Bump version to 3.4.1

New Crowdin translations by GitHub Action (#14584 )
Co-authored-by: Crowdin Bot <support+bot@crowdin.com>
2026-10-31 12:05:45 +00:00 · 2026-10-30 22:20:31 -07:00 · 2026-10-31 05:12:07 +00:00 · 2026-10-31 04:48:33 +00:00 · 2026-10-30 21:47:12 -07:00 · 2026-10-30 16:16:48 -07:00
213 changed files with 50206 additions and 36863 deletions
@@ -61,6 +61,7 @@ The following are not generally considered vulnerabilities unless accompanied by
 - claims based solely on the presence of a library, framework feature or code pattern without a working exploit
 - pickle deserialization of internal data from trusted components such as the Redis-compatible broker or Paperless-ngx data directory
 - users with permission to edit users granting themselves additional privileges; this is expected behavior for that trusted permission
+- users with change permission on a mail account redirecting stored credentials to another mail server, including through connectivity tests. Mail account editing is a trusted permission, and UI password masking does not imply credential isolation from account editors
 - reports that rely on admin-level access, application-configuration access, workflow-editing privileges, shell access, or other high-trust roles unless they demonstrate an unintended privilege boundary bypass
 - optional webhook, mail, AI, OCR, or integration behavior described without a product-level vulnerability
 - missing limits or hardening settings presented without concrete impact
@@ -10,9 +10,11 @@ if [[ -n "${PAPERLESS_CONSUMER_DISABLE}" ]]; then
 else
 	cd ${PAPERLESS_SRC_DIR}

+	# Django system checks already ran once in init-system-checks, skip repeating them
+
 	if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-		exec python3 manage.py document_consumer
+		exec python3 manage.py document_consumer --skip-checks
 	else
-		exec s6-setuidgid paperless python3 manage.py document_consumer
+		exec s6-setuidgid paperless python3 manage.py document_consumer --skip-checks
 	fi
 fi
@@ -3,8 +3,9 @@

 cd ${PAPERLESS_SRC_DIR}

+# Django system checks already ran once in init-system-checks, skip repeating them
 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	exec /usr/local/bin/celery --app paperless beat --loglevel INFO
+	exec /usr/local/bin/celery --skip-checks --app paperless beat --loglevel INFO
 else
-	exec s6-setuidgid paperless /usr/local/bin/celery --app paperless beat --loglevel INFO
+	exec s6-setuidgid paperless /usr/local/bin/celery --skip-checks --app paperless beat --loglevel INFO
 fi
@@ -3,8 +3,9 @@

 cd ${PAPERLESS_SRC_DIR}

+# Django system checks already ran once in init-system-checks, skip repeating them
 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	exec /usr/local/bin/celery --app paperless worker --loglevel INFO --without-mingle --without-gossip
+	exec /usr/local/bin/celery --skip-checks --app paperless worker --loglevel INFO --without-mingle --without-gossip
 else
-	exec s6-setuidgid paperless /usr/local/bin/celery --app paperless worker --loglevel INFO --without-mingle --without-gossip
+	exec s6-setuidgid paperless /usr/local/bin/celery --skip-checks --app paperless worker --loglevel INFO --without-mingle --without-gossip
 fi
@@ -162,6 +162,17 @@ including `gt` (>), `gte` (>=), `lt` (<), `lte` (<=), and `range`.
 Lastly, document link fields support a `contains` operator that behaves
 like a "is superset of" check.

+Date fields also accept relative expressions supported by
+[dateparser](https://dateparser.readthedocs.io/en/stable/), such as `today`,
+`in 30 days`, or `1 month ago`. For example, dates within the next 30 days:
+
+```json
+["expiry", "range", ["today", "in 30 days"]]
+```
+
+Expressions resolve each time the query runs, using `PAPERLESS_TIME_ZONE` and
+`PAPERLESS_DATE_PARSER_LANGUAGES` (automatic language detection when unset).
+
 ### `/api/search/autocomplete/`

 Get auto completions for a partial search term.
@@ -1,5 +1,91 @@
 # Changelog

+## paperless-ngx 3.4.0
+
+### Features / Enhancements
+
+- Enhancement: support custom fields in workflow title templates [@shamoon](https://github.com/shamoon) ([#14564](https://github.com/paperless-ngx/paperless-ngx/pull/14564))
+- Enhancement: relative date custom field queries [@shamoon](https://github.com/shamoon) ([#14549](https://github.com/paperless-ngx/paperless-ngx/pull/14549))
+- Performance: reduce tasks badge load times [@JanKleine](https://github.com/JanKleine) ([#14552](https://github.com/paperless-ngx/paperless-ngx/pull/14552))
+- Enhancement: skip local 2FA for trusted OIDC AMR [@shamoon](https://github.com/shamoon) ([#14403](https://github.com/paperless-ngx/paperless-ngx/pull/14403))
+- Feature: Generate PDF thumbnails via poppler utils [@stumpylog](https://github.com/stumpylog) ([#14420](https://github.com/paperless-ngx/paperless-ngx/pull/14420))
+- Enhancement: add upload count to button, link to tray, reduce notifications [@shamoon](https://github.com/shamoon) ([#14501](https://github.com/paperless-ngx/paperless-ngx/pull/14501))
+- Enhancement: notifications improvements [@shamoon](https://github.com/shamoon) ([#14500](https://github.com/paperless-ngx/paperless-ngx/pull/14500))
+- Enhancement: doc details ux improvements [@shamoon](https://github.com/shamoon) ([#14485](https://github.com/paperless-ngx/paperless-ngx/pull/14485))
+- Enhancement (QoL): allow independently toggling child + parent tags in WF tag fields [@shamoon](https://github.com/shamoon) ([#14400](https://github.com/paperless-ngx/paperless-ngx/pull/14400))
+- Tweak: drop the user dropdown caret [@shamoon](https://github.com/shamoon) ([#14444](https://github.com/paperless-ngx/paperless-ngx/pull/14444))
+- Enhancement: navbar upload button [@shamoon](https://github.com/shamoon) ([#14442](https://github.com/paperless-ngx/paperless-ngx/pull/14442))
+- Enhancement: AI chat UX tweaks [@shamoon](https://github.com/shamoon) ([#14415](https://github.com/paperless-ngx/paperless-ngx/pull/14415))
+- Enhancement: support markdown in AI chat [@shamoon](https://github.com/shamoon) ([#14409](https://github.com/paperless-ngx/paperless-ngx/pull/14409))
+
+### Bug Fixes
+
+- Fix: truncate long version labels in dropdown [@shamoon](https://github.com/shamoon) ([#14578](https://github.com/paperless-ngx/paperless-ngx/pull/14578))
+- Fixhancement: show better result for revoked / expired tasks [@shamoon](https://github.com/shamoon) ([#14566](https://github.com/paperless-ngx/paperless-ngx/pull/14566))
+- Fix: move re-index after workflow runs on doc edit [@shamoon](https://github.com/shamoon) ([#14558](https://github.com/paperless-ngx/paperless-ngx/pull/14558))
+- Fix: folder export with --delete fails on a stale manifest.json.tmp [@benpetty](https://github.com/benpetty) ([#14526](https://github.com/paperless-ngx/paperless-ngx/pull/14526))
+- Fix: fix list type for api schema document object filters [@shamoon](https://github.com/shamoon) ([#14524](https://github.com/paperless-ngx/paperless-ngx/pull/14524))
+- Fix: standardize some dropdown sizing [@shamoon](https://github.com/shamoon) ([#14510](https://github.com/paperless-ngx/paperless-ngx/pull/14510))
+- Fix: prevent doc permissions queries on schema view [@shamoon](https://github.com/shamoon) ([#14503](https://github.com/paperless-ngx/paperless-ngx/pull/14503))
+- Fix: dont defer tag assignment when barcode will not result in a split [@shamoon](https://github.com/shamoon) ([#14497](https://github.com/paperless-ngx/paperless-ngx/pull/14497))
+
+### Dependencies
+
+<details>
+<summary>6 changes</summary>
+
+- Chore: bump some frontend deps for security fixes [@shamoon](https://github.com/shamoon) ([#14581](https://github.com/paperless-ngx/paperless-ngx/pull/14581))
+- Chore: bump brotli, djangorestframework, filelock, msgpack, setuptools for security fixes [@stumpylog](https://github.com/stumpylog) ([#14575](https://github.com/paperless-ngx/paperless-ngx/pull/14575))
+- Chore: bump django-allauth to 65.20 and oauthlib to 4.0 [@stumpylog](https://github.com/stumpylog) ([#14570](https://github.com/paperless-ngx/paperless-ngx/pull/14570))
+- Chore(deps): Bump the uv group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14517](https://github.com/paperless-ngx/paperless-ngx/pull/14517))
+- Chore(deps): Bump the uv group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14493](https://github.com/paperless-ngx/paperless-ngx/pull/14493))
+- Chore: Drop ImageMagik as a dependency [@stumpylog](https://github.com/stumpylog) ([#14440](https://github.com/paperless-ngx/paperless-ngx/pull/14440))
+
+</details>
+
+### All App Changes
+
+<details>
+<summary>35 changes</summary>
+
+- Chore: Consolidate test sample files [@stumpylog](https://github.com/stumpylog) ([#14430](https://github.com/paperless-ngx/paperless-ngx/pull/14430))
+- Chore: bump some frontend deps for security fixes [@shamoon](https://github.com/shamoon) ([#14581](https://github.com/paperless-ngx/paperless-ngx/pull/14581))
+- Enhancement: support custom fields in workflow title templates [@shamoon](https://github.com/shamoon) ([#14564](https://github.com/paperless-ngx/paperless-ngx/pull/14564))
+- Enhancement: relative date custom field queries [@shamoon](https://github.com/shamoon) ([#14549](https://github.com/paperless-ngx/paperless-ngx/pull/14549))
+- Fix: truncate long version labels in dropdown [@shamoon](https://github.com/shamoon) ([#14578](https://github.com/paperless-ngx/paperless-ngx/pull/14578))
+- Chore: bump brotli, djangorestframework, filelock, msgpack, setuptools for security fixes [@stumpylog](https://github.com/stumpylog) ([#14575](https://github.com/paperless-ngx/paperless-ngx/pull/14575))
+- Chore: bump django-allauth to 65.20 and oauthlib to 4.0 [@stumpylog](https://github.com/stumpylog) ([#14570](https://github.com/paperless-ngx/paperless-ngx/pull/14570))
+- Fixhancement: show better result for revoked / expired tasks [@shamoon](https://github.com/shamoon) ([#14566](https://github.com/paperless-ngx/paperless-ngx/pull/14566))
+- Fix: move re-index after workflow runs on doc edit [@shamoon](https://github.com/shamoon) ([#14558](https://github.com/paperless-ngx/paperless-ngx/pull/14558))
+- Performance: reduce tasks badge load times [@JanKleine](https://github.com/JanKleine) ([#14552](https://github.com/paperless-ngx/paperless-ngx/pull/14552))
+- Enhancement: skip local 2FA for trusted OIDC AMR [@shamoon](https://github.com/shamoon) ([#14403](https://github.com/paperless-ngx/paperless-ngx/pull/14403))
+- Chore: consolidate direct permission grant lookups into one helper [@stumpylog](https://github.com/stumpylog) ([#14456](https://github.com/paperless-ngx/paperless-ngx/pull/14456))
+- Chore: drop get\_groups\_with\_only\_permission [@stumpylog](https://github.com/stumpylog) ([#14454](https://github.com/paperless-ngx/paperless-ngx/pull/14454))
+- Chore: Consolidate to a single way to set permission on an object [@stumpylog](https://github.com/stumpylog) ([#14453](https://github.com/paperless-ngx/paperless-ngx/pull/14453))
+- Chore: Refactor bulk edit to remove PDF knowledge [@stumpylog](https://github.com/stumpylog) ([#14445](https://github.com/paperless-ngx/paperless-ngx/pull/14445))
+- Fix: folder export with --delete fails on a stale manifest.json.tmp [@benpetty](https://github.com/benpetty) ([#14526](https://github.com/paperless-ngx/paperless-ngx/pull/14526))
+- Chore(deps): Bump the uv group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14517](https://github.com/paperless-ngx/paperless-ngx/pull/14517))
+- Fix: fix list type for api schema document object filters [@shamoon](https://github.com/shamoon) ([#14524](https://github.com/paperless-ngx/paperless-ngx/pull/14524))
+- Chore(deps): Bump the uv group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14493](https://github.com/paperless-ngx/paperless-ngx/pull/14493))
+- Chore: drop get\_objects\_for\_user\_owner\_aware [@stumpylog](https://github.com/stumpylog) ([#14457](https://github.com/paperless-ngx/paperless-ngx/pull/14457))
+- Chore: update Angular components to 22.2.2 [@shamoon](https://github.com/shamoon) ([#14515](https://github.com/paperless-ngx/paperless-ngx/pull/14515))
+- Chore: share one base class for the method-mapped permission classes [@stumpylog](https://github.com/stumpylog) ([#14458](https://github.com/paperless-ngx/paperless-ngx/pull/14458))
+- Fix: standardize some dropdown sizing [@shamoon](https://github.com/shamoon) ([#14510](https://github.com/paperless-ngx/paperless-ngx/pull/14510))
+- Chore: Drop ImageMagik as a dependency [@stumpylog](https://github.com/stumpylog) ([#14440](https://github.com/paperless-ngx/paperless-ngx/pull/14440))
+- Feature: Generate PDF thumbnails via poppler utils [@stumpylog](https://github.com/stumpylog) ([#14420](https://github.com/paperless-ngx/paperless-ngx/pull/14420))
+- Fix: prevent doc permissions queries on schema view [@shamoon](https://github.com/shamoon) ([#14503](https://github.com/paperless-ngx/paperless-ngx/pull/14503))
+- Enhancement: add upload count to button, link to tray, reduce notifications [@shamoon](https://github.com/shamoon) ([#14501](https://github.com/paperless-ngx/paperless-ngx/pull/14501))
+- Enhancement: notifications improvements [@shamoon](https://github.com/shamoon) ([#14500](https://github.com/paperless-ngx/paperless-ngx/pull/14500))
+- Enhancement: doc details ux improvements [@shamoon](https://github.com/shamoon) ([#14485](https://github.com/paperless-ngx/paperless-ngx/pull/14485))
+- Enhancement (QoL): allow independently toggling child + parent tags in WF tag fields [@shamoon](https://github.com/shamoon) ([#14400](https://github.com/paperless-ngx/paperless-ngx/pull/14400))
+- Tweak: drop the user dropdown caret [@shamoon](https://github.com/shamoon) ([#14444](https://github.com/paperless-ngx/paperless-ngx/pull/14444))
+- Enhancement: navbar upload button [@shamoon](https://github.com/shamoon) ([#14442](https://github.com/paperless-ngx/paperless-ngx/pull/14442))
+- Enhancement: AI chat UX tweaks [@shamoon](https://github.com/shamoon) ([#14415](https://github.com/paperless-ngx/paperless-ngx/pull/14415))
+- Enhancement: support markdown in AI chat [@shamoon](https://github.com/shamoon) ([#14409](https://github.com/paperless-ngx/paperless-ngx/pull/14409))
+- Fix: dont defer tag assignment when barcode will not result in a split [@shamoon](https://github.com/shamoon) ([#14497](https://github.com/paperless-ngx/paperless-ngx/pull/14497))
+
+</details>
+
 ## paperless-ngx 3.3.4

 ### All App Changes
@@ -803,6 +803,17 @@ system. See the corresponding

    Defaults to None

+#### [`PAPERLESS_SOCIAL_ACCOUNT_MFA_TRUSTED_AMR=<comma-separated-list>`](#PAPERLESS_SOCIAL_ACCOUNT_MFA_TRUSTED_AMR) {#PAPERLESS_SOCIAL_ACCOUNT_MFA_TRUSTED_AMR}
+
+: A list of authentication method values which, if present in the `amr` claim of the ID token sent by an OpenID Connect provider, cause Paperless-ngx to skip its own two-factor authentication prompt for that login. This avoids users having to enter a second factor twice when the identity provider already performed multi-factor authentication. Logins with a username and password, or via a provider which does not send a matching `amr` value, still require the Paperless-ngx code.
+
+    Which values to trust depends entirely on your identity provider, e.g. Authelia sends `mfa` and Pocket ID sends `phr` for passkey logins (but `otp` for single-factor email codes, which should _not_ be trusted). Some providers, such as Keycloak, do not send an `amr` claim by default and need to be configured to do so. You can see what your provider sends from the Django admin as a superuser by checking `id_token` → `amr` in the "Extra data" of the social account.
+
+    !!! warning
+        Only list values that mean a second factor was actually used for the login.
+
+    Defaults to `mfa`, the standard value for multi-factor authentication ([RFC 8176](https://www.rfc-editor.org/rfc/rfc8176.html)).
+
 #### [`PAPERLESS_SOCIAL_ACCOUNT_DEFAULT_GROUPS=<comma-separated-list>`](#PAPERLESS_SOCIAL_ACCOUNT_DEFAULT_GROUPS) {#PAPERLESS_SOCIAL_ACCOUNT_DEFAULT_GROUPS}

 : A list of group names that users who signup via social accounts will be added to upon signup. Groups listed here must already exist.
@@ -472,6 +472,8 @@ Users can enable two-factor authentication (2FA) for their accounts from the 'My

 Should a user lose access to their 2FA device and all recovery codes, a superuser can disable 2FA for the user from the 'Users & Groups' management screen.

