Fix: simplify CI apt caching and mirror handling

Let apt resolve package aliases and missing dependencies while reusing cached downloads. Support Azure mirror replacement in both hosted runners and job containers, and keep timeouts limited to downloads. Co-Authored-By: Codex <267193182+codex@users.noreply.github.com>
Lets just see this idea
2026-11-01 20:45:35 +00:00 · 2026-10-26 08:12:42 -07:00 · 2026-10-22 16:03:07 -07:00
235 changed files with 37182 additions and 50784 deletions
@@ -1,53 +1,53 @@
 name: Install apt packages
 description: >
-  Installs apt packages with a per-attempt timeout and retries. The hosted runner's Azure apt mirror intermittently serves archives at a crawl, which apt's own timeout does not catch. A stuck attempt is killed and retried, which usually lands on a healthy mirror node.
+  Installs apt packages using Ubuntu mirrors and bounded download retries. Caches downloaded packages as an optimization; apt resolves dependencies on every run.

 inputs:
  packages:
-    description: Space separated list of packages to install
+    description: Space separated list of package names to install
    required: true
  attempts:
-    description: Maximum number of attempts
+    description: Maximum number of download attempts
    default: "3"
  attempt-timeout:
-    description: Seconds before a single attempt is killed
+    description: Seconds before a single download attempt is killed
    default: "180"
 runs:
  using: composite
  steps:
+    - name: Identify apt cache
+      id: cache-key
+      shell: bash
+      env:
+        PACKAGES: ${{ inputs.packages }}
+      run: |
+        . /etc/os-release
+        packages_hash=$(printf '%s' "$PACKAGES" | sha256sum | cut -d ' ' -f 1)
+        # Cached downloads are optional: apt fetches any missing/newer packages.
+        # Refresh weekly, including inside job containers without ImageVersion.
+        echo "key=apt-v2-${ID}-${VERSION_ID}-$(dpkg --print-architecture)-$(date -u +%G-%V)-${packages_hash}" >> "$GITHUB_OUTPUT"
+    - name: Restore apt packages
+      id: cache
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: |
+          ${{ runner.temp }}/apt-packages/*.deb
+          ${{ runner.temp }}/apt-packages/.keep
+        key: ${{ steps.cache-key.outputs.key }}
    - name: Install ${{ inputs.packages }}
      shell: bash
      env:
        PACKAGES: ${{ inputs.packages }}
        ATTEMPTS: ${{ inputs.attempts }}
        ATTEMPT_TIMEOUT: ${{ inputs.attempt-timeout }}
-      run: |
-        SUDO=""
-        if [ "$(id -u)" -ne 0 ]; then
-          SUDO="sudo"
-        fi
-
-        attempt_install() {
-          $SUDO apt-get update -q
-          # Intentionally unquoted, this is a list of package names
-          $SUDO apt-get install -q --yes --no-install-recommends $PACKAGES
-        }
-        export -f attempt_install
-        export SUDO PACKAGES
-
-        for attempt in $(seq 1 "${ATTEMPTS}"); do
-          echo "::group::apt install attempt ${attempt}/${ATTEMPTS}"
-          start=$(date +%s)
-          if timeout --kill-after=10 "${ATTEMPT_TIMEOUT}" bash -c attempt_install; then
-            echo "::endgroup::"
-            echo "Installed in $(( $(date +%s) - start ))s"
-            exit 0
-          fi
-          echo "::endgroup::"
-          echo "::warning::apt install attempt ${attempt}/${ATTEMPTS} failed or exceeded ${ATTEMPT_TIMEOUT}s"
-          # A killed attempt can leave dpkg half configured
-          $SUDO dpkg --configure -a || true
-        done
-
-        echo "::error::apt install failed after ${ATTEMPTS} attempts"
-        exit 1
+        CACHE_DIR: ${{ runner.temp }}/apt-packages
+      run: bash "$GITHUB_ACTION_PATH/install.sh"
+    # Save immediately: a later test failure must not discard downloaded packages.
+    - name: Save apt packages
+      if: steps.cache.outputs.cache-hit != 'true'
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: |
+          ${{ runner.temp }}/apt-packages/*.deb
+          ${{ runner.temp }}/apt-packages/.keep
+        key: ${{ steps.cache-key.outputs.key }}
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Run as root in the timed child process. Only downloads may be interrupted.
+if [ "${1:-}" = download ]; then
+	download_archive_dir=$2
+	shift 2
+	apt-get update -q
+	apt-get install -q --yes --no-install-recommends --download-only \
+		-o "Dir::Cache::archives=$download_archive_dir" "$@"
+	exit 0
+fi
+
+SUDO=()
+if [ "$(id -u)" -ne 0 ]; then
+	SUDO=(sudo)
+fi
+read -r -a requested_packages <<< "$PACKAGES"
+mkdir -p "$CACHE_DIR"
+touch "$CACHE_DIR/.keep"
+
+# Hosted runners use a mirror list; job containers can point directly at Azure.
+# Handle both layouts, leaving other repositories and signature checks intact.
+if [ -f /etc/apt/apt-mirrors.txt ]; then
+	"${SUDO[@]}" sed -i '\|azure\.archive\.ubuntu\.com|d' /etc/apt/apt-mirrors.txt
+fi
+for source in /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do
+	if [ -f "$source" ]; then
+		"${SUDO[@]}" sed -i 's|azure\.archive\.ubuntu\.com|archive.ubuntu.com|g' "$source"
+	fi
+done
+
+for attempt in $(seq 1 "$ATTEMPTS"); do
+	echo "::group::apt download attempt ${attempt}/${ATTEMPTS}"
+	if timeout --kill-after=10 "$ATTEMPT_TIMEOUT" "${SUDO[@]}" bash "$0" download "$CACHE_DIR" "${requested_packages[@]}"; then
+		echo "::endgroup::"
+		# Apt handles aliases (e.g. libmagic1 -> libmagic1t64) and dependencies.
+		"${SUDO[@]}" apt-get install -q --yes --no-install-recommends --no-download \
+			-o "Dir::Cache::archives=$CACHE_DIR" "${requested_packages[@]}"
+		# Allow the unprivileged cache action to read archives downloaded as root.
+		find "$CACHE_DIR" -maxdepth 1 -name '*.deb' -exec "${SUDO[@]}" chmod a+r {} +
+		exit 0
+	fi
+	echo "::endgroup::"
+	echo "::warning::apt download attempt ${attempt}/${ATTEMPTS} failed or exceeded ${ATTEMPT_TIMEOUT}s"
+done
+
+echo "::error::apt download failed after ${ATTEMPTS} attempts"
+exit 1
@@ -76,6 +76,7 @@ jobs:
              - 'uv.lock'
              - 'docker/compose/docker-compose.ci-test.yml'
              - '.github/workflows/ci-backend.yml'
+              - '.github/actions/apt-install/**'
  test:
    needs: changes
    if: needs.changes.outputs.backend_changed == 'true'
@@ -68,6 +68,7 @@ jobs:
            frontend:
              - 'src-ui/**'
              - '.github/workflows/ci-frontend.yml'
+              - '.github/actions/apt-install/**'
  install-dependencies:
    needs: changes
    if: needs.changes.outputs.frontend_changed == 'true'
@@ -61,7 +61,6 @@ The following are not generally considered vulnerabilities unless accompanied by
 - claims based solely on the presence of a library, framework feature or code pattern without a working exploit
 - pickle deserialization of internal data from trusted components such as the Redis-compatible broker or Paperless-ngx data directory
 - users with permission to edit users granting themselves additional privileges; this is expected behavior for that trusted permission
- users with change permission on a mail account redirecting stored credentials to another mail server, including through connectivity tests. Mail account editing is a trusted permission, and UI password masking does not imply credential isolation from account editors
 - reports that rely on admin-level access, application-configuration access, workflow-editing privileges, shell access, or other high-trust roles unless they demonstrate an unintended privilege boundary bypass
 - optional webhook, mail, AI, OCR, or integration behavior described without a product-level vulnerability
 - missing limits or hardening settings presented without concrete impact
@@ -4,7 +4,7 @@
 # correct networking for the tests
 services:
  gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.38
+    image: docker.io/gotenberg/gotenberg:8.37
    hostname: gotenberg
    container_name: gotenberg
    network_mode: host
@@ -71,7 +71,7 @@ services:
      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
  gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.38
+    image: docker.io/gotenberg/gotenberg:8.37
    restart: unless-stopped
    # The gotenberg chromium route is used to convert .eml files. We do not
    # want to allow external content like tracking pixels or even javascript.
@@ -67,7 +67,7 @@ services:
      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
  gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.38
+    image: docker.io/gotenberg/gotenberg:8.37
    restart: unless-stopped
    # The gotenberg chromium route is used to convert .eml files. We do not
    # want to allow external content like tracking pixels or even javascript.
@@ -56,7 +56,7 @@ services:
      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
  gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.38
+    image: docker.io/gotenberg/gotenberg:8.37
    restart: unless-stopped
    # The gotenberg chromium route is used to convert .eml files. We do not
    # want to allow external content like tracking pixels or even javascript.
@@ -10,11 +10,9 @@ if [[ -n "${PAPERLESS_CONSUMER_DISABLE}" ]]; then
 else
 	cd ${PAPERLESS_SRC_DIR}

-	# Django system checks already ran once in init-system-checks, skip repeating them
-
 	if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-		exec python3 manage.py document_consumer --skip-checks
+		exec python3 manage.py document_consumer
 	else
-		exec s6-setuidgid paperless python3 manage.py document_consumer --skip-checks
+		exec s6-setuidgid paperless python3 manage.py document_consumer
 	fi
 fi
@@ -3,9 +3,8 @@

 cd ${PAPERLESS_SRC_DIR}

-# Django system checks already ran once in init-system-checks, skip repeating them
 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	exec /usr/local/bin/celery --skip-checks --app paperless beat --loglevel INFO
+	exec /usr/local/bin/celery --app paperless beat --loglevel INFO
 else
-	exec s6-setuidgid paperless /usr/local/bin/celery --skip-checks --app paperless beat --loglevel INFO
+	exec s6-setuidgid paperless /usr/local/bin/celery --app paperless beat --loglevel INFO
 fi
@@ -3,9 +3,8 @@

 cd ${PAPERLESS_SRC_DIR}

-# Django system checks already ran once in init-system-checks, skip repeating them
 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	exec /usr/local/bin/celery --skip-checks --app paperless worker --loglevel INFO --without-mingle --without-gossip
+	exec /usr/local/bin/celery --app paperless worker --loglevel INFO --without-mingle --without-gossip
 else
-	exec s6-setuidgid paperless /usr/local/bin/celery --skip-checks --app paperless worker --loglevel INFO --without-mingle --without-gossip
+	exec s6-setuidgid paperless /usr/local/bin/celery --app paperless worker --loglevel INFO --without-mingle --without-gossip
 fi
@@ -162,17 +162,6 @@ including `gt` (>), `gte` (>=), `lt` (<), `lte` (<=), and `range`.
 Lastly, document link fields support a `contains` operator that behaves
 like a "is superset of" check.

-Date fields also accept relative expressions supported by
-[dateparser](https://dateparser.readthedocs.io/en/stable/), such as `today`,
-`in 30 days`, or `1 month ago`. For example, dates within the next 30 days:
-
-```json
-["expiry", "range", ["today", "in 30 days"]]
-```
-
-Expressions resolve each time the query runs, using `PAPERLESS_TIME_ZONE` and
-`PAPERLESS_DATE_PARSER_LANGUAGES` (automatic language detection when unset).
-
 ### `/api/search/autocomplete/`

