test: add matching.py permission coverage for correspondents, document types, storage paths

Completes the parametrized coverage started for tags -- proves all 4 matching.py lookups migrated to permitted_object_ids respect per-object view permissions, not just the tag case. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
perf: migrate matching.py's 4 permission-filtered lookups to permitted_object_ids
2026-08-08 11:53:19 +00:00 · 2026-08-07 13:16:04 -07:00 · 2026-08-07 13:16:04 -07:00 · 2026-08-07 13:16:03 -07:00 · 2026-08-07 13:16:03 -07:00 · 2026-08-07 13:16:03 -07:00
337 changed files with 116464 additions and 70172 deletions
@@ -1,49 +1,51 @@
 categories:
+  - type: 'pre-include'
+    when:
+      - label: 'enhancement'
+      - label: 'bug'
+      - label: 'chore'
+      - label: 'deployment'
+      - label: 'translation'
+      - label: 'dependencies'
+      - label: 'documentation'
+      - label: 'frontend'
+      - label: 'backend'
+      - label: 'ci-cd'
+      - label: 'breaking-change'
+      - label: 'notable'
+  - type: 'pre-exclude'
+    when:
+      - label: 'skip-changelog'
  - title: 'Breaking Changes'
-    labels:
-      - 'breaking-change'
+    when:
+      - label: 'breaking-change'
  - title: 'Notable Changes'
-    labels:
-      - 'notable'
+    when:
+      - label: 'notable'
  - title: 'Features / Enhancements'
-    labels:
-      - 'enhancement'
+    when:
+      - label: 'enhancement'
  - title: 'Bug Fixes'
-    labels:
-      - 'bug'
+    when:
+      - label: 'bug'
  - title: 'Documentation'
-    labels:
-      - 'documentation'
+    when:
+      - label: 'documentation'
  - title: 'Maintenance'
-    labels:
-      - 'chore'
-      - 'deployment'
-      - 'translation'
-      - 'ci-cd'
+    when:
+      - label: 'chore'
+      - label: 'deployment'
+      - label: 'translation'
+      - label: 'ci-cd'
  - title: 'Dependencies'
    collapse-after: 3
-    labels:
-      - 'dependencies'
+    when:
+      - label: 'dependencies'
  - title: 'All App Changes'
-    labels:
-      - 'frontend'
-      - 'backend'
    collapse-after: 1
-include-labels:
-  - 'enhancement'
-  - 'bug'
-  - 'chore'
-  - 'deployment'
-  - 'translation'
-  - 'dependencies'
-  - 'documentation'
-  - 'frontend'
-  - 'backend'
-  - 'ci-cd'
-  - 'breaking-change'
-  - 'notable'
-exclude-labels:
-  - 'skip-changelog'
+    when:
+      - label: 'frontend'
+      - label: 'backend'
 filter-by-commitish: true
 category-template: '### $TITLE'
 change-template: '- $TITLE @$AUTHOR ([#$NUMBER]($URL))'
@@ -24,7 +24,7 @@ jobs:
      backend_changed: ${{ steps.force.outputs.run_all == 'true' || steps.filter.outputs.backend == 'true' }}
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -63,7 +63,7 @@ jobs:
      - name: Detect changes
        id: filter
        if: steps.force.outputs.run_all != 'true'
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        with:
          base: ${{ steps.range.outputs.base }}
          ref: ${{ steps.range.outputs.ref }}
@@ -87,7 +87,7 @@ jobs:
      fail-fast: false
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Start containers
@@ -96,11 +96,11 @@ jobs:
          docker compose --file docker/compose/docker-compose.ci-test.yml up --detach
      - name: Set up Python
        id: setup-python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "${{ matrix.python-version }}"
      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
@@ -169,16 +169,16 @@ jobs:
      PAPERLESS_SECRET_KEY: "ci-typing-not-a-real-secret"
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Python
        id: setup-python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "${{ env.DEFAULT_PYTHON }}"
      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
@@ -41,7 +41,7 @@ jobs:
      ref-name: ${{ steps.ref.outputs.name }}
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Determine ref name
@@ -106,9 +106,9 @@ jobs:
          echo "repository=${repo_name}"
          echo "name=${repo_name}" >> $GITHUB_OUTPUT
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -121,7 +121,7 @@ jobs:
          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
      - name: Docker metadata
        id: docker-meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: |
            ${{ env.REGISTRY }}/${{ steps.repo.outputs.name }}
@@ -132,7 +132,7 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}
      - name: Build and push by digest
        id: build
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: ./Dockerfile
@@ -182,29 +182,29 @@ jobs:
          echo "Downloaded digests:"
          ls -la /tmp/digests/
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to Docker Hub
        if: needs.build-arch.outputs.push-external == 'true'
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to Quay.io
        if: needs.build-arch.outputs.push-external == 'true'
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
      - name: Docker metadata
        id: docker-meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: |
            ${{ env.REGISTRY }}/${{ needs.build-arch.outputs.repository }}
@@ -21,7 +21,7 @@ jobs:
      docs_changed: ${{ steps.force.outputs.run_all == 'true' || steps.filter.outputs.docs == 'true' }}
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -50,7 +50,7 @@ jobs:
      - name: Detect changes
        id: filter
        if: steps.force.outputs.run_all != 'true'
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        with:
          base: ${{ steps.range.outputs.base }}
          ref: ${{ steps.range.outputs.ref }}
@@ -69,16 +69,16 @@ jobs:
    steps:
      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Python
        id: setup-python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
@@ -21,7 +21,7 @@ jobs:
      frontend_changed: ${{ steps.force.outputs.run_all == 'true' || steps.filter.outputs.frontend == 'true' }}
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -60,7 +60,7 @@ jobs:
      - name: Detect changes
        id: filter
        if: steps.force.outputs.run_all != 'true'
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        with:
          base: ${{ steps.range.outputs.base }}
          ref: ${{ steps.range.outputs.ref }}
@@ -77,7 +77,7 @@ jobs:
      contents: read
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install pnpm
@@ -85,7 +85,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: 'pnpm'
@@ -109,7 +109,7 @@ jobs:
      contents: read
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install pnpm
@@ -117,7 +117,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: 'pnpm'
@@ -129,8 +129,8 @@ jobs:
            ~/.pnpm-store
            ~/.cache
          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
-      - name: Re-link Angular CLI
-        run: cd src-ui && pnpm link @angular/cli
+      - name: Install dependencies
+        run: cd src-ui && pnpm install --frozen-lockfile
      - name: Run lint
        run: cd src-ui && pnpm run lint
  unit-tests:
@@ -148,7 +148,7 @@ jobs:
        shard-count: [4]
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install pnpm
@@ -156,7 +156,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: 'pnpm'
@@ -168,8 +168,8 @@ jobs:
            ~/.pnpm-store
            ~/.cache
          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
-      - name: Re-link Angular CLI
-        run: cd src-ui && pnpm link @angular/cli
+      - name: Install dependencies
+        run: cd src-ui && pnpm install --frozen-lockfile
      - name: Run Jest unit tests
        run: cd src-ui && pnpm run test --max-workers=2 --shard=${{ matrix.shard-index }}/${{ matrix.shard-count }}
      - name: Upload test results to Codecov
@@ -191,7 +191,7 @@ jobs:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
-    container: mcr.microsoft.com/playwright:v1.61.1-noble
+    container: mcr.microsoft.com/playwright:v1.62.0-noble
    env:
      PLAYWRIGHT_BROWSERS_PATH: /ms-playwright
      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
@@ -203,7 +203,7 @@ jobs:
        shard-count: [2]
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install pnpm
@@ -211,7 +211,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: 'pnpm'
@@ -223,23 +223,20 @@ jobs:
            ~/.pnpm-store
            ~/.cache
          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
-      - name: Re-link Angular CLI
-        run: cd src-ui && pnpm link @angular/cli
      - name: Install dependencies
-        run: cd src-ui && pnpm install --no-frozen-lockfile
+        run: cd src-ui && pnpm install --frozen-lockfile
      - name: Run Playwright E2E tests
        run: cd src-ui && pnpm exec playwright test --shard ${{ matrix.shard-index }}/${{ matrix.shard-count }}
-  bundle-analysis:
-    name: Bundle Analysis
+  frontend-build:
+    name: Frontend Build
    needs: [changes, unit-tests, e2e-tests]
    if: needs.changes.outputs.frontend_changed == 'true'
    runs-on: ubuntu-24.04
-    environment: bundle-analysis
    permissions:
      contents: read
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 2
          persist-credentials: false
@@ -248,7 +245,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: 'pnpm'
@@ -260,21 +257,19 @@ jobs:
            ~/.pnpm-store
            ~/.cache
          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
-      - name: Re-link Angular CLI
-        run: cd src-ui && pnpm link @angular/cli
-      - name: Build and analyze
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+      - name: Install dependencies
+        run: cd src-ui && pnpm install --frozen-lockfile
+      - name: Build
        run: cd src-ui && pnpm run build --configuration=production
  gate:
    name: Frontend CI Gate
-    needs: [changes, install-dependencies, lint, unit-tests, e2e-tests, bundle-analysis]
+    needs: [changes, install-dependencies, lint, unit-tests, e2e-tests, frontend-build]
    if: always()
    runs-on: ubuntu-slim
    steps:
      - name: Check gate
        env:
-          BUNDLE_ANALYSIS_RESULT: ${{ needs['bundle-analysis'].result }}
+          BUILD_RESULT: ${{ needs['frontend-build'].result }}
          E2E_RESULT: ${{ needs['e2e-tests'].result }}
          FRONTEND_CHANGED: ${{ needs.changes.outputs.frontend_changed }}
          INSTALL_RESULT: ${{ needs['install-dependencies'].result }}
@@ -306,8 +301,8 @@ jobs:
            exit 1
          fi

-          if [[ "${BUNDLE_ANALYSIS_RESULT}" != "success" ]]; then
-            echo "::error::Frontend bundle-analysis job result: ${BUNDLE_ANALYSIS_RESULT}"
+          if [[ "${BUILD_RESULT}" != "success" ]]; then
+            echo "::error::Frontend build job result: ${BUILD_RESULT}"
            exit 1
          fi

@@ -17,12 +17,12 @@ jobs:
    runs-on: ubuntu-slim
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.14"
      - name: Run prek
-        uses: j178/prek-action@bdca6f102f98e2b4c7029491a53dfd366469e33d # v2.0.4
+        uses: j178/prek-action@5337cb91e0fa35a7ff31b9ca345126d8bbbcdf16 # v2.0.6
@@ -20,12 +20,13 @@ jobs:
      statuses: read
    steps:
      - name: Wait for Docker build
-        uses: lewagon/wait-on-check-action@96d9100b431964d10e0136aff8b9ccb92470505e # v1.8.0
+        uses: lewagon/wait-on-check-action@2271c86c146b96545b4e871b855e10ffa6f50773 # v1.9.0
        with:
          ref: ${{ github.sha }}
          check-name: 'Merge and Push Manifest'
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          wait-interval: 60
+          checks-discovery-timeout: 1800
  build-release:
    name: Build Release
    needs: wait-for-docker
@@ -34,7 +35,7 @@ jobs:
      contents: read
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # ---- Frontend Build ----
@@ -43,7 +44,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          package-manager-cache: false
@@ -54,11 +55,11 @@ jobs:
      # ---- Backend Setup ----
      - name: Set up Python
        id: setup-python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: false
@@ -85,7 +86,7 @@ jobs:
      # ---- Prepare Release ----
      - name: Generate requirements file
        run: |
-          uv export --quiet --no-dev --all-extras --format requirements-txt --output-file requirements.txt
+          uv export --quiet --no-dev --all-extras --emit-index-url --format requirements-txt --output-file requirements.txt
      - name: Compile messages
        env:
          PAPERLESS_SECRET_KEY: "ci-release-not-a-real-secret"
@@ -170,7 +171,7 @@ jobs:
          fi
      - name: Create release and changelog
        id: create-release
-        uses: release-drafter/release-drafter@4d75298e00d9e34c483e5ff8c68d0ea1c1940c1e # v7.5.1
+        uses: release-drafter/release-drafter@eada3c96a64734dd381cfbda23511034e328ddb0 # v7.6.0
        with:
          name: Paperless-ngx ${{ steps.get-version.outputs.version }}
          tag: ${{ steps.get-version.outputs.version }}
@@ -201,17 +202,17 @@ jobs:
      pull-requests: write
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: main
          persist-credentials: true # for pushing changelog branch
      - name: Set up Python
        id: setup-python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: false
@@ -22,11 +22,11 @@ jobs:
      security-events: write
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
  semgrep:
    name: Semgrep CE
    runs-on: ubuntu-24.04
@@ -38,13 +38,13 @@ jobs:
      security-events: write
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Run Semgrep
        run: semgrep scan --config auto --sarif-output results.sarif
      - name: Upload results to GitHub code scanning
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
        if: always()
        with:
          sarif_file: results.sarif
@@ -34,12 +34,12 @@ jobs:
        # Learn more about CodeQL language support at https://git.io/codeql-language-support
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
        with:
          languages: ${{ matrix.language }}
          # If you wish to specify custom queries, you can do so here or in a config file.
@@ -47,4 +47,4 @@ jobs:
          # Prefix the list here with "+" to use these queries and those in the config file.
          # queries: ./path/to/local/query, your-org/your-repo/queries@main
      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
@@ -17,12 +17,12 @@ jobs:
    environment: translation-sync
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          token: ${{ secrets.PNGX_BOT_PAT }}
          persist-credentials: false
      - name: crowdin action
-        uses: crowdin/github-action@52aa776766211d83d975df51f3b9c53c2f8ba35f # v2.16.3
+        uses: crowdin/github-action@c7af9bc98b01694653031fef2a0dc6c7888ce9bc # v2.17.0
        with:
          upload_translations: false
          download_translations: true
@@ -31,7 +31,7 @@ jobs:
    steps:
      - name: Label PR by file path or branch name
        # see .github/labeler.yml for the labeler config
-        uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
+        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - name: Label by size
@@ -19,6 +19,6 @@ jobs:
    if: github.event_name == 'pull_request_target' && (github.event.action == 'opened' || github.event.action == 'reopened') && github.event.pull_request.user.login != 'dependabot'
    steps:
      - name: Label PR with release-drafter
-        uses: release-drafter/release-drafter@4d75298e00d9e34c483e5ff8c68d0ea1c1940c1e # v7.5.1
+        uses: release-drafter/release-drafter@eada3c96a64734dd381cfbda23511034e328ddb0 # v7.6.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -14,7 +14,7 @@ jobs:
      issues: write
      pull-requests: write
    steps:
-      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
        with:
          days-before-stale: 7
          days-before-close: 14
@@ -14,7 +14,7 @@ jobs:
      contents: write
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        env:
          GH_REF: ${{ github.ref }} # sonar rule:githubactions:S7630 - avoid injection
        with:
@@ -23,13 +23,13 @@ jobs:
          persist-credentials: true # for pushing translation branch
      - name: Set up Python
        id: setup-python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      - name: Install system dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -qq --no-install-recommends gettext
      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
@@ -47,7 +47,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: 'pnpm'
@@ -61,16 +61,13 @@ jobs:
            ~/.cache
          key: ${{ runner.os }}-frontenddeps-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
      - name: Install frontend dependencies
-        if: steps.cache-frontend-deps.outputs.cache-hit != 'true'
-        run: cd src-ui && pnpm install
-      - name: Re-link Angular cli
-        run: cd src-ui && pnpm link @angular/cli
+        run: cd src-ui && pnpm install --frozen-lockfile
      - name: Generate frontend translation strings
        run: |
          cd src-ui
          pnpm run ng extract-i18n
      - name: Commit changes
-        uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7.1.0
+        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
        with:
          file_pattern: 'src-ui/messages.xlf src/locale/en_US/LC_MESSAGES/django.po'
          commit_message: "Auto translate strings"
@@ -29,7 +29,7 @@ repos:
      - id: check-case-conflict
      - id: detect-private-key
  - repo: https://github.com/codespell-project/codespell
-    rev: v2.4.2
+    rev: v2.4.3
    hooks:
      - id: codespell
        additional_dependencies: [tomli]
@@ -38,7 +38,7 @@ repos:
          - json
  # See https://github.com/prettier/prettier/issues/15742 for the fork reason
  - repo: https://github.com/rbubley/mirrors-prettier
-    rev: 'v3.8.4'
+    rev: 'v3.9.6'
    hooks:
      - id: prettier
        types_or:
@@ -46,16 +46,16 @@ repos:
          - ts
          - markdown
        additional_dependencies:
-          - prettier@3.8.3
+          - prettier@3.9.6
          - 'prettier-plugin-organize-imports@4.3.0'
  # Python hooks
  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.17
+    rev: v0.16.1
    hooks:
      - id: ruff-check
      - id: ruff-format
  - repo: https://github.com/tox-dev/pyproject-fmt
-    rev: "v2.24.1"
+    rev: "v2.26.0"
    hooks:
      - id: pyproject-fmt
        additional_dependencies: [tomli]
@@ -30,7 +30,7 @@ RUN set -eux \
 # Purpose: Installs s6-overlay and rootfs
 # Comments:
 #  - Don't leave anything extra in here either
-FROM ghcr.io/astral-sh/uv:0.11.19-python3.12-trixie-slim AS s6-overlay-base
+FROM ghcr.io/astral-sh/uv:0.11.32-python3.12-trixie-slim AS s6-overlay-base

 WORKDIR /usr/src/s6

@@ -238,6 +238,10 @@ RUN set -eux \
    && chown --from root:root --changes --recursive paperless:paperless /usr/src/paperless \
  && echo "Making fontconfig cache writable for arbitrary container UIDs" \
    && chmod 1777 /var/cache/fontconfig \
+  && echo "Making /run world-writable for rootless operation" \
+    && chmod 1777 /run \
+  && echo "Removing setuid from s6-overlay-suexec for rootless compat" \
+    && chmod u-s /command/s6-overlay-suexec \
  && echo "Collecting static files" \
    && PAPERLESS_SECRET_KEY=build-time-dummy s6-setuidgid paperless python3 manage.py collectstatic --clear --no-input --link \
    && PAPERLESS_SECRET_KEY=build-time-dummy s6-setuidgid paperless python3 manage.py compilemessages \
@@ -4,7 +4,7 @@
 # correct networking for the tests
 services:
  gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.33
+    image: docker.io/gotenberg/gotenberg:8.34
    hostname: gotenberg
    container_name: gotenberg
    network_mode: host
@@ -24,7 +24,7 @@ services:
    network_mode: host
    restart: unless-stopped
  greenmail:
-    image: docker.io/greenmail/standalone:2.1.8
+    image: docker.io/greenmail/standalone:2.1.11
    hostname: greenmail
    container_name: greenmail
    environment:
@@ -35,7 +35,7 @@ services:
      - "3143:3143" # IMAP
    restart: unless-stopped
  nginx:
-    image: docker.io/nginx:1.31.1-alpine
+    image: docker.io/nginx:1.31.3-alpine
    hostname: nginx
    container_name: nginx
    ports:
@@ -72,7 +72,7 @@ services:
      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
  gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.33
+    image: docker.io/gotenberg/gotenberg:8.34
    restart: unless-stopped
    # The gotenberg chromium route is used to convert .eml files. We do not
    # want to allow external content like tracking pixels or even javascript.
@@ -56,7 +56,7 @@ services:
    environment:
      PAPERLESS_REDIS: redis://broker:6379
      PAPERLESS_DBHOST: db
-      PAPERLESS_DBENGINE: postgres
+      PAPERLESS_DBENGINE: postgresql
    env_file:
      - stack.env
 volumes:
@@ -67,7 +67,7 @@ services:
      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
  gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.33
+    image: docker.io/gotenberg/gotenberg:8.34
    restart: unless-stopped
    # The gotenberg chromium route is used to convert .eml files. We do not
    # want to allow external content like tracking pixels or even javascript.
@@ -56,7 +56,7 @@ services:
      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
  gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.33
+    image: docker.io/gotenberg/gotenberg:8.34
    restart: unless-stopped
    # The gotenberg chromium route is used to convert .eml files. We do not
    # want to allow external content like tracking pixels or even javascript.
@@ -0,0 +1,12 @@
+#!/command/with-contenv /usr/bin/bash
+# shellcheck shell=bash
+
+declare -r log_prefix="[init-llmindex-migrate]"
+
+echo "${log_prefix} Checking for pending LLM index migrations..."
+cd "${PAPERLESS_SRC_DIR}"
+if [[ -n "${USER_IS_NON_ROOT}" ]]; then
+	python3 manage.py document_llmindex migrate
+else
+	s6-setuidgid paperless python3 manage.py document_llmindex migrate
+fi
@@ -0,0 +1 @@
+oneshot
@@ -0,0 +1 @@
+/etc/s6-overlay/s6-rc.d/init-llmindex-migrate/run
@@ -151,6 +151,23 @@ the background.