+If users log in via an OpenID Connect provider which already enforces multi-factor authentication, see [`PAPERLESS_SOCIAL_ACCOUNT_MFA_TRUSTED_AMR`](configuration.md#PAPERLESS_SOCIAL_ACCOUNT_MFA_TRUSTED_AMR) to skip the Paperless-ngx prompt for those logins.
+
 ## Workflows

 !!! note
@@ -724,6 +726,7 @@ applied. You can use the following placeholders in the template with any trigger
 - `{{added_time}}`: added time in HH:MM format
 - `{{original_filename}}`: original file name without extension
 - `{{filename}}`: current file name without extension (for "added" workflows this may not be final yet, you can use `{{original_filename}}`)
+- `{{custom_fields}}`: Custom field names mapped to their type and value, as in [file name templates](advanced_usage.md#additional-variables). For example, `{{ custom_fields.Invoice.value }}` or `{{ custom_fields | get_cf_value("Invoice", "") }}` for a fallback when the field is missing. In title assignments, fields assigned by the same action are available.
 - `{{doc_title}}`: current document title (cannot be used in title assignment)

 The following placeholders are only available for "added" or "updated" triggers
@@ -1,6 +1,6 @@
 [project]
 name = "paperless-ngx"
-version = "3.3.4"
+version = "3.4.1"
 description = """\
  A community-supported supercharged document management system: scan, index and archive all your physical documents\
  """
@@ -27,7 +27,7 @@ dependencies = [
  # WARNING: django does not use semver.
  #          Only patch versions are guaranteed to not introduce breaking changes.
  "django~=5.2.13",
-  "django-allauth[mfa,socialaccount]~=65.16.0",
+  "django-allauth[mfa,socialaccount]~=65.20.0",
  "django-auditlog~=3.4.1",
  "django-cachalot~=2.9.0",
  "django-compression-middleware~=0.5.0",
@@ -43,7 +43,7 @@ dependencies = [
  "drf-spectacular~=0.30",
  "drf-spectacular-sidecar>=2026.7.1,<2026.10",
  "drf-writable-nested~=0.7.1",
-  "filelock>=3.32,<4.1",
+  "filelock>=3.32,<4.3",
  "flower>=2.0.1,<2.3",
  "gotenberg-client[httpx]~=1.0",
  "httpx-oauth~=0.17",
@@ -256,8 +256,8 @@ isort.force-single-line = true
 [tool.codespell]
 ignore-words-list = "criterias,afterall,valeu,ureue,equest,ure,assertIn,Oktober,commitish,NIN,nin,reprot"
 skip = """\
-  src-ui/src/locale/*,src-ui/pnpm-lock.yaml,src-ui/e2e/*,src/paperless_mail/tests/samples/*,src/paperless/tests/samples\
-  /mail/*,src/documents/tests/samples/*,*.po,*.json\
+  src-ui/src/locale/*,src-ui/pnpm-lock.yaml,src-ui/e2e/*,src/paperless/tests/samples/mail/*,src/documents/tests/samples\
+  /*,src/paperless_testing/sample_files/*,*.po,*.json\
  """
 write-changes = true

@@ -43,6 +43,7 @@ def configure_environment(instance_root: Path) -> None:


 def seed_database() -> None:
+    from django.contrib.auth.models import Permission
    from django.contrib.auth.models import User
    from django.core.management import call_command
    from django.utils import timezone
@@ -63,11 +64,18 @@ def seed_database() -> None:
        username="playwright",
        password="playwright",  # NOSONAR
    )
-    User.objects.create_user(
+    viewer = User.objects.create_user(
        username="viewer",
        password="viewer",  # NOSONAR
    )

+    viewer.user_permissions.add(
+        Permission.objects.get(
+            content_type__app_label="documents",
+            codename="view_uisettings",
+        ),
+    )
+
    inbox = Tag.objects.create(name="Inbox", is_inbox_tag=True, owner=admin)
    quick_filter = Tag.objects.create(name="Another Sample Tag", owner=admin)
    Tag.objects.create(name="TagWithPartial", owner=admin)
@@ -134,7 +142,9 @@ def seed_database() -> None:
    originals.mkdir(parents=True)
    thumbnails = Path(os.environ["PAPERLESS_MEDIA_ROOT"]) / "documents" / "thumbnails"
    thumbnails.mkdir(parents=True)
-    sample_pdf = SOURCE_ROOT / "documents" / "tests" / "samples" / "simple.pdf"
+    sample_pdf = (
+        SOURCE_ROOT / "paperless_testing" / "sample_files" / "simple-digital.pdf"
+    )
    for document in documents:
        shutil.copyfile(sample_pdf, originals / document.filename)
        shutil.copyfile(
@@ -80,12 +80,21 @@ test('should show a list of notes', async ({ page }) => {

 test('should support quick filters', async ({ page }) => {
  await page.goto('/documents/1/details')
+  // filter button is available before tags have loaded
+  const selectedTags = page.locator('pngx-input-tags .ng-value pngx-tag')
+  await expect(selectedTags).toHaveCount(2)
+  await expect(
+    selectedTags.getByText('Another Sample Tag', { exact: true })
+  ).toBeVisible()
+  await expect(selectedTags.getByText('Inbox', { exact: true })).toBeVisible()
  await page
    .getByRole('button', { name: 'Filter documents with these Tags' })
    .click()
-  await expect(page).toHaveURL(
-    /tags__id__all=2,1&sort=created&reverse=1&page=1/
-  )
+  await expect(page).toHaveURL((url) => {
+    const tags = url.searchParams.get('tags__id__all')?.split(',').sort()
+    return url.pathname === '/documents' && tags?.join(',') === '1,2'
+  })
+  await expect(page.locator('pngx-document-list')).toHaveText(/one document/i)
 })

 test('should finish reloading the preview after a remote document update', async ({
@@ -6,8 +6,15 @@ test.use({
  },
 })

-test('should not allow user to edit settings', async ({ page }) => {
+test.beforeEach(async ({ page }) => {
+  const settingsLoaded = page.waitForResponse((response) =>
+    response.url().endsWith('/api/ui_settings/')
+  )
  await page.goto('/dashboard')
+  expect((await settingsLoaded).status()).toBe(200)
+})
+
+test('should not allow user to edit settings', async ({ page }) => {
  await expect(page.getByRole('link', { name: 'Settings' })).not.toBeAttached()
  await page.goto('/settings')
  await expect(page.locator('body')).toHaveText(
@@ -16,7 +23,6 @@ test('should not allow user to edit settings', async ({ page }) => {
 })

 test('should not allow user to view documents', async ({ page }) => {
-  await page.goto('/dashboard')
  await expect(
    page.locator('nav').getByRole('link', { name: 'Documents' })
  ).not.toBeAttached()
@@ -31,7 +37,6 @@ test('should not allow user to view documents', async ({ page }) => {
 })

 test('should not allow user to view correspondents', async ({ page }) => {
-  await page.goto('/dashboard')
  await expect(
    page.getByRole('link', { name: 'Attributes' })
  ).not.toBeAttached()
@@ -42,7 +47,6 @@ test('should not allow user to view correspondents', async ({ page }) => {
 })

 test('should not allow user to view tags', async ({ page }) => {
-  await page.goto('/dashboard')
  await expect(
    page.getByRole('link', { name: 'Attributes' })
  ).not.toBeAttached()
@@ -53,7 +57,6 @@ test('should not allow user to view tags', async ({ page }) => {
 })

 test('should not allow user to view document types', async ({ page }) => {
-  await page.goto('/dashboard')
  await expect(
    page.getByRole('link', { name: 'Attributes' })
  ).not.toBeAttached()
@@ -64,7 +67,6 @@ test('should not allow user to view document types', async ({ page }) => {
 })

 test('should not allow user to view storage paths', async ({ page }) => {
-  await page.goto('/dashboard')
  await expect(
    page.getByRole('link', { name: 'Attributes' })
  ).not.toBeAttached()
@@ -75,7 +77,6 @@ test('should not allow user to view storage paths', async ({ page }) => {
 })

 test('should not allow user to view logs', async ({ page }) => {
-  await page.goto('/dashboard')
  await expect(page.getByRole('link', { name: 'Logs' })).not.toBeAttached()
  await page.goto('/logs')
  await expect(page.locator('body')).toHaveText(
@@ -84,7 +85,6 @@ test('should not allow user to view logs', async ({ page }) => {
 })

 test('should not allow user to view tasks', async ({ page }) => {
-  await page.goto('/dashboard')
  await expect(page.getByRole('link', { name: 'Tasks' })).not.toBeAttached()
  await page.goto('/tasks')
  await expect(page.locator('body')).toHaveText(
@@ -2048,7 +2048,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">167,168</context>
+          <context context-type="linenumber">201,202</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/filterable-dropdown/filterable-dropdown.component.html</context>
@@ -4414,11 +4414,68 @@
          <context context-type="linenumber">96</context>
        </context-group>
      </trans-unit>
+      <trans-unit id="3625677668275605418" datatype="html">
+        <source>Date mode</source>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
+          <context context-type="linenumber">38</context>
+        </context-group>
+      </trans-unit>
+      <trans-unit id="7572800523712857519" datatype="html">
+        <source>Fixed date</source>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
+          <context context-type="linenumber">39</context>
+        </context-group>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
+          <context context-type="linenumber">40</context>
+        </context-group>
+      </trans-unit>
+      <trans-unit id="4108478337308251505" datatype="html">
+        <source>Fixed</source>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
+          <context context-type="linenumber">41,42</context>
+        </context-group>
+      </trans-unit>
+      <trans-unit id="8283919074858117329" datatype="html">
+        <source>Relative date</source>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
+          <context context-type="linenumber">43</context>
+        </context-group>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
+          <context context-type="linenumber">44</context>
+        </context-group>
+      </trans-unit>
+      <trans-unit id="2731996625798485199" datatype="html">
+        <source>Relative</source>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
+          <context context-type="linenumber">45,46</context>
+        </context-group>
+      </trans-unit>
+      <trans-unit id="6533918067030990396" datatype="html">
+        <source>Amount</source>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
+          <context context-type="linenumber">51</context>
+        </context-group>
+      </trans-unit>
+      <trans-unit id="8932917860978648376" datatype="html">
+        <source>Unit</source>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
+          <context context-type="linenumber">56,57</context>
+        </context-group>
+      </trans-unit>
      <trans-unit id="9138811584797805840" datatype="html">
        <source>Open date picker</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">42</context>
+          <context context-type="linenumber">72</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/input/date/date.component.html</context>
@@ -4429,7 +4486,11 @@
        <source>Today</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">47,48</context>
+          <context context-type="linenumber">77,78</context>
+        </context-group>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts</context>
+          <context context-type="linenumber">329</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/dates-dropdown/dates-dropdown.component.html</context>
@@ -4460,7 +4521,7 @@
        <source>Close</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">48,49</context>
+          <context context-type="linenumber">78,79</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/dates-dropdown/dates-dropdown.component.html</context>
@@ -4499,55 +4560,62 @@
        <source>True</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">55,56</context>
+          <context context-type="linenumber">88,89</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">107,108</context>
+          <context context-type="linenumber">141,142</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">113,114</context>
+          <context context-type="linenumber">147,148</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3800326155195149498" datatype="html">
        <source>False</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">56,57</context>
+          <context context-type="linenumber">89,90</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">108,109</context>
+          <context context-type="linenumber">142,143</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">114,115</context>
+          <context context-type="linenumber">148,149</context>
        </context-group>
      </trans-unit>
      <trans-unit id="7551700625201096185" datatype="html">
        <source>Search docs...</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">73</context>
+          <context context-type="linenumber">106</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">130</context>
+          <context context-type="linenumber">164</context>
+        </context-group>
+      </trans-unit>
+      <trans-unit id="1179184907489210406" datatype="html">
+        <source>Operator</source>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
+          <context context-type="linenumber">119,120</context>
        </context-group>
      </trans-unit>
      <trans-unit id="2328549728463836983" datatype="html">
        <source>Remove query</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">154</context>
+          <context context-type="linenumber">189</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3184700926171002527" datatype="html">
        <source>Any</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">165,166</context>
+          <context context-type="linenumber">199,200</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/filterable-dropdown/filterable-dropdown.component.html</context>
@@ -4558,28 +4626,84 @@
        <source>Not</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">170,171</context>
+          <context context-type="linenumber">204,205</context>
        </context-group>
      </trans-unit>
      <trans-unit id="6548676277933116532" datatype="html">
        <source>Add query</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">189</context>
+          <context context-type="linenumber">223</context>
        </context-group>
      </trans-unit>
      <trans-unit id="5599577087865387184" datatype="html">
        <source>Add expression</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">192</context>
+          <context context-type="linenumber">226</context>
        </context-group>
      </trans-unit>
      <trans-unit id="7394978038852129121" datatype="html">
        <source>Remove expression</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">196</context>
+          <context context-type="linenumber">230</context>
+        </context-group>
+      </trans-unit>
+      <trans-unit id="5620397708418210833" datatype="html">
+        <source>days ago</source>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts</context>
+          <context context-type="linenumber">330</context>
+        </context-group>
+      </trans-unit>
+      <trans-unit id="2871318661796659216" datatype="html">
+        <source>weeks ago</source>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts</context>
+          <context context-type="linenumber">331</context>
+        </context-group>
+      </trans-unit>
+      <trans-unit id="6041340836190906216" datatype="html">
+        <source>months ago</source>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts</context>
+          <context context-type="linenumber">332</context>
+        </context-group>
+      </trans-unit>
+      <trans-unit id="963494111451627204" datatype="html">
+        <source>years ago</source>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts</context>
+          <context context-type="linenumber">333</context>
+        </context-group>
+      </trans-unit>
+      <trans-unit id="5555905617885007774" datatype="html">
+        <source>days from now</source>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts</context>
+          <context context-type="linenumber">334</context>
+        </context-group>
+      </trans-unit>
+      <trans-unit id="4298377021616940216" datatype="html">
+        <source>weeks from now</source>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts</context>
+          <context context-type="linenumber">335</context>
+        </context-group>
+      </trans-unit>
+      <trans-unit id="2772874767134148305" datatype="html">
+        <source>months from now</source>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts</context>
+          <context context-type="linenumber">336</context>
+        </context-group>
+      </trans-unit>
+      <trans-unit id="6363533917780225967" datatype="html">
+        <source>years from now</source>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts</context>
+          <context context-type="linenumber">337</context>
        </context-group>
      </trans-unit>
      <trans-unit id="6630533861307510614" datatype="html">
@@ -10210,18 +10334,18 @@
          <context context-type="linenumber">294,295</context>
        </context-group>
      </trans-unit>
-      <trans-unit id="2179847500064178686" datatype="html">
-        <source>Edit document</source>
+      <trans-unit id="3420321797707163677" datatype="html">
+        <source>Preview document</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
          <context context-type="linenumber">328</context>
        </context-group>
      </trans-unit>
-      <trans-unit id="3420321797707163677" datatype="html">
-        <source>Preview document</source>
+      <trans-unit id="2179847500064178686" datatype="html">
+        <source>Edit document</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">329</context>
+          <context context-type="linenumber">331</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4512084577073831437" datatype="html">
@@ -1,6 +1,6 @@
 {
  "name": "paperless-ngx-ui",
-  "version": "3.3.4",
+  "version": "3.4.1",
  "scripts": {
    "preinstall": "npx only-allow pnpm",
    "ng": "ng",
@@ -4,6 +4,10 @@ settings:
  autoInstallPeers: false
  excludeLinksFromLockfile: false

+overrides:
+  vite@>=8.3.0 <8.3.3: ^8.3.3
+  zod@<4.6.6: ^4.6.6
+
 importers:

  .:
@@ -1650,6 +1654,9 @@ packages:
  '@oxc-project/types@0.150.0':
    resolution: {integrity: sha512-rDS5/31E9HfPl/CIzGrn0DOlvBbXFseQ5URJ9sYMfstbKLD/c6Gm9vmRzRGDdAXyOIL4zmO37lc9RIwYqVruZw==}

+  '@oxc-project/types@0.155.0':
+    resolution: {integrity: sha512-SeE8JPwW1xs1tHeNycjUtUBdhorRa8o4jlvjwk49R7/Z291i+4DQa7JJIgOm/TaYQZx+QrPQbVJ/9c8dMIZN8Q==}
+
  '@parcel/watcher-android-arm64@2.6.0':
    resolution: {integrity: sha512-trgpLSCKRC/huFjXX/Smh+0sWe4+YtKfktIToiMl59ghz7z+qkH6kMvNnUbLyRs9N11t8l4svSCs1+5B3rOAhA==}
    engines: {node: '>= 10.0.0'}
@@ -1748,42 +1755,85 @@ packages:
  '@popperjs/core@2.11.8':
    resolution: {integrity: sha512-P1st0aksCrn9sGZhp8GMYwBnQsbvAWsZAX44oXNNvLHGqAOcoVxmjZiohstwQ7SqKnbR47akdNi+uleWD8+g6A==}

+  '@rolldown/binding-android-arm-eabi@1.2.15':
+    resolution: {integrity: sha512-aLcgK9gIJ3YRvrrtfSBbRa27F5WrpiTaPulnFpsHPxpUHgFlSgnU4854MHwoRGEBhfRJDWCS2WQ7lIjskE9Olw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm]
+    os: [android]
+
  '@rolldown/binding-android-arm-eabi@1.2.8':
    resolution: {integrity: sha512-tN5aztYkKCte4i5SIrrz5yK/HMjEuCqCSCJa418jOV8tZ1cBY3YF2otxB1ktPxzsLA1BeTqwapK0bfjxNvHJVw==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [arm]
    os: [android]

+  '@rolldown/binding-android-arm64@1.2.15':
+    resolution: {integrity: sha512-xD7DdZCrbThKuxNg7ooQmvp07ys4J/pnSEMTG3/OdOWl6daC67m/Q4fL78sRHMxTH/N4fGUbYhcPM0MF5WFHkg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [android]
+
  '@rolldown/binding-android-arm64@1.2.8':
    resolution: {integrity: sha512-dIYTWl9XprMUiQFoc55KUyk/oS8SKYH3zFl0LTR7RT0Xj4hgSVyuJcroH8JUu8RcpF8fTB6E0aOwCkZoYPcDSQ==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [arm64]
    os: [android]

+  '@rolldown/binding-darwin-arm64@1.2.15':
+    resolution: {integrity: sha512-m2WuQ6r0B4OTYxyPpNLtXaMRbRDUbG8YQV2Q3KTdSSK8Th6KHCnC8jVCJt8bvYeSB5WivkkNbc85mKadaSdOxA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [darwin]
+
  '@rolldown/binding-darwin-arm64@1.2.8':
    resolution: {integrity: sha512-PCSDQGXD2IyTEFrcgPyBM8jJuGmrbCMuoIOXdbEGVemruKACXoLQJrb+A45Z0L5t1RQkdfJprAYPkikbh7dzdA==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [arm64]
    os: [darwin]

+  '@rolldown/binding-darwin-x64@1.2.15':
+    resolution: {integrity: sha512-5RtnsHM36nodM9WbMy+zip0LGS/G+y5wro5RHrpOlr4ac24+1zSi9kiV2MP1myZeZ/ifEHfulQcWjnAXzc2C2A==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [darwin]
+
  '@rolldown/binding-darwin-x64@1.2.8':
    resolution: {integrity: sha512-Uk7lRsGhPFHVX/sAUC6D5H9Ol30dFHd6iquokll2th3LpdJ3F5CzQB+7DHn0Ri2mG+U7k2zXiPHDrwZenXhwSA==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [x64]
    os: [darwin]

