueriesModel>()
  public get queries(): CustomFieldQueryElement[] {
    return this._queries
  }
  public set queries(value: CustomFieldQueryElement[]) {
    this.teardownRootSubscriptions()
    this._queries = value ?? []
    for (const element of this._queries) {
      this.rootSubscriptions.push(
        element.changed.subscribe(() => {
          this.changed.next(this)
        })
      )
    }
  }
  public clear(fireEvent = true) {
    this.queries = []
    if (fireEvent) {
@@ -107,14 +124,14 @@ export class CustomFieldQueriesModel {
  public addExpression(
    expression: CustomFieldQueryExpression = new CustomFieldQueryExpression()
  ) {
-    if (this.queries.length > 0) {
+    if (this.queries.length === 0) {
-      ;(
+      this.queries = [expression]
-        (this.queries[0] as CustomFieldQueryExpression)
+      return
          .value as CustomFieldQueryElement[]
      ).push(expression)
    } else {
      this.queries.push(expression)
    }
    ;(
      (this.queries[0] as CustomFieldQueryExpression)
        .value as CustomFieldQueryElement[]
    ).push(expression)
    expression.changed.subscribe(() => {
      this.changed.next(this)
    })
@@ -166,6 +183,13 @@ export class CustomFieldQueriesModel {
      this.changed.next(this)
    }
  }
  private teardownRootSubscriptions() {
    for (const subscription of this.rootSubscriptions) {
      subscription.unsubscribe()
    }
    this.rootSubscriptions = []
  }
 }
@Component({
--- a/src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.html
+++ b/src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.html
@@ -26,7 +26,7 @@
          i18n-placeholder
          (change)="onSetCreatedRelativeDate($event)">
          <ng-template ng-option-tmp let-item="item">
-            <div class="d-flex">{{ item.name }}<span class="ms-auto text-muted small">{{ item.date | customDate:'mediumDate' }} &ndash; <ng-container i18n>now</ng-container></span></div>
+            <ng-container [ngTemplateOutlet]="relativeDateOptionTemplate" [ngTemplateOutletContext]="{ $implicit: item }"></ng-container>
          </ng-template>
          </ng-select>
        </div>
@@ -102,7 +102,7 @@
            i18n-placeholder
            (change)="onSetAddedRelativeDate($event)">
            <ng-template ng-option-tmp let-item="item">
-              <div class="d-flex">{{ item.name }}<span class="ms-auto text-muted small">{{ item.date | customDate:'mediumDate' }} &ndash; <ng-container i18n>now</ng-container></span></div>
+              <ng-container [ngTemplateOutlet]="relativeDateOptionTemplate" [ngTemplateOutletContext]="{ $implicit: item }"></ng-container>
            </ng-template>
          </ng-select>
        </div>
@@ -158,3 +158,16 @@
    </div>
  </div>
 </div>
 <ng-template #relativeDateOptionTemplate let-item>
  <div class="d-flex">
    {{ item.name }}
    <span class="ms-auto text-muted small">
      @if (item.dateEnd) {
        {{ item.date | customDate:'MMM d' }} &ndash; {{ item.dateEnd | customDate:'mediumDate' }}
      } @else {
        {{ item.date | customDate:'mediumDate' }} &ndash; <ng-container i18n>now</ng-container>
      }
    </span>
  </div>
 </ng-template>
--- a/src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.ts
+++ b/src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.ts
@@ -1,4 +1,4 @@
-import { NgClass } from '@angular/common'
+import { NgClass, NgTemplateOutlet } from '@angular/common'
 import {
  Component,
  EventEmitter,
@@ -42,6 +42,10 @@ export enum RelativeDate {
  THIS_MONTH = 6,
  TODAY = 7,
  YESTERDAY = 8,
  PREVIOUS_WEEK = 9,
  PREVIOUS_MONTH = 10,
  PREVIOUS_QUARTER = 11,
  PREVIOUS_YEAR = 12,
 }
@Component({
@@ -59,6 +63,7 @@ export enum RelativeDate {
    FormsModule,
    ReactiveFormsModule,
    NgClass,
    NgTemplateOutlet,
  ],
 })
 export class DatesDropdownComponent implements OnInit, OnDestroy {
@@ -111,6 +116,46 @@ export class DatesDropdownComponent implements OnInit, OnDestroy {
      name: $localize`Yesterday`,
      date: new Date().setDate(new Date().getDate() - 1),
    },
    {
      id: RelativeDate.PREVIOUS_WEEK,
      name: $localize`Previous week`,
      date: new Date(
        new Date().getFullYear(),
        new Date().getMonth(),
        new Date().getDate() - new Date().getDay() - 6
      ),
      dateEnd: new Date(
        new Date().getFullYear(),
        new Date().getMonth(),
        new Date().getDate() - new Date().getDay()
      ),
    },
    {
      id: RelativeDate.PREVIOUS_MONTH,
      name: $localize`Previous month`,
      date: new Date(new Date().getFullYear(), new Date().getMonth() - 1, 1),
      dateEnd: new Date(new Date().getFullYear(), new Date().getMonth(), 0),
    },
    {
      id: RelativeDate.PREVIOUS_QUARTER,
      name: $localize`Previous quarter`,
      date: new Date(
        new Date().getFullYear(),
        Math.floor(new Date().getMonth() / 3) * 3 - 3,
        1
      ),
      dateEnd: new Date(
        new Date().getFullYear(),
        Math.floor(new Date().getMonth() / 3) * 3,
        0
      ),
    },
    {
      id: RelativeDate.PREVIOUS_YEAR,
      name: $localize`Previous year`,
      date: new Date('1/1/' + (new Date().getFullYear() - 1)),
      dateEnd: new Date('12/31/' + (new Date().getFullYear() - 1)),
    },
  ]
  datePlaceHolder: string
--- a/src-ui/src/app/components/common/edit-dialog/custom-field-edit-dialog/custom-field-edit-dialog.component.spec.ts
+++ b/src-ui/src/app/components/common/edit-dialog/custom-field-edit-dialog/custom-field-edit-dialog.component.spec.ts
@@ -10,7 +10,6 @@ import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
 import { CustomFieldDataType } from 'src/app/data/custom-field'
 import { IfOwnerDirective } from 'src/app/directives/if-owner.directive'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { SettingsService } from 'src/app/services/settings.service'
 import { SelectComponent } from '../../input/select/select.component'
 import { TextComponent } from '../../input/text/text.component'
@@ -35,7 +34,6 @@ describe('CustomFieldEditDialogComponent', () => {
        IfOwnerDirective,
        SelectComponent,
        TextComponent,
        SafeHtmlPipe,
      ],
      providers: [
        NgbActiveModal,
--- a/src-ui/src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.spec.ts
+++ b/src-ui/src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.spec.ts
@@ -11,7 +11,6 @@ import {
 } from 'src/app/data/mail-rule'
 import { IfOwnerDirective } from 'src/app/directives/if-owner.directive'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { CorrespondentService } from 'src/app/services/rest/correspondent.service'
 import { DocumentTypeService } from 'src/app/services/rest/document-type.service'
 import { MailAccountService } from 'src/app/services/rest/mail-account.service'
@@ -46,7 +45,6 @@ describe('MailRuleEditDialogComponent', () => {
        PermissionsFormComponent,
        NumberComponent,
        TagsComponent,
        SafeHtmlPipe,
        CheckComponent,
        SwitchComponent,
      ],
--- a/src-ui/src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.ts
