Normalize and casefold input in TitleContentFilter

Bumps the actions group with 4 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact), [actions/cache](https://github.com/actions/cache), [actions/download-artifact](https://github.com/actions/download-artifact) and [dessant/lock-threads](https://github.com/dessant/lock-threads).


Updates `actions/upload-artifact` from 5 to 6
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v5...v6)

Updates `actions/cache` from 4 to 5
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v4...v5)

Updates `actions/download-artifact` from 6 to 7
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v6...v7)

Updates `dessant/lock-threads` from 5 to 6
- [Release notes](https://github.com/dessant/lock-threads/releases)
- [Changelog](https://github.com/dessant/lock-threads/blob/main/CHANGELOG.md)
- [Commits](https://github.com/dessant/lock-threads/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/cache
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/download-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: dessant/lock-threads
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.devcontainer/vscode/tasks.json

@@ -116,9 +116,9 @@
 		},
 		{
 			"label": "Maintenance: Build Documentation",
-			"description": "Build the documentation with Zensical",
+			"description": "Build the documentation with MkDocs",
 			"type": "shell",
-			"command": "uv run zensical build && uv run zensical serve",
+			"command": "uv run mkdocs build --config-file mkdocs.yml && uv run mkdocs serve",
 			"group": "none",
 			"presentation": {
 				"echo": true,

.github/dependabot.yml

@@ -46,7 +46,7 @@ updates:
         patterns:
           - "*pytest*"
           - "ruff"
-          - "zensical"
+          - "mkdocs-material"
           - "pre-commit*"
       # Django & DRF Ecosystem
       django-ecosystem:

.github/release-drafter.yml

@@ -44,7 +44,6 @@ include-labels:
   - 'notable'
 exclude-labels:
   - 'skip-changelog'
-filter-by-commitish: true
 category-template: '### $TITLE'
 change-template: '- $TITLE @$AUTHOR ([#$NUMBER]($URL))'
 change-title-escapes: '\<*_&#@'

.github/workflows/ci.yml

@@ -11,10 +11,6 @@ on:
   pull_request:
     branches-ignore:
       - 'translations**'
-permissions:
-  contents: read
-  pages: write
-  id-token: write
 env:
   DEFAULT_UV_VERSION: "0.9.x"
   # This is the default version of Python to use in most steps which aren't specific
@@ -79,12 +75,11 @@ jobs:
       - name: Check files
         uses: pre-commit/action@v3.0.1
   documentation:
-    name: "Build Documentation"
+    name: "Build & Deploy Documentation"
     runs-on: ubuntu-24.04
     needs:
       - pre-commit
     steps:
-      - uses: actions/configure-pages@v5
       - name: Checkout
         uses: actions/checkout@v6
       - name: Set up Python
@@ -107,30 +102,24 @@ jobs:
             --python ${{ steps.setup-python.outputs.python-version }} \
             --dev \
             --frozen \
-            zensical build --clean
-      - name: Upload documentation artifact
-        uses: actions/upload-artifact@v5
+            mkdocs build --config-file ./mkdocs.yml
+      - name: Deploy documentation
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: |
+          echo "docs.paperless-ngx.com" > "${{ github.workspace }}/docs/CNAME"
+          git config --global user.name "${{ github.actor }}"
+          git config --global user.email "${{ github.actor }}@users.noreply.github.com"
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            --dev \
+            --frozen \
+            mkdocs gh-deploy --force --no-history
+      - name: Upload artifact
+        uses: actions/upload-artifact@v6
         with:
           name: documentation
           path: site/
-      - uses: actions/upload-pages-artifact@v4
-        with:
-          path: site
-          name: github-pages-${{ github.run_id }}-${{ github.run_attempt }}
-  deploy-documentation:
-    name: "Deploy Documentation"
-    runs-on: ubuntu-24.04
-    needs:
-      - documentation
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    steps:
-      - uses: actions/deploy-pages@v4
-        id: deployment
-        with:
-          artifact_name: github-pages-${{ github.run_id }}-${{ github.run_attempt }}
+          retention-days: 7
   tests-backend:
     name: "Backend Tests (Python ${{ matrix.python-version }})"
     runs-on: ubuntu-24.04
@@ -226,7 +215,7 @@ jobs:
           cache-dependency-path: 'src-ui/pnpm-lock.yaml'
       - name: Cache frontend dependencies
         id: cache-frontend-deps
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.pnpm-store
@@ -259,7 +248,7 @@ jobs:
           cache-dependency-path: 'src-ui/pnpm-lock.yaml'
       - name: Cache frontend dependencies
         id: cache-frontend-deps
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.pnpm-store
@@ -312,7 +301,7 @@ jobs:
           cache-dependency-path: 'src-ui/pnpm-lock.yaml'
       - name: Cache frontend dependencies
         id: cache-frontend-deps
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.pnpm-store
@@ -344,7 +333,7 @@ jobs:
           cache-dependency-path: 'src-ui/pnpm-lock.yaml'
       - name: Cache frontend dependencies
         id: cache-frontend-deps
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.pnpm-store
@@ -359,9 +348,6 @@ jobs:
   build-docker-image:
     name: Build Docker image for ${{ github.event_name == 'pull_request' && github.head_ref || github.ref_name }}
     runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-      packages: write
     if: (github.event_name == 'push' && (startsWith(github.ref, 'refs/heads/feature-') || startsWith(github.ref, 'refs/heads/fix-') || github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/beta' || contains(github.ref, 'beta.rc') || startsWith(github.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/heads/l10n_'))) || (github.event_name == 'pull_request' && (startsWith(github.head_ref, 'feature-') || startsWith(github.head_ref, 'fix-') || github.head_ref == 'dev' || github.head_ref == 'beta' || contains(github.head_ref, 'beta.rc') || startsWith(github.head_ref, 'l10n_')))
     concurrency:
       group: ${{ github.workflow }}-build-docker-image-${{ github.ref_name }}
@@ -490,7 +476,7 @@ jobs:
           docker cp frontend-extract:/usr/src/paperless/src/documents/static/frontend src/documents/static/frontend/
       - name: Upload frontend artifact
         if: steps.build-vars.outputs.can-push == 'true'
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: frontend-compiled
           path: src/documents/static/frontend/
@@ -524,12 +510,12 @@ jobs:
           sudo apt-get update -qq
           sudo apt-get install -qq --no-install-recommends gettext liblept5
       - name: Download frontend artifact
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         with:
           name: frontend-compiled
           path: src/documents/static/frontend/
       - name: Download documentation artifact
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         with:
           name: documentation
           path: docs/_build/html/
@@ -592,7 +578,7 @@ jobs:
           sudo chown -R 1000:1000 paperless-ngx/
           tar -cJf paperless-ngx.tar.xz paperless-ngx/
       - name: Upload release artifact
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: release
           path: dist/paperless-ngx.tar.xz
@@ -600,8 +586,6 @@ jobs:
   publish-release:
     name: "Publish Release"
     runs-on: ubuntu-24.04
-    permissions:
-      contents: write
     outputs:
       prerelease: ${{ steps.get_version.outputs.prerelease }}
       changelog: ${{ steps.create-release.outputs.body }}
@@ -611,7 +595,7 @@ jobs:
     if: github.ref_type == 'tag' && (startsWith(github.ref_name, 'v') || contains(github.ref_name, '-beta.rc'))
     steps:
       - name: Download release artifact
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         with:
           name: release
           path: ./
@@ -633,7 +617,6 @@ jobs:
           version: ${{ steps.get_version.outputs.version }}
           prerelease: ${{ steps.get_version.outputs.prerelease }}
           publish: true # ensures release is not marked as draft
-          commitish: main
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Upload release archive
@@ -648,10 +631,6 @@ jobs:
   append-changelog:
     name: "Append Changelog"
     runs-on: ubuntu-24.04
-    permissions:
-      contents: write
-      pull-requests: write
-      issues: write
     needs:
       - publish-release
     if: needs.publish-release.outputs.prerelease == 'false'

.github/workflows/repo-maintenance.yml

@@ -37,7 +37,7 @@ jobs:
     if: github.repository_owner == 'paperless-ngx'
     runs-on: ubuntu-24.04
     steps:
-      - uses: dessant/lock-threads@v5
+      - uses: dessant/lock-threads@v6
         with:
           issue-inactive-days: '30'
           pr-inactive-days: '30'

.github/workflows/translate-strings.yml

@@ -12,9 +12,11 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
+        env:
+          GH_REF: ${{ github.ref }} # sonar rule:githubactions:S7630 - avoid injection
         with:
           token: ${{ secrets.PNGX_BOT_PAT }}
-          ref: ${{ github.head_ref }}
+          ref: ${{ env.GH_REF }}
       - name: Set up Python
         id: setup-python
         uses: actions/setup-python@v6
@@ -45,7 +47,7 @@ jobs:
           cache-dependency-path: 'src-ui/pnpm-lock.yaml'
       - name: Cache frontend dependencies
         id: cache-frontend-deps
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.pnpm-store

.gitignore

@@ -53,7 +53,7 @@ junit.xml
 # Django stuff:
 *.log
 
-# Zensical documentation
+# MkDocs documentation
 site/
 
 # PyBuilder

docker/management_script.sh

@@ -5,13 +5,10 @@ set -e
 
 cd "${PAPERLESS_SRC_DIR}"
 
-if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py management_command "$@"
-elif [[ $(id -u) == 0 ]]; then
+if [[ $(id -u) == 0 ]]; then
 	s6-setuidgid paperless python3 manage.py management_command "$@"
 elif [[ $(id -un) == "paperless" ]]; then
 	python3 manage.py management_command "$@"
 else
 	echo "Unknown user."
-	exit 1
 fi

docker/rootfs/usr/local/bin/convert_mariadb_uuid

@@ -5,13 +5,10 @@ set -e
 
 cd "${PAPERLESS_SRC_DIR}"
 
-if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py convert_mariadb_uuid "$@"
-elif [[ $(id -u) == 0 ]]; then
+if [[ $(id -u) == 0 ]]; then
 	s6-setuidgid paperless python3 manage.py convert_mariadb_uuid "$@"
 elif [[ $(id -un) == "paperless" ]]; then
 	python3 manage.py convert_mariadb_uuid "$@"
 else
 	echo "Unknown user."
-	exit 1
 fi

docker/rootfs/usr/local/bin/createsuperuser

@@ -5,13 +5,10 @@ set -e
 
 cd "${PAPERLESS_SRC_DIR}"
 
-if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py createsuperuser "$@"
-elif [[ $(id -u) == 0 ]]; then
+if [[ $(id -u) == 0 ]]; then
 	s6-setuidgid paperless python3 manage.py createsuperuser "$@"
 elif [[ $(id -un) == "paperless" ]]; then
 	python3 manage.py createsuperuser "$@"
 else
 	echo "Unknown user."
-	exit 1
 fi

docker/rootfs/usr/local/bin/decrypt_documents

@@ -5,13 +5,10 @@ set -e
 
 cd "${PAPERLESS_SRC_DIR}"
 
-if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py decrypt_documents "$@"
-elif [[ $(id -u) == 0 ]]; then
+if [[ $(id -u) == 0 ]]; then
 	s6-setuidgid paperless python3 manage.py decrypt_documents "$@"
 elif [[ $(id -un) == "paperless" ]]; then
 	python3 manage.py decrypt_documents "$@"
 else
 	echo "Unknown user."
-	exit 1
 fi

docker/rootfs/usr/local/bin/document_archiver

@@ -5,13 +5,10 @@ set -e
 
 cd "${PAPERLESS_SRC_DIR}"
 
-if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py document_archiver "$@"
-elif [[ $(id -u) == 0 ]]; then
+if [[ $(id -u) == 0 ]]; then
 	s6-setuidgid paperless python3 manage.py document_archiver "$@"
 elif [[ $(id -un) == "paperless" ]]; then
 	python3 manage.py document_archiver "$@"
 else
 	echo "Unknown user."
-	exit 1
 fi

docker/rootfs/usr/local/bin/document_create_classifier

@@ -5,13 +5,10 @@ set -e
 
 cd "${PAPERLESS_SRC_DIR}"
 
-if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py document_create_classifier "$@"
-elif [[ $(id -u) == 0 ]]; then
+if [[ $(id -u) == 0 ]]; then
 	s6-setuidgid paperless python3 manage.py document_create_classifier "$@"
 elif [[ $(id -un) == "paperless" ]]; then
 	python3 manage.py document_create_classifier "$@"
 else
 	echo "Unknown user."
-	exit 1
 fi

docker/rootfs/usr/local/bin/document_exporter

@@ -5,13 +5,10 @@ set -e
 
 cd "${PAPERLESS_SRC_DIR}"
 
-if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py document_exporter "$@"
-elif [[ $(id -u) == 0 ]]; then
+if [[ $(id -u) == 0 ]]; then
 	s6-setuidgid paperless python3 manage.py document_exporter "$@"
 elif [[ $(id -un) == "paperless" ]]; then
 	python3 manage.py document_exporter "$@"
 else
 	echo "Unknown user."
-	exit 1
 fi

docker/rootfs/usr/local/bin/document_fuzzy_match

@@ -5,13 +5,10 @@ set -e
 
 cd "${PAPERLESS_SRC_DIR}"
 
-if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py document_fuzzy_match "$@"
-elif [[ $(id -u) == 0 ]]; then
+if [[ $(id -u) == 0 ]]; then
 	s6-setuidgid paperless python3 manage.py document_fuzzy_match "$@"
 elif [[ $(id -un) == "paperless" ]]; then
 	python3 manage.py document_fuzzy_match "$@"
 else
 	echo "Unknown user."
-	exit 1
 fi

docker/rootfs/usr/local/bin/document_importer

@@ -5,13 +5,10 @@ set -e
 
 cd "${PAPERLESS_SRC_DIR}"
 
-if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py document_importer "$@"
-elif [[ $(id -u) == 0 ]]; then
+if [[ $(id -u) == 0 ]]; then
 	s6-setuidgid paperless python3 manage.py document_importer "$@"
 elif [[ $(id -un) == "paperless" ]]; then
 	python3 manage.py document_importer "$@"
 else
 	echo "Unknown user."
-	exit 1
 fi

docker/rootfs/usr/local/bin/document_index

@@ -5,13 +5,10 @@ set -e
 
 cd "${PAPERLESS_SRC_DIR}"
 
-if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py document_index "$@"
-elif [[ $(id -u) == 0 ]]; then
+if [[ $(id -u) == 0 ]]; then
 	s6-setuidgid paperless python3 manage.py document_index "$@"
 elif [[ $(id -un) == "paperless" ]]; then
 	python3 manage.py document_index "$@"
 else
 	echo "Unknown user."
-	exit 1
 fi

docker/rootfs/usr/local/bin/document_renamer

@@ -5,13 +5,10 @@ set -e
 
 cd "${PAPERLESS_SRC_DIR}"
 
-if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py document_renamer "$@"
-elif [[ $(id -u) == 0 ]]; then
+if [[ $(id -u) == 0 ]]; then
 	s6-setuidgid paperless python3 manage.py document_renamer "$@"
 elif [[ $(id -un) == "paperless" ]]; then
 	python3 manage.py document_renamer "$@"
 else
 	echo "Unknown user."
-	exit 1
 fi

docker/rootfs/usr/local/bin/document_retagger

@@ -5,13 +5,10 @@ set -e
 
 cd "${PAPERLESS_SRC_DIR}"
 
-if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py document_retagger "$@"
-elif [[ $(id -u) == 0 ]]; then
+if [[ $(id -u) == 0 ]]; then
 	s6-setuidgid paperless python3 manage.py document_retagger "$@"
 elif [[ $(id -un) == "paperless" ]]; then
 	python3 manage.py document_retagger "$@"
 else
 	echo "Unknown user."
-	exit 1
 fi

docker/rootfs/usr/local/bin/document_sanity_checker

@@ -5,13 +5,10 @@ set -e
 
 cd "${PAPERLESS_SRC_DIR}"
 
-if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py document_sanity_checker "$@"
-elif [[ $(id -u) == 0 ]]; then
+if [[ $(id -u) == 0 ]]; then
 	s6-setuidgid paperless python3 manage.py document_sanity_checker "$@"
 elif [[ $(id -un) == "paperless" ]]; then
 	python3 manage.py document_sanity_checker "$@"
 else
 	echo "Unknown user."
-	exit 1
 fi

docker/rootfs/usr/local/bin/document_thumbnails

@@ -5,13 +5,10 @@ set -e
 
 cd "${PAPERLESS_SRC_DIR}"
 
-if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py document_thumbnails "$@"
-elif [[ $(id -u) == 0 ]]; then
+if [[ $(id -u) == 0 ]]; then
 	s6-setuidgid paperless python3 manage.py document_thumbnails "$@"
 elif [[ $(id -un) == "paperless" ]]; then
 	python3 manage.py document_thumbnails "$@"
 else
 	echo "Unknown user."
-	exit 1
 fi

docker/rootfs/usr/local/bin/mail_fetcher

@@ -5,13 +5,10 @@ set -e
 
 cd "${PAPERLESS_SRC_DIR}"
 
-if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py mail_fetcher "$@"
-elif [[ $(id -u) == 0 ]]; then
+if [[ $(id -u) == 0 ]]; then
 	s6-setuidgid paperless python3 manage.py mail_fetcher "$@"
 elif [[ $(id -un) == "paperless" ]]; then
 	python3 manage.py mail_fetcher "$@"
 else
 	echo "Unknown user."
-	exit 1
 fi

docker/rootfs/usr/local/bin/manage_superuser

@@ -5,13 +5,10 @@ set -e
 
 cd "${PAPERLESS_SRC_DIR}"
 
-if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py manage_superuser "$@"
-elif [[ $(id -u) == 0 ]]; then
+if [[ $(id -u) == 0 ]]; then
 	s6-setuidgid paperless python3 manage.py manage_superuser "$@"
 elif [[ $(id -un) == "paperless" ]]; then
 	python3 manage.py manage_superuser "$@"
 else
 	echo "Unknown user."
-	exit 1
 fi

docker/rootfs/usr/local/bin/prune_audit_logs

@@ -5,13 +5,10 @@ set -e
 
 cd "${PAPERLESS_SRC_DIR}"
 
-if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py prune_audit_logs "$@"
-elif [[ $(id -u) == 0 ]]; then
+if [[ $(id -u) == 0 ]]; then
 	s6-setuidgid paperless python3 manage.py prune_audit_logs "$@"
 elif [[ $(id -un) == "paperless" ]]; then
 	python3 manage.py prune_audit_logs "$@"
 else
 	echo "Unknown user."
-	exit 1
 fi

docs/advanced_usage.md

@@ -431,10 +431,8 @@ This allows for complex logic to be included in the format, including [logical s
 and [filters](https://jinja.palletsprojects.com/en/3.1.x/templates/#id11) to manipulate the [variables](#filename-format-variables)
 provided. The template is provided as a string, potentially multiline, and rendered into a single line.
 
-In addition, a limited `document` object is available for advanced templates.
-This object includes common metadata fields such as `id`, `pk`, `title`, `content`, `page_count`, `created`, `added`, `modified`, `mime_type`,
-`checksum`, `archive_checksum`, `archive_serial_number`, `filename`, `archive_filename`, and `original_filename`.
-Related values are available as nested objects with limited fields, for example document.correspondent.name, etc.
+In addition, the entire Document instance is available to be utilized in a more advanced way, as well as some variables which only make sense to be accessed
+with more complex logic.
 