+  '@rolldown/binding-freebsd-x64@1.2.15':
+    resolution: {integrity: sha512-g3l09pyFqhu+135JKkbkwiKGQmwU5hUMUPJ4VdBADvuqR8d33L6H578rh8m7rtxbdp+VmX/+nzI7nvhSZlzpUQ==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [freebsd]
+
  '@rolldown/binding-freebsd-x64@1.2.8':
    resolution: {integrity: sha512-DjszaTEVogPqA5bYzsEeqDCQxbcp2fexQwKcRspYji2yzR68fCf+e4fx6kBSRDwX5/brZaHw/hWS9+A/+/w9sQ==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [x64]
    os: [freebsd]

+  '@rolldown/binding-linux-arm-gnueabihf@1.2.15':
+    resolution: {integrity: sha512-nIe3VugI97nGQtspPxDqA4sXMUpeiocKIP/CqpY/u/vgbT+alX+cVxu1C/oVBPKg4feNTmYovE91v4DgXvXNwQ==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm]
+    os: [linux]
+
  '@rolldown/binding-linux-arm-gnueabihf@1.2.8':
    resolution: {integrity: sha512-zmwa7FTmdzB6aaEEuuls18H6Ap5JmJPSoPTuXixeJZV6tG40SyLkApQtz1g8ptZtiEKqj9OM0oNLPh1AgvE31Q==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [arm]
    os: [linux]

+  '@rolldown/binding-linux-arm64-gnu@1.2.15':
+    resolution: {integrity: sha512-iTBjXx+B5QSvgI89lJfmqh4wTh8NabR1YZIIN3hNx4zSG0EVfVqkOvLulNpG4251pbd6/IAmZ/LefVk1Y4rPhw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
  '@rolldown/binding-linux-arm64-gnu@1.2.8':
    resolution: {integrity: sha512-KdYQDPHwJVnbFwdTGMgxsI9SqblBlz6STGM+w1We/d5B8OWWidYH0MwkU/uA1wM5fIpO2MkOVxXrNzzuZhw9ew==}
    engines: {node: ^20.19.0 || >=22.12.0}
@@ -1791,6 +1841,13 @@ packages:
    os: [linux]
    libc: [glibc]

+  '@rolldown/binding-linux-arm64-musl@1.2.15':
+    resolution: {integrity: sha512-uN26XOnVR7rqQupG3V9oAG2EGGatWjcJHOeDOHUFCh4TBWmP2tHTFoVN13aYbwfm0aHqJAEmcwhAu6sooIjfqQ==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
  '@rolldown/binding-linux-arm64-musl@1.2.8':
    resolution: {integrity: sha512-jFJTifHnNPY+yzOoNZQfSIysrVyXzEQPhPnOUjmD1bcQGHH6s7c8cViKWar8YplQImE5N9JRqMCLrM2CdxOrZA==}
    engines: {node: ^20.19.0 || >=22.12.0}
@@ -1798,6 +1855,13 @@ packages:
    os: [linux]
    libc: [musl]

+  '@rolldown/binding-linux-ppc64-gnu@1.2.15':
+    resolution: {integrity: sha512-9nWkcdd+H+XhaA3fQIwpHnKIrfx/PQ6rO0pivr78Og07tXlUlctBBJoEYLPfhTmCR/QxEVdn6uPjHV5SymPhdw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
  '@rolldown/binding-linux-ppc64-gnu@1.2.8':
    resolution: {integrity: sha512-FhiOziBDWPBjbcmRzfLyIJnaP7AVMFXT7YCXPjXxj7wKU3vx24RjrCNN/zjvVa+N2vVoHJwCoUBvsrN/DG3zIA==}
    engines: {node: ^20.19.0 || >=22.12.0}
@@ -1805,6 +1869,13 @@ packages:
    os: [linux]
    libc: [glibc]

+  '@rolldown/binding-linux-s390x-gnu@1.2.15':
+    resolution: {integrity: sha512-Ggh0ciFjLwIusLSLz7LZYEaGdxOAUJXI+Qu5JCbhPJJHEt8vP+IjRATTJheiJsdzzTYgUiHUiw3X1Ea3ZpMBdA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
  '@rolldown/binding-linux-s390x-gnu@1.2.8':
    resolution: {integrity: sha512-WnHfADMzOV2Y55wlx1hzzQnar/wDt/VdvWSD99r18Mz9ylNieIGOkRx3UV21h7m/eJvjySYJkO26VvGNFkwsIQ==}
    engines: {node: ^20.19.0 || >=22.12.0}
@@ -1812,6 +1883,13 @@ packages:
    os: [linux]
    libc: [glibc]

+  '@rolldown/binding-linux-x64-gnu@1.2.15':
+    resolution: {integrity: sha512-FHg60rS6DBePAYZ9X9F67x+JObFdmgn6tupA1C/a3B+CufFmTD4mX+e8M75tCiAO3foR/6xwVBI0KQiI7sn/rw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
  '@rolldown/binding-linux-x64-gnu@1.2.8':
    resolution: {integrity: sha512-H9tRr5ibfXFVLxbPOseVewewFpl28zcEdjRDt2FTUZU7odxP0gEv1ki4/kGmcGOh78oRwZuuQllGLZ9zTJp84g==}
    engines: {node: ^20.19.0 || >=22.12.0}
@@ -1819,6 +1897,13 @@ packages:
    os: [linux]
    libc: [glibc]

+  '@rolldown/binding-linux-x64-musl@1.2.15':
+    resolution: {integrity: sha512-/cvV/7v5VGz/moiz0XKRj2dE8DzsKyhIu1KpOvJGPjRywg3yscON889UGvAe8zfiJLHup7VLjBduoGWi3HusWQ==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
  '@rolldown/binding-linux-x64-musl@1.2.8':
    resolution: {integrity: sha512-UefiqfM3D6IVNlZ8tSGs9+Ejjud2T+oxO0IHADU45Y+lyEjD2dVFyZHbkfX0LUb5Zugo/oIv1eCO/KVYhgYJYA==}
    engines: {node: ^20.19.0 || >=22.12.0}
@@ -1826,18 +1911,36 @@ packages:
    os: [linux]
    libc: [musl]

+  '@rolldown/binding-openharmony-arm64@1.2.15':
+    resolution: {integrity: sha512-MyzC5Hrv/sm+Z7TSGKP/j8001RO2xQm1zOpCNVL4j0cY/VhBZviludA2YFQ7i4lH6ZAXxQm0lcMdBzM+99mE7w==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [openharmony]
+
  '@rolldown/binding-openharmony-arm64@1.2.8':
    resolution: {integrity: sha512-637Ke4kWSy6rp9cxQ9gMOXlxPgIw/c1beASV4M//3+9I4uwBVOOl74G+e3zyU3u19U7RkRl/HuewixZ/Z6+Rjg==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [arm64]
    os: [openharmony]

+  '@rolldown/binding-win32-arm64-msvc@1.2.15':
+    resolution: {integrity: sha512-+PgYiS+AH5omy6L45ZLxybasauJaj3M8buoT83D+nzPmCayXlxUV9hydhciCKVyIg0B/v0BtXPDE1uGqNwCPpg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [win32]
+
  '@rolldown/binding-win32-arm64-msvc@1.2.8':
    resolution: {integrity: sha512-xWBkPOF1Q9k/Gv1nQXnVdLxKu74jXppuOM4Z3mnypVUJJJwLsMl7hNJGRAUJoG8A5MgOI1ACKM+wBFxSJzKy4A==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [arm64]
    os: [win32]

+  '@rolldown/binding-win32-x64-msvc@1.2.15':
+    resolution: {integrity: sha512-HFZd2QNQYn1JbIi+Hpd7H+r/lkWxcfIu28nirZ6eCn2LafuvmExMlb/P96Sfx5tf7pPArw39IdhmCF8vmV+NhQ==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [win32]
+
  '@rolldown/binding-win32-x64-msvc@1.2.8':
    resolution: {integrity: sha512-uz2ZvfgXbxqNwijjjbxrnvALwpyODDcgc1T1N8N3rf/DXKQmaFwmB4LX4yyjggpwN2obdQLb2rgirX5ffCWYng==}
    engines: {node: ^20.19.0 || >=22.12.0}
@@ -2132,7 +2235,7 @@ packages:
    resolution: {integrity: sha512-bdyo8rB3NnQbikdMpHaML9Z1OZPBu6fFOBo+OtxsBlvMJtysWskmBcnbIDhUqgC8tcxNv/a+BcV5U+2nQMm1OQ==}
    engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
    peerDependencies:
-      vite: ^6.0.0 || ^7.0.0 || ^8.0.0
+      vite: ^8.3.3

  acorn-jsx@5.3.2:
    resolution: {integrity: sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==}
@@ -2261,8 +2364,8 @@ packages:
    peerDependencies:
      '@popperjs/core': ^2.11.8

-  brace-expansion@2.1.4:
-    resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==}
+  brace-expansion@2.1.7:
+    resolution: {integrity: sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==}

  brace-expansion@5.0.12:
    resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==}
@@ -2597,8 +2700,8 @@ packages:
  fast-string-width@3.0.2:
    resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==}

-  fast-uri@3.1.8:
-    resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==}
+  fast-uri@3.1.9:
+    resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==}

  fast-wrap-ansi@0.2.2:
    resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==}
@@ -3029,8 +3132,8 @@ packages:
  js-tokens@4.0.0:
    resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}

-  js-yaml@3.15.1:
-    resolution: {integrity: sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==}
+  js-yaml@3.15.2:
+    resolution: {integrity: sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==}
    hasBin: true

  jsdom@26.1.0:
@@ -3280,6 +3383,11 @@ packages:
    engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
    hasBin: true

+  nanoid@3.3.20:
+    resolution: {integrity: sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ==}
+    engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
+    hasBin: true
+
  napi-postinstall@0.3.4:
    resolution: {integrity: sha512-PHI5f1O0EP5xJ9gQmFGMS6IZcrVvTjpXjz7Na41gTE7eE2hK11lg04CECCYEEjdc17EV4DO+fkGEtt7TpTaTiQ==}
    engines: {node: ^12.20.0 || ^14.18.0 || >=16.0.0}
@@ -3510,6 +3618,10 @@ packages:
    resolution: {integrity: sha512-RRuzqDtt5Y9h3quz5hWhK+TPnsmVs6WwSU6LkJMeY4HstUEDuYTG8UJSdawMRzmzAtV+KEoG8N3Qg2qLy5vM/A==}
    engines: {node: ^10 || ^12 || >=14}

+  postcss@8.5.31:
+    resolution: {integrity: sha512-YUbWYCgErwnMAVkjUnYa+KlMBzGpHwiIt/DE7f0G33AuX2LH9UcTk6KgWxd3zRU+pN3u/C+Xl3EnMLM4Hea7Sg==}
+    engines: {node: ^10 || ^12 || >=14}
+
  prelude-ls@1.2.1:
    resolution: {integrity: sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==}
    engines: {node: '>= 0.8.0'}
@@ -3601,6 +3713,11 @@ packages:
    resolution: {integrity: sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA==}
    engines: {node: '>=18'}

+  rolldown@1.2.15:
+    resolution: {integrity: sha512-6odND+fel5zVw3I4Yc2e69gvguDnX0CAAGiNDZSq4ik5WUcaLrkD2GLuog0XcODbor31hZ5ayEMgVDno+KPV5g==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    hasBin: true
+
  rolldown@1.2.8:
    resolution: {integrity: sha512-Z67nTmhZe7anqnM/EjI392w5i/ANUinjip7QYsOyN37oayduxt3ksdX0hf5OOamkAd53BiIHfbfSzfUmzKFQqQ==}
    engines: {node: ^20.19.0 || >=22.12.0}
@@ -3773,8 +3890,8 @@ packages:
    resolution: {integrity: sha512-aBY19bn/XA+hKOKX0qL7Z0UfdBsbQvc9hn993U8ALUjzxCvDcuZqLoRXjGJrUARWAlwMnsRVD9sw2AFNOYvalA==}
    engines: {node: '>=22'}

-  source-map-js@1.2.1:
-    resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
+  source-map-js@1.2.2:
+    resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==}
    engines: {node: '>=0.10.0'}

  source-map-support@0.5.21:
@@ -4005,13 +4122,13 @@ packages:
    resolution: {integrity: sha512-zj/ob3UsvJGN0whEAKFp53REA5X66hvffVqoCtVQAakJKnKlH+/PcOfMoFwIG/o4rElqLv/ycAFlx8ZlXUorCg==}
    engines: {node: '>=18.12.0'}

-  vite@8.3.0:
-    resolution: {integrity: sha512-lhZBVvEHefgE+HQZC9O7EBJgCU/nVzFNl7vkS4RE0APtWLP02/8QVIkQtzBxPquh7lq5/78NHipTj7ODQ6XuyQ==}
+  vite@8.3.5:
+    resolution: {integrity: sha512-z1YpjieJ9g0ebTmQpLBv/oq9E3F9EIlOe+7LahW8SrE3LTiG3udBRUXQOlYXP9b+IC2q2phHeVxj9xGlw34OEQ==}
    engines: {node: ^20.19.0 || >=22.12.0}
    hasBin: true
    peerDependencies:
      '@types/node': ^20.19.0 || >=22.12.0
-      '@vitejs/devtools': ^0.7.1
+      '@vitejs/devtools': ^0.7.1 || ^0.8.0
      esbuild: ^0.27.0 || ^0.28.0
      jiti: '>=1.21.0'
      less: ^4.0.0
@@ -4168,8 +4285,8 @@ packages:
    resolution: {integrity: sha512-xYqdZFUK/VYazNl/oCDYN+3WloWQwMfZxBoiNt6qNyk+xfOdi598muWE42rNZFp1kNOiqW936q5RhUdnpqElSg==}
    engines: {node: '>=18'}

-  zod@4.6.5:
-    resolution: {integrity: sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==}
+  zod@4.6.7:
+    resolution: {integrity: sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==}

 snapshots:

@@ -4369,7 +4486,7 @@ snapshots:
      '@babel/core': 8.0.5
      '@inquirer/confirm': 6.3.2(@types/node@26.6.2)
      '@parcel/watcher': 2.6.0
-      '@vitejs/plugin-basic-ssl': 2.3.0(vite@8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(sass-embedded@1.104.1)(sass@1.104.1))
+      '@vitejs/plugin-basic-ssl': 2.3.0(vite@8.3.5(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(sass-embedded@1.104.1)(sass@1.104.1))
      beasties: 0.5.4
      browserslist: 4.29.1
      chokidar: 5.0.0
@@ -4391,7 +4508,7 @@ snapshots:
      tinyglobby: 0.2.17
      tslib: 2.8.1
      typescript: 6.0.3
-      vite: 8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(sass-embedded@1.104.1)(sass@1.104.1)
+      vite: 8.3.5(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(sass-embedded@1.104.1)(sass@1.104.1)
      xxhash-wasm: 1.1.0
    optionalDependencies:
      '@angular/core': 22.2.2(@angular/compiler@22.2.2)(rxjs@7.8.2)
@@ -4437,7 +4554,7 @@ snapshots:
      parse5-html-rewriting-stream: 8.0.1
      semver: 7.8.5
      yargs: 18.1.0
-      zod: 4.6.5
+      zod: 4.6.7
    transitivePeerDependencies:
      - '@types/node'
      - chokidar
@@ -4481,7 +4598,7 @@ snapshots:
      '@standard-schema/spec': 1.1.0
      rxjs: 7.8.2
      tslib: 2.8.1
-      zod: 4.6.5
+      zod: 4.6.7

  '@angular/localize@22.2.2(@angular/compiler-cli@22.2.2(@angular/compiler@22.2.2)(typescript@6.0.3))(@angular/compiler@22.2.2)':
    dependencies:
@@ -5118,7 +5235,7 @@ snapshots:
      camelcase: 5.3.1
      find-up: 4.1.0
      get-package-type: 0.1.0
-      js-yaml: 3.15.1
+      js-yaml: 3.15.2
      resolve-from: 5.0.0

  '@istanbuljs/schema@0.1.6': {}
@@ -5412,12 +5529,12 @@ snapshots:

  '@modelcontextprotocol/core@2.3.1':
    dependencies:
-      zod: 4.6.5
+      zod: 4.6.7

  '@modelcontextprotocol/server@2.3.1':
    dependencies:
      '@modelcontextprotocol/core': 2.3.1
-      zod: 4.6.5
+      zod: 4.6.7

  '@msgpackr-extract/msgpackr-extract-darwin-arm64@3.0.4':
    optional: true
@@ -5652,6 +5769,8 @@ snapshots:

  '@oxc-project/types@0.150.0': {}

+  '@oxc-project/types@0.155.0': {}
+
  '@parcel/watcher-android-arm64@2.6.0':
    optional: true

@@ -5719,48 +5838,93 @@ snapshots:

  '@popperjs/core@2.11.8': {}

+  '@rolldown/binding-android-arm-eabi@1.2.15':
+    optional: true
+
  '@rolldown/binding-android-arm-eabi@1.2.8':
    optional: true

+  '@rolldown/binding-android-arm64@1.2.15':
+    optional: true
+
  '@rolldown/binding-android-arm64@1.2.8':
    optional: true

+  '@rolldown/binding-darwin-arm64@1.2.15':
+    optional: true
+
  '@rolldown/binding-darwin-arm64@1.2.8':
    optional: true

+  '@rolldown/binding-darwin-x64@1.2.15':
+    optional: true
+
  '@rolldown/binding-darwin-x64@1.2.8':
    optional: true

+  '@rolldown/binding-freebsd-x64@1.2.15':
+    optional: true
+
  '@rolldown/binding-freebsd-x64@1.2.8':
    optional: true

+  '@rolldown/binding-linux-arm-gnueabihf@1.2.15':
+    optional: true
+
  '@rolldown/binding-linux-arm-gnueabihf@1.2.8':
    optional: true

+  '@rolldown/binding-linux-arm64-gnu@1.2.15':
+    optional: true
+
  '@rolldown/binding-linux-arm64-gnu@1.2.8':
    optional: true

+  '@rolldown/binding-linux-arm64-musl@1.2.15':
+    optional: true
+
  '@rolldown/binding-linux-arm64-musl@1.2.8':
    optional: true

+  '@rolldown/binding-linux-ppc64-gnu@1.2.15':
+    optional: true
+
  '@rolldown/binding-linux-ppc64-gnu@1.2.8':
    optional: true

+  '@rolldown/binding-linux-s390x-gnu@1.2.15':
+    optional: true
+
  '@rolldown/binding-linux-s390x-gnu@1.2.8':
    optional: true

