Enhancement: skip local 2FA for trusted OIDC AMR

2026-10-19 22:38:13 +00:00 · 2026-10-10 12:27:39 -07:00
191 changed files with 32825 additions and 33758 deletions
@@ -66,7 +66,7 @@ services:
    command:
      - "gotenberg"
      - "--chromium-disable-javascript=true"
-      - "--chromium-allow-list=^file:///tmp/.*"
+      - "--chromium-allow-list=file:///tmp/.*"
  tika:
    image: docker.io/apache/tika:3.3.1.0
    restart: unless-stopped
@@ -31,19 +31,9 @@ body:
      value: |
        #### 🤖 Use of AI tools

-        If this report was generated, in whole or in part, by an AI tool or agent you **must** say so using the field below. Failing to clearly disclose this is a violation of our [Code of Conduct](https://github.com/paperless-ngx/paperless-ngx/blob/main/CODE_OF_CONDUCT.md).
+        If this report was generated, in whole or in part, by an AI tool or agent you **must** clearly say so in the description below. Failing to clearly disclose this is a violation of our [Code of Conduct](https://github.com/paperless-ngx/paperless-ngx/blob/main/CODE_OF_CONDUCT.md).

        Reports written by an AI agent must describe the _observed behavior only_: what happened, how to reproduce it, logs etc. Do **not** include code analysis, speculation about the root cause, or suggest code fixes.
-  - type: dropdown
-    id: ai-usage
-    attributes:
-      label: AI usage
-      description: Was any part of this report written by an AI tool or agent?
-      options:
-        - No AI tools were used
-        - Yes, AI tools helped write this report
-    validations:
-      required: true
  - type: textarea
    id: description
    attributes:
@@ -43,12 +43,6 @@ jobs:
            const haystack = `${issue.title}\n${issue.body ?? ''}`;
            const honeypot = haystack.toUpperCase().includes('ASLOP-PR-VERIFY');

-            // The form's required "AI usage" dropdown renders as a `### AI usage` section. An agent
-            // that follows the template trips the honeypot even when it discloses, so only treat
-            // the honeypot as undisclosed AI use when the reporter did not answer "Yes" here.
-            const aiUsage = (issue.body ?? '').match(/^###\s+AI usage\s*\n+\s*(.+?)\s*$/m)?.[1] ?? '';
-            const disclosedAI = aiUsage.toLowerCase().startsWith('yes');
-
            // Issues opened through the form always get the template's default labels. GitHub
            // applies them a second or two *after* creation, so re-read them instead of trusting
            // the webhook payload, and retry before concluding that there are none.
@@ -61,30 +55,19 @@ jobs:
              if (labels.some((label) => templateLabels.includes(label))) break;
            }
            const bypassedTemplate = !labels.some((label) => templateLabels.includes(label));
-            core.info(
-              `Labels: [${labels.join(', ')}], honeypot: ${honeypot}, AI usage: "${aiUsage}", ` +
-                `bypassed template: ${bypassedTemplate}`
-            );
+            core.info(`Labels: [${labels.join(', ')}], honeypot: ${honeypot}, bypassed template: ${bypassedTemplate}`);

-            if (!bypassedTemplate && (disclosedAI || !honeypot)) {
-              if (disclosedAI) {
-                core.info('AI use disclosed, labeling only');
-                await github.rest.issues.addLabels({ ...common, labels: ['ai'] });
-              } else {
-                core.info('No slop signals found');
-              }
+            if (!honeypot && !bypassedTemplate) {
+              core.info('No slop signals found');
              return;
            }

+            // The honeypot is only ever tripped deliberately, so that message can name the cause.
            // A missing template label only tells us the issue did not come from the form, which
-            // is reason enough to close it, but not proof of how it was written. It takes priority:
-            // a hand-built body can carry the honeypot *and* a disclosure, and the form message is
-            // the only one that is accurate for both. Reaching the honeypot message means the issue
-            // came from the form without disclosing AI usage, so that message can name the cause.
-            const body = honeypot && !bypassedTemplate
+            // is reason enough to close it, but not proof of how it was written.
+            const body = honeypot
              ? 'This issue was automatically closed because it contains a marker that is only visible to ' +
-                'automated tools, which indicates it was generated by an AI agent, but the "AI usage" field does not ' +
-                'disclose this.\n\n' +
+                'automated tools, which indicates it was generated by an AI agent without being disclosed as such.\n\n' +
                `Please see our [contributing guidelines](${contributing}) and [Code of Conduct](${codeOfConduct}). ` +
                'You are welcome to open a new issue that describes the problem you observed in your own words.'
              : 'This issue was automatically closed because it was not opened using our bug report form. ' +
@@ -38,6 +38,16 @@ jobs:
        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Label by size
+        uses: Gascon1/pr-size-labeler@deff8ed00a76639a7c0f197525bafa3350ba4c36 # v1.3.0
+        with:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          xs_label: 'small-change'
+          xs_diff: '9'
+          s_label: 'non-trivial'
+          s_diff: '99999'
+          fail_if_xl: 'false'
+          excluded_files: /\.lock$/ /\.txt$/ ^src-ui/pnpm-lock\.yaml$ ^src-ui/messages\.xlf$ ^src/locale/en_US/LC_MESSAGES/django\.po$
      - name: Label by PR title
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
@@ -43,17 +43,26 @@ Once you have submitted a **P**ull **R**equest it will be reviewed, approved, an

 Important: Pull requests that implement a new feature or enhancement _should almost always target an existing feature request_ with evidence of community interest and discussion. This is in order to balance the work of implementing and maintaining new features / enhancements. Instead of opening a PR which does not meet this requirement, please open a feature request instead, to gather feedback from both users and the project maintainers.

-## PR Review Process
+## Non-Trivial Requests

-Our community review process for PRs is the following:
+PRs deemed `non-trivial` will go through a stricter review process before being merged into `dev`. This is to ensure code quality and complete functionality (free of side effects).
+
+Examples of `non-trivial` PRs might include:
+
+- Additional features
+- Large changes to many distinct files
+- Breaking or deprecation of existing features
+
+Our community review process for `non-trivial` PRs is the following:

 1. Must pass usual automated code tests and formatting checks.
 2. The PR will be assigned and pinged to the appropriately experienced team (i.e. @paperless-ngx/backend for backend changes).
 3. Development team will check and test code manually (possibly over several days).
   - You may be asked to make changes or rebase.
-4. One or more members of the team will approve and finally merge the request into `dev` 🎉.
+   - The team may ask for additional testing done by @paperless-ngx/test
+4. **At least two** members of the team will approve and finally merge the request into `dev` 🎉.

-This process might be slow as community members have different schedules and time to dedicate to the Paperless project. However it ensures community code reviews are thorough and of high quality.
+This process might be slow as community members have different schedules and time to dedicate to the Paperless project. However it ensures community code reviews are as brilliantly thorough as they once were with @jonaswinkler.

 # Use of AI Tools

@@ -21,7 +21,7 @@ Paperless-ngx is a document management system that transforms your physical docu

 Paperless-ngx is the official successor to the original [Paperless](https://github.com/the-paperless-project/paperless) & [Paperless-ng](https://github.com/jonaswinkler/paperless-ng) projects and is designed to distribute the responsibility of advancing and supporting the project among a team of people. [Consider joining us!](#community-support)

-Thanks to the generous folks at [Fyra Stack](https://fyrastack.com), a demo is available at [demo.paperless-ngx.com](https://demo.paperless-ngx.com) using login `demo` / `demo`. _Note: demo content is reset frequently and confidential information should not be uploaded._
+Thanks to the generous folks at [DigitalOcean](https://m.do.co/c/8d70b916d462), a demo is available at [demo.paperless-ngx.com](https://demo.paperless-ngx.com) using login `demo` / `demo`. _Note: demo content is reset frequently and confidential information should not be uploaded._

 - [Features](#features)
 - [Getting started](#getting-started)
@@ -33,9 +33,13 @@ Thanks to the generous folks at [Fyra Stack](https://fyrastack.com), a demo is a
 - [Related Projects](#related-projects)
 - [Important Note](#important-note)

-<p align="right">Demo hosting provided by:<br/>
-  <a href="https://fyrastack.com">
-    <img src="docs/assets/sponsors/fyra-stack.svg" alt="" width="28px" align="absmiddle"> Fyra Stack
+<p align="right">This project is supported by:<br/>
+  <a href="https://m.do.co/c/8d70b916d462" style="padding-top: 4px; display: block;">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_white.svg" width="140px">
+      <source media="(prefers-color-scheme: light)" srcset="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" width="140px">
+      <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_black_.svg" width="140px">
+    </picture>
  </a>
 </p>

@@ -14,7 +14,7 @@ services:
    command:
      - "gotenberg"
      - "--chromium-disable-javascript=true"
-      - "--chromium-allow-list=^file:///tmp/.*"
+      - "--chromium-allow-list=file:///tmp/.*"
      - "--log-level=warn"
      - "--log-format=text"
  tika:
@@ -40,6 +40,7 @@ services:
    volumes:
      - dbdata:/var/lib/mysql
    environment:
+      MARIADB_HOST: paperless
      MARIADB_DATABASE: paperless
      MARIADB_USER: paperless
      MARIADB_PASSWORD: paperless
@@ -78,7 +79,7 @@ services:
    command:
      - "gotenberg"
      - "--chromium-disable-javascript=true"
-      - "--chromium-allow-list=^file:///tmp/.*"
+      - "--chromium-allow-list=file:///tmp/.*"
  tika:
    image: docker.io/apache/tika:3.3.1.0
    restart: unless-stopped
@@ -36,6 +36,7 @@ services:
    volumes:
      - dbdata:/var/lib/mysql
    environment:
+      MARIADB_HOST: paperless
      MARIADB_DATABASE: paperless
      MARIADB_USER: paperless
      MARIADB_PASSWORD: paperless
@@ -74,7 +74,7 @@ services:
    command:
      - "gotenberg"
      - "--chromium-disable-javascript=true"
-      - "--chromium-allow-list=^file:///tmp/.*"
+      - "--chromium-allow-list=file:///tmp/.*"
  tika:
    image: docker.io/apache/tika:3.3.1.0
    restart: unless-stopped
@@ -63,7 +63,7 @@ services:
    command:
      - "gotenberg"
      - "--chromium-disable-javascript=true"
-      - "--chromium-allow-list=^file:///tmp/.*"
+      - "--chromium-allow-list=file:///tmp/.*"
  tika:
    image: docker.io/apache/tika:3.3.1.0
    restart: unless-stopped
@@ -101,32 +101,3 @@ h4 code {
        border-top: .05rem solid var(--md-default-fg-color--lightest);
    }
 }
-
-.md-typeset .demo-sponsor {
-    display: flex;
-    align-items: center;
-    flex-wrap: wrap;
-    gap: .35rem;
-    margin-top: -1rem;
-    margin-bottom: 2rem;
-    color: var(--md-default-fg-color--light);
-    font-size: .65rem;
-}
-
-.md-typeset .demo-sponsor a {
-    display: inline-flex;
-    align-items: center;
-    gap: .25rem;
-    color: inherit;
-    font-weight: 600;
-}
-
-.md-typeset .demo-sponsor a:hover {
-    color: var(--md-accent-fg-color);
-}
-
-.md-typeset .demo-sponsor img {
-    width: 1rem;
-    height: 1rem;
-    flex-shrink: 0;
-}
@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="666.667" height="666.667" viewBox="0 0 666.667 666.667"><g stroke-width="1.333"><path fill="#fef400" d="m332.66668 418.66668h-84.66667v-85.33334-85.33333h84.66667 84.66667v-85.33334-85.333334h85.33333 85.33334v85.333334 85.33334h-85.33334-85.33333v85.33333 85.33334z"/><path fill="#fe6565" d="m248.00001 589.33335h-170.666674v-170.66667-170.66667h85.333334 85.33334v-85.33334-85.333334h84.66667 84.66667v85.333334 85.33334h85.33333 85.33334v85.33333 85.33334h-84.66667-84.66667v85.33334 85.33333zm84.66667-170.66667h84.66667v-85.33334-85.33333h-84.66667-84.66667v85.33333 85.33334z"/></g></svg>
@@ -1,238 +1,5 @@
 # Changelog