 ### Bare Metal Route {#bare-metal-updating}

+!!! warning
+
+    Extracting a new release archive on top of an existing installation
+    (e.g. `tar -xf paperless-ngx-vX.Y.Z.tar.xz -C /opt/paperless`) only adds
+    and overwrites files -- it does not remove files that were deleted in
+    the new release. Leftover files from an old version, such as
+    superseded database migrations, can remain on disk and cause errors
+    like `NodeNotFoundError` during `manage.py migrate`.
+
+    Before unpacking a new release over an existing bare-metal
+    installation, remove the previous source tree first (everything
+    except your `media`, `data`, and `consume` directories and your
+    `paperless.conf`/`.env`), or unpack into a fresh directory and move
+    your persistent data and configuration over. Installations updated via
+    `git pull` on a clean checkout are not affected, since Git removes
+    files that no longer exist upstream.
+
 After grabbing the new release and unpacking the contents, do the
 following:

@@ -195,6 +212,16 @@ following:
    This is a no-op if the index is already up to date, so it is safe to
    run on every upgrade.

+5.  Migrate the LLM index if needed.
+
+    ```shell-session
+    cd src
+    python3 manage.py document_llmindex migrate
+    ```
+
+    This is a no-op if the index schema is already current, so it is safe
+    to run on every upgrade.
+
 ### Database Upgrades

 Paperless-ngx is compatible with Django-supported versions of PostgreSQL and MariaDB and it is generally
@@ -515,7 +542,7 @@ index is updated automatically on the schedule set by
 can manage it manually:

 ```
-document_llmindex {rebuild,update,compact}
+document_llmindex {rebuild,update,compact,migrate}
 ```

 Specify `rebuild` to build the index from scratch from all documents in the database. Use
@@ -522,22 +522,36 @@ do CORS calls. Set this to your public domain name.
 fail2ban with log entries for failed authorization attempts. Value should be
 IP address(es).

-    This setting also controls allauth's
-    [`ALLAUTH_TRUSTED_PROXY_COUNT`](https://docs.allauth.org/en/latest/account/configuration.html),
-    which is set to the number of proxies listed here. Without this,
-    allauth cannot determine the client IP address for rate limiting when
-    running behind a reverse proxy, resulting in a `403 Forbidden` on login.
+    By default, this setting also controls allauth's trusted proxy count,
+    which is set to the number of proxies listed here. Override that default
+    with [`PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT`](#PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT)
+    when the list length does not match the number of proxy hops.

    Defaults to empty string.

+#### [`PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT=<integer>`](#PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT) {#PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT}
+
+: Sets allauth's
+[`ALLAUTH_TRUSTED_PROXY_COUNT`](https://docs.allauth.org/en/latest/common/rate_limits.html#configuration).
+This is the number of trusted proxy **hops** represented in each
+`X-Forwarded-For` header, not the number of IP addresses through which those
+proxies may be reached. For example, a single dual-stack proxy is one hop even
+when its IPv4 and IPv6 addresses are both listed in
+[`PAPERLESS_TRUSTED_PROXIES`](#PAPERLESS_TRUSTED_PROXIES).
+
+    Only trust `X-Forwarded-For` when untrusted clients cannot connect directly
+    to Paperless-ngx.
+
+    Defaults to the number of entries in `PAPERLESS_TRUSTED_PROXIES`.
+
 #### [`PAPERLESS_ALLAUTH_TRUSTED_CLIENT_IP_HEADER=<header-name>`](#PAPERLESS_ALLAUTH_TRUSTED_CLIENT_IP_HEADER) {#PAPERLESS_ALLAUTH_TRUSTED_CLIENT_IP_HEADER}

 : Sets allauth's
-[`ALLAUTH_TRUSTED_CLIENT_IP_HEADER`](https://docs.allauth.org/en/latest/account/configuration.html).
+[`ALLAUTH_TRUSTED_CLIENT_IP_HEADER`](https://docs.allauth.org/en/latest/common/rate_limits.html#configuration).
 Use this when your reverse proxy sets a dedicated header for the real
 client IP instead of `X-Forwarded-For`, for example `X-Real-IP` (nginx)
 or `CF-Connecting-IP` (Cloudflare). When set, this takes precedence over
-[`PAPERLESS_TRUSTED_PROXIES`](#PAPERLESS_TRUSTED_PROXIES).
+`PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT`.

    Defaults to none.

@@ -918,8 +932,8 @@ for display in the web interface.
    | Document type              | `never` | `auto` (default)           | `always` |
    | -------------------------- | ------- | -------------------------- | -------- |
    | Scanned image (TIFF, JPEG) | No      | **Yes**                    | Yes      |
-    | Image-based PDF            | No      | **Yes** (short/no text, untagged) | Yes |
-    | Born-digital PDF           | No      | No (tagged or has embedded text)  | Yes |
+    | Image-based PDF            | No      | **Yes** (no embedded text) | Yes |
+    | Born-digital PDF           | No      | No (has embedded text, optionally confirmed by tag) | Yes |
    | Plain text, email, HTML    | No      | No                         | No       |
    | DOCX / ODT (via Tika)      | Yes\*   | Yes\*                      | Yes\*    |

@@ -1159,19 +1173,21 @@ still perform some basic text pre-processing before matching.

 #### [`PAPERLESS_DATE_PARSER_LANGUAGES=<lang>`](#PAPERLESS_DATE_PARSER_LANGUAGES) {#PAPERLESS_DATE_PARSER_LANGUAGES}

-Specifies which language Paperless should use when parsing dates from documents.
+: Specifies which language Paperless should use when parsing dates from documents.

-    This should be a language code supported by the dateparser library,
-    for example: "en", or a combination such as "en+de".
-    Locales are also supported (e.g., "en-AU").
-    Multiple languages can be combined using "+", for example: "en+de" or "en-AU+de".
-    For valid values, refer to the list of supported languages and locales in the [dateparser documentation](https://dateparser.readthedocs.io/en/latest/supported_locales.html).
+: This should be a language code supported by the dateparser library,
+for example: "en", or a combination such as "en+de".
+Locales are also supported (e.g., "en-AU").
+Multiple languages can be combined using "+", for example: "en+de" or "en-AU+de".
+For valid values, refer to the list of supported languages and locales in the [dateparser documentation](https://dateparser.readthedocs.io/en/latest/supported_locales.html).
+
+: Set this to match the languages in which most of your documents are written.

-    Set this to match the languages in which most of your documents are written.
    If not set, Paperless will attempt to infer the language(s) from the OCR configuration (`PAPERLESS_OCR_LANGUAGE`).

-!!! note
-This format differs from the `PAPERLESS_OCR_LANGUAGE` setting, which uses ISO 639-2 codes (3 letters, e.g., "eng+deu" for Tesseract OCR).
+    !!! note
+
+        This format differs from the `PAPERLESS_OCR_LANGUAGE` setting, which uses ISO 639-2 codes (3 letters, e.g., "eng+deu" for Tesseract OCR).

 #### [`PAPERLESS_EMAIL_TASK_CRON=<cron expression>`](#PAPERLESS_EMAIL_TASK_CRON) {#PAPERLESS_EMAIL_TASK_CRON}

@@ -1344,13 +1360,16 @@ don't exist yet.
 #### [`PAPERLESS_CONSUMER_IGNORE_PATTERNS=<json>`](#PAPERLESS_CONSUMER_IGNORE_PATTERNS) {#PAPERLESS_CONSUMER_IGNORE_PATTERNS}

 : Additional regex patterns for files to ignore in the consumption directory. Patterns are matched against filenames only (not full paths)
-using Python's `re.match()`, which anchors at the start of the filename.
+using Python's `re.search()`. Use `^` to anchor a pattern to the start of the filename and `$` to anchor it to the end.

    See the [watchfiles documentation](https://watchfiles.helpmanual.io/api/filters/#watchfiles.BaseFilter.ignore_entity_patterns)

    This setting is for additional patterns beyond the built-in defaults. Common system files and directories are already ignored automatically.
    The patterns will be compiled via Python's standard `re` module.

+    These are regular expressions, not glob patterns. For example, the glob pattern `._*` does not mean "starts with `._`" when used as a
+    regular expression; it matches nearly any non-empty filename. Use `^\._.*` for that behavior instead.
+
    Example custom patterns:

    ```json
@@ -1365,7 +1384,11 @@ using Python's `re.match()`, which anchors at the start of the filename.

    Defaults to `[]` (empty list, uses only built-in defaults).

-    The default ignores are `[.DS_Store, .DS_STORE, ._*, desktop.ini, Thumbs.db]` and cannot be overridden.
+    The built-in file patterns are equivalent to the following regular expressions and cannot be overridden:
+
+    ```json
+    ["^\\.DS_Store$", "^\\.DS_STORE$", "^\\._.*", "^desktop\\.ini$", "^Thumbs\\.db$"]
+    ```

 #### [`PAPERLESS_CONSUMER_IGNORE_DIRS=<json>`](#PAPERLESS_CONSUMER_IGNORE_DIRS) {#PAPERLESS_CONSUMER_IGNORE_DIRS}

@@ -2119,7 +2142,7 @@ used with the OpenAI-compatible backend to target a custom provider or local gat

    Defaults to None.

-### [`PAPERLESS_AI_LLM_OUTPUT_LANGUAGE=<str>`](#PAPERLESS_AI_LLM_OUTPUT_LANGUAGE) {#PAPERLESS_AI_LLM_OUTPUT_LANGUAGE}
+#### [`PAPERLESS_AI_LLM_OUTPUT_LANGUAGE=<str>`](#PAPERLESS_AI_LLM_OUTPUT_LANGUAGE) {#PAPERLESS_AI_LLM_OUTPUT_LANGUAGE}

 : The language to use for AI suggestions (results may vary by LLM model). If not supplied, defaults to the user's UI language setting or None.

@@ -133,7 +133,7 @@ PAPERLESS_DB_OPTIONS="sslmode=require,sslrootcert=/certs/ca.pem,pool.max_size=10

 ## OCR and Archive File Generation Settings

-The settings that control OCR behaviour and archive file generation have been redesigned. The old settings that coupled these two concerns together are **removed** — old values are not silently honoured; a startup warning is logged if any removed variable is still set in your environment.
+The settings that control OCR behaviour and archive file generation have been redesigned. The old settings that coupled these two concerns together are **removed** - old values are not silently honoured; a startup warning is logged if any removed variable is still set in your environment.

 ### Removed settings

@@ -166,7 +166,7 @@ Remove any `PAPERLESS_OCR_SKIP_ARCHIVE_FILE` variable from your environment. If
 # v2: skip OCR when text present, always archive
 PAPERLESS_OCR_MODE=skip
 # v3: equivalent (auto is the new default)
-# No change needed — auto is the default
+# No change needed - auto is the default

 # v2: skip OCR when text present, skip archive too
 PAPERLESS_OCR_MODE=skip_noarchive
@@ -189,10 +189,10 @@ PAPERLESS_ARCHIVE_FILE_GENERATION=auto

 If you use the **remote OCR parser** (Azure AI), note that it always produces a
 searchable PDF and stores it as the archive copy. `ARCHIVE_FILE_GENERATION=never`
-has no effect for documents handled by the remote parser — the archive is produced
+has no effect for documents handled by the remote parser - the archive is produced
 unconditionally by the remote engine.

-# Search Index (Whoosh -> Tantivy)
+## Search Index (Whoosh -> Tantivy)

 The full-text search backend has been replaced with [Tantivy](https://github.com/quickwit-oss/tantivy).
 The index format is incompatible with Whoosh, so **the search index is automatically rebuilt from
@@ -324,5 +324,74 @@ option since v1.8.0.
 Allauth changed how it determines the client IP address for login rate limiting. Users running
 behind a reverse proxy may need to set
 [`PAPERLESS_TRUSTED_PROXIES`](configuration.md#PAPERLESS_TRUSTED_PROXIES),
+[`PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT`](configuration.md#PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT),
 [`PAPERLESS_ALLAUTH_TRUSTED_CLIENT_IP_HEADER`](configuration.md#PAPERLESS_ALLAUTH_TRUSTED_CLIENT_IP_HEADER),
-or both, to avoid `403 Forbidden` errors on login.
+or a combination of these settings to avoid `403 Forbidden` errors on login.
+The proxy count is the number of proxy hops in `X-Forwarded-For`, which may
+differ from the number of configured proxy IP addresses.
+
+## Minimum CPU Requirements (NumPy Baseline)
+
+Starting with NumPy 2.4.0, official `manylinux` x86_64 wheels are compiled with a minimum
+CPU baseline of `x86-64-v2`, which requires SSE3, SSSE3, SSE4.1, SSE4.2, POPCNT, and
+CMPXCHG16B. This is a [deliberate upstream change](https://github.com/numpy/numpy/issues/27851)
+citing that these instructions have been present in over 99.7% of CPUs since 2008
+([Intel](<https://en.wikipedia.org/wiki/Nehalem_(microarchitecture)>)) or 2011
+([AMD](<https://en.wikipedia.org/wiki/Bulldozer_(microarchitecture)>)).
+
+NumPy is a dependency of the document classifier (via scikit-learn), so any CPU that
+predates SSE4.2 support will crash with `SIGILL` (illegal instruction) when the classifier
+is loaded or trained, regardless of whether AI features are enabled.
+
+This differs from NumPy's optional SIMD dispatch (e.g. AVX2, AVX512), which is detected and
+selected safely at runtime - the `x86-64-v2` requirement above is a hard floor baked into the
+wheel, with no runtime fallback.
+
+### Affected hardware
+
+CPUs older than roughly 2008 (Intel) or 2011 (AMD) that lack SSE4.2 support. This is more
+likely to affect low-power or embedded hardware - e.g. early Atom, Celeron, or pre-Bulldozer
+AMD chips - than typical desktop or server hardware from the last decade.
+
+Check for SSE4.2 support with:
+
+```bash
+grep -o -m1 sse4_2 /proc/cpuinfo
+```
+
+If this prints nothing, your CPU is affected.
+
+### Symptoms
+
+The Celery worker (and potentially the web server) repeatedly crashes and restarts with a
+`SIGILL` error, typically visible in `dmesg`/`journalctl` as a `trap invalid opcode` inside
+`_multiarray_umath...so`. Because the classifier is trained on a periodic schedule
+(hourly, by default), affected instances see intermittent, hard-to-reproduce document
+consumption failures whenever that scheduled task runs and takes down the worker process
+mid-task.
+
+### Action Required (for affected hardware only)
+
+There is no way to make the classifier itself work on such CPUs - it requires an unofficial
+NumPy build with `cpu-baseline=none`, which is not something we can ship. The practical
+path forward is to stop the classifier from ever loading or training, which avoids
+importing NumPy at all:
+
+```bash
+PAPERLESS_TRAIN_TASK_CRON=disable
+```
+
+This disables the periodic classifier training task (see
+[`PAPERLESS_TRAIN_TASK_CRON`](configuration.md#PAPERLESS_TRAIN_TASK_CRON)). Automatic
+matching based on the classifier (suggested correspondents, document types, tags, and
+storage paths from trained rules) will no longer be available, but rule-based matching is
+unaffected, and document consumption itself will no longer be at risk of crashing the
+worker.
+
+## Database Migrations
+
+Some integer fields have been changed to smaller types to reduce database size. If you have any `MailRule` records with a `maximum_age` greater than 32767, they will be clamped to 32767 during the migration to avoid errors during migration.
+
+### Action Required
+
+No user action is required. The migration will automatically clamp any `MailRule.maximum_age` values greater than 32767 to 32767 during the migration process.
@@ -142,7 +142,7 @@ a [superuser](usage.md#superusers) account.

    It is not possible to run the container rootless if additional languages are specified via `PAPERLESS_OCR_LANGUAGES`.

-If you want to run Paperless as a rootless container, set `user:` in `docker-compose.yml` to the UID and GID of your host user (use `id -u` and `id -g` to find these values). The container process starts directly as that user with no internal privilege remapping:
+If you want to run Paperless as a rootless container, set `user:` in `docker-compose.yml` to the UID and GID of your host user (use `id -u` and `id -g` to find these values). The container process starts directly as that user with no internal privilege remapping. Any UID and GID is supported:

 ```yaml
 webserver:
@@ -157,8 +157,8 @@ Do not combine this with `USERMAP_UID` or `USERMAP_GID`, which are intended for
 Some file systems, such as NFS network shares, don't support file system
 notifications with `inotify`. When the consumption directory is on such a
 file system, Paperless-ngx will not pick up new files with the default
-configuration. Use [`PAPERLESS_CONSUMER_POLLING`](configuration.md#PAPERLESS_CONSUMER_POLLING)
-to enable polling and disable inotify. See [here](configuration.md#polling).
+configuration. Set [`PAPERLESS_CONSUMER_POLLING_INTERVAL`](configuration.md#PAPERLESS_CONSUMER_POLLING_INTERVAL)
+to a positive number to enable polling and disable native filesystem notifications.

 ## Bare Metal Install {#bare_metal}

@@ -262,6 +262,14 @@ to enable polling and disable inotify. See [here](configuration.md#polling).
    and copy the contents to the home directory of the user you created
    earlier (`/opt/paperless`).

+    !!! note
+
+        If you are updating an existing bare-metal installation rather than
+        installing for the first time, see the
+        [bare metal update instructions](administration.md#bare-metal-updating)
+        instead -- extracting a new release on top of an old one can leave
+        behind stale files from the previous version.
+
    Optional: If you cloned the Git repository, you will need to
    compile the frontend yourself. See [here](development.md#front-end-development)
    and use the `build` step, not `serve`.
@@ -458,8 +458,8 @@ For related metadata such as tags, correspondents, document types, and storage p
 ### Password reset

 In order to enable the password reset feature you will need to setup an SMTP backend, see
-[`PAPERLESS_EMAIL_HOST`](configuration.md#PAPERLESS_EMAIL_HOST). If your installation does not have
-[`PAPERLESS_URL`](configuration.md#PAPERLESS_URL) set, the reset link included in emails will use the server host.
+[`PAPERLESS_EMAIL_HOST`](configuration.md#PAPERLESS_EMAIL_HOST). You should also set
+[`PAPERLESS_URL`](configuration.md#PAPERLESS_URL) and / or its corresponding configuration settings.

 ### Two-factor authentication

@@ -620,6 +620,34 @@ no other workflow will be executed on the document.
 If a "Move to Trash" action is executed in a consume pipeline, the consumption
 will be aborted and the file will be deleted.

+##### Password Removal {#workflow-action-password-removal}
+
+"Password Removal" actions attempt to remove password protection from encrypted PDF documents. You can specify:
+
+- One or more passwords to try, separated by commas or new lines
+- Each password is tried in order until one successfully unlocks the document
+
+Password removal never modifies a file in place. Instead, once a working password is found, the
+decrypted content is consumed as a new [document version](#document-file-versions), leaving the
+original (still encrypted) version in the document's version history.
+
+**Consumption Started**: because this trigger fires before the document exists yet, the password
+removal itself is deferred until after the initial consumption of the encrypted file has completed.
+OCR engines cannot process an encrypted PDF, so this first version is typically stored with no
+extracted text (unless the file already contained extractable text outside of OCR). Immediately
+afterwards, the password is removed and the decrypted file is automatically re-consumed as a second,
+new version of the same document, this time with normal OCR/text extraction applied. In other words,
+a password-protected file added with this trigger will briefly exist as an un-OCR'd version before
+the properly processed version is created.
+
+**Document Added**, **Document Updated**, **Scheduled**: these triggers run against a document that
+already exists, so password removal happens immediately: the decrypted content is queued for
+consumption as a new version right away. Note that if the document's initial consumption also
+happened while it was still encrypted, that original version will likewise be missing OCR text.
+
+**Current limitation**: Passwords are stored as a simple list without descriptions. To handle
+multiple PDF types with different passwords, create separate workflows for each use case.
+
 #### Workflow placeholders

 Titles and webhook payloads can be generated by workflows using [Jinja templates](https://jinja.palletsprojects.com/en/3.1.x/templates/).
@@ -833,10 +861,10 @@ contract you signed 8 years ago).

 When you search paperless for a document, it tries to match this query
 against your documents. Paperless will look for matching documents by
-inspecting their content, title, correspondent, type, tags, notes, and
-custom field values. Paperless returns a scored list of results, so that
-documents matching your query better will appear further up in the search
-results.
+inspecting their content, title, correspondent, type, and tags. Paperless
+returns a scored list of results, so that documents matching your query
+better will appear further up in the search results. Notes and custom field
+values can be searched using the advanced search syntax described below.

 By default, paperless returns only documents which contain all words
 typed in the search bar. A few things to know about how matching works:
@@ -891,9 +919,9 @@ Supported date keywords: `today`, `yesterday`, `previous week`,

 #### Searching custom fields

-Custom field values are included in the full-text index, so a plain search
-already matches documents whose custom field values contain your search terms.
-To narrow by field name or value specifically:
+Custom field names and values are included in the full-text index, but they
+are not searched by a plain, unqualified query. Use the advanced search syntax
+to search by field name or value:

 ```
 custom_fields.value:policy
@@ -921,8 +949,9 @@ custom_fields.name:"Contract Number" custom_fields.value:1312

 #### Searching notes

-Notes content is included in full-text search automatically. To search
-by note author or content specifically:
+Notes are included in the full-text index, but they are not searched by a
+plain, unqualified query. Use the advanced search syntax to search by note
+author or content:

 ```
 notes.user:alice
@@ -1,6 +1,6 @@
 [project]
 name = "paperless-ngx"
-version = "3.0.0"
+version = "3.0.5"
 description = "A community-supported supercharged document management system: scan, index and archive all your physical documents"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -16,12 +16,12 @@ classifiers = [
 dependencies = [
  "azure-ai-documentintelligence>=1.0.2",
  "babel>=2.17",
-  "bleach~=6.3.0",
+  "bleach~=6.4.0",
  "celery[redis]~=5.6.2",
  "channels~=4.2",
  "channels-redis~=4.2",
  "concurrent-log-handler~=0.9.25",
-  "dateparser~=1.2",
+  "dateparser~=1.4",
  # WARNING: django does not use semver.
  #          Only patch versions are guaranteed to not introduce breaking changes.
  "django~=5.2.13",
@@ -32,33 +32,33 @@ dependencies = [
  "django-cors-headers~=4.9.0",
  "django-extensions~=4.1",
  "django-filter~=25.1",
-  "django-guardian~=3.3.0",
+  "django-guardian~=3.3.3",
  "django-multiselectfield~=1.0.1",
  "django-rich~=2.2.0",
  "django-soft-delete~=1.0.18",
  "django-treenode>=0.24",
  "djangorestframework~=3.16",
  "djangorestframework-guardian~=0.4.0",
-  "drf-spectacular~=0.28",
-  "drf-spectacular-sidecar~=2026.5.1",
+  "drf-spectacular~=0.30",
+  "drf-spectacular-sidecar~=2026.7.1",
  "drf-writable-nested~=0.7.1",
-  "filelock~=3.29.0",
+  "filelock~=3.32.0",
  "flower~=2.0.1",
  "gotenberg-client~=0.14.0",
-  "httpx-oauth~=0.16",
-  "ijson>=3.2",
-  "imap-tools~=1.13.0",
+  "httpx-oauth~=0.17",
+  "ijson>=3.5.1",
+  "imap-tools~=1.14.0",
  "jinja2~=3.1.5",
  "langdetect~=1.0.9",
-  "llama-index-core>=0.14.22",
+  "llama-index-core>=0.14.23",
  "llama-index-embeddings-huggingface>=0.6.1",
  "llama-index-embeddings-ollama>=0.9",
  "llama-index-embeddings-openai-like>=0.2.2",
  "llama-index-llms-ollama>=0.9.1",
  "llama-index-llms-openai-like>=0.7.1",
-  "nltk~=3.9.1",
-  "ocrmypdf~=17.4.2",
-  "openai>=2.32",
+  "nltk~=3.10.0",
+  "ocrmypdf~=17.7.0",
+  "openai>=2.48",
  "pathvalidate~=3.3.1",
  "pdf2image~=1.17.0",
  "python-dateutil~=2.9.0",
@@ -68,17 +68,17 @@ dependencies = [
  "python-magic~=0.4.27",
  "rapidfuzz~=3.14.5",
  "redis[hiredis]~=5.2.1",
-  "regex>=2026.4.4",
-  "scikit-learn~=1.8.0",
-  "sentence-transformers>=5.4.1",
+  "regex>=2026.7.19",
+  "scikit-learn~=1.9.0",
+  "sentence-transformers>=5.6.1",
  "setproctitle~=1.3.4",
  "sqlite-vec==0.1.9",
  "tantivy~=0.26.0",
  "tika-client~=0.11.0",
-  "torch~=2.12.0",
-  "watchfiles>=1.1.1",
+  "torch~=2.13.0",
+  "watchfiles>=1.2",
  "whitenoise~=6.11",
-  "zxing-cpp~=3.0.0",
+  "zxing-cpp~=3.1.0",
 ]
 [project.optional-dependencies]
 mariadb = [
@@ -101,25 +101,25 @@ dev = [
  { include-group = "testing" },
 ]
 docs = [
-  "zensical>=0.0.43",
+  "zensical>=0.0.51",
 ]
 lint = [
-  "prek~=0.3.10",
-  "ruff~=0.15.15",
+  "prek~=0.4.11",
+  "ruff~=0.16.1",
 ]
 testing = [
  "daphne",
  "factory-boy~=3.3.1",
-  "faker~=40.15.0",
+  "faker~=40.36.0",
  "imagehash",
-  "pytest~=9.0.3",
+  "pytest~=9.1.1",
  "pytest-cov~=7.1.0",
  "pytest-django~=4.12.0",
-  "pytest-env~=1.6.0",
+  "pytest-env~=1.7.0",
  "pytest-httpx",
  "pytest-mock~=3.15.1",
  # "pytest-randomly~=4.0.1",
-  "pytest-rerunfailures~=16.1",
+  "pytest-rerunfailures~=16.4",
  "pytest-sugar",
  "pytest-xdist~=3.8.0",
  "time-machine>=2.13",
@@ -183,6 +183,7 @@ output-format = "grouped"
 line-ending = "lf"
 [tool.ruff.lint]
 # https://docs.astral.sh/ruff/rules/
+select = [ "E4", "E7", "E9", "F" ]
 extend-select = [
  "COM",  # https://docs.astral.sh/ruff/rules/#flake8-commas-com
  "DJ",   # https://docs.astral.sh/ruff/rules/#flake8-django-dj
@@ -56,13 +56,13 @@
      },
      "architect": {
        "build": {
-          "builder": "@angular-builders/custom-webpack:browser",
+          "builder": "@angular/build:application",
          "options": {
-            "customWebpackConfig": {
-                "path": "./extra-webpack.config.ts"
+            "outputPath": {
+              "base": "dist/paperless-ui",
+              "browser": ""
            },
-            "outputPath": "dist/paperless-ui",
-            "main": "src/main.ts",
+            "browser": "src/main.ts",
            "outputHashing": "none",
            "index": "src/index.html",
            "polyfills": [
@@ -79,6 +79,16 @@
                "glob": "{pdf.worker.min.mjs,pdf.min.mjs}",
                "input": "node_modules/pdfjs-dist/legacy/build/",
                "output": "/assets/js/"
+              },
+              {
+                "glob": "**/*",
+                "input": "node_modules/pdfjs-dist/wasm/",
+                "output": "/assets/wasm/"
+              },
+              {
+                "glob": "**/*",
+                "input": "node_modules/pdfjs-dist/iccs/",
+                "output": "/assets/iccs/"
              }
            ],
            "styles": [
@@ -87,6 +97,7 @@
            "scripts": [],
            "allowedCommonJsDependencies": [
              "file-saver",
+              "mime-names",
              "utif"
            ],
            "extractLicenses": false,
@@ -107,11 +118,13 @@
                  "with": "src/environments/environment.prod.ts"
                }
              ],
-              "outputPath": "../src/documents/static/frontend/",
+              "outputPath": {
+                "base": "../src/documents/static/frontend/",
+                "browser": ""
+              },
              "optimization": true,
              "outputHashing": "none",
              "sourceMap": false,
-              "namedChunks": false,
              "extractLicenses": true,
              "budgets": [
                {
@@ -135,7 +148,7 @@
          "defaultConfiguration": ""
        },
        "serve": {
-          "builder": "@angular-builders/custom-webpack:dev-server",
+          "builder": "@angular/build:dev-server",
          "options": {
            "buildTarget": "paperless-ui:build:en-US"
          },
@@ -146,7 +159,7 @@
          }
        },
        "extract-i18n": {
-          "builder": "@angular-builders/custom-webpack:extract-i18n",
+          "builder": "@angular/build:extract-i18n",
          "options": {
            "buildTarget": "paperless-ui:build"
          }
@@ -1,4 +1,4 @@
-import { expect, test } from '@playwright/test'
+import { expect, test, type WebSocketRoute } from '@playwright/test'
 import path from 'node:path'

 const REQUESTS_HAR = path.join(__dirname, 'requests/api-document-detail.har')
@@ -95,3 +95,60 @@ test('should support quick filters', async ({ page }) => {
    .click()
  await expect(page).toHaveURL(/tags__id__all=4&sort=created&reverse=1&page=1/)
 })
+
+test('should finish reloading the preview after a remote document update', async ({
+  page,
+}) => {
+  let resolveStatusSocket: (socket: WebSocketRoute) => void
+  const statusSocketReady = new Promise<WebSocketRoute>((resolve) => {
+    resolveStatusSocket = resolve
+  })
+  await page.routeWebSocket(/\/ws\/status\/$/, (socket) => {
+    resolveStatusSocket(socket)
+  })
+  await page.routeFromHAR(REQUESTS_HAR, { notFound: 'fallback' })
+  let previewRequestCount = 0
+  page.on('request', (request) => {
+    if (request.url().includes('/api/documents/175/preview/')) {
+      previewRequestCount++
+    }
+  })
+  await page.goto('/documents/175/details')
+
+  await page.locator('pngx-document-detail').waitFor()
+  await expect(page.getByTitle('Storage path', { exact: true })).toHaveText(
+    /\w+/
+  )
+  const previewWasLoaded = await page.evaluate(() => {
+    const detail = document.querySelector('pngx-document-detail')
+    const component = (window as any).ng.getComponent(detail)
+    component.pdfPreviewLoaded({ numPages: 1 })
+    return component.previewLoaded()
+  })
+  expect(previewWasLoaded).toBe(true)
+  const previewRequestsBeforeReload = previewRequestCount
+
+  const statusSocket = await statusSocketReady
+  const documentReloaded = page.waitForResponse(
+    (response) =>
+      response.url().includes('/api/documents/175/?full_perms=true') &&
+      response.request().method() === 'GET'
+  )
+  statusSocket.send(
+    JSON.stringify({
+      type: 'document_updated',
+      data: {
+        document_id: 175,
+        modified: '2026-07-26T20:00:00Z',
+      },
+    })
+  )
+  await documentReloaded
+
+  await expect(
+    page.getByText('Document reloaded with latest changes.').first()
+  ).toBeVisible()
+  await expect
+    .poll(() => previewRequestCount)
+    .toBeGreaterThan(previewRequestsBeforeReload + 1)
+})
@@ -1,24 +0,0 @@
-import {
-  CustomWebpackBrowserSchema,
-  TargetOptions,
-} from '@angular-builders/custom-webpack'
-import * as webpack from 'webpack'
-const { codecovWebpackPlugin } = require('@codecov/webpack-plugin')
-
-export default (
-  config: webpack.Configuration,
-  options: CustomWebpackBrowserSchema,
-  targetOptions: TargetOptions
-) => {
-  if (config.plugins) {
-    config.plugins.push(
-      codecovWebpackPlugin({
-        enableBundleAnalysis: process.env.CODECOV_TOKEN !== undefined,
-        bundleName: 'paperless-ngx',
-        uploadToken: process.env.CODECOV_TOKEN,
-      })
-    )
-  }
-
-  return config
-}
@@ -1,6 +1,6 @@
 {
  "name": "paperless-ngx-ui",
-  "version": "3.0.0",
+  "version": "3.0.5",
  "scripts": {
    "preinstall": "npx only-allow pnpm",
    "ng": "ng",
@@ -11,17 +11,16 @@
  },
  "private": true,
  "dependencies": {
-    "@angular/cdk": "^22.0.3",
-    "@angular/common": "~22.0.5",
-    "@angular/compiler": "~22.0.5",
-    "@angular/core": "~22.0.5",
-    "@angular/forms": "~22.0.5",
-    "@angular/localize": "~22.0.5",
-    "@angular/platform-browser": "~22.0.5",
-    "@angular/platform-browser-dynamic": "~22.0.5",
-    "@angular/router": "~22.0.5",
+    "@angular/cdk": "^22.0.6",
+    "@angular/common": "~22.1.0",
+    "@angular/compiler": "~22.1.0",
+    "@angular/core": "~22.1.0",
+    "@angular/forms": "~22.1.0",
+    "@angular/localize": "~22.1.0",
+    "@angular/platform-browser": "~22.1.0",
+    "@angular/router": "~22.1.0",
    "@ng-bootstrap/ng-bootstrap": "^21.0.0",
-    "@ng-select/ng-select": "^23.2.0",
+    "@ng-select/ng-select": "^23.5.0",
    "@ngneat/dirty-check-forms": "^3.0.3",
    "@popperjs/core": "^2.11.8",
    "bootstrap": "^5.3.8",
@@ -33,33 +32,31 @@
    "ngx-device-detector": "^12.0.0",
    "ngx-ui-tour-ng-bootstrap": "^19.0.0",
    "normalize-diacritics": "^5.0.0",
-    "pdfjs-dist": "^6.0.227",
+    "pdfjs-dist": "^6.2.108",
    "rxjs": "^7.8.2",
    "tslib": "^2.8.1",
    "utif": "^3.1.0",
    "uuid": "^14.0.1"
  },
  "devDependencies": {
-    "@angular-builders/custom-webpack": "^22.0.1",
    "@angular-builders/jest": "^22.0.1",
-    "@angular-devkit/core": "^22.0.5",
-    "@angular-devkit/schematics": "^22.0.5",
-    "@angular-eslint/builder": "22.0.0",
-    "@angular-eslint/eslint-plugin": "22.0.0",
-    "@angular-eslint/eslint-plugin-template": "22.0.0",
-    "@angular-eslint/schematics": "22.0.0",
-    "@angular-eslint/template-parser": "22.0.0",
-    "@angular/build": "^22.0.5",
-    "@angular/cli": "~22.0.5",
-    "@angular/compiler-cli": "~22.0.5",
-    "@codecov/webpack-plugin": "^2.0.1",
-    "@playwright/test": "^1.61.1",
+    "@angular-devkit/core": "^22.1.2",
+    "@angular-devkit/schematics": "^22.1.2",
+    "@angular-eslint/builder": "22.1.0",
+    "@angular-eslint/eslint-plugin": "22.1.0",
+    "@angular-eslint/eslint-plugin-template": "22.1.0",
+    "@angular-eslint/schematics": "22.1.0",
+    "@angular-eslint/template-parser": "22.1.0",
+    "@angular/build": "22.1.2",
+    "@angular/cli": "22.1.2",
+    "@angular/compiler-cli": "~22.1.0",
+    "@playwright/test": "^1.62.0",
    "@types/jest": "^30.0.0",
-    "@types/node": "^26.0.0",
-    "@typescript-eslint/eslint-plugin": "^8.62.0",
-    "@typescript-eslint/parser": "^8.62.0",
-    "@typescript-eslint/utils": "^8.62.0",
-    "eslint": "^10.5.0",
+    "@types/node": "^26.1.1",
+    "@typescript-eslint/eslint-plugin": "^8.65.0",
+    "@typescript-eslint/parser": "^8.65.0",
+    "@typescript-eslint/utils": "^8.65.0",
+    "eslint": "^10.8.0",
    "jest": "30.4.2",
    "jest-environment-jsdom": "^30.4.1",
    "jest-junit": "^17.0.0",
@@ -67,8 +64,7 @@
    "jest-websocket-mock": "^2.5.0",
    "prettier-plugin-organize-imports": "^4.3.0",
    "ts-node": "~10.9.1",
-    "typescript": "^6.0.3",
-    "webpack": "^5.107.2"
+    "typescript": "^6.0.3"
  },
  "packageManager": "pnpm@10.26.0"
 }
@@ -2,6 +2,9 @@ packages:
  - "."
 minimumReleaseAge: 10080
 trustPolicy: no-downgrade
+trustPolicyExclude:
+  - "chokidar@4.0.3"
+  - "semver@6.3.1 || 5.7.2"
 allowBuilds:
  "@parcel/watcher": true
  canvas: true
@@ -5,8 +5,9 @@
  i18n-info>
  <div class="input-group input-group-sm align-items-center">
    <div class="input-group input-group-sm me-3">
-      <span class="input-group-text text-muted" i18n>Show</span>
+      <label class="input-group-text text-muted" for="logLineLimit" i18n>Show</label>
      <input
+        id="logLineLimit"
        class="form-control"
        type="number"
        min="100"
@@ -17,7 +18,7 @@
      <span class="input-group-text text-muted" i18n>lines</span>
    </div>
    <div class="form-check form-switch mt-1">
-      <input class="form-check-input" type="checkbox" role="switch" [ngModel]="autoRefreshEnabled()" (ngModelChange)="autoRefreshEnabled.set($event)">
+      <input id="autoRefreshSwitch" class="form-check-input" type="checkbox" role="switch" [ngModel]="autoRefreshEnabled()" (ngModelChange)="autoRefreshEnabled.set($event)">
      <label class="form-check-label" for="autoRefreshSwitch" i18n>Auto refresh</label>
    </div>
  </div>
@@ -100,9 +100,7 @@ export class LogsComponent
            parsed.some((log, idx) => {
              const current = this.logs()[idx]
              return (
-                !current ||
-                current.message !== log.message ||
-                current.level !== log.level
+                current?.message !== log.message || current?.level !== log.level
              )
            })
          if (hasChanges) {
@@ -37,7 +37,7 @@

 <form [formGroup]="settingsForm" (ngSubmit)="saveSettings()">

-  <ul ngbNav #nav="ngbNav" (navChange)="onNavChange($event)" [(activeId)]="activeNavID" class="nav-tabs">
+  <ul ngbNav #nav="ngbNav" (navChange)="onNavChange($event)" [activeId]="activeNavID()" (activeIdChange)="activeNavID.set($event)" class="nav-tabs">
    <li [ngbNavItem]="SettingsNavIDs.General">
      <a ngbNavLink i18n>General</a>
      <ng-template ngbNavContent>
@@ -150,10 +150,10 @@

            <div class="row mb-3">
              <div class="col-md-3 col-form-label pt-0">
-                <span i18n>Full search links to</span>
+                <label for="searchLink" i18n>Full search links to</label>
              </div>
              <div class="col mb-3">
-                <select class="form-select" formControlName="searchLink">
+                <select id="searchLink" class="form-select" formControlName="searchLink">
                  <option [ngValue]="GlobalSearchType.TITLE_CONTENT" i18n>Title and content search</option>
                  <option [ngValue]="GlobalSearchType.ADVANCED" i18n>Advanced search</option>
                </select>
@@ -199,10 +199,10 @@
            <h5 i18n>Documents</h5>
            <div class="row mb-3">
              <div class="col-md-3 col-form-label pt-0">
-                <span i18n>Items per page</span>
+                <label for="documentListItemPerPage" i18n>Items per page</label>
              </div>
              <div class="col">
-                <select class="form-select" formControlName="documentListItemPerPage">
+                <select id="documentListItemPerPage" class="form-select" formControlName="documentListItemPerPage">
                  <option [ngValue]="10">10</option>
                  <option [ngValue]="25">25</option>
                  <option [ngValue]="50">50</option>
@@ -274,10 +274,10 @@
            <h5 class="mt-3" i18n>PDF Editor</h5>
            <div class="row">
              <div class="col-md-3 col-form-label pt-0">
-                <span i18n>Default editing mode</span>
+                <label for="pdfEditorDefaultEditMode" i18n>Default editing mode</label>
              </div>
              <div class="col">
-                <select class="form-select" formControlName="pdfEditorDefaultEditMode">
+                <select id="pdfEditorDefaultEditMode" class="form-select" formControlName="pdfEditorDefaultEditMode">
                  <option [ngValue]="PdfEditorEditMode.Create" i18n>Create new document(s)</option>
                  <option [ngValue]="PdfEditorEditMode.Update" i18n>Add document version</option>
                </select>
@@ -304,7 +304,7 @@
        <div class="row mb-3">
          <div class="col">
            <p i18n>
-              Settings apply to this user account for objects (Tags, Mail Rules, etc. but not documents) created via the web UI.
+              Settings apply to this user account for objects (Tags, Mail Rules, etc.) created via the web UI. These settings do not apply to documents.
            </p>
          </div>
        </div>
@@ -242,7 +242,7 @@ describe('SettingsComponent', () => {
    activatedRoute.snapshot.fragment = '#notifications'
    const scrollSpy = jest.spyOn(viewportScroller, 'scrollToAnchor')
    component.ngOnInit()
-    expect(component.activeNavID).toEqual(4) // Notifications
+    expect(component.activeNavID()).toEqual(4) // Notifications
    component.ngAfterViewInit()
    expect(scrollSpy).toHaveBeenCalledWith('#notifications')
  })
@@ -399,17 +399,17 @@ describe('SettingsComponent', () => {
    completeSetup()
    const field = 'storage_path'
    expect(
-      component.settingsForm.get('documentDetailsHiddenFields').value.length
-    ).toEqual(0)
+      component.settingsForm.get('documentDetailsHiddenFields').value
+    ).toHaveLength(0)
    component.toggleDocumentDetailField(field, false)
    expect(
-      component.settingsForm.get('documentDetailsHiddenFields').value.length
-    ).toEqual(1)
+      component.settingsForm.get('documentDetailsHiddenFields').value
+    ).toHaveLength(1)
    expect(component.isDocumentDetailFieldShown(field)).toBeFalsy()
    component.toggleDocumentDetailField(field, true)
    expect(
-      component.settingsForm.get('documentDetailsHiddenFields').value.length
-    ).toEqual(0)
+      component.settingsForm.get('documentDetailsHiddenFields').value
+    ).toHaveLength(0)
    expect(component.isDocumentDetailFieldShown(field)).toBeTruthy()
  })
 })
@@ -142,7 +142,7 @@ export class SettingsComponent
  private systemStatusService = inject(SystemStatusService)
  private savedViewsService = inject(SavedViewService)

-  activeNavID: number
+  readonly activeNavID = signal<number>(undefined)

  settingsForm = new FormGroup({
    bulkEditConfirmationDialogs: new FormControl(null),
@@ -283,7 +283,7 @@ export class SettingsComponent
          (navID) => navID.toLowerCase() == section
        )
        if (navIDKey) {
-          this.activeNavID = SettingsNavIDs[navIDKey]
+          this.activeNavID.set(SettingsNavIDs[navIDKey])
        }
      }
    })
@@ -386,7 +386,7 @@ export class SettingsComponent
        .navigate(['settings', foundNavIDkey.toLowerCase()])
        .then((navigated) => {
          if (!navigated && this.isDirty) {
-            this.activeNavID = navChangeEvent.activeId
+            this.activeNavID.set(navChangeEvent.activeId)
          } else if (navigated && this.isDirty) {
            this.initialize()
          }
@@ -15,13 +15,13 @@
      <i-bs name="check2-all" class="me-1"></i-bs><ng-container i18n>Dismiss all</ng-container>
    </button>