+  '@rolldown/binding-linux-x64-gnu@1.2.15':
+    optional: true
+
  '@rolldown/binding-linux-x64-gnu@1.2.8':
    optional: true

+  '@rolldown/binding-linux-x64-musl@1.2.15':
+    optional: true
+
  '@rolldown/binding-linux-x64-musl@1.2.8':
    optional: true

+  '@rolldown/binding-openharmony-arm64@1.2.15':
+    optional: true
+
  '@rolldown/binding-openharmony-arm64@1.2.8':
    optional: true

+  '@rolldown/binding-win32-arm64-msvc@1.2.15':
+    optional: true
+
  '@rolldown/binding-win32-arm64-msvc@1.2.8':
    optional: true

+  '@rolldown/binding-win32-x64-msvc@1.2.15':
+    optional: true
+
  '@rolldown/binding-win32-x64-msvc@1.2.8':
    optional: true

@@ -6051,9 +6215,9 @@ snapshots:
  '@unrs/resolver-binding-win32-x64-msvc@1.12.2':
    optional: true

-  '@vitejs/plugin-basic-ssl@2.3.0(vite@8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(sass-embedded@1.104.1)(sass@1.104.1))':
+  '@vitejs/plugin-basic-ssl@2.3.0(vite@8.3.5(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(sass-embedded@1.104.1)(sass@1.104.1))':
    dependencies:
-      vite: 8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(sass-embedded@1.104.1)(sass@1.104.1)
+      vite: 8.3.5(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(sass-embedded@1.104.1)(sass@1.104.1)

  acorn-jsx@5.3.2(acorn@8.18.0):
    dependencies:
@@ -6083,7 +6247,7 @@ snapshots:
  ajv@8.20.0:
    dependencies:
      fast-deep-equal: 3.1.3
-      fast-uri: 3.1.8
+      fast-uri: 3.1.9
      json-schema-traverse: 1.0.0
      require-from-string: 2.0.2

@@ -6198,7 +6362,7 @@ snapshots:
    dependencies:
      '@popperjs/core': 2.11.8

-  brace-expansion@2.1.4:
+  brace-expansion@2.1.7:
    dependencies:
      balanced-match: 1.0.2

@@ -6543,7 +6707,7 @@ snapshots:
    dependencies:
      fast-string-truncated-width: 3.0.3

-  fast-uri@3.1.8: {}
+  fast-uri@3.1.9: {}

  fast-wrap-ansi@0.2.2:
    dependencies:
@@ -7193,7 +7357,7 @@ snapshots:

  js-tokens@4.0.0: {}

-  js-yaml@3.15.1:
+  js-yaml@3.15.2:
    dependencies:
      argparse: 1.0.10
      esprima: 4.0.1
@@ -7393,7 +7557,7 @@ snapshots:

  minimatch@9.0.9:
    dependencies:
-      brace-expansion: 2.1.4
+      brace-expansion: 2.1.7

  minimist@1.2.8: {}

@@ -7428,6 +7592,8 @@ snapshots:

  nanoid@3.3.18: {}

+  nanoid@3.3.20: {}
+
  napi-postinstall@0.3.4: {}

  natural-compare@1.4.0: {}
@@ -7674,7 +7840,13 @@ snapshots:
    dependencies:
      nanoid: 3.3.18
      picocolors: 1.1.1
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
+
+  postcss@8.5.31:
+    dependencies:
+      nanoid: 3.3.20
+      picocolors: 1.1.1
+      source-map-js: 1.2.2

  prelude-ls@1.2.1: {}

@@ -7742,6 +7914,27 @@ snapshots:
      onetime: 7.0.0
      signal-exit: 4.1.0

+  rolldown@1.2.15:
+    dependencies:
+      '@oxc-project/types': 0.155.0
+      '@rolldown/pluginutils': 1.0.1
+    optionalDependencies:
+      '@rolldown/binding-android-arm-eabi': 1.2.15
+      '@rolldown/binding-android-arm64': 1.2.15
+      '@rolldown/binding-darwin-arm64': 1.2.15
+      '@rolldown/binding-darwin-x64': 1.2.15
+      '@rolldown/binding-freebsd-x64': 1.2.15
+      '@rolldown/binding-linux-arm-gnueabihf': 1.2.15
+      '@rolldown/binding-linux-arm64-gnu': 1.2.15
+      '@rolldown/binding-linux-arm64-musl': 1.2.15
+      '@rolldown/binding-linux-ppc64-gnu': 1.2.15
+      '@rolldown/binding-linux-s390x-gnu': 1.2.15
+      '@rolldown/binding-linux-x64-gnu': 1.2.15
+      '@rolldown/binding-linux-x64-musl': 1.2.15
+      '@rolldown/binding-openharmony-arm64': 1.2.15
+      '@rolldown/binding-win32-arm64-msvc': 1.2.15
+      '@rolldown/binding-win32-x64-msvc': 1.2.15
+
  rolldown@1.2.8:
    dependencies:
      '@oxc-project/types': 0.149.0
@@ -7862,7 +8055,7 @@ snapshots:
    dependencies:
      chokidar: 5.0.0
      immutable: 5.1.9
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
    optionalDependencies:
      '@parcel/watcher': 2.6.0

@@ -7891,7 +8084,7 @@ snapshots:
      ansi-styles: 6.2.3
      is-fullwidth-code-point: 5.1.0

-  source-map-js@1.2.1: {}
+  source-map-js@1.2.2: {}

  source-map-support@0.5.21:
    dependencies:
@@ -8118,12 +8311,12 @@ snapshots:

  verkit@0.3.2: {}

-  vite@8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(sass-embedded@1.104.1)(sass@1.104.1):
+  vite@8.3.5(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(sass-embedded@1.104.1)(sass@1.104.1):
    dependencies:
      lightningcss: 1.33.0
      picomatch: 4.0.7
-      postcss: 8.5.28
-      rolldown: 1.2.8
+      postcss: 8.5.31
+      rolldown: 1.2.15
      tinyglobby: 0.2.17
    optionalDependencies:
      '@types/node': 26.6.2
@@ -8241,4 +8434,4 @@ snapshots:

  yoctocolors@2.2.0: {}

-  zod@4.6.5: {}
+  zod@4.6.7: {}
@@ -24,3 +24,6 @@ onlyBuiltDependencies:
 ignoredBuiltDependencies:
  - normalize-diacritics
  - unrs-resolver
+overrides:
+  "vite@>=8.3.0 <8.3.3": "^8.3.3"
+  "zod@<4.6.6": "^4.6.6"
@@ -19,7 +19,6 @@ import {
  PaperlessTaskTriggerSource,
  PaperlessTaskType,
 } from 'src/app/data/paperless-task'
-import { Results } from 'src/app/data/results'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { PermissionsGuard } from 'src/app/guards/permissions.guard'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
@@ -153,11 +152,6 @@ const tasks: PaperlessTask[] = [
  },
 ]

-const paginatedTasks: Results<PaperlessTask> = {
-  count: tasks.length,
-  results: tasks,
-}
-
 const sectionCountResponse = {
  all: 7,
  needs_attention: 2,
@@ -204,7 +198,7 @@ describe('TasksComponent', () => {
    }).compileComponents()

    tasksService = TestBed.inject(TasksService)
-    reloadSpy = jest.spyOn(tasksService, 'reload')
+    reloadSpy = jest.spyOn(tasksService, 'reload').mockImplementation(() => {})
    httpTestingController = TestBed.inject(HttpTestingController)
    modalService = TestBed.inject(NgbModal)
    router = TestBed.inject(Router)
@@ -214,15 +208,6 @@ describe('TasksComponent', () => {
    jest.useFakeTimers()
    fixture.detectChanges()

-    httpTestingController
-      .expectOne(
-        (req) =>
-          req.url === `${environment.apiBaseUrl}tasks/` &&
-          req.params.get('acknowledged') === 'false' &&
-          req.params.get('page_size') === '1000'
-      )
-      .flush(paginatedTasks)
-
    httpTestingController
      .expectOne(
        (req) =>
@@ -344,11 +344,11 @@
                ngbPopover="Tasks" i18n-ngbPopover [disablePopover]="!slimSidebarPopoversEnabled" placement="end"
                container="body" triggers="mouseenter:mouseleave" popoverClass="popover-slim">
                <i-bs class="me-2" name="list-task"></i-bs><span class="nav-link-label"><ng-container i18n>Tasks</ng-container></span>
-                @if (tasksService.needsAttentionTasks.length > 0 && !slimSidebarEnabled) {
-                  <span class="badge bg-danger ms-2 d-inline flex-shrink-0">{{tasksService.needsAttentionTasks.length}}</span>
+                @if (tasksService.needsAttentionTasksCount > 0 && !slimSidebarEnabled) {
+                  <span class="badge bg-danger ms-2 d-inline flex-shrink-0">{{tasksService.needsAttentionTasksCount}}</span>
                }
-                @if (tasksService.needsAttentionTasks.length > 0 && slimSidebarEnabled) {
-                  <span class="badge bg-danger position-absolute top-0 end-0 d-none d-md-block">{{tasksService.needsAttentionTasks.length}}</span>
+                @if (tasksService.needsAttentionTasksCount > 0 && slimSidebarEnabled) {
+                  <span class="badge bg-danger position-absolute top-0 end-0 d-none d-md-block">{{tasksService.needsAttentionTasksCount}}</span>
                }
              </a>
            </li>
@@ -588,8 +588,8 @@ describe('AppFrameComponent', () => {

  it('should show tasks badge for needs-attention tasks', () => {
    jest
-      .spyOn(tasksService, 'needsAttentionTasks', 'get')
-      .mockReturnValue([{} as any, {} as any])
+      .spyOn(tasksService, 'needsAttentionTasksCount', 'get')
+      .mockReturnValue(2)

    fixture.detectChanges()

@@ -1,10 +1,3 @@
 .custom-fields-dropdown {
    min-width: 300px;
-
-    // correct position on mobile
-    @media (max-width: 575.98px) {
-        &.show {
-            margin-left: -245px !important;
-        }
-    }
 }
@@ -33,21 +33,54 @@

 <ng-template #comparisonValueTemplate let-atom="atom">
  @if (getCustomFieldByID(atom.field)?.data_type === CustomFieldDataType.Date) {
-    <input class="form-control" placeholder="yyyy-mm-dd"
-      [(ngModel)]="atom.value"
-      [ngModelOptions]="{standalone: true}"
-      ngbDatepicker
-      #d="ngbDatepicker"
-      [footerTemplate]="datePickerFooterTemplate" />
-    <button class="btn btn-sm btn-outline-secondary rounded-end" (click)="d.toggle()" type="button" aria-label="Open date picker" i18n-aria-label>
-      <i-bs name="calendar-event"></i-bs>
-    </button>
-    <ng-template #datePickerFooterTemplate>
-      <div class="btn-group-xs border-top p-2 d-flex">
-        <button type="button" class="btn btn-primary" (click)="atom.value = today; d.close()" i18n>Today</button>
-        <button type="button" class="btn btn-secondary ms-auto" (click)="d.close()" i18n>Close</button>
+    @let relativeDate = getRelativeDate(atom);
+    <div class="d-flex gap-2 w-100 ms-0 mt-1">
+      <fieldset class="btn-group btn-group-sm flex-shrink-0 date-mode" aria-label="Date mode" i18n-aria-label>
+        <input type="radio" class="btn-check" [id]="atom.id + '_fixed'" [name]="atom.id + '_dateMode'" [checked]="!relativeDate" (change)="toggleRelativeDate(atom)" [disabled]="disabled" aria-label="Fixed date" i18n-aria-label>
+        <label class="btn btn-outline-secondary text-nowrap" [for]="atom.id + '_fixed'" title="Fixed date" i18n-title>
+          <i-bs name="calendar"></i-bs><span class="d-none d-md-inline ms-2" i18n>Fixed</span>
+        </label>
+        <input type="radio" class="btn-check" [id]="atom.id + '_relative'" [name]="atom.id + '_dateMode'" [checked]="!!relativeDate" (change)="toggleRelativeDate(atom)" [disabled]="disabled" aria-label="Relative date" i18n-aria-label>
+        <label class="btn btn-outline-secondary text-nowrap" [for]="atom.id + '_relative'" title="Relative date" i18n-title>
+          <i-bs name="clock-history"></i-bs><span class="d-none d-md-inline ms-2" i18n>Relative</span>
+        </label>
+      </fieldset>
+      <div class="input-group input-group-sm flex-grow-1">
+        @if (relativeDate) {
+          @if (relativeDate.unit.includes('{n}')) {
+            <input class="form-control w-25 flex-grow-0" type="number" min="0" aria-label="Amount" i18n-aria-label
+              [ngModel]="relativeDate.amount"
+              (ngModelChange)="updateRelativeDate(atom, { amount: $event })"
+              [ngModelOptions]="{standalone: true}" />
+          }
+          <label class="visually-hidden" [for]="atom.id + '_unit'" i18n>Unit</label>
+          <select class="form-select" [id]="atom.id + '_unit'"
+            [ngModel]="relativeDate.unit"
+            (ngModelChange)="updateRelativeDate(atom, { unit: $event })"
+            [ngModelOptions]="{standalone: true}">
+            @for (unit of relativeDateUnits; track unit.id) {
+              <option [ngValue]="unit.id">{{unit.label}}</option>
+            }
+          </select>
+        } @else {
+          <input class="form-control" placeholder="yyyy-mm-dd"
+            [(ngModel)]="atom.value"
+            [ngModelOptions]="{standalone: true}"
+            ngbDatepicker
+            #d="ngbDatepicker"
+            [footerTemplate]="datePickerFooterTemplate" />
+          <button class="btn btn-sm btn-outline-secondary" (click)="d.toggle()" type="button" aria-label="Open date picker" i18n-aria-label>
+            <i-bs name="calendar-event"></i-bs>
+          </button>
+          <ng-template #datePickerFooterTemplate>
+            <div class="btn-group-xs border-top p-2 d-flex">
+              <button type="button" class="btn btn-primary" (click)="atom.value = today; d.close()" i18n>Today</button>
+              <button type="button" class="btn btn-secondary ms-auto" (click)="d.close()" i18n>Close</button>
+            </div>
+          </ng-template>
+        }
      </div>
-    </ng-template>
+    </div>
  } @else if (getCustomFieldByID(atom.field)?.data_type === CustomFieldDataType.Float || getCustomFieldByID(atom.field)?.data_type === CustomFieldDataType.Integer) {
    <input class="w-25 form-control rounded-end" type="number" [(ngModel)]="atom.value" [ngModelOptions]="{standalone: true}" [disabled]="disabled">
  } @else if (getCustomFieldByID(atom.field)?.data_type === CustomFieldDataType.Boolean) {
@@ -83,6 +116,7 @@
 </ng-template>

 <ng-template #queryAtom let-atom="atom">
+  <label class="visually-hidden" [for]="atom.id + '_operator'" i18n>Operator</label>
  <div class="input-group input-group-sm">
    <ng-select #fieldSelects
      class="paperless-input-select"
@@ -96,7 +130,7 @@
      [appendTo]="selectAppendTo"
      (mousedown)="$event.stopImmediatePropagation()"
    ></ng-select>
-    <select class="w-25 form-select" [(ngModel)]="atom.operator" [ngModelOptions]="{standalone: true}" [disabled]="disabled">
+    <select class="w-25 form-select" [id]="atom.id + '_operator'" [class.rounded-end]="hasDateValueRow(atom)" [(ngModel)]="atom.operator" [ngModelOptions]="{standalone: true}" [disabled]="disabled">
      @for (operator of getOperatorsForField(atom.field); track operator.label) {
        <option [ngValue]="operator.value">{{operator.label}}</option>
      }
@@ -151,10 +185,10 @@
        <input class="w-25 form-control rounded-end" type="text" [(ngModel)]="atom.value" [ngModelOptions]="{standalone: true}" [disabled]="disabled">
      }
    }
-    <button class="btn btn-link btn-sm text-danger pe-0" type="button" (click)="removeElement(atom)" [disabled]="disabled" aria-label="Remove query" i18n-aria-label>
-      <i-bs name="x-circle"></i-bs>
-    </button>
  </div>
+  <button class="btn btn-link btn-sm text-danger pe-0 align-self-center" type="button" (click)="removeElement(atom)" [disabled]="disabled" aria-label="Remove query" i18n-aria-label>
+    <i-bs name="x-circle"></i-bs>
+  </button>
 </ng-template>

 <ng-template #queryExpression let-expression="expression">
@@ -5,6 +5,11 @@
  }
 }

+:host {
+  --ng-select-border-radius: var(--bs-border-radius);
+  --ng-select-height: calc(1.5em + 0.5rem + calc(var(--bs-border-width) * 2));
+}
+
 :host ::ng-deep .ng-select-container {
  border-top-right-radius: 0 !important;
  border-bottom-right-radius: 0 !important;
@@ -41,3 +46,13 @@
    min-width: 140px;
  }
 }
+
+.date-mode .btn {
+  --bs-btn-color: var(--bs-secondary-color);
+  --bs-btn-hover-bg: transparent;
+  --bs-btn-hover-color: var(--bs-body-color);
+  --bs-btn-hover-border-color: var(--bs-border-color);
+  --bs-btn-active-bg: transparent;
+  --bs-btn-active-color: var(--bs-primary);
+  --bs-btn-active-border-color: var(--bs-border-color);
+}
@@ -3,7 +3,7 @@ import { provideHttpClientTesting } from '@angular/common/http/testing'
 import { LOCALE_ID } from '@angular/core'
 import { ComponentFixture, TestBed } from '@angular/core/testing'
 import { FormsModule, ReactiveFormsModule } from '@angular/forms'
-import { NgbDropdownModule } from '@ng-bootstrap/ng-bootstrap'
+import { NgbDateAdapter, NgbDropdownModule } from '@ng-bootstrap/ng-bootstrap'
 import { NgSelectModule } from '@ng-select/ng-select'
 import { allIcons, NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
 import { of } from 'rxjs'
@@ -11,6 +11,7 @@ import { CustomField, CustomFieldDataType } from 'src/app/data/custom-field'
 import {
  CUSTOM_FIELD_QUERY_OPERATORS_BY_GROUP,
  CustomFieldQueryLogicalOperator,
+  CustomFieldQueryOperator,
  CustomFieldQueryOperatorGroups,
 } from 'src/app/data/custom-field-query'
 import { CustomFieldsService } from 'src/app/services/rest/custom-fields.service'
@@ -19,6 +20,7 @@ import {
  CustomFieldQueryElement,
  CustomFieldQueryExpression,
 } from 'src/app/utils/custom-field-query-element'
+import { ISODateAdapter } from 'src/app/utils/ngb-iso-date-adapter'
 import {
  CustomFieldQueriesModel,
  CustomFieldsQueryDropdownComponent,
@@ -48,6 +50,12 @@ const customFields = [
    data_type: CustomFieldDataType.Monetary,
    extra_data: { default_currency: 'EUR' },
  },
+  {
+    id: 4,
+    name: 'Test Date Field',
+    data_type: CustomFieldDataType.Date,
+    extra_data: {},
+  },
 ]

 describe('CustomFieldsQueryDropdownComponent', () => {
@@ -69,6 +77,7 @@ describe('CustomFieldsQueryDropdownComponent', () => {
        provideHttpClient(withInterceptorsFromDi()),
        provideHttpClientTesting(),
        { provide: LOCALE_ID, useValue: 'de' },
+        { provide: NgbDateAdapter, useClass: ISODateAdapter },
      ],
    }).compileComponents()