-## paperless-ngx 3.3.3
-
-### Bug Fixes
-
- Fix: fix global search input layout shifting [@shamoon](https://github.com/shamoon) ([#14491](https://github.com/paperless-ngx/paperless-ngx/pull/14491))
- Fix: dont include doc content on global search results [@shamoon](https://github.com/shamoon) ([#14488](https://github.com/paperless-ngx/paperless-ngx/pull/14488))
- Fix: remove some redundant pagers [@shamoon](https://github.com/shamoon) ([#14487](https://github.com/paperless-ngx/paperless-ngx/pull/14487))
- Fix: prevent weird wrapping of dashboard widget column titles [@shamoon](https://github.com/shamoon) ([#14486](https://github.com/paperless-ngx/paperless-ngx/pull/14486))
- Fix: dont paginate 'all' tasks view across sections [@shamoon](https://github.com/shamoon) ([#14484](https://github.com/paperless-ngx/paperless-ngx/pull/14484))
- Fix: use float parsing for importer manifest records with a passphrase [@stumpylog](https://github.com/stumpylog) ([#14483](https://github.com/paperless-ngx/paperless-ngx/pull/14483))
- Fix: respect subpath in logout, share link and auto-login redirects [@jaimevelaz](https://github.com/jaimevelaz) ([#14476](https://github.com/paperless-ngx/paperless-ngx/pull/14476))
- Fix: dont tie suggestions button to ai enabled any more [@shamoon](https://github.com/shamoon) ([#14478](https://github.com/paperless-ngx/paperless-ngx/pull/14478))
- Fix: handle single-class classifier in threshold prediction (#<!---->14471) [@stumpylog](https://github.com/stumpylog) ([#14473](https://github.com/paperless-ngx/paperless-ngx/pull/14473))
- Fix: keep counter and extension when shortening long public filenames [@stumpylog](https://github.com/stumpylog) ([#14472](https://github.com/paperless-ngx/paperless-ngx/pull/14472))
-
-### All App Changes
-
-<details>
-<summary>10 changes</summary>
-
- Fix: fix global search input layout shifting [@shamoon](https://github.com/shamoon) ([#14491](https://github.com/paperless-ngx/paperless-ngx/pull/14491))
- Fix: dont include doc content on global search results [@shamoon](https://github.com/shamoon) ([#14488](https://github.com/paperless-ngx/paperless-ngx/pull/14488))
- Fix: remove some redundant pagers [@shamoon](https://github.com/shamoon) ([#14487](https://github.com/paperless-ngx/paperless-ngx/pull/14487))
- Fix: prevent weird wrapping of dashboard widget column titles [@shamoon](https://github.com/shamoon) ([#14486](https://github.com/paperless-ngx/paperless-ngx/pull/14486))
- Fix: dont paginate 'all' tasks view across sections [@shamoon](https://github.com/shamoon) ([#14484](https://github.com/paperless-ngx/paperless-ngx/pull/14484))
- Fix: use float parsing for importer manifest records with a passphrase [@stumpylog](https://github.com/stumpylog) ([#14483](https://github.com/paperless-ngx/paperless-ngx/pull/14483))
- Fix: respect subpath in logout, share link and auto-login redirects [@jaimevelaz](https://github.com/jaimevelaz) ([#14476](https://github.com/paperless-ngx/paperless-ngx/pull/14476))
- Fix: dont tie suggestions button to ai enabled any more [@shamoon](https://github.com/shamoon) ([#14478](https://github.com/paperless-ngx/paperless-ngx/pull/14478))
- Fix: handle single-class classifier in threshold prediction (#<!---->14471) [@stumpylog](https://github.com/stumpylog) ([#14473](https://github.com/paperless-ngx/paperless-ngx/pull/14473))
- Fix: keep counter and extension when shortening long public filenames [@stumpylog](https://github.com/stumpylog) ([#14472](https://github.com/paperless-ngx/paperless-ngx/pull/14472))
-
-</details>
-
-## paperless-ngx 3.3.2
-
-### Bug Fixes
-
- Fix: copy only direct user grants in DocumentMetadataOverrides.from\_document [@stumpylog](https://github.com/stumpylog) ([#14452](https://github.com/paperless-ngx/paperless-ngx/pull/14452))
- Fix: support combined text/query searches [@shamoon](https://github.com/shamoon) ([#14443](https://github.com/paperless-ngx/paperless-ngx/pull/14443))
- Fix: make exporter derived file names unique when originals differ only by extension [@stumpylog](https://github.com/stumpylog) ([#14429](https://github.com/paperless-ngx/paperless-ngx/pull/14429))
-
-### Dependencies
-
- Chore(deps): Bump filelock from 3.32.6 to 4.0.12 @[dependabot[bot]](https://github.com/apps/dependabot) ([#14336](https://github.com/paperless-ngx/paperless-ngx/pull/14336))
- Chore(deps): Bump the uv group across 1 directory with 3 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14418](https://github.com/paperless-ngx/paperless-ngx/pull/14418))
-
-### All App Changes
-
-<details>
-<summary>5 changes</summary>
-
- Fix: copy only direct user grants in DocumentMetadataOverrides.from\_document [@stumpylog](https://github.com/stumpylog) ([#14452](https://github.com/paperless-ngx/paperless-ngx/pull/14452))
- Chore(deps): Bump filelock from 3.32.6 to 4.0.12 @[dependabot[bot]](https://github.com/apps/dependabot) ([#14336](https://github.com/paperless-ngx/paperless-ngx/pull/14336))
- Fix: support combined text/query searches [@shamoon](https://github.com/shamoon) ([#14443](https://github.com/paperless-ngx/paperless-ngx/pull/14443))
- Chore(deps): Bump the uv group across 1 directory with 3 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14418](https://github.com/paperless-ngx/paperless-ngx/pull/14418))
- Fix: make exporter derived file names unique when originals differ only by extension [@stumpylog](https://github.com/stumpylog) ([#14429](https://github.com/paperless-ngx/paperless-ngx/pull/14429))
-
-</details>
-
-## paperless-ngx 3.3.1
-
-### Bug Fixes
-
- Fix: use a root document's effective content for the LLM index and pr… [@stumpylog](https://github.com/stumpylog) ([#14423](https://github.com/paperless-ngx/paperless-ngx/pull/14423))
- Fix: index document versions as their root document [@stumpylog](https://github.com/stumpylog) ([#14422](https://github.com/paperless-ngx/paperless-ngx/pull/14422))
- Fix: authorize document versions by their root in the single-object permission check [@stumpylog](https://github.com/stumpylog) ([#14421](https://github.com/paperless-ngx/paperless-ngx/pull/14421))
- Fix: Provide better error messages to users for invalid JSON [@stumpylog](https://github.com/stumpylog) ([#14419](https://github.com/paperless-ngx/paperless-ngx/pull/14419))
- Fix: authorize document versions by their root and speed up permission id sets [@stumpylog](https://github.com/stumpylog) ([#14396](https://github.com/paperless-ngx/paperless-ngx/pull/14396))
- Chore: update the db options warning [@shamoon](https://github.com/shamoon) ([#14398](https://github.com/paperless-ngx/paperless-ngx/pull/14398))
- Fix: bulk reprocess latest version for root documents [@shamoon](https://github.com/shamoon) ([#14385](https://github.com/paperless-ngx/paperless-ngx/pull/14385))
- Fix: consistently use root doc for version action permissions [@shamoon](https://github.com/shamoon) ([#14384](https://github.com/paperless-ngx/paperless-ngx/pull/14384))
- Fix: Don't attempt to index created dates which are not representable in the FTS index [@stumpylog](https://github.com/stumpylog) ([#14390](https://github.com/paperless-ngx/paperless-ngx/pull/14390))
- Fix: retry a search index rebuild that was interrupted [@stumpylog](https://github.com/stumpylog) ([#14379](https://github.com/paperless-ngx/paperless-ngx/pull/14379))
-
-### Documentation
-
- Chore: silence gotenberg startup warning [@slankes](https://github.com/slankes) ([#14405](https://github.com/paperless-ngx/paperless-ngx/pull/14405))
- Documentation: remove MARIADB\_HOST from MariaDB compose files [@shamoon](https://github.com/shamoon) ([#14378](https://github.com/paperless-ngx/paperless-ngx/pull/14378))
- Documentation: Updates the troubleshooting with 2 common database collation issues [@stumpylog](https://github.com/stumpylog) ([#14370](https://github.com/paperless-ngx/paperless-ngx/pull/14370))
-
-### Maintenance
-
- Chore: Upgrade runners to Ubuntu 26.04 [@stumpylog](https://github.com/stumpylog) ([#14347](https://github.com/paperless-ngx/paperless-ngx/pull/14347))
-
-### Dependencies
-
- Chore(deps): Bump the npm\_and\_yarn group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14417](https://github.com/paperless-ngx/paperless-ngx/pull/14417))
-
-### All App Changes
-
-<details>
-<summary>12 changes</summary>
-
- Chore: share the authorizing owner rule between the id sets and the trash filter [@stumpylog](https://github.com/stumpylog) ([#14425](https://github.com/paperless-ngx/paperless-ngx/pull/14425))
- Fix: use a root document's effective content for the LLM index and pr… [@stumpylog](https://github.com/stumpylog) ([#14423](https://github.com/paperless-ngx/paperless-ngx/pull/14423))
- Fix: index document versions as their root document [@stumpylog](https://github.com/stumpylog) ([#14422](https://github.com/paperless-ngx/paperless-ngx/pull/14422))
- Fix: authorize document versions by their root in the single-object permission check [@stumpylog](https://github.com/stumpylog) ([#14421](https://github.com/paperless-ngx/paperless-ngx/pull/14421))
- Fix: Provide better error messages to users for invalid JSON [@stumpylog](https://github.com/stumpylog) ([#14419](https://github.com/paperless-ngx/paperless-ngx/pull/14419))
- Chore(deps): Bump the npm\_and\_yarn group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14417](https://github.com/paperless-ngx/paperless-ngx/pull/14417))
- Fix: authorize document versions by their root and speed up permission id sets [@stumpylog](https://github.com/stumpylog) ([#14396](https://github.com/paperless-ngx/paperless-ngx/pull/14396))
- Chore: update the db options warning [@shamoon](https://github.com/shamoon) ([#14398](https://github.com/paperless-ngx/paperless-ngx/pull/14398))
- Fix: bulk reprocess latest version for root documents [@shamoon](https://github.com/shamoon) ([#14385](https://github.com/paperless-ngx/paperless-ngx/pull/14385))
- Fix: consistently use root doc for version action permissions [@shamoon](https://github.com/shamoon) ([#14384](https://github.com/paperless-ngx/paperless-ngx/pull/14384))
- Fix: Don't attempt to index created dates which are not representable in the FTS index [@stumpylog](https://github.com/stumpylog) ([#14390](https://github.com/paperless-ngx/paperless-ngx/pull/14390))
- Fix: retry a search index rebuild that was interrupted [@stumpylog](https://github.com/stumpylog) ([#14379](https://github.com/paperless-ngx/paperless-ngx/pull/14379))
-
-</details>
-
-## paperless-ngx 3.3.0
-
-### Features / Enhancements
-
- Enhancement: more control over suggestion requests [@shamoon](https://github.com/shamoon) ([#14258](https://github.com/paperless-ngx/paperless-ngx/pull/14258))
- Chorehancement: set manifest CORS for credentials [@shamoon](https://github.com/shamoon) ([#14307](https://github.com/paperless-ngx/paperless-ngx/pull/14307))
- Enhancement: include Django admin with 2FA [@shamoon](https://github.com/shamoon) ([#14270](https://github.com/paperless-ngx/paperless-ngx/pull/14270))
- Feature: propagate resolved secrets to interactive container shells [@stumpylog](https://github.com/stumpylog) ([#14254](https://github.com/paperless-ngx/paperless-ngx/pull/14254))
- Enhancement: support separate embedding API key [@furkanural](https://github.com/furkanural) ([#14067](https://github.com/paperless-ngx/paperless-ngx/pull/14067))
- Enhancement: support passthrough extra params for LLMs [@shamoon](https://github.com/shamoon) ([#14202](https://github.com/paperless-ngx/paperless-ngx/pull/14202))
- Feature: store barcode contents, list and search them [@jurassicparkicecream](https://github.com/jurassicparkicecream) ([#14276](https://github.com/paperless-ngx/paperless-ngx/pull/14276))
-
-### Bug Fixes
-
- Fix: Set the ProcessedMail owner based on the rule owner in all cases [@stumpylog](https://github.com/stumpylog) ([#14356](https://github.com/paperless-ngx/paperless-ngx/pull/14356))
- Fix: Ensure log rotation settings are converted to integers [@stumpylog](https://github.com/stumpylog) ([#14343](https://github.com/paperless-ngx/paperless-ngx/pull/14343))
- Fix: Wrap apt calls into a retry so we can ideally jump a slow mirror [@stumpylog](https://github.com/stumpylog) ([#14344](https://github.com/paperless-ngx/paperless-ngx/pull/14344))
- Fix: ship pdf.js CMaps so CJK documents render in the viewer [@MrOggy85](https://github.com/MrOggy85) ([#14318](https://github.com/paperless-ngx/paperless-ngx/pull/14318))
- Fix: use version page\_count for versioned document [@shamoon](https://github.com/shamoon) ([#14280](https://github.com/paperless-ngx/paperless-ngx/pull/14280))
- Fix: allow pointer events for pdf links in pngx viewer [@shamoon](https://github.com/shamoon) ([#14264](https://github.com/paperless-ngx/paperless-ngx/pull/14264))
- Fix: During a move to the trash directory, only attempt to copy metadata [@stumpylog](https://github.com/stumpylog) ([#14250](https://github.com/paperless-ngx/paperless-ngx/pull/14250))
- Fix: convert file mtime to the configured time zone directly [@stumpylog](https://github.com/stumpylog) ([#14249](https://github.com/paperless-ngx/paperless-ngx/pull/14249))
- Fix: ensure documentDeleted subscription is discarded [@shamoon](https://github.com/shamoon) ([#14247](https://github.com/paperless-ngx/paperless-ngx/pull/14247))
- Chore: Fix bugs in the test suite [@stumpylog](https://github.com/stumpylog) ([#14244](https://github.com/paperless-ngx/paperless-ngx/pull/14244))
- Fix: ensure bulk operations are checked against version root [@shamoon](https://github.com/shamoon) ([#14246](https://github.com/paperless-ngx/paperless-ngx/pull/14246))
- Fix: indexing after document-added workflows signal [@shamoon](https://github.com/shamoon) ([#14242](https://github.com/paperless-ngx/paperless-ngx/pull/14242))
- Fix: Record full tag and custom field lists in bulk edit audit log [@stumpylog](https://github.com/stumpylog) ([#14236](https://github.com/paperless-ngx/paperless-ngx/pull/14236))
