Bump version to 3.3.0

.github/workflows/ci-backend.yml

@@ -80,7 +80,7 @@ jobs:
     needs: changes
     if: needs.changes.outputs.backend_changed == 'true'
     name: "Python ${{ matrix.python-version }}"
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
     strategy:
@@ -114,7 +114,7 @@ jobs:
           packages: unpaper tesseract-ocr imagemagick ghostscript poppler-utils
       - name: Configure ImageMagick
         run: |
-          sudo cp docker/rootfs/etc/ImageMagick-6/paperless-policy.xml /etc/ImageMagick-7/policy.xml
+          sudo cp docker/rootfs/etc/ImageMagick-6/paperless-policy.xml /etc/ImageMagick-6/policy.xml
       - name: Install Python dependencies
         env:
           PYTHON_VERSION: ${{ steps.setup-python.outputs.python-version }}
@@ -158,7 +158,7 @@ jobs:
     needs: changes
     if: needs.changes.outputs.backend_changed == 'true'
     name: Check project typing
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
     env:

.github/workflows/ci-docker.yml

@@ -24,10 +24,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - runner: ubuntu-26.04
+          - runner: ubuntu-24.04
             arch: amd64
             platform: linux/amd64
-          - runner: ubuntu-26.04-arm
+          - runner: ubuntu-24.04-arm
             arch: arm64
             platform: linux/arm64
     runs-on: ${{ matrix.runner }}
@@ -163,7 +163,7 @@ jobs:
           archive: false
   merge-and-push:
     name: Merge and Push Manifest
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     needs: build-arch
     if: needs.build-arch.outputs.should-push == 'true'
     environment: image-publishing

.github/workflows/ci-docs.yml

@@ -65,7 +65,7 @@ jobs:
     needs: changes
     if: needs.changes.outputs.docs_changed == 'true'
     name: Build Documentation
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
       - name: Checkout
@@ -102,7 +102,7 @@ jobs:
     name: Deploy Documentation
     needs: [changes, build]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.changes.outputs.docs_changed == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     permissions:
       pages: write
       id-token: write

.github/workflows/ci-frontend.yml

@@ -72,7 +72,7 @@ jobs:
     needs: changes
     if: needs.changes.outputs.frontend_changed == 'true'
     name: Install Dependencies
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
     steps:
@@ -104,7 +104,7 @@ jobs:
     name: Lint
     needs: [changes, install-dependencies]
     if: needs.changes.outputs.frontend_changed == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
     steps:
@@ -137,7 +137,7 @@ jobs:
     name: "Unit Tests (${{ matrix.shard-index }}/${{ matrix.shard-count }})"
     needs: [changes, install-dependencies]
     if: needs.changes.outputs.frontend_changed == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
     strategy:
@@ -188,10 +188,10 @@ jobs:
     name: E2E Tests
     needs: [changes, install-dependencies]
     if: needs.changes.outputs.frontend_changed == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
-    container: mcr.microsoft.com/playwright:v1.62.1-resolute
+    container: mcr.microsoft.com/playwright:v1.62.1-noble
     env:
       PLAYWRIGHT_BROWSERS_PATH: /ms-playwright
       PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
@@ -246,7 +246,7 @@ jobs:
     name: Frontend Build
     needs: [changes, unit-tests, e2e-tests]
     if: needs.changes.outputs.frontend_changed == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
     steps:

.github/workflows/ci-release.yml

@@ -14,7 +14,7 @@ permissions: {}
 jobs:
   wait-for-docker:
     name: Wait for Docker Build
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     permissions:
       checks: read
       statuses: read
@@ -30,7 +30,7 @@ jobs:
   build-release:
     name: Build Release
     needs: wait-for-docker
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
     steps:
@@ -73,7 +73,7 @@ jobs:
         timeout-minutes: 12
         uses: $/.github/actions/apt-install
         with:
-          packages: gettext libleptonica6
+          packages: gettext liblept5
       # ---- Build Documentation ----
       - name: Build documentation
         env:
@@ -145,7 +145,7 @@ jobs:
   publish-release:
     name: Publish Release
     needs: build-release
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: write
       pull-requests: write
@@ -197,7 +197,7 @@ jobs:
     name: Append Changelog
     needs: publish-release
     if: needs.publish-release.outputs.prerelease == 'false'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: write
       pull-requests: write