 Get auto completions for a partial search term.
@@ -1,115 +1,5 @@
 # Changelog

-## paperless-ngx 3.4.1
-
-### Bug Fixes
-
- Fix the id\_\_ schemae in the right place [@shamoon](https://github.com/shamoon) ([#14604](https://github.com/paperless-ngx/paperless-ngx/pull/14604))
- Fix: drop redundant change perms checks on cards open button [@shamoon](https://github.com/shamoon) ([#14601](https://github.com/paperless-ngx/paperless-ngx/pull/14601))
- Tweak/fix: make new pdf controls mostly hidden [@shamoon](https://github.com/shamoon) ([#14595](https://github.com/paperless-ngx/paperless-ngx/pull/14595))
- Tweak/fix: move preview button in doc list [@shamoon](https://github.com/shamoon) ([#14594](https://github.com/paperless-ngx/paperless-ngx/pull/14594))
- Fix: checksum light mode display and cf dropdown mobile position [@shamoon](https://github.com/shamoon) ([#14590](https://github.com/paperless-ngx/paperless-ngx/pull/14590))
-
-### All App Changes
-
-<details>
-<summary>6 changes</summary>
-
- Fix the id\_\_ schemae in the right place [@shamoon](https://github.com/shamoon) ([#14604](https://github.com/paperless-ngx/paperless-ngx/pull/14604))
- Fix: drop redundant change perms checks on cards open button [@shamoon](https://github.com/shamoon) ([#14601](https://github.com/paperless-ngx/paperless-ngx/pull/14601))
- Chore: Improve idle memory via more lazy imports [@stumpylog](https://github.com/stumpylog) ([#14599](https://github.com/paperless-ngx/paperless-ngx/pull/14599))
- Tweak/fix: make new pdf controls mostly hidden [@shamoon](https://github.com/shamoon) ([#14595](https://github.com/paperless-ngx/paperless-ngx/pull/14595))
- Tweak/fix: move preview button in doc list [@shamoon](https://github.com/shamoon) ([#14594](https://github.com/paperless-ngx/paperless-ngx/pull/14594))
- Fix: checksum light mode display and cf dropdown mobile position [@shamoon](https://github.com/shamoon) ([#14590](https://github.com/paperless-ngx/paperless-ngx/pull/14590))
-
-</details>
-
-## paperless-ngx 3.4.0
-
-### Features / Enhancements
-
- Enhancement: support custom fields in workflow title templates [@shamoon](https://github.com/shamoon) ([#14564](https://github.com/paperless-ngx/paperless-ngx/pull/14564))
- Enhancement: relative date custom field queries [@shamoon](https://github.com/shamoon) ([#14549](https://github.com/paperless-ngx/paperless-ngx/pull/14549))
- Performance: reduce tasks badge load times [@JanKleine](https://github.com/JanKleine) ([#14552](https://github.com/paperless-ngx/paperless-ngx/pull/14552))
- Enhancement: skip local 2FA for trusted OIDC AMR [@shamoon](https://github.com/shamoon) ([#14403](https://github.com/paperless-ngx/paperless-ngx/pull/14403))
- Feature: Generate PDF thumbnails via poppler utils [@stumpylog](https://github.com/stumpylog) ([#14420](https://github.com/paperless-ngx/paperless-ngx/pull/14420))
- Enhancement: add upload count to button, link to tray, reduce notifications [@shamoon](https://github.com/shamoon) ([#14501](https://github.com/paperless-ngx/paperless-ngx/pull/14501))
- Enhancement: notifications improvements [@shamoon](https://github.com/shamoon) ([#14500](https://github.com/paperless-ngx/paperless-ngx/pull/14500))
- Enhancement: doc details ux improvements [@shamoon](https://github.com/shamoon) ([#14485](https://github.com/paperless-ngx/paperless-ngx/pull/14485))
- Enhancement (QoL): allow independently toggling child + parent tags in WF tag fields [@shamoon](https://github.com/shamoon) ([#14400](https://github.com/paperless-ngx/paperless-ngx/pull/14400))
- Tweak: drop the user dropdown caret [@shamoon](https://github.com/shamoon) ([#14444](https://github.com/paperless-ngx/paperless-ngx/pull/14444))
- Enhancement: navbar upload button [@shamoon](https://github.com/shamoon) ([#14442](https://github.com/paperless-ngx/paperless-ngx/pull/14442))
- Enhancement: AI chat UX tweaks [@shamoon](https://github.com/shamoon) ([#14415](https://github.com/paperless-ngx/paperless-ngx/pull/14415))
- Enhancement: support markdown in AI chat [@shamoon](https://github.com/shamoon) ([#14409](https://github.com/paperless-ngx/paperless-ngx/pull/14409))
-
-### Bug Fixes
-
- Fix: truncate long version labels in dropdown [@shamoon](https://github.com/shamoon) ([#14578](https://github.com/paperless-ngx/paperless-ngx/pull/14578))
- Fixhancement: show better result for revoked / expired tasks [@shamoon](https://github.com/shamoon) ([#14566](https://github.com/paperless-ngx/paperless-ngx/pull/14566))
- Fix: move re-index after workflow runs on doc edit [@shamoon](https://github.com/shamoon) ([#14558](https://github.com/paperless-ngx/paperless-ngx/pull/14558))
- Fix: folder export with --delete fails on a stale manifest.json.tmp [@benpetty](https://github.com/benpetty) ([#14526](https://github.com/paperless-ngx/paperless-ngx/pull/14526))
- Fix: fix list type for api schema document object filters [@shamoon](https://github.com/shamoon) ([#14524](https://github.com/paperless-ngx/paperless-ngx/pull/14524))
- Fix: standardize some dropdown sizing [@shamoon](https://github.com/shamoon) ([#14510](https://github.com/paperless-ngx/paperless-ngx/pull/14510))
- Fix: prevent doc permissions queries on schema view [@shamoon](https://github.com/shamoon) ([#14503](https://github.com/paperless-ngx/paperless-ngx/pull/14503))
- Fix: dont defer tag assignment when barcode will not result in a split [@shamoon](https://github.com/shamoon) ([#14497](https://github.com/paperless-ngx/paperless-ngx/pull/14497))
-
-### Dependencies
-
-<details>
-<summary>6 changes</summary>
-
- Chore: bump some frontend deps for security fixes [@shamoon](https://github.com/shamoon) ([#14581](https://github.com/paperless-ngx/paperless-ngx/pull/14581))
- Chore: bump brotli, djangorestframework, filelock, msgpack, setuptools for security fixes [@stumpylog](https://github.com/stumpylog) ([#14575](https://github.com/paperless-ngx/paperless-ngx/pull/14575))
- Chore: bump django-allauth to 65.20 and oauthlib to 4.0 [@stumpylog](https://github.com/stumpylog) ([#14570](https://github.com/paperless-ngx/paperless-ngx/pull/14570))
- Chore(deps): Bump the uv group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14517](https://github.com/paperless-ngx/paperless-ngx/pull/14517))
- Chore(deps): Bump the uv group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14493](https://github.com/paperless-ngx/paperless-ngx/pull/14493))
- Chore: Drop ImageMagik as a dependency [@stumpylog](https://github.com/stumpylog) ([#14440](https://github.com/paperless-ngx/paperless-ngx/pull/14440))
-
-</details>
-
-### All App Changes
-
-<details>
-<summary>35 changes</summary>
-
- Chore: Consolidate test sample files [@stumpylog](https://github.com/stumpylog) ([#14430](https://github.com/paperless-ngx/paperless-ngx/pull/14430))
- Chore: bump some frontend deps for security fixes [@shamoon](https://github.com/shamoon) ([#14581](https://github.com/paperless-ngx/paperless-ngx/pull/14581))
- Enhancement: support custom fields in workflow title templates [@shamoon](https://github.com/shamoon) ([#14564](https://github.com/paperless-ngx/paperless-ngx/pull/14564))
- Enhancement: relative date custom field queries [@shamoon](https://github.com/shamoon) ([#14549](https://github.com/paperless-ngx/paperless-ngx/pull/14549))
- Fix: truncate long version labels in dropdown [@shamoon](https://github.com/shamoon) ([#14578](https://github.com/paperless-ngx/paperless-ngx/pull/14578))
- Chore: bump brotli, djangorestframework, filelock, msgpack, setuptools for security fixes [@stumpylog](https://github.com/stumpylog) ([#14575](https://github.com/paperless-ngx/paperless-ngx/pull/14575))
- Chore: bump django-allauth to 65.20 and oauthlib to 4.0 [@stumpylog](https://github.com/stumpylog) ([#14570](https://github.com/paperless-ngx/paperless-ngx/pull/14570))
- Fixhancement: show better result for revoked / expired tasks [@shamoon](https://github.com/shamoon) ([#14566](https://github.com/paperless-ngx/paperless-ngx/pull/14566))
- Fix: move re-index after workflow runs on doc edit [@shamoon](https://github.com/shamoon) ([#14558](https://github.com/paperless-ngx/paperless-ngx/pull/14558))
- Performance: reduce tasks badge load times [@JanKleine](https://github.com/JanKleine) ([#14552](https://github.com/paperless-ngx/paperless-ngx/pull/14552))
- Enhancement: skip local 2FA for trusted OIDC AMR [@shamoon](https://github.com/shamoon) ([#14403](https://github.com/paperless-ngx/paperless-ngx/pull/14403))
- Chore: consolidate direct permission grant lookups into one helper [@stumpylog](https://github.com/stumpylog) ([#14456](https://github.com/paperless-ngx/paperless-ngx/pull/14456))
- Chore: drop get\_groups\_with\_only\_permission [@stumpylog](https://github.com/stumpylog) ([#14454](https://github.com/paperless-ngx/paperless-ngx/pull/14454))
- Chore: Consolidate to a single way to set permission on an object [@stumpylog](https://github.com/stumpylog) ([#14453](https://github.com/paperless-ngx/paperless-ngx/pull/14453))
- Chore: Refactor bulk edit to remove PDF knowledge [@stumpylog](https://github.com/stumpylog) ([#14445](https://github.com/paperless-ngx/paperless-ngx/pull/14445))
- Fix: folder export with --delete fails on a stale manifest.json.tmp [@benpetty](https://github.com/benpetty) ([#14526](https://github.com/paperless-ngx/paperless-ngx/pull/14526))
- Chore(deps): Bump the uv group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14517](https://github.com/paperless-ngx/paperless-ngx/pull/14517))
- Fix: fix list type for api schema document object filters [@shamoon](https://github.com/shamoon) ([#14524](https://github.com/paperless-ngx/paperless-ngx/pull/14524))
- Chore(deps): Bump the uv group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14493](https://github.com/paperless-ngx/paperless-ngx/pull/14493))
- Chore: drop get\_objects\_for\_user\_owner\_aware [@stumpylog](https://github.com/stumpylog) ([#14457](https://github.com/paperless-ngx/paperless-ngx/pull/14457))
- Chore: update Angular components to 22.2.2 [@shamoon](https://github.com/shamoon) ([#14515](https://github.com/paperless-ngx/paperless-ngx/pull/14515))
- Chore: share one base class for the method-mapped permission classes [@stumpylog](https://github.com/stumpylog) ([#14458](https://github.com/paperless-ngx/paperless-ngx/pull/14458))
- Fix: standardize some dropdown sizing [@shamoon](https://github.com/shamoon) ([#14510](https://github.com/paperless-ngx/paperless-ngx/pull/14510))
- Chore: Drop ImageMagik as a dependency [@stumpylog](https://github.com/stumpylog) ([#14440](https://github.com/paperless-ngx/paperless-ngx/pull/14440))
- Feature: Generate PDF thumbnails via poppler utils [@stumpylog](https://github.com/stumpylog) ([#14420](https://github.com/paperless-ngx/paperless-ngx/pull/14420))
- Fix: prevent doc permissions queries on schema view [@shamoon](https://github.com/shamoon) ([#14503](https://github.com/paperless-ngx/paperless-ngx/pull/14503))
- Enhancement: add upload count to button, link to tray, reduce notifications [@shamoon](https://github.com/shamoon) ([#14501](https://github.com/paperless-ngx/paperless-ngx/pull/14501))
- Enhancement: notifications improvements [@shamoon](https://github.com/shamoon) ([#14500](https://github.com/paperless-ngx/paperless-ngx/pull/14500))
- Enhancement: doc details ux improvements [@shamoon](https://github.com/shamoon) ([#14485](https://github.com/paperless-ngx/paperless-ngx/pull/14485))
- Enhancement (QoL): allow independently toggling child + parent tags in WF tag fields [@shamoon](https://github.com/shamoon) ([#14400](https://github.com/paperless-ngx/paperless-ngx/pull/14400))
- Tweak: drop the user dropdown caret [@shamoon](https://github.com/shamoon) ([#14444](https://github.com/paperless-ngx/paperless-ngx/pull/14444))
- Enhancement: navbar upload button [@shamoon](https://github.com/shamoon) ([#14442](https://github.com/paperless-ngx/paperless-ngx/pull/14442))
- Enhancement: AI chat UX tweaks [@shamoon](https://github.com/shamoon) ([#14415](https://github.com/paperless-ngx/paperless-ngx/pull/14415))
- Enhancement: support markdown in AI chat [@shamoon](https://github.com/shamoon) ([#14409](https://github.com/paperless-ngx/paperless-ngx/pull/14409))
- Fix: dont defer tag assignment when barcode will not result in a split [@shamoon](https://github.com/shamoon) ([#14497](https://github.com/paperless-ngx/paperless-ngx/pull/14497))
-
-</details>
-
 ## paperless-ngx 3.3.4

 ### All App Changes
@@ -803,17 +803,6 @@ system. See the corresponding

    Defaults to None

-#### [`PAPERLESS_SOCIAL_ACCOUNT_MFA_TRUSTED_AMR=<comma-separated-list>`](#PAPERLESS_SOCIAL_ACCOUNT_MFA_TRUSTED_AMR) {#PAPERLESS_SOCIAL_ACCOUNT_MFA_TRUSTED_AMR}
-
-: A list of authentication method values which, if present in the `amr` claim of the ID token sent by an OpenID Connect provider, cause Paperless-ngx to skip its own two-factor authentication prompt for that login. This avoids users having to enter a second factor twice when the identity provider already performed multi-factor authentication. Logins with a username and password, or via a provider which does not send a matching `amr` value, still require the Paperless-ngx code.
-
-    Which values to trust depends entirely on your identity provider, e.g. Authelia sends `mfa` and Pocket ID sends `phr` for passkey logins (but `otp` for single-factor email codes, which should _not_ be trusted). Some providers, such as Keycloak, do not send an `amr` claim by default and need to be configured to do so. You can see what your provider sends from the Django admin as a superuser by checking `id_token` → `amr` in the "Extra data" of the social account.
-
-    !!! warning
-        Only list values that mean a second factor was actually used for the login.
-
-    Defaults to `mfa`, the standard value for multi-factor authentication ([RFC 8176](https://www.rfc-editor.org/rfc/rfc8176.html)).
-
 #### [`PAPERLESS_SOCIAL_ACCOUNT_DEFAULT_GROUPS=<comma-separated-list>`](#PAPERLESS_SOCIAL_ACCOUNT_DEFAULT_GROUPS) {#PAPERLESS_SOCIAL_ACCOUNT_DEFAULT_GROUPS}

 : A list of group names that users who signup via social accounts will be added to upon signup. Groups listed here must already exist.
@@ -472,8 +472,6 @@ Users can enable two-factor authentication (2FA) for their accounts from the 'My

 Should a user lose access to their 2FA device and all recovery codes, a superuser can disable 2FA for the user from the 'Users & Groups' management screen.

-If users log in via an OpenID Connect provider which already enforces multi-factor authentication, see [`PAPERLESS_SOCIAL_ACCOUNT_MFA_TRUSTED_AMR`](configuration.md#PAPERLESS_SOCIAL_ACCOUNT_MFA_TRUSTED_AMR) to skip the Paperless-ngx prompt for those logins.
-
 ## Workflows

 !!! note
@@ -726,7 +724,6 @@ applied. You can use the following placeholders in the template with any trigger
 - `{{added_time}}`: added time in HH:MM format
 - `{{original_filename}}`: original file name without extension
 - `{{filename}}`: current file name without extension (for "added" workflows this may not be final yet, you can use `{{original_filename}}`)
- `{{custom_fields}}`: Custom field names mapped to their type and value, as in [file name templates](advanced_usage.md#additional-variables). For example, `{{ custom_fields.Invoice.value }}` or `{{ custom_fields | get_cf_value("Invoice", "") }}` for a fallback when the field is missing. In title assignments, fields assigned by the same action are available.
 - `{{doc_title}}`: current document title (cannot be used in title assignment)

 The following placeholders are only available for "added" or "updated" triggers
@@ -1,6 +1,6 @@
 [project]
 name = "paperless-ngx"
-version = "3.4.1"
+version = "3.3.4"
 description = """\
  A community-supported supercharged document management system: scan, index and archive all your physical documents\
  """
@@ -27,7 +27,7 @@ dependencies = [
  # WARNING: django does not use semver.
  #          Only patch versions are guaranteed to not introduce breaking changes.
  "django~=5.2.13",
-  "django-allauth[mfa,socialaccount]~=65.20.0",
+  "django-allauth[mfa,socialaccount]~=65.16.0",
  "django-auditlog~=3.4.1",
  "django-cachalot~=2.9.0",
  "django-compression-middleware~=0.5.0",
@@ -43,7 +43,7 @@ dependencies = [
  "drf-spectacular~=0.30",
  "drf-spectacular-sidecar>=2026.7.1,<2026.10",
  "drf-writable-nested~=0.7.1",
-  "filelock>=3.32,<4.3",
+  "filelock>=3.32,<4.1",
  "flower>=2.0.1,<2.3",
  "gotenberg-client[httpx]~=1.0",
  "httpx-oauth~=0.17",
@@ -256,8 +256,8 @@ isort.force-single-line = true
 [tool.codespell]
 ignore-words-list = "criterias,afterall,valeu,ureue,equest,ure,assertIn,Oktober,commitish,NIN,nin,reprot"
 skip = """\
-  src-ui/src/locale/*,src-ui/pnpm-lock.yaml,src-ui/e2e/*,src/paperless/tests/samples/mail/*,src/documents/tests/samples\
-  /*,src/paperless_testing/sample_files/*,*.po,*.json\
+  src-ui/src/locale/*,src-ui/pnpm-lock.yaml,src-ui/e2e/*,src/paperless_mail/tests/samples/*,src/paperless/tests/samples\
+  /mail/*,src/documents/tests/samples/*,*.po,*.json\
  """
 write-changes = true

@@ -43,7 +43,6 @@ def configure_environment(instance_root: Path) -> None:


 def seed_database() -> None:
-    from django.contrib.auth.models import Permission
    from django.contrib.auth.models import User
    from django.core.management import call_command
    from django.utils import timezone
@@ -64,18 +63,11 @@ def seed_database() -> None:
        username="playwright",
        password="playwright",  # NOSONAR
    )
-    viewer = User.objects.create_user(
+    User.objects.create_user(
        username="viewer",
        password="viewer",  # NOSONAR
    )

-    viewer.user_permissions.add(
-        Permission.objects.get(
-            content_type__app_label="documents",
-            codename="view_uisettings",
-        ),
-    )
-
    inbox = Tag.objects.create(name="Inbox", is_inbox_tag=True, owner=admin)
    quick_filter = Tag.objects.create(name="Another Sample Tag", owner=admin)
    Tag.objects.create(name="TagWithPartial", owner=admin)
@@ -142,9 +134,7 @@ def seed_database() -> None:
    originals.mkdir(parents=True)
    thumbnails = Path(os.environ["PAPERLESS_MEDIA_ROOT"]) / "documents" / "thumbnails"
    thumbnails.mkdir(parents=True)
-    sample_pdf = (
-        SOURCE_ROOT / "paperless_testing" / "sample_files" / "simple-digital.pdf"
-    )
+    sample_pdf = SOURCE_ROOT / "documents" / "tests" / "samples" / "simple.pdf"
    for document in documents:
        shutil.copyfile(sample_pdf, originals / document.filename)
        shutil.copyfile(
@@ -80,21 +80,12 @@ test('should show a list of notes', async ({ page }) => {

 test('should support quick filters', async ({ page }) => {
  await page.goto('/documents/1/details')
-  // filter button is available before tags have loaded
-  const selectedTags = page.locator('pngx-input-tags .ng-value pngx-tag')
-  await expect(selectedTags).toHaveCount(2)
-  await expect(
-    selectedTags.getByText('Another Sample Tag', { exact: true })
-  ).toBeVisible()
-  await expect(selectedTags.getByText('Inbox', { exact: true })).toBeVisible()
  await page
    .getByRole('button', { name: 'Filter documents with these Tags' })
    .click()
-  await expect(page).toHaveURL((url) => {
-    const tags = url.searchParams.get('tags__id__all')?.split(',').sort()
-    return url.pathname === '/documents' && tags?.join(',') === '1,2'
-  })
-  await expect(page.locator('pngx-document-list')).toHaveText(/one document/i)
+  await expect(page).toHaveURL(
+    /tags__id__all=2,1&sort=created&reverse=1&page=1/
+  )
 })

 test('should finish reloading the preview after a remote document update', async ({
@@ -6,15 +6,8 @@ test.use({
  },
 })