 #### Custom Jinja2 Filters
 

docs/api.md

@@ -1,4 +1,4 @@
-# REST API
+# The REST API
 
 Paperless-ngx now ships with a fully-documented REST API and a browsable
 web interface to explore it. The API browsable interface is available at

docs/assets/extra.css

@@ -1,31 +1,13 @@
-:root>* {
-    --paperless-green: #17541f;
-    --paperless-green-accent: #2b8a38;
-    --md-primary-fg-color: var(--paperless-green);
-    --md-primary-fg-color--dark: var(--paperless-green);
-    --md-primary-fg-color--light: var(--paperless-green-accent);
-    --md-accent-fg-color: var(--paperless-green-accent);
+:root > * {
+    --md-primary-fg-color: #17541f;
+    --md-primary-fg-color--dark: #17541f;
+    --md-primary-fg-color--light: #17541f;
+    --md-accent-fg-color: #2b8a38;
     --md-typeset-a-color: #21652a;
 }
 
-.md-header,
-.md-tabs {
-    background-color: var(--paperless-green);
-    color: #fff;
-}
-
-.md-tabs__link {
-    color: rgba(255, 255, 255, 0.82);
-}
-
-.md-tabs__link:hover,
-.md-tabs__link--active {
-    color: #fff;
-}
-
 [data-md-color-scheme="slate"] {
     --md-hue: 222;
-    --md-default-bg-color: hsla(var(--md-hue), 15%, 10%, 1);
 }
 
 @media (min-width: 768px) {
@@ -87,8 +69,8 @@ h4 code {
 }
 
 /* Hide config vars from sidebar, toc and move the border on mobile case their hidden */
-.md-nav.md-nav--secondary .md-nav__item:has(> .md-nav__link[href*="PAPERLESS_"]),
-.md-nav.md-nav--secondary .md-nav__item:has(> .md-nav__link[href*="USERMAP_"]) {
+.md-nav.md-nav--secondary .md-nav__item .md-nav__link[href*="PAPERLESS_"],
+.md-nav.md-nav--secondary .md-nav__item .md-nav__link[href*="USERMAP_"] {
     display: none;
 }
 
@@ -101,3 +83,18 @@ h4 code {
         border-top: .05rem solid var(--md-default-fg-color--lightest);
     }
 }
+
+/* Show search shortcut key */
+[data-md-toggle="search"]:not(:checked) ~ .md-header .md-search__form::after {
+    position: absolute;
+    top: .3rem;
+    right: .3rem;
+    display: block;
+    padding: .1rem .4rem;
+    color: var(--md-default-fg-color--lighter);
+    font-weight: bold;
+    font-size: .8rem;
+    border: .05rem solid var(--md-default-fg-color--lighter);
+    border-radius: .1rem;
+    content: "/";
+  }

docs/changelog.md

@@ -1,149 +1,9 @@
 # Changelog
 
-## paperless-ngx 2.20.10
-
-### Bug Fixes
-
--   Fix: support string coercion in filepath jinja templates [@shamoon](https://github.com/shamoon) ([#12244](https://github.com/paperless-ngx/paperless-ngx/pull/12244))
--   Fix: apply ordering after annotating tag document count [@shamoon](https://github.com/shamoon) ([#12238](https://github.com/paperless-ngx/paperless-ngx/pull/12238))
--   Fix: enforce path limit for db filename fields [@shamoon](https://github.com/shamoon) ([#12235](https://github.com/paperless-ngx/paperless-ngx/pull/12235))
-
-### All App Changes
-
-<details>
-<summary>3 changes</summary>
-
--   Fix: support string coercion in filepath jinja templates [@shamoon](https://github.com/shamoon) ([#12244](https://github.com/paperless-ngx/paperless-ngx/pull/12244))
--   Fix: apply ordering after annotating tag document count [@shamoon](https://github.com/shamoon) ([#12238](https://github.com/paperless-ngx/paperless-ngx/pull/12238))
--   Fix: enforce path limit for db filename fields [@shamoon](https://github.com/shamoon) ([#12235](https://github.com/paperless-ngx/paperless-ngx/pull/12235))
-</details>
-
-## paperless-ngx 2.20.9
-
-### Security
-
--   Resolve [GHSA-386h-chg4-cfw9](https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-386h-chg4-cfw9)
-
-### Bug Fixes
-
--   Fixhancement: config option reset [@shamoon](https://github.com/shamoon) ([#12176](https://github.com/paperless-ngx/paperless-ngx/pull/12176))
--   Fix: correct page count by separating display vs collection sizes for tags [@shamoon](https://github.com/shamoon) ([#12170](https://github.com/paperless-ngx/paperless-ngx/pull/12170))
-
-### All App Changes
-
-<details>
-<summary>2 changes</summary>
-
--   Fixhancement: config option reset [@shamoon](https://github.com/shamoon) ([#12176](https://github.com/paperless-ngx/paperless-ngx/pull/12176))
--   Fix: correct page count by separating display vs collection sizes for tags [@shamoon](https://github.com/shamoon) ([#12170](https://github.com/paperless-ngx/paperless-ngx/pull/12170))
-</details>
-
-## paperless-ngx 2.20.8
-
-### Security
-
--   Resolve [GHSA-7qqc-wrcw-2fj9](https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-7qqc-wrcw-2fj9)
-
-## paperless-ngx 2.20.7
-
-### Security
-
--   Resolve [GHSA-x395-6h48-wr8v](https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-x395-6h48-wr8v)
-
-### Bug Fixes
-
--   Performance fix: use subqueries to improve object retrieval in large installs [@shamoon](https://github.com/shamoon) ([#11950](https://github.com/paperless-ngx/paperless-ngx/pull/11950))
--   Fix: correct user dropdown button icon styling [@shamoon](https://github.com/shamoon) ([#12092](https://github.com/paperless-ngx/paperless-ngx/issues/12092))
--   Fix: fix broken docker create_classifier command in 2.20.6 [@shamoon](https://github.com/shamoon) ([#11965](https://github.com/paperless-ngx/paperless-ngx/issues/11965))
-
-### All App Changes
-
-<details>
-<summary>3 changes</summary>
-
--   Performance fix: use subqueries to improve object retrieval in large installs [@shamoon](https://github.com/shamoon) ([#11950](https://github.com/paperless-ngx/paperless-ngx/pull/11950))
--   Fix: correct user dropdown button icon styling [@shamoon](https://github.com/shamoon) ([#12092](https://github.com/paperless-ngx/paperless-ngx/issues/12092))
--   Fix: fix broken docker create_classifier command in 2.20.6 [@shamoon](https://github.com/shamoon) ([#11965](https://github.com/paperless-ngx/paperless-ngx/issues/11965))
-</details>
-
-## paperless-ngx 2.20.6
-
-### Security
-
--   Resolve [GHSA-jqwv-hx7q-fxh3](https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-jqwv-hx7q-fxh3) and [GHSA-w47q-3m69-84v8](https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-w47q-3m69-84v8)
-
-### Bug Fixes
-
--   Fix: extract all ids for nested tags [@shamoon](https://github.com/shamoon) ([#11888](https://github.com/paperless-ngx/paperless-ngx/pull/11888))
--   Fixhancement: change date calculation for 'this year' to include future documents [@shamoon](https://github.com/shamoon) ([#11884](https://github.com/paperless-ngx/paperless-ngx/pull/11884))
--   Fix: Running management scripts under rootless could fail [@stumpylog](https://github.com/stumpylog) ([#11870](https://github.com/paperless-ngx/paperless-ngx/pull/11870))
--   Fix: use correct field id for overrides [@shamoon](https://github.com/shamoon) ([#11869](https://github.com/paperless-ngx/paperless-ngx/pull/11869))
-
-### All App Changes
-
-<details>
-<summary>3 changes</summary>
-
--   Fix: extract all ids for nested tags [@shamoon](https://github.com/shamoon) ([#11888](https://github.com/paperless-ngx/paperless-ngx/pull/11888))
--   Fixhancement: change date calculation for 'this year' to include future documents [@shamoon](https://github.com/shamoon) ([#11884](https://github.com/paperless-ngx/paperless-ngx/pull/11884))
--   Fix: use correct field id for overrides [@shamoon](https://github.com/shamoon) ([#11869](https://github.com/paperless-ngx/paperless-ngx/pull/11869))
-</details>
-
-## paperless-ngx 2.20.5
-
-### Bug Fixes
-
--   Fix: ensure horizontal scroll for long tag names in list, wrap tags without parent [@shamoon](https://github.com/shamoon) ([#11811](https://github.com/paperless-ngx/paperless-ngx/pull/11811))
--   Fix: use explicit order field for workflow actions [@shamoon](https://github.com/shamoon) [@stumpylog](https://github.com/stumpylog) ([#11781](https://github.com/paperless-ngx/paperless-ngx/pull/11781))
-
-### All App Changes
-
-<details>
-<summary>2 changes</summary>
-
--   Fix: ensure horizontal scroll for long tag names in list, wrap tags without parent [@shamoon](https://github.com/shamoon) ([#11811](https://github.com/paperless-ngx/paperless-ngx/pull/11811))
--   Fix: use explicit order field for workflow actions [@shamoon](https://github.com/shamoon) [@stumpylog](https://github.com/stumpylog) ([#11781](https://github.com/paperless-ngx/paperless-ngx/pull/11781))
-</details>
-
-## paperless-ngx 2.20.4
-
-### Security
-
--   Resolve [GHSA-28cf-xvcf-hw6m](https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-28cf-xvcf-hw6m)
-
-### Bug Fixes
-
--   Fix: propagate metadata override created value [@shamoon](https://github.com/shamoon) ([#11659](https://github.com/paperless-ngx/paperless-ngx/pull/11659))
--   Fix: support ordering by storage path name [@shamoon](https://github.com/shamoon) ([#11661](https://github.com/paperless-ngx/paperless-ngx/pull/11661))
--   Fix: validate cf integer values within PostgreSQL range [@shamoon](https://github.com/shamoon) ([#11666](https://github.com/paperless-ngx/paperless-ngx/pull/11666))
--   Fixhancement: add error handling and retry when opening index [@shamoon](https://github.com/shamoon) ([#11731](https://github.com/paperless-ngx/paperless-ngx/pull/11731))
--   Fix: fix recurring workflow to respect latest run time [@shamoon](https://github.com/shamoon) ([#11735](https://github.com/paperless-ngx/paperless-ngx/pull/11735))
-
-### All App Changes
-
-<details>
-<summary>5 changes</summary>
-
--   Fix: propagate metadata override created value [@shamoon](https://github.com/shamoon) ([#11659](https://github.com/paperless-ngx/paperless-ngx/pull/11659))
--   Fix: support ordering by storage path name [@shamoon](https://github.com/shamoon) ([#11661](https://github.com/paperless-ngx/paperless-ngx/pull/11661))
--   Fix: validate cf integer values within PostgreSQL range [@shamoon](https://github.com/shamoon) ([#11666](https://github.com/paperless-ngx/paperless-ngx/pull/11666))
--   Fixhancement: add error handling and retry when opening index [@shamoon](https://github.com/shamoon) ([#11731](https://github.com/paperless-ngx/paperless-ngx/pull/11731))
--   Fix: fix recurring workflow to respect latest run time [@shamoon](https://github.com/shamoon) ([#11735](https://github.com/paperless-ngx/paperless-ngx/pull/11735))
-</details>
-
 ## paperless-ngx 2.20.3
 
-### Security
-
--   Resolve [GHSA-7cq3-mhxq-w946](https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-7cq3-mhxq-w946)
-
 ## paperless-ngx 2.20.2
 
-### Security
-
--   Resolve [GHSA-6653-vcx4-69mc](https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-6653-vcx4-69mc)
--   Resolve [GHSA-24x5-wp64-9fcc](https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-24x5-wp64-9fcc)
-
 ### Features / Enhancements
 
 -   Tweakhancement: dim inactive users in users-groups list [@shamoon](https://github.com/shamoon) ([#11537](https://github.com/paperless-ngx/paperless-ngx/pull/11537))

docs/configuration.md

@@ -170,18 +170,11 @@ Available options are `postgresql` and `mariadb`.
 