.github/workflows/ci-static-analysis.yml

@@ -15,7 +15,7 @@ permissions:
 jobs:
   zizmor:
     name: Run zizmor
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       actions: read
@@ -29,7 +29,7 @@ jobs:
         uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
   semgrep:
     name: Semgrep CE
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     container:
       image: semgrep/semgrep:1.155.0@sha256:cc869c685dcc0fe497c86258da9f205397d8108e56d21a86082ea4886e52784d
     if: github.actor != 'dependabot[bot]'

.github/workflows/cleanup-tags.yml

@@ -17,7 +17,7 @@ jobs:
   cleanup-images:
     name: Cleanup Image Tags for ${{ matrix.primary-name }}
     if: github.repository_owner == 'paperless-ngx'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     environment: registry-maintenance
     strategy:
       fail-fast: false
@@ -42,7 +42,7 @@ jobs:
   cleanup-untagged-images:
     name: Cleanup Untagged Images Tags for ${{ matrix.primary-name }}
     if: github.repository_owner == 'paperless-ngx'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     needs:
       - cleanup-images
     environment: registry-maintenance

.github/workflows/codeql-analysis.yml

@@ -21,7 +21,7 @@ on:
 jobs:
   analyze:
     name: Analyze
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     permissions:
       actions: read
       contents: read

.github/workflows/crowdin.yml

@@ -13,7 +13,7 @@ jobs:
   synchronize-with-crowdin:
     name: Crowdin Sync
     if: github.repository_owner == 'paperless-ngx'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     environment: translation-sync
     steps:
       - name: Checkout

.github/workflows/issue-bot.yml

@@ -7,7 +7,7 @@ jobs:
     # Note: peakoss/anti-slop does not support the `issues` event yet (all of its
     # issue inputs are still commented out upstream), so the checks that the PR Bot
     # workflow gets from the action are implemented manually here.
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-latest
     permissions:
       issues: write
     steps:

.github/workflows/pr-bot.yml

@@ -4,7 +4,7 @@ on:
     types: [opened]
 jobs:
   Anti-slop:
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       issues: read
@@ -24,7 +24,7 @@ jobs:
             ASLOP-PR-VERIFY
   pr-bot:
     name: Automated PR Bot
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-latest
     # Runs after Anti-slop so the welcome comment can see whether the PR was closed
     # instead of racing it. Still runs if that job fails, so labeling is not lost.
     needs: Anti-slop

.github/workflows/project-actions.yml

@@ -12,7 +12,7 @@ permissions:
 jobs:
   pr_opened_or_reopened:
     name: pr_opened_or_reopened
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
     permissions:
       # write permission is required for autolabeler
       pull-requests: write

.github/workflows/repo-maintenance.yml

@@ -9,7 +9,7 @@ jobs:
   stale:
     name: 'Stale'
     if: github.repository_owner == 'paperless-ngx'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     permissions:
       issues: write
       pull-requests: write
@@ -34,7 +34,7 @@ jobs:
   lock-threads:
     name: 'Lock Old Threads'
     if: github.repository_owner == 'paperless-ngx'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     permissions:
       issues: write
       pull-requests: write
@@ -58,7 +58,7 @@ jobs:
   close-answered-discussions:
     name: 'Close Answered Discussions'
     if: github.repository_owner == 'paperless-ngx'
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
     permissions:
       discussions: write
     steps:
@@ -117,7 +117,7 @@ jobs:
   close-outdated-discussions:
     name: 'Close Outdated Discussions'
     if: github.repository_owner == 'paperless-ngx'
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
     permissions:
       discussions: write
     steps:
@@ -211,7 +211,7 @@ jobs:
   close-unsupported-feature-requests:
     name: 'Close Unsupported Feature Requests'
     if: github.repository_owner == 'paperless-ngx'
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
     permissions:
       discussions: write
     steps:

.github/workflows/translate-strings.yml

@@ -8,7 +8,7 @@ env:
 jobs:
   generate-translate-strings:
     name: Generate Translation Strings
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     environment: translation-sync
     permissions:
       contents: write

docs/faq.md

@@ -76,7 +76,9 @@ is not supported by any of the available parsers.
 