-test.beforeEach(async ({ page }) => {
-  const settingsLoaded = page.waitForResponse((response) =>
-    response.url().endsWith('/api/ui_settings/')
-  )
-  await page.goto('/dashboard')
-  expect((await settingsLoaded).status()).toBe(200)
-})
-
 test('should not allow user to edit settings', async ({ page }) => {
+  await page.goto('/dashboard')
  await expect(page.getByRole('link', { name: 'Settings' })).not.toBeAttached()
  await page.goto('/settings')
  await expect(page.locator('body')).toHaveText(
@@ -23,6 +16,7 @@ test('should not allow user to edit settings', async ({ page }) => {
 })

 test('should not allow user to view documents', async ({ page }) => {
+  await page.goto('/dashboard')
  await expect(
    page.locator('nav').getByRole('link', { name: 'Documents' })
  ).not.toBeAttached()
@@ -37,6 +31,7 @@ test('should not allow user to view documents', async ({ page }) => {
 })

 test('should not allow user to view correspondents', async ({ page }) => {
+  await page.goto('/dashboard')
  await expect(
    page.getByRole('link', { name: 'Attributes' })
  ).not.toBeAttached()
@@ -47,6 +42,7 @@ test('should not allow user to view correspondents', async ({ page }) => {
 })

 test('should not allow user to view tags', async ({ page }) => {
+  await page.goto('/dashboard')
  await expect(
    page.getByRole('link', { name: 'Attributes' })
  ).not.toBeAttached()
@@ -57,6 +53,7 @@ test('should not allow user to view tags', async ({ page }) => {
 })

 test('should not allow user to view document types', async ({ page }) => {
+  await page.goto('/dashboard')
  await expect(
    page.getByRole('link', { name: 'Attributes' })
  ).not.toBeAttached()
@@ -67,6 +64,7 @@ test('should not allow user to view document types', async ({ page }) => {
 })

 test('should not allow user to view storage paths', async ({ page }) => {
+  await page.goto('/dashboard')
  await expect(
    page.getByRole('link', { name: 'Attributes' })
  ).not.toBeAttached()
@@ -77,6 +75,7 @@ test('should not allow user to view storage paths', async ({ page }) => {
 })

 test('should not allow user to view logs', async ({ page }) => {
+  await page.goto('/dashboard')
  await expect(page.getByRole('link', { name: 'Logs' })).not.toBeAttached()
  await page.goto('/logs')
  await expect(page.locator('body')).toHaveText(
@@ -85,6 +84,7 @@ test('should not allow user to view logs', async ({ page }) => {
 })

 test('should not allow user to view tasks', async ({ page }) => {
+  await page.goto('/dashboard')
  await expect(page.getByRole('link', { name: 'Tasks' })).not.toBeAttached()
  await page.goto('/tasks')
  await expect(page.locator('body')).toHaveText(
@@ -1402,7 +1402,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">240,241</context>
+          <context context-type="linenumber">239,240</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/data/document.ts</context>
@@ -1733,7 +1733,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">249,250</context>
+          <context context-type="linenumber">248,249</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/filter-editor/filter-editor.component.html</context>
@@ -1768,7 +1768,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">258,259</context>
+          <context context-type="linenumber">257,258</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/filter-editor/filter-editor.component.html</context>
@@ -1811,7 +1811,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">222,223</context>
+          <context context-type="linenumber">221,222</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/filter-editor/filter-editor.component.html</context>
@@ -2048,7 +2048,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">201,202</context>
+          <context context-type="linenumber">167,168</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/filterable-dropdown/filterable-dropdown.component.html</context>
@@ -2289,7 +2289,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">267,268</context>
+          <context context-type="linenumber">266,267</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/manage/share-links/share-link-bundle-list/share-link-bundle-list.component.html</context>
@@ -4115,7 +4115,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">391</context>
+          <context context-type="linenumber">388</context>
        </context-group>
      </trans-unit>
      <trans-unit id="7515883357904500238" datatype="html">
@@ -4389,7 +4389,7 @@
        <source>Create new field</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-dropdown/custom-fields-dropdown.component.html</context>
-          <context context-type="linenumber">19</context>
+          <context context-type="linenumber">20</context>
        </context-group>
      </trans-unit>
      <trans-unit id="6973528734330066202" datatype="html">
@@ -4414,68 +4414,11 @@
          <context context-type="linenumber">96</context>
        </context-group>
      </trans-unit>
-      <trans-unit id="3625677668275605418" datatype="html">
-        <source>Date mode</source>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">38</context>
-        </context-group>
-      </trans-unit>
-      <trans-unit id="7572800523712857519" datatype="html">
-        <source>Fixed date</source>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">39</context>
-        </context-group>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">40</context>
-        </context-group>
-      </trans-unit>
-      <trans-unit id="4108478337308251505" datatype="html">
-        <source>Fixed</source>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">41,42</context>
-        </context-group>
-      </trans-unit>
-      <trans-unit id="8283919074858117329" datatype="html">
-        <source>Relative date</source>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">43</context>
-        </context-group>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">44</context>
-        </context-group>
-      </trans-unit>
-      <trans-unit id="2731996625798485199" datatype="html">
-        <source>Relative</source>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">45,46</context>
-        </context-group>
-      </trans-unit>
-      <trans-unit id="6533918067030990396" datatype="html">
-        <source>Amount</source>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">51</context>
-        </context-group>
-      </trans-unit>
-      <trans-unit id="8932917860978648376" datatype="html">
-        <source>Unit</source>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">56,57</context>
-        </context-group>
-      </trans-unit>
      <trans-unit id="9138811584797805840" datatype="html">
        <source>Open date picker</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">72</context>
+          <context context-type="linenumber">42</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/input/date/date.component.html</context>
@@ -4486,11 +4429,7 @@
        <source>Today</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">77,78</context>
-        </context-group>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts</context>
-          <context context-type="linenumber">329</context>
+          <context context-type="linenumber">47,48</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/dates-dropdown/dates-dropdown.component.html</context>
@@ -4521,7 +4460,7 @@
        <source>Close</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">78,79</context>
+          <context context-type="linenumber">48,49</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/dates-dropdown/dates-dropdown.component.html</context>
@@ -4560,62 +4499,55 @@
        <source>True</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">88,89</context>
+          <context context-type="linenumber">55,56</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">141,142</context>
+          <context context-type="linenumber">107,108</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">147,148</context>
+          <context context-type="linenumber">113,114</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3800326155195149498" datatype="html">
        <source>False</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">89,90</context>
+          <context context-type="linenumber">56,57</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">142,143</context>
+          <context context-type="linenumber">108,109</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">148,149</context>
+          <context context-type="linenumber">114,115</context>
        </context-group>
      </trans-unit>
      <trans-unit id="7551700625201096185" datatype="html">
        <source>Search docs...</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">106</context>
+          <context context-type="linenumber">73</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">164</context>
-        </context-group>
-      </trans-unit>
-      <trans-unit id="1179184907489210406" datatype="html">
-        <source>Operator</source>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">119,120</context>
+          <context context-type="linenumber">130</context>
        </context-group>
      </trans-unit>
      <trans-unit id="2328549728463836983" datatype="html">
        <source>Remove query</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">189</context>
+          <context context-type="linenumber">154</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3184700926171002527" datatype="html">
        <source>Any</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">199,200</context>
+          <context context-type="linenumber">165,166</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/filterable-dropdown/filterable-dropdown.component.html</context>
@@ -4626,84 +4558,28 @@
        <source>Not</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">204,205</context>
+          <context context-type="linenumber">170,171</context>
        </context-group>
      </trans-unit>
      <trans-unit id="6548676277933116532" datatype="html">
        <source>Add query</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">223</context>
+          <context context-type="linenumber">189</context>
        </context-group>
      </trans-unit>
      <trans-unit id="5599577087865387184" datatype="html">
        <source>Add expression</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">226</context>
+          <context context-type="linenumber">192</context>
        </context-group>
      </trans-unit>
      <trans-unit id="7394978038852129121" datatype="html">
        <source>Remove expression</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.html</context>
-          <context context-type="linenumber">230</context>
-        </context-group>
-      </trans-unit>
-      <trans-unit id="5620397708418210833" datatype="html">
-        <source>days ago</source>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts</context>
-          <context context-type="linenumber">330</context>
-        </context-group>
-      </trans-unit>
-      <trans-unit id="2871318661796659216" datatype="html">
-        <source>weeks ago</source>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts</context>
-          <context context-type="linenumber">331</context>
-        </context-group>
-      </trans-unit>
-      <trans-unit id="6041340836190906216" datatype="html">
-        <source>months ago</source>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts</context>
-          <context context-type="linenumber">332</context>
-        </context-group>
-      </trans-unit>
-      <trans-unit id="963494111451627204" datatype="html">
-        <source>years ago</source>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts</context>
-          <context context-type="linenumber">333</context>
-        </context-group>
-      </trans-unit>
-      <trans-unit id="5555905617885007774" datatype="html">
-        <source>days from now</source>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts</context>
-          <context context-type="linenumber">334</context>
-        </context-group>
-      </trans-unit>
-      <trans-unit id="4298377021616940216" datatype="html">
-        <source>weeks from now</source>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts</context>
-          <context context-type="linenumber">335</context>
-        </context-group>
-      </trans-unit>
-      <trans-unit id="2772874767134148305" datatype="html">
-        <source>months from now</source>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts</context>
-          <context context-type="linenumber">336</context>
-        </context-group>
-      </trans-unit>
-      <trans-unit id="6363533917780225967" datatype="html">
-        <source>years from now</source>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/custom-fields-query-dropdown/custom-fields-query-dropdown.component.ts</context>
-          <context context-type="linenumber">337</context>
+          <context context-type="linenumber">196</context>
        </context-group>
      </trans-unit>
      <trans-unit id="6630533861307510614" datatype="html">
@@ -4786,7 +4662,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">276,277</context>
+          <context context-type="linenumber">275,276</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/data/document.ts</context>
@@ -6604,7 +6480,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">219,220</context>
+          <context context-type="linenumber">218,219</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/filter-editor/filter-editor.component.ts</context>
@@ -8410,7 +8286,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">321</context>
+          <context context-type="linenumber">320</context>
        </context-group>
      </trans-unit>
      <trans-unit id="78870852467682010" datatype="html">
@@ -8425,7 +8301,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">363</context>
+          <context context-type="linenumber">360</context>
        </context-group>
      </trans-unit>
      <trans-unit id="157572966557284263" datatype="html">
@@ -8440,7 +8316,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">370</context>
+          <context context-type="linenumber">367</context>
        </context-group>
      </trans-unit>
      <trans-unit id="883965278435032344" datatype="html">
@@ -8458,7 +8334,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">391</context>
+          <context context-type="linenumber">388</context>
        </context-group>
      </trans-unit>
      <trans-unit id="872092479747931526" datatype="html">
@@ -9919,7 +9795,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">339</context>
+          <context context-type="linenumber">336</context>
        </context-group>
      </trans-unit>
      <trans-unit id="106713086593101376" datatype="html">
@@ -10234,21 +10110,21 @@
        <source>Sort by title</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">214</context>
+          <context context-type="linenumber">213</context>
        </context-group>
      </trans-unit>
      <trans-unit id="6232673011753681091" datatype="html">
        <source>Sort by owner</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">227</context>
+          <context context-type="linenumber">226</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3715596725146409911" datatype="html">
        <source>Owner</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">231,232</context>
+          <context context-type="linenumber">230,231</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/data/document.ts</context>
@@ -10263,49 +10139,49 @@
        <source>Sort by notes</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">236</context>
+          <context context-type="linenumber">235</context>
        </context-group>
      </trans-unit>
      <trans-unit id="5499001829734502606" datatype="html">
        <source>Sort by document type</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">245</context>
+          <context context-type="linenumber">244</context>
        </context-group>
      </trans-unit>
      <trans-unit id="6213829731736042759" datatype="html">
        <source>Sort by storage path</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">254</context>
+          <context context-type="linenumber">253</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3406167410329973166" datatype="html">
        <source>Sort by created date</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">263</context>
+          <context context-type="linenumber">262</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3769035778779263084" datatype="html">
        <source>Sort by added date</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">272</context>
+          <context context-type="linenumber">271</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4874754501044009042" datatype="html">
        <source>Sort by number of pages</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">281</context>
+          <context context-type="linenumber">280</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3817498941817715969" datatype="html">
        <source>Pages</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">285,286</context>
+          <context context-type="linenumber">284,285</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/data/document.ts</context>
@@ -10324,28 +10200,28 @@
        <source> Shared </source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">289</context>
+          <context context-type="linenumber">288</context>
        </context-group>
      </trans-unit>
      <trans-unit id="5083658411133224968" datatype="html">
        <source>Sort by <x id="INTERPOLATION" equiv-text="{{getDisplayCustomFieldTitle(field_id)}}"/></source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">295,296</context>
-        </context-group>
-      </trans-unit>
-      <trans-unit id="3420321797707163677" datatype="html">
-        <source>Preview document</source>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">327</context>
+          <context context-type="linenumber">294,295</context>
        </context-group>
      </trans-unit>
      <trans-unit id="2179847500064178686" datatype="html">
        <source>Edit document</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
-          <context context-type="linenumber">335</context>
+          <context context-type="linenumber">328</context>
+        </context-group>
+      </trans-unit>
+      <trans-unit id="3420321797707163677" datatype="html">
+        <source>Preview document</source>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
+          <context context-type="linenumber">329</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4512084577073831437" datatype="html">
@@ -1,6 +1,6 @@
 {
  "name": "paperless-ngx-ui",
-  "version": "3.4.1",
+  "version": "3.3.4",
  "scripts": {
    "preinstall": "npx only-allow pnpm",
    "ng": "ng",
@@ -4,10 +4,6 @@ settings:
  autoInstallPeers: false
  excludeLinksFromLockfile: false

-overrides:
-  vite@>=8.3.0 <8.3.3: ^8.3.3
-  zod@<4.6.6: ^4.6.6
-
 importers:

  .:
@@ -1654,9 +1650,6 @@ packages:
  '@oxc-project/types@0.150.0':
    resolution: {integrity: sha512-rDS5/31E9HfPl/CIzGrn0DOlvBbXFseQ5URJ9sYMfstbKLD/c6Gm9vmRzRGDdAXyOIL4zmO37lc9RIwYqVruZw==}

-  '@oxc-project/types@0.155.0':
-    resolution: {integrity: sha512-SeE8JPwW1xs1tHeNycjUtUBdhorRa8o4jlvjwk49R7/Z291i+4DQa7JJIgOm/TaYQZx+QrPQbVJ/9c8dMIZN8Q==}
-
  '@parcel/watcher-android-arm64@2.6.0':
    resolution: {integrity: sha512-trgpLSCKRC/huFjXX/Smh+0sWe4+YtKfktIToiMl59ghz7z+qkH6kMvNnUbLyRs9N11t8l4svSCs1+5B3rOAhA==}
    engines: {node: '>= 10.0.0'}
@@ -1755,85 +1748,42 @@ packages:
  '@popperjs/core@2.11.8':
    resolution: {integrity: sha512-P1st0aksCrn9sGZhp8GMYwBnQsbvAWsZAX44oXNNvLHGqAOcoVxmjZiohstwQ7SqKnbR47akdNi+uleWD8+g6A==}