@@ -237,6 +246,74 @@ describe('CustomFieldsQueryDropdownComponent', () => {
    expect(component.selectionModel.queries.length).toBe(1)
  })

+  it('should build relative date values from amount and unit', async () => {
+    component.useDropdown = false
+    const atom = new CustomFieldQueryAtom([
+      4,
+      CustomFieldQueryOperator.GreaterThanOrEqual,
+      '2026-10-22',
+    ])
+    component.selectionModel.addAtom(atom)
+    fixture.detectChanges()
+    await fixture.whenStable()
+    const query = (selector: string) =>
+      fixture.nativeElement.querySelector(selector)
+    expect(query('[ngbDatepicker]')).not.toBeNull()
+    expect(query('input[id$="_fixed"]').checked).toBe(true)
+
+    query('input[id$="_relative"]').click()
+    fixture.detectChanges()
+    await fixture.whenStable()
+    expect(atom.value).toBeNull()
+    const amount: HTMLInputElement = query('input[aria-label="Amount"]')
+    const unit: HTMLSelectElement = query('select[id$="_unit"]')
+    amount.value = '30'
+    amount.dispatchEvent(new Event('input'))
+    expect(atom.serialize()).toEqual([4, 'gte', '30 days ago'])
+    unit.selectedIndex = 6
+    unit.dispatchEvent(new Event('change'))
+    expect(atom.serialize()).toEqual([4, 'gte', 'in 30 weeks'])
+    unit.selectedIndex = 0
+    unit.dispatchEvent(new Event('change'))
+    fixture.detectChanges()
+    expect(atom.serialize()).toEqual([4, 'gte', 'today'])
+    expect(query('input[aria-label="Amount"]')).toBeNull()
+
+    query('input[id$="_fixed"]').click()
+    fixture.detectChanges()
+    expect(atom.value).toBeNull()
+    expect(query('[ngbDatepicker]')).not.toBeNull()
+  })
+
+  it('should restore a saved relative date value', async () => {
+    component.useDropdown = false
+    const atom = new CustomFieldQueryAtom([
+      4,
+      CustomFieldQueryOperator.Exact,
+      'in 2 months',
+    ])
+    component.selectionModel.addAtom(atom)
+    fixture.detectChanges()
+    await fixture.whenStable()
+    expect(component.getRelativeDate(atom)).toEqual({
+      amount: 2,
+      unit: 'in {n} months',
+    })
+    expect(
+      fixture.nativeElement.querySelector('input[aria-label="Amount"]').value
+    ).toBe('2')
+
+    const today = new CustomFieldQueryAtom([
+      4,
+      CustomFieldQueryOperator.Exact,
+      'today',
+    ])
+    expect(component.getRelativeDate(today)).toEqual({
+      amount: null,
+      unit: 'today',
+    })
+  })
+
  describe('CustomFieldQueriesModel', () => {
    let model: CustomFieldQueriesModel

@@ -49,6 +49,26 @@ import { LoadingComponentWithPermissions } from '../../loading-component/loading
 import { ClearableBadgeComponent } from '../clearable-badge/clearable-badge.component'
 import { DocumentLinkComponent } from '../input/document-link/document-link.component'

+interface RelativeDate {
+  // The expression sent to the API, with {n} standing in for the amount
+  amount: number | null
+  unit: string
+}
+
+function parseRelativeDate(
+  value: string,
+  unit: string
+): RelativeDate | undefined {
+  const [prefix, suffix] = unit.split('{n}')
+  if (suffix === undefined) {
+    return value === unit ? { amount: null, unit } : undefined
+  }
+  if (!value.startsWith(prefix) || !value.endsWith(suffix)) return undefined
+  const amount = value.slice(prefix.length, value.length - suffix.length)
+  if (!amount || !Number.isInteger(+amount) || +amount < 0) return undefined
+  return { amount: +amount, unit }
+}
+
 export class CustomFieldQueriesModel {
  private readonly _queries = signal<CustomFieldQueryElement[]>([])
  private rootSubscriptions: Subscription[] = []
@@ -305,6 +325,67 @@ export class CustomFieldsQueryDropdownComponent extends LoadingComponentWithPerm

  public readonly today: string = new Date().toLocaleDateString('en-CA')

+  public readonly relativeDateUnits = [
+    { id: 'today', label: $localize`Today` },
+    { id: '{n} days ago', label: $localize`days ago` },
+    { id: '{n} weeks ago', label: $localize`weeks ago` },
+    { id: '{n} months ago', label: $localize`months ago` },
+    { id: '{n} years ago', label: $localize`years ago` },
+    { id: 'in {n} days', label: $localize`days from now` },
+    { id: 'in {n} weeks', label: $localize`weeks from now` },
+    { id: 'in {n} months', label: $localize`months from now` },
+    { id: 'in {n} years', label: $localize`years from now` },
+  ]
+
+  private readonly relativeDates = new Map<string, RelativeDate>()
+
+  getRelativeDate(atom: CustomFieldQueryAtom): RelativeDate | undefined {
+    if (!this.relativeDates.has(atom.id) && typeof atom.value === 'string') {
+      for (const { id } of this.relativeDateUnits) {
+        const relativeDate = parseRelativeDate(atom.value, id)
+        if (relativeDate) {
+          this.relativeDates.set(atom.id, relativeDate)
+          break
+        }
+      }
+    }
+    return this.relativeDates.get(atom.id)
+  }
+
+  hasDateValueRow(atom: CustomFieldQueryAtom): boolean {
+    return (
+      this.getCustomFieldByID(atom.field)?.data_type ===
+        CustomFieldDataType.Date &&
+      atom.operator !== CustomFieldQueryOperator.Exists &&
+      atom.operator !== CustomFieldQueryOperator.IsNull
+    )
+  }
+
+  toggleRelativeDate(atom: CustomFieldQueryAtom) {
+    if (this.getRelativeDate(atom)) {
+      this.relativeDates.delete(atom.id)
+      atom.value = null
+    } else {
+      this.relativeDates.set(atom.id, { amount: null, unit: '{n} days ago' })
+      this.updateRelativeDate(atom, {})
+    }
+  }
+
+  updateRelativeDate(
+    atom: CustomFieldQueryAtom,
+    change: Partial<RelativeDate>
+  ) {
+    const { amount, unit } = Object.assign(
+      this.relativeDates.get(atom.id),
+      change
+    )
+    if (!unit.includes('{n}')) {
+      atom.value = unit
+    } else {
+      atom.value = amount === null ? null : unit.replace('{n}', `${amount}`)
+    }
+  }
+
  public customFieldSearchFn = (term: string, field: CustomField): boolean =>
    matchesSearchText(field?.name, term)

@@ -308,7 +308,7 @@
                  </tr>
                  <tr class="align-middle">
                    <td i18n>Original SHA256 checksum</td>
-                    <td><span class="badge bg-light font-monospace text-wrap text-break text-start">{{metadata()?.original_checksum}}</span></td>
+                    <td><span class="badge bg-light text-dark font-monospace text-wrap text-break text-start">{{metadata()?.original_checksum}}</span></td>
                  </tr>
                  <tr>
                    <td i18n>Original file size</td>
@@ -465,7 +465,7 @@
    @switch (archiveContentRenderType) {
      @case (ContentRenderType.PDF) {
        @if (!useNativePdfViewer) {
-          <div class="preview-sticky pdf-viewer-container">
+          <div class="preview-sticky pdf-viewer-container" tabindex="-1">
            <pngx-pdf-viewer
              [src]="pdfSource()"
              [sourceRevision]="previewRevision()"
@@ -477,7 +477,7 @@
              (loadError)="onError($event)"
              (afterLoadComplete)="pdfPreviewLoaded($event)">
            </pngx-pdf-viewer>
-            <div class="position-absolute bottom-0 start-50 translate-middle-x z-1 mb-3 d-flex gap-2 p-1 bg-body border rounded shadow">
+            <div class="preview-controls position-absolute bottom-0 start-50 translate-middle-x z-1 mb-3 d-flex gap-2 p-1 bg-body border rounded shadow">
              @if (previewNumPages()) {
                <div class="input-group input-group-sm w-auto flex-nowrap">
                  <input class="form-control flex-grow-0 w-auto" type="number" min="1" [max]="previewNumPages()" [ngModelOptions]="{standalone: true}" [ngModel]="previewCurrentPage()" (ngModelChange)="previewCurrentPage.set($event)" aria-label="Page" i18n-aria-label />
@@ -12,6 +12,22 @@
    width: 100%;
    height: 100%;
  }
+
+  &:focus {
+    outline: none;
+  }
+
+  .preview-controls {
+    opacity: 0;
+    pointer-events: none;
+    transition: opacity 0.15s ease-in-out;
+  }
+
+  &:hover .preview-controls,
+  &:focus-within .preview-controls {
+    opacity: 1;
+    pointer-events: auto;
+  }
 }

 .btn-group .dropdown-toggle-split {
@@ -105,7 +105,7 @@
                    (click)="$event.stopPropagation()"
                  />
                } @else {
-                  <span class="input-group-text version-label">
+                  <span class="input-group-text overflow-hidden version-label">
                    @if (version.version_label) {
                      {{ version.version_label }}
                    } @else {
@@ -72,7 +72,7 @@
              <a class="btn btn-sm btn-outline-secondary" (click)="clickMoreLike.emit()">
                <i-bs name="diagram-3" class="me-1"></i-bs><span class="d-none d-md-inline" i18n>More like this</span>
              </a>
-              <a routerLink="/documents/{{document().id}}" class="btn btn-sm btn-outline-secondary" *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.Document }">
+              <a routerLink="/documents/{{document().id}}" class="btn btn-sm btn-outline-secondary">
                <i-bs name="file-earmark-richtext" class="me-1"></i-bs><span class="d-none d-md-inline" i18n>Open</span>
              </a>
              <pngx-preview-popup [document]="document()" #popupPreview>
@@ -10,7 +10,6 @@ import {
  NgbTooltipModule,
 } from '@ng-bootstrap/ng-bootstrap'
 import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
-import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
 import { DocumentTitlePipe } from 'src/app/pipes/document-title.pipe'
 import { IsNumberPipe } from 'src/app/pipes/is-number.pipe'
@@ -52,7 +51,6 @@ describe('DocumentCardLargeComponent', () => {
        DocumentCardLargeComponent,
        DocumentTitlePipe,
        CustomDatePipe,
-        IfPermissionsDirective,
        SafeUrlPipe,
        IsNumberPipe,
        PreviewPopupComponent,
@@ -20,7 +20,6 @@ import {
  Document,
 } from 'src/app/data/document'
 import { SETTINGS_KEYS } from 'src/app/data/ui-settings'
-import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { CorrespondentNamePipe } from 'src/app/pipes/correspondent-name.pipe'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
 import { DocumentTitlePipe } from 'src/app/pipes/document-title.pipe'
@@ -51,7 +50,6 @@ import { LoadingComponentWithPermissions } from '../../loading-component/loading
    CorrespondentNamePipe,
    DocumentTypeNamePipe,
    StoragePathNamePipe,
-    IfPermissionsDirective,
    CustomDatePipe,
    RouterModule,
    NgbTooltipModule,
@@ -144,7 +144,7 @@
      <div class="d-flex justify-content-between align-items-center">
        <div class="btn-group w-100">
           @if (document()) {
-            <a routerLink="/documents/{{document().id}}" class="btn btn-sm btn-outline-secondary" title="Open" i18n-title *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.Document }" i18n-title>
+            <a routerLink="/documents/{{document().id}}" class="btn btn-sm btn-outline-secondary" title="Open" i18n-title>
              <i-bs name="file-earmark-richtext"></i-bs>
            </a>
            <pngx-preview-popup [document]="document()" #popupPreview>
@@ -20,7 +20,6 @@ import {
  Document,
 } from 'src/app/data/document'
 import { SETTINGS_KEYS } from 'src/app/data/ui-settings'
-import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { CorrespondentNamePipe } from 'src/app/pipes/correspondent-name.pipe'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
 import { DocumentTitlePipe } from 'src/app/pipes/document-title.pipe'
@@ -51,7 +50,6 @@ import { LoadingComponentWithPermissions } from '../../loading-component/loading
    CorrespondentNamePipe,
    DocumentTypeNamePipe,
    StoragePathNamePipe,
-    IfPermissionsDirective,
    CustomDatePipe,
    RouterModule,
    NgbTooltipModule,
@@ -208,7 +208,7 @@
                  i18n>Correspondent</th>
              }
              @if (activeDisplayFields.includes(DisplayField.TITLE)) {
-                <th class="cursor-pointer"
+                <th class="cursor-pointer ps-5"
                  pngxSortable="title"
                  title="Sort by title" i18n-title
                  [currentSortField]="list.sortField"
@@ -322,13 +322,13 @@
                  </td>
                }
                @if (activeDisplayFields.includes(DisplayField.TITLE) || activeDisplayFields.includes(DisplayField.TAGS)) {
-                  <td width="30%">
+                  <td width="30%" class="position-relative" [class.ps-5]="activeDisplayFields.includes(DisplayField.TITLE)">
                    @if (activeDisplayFields.includes(DisplayField.TITLE)) {
                      <div class="d-inline-block" (mouseleave)="popupPreview.close()">
-                        <a routerLink="/documents/{{d.id}}" title="Edit document" i18n-title style="overflow-wrap: anywhere;">{{d.title | documentTitle}}</a>
-                        <pngx-preview-popup [document]="d" linkClasses="btn btn-sm btn-link text-secondary" linkTitle="Preview document" (click)="$event.stopPropagation()" i18n-linkTitle #popupPreview>
+                        <pngx-preview-popup class="position-absolute start-0" [document]="d" linkClasses="btn btn-sm btn-link text-secondary" linkTitle="Preview document" (click)="$event.stopPropagation()" i18n-linkTitle #popupPreview>
                          <i-bs name="eye"></i-bs>
                        </pngx-preview-popup>
+                        <a routerLink="/documents/{{d.id}}" title="Edit document" i18n-title style="overflow-wrap: anywhere;">{{d.title | documentTitle}}</a>
                      </div>
                    }
                    @if (activeDisplayFields.includes(DisplayField.TAGS)) {
@@ -87,6 +87,10 @@ $paperless-card-breakpoints: (
  }
 }

+.table .ps-5 {
+  padding-left: 2.2rem !important;
+}
+
 a {
  cursor: pointer;
 }
@@ -9,11 +9,7 @@ import {
 } from '@angular/common/http/testing'
 import { TestBed } from '@angular/core/testing'
 import { environment } from 'src/environments/environment'
-import {
-  PaperlessTaskStatus,
-  PaperlessTaskTriggerSource,
-  PaperlessTaskType,
-} from '../data/paperless-task'
+import { PaperlessTaskType } from '../data/paperless-task'
 import { TasksService } from './tasks.service'

 describe('TasksService', () => {
@@ -38,23 +34,23 @@ describe('TasksService', () => {
    httpTestingController.verify()
  })

-  it('calls tasks api endpoint on reload', () => {
+  it('calls tasks status counts api endpoint on reload', () => {
    tasksService.reload()
    const req = httpTestingController.expectOne(
      (req: HttpRequest<unknown>) =>
-        req.url === `${environment.apiBaseUrl}tasks/` &&
-        req.params.get('acknowledged') === 'false' &&
-        req.params.get('page_size') === '1000'
+        req.url === `${environment.apiBaseUrl}tasks/status_counts/` &&
+        req.params.get('acknowledged') === 'false'
    )
    expect(req.request.method).toEqual('GET')
-    req.flush({ count: 0, results: [] })
+    req.flush({ all: 5, needs_attention: 3, in_progress: 1, completed: 1 })
+    expect(tasksService.needsAttentionTasksCount).toEqual(3)
  })

  it('cancels an in-progress reload when reloading again', () => {
    tasksService.reload()
    const staleReload = httpTestingController.expectOne(
      (req: HttpRequest<unknown>) =>
-        req.url === `${environment.apiBaseUrl}tasks/`
+        req.url === `${environment.apiBaseUrl}tasks/status_counts/`
    )
    tasksService.reload()

@@ -62,9 +58,9 @@ describe('TasksService', () => {
    httpTestingController
      .expectOne(
        (req: HttpRequest<unknown>) =>
-          req.url === `${environment.apiBaseUrl}tasks/`
+          req.url === `${environment.apiBaseUrl}tasks/status_counts/`
      )
-      .flush({ count: 0, results: [] })
+      .flush({ all: 0, needs_attention: 0, in_progress: 0, completed: 0 })
  })

  it('continues reloading after a reload request fails', () => {
@@ -72,7 +68,7 @@ describe('TasksService', () => {
    httpTestingController
      .expectOne(
        (req: HttpRequest<unknown>) =>
-          req.url === `${environment.apiBaseUrl}tasks/`
+          req.url === `${environment.apiBaseUrl}tasks/status_counts/`
      )
      .flush('error', { status: 500, statusText: 'error' })

@@ -82,16 +78,16 @@ describe('TasksService', () => {
    httpTestingController
      .expectOne(
        (req: HttpRequest<unknown>) =>
-          req.url === `${environment.apiBaseUrl}tasks/`
+          req.url === `${environment.apiBaseUrl}tasks/status_counts/`
      )
-      .flush({ count: 0, results: [] })
+      .flush({ all: 0, needs_attention: 0, in_progress: 0, completed: 0 })
  })

  it('reloads after dismissing a task while a reload is already in progress', () => {
    tasksService.reload()
    const staleReload = httpTestingController.expectOne(
      (req: HttpRequest<unknown>) =>
-        req.url === `${environment.apiBaseUrl}tasks/` &&
+        req.url === `${environment.apiBaseUrl}tasks/status_counts/` &&
        req.params.get('acknowledged') === 'false'
    )