- Chore: update pikepdf for ocrmypdf requirement [@shamoon](https://github.com/shamoon) ([#14235](https://github.com/paperless-ngx/paperless-ngx/pull/14235))
- Fix: handle legacy bulk edit split page range with missing page\_count [@shamoon](https://github.com/shamoon) ([#14212](https://github.com/paperless-ngx/paperless-ngx/pull/14212))
- Fix: ignore invalid EXIF orientation when generating image archives [@zhzy0077](https://github.com/zhzy0077) ([#14203](https://github.com/paperless-ngx/paperless-ngx/pull/14203))
-
-### Documentation
-
- Documentation: correct duplicates info [@shamoon](https://github.com/shamoon) ([#14243](https://github.com/paperless-ngx/paperless-ngx/pull/14243))
-
-### Maintenance
-
- Chore(deps): Bump the actions group across 1 directory with 4 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14332](https://github.com/paperless-ngx/paperless-ngx/pull/14332))
- Fix: Wrap apt calls into a retry so we can ideally jump a slow mirror [@stumpylog](https://github.com/stumpylog) ([#14344](https://github.com/paperless-ngx/paperless-ngx/pull/14344))
- Chore(deps): Bump the actions group across 1 directory with 10 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14301](https://github.com/paperless-ngx/paperless-ngx/pull/14301))
-
-### Dependencies
-
-<details>
-<summary>27 changes</summary>
-
- Chore(deps): Bump django-filter from 25.2 to 26.1 @[dependabot[bot]](https://github.com/apps/dependabot) ([#14337](https://github.com/paperless-ngx/paperless-ngx/pull/14337))
- Chore(deps): Bump the utilities-patch group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14338](https://github.com/paperless-ngx/paperless-ngx/pull/14338))
- Chore(deps): Bump the pre-commit-dependencies group across 1 directory with 3 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14351](https://github.com/paperless-ngx/paperless-ngx/pull/14351))
- Chore(deps-dev): Bump types-channels from 4.3.0.20260408 to 4.3.0.20260518 @[dependabot[bot]](https://github.com/apps/dependabot) ([#14335](https://github.com/paperless-ngx/paperless-ngx/pull/14335))
- docker(deps): Bump astral-sh/uv from 0.12.20-python3.14-trixie-slim to 0.12.23-python3.14-trixie-slim @[dependabot[bot]](https://github.com/apps/dependabot) ([#14327](https://github.com/paperless-ngx/paperless-ngx/pull/14327))
- Chore(deps): Bump the actions group across 1 directory with 4 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14332](https://github.com/paperless-ngx/paperless-ngx/pull/14332))
- Chore(deps): Bump the uv group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14325](https://github.com/paperless-ngx/paperless-ngx/pull/14325))
- Chore(deps): Bump the frontend-angular-dependencies group across 1 directory with 13 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14329](https://github.com/paperless-ngx/paperless-ngx/pull/14329))
- Chore(deps-dev): Bump prettier from 3.9.8 to 3.9.9 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#14331](https://github.com/paperless-ngx/paperless-ngx/pull/14331))
- Chore(deps-dev): Bump the frontend-eslint-dependencies group across 1 directory with 3 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14330](https://github.com/paperless-ngx/paperless-ngx/pull/14330))
- Chore(deps-dev): Bump zensical from 0.0.64 to 0.0.65 in the development group @[dependabot[bot]](https://github.com/apps/dependabot) ([#14326](https://github.com/paperless-ngx/paperless-ngx/pull/14326))
- Chore(deps): Bump the uv group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14314](https://github.com/paperless-ngx/paperless-ngx/pull/14314))
- Chore(deps): Bump the utilities-minor group across 1 directory with 7 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14305](https://github.com/paperless-ngx/paperless-ngx/pull/14305))
- docker-compose(deps): bump greenmail/standalone from 2.1.13 to 2.1.14 in /docker/compose @[dependabot[bot]](https://github.com/apps/dependabot) ([#14281](https://github.com/paperless-ngx/paperless-ngx/pull/14281))
- docker(deps): Bump astral-sh/uv from 0.12.16-python3.14-trixie-slim to 0.12.20-python3.14-trixie-slim @[dependabot[bot]](https://github.com/apps/dependabot) ([#14282](https://github.com/paperless-ngx/paperless-ngx/pull/14282))
- Chore(deps): Bump the pre-commit-dependencies group across 1 directory with 3 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14283](https://github.com/paperless-ngx/paperless-ngx/pull/14283))
- Chore(deps): Bump the utilities-patch group across 1 directory with 6 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14297](https://github.com/paperless-ngx/paperless-ngx/pull/14297))
- Chore(deps): Bump the actions group across 1 directory with 10 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14301](https://github.com/paperless-ngx/paperless-ngx/pull/14301))
- Chore(deps-dev): Bump the frontend-jest-dependencies group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14286](https://github.com/paperless-ngx/paperless-ngx/pull/14286))
- Chore(deps-dev): Bump eslint from 10.10.0 to 10.11.0 in /src-ui in the frontend-eslint-dependencies group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#14287](https://github.com/paperless-ngx/paperless-ngx/pull/14287))
- Chore(deps-dev): Bump @types/node from 26.5.0 to 26.6.2 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#14288](https://github.com/paperless-ngx/paperless-ngx/pull/14288))
- Chore(deps-dev): Bump prettier from 3.9.6 to 3.9.8 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#14289](https://github.com/paperless-ngx/paperless-ngx/pull/14289))
- Chore(deps): Bump the frontend-angular-dependencies group across 1 directory with 10 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14285](https://github.com/paperless-ngx/paperless-ngx/pull/14285))
- Chore: replace bleach with turbohtml [@gaborbernat](https://github.com/gaborbernat) ([#14269](https://github.com/paperless-ngx/paperless-ngx/pull/14269))
- Chore(deps): Bump autobahn from 25.12.2 to 26.7.1 in the uv group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#14231](https://github.com/paperless-ngx/paperless-ngx/pull/14231))
- Chore: update pikepdf for ocrmypdf requirement [@shamoon](https://github.com/shamoon) ([#14235](https://github.com/paperless-ngx/paperless-ngx/pull/14235))
- Chore(deps): Bump the pre-commit-dependencies group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14133](https://github.com/paperless-ngx/paperless-ngx/pull/14133))
-
-</details>
-
-### All App Changes
-
-<details>
-<summary>41 changes</summary>
-
- Feature: store barcode contents, list and search them [@jurassicparkicecream](https://github.com/jurassicparkicecream) ([#14276](https://github.com/paperless-ngx/paperless-ngx/pull/14276))
- Fix: Set the ProcessedMail owner based on the rule owner in all cases [@stumpylog](https://github.com/stumpylog) ([#14356](https://github.com/paperless-ngx/paperless-ngx/pull/14356))
- Chore(deps): Bump django-filter from 25.2 to 26.1 @[dependabot[bot]](https://github.com/apps/dependabot) ([#14337](https://github.com/paperless-ngx/paperless-ngx/pull/14337))
- Chore(deps): Bump the utilities-patch group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14338](https://github.com/paperless-ngx/paperless-ngx/pull/14338))
- Chore(deps-dev): Bump types-channels from 4.3.0.20260408 to 4.3.0.20260518 @[dependabot[bot]](https://github.com/apps/dependabot) ([#14335](https://github.com/paperless-ngx/paperless-ngx/pull/14335))
- Chore(deps): Bump the uv group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14325](https://github.com/paperless-ngx/paperless-ngx/pull/14325))
- Fix: Ensure log rotation settings are converted to integers [@stumpylog](https://github.com/stumpylog) ([#14343](https://github.com/paperless-ngx/paperless-ngx/pull/14343))
- Chore(deps): Bump the frontend-angular-dependencies group across 1 directory with 13 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14329](https://github.com/paperless-ngx/paperless-ngx/pull/14329))
- Chore(deps-dev): Bump prettier from 3.9.8 to 3.9.9 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#14331](https://github.com/paperless-ngx/paperless-ngx/pull/14331))
- Chore(deps-dev): Bump the frontend-eslint-dependencies group across 1 directory with 3 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14330](https://github.com/paperless-ngx/paperless-ngx/pull/14330))
- Fix: ship pdf.js CMaps so CJK documents render in the viewer [@MrOggy85](https://github.com/MrOggy85) ([#14318](https://github.com/paperless-ngx/paperless-ngx/pull/14318))
- Chore(deps-dev): Bump zensical from 0.0.64 to 0.0.65 in the development group @[dependabot[bot]](https://github.com/apps/dependabot) ([#14326](https://github.com/paperless-ngx/paperless-ngx/pull/14326))
- Enhancement: more control over suggestion requests [@shamoon](https://github.com/shamoon) ([#14258](https://github.com/paperless-ngx/paperless-ngx/pull/14258))
- Chore(deps): Bump the uv group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14314](https://github.com/paperless-ngx/paperless-ngx/pull/14314))
- Chore: anchor admin url pattern [@shamoon](https://github.com/shamoon) ([#14316](https://github.com/paperless-ngx/paperless-ngx/pull/14316))
- Chorehancement: set manifest CORS for credentials [@shamoon](https://github.com/shamoon) ([#14307](https://github.com/paperless-ngx/paperless-ngx/pull/14307))
- Chore(deps): Bump the utilities-minor group across 1 directory with 7 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14305](https://github.com/paperless-ngx/paperless-ngx/pull/14305))
- Chore(deps): Bump the utilities-patch group across 1 directory with 6 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14297](https://github.com/paperless-ngx/paperless-ngx/pull/14297))
- Chore(deps-dev): Bump the frontend-jest-dependencies group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14286](https://github.com/paperless-ngx/paperless-ngx/pull/14286))
- Chore(deps-dev): Bump eslint from 10.10.0 to 10.11.0 in /src-ui in the frontend-eslint-dependencies group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#14287](https://github.com/paperless-ngx/paperless-ngx/pull/14287))
- Chore(deps-dev): Bump @types/node from 26.5.0 to 26.6.2 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#14288](https://github.com/paperless-ngx/paperless-ngx/pull/14288))
- Chore(deps-dev): Bump prettier from 3.9.6 to 3.9.8 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#14289](https://github.com/paperless-ngx/paperless-ngx/pull/14289))
- Chore(deps): Bump the frontend-angular-dependencies group across 1 directory with 10 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14285](https://github.com/paperless-ngx/paperless-ngx/pull/14285))
- Fix: use version page\_count for versioned document [@shamoon](https://github.com/shamoon) ([#14280](https://github.com/paperless-ngx/paperless-ngx/pull/14280))
- Chore: replace bleach with turbohtml [@gaborbernat](https://github.com/gaborbernat) ([#14269](https://github.com/paperless-ngx/paperless-ngx/pull/14269))
- Enhancement: include Django admin with 2FA [@shamoon](https://github.com/shamoon) ([#14270](https://github.com/paperless-ngx/paperless-ngx/pull/14270))
- Fix: allow pointer events for pdf links in pngx viewer [@shamoon](https://github.com/shamoon) ([#14264](https://github.com/paperless-ngx/paperless-ngx/pull/14264))
- Feature: propagate resolved secrets to interactive container shells [@stumpylog](https://github.com/stumpylog) ([#14254](https://github.com/paperless-ngx/paperless-ngx/pull/14254))
- Fix: During a move to the trash directory, only attempt to copy metadata [@stumpylog](https://github.com/stumpylog) ([#14250](https://github.com/paperless-ngx/paperless-ngx/pull/14250))
- Fix: convert file mtime to the configured time zone directly [@stumpylog](https://github.com/stumpylog) ([#14249](https://github.com/paperless-ngx/paperless-ngx/pull/14249))
- Fix: ensure documentDeleted subscription is discarded [@shamoon](https://github.com/shamoon) ([#14247](https://github.com/paperless-ngx/paperless-ngx/pull/14247))
- Chore: Fix bugs in the test suite [@stumpylog](https://github.com/stumpylog) ([#14244](https://github.com/paperless-ngx/paperless-ngx/pull/14244))
- Fix: ensure bulk operations are checked against version root [@shamoon](https://github.com/shamoon) ([#14246](https://github.com/paperless-ngx/paperless-ngx/pull/14246))
- Enhancement: support separate embedding API key [@furkanural](https://github.com/furkanural) ([#14067](https://github.com/paperless-ngx/paperless-ngx/pull/14067))
- Enhancement: support passthrough extra params for LLMs [@shamoon](https://github.com/shamoon) ([#14202](https://github.com/paperless-ngx/paperless-ngx/pull/14202))
- Chore(deps): Bump autobahn from 25.12.2 to 26.7.1 in the uv group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#14231](https://github.com/paperless-ngx/paperless-ngx/pull/14231))
- Fix: indexing after document-added workflows signal [@shamoon](https://github.com/shamoon) ([#14242](https://github.com/paperless-ngx/paperless-ngx/pull/14242))
- Fix: Record full tag and custom field lists in bulk edit audit log [@stumpylog](https://github.com/stumpylog) ([#14236](https://github.com/paperless-ngx/paperless-ngx/pull/14236))
- Chore: update pikepdf for ocrmypdf requirement [@shamoon](https://github.com/shamoon) ([#14235](https://github.com/paperless-ngx/paperless-ngx/pull/14235))
- Fix: handle legacy bulk edit split page range with missing page\_count [@shamoon](https://github.com/shamoon) ([#14212](https://github.com/paperless-ngx/paperless-ngx/pull/14212))
- Fix: ignore invalid EXIF orientation when generating image archives [@zhzy0077](https://github.com/zhzy0077) ([#14203](https://github.com/paperless-ngx/paperless-ngx/pull/14203))
-
-</details>
-
 ## paperless-ngx 3.2.1