-  '@rolldown/binding-android-arm-eabi@1.2.15':
-    resolution: {integrity: sha512-aLcgK9gIJ3YRvrrtfSBbRa27F5WrpiTaPulnFpsHPxpUHgFlSgnU4854MHwoRGEBhfRJDWCS2WQ7lIjskE9Olw==}
-    engines: {node: ^20.19.0 || >=22.12.0}
-    cpu: [arm]
-    os: [android]
-
  '@rolldown/binding-android-arm-eabi@1.2.8':
    resolution: {integrity: sha512-tN5aztYkKCte4i5SIrrz5yK/HMjEuCqCSCJa418jOV8tZ1cBY3YF2otxB1ktPxzsLA1BeTqwapK0bfjxNvHJVw==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [arm]
    os: [android]

-  '@rolldown/binding-android-arm64@1.2.15':
-    resolution: {integrity: sha512-xD7DdZCrbThKuxNg7ooQmvp07ys4J/pnSEMTG3/OdOWl6daC67m/Q4fL78sRHMxTH/N4fGUbYhcPM0MF5WFHkg==}
-    engines: {node: ^20.19.0 || >=22.12.0}
-    cpu: [arm64]
-    os: [android]
-
  '@rolldown/binding-android-arm64@1.2.8':
    resolution: {integrity: sha512-dIYTWl9XprMUiQFoc55KUyk/oS8SKYH3zFl0LTR7RT0Xj4hgSVyuJcroH8JUu8RcpF8fTB6E0aOwCkZoYPcDSQ==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [arm64]
    os: [android]

-  '@rolldown/binding-darwin-arm64@1.2.15':
-    resolution: {integrity: sha512-m2WuQ6r0B4OTYxyPpNLtXaMRbRDUbG8YQV2Q3KTdSSK8Th6KHCnC8jVCJt8bvYeSB5WivkkNbc85mKadaSdOxA==}
-    engines: {node: ^20.19.0 || >=22.12.0}
-    cpu: [arm64]
-    os: [darwin]
-
  '@rolldown/binding-darwin-arm64@1.2.8':
    resolution: {integrity: sha512-PCSDQGXD2IyTEFrcgPyBM8jJuGmrbCMuoIOXdbEGVemruKACXoLQJrb+A45Z0L5t1RQkdfJprAYPkikbh7dzdA==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [arm64]
    os: [darwin]

-  '@rolldown/binding-darwin-x64@1.2.15':
-    resolution: {integrity: sha512-5RtnsHM36nodM9WbMy+zip0LGS/G+y5wro5RHrpOlr4ac24+1zSi9kiV2MP1myZeZ/ifEHfulQcWjnAXzc2C2A==}
-    engines: {node: ^20.19.0 || >=22.12.0}
-    cpu: [x64]
-    os: [darwin]
-
  '@rolldown/binding-darwin-x64@1.2.8':
    resolution: {integrity: sha512-Uk7lRsGhPFHVX/sAUC6D5H9Ol30dFHd6iquokll2th3LpdJ3F5CzQB+7DHn0Ri2mG+U7k2zXiPHDrwZenXhwSA==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [x64]
    os: [darwin]

-  '@rolldown/binding-freebsd-x64@1.2.15':
-    resolution: {integrity: sha512-g3l09pyFqhu+135JKkbkwiKGQmwU5hUMUPJ4VdBADvuqR8d33L6H578rh8m7rtxbdp+VmX/+nzI7nvhSZlzpUQ==}
-    engines: {node: ^20.19.0 || >=22.12.0}
-    cpu: [x64]
-    os: [freebsd]
-
  '@rolldown/binding-freebsd-x64@1.2.8':
    resolution: {integrity: sha512-DjszaTEVogPqA5bYzsEeqDCQxbcp2fexQwKcRspYji2yzR68fCf+e4fx6kBSRDwX5/brZaHw/hWS9+A/+/w9sQ==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [x64]
    os: [freebsd]

-  '@rolldown/binding-linux-arm-gnueabihf@1.2.15':
-    resolution: {integrity: sha512-nIe3VugI97nGQtspPxDqA4sXMUpeiocKIP/CqpY/u/vgbT+alX+cVxu1C/oVBPKg4feNTmYovE91v4DgXvXNwQ==}
-    engines: {node: ^20.19.0 || >=22.12.0}
-    cpu: [arm]
-    os: [linux]
-
  '@rolldown/binding-linux-arm-gnueabihf@1.2.8':
    resolution: {integrity: sha512-zmwa7FTmdzB6aaEEuuls18H6Ap5JmJPSoPTuXixeJZV6tG40SyLkApQtz1g8ptZtiEKqj9OM0oNLPh1AgvE31Q==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [arm]
    os: [linux]

-  '@rolldown/binding-linux-arm64-gnu@1.2.15':
-    resolution: {integrity: sha512-iTBjXx+B5QSvgI89lJfmqh4wTh8NabR1YZIIN3hNx4zSG0EVfVqkOvLulNpG4251pbd6/IAmZ/LefVk1Y4rPhw==}
-    engines: {node: ^20.19.0 || >=22.12.0}
-    cpu: [arm64]
-    os: [linux]
-    libc: [glibc]
-
  '@rolldown/binding-linux-arm64-gnu@1.2.8':
    resolution: {integrity: sha512-KdYQDPHwJVnbFwdTGMgxsI9SqblBlz6STGM+w1We/d5B8OWWidYH0MwkU/uA1wM5fIpO2MkOVxXrNzzuZhw9ew==}
    engines: {node: ^20.19.0 || >=22.12.0}
@@ -1841,13 +1791,6 @@ packages:
    os: [linux]
    libc: [glibc]

-  '@rolldown/binding-linux-arm64-musl@1.2.15':
-    resolution: {integrity: sha512-uN26XOnVR7rqQupG3V9oAG2EGGatWjcJHOeDOHUFCh4TBWmP2tHTFoVN13aYbwfm0aHqJAEmcwhAu6sooIjfqQ==}
-    engines: {node: ^20.19.0 || >=22.12.0}
-    cpu: [arm64]
-    os: [linux]
-    libc: [musl]
-
  '@rolldown/binding-linux-arm64-musl@1.2.8':
    resolution: {integrity: sha512-jFJTifHnNPY+yzOoNZQfSIysrVyXzEQPhPnOUjmD1bcQGHH6s7c8cViKWar8YplQImE5N9JRqMCLrM2CdxOrZA==}
    engines: {node: ^20.19.0 || >=22.12.0}
@@ -1855,13 +1798,6 @@ packages:
    os: [linux]
    libc: [musl]

-  '@rolldown/binding-linux-ppc64-gnu@1.2.15':
-    resolution: {integrity: sha512-9nWkcdd+H+XhaA3fQIwpHnKIrfx/PQ6rO0pivr78Og07tXlUlctBBJoEYLPfhTmCR/QxEVdn6uPjHV5SymPhdw==}
-    engines: {node: ^20.19.0 || >=22.12.0}
-    cpu: [ppc64]
-    os: [linux]
-    libc: [glibc]
-
  '@rolldown/binding-linux-ppc64-gnu@1.2.8':
    resolution: {integrity: sha512-FhiOziBDWPBjbcmRzfLyIJnaP7AVMFXT7YCXPjXxj7wKU3vx24RjrCNN/zjvVa+N2vVoHJwCoUBvsrN/DG3zIA==}
    engines: {node: ^20.19.0 || >=22.12.0}
@@ -1869,13 +1805,6 @@ packages:
    os: [linux]
    libc: [glibc]

-  '@rolldown/binding-linux-s390x-gnu@1.2.15':
-    resolution: {integrity: sha512-Ggh0ciFjLwIusLSLz7LZYEaGdxOAUJXI+Qu5JCbhPJJHEt8vP+IjRATTJheiJsdzzTYgUiHUiw3X1Ea3ZpMBdA==}
-    engines: {node: ^20.19.0 || >=22.12.0}
-    cpu: [s390x]
-    os: [linux]
-    libc: [glibc]
-
  '@rolldown/binding-linux-s390x-gnu@1.2.8':
    resolution: {integrity: sha512-WnHfADMzOV2Y55wlx1hzzQnar/wDt/VdvWSD99r18Mz9ylNieIGOkRx3UV21h7m/eJvjySYJkO26VvGNFkwsIQ==}
    engines: {node: ^20.19.0 || >=22.12.0}
@@ -1883,13 +1812,6 @@ packages:
    os: [linux]
    libc: [glibc]

-  '@rolldown/binding-linux-x64-gnu@1.2.15':
-    resolution: {integrity: sha512-FHg60rS6DBePAYZ9X9F67x+JObFdmgn6tupA1C/a3B+CufFmTD4mX+e8M75tCiAO3foR/6xwVBI0KQiI7sn/rw==}
-    engines: {node: ^20.19.0 || >=22.12.0}
-    cpu: [x64]
-    os: [linux]
-    libc: [glibc]
-
  '@rolldown/binding-linux-x64-gnu@1.2.8':
    resolution: {integrity: sha512-H9tRr5ibfXFVLxbPOseVewewFpl28zcEdjRDt2FTUZU7odxP0gEv1ki4/kGmcGOh78oRwZuuQllGLZ9zTJp84g==}
    engines: {node: ^20.19.0 || >=22.12.0}
@@ -1897,13 +1819,6 @@ packages:
    os: [linux]
    libc: [glibc]

-  '@rolldown/binding-linux-x64-musl@1.2.15':
-    resolution: {integrity: sha512-/cvV/7v5VGz/moiz0XKRj2dE8DzsKyhIu1KpOvJGPjRywg3yscON889UGvAe8zfiJLHup7VLjBduoGWi3HusWQ==}
-    engines: {node: ^20.19.0 || >=22.12.0}
-    cpu: [x64]
-    os: [linux]
-    libc: [musl]
-
  '@rolldown/binding-linux-x64-musl@1.2.8':
    resolution: {integrity: sha512-UefiqfM3D6IVNlZ8tSGs9+Ejjud2T+oxO0IHADU45Y+lyEjD2dVFyZHbkfX0LUb5Zugo/oIv1eCO/KVYhgYJYA==}
    engines: {node: ^20.19.0 || >=22.12.0}
@@ -1911,36 +1826,18 @@ packages:
    os: [linux]
    libc: [musl]

-  '@rolldown/binding-openharmony-arm64@1.2.15':
-    resolution: {integrity: sha512-MyzC5Hrv/sm+Z7TSGKP/j8001RO2xQm1zOpCNVL4j0cY/VhBZviludA2YFQ7i4lH6ZAXxQm0lcMdBzM+99mE7w==}
-    engines: {node: ^20.19.0 || >=22.12.0}
-    cpu: [arm64]
-    os: [openharmony]
-
  '@rolldown/binding-openharmony-arm64@1.2.8':
    resolution: {integrity: sha512-637Ke4kWSy6rp9cxQ9gMOXlxPgIw/c1beASV4M//3+9I4uwBVOOl74G+e3zyU3u19U7RkRl/HuewixZ/Z6+Rjg==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [arm64]
    os: [openharmony]

-  '@rolldown/binding-win32-arm64-msvc@1.2.15':
-    resolution: {integrity: sha512-+PgYiS+AH5omy6L45ZLxybasauJaj3M8buoT83D+nzPmCayXlxUV9hydhciCKVyIg0B/v0BtXPDE1uGqNwCPpg==}
-    engines: {node: ^20.19.0 || >=22.12.0}
-    cpu: [arm64]
-    os: [win32]
-
  '@rolldown/binding-win32-arm64-msvc@1.2.8':
    resolution: {integrity: sha512-xWBkPOF1Q9k/Gv1nQXnVdLxKu74jXppuOM4Z3mnypVUJJJwLsMl7hNJGRAUJoG8A5MgOI1ACKM+wBFxSJzKy4A==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [arm64]
    os: [win32]

-  '@rolldown/binding-win32-x64-msvc@1.2.15':
-    resolution: {integrity: sha512-HFZd2QNQYn1JbIi+Hpd7H+r/lkWxcfIu28nirZ6eCn2LafuvmExMlb/P96Sfx5tf7pPArw39IdhmCF8vmV+NhQ==}
-    engines: {node: ^20.19.0 || >=22.12.0}
-    cpu: [x64]
-    os: [win32]
-
  '@rolldown/binding-win32-x64-msvc@1.2.8':
    resolution: {integrity: sha512-uz2ZvfgXbxqNwijjjbxrnvALwpyODDcgc1T1N8N3rf/DXKQmaFwmB4LX4yyjggpwN2obdQLb2rgirX5ffCWYng==}
    engines: {node: ^20.19.0 || >=22.12.0}
@@ -2235,7 +2132,7 @@ packages:
    resolution: {integrity: sha512-bdyo8rB3NnQbikdMpHaML9Z1OZPBu6fFOBo+OtxsBlvMJtysWskmBcnbIDhUqgC8tcxNv/a+BcV5U+2nQMm1OQ==}
    engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
    peerDependencies:
-      vite: ^8.3.3
+      vite: ^6.0.0 || ^7.0.0 || ^8.0.0

  acorn-jsx@5.3.2:
    resolution: {integrity: sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==}
@@ -2364,8 +2261,8 @@ packages:
    peerDependencies:
      '@popperjs/core': ^2.11.8

-  brace-expansion@2.1.7:
-    resolution: {integrity: sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==}
+  brace-expansion@2.1.4:
+    resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==}

  brace-expansion@5.0.12:
    resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==}
@@ -2700,8 +2597,8 @@ packages:
  fast-string-width@3.0.2:
    resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==}

-  fast-uri@3.1.9:
-    resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==}
+  fast-uri@3.1.8:
+    resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==}

  fast-wrap-ansi@0.2.2:
    resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==}
@@ -3132,8 +3029,8 @@ packages:
  js-tokens@4.0.0:
    resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}

-  js-yaml@3.15.2:
-    resolution: {integrity: sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==}
+  js-yaml@3.15.1:
+    resolution: {integrity: sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==}
    hasBin: true

  jsdom@26.1.0:
@@ -3383,11 +3280,6 @@ packages:
    engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
    hasBin: true

-  nanoid@3.3.20:
-    resolution: {integrity: sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ==}
-    engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
-    hasBin: true
-
  napi-postinstall@0.3.4:
    resolution: {integrity: sha512-PHI5f1O0EP5xJ9gQmFGMS6IZcrVvTjpXjz7Na41gTE7eE2hK11lg04CECCYEEjdc17EV4DO+fkGEtt7TpTaTiQ==}
    engines: {node: ^12.20.0 || ^14.18.0 || >=16.0.0}
@@ -3618,10 +3510,6 @@ packages:
    resolution: {integrity: sha512-RRuzqDtt5Y9h3quz5hWhK+TPnsmVs6WwSU6LkJMeY4HstUEDuYTG8UJSdawMRzmzAtV+KEoG8N3Qg2qLy5vM/A==}
    engines: {node: ^10 || ^12 || >=14}

-  postcss@8.5.31:
-    resolution: {integrity: sha512-YUbWYCgErwnMAVkjUnYa+KlMBzGpHwiIt/DE7f0G33AuX2LH9UcTk6KgWxd3zRU+pN3u/C+Xl3EnMLM4Hea7Sg==}
-    engines: {node: ^10 || ^12 || >=14}
-
  prelude-ls@1.2.1:
    resolution: {integrity: sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==}
    engines: {node: '>= 0.8.0'}
@@ -3713,11 +3601,6 @@ packages:
    resolution: {integrity: sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA==}
    engines: {node: '>=18'}

-  rolldown@1.2.15:
-    resolution: {integrity: sha512-6odND+fel5zVw3I4Yc2e69gvguDnX0CAAGiNDZSq4ik5WUcaLrkD2GLuog0XcODbor31hZ5ayEMgVDno+KPV5g==}
-    engines: {node: ^20.19.0 || >=22.12.0}
-    hasBin: true
-
  rolldown@1.2.8:
    resolution: {integrity: sha512-Z67nTmhZe7anqnM/EjI392w5i/ANUinjip7QYsOyN37oayduxt3ksdX0hf5OOamkAd53BiIHfbfSzfUmzKFQqQ==}
    engines: {node: ^20.19.0 || >=22.12.0}
@@ -3890,8 +3773,8 @@ packages:
    resolution: {integrity: sha512-aBY19bn/XA+hKOKX0qL7Z0UfdBsbQvc9hn993U8ALUjzxCvDcuZqLoRXjGJrUARWAlwMnsRVD9sw2AFNOYvalA==}
    engines: {node: '>=22'}