+++ b/src-ui/src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.ts
@@ -14,6 +14,7 @@ import { GroupService } from 'src/app/services/rest/group.service'
 import { UserService } from 'src/app/services/rest/user.service'
 import { SettingsService } from 'src/app/services/settings.service'
 import { ToastService } from 'src/app/services/toast.service'
 import { ConfirmButtonComponent } from '../../confirm-button/confirm-button.component'
 import { PasswordComponent } from '../../input/password/password.component'
 import { SelectComponent } from '../../input/select/select.component'
 import { TextComponent } from '../../input/text/text.component'
@@ -28,6 +29,7 @@ import { PermissionsSelectComponent } from '../../permissions-select/permissions
    SelectComponent,
    TextComponent,
    PasswordComponent,
    ConfirmButtonComponent,
    FormsModule,
    ReactiveFormsModule,
  ],
--- a/src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.html
+++ b/src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.html
@@ -77,9 +77,11 @@
              </div>
              <div ngbAccordion [closeOthers]="true" cdkDropList (cdkDropListDropped)="onActionDrop($event)">
                @for (action of object?.actions; track action; let i = $index){
-                  <div ngbAccordionItem cdkDrag [formGroup]="actionFields.controls[i]">
+                  <div ngbAccordionItem [formGroup]="actionFields.controls[i]">
-                    <div ngbAccordionHeader>
+                    <div ngbAccordionHeader cdkDrag>
-                      <button ngbAccordionButton>{{i + 1}}. {{getActionTypeOptionName(actionFields.controls[i].value.type)}}
+                      <button ngbAccordionButton>
                        <i-bs name="grip-vertical" class="ms-n3 pe-1"></i-bs>
                        {{i + 1}}. {{getActionTypeOptionName(actionFields.controls[i].value.type)}}
                        @if(action.id) {
                          <span class="badge bg-primary text-primary-text-contrast ms-2">ID: {{action.id}}</span>
                        }
@@ -159,7 +161,7 @@
        <pngx-input-text i18n-title title="Filter filename" formControlName="filter_filename" horizontal="true" i18n-hint hint="Apply to documents that match this filename. Wildcards such as *.pdf or *invoice* are allowed. Case insensitive." [error]="error?.filter_filename"></pngx-input-text>
        @if (formGroup.get('type').value === WorkflowTriggerType.Consumption) {
          <pngx-input-select i18n-title title="Filter sources" [items]="sourceOptions" horizontal="true" [multiple]="true" formControlName="sources" [error]="error?.sources"></pngx-input-select>
-          <pngx-input-text i18n-title title="Filter path" formControlName="filter_path" horizontal="true" i18n-hint hint="Apply to documents that match this path. Wildcards specified as * are allowed. Case-normalized.</a>" [error]="error?.filter_path"></pngx-input-text>
+          <pngx-input-text i18n-title title="Filter path" formControlName="filter_path" horizontal="true" i18n-hint hint="Apply to documents that match this path. Wildcards specified as * are allowed. Case-normalized." [error]="error?.filter_path"></pngx-input-text>
          <pngx-input-select i18n-title title="Filter mail rule" [items]="mailRules" horizontal="true" [allowNull]="true" formControlName="filter_mailrule" i18n-hint hint="Apply to documents consumed via this mail rule." [error]="error?.filter_mailrule"></pngx-input-select>
        }
        @if (formGroup.get('type').value === WorkflowTriggerType.DocumentAdded || formGroup.get('type').value === WorkflowTriggerType.DocumentUpdated || formGroup.get('type').value === WorkflowTriggerType.Scheduled) {
--- a/src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.scss
+++ b/src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.scss
@@ -11,3 +11,7 @@
 :host ::ng-deep .filters .paperless-input-select.mb-3 {
    margin-bottom: 0 !important;
 }
 .ms-n3 {
    margin-left: -1rem !important;
 }
--- a/src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.spec.ts
+++ b/src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.spec.ts
@@ -30,7 +30,6 @@ import {
 } from 'src/app/data/workflow-trigger'
 import { IfOwnerDirective } from 'src/app/directives/if-owner.directive'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { CorrespondentService } from 'src/app/services/rest/correspondent.service'
 import { CustomFieldsService } from 'src/app/services/rest/custom-fields.service'
 import { DocumentTypeService } from 'src/app/services/rest/document-type.service'
@@ -105,7 +104,6 @@ describe('WorkflowEditDialogComponent', () => {
        TagsComponent,
        PermissionsUserComponent,
        PermissionsGroupComponent,
        SafeHtmlPipe,
        ConfirmButtonComponent,
      ],
      providers: [
--- a/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.spec.ts
+++ b/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.spec.ts
@@ -564,6 +564,208 @@ describe('FilterableDropdownComponent & FilterableDropdownSelectionModel', () =>
    ])
  })
  it('keeps children with their parent when parent has document count', () => {
    const parent: Tag = {
      id: 10,
      name: 'Parent Tag',
      orderIndex: 0,
      document_count: 2,
    }
    const child: Tag = {
      id: 11,
      name: 'Child Tag',
      parent: parent.id,
      orderIndex: 1,
      document_count: 0,
    }
    const otherRoot: Tag = {
      id: 20,
      name: 'Other Tag',
      orderIndex: 2,
      document_count: 0,
    }
    component.selectionModel.items = [parent, child, otherRoot]
    component.selectionModel = selectionModel
    component.documentCounts = [
      { id: parent.id, document_count: 2 },
      { id: otherRoot.id, document_count: 0 },
    ]
    selectionModel.apply()
    expect(component.selectionModel.items).toEqual([
      nullItem,
      parent,
      child,
      otherRoot,
    ])
  })
  it('keeps selected branches ahead of document-based ordering', () => {
    const selectedRoot: Tag = {
      id: 30,
      name: 'Selected Root',
      orderIndex: 0,
      document_count: 0,
    }
    const otherRoot: Tag = {
      id: 40,
      name: 'Other Root',
      orderIndex: 1,
      document_count: 2,
    }
    component.selectionModel.items = [selectedRoot, otherRoot]
    component.selectionModel = selectionModel
    selectionModel.set(selectedRoot.id, ToggleableItemState.Selected)
    component.documentCounts = [
      { id: selectedRoot.id, document_count: 0 },
      { id: otherRoot.id, document_count: 2 },
    ]
    selectionModel.apply()
    expect(component.selectionModel.items).toEqual([
      nullItem,
      selectedRoot,
      otherRoot,
    ])
  })
  it('resorts items immediately when document count sorting enabled', () => {
    const apple: Tag = { id: 55, name: 'Apple' }
    const zebra: Tag = { id: 56, name: 'Zebra' }
    selectionModel.documentCountSortingEnabled = true
    selectionModel.items = [apple, zebra]
    expect(selectionModel.items.map((item) => item?.id ?? null)).toEqual([
      null,