    <div class="form-check form-switch mb-0 ms-2">
-      <input class="form-check-input" type="checkbox" role="switch" [(ngModel)]="autoRefreshEnabled">
+      <input id="autoRefreshSwitch" class="form-check-input" type="checkbox" role="switch" [(ngModel)]="autoRefreshEnabled">
      <label class="form-check-label" for="autoRefreshSwitch" i18n>Auto refresh</label>
    </div>
  </div>
 </pngx-page-header>

-@if (!tasksService.completedFileTasks && tasksService.loading) {
+@if (loading() && pagedTasks().length === 0) {
  <div class="spinner-border spinner-border-sm fw-normal ms-2 me-auto" role="status"></div>
  <div class="visually-hidden" i18n>Loading...</div>
 }
@@ -93,7 +93,8 @@
          <i-bs width="1em" height="1em" name="x"></i-bs>
        </button>
      }
-      <input #filterInput class="form-control form-control-sm" type="text"
+      <label class="visually-hidden" for="taskSearch" i18n>Search tasks</label>
+      <input #filterInput id="taskSearch" class="form-control form-control-sm" type="text"
        (keyup)="filterInputKeyup($event)"
        [(ngModel)]="filterText">
    </div>
@@ -211,7 +212,7 @@
                <i-bs width="1.2em" height="1.2em" name="info-circle"></i-bs>
              </button>
            </td>
-            <td scope="row" class="actions-col">
+            <td class="actions-col">
              <div class="btn-group" role="group">
                <button class="btn btn-sm btn-outline-secondary" (click)="dismissTask(task); $event.stopPropagation();" *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.PaperlessTask }">
                  <i-bs name="check" class="me-1"></i-bs><ng-container i18n>Dismiss</ng-container>
@@ -104,7 +104,7 @@
            </h6>
            <ul class="nav flex-column mb-2" cdkDropList (cdkDropListDropped)="onDrop($event)">
              @for (view of savedViewService.sidebarViews; track view.id) {
-                <li class="nav-item w-100 app-link" cdkDrag [cdkDragDisabled]="!settingsService.organizingSidebarSavedViews()"
+                <li class="nav-item w-100 app-link" cdkDrag [cdkDragDisabled]="!settingsService.organizingSidebarSavedViews() || !canSaveSettings"
                  cdkDragPreviewContainer="parent" cdkDragPreviewClass="navItemDrag" (cdkDragStarted)="onDragStart($event)"
                  (cdkDragEnded)="onDragEnd($event)">
                  <a class="nav-link" routerLink="view/{{view.id}}"
@@ -120,7 +120,7 @@
                      <span class="badge bg-info text-dark position-absolute top-0 end-0 d-none d-md-block">{{ savedViewService.getDocumentCount(view) }}</span>
                    }
                  </a>
-                  @if (settingsService.organizingSidebarSavedViews()) {
+                  @if (settingsService.organizingSidebarSavedViews() && canSaveSettings) {
                    <div class="position-absolute end-0 top-0 px-3 py-2" [class.me-n3]="slimSidebarEnabled" cdkDragHandle>
                      <i-bs name="grip-vertical"></i-bs>
                    </div>
@@ -150,7 +150,8 @@
                  [disablePopover]="!slimSidebarEnabled" placement="end" container="body" triggers="mouseenter:mouseleave"
                  popoverClass="popover-slim">
                  <i-bs class="me-2" name="file-text"></i-bs><span>{{d.title | documentTitle}}</span>
-                  <span class="close flex-column justify-content-center" (click)="closeDocument(d); $event.preventDefault()">
+                  <span class="close flex-column justify-content-center"
+                    (click)="$event.preventDefault(); $event.stopPropagation(); closeDocument(d)">
                    <i-bs name="x"></i-bs>
                  </span>
                </a>
@@ -181,7 +182,7 @@
                    container="body" triggers="mouseenter:mouseleave" popoverClass="popover-slim">
                    <i-bs class="me-2" name="stack"></i-bs><span><ng-container i18n>Attributes</ng-container></span>
                  </a>
-                  @if (!slimSidebarEnabled) {
+                  @if (!slimSidebarEnabled && canSaveSettings) {
                    <button
                      type="button"
                      class="btn btn-link btn-sm text-muted p-0 me-3 attributes-expand-btn"
@@ -280,10 +280,52 @@ main {
  }
 }

-@media screen and (min-width: 376px) and (max-width: 768px) {
+@media screen and (max-width: 575.98px) {
+  .navbar {
+    display: grid;
+    grid-template-columns: 1fr auto 1fr;
+    grid-template-areas:
+      "toggler brand actions"
+      "search search search";
+  }
+
  .navbar-toggler {
-    // compensate for 2 buttons on the right
-    margin-right: 45px;
+    grid-area: toggler;
+    text-align: left;
+  }
+
+  .navbar-brand {
+    grid-area: brand;
+    min-width: 0;
+    max-width: 100%;
+    justify-self: center;
+    overflow: hidden;
+
+    > div,
+    .custom-title {
+      min-width: 0;
+      max-width: 100%;
+      overflow: hidden;
+    }
+
+    .title,
+    .byline {
+      max-width: 100%;
+      overflow: hidden;
+      text-overflow: ellipsis;
+      white-space: nowrap;
+    }
+  }
+
+  .search-container {
+    grid-area: search;
+    width: 100%;
+  }
+
+  .navbar > ul {
+    grid-area: actions;
+    justify-self: end;
+    flex-wrap: nowrap;
  }
 }

@@ -293,13 +335,6 @@ main {
  }
 }

-@media screen and (max-width: 345px) {
-  .custom-title {
-    max-width: 110px;
-    overflow: hidden;
-  }
-}
-
 :host ::ng-deep .dropdown.show .dropdown-toggle,
 :host ::ng-deep .dropdown-toggle:hover {
  opacity: 0.7;
@@ -6,17 +6,17 @@
  <div ngbDropdownMenu class="dropdown-menu-end shadow p-3" aria-labelledby="chatDropdown">
    <div class="chat-container bg-light p-2">
      <div class="chat-messages font-monospace small">
-        @for (message of messages; track message) {
+        @for (message of messages(); track message) {
          <div class="message d-flex flex-row small" [class.justify-content-end]="message.role === 'user'">
            <div class="p-2 m-2" [class.bg-body]="message.role === 'user'">
-              <span>
+              <span class="text-break">
                {{ message.content }}
                @if (message.isStreaming) { <span class="blinking-cursor">|</span> }
              </span>
              @if (message.role === 'assistant' && message.references?.length) {
                <div class="chat-references list-group mt-3">
                  @for (reference of message.references; track reference.id) {
-                    <a class="list-group-item list-group-item-action text-primary" [routerLink]="['/documents', reference.id]">
+                    <a class="list-group-item list-group-item-action d-flex text-primary text-break" [routerLink]="['/documents', reference.id]">
                      <i-bs width="0.9em" height="0.9em" name="file-text" class="me-1"></i-bs><span>{{ reference.title }}</span>
                    </a>
                  }
@@ -29,16 +29,19 @@
      </div>

      <form class="chat-input">
+        <label class="visually-hidden" for="chatInput" i18n>Message</label>
        <div class="input-group">
          <input
            #chatInput
+            id="chatInput"
            class="form-control form-control-sm" name="chatInput" type="text"
            [placeholder]="placeholder"
-            [disabled]="loading"
-            [(ngModel)]="input"
+            [disabled]="loading()"
+            [ngModel]="input()"
+            (ngModelChange)="input.set($event)"
            (keydown)="searchInputKeyDown($event)"
            />
-          <button class="btn btn-sm btn-secondary" type="button" (click)="sendMessage()" [disabled]="loading">Send</button>
+          <button class="btn btn-sm btn-secondary" type="button" (click)="sendMessage()" [disabled]="loading()">Send</button>
        </div>
      </form>
    </div>
@@ -5,6 +5,7 @@
 .chat-messages {
  max-height: 350px;
  overflow-y: auto;
+  white-space: pre-wrap;
 }

 .chat-references {
@@ -56,44 +56,53 @@ describe('ChatComponent', () => {
  it('should update documentId on initialization', () => {
    jest.spyOn(router, 'url', 'get').mockReturnValue('/documents/123')
    component.ngOnInit()
-    expect(component.documentId).toBe(123)
+    expect(component.documentId()).toBe(123)
  })

  it('should update documentId on navigation', () => {
    component.ngOnInit()
    routerEvents$.next(new NavigationEnd(1, '/documents/456', '/documents/456'))
-    expect(component.documentId).toBe(456)
+    expect(component.documentId()).toBe(456)
  })

  it('should return correct placeholder based on documentId', () => {
-    component.documentId = 123
+    component.documentId.set(123)
    expect(component.placeholder).toBe('Ask a question about this document...')
-    component.documentId = undefined
+    component.documentId.set(undefined)
    expect(component.placeholder).toBe('Ask a question about a document...')
  })

-  it('should send a message and handle streaming response', () => {
-    component.input = 'Hello'
+  it('should send a message and render the streaming response', async () => {
+    component.input.set('Hello')
    component.sendMessage()

-    expect(component.messages.length).toBe(2)
-    expect(component.messages[0].content).toBe('Hello')
-    expect(component.loading).toBe(true)
+    expect(component.messages()).toHaveLength(2)
+    expect(component.messages()[0].content).toBe('Hello')
+    expect(component.loading()).toBe(true)

    mockStream$.next('Hi')
-    expect(component.messages[1].content).toBe('H')
+    expect(component.messages()[1].content).toBe('H')
    mockStream$.next('Hi there')
    // advance time to process the typewriter effect
-    jest.advanceTimersByTime(1000)
-    expect(component.messages[1].content).toBe('Hi there')
+    await jest.runAllTimersAsync()
+    await fixture.whenStable()
+    expect(component.messages()[1].content).toBe('Hi there')
+    expect(
+      fixture.nativeElement.querySelector('.chat-messages').textContent
+    ).toContain('Hi there')

    mockStream$.complete()
-    expect(component.loading).toBe(false)
-    expect(component.messages[1].isStreaming).toBe(false)
+    await jest.runAllTimersAsync()
+    await fixture.whenStable()
+    expect(component.loading()).toBe(false)
+    expect(component.messages()[1].isStreaming).toBe(false)
+    expect(fixture.nativeElement.querySelector('#chatInput').disabled).toBe(
+      false
+    )
  })

  it('should parse references from the metadata trailer without showing it', () => {
-    component.input = 'Hello'
+    component.input.set('Hello')
    component.sendMessage()

    mockStream$.next(
@@ -101,14 +110,14 @@ describe('ChatComponent', () => {
    )
    jest.advanceTimersByTime(1000)

-    expect(component.messages[1].content).toBe('Hi there')
-    expect(component.messages[1].references).toEqual([
+    expect(component.messages()[1].content).toBe('Hi there')
+    expect(component.messages()[1].references).toEqual([
      { id: 42, title: 'Bread Recipe' },
    ])
  })

  it('should render document reference links under assistant messages', () => {
-    component.input = 'Hello'
+    component.input.set('Hello')
    component.sendMessage()

    mockStream$.next(
@@ -123,12 +132,12 @@ describe('ChatComponent', () => {
  })

  it('should remove delimiter fragments that were already streamed', () => {
-    component.input = 'Hello'
+    component.input.set('Hello')
    component.sendMessage()

    mockStream$.next(`Hi there${CHAT_METADATA_DELIMITER.slice(0, 8)}`)
    jest.advanceTimersByTime(1000)
-    expect(component.messages[1].content).toBe(
+    expect(component.messages()[1].content).toBe(
      `Hi there${CHAT_METADATA_DELIMITER.slice(0, 8)}`
    )

@@ -137,28 +146,28 @@ describe('ChatComponent', () => {
    )
    jest.advanceTimersByTime(1000)

-    expect(component.messages[1].content).toBe('Hi there')
-    expect(component.messages[1].references).toEqual([
+    expect(component.messages()[1].content).toBe('Hi there')
+    expect(component.messages()[1].references).toEqual([
      { id: 42, title: 'Bread Recipe' },
    ])
  })

  it('should handle errors during streaming', () => {
-    component.input = 'Hello'
+    component.input.set('Hello')
    component.sendMessage()

    mockStream$.error('Error')
-    expect(component.messages[1].content).toContain(
+    expect(component.messages()[1].content).toContain(
      '⚠️ Error receiving response.'
    )
-    expect(component.loading).toBe(false)
+    expect(component.loading()).toBe(false)
  })

  it('should enqueue typewriter chunks correctly', () => {
    const message = { content: '', role: 'assistant', isStreaming: true }
    component.enqueueTypewriter(null, message as any) // coverage for null
    component.enqueueTypewriter('Hello', message as any)
-    expect(component['typewriterBuffer'].length).toBe(4)
+    expect(component['typewriterBuffer']).toHaveLength(4)
  })

  it('should scroll to bottom after sending a message', () => {
@@ -166,7 +175,7 @@ describe('ChatComponent', () => {
      ChatComponent.prototype as any,
      'scrollToBottom'
    )
-    component.input = 'Test'
+    component.input.set('Test')
    component.sendMessage()
    expect(scrollSpy).toHaveBeenCalled()
  })
@@ -1,4 +1,11 @@
-import { Component, ElementRef, inject, OnInit, ViewChild } from '@angular/core'
+import {
+  Component,
+  ElementRef,
+  inject,
+  OnInit,
+  signal,
+  ViewChild,
+} from '@angular/core'
 import { FormsModule, ReactiveFormsModule } from '@angular/forms'
 import { NavigationEnd, Router, RouterModule } from '@angular/router'
 import { NgbDropdownModule } from '@ng-bootstrap/ng-bootstrap'
@@ -23,10 +30,10 @@ import {
  styleUrl: './chat.component.scss',
 })
 export class ChatComponent implements OnInit {
-  public messages: ChatMessage[] = []
-  public loading = false
-  public input: string = ''
-  public documentId!: number
+  readonly messages = signal<ChatMessage[]>([])
+  readonly loading = signal(false)
+  readonly input = signal('')
+  readonly documentId = signal<number>(undefined)

  private chatService: ChatService = inject(ChatService)
  private router: Router = inject(Router)
@@ -38,7 +45,7 @@ export class ChatComponent implements OnInit {
  private typewriterActive = false

  public get placeholder(): string {
-    return this.documentId
+    return this.documentId()
      ? $localize`Ask a question about this document...`
      : $localize`Ask a question about a document...`
  }
@@ -57,14 +64,14 @@ export class ChatComponent implements OnInit {

  private updateDocumentId(url: string): void {
    const docIdRe = url.match(/^\/documents\/(\d+)/)
-    this.documentId = docIdRe ? +docIdRe[1] : undefined
+    this.documentId.set(docIdRe ? +docIdRe[1] : undefined)
  }

  sendMessage(): void {
-    if (!this.input.trim()) return
+    if (!this.input().trim()) return

-    const userMessage: ChatMessage = { role: 'user', content: this.input }
-    this.messages.push(userMessage)
+    const userMessage: ChatMessage = { role: 'user', content: this.input() }
+    this.messages.update((messages) => [...messages, userMessage])
    this.scrollToBottom()

    const assistantMessage: ChatMessage = {
@@ -72,12 +79,12 @@ export class ChatComponent implements OnInit {
      content: '',
      isStreaming: true,
    }
-    this.messages.push(assistantMessage)
-    this.loading = true
+    this.messages.update((messages) => [...messages, assistantMessage])
+    this.loading.set(true)

    let lastVisibleContent = ''

-    this.chatService.streamChat(this.documentId, this.input).subscribe({
+    this.chatService.streamChat(this.documentId(), this.input()).subscribe({
      next: (chunk) => {
        const nextResponse = parseChatResponse(chunk)

@@ -93,26 +100,30 @@ export class ChatComponent implements OnInit {
        }

        assistantMessage.references = nextResponse.references
+        this.notifyMessagesChanged()
      },
      error: () => {
        assistantMessage.content += '\n\n⚠️ Error receiving response.'
        assistantMessage.isStreaming = false
-        this.loading = false
+        this.notifyMessagesChanged()
+        this.loading.set(false)
      },
      complete: () => {
        assistantMessage.isStreaming = false
-        this.loading = false
+        this.notifyMessagesChanged()
+        this.loading.set(false)
        this.scrollToBottom()
      },
    })

-    this.input = ''
+    this.input.set('')
  }

  private resetTypewriter(message: ChatMessage, content: string): void {
    this.typewriterBuffer = []
    this.typewriterActive = false
    message.content = content
+    this.notifyMessagesChanged()
    this.scrollToBottom()
  }

@@ -135,11 +146,16 @@ export class ChatComponent implements OnInit {

    const nextChar = this.typewriterBuffer.shift()
    message.content += nextChar
+    this.notifyMessagesChanged()
    this.scrollToBottom()

    setTimeout(() => this.playTypewriter(message), 10) // 10ms per character
  }

+  private notifyMessagesChanged(): void {
+    this.messages.update((messages) => [...messages])
+  }
+
  private scrollToBottom(): void {
    setTimeout(() => {
      this.scrollAnchor?.nativeElement?.scrollIntoView({ behavior: 'smooth' })
@@ -17,6 +17,6 @@

 <ng-template #popoverContent>
    <div>
-        {{confirmMessage}}&nbsp;<button class="btn btn-link btn-sm text-danger p-0 m-0 lh-1" type="button" (click)="onConfirm($event)">Yes</button>
+        {{confirmMessage}}&nbsp;<button class="btn btn-link btn-sm text-danger p-0 m-0 lh-1" type="button" (click)="onConfirm($event)" i18n>Yes</button>
    </div>
 </ng-template>
@@ -1,5 +1,12 @@
 import { CurrencyPipe, getLocaleCurrencyCode, SlicePipe } from '@angular/common'
-import { Component, inject, Input, LOCALE_ID, OnInit } from '@angular/core'
+import {
+  ChangeDetectorRef,
+  Component,
+  inject,
+  Input,
+  LOCALE_ID,
+  OnInit,
+} from '@angular/core'
 import { NgbTooltipModule } from '@ng-bootstrap/ng-bootstrap'
 import { takeUntil } from 'rxjs'
 import { CustomField, CustomFieldDataType } from 'src/app/data/custom-field'
@@ -22,6 +29,7 @@ export class CustomFieldDisplayComponent
 {
  private customFieldService = inject(CustomFieldsService)
  private documentService = inject(DocumentService)
+  private changeDetector = inject(ChangeDetectorRef)

  CustomFieldDataType = CustomFieldDataType

@@ -74,6 +82,7 @@ export class CustomFieldDisplayComponent
    this.customFieldService.listAll().subscribe((r) => {
      this.customFields = r.results
      this.init()
+      this.changeDetector.markForCheck()
    })
  }

@@ -111,6 +120,7 @@ export class CustomFieldDisplayComponent
        this.docLinkDocuments = this.value
          .map((id) => result.results.find((d) => d.id === id))
          .filter((d) => d)
+        this.changeDetector.markForCheck()
      })
  }

@@ -95,8 +95,8 @@ describe('CustomFieldsDropdownComponent', () => {
  it('should support update unused fields', () => {
    component.existingFields = [{ field: fields[0].id } as any]
    component['updateUnusedFields']()
-    expect(component['unusedFields'].length).toEqual(1)
-    expect(component['unusedFields'][0].name).toEqual('Field 2')
+    expect(component['unusedFields']().length).toEqual(1)
+    expect(component['unusedFields']()[0].name).toEqual('Field 2')
  })

  it('should support getting data type label', () => {
@@ -8,6 +8,7 @@ import {
  ViewChild,
  ViewChildren,
  inject,
+  signal,
 } from '@angular/core'
 import { FormsModule, ReactiveFormsModule } from '@angular/forms'
 import { NgbDropdownModule, NgbModal } from '@ng-bootstrap/ng-bootstrap'
@@ -65,11 +66,11 @@ export class CustomFieldsDropdownComponent extends LoadingComponentWithPermissio
  @ViewChildren('button') buttons: QueryList<ElementRef>

  private customFields: CustomField[] = []
-  private unusedFields: CustomField[] = []
+  private readonly unusedFields = signal<CustomField[]>([])
  private keyboardIndex: number

  public get filteredFields(): CustomField[] {
-    return this.unusedFields.filter(
+    return this.unusedFields().filter(