-  source-map-js@1.2.2:
-    resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==}
+  source-map-js@1.2.1:
+    resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
    engines: {node: '>=0.10.0'}

  source-map-support@0.5.21:
@@ -4122,13 +4005,13 @@ packages:
    resolution: {integrity: sha512-zj/ob3UsvJGN0whEAKFp53REA5X66hvffVqoCtVQAakJKnKlH+/PcOfMoFwIG/o4rElqLv/ycAFlx8ZlXUorCg==}
    engines: {node: '>=18.12.0'}

-  vite@8.3.5:
-    resolution: {integrity: sha512-z1YpjieJ9g0ebTmQpLBv/oq9E3F9EIlOe+7LahW8SrE3LTiG3udBRUXQOlYXP9b+IC2q2phHeVxj9xGlw34OEQ==}
+  vite@8.3.0:
+    resolution: {integrity: sha512-lhZBVvEHefgE+HQZC9O7EBJgCU/nVzFNl7vkS4RE0APtWLP02/8QVIkQtzBxPquh7lq5/78NHipTj7ODQ6XuyQ==}
    engines: {node: ^20.19.0 || >=22.12.0}
    hasBin: true
    peerDependencies:
      '@types/node': ^20.19.0 || >=22.12.0
-      '@vitejs/devtools': ^0.7.1 || ^0.8.0
+      '@vitejs/devtools': ^0.7.1
      esbuild: ^0.27.0 || ^0.28.0
      jiti: '>=1.21.0'
      less: ^4.0.0
@@ -4285,8 +4168,8 @@ packages:
    resolution: {integrity: sha512-xYqdZFUK/VYazNl/oCDYN+3WloWQwMfZxBoiNt6qNyk+xfOdi598muWE42rNZFp1kNOiqW936q5RhUdnpqElSg==}
    engines: {node: '>=18'}

-  zod@4.6.7:
-    resolution: {integrity: sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==}
+  zod@4.6.5:
+    resolution: {integrity: sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==}

 snapshots:

@@ -4486,7 +4369,7 @@ snapshots:
      '@babel/core': 8.0.5
      '@inquirer/confirm': 6.3.2(@types/node@26.6.2)
      '@parcel/watcher': 2.6.0
-      '@vitejs/plugin-basic-ssl': 2.3.0(vite@8.3.5(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(sass-embedded@1.104.1)(sass@1.104.1))
+      '@vitejs/plugin-basic-ssl': 2.3.0(vite@8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(sass-embedded@1.104.1)(sass@1.104.1))
      beasties: 0.5.4
      browserslist: 4.29.1
      chokidar: 5.0.0
@@ -4508,7 +4391,7 @@ snapshots:
      tinyglobby: 0.2.17
      tslib: 2.8.1
      typescript: 6.0.3
-      vite: 8.3.5(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(sass-embedded@1.104.1)(sass@1.104.1)
+      vite: 8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(sass-embedded@1.104.1)(sass@1.104.1)
      xxhash-wasm: 1.1.0
    optionalDependencies:
      '@angular/core': 22.2.2(@angular/compiler@22.2.2)(rxjs@7.8.2)
@@ -4554,7 +4437,7 @@ snapshots:
      parse5-html-rewriting-stream: 8.0.1
      semver: 7.8.5
      yargs: 18.1.0
-      zod: 4.6.7
+      zod: 4.6.5
    transitivePeerDependencies:
      - '@types/node'
      - chokidar
@@ -4598,7 +4481,7 @@ snapshots:
      '@standard-schema/spec': 1.1.0
      rxjs: 7.8.2
      tslib: 2.8.1
-      zod: 4.6.7
+      zod: 4.6.5

  '@angular/localize@22.2.2(@angular/compiler-cli@22.2.2(@angular/compiler@22.2.2)(typescript@6.0.3))(@angular/compiler@22.2.2)':
    dependencies:
@@ -5235,7 +5118,7 @@ snapshots:
      camelcase: 5.3.1
      find-up: 4.1.0
      get-package-type: 0.1.0
-      js-yaml: 3.15.2
+      js-yaml: 3.15.1
      resolve-from: 5.0.0

  '@istanbuljs/schema@0.1.6': {}
@@ -5529,12 +5412,12 @@ snapshots:

  '@modelcontextprotocol/core@2.3.1':
    dependencies:
-      zod: 4.6.7
+      zod: 4.6.5

  '@modelcontextprotocol/server@2.3.1':
    dependencies:
      '@modelcontextprotocol/core': 2.3.1
-      zod: 4.6.7
+      zod: 4.6.5

  '@msgpackr-extract/msgpackr-extract-darwin-arm64@3.0.4':
    optional: true
@@ -5769,8 +5652,6 @@ snapshots:

  '@oxc-project/types@0.150.0': {}

-  '@oxc-project/types@0.155.0': {}
-
  '@parcel/watcher-android-arm64@2.6.0':
    optional: true

@@ -5838,93 +5719,48 @@ snapshots:

  '@popperjs/core@2.11.8': {}

-  '@rolldown/binding-android-arm-eabi@1.2.15':
-    optional: true
-
  '@rolldown/binding-android-arm-eabi@1.2.8':
    optional: true

-  '@rolldown/binding-android-arm64@1.2.15':
-    optional: true
-
  '@rolldown/binding-android-arm64@1.2.8':
    optional: true

-  '@rolldown/binding-darwin-arm64@1.2.15':
-    optional: true
-
  '@rolldown/binding-darwin-arm64@1.2.8':
    optional: true

-  '@rolldown/binding-darwin-x64@1.2.15':
-    optional: true
-
  '@rolldown/binding-darwin-x64@1.2.8':
    optional: true

-  '@rolldown/binding-freebsd-x64@1.2.15':
-    optional: true
-
  '@rolldown/binding-freebsd-x64@1.2.8':
    optional: true

-  '@rolldown/binding-linux-arm-gnueabihf@1.2.15':
-    optional: true
-
  '@rolldown/binding-linux-arm-gnueabihf@1.2.8':
    optional: true

-  '@rolldown/binding-linux-arm64-gnu@1.2.15':
-    optional: true
-
  '@rolldown/binding-linux-arm64-gnu@1.2.8':
    optional: true

-  '@rolldown/binding-linux-arm64-musl@1.2.15':
-    optional: true
-
  '@rolldown/binding-linux-arm64-musl@1.2.8':
    optional: true

-  '@rolldown/binding-linux-ppc64-gnu@1.2.15':
-    optional: true
-
  '@rolldown/binding-linux-ppc64-gnu@1.2.8':
    optional: true

-  '@rolldown/binding-linux-s390x-gnu@1.2.15':
-    optional: true
-
  '@rolldown/binding-linux-s390x-gnu@1.2.8':
    optional: true

-  '@rolldown/binding-linux-x64-gnu@1.2.15':
-    optional: true
-
  '@rolldown/binding-linux-x64-gnu@1.2.8':
    optional: true

-  '@rolldown/binding-linux-x64-musl@1.2.15':
-    optional: true
-
  '@rolldown/binding-linux-x64-musl@1.2.8':
    optional: true

-  '@rolldown/binding-openharmony-arm64@1.2.15':
-    optional: true
-
  '@rolldown/binding-openharmony-arm64@1.2.8':
    optional: true

-  '@rolldown/binding-win32-arm64-msvc@1.2.15':
-    optional: true
-
  '@rolldown/binding-win32-arm64-msvc@1.2.8':
    optional: true

-  '@rolldown/binding-win32-x64-msvc@1.2.15':
-    optional: true
-
  '@rolldown/binding-win32-x64-msvc@1.2.8':
    optional: true

@@ -6215,9 +6051,9 @@ snapshots:
  '@unrs/resolver-binding-win32-x64-msvc@1.12.2':
    optional: true

-  '@vitejs/plugin-basic-ssl@2.3.0(vite@8.3.5(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(sass-embedded@1.104.1)(sass@1.104.1))':
+  '@vitejs/plugin-basic-ssl@2.3.0(vite@8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(sass-embedded@1.104.1)(sass@1.104.1))':
    dependencies:
-      vite: 8.3.5(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(sass-embedded@1.104.1)(sass@1.104.1)
+      vite: 8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(sass-embedded@1.104.1)(sass@1.104.1)

  acorn-jsx@5.3.2(acorn@8.18.0):
    dependencies:
@@ -6247,7 +6083,7 @@ snapshots:
  ajv@8.20.0:
    dependencies:
      fast-deep-equal: 3.1.3
-      fast-uri: 3.1.9
+      fast-uri: 3.1.8
      json-schema-traverse: 1.0.0
      require-from-string: 2.0.2

@@ -6362,7 +6198,7 @@ snapshots:
    dependencies:
      '@popperjs/core': 2.11.8

-  brace-expansion@2.1.7:
+  brace-expansion@2.1.4:
    dependencies:
      balanced-match: 1.0.2

@@ -6707,7 +6543,7 @@ snapshots:
    dependencies:
      fast-string-truncated-width: 3.0.3

-  fast-uri@3.1.9: {}
+  fast-uri@3.1.8: {}

  fast-wrap-ansi@0.2.2:
    dependencies:
@@ -7357,7 +7193,7 @@ snapshots:

  js-tokens@4.0.0: {}

-  js-yaml@3.15.2:
+  js-yaml@3.15.1:
    dependencies:
      argparse: 1.0.10
      esprima: 4.0.1
@@ -7557,7 +7393,7 @@ snapshots:

  minimatch@9.0.9:
    dependencies:
-      brace-expansion: 2.1.7
+      brace-expansion: 2.1.4

  minimist@1.2.8: {}

@@ -7592,8 +7428,6 @@ snapshots:

  nanoid@3.3.18: {}

-  nanoid@3.3.20: {}
-
  napi-postinstall@0.3.4: {}

  natural-compare@1.4.0: {}
@@ -7840,13 +7674,7 @@ snapshots:
    dependencies:
      nanoid: 3.3.18
      picocolors: 1.1.1
-      source-map-js: 1.2.2
-
-  postcss@8.5.31:
-    dependencies:
-      nanoid: 3.3.20
-      picocolors: 1.1.1
-      source-map-js: 1.2.2
+      source-map-js: 1.2.1

  prelude-ls@1.2.1: {}

@@ -7914,27 +7742,6 @@ snapshots:
      onetime: 7.0.0
      signal-exit: 4.1.0

-  rolldown@1.2.15:
-    dependencies:
-      '@oxc-project/types': 0.155.0
-      '@rolldown/pluginutils': 1.0.1
-    optionalDependencies:
-      '@rolldown/binding-android-arm-eabi': 1.2.15
-      '@rolldown/binding-android-arm64': 1.2.15
-      '@rolldown/binding-darwin-arm64': 1.2.15
-      '@rolldown/binding-darwin-x64': 1.2.15
-      '@rolldown/binding-freebsd-x64': 1.2.15
-      '@rolldown/binding-linux-arm-gnueabihf': 1.2.15
-      '@rolldown/binding-linux-arm64-gnu': 1.2.15
-      '@rolldown/binding-linux-arm64-musl': 1.2.15
-      '@rolldown/binding-linux-ppc64-gnu': 1.2.15
-      '@rolldown/binding-linux-s390x-gnu': 1.2.15
-      '@rolldown/binding-linux-x64-gnu': 1.2.15
-      '@rolldown/binding-linux-x64-musl': 1.2.15
-      '@rolldown/binding-openharmony-arm64': 1.2.15
-      '@rolldown/binding-win32-arm64-msvc': 1.2.15
-      '@rolldown/binding-win32-x64-msvc': 1.2.15
-
  rolldown@1.2.8:
    dependencies:
      '@oxc-project/types': 0.149.0
@@ -8055,7 +7862,7 @@ snapshots:
    dependencies:
      chokidar: 5.0.0
      immutable: 5.1.9
-      source-map-js: 1.2.2
+      source-map-js: 1.2.1
    optionalDependencies:
      '@parcel/watcher': 2.6.0

@@ -8084,7 +7891,7 @@ snapshots:
      ansi-styles: 6.2.3
      is-fullwidth-code-point: 5.1.0

-  source-map-js@1.2.2: {}
+  source-map-js@1.2.1: {}

  source-map-support@0.5.21:
    dependencies:
@@ -8311,12 +8118,12 @@ snapshots:

  verkit@0.3.2: {}

-  vite@8.3.5(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(sass-embedded@1.104.1)(sass@1.104.1):
+  vite@8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(sass-embedded@1.104.1)(sass@1.104.1):
    dependencies:
      lightningcss: 1.33.0
      picomatch: 4.0.7
-      postcss: 8.5.31
-      rolldown: 1.2.15
+      postcss: 8.5.28
+      rolldown: 1.2.8
      tinyglobby: 0.2.17
    optionalDependencies:
      '@types/node': 26.6.2
@@ -8434,4 +8241,4 @@ snapshots:

  yoctocolors@2.2.0: {}

-  zod@4.6.7: {}
+  zod@4.6.5: {}
@@ -24,6 +24,3 @@ onlyBuiltDependencies:
 ignoredBuiltDependencies:
  - normalize-diacritics
  - unrs-resolver
-overrides:
-  "vite@>=8.3.0 <8.3.3": "^8.3.3"
-  "zod@<4.6.6": "^4.6.6"
@@ -19,6 +19,7 @@ import {
  PaperlessTaskTriggerSource,
  PaperlessTaskType,
 } from 'src/app/data/paperless-task'
+import { Results } from 'src/app/data/results'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { PermissionsGuard } from 'src/app/guards/permissions.guard'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
@@ -152,6 +153,11 @@ const tasks: PaperlessTask[] = [
  },
 ]

+const paginatedTasks: Results<PaperlessTask> = {
+  count: tasks.length,
+  results: tasks,
+}
+
 const sectionCountResponse = {
  all: 7,
  needs_attention: 2,
@@ -198,7 +204,7 @@ describe('TasksComponent', () => {
    }).compileComponents()

    tasksService = TestBed.inject(TasksService)
-    reloadSpy = jest.spyOn(tasksService, 'reload').mockImplementation(() => {})
+    reloadSpy = jest.spyOn(tasksService, 'reload')
    httpTestingController = TestBed.inject(HttpTestingController)
    modalService = TestBed.inject(NgbModal)
    router = TestBed.inject(Router)
@@ -208,6 +214,15 @@ describe('TasksComponent', () => {
    jest.useFakeTimers()
    fixture.detectChanges()

+    httpTestingController
+      .expectOne(
+        (req) =>
+          req.url === `${environment.apiBaseUrl}tasks/` &&
+          req.params.get('acknowledged') === 'false' &&
+          req.params.get('page_size') === '1000'
+      )
+      .flush(paginatedTasks)
+
    httpTestingController
      .expectOne(
        (req) =>
@@ -344,11 +344,11 @@
                ngbPopover="Tasks" i18n-ngbPopover [disablePopover]="!slimSidebarPopoversEnabled" placement="end"
                container="body" triggers="mouseenter:mouseleave" popoverClass="popover-slim">
                <i-bs class="me-2" name="list-task"></i-bs><span class="nav-link-label"><ng-container i18n>Tasks</ng-container></span>
-                @if (tasksService.needsAttentionTasksCount > 0 && !slimSidebarEnabled) {
-                  <span class="badge bg-danger ms-2 d-inline flex-shrink-0">{{tasksService.needsAttentionTasksCount}}</span>
+                @if (tasksService.needsAttentionTasks.length > 0 && !slimSidebarEnabled) {
+                  <span class="badge bg-danger ms-2 d-inline flex-shrink-0">{{tasksService.needsAttentionTasks.length}}</span>
                }
-                @if (tasksService.needsAttentionTasksCount > 0 && slimSidebarEnabled) {
-                  <span class="badge bg-danger position-absolute top-0 end-0 d-none d-md-block">{{tasksService.needsAttentionTasksCount}}</span>
+                @if (tasksService.needsAttentionTasks.length > 0 && slimSidebarEnabled) {
+                  <span class="badge bg-danger position-absolute top-0 end-0 d-none d-md-block">{{tasksService.needsAttentionTasks.length}}</span>
                }
              </a>
            </li>
@@ -588,8 +588,8 @@ describe('AppFrameComponent', () => {

  it('should show tasks badge for needs-attention tasks', () => {
    jest
-      .spyOn(tasksService, 'needsAttentionTasksCount', 'get')
-      .mockReturnValue(2)
+      .spyOn(tasksService, 'needsAttentionTasks', 'get')
+      .mockReturnValue([{} as any, {} as any])

    fixture.detectChanges()