 ### Bug Fixes
@@ -794,6 +794,17 @@ system. See the corresponding

    Defaults to None

+#### [`PAPERLESS_SOCIAL_ACCOUNT_MFA_TRUSTED_AMR=<comma-separated-list>`](#PAPERLESS_SOCIAL_ACCOUNT_MFA_TRUSTED_AMR) {#PAPERLESS_SOCIAL_ACCOUNT_MFA_TRUSTED_AMR}
+
+: A list of authentication method values which, if present in the `amr` claim of the ID token sent by an OpenID Connect provider, cause Paperless-ngx to skip its own two-factor authentication prompt for that login. This avoids users having to enter a second factor twice when the identity provider already performed multi-factor authentication. Logins with a username and password, or via a provider which does not send a matching `amr` value, still require the Paperless-ngx code.
+
+    Which values to trust depends entirely on your identity provider, e.g. Authelia sends `mfa` and Pocket ID sends `phr` for passkey logins (but `otp` for single-factor email codes, which should _not_ be trusted). Some providers, such as Keycloak, do not send an `amr` claim by default and need to be configured to do so. You can see what your provider sends from the Django admin as a superuser by checking `id_token` → `amr` in the "Extra data" of the social account.
+
+    !!! warning
+        Only list values that mean a second factor was actually used for the login.
+
+    Defaults to `mfa`, the standard value for multi-factor authentication ([RFC 8176](https://www.rfc-editor.org/rfc/rfc8176.html)).
+
 #### [`PAPERLESS_SOCIAL_ACCOUNT_DEFAULT_GROUPS=<comma-separated-list>`](#PAPERLESS_SOCIAL_ACCOUNT_DEFAULT_GROUPS) {#PAPERLESS_SOCIAL_ACCOUNT_DEFAULT_GROUPS}

 : A list of group names that users who signup via social accounts will be added to upon signup. Groups listed here must already exist.
@@ -76,9 +76,7 @@ is not supported by any of the available parsers.

 **A:** Not by default. As of v3, a file whose contents match an existing document is still
 consumed, and the duplicate is flagged in the UI — open the document and check the
-**Duplicates** tab to review documents that share the same content, or filter the document
-list by **Duplicates** to find all of them (see
-[Duplicate documents](usage.md#duplicate-documents)). If you prefer the old
+**Duplicates** tab to review documents that share the same content. If you prefer the old
 behavior of rejecting duplicates during consumption, set
 [`PAPERLESS_CONSUMER_DELETE_DUPLICATES`](configuration.md#PAPERLESS_CONSUMER_DELETE_DUPLICATES)
 to `true`.
@@ -12,10 +12,10 @@ physical documents into a searchable online archive so you can keep, well, _less
 [Get started](setup.md){ .md-button .md-button--primary .index-callout }
 [Demo](https://demo.paperless-ngx.com){ .md-button .md-button--secondary target=\_blank }

-<div class="demo-sponsor">
-  <span>Demo hosting by</span>
-  <a href="https://fyrastack.com" target="_blank" rel="noopener">
-    <img src="assets/sponsors/fyra-stack.svg" alt="" class="no-lightbox" width="20" height="20"> Fyra Stack
+<div style="display: flex; justify-content: end; margin-top: -1.5rem;">
+  <a href="https://m.do.co/c/8d70b916d462" target="_blank">
+    <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/PoweredByDO/DO_Powered_by_Badge_white.svg#only-dark" class="no-lightbox" width="150px">
+    <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/PoweredByDO/DO_Powered_by_Badge_black.svg#only-light" class="no-lightbox" width="150px">
  </a>
 </div>

@@ -129,7 +129,7 @@ change in the `docker-compose.yml` file:
 command:
  - 'gotenberg'
  - '--chromium-disable-javascript=true'
-  - '--chromium-allow-list=^file:///tmp/.*'
+  - '--chromium-allow-list=file:///tmp/.*'
  - '--api-timeout=60s'
 ```

@@ -272,65 +272,6 @@ This error can occur in installations which have upgraded from a version of Pape
 $ python3 manage.py convert_mariadb_uuid
 ```

-## MariaDB/MySQL error "Illegal mix of collations"
-
-Consumption or other operations fail with an error like:
-
-```
-(1267, "Illegal mix of collations (utf8mb4_general_ci,IMPLICIT) and
-(utf8mb4_unicode_ci,IMPLICIT) for operation '='")
-```
-
-This happens when the tables in your database do not all use the same
-collation. It is most often seen on databases that existed before a
-MariaDB/MySQL upgrade: older tables keep their original collation, while
-tables created afterwards use the new server default.
-
-To work around it, set the collation your existing tables use (the one in the error
-that is not `utf8mb4_unicode_ci`) with
-[`PAPERLESS_DB_OPTIONS`](configuration.md#PAPERLESS_DB_OPTIONS):
-
-```bash
-PAPERLESS_DB_OPTIONS="collation=utf8mb4_general_ci"
-```
-
-To fix it permanently, back up your database, then convert the database and
-each table to a single collation and remove the override:
-
-```sql
-ALTER DATABASE paperless CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
-ALTER TABLE <table_name> CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
-```
-
-## PostgreSQL warns about a "collation version mismatch"
-
-The PostgreSQL log shows a warning like:
-
-```
-WARNING:  database "paperless" has a collation version mismatch
-DETAIL:  The database was created using collation version 2.36, but the operating system provides version 2.41.
-HINT:  Rebuild all objects in this database that use the default collation and run ALTER DATABASE paperless REFRESH COLLATION VERSION, or build PostgreSQL with the right library version.
-```
-
-This comes from PostgreSQL, not Paperless-ngx. The `glibc` version that PostgreSQL
-runs against changed, and the existing database was created with an older one. With
-Docker, `glibc` comes from the PostgreSQL image's Debian base, not the host, so this
-commonly happens when a new image is pulled after its base Debian release changed.
-If PostgreSQL is installed directly on a host, it uses the host's `glibc` instead.
-
-The warning is not an error and Paperless-ngx keeps working, but the database's text
-indexes may be built with outdated sorting rules. To resolve it, back up your
-database, then connect to it (for example with `psql -U paperless -d paperless`
-inside the database container) and run:
-
-```sql
-REINDEX DATABASE paperless;
-ALTER DATABASE paperless REFRESH COLLATION VERSION;
-```
-
-To avoid this in the future, pin your PostgreSQL image to a specific Debian release,
-for example `postgres:18-trixie`, rather than `postgres:18`.
-
 ## Platform-Specific Deployment Troubleshooting

 A user-maintained wiki page is available to help troubleshoot issues that may arise when trying to deploy Paperless-ngx on specific platforms, for example SELinux. Please see [the wiki](https://github.com/paperless-ngx/paperless-ngx/wiki/Platform%E2%80%90Specific-Troubleshooting).
@@ -299,18 +299,19 @@ for details.
 ### Duplicate documents

 By default, Paperless-ngx **does not reject duplicates**. If you consume a file whose
-contents match an existing document (same original or archive checksum), the new copy is
-still consumed and a warning is logged.
+contents exactly match an existing document (same checksum), the new copy is still
+consumed and a warning is logged. The task entry for the upload also flags that a
+duplicate was detected and links to the existing document(s).

-When a document has duplicates, a **Duplicates** tab appears on its detail page, listing
-the other documents you can view that share the same content (including any in the trash).
-To find all documents with duplicates, choose **Duplicates** in the document list's text
-filter dropdown, or use `has_duplicates=true` in the REST API.
+To review duplicates, open a document and switch to the **Duplicates** tab on the
+document detail page. It lists other documents that share the same content, including any
+that are in the trash (shown with a badge), and links to each so you can decide which to
+keep.

 If you would rather reject duplicates at consumption time (the pre-v3 behavior), set
 [`PAPERLESS_CONSUMER_DELETE_DUPLICATES`](configuration.md#PAPERLESS_CONSUMER_DELETE_DUPLICATES)
 to `true`. The duplicate file is then deleted instead of consumed, and the task fails with
-a "Document already exists" message linking to the existing document.
+a "document already exists" message.

 ## Document Suggestions

@@ -472,6 +473,8 @@ Users can enable two-factor authentication (2FA) for their accounts from the 'My

 Should a user lose access to their 2FA device and all recovery codes, a superuser can disable 2FA for the user from the 'Users & Groups' management screen.

+If users log in via an OpenID Connect provider which already enforces multi-factor authentication, see [`PAPERLESS_SOCIAL_ACCOUNT_MFA_TRUSTED_AMR`](configuration.md#PAPERLESS_SOCIAL_ACCOUNT_MFA_TRUSTED_AMR) to skip the Paperless-ngx prompt for those logins.
+
 ## Workflows

 !!! note
@@ -1,6 +1,6 @@
 [project]
 name = "paperless-ngx"
-version = "3.3.3"
+version = "3.2.1"
 description = """\
  A community-supported supercharged document management system: scan, index and archive all your physical documents\
  """
@@ -43,7 +43,7 @@ dependencies = [
  "drf-spectacular~=0.30",
  "drf-spectacular-sidecar>=2026.7.1,<2026.10",
  "drf-writable-nested~=0.7.1",
-  "filelock>=3.32,<4.1",
+  "filelock~=3.32.0",
  "flower>=2.0.1,<2.3",
  "gotenberg-client[httpx]~=1.0",
  "httpx-oauth~=0.17",
@@ -2,5 +2,5 @@

 docker run -p 5432:5432 -e POSTGRES_PASSWORD=password -v paperless_pgdata:/var/lib/postgresql/data -d postgres:15
 docker run -d -p 6379:6379 redis:latest
-docker run -p 3000:3000 -d gotenberg/gotenberg:7.8 gotenberg --chromium-disable-javascript=true --chromium-allow-list="^file:///tmp/.*"
+docker run -p 3000:3000 -d gotenberg/gotenberg:7.8 gotenberg --chromium-disable-javascript=true --chromium-allow-list="file:///tmp/.*"
 docker run -p 9998:9998 -d docker.io/apache/tika:latest
@@ -15,8 +15,6 @@ module.exports = {
        tsconfig: '<rootDir>/tsconfig.spec.json',
        stringifyContentPathRegex: '\\.(html|svg)$',
        useESM: true,
-        // Disable the builder's deprecated override; tsconfig.spec.json enables isolation.
-        isolatedModules: false,
      },
    ],
  },
@@ -1,6 +1,6 @@
 {
  "name": "paperless-ngx-ui",
-  "version": "3.3.3",
+  "version": "3.2.1",
  "scripts": {
    "preinstall": "npx only-allow pnpm",
    "ng": "ng",
@@ -102,34 +102,25 @@
    </button>
  }

-  @if (selectedSection !== TaskSection.All && totalTasks() > pageSize) {
-    <ngb-pagination
-      [pageSize]="pageSize"
-      [collectionSize]="totalTasks()"
-      [page]="page"
-      [maxSize]="5"
-      [rotate]="true"
-      size="sm"
-      aria-label="Tasks pagination"
-      (pageChange)="setPage($event)">
-    </ngb-pagination>
-  }
+  <ngb-pagination
+    [pageSize]="pageSize"
+    [collectionSize]="totalTasks()"
+    [page]="page"
+    [maxSize]="5"
+    [rotate]="true"
+    size="sm"
+    aria-label="Tasks pagination"
+    (pageChange)="setPage($event)">
+  </ngb-pagination>
 </div>