      (f) => !this.filterText || matchesSearchText(f.name, this.filterText)
    )
  }
@@ -99,8 +100,10 @@ export class CustomFieldsDropdownComponent extends LoadingComponentWithPermissio
  }

  private updateUnusedFields() {
-    this.unusedFields = this.customFields.filter(
-      (f) => !this.existingFields?.find((e) => e.field === f.id)
+    this.unusedFields.set(
+      this.customFields.filter(
+        (f) => !this.existingFields?.find((e) => e.field === f.id)
+      )
    )
  }

@@ -68,6 +68,11 @@
    ></ng-select>
  } @else if (getCustomFieldByID(atom.field)?.data_type === CustomFieldDataType.DocumentLink) {
    <pngx-input-document-link [(ngModel)]="atom.value" class="w-25 form-select doc-link-select p-0" placeholder="Search docs..." i18n-placeholder [minimal]="true"></pngx-input-document-link>
+  } @else if (getCustomFieldByID(atom.field)?.data_type === CustomFieldDataType.Monetary) {
+    <input class="w-25 form-control rounded-end" type="text" inputmode="decimal"
+      [ngModel]="atom.value"
+      (ngModelChange)="setMonetaryValue(atom, $event)"
+      [disabled]="disabled">
  } @else {
    <input class="w-25 form-control rounded-end" type="text" [(ngModel)]="atom.value" [disabled]="disabled">
  }
@@ -77,7 +82,7 @@
  <div class="input-group input-group-sm">
    <ng-select #fieldSelects
      class="paperless-input-select"
-      [items]="customFields"
+      [items]="customFields()"
      [(ngModel)]="atom.field"
      [disabled]="disabled"
      bindLabel="name"
@@ -1,5 +1,6 @@
 import { provideHttpClient, withInterceptorsFromDi } from '@angular/common/http'
 import { provideHttpClientTesting } from '@angular/common/http/testing'
+import { LOCALE_ID } from '@angular/core'
 import { ComponentFixture, TestBed } from '@angular/core/testing'
 import { FormsModule, ReactiveFormsModule } from '@angular/forms'
 import { NgbDropdownModule } from '@ng-bootstrap/ng-bootstrap'
@@ -41,6 +42,12 @@ const customFields = [
      ],
    },
  },
+  {
+    id: 3,
+    name: 'Test Monetary Field',
+    data_type: CustomFieldDataType.Monetary,
+    extra_data: { default_currency: 'EUR' },
+  },
 ]

 describe('CustomFieldsQueryDropdownComponent', () => {
@@ -61,6 +68,7 @@ describe('CustomFieldsQueryDropdownComponent', () => {
      providers: [
        provideHttpClient(withInterceptorsFromDi()),
        provideHttpClientTesting(),
+        { provide: LOCALE_ID, useValue: 'de' },
      ],
    }).compileComponents()

@@ -79,7 +87,7 @@ describe('CustomFieldsQueryDropdownComponent', () => {
  })

  it('should initialize custom fields on creation', () => {
-    expect(component.customFields).toEqual(customFields)
+    expect(component.customFields()).toEqual(customFields)
  })

  it('should add an expression when opened if queries are empty', () => {
@@ -101,7 +109,7 @@ describe('CustomFieldsQueryDropdownComponent', () => {
      data_type: CustomFieldDataType.String,
      extra_data: {},
    }
-    component.customFields = [field]
+    component.customFields.set([field])
    const operators = component.getOperatorsForField(1)
    expect(operators.length).toEqual(
      [
@@ -138,7 +146,7 @@ describe('CustomFieldsQueryDropdownComponent', () => {
        ],
      },
    }
-    component.customFields = [field]
+    component.customFields.set([field])
    const options = component.getSelectOptionsForField(1)
    expect(options).toEqual([
      { label: 'Option 1', id: 'abc-123' },
@@ -150,6 +158,22 @@ describe('CustomFieldsQueryDropdownComponent', () => {
    expect(options2).toEqual([])
  })

+  it('should normalize localized monetary comparison values', () => {
+    const atom = new CustomFieldQueryAtom([3, 'exact', null])
+
+    component.setMonetaryValue(atom, '1.234,56')
+
+    expect(atom.value).toEqual('1234.56')
+  })
+
+  it('should preserve API-formatted monetary comparison values', () => {
+    const atom = new CustomFieldQueryAtom([3, 'exact', null])
+
+    component.setMonetaryValue(atom, '1234.56')
+
+    expect(atom.value).toEqual('1234.56')
+  })
+
  it('should remove an element from the selection model', () => {
    const expression = new CustomFieldQueryExpression()
    const atom = new CustomFieldQueryAtom()
@@ -1,11 +1,17 @@
-import { NgTemplateOutlet } from '@angular/common'
+import {
+  getLocaleNumberSymbol,
+  NgTemplateOutlet,
+  NumberSymbol,
+} from '@angular/common'
 import {
  Component,
  EventEmitter,
  inject,
  Input,
+  LOCALE_ID,
  Output,
  QueryList,
+  signal,
  ViewChild,
  ViewChildren,
 } from '@angular/core'
@@ -211,6 +217,7 @@ export class CustomFieldQueriesModel {
 })
 export class CustomFieldsQueryDropdownComponent extends LoadingComponentWithPermissions {
  protected customFieldsService = inject(CustomFieldsService)
+  private readonly locale = inject(LOCALE_ID)

  public CustomFieldQueryComponentType = CustomFieldQueryElementType
  public CustomFieldQueryOperator = CustomFieldQueryOperator
@@ -278,7 +285,7 @@ export class CustomFieldsQueryDropdownComponent extends LoadingComponentWithPerm
  @Output()
  selectionModelChange = new EventEmitter<CustomFieldQueriesModel>()

-  customFields: CustomField[] = []
+  readonly customFields = signal<CustomField[]>([])

  public readonly today: string = new Date().toLocaleDateString('en-CA')

@@ -325,12 +332,12 @@ export class CustomFieldsQueryDropdownComponent extends LoadingComponentWithPerm
      .listAll()
      .pipe(first(), takeUntil(this.unsubscribeNotifier))
      .subscribe((result) => {
-        this.customFields = result.results
+        this.customFields.set(result.results)
      })
  }

  public getCustomFieldByID(id: number): CustomField {
-    return this.customFields.find((field) => field.id === id)
+    return this.customFields().find((field) => field.id === id)
  }

  public addAtom(expression: CustomFieldQueryExpression) {
@@ -353,7 +360,7 @@ export class CustomFieldsQueryDropdownComponent extends LoadingComponentWithPerm
  getOperatorsForField(
    fieldID: number
  ): Array<{ value: string; label: string }> {
-    const field = this.customFields.find((field) => field.id === fieldID)
+    const field = this.customFields().find((field) => field.id === fieldID)
    const groups: CustomFieldQueryOperatorGroups[] = field
      ? CUSTOM_FIELD_QUERY_OPERATOR_GROUPS_BY_TYPE[field.data_type]
      : [CustomFieldQueryOperatorGroups.Basic]
@@ -369,10 +376,24 @@ export class CustomFieldsQueryDropdownComponent extends LoadingComponentWithPerm
  getSelectOptionsForField(
    fieldID: number
  ): Array<{ label: string; id: string }> {
-    const field = this.customFields.find((field) => field.id === fieldID)
+    const field = this.customFields().find((field) => field.id === fieldID)
    if (field) {
      return field.extra_data['select_options']
    }
    return []
  }
+
+  setMonetaryValue(atom: CustomFieldQueryAtom, value: string) {
+    // Normalize the decimal symbol e.g. . vs , by locale
+    const decimalSymbol = getLocaleNumberSymbol(
+      this.locale,
+      NumberSymbol.Decimal
+    )
+    if (decimalSymbol !== '.' && value.includes(decimalSymbol)) {
+      const groupSymbol = getLocaleNumberSymbol(this.locale, NumberSymbol.Group)
+      value = value.split(groupSymbol).join('').split(decimalSymbol).join('.')
+    }
+
+    atom.value = value
+  }
 }
@@ -32,6 +32,8 @@ import { EditDialogComponent, EditDialogMode } from './edit-dialog.component'
  template: `
    <div>
      <h4 class="modal-title" id="modal-basic-title">{{ getTitle() }}</h4>
+      <span class="error">{{ error?.name }}</span>
+      <button [disabled]="networkActive" (click)="save()">Save</button>
    </div>
  `,
  imports: [FormsModule, ReactiveFormsModule],
@@ -276,4 +278,22 @@ describe('EditDialogComponent', () => {
    expect(failedSpy).toHaveBeenCalled()
    expect(component.error).toEqual('error')
  })
+
+  it('should update the view after a failed save', async () => {
+    const button: HTMLButtonElement =
+      fixture.nativeElement.querySelector('button')
+    button.click()
+    await fixture.whenStable()
+    expect(button.disabled).toBe(true)
+
+    httpTestingController
+      .expectOne(`${environment.apiBaseUrl}tags/`)
+      .flush({ name: ['Name is required.'] }, { status: 400, statusText: '' })
+    await fixture.whenStable()
+
+    expect(button.disabled).toBe(false)
+    expect(fixture.nativeElement.querySelector('.error').textContent).toContain(
+      'Name is required.'
+    )
+  })
 })
@@ -1,4 +1,5 @@
 import {
+  ChangeDetectorRef,
  Directive,
  EventEmitter,
  Input,
@@ -45,6 +46,7 @@ export abstract class EditDialogComponent<
  protected userService = inject(UserService)
  protected settingsService = inject(SettingsService)
  protected permissionsService = inject(PermissionsService)
+  protected changeDetector = inject(ChangeDetectorRef)

  dialogMode = model(EditDialogMode.CREATE)

@@ -108,10 +110,12 @@ export abstract class EditDialogComponent<
    // wait to enable close button so it doesn't steal focus from input since its the first clickable element in the DOM
    setTimeout(() => {
      this.closeEnabled = true
+      this.changeDetector.markForCheck()
    })

    this.userService.listAll().subscribe((r) => {
      this.users = r.results
+      this.changeDetector.markForCheck()
    })
  }

@@ -191,6 +195,7 @@ export abstract class EditDialogComponent<
        this.error = error.error
        this.networkActive = false
        this.failed.next(error)
+        this.changeDetector.markForCheck()
      },
    })
  }
@@ -22,11 +22,11 @@
            <ng-template>
              <div class="card mb-2">
                <div class="card-body p-2">
-                  @if (testLoading) {
+                  @if (testLoading()) {
                    <ng-container [ngTemplateOutlet]="loadingTemplate"></ng-container>
-                  } @else if (testResult) {
-                    <code>{{testResult}}</code>
-                  } @else if (testFailed) {
+                  } @else if (testResult()) {
+                    <code>{{testResult()}}</code>
+                  } @else if (testFailed()) {
                    <div class="text-danger" i18n>Path test failed</div>
                  } @else {
                    <div class="text-muted small" i18n>No document selected</div>
@@ -42,7 +42,7 @@
                [compareWith]="compareDocuments"
                [trackByFn]="trackByFn"
                [minTermLength]="2"
-                [loading]="loading"
+                [loading]="loading()"
                [typeahead]="documentsInput$"
                (change)="testPath($event)">
                <ng-template #loadingTemplate ng-loadingspinner-tmp>
@@ -58,17 +58,17 @@ describe('StoragePathEditDialogComponent', () => {
    fixture.detectChanges()
    component.testPath({ id: 1 })
    expect(testSpy).toHaveBeenCalledWith('test/{{title}}', 1)
-    expect(component.testResult).toBe('test/abc123')
-    expect(component.testFailed).toBeFalsy()
+    expect(component.testResult()).toBe('test/abc123')
+    expect(component.testFailed()).toBeFalsy()

    // test failed
    testSpy.mockReturnValueOnce(of(''))
    component.testPath({ id: 1 })
-    expect(component.testResult).toBeNull()
-    expect(component.testFailed).toBeTruthy()
+    expect(component.testResult()).toBeNull()
+    expect(component.testFailed()).toBeTruthy()

    component.testPath(null)
-    expect(component.testResult).toBeNull()
+    expect(component.testResult()).toBeNull()
  })

  it('should compare two documents by id', () => {
@@ -1,5 +1,5 @@
 import { AsyncPipe, NgTemplateOutlet } from '@angular/common'
-import { Component, OnDestroy, inject } from '@angular/core'
+import { Component, OnDestroy, inject, signal } from '@angular/core'
 import {
  FormControl,
  FormGroup,
@@ -65,9 +65,9 @@ export class StoragePathEditDialogComponent
  public documentsInput$ = new Subject<string>()
  public foundDocuments$: Observable<Document[]>
  private testDocument: Document
-  public testResult: string
-  public testFailed: boolean = false
-  public testLoading = false
+  readonly testResult = signal<string>(undefined)
+  readonly testFailed = signal(false)
+  readonly testLoading = signal(false)

  constructor() {
    super()
@@ -99,22 +99,22 @@ export class StoragePathEditDialogComponent

  public testPath(document: Document) {
    if (!document) {
-      this.testResult = null
+      this.testResult.set(null)
      return
    }
    this.testDocument = document
-    this.testLoading = true
+    this.testLoading.set(true)
    ;(this.service as StoragePathService)
      .testPath(this.objectForm.get('path').value, document.id)
      .subscribe((result) => {
        if (result?.length) {
-          this.testResult = result
-          this.testFailed = false
+          this.testResult.set(result)
+          this.testFailed.set(false)
        } else {
-          this.testResult = null
-          this.testFailed = true
+          this.testResult.set(null)
+          this.testFailed.set(true)
        }
-        this.testLoading = false
+        this.testLoading.set(false)
      })
  }

@@ -12,7 +12,7 @@

    <pngx-input-color i18n-title title="Color" formControlName="color" [error]="error?.color"></pngx-input-color>

-    <pngx-input-select i18n-title title="Parent" formControlName="parent" [items]="tags" [allowNull]="true" [error]="error?.parent"></pngx-input-select>
+    <pngx-input-select i18n-title title="Parent" formControlName="parent" [items]="tags()" [allowNull]="true" [error]="error?.parent"></pngx-input-select>

    <pngx-input-check i18n-title title="Inbox tag" formControlName="is_inbox_tag" i18n-hint hint="Inbox tags are automatically assigned to all consumed documents."></pngx-input-check>
    <pngx-input-select i18n-title title="Matching algorithm" [items]="getMatchingAlgorithms()" formControlName="matching_algorithm"></pngx-input-select>
@@ -1,4 +1,4 @@
-import { Component, inject } from '@angular/core'
+import { Component, inject, signal } from '@angular/core'
 import {
  FormControl,
  FormGroup,
@@ -35,7 +35,7 @@ import { TextComponent } from '../../input/text/text.component'
  ],
 })
 export class TagEditDialogComponent extends EditDialogComponent<Tag> {
-  tags: Tag[]
+  readonly tags = signal<Tag[]>([])

  constructor() {
    super()
@@ -43,7 +43,7 @@ export class TagEditDialogComponent extends EditDialogComponent<Tag> {
    this.userService = inject(UserService)
    this.settingsService = inject(SettingsService)
    this.service.listAll().subscribe((result) => {
-      this.tags = result.results
+      this.tags.set(result.results)
    })
  }

@@ -180,7 +180,7 @@
        <div class="col">
          <div class="trigger-filters mb-3">
            <div class="d-flex align-items-center">
-              <label class="form-label mb-0" i18n>Advanced Filters</label>
+              <span class="form-label mb-0" i18n>Advanced Filters</span>
              <button
                type="button"
                class="btn btn-sm btn-outline-primary ms-auto"
@@ -401,7 +401,7 @@ describe('WorkflowEditDialogComponent', () => {
    component.addFilter(triggerGroup as FormGroup)

    const filters = component.getFiltersFormArray(triggerGroup as FormGroup)
-    expect(filters.length).toBe(3)
+    expect(filters).toHaveLength(3)

    filters.at(0).get('values').setValue([1])
    filters.at(1).get('values').setValue([2, 3])
@@ -672,7 +672,7 @@ describe('WorkflowEditDialogComponent', () => {
    } as any

    const filters = component['buildFiltersFormArray'](trigger)
-    expect(filters.length).toBe(0)
+    expect(filters).toHaveLength(0)

    component.filterDefinitions = originalDefinitions
  })
@@ -739,7 +739,7 @@ describe('WorkflowEditDialogComponent', () => {
    component.ngOnInit()
    const triggerGroup = component.triggerFields.at(0) as FormGroup
    const filters = component.getFiltersFormArray(triggerGroup)
-    expect(filters.length).toBe(13)
+    expect(filters).toHaveLength(13)
    const customFieldFilter = filters.at(12) as FormGroup
    expect(customFieldFilter.get('type').value).toBe(
      TriggerFilterType.CustomFieldQuery
@@ -969,12 +969,12 @@ describe('WorkflowEditDialogComponent', () => {
    component.addFilter(triggerGroup)

    component.removeFilter(triggerGroup, 0)
-    expect(component.getFiltersFormArray(triggerGroup).length).toBe(0)
+    expect(component.getFiltersFormArray(triggerGroup)).toHaveLength(0)

    component.addFilter(triggerGroup)
    const filterArrayAfterAdd = component.getFiltersFormArray(triggerGroup)
    filterArrayAfterAdd.at(0).get('type').setValue(TriggerFilterType.TagsAll)
-    expect(component.getFiltersFormArray(triggerGroup).length).toBe(1)
+    expect(component.getFiltersFormArray(triggerGroup)).toHaveLength(1)
  })

  it('should remove selected custom field from the form group', () => {
@@ -1019,4 +1019,28 @@ describe('WorkflowEditDialogComponent', () => {
      'pass3',
    ])
  })
+
+  it('should parse passwords again when retrying a failed save', () => {
+    component.object = {
+      name: 'Workflow with blank Passwords',
+      id: 1,
+      order: null,
+      enabled: true,
+      triggers: [],
+      actions: [
+        {
+          id: 1,
+          type: WorkflowActionType.PasswordRemoval,
+          passwords: [],
+        },
+      ],
+    }
+    component.ngOnInit()
+
+    component.save()
+    component.objectForm.get('order').setValue(1)
+
+    expect(() => component.save()).not.toThrow()
+    expect(component.objectForm.get('actions').value[0].passwords).toEqual([])
+  })
 })
@@ -933,7 +933,7 @@ export class WorkflowEditDialogComponent

  getFilterSelectItems(type: TriggerFilterType) {
    const definition = this.getFilterDefinition(type)
-    if (!definition || definition.inputType !== 'select') {
+    if (definition?.inputType !== 'select') {
      return []
    }

@@ -1207,9 +1207,8 @@ export class WorkflowEditDialogComponent
    return passwords.join('\n')
  }

-  private parsePasswords(value: string = ''): string[] {
-    return value
-      .split(/[\n,]+/)
+  private parsePasswords(value: string | string[] = ''): string[] {
+    return (Array.isArray(value) ? value : value.split(/[\n,]+/))
      .map((entry) => entry.trim())
      .filter((entry) => entry.length > 0)
  }
@@ -34,32 +34,30 @@
      </div>
      @if (selectionModel.items) {
        <cdk-virtual-scroll-viewport class="items" [itemSize]="FILTERABLE_BUTTON_HEIGHT_PX" #buttonsViewport [style.height.px]="scrollViewportHeight">
-          <div *cdkVirtualFor="let item of selectionModel.items | filter: filterText:'name'; trackBy: trackByItem; let i = index">
-            @if (allowSelectNone || item.id) {
-              <pngx-toggleable-dropdown-button
-                [item]="item"
-                [hideCount]="hideCount(item)"
-                [opacifyCount]="!editing"
-                [state]="selectionModel.get(item.id)"
-                [count]="getUpdatedDocumentCount(item.id)"
-                (toggled)="selectionModel.toggle(item.id)"
-                (exclude)="excludeClicked(item.id)"
-                [disabled]="disabled">
-              </pngx-toggleable-dropdown-button>
-            }
+          <div *cdkVirtualFor="let item of filteredItems; trackBy: trackByItem; let i = index">
+            <pngx-toggleable-dropdown-button
+              [item]="item"
+              [hideCount]="hideCount(item)"
+              [opacifyCount]="!editing"
+              [state]="selectionModel.get(item.id)"
+              [count]="getUpdatedDocumentCount(item.id)"
+              (toggled)="selectionModel.toggle(item.id)"
+              (exclude)="excludeClicked(item.id)"
+              [disabled]="disabled">
+            </pngx-toggleable-dropdown-button>
          </div>
        </cdk-virtual-scroll-viewport>
      }
      @if (editing) {
-        @if ((selectionModel.items | filter: filterText:'name').length === 0 && createRef !== undefined) {
+        @if (filteredItems.length === 0 && createRef !== undefined) {