     !!! note
 
-        A pool of 8-10 connections per worker is typically sufficient.
-        If you encounter error messages such as `couldn't get a connection`
-        or database connection timeouts, you probably need to increase the pool size.
-
-    !!! warning
-        Make sure your PostgreSQL `max_connections` setting is large enough to handle the connection pools:
-        `(NB_PAPERLESS_WORKERS + NB_CELERY_WORKERS) × POOL_SIZE + SAFETY_MARGIN`. For example, with
-        4 Paperless workers and 2 Celery workers, and a pool size of 8:``(4 + 2) × 8 + 10 = 58`,
-        so `max_connections = 60` (or even more) is appropriate.
-
-        This assumes only Paperless-ngx connects to your PostgreSQL instance. If you have other applications,
-        you should increase `max_connections` accordingly.
+        A small pool is typically sufficient — for example, a size of 4.
+        Make sure your PostgreSQL server's max_connections setting is large enough to handle:
+        ```(Paperless workers + Celery workers) × pool size + safety margin```
+        For example, with 4 Paperless workers and 2 Celery workers, and a pool size of 4:
+        (4 + 2) × 4 + 10 = 34 connections required.
 
 #### [`PAPERLESS_DB_READ_CACHE_ENABLED=<bool>`](#PAPERLESS_DB_READ_CACHE_ENABLED) {#PAPERLESS_DB_READ_CACHE_ENABLED}
 

docs/development.md

@@ -338,13 +338,13 @@ LANGUAGES = [
 
 ## Building the documentation
 
-The documentation is built using Zensical, see their [documentation](https://zensical.org/docs/).
+The documentation is built using material-mkdocs, see their [documentation](https://squidfunk.github.io/mkdocs-material/reference/).
 If you want to build the documentation locally, this is how you do it:
 
 1.  Build the documentation
 
     ```bash
-    $ uv run zensical build
+    $ uv run mkdocs build --config-file mkdocs.yml
     ```
 
     _alternatively..._
@@ -355,10 +355,10 @@ If you want to build the documentation locally, this is how you do it:
     something.
 
     ```bash
-    $ uv run zensical serve
+    $ uv run mkdocs serve
     ```
 
-## Building the Docker image {#docker_build}
+## Building the Docker image
 
 The docker image is primarily built by the GitHub actions workflow, but
 it can be faster when developing to build and tag an image locally.

docs/faq.md

@@ -1,7 +1,3 @@
----
-title: FAQs
----
-
 # Frequently Asked Questions
 
 ## _What's the general plan for Paperless-ngx?_
@@ -67,10 +63,8 @@ elsewhere. Here are a couple notes about that.
     Paperless also supports various Office documents (.docx, .doc, odt,
     .ppt, .pptx, .odp, .xls, .xlsx, .ods).
 
-Paperless-ngx determines the type of a file by inspecting its content
-rather than its file extensions. However, files processed via the
-consumption directory will be rejected if they have a file extension that
-not supported by any of the available parsers.
+Paperless-ngx determines the type of a file by inspecting its content.
+The file extensions do not matter.
 
 ## _Will paperless-ngx run on Raspberry Pi?_
 

docs/index.md

@@ -1,7 +1,3 @@
----
-title: Home
----
-
 <div class="grid-left" markdown>
 ![image](assets/logo_full_black.svg#only-light){.index-logo}
 ![image](assets/logo_full_white.svg#only-dark){.index-logo}

docs/setup.md

@@ -1,77 +1,52 @@
----
-title: Setup
----
+## Installation
 
-# Installation
+You can go multiple routes to setup and run Paperless:
 
-!!! tip "Quick Start"
+-   [Use the script to setup a Docker install](#docker_script)
+-   [Use the Docker compose templates](#docker)
+-   [Build the Docker image yourself](#docker_build)
+-   [Install Paperless-ngx directly on your system manually ("bare metal")](#bare_metal)
+-   A user-maintained list of commercial hosting providers can be found [in the wiki](https://github.com/paperless-ngx/paperless-ngx/wiki/Related-Projects)
+
+The Docker routes are quick & easy. These are the recommended routes.
+This configures all the stuff from the above automatically so that it
+just works and uses sensible defaults for all configuration options.
+Here you find a cheat-sheet for docker beginners: [CLI
+Basics](https://www.sehn.tech/refs/devops-with-docker/)
+
+The bare metal route is complicated to setup but makes it easier should
+you want to contribute some code back. You need to configure and run the
+above mentioned components yourself.
+
+### Use the Installation Script {#docker_script}
+
+Paperless provides an interactive installation script to setup a Docker Compose
+installation. The script asks for a couple configuration options, and will then create the
+necessary configuration files, pull the docker image, start Paperless-ngx and create your superuser
+account. The script essentially automatically performs the steps described in [Docker setup](#docker).
+
+1.  Make sure that Docker and Docker Compose are [installed](https://docs.docker.com/engine/install/){:target="\_blank"}.
+
+2.  Download and run the installation script:
 
-    If you just want Paperless-ngx running quickly, use our installation script:
     ```shell-session
     bash -c "$(curl --location --silent --show-error https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/main/install-paperless-ngx.sh)"
     ```
-    _If piping into a shell directly from the internet makes you nervous, inspect [the script](https://github.com/paperless-ngx/paperless-ngx/blob/main/install-paperless-ngx.sh) first!_
 
-## Overview
+    !!! note
 
-Choose the installation route that best fits your setup:
+        macOS users will need to install [gnu-sed](https://formulae.brew.sh/formula/gnu-sed) with support
+        for running as `sed` as well as [wget](https://formulae.brew.sh/formula/wget).
 
-| Route                                                                                                             | Best for                                                                            | Effort |
-| ----------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | ------ |
-| [Installation script](#docker_script)                                                                             | Fastest first-time setup with guided prompts (recommended for most users)           | Low    |
-| [Docker Compose templates](#docker)                                                                               | Manual control over compose files and settings                                      | Medium |
-| [Bare metal](#bare_metal)                                                                                         | Advanced setups, packaging, and development-adjacent workflows                      | High   |
-| [Hosted providers (wiki)](https://github.com/paperless-ngx/paperless-ngx/wiki/Related-Projects#hosting-providers) | Managed hosting options maintained by the community — check details carefully | Varies |
+### Use Docker Compose {#docker}
 
-For most users, Docker is the best option. It is faster to set up,
-easier to maintain, and ships with sensible defaults.
+1.  Make sure that Docker and Docker Compose are [installed](https://docs.docker.com/engine/install/){:target="\_blank"}.
 
-The bare-metal route gives you more control, but it requires manual
-installation and operation of all components. It is usually best suited
-for advanced users and contributors.
-
-!!! info
-
-    Because [superuser](usage.md#superusers) accounts have full access to all objects and documents, you may want to create a separate user account for daily use,
-    or "downgrade" your superuser account to a normal user account after setup.
-
-## Installation Script {#docker_script}
-
-Paperless-ngx provides an interactive script for Docker Compose setups.
-It asks a few configuration questions, then creates the required files,
-pulls the image, starts the containers, and creates your [superuser](usage.md#superusers)
-account. In short, it automates the [Docker Compose setup](#docker) described below.
-
-#### Prerequisites
-
--   Docker and Docker Compose must be [installed](https://docs.docker.com/engine/install/){:target="\_blank"}.
--   macOS users will need [GNU sed](https://formulae.brew.sh/formula/gnu-sed) with support for running as `sed` as well as [wget](https://formulae.brew.sh/formula/wget).
-
-#### Run the installation script
-
-```shell-session
-bash -c "$(curl --location --silent --show-error https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/main/install-paperless-ngx.sh)"
-```
-
-#### After installation
-
-Paperless-ngx should be available at `http://127.0.0.1:8000` (or similar,
-depending on your configuration) and you will be able to login with the
-credentials you provided during the installation script.
-
-## Docker Compose Install {#docker}
-
-#### Prerequisites
-
--   Docker and Docker Compose must be [installed](https://docs.docker.com/engine/install/){:target="\_blank"}.
-
-#### Installation
-
-1.  Go to the [/docker/compose directory on the project
+2.  Go to the [/docker/compose directory on the project
     page](https://github.com/paperless-ngx/paperless-ngx/tree/main/docker/compose){:target="\_blank"}
-    and download one `docker-compose.*.yml` file for your preferred
-    database backend. Save it in a local directory as `docker-compose.yml`.
-    Also download `docker-compose.env` and `.env` into that same directory.
+    and download one of the `docker-compose.*.yml` files, depending on which database backend
+    you want to use. Place the files in a local directory and rename it `docker-compose.yml`. Download the
+    `docker-compose.env` file and the `.env` file as well in the same directory.
 
     If you want to enable optional support for Office and other documents, download a
     file with `-tika` in the file name.
@@ -81,16 +56,15 @@ credentials you provided during the installation script.
         For new installations, it is recommended to use PostgreSQL as the
         database backend.
 
-2.  Modify `docker-compose.yml` as needed. For example, you may want to
-    change the paths for `consume`, `media`, and other directories to
-    use bind mounts.
+3.  Modify `docker-compose.yml` as needed. For example, you may want to change the paths to the
+    consumption, media etc. directories to use 'bind mounts'.
     Find the line that specifies where to mount the directory, e.g.:
 
     ```yaml
     - ./consume:/usr/src/paperless/consume
     ```
 
-    Replace the part _before_ the colon with your local directory:
+    Replace the part _before_ the colon with a local directory of your choice:
 
     ```yaml
     - /home/jonaswinkler/paperless-inbox:/usr/src/paperless/consume
@@ -104,15 +78,38 @@ credentials you provided during the installation script.
         - 8010:8000
     ```
 
-3.  Modify `docker-compose.env` with any configuration options you need.
+    **Rootless**
+
+    !!! warning
+
+        It is currently not possible to run the container rootless if additional languages are specified via `PAPERLESS_OCR_LANGUAGES`.
+
+    If you want to run Paperless as a rootless container, you will need
+    to do the following in your `docker-compose.yml`:
+
+    -   set the `user` running the container to map to the `paperless`
+        user in the container. This value (`user_id` below), should be
+        the same id that `USERMAP_UID` and `USERMAP_GID` are set to in
+        the next step. See `USERMAP_UID` and `USERMAP_GID`
+        [here](configuration.md#docker).
+
+    Your entry for Paperless should contain something like:
+
+    > ```
+    > webserver:
+    >   image: ghcr.io/paperless-ngx/paperless-ngx:latest
+    >   user: <user_id>
+    > ```
+
+4.  Modify `docker-compose.env` with any configuration options you'd like.
     See the [configuration documentation](configuration.md) for all options.
 
     You may also need to set `USERMAP_UID` and `USERMAP_GID` to
-    the UID and GID of your user on the host system. Use `id -u` and
-    `id -g` to get these values. This ensures both the container and the
-    host user can write to the consumption directory. If your UID and
-    GID are `1000` (the default for the first normal user on many
-    systems), this usually works out of the box without
+    the uid and gid of your user on the host system. Use `id -u` and
+    `id -g` to get these. This ensures that both the container and the host
+    user have write access to the consumption directory. If your UID
+    and GID on the host system is 1000 (the default for the first normal
+    user on most systems), it will work out of the box without any
     modifications. Run `id "username"` to check.
 
     !!! note
@@ -121,62 +118,79 @@ credentials you provided during the installation script.
         appending `_FILE` to configuration values. For example [`PAPERLESS_DBUSER`](configuration.md#PAPERLESS_DBUSER)
         can be set using `PAPERLESS_DBUSER_FILE=/var/run/secrets/password.txt`.
 
-4.  Run `docker compose pull`. This pulls the image from the GitHub container registry
-    by default, but you can pull from Docker Hub by changing the `image`
+    !!! warning
+
+        Some file systems such as NFS network shares don't support file
+        system notifications with `inotify`. When storing the consumption
+        directory on such a file system, paperless will not pick up new
+        files with the default configuration. You will need to use
+        [`PAPERLESS_CONSUMER_POLLING`](configuration.md#PAPERLESS_CONSUMER_POLLING), which will disable inotify. See
+        [here](configuration.md#polling).
+
+5.  Run `docker compose pull`. This will pull the image from the GitHub container registry
+    by default but you can change the image to pull from Docker Hub by changing the `image`
     line to `image: paperlessngx/paperless-ngx:latest`.
 
-5.  Run `docker compose up -d`. This will create and start the necessary containers.
+6.  Run `docker compose up -d`. This will create and start the necessary containers.
 
-#### After installation
+7.  Congratulations! Your Paperless-ngx instance should now be accessible at `http://127.0.0.1:8000`
+    (or similar, depending on your configuration). When you first access the web interface, you will be
+    prompted to create a superuser account.
 
-Your Paperless-ngx instance should now be accessible at
-`http://127.0.0.1:8000` (or similar, depending on your configuration).
-When you first access the web interface, you will be prompted to create
-a [superuser](usage.md#superusers) account.
+### Build the Docker image yourself {#docker_build}
 
-#### Optional Advanced Compose Configurations {#advanced_compose data-toc-label="Advanced Compose Configurations"}
+1.  Clone the entire repository of paperless:
 
-**Rootless**
+    ```shell-session
+    git clone https://github.com/paperless-ngx/paperless-ngx
+    ```
 
-!!! warning
+    The main branch always reflects the latest stable version.
 
-    It is currently not possible to run the container rootless if additional languages are specified via `PAPERLESS_OCR_LANGUAGES`.
+2.  Copy one of the `docker/compose/docker-compose.*.yml` to
+    `docker-compose.yml` in the root folder, depending on which database
+    backend you want to use. Copy `docker-compose.env` into the project
+    root as well.
 
-If you want to run Paperless as a rootless container, make this
-change in `docker-compose.yml`:
+3.  In the `docker-compose.yml` file, find the line that instructs
+    Docker Compose to pull the paperless image from Docker Hub:
 
--   Set the `user` running the container to map to the `paperless`
-    user in the container. This value (`user_id` below) should be
-    the same ID that `USERMAP_UID` and `USERMAP_GID` are set to in
-    `docker-compose.env`. See `USERMAP_UID` and `USERMAP_GID`
-    [here](configuration.md#docker).
+    ```yaml
+    webserver:
+        image: ghcr.io/paperless-ngx/paperless-ngx:latest
+    ```
 
-Your entry for Paperless should contain something like:
+    and replace it with a line that instructs Docker Compose to build
+    the image from the current working directory instead:
 
-> ```
-> webserver:
->   image: ghcr.io/paperless-ngx/paperless-ngx:latest
->   user: <user_id>
-> ```
+    ```yaml
+    webserver:
+        build:
+            context: .
+    ```
 
-**File systems without inotify support (e.g. NFS)**
+4.  Follow the [Docker setup](#docker) above except when asked to run
+    `docker compose pull` to pull the image, run
 
-Some file systems, such as NFS network shares, don't support file system
-notifications with `inotify`. When the consumption directory is on such a
-file system, Paperless-ngx will not pick up new files with the default
-configuration. Use [`PAPERLESS_CONSUMER_POLLING`](configuration.md#PAPERLESS_CONSUMER_POLLING)
-to enable polling and disable inotify. See [here](configuration.md#polling).
+    ```shell-session
+    docker compose build
+    ```
 
-## Bare Metal Install {#bare_metal}
+    instead to build the image.
 
-#### Prerequisites
+### Bare Metal Route {#bare_metal}
 
--   Paperless runs on Linux only, Windows is not supported.
--   Python 3 is required with versions 3.10 - 3.12 currently supported. Newer versions may work, but some dependencies may not be fully compatible.
+Paperless runs on linux only. The following procedure has been tested on
+a minimal installation of Debian/Buster, which is the current stable
+release at the time of writing. Windows is not and will never be
+supported.
 
-#### Installation
+Paperless requires Python 3. At this time, 3.10 - 3.12 are tested versions.
+Newer versions may work, but some dependencies may not fully support newer versions.
+Support for older Python versions may be dropped as they reach end of life or as newer versions
+are released, dependency support is confirmed, etc.
 
-1.  Install dependencies. Paperless requires the following packages:
+1.  Install dependencies. Paperless requires the following packages.
 
     -   `python3`
     -   `python3-pip`
@@ -240,8 +254,8 @@ to enable polling and disable inotify. See [here](configuration.md#polling).
 
 2.  Install `redis` >= 6.0 and configure it to start automatically.
 
-3.  Optional: Install `postgresql` and configure a database, user, and
-    password for Paperless-ngx. If you do not wish to use PostgreSQL,
+3.  Optional. Install `postgresql` and configure a database, user and
+    password for paperless. If you do not wish to use PostgreSQL,
     MariaDB and SQLite are available as well.
 
     !!! note
@@ -250,60 +264,61 @@ to enable polling and disable inotify. See [here](configuration.md#polling).
         extension](https://code.djangoproject.com/wiki/JSON1Extension) is
         enabled. This is usually the case, but not always.
 
-4.  Create a system user with a new home folder in which you want
-    to run Paperless-ngx.
+4.  Create a system user with a new home folder under which you wish
+    to run paperless.
 
     ```shell-session
     adduser paperless --system --home /opt/paperless --group
     ```
 
-5.  Download a release archive from
-    <https://github.com/paperless-ngx/paperless-ngx/releases>. For example:
+5.  Get the release archive from
+    <https://github.com/paperless-ngx/paperless-ngx/releases> for example with
 
     ```shell-session
-    curl -O -L https://github.com/paperless-ngx/paperless-ngx/releases/download/vX.Y.Z/paperless-ngx-vX.Y.Z.tar.xz
+    curl -O -L https://github.com/paperless-ngx/paperless-ngx/releases/download/v1.10.2/paperless-ngx-v1.10.2.tar.xz
     ```
 
     Extract the archive with
 
     ```shell-session
-    tar -xf paperless-ngx-vX.Y.Z.tar.xz
+    tar -xf paperless-ngx-v1.10.2.tar.xz
     ```
 
-    and copy the contents to the home directory of the user you created
-    earlier (`/opt/paperless`).
+    and copy the contents to the
+    home folder of the user you created before (`/opt/paperless`).
 
-    Optional: If you cloned the Git repository, you will need to
-    compile the frontend yourself. See [here](development.md#front-end-development)
+    Optional: If you cloned the git repo, you will have to
+    compile the frontend yourself, see [here](development.md#front-end-development)
     and use the `build` step, not `serve`.
 
-6.  Configure Paperless-ngx. See [configuration](configuration.md) for details.
+6.  Configure paperless. See [configuration](configuration.md) for details.
     Edit the included `paperless.conf` and adjust the settings to your
-    needs. Required settings for getting Paperless-ngx running are:
+    needs. Required settings for getting
+    paperless running are:
 
-    -   [`PAPERLESS_REDIS`](configuration.md#PAPERLESS_REDIS) should point to your Redis server, such as
-        `redis://localhost:6379`.
-    -   [`PAPERLESS_DBENGINE`](configuration.md#PAPERLESS_DBENGINE) is optional, and should be one of `postgres`,
+    -   [`PAPERLESS_REDIS`](configuration.md#PAPERLESS_REDIS) should point to your redis server, such as
+        <redis://localhost:6379>.
+    -   [`PAPERLESS_DBENGINE`](configuration.md#PAPERLESS_DBENGINE) optional, and should be one of `postgres`,
         `mariadb`, or `sqlite`
     -   [`PAPERLESS_DBHOST`](configuration.md#PAPERLESS_DBHOST) should be the hostname on which your
         PostgreSQL server is running. Do not configure this to use
         SQLite instead. Also configure port, database name, user and
         password as necessary.
-    -   [`PAPERLESS_CONSUMPTION_DIR`](configuration.md#PAPERLESS_CONSUMPTION_DIR) should point to the folder
-        that Paperless-ngx should watch for incoming documents.
-        Likewise, [`PAPERLESS_DATA_DIR`](configuration.md#PAPERLESS_DATA_DIR) and
-        [`PAPERLESS_MEDIA_ROOT`](configuration.md#PAPERLESS_MEDIA_ROOT) define where Paperless-ngx stores its data.
-        If needed, these can point to the same directory.
+    -   [`PAPERLESS_CONSUMPTION_DIR`](configuration.md#PAPERLESS_CONSUMPTION_DIR) should point to a folder which
+        paperless should watch for documents. You might want to have
+        this somewhere else. Likewise, [`PAPERLESS_DATA_DIR`](configuration.md#PAPERLESS_DATA_DIR) and
+        [`PAPERLESS_MEDIA_ROOT`](configuration.md#PAPERLESS_MEDIA_ROOT) define where paperless stores its data.
+        If you like, you can point both to the same directory.
     -   [`PAPERLESS_SECRET_KEY`](configuration.md#PAPERLESS_SECRET_KEY) should be a random sequence of
         characters. It's used for authentication. Failure to do so
         allows third parties to forge authentication credentials.
-    -   Set [`PAPERLESS_URL`](configuration.md#PAPERLESS_URL) if you are behind a reverse proxy. This should
+    -   [`PAPERLESS_URL`](configuration.md#PAPERLESS_URL) if you are behind a reverse proxy. This should
         point to your domain. Please see
         [configuration](configuration.md) for more
         information.
 
-    You can make many more adjustments, especially for OCR.
-    The following options are recommended for most users:
+    Many more adjustments can be made to paperless, especially the OCR
+    part. The following options are recommended for everyone:
 
     -   Set [`PAPERLESS_OCR_LANGUAGE`](configuration.md#PAPERLESS_OCR_LANGUAGE) to the language most of your
         documents are written in.
@@ -313,14 +328,15 @@ to enable polling and disable inotify. See [here](configuration.md#polling).
 
         Ensure your Redis instance [is secured](https://redis.io/docs/latest/operate/oss_and_stack/management/security/).
 
-7.  Create the following directories if they do not already exist:
+7.  Create the following directories if they are missing:
 
     -   `/opt/paperless/media`
     -   `/opt/paperless/data`
     -   `/opt/paperless/consume`
 
-    Adjust these paths if you configured different folders.
-    Then verify that the `paperless` user has write permissions:
+    Adjust as necessary if you configured different folders.
+    Ensure that the paperless user has write permissions for every one
+    of these folders with
 
     ```shell-session
     ls -l -d /opt/paperless/media
@@ -334,44 +350,45 @@ to enable polling and disable inotify. See [here](configuration.md#polling).
     sudo chown paperless:paperless /opt/paperless/consume
     ```
 
-8.  Install Python dependencies from `requirements.txt`.
+8.  Install python requirements from the `requirements.txt` file.
 
     ```shell-session
     sudo -Hu paperless pip3 install -r requirements.txt
     ```
 
-    This will install all Python dependencies in the home directory of
+    This will install all python dependencies in the home directory of
     the new paperless user.
 
     !!! tip
 
-        You can use a virtual environment if you prefer. If you do,
-        you may need to adjust the example scripts for your virtual
-        environment paths.
+        It is up to you if you wish to use a virtual environment or not for the Python
+        dependencies.  This is an alternative to the above and may require adjusting
+        the example scripts to utilize the virtual environment paths
 
     !!! tip
 
         If you use modern Python tooling, such as `uv`, installation will not include
-        dependencies for PostgreSQL or MariaDB. You can select those
-        extras with `--extra <EXTRA>`, or install all extras with
-        `--all-extras`.
+        dependencies for Postgres or Mariadb.  You can select those extras with `--extra <EXTRA>`
+        or all with `--all-extras`
 
-9.  Go to `/opt/paperless/src` and execute the following command:
+9.  Go to `/opt/paperless/src`, and execute the following command:
 
     ```bash
     # This creates the database schema.
     sudo -Hu paperless python3 manage.py migrate
     ```
 
-10. Optional: Test that Paperless-ngx is working by running
+    When you first access the web interface you will be prompted to create a superuser account.
+
+10. Optional: Test that paperless is working by executing
 
     ```bash
     # Manually starts the webserver
     sudo -Hu paperless python3 manage.py runserver
     ```
 
-    Then point your browser to `http://localhost:8000` if
-    accessing from the same device on which Paperless-ngx is installed.
+    and pointing your browser to http://localhost:8000 if
+    accessing from the same devices on which paperless is installed.
     If accessing from another machine, set up systemd services. You may need
     to set `PAPERLESS_DEBUG=true` in order for the development server to work
     normally in your browser.
@@ -379,24 +396,23 @@ to enable polling and disable inotify. See [here](configuration.md#polling).
     !!! warning
 
         This is a development server which should not be used in production.
-        It is not audited for security, and performance is inferior to
-        production-ready web servers.
+        It is not audited for security and performance is inferior to
+        production ready web servers.
 
     !!! tip
 
         This will not start the consumer. Paperless does this in a separate
         process.
 
-11. Set up systemd services to run Paperless-ngx automatically. You may use
+11. Setup systemd services to run paperless automatically. You may use
     the service definition files included in the `scripts` folder as a
     starting point.
 
-    Paperless needs:
-
-    -   The `webserver` script to run the webserver.
-    -   The `consumer` script to watch the input folder.
-    -   The `taskqueue` script for background workers (document consumption, etc.).
-    -   The `scheduler` script for periodic tasks such as email checking.
+    Paperless needs the `webserver` script to run the webserver, the
+    `consumer` script to watch the input folder, `taskqueue` for the
+    background workers used to handle things like document consumption
+    and the `scheduler` script to run tasks such as email checking at
+    certain times .
 
     !!! note
 
@@ -405,9 +421,9 @@ to enable polling and disable inotify. See [here](configuration.md#polling).
         `Require=paperless-webserver.socket` in the `webserver` script
         and configure `granian` to listen on port 80 (set `GRANIAN_PORT`).
 
-    These services rely on Redis and optionally the database server, but
+    These services rely on redis and optionally the database server, but
     don't need to be started in any particular order. The example files
-    depend on Redis being started. If you use a database server, you
+    depend on redis being started. If you use a database server, you
     should add additional dependencies.
 
     !!! note
@@ -417,15 +433,18 @@ to enable polling and disable inotify. See [here](configuration.md#polling).
 
     !!! warning
 
-        If Celery won't start, check
+        If celery won't start (check with
         `sudo systemctl status paperless-task-queue.service` for
-        `paperless-task-queue.service` and `paperless-scheduler.service`.
-        You may need to change the path in the files. Example:
+        paperless-task-queue.service and paperless-scheduler.service
+        ) you need to change the path in the files. Example:
         `ExecStart=/opt/paperless/.local/bin/celery --app paperless worker --loglevel INFO`
 
-12. Configure ImageMagick to allow processing of PDF documents. Most
+12. Optional: Install a samba server and make the consumption folder
+    available as a network share.
+
+13. Configure ImageMagick to allow processing of PDF documents. Most
     distributions have this disabled by default, since PDF documents can
-    contain malware. If you don't do this, Paperless-ngx will fall back to
+    contain malware. If you don't do this, paperless will fall back to
     Ghostscript for certain steps such as thumbnail generation.
 
     Edit `/etc/ImageMagick-6/policy.xml` and adjust
@@ -440,38 +459,32 @@ to enable polling and disable inotify. See [here](configuration.md#polling).
     <policy domain="coder" rights="read|write" pattern="PDF" />
     ```
 
-**Optional: Install the [jbig2enc](https://ocrmypdf.readthedocs.io/en/latest/jbig2.html) encoder.**
-This will reduce the size of generated PDF documents. You'll most likely need to compile this yourself, because this
-software has been patented until around 2017 and binary packages are not available for most distributions.
+14. Optional: Install the
+    [jbig2enc](https://ocrmypdf.readthedocs.io/en/latest/jbig2.html)
+    encoder. This will reduce the size of generated PDF documents.
+    You'll most likely need to compile this by yourself, because this
+    software has been patented until around 2017 and binary packages are
+    not available for most distributions.
 
-**Optional: download the NLTK data**
-If using the NLTK machine-learning processing (see [`PAPERLESS_ENABLE_NLTK`](configuration.md#PAPERLESS_ENABLE_NLTK) for details),
-download the NLTK data for the Snowball Stemmer, Stopwords and Punkt tokenizer to `/usr/share/nltk_data`. Refer to the [NLTK
-instructions](https://www.nltk.org/data.html) for details on how to download the data.
+15. Optional: If using the NLTK machine learning processing (see
+    [`PAPERLESS_ENABLE_NLTK`](configuration.md#PAPERLESS_ENABLE_NLTK) for details),
+    download the NLTK data for the Snowball
+    Stemmer, Stopwords and Punkt tokenizer to `/usr/share/nltk_data`. Refer to the [NLTK
+    instructions](https://www.nltk.org/data.html) for details on how to
+    download the data.
 
-#### After installation
+# Migrating to Paperless-ngx
 
-Your Paperless-ngx instance should now be accessible at `http://localhost:8000` (or similar, depending on your configuration).
-When you first access the web interface you will be prompted to create a [superuser](usage.md#superusers) account.
+Migration is possible both from Paperless-ng or directly from the
+'original' Paperless.
 
-## Build the Docker image yourself {#docker_build data-toc-label="Building the Docker image"}
+## Migrating from Paperless-ng
 
-Building the Docker image yourself is typically used for development, but it can also be used for production
-if you want to customize the image. See [Building the Docker image](development.md#docker_build) in the
-development documentation.
-
-## Migrating to Paperless-ngx
-
-You can migrate to Paperless-ngx from Paperless-ng or from the original
-Paperless project.
-
-<h3 id="migration_ng">Migrating from Paperless-ng</h3>
-
-Paperless-ngx is meant to be a drop-in replacement for Paperless-ng, and
-upgrading should be trivial for most users, especially when using
-Docker. However, as with any major change, it is recommended to take a
+Paperless-ngx is meant to be a drop-in replacement for Paperless-ng and
+thus upgrading should be trivial for most users, especially when using
+docker. However, as with any major change, it is recommended to take a
 full backup first. Once you are ready, simply change the docker image to
-point to the new source. For example, if using Docker Compose, edit
+point to the new source. E.g. if using Docker Compose, edit
 `docker-compose.yml` and change:
 