 <ng-template let-tasks="tasks" let-section="section" #tasksTemplate>
-  <div class="section-header mb-2">
-    <h5 class="mb-0">{{ sectionLabel(section) }}</h5>
-    @let count = sectionCount(section);
-    @let hasMore = selectedSection === TaskSection.All && count > tasks.length;
-    <div class="small text-muted">
-      @if (hasMore) {
-        <ng-container i18n>{{tasks.length}} of {{count}} tasks</ng-container>
-        <button class="btn btn-link show-all p-0 ms-2 align-baseline" type="button" (click)="setSection(section)">
-          <ng-container i18n>Show all</ng-container><i-bs class="ms-1" width="1em" height="1em" name="arrow-right"></i-bs>
-        </button>
-      } @else {
-        <ng-container i18n>{count, plural, =1 {1 task} other {{{count}} tasks}}</ng-container>
-      }
+  <div class="section-header d-flex align-items-center justify-content-between mb-2">
+    <div>
+      <h5 class="mb-0">{{ sectionLabel(section) }}</h5>
+      <div class="small text-muted">
+        <ng-container i18n>{tasks.length, plural, =1 {1 task} other {{{tasks.length}} tasks}}</ng-container>
+      </div>
    </div>
  </div>

@@ -178,9 +169,10 @@
              <div>{{ taskDisplayName(task) }}</div>
              <div class="small text-muted">
                @if (taskShowsSeparateTypeLabel(task)) {
-                  <span class="me-2">{{ task.task_type_display }}</span>
+                  <span>{{ task.task_type_display }}</span>
+                  <span class="mx-1">&bull;</span>
                }
-                <span class="text-nowrap"><i-bs class="me-1" width="1em" height="1em" name="box-arrow-in-right"></i-bs>{{ task.trigger_source_display }}</span>
+                <span>{{ task.trigger_source_display }}</span>
              </div>
            </td>
            <td class="d-none d-lg-table-cell created-col">{{ task.date_created | customDate:'short' }}</td>
@@ -72,7 +72,3 @@ pre {
 tbody tr:nth-last-child(2) td {
    border-bottom: none !important;
 }
-
-.section-header .show-all {
-    font-size: inherit;
-}
@@ -223,6 +223,16 @@ describe('TasksComponent', () => {
      )
      .flush(paginatedTasks)

+    httpTestingController
+      .expectOne(
+        (req) =>
+          req.url === `${environment.apiBaseUrl}tasks/` &&
+          req.params.get('acknowledged') === 'false' &&
+          req.params.get('page_size') === '25' &&
+          req.params.get('page') === '1'
+      )
+      .flush(paginatedTasks)
+
    httpTestingController
      .expectOne(
        (req) =>
@@ -231,30 +241,8 @@ describe('TasksComponent', () => {
          !req.params.has('status')
      )
      .flush(sectionCountResponse)
-
-    flushTaskLists(10)
  })

-  // answers task list requests with the fixture tasks matching their status filter
-  function flushTaskLists(pageSize: number, count?: number) {
-    httpTestingController
-      .match(
-        (req) =>
-          req.url === `${environment.apiBaseUrl}tasks/` &&
-          req.params.get('page_size') === `${pageSize}`
-      )
-      .forEach((req) => {
-        const statuses = req.request.params.getAll('status')
-        const results = tasks.filter((task) => statuses.includes(task.status))
-        req.flush({ count: count ?? results.length, results })
-      })
-  }
-
-  function selectSection(section: TaskSection, count: number) {
-    component.setSection(section)
-    flushTaskLists(25, count)
-  }
-
  it('should display task sections with counts', () => {
    expect(component.selectedSection).toBe(TaskSection.All)
    expect(component.selectedTaskType).toBeNull()
@@ -350,7 +338,6 @@ describe('TasksComponent', () => {
  })

  it('should render pagination controls next to the task filter', () => {
-    selectSection(TaskSection.Completed, 30)
    fixture.detectChanges()

    const controls = fixture.debugElement.query(By.css('.task-controls'))
@@ -361,51 +348,6 @@ describe('TasksComponent', () => {
    expect(pagination).not.toBeNull()
  })

-  it('should only paginate a section with more than one page of tasks', () => {
-    const pagination = () =>
-      fixture.debugElement.query(By.css('ngb-pagination'))
-
-    fixture.detectChanges()
-    expect(pagination()).toBeNull()
-
-    selectSection(TaskSection.Completed, 2)
-    fixture.detectChanges()
-    expect(pagination()).toBeNull()
-  })
-
-  it('should load the all tasks overview one section at a time', () => {
-    expect(component.tasksForSection(TaskSection.NeedsAttention)).toHaveLength(
-      2
-    )
-    expect(component.tasksForSection(TaskSection.InProgress)).toHaveLength(3)
-    expect(component.tasksForSection(TaskSection.Completed)).toHaveLength(2)
-    expect(component.totalTasks()).toBe(7)
-  })
-
-  it('should show section totals and link truncated sections to their full list', () => {
-    component.sectionCounts.update((counts) => ({
-      ...counts,
-      [TaskSection.Completed]: 27,
-    }))
-    fixture.detectChanges()
-
-    const header = (label: string) =>
-      fixture.debugElement
-        .queryAll(By.css('.section-header'))
-        .find((h) => h.nativeElement.textContent.includes(label))
-
-    expect(header('Needs attention').nativeElement.textContent).toContain(
-      '2 tasks'
-    )
-    expect(header('Needs attention').query(By.css('button'))).toBeNull()
-
-    expect(header('Recently completed').nativeElement.textContent).toContain(
-      '2 of 27 tasks'
-    )
-    header('Recently completed').query(By.css('button')).nativeElement.click()
-    expect(component.selectedSection).toBe(TaskSection.Completed)
-  })
-
  it('should apply the selected section to the server-side task query', () => {
    component.setSection(TaskSection.NeedsAttention)

@@ -426,56 +368,55 @@ describe('TasksComponent', () => {
  it('should apply task type and trigger source filters to the server-side task query', () => {
    component.setTaskType(PaperlessTaskType.SanityCheck)

-    expect(
-      httpTestingController.match(
+    httpTestingController
+      .expectOne(
        (request) =>
          request.url === `${environment.apiBaseUrl}tasks/` &&
-          request.params.get('page_size') === '10' &&
+          request.params.get('page_size') === '25' &&
          request.params.get('task_type') === PaperlessTaskType.SanityCheck
      )
-    ).toHaveLength(3)
+      .flush({ count: 1, results: [tasks[6]] })

    component.setTriggerSource(PaperlessTaskTriggerSource.System)

-    expect(
-      httpTestingController.match(
+    httpTestingController
+      .expectOne(
        (request) =>
          request.url === `${environment.apiBaseUrl}tasks/` &&
-          request.params.get('page_size') === '10' &&
+          request.params.get('page_size') === '25' &&
          request.params.get('task_type') === PaperlessTaskType.SanityCheck &&
          request.params.get('trigger_source') ===
            PaperlessTaskTriggerSource.System
      )
-    ).toHaveLength(3)
+      .flush({ count: 1, results: [tasks[6]] })
  })

  it('should apply text filters to the server-side task query', () => {
    component.filterText = 'invoice'
    jest.advanceTimersByTime(150)

-    expect(
-      httpTestingController.match(
+    httpTestingController
+      .expectOne(
        (request) =>
          request.url === `${environment.apiBaseUrl}tasks/` &&
-          request.params.get('page_size') === '10' &&
+          request.params.get('page_size') === '25' &&
          request.params.get('name') === 'invoice'
      )
-    ).toHaveLength(3)
+      .flush({ count: 1, results: [tasks[0]] })

    component.setFilterTarget(TaskFilterTargetID.Result)

-    expect(
-      httpTestingController.match(
+    httpTestingController
+      .expectOne(
        (request) =>
          request.url === `${environment.apiBaseUrl}tasks/` &&
-          request.params.get('page_size') === '10' &&
+          request.params.get('page_size') === '25' &&
          request.params.get('result') === 'invoice'
      )
-    ).toHaveLength(3)
+      .flush({ count: 0, results: [] })
  })

  it('should load a different task page when pagination changes', () => {
-    selectSection(TaskSection.Completed, 30)
    component.setPage(2)

    const pageTwoTasks = {
@@ -499,7 +440,6 @@ describe('TasksComponent', () => {
  })

  it('should not replace section counts with current-page counts', () => {
-    selectSection(TaskSection.Completed, 30)
    component.setPage(2)

    httpTestingController
@@ -515,21 +455,11 @@ describe('TasksComponent', () => {
        results: [tasks[0]],
      })

-    expect(component.sectionCount(TaskSection.All)).toBe(7)
    expect(component.sectionCount(TaskSection.NeedsAttention)).toBe(2)
    expect(component.sectionCount(TaskSection.InProgress)).toBe(3)
    expect(component.sectionCount(TaskSection.Completed)).toBe(2)
  })

-  it('should stop loading when the overview fails to load', () => {
-    component.setSection(TaskSection.All)
-    httpTestingController
-      .match((req) => req.params.get('page_size') === '10')[0]
-      .flush('', { status: 500, statusText: 'Error' })
-
-    expect(component.loading()).toBe(false)
-  })
-
  it('should expose stable task type options and disable empty ones', () => {
    expect(component.taskTypeOptions.map((option) => option.value)).toContain(
      PaperlessTaskType.TrainClassifier
@@ -15,9 +15,6 @@ import {
  distinctUntilChanged,
  filter,
  first,
-  forkJoin,
-  map,
-  Observable,
  Subject,
  takeUntil,
  timer,
@@ -28,7 +25,6 @@ import {
  PaperlessTaskTriggerSource,
  PaperlessTaskType,
 } from 'src/app/data/paperless-task'
-import { Results } from 'src/app/data/results'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
 import { TasksService } from 'src/app/services/tasks.service'
@@ -173,7 +169,6 @@ export class TasksComponent
  public expandedTask: number
  public autoRefreshEnabled: boolean = true
  public readonly pageSize = 25
-  public readonly overviewSize = 10
  public page: number = 1
  readonly totalTasks = signal(0)
  readonly sectionCounts = signal<Record<TaskSection, number>>({
@@ -489,6 +484,13 @@ export class TasksComponent
    return this.sectionCounts()[section]
  }

+  private setSectionCount(section: TaskSection, count: number) {
+    this.sectionCounts.update((counts) => ({
+      ...counts,
+      [section]: count,
+    }))
+  }
+
  sectionShowsResults(section: TaskSection): boolean {
    return section !== TaskSection.InProgress
  }
@@ -735,12 +737,21 @@ export class TasksComponent
    this.reloadSectionCounts()

    this.loading.set(true)
-    this.listTasks()
+    this.tasksService
+      .list(
+        this.page,
+        this.pageSize,
+        this.getParamsForSection(this.selectedSection)
+      )
      .pipe(first(), takeUntil(this.unsubscribeNotifier))
      .subscribe({
        next: (result) => {
          this.pagedTasks.set(result.results)
          this.totalTasks.set(result.count)
+          this.setSectionCount(TaskSection.All, result.count)
+          if (this.selectedSection !== TaskSection.All) {
+            this.setSectionCount(this.selectedSection, result.count)
+          }
          this.loading.set(false)
          if (
            this.page > 1 &&
@@ -756,30 +767,4 @@ export class TasksComponent
        },
      })
  }
-
-  private listTasks(): Observable<Results<PaperlessTask>> {
-    if (this.selectedSection !== TaskSection.All) {
-      return this.tasksService.list(
-        this.page,
-        this.pageSize,
-        this.getParamsForSection(this.selectedSection)
-      )
-    }
-
-    // All is an overview of each section to avoid splitting sections across pages
-    return forkJoin(
-      this.sections.map((section) =>
-        this.tasksService.list(
-          1,
-          this.overviewSize,
-          this.getParamsForSection(section)
-        )
-      )
-    ).pipe(
-      map((results) => ({
-        count: results.reduce((sum, result) => sum + result.count, 0),
-        results: results.flatMap((result) => result.results),
-      }))
-    )
-  }
 }
@@ -154,31 +154,6 @@ describe('UsersAndGroupsComponent', () => {
    jest.useRealTimers()
  })

-  it('should logout current user under base href if password changed', () => {
-    jest.useFakeTimers()
-    const base = document.createElement('base')
-    base.href = '/paperless/'
-    document.head.appendChild(base)
-    completeSetup()
-    let modal: NgbModalRef
-    modalService.activeInstances.subscribe((refs) => (modal = refs[0]))
-    component.editUser(users[0])
-    const navSpy = jest
-      .spyOn(navUtils, 'setLocationHref')
-      .mockImplementation(() => {})
-    const editDialog = modal.componentInstance as UserEditDialogComponent
-    editDialog.passwordIsSet = true
-    settingsService.currentUser.set(users[0]) // simulate logged in as same user
-    editDialog.succeeded.emit(users[0])
-    fixture.detectChanges()
-    jest.advanceTimersByTime(2600)
-    expect(navSpy).toHaveBeenCalledWith(
-      `${window.location.origin}/paperless/accounts/logout/?next=/paperless/accounts/login/?next=/paperless/`
-    )
-    base.remove()
-    jest.useRealTimers()
-  })
-
  it('should support edit / create group, show error if needed', () => {
    completeSetup()
    let modal: NgbModalRef
@@ -116,9 +116,8 @@ export class UsersAndGroupsComponent
            $localize`Password has been changed, you will be logged out momentarily.`
          )
          setTimeout(() => {
-            const basePath = new URL(document.baseURI).pathname
            setLocationHref(
-              `${window.location.origin}${basePath}accounts/logout/?next=${basePath}accounts/login/?next=${basePath}`
+              `${window.location.origin}/accounts/logout/?next=/accounts/login/?next=/`
            )
          }, 2500)
        } else {
@@ -66,7 +66,6 @@
 }