      apple.id,
      zebra.id,
    ])
    selectionModel.documentCounts = [
      { id: zebra.id, document_count: 5 },
      { id: apple.id, document_count: 0 },
    ]
    expect(selectionModel.items.map((item) => item?.id ?? null)).toEqual([
      null,
      zebra.id,
      apple.id,
    ])
  })
  it('does not resort items by default when document counts are set', () => {
    const first: Tag = { id: 57, name: 'First' }
    const second: Tag = { id: 58, name: 'Second' }
    selectionModel.items = [first, second]
    selectionModel.documentCounts = [
      { id: second.id, document_count: 10 },
      { id: first.id, document_count: 0 },
    ]
    expect(selectionModel.items.map((item) => item?.id ?? null)).toEqual([
      null,
      first.id,
      second.id,
    ])
  })
  it('uses fallback document counts when selection data is missing', () => {
    const fallbackRoot: Tag = {
      id: 50,
      name: 'Fallback Root',
      orderIndex: 0,
      document_count: 3,
    }
    const fallbackChild: Tag = {
      id: 51,
      name: 'Fallback Child',
      parent: fallbackRoot.id,
      orderIndex: 1,
      document_count: 0,
    }
    const otherRoot: Tag = {
      id: 60,
      name: 'Other Root',
      orderIndex: 2,
      document_count: 0,
    }
    component.selectionModel = selectionModel
    selectionModel.items = [fallbackRoot, fallbackChild, otherRoot]
    component.documentCounts = [{ id: otherRoot.id, document_count: 0 }]
    selectionModel.apply()
    expect(selectionModel.items).toEqual([
      nullItem,
      fallbackRoot,
      fallbackChild,
      otherRoot,
    ])
  })
  it('handles special and non-numeric ids when promoting branches', () => {
    const rootWithDocs: Tag = {
      id: 70,
      name: 'Root With Docs',
      orderIndex: 0,
      document_count: 1,
    }
    const miscItem: any = { id: 'misc', name: 'Misc Item' }
    component.selectionModel = selectionModel
    selectionModel.intersection = Intersection.Exclude
    selectionModel.items = [rootWithDocs, miscItem as any]
    component.documentCounts = [{ id: rootWithDocs.id, document_count: 1 }]
    selectionModel.apply()
    expect(selectionModel.items.map((item) => item.id)).toEqual([
      NEGATIVE_NULL_FILTER_VALUE,
      rootWithDocs.id,
      'misc',
    ])
  })
  it('memoizes root document counts between lookups', () => {
    const memoRoot: Tag = { id: 80, name: 'Memo Root' }
    selectionModel.items = [memoRoot]
    selectionModel.documentCounts = [{ id: memoRoot.id, document_count: 9 }]
    const getRootDocCount = (selectionModel as any).createRootDocCounter()
    expect(getRootDocCount(memoRoot.id)).toEqual(9)
    selectionModel.documentCounts = []
    expect(getRootDocCount(memoRoot.id)).toEqual(9)
  })
  it('falls back to model stored document counts if selection data missing entry', () => {
    const rootWithoutSelection: Tag = {
      id: 90,
      name: 'Fallback Root',
      document_count: 4,
    }
    selectionModel.items = [rootWithoutSelection]
    selectionModel.documentCounts = []
    const getRootDocCount = (selectionModel as any).createRootDocCounter()
    expect(getRootDocCount(rootWithoutSelection.id)).toEqual(4)
  })
  it('defaults to zero document count when neither selection nor model provide it', () => {
    const rootWithoutCounts: Tag = { id: 91, name: 'Fallback Zero Root' }
    selectionModel.items = [rootWithoutCounts]
    selectionModel.documentCounts = []
    const getRootDocCount = (selectionModel as any).createRootDocCounter()
    expect(getRootDocCount(rootWithoutCounts.id)).toEqual(0)
  })
  it('should set support create, keep open model and call createRef method', fakeAsync(() => {
    component.selectionModel.items = items
    component.icon = 'tag-fill'
--- a/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.ts
+++ b/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.ts
@@ -32,6 +32,14 @@ export interface ChangedItems {
  itemsToRemove: MatchingModel[]
 }
 type BranchSummary = {
  items: MatchingModel[]
  firstIndex: number
  special: boolean
  selected: boolean
  hasDocs: boolean
 }
 export enum LogicalOperator {
  And = 'and',
  Or = 'or',
@@ -53,8 +61,13 @@ export class FilterableDropdownSelectionModel {
  temporaryIntersection: Intersection = this._intersection
  private _documentCounts: SelectionDataItem[] = []
  public documentCountSortingEnabled = false
  public set documentCounts(counts: SelectionDataItem[]) {
    this._documentCounts = counts
    if (this.documentCountSortingEnabled) {
      this.sortItems()
    }
  }
  private _items: MatchingModel[] = []
@@ -114,6 +127,13 @@ export class FilterableDropdownSelectionModel {
          b.id == NEGATIVE_NULL_FILTER_VALUE)
      ) {
        return 1
      }
      // Preserve hierarchical order when provided (e.g., Tags)
      const ao = (a as any)['orderIndex']
      const bo = (b as any)['orderIndex']
      if (ao !== undefined && bo !== undefined) {
        return ao - bo
      } else if (
        this.getNonTemporary(a.id) == ToggleableItemState.NotSelected &&
        this.getNonTemporary(b.id) != ToggleableItemState.NotSelected
@@ -136,17 +156,14 @@ export class FilterableDropdownSelectionModel {
        this.getDocumentCount(a.id) < this.getDocumentCount(b.id)
      ) {
        return 1
      }
      // Preserve hierarchical order when provided (e.g., Tags)
      const ao = (a as any)['orderIndex']
      const bo = (b as any)['orderIndex']
      if (ao !== undefined && bo !== undefined) {
        return ao - bo
      } else {
        return a.name.localeCompare(b.name)
      }
    })
    if (this._documentCounts.length) {
      this.promoteBranchesWithDocumentCounts()
    }
  }
  private selectionStates = new Map<number, ToggleableItemState>()
@@ -380,6 +397,180 @@ export class FilterableDropdownSelectionModel {
    return this._documentCounts.find((c) => c.id === id)?.document_count
  }
  private promoteBranchesWithDocumentCounts() {
    const parentById = this.buildParentById()
    const findRootId = this.createRootFinder(parentById)
    const getRootDocCount = this.createRootDocCounter()
    const summaries = this.buildBranchSummaries(findRootId, getRootDocCount)
    const orderedBranches = this.orderBranchesByPriority(summaries)
    this._items = orderedBranches.flatMap((summary) => summary.items)
  }
  private buildParentById(): Map<number, number | null> {
    const parentById = new Map<number, number | null>()
    for (const item of this._items) {
      if (typeof item?.id === 'number') {
        const parentValue = (item as any)['parent']
        parentById.set(
          item.id,
          typeof parentValue === 'number' ? parentValue : null
        )
      }
    }
    return parentById
  }
  private createRootFinder(
    parentById: Map<number, number | null>
  ): (id: number) => number {
    const rootMemo = new Map<number, number>()
    const findRootId = (id: number): number => {
      const cached = rootMemo.get(id)
      if (cached !== undefined) {
        return cached
      }
      const parentId = parentById.get(id)