 ```
@@ -484,65 +497,66 @@ to
 image: ghcr.io/paperless-ngx/paperless-ngx:latest
 ```
 
-and then run `docker compose up -d`, which will pull the new image and
-recreate the container. That's it.
+and then run `docker compose up -d` which will pull the new image
+recreate the container. That's it!
 
 Users who installed with the bare-metal route should also update their
 Git clone to point to `https://github.com/paperless-ngx/paperless-ngx`,
-for example using:
+e.g. using the command
 `git remote set-url origin https://github.com/paperless-ngx/paperless-ngx`
 and then pull the latest version.
 
-<h3 id="migration_paperless">Migrating from Paperless</h3>
+## Migrating from Paperless
 
-At its core, Paperless-ngx is still Paperless and fully compatible.
+At its core, paperless-ngx is still paperless and fully compatible.
 However, some things have changed under the hood, so you need to adapt
-your setup depending on how you installed Paperless.
+your setup depending on how you installed paperless.
 
-This section describes how to update an existing Paperless Docker
-installation. Keep these points in mind:
+This setup describes how to update an existing paperless Docker
+installation. The important things to keep in mind are as follows:
 
 -   Read the [changelog](changelog.md) and
     take note of breaking changes.
--   Decide whether to stay on SQLite or migrate to PostgreSQL.
-    See [documentation](#sqlite_to_psql) for details on moving data
-    from SQLite to PostgreSQL. Both work fine with
-    Paperless. However, if you already have a database server running
-    for other services, you might as well use it for Paperless as well.
--   The task scheduler of Paperless, which is used to execute periodic
+-   You should decide if you want to stick with SQLite or want to
+    migrate your database to PostgreSQL. See [documentation](#sqlite_to_psql)
+    for details on
+    how to move your data from SQLite to PostgreSQL. Both work fine with
+    paperless. However, if you already have a database server running
+    for other services, you might as well use it for paperless as well.
+-   The task scheduler of paperless, which is used to execute periodic
     tasks such as email checking and maintenance, requires a
-    [Redis](https://redis.io/) message broker instance. The
+    [redis](https://redis.io/) message broker instance. The
     Docker Compose route takes care of that.
 -   The layout of the folder structure for your documents and data
-    remains the same, so you can plug your old Docker volumes into
+    remains the same, so you can just plug your old docker volumes into
     paperless-ngx and expect it to find everything where it should be.
 
-Migration to Paperless-ngx is then performed in a few simple steps:
+Migration to paperless-ngx is then performed in a few simple steps:
 
-1.  Stop Paperless.
+1.  Stop paperless.
 
     ```bash
     cd /path/to/current/paperless
     docker compose down
     ```
 
-2.  Create a backup for two reasons: if something goes wrong, you still
-    have your data; and if you don't like paperless-ngx, you can
-    switch back to Paperless.
+2.  Do a backup for two purposes: If something goes wrong, you still
+    have your data. Second, if you don't like paperless-ngx, you can
+    switch back to paperless.
 
-3.  Download the latest release of Paperless-ngx. You can either use
+3.  Download the latest release of paperless-ngx. You can either go with
     the Docker Compose files from
     [here](https://github.com/paperless-ngx/paperless-ngx/tree/main/docker/compose)
     or clone the repository to build the image yourself (see
-    [development docs](development.md#docker_build)). You can either replace your current paperless
-    folder or put Paperless-ngx in
+    [above](#docker_build)). You can
+    either replace your current paperless folder or put paperless-ngx in
     a different location.
 
     !!! warning
 
         Paperless-ngx includes a `.env` file. This will set the project name
-        for Docker Compose to `paperless`, which will also define the
-        volume names created by Paperless-ngx. However, if you notice that
+        for docker compose to `paperless`, which will also define the name
+        of the volumes by paperless-ngx. However, if you experience that
         paperless-ngx is not using your old paperless volumes, verify the
         names of your volumes with
 
@@ -558,10 +572,10 @@ Migration to Paperless-ngx is then performed in a few simple steps:
     after you migrated your existing SQLite database.
 
 5.  Adjust `docker-compose.yml` and `docker-compose.env` to your needs.
-    See [Docker setup](#docker) for details on
-    which edits are recommended.
+    See [Docker setup](#docker) details on
+    which edits are advised.
 
-6.  Follow the update procedure in [Update paperless](administration.md#updating).
+6.  [Update paperless.](administration.md#updating)
 
 7.  In order to find your existing documents with the new search
     feature, you need to invoke a one-time operation that will create
@@ -572,99 +586,136 @@ Migration to Paperless-ngx is then performed in a few simple steps:
     ```
 
     This will migrate your database and create the search index. After
-    that, Paperless-ngx will maintain the index automatically.
+    that, paperless will take care of maintaining the index by itself.
 
-8.  Start Paperless-ngx.
+8.  Start paperless-ngx.
 
     ```bash
     docker compose up -d
     ```
 
-    This will run Paperless-ngx in the background and automatically start it
+    This will run paperless in the background and automatically start it
     on system boot.
 
-9.  Paperless may have installed a permanent redirect to `admin/` in your
+9.  Paperless installed a permanent redirect to `admin/` in your
     browser. This redirect is still in place and prevents access to the
-    new UI. Clear your browser cache to fix this.
+    new UI. Clear your browsing cache in order to fix this.
 
 10. Optionally, follow the instructions below to migrate your existing
     data to PostgreSQL.
 
-<h3 id="migration_lsio">Migrating from LinuxServer.io Docker Image</h3>
+## Migrating from LinuxServer.io Docker Image
 
-As with any upgrade or large change, it is highly recommended to
+As with any upgrades and large changes, it is highly recommended to
 create a backup before starting. This assumes the image was running
 using Docker Compose, but the instructions are translatable to Docker
 commands as well.
 
-1.  Stop and remove the Paperless container.
-2.  If using an external database, stop that container.
-3.  Update Redis configuration.
+1.  Stop and remove the paperless container
+2.  If using an external database, stop the container
+3.  Update Redis configuration
 
     1. If `REDIS_URL` is already set, change it to [`PAPERLESS_REDIS`](configuration.md#PAPERLESS_REDIS)
        and continue to step 4.
 
-    1. Otherwise, add a new Redis service in `docker-compose.yml`,
-       following [the example compose
+    1. Otherwise, in the `docker-compose.yml` add a new service for
+       Redis, following [the example compose
        files](https://github.com/paperless-ngx/paperless-ngx/tree/main/docker/compose)
 
     1. Set the environment variable [`PAPERLESS_REDIS`](configuration.md#PAPERLESS_REDIS) so it points to
-       the new Redis container.
+       the new Redis container
 
-4.  Update user mapping.
+4.  Update user mapping
 
-    1. If set, change the environment variable `PUID` to `USERMAP_UID`.
+    1. If set, change the environment variable `PUID` to `USERMAP_UID`
 
-    1. If set, change the environment variable `PGID` to `USERMAP_GID`.
+    1. If set, change the environment variable `PGID` to `USERMAP_GID`
 
-5.  Update configuration paths.
+5.  Update configuration paths
 
-    1. Set the environment variable [`PAPERLESS_DATA_DIR`](configuration.md#PAPERLESS_DATA_DIR) to `/config`.
+    1. Set the environment variable [`PAPERLESS_DATA_DIR`](configuration.md#PAPERLESS_DATA_DIR) to `/config`
 
-6.  Update media paths.
+6.  Update media paths
 
     1. Set the environment variable [`PAPERLESS_MEDIA_ROOT`](configuration.md#PAPERLESS_MEDIA_ROOT) to
-       `/data/media`.
+       `/data/media`
 
-7.  Update timezone.
+7.  Update timezone
 
     1. Set the environment variable [`PAPERLESS_TIME_ZONE`](configuration.md#PAPERLESS_TIME_ZONE) to the same
-       value as `TZ`.
+       value as `TZ`
 
-8.  Modify `image:` to point to
+8.  Modify the `image:` to point to
     `ghcr.io/paperless-ngx/paperless-ngx:latest` or a specific version
     if preferred.
 9.  Start the containers as before, using `docker compose`.
 
-## Running Paperless-ngx on less powerful devices {#less-powerful-devices data-toc-label="Less Powerful Devices"}
+## Moving data from SQLite to PostgreSQL or MySQL/MariaDB {#sqlite_to_psql}
 
-Paperless runs on Raspberry Pi. Some tasks can be slow on lower-powered
-hardware, but a few settings can improve performance:
+The best way to migrate between database types is to perform an [export](administration.md#exporter) and then
+[import](administration.md#importer) into a clean installation of Paperless-ngx.
+
+## Moving back to Paperless
+
+Lets say you migrated to Paperless-ngx and used it for a while, but
+decided that you don't like it and want to move back (If you do, send
+me a mail about what part you didn't like!), you can totally do that
+with a few simple steps.
+
+Paperless-ngx modified the database schema slightly, however, these
+changes can be reverted while keeping your current data, so that your
+current data will be compatible with original Paperless. Thumbnails
+were also changed from PNG to WEBP format and will need to be
+re-generated.
+
+Execute this:
+
+```shell-session
+$ cd /path/to/paperless
+$ docker compose run --rm webserver migrate documents 0023
+```
+
+Or without docker:
+
+```shell-session
+$ cd /path/to/paperless/src
+$ python3 manage.py migrate documents 0023
+```
+
+After regenerating thumbnails, you'll need to clear your cookies
+(Paperless-ngx comes with updated dependencies that do cookie-processing
+differently) and probably your cache as well.
+
+# Considerations for less powerful devices {#less-powerful-devices}
+
+Paperless runs on Raspberry Pi. However, some things are rather slow on
+the Pi and configuring some options in paperless can help improve
+performance immensely:
 
 -   Stick with SQLite to save some resources. See [troubleshooting](troubleshooting.md#log-reports-creating-paperlesstask-failed)
     if you encounter issues with SQLite locking.
 -   If you do not need the filesystem-based consumer, consider disabling it
     entirely by setting [`PAPERLESS_CONSUMER_DISABLE`](configuration.md#PAPERLESS_CONSUMER_DISABLE) to `true`.
--   Consider setting [`PAPERLESS_OCR_PAGES`](configuration.md#PAPERLESS_OCR_PAGES) to 1, so that Paperless
-    OCRs only the first page of your documents. In most cases, this page
+-   Consider setting [`PAPERLESS_OCR_PAGES`](configuration.md#PAPERLESS_OCR_PAGES) to 1, so that paperless will
+    only OCR the first page of your documents. In most cases, this page
     contains enough information to be able to find it.
 -   [`PAPERLESS_TASK_WORKERS`](configuration.md#PAPERLESS_TASK_WORKERS) and [`PAPERLESS_THREADS_PER_WORKER`](configuration.md#PAPERLESS_THREADS_PER_WORKER) are
     configured to use all cores. The Raspberry Pi models 3 and up have 4
-    cores, meaning that Paperless will use 2 workers and 2 threads per
+    cores, meaning that paperless will use 2 workers and 2 threads per
     worker. This may result in sluggish response times during
     consumption, so you might want to lower these settings (example: 2
     workers and 1 thread to always have some computing power left for
     other tasks).
 -   Keep [`PAPERLESS_OCR_MODE`](configuration.md#PAPERLESS_OCR_MODE) at its default value `skip` and consider
-    OCRing your documents before feeding them into Paperless. Some
+    OCR'ing your documents before feeding them into paperless. Some
     scanners are able to do this!
 -   Set [`PAPERLESS_OCR_SKIP_ARCHIVE_FILE`](configuration.md#PAPERLESS_OCR_SKIP_ARCHIVE_FILE) to `with_text` to skip archive
-    file generation for already OCRed documents, or `always` to skip it
+    file generation for already ocr'ed documents, or `always` to skip it
     for all documents.
 -   If you want to perform OCR on the device, consider using
     `PAPERLESS_OCR_CLEAN=none`. This will speed up OCR times and use
     less memory at the expense of slightly worse OCR results.
--   If using Docker, consider setting [`PAPERLESS_WEBSERVER_WORKERS`](configuration.md#PAPERLESS_WEBSERVER_WORKERS) to 1. This will save some memory.
+-   If using docker, consider setting [`PAPERLESS_WEBSERVER_WORKERS`](configuration.md#PAPERLESS_WEBSERVER_WORKERS) to 1. This will save some memory.
 -   Consider setting [`PAPERLESS_ENABLE_NLTK`](configuration.md#PAPERLESS_ENABLE_NLTK) to false, to disable the
     more advanced language processing, which can take more memory and
     processing time.
@@ -676,19 +727,17 @@ For details, refer to [configuration](configuration.md).
     Updating the
     [automatic matching algorithm](advanced_usage.md#automatic-matching) takes quite a bit of time. However, the update mechanism
     checks if your data has changed before doing the heavy lifting. If you
-    experience the algorithm taking too much CPU time, consider changing the
+    experience the algorithm taking too much cpu time, consider changing the
     schedule in the admin interface to daily. You can also manually invoke
     the task by changing the date and time of the next run to today/now.
 
     The actual matching of the algorithm is fast and works on Raspberry Pi
     as well as on any other device.
 
-## Additional considerations
+# Using nginx as a reverse proxy {#nginx}
 
-**Using a reverse proxy with Paperless-ngx**
+Please see [the wiki](https://github.com/paperless-ngx/paperless-ngx/wiki/Using-a-Reverse-Proxy-with-Paperless-ngx#nginx) for user-maintained documentation of using nginx with Paperless-ngx.
 
-Please see [the wiki](https://github.com/paperless-ngx/paperless-ngx/wiki/Using-a-Reverse-Proxy-with-Paperless-ngx#nginx) for user-maintained documentation on using nginx with Paperless-ngx.
+# Enhancing security {#security}
 
-**Enhancing security**
-
-Please see [the wiki](https://github.com/paperless-ngx/paperless-ngx/wiki/Using-Security-Tools-with-Paperless-ngx) for user-maintained documentation on configuring security tools like Fail2ban with Paperless-ngx.
+Please see [the wiki](https://github.com/paperless-ngx/paperless-ngx/wiki/Using-Security-Tools-with-Paperless-ngx) for user-maintained documentation of how to configure security tools like Fail2ban with Paperless-ngx.

docs/usage.md

@@ -1,8 +1,4 @@
----
-title: Basic Usage
----
-
-# Usage
+# Usage Overview
 
 Paperless-ngx is an application that manages your personal documents. With
 the (optional) help of a document scanner (see [the scanners wiki](https://github.com/paperless-ngx/paperless-ngx/wiki/Scanner-&-Software-Recommendations)), Paperless-ngx transforms your unwieldy
@@ -348,11 +344,6 @@ permissions can be granted to limit access to certain parts of the UI (and corre
 
 Superusers can access all parts of the front and backend application as well as any and all objects. Superuser status can only be granted by another superuser.
 
-!!! tip
-
-    Because superuser accounts can see all objects and documents, you may want to use a regular account for day-to-day use. Additional superuser accounts can
-    be created via [cli](administration.md#create-superuser) or granted superuser status from an existing superuser account.
-
 #### Admin Status
 
 Admin status (Django 'staff status') grants access to viewing the paperless logs and the system status dialog
@@ -570,7 +561,7 @@ applied. You can use the following placeholders in the template with any trigger
 -   `{{added_day}}`: added day
 -   `{{added_time}}`: added time in HH:MM format
 -   `{{original_filename}}`: original file name without extension
--   `{{filename}}`: current file name without extension (for "added" workflows this may not be final yet, you can use `{{original_filename}}`)
+-   `{{filename}}`: current file name without extension
 -   `{{doc_title}}`: current document title
 
 The following placeholders are only available for "added" or "updated" triggers

mkdocs.yml

@@ -0,0 +1,86 @@
+site_name: Paperless-ngx
+theme:
+  name: material
+  logo: assets/logo.svg
+  font:
+    text: Roboto
+    code: Roboto Mono
+  palette:
+    # Palette toggle for automatic mode
+    - media: "(prefers-color-scheme)"
+      toggle:
+        icon: material/brightness-auto
+        name: Switch to light mode
+    # Palette toggle for light mode
+    - media: "(prefers-color-scheme: light)"
+      scheme: default
+      toggle:
+        icon: material/brightness-7
+        name: Switch to dark mode
+    # Palette toggle for dark mode
+    - media: "(prefers-color-scheme: dark)"
+      scheme: slate
+      toggle:
+        icon: material/brightness-4
+        name: Switch to system preference
+  features:
+    - navigation.tabs
+    - navigation.top
+    - toc.integrate
+    - content.code.annotate
+  icon:
+    repo: fontawesome/brands/github
+  favicon: assets/favicon.png
+repo_url: https://github.com/paperless-ngx/paperless-ngx
+repo_name: paperless-ngx/paperless-ngx
+edit_uri: blob/main/docs/
+extra_css:
+  - assets/extra.css
+markdown_extensions:
+  - attr_list
+  - md_in_html
+  - def_list
+  - admonition
+  - tables
+  - pymdownx.highlight:
+      anchor_linenums: true
+  - pymdownx.superfences
+  - pymdownx.inlinehilite
+  - pymdownx.snippets
+  - pymdownx.tilde
+  - footnotes
+  - pymdownx.superfences:
+      custom_fences:
+        - name: mermaid
+          class: mermaid
+          format: !!python/name:pymdownx.superfences.fence_code_format
+  - pymdownx.emoji:
+      emoji_index: !!python/name:material.extensions.emoji.twemoji
+      emoji_generator: !!python/name:material.extensions.emoji.to_svg
+strict: true
+nav:
+  - index.md
+  - setup.md
+  - 'Basic Usage': usage.md
+  - configuration.md
+  - administration.md
+  - advanced_usage.md
+  - 'REST API': api.md
+  - development.md
+  - 'FAQs': faq.md
+  - troubleshooting.md
+  - changelog.md
+copyright: Copyright © 2016 - 2023 Daniel Quinn, Jonas Winkler, and the Paperless-ngx team
+extra:
+  social:
+    - icon: fontawesome/brands/github
+      link: https://github.com/paperless-ngx/paperless-ngx
+    - icon: fontawesome/brands/docker
+      link: https://hub.docker.com/r/paperlessngx/paperless-ngx
+    - icon: material/chat
+      link: https://matrix.to/#/#paperless:matrix.org
+plugins:
+  - search
+  - glightbox:
+      skip_classes:
+        - no-lightbox

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "paperless-ngx"
-version = "2.20.10"
+version = "2.20.3"
 description = "A community-supported supercharged document management system: scan, index and archive all your physical documents"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -96,7 +96,8 @@ dev = [
 ]
 
 docs = [
-  "zensical>=0.0.21",
+  "mkdocs-glightbox~=0.5.1",
+  "mkdocs-material~=9.7.0",
 ]
 
 testing = [
@@ -237,7 +238,7 @@ lint.isort.force-single-line = true
 
 [tool.codespell]
 write-changes = true
-ignore-words-list = "criterias,afterall,valeu,ureue,equest,ure,assertIn,Oktober,commitish"
+ignore-words-list = "criterias,afterall,valeu,ureue,equest,ure,assertIn,Oktober"
 skip = "src-ui/src/locale/*,src-ui/pnpm-lock.yaml,src-ui/e2e/*,src/paperless_mail/tests/samples/*,src/documents/tests/samples/*,*.po,*.json"
 
 [tool.pytest.ini_options]

src-ui/angular.json

@@ -31,6 +31,7 @@
           "fi-FI": "src/locale/messages.fi_FI.xlf",
           "fr-FR": "src/locale/messages.fr_FR.xlf",
           "hu-HU": "src/locale/messages.hu_HU.xlf",
+          "id-ID": "src/locale/messages.id_ID.xlf",
           "it-IT": "src/locale/messages.it_IT.xlf",
           "ja-JP": "src/locale/messages.ja_JP.xlf",
           "lb-LU": "src/locale/messages.lb_LU.xlf",

src-ui/messages.xlf

@@ -10028,179 +10028,186 @@
           <context context-type="linenumber">135</context>
         </context-group>
       </trans-unit>
+      <trans-unit id="8312065814232621608" datatype="html">
+        <source>Indonesian</source>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/services/settings.service.ts</context>
+          <context context-type="linenumber">141</context>
+        </context-group>
+      </trans-unit>
       <trans-unit id="2935232983274991580" datatype="html">
         <source>Italian</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">141</context>
+          <context context-type="linenumber">147</context>
         </context-group>
       </trans-unit>
       <trans-unit id="6924606686202701860" datatype="html">
         <source>Japanese</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">147</context>
+          <context context-type="linenumber">153</context>
         </context-group>
       </trans-unit>
       <trans-unit id="6145439649200570157" datatype="html">
         <source>Korean</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">153</context>
+          <context context-type="linenumber">159</context>
         </context-group>
       </trans-unit>
       <trans-unit id="1334425850005897370" datatype="html">
         <source>Luxembourgish</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">159</context>
+          <context context-type="linenumber">165</context>
         </context-group>
       </trans-unit>
       <trans-unit id="3071065188816255493" datatype="html">
         <source>Dutch</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">165</context>
+          <context context-type="linenumber">171</context>
         </context-group>
       </trans-unit>
       <trans-unit id="8069284467804715623" datatype="html">
         <source>Norwegian</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">171</context>
+          <context context-type="linenumber">177</context>
         </context-group>
       </trans-unit>
       <trans-unit id="4977087909184008115" datatype="html">
         <source>Persian</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">177</context>
+          <context context-type="linenumber">183</context>
         </context-group>
       </trans-unit>
       <trans-unit id="792060551707690640" datatype="html">
         <source>Polish</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">183</context>
+          <context context-type="linenumber">189</context>
         </context-group>
       </trans-unit>
       <trans-unit id="9184513005098760425" datatype="html">
         <source>Portuguese (Brazil)</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">189</context>
+          <context context-type="linenumber">195</context>
         </context-group>
       </trans-unit>
       <trans-unit id="153799456510623899" datatype="html">
         <source>Portuguese</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">195</context>
+          <context context-type="linenumber">201</context>
         </context-group>
       </trans-unit>
       <trans-unit id="8118856427047826368" datatype="html">
         <source>Romanian</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">201</context>
+          <context context-type="linenumber">207</context>
         </context-group>
       </trans-unit>
       <trans-unit id="7137419789978325708" datatype="html">
         <source>Russian</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">207</context>
+          <context context-type="linenumber">213</context>
         </context-group>
       </trans-unit>
       <trans-unit id="9102963095355753902" datatype="html">
         <source>Slovak</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">213</context>
+          <context context-type="linenumber">219</context>