@@ -11,12 +11,14 @@
            </div>
            @for (field of filteredFields; track field.id) {
                <button type="button" class="list-group-item list-group-item-action bg-light" (click)="addField(field)" #button>
-                    <div class="d-flex">{{field.name}} <small class="ms-auto text-muted">{{getDataTypeLabel(field.data_type)}}</small></div>
+                    <small class="d-flex">{{field.name}} <small class="ms-auto text-muted">{{getDataTypeLabel(field.data_type)}}</small></small>
                </button>
            }
            @if (!filterText?.length || filteredFields.length === 0) {
                <button type="button" class="list-group-item list-group-item-action bg-light" (click)="createField(filterText)" [disabled]="!canCreateFields" #button>
-                    <i-bs width=".9em" height=".9em" name="asterisk" class="me-1"></i-bs><ng-container i18n>Create new field</ng-container>
+                    <small>
+                        <i-bs width=".9em" height=".9em" name="asterisk" class="me-1"></i-bs><ng-container i18n>Create new field</ng-container>
+                    </small>
                </button>
            }
        </div>
@@ -1,3 +1,10 @@
 .custom-fields-dropdown {
    min-width: 300px;
+
+    // correct position on mobile
+    @media (max-width: 575.98px) {
+        &.show {
+            margin-left: -245px !important;
+        }
+    }
 }
@@ -33,54 +33,21 @@

 <ng-template #comparisonValueTemplate let-atom="atom">
  @if (getCustomFieldByID(atom.field)?.data_type === CustomFieldDataType.Date) {
-    @let relativeDate = getRelativeDate(atom);
-    <div class="d-flex gap-2 w-100 ms-0 mt-1">
-      <fieldset class="btn-group btn-group-sm flex-shrink-0 date-mode" aria-label="Date mode" i18n-aria-label>
-        <input type="radio" class="btn-check" [id]="atom.id + '_fixed'" [name]="atom.id + '_dateMode'" [checked]="!relativeDate" (change)="toggleRelativeDate(atom)" [disabled]="disabled" aria-label="Fixed date" i18n-aria-label>
-        <label class="btn btn-outline-secondary text-nowrap" [for]="atom.id + '_fixed'" title="Fixed date" i18n-title>
-          <i-bs name="calendar"></i-bs><span class="d-none d-md-inline ms-2" i18n>Fixed</span>
-        </label>
-        <input type="radio" class="btn-check" [id]="atom.id + '_relative'" [name]="atom.id + '_dateMode'" [checked]="!!relativeDate" (change)="toggleRelativeDate(atom)" [disabled]="disabled" aria-label="Relative date" i18n-aria-label>
-        <label class="btn btn-outline-secondary text-nowrap" [for]="atom.id + '_relative'" title="Relative date" i18n-title>
-          <i-bs name="clock-history"></i-bs><span class="d-none d-md-inline ms-2" i18n>Relative</span>
-        </label>
-      </fieldset>
-      <div class="input-group input-group-sm flex-grow-1">
-        @if (relativeDate) {
-          @if (relativeDate.unit.includes('{n}')) {
-            <input class="form-control w-25 flex-grow-0" type="number" min="0" aria-label="Amount" i18n-aria-label
-              [ngModel]="relativeDate.amount"
-              (ngModelChange)="updateRelativeDate(atom, { amount: $event })"
-              [ngModelOptions]="{standalone: true}" />
-          }
-          <label class="visually-hidden" [for]="atom.id + '_unit'" i18n>Unit</label>
-          <select class="form-select" [id]="atom.id + '_unit'"
-            [ngModel]="relativeDate.unit"
-            (ngModelChange)="updateRelativeDate(atom, { unit: $event })"
-            [ngModelOptions]="{standalone: true}">
-            @for (unit of relativeDateUnits; track unit.id) {
-              <option [ngValue]="unit.id">{{unit.label}}</option>
-            }
-          </select>
-        } @else {
-          <input class="form-control" placeholder="yyyy-mm-dd"
-            [(ngModel)]="atom.value"
-            [ngModelOptions]="{standalone: true}"
-            ngbDatepicker
-            #d="ngbDatepicker"
-            [footerTemplate]="datePickerFooterTemplate" />
-          <button class="btn btn-sm btn-outline-secondary" (click)="d.toggle()" type="button" aria-label="Open date picker" i18n-aria-label>
-            <i-bs name="calendar-event"></i-bs>
-          </button>
-          <ng-template #datePickerFooterTemplate>
-            <div class="btn-group-xs border-top p-2 d-flex">
-              <button type="button" class="btn btn-primary" (click)="atom.value = today; d.close()" i18n>Today</button>
-              <button type="button" class="btn btn-secondary ms-auto" (click)="d.close()" i18n>Close</button>
-            </div>
-          </ng-template>
-        }
+    <input class="form-control" placeholder="yyyy-mm-dd"
+      [(ngModel)]="atom.value"
+      [ngModelOptions]="{standalone: true}"
+      ngbDatepicker
+      #d="ngbDatepicker"
+      [footerTemplate]="datePickerFooterTemplate" />
+    <button class="btn btn-sm btn-outline-secondary rounded-end" (click)="d.toggle()" type="button" aria-label="Open date picker" i18n-aria-label>
+      <i-bs name="calendar-event"></i-bs>
+    </button>
+    <ng-template #datePickerFooterTemplate>
+      <div class="btn-group-xs border-top p-2 d-flex">
+        <button type="button" class="btn btn-primary" (click)="atom.value = today; d.close()" i18n>Today</button>
+        <button type="button" class="btn btn-secondary ms-auto" (click)="d.close()" i18n>Close</button>
      </div>
-    </div>
+    </ng-template>
  } @else if (getCustomFieldByID(atom.field)?.data_type === CustomFieldDataType.Float || getCustomFieldByID(atom.field)?.data_type === CustomFieldDataType.Integer) {
    <input class="w-25 form-control rounded-end" type="number" [(ngModel)]="atom.value" [ngModelOptions]="{standalone: true}" [disabled]="disabled">
  } @else if (getCustomFieldByID(atom.field)?.data_type === CustomFieldDataType.Boolean) {
@@ -116,7 +83,6 @@
 </ng-template>

 <ng-template #queryAtom let-atom="atom">
-  <label class="visually-hidden" [for]="atom.id + '_operator'" i18n>Operator</label>
  <div class="input-group input-group-sm">
    <ng-select #fieldSelects
      class="paperless-input-select"
@@ -130,7 +96,7 @@
      [appendTo]="selectAppendTo"
      (mousedown)="$event.stopImmediatePropagation()"
    ></ng-select>
-    <select class="w-25 form-select" [id]="atom.id + '_operator'" [class.rounded-end]="hasDateValueRow(atom)" [(ngModel)]="atom.operator" [ngModelOptions]="{standalone: true}" [disabled]="disabled">
+    <select class="w-25 form-select" [(ngModel)]="atom.operator" [ngModelOptions]="{standalone: true}" [disabled]="disabled">
      @for (operator of getOperatorsForField(atom.field); track operator.label) {
        <option [ngValue]="operator.value">{{operator.label}}</option>
      }
@@ -185,10 +151,10 @@
        <input class="w-25 form-control rounded-end" type="text" [(ngModel)]="atom.value" [ngModelOptions]="{standalone: true}" [disabled]="disabled">
      }
    }
+    <button class="btn btn-link btn-sm text-danger pe-0" type="button" (click)="removeElement(atom)" [disabled]="disabled" aria-label="Remove query" i18n-aria-label>
+      <i-bs name="x-circle"></i-bs>
+    </button>
  </div>
-  <button class="btn btn-link btn-sm text-danger pe-0 align-self-center" type="button" (click)="removeElement(atom)" [disabled]="disabled" aria-label="Remove query" i18n-aria-label>
-    <i-bs name="x-circle"></i-bs>
-  </button>
 </ng-template>

 <ng-template #queryExpression let-expression="expression">
@@ -5,11 +5,6 @@
  }
 }

-:host {
-  --ng-select-border-radius: var(--bs-border-radius);
-  --ng-select-height: calc(1.5em + 0.5rem + calc(var(--bs-border-width) * 2));
-}
-
 :host ::ng-deep .ng-select-container {
  border-top-right-radius: 0 !important;
  border-bottom-right-radius: 0 !important;
@@ -46,13 +41,3 @@
    min-width: 140px;
  }
 }
-
-.date-mode .btn {
-  --bs-btn-color: var(--bs-secondary-color);
-  --bs-btn-hover-bg: transparent;
-  --bs-btn-hover-color: var(--bs-body-color);
-  --bs-btn-hover-border-color: var(--bs-border-color);
-  --bs-btn-active-bg: transparent;
-  --bs-btn-active-color: var(--bs-primary);
-  --bs-btn-active-border-color: var(--bs-border-color);
-}
@@ -3,7 +3,7 @@ import { provideHttpClientTesting } from '@angular/common/http/testing'
 import { LOCALE_ID } from '@angular/core'
 import { ComponentFixture, TestBed } from '@angular/core/testing'
 import { FormsModule, ReactiveFormsModule } from '@angular/forms'
-import { NgbDateAdapter, NgbDropdownModule } from '@ng-bootstrap/ng-bootstrap'
+import { NgbDropdownModule } from '@ng-bootstrap/ng-bootstrap'
 import { NgSelectModule } from '@ng-select/ng-select'
 import { allIcons, NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
 import { of } from 'rxjs'
@@ -11,7 +11,6 @@ import { CustomField, CustomFieldDataType } from 'src/app/data/custom-field'
 import {
  CUSTOM_FIELD_QUERY_OPERATORS_BY_GROUP,
  CustomFieldQueryLogicalOperator,
-  CustomFieldQueryOperator,
  CustomFieldQueryOperatorGroups,
 } from 'src/app/data/custom-field-query'
 import { CustomFieldsService } from 'src/app/services/rest/custom-fields.service'
@@ -20,7 +19,6 @@ import {
  CustomFieldQueryElement,
  CustomFieldQueryExpression,
 } from 'src/app/utils/custom-field-query-element'
-import { ISODateAdapter } from 'src/app/utils/ngb-iso-date-adapter'
 import {
  CustomFieldQueriesModel,
  CustomFieldsQueryDropdownComponent,
@@ -50,12 +48,6 @@ const customFields = [
    data_type: CustomFieldDataType.Monetary,
    extra_data: { default_currency: 'EUR' },
  },
-  {
-    id: 4,
-    name: 'Test Date Field',
-    data_type: CustomFieldDataType.Date,
-    extra_data: {},
-  },
 ]

 describe('CustomFieldsQueryDropdownComponent', () => {
@@ -77,7 +69,6 @@ describe('CustomFieldsQueryDropdownComponent', () => {
        provideHttpClient(withInterceptorsFromDi()),
        provideHttpClientTesting(),
        { provide: LOCALE_ID, useValue: 'de' },
-        { provide: NgbDateAdapter, useClass: ISODateAdapter },
      ],
    }).compileComponents()

@@ -246,74 +237,6 @@ describe('CustomFieldsQueryDropdownComponent', () => {
    expect(component.selectionModel.queries.length).toBe(1)
  })

-  it('should build relative date values from amount and unit', async () => {
-    component.useDropdown = false
-    const atom = new CustomFieldQueryAtom([
-      4,
-      CustomFieldQueryOperator.GreaterThanOrEqual,
-      '2026-10-22',
-    ])
-    component.selectionModel.addAtom(atom)
-    fixture.detectChanges()
-    await fixture.whenStable()
-    const query = (selector: string) =>
-      fixture.nativeElement.querySelector(selector)
-    expect(query('[ngbDatepicker]')).not.toBeNull()
-    expect(query('input[id$="_fixed"]').checked).toBe(true)
-
-    query('input[id$="_relative"]').click()
-    fixture.detectChanges()
-    await fixture.whenStable()
-    expect(atom.value).toBeNull()
-    const amount: HTMLInputElement = query('input[aria-label="Amount"]')
-    const unit: HTMLSelectElement = query('select[id$="_unit"]')
-    amount.value = '30'
-    amount.dispatchEvent(new Event('input'))
-    expect(atom.serialize()).toEqual([4, 'gte', '30 days ago'])
-    unit.selectedIndex = 6
-    unit.dispatchEvent(new Event('change'))
-    expect(atom.serialize()).toEqual([4, 'gte', 'in 30 weeks'])
-    unit.selectedIndex = 0
-    unit.dispatchEvent(new Event('change'))
-    fixture.detectChanges()
-    expect(atom.serialize()).toEqual([4, 'gte', 'today'])
-    expect(query('input[aria-label="Amount"]')).toBeNull()
-
-    query('input[id$="_fixed"]').click()
-    fixture.detectChanges()
-    expect(atom.value).toBeNull()
-    expect(query('[ngbDatepicker]')).not.toBeNull()
-  })
-
-  it('should restore a saved relative date value', async () => {
-    component.useDropdown = false
-    const atom = new CustomFieldQueryAtom([
-      4,
-      CustomFieldQueryOperator.Exact,
-      'in 2 months',
-    ])
-    component.selectionModel.addAtom(atom)
-    fixture.detectChanges()
-    await fixture.whenStable()
-    expect(component.getRelativeDate(atom)).toEqual({
-      amount: 2,
-      unit: 'in {n} months',
-    })
-    expect(
-      fixture.nativeElement.querySelector('input[aria-label="Amount"]').value
-    ).toBe('2')
-
-    const today = new CustomFieldQueryAtom([
-      4,
-      CustomFieldQueryOperator.Exact,
-      'today',
-    ])
-    expect(component.getRelativeDate(today)).toEqual({
-      amount: null,
-      unit: 'today',
-    })
-  })
-
  describe('CustomFieldQueriesModel', () => {
    let model: CustomFieldQueriesModel

@@ -49,26 +49,6 @@ import { LoadingComponentWithPermissions } from '../../loading-component/loading
 import { ClearableBadgeComponent } from '../clearable-badge/clearable-badge.component'
 import { DocumentLinkComponent } from '../input/document-link/document-link.component'

-interface RelativeDate {
-  // The expression sent to the API, with {n} standing in for the amount
-  amount: number | null
-  unit: string
-}
-
-function parseRelativeDate(
-  value: string,
-  unit: string
-): RelativeDate | undefined {
-  const [prefix, suffix] = unit.split('{n}')
-  if (suffix === undefined) {
-    return value === unit ? { amount: null, unit } : undefined
-  }
-  if (!value.startsWith(prefix) || !value.endsWith(suffix)) return undefined
-  const amount = value.slice(prefix.length, value.length - suffix.length)
-  if (!amount || !Number.isInteger(+amount) || +amount < 0) return undefined
-  return { amount: +amount, unit }
-}
-
 export class CustomFieldQueriesModel {
  private readonly _queries = signal<CustomFieldQueryElement[]>([])
  private rootSubscriptions: Subscription[] = []
@@ -325,67 +305,6 @@ export class CustomFieldsQueryDropdownComponent extends LoadingComponentWithPerm

  public readonly today: string = new Date().toLocaleDateString('en-CA')