@@ -104,12 +100,12 @@ describe('TasksService', () => {
    httpTestingController
      .expectOne(
        (req: HttpRequest<unknown>) =>
-          req.url === `${environment.apiBaseUrl}tasks/` &&
+          req.url === `${environment.apiBaseUrl}tasks/status_counts/` &&
          req.params.get('acknowledged') === 'false'
      )
-      .flush({ count: 0, results: [] })
+      .flush({ all: 50, needs_attention: 42, in_progress: 3, completed: 5 })

-    expect(tasksService.needsAttentionTasks).toHaveLength(0)
+    expect(tasksService.needsAttentionTasksCount).toEqual(42)
  })

  it('calls acknowledge_tasks api endpoint on dismiss and reloads', () => {
@@ -126,11 +122,10 @@ describe('TasksService', () => {
    httpTestingController
      .expectOne(
        (req: HttpRequest<unknown>) =>
-          req.url === `${environment.apiBaseUrl}tasks/` &&
-          req.params.get('acknowledged') === 'false' &&
-          req.params.get('page_size') === '1000'
+          req.url === `${environment.apiBaseUrl}tasks/status_counts/` &&
+          req.params.get('acknowledged') === 'false'
      )
-      .flush({ count: 0, results: [] })
+      .flush({ all: 0, needs_attention: 0, in_progress: 0, completed: 0 })
  })

  it('calls acknowledge_tasks api endpoint on dismiss all and reloads', () => {
@@ -147,65 +142,10 @@ describe('TasksService', () => {
    httpTestingController
      .expectOne(
        (req: HttpRequest<unknown>) =>
-          req.url === `${environment.apiBaseUrl}tasks/` &&
-          req.params.get('acknowledged') === 'false' &&
-          req.params.get('page_size') === '1000'
+          req.url === `${environment.apiBaseUrl}tasks/status_counts/` &&
+          req.params.get('acknowledged') === 'false'
      )
-      .flush({ count: 0, results: [] })
-  })
-
-  it('includes revoked tasks in needs attention', () => {
-    const mockTasks = [
-      {
-        task_type: PaperlessTaskType.SanityCheck,
-        trigger_source: PaperlessTaskTriggerSource.System,
-        status: PaperlessTaskStatus.Failure,
-        acknowledged: false,
-        task_id: '1235',
-        input_data: {},
-        date_created: new Date(),
-        related_document_ids: [],
-      },
-      {
-        task_type: PaperlessTaskType.MailFetch,
-        trigger_source: PaperlessTaskTriggerSource.Scheduled,
-        status: PaperlessTaskStatus.Revoked,
-        acknowledged: false,
-        task_id: '1236',
-        input_data: {},
-        date_created: new Date(),
-        related_document_ids: [],
-      },
-      {
-        task_type: PaperlessTaskType.EmptyTrash,
-        trigger_source: PaperlessTaskTriggerSource.Manual,
-        status: PaperlessTaskStatus.Success,
-        acknowledged: false,
-        task_id: '1238',
-        input_data: {},
-        date_created: new Date(),
-        related_document_ids: [],
-      },
-    ]
-
-    tasksService.reload()
-
-    const req = httpTestingController.expectOne(
-      (req: HttpRequest<unknown>) =>
-        req.url === `${environment.apiBaseUrl}tasks/` &&
-        req.params.get('acknowledged') === 'false' &&
-        req.params.get('page_size') === '1000'
-    )
-
-    req.flush({ count: mockTasks.length, results: mockTasks })
-
-    expect(tasksService.needsAttentionTasks).toHaveLength(2)
-    expect(tasksService.needsAttentionTasks.map((task) => task.status)).toEqual(
-      expect.arrayContaining([
-        PaperlessTaskStatus.Failure,
-        PaperlessTaskStatus.Revoked,
-      ])
-    )
+      .flush({ all: 0, needs_attention: 0, in_progress: 0, completed: 0 })
  })

  it('supports running tasks', () => {
@@ -5,14 +5,12 @@ import {
  catchError,
  finalize,
  first,
-  map,
  switchMap,
  takeUntil,
  tap,
 } from 'rxjs/operators'
 import {
  PaperlessTask,
-  PaperlessTaskStatus,
  PaperlessTaskStatusCounts,
  PaperlessTaskType,
 } from 'src/app/data/paperless-task'
@@ -27,50 +25,42 @@ export class TasksService {

  private baseUrl: string = environment.apiBaseUrl
  private endpoint: string = 'tasks'
-  private readonly defaultReloadPageSize = 1000

  public loading: boolean = false

-  private readonly tasks = signal<PaperlessTask[]>([])
+  private readonly tasksStatusCounts = signal<PaperlessTaskStatusCounts>({
+    all: 0,
+    needs_attention: 0,
+    in_progress: 0,
+    completed: 0,
+  })
  private readonly reloadNotifier = new Subject<void>()

  private unsubscribeNotifer: Subject<any> = new Subject()

  constructor() {
    this.reloadNotifier
-      .pipe(
-        switchMap(() => {
-          this.loading = true
-          return this.http
-            .get<Results<PaperlessTask>>(`${this.baseUrl}${this.endpoint}/`, {
-              params: {
-                acknowledged: 'false',
-                page_size: this.defaultReloadPageSize,
-              },
-            })
-            .pipe(
-              map((response) => response.results),
-              takeUntil(this.unsubscribeNotifer),
-              catchError(() => EMPTY),
-              finalize(() => {
-                this.loading = false
-              })
-            )
-        })
-      )
-      .subscribe((tasks) => {
-        this.tasks.set(tasks)
+      .pipe(switchMap(() => this.fetchUnacknowledgedTasksCounts()))
+      .subscribe((taskStatusCounts) => {
+        this.tasksStatusCounts.set(taskStatusCounts)
      })
  }

-  public get needsAttentionTasks(): PaperlessTask[] {
-    return this.tasks().filter((t) =>
-      [PaperlessTaskStatus.Failure, PaperlessTaskStatus.Revoked].includes(
-        t.status
-      )
+  private fetchUnacknowledgedTasksCounts(): Observable<PaperlessTaskStatusCounts> {
+    this.loading = true
+    return this.statusCounts({ acknowledged: false }).pipe(
+      takeUntil(this.unsubscribeNotifer),
+      catchError(() => EMPTY),
+      finalize(() => {
+        this.loading = false
+      })
    )
  }

+  public get needsAttentionTasksCount(): number {
+    return this.tasksStatusCounts().needs_attention
+  }
+
  public reload() {
    this.reloadNotifier.next()
  }
@@ -105,7 +95,7 @@ export class TasksService {

  public dismissTasks(task_ids: Set<number>): Observable<any> {
    return this.http
-      .post(`${this.baseUrl}tasks/acknowledge/`, {
+      .post(`${this.baseUrl}${this.endpoint}/acknowledge/`, {
        tasks: [...task_ids],
      })
      .pipe(
@@ -119,7 +109,7 @@ export class TasksService {

  public dismissAllTasks(): Observable<any> {
    return this.http
-      .post(`${this.baseUrl}tasks/acknowledge/`, {
+      .post(`${this.baseUrl}${this.endpoint}/acknowledge/`, {
        all: true,
      })
      .pipe(
@@ -8,7 +8,7 @@ export const environment = {
  apiVersion: '10', // match src/paperless/settings.py
  appTitle: DEFAULT_APP_TITLE,
  tag: 'prod',
-  version: '3.3.4',
+  version: '3.4.1',
  webSocketHost: window.location.host,
  webSocketProtocol: window.location.protocol == 'https:' ? 'wss:' : 'ws:',
  webSocketBaseUrl: base_url.pathname + 'ws/',
@@ -11,6 +11,8 @@ from typing import TYPE_CHECKING

 import pytest

+from paperless_testing import samples
+
 if TYPE_CHECKING:
    from collections.abc import Generator
    from pathlib import Path
@@ -149,3 +151,39 @@ def fake_progress_manager(

    monkeypatch.setattr("documents.tasks.ProgressManager", FakeProgressManager)
    return FakeProgressManager
+
+
+@pytest.fixture(scope="session")
+def shared_samples_dir() -> Path:
+    """Directory of sample files used by more than one app's tests."""
+    return samples.SHARED_SAMPLES_DIR
+
+
+@pytest.fixture(scope="session")
+def simple_digital_pdf_file() -> Path:
+    """One-page PDF with a text layer."""
+    return samples.SIMPLE_DIGITAL_PDF
+
+
+@pytest.fixture(scope="session")
+def multi_page_digital_pdf_file() -> Path:
+    """Three-page PDF with a text layer."""
+    return samples.MULTI_PAGE_DIGITAL_PDF
+
+
+@pytest.fixture(scope="session")
+def with_form_pdf_file() -> Path:
+    """PDF containing a fillable form."""
+    return samples.WITH_FORM_PDF
+
+
+@pytest.fixture(scope="session")
+def multi_page_images_pdf_file() -> Path:
+    """Multi-page PDF of scanned images, no text layer."""
+    return samples.MULTI_PAGE_IMAGES_PDF
+
+
+@pytest.fixture(scope="session")
+def thumbnail_webp_file() -> Path:
+    """Small WebP thumbnail."""
+    return samples.THUMBNAIL_WEBP
@@ -10,9 +10,6 @@ from typing import TYPE_CHECKING
 import regex as regex_mod
 from django.conf import settings
 from pdf2image import convert_from_path
-from pikepdf import Page
-from pikepdf import PasswordError
-from pikepdf import Pdf

 from documents.converters import convert_from_tiff_to_pdf
 from documents.data_models import ConsumableDocument
@@ -34,6 +31,7 @@ from documents.utils import maybe_override_pixel_limit
 from paperless.config import BarcodeConfig

 if TYPE_CHECKING:
+    from pikepdf import Page
    from PIL import Image

 logger = logging.getLogger("paperless.barcodes")
@@ -282,6 +280,8 @@ class BarcodePlugin(ConsumeTaskPlugin):
        # No op if not a TIFF
        self.convert_from_tiff_to_pdf()

+        from pikepdf import PasswordError
+
        try:
            self.barcodes = scan_pdf(
                self.pdf_file,
@@ -433,6 +433,8 @@ class BarcodePlugin(ConsumeTaskPlugin):

        document_paths = []
        fname: str = self.input_doc.original_file.stem
+        from pikepdf import Pdf
+
        with Pdf.open(self.pdf_file) as input_pdf:
            # Start with an empty document
            current_document: list[Page] = []
@@ -516,6 +518,8 @@ def scan_pdf(pdf_path: Path, settings: BarcodeConfig, work_dir: Path) -> list[Ba
    """
    barcodes: list[Barcode] = []

+    from pikepdf import Pdf
+
    with Pdf.open(pdf_path) as pdf:
        num_of_pages = len(pdf.pages)
    logger.debug(f"PDF has {num_of_pages} pages")
@@ -36,6 +36,7 @@ from documents.models import DocumentType
 from documents.models import PaperlessTask
 from documents.models import StoragePath
 from documents.models import Tag
+from documents.permissions import PermissionsSpec
 from documents.permissions import set_permissions_for_objects
 from documents.plugins.helpers import DocumentsStatusManager
 from documents.tasks import bulk_update_documents
@@ -452,7 +453,7 @@ def reprocess(doc_ids: list[int], *, remote_ocr: bool = False) -> Literal["OK"]:

 def set_permissions(
    doc_ids: list[int],
-    set_permissions: dict,
+    set_permissions: PermissionsSpec,
    *,
    owner: User | None = None,
    merge: bool = False,
@@ -38,7 +38,8 @@ from documents.models import StoragePath
 from documents.models import Tag
 from documents.models import WorkflowTrigger
 from documents.parsers import ParseError
-from documents.permissions import set_permissions_for_object
+from documents.permissions import PermissionsSpec
+from documents.permissions import set_permissions_for_objects
 from documents.plugins.base import AlwaysRunPluginMixin
 from documents.plugins.base import ConsumeTaskPlugin
 from documents.plugins.base import NoCleanupPluginMixin
@@ -846,6 +847,19 @@ class ConsumerPlugin(
            local_added,
            self.filename,
            self.filename,
+            custom_fields=[
+                CustomFieldInstance(
+                    field=field,
+                    **{
+                        CustomFieldInstance.get_value_field_name(
+                            field.data_type,
+                        ): self.metadata.custom_fields[field.pk],
+                    },
+                )
+                for field in CustomField.objects.filter(
+                    pk__in=self.metadata.custom_fields or {},
+                )
+            ],
        )

    def _store(
@@ -948,7 +962,7 @@ class ConsumerPlugin(
            or self.metadata.change_users is not None
            or self.metadata.change_groups is not None
        ):
-            permissions = {
+            permissions: PermissionsSpec = {
                "view": {
                    "users": self.metadata.view_users or [],
                    "groups": self.metadata.view_groups or [],
@@ -958,7 +972,7 @@ class ConsumerPlugin(
                    "groups": self.metadata.change_groups or [],
                },
            }
-            set_permissions_for_object(permissions=permissions, object=document)
+            set_permissions_for_objects(permissions, Document, [document.pk])

        if self.metadata.custom_fields:
            for field in CustomField.objects.filter(
@@ -1,6 +1,5 @@
 from pathlib import Path

-import img2pdf
 from PIL import Image

 from documents.utils import copy_basic_file_stats
@@ -17,6 +16,8 @@ def convert_from_tiff_to_pdf(tiff_path: Path, target_directory: Path) -> Path:

    Returns the path of the PDF created.
    """
+    import img2pdf
+
    # override pixel setting if needed
    maybe_override_pixel_limit()

@@ -5,8 +5,6 @@ from pathlib import Path
 from typing import TypedDict

 import magic
-from guardian.shortcuts import get_groups_with_perms
-from guardian.shortcuts import get_users_with_perms


 class StoredBarcode(TypedDict):
@@ -117,6 +115,9 @@ class DocumentMetadataOverrides:
        """
        Fills in the overrides from a document object
        """
+        # documents.models imports this module, so this can't be a top-level import
+        from documents.permissions import get_permission_grantees
+
        overrides = DocumentMetadataOverrides()
        overrides.title = doc.title
        overrides.correspondent_id = doc.correspondent.id if doc.correspondent else None
@@ -126,40 +127,16 @@ class DocumentMetadataOverrides:
        overrides.tag_ids = list(doc.tags.values_list("id", flat=True))
        overrides.created = doc.created

-        overrides.view_users = list(
-            get_users_with_perms(
-                doc,
-                only_with_perms_in=["view_document"],
-                with_group_users=False,
-            ).values_list("id", flat=True),
-        )
-        overrides.change_users = list(
-            get_users_with_perms(
-                doc,
-                only_with_perms_in=["change_document"],
-                with_group_users=False,
-            ).values_list("id", flat=True),
-        )
+        grantees = get_permission_grantees(type(doc), [doc.pk])[doc.pk]
+        overrides.view_users = grantees["view"]["users"]
+        overrides.view_groups = grantees["view"]["groups"]
+        overrides.change_users = grantees["change"]["users"]
+        overrides.change_groups = grantees["change"]["groups"]
        overrides.custom_fields = {
            custom_field.field.id: custom_field.value
            for custom_field in doc.custom_fields.all()
        }

-        groups_with_perms = get_groups_with_perms(
-            doc,
-            attach_perms=True,
-        )
-        overrides.view_groups = [
-            group.id
-            for group in groups_with_perms
-            if "view_document" in groups_with_perms[group]
-        ]
-        overrides.change_groups = [
-            group.id
-            for group in groups_with_perms
-            if "change_document" in groups_with_perms[group]
-        ]
-
        return overrides


@@ -6,7 +6,6 @@ from pathlib import Path
 from typing import Final

 from django.conf import settings
-from pikepdf import Pdf

 from documents.consumer import ConsumerError
 from documents.converters import convert_from_tiff_to_pdf
@@ -85,6 +84,8 @@ class CollatePlugin(NoCleanupPluginMixin, NoSetupPluginMixin, ConsumeTaskPlugin)
                valid_staging_exists = True

        if valid_staging_exists:
+            from pikepdf import Pdf
+
            try:
                # Collate pages from second PDF in reverse order
                with Pdf.open(staging) as pdf1, Pdf.open(pdf_file) as pdf2:
@@ -11,6 +11,7 @@ from decimal import InvalidOperation
 from typing import TYPE_CHECKING
 from typing import Any

+from django.conf import settings
 from django.contrib.contenttypes.models import ContentType
 from django.db.models import Case
 from django.db.models import CharField
@@ -25,6 +26,7 @@ from django.db.models import Value
 from django.db.models import When
 from django.db.models.functions import Cast
 from django.db.models.functions import NullIf
+from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
 from django_filters import DateFilter
 from django_filters.rest_framework import BooleanFilter
@@ -57,6 +59,7 @@ from documents.versioning import annotate_effective_content

 if TYPE_CHECKING:
    from collections.abc import Callable
+    from datetime import datetime

 CHAR_KWARGS = ["istartswith", "iendswith", "icontains", "iexact"]
 ID_KWARGS = ["in", "exact"]
@@ -322,6 +325,53 @@ class MonetaryAmountField(serializers.Field):
        return str(value)


+class DateQueryField(serializers.DateField):
+    """
+    Accepts either a fixed date or a relative date expression using `dateparser` and
+    resolves it against the provided reference datetime.
+    """
+
+    default_error_messages = {
+        "expression": _(
+            'Expected a date or a relative date such as "today" or "in 30 days".',
+        ),
+    }
+
+    def __init__(self, *, reference_datetime: datetime, **kwargs):
+        super().__init__(**kwargs)
+        self.reference_datetime = reference_datetime
+
+    def to_internal_value(self, value):
+        try:
+            # Let the parent class handle fixed-date formats and string validation first
+            return super().to_internal_value(value)
+        except serializers.ValidationError:
+            if not isinstance(value, str):
+                raise
+
+        import dateparser
+
+        try:
+            parsed = dateparser.parse(
+                value,
+                # The UI always builds English expressions
+                locales=[*settings.DATE_PARSER_LANGUAGES, "en"]
+                if settings.DATE_PARSER_LANGUAGES
+                else None,
+                settings={
+                    "PARSERS": ["relative-time"],
+                    "RELATIVE_BASE": self.reference_datetime,
+                    "TIMEZONE": str(self.reference_datetime.tzinfo),
+                    "RETURN_AS_TIMEZONE_AWARE": True,
+                },
+            )
+        except (ValueError, OverflowError):
+            self.fail("expression")
+        if parsed is None:
+            self.fail("expression")
+        return parsed.astimezone(self.reference_datetime.tzinfo).date()
+
+
 class SelectField(serializers.CharField):
    def __init__(self, custom_field: CustomField) -> None:
        self._options = custom_field.extra_data["select_options"]
@@ -463,6 +513,8 @@ class CustomFieldQueryParser:
            raise serializers.ValidationError(
                {self._validation_prefix: [_("Value must be valid JSON.")]},
            )
+        # Save the current local time as the reference for the query
+        self._reference_datetime = timezone.localtime()
        return (
            self._parse_expr(expr, validation_prefix=self._validation_prefix),
            self._annotations,
@@ -649,6 +701,8 @@ class CustomFieldQueryParser:
        ):
            # DateField admits queries in the form of `year__exact`, etc. These take integers.
            field = serializers.IntegerField()
+        elif custom_field.data_type == CustomField.FieldDataType.DATE:
+            field = DateQueryField(reference_datetime=self._reference_datetime)
        elif custom_field.data_type == CustomField.FieldDataType.DOCUMENTLINK:
            # We can be more specific here and make sure the value is a list.
            field = serializers.ListField(child=serializers.IntegerField())
@@ -14,8 +14,6 @@ from __future__ import annotations
 from typing import TYPE_CHECKING
 from typing import NamedTuple