         </context-group>
       </trans-unit>
       <trans-unit id="4287008301409320881" datatype="html">
         <source>Slovenian</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">219</context>
+          <context context-type="linenumber">225</context>
         </context-group>
       </trans-unit>
       <trans-unit id="8608389829607915090" datatype="html">
         <source>Serbian</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">225</context>
+          <context context-type="linenumber">231</context>
         </context-group>
       </trans-unit>
       <trans-unit id="499386805970351976" datatype="html">
         <source>Swedish</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">231</context>
+          <context context-type="linenumber">237</context>
         </context-group>
       </trans-unit>
       <trans-unit id="5682359291233237791" datatype="html">
         <source>Turkish</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">237</context>
+          <context context-type="linenumber">243</context>
         </context-group>
       </trans-unit>
       <trans-unit id="3578644052206125685" datatype="html">
         <source>Ukrainian</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">243</context>
+          <context context-type="linenumber">249</context>
         </context-group>
       </trans-unit>
       <trans-unit id="3611216939636790848" datatype="html">
         <source>Vietnamese</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">249</context>
+          <context context-type="linenumber">255</context>
         </context-group>
       </trans-unit>
       <trans-unit id="4689443708886954687" datatype="html">
         <source>Chinese Simplified</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">255</context>
+          <context context-type="linenumber">261</context>
         </context-group>
       </trans-unit>
       <trans-unit id="8082606363137705994" datatype="html">
         <source>Chinese Traditional</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">261</context>
+          <context context-type="linenumber">267</context>
         </context-group>
       </trans-unit>
       <trans-unit id="4912706592792948707" datatype="html">
         <source>ISO 8601</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">269</context>
+          <context context-type="linenumber">275</context>
         </context-group>
       </trans-unit>
       <trans-unit id="313643372755303297" datatype="html">
         <source>Successfully completed one-time migratration of settings to the database!</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">603</context>
+          <context context-type="linenumber">609</context>
         </context-group>
       </trans-unit>
       <trans-unit id="5558341108007064934" datatype="html">
         <source>Unable to migrate settings to the database, please try saving manually.</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">604</context>
+          <context context-type="linenumber">610</context>
         </context-group>
       </trans-unit>
       <trans-unit id="1168781785897678748" datatype="html">
         <source>You can restart the tour from the settings page.</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">677</context>
+          <context context-type="linenumber">683</context>
         </context-group>
       </trans-unit>
       <trans-unit id="3852289441366561594" datatype="html">

src-ui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paperless-ngx-ui",
-  "version": "2.20.10",
+  "version": "2.20.3",
   "scripts": {
     "preinstall": "npx only-allow pnpm",
     "ng": "ng",

src-ui/setup-jest.ts

@@ -28,6 +28,7 @@ import localeFa from '@angular/common/locales/fa'
 import localeFi from '@angular/common/locales/fi'
 import localeFr from '@angular/common/locales/fr'
 import localeHu from '@angular/common/locales/hu'
+import localeId from '@angular/common/locales/id'
 import localeIt from '@angular/common/locales/it'
 import localeJa from '@angular/common/locales/ja'
 import localeKo from '@angular/common/locales/ko'
@@ -63,6 +64,7 @@ registerLocaleData(localeFa)
 registerLocaleData(localeFi)
 registerLocaleData(localeFr)
 registerLocaleData(localeHu)
+registerLocaleData(localeId)
 registerLocaleData(localeIt)
 registerLocaleData(localeJa)
 registerLocaleData(localeKo)

src-ui/src/app/components/admin/config/config.component.html

@@ -19,18 +19,13 @@
                                 <div class="col">
                                     <div class="card bg-light">
                                         <div class="card-body">
-                                            <div class="card-title d-flex align-items-center">
-                                                <h6 class="mb-0">
-                                                  {{option.title}}
+                                            <div class="card-title">
+                                                <h6>
+                                                    {{option.title}}
+                                                    <a class="btn btn-sm btn-link" title="Read the documentation about this setting" i18n-title [href]="getDocsUrl(option.config_key)" target="_blank" referrerpolicy="no-referrer">
+                                                        <i-bs  name="info-circle"></i-bs>
+                                                    </a>
                                                 </h6>
-                                                <a class="btn btn-sm btn-link" title="Read the documentation about this setting" i18n-title [href]="getDocsUrl(option.config_key)" target="_blank" referrerpolicy="no-referrer">
-                                                    <i-bs name="info-circle"></i-bs>
-                                                </a>
-                                                @if (isSet(option.key)) {
-                                                  <button type="button" class="btn btn-sm btn-link text-danger ms-auto pe-0" title="Reset" i18n-title (click)="resetOption(option.key)">
-                                                      <i-bs class="me-1" name="x"></i-bs><ng-container i18n>Reset</ng-container>
-                                                  </button>
-                                                }
                                             </div>
                                             <div class="mb-n3">
                                                 @switch (option.type) {

src-ui/src/app/components/admin/config/config.component.spec.ts

@@ -144,18 +144,4 @@ describe('ConfigComponent', () => {
     component.uploadFile(new File([], 'test.png'), 'app_logo')
     expect(initSpy).toHaveBeenCalled()
   })
-
-  it('should reset option to null', () => {
-    component.configForm.patchValue({ output_type: OutputTypeConfig.PDF_A })
-    expect(component.isSet('output_type')).toBeTruthy()
-    component.resetOption('output_type')
-    expect(component.configForm.get('output_type').value).toBeNull()
-    expect(component.isSet('output_type')).toBeFalsy()
-    component.configForm.patchValue({ app_title: 'Test Title' })
-    component.resetOption('app_title')
-    expect(component.configForm.get('app_title').value).toBeNull()
-    component.configForm.patchValue({ barcodes_enabled: true })
-    component.resetOption('barcodes_enabled')
-    expect(component.configForm.get('barcodes_enabled').value).toBeNull()
-  })
 })

src-ui/src/app/components/admin/config/config.component.ts

@@ -208,12 +208,4 @@ export class ConfigComponent
         },
       })
   }
-
-  public isSet(key: string): boolean {
-    return this.configForm.get(key).value != null
-  }
-
-  public resetOption(key: string) {
-    this.configForm.get(key).setValue(null)
-  }
 }

src-ui/src/app/components/app-frame/app-frame.component.scss

@@ -281,7 +281,7 @@ main {
 .navbar .dropdown-menu {
   font-size: 0.875rem; // body size
 
-  a i-bs, button i-bs {
+  a i-bs {
     opacity: 0.6;
   }
 }

src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.spec.ts

@@ -252,7 +252,7 @@ describe('WorkflowEditDialogComponent', () => {
     expect(component.object.actions.length).toEqual(2)
   })
 
-  it('should update order on drag n drop', () => {
+  it('should update order and remove ids from actions on drag n drop', () => {
     const action1 = workflow.actions[0]
     const action2 = workflow.actions[1]
     component.object = workflow
@@ -261,6 +261,8 @@ describe('WorkflowEditDialogComponent', () => {
       WorkflowAction[]
     >)
     expect(component.object.actions).toEqual([action2, action1])
+    expect(action1.id).toBeNull()
+    expect(action2.id).toBeNull()
   })
 
   it('should not include auto matching in algorithms', () => {

src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts

@@ -1283,6 +1283,11 @@ export class WorkflowEditDialogComponent
     const actionField = this.actionFields.at(event.previousIndex)
     this.actionFields.removeAt(event.previousIndex)
     this.actionFields.insert(event.currentIndex, actionField)
+    // removing id will effectively re-create the actions in this order
+    this.object.actions.forEach((a) => (a.id = null))
+    this.actionFields.controls.forEach((c) =>
+      c.get('id').setValue(null, { emitEvent: false })
+    )
   }
 
   save(): void {

src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.spec.ts

@@ -631,59 +631,6 @@ describe('FilterableDropdownComponent & FilterableDropdownSelectionModel', () =>
     ])
   })
 
-  it('deselecting a parent clears selected descendants', () => {
-    const root: Tag = { id: 100, name: 'Root Tag' }
-    const child: Tag = { id: 101, name: 'Child Tag', parent: root.id }
-    const grandchild: Tag = {
-      id: 102,
-      name: 'Grandchild Tag',
-      parent: child.id,
-    }
-    const other: Tag = { id: 103, name: 'Other Tag' }
-
-    selectionModel.items = [root, child, grandchild, other]
-    selectionModel.set(root.id, ToggleableItemState.Selected, false)
-    selectionModel.set(child.id, ToggleableItemState.Selected, false)
-    selectionModel.set(grandchild.id, ToggleableItemState.Selected, false)
-    selectionModel.set(other.id, ToggleableItemState.Selected, false)
-
-    selectionModel.toggle(root.id, false)
-
-    expect(selectionModel.getSelectedItems()).toEqual([other])
-  })
-
-  it('un-excluding a parent clears excluded descendants', () => {
-    const root: Tag = { id: 110, name: 'Root Tag' }
-    const child: Tag = { id: 111, name: 'Child Tag', parent: root.id }
-    const other: Tag = { id: 112, name: 'Other Tag' }
-
-    selectionModel.items = [root, child, other]
-    selectionModel.set(root.id, ToggleableItemState.Excluded, false)
-    selectionModel.set(child.id, ToggleableItemState.Excluded, false)
-    selectionModel.set(other.id, ToggleableItemState.Excluded, false)
-
-    selectionModel.exclude(root.id, false)
-
-    expect(selectionModel.getExcludedItems()).toEqual([other])
-  })
-
-  it('excluding a selected parent clears selected descendants', () => {
-    const root: Tag = { id: 120, name: 'Root Tag' }
-    const child: Tag = { id: 121, name: 'Child Tag', parent: root.id }
-    const other: Tag = { id: 122, name: 'Other Tag' }
-
-    selectionModel.manyToOne = true
-    selectionModel.items = [root, child, other]
-    selectionModel.set(root.id, ToggleableItemState.Selected, false)
-    selectionModel.set(child.id, ToggleableItemState.Selected, false)
-    selectionModel.set(other.id, ToggleableItemState.Selected, false)
-
-    selectionModel.exclude(root.id, false)
-
-    expect(selectionModel.getExcludedItems()).toEqual([root])
-    expect(selectionModel.getSelectedItems()).toEqual([other])
-  })
-
   it('resorts items immediately when document count sorting enabled', () => {
     const apple: Tag = { id: 55, name: 'Apple' }
     const zebra: Tag = { id: 56, name: 'Zebra' }

src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.ts

@@ -231,7 +231,6 @@ export class FilterableDropdownSelectionModel {
       state == ToggleableItemState.Excluded
     ) {
       this.temporarySelectionStates.delete(id)
-      this.clearDescendantSelections(id)
     }
 
     if (!id) {
@@ -258,7 +257,6 @@ export class FilterableDropdownSelectionModel {
 
       if (this.manyToOne || this.singleSelect) {
         this.temporarySelectionStates.set(id, ToggleableItemState.Excluded)
-        this.clearDescendantSelections(id)
 
         if (this.singleSelect) {
           for (let key of this.temporarySelectionStates.keys()) {
@@ -279,15 +277,9 @@ export class FilterableDropdownSelectionModel {
           newState = ToggleableItemState.NotSelected
         }
         this.temporarySelectionStates.set(id, newState)
-        if (newState == ToggleableItemState.Excluded) {
-          this.clearDescendantSelections(id)
-        }
       }
     } else if (!id || state == ToggleableItemState.Excluded) {
       this.temporarySelectionStates.delete(id)
-      if (id) {
-        this.clearDescendantSelections(id)
-      }
     }
 
     if (fireEvent) {
@@ -299,33 +291,6 @@ export class FilterableDropdownSelectionModel {
     return this.selectionStates.get(id) || ToggleableItemState.NotSelected
   }
 
-  private clearDescendantSelections(id: number) {
-    for (const descendantID of this.getDescendantIDs(id)) {
-      this.temporarySelectionStates.delete(descendantID)
-    }
-  }
-
-  private getDescendantIDs(id: number): number[] {
-    const descendants: number[] = []
-    const queue: number[] = [id]
-
-    while (queue.length) {
-      const parentID = queue.shift()
-      for (const item of this._items) {
-        if (
-          typeof item?.id === 'number' &&
-          typeof (item as any)['parent'] === 'number' &&
-          (item as any)['parent'] === parentID
-        ) {
-          descendants.push(item.id)
-          queue.push(item.id)
-        }
-      }
-    }
-
-    return descendants
-  }
-
   get logicalOperator(): LogicalOperator {
     return this.temporaryLogicalOperator
   }

src-ui/src/app/components/common/input/tags/tags.component.html

@@ -28,7 +28,7 @@
             </button>
           </ng-template>
           <ng-template ng-option-tmp let-item="item" let-index="index" let-search="searchTerm">
-            <div class="tag-option-row d-flex align-items-center" [class.w-auto]="!getTag(item.id)?.parent">
+            <div class="tag-option-row d-flex align-items-center">
               @if (item.id && tags) {
                 @if (getTag(item.id)?.parent) {
                   <i-bs name="list-nested" class="me-1"></i-bs>

src-ui/src/app/components/common/input/tags/tags.component.scss

@@ -22,8 +22,8 @@
 }
 
 // Dropdown hierarchy reveal for ng-select options
-:host ::ng-deep .ng-dropdown-panel .ng-option {
-  overflow-x: auto !important;
+::ng-deep .ng-dropdown-panel .ng-option {
+  overflow-x: scroll;
 
   .tag-option-row {
     font-size: 1rem;
@@ -41,12 +41,12 @@
   }
 }
 
-:host ::ng-deep .ng-dropdown-panel .ng-option:hover .hierarchy-reveal,
-:host ::ng-deep .ng-dropdown-panel .ng-option.ng-option-marked .hierarchy-reveal {
+::ng-deep .ng-dropdown-panel .ng-option:hover .hierarchy-reveal,
+::ng-deep .ng-dropdown-panel .ng-option.ng-option-marked .hierarchy-reveal {
   max-width: 1000px;
 }
 
 ::ng-deep .ng-dropdown-panel .ng-option:hover .hierarchy-indicator,
-:host ::ng-deep .ng-dropdown-panel .ng-option.ng-option-marked .hierarchy-indicator {
+::ng-deep .ng-dropdown-panel .ng-option.ng-option-marked .hierarchy-indicator {
   background: transparent;
 }

src-ui/src/app/components/common/preview-popup/preview-popup.component.html

@@ -14,7 +14,7 @@
         @if (previewText) {
           <div class="bg-light p-3 overflow-auto whitespace-preserve" width="100%">{{previewText}}</div>
         } @else {
-          <object [data]="previewURL | safeUrl" width="100%" class="bg-light" [class.p-2]="!isPdf"></object>
+          <object [data]="previewUrl | safeUrl" width="100%" class="bg-light" [class.p-2]="!isPdf"></object>
         }
       } @else {
         @if (requiresPassword) {
@@ -24,7 +24,7 @@
         }
         @if (!requiresPassword) {
           <pdf-viewer
-            [src]="previewURL"
+            [src]="previewUrl"
             [original-size]="false"
             [show-borders]="false"
             [show-all]="true"

src-ui/src/app/components/common/preview-popup/preview-popup.component.ts

@@ -71,7 +71,7 @@ export class PreviewPopupComponent implements OnDestroy {
     return (this.isPdf && this.useNativePdfViewer) || !this.isPdf
   }
 
-  get previewURL() {
+  get previewUrl() {
     return this.documentService.getPreviewUrl(this.document.id)
   }
 
@@ -93,7 +93,7 @@ export class PreviewPopupComponent implements OnDestroy {
   init() {
     if (this.document.mime_type?.includes('text')) {
       this.http
-        .get(this.previewURL, { responseType: 'text' })
+        .get(this.previewUrl, { responseType: 'text' })
         .pipe(first(), takeUntil(this.unsubscribeNotifier))
         .subscribe({
           next: (res) => {
@@ -126,10 +126,6 @@ export class PreviewPopupComponent implements OnDestroy {
     }
   }
 
-  get previewUrl() {
-    return this.documentService.getPreviewUrl(this.document.id)
-  }
-
   mouseEnterPreview() {
     this.mouseOnPreview = true
     if (!this.popover.isOpen()) {

src-ui/src/app/components/document-detail/document-detail.component.html

@@ -379,7 +379,7 @@
 <ng-template #previewContent>
   <div class="thumb-preview position-absolute pe-none text-center" [class.fade]="previewLoaded">
     @if (showThumbnailOverlay) {
-      <img [src]="thumbUrl | safeUrl" class="mx-auto" [attr.width]="previewZoomScale === 'page-fit' ? 'auto' : '100%'" [attr.height]="previewZoomScale === 'page-fit' ? '100%' : 'auto'" alt="Document loading..." i18n-alt />
+      <img [src]="thumbUrl" class="mx-auto" [attr.width]="previewZoomScale === 'page-fit' ? 'auto' : '100%'" [attr.height]="previewZoomScale === 'page-fit' ? '100%' : 'auto'" alt="Document loading..." i18n-alt />
     }
     <div class="position-absolute top-0 start-0 m-2 p-2 d-flex align-items-center justify-content-center">
       <div>
@@ -414,7 +414,7 @@
       }
       @case (ContentRenderType.Image) {
         <div class="preview-sticky">
-          <img [src]="previewUrl | safeUrl" width="100%" height="100%" alt="{{title}}" />
+          <img [src]="previewUrl" width="100%" height="100%" alt="{{title}}" />
         </div>
       }
       @case (ContentRenderType.TIFF) {

src-ui/src/app/components/document-list/document-card-small/document-card-small.component.html

@@ -15,7 +15,7 @@
       }
 
       @if (document && displayFields?.includes(DisplayField.TAGS)) {
-        <div class="tags d-flex flex-column text-end position-absolute me-1 fs-6" [class.tags-no-wrap]="document.tags.length > 3">
+        <div class="tags d-flex flex-column text-end position-absolute me-1 fs-6">
           @for (tagID of tagIDs; track tagID) {
             <pngx-tag [tagID]="tagID" (click)="clickTag.emit(tagID);$event.stopPropagation()" [clickable]="true" linkTitle="Toggle tag filter" i18n-linkTitle></pngx-tag>
           }

src-ui/src/app/components/document-list/document-card-small/document-card-small.component.scss

@@ -72,14 +72,4 @@ a {
   max-width: 80%;
   row-gap: .2rem;
   line-height: 1;
-
-  &.tags-no-wrap {
-    ::ng-deep .badge {
-      display: inline-block;
-      max-width: 100%;
-      white-space: nowrap;
-      overflow: hidden;
-      text-overflow: ellipsis;
-    }
-  }
 }

src-ui/src/app/components/document-list/document-card-small/document-card-small.component.spec.ts

@@ -82,16 +82,6 @@ describe('DocumentCardSmallComponent', () => {
     ).toHaveLength(6)
   })
 
-  it('should clear hidden tag counter when tag count falls below the limit', () => {
-    expect(component.moreTags).toEqual(3)
-
-    component.document.tags = [1, 2, 3, 4, 5, 6]
-    fixture.detectChanges()
-
-    expect(component.moreTags).toBeNull()
-    expect(fixture.nativeElement.textContent).not.toContain('+ 3')
-  })
-
   it('should try to close the preview on mouse leave', () => {
     component.popupPreview = {
       close: jest.fn(),

src-ui/src/app/components/document-list/document-card-small/document-card-small.component.ts

@@ -126,7 +126,6 @@ export class DocumentCardSmallComponent
       this.moreTags = this.document.tags.length - (limit - 1)
       return this.document.tags.slice(0, limit - 1)
     } else {
-      this.moreTags = null
       return this.document.tags
     }
   }

src-ui/src/app/components/manage/management-list/management-list.component.html

@@ -62,9 +62,9 @@
 
 @if (!loading) {
   <div class="d-flex mb-2">
-    @if (displayCollectionSize > 0) {
+    @if (collectionSize > 0) {
       <div>
-        <ng-container i18n>{displayCollectionSize, plural, =1 {One {{typeName}}} other {{{displayCollectionSize || 0}} total {{typeNamePlural}}}}</ng-container>
+        <ng-container i18n>{collectionSize, plural, =1 {One {{typeName}}} other {{{collectionSize || 0}} total {{typeNamePlural}}}}</ng-container>
         @if (selectedObjects.size > 0) {
           &nbsp;({{selectedObjects.size}} selected)
         }

src-ui/src/app/components/manage/management-list/management-list.component.spec.ts

@@ -229,22 +229,6 @@ describe('ManagementListComponent', () => {
     expect(reloadSpy).toHaveBeenCalled()
   })
 
-  it('should use API count for pagination and all ids for displayed total', fakeAsync(() => {
-    jest.spyOn(tagService, 'listFiltered').mockReturnValueOnce(
-      of({
-        count: 1,
-        all: [1, 2, 3],
-        results: tags.slice(0, 1),
-      })
-    )
-
-    component.reloadData()
-    tick(100)
-
-    expect(component.collectionSize).toBe(1)
-    expect(component.displayCollectionSize).toBe(3)
-  }))
-
   it('should support quick filter for objects', () => {
     const qfSpy = jest.spyOn(documentListViewService, 'quickFilter')
     const filterButton = fixture.debugElement.queryAll(By.css('button'))[9]

src-ui/src/app/components/manage/management-list/management-list.component.ts

@@ -23,7 +23,6 @@ import {
   MatchingModel,
 } from 'src/app/data/matching-model'
 import { ObjectWithPermissions } from 'src/app/data/object-with-permissions'
-import { Results } from 'src/app/data/results'
 import {
   SortableDirective,
   SortEvent,
@@ -89,7 +88,6 @@ export abstract class ManagementListComponent<T extends MatchingModel>
   public page = 1
 
   public collectionSize = 0
-  public displayCollectionSize = 0
 
   public sortField: string
   public sortReverse: boolean
@@ -143,14 +141,6 @@ export abstract class ManagementListComponent<T extends MatchingModel>
     return data
   }
 
-  protected getCollectionSize(results: Results<T>): number {
-    return results.all?.length ?? results.count
-  }
-
-  protected getDisplayCollectionSize(results: Results<T>): number {
-    return this.getCollectionSize(results)
-  }
-
   getDocumentCount(object: MatchingModel): number {
     return (
       object.document_count ??
@@ -181,8 +171,7 @@ export abstract class ManagementListComponent<T extends MatchingModel>
         tap((c) => {
           this.unfilteredData = c.results
           this.data = this.filterData(c.results)
-          this.collectionSize = this.getCollectionSize(c)
-          this.displayCollectionSize = this.getDisplayCollectionSize(c)
+          this.collectionSize = c.count
         }),
         delay(100)
       )
@@ -375,7 +364,7 @@ export abstract class ManagementListComponent<T extends MatchingModel>
       backdrop: 'static',
     })
     modal.componentInstance.title = $localize`Confirm delete`
-    modal.componentInstance.messageBold = $localize`This operation will permanently delete the selected ${this.typeNamePlural}.`
+    modal.componentInstance.messageBold = $localize`This operation will permanently delete all objects.`
     modal.componentInstance.message = $localize`This operation cannot be undone.`