          <button class="list-group-item list-group-item-action bg-light" (click)="createClicked()" [disabled]="disabled">
            <small class="ms-2"><ng-container i18n>Create</ng-container> "{{filterText}}"</small>
            <i-bs width="1.5em" height="1em" name="plus"></i-bs>
          </button>
        }
-        @if ((selectionModel.items | filter: filterText:'name').length > 0) {
-          <button class="list-group-item list-group-item-action bg-light d-flex align-items-center" (click)="applyClicked()" [disabled]="!modelIsDirty || disabled">
-            <small class="ms-2" [ngClass]="{'fw-bold': modelIsDirty}" i18n>Apply</small>
+        @if (filteredItems.length > 0) {
+          <button class="list-group-item list-group-item-action bg-light d-flex align-items-center" (click)="applyClicked()" [disabled]="!modelIsDirty() || disabled">
+            <small class="ms-2" [ngClass]="{'fw-bold': modelIsDirty()}" i18n>Apply</small>
            <i-bs width="1.5em" height="1em" name="arrow-right"></i-bs>
          </button>
        }
@@ -221,7 +221,7 @@ describe('FilterableDropdownComponent & FilterableDropdownSelectionModel', () =>
      .dispatchEvent(new MouseEvent('click')) // open
    selectionModel.toggle(items[0].id)
    fixture.detectChanges()
-    expect(component.modelIsDirty).toBeTruthy()
+    expect(component.modelIsDirty()).toBeTruthy()
    let applyResult: ChangedItems
    const closeSpy = jest.spyOn(component.dropdown, 'close')
    component.apply.subscribe((result) => (applyResult = result))
@@ -244,7 +244,7 @@ describe('FilterableDropdownComponent & FilterableDropdownSelectionModel', () =>
      .dispatchEvent(new MouseEvent('click')) // open
    selectionModel.toggle(items[0].id)
    fixture.detectChanges()
-    expect(component.modelIsDirty).toBeTruthy()
+    expect(component.modelIsDirty()).toBeTruthy()
    let applyResult: ChangedItems
    component.apply.subscribe((result) => (applyResult = result))
    component.dropdown.close()
@@ -265,7 +265,9 @@ describe('FilterableDropdownComponent & FilterableDropdownSelectionModel', () =>
    expect(document.activeElement).toEqual(
      component.listFilterTextInput.nativeElement
    )
-    expect(component.buttonsViewport.getRenderedRange().end).toEqual(3) // all items shown
+    expect(component.buttonsViewport.getRenderedRange().end).toEqual(
+      items.length
+    ) // all selectable items shown

    component.filterText = 'Tag2'
    fixture.detectChanges()
@@ -278,6 +280,29 @@ describe('FilterableDropdownComponent & FilterableDropdownSelectionModel', () =>
    expect(component.filterText).toHaveLength(0)
  })

+  it('should omit disallowed null items from the virtual scroll viewport', async () => {
+    component.selectionModel.items = items
+    component.icon = 'tag-fill'
+    fixture.nativeElement
+      .querySelector('button')
+      .dispatchEvent(new MouseEvent('click')) // open
+    fixture.detectChanges()
+    await wait(100)
+    fixture.detectChanges()
+    component.buttonsViewport?.checkViewportSize()
+    fixture.detectChanges()
+
+    expect(component.filteredItems).toEqual(items)
+    expect(component.scrollViewportHeight).toEqual(
+      items.length * component.FILTERABLE_BUTTON_HEIGHT_PX
+    )
+    expect(
+      component.buttonsViewport.elementRef.nativeElement.querySelectorAll(
+        '.cdk-virtual-scroll-content-wrapper > div'
+      )
+    ).toHaveLength(items.length)
+  })
+
  it('should toggle & close on enter inside filter field if 1 item remains', async () => {
    component.selectionModel.items = items
    component.icon = 'tag-fill'
@@ -12,6 +12,7 @@ import {
  Output,
  ViewChild,
  inject,
+  signal,
 } from '@angular/core'
 import { FormsModule, ReactiveFormsModule } from '@angular/forms'
 import { NgbDropdown, NgbDropdownModule } from '@ng-bootstrap/ng-bootstrap'
@@ -660,7 +661,6 @@ export class FilterableDropdownSelectionModel {
  imports: [
    ClearableBadgeComponent,
    ToggleableDropdownButtonComponent,
-    FilterPipe,
    FormsModule,
    ReactiveFormsModule,
    NgxBootstrapIconsModule,
@@ -796,22 +796,27 @@ export class FilterableDropdownComponent
    return this.title ? this.title.replace(/\s/g, '_').toLowerCase() : null
  }

-  modelIsDirty: boolean = false
+  readonly modelIsDirty = signal(false)

  private keyboardIndex: number

+  public get filteredItems(): MatchingModel[] {
+    return this.filterPipe
+      .transform(this.items, this.filterText, 'name')
+      .filter((item) => this.allowSelectNone || Boolean(item.id))
+  }
+
  public get scrollViewportHeight(): number {
-    const filteredLength = this.filterPipe.transform(
-      this.items,
-      this.filterText
-    ).length
-    return Math.min(filteredLength * this.FILTERABLE_BUTTON_HEIGHT_PX, 400)
+    return Math.min(
+      this.filteredItems.length * this.FILTERABLE_BUTTON_HEIGHT_PX,
+      400
+    )
  }

  constructor() {
    super()
    this.selectionModelChange.subscribe((updatedModel) => {
-      this.modelIsDirty = updatedModel.isDirty()
+      this.modelIsDirty.set(updatedModel.isDirty())
    })
  }

@@ -858,7 +863,7 @@ export class FilterableDropdownComponent
      }, 0)
      if (this.editing) {
        this.selectionModel.reset()
-        this.modelIsDirty = false
+        this.modelIsDirty.set(false)
      }
      this.selectionModel.singleSelect =
        this.editing && !this.selectionModel.manyToOne
@@ -877,7 +882,7 @@ export class FilterableDropdownComponent
  }

  listFilterEnter(): void {
-    let filtered = this.filterPipe.transform(this.items, this.filterText)
+    const filtered = this.filteredItems
    if (filtered.length == 1) {
      this.selectionModel.toggle(filtered[0].id)
      setTimeout(() => {
@@ -5,6 +5,7 @@ import {
  inject,
  Input,
  Output,
+  signal,
 } from '@angular/core'
 import {
  FormsModule,
@@ -63,11 +64,11 @@ export class CustomFieldsValuesComponent extends AbstractInputComponent<Object>

    super()
    customFieldsService.listAll().subscribe((items) => {
-      this.fields = items.results
+      this.fields.set(items.results)
    })
  }

-  private fields: CustomField[]
+  private readonly fields = signal<CustomField[]>([])

  private _selectedFields: number[]

@@ -90,6 +91,6 @@ export class CustomFieldsValuesComponent extends AbstractInputComponent<Object>
  public removeSelectedField: EventEmitter<number> = new EventEmitter<number>()

  public getCustomField(id: number): CustomField {
-    return this.fields.find((field) => field.id === id)
+    return this.fields().find((field) => field.id === id)
  }
 }
@@ -33,7 +33,7 @@
    [compareWith]="compareDocuments"
    [trackByFn]="trackByFn"
    [minTermLength]="2"
-    [loading]="loading"
+    [loading]="loading()"
    [typeahead]="documentsInput$"
    (mousedown)="$event.stopImmediatePropagation()"
    (change)="onChange(selectedDocumentIDs)">
@@ -2,7 +2,11 @@ import { provideHttpClient, withInterceptorsFromDi } from '@angular/common/http'
 import { provideHttpClientTesting } from '@angular/common/http/testing'
 import { ComponentFixture, TestBed } from '@angular/core/testing'
 import { NG_VALUE_ACCESSOR } from '@angular/forms'
-import { of, throwError } from 'rxjs'
+import { By } from '@angular/platform-browser'
+import { provideRouter } from '@angular/router'
+import { NgSelectComponent } from '@ng-select/ng-select'
+import { allIcons, NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
+import { of, Subject, throwError } from 'rxjs'
 import { FILTER_SIMPLE_TITLE } from 'src/app/data/filter-rule-type'
 import { DocumentService } from 'src/app/services/rest/document.service'
 import { DocumentLinkComponent } from './document-link.component'
@@ -33,10 +37,11 @@ describe('DocumentLinkComponent', () => {

  beforeEach(() => {
    TestBed.configureTestingModule({
-      imports: [DocumentLinkComponent],
+      imports: [DocumentLinkComponent, NgxBootstrapIconsModule.pick(allIcons)],
      providers: [
        provideHttpClient(withInterceptorsFromDi()),
        provideHttpClientTesting(),
+        provideRouter([]),
      ],
    })
    documentService = TestBed.inject(DocumentService)
@@ -60,6 +65,25 @@ describe('DocumentLinkComponent', () => {
    expect(getSpy).toHaveBeenCalled()
  })

+  it('should render loading and selected documents after async updates', async () => {
+    const result$ = new Subject<any>()
+    jest.spyOn(documentService, 'getFew').mockReturnValue(result$)
+
+    component.writeValue([1])
+    await fixture.whenStable()
+
+    const select = fixture.debugElement.query(By.directive(NgSelectComponent))
+      .componentInstance as NgSelectComponent
+    expect(select.loading()).toBe(true)
+
+    result$.next({ count: 1, all: [1], results: [documents[0]] })
+    result$.complete()
+    await fixture.whenStable()
+
+    expect(select.loading()).toBe(false)
+    expect(fixture.nativeElement.textContent).toContain(documents[0].title)
+  })
+
  it('shoud maintain ordering of selected documents', () => {
    const getSpy = jest.spyOn(documentService, 'getFew')
    getSpy.mockImplementation((ids) => {
@@ -6,6 +6,7 @@ import {
  Input,
  OnDestroy,
  OnInit,
+  signal,
 } from '@angular/core'
 import {
  FormsModule,
@@ -63,7 +64,7 @@ export class DocumentLinkComponent

  documentsInput$ = new Subject<string>()
  foundDocuments$: Observable<Document[]>
-  loading = false
+  readonly loading = signal(false)
  selectedDocuments: Document[] = []

  private unsubscribeNotifier: Subject<any> = new Subject()
@@ -93,12 +94,12 @@ export class DocumentLinkComponent
      this.selectedDocuments = []
      super.writeValue([])
    } else {
-      this.loading = true
+      this.loading.set(true)
      this.documentsService
        .getFew(documentIDs, { fields: 'id,title' })
        .pipe(takeUntil(this.unsubscribeNotifier))
        .subscribe((documentResults) => {
-          this.loading = false
+          this.loading.set(false)
          this.selectedDocuments = documentIDs.map(
            (id) => documentResults.results.find((d) => d.id === id) ?? {}
          )
@@ -113,7 +114,7 @@ export class DocumentLinkComponent
      this.documentsInput$.pipe(
        distinctUntilChanged(),
        takeUntil(this.unsubscribeNotifier),
-        tap(() => (this.loading = true)),
+        tap(() => this.loading.set(true)),
        switchMap((title) =>
          this.documentsService
            .listFiltered(
@@ -133,7 +134,7 @@ export class DocumentLinkComponent
                )
              ),
              catchError(() => of([])), // empty on error
-              tap(() => (this.loading = false))
+              tap(() => this.loading.set(false))
            )
        )
      )
@@ -37,6 +37,7 @@ export class NumberComponent extends AbstractInputComponent<number> {
    this.documentService.getNextAsn().subscribe((nextAsn) => {
      this.value = nextAsn
      this.onChange(this.value)
+      this.changeDetector.markForCheck()
    })
  }

@@ -157,8 +157,8 @@ export class TagsComponent implements OnInit, ControlValueAccessor {

  private removeChildren(tagIDs: number[], tag: Tag) {
    if (tag.children?.length) {
-      const childIDs = tag.children.map((child) => child.id)
-      tagIDs = tagIDs.filter((id) => !childIDs.includes(id))
+      const childIDs = new Set(tag.children.map((child) => child.id))
+      tagIDs = tagIDs.filter((id) => !childIDs.has(id))
      for (const child of tag.children) {
        tagIDs = this.removeChildren(tagIDs, child)
      }
@@ -14,7 +14,7 @@ import { environment } from 'src/environments/environment'
 })
 export class PageHeaderComponent {
  private titleService = inject(Title)
-  private clipboard = inject(Clipboard)
+  private readonly clipboard = inject(Clipboard)

  readonly id = input<number>(undefined)
  readonly subTitle = input('')
@@ -49,8 +49,7 @@ describe('PngxPdfViewerComponent', () => {
      new URL('assets/js/pdf.worker.min.mjs', document.baseURI).toString()
    )
    const isVisible = (component as any).findController.onIsPageVisible as
-      | (() => boolean)
-      | undefined
+      (() => boolean) | undefined
    expect(isVisible?.()).toBe(true)
    expect(loadSpy).toHaveBeenCalledWith(
      expect.objectContaining({ numPages: 1 })
@@ -61,6 +60,7 @@ describe('PngxPdfViewerComponent', () => {

  it('resolves the worker source relative to the document base URI', async () => {
    setBaseHref('/paperless/')
+    const getDocumentSpy = jest.spyOn(pdfjs, 'getDocument')

    await initComponent()

@@ -70,6 +70,13 @@ describe('PngxPdfViewerComponent', () => {
    expect(pdfjs.GlobalWorkerOptions.workerSrc).toContain(
      '/paperless/assets/js/pdf.worker.min.mjs'
    )
+    expect(getDocumentSpy).toHaveBeenCalledWith({
+      url: 'test.pdf',
+      password: undefined,
+      withCredentials: true,
+      wasmUrl: expect.stringContaining('/paperless/assets/wasm/'),
+      iccUrl: expect.stringContaining('/paperless/assets/iccs/'),
+    })
  })

  it('initializes single-page viewer and disables text layer', async () => {
@@ -83,6 +90,7 @@ describe('PngxPdfViewerComponent', () => {
    }
    expect(viewer).toBeInstanceOf(PDFSinglePageViewer)
    expect(viewer.options.textLayerMode).toBe(0)
+    expect(viewer.options.enableSelectionRendering).toBe(false)
  })

  it('applies zoom, rotation, and page changes', async () => {
@@ -122,13 +130,37 @@ describe('PngxPdfViewerComponent', () => {
    ;(component as any).applyScale()
    expect(viewer.currentScaleValue).toBe(PdfZoomScale.PageFit)
    expect(viewer.currentScale).toBe(2)
+  })

+  it('does not reapply scale for page-only changes', async () => {
+    await initComponent()
+
+    const pdf = (component as any).pdf as { numPages: number }
+    pdf.numPages = 3
+    const viewer = (component as any).pdfViewer as PDFViewer
+    viewer.setDocument(pdf)
    const applyScaleSpy = jest.spyOn(component as any, 'applyScale')
    component.page = 2
-    ;(component as any).lastViewerPage = 2
-    ;(component as any).applyViewerState()
+
+    component.ngOnChanges({
+      page: new SimpleChange(1, 2, false),
+    })
+
+    expect(viewer.currentPageNumber).toBe(2)
    expect((component as any).lastViewerPage).toBeUndefined()
-    expect(applyScaleSpy).toHaveBeenCalled()
+    expect(applyScaleSpy).not.toHaveBeenCalled()
+  })
+
+  it('does not reset the viewer when it is already on the requested page', async () => {
+    await initComponent()
+
+    const viewer = (component as any).pdfViewer as PDFViewer
+    const currentPageSpy = jest.spyOn(viewer, 'currentPageNumber', 'set')
+    component.page = viewer.currentPageNumber
+
+    ;(component as any).applyViewerState()
+
+    expect(currentPageSpy).not.toHaveBeenCalled()
  })

  it('dispatches find when search query changes after render', async () => {
@@ -264,6 +296,22 @@ describe('PngxPdfViewerComponent', () => {
    expect(mockViewer.currentPageNumber).toBe(1)
  })

+  it('reloads when the source revision changes', () => {
+    const resetSpy = jest.spyOn(component as any, 'resetViewerState')
+    const loadSpy = jest
+      .spyOn(component as any, 'loadDocument')
+      .mockImplementation(() => {})
+    component.src = 'test.pdf'
+    component.sourceRevision = 1
+
+    component.ngOnChanges({
+      sourceRevision: new SimpleChange(0, 1, false),
+    })
+
+    expect(resetSpy).toHaveBeenCalled()
+    expect(loadSpy).toHaveBeenCalled()
+  })
+
  it('applies viewer state after view init when already loaded', () => {
    const applySpy = jest.spyOn(component as any, 'applyViewerState')
    ;(component as any).hasLoaded = true
@@ -43,6 +43,7 @@ export class PngxPdfViewerComponent
  private readonly document = inject<Document>(DOCUMENT)

  @Input() src!: string
+  @Input() sourceRevision = 0
  @Input() password?: string
  @Input() page?: number
  @Output() pageChange = new EventEmitter<number>()
@@ -93,7 +94,7 @@ export class PngxPdfViewerComponent
  }

  ngOnChanges(changes: SimpleChanges): void {
-    if (changes['src'] || changes['password']) {
+    if (changes['src'] || changes['sourceRevision'] || changes['password']) {
      this.resetViewerState()
      if (this.src) {
        this.loadDocument()
@@ -115,7 +116,10 @@ export class PngxPdfViewerComponent
      changes['zoomScale'] ||
      changes['rotation']
    ) {
-      this.applyViewerState()
+      // Prevent loop with page / scale application see https://github.com/paperless-ngx/paperless-ngx/issues/13404
+      this.applyViewerState(
+        !!(changes['zoom'] || changes['zoomScale'] || changes['rotation'])
+      )
    }

    if (changes['searchQuery']) {
@@ -174,10 +178,12 @@ export class PngxPdfViewerComponent
      'assets/js/pdf.worker.min.mjs',
      this.document.baseURI
    ).toString()
-    let initOptions = {
+    const initOptions = {
      url: this.src,
      password: this.password,
      withCredentials: true,
+      wasmUrl: new URL('assets/wasm/', this.document.baseURI).toString(),
+      iccUrl: new URL('assets/iccs/', this.document.baseURI).toString(),
    }
    this.loadingTask = getDocument(initOptions)
    try {
@@ -215,6 +221,7 @@ export class PngxPdfViewerComponent
      linkService: this.linkService,
      findController: this.findController,
      textLayerMode,
+      enableSelectionRendering: false,
      removePageBorders: true,
    }

@@ -237,7 +244,7 @@ export class PngxPdfViewerComponent
    }
  }

-  private applyViewerState(): void {
+  private applyViewerState(applyScale = true): void {
    if (!this.pdfViewer) {
      return
    }
@@ -254,12 +261,14 @@ export class PngxPdfViewerComponent
        Math.max(Math.trunc(this.page), 1),
        this.pdfViewer.pagesCount
      )
-      this.pdfViewer.currentPageNumber = nextPage
+      if (nextPage !== this.pdfViewer.currentPageNumber) {
+        this.pdfViewer.currentPageNumber = nextPage
+      }
    }
    if (this.page === this.lastViewerPage) {
      this.lastViewerPage = undefined
    }
-    if (hasPages) {
+    if (hasPages && applyScale) {
      this.applyScale()
    }
    this.dispatchFindIfReady()
@@ -68,7 +68,7 @@
            [(ngModel)]="selectionModel.includeUsers"
            [disabled]="disabled"
            [clearable]="false"
-            [items]="users"
+            [items]="users()"
            bindLabel="username"
            multiple="true"
            bindValue="id"
@@ -1,5 +1,12 @@
 import { NgClass } from '@angular/common'
-import { Component, EventEmitter, Input, Output, inject } from '@angular/core'
+import {
+  Component,
+  EventEmitter,
+  Input,
+  Output,
+  inject,
+  signal,
+} from '@angular/core'
 import { FormsModule, ReactiveFormsModule } from '@angular/forms'
 import { NgbDropdownModule } from '@ng-bootstrap/ng-bootstrap'
 import { NgSelectComponent } from '@ng-select/ng-select'
@@ -75,7 +82,7 @@ export class PermissionsFilterDropdownComponent extends ComponentWithPermissions
  @Output()
  ownerFilterSet = new EventEmitter<PermissionsSelectionModel>()

-  users: User[]
+  readonly users = signal<User[]>([])

  hideUnowned: boolean

@@ -102,7 +109,7 @@ export class PermissionsFilterDropdownComponent extends ComponentWithPermissions
        .listAll()
        .pipe(first())
        .subscribe({
-          next: (result) => (this.users = result.results),
+          next: (result) => this.users.set(result.results),
        })
    }
  }
@@ -1,6 +1,7 @@
 <a [href]="link ?? previewUrl" class="{{linkClasses}}" [target]="linkTarget" [title]="linkTitle"
  [ngbPopover]="previewContent" [popoverTitle]="document.title | documentTitle" container="body"
-  autoClose="true" [popoverClass]="popoverClass()" (mouseenter)="mouseEnterPreview()" (mouseleave)="mouseLeavePreview()" #popover="ngbPopover">
+  autoClose="true" [popoverClass]="popoverClass()" [popperOptions]="popperOptions"
+  (mouseenter)="mouseEnterPreview()" (mouseleave)="mouseLeavePreview()" #popover="ngbPopover">
  <ng-content></ng-content>
 </a>
 <ng-template #previewContent>
@@ -67,6 +67,10 @@ describe('PreviewPopupComponent', () => {
    expect(component.useNativePdfViewer).toBeTruthy()