 **A:** Not by default. As of v3, a file whose contents match an existing document is still
 consumed, and the duplicate is flagged in the UI — open the document and check the
-**Duplicates** tab to review documents that share the same content. If you prefer the old
+**Duplicates** tab to review documents that share the same content, or filter the document
+list by **Duplicates** to find all of them (see
+[Duplicate documents](usage.md#duplicate-documents)). If you prefer the old
 behavior of rejecting duplicates during consumption, set
 [`PAPERLESS_CONSUMER_DELETE_DUPLICATES`](configuration.md#PAPERLESS_CONSUMER_DELETE_DUPLICATES)
 to `true`.

docs/usage.md

@@ -299,19 +299,18 @@ for details.
 ### Duplicate documents
 
 By default, Paperless-ngx **does not reject duplicates**. If you consume a file whose
-contents exactly match an existing document (same checksum), the new copy is still
-consumed and a warning is logged. The task entry for the upload also flags that a
-duplicate was detected and links to the existing document(s).
+contents match an existing document (same original or archive checksum), the new copy is
+still consumed and a warning is logged.
 
-To review duplicates, open a document and switch to the **Duplicates** tab on the
-document detail page. It lists other documents that share the same content, including any
-that are in the trash (shown with a badge), and links to each so you can decide which to
-keep.
+When a document has duplicates, a **Duplicates** tab appears on its detail page, listing
+the other documents you can view that share the same content (including any in the trash).
+To find all documents with duplicates, choose **Duplicates** in the document list's text
+filter dropdown, or use `has_duplicates=true` in the REST API.
 
 If you would rather reject duplicates at consumption time (the pre-v3 behavior), set
 [`PAPERLESS_CONSUMER_DELETE_DUPLICATES`](configuration.md#PAPERLESS_CONSUMER_DELETE_DUPLICATES)
 to `true`. The duplicate file is then deleted instead of consumed, and the task fails with
-a "document already exists" message.
+a "Document already exists" message linking to the existing document.
 
 ## Document Suggestions
 

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "paperless-ngx"
-version = "3.2.1"
+version = "3.3.0"
 description = """\
   A community-supported supercharged document management system: scan, index and archive all your physical documents\
   """

src-ui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paperless-ngx-ui",
-  "version": "3.2.1",
+  "version": "3.3.0",
   "scripts": {
     "preinstall": "npx only-allow pnpm",
     "ng": "ng",

src-ui/src/environments/environment.prod.ts

@@ -8,7 +8,7 @@ export const environment = {
   apiVersion: '10', // match src/paperless/settings.py
   appTitle: DEFAULT_APP_TITLE,
   tag: 'prod',
-  version: '3.2.1',
+  version: '3.3.0',
   webSocketHost: window.location.host,
   webSocketProtocol: window.location.protocol == 'https:' ? 'wss:' : 'ws:',
   webSocketBaseUrl: base_url.pathname + 'ws/',

src/locale/en_US/LC_MESSAGES/django.po

@@ -2,7 +2,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: paperless-ngx\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-10-06 15:12+0000\n"
+"POT-Creation-Date: 2026-10-05 16:26+0000\n"
 "PO-Revision-Date: 2022-02-17 04:17\n"
 "Last-Translator: \n"
 "Language-Team: English\n"
@@ -1941,8 +1941,25 @@ msgstr ""
 msgid "As a final step, please complete the following form:"
 msgstr ""
 