     modal.componentInstance.btnClass = 'btn-danger'
     modal.componentInstance.btnCaption = $localize`Proceed`

src-ui/src/app/components/manage/saved-views/saved-views.component.html

@@ -51,7 +51,6 @@
             @if (displayFields) {
               <pngx-input-drag-drop-select i18n-title title="Show" i18n-emptyText emptyText="Default" [items]="displayFields" formControlName="display_fields"></pngx-input-drag-drop-select>
             }
-            <span class="small text-muted fst-italic" i18n>Note: ordering is not preserved</span>
           </div>
       </div>
       </li>

src-ui/src/app/components/manage/tag-list/tag-list.component.ts

@@ -7,7 +7,6 @@ import {
 } from '@ng-bootstrap/ng-bootstrap'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
 import { FILTER_HAS_TAGS_ALL } from 'src/app/data/filter-rule-type'
-import { Results } from 'src/app/data/results'
 import { Tag } from 'src/app/data/tag'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { SortableDirective } from 'src/app/directives/sortable.directive'
@@ -78,16 +77,6 @@ export class TagListComponent extends ManagementListComponent<Tag> {
     return data.filter((tag) => !tag.parent || !availableIds.has(tag.parent))
   }
 
-  protected override getCollectionSize(results: Results<Tag>): number {
-    // Tag list pages are requested with is_root=true (when unfiltered), so
-    // pagination must follow root count even though `all` includes descendants
-    return results.count
-  }
-
-  protected override getDisplayCollectionSize(results: Results<Tag>): number {
-    return super.getCollectionSize(results)
-  }
-
   protected override getSelectableIDs(tags: Tag[]): number[] {
     const ids: number[] = []
     for (const tag of tags.filter(Boolean)) {

src-ui/src/app/services/settings.service.ts

@@ -136,6 +136,12 @@ const LANGUAGE_OPTIONS = [
     englishName: 'Hungarian',
     dateInputFormat: 'yyyy.mm.dd',
   },
+  {
+    code: 'id-id',
+    name: $localize`Indonesian`,
+    englishName: 'Indonesian',
+    dateInputFormat: 'dd-mm-yyyy',
+  },
   {
     code: 'it-it',
     name: $localize`Italian`,

src-ui/src/environments/environment.prod.ts

@@ -6,7 +6,7 @@ export const environment = {
   apiVersion: '9', // match src/paperless/settings.py
   appTitle: 'Paperless-ngx',
   tag: 'prod',
-  version: '2.20.10',
+  version: '2.20.3',
   webSocketHost: window.location.host,
   webSocketProtocol: window.location.protocol == 'https:' ? 'wss:' : 'ws:',
   webSocketBaseUrl: base_url.pathname + 'ws/',

src-ui/src/main.ts

@@ -171,6 +171,7 @@ import localeFa from '@angular/common/locales/fa'
 import localeFi from '@angular/common/locales/fi'
 import localeFr from '@angular/common/locales/fr'
 import localeHu from '@angular/common/locales/hu'
+import localeId from '@angular/common/locales/id'
 import localeIt from '@angular/common/locales/it'
 import localeJa from '@angular/common/locales/ja'
 import localeKo from '@angular/common/locales/ko'
@@ -209,6 +210,7 @@ registerLocaleData(localeFa)
 registerLocaleData(localeFi)
 registerLocaleData(localeFr)
 registerLocaleData(localeHu)
+registerLocaleData(localeId)
 registerLocaleData(localeIt)
 registerLocaleData(localeJa)
 registerLocaleData(localeKo)

src-ui/src/theme.scss

@@ -149,10 +149,6 @@ $form-check-radio-checked-bg-image-dark: url("data:image/svg+xml,<svg xmlns='htt
     background-color: var(--pngx-body-color-accent);
   }
 
-  .list-group-item-action:not(.active):active {
-    --bs-list-group-action-active-color: var(--bs-body-color);
-    --bs-list-group-action-active-bg: var(--pngx-bg-darker);
-  }
   .search-container {
     input, input:focus, i-bs[name="search"] , ::placeholder {
       color: var(--pngx-primary-text-contrast) !important;

src/documents/barcodes.py

@@ -186,7 +186,11 @@ class BarcodePlugin(ConsumeTaskPlugin):
 
         # Update/overwrite an ASN if possible
         # After splitting, as otherwise each split document gets the same ASN
-        if self.settings.barcode_enable_asn and (located_asn := self.asn) is not None:
+        if (
+            self.settings.barcode_enable_asn
+            and not self.metadata.skip_asn
+            and (located_asn := self.asn) is not None
+        ):
             logger.info(f"Found ASN in barcode: {located_asn}")
             self.metadata.asn = located_asn
 

src/documents/bulk_edit.py

@@ -433,6 +433,8 @@ def merge(
 
     if user is not None:
         overrides.owner_id = user.id
+    # Avoid copying or detecting ASN from merged PDFs to prevent collision
+    overrides.skip_asn = True
 
     logger.info("Adding merged document to the task queue.")
 

src/documents/consumer.py

@@ -19,7 +19,6 @@ from documents.classifier import load_classifier
 from documents.data_models import ConsumableDocument
 from documents.data_models import DocumentMetadataOverrides
 from documents.file_handling import create_source_path_directory
-from documents.file_handling import generate_filename
 from documents.file_handling import generate_unique_filename
 from documents.loggers import LoggingMixin
 from documents.models import Correspondent
@@ -47,6 +46,7 @@ from documents.signals.handlers import run_workflows
 from documents.templating.workflows import parse_w_workflow_placeholders
 from documents.utils import copy_basic_file_stats
 from documents.utils import copy_file_with_basic_stats
+from documents.utils import normalize_nfc
 from documents.utils import run_subprocess
 from paperless_mail.parsers import MailDocumentParser
 
@@ -112,7 +112,12 @@ class ConsumerPluginMixin:
 
         self.renew_logging_group()
 
-        self.filename = self.metadata.filename or self.input_doc.original_file.name
+        self.metadata.filename = normalize_nfc(self.metadata.filename)
+        self.metadata.title = normalize_nfc(self.metadata.title)
+
+        self.filename = normalize_nfc(
+            self.metadata.filename or self.input_doc.original_file.name,
+        )
 
     def _send_progress(
         self,
@@ -494,19 +499,7 @@ class ConsumerPlugin(
                 # After everything is in the database, copy the files into
                 # place. If this fails, we'll also rollback the transaction.
                 with FileLock(settings.MEDIA_LOCK):
-                    generated_filename = generate_unique_filename(document)
-                    if (
-                        len(str(generated_filename))
-                        > Document.MAX_STORED_FILENAME_LENGTH
-                    ):
-                        self.log.warning(
-                            "Generated source filename exceeds db path limit, falling back to default naming",
-                        )
-                        generated_filename = generate_filename(
-                            document,
-                            use_format=False,
-                        )
-                    document.filename = generated_filename
+                    document.filename = generate_unique_filename(document)
                     create_source_path_directory(document.source_path)
 
                     self._write(
@@ -524,23 +517,10 @@ class ConsumerPlugin(
                     )
 
                     if archive_path and Path(archive_path).is_file():
-                        generated_archive_filename = generate_unique_filename(
+                        document.archive_filename = generate_unique_filename(
                             document,
                             archive_filename=True,
                         )
-                        if (
-                            len(str(generated_archive_filename))
-                            > Document.MAX_STORED_FILENAME_LENGTH
-                        ):
-                            self.log.warning(
-                                "Generated archive filename exceeds db path limit, falling back to default naming",
-                            )
-                            generated_archive_filename = generate_filename(
-                                document,
-                                archive_filename=True,
-                                use_format=False,
-                            )
-                        document.archive_filename = generated_archive_filename
                         create_source_path_directory(document.archive_path)
                         self._write(
                             document.storage_type,
@@ -678,6 +658,8 @@ class ConsumerPlugin(
                     f"Error occurred parsing title override '{self.metadata.title}', falling back to original. Exception: {e}",
                 )
 
+        title = normalize_nfc(title)
+
         file_for_checksum = (
             self.unmodified_original
             if self.unmodified_original is not None
@@ -722,7 +704,7 @@ class ConsumerPlugin(
                 pk=self.metadata.storage_path_id,
             )
 
-        if self.metadata.asn is not None:
+        if self.metadata.asn is not None and not self.metadata.skip_asn:
             document.archive_serial_number = self.metadata.asn
 
         if self.metadata.owner_id:
@@ -838,8 +820,8 @@ class ConsumerPreflightPlugin(
         """
         Check that if override_asn is given, it is unique and within a valid range
         """
-        if self.metadata.asn is None:
-            # check not necessary in case no ASN gets set
+        if self.metadata.skip_asn or self.metadata.asn is None:
+            # if skip is set or ASN is None
             return
         # Validate the range is above zero and less than uint32_t max
         # otherwise, Whoosh can't handle it in the index

src/documents/data_models.py

@@ -30,6 +30,7 @@ class DocumentMetadataOverrides:
     change_users: list[int] | None = None
     change_groups: list[int] | None = None
     custom_fields: dict | None = None
+    skip_asn: bool = False
 
     def update(self, other: "DocumentMetadataOverrides") -> "DocumentMetadataOverrides":
         """
@@ -49,6 +50,8 @@ class DocumentMetadataOverrides:
             self.storage_path_id = other.storage_path_id
         if other.owner_id is not None:
             self.owner_id = other.owner_id
+        if other.skip_asn:
+            self.skip_asn = True
 
         # merge
         if self.tag_ids is None:
@@ -115,7 +118,7 @@ class DocumentMetadataOverrides:
             ).values_list("id", flat=True),
         )
         overrides.custom_fields = {
-            custom_field.field.id: custom_field.value
+            custom_field.id: custom_field.value
             for custom_field in doc.custom_fields.all()
         }
 

src/documents/file_handling.py

@@ -6,6 +6,7 @@ from django.conf import settings
 from documents.models import Document
 from documents.templating.filepath import validate_filepath_template_and_render
 from documents.templating.utils import convert_format_str_to_template_format
+from documents.utils import normalize_nfc
 
 
 def create_source_path_directory(source_path: Path) -> None:
@@ -55,11 +56,11 @@ def generate_unique_filename(doc, *, archive_filename=False) -> Path:
     """
     if archive_filename:
         old_filename: Path | None = (
-            Path(doc.archive_filename) if doc.archive_filename else None
+            Path(normalize_nfc(doc.archive_filename)) if doc.archive_filename else None
         )
         root = settings.ARCHIVE_DIR
     else:
-        old_filename = Path(doc.filename) if doc.filename else None
+        old_filename = Path(normalize_nfc(doc.filename)) if doc.filename else None
         root = settings.ORIGINALS_DIR
 
     # If generating archive filenames, try to make a name that is similar to
@@ -91,7 +92,7 @@ def generate_unique_filename(doc, *, archive_filename=False) -> Path:
         )
         if new_filename == old_filename:
             # still the same as before.
-            return new_filename
+            return Path(normalize_nfc(str(new_filename)))
 
         if (root / new_filename).exists():
             counter += 1
@@ -119,7 +120,7 @@ def format_filename(document: Document, template_str: str) -> str | None:
         "none",
     )  # backward compatibility
 
-    return rendered_filename
+    return normalize_nfc(rendered_filename)
 
 
 def generate_filename(
@@ -128,21 +129,17 @@ def generate_filename(
     counter=0,
     append_gpg=True,
     archive_filename=False,
-    use_format=True,
 ) -> Path:
     base_path: Path | None = None
 
     # Determine the source of the format string
-    if use_format:
-        if doc.storage_path is not None:
-            filename_format = doc.storage_path.path
-        elif settings.FILENAME_FORMAT is not None:
-            # Maybe convert old to new style
-            filename_format = convert_format_str_to_template_format(
-                settings.FILENAME_FORMAT,
-            )
-        else:
-            filename_format = None
+    if doc.storage_path is not None:
+        filename_format = doc.storage_path.path
+    elif settings.FILENAME_FORMAT is not None:
+        # Maybe convert old to new style
+        filename_format = convert_format_str_to_template_format(
+            settings.FILENAME_FORMAT,
+        )
     else:
         filename_format = None
 
@@ -178,4 +175,4 @@ def generate_filename(
     if append_gpg and doc.storage_type == doc.STORAGE_TYPE_GPG:
         full_path = full_path.with_suffix(full_path.suffix + ".gpg")
 
-    return full_path
+    return Path(normalize_nfc(str(full_path)))

src/documents/filters.py

@@ -41,6 +41,7 @@ from documents.models import PaperlessTask
 from documents.models import ShareLink
 from documents.models import StoragePath
 from documents.models import Tag
+from documents.utils import normalize_nfc
 
 if TYPE_CHECKING:
     from collections.abc import Callable
@@ -162,7 +163,11 @@ class TitleContentFilter(Filter):
     def filter(self, qs, value):
         value = value.strip() if isinstance(value, str) else value
         if value:
-            return qs.filter(Q(title__icontains=value) | Q(content__icontains=value))
+            normalized = normalize_nfc(value) or ""
+            folded = normalized.casefold()
+            return qs.filter(
+                Q(title__icontains=folded) | Q(content__icontains=folded),
+            )
         else:
             return qs
 

src/documents/index.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import logging
 import math
 import re
+import unicodedata
 from collections import Counter
 from contextlib import contextmanager
 from datetime import datetime
@@ -10,7 +11,6 @@ from datetime import time
 from datetime import timedelta
 from datetime import timezone
 from shutil import rmtree
-from time import sleep
 from typing import TYPE_CHECKING
 from typing import Literal
 
@@ -33,7 +33,6 @@ from whoosh.highlight import HtmlFormatter
 from whoosh.idsets import BitSet
 from whoosh.idsets import DocIdSet
 from whoosh.index import FileIndex
-from whoosh.index import LockError
 from whoosh.index import create_in
 from whoosh.index import exists_in
 from whoosh.index import open_dir
@@ -60,6 +59,14 @@ if TYPE_CHECKING:
 logger = logging.getLogger("paperless.index")
 
 
+def _normalize_for_index(value: str | None) -> str | None:
+    """Normalize text to NFC for consistent search/index matching."""
+
+    if value is None:
+        return None
+    return unicodedata.normalize("NFC", value)
+
+
 def get_schema() -> Schema:
     return Schema(
         id=NUMERIC(stored=True, unique=True),
@@ -99,33 +106,11 @@ def get_schema() -> Schema:
 
 
 def open_index(*, recreate=False) -> FileIndex:
-    transient_exceptions = (FileNotFoundError, LockError)
-    max_retries = 3
-    retry_delay = 0.1
-
-    for attempt in range(max_retries + 1):
-        try:
-            if exists_in(settings.INDEX_DIR) and not recreate:
-                return open_dir(settings.INDEX_DIR, schema=get_schema())
-            break
-        except transient_exceptions as exc:
-            is_last_attempt = attempt == max_retries or recreate
-            if is_last_attempt:
-                logger.exception(
-                    "Error while opening the index after retries, recreating.",
-                )
-                break
-
-            logger.warning(
-                "Transient error while opening the index (attempt %s/%s): %s. Retrying.",
-                attempt + 1,
-                max_retries + 1,
-                exc,
-            )
-            sleep(retry_delay)
-        except Exception:
-            logger.exception("Error while opening the index, recreating.")
-            break
+    try:
+        if exists_in(settings.INDEX_DIR) and not recreate:
+            return open_dir(settings.INDEX_DIR, schema=get_schema())
+    except Exception:
+        logger.exception("Error while opening the index, recreating.")
 
     # create_in doesn't handle corrupted indexes very well, remove the directory entirely first
     if settings.INDEX_DIR.is_dir():
@@ -187,37 +172,41 @@ def update_document(writer: AsyncWriter, doc: Document) -> None:
     viewer_ids: str = ",".join([str(u.id) for u in users_with_perms])
     writer.update_document(
         id=doc.pk,
-        title=doc.title,
-        content=doc.content,
-        correspondent=doc.correspondent.name if doc.correspondent else None,
+        title=_normalize_for_index(doc.title),
+        content=_normalize_for_index(doc.content),
+        correspondent=_normalize_for_index(
+            doc.correspondent.name if doc.correspondent else None,
+        ),
         correspondent_id=doc.correspondent.id if doc.correspondent else None,
         has_correspondent=doc.correspondent is not None,
-        tag=tags if tags else None,
+        tag=_normalize_for_index(tags) if tags else None,
         tag_id=tags_ids if tags_ids else None,
         has_tag=len(tags) > 0,
-        type=doc.document_type.name if doc.document_type else None,
+        type=_normalize_for_index(
+            doc.document_type.name if doc.document_type else None,
+        ),
         type_id=doc.document_type.id if doc.document_type else None,
         has_type=doc.document_type is not None,
         created=datetime.combine(doc.created, time.min),
         added=doc.added,
         asn=asn,
         modified=doc.modified,
-        path=doc.storage_path.name if doc.storage_path else None,
+        path=_normalize_for_index(doc.storage_path.name if doc.storage_path else None),
         path_id=doc.storage_path.id if doc.storage_path else None,
         has_path=doc.storage_path is not None,
-        notes=notes,
+        notes=_normalize_for_index(notes),
         num_notes=len(notes),
-        custom_fields=custom_fields,
+        custom_fields=_normalize_for_index(custom_fields),
         custom_field_count=len(doc.custom_fields.all()),
         has_custom_fields=len(custom_fields) > 0,
         custom_fields_id=custom_fields_ids if custom_fields_ids else None,
-        owner=doc.owner.username if doc.owner else None,
+        owner=_normalize_for_index(doc.owner.username if doc.owner else None),
         owner_id=doc.owner.id if doc.owner else None,
         has_owner=doc.owner is not None,
         viewer_id=viewer_ids if viewer_ids else None,
         checksum=doc.checksum,
         page_count=doc.page_count,
-        original_filename=doc.original_filename,
+        original_filename=_normalize_for_index(doc.original_filename),
         is_shared=len(viewer_ids) > 0,
     )
     logger.debug(f"Index updated for document {doc.pk}.")
@@ -445,7 +434,7 @@ class LocalDateParser(English):
 
 class DelayedFullTextQuery(DelayedQuery):
     def _get_query(self) -> tuple:
-        q_str = self.query_params["query"]
+        q_str = _normalize_for_index(self.query_params["query"]) or ""
         q_str = rewrite_natural_date_keywords(q_str)
         qp = MultifieldParser(
             [
@@ -484,7 +473,12 @@ class DelayedFullTextQuery(DelayedQuery):
 class DelayedMoreLikeThisQuery(DelayedQuery):
     def _get_query(self) -> tuple:
         more_like_doc_id = int(self.query_params["more_like_id"])
-        content = Document.objects.get(id=more_like_doc_id).content
+        content = (
+            _normalize_for_index(
+                Document.objects.get(id=more_like_doc_id).content,
+            )
+            or ""
+        )
 
         docnum = self.searcher.document_number(id=more_like_doc_id)
         kts = self.searcher.key_terms_from_text(
@@ -512,6 +506,7 @@ def autocomplete(
     Mimics whoosh.reading.IndexReader.most_distinctive_terms with permissions
     and without scoring
     """
+    term = _normalize_for_index(term) or ""
     terms = []
 
     with ix.searcher(weighting=TF_IDF()) as s:
@@ -602,7 +597,7 @@ def rewrite_natural_date_keywords(query_string: str) -> str:
 
             case "this year":
                 start = datetime(local_now.year, 1, 1, 0, 0, 0, tzinfo=tz)
-                end = datetime(local_now.year, 12, 31, 23, 59, 59, tzinfo=tz)
+                end = datetime.combine(today, time.max, tzinfo=tz)
 
             case "previous week":
                 days_since_monday = local_now.weekday()

src/documents/matching.py

@@ -2,10 +2,12 @@ from __future__ import annotations
 
 import logging
 import re
+import unicodedata
 from fnmatch import fnmatch
 from fnmatch import translate as fnmatch_translate
 from typing import TYPE_CHECKING
 
+from django.db.models import Q
 from rest_framework import serializers
 
 from documents.data_models import ConsumableDocument
@@ -21,6 +23,7 @@ from documents.models import Workflow
 from documents.models import WorkflowTrigger
 from documents.permissions import get_objects_for_user_owner_aware
 from documents.regex import safe_regex_search
+from documents.utils import normalize_nfc
 
 if TYPE_CHECKING:
     from django.db.models import QuerySet
@@ -30,6 +33,34 @@ if TYPE_CHECKING:
 logger = logging.getLogger("paperless.matching")
 
 
+def _normalize_glob_value(value: str) -> str:
+    """Normalize strings for glob-style matching (case-insensitive)."""
+
+    return (normalize_nfc(value) or "").casefold()
+
+
+def _normalized_fnmatch(name: str, pattern: str) -> bool:
+    """Canonicalize Unicode and compare using fnmatch semantics."""
+
+    return fnmatch(_normalize_glob_value(name), _normalize_glob_value(pattern))
+
+
+def _glob_regex_variants(pattern: str) -> list[str]:
+    """
+    Build regex patterns that match both NFC and NFD forms of a glob pattern.
+    Using both forms lets DB prefilters remain Unicode-normalization agnostic.
+    """
+
+    regexes = set()
+    for normalized in {
+        normalize_nfc(pattern) or "",
+        unicodedata.normalize("NFD", pattern),
+    }:
+        regex = fnmatch_translate(normalized).lstrip("^").rstrip("$")
+        regexes.add(regex)
+    return list(regexes)
+
+
 def log_reason(
     matching_model: MatchingModel | WorkflowTrigger,
     document: Document,
@@ -305,9 +336,9 @@ def consumable_document_matches_workflow(
     if (
         trigger.filter_filename is not None
         and len(trigger.filter_filename) > 0
-        and not fnmatch(
-            document.original_file.name.lower(),
-            trigger.filter_filename.lower(),
+        and not _normalized_fnmatch(
+            document.original_file.name,
+            trigger.filter_filename,
         )
     ):
         reason = (
@@ -328,7 +359,7 @@ def consumable_document_matches_workflow(
     if (
         trigger.filter_path is not None
         and len(trigger.filter_path) > 0
-        and not fnmatch(
+        and not _normalized_fnmatch(
             match_against,
             trigger.filter_path,
         )
@@ -492,9 +523,9 @@ def existing_document_matches_workflow(
         trigger.filter_filename is not None
         and len(trigger.filter_filename) > 0
         and document.original_filename is not None
-        and not fnmatch(
-            document.original_filename.lower(),
-            trigger.filter_filename.lower(),
+        and not _normalized_fnmatch(
+            document.original_filename,
+            trigger.filter_filename,
         )