      if (parentId === undefined || parentId === null) {
        rootMemo.set(id, id)
        return id
      }
      const rootId = findRootId(parentId)
      rootMemo.set(id, rootId)
      return rootId
    }
    return findRootId
  }
  private createRootDocCounter(): (rootId: number) => number {
    const docCountMemo = new Map<number, number>()
    return (rootId: number): number => {
      const cached = docCountMemo.get(rootId)
      if (cached !== undefined) {
        return cached
      }
      const explicit = this.getDocumentCount(rootId)
      if (typeof explicit === 'number') {
        docCountMemo.set(rootId, explicit)
        return explicit
      }
      const rootItem = this._items.find((i) => i.id === rootId)
      const fallback =
        typeof (rootItem as any)?.['document_count'] === 'number'
          ? (rootItem as any)['document_count']
          : 0
      docCountMemo.set(rootId, fallback)
      return fallback
    }
  }
  private buildBranchSummaries(
    findRootId: (id: number) => number,
    getRootDocCount: (rootId: number) => number
  ): Map<string, BranchSummary> {
    const summaries = new Map<string, BranchSummary>()
    for (const [index, item] of this._items.entries()) {
      const { key, special, rootId } = this.describeBranchItem(
        item,
        index,
        findRootId
      )
      let summary = summaries.get(key)
      if (!summary) {
        summary = {
          items: [],
          firstIndex: index,
          special,
          selected: false,
          hasDocs:
            special || rootId === null ? false : getRootDocCount(rootId) > 0,
        }
        summaries.set(key, summary)
      }
      summary.items.push(item)
      if (this.shouldMarkSummarySelected(summary, item)) {
        summary.selected = true
      }
    }
    return summaries
  }
  private describeBranchItem(
    item: MatchingModel,
    index: number,
    findRootId: (id: number) => number
  ): { key: string; special: boolean; rootId: number | null } {
    if (item?.id === null) {
      return { key: 'null', special: true, rootId: null }
    }
    if (item?.id === NEGATIVE_NULL_FILTER_VALUE) {
      return { key: 'neg-null', special: true, rootId: null }
    }
    if (typeof item?.id === 'number') {
      const rootId = findRootId(item.id)
      return { key: `root-${rootId}`, special: false, rootId }
    }
    return { key: `misc-${index}`, special: false, rootId: null }
  }
  private shouldMarkSummarySelected(
    summary: BranchSummary,
    item: MatchingModel
  ): boolean {
    if (summary.special) {
      return false
    }
    if (typeof item?.id !== 'number') {
      return false
    }
    return this.getNonTemporary(item.id) !== ToggleableItemState.NotSelected
  }
  private orderBranchesByPriority(
    summaries: Map<string, BranchSummary>
  ): BranchSummary[] {
    return Array.from(summaries.values()).sort((a, b) => {
      const rankDiff = this.branchRank(a) - this.branchRank(b)
      if (rankDiff !== 0) {
        return rankDiff
      }
      if (a.hasDocs !== b.hasDocs) {
        return a.hasDocs ? -1 : 1
      }
      return a.firstIndex - b.firstIndex
    })
  }
  private branchRank(summary: BranchSummary): number {
    if (summary.special) {
      return -1
    }
    if (summary.selected) {
      return 0
    }
    return 1
  }
  init(map: Map<number, ToggleableItemState>) {
    this.temporarySelectionStates = map
    this.apply()
@@ -465,8 +656,9 @@ export class FilterableDropdownComponent
      this.selectionModel.changed.complete()
      model.items = this.selectionModel.items
      model.manyToOne = this.selectionModel.manyToOne
-      model.singleSelect = this.editing && !this.selectionModel.manyToOne
+      model.singleSelect = this._editing && !model.manyToOne
    }
    model.documentCountSortingEnabled = this._editing
    model.changed.subscribe((updatedModel) => {
      this.selectionModelChange.next(updatedModel)
    })
@@ -496,8 +688,21 @@ export class FilterableDropdownComponent
  @Input()
  allowSelectNone: boolean = false
  private _editing = false
  @Input()
-  editing = false
+  set editing(value: boolean) {
    this._editing = value
    if (this.selectionModel) {
      this.selectionModel.singleSelect =
        this._editing && !this.selectionModel.manyToOne
      this.selectionModel.documentCountSortingEnabled = this._editing
    }
  }
  get editing() {
    return this._editing
  }
  @Input()
  applyOnClose = false
--- a/src-ui/src/app/components/common/input/entries/entries.component.html
+++ b/src-ui/src/app/components/common/input/entries/entries.component.html
@@ -19,7 +19,7 @@
        </div>
      }
      @if (hint) {
-        <small class="form-text text-muted" [innerHTML]="hint | safeHtml"></small>
+        <small class="form-text text-muted" [innerHTML]="hint"></small>
      }
      <div class="invalid-feedback position-absolute top-100">
        {{error}}
--- a/src-ui/src/app/components/common/input/file/file.component.html
+++ b/src-ui/src/app/components/common/input/file/file.component.html
@@ -24,7 +24,7 @@
        }
        <input #inputField type="hidden" class="form-control small" [(ngModel)]="value" [disabled]="true">
        @if (hint) {
-            <small class="form-text text-muted" [innerHTML]="hint | safeHtml"></small>
+            <small class="form-text text-muted" [innerHTML]="hint"></small>
        }
        <div class="invalid-feedback position-absolute top-100">
            {{error}}
--- a/src-ui/src/app/components/common/input/password/password.component.html
+++ b/src-ui/src/app/components/common/input/password/password.component.html
@@ -12,6 +12,6 @@
    {{error}}
  </div>
  @if (hint) {
-    <small class="form-text text-muted" [innerHTML]="hint | safeHtml"></small>
+    <small class="form-text text-muted" [innerHTML]="hint"></small>
  }
 </div>
--- a/src-ui/src/app/components/common/input/select/select.component.html
+++ b/src-ui/src/app/components/common/input/select/select.component.html
@@ -29,6 +29,7 @@
          [multiple]="multiple"
          [bindLabel]="bindLabel"
          bindValue="id"
          [virtualScroll]="items?.length > 100"
          (change)="onChange(value)"
          (search)="onSearch($event)"
          (focus)="clearLastSearchTerm()"
--- a/src-ui/src/app/components/common/input/tags/tags.component.spec.ts
+++ b/src-ui/src/app/components/common/input/tags/tags.component.spec.ts
@@ -106,6 +106,7 @@ describe('TagsComponent', () => {
    modalService = TestBed.inject(NgbModal)
    settingsService = TestBed.inject(SettingsService)
    settingsService.currentUser = { id: 1 }
    fixture = TestBed.createComponent(TagsComponent)
    fixture.debugElement.injector.get(NG_VALUE_ACCESSOR)
    component = fixture.componentInstance
@@ -138,7 +139,7 @@ describe('TagsComponent', () => {
    settingsService.currentUser = { id: 1 }
    let activeInstances: NgbModalRef[]
    modalService.activeInstances.subscribe((v) => (activeInstances = v))
-    component.select.searchTerm = 'foobar'
+    component.select.filter('foobar')
    component.createTag()