 .search-container {
-  min-width: 0;
  padding-left: 1rem;
  padding-right: 1rem;
 }
@@ -500,11 +499,6 @@ main {

 // true center the search with equal flex widths
@media (min-width: 768px) {
-  .search-container {
-    // Prevent input padding and the conditional search button from resizing
-    flex-basis: 55rem;
-  }
-
  .navbar-brand-container,
  .navbar > ul {
    display: flex; // so the brand link stays as wide as its contents
@@ -70,17 +70,6 @@ form {
  max-height: 75vh;
 }

-.dropdown.show {
-  // Hide the search icon when the dropdown is shown
-  i-bs[name="search"] {
-    display: none !important;
-  }
-
-  .form-control {
-    padding-left: 0.5rem;
-  }
-}
-
 .dropdown-item {
  &:has(button:focus) {
    background-color: var(--pngx-bg-darker);
@@ -218,38 +218,6 @@ describe('ProfileEditDialogComponent', () => {
    jest.useRealTimers()
  })

-  it('should logout under base href on save if password changed', () => {
-    jest.useFakeTimers()
-    const base = document.createElement('base')
-    base.href = '/paperless/'
-    document.head.appendChild(base)
-    const getSpy = jest.spyOn(profileService, 'get')
-    getSpy.mockReturnValue(of(profile))
-    const getProvidersSpy = jest.spyOn(
-      profileService,
-      'getSocialAccountProviders'
-    )
-    getProvidersSpy.mockReturnValue(of(socialAccountProviders))
-    component.ngOnInit()
-    component['newPassword'] = 'new*pass'
-    component.form.get('password').patchValue('new*pass')
-    component.form.get('password_confirm').patchValue('new*pass')
-
-    const updateSpy = jest.spyOn(profileService, 'update')
-    updateSpy.mockReturnValue(of(null))
-    const navSpy = jest
-      .spyOn(navUtils, 'setLocationHref')
-      .mockImplementation(() => {})
-    component.save()
-    expect(updateSpy).toHaveBeenCalled()
-    jest.advanceTimersByTime(2600)
-    expect(navSpy).toHaveBeenCalledWith(
-      `${window.location.origin}/paperless/accounts/logout/?next=/paperless/accounts/login/?next=/paperless/`
-    )
-    base.remove()
-    jest.useRealTimers()
-  })
-
  it('should support auth token copy', () => {
    jest.useFakeTimers()
    const getSpy = jest.spyOn(profileService, 'get')
@@ -210,9 +210,8 @@ export class ProfileEditDialogComponent
              $localize`Password has been changed, you will be logged out momentarily.`
            )
            setTimeout(() => {
-              const basePath = new URL(document.baseURI).pathname
              setLocationHref(
-                `${window.location.origin}${basePath}accounts/logout/?next=${basePath}accounts/login/?next=${basePath}`
+                `${window.location.origin}/accounts/logout/?next=/accounts/login/?next=/`
              )
            }, 2500)
          }
@@ -1,6 +1,6 @@
 <div class="d-flex align-items-center">
  <div class="btn-group">
-    <button type="button" class="btn btn-sm btn-outline-primary" (click)="clickSuggest()" [disabled]="disabled() || loading()" [aria-label]="noSuggestions ? 'No suggestions' : 'Suggest'" i18n-aria-label>
+    <button type="button" class="btn btn-sm btn-outline-primary" (click)="clickSuggest()" [disabled]="disabled() || loading() || (suggestions() && !aiEnabled())" [aria-label]="noSuggestions ? 'No suggestions' : 'Suggest'" i18n-aria-label>
      @if (loading()) {
        <div class="spinner-border spinner-border-sm" role="status"></div>
      } @else if (noSuggestions) {
@@ -18,44 +18,46 @@
      }
    </button>

-    <div class="btn-group" ngbDropdown #dropdown="ngbDropdown" [popperOptions]="popperOptions">
-      <button type="button" class="btn btn-sm btn-outline-primary" ngbDropdownToggle [disabled]="disabled() || loading() || !suggestions()" aria-expanded="false" aria-controls="suggestionsDropdown" aria-label="Suggestions dropdown">
-        <span class="visually-hidden" i18n>Show suggestions</span>
-      </button>
+    @if (aiEnabled()) {
+      <div class="btn-group" ngbDropdown #dropdown="ngbDropdown" [popperOptions]="popperOptions">
+        <button type="button" class="btn btn-sm btn-outline-primary" ngbDropdownToggle [disabled]="disabled() || loading() || !suggestions()" aria-expanded="false" aria-controls="suggestionsDropdown" aria-label="Suggestions dropdown">
+          <span class="visually-hidden" i18n>Show suggestions</span>
+        </button>

-      <div ngbDropdownMenu aria-labelledby="suggestionsDropdown" class="shadow suggestions-dropdown">
-        <div class="list-group list-group-flush small pb-0">
-          @if (novelSuggestions === 0 && fieldSuggestions === 0) {
-            <div class="list-group-item text-muted fst-italic">
-              <small class="text-muted small fst-italic" i18n>No novel suggestions</small>
-            </div>
-          }
-          @if (suggestions()?.suggested_tags?.length > 0) {
-            <small class="list-group-item text-uppercase text-muted small"><i-bs class="me-2" name="tags"></i-bs><ng-container i18n>Tags</ng-container></small>
-            @for (tag of suggestions().suggested_tags; track tag) {
-              <button type="button" class="list-group-item list-group-item-action bg-light" (click)="addTag.emit(tag)">{{ tag }}</button>
+        <div ngbDropdownMenu aria-labelledby="suggestionsDropdown" class="shadow suggestions-dropdown">
+          <div class="list-group list-group-flush small pb-0">
+            @if (novelSuggestions === 0 && fieldSuggestions === 0) {
+              <div class="list-group-item text-muted fst-italic">
+                <small class="text-muted small fst-italic" i18n>No novel suggestions</small>
+              </div>
            }
-          }
-          @if (suggestions()?.suggested_document_types?.length > 0) {
-            <div class="list-group-item text-uppercase text-muted small"><i-bs class="me-2" name="hash"></i-bs><ng-container i18n>Document Types</ng-container></div>
-            @for (type of suggestions().suggested_document_types; track type) {
-              <button type="button" class="list-group-item list-group-item-action bg-light" (click)="addDocumentType.emit(type)">{{ type }}</button>
+            @if (suggestions()?.suggested_tags?.length > 0) {
+              <small class="list-group-item text-uppercase text-muted small"><i-bs class="me-2" name="tags"></i-bs><ng-container i18n>Tags</ng-container></small>
+              @for (tag of suggestions().suggested_tags; track tag) {
+                <button type="button" class="list-group-item list-group-item-action bg-light" (click)="addTag.emit(tag)">{{ tag }}</button>
+              }
            }
-          }
-          @if (suggestions()?.suggested_correspondents?.length > 0) {
-            <div class="list-group-item text-uppercase text-muted small"><i-bs class="me-2" name="person"></i-bs><ng-container i18n>Correspondents</ng-container></div>
-            @for (correspondent of suggestions().suggested_correspondents; track correspondent) {
-              <button type="button" class="list-group-item list-group-item-action bg-light" (click)="addCorrespondent.emit(correspondent)">{{ correspondent }}</button>
+            @if (suggestions()?.suggested_document_types?.length > 0) {
+              <div class="list-group-item text-uppercase text-muted small"><i-bs class="me-2" name="hash"></i-bs><ng-container i18n>Document Types</ng-container></div>
+              @for (type of suggestions().suggested_document_types; track type) {
+                <button type="button" class="list-group-item list-group-item-action bg-light" (click)="addDocumentType.emit(type)">{{ type }}</button>
+              }
            }
-          }
-          @if (fieldSuggestions > 0) {
-            <div class="list-group-item text-muted fst-italic">
-              <small class="text-muted small fst-italic" i18n>{fieldSuggestions, plural, =1 {1 suggestion available below} other {{{fieldSuggestions}} suggestions available below}}</small>
-            </div>
-          }
+            @if (suggestions()?.suggested_correspondents?.length > 0) {
+              <div class="list-group-item text-uppercase text-muted small"><i-bs class="me-2" name="person"></i-bs><ng-container i18n>Correspondents</ng-container></div>
+              @for (correspondent of suggestions().suggested_correspondents; track correspondent) {
+                <button type="button" class="list-group-item list-group-item-action bg-light" (click)="addCorrespondent.emit(correspondent)">{{ correspondent }}</button>
+              }
+            }
+            @if (fieldSuggestions > 0) {
+              <div class="list-group-item text-muted fst-italic">
+                <small class="text-muted small fst-italic" i18n>{fieldSuggestions, plural, =1 {1 suggestion available below} other {{{fieldSuggestions}} suggestions available below}}</small>
+              </div>
+            }
+          </div>
        </div>
      </div>
-    </div>
+    }
  </div>

  @if (aiEnabled()) {
@@ -251,37 +251,6 @@ describe('SuggestionsDropdownComponent', () => {
    expect(fixture.nativeElement.textContent).toContain('No novel suggestions')
  })

-  it('should open ML date suggestions with AI disabled', () => {
-    const getSuggestions = jest.spyOn(component.getSuggestions, 'emit')
-    fixture.componentRef.setInput('aiEnabled', false)
-    fixture.componentRef.setInput('fetchedSources', [SuggestionSource.ML])
-    fixture.componentRef.setInput('suggestions', {
-      dates: ['2026-01-04', '2026-02-01'],
-    })
-    fixture.componentRef.setInput('appliedCreated', '2026-01-04')
-    fixture.detectChanges()
-
-    const button = fixture.nativeElement.querySelector('button')
-    expect(button.disabled).toBeFalsy()
-    expect(button.querySelector('.badge').textContent.trim()).toBe('1')
-
-    button.click()
-    fixture.detectChanges()
-
-    expect(component.dropdown.isOpen()).toBeTruthy()
-    expect(fixture.nativeElement.textContent).toContain(
-      '1 suggestion available below'
-    )
-    expect(getSuggestions).not.toHaveBeenCalled()
-    expect(
-      fixture.nativeElement.querySelector('button[title="Suggestion options"]')
-    ).toBeNull()
-
-    button.click()
-    fixture.detectChanges()
-    expect(component.dropdown.isOpen()).toBeFalsy()
-  })
-
  it('should fetch unfetched sources and show existing suggestions', () => {
    jest.spyOn(component.getSuggestions, 'emit')
    fixture.componentRef.setInput('aiEnabled', true)
@@ -53,7 +53,11 @@ export class SuggestionsDropdownComponent {
  addCorrespondent: EventEmitter<string> = new EventEmitter()

  public clickSuggest(): void {
-    if (this.disabled() || this.loading()) {
+    if (
+      this.disabled() ||
+      this.loading() ||
+      (this.suggestions() && !this.aiEnabled())
+    ) {
      return
    }

@@ -25,8 +25,6 @@
            @if (displayFields().includes(field)) {
              <th
                scope="col"
-                class="text-truncate"
-                [title]="getColumnTitle(field)"
                [ngClass]="{
                  'd-none d-md-table-cell': i > 1,
                  'w-25': field === DisplayField.CREATED || field === DisplayField.ADDED
@@ -484,22 +484,6 @@ describe('FilterEditorComponent', () => {
    expect(component.textFilter).toBeNull()
  })

-  it('should ingest title filter rules alongside a fulltext query with date created', () => {
-    component.filterRules = [
-      {
-        rule_type: FILTER_SIMPLE_TITLE,
-        value: 'foo',
-      },
-      {
-        rule_type: FILTER_FULLTEXT_QUERY,
-        value: 'created:[-1 week to now]',
-      },
-    ]
-    expect(component.dateCreatedRelativeDate).toEqual(1) // RELATIVE_DATE_QUERYSTRINGS['-1 week to now']
-    expect(component.textFilter).toEqual('foo')
-    expect(component.textFilterTarget).toEqual('title') // TEXT_FILTER_TARGET_TITLE
-  })
-
  it('should ingest text filter rules for fulltext query that include date added', () => {
    expect(component.dateAddedRelativeDate).toBeNull()
    component.filterRules = [
@@ -1861,7 +1845,7 @@ describe('FilterEditorComponent', () => {
    ])
  })