-import pikepdf
-
 if TYPE_CHECKING:
    from collections.abc import Callable
    from collections.abc import Iterable
@@ -43,6 +41,8 @@ def rotate_pdf(src: Path, dst: Path, degrees: int) -> None:
    Rotate every page relatively on the opened document, not a rebuild, so Info,
    XMP and outlines are kept. ``src`` is not modified.
    """
+    import pikepdf
+
    with pikepdf.open(src) as pdf:
        for page in pdf.pages:
            page.rotate(degrees, relative=True)
@@ -58,6 +58,8 @@ def remove_pages(src: Path, dst: Path, pages: Iterable[int]) -> None:
    Duplicates are ignored. Pages are removed highest first so earlier removals
    never shift the index of later ones.
    """
+    import pikepdf
+
    unique = sorted(set(pages))
    _require_positive(unique)
    with pikepdf.open(src) as pdf:
@@ -81,6 +83,8 @@ def build_pdfs(
    (Info, XMP, outlines) is not carried over. Returns the written paths in output
    order.
    """
+    import pikepdf
+
    for specs, _ in outputs:
        _require_positive(spec.page for spec in specs)

@@ -140,6 +144,8 @@ def needs_decrypt(src: Path) -> bool:
    True if ``src`` is encrypted. A PDF that needs a password to open at all
    counts as encrypted.
    """
+    import pikepdf
+
    try:
        with pikepdf.open(src) as pdf:
            return bool(pdf.is_encrypted)
@@ -154,6 +160,8 @@ def decrypt_pdf(src: Path, make_dst: Callable[[], Path], password: str) -> Path:
    ``make_dst`` is only called once the password has been accepted, so a wrong
    password never leaves a destination behind.
    """
+    import pikepdf
+
    with pikepdf.open(src, password=password) as pdf:
        pdf.remove_unreferenced_resources()
        dst = make_dst()
@@ -170,6 +178,8 @@ class PdfMerger:
    """

    def __init__(self) -> None:
+        import pikepdf
+
        self._pdf = pikepdf.new()
        self._version: str = self._pdf.pdf_version

@@ -185,6 +195,8 @@ class PdfMerger:
        self._pdf.close()

    def add(self, path: Path) -> None:
+        import pikepdf
+
        with pikepdf.open(str(path)) as pdf:
            self._version = max(self._version, pdf.pdf_version)
            self._pdf.pages.extend(pdf.pages)
@@ -1,8 +1,12 @@
+from collections.abc import Iterable
 from collections.abc import Mapping
 from collections.abc import Sequence
 from typing import Any
 from typing import ClassVar
+from typing import Final
 from typing import Literal
+from typing import TypeAlias
+from typing import TypedDict
 from typing import TypeGuard
 from typing import TypeVar
 from typing import cast
@@ -26,15 +30,38 @@ from django.db.models.functions import Coalesce
 from guardian.core import ObjectPermissionChecker
 from guardian.models import GroupObjectPermission
 from guardian.models import UserObjectPermission
-from guardian.shortcuts import assign_perm
-from guardian.shortcuts import get_users_with_perms
-from guardian.shortcuts import remove_perm
 from rest_framework.permissions import BasePermission
 from rest_framework.permissions import DjangoObjectPermissions

 from documents.models import Document
 from documents.versioning import get_root_document

+PermissionAction = Literal["view", "change"]
+PERMISSION_ACTIONS: Final[tuple[PermissionAction, ...]] = ("view", "change")
+
+
+class PermissionGrantees(TypedDict):
+    """
+    The user and group ids holding one permission action directly on an
+    object. Users who only hold it through a group are not listed.
+    """
+
+    users: list[int]
+    groups: list[int]
+
+
+class PermissionGranteesUpdate(TypedDict, total=False):
+    """
+    The user and group ids to grant one permission action to. A missing key
+    leaves that kind of grant untouched.
+    """
+
+    users: Iterable[int]
+    groups: Iterable[int]
+
+
+PermissionsSpec: TypeAlias = Mapping[PermissionAction, PermissionGranteesUpdate]
+

 class PaperlessObjectPermissions(DjangoObjectPermissions):
    """
@@ -90,101 +117,10 @@ def has_system_status_permission(user: User | None) -> bool:
    )


-def get_groups_with_only_permission(obj, codename):
-    ctype = ContentType.objects.get_for_model(obj)
-    permission = Permission.objects.get(content_type=ctype, codename=codename)
-    group_object_perm_group_ids = (
-        GroupObjectPermission.objects.filter(
-            object_pk=obj.pk,
-            content_type=ctype,
-        )
-        .filter(permission=permission)
-        .values_list("group_id")
-    )
-    return Group.objects.filter(id__in=group_object_perm_group_ids).distinct()
-
-
-def set_permissions_for_object(
-    permissions: dict,
-    object,
-    *,
-    merge: bool = False,
-) -> None:
-    """
-    Set permissions for an object. The permissions are given as a mapping of actions
-    to a dict of user / group id lists, e.g.
-    {"view": {"users": [1], "groups": [2]}, "change": {"users": [], "groups": []}}.
-
-    If merge is True, the permissions are merged with the existing permissions and
-    no users or groups are removed. If False, the permissions are set to exactly
-    the given list of users and groups.
-    """
-
-    for action, entry in permissions.items():
-        permission = f"{action}_{object.__class__.__name__.lower()}"
-        if "users" in entry:
-            # users
-            users_to_add = User.objects.filter(id__in=entry["users"])
-            users_to_remove = (
-                get_users_with_perms(
-                    object,
-                    only_with_perms_in=[permission],
-                    with_group_users=False,
-                )
-                if not merge
-                else User.objects.none()
-            )
-            if users_to_add.exists() and users_to_remove.exists():
-                users_to_remove = users_to_remove.exclude(id__in=users_to_add)
-            if users_to_remove.exists():
-                for user in users_to_remove:
-                    remove_perm(permission, user, object)
-            if users_to_add.exists():
-                for user in users_to_add:
-                    assign_perm(permission, user, object)
-                    if action == "change":
-                        # change gives view too
-                        assign_perm(
-                            f"view_{object.__class__.__name__.lower()}",
-                            user,
-                            object,
-                        )
-        if "groups" in entry:
-            # groups
-            groups_to_add = Group.objects.filter(id__in=entry["groups"])
-            groups_to_remove = (
-                get_groups_with_only_permission(
-                    object,
-                    permission,
-                )
-                if not merge
-                else Group.objects.none()
-            )
-            if groups_to_add.exists() and groups_to_remove.exists():
-                groups_to_remove = groups_to_remove.exclude(id__in=groups_to_add)
-            if groups_to_remove.exists():
-                for group in groups_to_remove:
-                    remove_perm(permission, group, object)
-            if groups_to_add.exists():
-                for group in groups_to_add:
-                    assign_perm(permission, group, object)
-                    if action == "change":
-                        # change gives view too
-                        assign_perm(
-                            f"view_{object.__class__.__name__.lower()}",
-                            group,
-                            object,
-                        )
-
-
 def _resolve_permissions(codenames: set[str], ctype: ContentType) -> list[Permission]:
    """
-    Resolves `codenames` to Permission rows, raising like the single-object
-    assign_perm() this bulk path replaces does (via a `.get()` internally)
-    if any codename doesn't exist. SetPermissionsSerializer rejects unknown
-    action names at the API, but a caller passing one directly would
-    otherwise get a plain `.filter()` that silently builds zero rows and
-    no-ops instead of reporting the bad input.
+    Resolve ``codenames`` to Permission rows, raising for any that don't exist
+    so a bad action name fails loudly instead of granting nothing.
    """
    permission_objs = list(
        Permission.objects.filter(content_type=ctype, codename__in=codenames),
@@ -203,16 +139,13 @@ def _apply_bulk_permission_entry(
    perm_model: type[UserObjectPermission] | type[GroupObjectPermission],
    identity_model: type[User] | type[Group],
    identity_field: str,
-    ids: list[int],
+    ids: Iterable[int],
    codename: str,
    permission_objs: list[Permission],
    ctype: ContentType,
    object_pks: list[str],
    merge: bool,
 ) -> None:
-    # Only the ids are needed to build permission rows (via `<field>_id=`),
-    # so avoid fetching full User/Group rows for identities that may not
-    # even end up being granted anything new.
    add_ids = set(
        identity_model.objects.filter(id__in=ids).values_list("id", flat=True),
    )
@@ -250,45 +183,26 @@ def _apply_bulk_permission_entry(
        for pk in object_pks
        for identity_id in add_ids
    ]
-    # ignore_conflicts skips only rows that already exist as an exact
-    # (identity, permission, object) match -- the same de-dup the
-    # underlying (user|group, permission, object_pk) unique constraint
-    # already enforces for the single-object assign_perm() this replaces,
-    # so it doesn't change what counts as "already granted". batch_size
-    # caps how many rows go into a single INSERT statement.
+    # ignore_conflicts skips grants that already exist (unique constraint).
    perm_model.objects.bulk_create(rows, ignore_conflicts=True, batch_size=1000)


 def set_permissions_for_objects(
-    permissions: dict,
+    permissions: PermissionsSpec,
    model: type[Model],
    pks: QuerySet | list,
    *,
    merge: bool = False,
 ) -> None:
    """
-    Bulk equivalent of set_permissions_for_object: applies the same
-    permission changes to every object identified by `pks` at once.
+    Set the view/change grants for every object in ``pks``. With ``merge``,
+    the given users and groups are added; without it, each given action's
+    direct grants are replaced. Granting change also grants view, and an
+    action entry with neither key is left untouched.

-    Takes a model + pks (rather than model instances) deliberately -- the
-    permission rows built below only ever need `pk`, `content_type`, and
-    identity ids, so callers shouldn't have to fetch full rows (with every
-    other field) just to hand them to this function.
-
-    Deliberately does not use guardian's queryset/list-aware assign_perm:
-    passing a list as the object routes to bulk_assign_perm, which skips
-    creating a direct permission row for anyone who already has the
-    permission via ANY group membership (it checks
-    ObjectPermissionChecker.has_perm, which is group-inheritance-aware) --
-    unlike the single-object assign_perm this replaces, which always
-    ensures a direct row via get_or_create regardless of group-derived
-    access. Losing that guarantee would mean a later revocation of the
-    group's grant silently strips access an admin explicitly asked to be
-    direct. Bulk-creating rows straight against the permission models
-    instead (see _apply_bulk_permission_entry) preserves the original
-    always-create-a-direct-row semantics while still batching every object
-    and every identity into one query per action, rather than one query per
-    (object, user) pair.
+    guardian's bulk assign_perm is avoided because it skips the direct row
+    for anyone who already has access through a group, so revoking the group
+    later would silently remove access that was granted explicitly.
    """
    object_pks = [str(pk) for pk in pks]
    if not object_pks:  # pragma: no cover
@@ -297,12 +211,9 @@ def set_permissions_for_objects(
    model_name = model.__name__.lower()
    ctype = ContentType.objects.get_for_model(model)

-    # Every action is resolved up front, before anything is written, so an
-    # unrecognized action name (see _resolve_permissions) aborts the whole
-    # call instead of leaving the actions ahead of it already applied.
-    # SetPermissionsSerializer rejects unknown actions at the API, so this
-    # guards any other caller.
-    permissions_by_action: dict[str, list[Permission]] = {}
+    # Resolve every action before writing, so a bad one can't leave the
+    # actions ahead of it applied.
+    permissions_by_action: dict[PermissionAction, list[Permission]] = {}
    for action, entry in permissions.items():
        if "users" not in entry and "groups" not in entry:
            continue
@@ -346,6 +257,56 @@ def set_permissions_for_objects(
            )


+def get_permission_grantees(
+    model: type[Model],
+    pks: Iterable[int],
+    actions: Iterable[PermissionAction] = PERMISSION_ACTIONS,
+) -> dict[int, dict[PermissionAction, PermissionGrantees]]:
+    """
+    Return the users and groups holding each of ``actions`` directly on each
+    object of ``model`` identified by ``pks``, in two queries however many
+    objects are asked about.
+
+    Every requested pk and action has an entry, with empty lists where nothing
+    is granted. Ids are sorted. Group grants stay group ids rather than being
+    expanded to their members, so a caller that copies them keeps access tied
+    to current group membership.
+    """
+    pks = list(pks)
+    actions = list(actions)
+    model_name = model.__name__.lower()
+    action_by_codename: dict[str, PermissionAction] = {
+        f"{action}_{model_name}": action for action in actions
+    }
+    result: dict[int, dict[PermissionAction, PermissionGrantees]] = {
+        pk: {action: {"users": [], "groups": []} for action in actions} for pk in pks
+    }
+    if not pks or not actions:
+        return result
+
+    ctype = ContentType.objects.get_for_model(model)
+    grant_filter = {
+        "content_type": ctype,
+        "permission__content_type": ctype,
+        "permission__codename__in": list(action_by_codename),
+        "object_pk__in": [str(pk) for pk in pks],
+    }
+    for perm_model, identity_field, key in (
+        (UserObjectPermission, "user_id", "users"),
+        (GroupObjectPermission, "group_id", "groups"),
+    ):
+        rows = (
+            perm_model.objects.filter(**grant_filter)
+            .values_list("object_pk", "permission__codename", identity_field)
+            .order_by(identity_field)
+        )
+        for object_pk, codename, identity_id in rows:
+            result[int(object_pk)][action_by_codename[codename]][key].append(
+                identity_id,
+            )
+    return result
+
+
 def permitted_object_ids(
    user: User | None,
    model: type[Model],
@@ -7,8 +7,6 @@ from dataclasses import dataclass
 from types import TracebackType
 from typing import Self

-import dateparser
-
 logger = logging.getLogger(__name__)


@@ -80,6 +78,8 @@ class DateParserPluginBase(ABC):

        Uses configuration from `self.config`.
        """
+        import dateparser
+
        try:
            return dateparser.parse(
                date_string,
@@ -48,8 +48,6 @@ if TYPE_CHECKING:
    from pathlib import Path

    from django.contrib.auth.models import AbstractUser
-    from django.contrib.auth.models import Group
-    from django.contrib.auth.models import User
    from django.db.models import QuerySet

    from documents.models import Document
@@ -528,8 +526,8 @@ class TantivyBackend:
        Annotate the queryset with ``annotate_effective_content`` when indexing
        more than a couple of documents, to resolve that without a query each.
        """
-        from guardian.shortcuts import get_groups_with_perms
-        from guardian.shortcuts import get_users_with_perms
+        from documents.models import Document
+        from documents.permissions import get_permission_grantees

        # Every searchable string is normalized on the way in, and every
        # query string on the way out (_parse_query), so the two agree on
@@ -674,28 +672,18 @@ class TantivyBackend:
            doc.add_unsigned("owner_id", document.owner_id)

        # Viewers with permission
-        if viewer_ids is None:
-            users_with_perms = get_users_with_perms(
-                document,
-                only_with_perms_in=["view_document"],
-                with_group_users=False,
-            )
-            viewer_ids = list(
-                cast("QuerySet[User]", users_with_perms).values_list("id", flat=True),
-            )
+        if viewer_ids is None or viewer_group_ids is None:
+            view = get_permission_grantees(
+                Document,
+                [document.pk],
+                actions=("view",),
+            )[document.pk]["view"]
+            if viewer_ids is None:
+                viewer_ids = view["users"]
+            if viewer_group_ids is None:
+                viewer_group_ids = view["groups"]
        for viewer_id in viewer_ids:
            doc.add_unsigned("viewer_id", viewer_id)
-        if viewer_group_ids is None:
-            groups_with_perms = get_groups_with_perms(
-                document,
-                only_with_perms_in=["view_document"],
-            )
-            viewer_group_ids = list(
-                cast("QuerySet[Group]", groups_with_perms).values_list(
-                    "id",
-                    flat=True,
-                ),
-            )
        for viewer_group_id in viewer_group_ids:
            doc.add_unsigned("viewer_group_id", viewer_group_id)

@@ -1200,12 +1188,6 @@ def chunked(iterable, size):
        yield chunk


-_EMPTY_VIEWER_GRANT: Final[ViewerGrant] = ViewerGrant(
-    viewer_ids=[],
-    viewer_group_ids=[],
-)
-
-
 class _DocumentViewerStream(QuerySetStream["Document"]):
    """Yield document permission data while batch-loading grants.