    expect(modalService.hasOpenModals()).toBeTruthy()
    expect(activeInstances[0].componentInstance.object.name).toEqual('foobar')
--- a/src-ui/src/app/components/common/input/tags/tags.component.ts
+++ b/src-ui/src/app/components/common/input/tags/tags.component.ts
@@ -169,7 +169,7 @@ export class TagsComponent implements OnInit, ControlValueAccessor {
    if (name) modal.componentInstance.object = { name: name }
    else if (this.select.searchTerm)
      modal.componentInstance.object = { name: this.select.searchTerm }
-    this.select.searchTerm = null
+    this.select.filter(null)
    this.select.detectChanges()
    return firstValueFrom(
      (modal.componentInstance as TagEditDialogComponent).succeeded.pipe(
--- a/src-ui/src/app/components/common/input/text/text.component.html
+++ b/src-ui/src/app/components/common/input/text/text.component.html
@@ -13,7 +13,7 @@
      <div class="position-relative" [class.col-md-9]="horizontal">
        <input #inputField type="text" class="form-control" [class.is-invalid]="error" [id]="inputId" [(ngModel)]="value" (change)="onChange(value)" [disabled]="disabled" [autocomplete]="autocomplete" [placeholder]="placeholder">
        @if (hint) {
-          <small class="form-text text-muted" [innerHTML]="hint | safeHtml"></small>
+          <small class="form-text text-muted" [innerHTML]="hint"></small>
        }
        <div class="invalid-feedback position-absolute top-100">
          {{error}}
--- a/src-ui/src/app/components/common/input/text/text.component.ts
+++ b/src-ui/src/app/components/common/input/text/text.component.ts
@@ -5,7 +5,6 @@ import {
  ReactiveFormsModule,
 } from '@angular/forms'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
 import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { AbstractInputComponent } from '../abstract-input'
@Component({
@@ -19,12 +18,7 @@ import { AbstractInputComponent } from '../abstract-input'
  selector: 'pngx-input-text',
  templateUrl: './text.component.html',
  styleUrls: ['./text.component.scss'],
-  imports: [
+  imports: [FormsModule, ReactiveFormsModule, NgxBootstrapIconsModule],
    FormsModule,
    ReactiveFormsModule,
    SafeHtmlPipe,
    NgxBootstrapIconsModule,
  ],
 })
 export class TextComponent extends AbstractInputComponent<string> {
  @Input()
--- a/src-ui/src/app/components/common/input/textarea/textarea.component.html
+++ b/src-ui/src/app/components/common/input/textarea/textarea.component.html
@@ -23,7 +23,7 @@
          rows="4">
        </textarea>
        @if (hint) {
-          <small class="form-text text-muted" [innerHTML]="hint | safeHtml"></small>
+          <small class="form-text text-muted" [innerHTML]="hint"></small>
        }
        <div class="invalid-feedback position-absolute top-100">
          {{error}}
--- a/src-ui/src/app/components/common/input/textarea/textarea.component.ts
+++ b/src-ui/src/app/components/common/input/textarea/textarea.component.ts
@@ -5,7 +5,6 @@ import {
  ReactiveFormsModule,
 } from '@angular/forms'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
 import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { AbstractInputComponent } from '../abstract-input'
@Component({
@@ -19,12 +18,7 @@ import { AbstractInputComponent } from '../abstract-input'
  selector: 'pngx-input-textarea',
  templateUrl: './textarea.component.html',
  styleUrls: ['./textarea.component.scss'],
-  imports: [
+  imports: [FormsModule, ReactiveFormsModule, NgxBootstrapIconsModule],
    FormsModule,
    ReactiveFormsModule,
    SafeHtmlPipe,
    NgxBootstrapIconsModule,
  ],
 })
 export class TextAreaComponent extends AbstractInputComponent<string> {
  @Input()
--- a/src-ui/src/app/components/common/input/url/url.component.html
+++ b/src-ui/src/app/components/common/input/url/url.component.html
@@ -19,7 +19,7 @@
        </div>
      </div>
      @if (hint) {
-        <small class="form-text text-muted" [innerHTML]="hint | safeHtml"></small>
+        <small class="form-text text-muted" [innerHTML]="hint"></small>
      }
    </div>
  </div>
--- a/src-ui/src/app/components/common/permissions-dialog/permissions-dialog.component.spec.ts
+++ b/src-ui/src/app/components/common/permissions-dialog/permissions-dialog.component.spec.ts
@@ -5,7 +5,6 @@ import { FormsModule, ReactiveFormsModule } from '@angular/forms'
 import { NgbActiveModal, NgbModule } from '@ng-bootstrap/ng-bootstrap'
 import { NgSelectModule } from '@ng-select/ng-select'
 import { of } from 'rxjs'
 import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { UserService } from 'src/app/services/rest/user.service'
 import { PermissionsFormComponent } from '../input/permissions/permissions-form/permissions-form.component'
 import { PermissionsGroupComponent } from '../input/permissions/permissions-group/permissions-group.component'
@@ -41,7 +40,6 @@ describe('PermissionsDialogComponent', () => {
        ReactiveFormsModule,
        NgbModule,
        PermissionsDialogComponent,
        SafeHtmlPipe,
        SelectComponent,
        SwitchComponent,
        PermissionsFormComponent,
--- a/src-ui/src/app/components/common/preview-popup/preview-popup.component.html
+++ b/src-ui/src/app/components/common/preview-popup/preview-popup.component.html
@@ -14,7 +14,7 @@
        @if (previewText) {
          <div class="bg-light p-3 overflow-auto whitespace-preserve" width="100%">{{previewText}}</div>
        } @else {
-          <object [data]="previewURL | safeUrl" width="100%" class="bg-light" [class.p-2]="!isPdf"></object>
+          <object [data]="previewUrl | safeUrl" width="100%" class="bg-light" [class.p-2]="!isPdf"></object>
        }
      } @else {
        @if (requiresPassword) {
@@ -24,7 +24,7 @@
        }
        @if (!requiresPassword) {
          <pdf-viewer
-            [src]="previewURL"
+            [src]="previewUrl"
            [original-size]="false"
            [show-borders]="false"
            [show-all]="true"
--- a/src-ui/src/app/components/common/preview-popup/preview-popup.component.ts
+++ b/src-ui/src/app/components/common/preview-popup/preview-popup.component.ts
@@ -71,7 +71,7 @@ export class PreviewPopupComponent implements OnDestroy {
    return (this.isPdf && this.useNativePdfViewer) || !this.isPdf
  }
-  get previewURL() {
+  get previewUrl() {
    return this.documentService.getPreviewUrl(this.document.id)
  }
@@ -93,7 +93,7 @@ export class PreviewPopupComponent implements OnDestroy {
  init() {
    if (this.document.mime_type?.includes('text')) {
      this.http
-        .get(this.previewURL, { responseType: 'text' })
+        .get(this.previewUrl, { responseType: 'text' })
        .pipe(first(), takeUntil(this.unsubscribeNotifier))
        .subscribe({
          next: (res) => {
@@ -126,10 +126,6 @@ export class PreviewPopupComponent implements OnDestroy {
    }
  }
  get previewUrl() {
    return this.documentService.getPreviewUrl(this.document.id)
  }
  mouseEnterPreview() {
    this.mouseOnPreview = true
    if (!this.popover.isOpen()) {
--- a/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.html