     ):
         return (
@@ -573,8 +604,11 @@ def prefilter_documents_by_workflowtrigger(
         documents = documents.annotate(**annotations).filter(custom_field_q)
 
     if trigger.filter_filename:
-        regex = fnmatch_translate(trigger.filter_filename).lstrip("^").rstrip("$")
-        documents = documents.filter(original_filename__iregex=regex)
+        regexes = _glob_regex_variants(trigger.filter_filename)
+        filename_q = Q()
+        for regex in regexes:
+            filename_q |= Q(original_filename__iregex=regex)
+        documents = documents.filter(filename_q)
 
     return documents
 

src/documents/migrations/1075_workflowaction_order.py

@@ -1,28 +0,0 @@
-# Generated by Django 5.2.7 on 2026-01-14 16:53
-
-from django.db import migrations
-from django.db import models
-from django.db.models import F
-
-
-def populate_action_order(apps, schema_editor):
-    WorkflowAction = apps.get_model("documents", "WorkflowAction")
-    WorkflowAction.objects.all().update(order=F("id"))
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ("documents", "1074_workflowrun_deleted_at_workflowrun_restored_at_and_more"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="workflowaction",
-            name="order",
-            field=models.PositiveIntegerField(default=0, verbose_name="order"),
-        ),
-        migrations.RunPython(
-            populate_action_order,
-            reverse_code=migrations.RunPython.noop,
-        ),
-    ]

src/documents/models.py

@@ -160,7 +160,6 @@ class Document(SoftDeleteModel, ModelWithOwner):
         (STORAGE_TYPE_UNENCRYPTED, _("Unencrypted")),
         (STORAGE_TYPE_GPG, _("Encrypted with GNU Privacy Guard")),
     )
-    MAX_STORED_FILENAME_LENGTH: Final[int] = 1024
 
     correspondent = models.ForeignKey(
         Correspondent,
@@ -268,7 +267,7 @@ class Document(SoftDeleteModel, ModelWithOwner):
 
     filename = models.FilePathField(
         _("filename"),
-        max_length=MAX_STORED_FILENAME_LENGTH,
+        max_length=1024,
         editable=False,
         default=None,
         unique=True,
@@ -278,7 +277,7 @@ class Document(SoftDeleteModel, ModelWithOwner):
 
     archive_filename = models.FilePathField(
         _("archive filename"),
-        max_length=MAX_STORED_FILENAME_LENGTH,
+        max_length=1024,
         editable=False,
         default=None,
         unique=True,
@@ -288,7 +287,7 @@ class Document(SoftDeleteModel, ModelWithOwner):
 
     original_filename = models.CharField(
         _("original filename"),
-        max_length=MAX_STORED_FILENAME_LENGTH,
+        max_length=1024,
         editable=False,
         default=None,
         unique=False,
@@ -1295,8 +1294,6 @@ class WorkflowAction(models.Model):
         default=WorkflowActionType.ASSIGNMENT,
     )
 
-    order = models.PositiveIntegerField(_("order"), default=0)
-
     assign_title = models.TextField(
         _("assign title"),
         null=True,

src/documents/permissions.py

@@ -2,17 +2,10 @@ from django.contrib.auth.models import Group
 from django.contrib.auth.models import Permission
 from django.contrib.auth.models import User
 from django.contrib.contenttypes.models import ContentType
-from django.db.models import Count
-from django.db.models import IntegerField
-from django.db.models import OuterRef
 from django.db.models import Q
 from django.db.models import QuerySet
-from django.db.models import Subquery
-from django.db.models.functions import Cast
-from django.db.models.functions import Coalesce
 from guardian.core import ObjectPermissionChecker
 from guardian.models import GroupObjectPermission
-from guardian.models import UserObjectPermission
 from guardian.shortcuts import assign_perm
 from guardian.shortcuts import get_objects_for_user
 from guardian.shortcuts import get_users_with_perms
@@ -136,96 +129,23 @@ def set_permissions_for_object(permissions: dict, object, *, merge: bool = False
                         )
 
 
-def _permitted_document_ids(user):
-    """
-    Return a queryset of document IDs the user may view, limited to non-deleted
-    documents. This intentionally avoids ``get_objects_for_user`` to keep the
-    subquery small and index-friendly.
-    """
-
-    base_docs = Document.objects.filter(deleted_at__isnull=True).only("id", "owner")
-
-    if user is None or not getattr(user, "is_authenticated", False):
-        # Just Anonymous user e.g. for drf-spectacular
-        return base_docs.filter(owner__isnull=True).values_list("id", flat=True)
-
-    if getattr(user, "is_superuser", False):
-        return base_docs.values_list("id", flat=True)
-
-    document_ct = ContentType.objects.get_for_model(Document)
-    perm_filter = {
-        "permission__codename": "view_document",
-        "permission__content_type": document_ct,
-    }
-
-    user_perm_docs = (
-        UserObjectPermission.objects.filter(user=user, **perm_filter)
-        .annotate(object_pk_int=Cast("object_pk", IntegerField()))
-        .values_list("object_pk_int", flat=True)
-    )
-
-    group_perm_docs = (
-        GroupObjectPermission.objects.filter(group__user=user, **perm_filter)
-        .annotate(object_pk_int=Cast("object_pk", IntegerField()))
-        .values_list("object_pk_int", flat=True)
-    )
-
-    permitted_documents = user_perm_docs.union(group_perm_docs)
-
-    return base_docs.filter(
-        Q(owner=user) | Q(owner__isnull=True) | Q(id__in=permitted_documents),
-    ).values_list("id", flat=True)
-
-
 def get_document_count_filter_for_user(user):
     """
     Return the Q object used to filter document counts for the given user.
-
-    The filter is expressed as an ``id__in`` against a small subquery of permitted
-    document IDs to keep the generated SQL simple and avoid large OR clauses.
     """
 
+    if user is None or not getattr(user, "is_authenticated", False):
+        return Q(documents__deleted_at__isnull=True, documents__owner__isnull=True)
     if getattr(user, "is_superuser", False):
-        # Superuser: no permission filtering needed
         return Q(documents__deleted_at__isnull=True)
-
-    permitted_ids = _permitted_document_ids(user)
-    return Q(documents__id__in=permitted_ids)
-
-
-def annotate_document_count_for_related_queryset(
-    queryset,
-    through_model,
-    related_object_field: str,
-    target_field: str = "document_id",
-    user=None,
-):
-    """
-    Annotate a queryset with permissions-aware document counts using a subquery
-    against a relation table.
-
-    Args:
-        queryset: base queryset to annotate (must contain pk)
-        through_model: model representing the relation (e.g., Document.tags.through
-                       or CustomFieldInstance)
-        source_field: field on the relation pointing back to queryset pk
-        target_field: field on the relation pointing to Document id
-        user: the user for whom to filter permitted document ids
-    """
-
-    permitted_ids = _permitted_document_ids(user)
-    counts = (
-        through_model.objects.filter(
-            **{
-                related_object_field: OuterRef("pk"),
-                f"{target_field}__in": permitted_ids,
-            },
-        )
-        .values(related_object_field)
-        .annotate(c=Count(target_field))
-        .values("c")
+    return Q(
+        documents__deleted_at__isnull=True,
+        documents__id__in=get_objects_for_user_owner_aware(
+            user,
+            "documents.view_document",
+            Document,
+        ).values_list("id", flat=True),
     )
-    return queryset.annotate(document_count=Coalesce(Subquery(counts[:1]), 0))
 
 
 def get_objects_for_user_owner_aware(user, perms, Model) -> QuerySet:

src/documents/serialisers.py

@@ -6,7 +6,6 @@ import re
 from datetime import datetime
 from decimal import Decimal
 from typing import TYPE_CHECKING
-from typing import Any
 from typing import Literal
 
 import magic
@@ -41,7 +40,6 @@ from guardian.utils import get_group_obj_perms_model
 from guardian.utils import get_user_obj_perms_model
 from rest_framework import fields
 from rest_framework import serializers
-from rest_framework.exceptions import PermissionDenied
 from rest_framework.fields import SerializerMethodField
 from rest_framework.filters import OrderingFilter
 
@@ -74,8 +72,6 @@ from documents.models import WorkflowTrigger
 from documents.parsers import is_mime_type_supported
 from documents.permissions import get_document_count_filter_for_user
 from documents.permissions import get_groups_with_only_permission
-from documents.permissions import get_objects_for_user_owner_aware
-from documents.permissions import has_perms_owner_aware
 from documents.permissions import set_permissions_for_object
 from documents.regex import validate_regex_pattern
 from documents.templating.filepath import validate_filepath_template_and_render
@@ -440,19 +436,6 @@ class OwnedObjectSerializer(
         return instance
 
     def update(self, instance, validated_data):
-        user = getattr(self, "user", None)
-        is_superuser = user.is_superuser if user is not None else False
-        is_owner = instance.owner == user if user is not None else False
-        is_unowned = instance.owner is None
-
-        if (
-            ("owner" in validated_data and validated_data["owner"] != instance.owner)
-            or "set_permissions" in validated_data
-        ) and not (is_superuser or is_owner or is_unowned):
-            raise PermissionDenied(
-                _("Insufficient permissions."),
-            )
-
         if "set_permissions" in validated_data:
             self._set_permissions(validated_data["set_permissions"], instance)
         self.validate_unique_together(validated_data, instance)
@@ -597,34 +580,30 @@ class TagSerializer(MatchingModelSerializer, OwnedObjectSerializer):
         ),
     )
     def get_children(self, obj):
-        children_map = self.context.get("children_map")
-        if children_map is not None:
-            children = children_map.get(obj.pk, [])
-        else:
-            filter_q = self.context.get("document_count_filter")
-            request = self.context.get("request")
-            if filter_q is None:
-                user = getattr(request, "user", None) if request else None
-                filter_q = get_document_count_filter_for_user(user)
-                self.context["document_count_filter"] = filter_q
+        filter_q = self.context.get("document_count_filter")
+        request = self.context.get("request")
+        if filter_q is None:
+            user = getattr(request, "user", None) if request else None
+            filter_q = get_document_count_filter_for_user(user)
+            self.context["document_count_filter"] = filter_q
 
-            children = (
-                obj.get_children_queryset()
-                .select_related("owner")
-                .annotate(document_count=Count("documents", filter=filter_q))
-            )
+        children_queryset = (
+            obj.get_children_queryset()
+            .select_related("owner")
+            .annotate(document_count=Count("documents", filter=filter_q))
+        )
 
-            view = self.context.get("view")
-            ordering = (
-                OrderingFilter().get_ordering(request, children, view)
-                if request and view
-                else None
-            )
-            ordering = ordering or (Lower("name"),)
-            children = children.order_by(*ordering)
+        view = self.context.get("view")
+        ordering = (
+            OrderingFilter().get_ordering(request, children_queryset, view)
+            if request and view
+            else None
+        )
+        ordering = ordering or (Lower("name"),)
+        children_queryset = children_queryset.order_by(*ordering)
 
         serializer = TagSerializer(
-            children,
+            children_queryset,
             many=True,
             user=self.user,
             full_perms=self.full_perms,
@@ -716,9 +695,6 @@ class StoragePathField(serializers.PrimaryKeyRelatedField):
 
 class CustomFieldSerializer(serializers.ModelSerializer):
     def __init__(self, *args, **kwargs):
-        # Ignore args passed by permissions mixin
-        kwargs.pop("user", None)
-        kwargs.pop("full_perms", None)
         context = kwargs.get("context")
         self.api_version = int(
             context.get("request").version
@@ -2180,17 +2156,6 @@ class ShareLinkSerializer(OwnedObjectSerializer):
         validated_data["slug"] = get_random_string(50)
         return super().create(validated_data)
 
-    def validate_document(self, document):
-        if self.user is not None and has_perms_owner_aware(
-            self.user,
-            "view_document",
-            document,
-        ):
-            return document
-        raise PermissionDenied(
-            _("Insufficient permissions."),
-        )
-
 
 class BulkEditObjectsSerializer(SerializerWithPerms, SetPermissionsMixin):
     objects = serializers.ListField(
@@ -2597,8 +2562,7 @@ class WorkflowSerializer(serializers.ModelSerializer):
                 set_triggers.append(trigger_instance)
 
         if actions is not None and actions is not serializers.empty:
-            for index, action in enumerate(actions):
-                action["order"] = index
+            for action in actions:
                 assign_tags = action.pop("assign_tags", None)
                 assign_view_users = action.pop("assign_view_users", None)
                 assign_view_groups = action.pop("assign_view_groups", None)
@@ -2725,16 +2689,6 @@ class WorkflowSerializer(serializers.ModelSerializer):
 
         return instance
 
-    def to_representation(self, instance):
-        data = super().to_representation(instance)
-        actions = instance.actions.order_by("order", "pk")
-        data["actions"] = WorkflowActionSerializer(
-            actions,
-            many=True,
-            context=self.context,
-        ).data
-        return data
-
 
 class TrashSerializer(SerializerWithPerms):
     documents = serializers.ListField(
@@ -2767,22 +2721,8 @@ class StoragePathTestSerializer(SerializerWithPerms):
     )
 
     document = serializers.PrimaryKeyRelatedField(
-        queryset=Document.objects.none(),
+        queryset=Document.objects.all(),
         required=True,
         label="Document",
         write_only=True,
     )
-
-    def __init__(self, *args: Any, **kwargs: Any) -> None:
-        super().__init__(*args, **kwargs)
-        request = self.context.get("request")
-        user = getattr(request, "user", None) if request else None
-        if user is not None and user.is_authenticated:
-            document_field = self.fields.get("document")
-            if not isinstance(document_field, serializers.PrimaryKeyRelatedField):
-                return
-            document_field.queryset = get_objects_for_user_owner_aware(
-                user,
-                "documents.view_document",
-                Document,
-            )

src/documents/signals/handlers.py

@@ -418,15 +418,7 @@ def update_filename_and_move_files(
             return
         instance = instance.document
 
-    def validate_move(instance, old_path: Path, new_path: Path, root: Path):
-        if not new_path.is_relative_to(root):
-            msg = (
-                f"Document {instance!s}: Refusing to move file outside root {root}: "
-                f"{new_path}."
-            )
-            logger.warning(msg)
-            raise CannotMoveFilesException(msg)
-
+    def validate_move(instance, old_path: Path, new_path: Path):
         if not old_path.is_file():
             # Can't do anything if the old file does not exist anymore.
             msg = f"Document {instance!s}: File {old_path} doesn't exist."
@@ -460,22 +452,8 @@ def update_filename_and_move_files(
 
             old_filename = instance.filename
             old_source_path = instance.source_path
-            move_original = False
-
-            old_archive_filename = instance.archive_filename
-            old_archive_path = instance.archive_path
-            move_archive = False
 
             candidate_filename = generate_filename(instance)
-            if len(str(candidate_filename)) > Document.MAX_STORED_FILENAME_LENGTH:
-                msg = (
-                    f"Document {instance!s}: Generated filename exceeds db path "
-                    f"limit ({len(str(candidate_filename))} > "
-                    f"{Document.MAX_STORED_FILENAME_LENGTH}): {candidate_filename!s}"
-                )
-                logger.warning(msg)
-                raise CannotMoveFilesException(msg)
-
             candidate_source_path = (
                 settings.ORIGINALS_DIR / candidate_filename
             ).resolve()
@@ -494,16 +472,11 @@ def update_filename_and_move_files(
             instance.filename = str(new_filename)
             move_original = old_filename != instance.filename
 
+            old_archive_filename = instance.archive_filename
+            old_archive_path = instance.archive_path
+
             if instance.has_archive_version:
                 archive_candidate = generate_filename(instance, archive_filename=True)
-                if len(str(archive_candidate)) > Document.MAX_STORED_FILENAME_LENGTH:
-                    msg = (
-                        f"Document {instance!s}: Generated archive filename exceeds "
-                        f"db path limit ({len(str(archive_candidate))} > "
-                        f"{Document.MAX_STORED_FILENAME_LENGTH}): {archive_candidate!s}"
-                    )
-                    logger.warning(msg)
-                    raise CannotMoveFilesException(msg)
                 archive_candidate_path = (
                     settings.ARCHIVE_DIR / archive_candidate
                 ).resolve()
@@ -534,22 +507,12 @@ def update_filename_and_move_files(
                 return
 
             if move_original:
-                validate_move(
-                    instance,
-                    old_source_path,
-                    instance.source_path,
-                    settings.ORIGINALS_DIR,
-                )
+                validate_move(instance, old_source_path, instance.source_path)
                 create_source_path_directory(instance.source_path)
                 shutil.move(old_source_path, instance.source_path)
 
             if move_archive:
-                validate_move(
-                    instance,
-                    old_archive_path,
-                    instance.archive_path,
-                    settings.ARCHIVE_DIR,
-                )
+                validate_move(instance, old_archive_path, instance.archive_path)
                 create_source_path_directory(instance.archive_path)
                 shutil.move(old_archive_path, instance.archive_path)
 
@@ -788,7 +751,7 @@ def run_workflows(
 
         if matching.document_matches_workflow(document, workflow, trigger_type):
             action: WorkflowAction
-            for action in workflow.actions.order_by("order", "pk"):
+            for action in workflow.actions.all():
                 message = f"Applying {action} from {workflow}"
                 if not use_overrides:
                     logger.info(message, extra={"group": logging_group})
@@ -833,8 +796,6 @@ def run_workflows(
             if not use_overrides:
                 # limit title to 128 characters
                 document.title = document.title[:128]
-                # Make sure the filename and archive filename are accurate
-                document.refresh_from_db(fields=["filename", "archive_filename"])
                 # save first before setting tags
                 document.save()
                 document.tags.set(doc_tag_ids)

src/documents/tasks.py

@@ -493,7 +493,7 @@ def check_scheduled_workflows():
                             trigger.schedule_is_recurring
                             and workflow_runs.exists()
                             and (
-                                workflow_runs.first().run_at
+                                workflow_runs.last().run_at
                                 > now
                                 - datetime.timedelta(
                                     days=trigger.schedule_recurring_interval_days,

src/documents/templating/filepath.py

@@ -79,23 +79,6 @@ class PlaceholderString(str):
 NO_VALUE_PLACEHOLDER = PlaceholderString("-none-")
 
 
-class MatchingModelContext:
-    """
-    Safe template context for related objects.
-
-    Keeps legacy behavior where including the object ina template yields the related object's
-    name as a string, while still exposing limited attributes.
-    """
-
-    def __init__(self, *, id: int, name: str, path: str | None = None):
-        self.id = id
-        self.name = name
-        self.path = path
-
-    def __str__(self) -> str:
-        return self.name
-
-
 _template_environment.undefined = _LogStrictUndefined
 
 _template_environment.filters["get_cf_value"] = get_cf_value
@@ -210,59 +193,6 @@ def get_basic_metadata_context(
     }
 
 
-def get_safe_document_context(
-    document: Document,
-    tags: Iterable[Tag],
-) -> dict[str, object]:
-    """
-    Build a document context object to avoid supplying entire model instance.
-    """
-    return {
-        "id": document.pk,
-        "pk": document.pk,
-        "title": document.title,
-        "content": document.content,
-        "page_count": document.page_count,
-        "created": document.created,
-        "added": document.added,
-        "modified": document.modified,
-        "archive_serial_number": document.archive_serial_number,
-        "mime_type": document.mime_type,
-        "checksum": document.checksum,
-        "archive_checksum": document.archive_checksum,
-        "filename": document.filename,
-        "archive_filename": document.archive_filename,
-        "original_filename": document.original_filename,
-        "owner": {"username": document.owner.username, "id": document.owner.id}
-        if document.owner
-        else None,
-        "tags": [{"name": tag.name, "id": tag.id} for tag in tags],
-        "correspondent": (
-            MatchingModelContext(
-                name=document.correspondent.name,
-                id=document.correspondent.id,
-            )
-            if document.correspondent
-            else None
-        ),
-        "document_type": (
-            MatchingModelContext(
-                name=document.document_type.name,
-                id=document.document_type.id,
-            )
-            if document.document_type
-            else None
-        ),
-        "storage_path": MatchingModelContext(
-            name=document.storage_path.name,
-            path=document.storage_path.path,
-            id=document.storage_path.id,
-        )
-        if document.storage_path
-        else None,
-    }
-
-
 def get_tags_context(tags: Iterable[Tag]) -> dict[str, str | list[str]]:
     """
     Given an Iterable of tags, constructs some context from them for usage
@@ -332,17 +262,6 @@ def get_custom_fields_context(
     return field_data
 
 
-def _is_safe_relative_path(value: str) -> bool:
-    if value == "":
-        return True
-
-    path = PurePath(value)
-    if path.is_absolute() or path.drive:
-        return False
-
-    return ".." not in path.parts
-
-
 def validate_filepath_template_and_render(
     template_string: str,
     document: Document | None = None,
@@ -373,7 +292,7 @@ def validate_filepath_template_and_render(
 
     # Build the context dictionary
     context = (
-        {"document": get_safe_document_context(document, tags=tags_list)}
+        {"document": document}
         | get_basic_metadata_context(document, no_value_default=NO_VALUE_PLACEHOLDER)
         | get_creation_date_context(document)
         | get_added_date_context(document)
@@ -390,12 +309,6 @@ def validate_filepath_template_and_render(
         )
         rendered_template = template.render(context)
 