  })

+  it('should use fixed positioning for the preview popover', () => {
+    expect(component.popperOptions({}).strategy).toEqual('fixed')
+  })
+
  it('should render object if native PDF viewer enabled', () => {
    settingsService.set(SETTINGS_KEYS.USE_NATIVE_PDF_VIEWER, true)
    component.popover.open()
@@ -8,6 +8,7 @@ import {
  ViewChild,
 } from '@angular/core'
 import { NgbPopover, NgbPopoverModule } from '@ng-bootstrap/ng-bootstrap'
+import { Options } from '@popperjs/core'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
 import { first, Subject, takeUntil } from 'rxjs'
 import { Document } from 'src/app/data/document'
@@ -74,6 +75,11 @@ export class PreviewPopupComponent implements OnDestroy {

  readonly popoverClass = signal('shadow popover-preview')

+  readonly popperOptions = (options: Partial<Options>): Partial<Options> => ({
+    ...options,
+    strategy: 'fixed',
+  })
+
  get renderAsObject(): boolean {
    return (this.isPdf && this.useNativePdfViewer) || !this.isPdf
  }
@@ -57,15 +57,15 @@
          </div>
      </div>
      <div class="col-12 col-md-6">
-        @if (socialAccounts?.length > 0) {
+        @if (socialAccounts().length > 0) {
          <div class="mb-3">
            <p i18n>Connected social accounts</p>
            <ul class="list-group">
-              @for (account of socialAccounts; track account.id) {
+              @for (account of socialAccounts(); track account.id) {
                <li class="list-group-item"
                  ngbPopover="Set a password before disconnecting social account."
                  i18n-ngbPopover
-                  [disablePopover]="hasUsablePassword"
+                  [disablePopover]="hasUsablePassword()"
                  triggers="mouseenter:mouseleave">
                  {{account.name}} ({{account.provider}})
                  <pngx-confirm-button
@@ -75,7 +75,7 @@
                    i18n-title
                    buttonClasses="btn-outline-danger btn-sm ms-2 align-baseline"
                    iconName="trash"
-                    [disabled]="!hasUsablePassword"
+                    [disabled]="!hasUsablePassword()"
                    (confirm)="disconnectSocialAccount(account.id)">
                  </pngx-confirm-button>
                </li>
@@ -84,11 +84,11 @@
            <div class="form-text text-muted text-end fst-italic" i18n>Warning: disconnecting social accounts cannot be undone</div>
          </div>
        }
-        @if (socialAccountProviders?.length > 0) {
+        @if (socialAccountProviders().length > 0) {
          <div class="mb-3">
            <p i18n>Connect new social account</p>
            <div class="list-group">
-              @for (provider of socialAccountProviders; track provider.name) {
+              @for (provider of socialAccountProviders(); track provider.name) {
                <a class="list-group-item list-group-item-action text-primary d-flex align-items-center" href="{{ provider.login_url }}" rel="noopener noreferrer">
                  {{provider.name}}<i-bs class="pb-1 ms-2" name="box-arrow-up-right"></i-bs>
                </a>
@@ -96,7 +96,7 @@
            </div>
          </div>
        }
-        @if (!isTotpEnabled) {
+        @if (!isTotpEnabled()) {
          <div ngbAccordion>
            <div ngbAccordionItem>
              <h2 ngbAccordionHeader>
@@ -105,10 +105,10 @@
              <div ngbAccordionCollapse>
                <div ngbAccordionBody>
                  <ng-template>
-                    @if (totpSettingsLoading) {
+                    @if (totpSettingsLoading()) {
                      <div class="spinner-border spinner-border-sm fw-normal ms-2 me-auto" role="status"></div>
                      <div class="visually-hidden" i18n>Loading...</div>
-                    } @else if (totpSettings) {
+                    } @else if (totpSettings()) {
                      <figure class="figure">
                        @if (qrSvgDataUrl) {
                          <img class="bg-white d-inline-block" [src]="qrSvgDataUrl" alt="Authenticator QR code">
@@ -116,14 +116,14 @@
                        <figcaption class="figure-caption text-end mt-2" i18n>Scan the QR code with your authenticator app and then enter the code below</figcaption>
                      </figure>
                      <p>
-                        <ng-container i18n>Authenticator secret</ng-container>: <code>{{totpSettings.secret}}</code>.
+                        <ng-container i18n>Authenticator secret</ng-container>: <code>{{totpSettings().secret}}</code>.
                        <ng-container i18n>You can store this secret and use it to reinstall your authenticator app at a later time.</ng-container>
                      </p>
                      <div class="input-group mb-3">
                        <input type="text" class="form-control" formControlName="totp_code" placeholder="Code" i18n-placeholder>
-                        <button type="button" class="btn btn-primary ml-auto" (click)="activateTotp()" [disabled]="totpLoading">
+                        <button type="button" class="btn btn-primary ml-auto" (click)="activateTotp()" [disabled]="totpLoading()">
                          <ng-container i18n>Enable</ng-container>
-                          @if (totpLoading) {
+                          @if (totpLoading()) {
                            <div class="spinner-border spinner-border-sm fw-normal ms-2" role="status"></div>
                            <div class="visually-hidden" i18n>Loading...</div>
                          }
@@ -137,18 +137,18 @@
          </div>
        } @else {
          <label class="d-block mb-2" i18n>Two-factor Authentication</label>
-          @if (recoveryCodes) {
+          @if (recoveryCodes()) {
            <div class="alert alert-warning" role="alert">
              <i-bs name="exclamation-triangle" class="me-1"></i-bs><ng-container i18n>Recovery codes will not be shown again, make sure to save them.</ng-container>
            </div>
            <div class="d-flex flex-row align-items-start mb-3">
              <ul class="list-group w-50">
-                  @for (code of recoveryCodes; track code; let i = $index) {
+                  @for (code of recoveryCodes(); track code; let i = $index) {
                    @if (i % 2 === 0) {
                      <li class="list-group-item d-flex justify-content-around align-items-center">
                        <code>{{code}}</code>
-                        @if (recoveryCodes[i + 1]) {
-                          <code>{{recoveryCodes[i + 1]}}</code>
+                        @if (recoveryCodes()[i + 1]) {
+                          <code>{{recoveryCodes()[i + 1]}}</code>
                        }
                      </li>
                    }
@@ -171,7 +171,7 @@
            i18n-title
            buttonClasses="btn-outline-danger btn-sm"
            iconName="trash"
-            [disabled]="totpLoading"
+            [disabled]="totpLoading()"
            (confirm)="deactivateTotp()">
          </pngx-confirm-button>
        }
@@ -10,7 +10,7 @@ import {
  NgbPopoverModule,
 } from '@ng-bootstrap/ng-bootstrap'
 import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
-import { of, throwError } from 'rxjs'
+import { NEVER, of, Subject, throwError } from 'rxjs'
 import { ProfileService } from 'src/app/services/profile.service'
 import { ToastService } from 'src/app/services/toast.service'
 import * as navUtils from 'src/app/utils/navigation'
@@ -60,6 +60,10 @@ describe('ProfileEditDialogComponent', () => {
      providers: [NgbActiveModal, provideHttpClient(withInterceptorsFromDi())],
    })
    profileService = TestBed.inject(ProfileService)
+    jest.spyOn(profileService, 'get').mockReturnValue(NEVER)
+    jest
+      .spyOn(profileService, 'getSocialAccountProviders')
+      .mockReturnValue(of([]))
    toastService = TestBed.inject(ToastService)
    clipboard = TestBed.inject(Clipboard)
    fixture = TestBed.createComponent(ProfileEditDialogComponent)
@@ -155,7 +159,7 @@ describe('ProfileEditDialogComponent', () => {
      'getSocialAccountProviders'
    )
    getProvidersSpy.mockReturnValue(of(socialAccountProviders))
-    component.hasUsablePassword = true
+    component.hasUsablePassword.set(true)
    component.ngOnInit()
    component.form.get('password').patchValue('new*pass')
    component.onPasswordKeyUp({
@@ -268,6 +272,27 @@ describe('ProfileEditDialogComponent', () => {
    expect(getProvidersSpy).toHaveBeenCalled()
  })

+  it('should render social account providers after an async update', async () => {
+    const providers$ = new Subject<typeof socialAccountProviders>()
+    jest.spyOn(profileService, 'get').mockReturnValue(of(profile))
+    jest
+      .spyOn(profileService, 'getSocialAccountProviders')
+      .mockReturnValue(providers$)
+
+    component.ngOnInit()
+    await fixture.whenStable()
+    expect(
+      fixture.nativeElement.querySelector('a[href="https://example.com"]')
+    ).toBeNull()
+
+    providers$.next(socialAccountProviders)
+    await fixture.whenStable()
+
+    expect(
+      fixture.nativeElement.querySelector('a[href="https://example.com"]')
+    ).not.toBeNull()
+  })
+
  it('should remove disconnected social account from component, show error if needed', () => {
    const disconnectSpy = jest.spyOn(profileService, 'disconnectSocialAccount')
    const getSpy = jest.spyOn(profileService, 'get')
@@ -276,7 +301,7 @@ describe('ProfileEditDialogComponent', () => {

    const errorSpy = jest.spyOn(toastService, 'showError')

-    expect(component.socialAccounts).toContainEqual(socialAccount)
+    expect(component.socialAccounts()).toContainEqual(socialAccount)

    // fail first
    disconnectSpy.mockReturnValueOnce(
@@ -289,7 +314,7 @@ describe('ProfileEditDialogComponent', () => {
    disconnectSpy.mockReturnValue(of(socialAccount.id))
    component.disconnectSocialAccount(socialAccount.id)
    expect(disconnectSpy).toHaveBeenCalled()
-    expect(component.socialAccounts).not.toContainEqual(socialAccount)
+    expect(component.socialAccounts()).not.toContainEqual(socialAccount)
  })

  it('should get totp settings', () => {
@@ -310,7 +335,7 @@ describe('ProfileEditDialogComponent', () => {
    getSpy.mockReturnValue(of(settings))
    component.gettotpSettings()
    expect(getSpy).toHaveBeenCalled()
-    expect(component.totpSettings).toEqual(settings)
+    expect(component.totpSettings()).toEqual(settings)
  })

  it('should activate totp', () => {
@@ -319,15 +344,15 @@ describe('ProfileEditDialogComponent', () => {
    const toastInfoSpy = jest.spyOn(toastService, 'showInfo')
    const error = new Error('failed to activate totp')
    activateSpy.mockReturnValueOnce(throwError(() => error))
-    component.totpSettings = {
+    component.totpSettings.set({
      url: 'http://localhost/',
      qr_svg: 'svg',
      secret: 'secret',
-    }
+    })
    component.form.get('totp_code').patchValue('123456')
    component.activateTotp()
    expect(activateSpy).toHaveBeenCalledWith(
-      component.totpSettings.secret,
+      component.totpSettings().secret,
      component.form.get('totp_code').value
    )
    expect(toastErrorSpy).toHaveBeenCalled()
@@ -341,8 +366,8 @@ describe('ProfileEditDialogComponent', () => {
    )
    component.activateTotp()
    expect(toastInfoSpy).toHaveBeenCalled()
-    expect(component.isTotpEnabled).toBeTruthy()
-    expect(component.recoveryCodes).toEqual(['1', '2', '3'])
+    expect(component.isTotpEnabled()).toBeTruthy()
+    expect(component.recoveryCodes()).toEqual(['1', '2', '3'])
  })

  it('should deactivate totp', () => {
@@ -362,13 +387,13 @@ describe('ProfileEditDialogComponent', () => {
    deactivateSpy.mockReturnValueOnce(of(true))
    component.deactivateTotp()
    expect(toastInfoSpy).toHaveBeenCalled()
-    expect(component.isTotpEnabled).toBeFalsy()
+    expect(component.isTotpEnabled()).toBeFalsy()
  })

  it('should copy recovery codes', () => {
    jest.useFakeTimers()
    const copySpy = jest.spyOn(clipboard, 'copy')
-    component.recoveryCodes = ['1', '2', '3']
+    component.recoveryCodes.set(['1', '2', '3'])
    component.copyRecoveryCodes()
    expect(copySpy).toHaveBeenCalledWith('1\n2\n3')
    jest.advanceTimersByTime(3000)
@@ -56,6 +56,14 @@ export class ProfileEditDialogComponent
  readonly showEmailConfirm = signal(false)
  readonly copied = signal(false)
  readonly codesCopied = signal(false)
+  readonly hasUsablePassword = signal(false)
+  readonly isTotpEnabled = signal(false)
+  readonly totpSettings = signal<TotpSettings>(undefined)
+  readonly totpSettingsLoading = signal(false)
+  readonly totpLoading = signal(false)
+  readonly recoveryCodes = signal<string[]>(undefined)
+  readonly socialAccounts = signal<SocialAccount[]>([])
+  readonly socialAccountProviders = signal<SocialAccountProvider[]>([])

  public form = new FormGroup({
    email: new FormControl(''),
@@ -72,25 +80,15 @@ export class ProfileEditDialogComponent
  private newPassword: string
  private passwordConfirm: string

-  public hasUsablePassword: boolean = false
-
  private currentEmail: string
  private newEmail: string
  private emailConfirm: string

-  public isTotpEnabled: boolean = false
-  public totpSettings: TotpSettings
-  public totpSettingsLoading: boolean = false
-  public totpLoading: boolean = false
-  public recoveryCodes: string[]
-  public socialAccounts: SocialAccount[] = []
-  public socialAccountProviders: SocialAccountProvider[] = []
-
  get qrSvgDataUrl(): string | null {
-    if (!this.totpSettings?.qr_svg) {
+    if (!this.totpSettings()?.qr_svg) {
      return null
    }
-    return `data:image/svg+xml;utf8,${encodeURIComponent(this.totpSettings.qr_svg)}`
+    return `data:image/svg+xml;utf8,${encodeURIComponent(this.totpSettings().qr_svg)}`
  }

  ngOnInit(): void {
@@ -107,20 +105,20 @@ export class ProfileEditDialogComponent
          this.onEmailChange()
        })
        this.currentPassword = profile.password
-        this.hasUsablePassword = profile.has_usable_password
+        this.hasUsablePassword.set(profile.has_usable_password)
        this.form.get('password').valueChanges.subscribe((newPassword) => {
          this.newPassword = newPassword
          this.onPasswordChange()
        })
-        this.socialAccounts = profile.social_accounts
-        this.isTotpEnabled = profile.is_mfa_enabled
+        this.socialAccounts.set(profile.social_accounts ?? [])
+        this.isTotpEnabled.set(profile.is_mfa_enabled)
      })

    this.profileService
      .getSocialAccountProviders()
      .pipe(takeUntil(this.unsubscribeNotifier))
      .subscribe((providers) => {
-        this.socialAccountProviders = providers
+        this.socialAccountProviders.set(providers ?? [])
      })
  }

@@ -259,7 +257,9 @@ export class ProfileEditDialogComponent
      .pipe(takeUntil(this.unsubscribeNotifier))
      .subscribe({
        next: (id: number) => {
-          this.socialAccounts = this.socialAccounts.filter((a) => a.id != id)
+          this.socialAccounts.update((accounts) =>
+            accounts.filter((account) => account.id != id)
+          )
        },
        error: (error) => {
          this.toastService.showError(
@@ -271,36 +271,39 @@ export class ProfileEditDialogComponent
  }

  public gettotpSettings(): void {
-    this.totpSettingsLoading = true
+    this.totpSettingsLoading.set(true)
    this.profileService
      .getTotpSettings()
      .pipe(takeUntil(this.unsubscribeNotifier))
      .subscribe({
        next: (totpSettings) => {
-          this.totpSettingsLoading = false
-          this.totpSettings = totpSettings
+          this.totpSettingsLoading.set(false)
+          this.totpSettings.set(totpSettings)
        },
        error: (error) => {
          this.toastService.showError(
            $localize`Error fetching TOTP settings`,
            error
          )
-          this.totpSettingsLoading = false
+          this.totpSettingsLoading.set(false)
        },
      })
  }

  public activateTotp(): void {
-    this.totpLoading = true
+    this.totpLoading.set(true)
    this.form.get('totp_code').disable()
    this.profileService
-      .activateTotp(this.totpSettings.secret, this.form.get('totp_code').value)
+      .activateTotp(
+        this.totpSettings().secret,
+        this.form.get('totp_code').value
+      )
      .pipe(takeUntil(this.unsubscribeNotifier))
      .subscribe({
        next: (activationResponse) => {
-          this.totpLoading = false
-          this.isTotpEnabled = activationResponse.success
-          this.recoveryCodes = activationResponse.recovery_codes
+          this.totpLoading.set(false)
+          this.isTotpEnabled.set(activationResponse.success)
+          this.recoveryCodes.set(activationResponse.recovery_codes)
          this.form.get('totp_code').enable()
          if (activationResponse.success) {
            this.toastService.showInfo($localize`TOTP activated successfully`)
@@ -309,7 +312,7 @@ export class ProfileEditDialogComponent
          }
        },
        error: (error) => {
-          this.totpLoading = false
+          this.totpLoading.set(false)
          this.form.get('totp_code').enable()
          this.toastService.showError($localize`Error activating TOTP`, error)
        },
@@ -317,15 +320,15 @@ export class ProfileEditDialogComponent
  }

  public deactivateTotp(): void {
-    this.totpLoading = true
+    this.totpLoading.set(true)
    this.profileService
      .deactivateTotp()
      .pipe(takeUntil(this.unsubscribeNotifier))
      .subscribe({
        next: (success) => {
-          this.totpLoading = false
-          this.isTotpEnabled = !success
-          this.recoveryCodes = null
+          this.totpLoading.set(false)
+          this.isTotpEnabled.set(!success)
+          this.recoveryCodes.set(null)
          if (success) {
            this.toastService.showInfo($localize`TOTP deactivated successfully`)
          } else {
@@ -333,14 +336,14 @@ export class ProfileEditDialogComponent
          }
        },
        error: (error) => {
-          this.totpLoading = false
+          this.totpLoading.set(false)
          this.toastService.showError($localize`Error deactivating TOTP`, error)
        },
      })
  }

  public copyRecoveryCodes(): void {
-    this.clipboard.copy(this.recoveryCodes.join('\n'))
+    this.clipboard.copy(this.recoveryCodes().join('\n'))
    this.codesCopied.set(true)
    setTimeout(() => {
      this.codesCopied.set(false)
@@ -65,8 +65,9 @@
        <dd class="col-sm-8"><code>{{ createdBundle.slug }}</code></dd>
        <dt class="col-sm-4" i18n>Link</dt>
        <dd class="col-sm-8">
+          <label class="visually-hidden" for="shareBundleLink" i18n>Share link</label>
          <div class="input-group input-group-sm">
-            <input class="form-control" type="text" [value]="getShareUrl(createdBundle)" readonly>
+            <input id="shareBundleLink" class="form-control" type="text" [value]="getShareUrl(createdBundle)" readonly>
            <button
              class="btn btn-outline-primary"
              type="button"
@@ -14,7 +14,9 @@
  }

  <div content class="wrapper fade" [class.show]="show()">
-  @if (displayMode() === DisplayMode.TABLE) {
+  @if (error()) {
+    <div class="alert alert-danger mb-0" role="alert"><ng-container i18n>Error while loading documents</ng-container>: {{error()}}</div>
+  } @else if (displayMode() === DisplayMode.TABLE) {
    <table class="table table-hover mb-0 mt-n2 align-middle">
      <thead>
        <tr>
@@ -1,6 +1,10 @@
 import { DragDropModule } from '@angular/cdk/drag-drop'
 import { DatePipe } from '@angular/common'
-import { provideHttpClient, withInterceptorsFromDi } from '@angular/common/http'
+import {
+  HttpErrorResponse,
+  provideHttpClient,
+  withInterceptorsFromDi,
+} from '@angular/common/http'
 import { provideHttpClientTesting } from '@angular/common/http/testing'
 import { ComponentFixture, TestBed } from '@angular/core/testing'