+#: documents/validators.py:24
+#, python-brace-format
+msgid "Unable to parse URI {value}, missing scheme"
+msgstr ""
+
+#: documents/validators.py:29
+#, python-brace-format
+msgid "Unable to parse URI {value}, missing net location or path"
+msgstr ""
+
 #: documents/validators.py:36
-msgid ", "
+msgid ""
+"URI scheme '{parts.scheme}' is not allowed. Allowed schemes: {', '."
+"join(allowed_schemes)}"
+msgstr ""
+
+#: documents/validators.py:45
+#, python-brace-format
+msgid "Unable to parse URI {value}"
 msgstr ""
 
 #: documents/views.py:336 documents/views.py:2729

src/paperless/tests/parsers/test_mail_parser_live.py

@@ -137,20 +137,9 @@ class TestNginxService:
     reason="No Gotenberg/Tika servers to test with",
 )
 class TestParserLive:
-    # Rasterizer versions shift a few pixels, so compare perceptual hashes by
-    # Hamming distance (out of 18 * 18 = 324 bits) rather than for equality
-    MAX_HASH_DISTANCE = 8
-
-    @classmethod
-    def assert_thumbnails_similar(cls, generated: Path, expected: Path) -> None:
-        distance = average_hash(Image.open(generated), 18) - average_hash(
-            Image.open(expected),
-            18,
-        )
-        assert distance <= cls.MAX_HASH_DISTANCE, (
-            f"Thumbnail {generated} differs from {expected} by {distance} bits "
-            f"(max {cls.MAX_HASH_DISTANCE})"
-        )
+    @staticmethod
+    def imagehash(file: Path, hash_size: int = 18) -> str:
+        return f"{average_hash(Image.open(file), hash_size)}"
 
     def test_get_thumbnail(
         self,
@@ -179,7 +168,12 @@ class TestParserLive:
         assert thumb.exists()
         assert thumb.is_file()
 
-        self.assert_thumbnails_similar(thumb, simple_txt_email_thumbnail_file)
+        assert self.imagehash(thumb) == self.imagehash(
+            simple_txt_email_thumbnail_file,
+        ), (
+            f"Created thumbnail {thumb} differs from expected file "
+            f"{simple_txt_email_thumbnail_file}"
+        )
 
     def test_tika_parse_successful(self, mail_parser: MailDocumentParser) -> None:
         """
@@ -261,7 +255,7 @@ class TestParserLive:
         THEN:
             - Gotenberg shall be called to generate the PDF
             - The archive PDF shall contain the expected content
-            - The generated thumbnail shall be perceptually close to the expected image
+            - The generated thumbnail shall match the expected image hash
         """
         util_call_with_backoff(mail_parser.parse, [html_email_file, "message/rfc822"])
 
@@ -278,4 +272,14 @@ class TestParserLive:
             html_email_file,
             "message/rfc822",
         )
-        self.assert_thumbnails_similar(generated_thumbnail, html_email_thumbnail_file)
+        generated_thumbnail_hash = self.imagehash(generated_thumbnail)
+
+        # The created PDF is not reproducible, but the converted image
+        # should always look the same
+        expected_hash = self.imagehash(html_email_thumbnail_file)
+
+        assert generated_thumbnail_hash == expected_hash, (
+            f"PDF thumbnail differs from expected. "
+            f"Generated: {generated_thumbnail}, "
+            f"Hash: {generated_thumbnail_hash} vs {expected_hash}"
+        )

src/paperless/version.py

@@ -1,6 +1,6 @@
 from typing import Final
 
-__version__: Final[tuple[int, int, int]] = (3, 2, 1)
+__version__: Final[tuple[int, int, int]] = (3, 3, 0)
 # Version string like X.Y.Z
 __full_version_str__: Final[str] = ".".join(map(str, __version__))
 # Version string like X.Y

uv.lock

@@ -2971,7 +2971,7 @@ wheels = [
 
 [[package]]
 name = "paperless-ngx"
-version = "3.2.1"
+version = "3.3.0"
 source = { virtual = "." }
 dependencies = [
     { name = "azure-ai-documentintelligence" },