+++ b/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.html
@@ -110,7 +110,9 @@
                      <div class="visually-hidden" i18n>Loading...</div>
                    } @else if (totpSettings) {
                      <figure class="figure">
-                        <div class="bg-white d-inline-block" [innerHTML]="totpSettings.qr_svg | safeHtml"></div>
+                        @if (qrSvgDataUrl) {
                          <img class="bg-white d-inline-block" [src]="qrSvgDataUrl" alt="Authenticator QR code">
                        }
                        <figcaption class="figure-caption text-end mt-2" i18n>Scan the QR code with your authenticator app and then enter the code below</figcaption>
                      </figure>
                      <p>
--- a/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.ts
+++ b/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.ts
@@ -18,7 +18,6 @@ import {
  SocialAccountProvider,
  TotpSettings,
 } from 'src/app/data/user-profile'
 import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { ProfileService } from 'src/app/services/profile.service'
 import { ToastService } from 'src/app/services/toast.service'
 import { setLocationHref } from 'src/app/utils/navigation'
@@ -37,7 +36,6 @@ import { TextComponent } from '../input/text/text.component'
    PasswordComponent,
    FormsModule,
    ReactiveFormsModule,
    SafeHtmlPipe,
    NgbAccordionModule,
    NgbPopoverModule,
    NgxBootstrapIconsModule,
@@ -89,6 +87,13 @@ export class ProfileEditDialogComponent
  public socialAccounts: SocialAccount[] = []
  public socialAccountProviders: SocialAccountProvider[] = []
  get qrSvgDataUrl(): string | null {
    if (!this.totpSettings?.qr_svg) {
      return null
    }
    return `data:image/svg+xml;utf8,${encodeURIComponent(this.totpSettings.qr_svg)}`
  }
  ngOnInit(): void {
    this.networkActive = true
    this.profileService
@@ -183,6 +188,7 @@ export class ProfileEditDialogComponent
      this.newPassword && this.currentPassword !== this.newPassword
    const profile = Object.assign({}, this.form.value)
    delete profile.totp_code
    this.error = null
    this.networkActive = true
    this.profileService
      .update(profile)
@@ -204,6 +210,7 @@ export class ProfileEditDialogComponent
        },
        error: (error) => {
          this.toastService.showError($localize`Error saving profile`, error)
          this.error = error?.error
          this.networkActive = false
        },
      })
--- a/src-ui/src/app/components/document-detail/document-detail.component.html
+++ b/src-ui/src/app/components/document-detail/document-detail.component.html
@@ -65,6 +65,12 @@
      <button ngbDropdownItem (click)="editPdf()" [disabled]="!userIsOwner || !userCanEdit || originalContentRenderType !== ContentRenderType.PDF">
        <i-bs name="pencil"></i-bs>&nbsp;<ng-container i18n>PDF Editor</ng-container>
      </button>
      @if (userIsOwner && (requiresPassword || password)) {
        <button ngbDropdownItem (click)="removePassword()" [disabled]="!password">
          <i-bs name="unlock"></i-bs>&nbsp;<ng-container i18n>Remove Password</ng-container>
        </button>
      }
    </div>
  </div>
@@ -379,7 +385,7 @@
 <ng-template #previewContent>
  <div class="thumb-preview position-absolute pe-none text-center" [class.fade]="previewLoaded">
    @if (showThumbnailOverlay) {
-      <img [src]="thumbUrl | safeUrl" class="mx-auto" [attr.width]="previewZoomScale === 'page-fit' ? 'auto' : '100%'" [attr.height]="previewZoomScale === 'page-fit' ? '100%' : 'auto'" alt="Document loading..." i18n-alt />
+      <img [src]="thumbUrl" class="mx-auto" [attr.width]="previewZoomScale === 'page-fit' ? 'auto' : '100%'" [attr.height]="previewZoomScale === 'page-fit' ? '100%' : 'auto'" alt="Document loading..." i18n-alt />
    }
    <div class="position-absolute top-0 start-0 m-2 p-2 d-flex align-items-center justify-content-center">
      <div>
@@ -414,7 +420,7 @@
      }
      @case (ContentRenderType.Image) {
        <div class="preview-sticky">
-          <img [src]="previewUrl | safeUrl" width="100%" height="100%" alt="{{title}}" />
+          <img [src]="previewUrl" width="100%" height="100%" alt="{{title}}" />
        </div>
      }
      @case (ContentRenderType.TIFF) {
--- a/src-ui/src/app/components/document-detail/document-detail.component.spec.ts
+++ b/src-ui/src/app/components/document-detail/document-detail.component.spec.ts
@@ -66,6 +66,7 @@ import { SettingsService } from 'src/app/services/settings.service'
 import { ToastService } from 'src/app/services/toast.service'
 import { environment } from 'src/environments/environment'
 import { ConfirmDialogComponent } from '../common/confirm-dialog/confirm-dialog.component'
 import { PasswordRemovalConfirmDialogComponent } from '../common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component'
 import { CustomFieldsDropdownComponent } from '../common/custom-fields-dropdown/custom-fields-dropdown.component'
 import {
  DocumentDetailComponent,
@@ -1209,6 +1210,88 @@ describe('DocumentDetailComponent', () => {
    expect(closeSpy).toHaveBeenCalled()
  })
  it('should support removing password protection from pdfs', () => {
    let modal: NgbModalRef
    modalService.activeInstances.subscribe((m) => (modal = m[0]))
    initNormally()
    component.password = 'secret'
    component.removePassword()
    const dialog =
      modal.componentInstance as PasswordRemovalConfirmDialogComponent
    dialog.updateDocument = false
    dialog.includeMetadata = false
    dialog.deleteOriginal = true
    dialog.confirm()
    const req = httpTestingController.expectOne(
      `${environment.apiBaseUrl}documents/bulk_edit/`
    )
    expect(req.request.body).toEqual({
      documents: [doc.id],
      method: 'remove_password',
      parameters: {
        password: 'secret',
        update_document: false,
        include_metadata: false,
        delete_original: true,
      },
    })
    req.flush(true)
  })
  it('should require the current password before removing it', () => {
    initNormally()
    const errorSpy = jest.spyOn(toastService, 'showError')
    component.requiresPassword = true
    component.password = ''
    component.removePassword()
    expect(errorSpy).toHaveBeenCalled()
    httpTestingController.expectNone(
      `${environment.apiBaseUrl}documents/bulk_edit/`
    )
  })
  it('should handle failures when removing password protection', () => {
    let modal: NgbModalRef
    modalService.activeInstances.subscribe((m) => (modal = m[0]))
    initNormally()
    const errorSpy = jest.spyOn(toastService, 'showError')
    component.password = 'secret'
    component.removePassword()
    const dialog =
      modal.componentInstance as PasswordRemovalConfirmDialogComponent
    dialog.confirm()
    const req = httpTestingController.expectOne(
      `${environment.apiBaseUrl}documents/bulk_edit/`
    )
    req.error(new ErrorEvent('failed'))
    expect(errorSpy).toHaveBeenCalled()
    expect(component.networkActive).toBe(false)
    expect(dialog.buttonsEnabled).toBe(true)
  })