-  it('should keep text filtering separate from date created relative date', () => {
+  it('should carry over text filtering on date created with relative date', () => {
    component.textFilter = 'foo'
    const dateCreatedDropdown = fixture.debugElement.queryAll(
      By.directive(DatesDropdownComponent)
@@ -1871,18 +1855,14 @@ describe('FilterEditorComponent', () => {
    fixture.detectChanges()
    tick(400)
    expect(component.filterRules).toEqual([
-      {
-        rule_type: FILTER_SIMPLE_TEXT,
-        value: 'foo',
-      },
      {
        rule_type: FILTER_FULLTEXT_QUERY,
-        value: 'created:[-1 week to now]',
+        value: 'foo,created:[-1 week to now]',
      },
    ])
  })

-  it('should keep text filtering separate from created and added relative dates', () => {
+  it('should carry over text filtering once with created and added relative dates', () => {
    component.textFilter = 'foo'
    const datesDropdown = fixture.debugElement.query(
      By.directive(DatesDropdownComponent)
@@ -1893,18 +1873,14 @@ describe('FilterEditorComponent', () => {
    fixture.detectChanges()
    tick(400)
    expect(component.filterRules).toEqual([
-      {
-        rule_type: FILTER_SIMPLE_TEXT,
-        value: 'foo',
-      },
      {
        rule_type: FILTER_FULLTEXT_QUERY,
-        value: 'created:[-1 week to now],added:[-1 month to now]',
+        value: 'foo,created:[-1 week to now],added:[-1 month to now]',
      },
    ])
  })

-  it('should keep legacy title filters as a title search when adding a created relative date', () => {
+  it('should convert legacy title filters into full text query when adding a created relative date', () => {
    component.filterRules = [
      {
        rule_type: FILTER_TITLE,
@@ -1919,18 +1895,14 @@ describe('FilterEditorComponent', () => {
    fixture.detectChanges()
    tick(400)
    expect(component.filterRules).toEqual([
-      {
-        rule_type: FILTER_SIMPLE_TITLE,
-        value: 'foo',
-      },
      {
        rule_type: FILTER_FULLTEXT_QUERY,
-        value: 'created:[-1 week to now]',
+        value: 'foo,created:[-1 week to now]',
      },
    ])
  })

-  it('should keep simple title filters as a title search when adding a created relative date', () => {
+  it('should convert simple title filters into full text query when adding a created relative date', () => {
    component.filterRules = [
      {
        rule_type: FILTER_SIMPLE_TITLE,
@@ -1945,13 +1917,9 @@ describe('FilterEditorComponent', () => {
    fixture.detectChanges()
    tick(400)
    expect(component.filterRules).toEqual([
-      {
-        rule_type: FILTER_SIMPLE_TITLE,
-        value: 'foo',
-      },
      {
        rule_type: FILTER_FULLTEXT_QUERY,
-        value: 'created:[-1 week to now]',
+        value: 'foo,created:[-1 week to now]',
      },
    ])
  })
@@ -2037,7 +2005,7 @@ describe('FilterEditorComponent', () => {
    ])
  })

-  it('should keep text filtering separate from date added relative date', () => {
+  it('should carry over text filtering on date added with relative date', () => {
    component.textFilter = 'foo'
    const datesDropdown = fixture.debugElement.query(
      By.directive(DatesDropdownComponent)
@@ -2047,13 +2015,9 @@ describe('FilterEditorComponent', () => {
    fixture.detectChanges()
    tick(400)
    expect(component.filterRules).toEqual([
-      {
-        rule_type: FILTER_SIMPLE_TEXT,
-        value: 'foo',
-      },
      {
        rule_type: FILTER_FULLTEXT_QUERY,
-        value: 'added:[-1 week to now]',
+        value: 'foo,added:[-1 week to now]',
      },
    ])
  })
@@ -1083,6 +1083,23 @@ export class FilterEditorComponent
        (fr) => fr.rule_type == FILTER_FULLTEXT_QUERY
      )

+      // if had a title / content search and added a relative date we need to carry it over...
+      if (
+        !existingRule &&
+        this._textFilter?.length > 0 &&
+        (this.textFilterTarget == TEXT_FILTER_TARGET_TITLE_CONTENT ||
+          this.textFilterTarget == TEXT_FILTER_TARGET_TITLE)
+      ) {
+        existingRule = filterRules.find(
+          (fr) =>
+            fr.rule_type == FILTER_TITLE_CONTENT ||
+            fr.rule_type == FILTER_SIMPLE_TEXT ||
+            fr.rule_type == FILTER_TITLE ||
+            fr.rule_type == FILTER_SIMPLE_TITLE
+        )
+        existingRule.rule_type = FILTER_FULLTEXT_QUERY
+      }
+
      let queryArgs = existingRule?.value.split(',') ?? []
      if (this.dateCreatedRelativeDate !== null) {
        const rd = RELATIVE_DATE_QUERYSTRINGS.find(
@@ -11,7 +11,7 @@
      <div class="input-group input-group-sm w-auto d-none d-md-flex">
        <label class="input-group-text bg-transparent border-0" for="managementPageSize" i18n>Show:</label>
      </div>
-      <div class="input-group input-group-sm w-auto">
+      <div class="input-group input-group-sm w-auto me-3">
        <select id="managementPageSize" class="form-select form-select-sm small" [(ngModel)]="pageSize">
          <option [ngValue]="25">25</option>
          <option [ngValue]="50">50</option>
@@ -19,9 +19,7 @@
        </select>
        <span class="input-group-text text-muted d-none d-md-flex" i18n>per page</span>
      </div>
-      @if (collectionSize() > pageSize) {
-        <ngb-pagination [pageSize]="pageSize" [collectionSize]="collectionSize()" [page]="page()" [maxSize]="5" (pageChange)="page.set($event); reloadData()" class="ms-3" size="sm" aria-label="Pagination"></ngb-pagination>
-      }
+      <ngb-pagination [pageSize]="pageSize" [collectionSize]="collectionSize()" [page]="page()" [maxSize]="5" (pageChange)="page.set($event); reloadData()" size="sm" aria-label="Pagination"></ngb-pagination>
    </div>
  </div>

@@ -72,7 +70,7 @@
        }
      </div>
    }
-    @if (collectionSize() > pageSize) {
+    @if (collectionSize() > 20) {
      <ngb-pagination class="ms-auto" [pageSize]="pageSize" [collectionSize]="collectionSize()" [page]="page()" [maxSize]="5" (pageChange)="page.set($event); reloadData()" size="sm" aria-label="Pagination"></ngb-pagination>
    }
  </div>
@@ -93,17 +93,15 @@
        [disabled]="selectedMailIds().size === 0"
        (confirm)="deleteSelected()">
      </pngx-confirm-button>
-      @if (processedMails().length > 50) {
-        <div class="ms-auto">
-          <ngb-pagination
-            [collectionSize]="processedMails().length"
-            [(page)]="page"
-            [pageSize]="50"
-            [maxSize]="5"
-            (pageChange)="loadProcessedMails()">
-          </ngb-pagination>
-        </div>
-      }
+      <div class="ms-auto">
+        <ngb-pagination
+          [collectionSize]="processedMails().length"
+          [(page)]="page"
+          [pageSize]="50"
+          [maxSize]="5"
+          (pageChange)="loadProcessedMails()">
+        </ngb-pagination>
+      </div>
    </div>
  }
 </div>
@@ -8,7 +8,7 @@ export const environment = {
  apiVersion: '10', // match src/paperless/settings.py
  appTitle: DEFAULT_APP_TITLE,
  tag: 'prod',
-  version: '3.3.3',
+  version: '3.2.1',
  webSocketHost: window.location.host,
  webSocketProtocol: window.location.protocol == 'https:' ? 'wss:' : 'ws:',
  webSocketBaseUrl: base_url.pathname + 'ws/',
@@ -41,7 +41,6 @@ import {
  bell,
  bodyText,
  bookmark,
-  boxArrowInRight,
  boxArrowUp,
  boxArrowUpRight,
  boxes,
@@ -294,7 +293,6 @@ const icons = {
  braces,
  bodyText,
  bookmark,
-  boxArrowInRight,
  boxArrowUp,
  boxArrowUpRight,
  boxes,
@@ -15,7 +15,7 @@
    "target": "ES2022",
    "module": "es2020",
    "lib": [
-      "es2022",
+      "es2020",
      "dom"
    ],
    "useDefineForClassFields": false
@@ -54,10 +54,6 @@ def _predict_with_threshold(classifier, X, threshold: float) -> int | None:
    cutoff so that uncertain predictions are discarded rather than assigned.
    """
    probas = classifier.predict_proba(X)[0]
-    if len(classifier.classes_) == 1:
-        # scikit-learn treats a single-class fit as binary, so predict_proba
-        # returns [1 - p, p] for one class. Column 0 is the real class.
-        probas = probas[:1]
    best_idx = int(probas.argmax())
    best_class = int(classifier.classes_[best_idx])

@@ -130,14 +130,12 @@ class DocumentMetadataOverrides:
            get_users_with_perms(
                doc,
                only_with_perms_in=["view_document"],
-                with_group_users=False,
            ).values_list("id", flat=True),
        )
        overrides.change_users = list(
            get_users_with_perms(
                doc,
                only_with_perms_in=["change_document"],
-                with_group_users=False,
            ).values_list("id", flat=True),
        )
        overrides.custom_fields = {
@@ -50,7 +50,6 @@ from documents.models import ShareLink
 from documents.models import ShareLinkBundle
 from documents.models import StoragePath
 from documents.models import Tag
-from documents.permissions import annotate_authorizing_fields
 from documents.permissions import permitted_document_ids
 from documents.permissions import permitted_object_ids
 from documents.versioning import annotate_effective_content
@@ -1076,9 +1075,6 @@ class PermittedObjectsFilter(BaseFilterBackend):

    include_granted: bool = True
    perm_codename: str | None = None
-    # A self-referencing foreign key whose target authorizes a row, so a row is
-    # judged by its parent's owner and grants (``Document.root_document``).
-    parent_field: str | None = None

    def filter_queryset(self, request, queryset, view):
        # Before the superuser and owner-only paths, neither of which consults
@@ -1090,23 +1086,11 @@ class PermittedObjectsFilter(BaseFilterBackend):
        if request.user.is_superuser:
            return queryset
        if not self.include_granted:
-            owner_field = "owner"
-            if self.parent_field is not None:
-                queryset = annotate_authorizing_fields(queryset, self.parent_field)
-                owner_field = "authorizing_owner"
-            return queryset.filter(
-                Q(**{owner_field: request.user.pk})
-                | Q(**{f"{owner_field}__isnull": True}),
-            )
+            return queryset.filter(Q(owner=request.user) | Q(owner__isnull=True))
        model = queryset.model
        perm = self.perm_codename or f"view_{model._meta.model_name}"
        return queryset.filter(
-            id__in=permitted_object_ids(
-                request.user,
-                model,
-                perm,
-                parent_field=self.parent_field,
-            ),
+            id__in=permitted_object_ids(request.user, model, perm),
        )


@@ -3,7 +3,6 @@ from itertools import islice
 from pathlib import Path
 from typing import TYPE_CHECKING
 from typing import Any
-from typing import Final

 from allauth.mfa.models import Authenticator
 from allauth.socialaccount.models import SocialAccount
@@ -71,15 +70,6 @@ from paperless.models import ApplicationConfiguration
 from paperless_mail.models import MailAccount
 from paperless_mail.models import MailRule

-# Derived names replace the original's extension with these suffixes
-THUMBNAIL_SUFFIX: Final[str] = "-thumbnail.webp"
-ARCHIVE_SUFFIX: Final[str] = "-archive.pdf"
-# Leave room for the longest derived suffix, which replaces the original's extension
-MAX_BASE_NAME_BYTES: Final[int] = Document.MAX_PUBLIC_FILENAME_BYTES - max(
-    len(THUMBNAIL_SUFFIX),
-    len(ARCHIVE_SUFFIX),
-)
-

 def serialize_queryset_batched(
    queryset: "QuerySet[Any]",
@@ -522,16 +512,10 @@ class Command(CryptMixin, PaperlessCommand):
                    counter=filename_counter,
                )
            else:
-                base_name = document.get_public_filename(
-                    counter=filename_counter,
-                    max_bytes=MAX_BASE_NAME_BYTES,
-                )
+                base_name = document.get_public_filename(counter=filename_counter)

-            # The thumbnail and archive names are derived from the stem, so
-            # uniqueness must hold without the original's extension
-            unique_key = str(Path(base_name).with_suffix(""))
-            if unique_key not in self.exported_files:
-                self.exported_files.add(unique_key)
+            if base_name not in self.exported_files:
+                self.exported_files.add(base_name)
                break
            else:
                filename_counter += 1
@@ -554,7 +538,7 @@ class Command(CryptMixin, PaperlessCommand):
        document_dict[EXPORTER_FILE_NAME] = original_arc

        if not self.no_thumbnail:
-            thumbnail_name = base_name.parent / (base_name.stem + THUMBNAIL_SUFFIX)
+            thumbnail_name = base_name.parent / (base_name.stem + "-thumbnail.webp")
            if self.use_folder_prefix:
                thumbnail_name = Path("thumbnails") / thumbnail_name
            thumbnail_arc = thumbnail_name.as_posix()
@@ -563,7 +547,7 @@ class Command(CryptMixin, PaperlessCommand):
            thumbnail_arc = None

        if not self.no_archive and document.has_archive_version:
-            archive_name = base_name.parent / (base_name.stem + ARCHIVE_SUFFIX)
+            archive_name = base_name.parent / (base_name.stem + "-archive.pdf")
            if self.use_folder_prefix:
                archive_name = Path("archive") / archive_name
            archive_arc = archive_name.as_posix()
@@ -66,7 +66,7 @@ def iter_manifest_records(path: Path) -> Generator[dict, None, None]:
    """Yield records one at a time from a manifest JSON array via ijson."""
    try:
        with path.open("rb") as f:
-            yield from ijson.items(f, "item", use_float=True)
+            yield from ijson.items(f, "item")
    except ijson.JSONError as e:
        raise CommandError(f"Failed to parse manifest file {path}: {e}") from e