 import { By } from '@angular/platform-browser'
@@ -8,7 +12,7 @@ import { Router } from '@angular/router'
 import { RouterTestingModule } from '@angular/router/testing'
 import { NgbModule } from '@ng-bootstrap/ng-bootstrap'
 import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
-import { Subject, of } from 'rxjs'
+import { Subject, of, throwError } from 'rxjs'
 import { routes } from 'src/app/app-routing.module'
 import { CustomFieldDisplayComponent } from 'src/app/components/common/custom-field-display/custom-field-display.component'
 import { PreviewPopupComponent } from 'src/app/components/common/preview-popup/preview-popup.component'
@@ -230,6 +234,27 @@ describe('SavedViewWidgetComponent', () => {
    expect(component.documents()).toEqual(documentResults)
  })

+  it('should show an error if documents fail to load', () => {
+    jest.spyOn(documentService, 'listFiltered').mockReturnValue(
+      throwError(
+        () =>
+          new HttpErrorResponse({
+            error: { added__date__lte: ['Enter a valid date.'] },
+            status: 400,
+          })
+      )
+    )
+
+    component.reload()
+    fixture.detectChanges()
+
+    expect(component.loading()).toBe(false)
+    expect(component.error()).toEqual('Added: Enter a valid date.')
+    expect(fixture.debugElement.nativeElement.textContent).toContain(
+      'Error while loading documents: Added: Enter a valid date.'
+    )
+  })
+
  it('should reload on document consumption finished', () => {
    const fileStatusSubject = new Subject<FileStatus>()
    jest
@@ -125,6 +125,8 @@ export class SavedViewWidgetComponent

  readonly count = signal<number>(null)

+  readonly error = signal<string | null>(null)
+
  placeholderRows: number[] = []

  ngOnInit(): void {
@@ -180,6 +182,7 @@ export class SavedViewWidgetComponent

  reload() {
    this.loading.set(this.documents().length == 0)
+    this.error.set(null)
    this.show.set(true)
    this.documentService
      .listFiltered(
@@ -191,12 +194,40 @@ export class SavedViewWidgetComponent
        { truncate_content: true }
      )
      .pipe(takeUntil(this.unsubscribeNotifier))
-      .subscribe((result) => {
-        this.documents.set(result.results)
-        this.count.set(result.count)
-        this.savedViewService.setDocumentCount(this.savedView, result.count)
-        this.loading.set(false)
-        this.show.set(true)
+      .subscribe({
+        next: (result) => {
+          this.documents.set(result.results)
+          this.count.set(result.count)
+          this.savedViewService.setDocumentCount(this.savedView, result.count)
+          this.loading.set(false)
+          this.show.set(true)
+        },
+        error: (error) => {
+          this.documents.set([])
+          this.count.set(null)
+          let errorMessage
+          if (
+            typeof error.error === 'object' &&
+            Object.keys(error.error).length > 0
+          ) {
+            errorMessage = Object.keys(error.error)
+              .map((fieldName) => {
+                const fieldNameBase = fieldName.split('__')[0]
+                const fieldError: Array<string> = error.error[fieldName]
+                return `${
+                  this.documentService.sortFields.find(
+                    (f) => f.field?.split('__')[0] == fieldNameBase
+                  )?.name ?? fieldNameBase
+                }: ${fieldError[0]}`
+              })
+              .join(', ')
+          } else {
+            errorMessage = error.error
+          }
+          this.error.set(errorMessage)
+          this.loading.set(false)
+          this.show.set(true)
+        },
      })
  }

@@ -1 +1 @@
-<p i18n>Searching document with asn {{asn}}</p>
+<p i18n>Searching document with asn {{asn()}}</p>
@@ -1,4 +1,4 @@
-import { Component, OnInit, inject } from '@angular/core'
+import { Component, OnInit, inject, signal } from '@angular/core'
 import { ActivatedRoute, Router } from '@angular/router'
 import { FILTER_ASN } from '../../data/filter-rule-type'
 import { DocumentService } from '../../services/rest/document.service'
@@ -13,13 +13,13 @@ export class DocumentAsnComponent implements OnInit {
  private route = inject(ActivatedRoute)
  private router = inject(Router)

-  asn: string
+  readonly asn = signal<string>(undefined)

  ngOnInit(): void {
    this.route.paramMap.subscribe((paramMap) => {
-      this.asn = paramMap.get('id')
+      this.asn.set(paramMap.get('id'))
      this.documentsService
-        .listAllFilteredIds([{ rule_type: FILTER_ASN, value: this.asn }])
+        .listAllFilteredIds([{ rule_type: FILTER_ASN, value: this.asn() }])
        .subscribe((documentId) => {
          if (documentId.length == 1) {
            this.router.navigate(['documents', documentId[0]])
@@ -113,8 +113,8 @@

    <form [formGroup]='documentForm' (ngSubmit)="save()">

-      <div class="btn-toolbar mb-1 border-bottom">
-        <div class="btn-group pb-3">
+      <div class="btn-toolbar justify-content-end mb-1 pb-3 gap-2 row-gap-2 border-bottom">
+        <div class="btn-group me-auto">
          <button type="button" class="btn btn-sm btn-outline-secondary" i18n-title title="Close" (click)="close()">
            <i-bs width="1.2em" height="1.2em" name="x"></i-bs>
          </button>
@@ -127,32 +127,36 @@
        </div>

        <ng-container *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.Document }">
-          <div class="btn-group pb-3 ms-auto">
-            <pngx-suggestions-dropdown *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.Document }"
-              [disabled]="!userCanEdit || suggestionsLoading()"
-              [loading]="suggestionsLoading()"
-              [suggestions]="suggestions()"
-              [aiEnabled]="aiEnabled"
-              (getSuggestions)="getSuggestions()"
-              (addTag)="createTag($event)"
-              (addDocumentType)="createDocumentType($event)"
-              (addCorrespondent)="createCorrespondent($event)">
-            </pngx-suggestions-dropdown>
+          <div class="d-flex gap-2">
+            <div class="btn-group">
+              <pngx-suggestions-dropdown *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.Document }"
+                [disabled]="!userCanEdit || suggestionsLoading()"
+                [loading]="suggestionsLoading()"
+                [suggestions]="suggestions()"
+                [aiEnabled]="aiEnabled"
+                (getSuggestions)="getSuggestions()"
+                (addTag)="createTag($event)"
+                (addDocumentType)="createDocumentType($event)"
+                (addCorrespondent)="createCorrespondent($event)">
+              </pngx-suggestions-dropdown>
+            </div>
+
+            <div class="btn-group">
+              <pngx-custom-fields-dropdown
+                *pngxIfPermissions="{ action: PermissionAction.View, type: PermissionType.CustomField }"
+                [documentId]="documentId()"
+                [disabled]="!userCanEdit"
+                [existingFields]="document()?.custom_fields"
+                (created)="refreshCustomFields()"
+                (added)="addField($event)">
+              </pngx-custom-fields-dropdown>
+            </div>
          </div>

-          <div class="btn-group pb-3 ms-2">
-            <pngx-custom-fields-dropdown
-              *pngxIfPermissions="{ action: PermissionAction.View, type: PermissionType.CustomField }"
-              [documentId]="documentId()"
-              [disabled]="!userCanEdit"
-              [existingFields]="document()?.custom_fields"
-              (created)="refreshCustomFields()"
-              (added)="addField($event)">
-            </pngx-custom-fields-dropdown>
+          <div class="ps-3">
+            <ng-container *ngTemplateOutlet="saveButtons"></ng-container>
          </div>
        </ng-container>
-
-        <ng-container *ngTemplateOutlet="saveButtons"></ng-container>
      </div>

      <ul ngbNav #nav="ngbNav" class="nav-underline flex-nowrap flex-md-wrap overflow-auto" (navChange)="onNavChange($event)" [activeId]="activeNavID()" (activeIdChange)="activeNavID.set($event)">
@@ -276,7 +280,7 @@
              }
            </div>

-            <div class="d-flex border-top pt-3">
+            <div class="d-flex justify-content-end border-top pt-3">
              <ng-container *ngTemplateOutlet="saveButtons"></ng-container>
            </div>
          </ng-template>
@@ -315,7 +319,7 @@
                    <td>{{metadata()?.original_filename}}</td>
                  </tr>
                  <tr>
-                    <td i18n>Original MD5 checksum</td>
+                    <td i18n>Original SHA256 checksum</td>
                    <td>{{metadata()?.original_checksum}}</td>
                  </tr>
                  <tr>
@@ -328,7 +332,7 @@
                  </tr>
                  @if (metadata()?.has_archive_version) {
                    <tr>
-                      <td i18n>Archive MD5 checksum</td>
+                      <td i18n>Archive SHA256 checksum</td>
                      <td>{{metadata()?.archive_checksum}}</td>
                    </tr>
                  }
@@ -440,7 +444,7 @@
 </div>

 <ng-template #saveButtons>
-  <div class="btn-group pb-3 ms-4">
+  <div class="btn-group">
    <ng-container *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.Document }">
      <button type="submit" class="order-3 btn btn-sm btn-primary" i18n [disabled]="!userCanEdit || networkActive() || (isDirty$ | async) !== true">Save</button>
      @if (hasNext()) {
@@ -472,6 +476,7 @@
          <div class="preview-sticky pdf-viewer-container">
            <pngx-pdf-viewer
              [src]="pdfSource()"
+              [sourceRevision]="previewRevision()"
              [password]="pdfPassword()"
              [renderMode]="PdfRenderMode.All"
              [page]="previewCurrentPage()" (pageChange)="previewCurrentPage.set($event)"
@@ -482,9 +487,7 @@
            </pngx-pdf-viewer>
          </div>
        } @else {
-          <object [data]="previewUrl() | safeUrl" class="preview-sticky" width="100%">
-            <span>Preview is unavailable.</span>
-          </object>
+          <object [data]="previewUrl() | safeUrl" class="preview-sticky" width="100%"></object>
        }
      }
      @case (ContentRenderType.Text) {
@@ -505,9 +508,7 @@
        }
      }
      @case (ContentRenderType.Other) {
-        <object [data]="previewUrl() | safeUrl" class="preview-sticky" width="100%">
-          <span>Preview is unavailable.</span>
-        </object>
+        <object [data]="previewUrl() | safeUrl" class="preview-sticky" width="100%"></object>
      }
    }
    @if (requiresPassword) {
@@ -510,7 +510,7 @@ describe('DocumentDetailComponent', () => {
    const deleteButtons = fixture.debugElement.queryAll(
      By.css('pngx-confirm-button')
    )
-    expect(deleteButtons.length).toEqual(1)
+    expect(deleteButtons).toHaveLength(1)
  })

  it('should fall back to details tab when duplicates tab is active but no duplicates', () => {
@@ -1602,6 +1602,7 @@ describe('DocumentDetailComponent', () => {
    expect(openDoc.__changedFields).toEqual([])
    expect(setDirtySpy).toHaveBeenCalledWith(openDoc, false)
    expect(saveSpy).toHaveBeenCalled()
+    expect(component.previewRevision()).toBe(1)
  })

  it('should ignore incoming update for a different document id', () => {
@@ -2160,8 +2161,14 @@ describe('DocumentDetailComponent', () => {
  it('should support open share links and email modals', () => {
    const modalSpy = jest.spyOn(modalService, 'open')
    initNormally()
+    component.selectedVersionId.set(10)
    component.openShareLinks()
    expect(modalSpy).toHaveBeenCalled()
+    expect(
+      (
+        modalSpy.mock.results[0].value as NgbModalRef
+      ).componentInstance.documentId()
+    ).toBe(10)
    component.openEmailDocument()
    expect(modalSpy).toHaveBeenCalled()
  })
@@ -2190,9 +2197,6 @@ describe('DocumentDetailComponent', () => {
    const appendChildSpy = jest
      .spyOn(document.body, 'appendChild')
      .mockImplementation((node: Node) => node)
-    const removeChildSpy = jest
-      .spyOn(document.body, 'removeChild')
-      .mockImplementation((node: Node) => node)
    const createObjectURLSpy = jest
      .spyOn(URL, 'createObjectURL')
      .mockReturnValue('blob:mock-url')
@@ -2211,6 +2215,7 @@ describe('DocumentDetailComponent', () => {
      src: '',
      onload: null,
      contentWindow: mockContentWindow,
+      remove: jest.fn(),
    }

    const createElementSpy = jest
@@ -2254,12 +2259,11 @@ describe('DocumentDetailComponent', () => {
      mockContentWindow.onafterprint(new Event('afterprint'))
    }

-    expect(removeChildSpy).toHaveBeenCalledWith(mockIframe)
+    expect(mockIframe.remove).toHaveBeenCalled()
    expect(revokeObjectURLSpy).toHaveBeenCalledWith('blob:mock-url')

    createElementSpy.mockRestore()
    appendChildSpy.mockRestore()
-    removeChildSpy.mockRestore()
    createObjectURLSpy.mockRestore()
    revokeObjectURLSpy.mockRestore()
  })
@@ -2306,9 +2310,6 @@ describe('DocumentDetailComponent', () => {
      const appendChildSpy = jest
        .spyOn(document.body, 'appendChild')
        .mockImplementation((node: Node) => node)
-      const removeChildSpy = jest
-        .spyOn(document.body, 'removeChild')
-        .mockImplementation((node: Node) => node)
      const createObjectURLSpy = jest
        .spyOn(URL, 'createObjectURL')
        .mockReturnValue('blob:mock-url')
@@ -2331,6 +2332,7 @@ describe('DocumentDetailComponent', () => {
        src: '',
        onload: null,
        contentWindow: mockContentWindow,
+        remove: jest.fn(),
      }

      const createElementSpy = jest
@@ -2353,15 +2355,21 @@ describe('DocumentDetailComponent', () => {

      if (expectToast) {
        expect(toastSpy).toHaveBeenCalled()
+        expect(mockIframe.remove).toHaveBeenCalled()
+        expect(revokeObjectURLSpy).toHaveBeenCalledWith('blob:mock-url')
      } else {
        expect(toastSpy).not.toHaveBeenCalled()
+        expect(mockIframe.remove).not.toHaveBeenCalled()
+        expect(revokeObjectURLSpy).not.toHaveBeenCalled()
+
+        component.ngOnDestroy()
+
+        expect(mockIframe.remove).toHaveBeenCalled()
+        expect(revokeObjectURLSpy).toHaveBeenCalledWith('blob:mock-url')
      }
-      expect(removeChildSpy).toHaveBeenCalledWith(mockIframe)
-      expect(revokeObjectURLSpy).toHaveBeenCalledWith('blob:mock-url')

      createElementSpy.mockRestore()
      appendChildSpy.mockRestore()
-      removeChildSpy.mockRestore()
      createObjectURLSpy.mockRestore()
      revokeObjectURLSpy.mockRestore()
    })
@@ -249,6 +249,7 @@ export class DocumentDetailComponent
  titleSubject: Subject<string> = new Subject()
  readonly previewUrl = signal<string>(undefined)
  readonly pdfSource = signal<string>(undefined)
+  readonly previewRevision = signal(0)
  readonly pdfPassword = signal<string>(undefined)
  readonly thumbUrl = signal<string>(undefined)
  readonly previewText = signal<string>(undefined)
@@ -288,6 +289,8 @@ export class DocumentDetailComponent
  private incomingUpdateModal: NgbModalRef
  private pendingIncomingUpdate: IncomingDocumentUpdate
  private lastLocalSaveModified: string | null = null
+  private printIframe: HTMLIFrameElement | null = null
+  private printBlobUrl: string | null = null

  requiresPassword: boolean = false
  password: string
@@ -609,6 +612,9 @@ export class DocumentDetailComponent
              .subscribe()
          }
          this.updateComponent(useDoc)
+          if (forceRemote) {
+            this.previewRevision.update((revision) => revision + 1)
+          }
          this.titleSubject
            .pipe(
              debounceTime(1000),
@@ -864,6 +870,7 @@ export class DocumentDetailComponent
  }

  ngOnDestroy(): void {
+    this.cleanupPrintDocument()
    this.unsubscribeNotifier.next(this)
    this.unsubscribeNotifier.complete()
  }
@@ -1885,6 +1892,7 @@ export class DocumentDetailComponent
  }

  printDocument() {
+    this.cleanupPrintDocument()
    const selectedVersionId = this.getSelectedNonLatestVersionId()
    const printUrl = this.documentsService.getDownloadUrl(
      this.document().id,
@@ -1898,6 +1906,8 @@ export class DocumentDetailComponent
        next: (blob) => {
          const blobUrl = URL.createObjectURL(blob)
          const iframe = document.createElement('iframe')
+          this.printIframe = iframe
+          this.printBlobUrl = blobUrl
          iframe.style.position = 'fixed'
          iframe.style.right = '0'
          iframe.style.bottom = '0'
@@ -1913,22 +1923,19 @@ export class DocumentDetailComponent
                iframe.contentWindow.focus()
                iframe.contentWindow.print()
                iframe.contentWindow.onafterprint = () => {
-                  document.body.removeChild(iframe)
-                  URL.revokeObjectURL(blobUrl)
+                  this.cleanupPrintDocument()
                }
              } catch (err) {
                // FF throws cross-origin error on onafterprint
                const isCrossOriginAfterPrintError =
                  err instanceof DOMException &&
                  err.message.includes('onafterprint')
+                // FF throws here while print preview is still reading the iframe
+                // so keep it alive until the next print or teardown
                if (!isCrossOriginAfterPrintError) {
                  this.toastService.showError($localize`Print failed.`, err)
+                  timer(100).subscribe(() => this.cleanupPrintDocument())
                }
-                timer(100).subscribe(() => {
-                  // delay to avoid FF print failure
-                  document.body.removeChild(iframe)
-                  URL.revokeObjectURL(blobUrl)
-                })
              }
            })
          }
@@ -1941,9 +1948,20 @@ export class DocumentDetailComponent
      })
  }

+  private cleanupPrintDocument() {
+    if (this.printIframe) this.printIframe.remove()
+    this.printIframe = null
+    if (this.printBlobUrl) {
+      URL.revokeObjectURL(this.printBlobUrl)
+      this.printBlobUrl = null
+    }
+  }
+
  public openShareLinks() {
    const modal = this.modalService.open(ShareLinksDialogComponent)
-    modal.componentInstance.documentId.set(this.document().id)
+    modal.componentInstance.documentId.set(
+      this.selectedVersionId() ?? this.document().id
+    )
    modal.componentInstance.hasArchiveVersion.set(
      this.metadata()?.has_archive_version ??
        !!this.document()?.archived_file_name
@@ -1,6 +1,6 @@
@if (loading()) {
    <div class="d-flex">
-        <output class="spinner-border spinner-border-sm fw-normal" role="status"></output>
+        <output class="spinner-border spinner-border-sm fw-normal"></output>
    </div>
 } @else {
    <ul class="list-group">
@@ -26,11 +26,11 @@ import { UserService } from 'src/app/services/rest/user.service'
  ],
 })
 export class DocumentHistoryComponent implements OnInit {
-  private documentService = inject(DocumentService)
-  private correspondentService = inject(CorrespondentService)
-  private storagePathService = inject(StoragePathService)
-  private documentTypeService = inject(DocumentTypeService)
-  private userService = inject(UserService)
+  private readonly documentService = inject(DocumentService)
+  private readonly correspondentService = inject(CorrespondentService)
+  private readonly storagePathService = inject(StoragePathService)
+  private readonly documentTypeService = inject(DocumentTypeService)
+  private readonly userService = inject(UserService)

  public AuditLogAction = AuditLogAction

@@ -70,7 +70,7 @@ export class DocumentHistoryComponent implements OnInit {
      return cached
    }

-    const idInt = parseInt(id, 10)
+    const idInt = Number.parseInt(id, 10)
    const fallback$ = of(id)

    let result$: Observable<string>
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`/etc/s6-overlay/s6-rc.d/init-llmindex-migrate/run`