-  public readonly relativeDateUnits = [
-    { id: 'today', label: $localize`Today` },
-    { id: '{n} days ago', label: $localize`days ago` },
-    { id: '{n} weeks ago', label: $localize`weeks ago` },
-    { id: '{n} months ago', label: $localize`months ago` },
-    { id: '{n} years ago', label: $localize`years ago` },
-    { id: 'in {n} days', label: $localize`days from now` },
-    { id: 'in {n} weeks', label: $localize`weeks from now` },
-    { id: 'in {n} months', label: $localize`months from now` },
-    { id: 'in {n} years', label: $localize`years from now` },
-  ]
-
-  private readonly relativeDates = new Map<string, RelativeDate>()
-
-  getRelativeDate(atom: CustomFieldQueryAtom): RelativeDate | undefined {
-    if (!this.relativeDates.has(atom.id) && typeof atom.value === 'string') {
-      for (const { id } of this.relativeDateUnits) {
-        const relativeDate = parseRelativeDate(atom.value, id)
-        if (relativeDate) {
-          this.relativeDates.set(atom.id, relativeDate)
-          break
-        }
-      }
-    }
-    return this.relativeDates.get(atom.id)
-  }
-
-  hasDateValueRow(atom: CustomFieldQueryAtom): boolean {
-    return (
-      this.getCustomFieldByID(atom.field)?.data_type ===
-        CustomFieldDataType.Date &&
-      atom.operator !== CustomFieldQueryOperator.Exists &&
-      atom.operator !== CustomFieldQueryOperator.IsNull
-    )
-  }
-
-  toggleRelativeDate(atom: CustomFieldQueryAtom) {
-    if (this.getRelativeDate(atom)) {
-      this.relativeDates.delete(atom.id)
-      atom.value = null
-    } else {
-      this.relativeDates.set(atom.id, { amount: null, unit: '{n} days ago' })
-      this.updateRelativeDate(atom, {})
-    }
-  }
-
-  updateRelativeDate(
-    atom: CustomFieldQueryAtom,
-    change: Partial<RelativeDate>
-  ) {
-    const { amount, unit } = Object.assign(
-      this.relativeDates.get(atom.id),
-      change
-    )
-    if (!unit.includes('{n}')) {
-      atom.value = unit
-    } else {
-      atom.value = amount === null ? null : unit.replace('{n}', `${amount}`)
-    }
-  }
-
  public customFieldSearchFn = (term: string, field: CustomField): boolean =>
    matchesSearchText(field?.name, term)

@@ -308,7 +308,7 @@
                  </tr>
                  <tr class="align-middle">
                    <td i18n>Original SHA256 checksum</td>
-                    <td><span class="badge bg-light text-dark font-monospace text-wrap text-break text-start">{{metadata()?.original_checksum}}</span></td>
+                    <td><span class="badge bg-light font-monospace text-wrap text-break text-start">{{metadata()?.original_checksum}}</span></td>
                  </tr>
                  <tr>
                    <td i18n>Original file size</td>
@@ -465,7 +465,7 @@
    @switch (archiveContentRenderType) {
      @case (ContentRenderType.PDF) {
        @if (!useNativePdfViewer) {
-          <div class="preview-sticky pdf-viewer-container" tabindex="-1">
+          <div class="preview-sticky pdf-viewer-container">
            <pngx-pdf-viewer
              [src]="pdfSource()"
              [sourceRevision]="previewRevision()"
@@ -477,7 +477,7 @@
              (loadError)="onError($event)"
              (afterLoadComplete)="pdfPreviewLoaded($event)">
            </pngx-pdf-viewer>
-            <div class="preview-controls position-absolute bottom-0 start-50 translate-middle-x z-1 mb-3 d-flex gap-2 p-1 bg-body border rounded shadow">
+            <div class="position-absolute bottom-0 start-50 translate-middle-x z-1 mb-3 d-flex gap-2 p-1 bg-body border rounded shadow">
              @if (previewNumPages()) {
                <div class="input-group input-group-sm w-auto flex-nowrap">
                  <input class="form-control flex-grow-0 w-auto" type="number" min="1" [max]="previewNumPages()" [ngModelOptions]="{standalone: true}" [ngModel]="previewCurrentPage()" (ngModelChange)="previewCurrentPage.set($event)" aria-label="Page" i18n-aria-label />
@@ -485,7 +485,7 @@
                </div>
              }
              <div class="input-group input-group-sm w-auto flex-nowrap">
-                <button class="btn btn-outline-secondary" type="button" (click)="decreaseZoom()" aria-label="Zoom out" i18n-aria-label>
+                <button class="btn btn-outline-secondary" (click)="decreaseZoom()" aria-label="Zoom out" i18n-aria-label>
                  <i-bs width="1em" height="1em" name="dash"></i-bs>
                </button>
                <select class="form-select" (change)="setZoom($event.target.value)" [ngModelOptions]="{standalone: true}" [ngModel]="currentZoom" aria-label="Zoom" i18n-aria-label>
@@ -495,7 +495,7 @@
                    </option>
                  }
                </select>
-                <button class="btn btn-outline-secondary" type="button" (click)="increaseZoom()" aria-label="Zoom in" i18n-aria-label>
+                <button class="btn btn-outline-secondary" (click)="increaseZoom()" aria-label="Zoom in" i18n-aria-label>
                  <i-bs width="1em" height="1em" name="plus"></i-bs>
                </button>
              </div>
@@ -12,22 +12,6 @@
    width: 100%;
    height: 100%;
  }
-
-  &:focus {
-    outline: none;
-  }
-
-  .preview-controls {
-    opacity: 0;
-    pointer-events: none;
-    transition: opacity 0.15s ease-in-out;
-  }
-
-  &:hover .preview-controls,
-  &:focus-within .preview-controls {
-    opacity: 1;
-    pointer-events: auto;
-  }
 }

 .btn-group .dropdown-toggle-split {
@@ -47,8 +47,6 @@
                                    <span>{{ change.key | titlecase }}</span>:&nbsp;
                                    @if (change.key === 'content') {
                                        <code class="text-primary">{{ change.value[1]?.substring(0,100) }}...</code>
-                                    } @else if (change.key === 'tags') {
-                                        <code class="text-primary">{{ getTagNames($any(change.value[1])) | async }}</code>
                                    } @else {
                                        <code class="text-primary">{{ getPrettyName(change.key, change.value[1]) | async }}</code>
                                    }
@@ -12,7 +12,6 @@ import { CorrespondentService } from 'src/app/services/rest/correspondent.servic
 import { DocumentTypeService } from 'src/app/services/rest/document-type.service'
 import { DocumentService } from 'src/app/services/rest/document.service'
 import { StoragePathService } from 'src/app/services/rest/storage-path.service'
-import { TagService } from 'src/app/services/rest/tag.service'
 import { UserService } from 'src/app/services/rest/user.service'
 import { DocumentHistoryComponent } from './document-history.component'

@@ -175,39 +174,6 @@ describe('DocumentHistoryComponent', () => {
    })
  })

-  it('should render bulk tag history with names and preserve missing tag IDs', () => {
-    const getCachedSpy = jest
-      .spyOn(TestBed.inject(TagService), 'getCached')
-      .mockImplementation((id) =>
-        of(id === 1 ? { id: 1, name: 'Invoice' } : null)
-      )
-    component.entries.set([
-      {
-        id: 1,
-        action: AuditLogAction.Update,
-        timestamp: '2021-01-01T00:00:00Z',
-        remote_addr: null,
-        changes: JSON.parse('{"tags":[[],[1,2345]]}'),
-      },
-    ])
-    component.loading.set(false)
-    fixture.detectChanges()
-
-    expect(fixture.nativeElement.querySelector('code').textContent).toBe(
-      'Invoice, 2345'
-    )
-    fixture.detectChanges()
-    expect(getCachedSpy).toHaveBeenCalledTimes(2)
-  })
-
-  it('should handle removal of all tags without a lookup', () => {
-    const getCachedSpy = jest.spyOn(TestBed.inject(TagService), 'getCached')
-    component.getTagNames([]).subscribe((result) => {
-      expect(result).toBe('')
-    })
-    expect(getCachedSpy).not.toHaveBeenCalled()
-  })
-
  it('getPrettyName should return the value as is for other types', () => {
    const id = '123'
    component.getPrettyName('other', id).subscribe((result) => {
@@ -2,7 +2,7 @@ import { AsyncPipe, KeyValuePipe, TitleCasePipe } from '@angular/common'
 import { Component, Input, OnInit, inject, signal } from '@angular/core'
 import { NgbTooltipModule } from '@ng-bootstrap/ng-bootstrap'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
-import { Observable, first, forkJoin, map, of, shareReplay } from 'rxjs'
+import { Observable, first, map, of, shareReplay } from 'rxjs'
 import { AuditLogAction, AuditLogEntry } from 'src/app/data/auditlog-entry'
 import { DataType } from 'src/app/data/datatype'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
@@ -10,7 +10,6 @@ import { CorrespondentService } from 'src/app/services/rest/correspondent.servic
 import { DocumentTypeService } from 'src/app/services/rest/document-type.service'
 import { DocumentService } from 'src/app/services/rest/document.service'
 import { StoragePathService } from 'src/app/services/rest/storage-path.service'
-import { TagService } from 'src/app/services/rest/tag.service'
 import { UserService } from 'src/app/services/rest/user.service'

@Component({
@@ -31,7 +30,6 @@ export class DocumentHistoryComponent implements OnInit {
  private readonly correspondentService = inject(CorrespondentService)
  private readonly storagePathService = inject(StoragePathService)
  private readonly documentTypeService = inject(DocumentTypeService)
-  private readonly tagService = inject(TagService)
  private readonly userService = inject(UserService)

  public AuditLogAction = AuditLogAction
@@ -65,30 +63,6 @@ export class DocumentHistoryComponent implements OnInit {
    }
  }

-  getTagNames(tagIds: number[]): Observable<string> {
-    const cacheKey = `tags:${JSON.stringify(tagIds)}`
-    const cachedNames = this.prettyNameCache.get(cacheKey)
-    if (cachedNames) {
-      return cachedNames
-    }
-
-    const tagNames$ = tagIds.length
-      ? forkJoin(
-          tagIds.map((tagId) =>
-            this.tagService.getCached(tagId).pipe(
-              first(),
-              map((tag) => tag?.name ?? String(tagId))
-            )
-          )
-        ).pipe(map((names) => names.join(', ')))
-      : of('')
-    const names$ = tagNames$.pipe(
-      shareReplay({ bufferSize: 1, refCount: true })
-    )
-    this.prettyNameCache.set(cacheKey, names$)
-    return names$
-  }
-
  getPrettyName(type: DataType | string, id: string): Observable<string> {
    const cacheKey = `${type}:${id}`
    const cached = this.prettyNameCache.get(cacheKey)
@@ -105,7 +105,7 @@
                    (click)="$event.stopPropagation()"
                  />
                } @else {
-                  <span class="input-group-text overflow-hidden version-label">
+                  <span class="input-group-text version-label">
                    @if (version.version_label) {
                      {{ version.version_label }}
                    } @else {
@@ -72,7 +72,7 @@
              <a class="btn btn-sm btn-outline-secondary" (click)="clickMoreLike.emit()">
                <i-bs name="diagram-3" class="me-1"></i-bs><span class="d-none d-md-inline" i18n>More like this</span>
              </a>
-              <a routerLink="/documents/{{document().id}}" class="btn btn-sm btn-outline-secondary">
+              <a routerLink="/documents/{{document().id}}" class="btn btn-sm btn-outline-secondary" *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.Document }">
                <i-bs name="file-earmark-richtext" class="me-1"></i-bs><span class="d-none d-md-inline" i18n>Open</span>
              </a>
              <pngx-preview-popup [document]="document()" #popupPreview>
@@ -10,6 +10,7 @@ import {
  NgbTooltipModule,
 } from '@ng-bootstrap/ng-bootstrap'
 import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
+import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
 import { DocumentTitlePipe } from 'src/app/pipes/document-title.pipe'
 import { IsNumberPipe } from 'src/app/pipes/is-number.pipe'
@@ -51,6 +52,7 @@ describe('DocumentCardLargeComponent', () => {
        DocumentCardLargeComponent,
        DocumentTitlePipe,
        CustomDatePipe,
+        IfPermissionsDirective,
        SafeUrlPipe,
        IsNumberPipe,
        PreviewPopupComponent,
@@ -20,6 +20,7 @@ import {
  Document,
 } from 'src/app/data/document'
 import { SETTINGS_KEYS } from 'src/app/data/ui-settings'
+import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { CorrespondentNamePipe } from 'src/app/pipes/correspondent-name.pipe'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
 import { DocumentTitlePipe } from 'src/app/pipes/document-title.pipe'
@@ -50,6 +51,7 @@ import { LoadingComponentWithPermissions } from '../../loading-component/loading
    CorrespondentNamePipe,
    DocumentTypeNamePipe,
    StoragePathNamePipe,
+    IfPermissionsDirective,
    CustomDatePipe,
    RouterModule,
    NgbTooltipModule,
@@ -144,7 +144,7 @@
      <div class="d-flex justify-content-between align-items-center">
        <div class="btn-group w-100">
           @if (document()) {
-            <a routerLink="/documents/{{document().id}}" class="btn btn-sm btn-outline-secondary" title="Open" i18n-title>
+            <a routerLink="/documents/{{document().id}}" class="btn btn-sm btn-outline-secondary" title="Open" i18n-title *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.Document }" i18n-title>
              <i-bs name="file-earmark-richtext"></i-bs>
            </a>
            <pngx-preview-popup [document]="document()" #popupPreview>
@@ -20,6 +20,7 @@ import {
  Document,
 } from 'src/app/data/document'
 import { SETTINGS_KEYS } from 'src/app/data/ui-settings'
+import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { CorrespondentNamePipe } from 'src/app/pipes/correspondent-name.pipe'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
 import { DocumentTitlePipe } from 'src/app/pipes/document-title.pipe'
@@ -50,6 +51,7 @@ import { LoadingComponentWithPermissions } from '../../loading-component/loading
    CorrespondentNamePipe,
    DocumentTypeNamePipe,
    StoragePathNamePipe,
+    IfPermissionsDirective,
    CustomDatePipe,
    RouterModule,
    NgbTooltipModule,
@@ -208,7 +208,6 @@
                  i18n>Correspondent</th>
              }
              @if (activeDisplayFields.includes(DisplayField.TITLE)) {
-                <th style="width: 2rem"><!-- Preview --></th>
                <th class="cursor-pointer"
                  pngxSortable="title"
                  title="Sort by title" i18n-title
@@ -322,17 +321,15 @@
                    }
                  </td>
                }
-                @if (activeDisplayFields.includes(DisplayField.TITLE)) {
-                  <td class="pe-0 text-end align-baseline" (mouseleave)="popupPreview.close()">
-                    <pngx-preview-popup [document]="d" linkClasses="btn btn-sm btn-link text-secondary px-1" linkTitle="Preview document" (click)="$event.stopPropagation()" i18n-linkTitle #popupPreview>
-                      <i-bs name="eye"></i-bs>
-                    </pngx-preview-popup>
-                  </td>
-                }
                @if (activeDisplayFields.includes(DisplayField.TITLE) || activeDisplayFields.includes(DisplayField.TAGS)) {
-                  <td width="30%" class="align-baseline">
+                  <td width="30%">
                    @if (activeDisplayFields.includes(DisplayField.TITLE)) {
-                      <a routerLink="/documents/{{d.id}}" title="Edit document" i18n-title style="overflow-wrap: anywhere;">{{d.title | documentTitle}}</a>
+                      <div class="d-inline-block" (mouseleave)="popupPreview.close()">
+                        <a routerLink="/documents/{{d.id}}" title="Edit document" i18n-title style="overflow-wrap: anywhere;">{{d.title | documentTitle}}</a>
+                        <pngx-preview-popup [document]="d" linkClasses="btn btn-sm btn-link text-secondary" linkTitle="Preview document" (click)="$event.stopPropagation()" i18n-linkTitle #popupPreview>
+                          <i-bs name="eye"></i-bs>
+                        </pngx-preview-popup>
+                      </div>
                    }
                    @if (activeDisplayFields.includes(DisplayField.TAGS)) {
                      @for (tagID of d.tags; track tagID) {
@@ -24,7 +24,7 @@ export interface SystemStatus {
    status: SystemStatusItemStatus
    error?: string
    migration_status: {
-      latest_migration: string | null
+      latest_migration: string
      unapplied_migrations: string[]
    }
  }
@@ -9,7 +9,11 @@ import {
 } from '@angular/common/http/testing'
 import { TestBed } from '@angular/core/testing'
 import { environment } from 'src/environments/environment'
-import { PaperlessTaskType } from '../data/paperless-task'
+import {
+  PaperlessTaskStatus,
+  PaperlessTaskTriggerSource,
+  PaperlessTaskType,
+} from '../data/paperless-task'
 import { TasksService } from './tasks.service'

 describe('TasksService', () => {
@@ -34,23 +38,23 @@ describe('TasksService', () => {
    httpTestingController.verify()
  })