@@ -1231,7 +1213,7 @@ class _DocumentViewerStream(QuerySetStream["Document"]):
        for chunk in chunked(documents, self._chunk_size):
            grants_by_pk = _bulk_get_viewer_permissions([doc.pk for doc in chunk])
            for doc in chunk:
-                yield doc, grants_by_pk.get(doc.pk, _EMPTY_VIEWER_GRANT)
+                yield doc, grants_by_pk[doc.pk]


 def _bulk_get_viewer_permissions(
@@ -1243,48 +1225,19 @@ def _bulk_get_viewer_permissions(
    requesting user's current memberships. Expanding groups to user IDs here
    would leave stale access behind after a user is removed from a group.
    """
-    from collections import defaultdict
-
-    from django.contrib.contenttypes.models import ContentType
-    from guardian.models import GroupObjectPermission
-    from guardian.models import UserObjectPermission
-
    from documents.models import Document
-
-    # get_for_model is cached by Django, so this costs at most one query total.
-    ct = ContentType.objects.get_for_model(Document)
-    str_pks = [str(pk) for pk in doc_pks]
-
-    viewer_map: dict[int, set[int]] = defaultdict(set)
-    viewer_group_map: dict[int, set[int]] = defaultdict(set)
-
-    # Fold the permission lookup into the query via a join on codename instead
-    # of a separate Permission.objects.get(), which would otherwise run once per
-    # chunk during a full reindex.
-    user_qs = UserObjectPermission.objects.filter(
-        content_type=ct,
-        permission__content_type=ct,
-        permission__codename="view_document",
-        object_pk__in=str_pks,
-    ).values_list("object_pk", "user_id")
-    for object_pk, user_id in user_qs:
-        viewer_map[int(object_pk)].add(user_id)
-
-    group_qs = GroupObjectPermission.objects.filter(
-        content_type=ct,
-        permission__content_type=ct,
-        permission__codename="view_document",
-        object_pk__in=str_pks,
-    ).values_list("object_pk", "group_id")
-    for object_pk, group_id in group_qs:
-        viewer_group_map[int(object_pk)].add(group_id)
+    from documents.permissions import get_permission_grantees

    return {
-        object_pk: ViewerGrant(
-            viewer_ids=list(viewer_map.get(object_pk, ())),
-            viewer_group_ids=list(viewer_group_map.get(object_pk, ())),
+        pk: ViewerGrant(
+            viewer_ids=grantees["view"]["users"],
+            viewer_group_ids=grantees["view"]["groups"],
        )
-        for object_pk in viewer_map.keys() | viewer_group_map.keys()
+        for pk, grantees in get_permission_grantees(
+            Document,
+            doc_pks,
+            actions=("view",),
+        ).items()
    }


@@ -8,7 +8,6 @@ from datetime import timedelta
 from decimal import Decimal
 from typing import TYPE_CHECKING
 from typing import Any
-from typing import Literal
 from typing import TypedDict

 import magic
@@ -39,7 +38,6 @@ from drf_spectacular.utils import extend_schema_field
 from drf_spectacular.utils import extend_schema_serializer
 from drf_writable_nested.serializers import NestedUpdateMixin
 from guardian.core import ObjectPermissionChecker
-from guardian.shortcuts import get_users_with_perms
 from guardian.utils import get_group_obj_perms_model
 from guardian.utils import get_user_obj_perms_model
 from rest_framework import fields
@@ -78,12 +76,17 @@ from documents.models import WorkflowActionEmail
 from documents.models import WorkflowActionWebhook
 from documents.models import WorkflowTrigger
 from documents.parsers import is_mime_type_supported
+from documents.permissions import PERMISSION_ACTIONS
+from documents.permissions import PermissionAction
+from documents.permissions import PermissionGrantees
+from documents.permissions import PermissionGranteesUpdate
+from documents.permissions import PermissionsSpec
 from documents.permissions import get_document_count_filter_for_user
-from documents.permissions import get_groups_with_only_permission
+from documents.permissions import get_permission_grantees
 from documents.permissions import has_perms_owner_aware
 from documents.permissions import permitted_document_ids
 from documents.permissions import restrict_queryset_to_visible
-from documents.permissions import set_permissions_for_object
+from documents.permissions import set_permissions_for_objects
 from documents.regex import validate_regex_pattern
 from documents.templating.filepath import validate_filepath_template_and_render
 from documents.templating.utils import convert_format_str_to_template_format
@@ -211,9 +214,6 @@ class MatchingModelSerializer(serializers.ModelSerializer[Any]):
        return match


-PERMISSION_ACTIONS = ("view", "change")
-
-
 class SetPermissionsMixin:
    def _validate_user_ids(self, user_ids):
        users = User.objects.none()
@@ -235,8 +235,10 @@ class SetPermissionsMixin:
                )
        return groups

-    def validate_set_permissions(self, set_permissions=None):
-        permissions_dict = {action: {} for action in PERMISSION_ACTIONS}
+    def validate_set_permissions(self, set_permissions=None) -> PermissionsSpec:
+        permissions_dict: dict[PermissionAction, PermissionGranteesUpdate] = {
+            action: {} for action in PERMISSION_ACTIONS
+        }
        if set_permissions is not None:
            for action in PERMISSION_ACTIONS:
                if action in set_permissions:
@@ -244,18 +246,18 @@ class SetPermissionsMixin:
                        users = set_permissions[action]["users"]
                        permissions_dict[action]["users"] = self._validate_user_ids(
                            users,
-                        )
+                        ).values_list("id", flat=True)
                    if "groups" in set_permissions[action]:
                        groups = set_permissions[action]["groups"]
                        permissions_dict[action]["groups"] = self._validate_group_ids(
                            groups,
-                        )
+                        ).values_list("id", flat=True)
                else:
                    del permissions_dict[action]
        return permissions_dict

-    def _set_permissions(self, permissions, object) -> None:
-        set_permissions_for_object(permissions, object)
+    def _set_permissions(self, permissions: PermissionsSpec, object) -> None:
+        set_permissions_for_objects(permissions, type(object), [object.pk])


 class SerializerWithPerms(serializers.Serializer[dict[str, Any]]):
@@ -311,35 +313,6 @@ class OwnedObjectSerializer(
            except KeyError:
                pass

-    def _get_perms(self, obj, codename: str, target: Literal["users", "groups"]):
-        """
-        Get the given permissions from context or from django-guardian.
-
-        :param codename: The permission codename, e.g. 'view' or 'change'
-        :param target: 'users' or 'groups'
-        """
-        key = f"{target}_{codename}_perms"
-        cached = self.context.get(key, {}).get(obj.pk)
-        if cached is not None:
-            return list(cached)
-
-        # Permission not found in the context, get it from guardian
-        if target == "users":
-            return list(
-                get_users_with_perms(
-                    obj,
-                    only_with_perms_in=[f"{codename}_{obj.__class__.__name__.lower()}"],
-                    with_group_users=False,
-                ).values_list("id", flat=True),
-            )
-        else:  # groups
-            return list(
-                get_groups_with_only_permission(
-                    obj,
-                    codename=f"{codename}_{obj.__class__.__name__.lower()}",
-                ).values_list("id", flat=True),
-            )
-
    @extend_schema_field(
        field={
            "type": "object",
@@ -373,17 +346,12 @@ class OwnedObjectSerializer(
            },
        },
    )
-    def get_permissions(self, obj) -> dict:
-        return {
-            "view": {
-                "users": self._get_perms(obj, "view", "users"),
-                "groups": self._get_perms(obj, "view", "groups"),
-            },
-            "change": {
-                "users": self._get_perms(obj, "change", "users"),
-                "groups": self._get_perms(obj, "change", "groups"),
-            },
-        }
+    def get_permissions(self, obj) -> dict[PermissionAction, PermissionGrantees]:
+        # Prefer the page-level batch computed by BulkPermissionMixin.
+        grantees = self.context.get("permission_grantees", {}).get(obj.pk)
+        if grantees is not None:
+            return grantees
+        return get_permission_grantees(type(obj), [obj.pk])[obj.pk]

    def get_user_can_change(self, obj) -> bool:
        if obj.owner is None or obj.owner == self.user:
@@ -399,18 +367,18 @@ class OwnedObjectSerializer(
        # Prefer the page-level batch computed by BulkPermissionMixin
        # (get_serializer_context) over a fresh per-object guardian check,
        # which would otherwise query the permission tables once per row.
-        users_change_perms = self.context.get("users_change_perms")
-        groups_change_perms = self.context.get("groups_change_perms")
-        if users_change_perms is not None and groups_change_perms is not None:
-            if self.user.pk in users_change_perms.get(obj.pk, []):
+        grantees_by_pk = self.context.get("permission_grantees")
+        if grantees_by_pk is not None:
+            change = grantees_by_pk.get(obj.pk, {}).get("change")
+            if change is None:
+                return False
+            if self.user.pk in change["users"]:
                return True
            user_group_ids = getattr(self, "_user_group_ids", None)
            if user_group_ids is None:
                user_group_ids = set(self.user.groups.values_list("id", flat=True))
                self._user_group_ids = user_group_ids
-            return bool(
-                user_group_ids.intersection(groups_change_perms.get(obj.pk, [])),
-            )
+            return bool(user_group_ids.intersection(change["groups"]))

        checker = ObjectPermissionChecker(self.user)
        return checker.has_perm(f"change_{obj.__class__.__name__.lower()}", obj)
@@ -3088,7 +3056,7 @@ class BulkEditObjectsSerializer(SerializerWithPerms, SetPermissionsMixin):
            )
        return objects

-    def _validate_permissions(self, permissions) -> dict:
+    def _validate_permissions(self, permissions) -> PermissionsSpec:
        return self.validate_set_permissions(
            permissions,
        )
@@ -1381,9 +1381,17 @@ def task_revoked_handler(
        return
    try:
        close_old_connections()
+        reason = "Task revoked before completion."
+        if expired:
+            reason = "Task expired before execution."
+        elif terminated:
+            reason = "Task terminated during execution."
        PaperlessTask.objects.filter(task_id=task_id).update(
            status=PaperlessTask.Status.REVOKED,
            date_done=timezone.now(),
+            result_data={
+                "reason": (reason + " Check worker logs for details."),
+            },
        )
    except Exception:  # pragma: no cover
        logger.exception("Updating PaperlessTask on revocation failed")
@@ -76,9 +76,6 @@ from paperless.logging import consume_task_id
 from paperless.parsers import ParserContext
 from paperless.parsers.registry import get_parser_registry
 from paperless_ai.exceptions import LLMTimeoutError
-from paperless_ai.indexing import llm_index_add_or_update_document
-from paperless_ai.indexing import llm_index_remove_document
-from paperless_ai.indexing import update_llm_index

 if settings.AUDIT_LOG_ENABLED:
    from auditlog.models import LogEntry
@@ -339,6 +336,8 @@ def bulk_update_documents(document_ids) -> None:

    ai_config = AIConfig()
    if ai_config.llm_index_enabled:
+        from paperless_ai.indexing import update_llm_index
+
        update_llm_index(
            rebuild=False,
            document_ids=document_ids,
@@ -499,6 +498,8 @@ def update_document_content_maybe_archive_file(

            ai_config = AIConfig()
            if ai_config.llm_index_enabled:
+                from paperless_ai.indexing import llm_index_add_or_update_document
+
                llm_index_add_or_update_document(document)

            clear_document_caches(document.pk)
@@ -800,11 +801,15 @@ def apply_ai_suggestions(self, action_id: int, document_id: int) -> None:

@shared_task
 def update_document_in_llm_index(document) -> None:
+    from paperless_ai.indexing import llm_index_add_or_update_document
+
    llm_index_add_or_update_document(document)


@shared_task
 def remove_document_from_llm_index(document) -> None:
+    from paperless_ai.indexing import llm_index_remove_document
+
    llm_index_remove_document(document)


@@ -1,4 +1,5 @@
 import logging
+from collections.abc import Iterable
 from datetime import date
 from datetime import datetime
 from pathlib import Path
@@ -13,7 +14,9 @@ from jinja2 import make_logging_undefined
 from jinja2.meta import find_undeclared_variables
 from jinja2.sandbox import SecurityError

+from documents.models import CustomFieldInstance
 from documents.templating.environment import _template_environment
+from documents.templating.filepath import get_custom_fields_context
 from documents.templating.filters import format_datetime
 from documents.templating.filters import localize_date

@@ -56,6 +59,7 @@ _known_placeholder_names = {
    "doc_title",
    "doc_url",
    "doc_id",
+    "custom_fields",
 }


@@ -86,6 +90,7 @@ def parse_w_workflow_placeholders(
    doc_title: str | None = None,
    doc_url: str | None = None,
    doc_id: int | None = None,
+    custom_fields: Iterable[CustomFieldInstance] = (),
 ) -> str:
    """
    Available title placeholders for Workflows depend on what has already been assigned,
@@ -108,6 +113,7 @@ def parse_w_workflow_placeholders(
        "original_filename": Path(original_filename).stem,
        "filename": Path(filename).stem,
    }
+    formatting.update(get_custom_fields_context(custom_fields))
    if created is not None:
        formatting.update(
            {
Author	SHA1	Message	Date
shamoon	b67cfdf3fd	Bump version to 3.4.1	2026-10-30 22:20:31 -07:00
github-actions[bot]andCrowdin Bot	98d2ddd1c6	New Crowdin translations by GitHub Action (#14584 ) Co-authored-by: Crowdin Bot <support+bot@crowdin.com>	2026-10-31 05:12:07 +00:00
GitHub Actions	91b35eada6	Auto translate strings	2026-10-31 04:48:33 +00:00
shamoon	11248f776d	Fix: fix the id__none schema in the right place (#14604 )	2026-10-30 21:47:12 -07:00
shamoon	331fa13088	Fix: drop redundant change perms checks on cards open button (#14601 )	2026-10-30 16:16:48 -07:00
shamoon	ebddd5687c	Chore: fix a couple e2e warnings / flakiness (#14596 )	2026-10-30 15:45:46 -07:00
Trenton H	2925b8de81	Chore: Skip repeating Django system checks in the Docker consumer, scheduler and worker (#14598 ) The init-system-checks step already runs them once and all three services depend on init-complete. Measured idle anon PSS saved on Python 3.14: consumer 14 MiB, beat 26 MiB, worker 27 MiB.	2026-10-30 22:37:37 +00:00
GitHub Actions	5e397e1222	Auto translate strings	2026-10-30 22:26:54 +00:00
Trenton H	6f99ad9469	Chore: Improve idle memory via more lazy imports (#14599 ) * Chore: Import dateparser lazily so processes that never parse dates skip it * Chore: Import turbohtml lazily in the mail parser * Chore: Import lxml lazily in the SVG validator * Chore: Import paperless_ai.indexing lazily in document tasks * Chore: Import paperless_ai helpers lazily in views * Chore: Read the OCRmyPDF sRGB profile on first use instead of at import * Chore: Import pikepdf and img2pdf lazily so startup does not load them * Chore: Reuse the initialized Django ASGI application for HTTP routing	2026-10-30 22:25:42 +00:00
shamoon	a5d3247ca7	Tweakhancement: make new pdf controls mostly hidden (#14595 )	2026-10-30 10:22:50 -07:00
GitHub Actions	8a67481a9d	Auto translate strings	2026-10-30 16:59:59 +00:00
shamoon	652f964f5d	Tweak: move preview button in doc list (#14594 )	2026-10-30 09:58:29 -07:00
shamoon	80a1827fa0	Fix: checksum light mode display and cf dropdown mobile position (#14590 )	2026-10-30 07:03:08 -07:00
github-actions[bot]andshamoon	e240c89f27	Documentation: Add v3.4.0 changelog (#14582 ) * Changelog v3.4.0 - GHA * Remove 3.3.4 PR --------- Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: shamoon <4887959+shamoon@users.noreply.github.com>	2026-10-29 15:45:43 -07:00
shamoon	ced3cf9303	Bump version to 3.4.0	2026-10-29 15:11:14 -07:00
Trenton HandClaude Sonnet 5.5	08a7d1d4b8	Chore: Consolidate test sample files (#14430 ) Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-29 12:43:51 -07:00
github-actions[bot]andCrowdin Bot	47052d6506	New Crowdin translations by GitHub Action (#14499 ) Co-authored-by: Crowdin Bot <support+bot@crowdin.com>	2026-10-29 18:35:37 +00:00
shamoon	9bd28d3e57	Chore: bump some frontend deps for security fixes (#14581 )	2026-10-29 11:09:55 -07:00
shamoon	9c4c9f2386	Enhancement: support custom fields in workflow title templates (#14564 )	2026-10-29 17:40:53 +00:00
GitHub Actions	cc54e3e5aa	Auto translate strings	2026-10-29 17:26:37 +00:00
shamoon	67c194978e	Enhancement: relative date custom field queries (#14549 )	2026-10-29 17:25:21 +00:00
shamoon	c21bdab5c8	Fix: truncate long version labels in dropdown (#14578 )	2026-10-28 15:44:52 -07:00
Trenton H	ea9e5e0732	Chore: bump brotli, djangorestframework, filelock, msgpack, setuptools for security fixes (#14575 )	2026-10-28 15:38:15 -07:00
Trenton H	ac955efdbf	Chore: bump django-allauth to 65.20 and oauthlib to 4.0 (#14570 ) allauth 65.20 is the first release allowing oauthlib 4, which carries the fixes for the open oauthlib advisories	2026-10-28 09:55:07 -07:00
shamoon	ec52490e4a	Fixhancement: show better result for revoked / expired tasks (#14566 )	2026-10-28 08:59:07 -07:00
GitHub Actions	fed9e8d783	Auto translate strings	2026-10-28 02:55:55 +00:00
shamoon	d4457efe44	Fix: move re-index after workflow runs on doc edit (#14558 )	2026-10-27 19:54:30 -07:00
Jan Kleineandshamoon	7d8147c21d	Performance: reduce tasks badge load times (#14552 ) --------- Co-authored-by: shamoon <4887959+shamoon@users.noreply.github.com>	2026-10-26 14:23:33 +00:00
GitHub Actions	5f17b1a310	Auto translate strings	2026-10-24 21:12:29 +00:00
shamoon	63eca7b427	Enhancement: skip local 2FA for trusted OIDC AMR (#14403 )	2026-10-24 21:11:10 +00:00
GitHub Actions	c88d02ab42	Auto translate strings	2026-10-24 20:30:00 +00:00
Trenton H	4299e9b12e	Chore: consolidate direct permission grant lookups into one helper (#14456 ) * Chore: drop get_groups_with_only_permission It worked around get_groups_with_perms lacking only_with_perms_in, which django-guardian added in 3.1.0. The pinned version is newer. * Chore: consolidate direct grant lookups into get_permission_grantees Six places listed who holds a permission on an object, each with its own query and result shape, and one had already drifted into expanding group members. * Chore: drop the unreachable empty viewer grant default get_permission_grantees returns an entry for every requested document.	2026-10-24 13:28:25 -07:00
Trenton H	10a1a9eae8	Chore: drop get_groups_with_only_permission (#14454 ) It worked around get_groups_with_perms lacking only_with_perms_in, which django-guardian added in 3.1.0. The pinned version is newer.	2026-10-24 13:28:25 -07:00
Trenton H	e7d70497c2	Chore: Consolidate to a single way to set permission on an object (#14453 ) * Chore: drop set_permissions_for_object in favor of the bulk helper The same grant rules were implemented twice, and only the bulk version validated every action before writing, so the single-object one could leave a partial change behind. * Chore: type the set-permissions dict Callers passed whatever they had, including querysets of User and Group objects that only worked because id__in accepts a subquery.	2026-10-24 13:28:25 -07:00
shamoon	a74256cd2a	Update SECURITY.md	2026-10-23 17:04:58 -07:00