@@ -67,22 +67,18 @@ class Command(PaperlessCommand):
                if options.get("recreate"):
                    wipe_index(settings.INDEX_DIR)

-                documents = (
-                    Document.objects.filter(root_document__isnull=True)
-                    .select_related(
-                        "correspondent",
-                        "document_type",
-                        "storage_path",
-                        "owner",
-                    )
-                    .prefetch_related(
-                        "tags",
-                        "notes__user",
-                        "custom_fields__field",
-                        "versions",
-                        "barcodes",
-                        "versions__barcodes",
-                    )
+                documents = Document.objects.select_related(
+                    "correspondent",
+                    "document_type",
+                    "storage_path",
+                    "owner",
+                ).prefetch_related(
+                    "tags",
+                    "notes__user",
+                    "custom_fields__field",
+                    "versions",
+                    "barcodes",
+                    "versions__barcodes",
                )
                total = documents.count()
                rebuild_kwargs = {}
@@ -157,8 +157,6 @@ class StoragePath(MatchingModel):

 class Document(SoftDeleteModel, ModelWithOwner):  # type: ignore[django-manager-missing]
    MAX_STORED_FILENAME_LENGTH: Final[int] = 1024
-    # Per-component limit of common filesystems (ext4, XFS, btrfs, ZFS, APFS)
-    MAX_PUBLIC_FILENAME_BYTES: Final[int] = 255

    correspondent = models.ForeignKey(
        Correspondent,
@@ -486,37 +484,28 @@ class Document(SoftDeleteModel, ModelWithOwner):  # type: ignore[django-manager-
    def archive_file(self):
        return Path(self.archive_path).open("rb")

-    def get_public_filename(
-        self,
-        *,
-        archive: bool = False,
-        counter: int = 0,
-        max_bytes: int = MAX_PUBLIC_FILENAME_BYTES,
-    ) -> str:
+    def get_public_filename(self, *, archive=False, counter=0, suffix=None) -> str:
        """
        Returns a sanitized filename for the document, not including any paths.
-
-        The name fits in max_bytes (UTF-8). A long title is shortened before
-        the counter and extension are appended, because sanitize_filename
-        truncates from the end. The tail is cut only when max_bytes is
-        smaller than the tail itself.
        """
        # Root owns metadata for all versions
        context_document = (
            self.root_document if self.root_document_id is not None else self
        )
+        result = str(context_document)

-        extension = ".pdf" if archive else self.file_type
-        tail = f"_{counter:02}{extension}" if counter else extension
+        if counter:
+            result += f"_{counter:02}"

-        head_bytes = max(0, max_bytes - len(tail.encode()))
-        head = str(context_document).encode()[:head_bytes].decode(errors="ignore")
+        if suffix:
+            result += suffix

-        return pathvalidate.sanitize_filename(
-            head + tail,
-            replacement_text="-",
-            max_len=max_bytes,
-        )
+        if archive:
+            result += ".pdf"
+        else:
+            result += self.file_type
+
+        return pathvalidate.sanitize_filename(result, replacement_text="-")

    @property
    def file_type(self):
@@ -6,9 +6,7 @@ from django.contrib.auth.models import Permission
 from django.contrib.auth.models import User
 from django.contrib.contenttypes.models import ContentType
 from django.db.models import Case
-from django.db.models import CharField
 from django.db.models import Count
-from django.db.models import F
 from django.db.models import IntegerField
 from django.db.models import Model
 from django.db.models import Q
@@ -28,7 +26,6 @@ from rest_framework.permissions import BasePermission
 from rest_framework.permissions import DjangoObjectPermissions

 from documents.models import Document
-from documents.versioning import get_root_document


 class PaperlessObjectPermissions(DjangoObjectPermissions):
@@ -352,7 +349,6 @@ def permitted_object_ids(
    perm: str,
    *,
    include_deleted: bool = False,
-    parent_field: str | None = None,
 ) -> QuerySet[int]:
    """
    Generic version of ``permitted_document_ids`` for any model with an
@@ -361,24 +357,6 @@ def permitted_object_ids(
    soft-delete pattern (currently only ``Document``); for every other model
    it is accepted but has no effect, since those models have no soft-delete
    concept.
-
-    ``parent_field`` names a self-referencing foreign key whose target
-    authorizes the row (``Document.root_document``). A row with a parent is
-    visible exactly when its parent is, judged by the parent's owner and
-    grants, so the row's own owner and grants are ignored.
-
-    Guardian stores ``object_pk`` as a string, so the row key is cast to a
-    string and tested against the user's and groups' grants with a single
-    uncorrelated ``IN``. Postgres and SQLite build that set once. MariaDB
-    evaluates it as an index probe per row, which is cheap because the
-    lookups use guardian's unique indexes. Casting every ``object_pk`` to an
-    integer instead cannot use an index, and MariaDB cannot materialize it
-    inside the owner ``OR``, so it re-scans the user's grants for every row.
-    A correlated ``EXISTS`` per grant fixes MariaDB too, but Postgres and
-    SQLite re-run it for every row and end up slower than the original. The
-    user's groups are matched with an ``IN`` subquery rather than a join
-    through the membership table, which SQLite plans badly once the grant
-    tables grow.
    """
    has_soft_delete = hasattr(model, "global_objects")
    manager = (
@@ -386,14 +364,8 @@ def permitted_object_ids(
    )
    base_qs = manager.all().only("id", "owner")

-    owner_field, key_field = "owner", "pk"
-    if parent_field is not None:
-        owner_field, key_field = "authorizing_owner", "authorizing_id"
-        base_qs = annotate_authorizing_fields(base_qs, parent_field)
-    unowned = Q(**{f"{owner_field}__isnull": True})
-
    if user is None or not getattr(user, "is_authenticated", False):
-        return base_qs.filter(unowned).values_list("id", flat=True)
+        return base_qs.filter(owner__isnull=True).values_list("id", flat=True)

    # Deactivated users get nothing, deactivated superusers included, so this
    # has to come before the superuser shortcut. guardian's
@@ -417,51 +389,26 @@ def permitted_object_ids(
        "permission__content_type": content_type,
    }

-    # Both grant sets are compared to the row key as strings, exactly as
-    # guardian stores them, and are uncorrelated, so each engine can build the
-    # set once instead of probing per row.
-    user_keys = UserObjectPermission.objects.filter(
-        user=user,
-        **perm_filter,
-    ).values_list("object_pk", flat=True)
-    group_keys = GroupObjectPermission.objects.filter(
-        group_id__in=user.groups.values("id"),
-        **perm_filter,
-    ).values_list("object_pk", flat=True)
-    permitted_keys = user_keys.union(group_keys, all=True)
-
-    return (
-        base_qs.annotate(permitted_key=Cast(key_field, CharField(max_length=64)))
-        .filter(
-            Q(**{owner_field: user.pk}) | unowned | Q(permitted_key__in=permitted_keys),
-        )
-        .values_list("id", flat=True)
+    user_perm_ids = (
+        UserObjectPermission.objects.filter(user=user, **perm_filter)
+        .annotate(object_pk_int=Cast("object_pk", IntegerField()))
+        .values_list("object_pk_int", flat=True)
    )
+    group_perm_ids = (
+        GroupObjectPermission.objects.filter(group__user=user, **perm_filter)
+        .annotate(object_pk_int=Cast("object_pk", IntegerField()))
+        .values_list("object_pk_int", flat=True)
+    )
+    permitted_ids = user_perm_ids.union(group_perm_ids)
+
+    return base_qs.filter(
+        Q(owner=user) | Q(owner__isnull=True) | Q(id__in=permitted_ids),
+    ).values_list("id", flat=True)


 ModelT = TypeVar("ModelT", bound=Model)


-def annotate_authorizing_fields(
-    queryset: QuerySet[ModelT],
-    parent_field: str,
-) -> QuerySet[ModelT]:
-    """
-    Annotate each row with ``authorizing_id`` and ``authorizing_owner``: the id
-    and owner of the row that authorizes it. A row with a parent (the
-    self-referencing foreign key ``parent_field``) is authorized by its parent,
-    any other row by itself.
-    """
-    return queryset.annotate(
-        authorizing_id=Coalesce(f"{parent_field}_id", "id"),
-        authorizing_owner=Case(
-            When(**{f"{parent_field}_id__isnull": True}, then=F("owner_id")),
-            default=F(f"{parent_field}__owner_id"),
-            output_field=IntegerField(),
-        ),
-    )
-
-
 def user_is_unrestricted(user: User | None) -> bool:
    """
    True when ``user`` means "no restriction at all" (an absent user, or an
@@ -511,28 +458,6 @@ def restrict_queryset_to_visible(
    return queryset.filter(pk__in=permitted_object_ids(user, queryset.model, perm))


-def user_is_active_superuser(user: User | None) -> bool:
-    """
-    True only for an active, authenticated superuser.
-    """
-    return user is not None and user_is_unrestricted(user)
-
-
-def restrict_queryset_to_owner_visible(
-    queryset: QuerySet[ModelT],
-    user: User | None,
-    perm: str,
-) -> QuerySet[ModelT]:
-    """
-    Like ``restrict_queryset_to_visible``, but ``user=None`` sees only unowned
-    rows (``permitted_object_ids(None, ...)`` semantics) instead of every row.
-    See ``user_is_active_superuser``.
-    """
-    if user_is_active_superuser(user):
-        return queryset
-    return queryset.filter(pk__in=permitted_object_ids(user, queryset.model, perm))
-
-
 def permitted_document_ids(
    user: User | None,
    *,
@@ -546,16 +471,30 @@ def permitted_document_ids(
    ``include_deleted=True`` for callers that need to check permission on
    soft-deleted documents (e.g. trash restore). This intentionally avoids
    ``get_objects_for_user`` to keep the subquery small and index-friendly.
-
-    A version is authorized by its root document, so a version's own owner and
-    grants never matter.
    """
-    return permitted_object_ids(
-        user,
-        Document,
-        perm,
-        include_deleted=include_deleted,
-        parent_field="root_document",
+    return permitted_object_ids(user, Document, perm, include_deleted=include_deleted)
+
+
+def documents_without_permitted_root(
+    documents: QuerySet[Document],
+    user: User | None,
+    *,
+    perm: str = "view_document",
+    include_deleted: bool = False,
+) -> QuerySet[Document]:
+    """
+    The documents the user lacks ``perm`` on. Versions are authorized by their
+    root document, so a version's own owner is ignored. A single query, without
+    loading the documents or joining the root.
+    """
+    return documents.annotate(
+        root_id=Coalesce("root_document_id", "id"),
+    ).exclude(
+        root_id__in=permitted_document_ids(
+            user,
+            perm=perm,
+            include_deleted=include_deleted,
+        ),
    )


@@ -715,14 +654,7 @@ def has_perms_owner_aware(user, perms, obj):
    single-object check still has many production callers. Several callers
    remain across ``documents/``, ``paperless_mail/``, and ``paperless_ai/``
    -- grep for this function name before removing it.
-
-    A document version is authorized by its root document, like in
-    ``permitted_document_ids``, so a version's own owner and grants never
-    matter. Fetch the root with ``select_related("root_document__owner")`` to
-    avoid extra queries.
    """
-    if isinstance(obj, Document):
-        obj = get_root_document(obj)
    checker = ObjectPermissionChecker(user)
    return obj.owner is None or obj.owner == user or checker.has_perm(perms, obj)
				`@@ -1 +0,0 @@`
				<svg xmlns="http://www.w3.org/2000/svg" width="666.667" height="666.667" viewBox="0 0 666.667 666.667"><g stroke-width="1.333"><path fill="#fef400" d="m332.66668 418.66668h-84.66667v-85.33334-85.33333h84.66667 84.66667v-85.33334-85.333334h85.33333 85.33334v85.333334 85.33334h-85.33334-85.33333v85.33333 85.33334z"/><path fill="#fe6565" d="m248.00001 589.33335h-170.666674v-170.66667-170.66667h85.333334 85.33334v-85.33334-85.333334h84.66667 84.66667v85.333334 85.33334h85.33333 85.33334v85.33333 85.33334h-84.66667-84.66667v85.33334 85.33333zm84.66667-170.66667h84.66667v-85.33334-85.33333h-84.66667-84.66667v85.33333 85.33334z"/></g></svg>