-  it('calls tasks status counts api endpoint on reload', () => {
+  it('calls tasks api endpoint on reload', () => {
    tasksService.reload()
    const req = httpTestingController.expectOne(
      (req: HttpRequest<unknown>) =>
-        req.url === `${environment.apiBaseUrl}tasks/status_counts/` &&
-        req.params.get('acknowledged') === 'false'
+        req.url === `${environment.apiBaseUrl}tasks/` &&
+        req.params.get('acknowledged') === 'false' &&
+        req.params.get('page_size') === '1000'
    )
    expect(req.request.method).toEqual('GET')
-    req.flush({ all: 5, needs_attention: 3, in_progress: 1, completed: 1 })
-    expect(tasksService.needsAttentionTasksCount).toEqual(3)
+    req.flush({ count: 0, results: [] })
  })

  it('cancels an in-progress reload when reloading again', () => {
    tasksService.reload()
    const staleReload = httpTestingController.expectOne(
      (req: HttpRequest<unknown>) =>
-        req.url === `${environment.apiBaseUrl}tasks/status_counts/`
+        req.url === `${environment.apiBaseUrl}tasks/`
    )
    tasksService.reload()

@@ -58,9 +62,9 @@ describe('TasksService', () => {
    httpTestingController
      .expectOne(
        (req: HttpRequest<unknown>) =>
-          req.url === `${environment.apiBaseUrl}tasks/status_counts/`
+          req.url === `${environment.apiBaseUrl}tasks/`
      )
-      .flush({ all: 0, needs_attention: 0, in_progress: 0, completed: 0 })
+      .flush({ count: 0, results: [] })
  })

  it('continues reloading after a reload request fails', () => {
@@ -68,7 +72,7 @@ describe('TasksService', () => {
    httpTestingController
      .expectOne(
        (req: HttpRequest<unknown>) =>
-          req.url === `${environment.apiBaseUrl}tasks/status_counts/`
+          req.url === `${environment.apiBaseUrl}tasks/`
      )
      .flush('error', { status: 500, statusText: 'error' })

@@ -78,16 +82,16 @@ describe('TasksService', () => {
    httpTestingController
      .expectOne(
        (req: HttpRequest<unknown>) =>
-          req.url === `${environment.apiBaseUrl}tasks/status_counts/`
+          req.url === `${environment.apiBaseUrl}tasks/`
      )
-      .flush({ all: 0, needs_attention: 0, in_progress: 0, completed: 0 })
+      .flush({ count: 0, results: [] })
  })

  it('reloads after dismissing a task while a reload is already in progress', () => {
    tasksService.reload()
    const staleReload = httpTestingController.expectOne(
      (req: HttpRequest<unknown>) =>
-        req.url === `${environment.apiBaseUrl}tasks/status_counts/` &&
+        req.url === `${environment.apiBaseUrl}tasks/` &&
        req.params.get('acknowledged') === 'false'
    )

@@ -100,12 +104,12 @@ describe('TasksService', () => {
    httpTestingController
      .expectOne(
        (req: HttpRequest<unknown>) =>
-          req.url === `${environment.apiBaseUrl}tasks/status_counts/` &&
+          req.url === `${environment.apiBaseUrl}tasks/` &&
          req.params.get('acknowledged') === 'false'
      )
-      .flush({ all: 50, needs_attention: 42, in_progress: 3, completed: 5 })
+      .flush({ count: 0, results: [] })

-    expect(tasksService.needsAttentionTasksCount).toEqual(42)
+    expect(tasksService.needsAttentionTasks).toHaveLength(0)
  })

  it('calls acknowledge_tasks api endpoint on dismiss and reloads', () => {
@@ -122,10 +126,11 @@ describe('TasksService', () => {
    httpTestingController
      .expectOne(
        (req: HttpRequest<unknown>) =>
-          req.url === `${environment.apiBaseUrl}tasks/status_counts/` &&
-          req.params.get('acknowledged') === 'false'
+          req.url === `${environment.apiBaseUrl}tasks/` &&
+          req.params.get('acknowledged') === 'false' &&
+          req.params.get('page_size') === '1000'
      )
-      .flush({ all: 0, needs_attention: 0, in_progress: 0, completed: 0 })
+      .flush({ count: 0, results: [] })
  })

  it('calls acknowledge_tasks api endpoint on dismiss all and reloads', () => {
@@ -142,10 +147,65 @@ describe('TasksService', () => {
    httpTestingController
      .expectOne(
        (req: HttpRequest<unknown>) =>
-          req.url === `${environment.apiBaseUrl}tasks/status_counts/` &&
-          req.params.get('acknowledged') === 'false'
+          req.url === `${environment.apiBaseUrl}tasks/` &&
+          req.params.get('acknowledged') === 'false' &&
+          req.params.get('page_size') === '1000'
      )
-      .flush({ all: 0, needs_attention: 0, in_progress: 0, completed: 0 })
+      .flush({ count: 0, results: [] })
+  })
+
+  it('includes revoked tasks in needs attention', () => {
+    const mockTasks = [
+      {
+        task_type: PaperlessTaskType.SanityCheck,
+        trigger_source: PaperlessTaskTriggerSource.System,
+        status: PaperlessTaskStatus.Failure,
+        acknowledged: false,
+        task_id: '1235',
+        input_data: {},
+        date_created: new Date(),
+        related_document_ids: [],
+      },
+      {
+        task_type: PaperlessTaskType.MailFetch,
+        trigger_source: PaperlessTaskTriggerSource.Scheduled,
+        status: PaperlessTaskStatus.Revoked,
+        acknowledged: false,
+        task_id: '1236',
+        input_data: {},
+        date_created: new Date(),
+        related_document_ids: [],
+      },
+      {
+        task_type: PaperlessTaskType.EmptyTrash,
+        trigger_source: PaperlessTaskTriggerSource.Manual,
+        status: PaperlessTaskStatus.Success,
+        acknowledged: false,
+        task_id: '1238',
+        input_data: {},
+        date_created: new Date(),
+        related_document_ids: [],
+      },
+    ]
+
+    tasksService.reload()
+
+    const req = httpTestingController.expectOne(
+      (req: HttpRequest<unknown>) =>
+        req.url === `${environment.apiBaseUrl}tasks/` &&
+        req.params.get('acknowledged') === 'false' &&
+        req.params.get('page_size') === '1000'
+    )
+
+    req.flush({ count: mockTasks.length, results: mockTasks })
+
+    expect(tasksService.needsAttentionTasks).toHaveLength(2)
+    expect(tasksService.needsAttentionTasks.map((task) => task.status)).toEqual(
+      expect.arrayContaining([
+        PaperlessTaskStatus.Failure,
+        PaperlessTaskStatus.Revoked,
+      ])
+    )
  })

  it('supports running tasks', () => {
@@ -5,12 +5,14 @@ import {
  catchError,
  finalize,
  first,
+  map,
  switchMap,
  takeUntil,
  tap,
 } from 'rxjs/operators'
 import {
  PaperlessTask,
+  PaperlessTaskStatus,
  PaperlessTaskStatusCounts,
  PaperlessTaskType,
 } from 'src/app/data/paperless-task'
@@ -25,42 +27,50 @@ export class TasksService {

  private baseUrl: string = environment.apiBaseUrl
  private endpoint: string = 'tasks'
+  private readonly defaultReloadPageSize = 1000

  public loading: boolean = false

-  private readonly tasksStatusCounts = signal<PaperlessTaskStatusCounts>({
-    all: 0,
-    needs_attention: 0,
-    in_progress: 0,
-    completed: 0,
-  })
+  private readonly tasks = signal<PaperlessTask[]>([])
  private readonly reloadNotifier = new Subject<void>()

  private unsubscribeNotifer: Subject<any> = new Subject()

  constructor() {
    this.reloadNotifier
-      .pipe(switchMap(() => this.fetchUnacknowledgedTasksCounts()))
-      .subscribe((taskStatusCounts) => {
-        this.tasksStatusCounts.set(taskStatusCounts)
+      .pipe(
+        switchMap(() => {
+          this.loading = true
+          return this.http
+            .get<Results<PaperlessTask>>(`${this.baseUrl}${this.endpoint}/`, {
+              params: {
+                acknowledged: 'false',
+                page_size: this.defaultReloadPageSize,
+              },
+            })
+            .pipe(
+              map((response) => response.results),
+              takeUntil(this.unsubscribeNotifer),
+              catchError(() => EMPTY),
+              finalize(() => {
+                this.loading = false
+              })
+            )
+        })
+      )
+      .subscribe((tasks) => {
+        this.tasks.set(tasks)
      })
  }

-  private fetchUnacknowledgedTasksCounts(): Observable<PaperlessTaskStatusCounts> {
-    this.loading = true
-    return this.statusCounts({ acknowledged: false }).pipe(
-      takeUntil(this.unsubscribeNotifer),
-      catchError(() => EMPTY),
-      finalize(() => {
-        this.loading = false
-      })
+  public get needsAttentionTasks(): PaperlessTask[] {
+    return this.tasks().filter((t) =>
+      [PaperlessTaskStatus.Failure, PaperlessTaskStatus.Revoked].includes(
+        t.status
+      )
    )
  }

-  public get needsAttentionTasksCount(): number {
-    return this.tasksStatusCounts().needs_attention
-  }
-
  public reload() {
    this.reloadNotifier.next()
  }
@@ -95,7 +105,7 @@ export class TasksService {

  public dismissTasks(task_ids: Set<number>): Observable<any> {
    return this.http
-      .post(`${this.baseUrl}${this.endpoint}/acknowledge/`, {
+      .post(`${this.baseUrl}tasks/acknowledge/`, {
        tasks: [...task_ids],
      })
      .pipe(
@@ -109,7 +119,7 @@ export class TasksService {

  public dismissAllTasks(): Observable<any> {
    return this.http
-      .post(`${this.baseUrl}${this.endpoint}/acknowledge/`, {
+      .post(`${this.baseUrl}tasks/acknowledge/`, {
        all: true,
      })
      .pipe(
@@ -8,7 +8,7 @@ export const environment = {
  apiVersion: '10', // match src/paperless/settings.py
  appTitle: DEFAULT_APP_TITLE,
  tag: 'prod',
-  version: '3.4.1',
+  version: '3.3.4',
  webSocketHost: window.location.host,
  webSocketProtocol: window.location.protocol == 'https:' ? 'wss:' : 'ws:',
  webSocketBaseUrl: base_url.pathname + 'ws/',
@@ -11,8 +11,6 @@ from typing import TYPE_CHECKING

 import pytest

-from paperless_testing import samples
-
 if TYPE_CHECKING:
    from collections.abc import Generator
    from pathlib import Path
@@ -151,39 +149,3 @@ def fake_progress_manager(

    monkeypatch.setattr("documents.tasks.ProgressManager", FakeProgressManager)
    return FakeProgressManager
-
-
-@pytest.fixture(scope="session")
-def shared_samples_dir() -> Path:
-    """Directory of sample files used by more than one app's tests."""
-    return samples.SHARED_SAMPLES_DIR
-
-
-@pytest.fixture(scope="session")
-def simple_digital_pdf_file() -> Path:
-    """One-page PDF with a text layer."""
-    return samples.SIMPLE_DIGITAL_PDF
-
-
-@pytest.fixture(scope="session")
-def multi_page_digital_pdf_file() -> Path:
-    """Three-page PDF with a text layer."""
-    return samples.MULTI_PAGE_DIGITAL_PDF
-
-
-@pytest.fixture(scope="session")
-def with_form_pdf_file() -> Path:
-    """PDF containing a fillable form."""
-    return samples.WITH_FORM_PDF
-
-
-@pytest.fixture(scope="session")
-def multi_page_images_pdf_file() -> Path:
-    """Multi-page PDF of scanned images, no text layer."""
-    return samples.MULTI_PAGE_IMAGES_PDF
-
-
-@pytest.fixture(scope="session")
-def thumbnail_webp_file() -> Path:
-    """Small WebP thumbnail."""
-    return samples.THUMBNAIL_WEBP
@@ -10,6 +10,9 @@ from typing import TYPE_CHECKING
 import regex as regex_mod
 from django.conf import settings
 from pdf2image import convert_from_path
+from pikepdf import Page
+from pikepdf import PasswordError
+from pikepdf import Pdf

 from documents.converters import convert_from_tiff_to_pdf
 from documents.data_models import ConsumableDocument
@@ -31,7 +34,6 @@ from documents.utils import maybe_override_pixel_limit
 from paperless.config import BarcodeConfig

 if TYPE_CHECKING:
-    from pikepdf import Page
    from PIL import Image

 logger = logging.getLogger("paperless.barcodes")
@@ -280,8 +282,6 @@ class BarcodePlugin(ConsumeTaskPlugin):
        # No op if not a TIFF
        self.convert_from_tiff_to_pdf()

-        from pikepdf import PasswordError
-
        try:
            self.barcodes = scan_pdf(
                self.pdf_file,
@@ -433,8 +433,6 @@ class BarcodePlugin(ConsumeTaskPlugin):

        document_paths = []
        fname: str = self.input_doc.original_file.stem
-        from pikepdf import Pdf
-
        with Pdf.open(self.pdf_file) as input_pdf:
            # Start with an empty document
            current_document: list[Page] = []
@@ -518,8 +516,6 @@ def scan_pdf(pdf_path: Path, settings: BarcodeConfig, work_dir: Path) -> list[Ba
    """
    barcodes: list[Barcode] = []

-    from pikepdf import Pdf
-
    with Pdf.open(pdf_path) as pdf:
        num_of_pages = len(pdf.pages)
    logger.debug(f"PDF has {num_of_pages} pages")
@@ -36,7 +36,6 @@ from documents.models import DocumentType
 from documents.models import PaperlessTask
 from documents.models import StoragePath
 from documents.models import Tag
-from documents.permissions import PermissionsSpec
 from documents.permissions import set_permissions_for_objects
 from documents.plugins.helpers import DocumentsStatusManager
 from documents.tasks import bulk_update_documents
@@ -453,7 +452,7 @@ def reprocess(doc_ids: list[int], *, remote_ocr: bool = False) -> Literal["OK"]:

 def set_permissions(
    doc_ids: list[int],
-    set_permissions: PermissionsSpec,
+    set_permissions: dict,
    *,
    owner: User | None = None,
    merge: bool = False,
@@ -38,8 +38,7 @@ from documents.models import StoragePath
 from documents.models import Tag
 from documents.models import WorkflowTrigger
 from documents.parsers import ParseError
-from documents.permissions import PermissionsSpec
-from documents.permissions import set_permissions_for_objects
+from documents.permissions import set_permissions_for_object
 from documents.plugins.base import AlwaysRunPluginMixin
 from documents.plugins.base import ConsumeTaskPlugin
 from documents.plugins.base import NoCleanupPluginMixin
@@ -847,19 +846,6 @@ class ConsumerPlugin(
            local_added,
            self.filename,
            self.filename,
-            custom_fields=[
-                CustomFieldInstance(
-                    field=field,
-                    **{
-                        CustomFieldInstance.get_value_field_name(
-                            field.data_type,
-                        ): self.metadata.custom_fields[field.pk],
-                    },
-                )
-                for field in CustomField.objects.filter(
-                    pk__in=self.metadata.custom_fields or {},
-                )
-            ],
        )

    def _store(
@@ -962,7 +948,7 @@ class ConsumerPlugin(
            or self.metadata.change_users is not None
            or self.metadata.change_groups is not None
        ):
-            permissions: PermissionsSpec = {
+            permissions = {
                "view": {
                    "users": self.metadata.view_users or [],
                    "groups": self.metadata.view_groups or [],
@@ -972,7 +958,7 @@ class ConsumerPlugin(
                    "groups": self.metadata.change_groups or [],
                },
            }
-            set_permissions_for_objects(permissions, Document, [document.pk])
+            set_permissions_for_object(permissions=permissions, object=document)

        if self.metadata.custom_fields:
            for field in CustomField.objects.filter(