  it('should refresh the document when removing password in update mode', () => {
    let modal: NgbModalRef
    modalService.activeInstances.subscribe((m) => (modal = m[0]))
    const refreshSpy = jest.spyOn(openDocumentsService, 'refreshDocument')
    initNormally()
    component.password = 'secret'
    component.removePassword()
    const dialog =
      modal.componentInstance as PasswordRemovalConfirmDialogComponent
    dialog.confirm()
    const req = httpTestingController.expectOne(
      `${environment.apiBaseUrl}documents/bulk_edit/`
    )
    req.flush(true)
    expect(refreshSpy).toHaveBeenCalledWith(doc.id)
  })
  it('should support keyboard shortcuts', () => {
    initNormally()
@@ -1489,6 +1572,8 @@ describe('DocumentDetailComponent', () => {
      mockContentWindow.onafterprint(new Event('afterprint'))
    }
    tick(500)
    expect(removeChildSpy).toHaveBeenCalledWith(mockIframe)
    expect(revokeObjectURLSpy).toHaveBeenCalledWith('blob:mock-url')
@@ -1512,65 +1597,97 @@ describe('DocumentDetailComponent', () => {
    )
  })
-  it('should show error toast if printing throws inside iframe', fakeAsync(() => {
+  const iframePrintErrorCases: Array<{
-    initNormally()
+    description: string
    thrownError: Error
    expectToast: boolean
  }> = [
    {
      description: 'should show error toast if printing throws inside iframe',
      thrownError: new Error('focus failed'),
      expectToast: true,
    },
    {
      description:
        'should suppress toast if cross-origin afterprint error occurs',
      thrownError: new DOMException(
        'Accessing onafterprint triggered a cross-origin violation',
        'SecurityError'
      ),
      expectToast: false,
    },
  ]
-    const appendChildSpy = jest
+  iframePrintErrorCases.forEach(({ description, thrownError, expectToast }) => {
-      .spyOn(document.body, 'appendChild')
+    it(
-      .mockImplementation((node: Node) => node)
+      description,
-    const removeChildSpy = jest
+      fakeAsync(() => {
-      .spyOn(document.body, 'removeChild')
+        initNormally()
      .mockImplementation((node: Node) => node)
    const createObjectURLSpy = jest
      .spyOn(URL, 'createObjectURL')
      .mockReturnValue('blob:mock-url')
    const revokeObjectURLSpy = jest
      .spyOn(URL, 'revokeObjectURL')
      .mockImplementation(() => {})
-    const toastSpy = jest.spyOn(toastService, 'showError')
+        const appendChildSpy = jest
          .spyOn(document.body, 'appendChild')
          .mockImplementation((node: Node) => node)
        const removeChildSpy = jest
          .spyOn(document.body, 'removeChild')
          .mockImplementation((node: Node) => node)
        const createObjectURLSpy = jest
          .spyOn(URL, 'createObjectURL')
          .mockReturnValue('blob:mock-url')
        const revokeObjectURLSpy = jest
          .spyOn(URL, 'revokeObjectURL')
          .mockImplementation(() => {})
-    const mockContentWindow = {
+        const toastSpy = jest.spyOn(toastService, 'showError')
      focus: jest.fn().mockImplementation(() => {
        throw new Error('focus failed')
      }),
      print: jest.fn(),
      onafterprint: null,
    }
-    const mockIframe: any = {
+        const mockContentWindow = {
-      style: {},
+          focus: jest.fn().mockImplementation(() => {
-      src: '',
+            throw thrownError
-      onload: null,
+          }),
-      contentWindow: mockContentWindow,
+          print: jest.fn(),
-    }
+          onafterprint: null,
        }
-    const createElementSpy = jest
+        const mockIframe: any = {
-      .spyOn(document, 'createElement')
+          style: {},
-      .mockReturnValue(mockIframe as any)
+          src: '',
          onload: null,
          contentWindow: mockContentWindow,
        }
-    const blob = new Blob(['test'], { type: 'application/pdf' })
+        const createElementSpy = jest
-    component.printDocument()
+          .spyOn(document, 'createElement')
          .mockReturnValue(mockIframe as any)
-    const req = httpTestingController.expectOne(
+        const blob = new Blob(['test'], { type: 'application/pdf' })
-      `${environment.apiBaseUrl}documents/${doc.id}/download/`
+        component.printDocument()
        const req = httpTestingController.expectOne(
          `${environment.apiBaseUrl}documents/${doc.id}/download/`
        )
        req.flush(blob)
        tick()
        if (mockIframe.onload) {
          mockIframe.onload(new Event('load'))
        }
        tick(200)
        if (expectToast) {
          expect(toastSpy).toHaveBeenCalled()
        } else {
          expect(toastSpy).not.toHaveBeenCalled()
        }
        expect(removeChildSpy).toHaveBeenCalledWith(mockIframe)
        expect(revokeObjectURLSpy).toHaveBeenCalledWith('blob:mock-url')
        createElementSpy.mockRestore()
        appendChildSpy.mockRestore()
        removeChildSpy.mockRestore()
        createObjectURLSpy.mockRestore()
        revokeObjectURLSpy.mockRestore()
      })
    )
-    req.flush(blob)
+  })
    tick()
    if (mockIframe.onload) {
      mockIframe.onload(new Event('load'))
    }
    expect(toastSpy).toHaveBeenCalled()
    expect(removeChildSpy).toHaveBeenCalledWith(mockIframe)
    expect(revokeObjectURLSpy).toHaveBeenCalledWith('blob:mock-url')
    createElementSpy.mockRestore()
    appendChildSpy.mockRestore()
    removeChildSpy.mockRestore()
    createObjectURLSpy.mockRestore()
    revokeObjectURLSpy.mockRestore()
  }))
 })
--- a/src-ui/src/app/components/document-detail/document-detail.component.ts
+++ b/src-ui/src/app/components/document-detail/document-detail.component.ts
@@ -21,7 +21,7 @@ import { dirtyCheck, DirtyComponent } from '@ngneat/dirty-check-forms'
 import { PDFDocumentProxy, PdfViewerModule } from 'ng2-pdf-viewer'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
 import { DeviceDetectorService } from 'ngx-device-detector'
-import { BehaviorSubject, Observable, of, Subject } from 'rxjs'
+import { BehaviorSubject, Observable, of, Subject, timer } from 'rxjs'
 import {
  catchError,
  debounceTime,
@@ -83,6 +83,7 @@ import { getFilenameFromContentDisposition } from 'src/app/utils/http'
 import { ISODateAdapter } from 'src/app/utils/ngb-iso-date-adapter'
 import * as UTIF from 'utif'
 import { ConfirmDialogComponent } from '../common/confirm-dialog/confirm-dialog.component'
 import { PasswordRemovalConfirmDialogComponent } from '../common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component'
 import { CustomFieldsDropdownComponent } from '../common/custom-fields-dropdown/custom-fields-dropdown.component'
 import { CorrespondentEditDialogComponent } from '../common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component'
 import { DocumentTypeEditDialogComponent } from '../common/edit-dialog/document-type-edit-dialog/document-type-edit-dialog.component'
@@ -1428,6 +1429,63 @@ export class DocumentDetailComponent
      })
  }
  removePassword() {
    if (this.requiresPassword || !this.password) {
      this.toastService.showError(
        $localize`Please enter the current password before attempting to remove it.`
      )
      return
    }
    const modal = this.modalService.open(
      PasswordRemovalConfirmDialogComponent,
      {
        backdrop: 'static',
      }
    )
    modal.componentInstance.title = $localize`Remove password protection`
    modal.componentInstance.message = $localize`Create an unprotected copy or replace the existing file.`
    modal.componentInstance.btnCaption = $localize`Start`
    modal.componentInstance.confirmClicked
      .pipe(takeUntil(this.unsubscribeNotifier))
      .subscribe(() => {
        const dialog =
          modal.componentInstance as PasswordRemovalConfirmDialogComponent
        dialog.buttonsEnabled = false
        this.networkActive = true
        this.documentsService
          .bulkEdit([this.document.id], 'remove_password', {
            password: this.password,
            update_document: dialog.updateDocument,
            include_metadata: dialog.includeMetadata,
            delete_original: dialog.deleteOriginal,
          })
          .pipe(first(), takeUntil(this.unsubscribeNotifier))
          .subscribe({
            next: () => {
              this.toastService.showInfo(
                $localize`Password removal operation for "${this.document.title}" will begin in the background.`
              )
              this.networkActive = false
              modal.close()
              if (!dialog.updateDocument && dialog.deleteOriginal) {
                this.openDocumentService.closeDocument(this.document)
              } else if (dialog.updateDocument) {
                this.openDocumentService.refreshDocument(this.documentId)
              }
            },
            error: (error) => {
              dialog.buttonsEnabled = true
              this.networkActive = false
              this.toastService.showError(
                $localize`Error executing password removal operation`,
                error
              )
            },
          })
      })
  }
  printDocument() {
    const printUrl = this.documentsService.getDownloadUrl(
      this.document.id,
@@ -1452,9 +1510,18 @@ export class DocumentDetailComponent
                URL.revokeObjectURL(blobUrl)
              }
            } catch (err) {
-              this.toastService.showError($localize`Print failed.`, err)
+              // FF throws cross-origin error on onafterprint
-              document.body.removeChild(iframe)
+              const isCrossOriginAfterPrintError =
-              URL.revokeObjectURL(blobUrl)
+                err instanceof DOMException &&
                err.message.includes('onafterprint')
              if (!isCrossOriginAfterPrintError) {
                this.toastService.showError($localize`Print failed.`, err)
              }
              timer(100).subscribe(() => {
                // delay to avoid FF print failure
                document.body.removeChild(iframe)
                URL.revokeObjectURL(blobUrl)
              })
            }
          }
        },
--- a/src-ui/src/app/components/document-list/document-list.component.html
+++ b/src-ui/src/app/components/document-list/document-list.component.html
@@ -15,7 +15,7 @@
  </div>
  <div class="d-none d-sm-flex flex-fill me-3">
    <div class="input-group input-group-sm">
-      <span class="input-group-text border-0">Select:</span>
+      <span class="input-group-text border-0" i18n>Select:</span>
    </div>
    <div class="btn-group btn-group-sm flex-nowrap">
      @if (list.selected.size > 0) {
--- a/src-ui/src/app/components/document-list/document-list.component.spec.ts
+++ b/src-ui/src/app/components/document-list/document-list.component.spec.ts
@@ -36,7 +36,6 @@ import { PermissionsGuard } from 'src/app/guards/permissions.guard'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
 import { DocumentTitlePipe } from 'src/app/pipes/document-title.pipe'
 import { FilterPipe } from 'src/app/pipes/filter.pipe'
 import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe'
 import { UsernamePipe } from 'src/app/pipes/username.pipe'
 import { DocumentListViewService } from 'src/app/services/document-list-view.service'
 import { PermissionsService } from 'src/app/services/permissions.service'
@@ -103,7 +102,6 @@ describe('DocumentListComponent', () => {
        DatePipe,
        DocumentTitlePipe,
        UsernamePipe,
        SafeHtmlPipe,
        PermissionsGuard,
        provideHttpClient(withInterceptorsFromDi()),
        provideHttpClientTesting(),
--- a/src-ui/src/app/components/document-list/filter-editor/filter-editor.component.ts
+++ b/src-ui/src/app/components/document-list/filter-editor/filter-editor.component.ts
@@ -173,6 +173,22 @@ const RELATIVE_DATE_QUERYSTRINGS = [
    relativeDate: RelativeDate.YESTERDAY,
    dateQuery: 'yesterday',
  },
  {
    relativeDate: RelativeDate.PREVIOUS_WEEK,
    dateQuery: 'previous week',
  },
  {
    relativeDate: RelativeDate.PREVIOUS_MONTH,
    dateQuery: 'previous month',
  },
  {
    relativeDate: RelativeDate.PREVIOUS_QUARTER,
    dateQuery: 'previous quarter',
  },
  {
    relativeDate: RelativeDate.PREVIOUS_YEAR,
    dateQuery: 'previous year',
  },
 ]
 const DEFAULT_TEXT_FILTER_TARGET_OPTIONS = [
@@ -400,6 +416,9 @@ export class FilterEditorComponent
  @Input()
  set filterRules(value: FilterRule[]) {
    if (value === this._filterRules) {
      return
    }
    this._filterRules = value
    this.documentTypeSelectionModel.clear(false)
@@ -747,7 +766,7 @@ export class FilterEditorComponent
    ) {
      filterRules.push({
        rule_type: FILTER_TITLE_CONTENT,
-        value: this._textFilter,
+        value: this._textFilter.trim(),
      })
    }
    if (this._textFilter && this.textFilterTarget == TEXT_FILTER_TARGET_TITLE) {
@@ -805,7 +824,7 @@ export class FilterEditorComponent
    ) {
      filterRules.push({
        rule_type: FILTER_FULLTEXT_QUERY,
-        value: this._textFilter,
+        value: this._textFilter.trim(),
      })
    }
    if (
@@ -1098,7 +1117,13 @@ export class FilterEditorComponent
  rulesModified: boolean = false
  updateRules() {
-    this.filterRulesChange.next(this.filterRules)
+    const updatedRules = this.filterRules
    this._filterRules = updatedRules
    this.rulesModified = filterRulesDiffer(
      this._unmodifiedFilterRules,
      updatedRules
    )
    this.filterRulesChange.next(updatedRules)
  }
  get textFilter() {
--- a/src-ui/src/app/components/file-drop/file-drop.component.ts
+++ b/src-ui/src/app/components/file-drop/file-drop.component.ts
@@ -150,12 +150,11 @@ export class FileDropComponent {
    this.onDragLeave(event, true)
  }
-  @HostListener('window:blur', ['$event']) public onWindowBlur() {
+  @HostListener('window:blur') public onWindowBlur() {
    if (this.fileIsOver) this.onDragLeave(null)
  }
-  @HostListener('document:visibilitychange', ['$event'])
+  @HostListener('document:visibilitychange') public onVisibilityChange() {
  public onVisibilityChange() {
    if (document.hidden && this.fileIsOver) this.onDragLeave(null)
  }
 }
--- a/Show More
+++ b/Show More