-        if not _is_safe_relative_path(rendered_template):
-            logger.warning(
-                "Template rendered an unsafe path (absolute or containing traversal).",
-            )
-            return None
-
         # We're good!
         return rendered_template
     except UndefinedError:

src/documents/tests/test_api_bulk_edit.py

@@ -773,22 +773,6 @@ class TestBulkEditAPI(DirectoriesMixin, APITestCase):
             ],
         )
 
-    def test_api_selection_data_requires_view_permission(self):
-        self.doc2.owner = self.user
-        self.doc2.save()
-
-        user1 = User.objects.create(username="user1")
-        self.client.force_authenticate(user=user1)
-
-        response = self.client.post(
-            "/api/documents/selection_data/",
-            json.dumps({"documents": [self.doc2.id]}),
-            content_type="application/json",
-        )
-
-        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
-        self.assertEqual(response.content, b"Insufficient permissions")
-
     @mock.patch("documents.serialisers.bulk_edit.set_permissions")
     def test_set_permissions(self, m):
         self.setup_mock(m, "set_permissions")

src/documents/tests/test_api_documents.py

@@ -1216,17 +1216,6 @@ class TestDocumentApi(DirectoriesMixin, DocumentConsumeDelayMixin, APITestCase):
 
         self.assertEqual(response.status_code, status.HTTP_405_METHOD_NOT_ALLOWED)
 
-    def test_upload_insufficient_permissions(self):
-        self.client.force_authenticate(user=User.objects.create_user("testuser2"))
-
-        with (Path(__file__).parent / "samples" / "simple.pdf").open("rb") as f:
-            response = self.client.post(
-                "/api/documents/post_document/",
-                {"document": f},
-            )
-
-        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
-
     def test_upload_empty_metadata(self):
         self.consume_file_mock.return_value = celery.result.AsyncResult(
             id=str(uuid.uuid4()),
@@ -2905,54 +2894,6 @@ class TestDocumentApi(DirectoriesMixin, DocumentConsumeDelayMixin, APITestCase):
         )
         self.assertEqual(resp.status_code, status.HTTP_200_OK)
 
-    def test_create_share_link_requires_view_permission_for_document(self):
-        """
-        GIVEN:
-            - A user with add_sharelink but without view permission on a document
-        WHEN:
-            - API request is made to create a share link for that document
-        THEN:
-            - Share link creation is denied until view permission is granted
-        """
-        user1 = User.objects.create_user(username="test1")
-        user1.user_permissions.add(*Permission.objects.filter(codename="add_sharelink"))
-        user1.save()
-
-        user2 = User.objects.create_user(username="test2")
-        user2.save()
-
-        doc = Document.objects.create(
-            title="test",
-            mime_type="application/pdf",
-            content="this is a document which will be protected",
-            owner=user2,
-        )
-
-        self.client.force_authenticate(user1)
-
-        create_resp = self.client.post(
-            "/api/share_links/",
-            data={
-                "document": doc.pk,
-                "file_version": "original",
-            },
-            format="json",
-        )
-        self.assertEqual(create_resp.status_code, status.HTTP_403_FORBIDDEN)
-
-        assign_perm("view_document", user1, doc)
-
-        create_resp = self.client.post(
-            "/api/share_links/",
-            data={
-                "document": doc.pk,
-                "file_version": "original",
-            },
-            format="json",
-        )
-        self.assertEqual(create_resp.status_code, status.HTTP_201_CREATED)
-        self.assertEqual(create_resp.data["document"], doc.pk)
-
     def test_next_asn(self):
         """
         GIVEN:

src/documents/tests/test_api_objects.py

@@ -5,13 +5,10 @@ from unittest import mock
 from django.contrib.auth.models import Permission
 from django.contrib.auth.models import User
 from django.test import override_settings
-from guardian.shortcuts import assign_perm
 from rest_framework import status
 from rest_framework.test import APITestCase
 
 from documents.models import Correspondent
-from documents.models import CustomField
-from documents.models import CustomFieldInstance
 from documents.models import Document
 from documents.models import DocumentType
 from documents.models import StoragePath
@@ -222,30 +219,6 @@ class TestApiStoragePaths(DirectoriesMixin, APITestCase):
         self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
         self.assertEqual(StoragePath.objects.count(), 1)
 
-    def test_api_create_storage_path_rejects_traversal(self):
-        """
-        GIVEN:
-            - API request to create a storage paths
-            - Storage path attempts directory traversal
-        WHEN:
-            - API is called
-        THEN:
-            - Correct HTTP 400 response
-            - No storage path is created
-        """
-        response = self.client.post(
-            self.ENDPOINT,
-            json.dumps(
-                {
-                    "name": "Traversal path",
-                    "path": "../../../../../tmp/proof",
-                },
-            ),
-            content_type="application/json",
-        )
-        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
-        self.assertEqual(StoragePath.objects.count(), 1)
-
     def test_api_storage_path_placeholders(self):
         """
         GIVEN:
@@ -401,292 +374,6 @@ class TestApiStoragePaths(DirectoriesMixin, APITestCase):
         self.assertEqual(response.status_code, status.HTTP_200_OK)
         self.assertEqual(response.data, "folder/Something")
 
-    def test_test_storage_path_requires_document_view_permission(self) -> None:
-        owner = User.objects.create_user(username="owner")
-        unprivileged = User.objects.create_user(username="unprivileged")
-        document = Document.objects.create(
-            mime_type="application/pdf",
-            owner=owner,
-            title="Sensitive",
-            checksum="123",
-        )
-        self.client.force_authenticate(user=unprivileged)
-        response = self.client.post(
-            f"{self.ENDPOINT}test/",
-            json.dumps(
-                {
-                    "document": document.id,
-                    "path": "path/{{ title }}",
-                },
-            ),
-            content_type="application/json",
-        )
-        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
-        self.assertIn("document", response.data)
-
-    def test_test_storage_path_allows_shared_document_view_permission(self) -> None:
-        owner = User.objects.create_user(username="owner")
-        viewer = User.objects.create_user(username="viewer")
-        document = Document.objects.create(
-            mime_type="application/pdf",
-            owner=owner,
-            title="Shared",
-            checksum="123",
-        )
-        assign_perm("view_document", viewer, document)
-
-        self.client.force_authenticate(user=viewer)
-        response = self.client.post(
-            f"{self.ENDPOINT}test/",
-            json.dumps(
-                {
-                    "document": document.id,
-                    "path": "path/{{ title }}",
-                },
-            ),
-            content_type="application/json",
-        )
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
-        self.assertEqual(response.data, "path/Shared")
-
-    def test_test_storage_path_exposes_basic_document_context_but_not_sensitive_owner_data(
-        self,
-    ) -> None:
-        owner = User.objects.create_user(
-            username="owner",
-            password="password",
-            email="owner@example.com",
-        )
-        document = Document.objects.create(
-            mime_type="application/pdf",
-            owner=owner,
-            title="Document",
-            content="Top secret content",
-            page_count=2,
-            checksum="123",
-        )
-        self.client.force_authenticate(user=owner)
-
-        response = self.client.post(
-            f"{self.ENDPOINT}test/",
-            json.dumps(
-                {
-                    "document": document.id,
-                    "path": "{{ document.owner.username }}",
-                },
-            ),
-            content_type="application/json",
-        )
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
-        self.assertEqual(response.data, "owner")
-
-        for expression, expected in (
-            ("{{ document.content }}", "Top secret content"),
-            ("{{ document.id }}", str(document.id)),
-            ("{{ document.page_count }}", "2"),
-        ):
-            response = self.client.post(
-                f"{self.ENDPOINT}test/",
-                json.dumps(
-                    {
-                        "document": document.id,
-                        "path": expression,
-                    },
-                ),
-                content_type="application/json",
-            )
-            self.assertEqual(response.status_code, status.HTTP_200_OK)
-            self.assertEqual(response.data, expected)
-
-        for expression in (
-            "{{ document.owner.password }}",
-            "{{ document.owner.email }}",
-        ):
-            response = self.client.post(
-                f"{self.ENDPOINT}test/",
-                json.dumps(
-                    {
-                        "document": document.id,
-                        "path": expression,
-                    },
-                ),
-                content_type="application/json",
-            )
-            self.assertEqual(response.status_code, status.HTTP_200_OK)
-            self.assertIsNone(response.data)
-
-    def test_test_storage_path_includes_related_objects_for_visible_document(
-        self,
-    ) -> None:
-        owner = User.objects.create_user(username="owner")
-        viewer = User.objects.create_user(username="viewer")
-        private_correspondent = Correspondent.objects.create(
-            name="Private Correspondent",
-            owner=owner,
-        )
-        document = Document.objects.create(
-            mime_type="application/pdf",
-            owner=owner,
-            correspondent=private_correspondent,
-            title="Document",
-            checksum="123",
-        )
-        assign_perm("view_document", viewer, document)
-
-        self.client.force_authenticate(user=viewer)
-        response = self.client.post(
-            f"{self.ENDPOINT}test/",
-            json.dumps(
-                {
-                    "document": document.id,
-                    "path": "{{ correspondent }}",
-                },
-            ),
-            content_type="application/json",
-        )
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
-        self.assertEqual(response.data, "Private Correspondent")
-
-        response = self.client.post(
-            f"{self.ENDPOINT}test/",
-            json.dumps(
-                {
-                    "document": document.id,
-                    "path": (
-                        "{{ document.correspondent.name if document.correspondent else 'none' }}"
-                    ),
-                },
-            ),
-            content_type="application/json",
-        )
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
-        self.assertEqual(response.data, "Private Correspondent")
-
-    def test_test_storage_path_superuser_can_view_private_related_objects(self) -> None:
-        owner = User.objects.create_user(username="owner")
-        private_correspondent = Correspondent.objects.create(
-            name="Private Correspondent",
-            owner=owner,
-        )
-        document = Document.objects.create(
-            mime_type="application/pdf",
-            owner=owner,
-            correspondent=private_correspondent,
-            title="Document",
-            checksum="123",
-        )
-
-        response = self.client.post(
-            f"{self.ENDPOINT}test/",
-            json.dumps(
-                {
-                    "document": document.id,
-                    "path": (
-                        "{{ document.correspondent.name if document.correspondent else 'none' }}"
-                    ),
-                },
-            ),
-            content_type="application/json",
-        )
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
-        self.assertEqual(response.data, "Private Correspondent")
-
-    def test_test_storage_path_includes_doc_type_storage_path_and_tags(
-        self,
-    ) -> None:
-        owner = User.objects.create_user(username="owner")
-        viewer = User.objects.create_user(username="viewer")
-        private_document_type = DocumentType.objects.create(
-            name="Private Type",
-            owner=owner,
-        )
-        private_storage_path = StoragePath.objects.create(
-            name="Private Storage Path",
-            path="private/path",
-            owner=owner,
-        )
-        private_tag = Tag.objects.create(
-            name="Private Tag",
-            owner=owner,
-        )
-        document = Document.objects.create(
-            mime_type="application/pdf",
-            owner=owner,
-            document_type=private_document_type,
-            storage_path=private_storage_path,
-            title="Document",
-            checksum="123",
-        )
-        document.tags.add(private_tag)
-        assign_perm("view_document", viewer, document)
-
-        self.client.force_authenticate(user=viewer)
-        response = self.client.post(
-            f"{self.ENDPOINT}test/",
-            json.dumps(
-                {
-                    "document": document.id,
-                    "path": (
-                        "{{ document.document_type.name if document.document_type else 'none' }}/"
-                        "{{ document.storage_path.path if document.storage_path else 'none' }}/"
-                        "{{ document.tags[0].name if document.tags else 'none' }}"
-                    ),
-                },
-            ),
-            content_type="application/json",
-        )
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
-        self.assertEqual(response.data, "Private Type/private/path/Private Tag")
-
-        response = self.client.post(
-            f"{self.ENDPOINT}test/",
-            json.dumps(
-                {
-                    "document": document.id,
-                    "path": "{{ document_type }}/{{ tag_list if tag_list else 'none' }}",
-                },
-            ),
-            content_type="application/json",
-        )
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
-        self.assertEqual(response.data, "Private Type/Private Tag")
-
-    def test_test_storage_path_includes_custom_fields_for_visible_document(
-        self,
-    ) -> None:
-        owner = User.objects.create_user(username="owner")
-        viewer = User.objects.create_user(username="viewer")
-        document = Document.objects.create(
-            mime_type="application/pdf",
-            owner=owner,
-            title="Document",
-            checksum="123",
-        )
-        custom_field = CustomField.objects.create(
-            name="Secret Number",
-            data_type=CustomField.FieldDataType.INT,
-        )
-        CustomFieldInstance.objects.create(
-            document=document,
-            field=custom_field,
-            value_int=42,
-        )
-        assign_perm("view_document", viewer, document)
-
-        self.client.force_authenticate(user=viewer)
-        response = self.client.post(
-            f"{self.ENDPOINT}test/",
-            json.dumps(
-                {
-                    "document": document.id,
-                    "path": "{{ custom_fields | get_cf_value('Secret Number', 'none') }}",
-                },
-            ),
-            content_type="application/json",
-        )
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
-        self.assertEqual(response.data, "42")
-
 
 class TestBulkEditObjects(APITestCase):
     # See test_api_permissions.py for bulk tests on permissions

src/documents/tests/test_api_permissions.py

@@ -441,59 +441,6 @@ class TestApiAuth(DirectoriesMixin, APITestCase):
         self.assertTrue(checker.has_perm("change_document", doc))
         self.assertIn("change_document", get_perms(group1, doc))
 
-    def test_document_permissions_change_requires_owner(self):
-        owner = User.objects.create_user(username="owner")
-        editor = User.objects.create_user(username="editor")
-        editor.user_permissions.add(
-            *Permission.objects.all(),
-        )
-
-        doc = Document.objects.create(
-            title="Ownered doc",
-            content="sensitive",
-            checksum="abc123",
-            mime_type="application/pdf",
-            owner=owner,
-        )
-
-        assign_perm("view_document", editor, doc)
-        assign_perm("change_document", editor, doc)
-
-        self.client.force_authenticate(editor)
-        response = self.client.patch(
-            f"/api/documents/{doc.pk}/",
-            json.dumps(
-                {
-                    "set_permissions": {
-                        "view": {
-                            "users": [editor.id],
-                            "groups": [],
-                        },
-                        "change": {
-                            "users": None,
-                            "groups": None,
-                        },
-                    },
-                },
-            ),
-            content_type="application/json",
-        )
-
-        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
-
-        self.client.force_authenticate(editor)
-        response = self.client.patch(
-            f"/api/documents/{doc.pk}/",
-            json.dumps(
-                {
-                    "owner": editor.id,
-                },
-            ),
-            content_type="application/json",
-        )
-
-        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
-
     def test_dynamic_permissions_fields(self):
         user1 = User.objects.create_user(username="user1")
         user1.user_permissions.add(*Permission.objects.filter(codename="view_document"))

src/documents/tests/test_api_search.py

@@ -89,6 +89,23 @@ class TestDocumentSearchApi(DirectoriesMixin, APITestCase):
         self.assertEqual(len(results), 0)
         self.assertCountEqual(response.data["all"], [])
 
+    def test_search_handles_diacritics_normalization(self):
+        doc = Document.objects.create(
+            title="certida\u0303o de nascimento",
+            content="birth record without keyword",
+            checksum="D",
+            pk=10,
+        )
+        with AsyncWriter(index.open_index()) as writer:
+            index.update_document(writer, doc)
+
+        response = self.client.get("/api/documents/?query=certidão")
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        results = response.data["results"]
+        self.assertEqual(response.data["count"], 1)
+        self.assertEqual(len(results), 1)
+        self.assertEqual(results[0]["id"], doc.id)
+
     def test_search_custom_field_ordering(self):
         custom_field = CustomField.objects.create(
             name="Sortable field",

src/documents/tests/test_bulk_edit.py

@@ -602,12 +602,14 @@ class TestPDFActions(DirectoriesMixin, TestCase):
             expected_filename,
         )
         self.assertEqual(consume_file_args[1].title, None)
+        self.assertTrue(consume_file_args[1].skip_asn)
 
         # With metadata_document_id overrides
         result = bulk_edit.merge(doc_ids, metadata_document_id=metadata_document_id)
         consume_file_args, _ = mock_consume_file.call_args
         self.assertEqual(consume_file_args[1].title, "B (merged)")
         self.assertEqual(consume_file_args[1].created, self.doc2.created)
+        self.assertTrue(consume_file_args[1].skip_asn)
 
         self.assertEqual(result, "OK")
 
@@ -648,6 +650,7 @@ class TestPDFActions(DirectoriesMixin, TestCase):
             expected_filename,
         )
         self.assertEqual(consume_file_args[1].title, None)
+        self.assertTrue(consume_file_args[1].skip_asn)
 
         delete_documents_args, _ = mock_delete_documents.call_args
         self.assertEqual(

src/documents/tests/test_consumer.py

@@ -290,6 +290,23 @@ class TestConsumer(
 
         self._assert_first_last_send_progress()
 
+    def test_override_filename_normalized(self):
+        filename = self.get_test_file()
+        override_filename = "Inhaltsu\u0308bersicht.pdf"
+
+        with self.get_consumer(
+            filename,
+            DocumentMetadataOverrides(filename=override_filename),
+        ) as consumer:
+            consumer.run()
+
+            document = Document.objects.first()
+
+        self.assertIsNotNone(document)
+        self.assertEqual(document.original_filename, "Inhaltsübersicht.pdf")
+        self.assertEqual(document.title, "Inhaltsübersicht")
+        self._assert_first_last_send_progress()
+
     def testOverrideTitle(self):
         with self.get_consumer(
             self.get_test_file(),
@@ -304,6 +321,25 @@ class TestConsumer(
         self.assertEqual(document.title, "Override Title")
         self._assert_first_last_send_progress()
 
+    @override_settings(FILENAME_FORMAT="{{ title }}")
+    def test_filename_format_normalized(self):
+        filename = self.get_test_file()
+        title = "Inhaltsu\u0308bersicht Faszination"
+
+        with self.get_consumer(
+            filename,
+            DocumentMetadataOverrides(title=title),
+        ) as consumer:
+            consumer.run()
+
+            document = Document.objects.first()
+
+        self.assertIsNotNone(document)
+        self.assertEqual(document.title, "Inhaltsübersicht Faszination")
+        self.assertEqual(document.filename, "Inhaltsübersicht Faszination.pdf")
+        self.assertIsFile(document.source_path)
+        self._assert_first_last_send_progress()
+
     def testOverrideCorrespondent(self):
         c = Correspondent.objects.create(name="test")
 
@@ -412,6 +448,14 @@ class TestConsumer(
         self.assertEqual(document.archive_serial_number, 123)
         self._assert_first_last_send_progress()
 
+    def testMetadataOverridesSkipAsnPropagation(self):
+        overrides = DocumentMetadataOverrides()
+        incoming = DocumentMetadataOverrides(skip_asn=True)
+
+        overrides.update(incoming)
+
+        self.assertTrue(overrides.skip_asn)
+
     def testOverrideTitlePlaceholders(self):
         c = Correspondent.objects.create(name="Correspondent Name")
         dt = DocumentType.objects.create(name="DocType Name")
@@ -633,33 +677,6 @@ class TestConsumer(
 
         self._assert_first_last_send_progress()
 
-    @mock.patch("documents.consumer.generate_unique_filename")
-    def testFilenameHandlingFallsBackWhenGeneratedPathExceedsDbLimit(self, m):
-        m.side_effect = lambda doc, archive_filename=False: Path(
-            ("a" * 1100 + ".pdf") if not archive_filename else ("b" * 1100 + ".pdf"),
-        )
-
-        with self.get_consumer(
-            self.get_test_file(),
-            DocumentMetadataOverrides(title="new docs"),
-        ) as consumer:
-            consumer.run()
-
-        document = Document.objects.first()
-        self.assertIsNotNone(document)
-        assert document is not None
-
-        self.assertEqual(document.filename, f"{document.pk:07d}.pdf")
-        self.assertLessEqual(len(document.filename), 1024)
-        self.assertLessEqual(
-            len(document.archive_filename),
-            1024,
-        )
-        self.assertIsFile(document.source_path)
-        self.assertIsFile(document.archive_path)
-
-        self._assert_first_last_send_progress()
-
     @override_settings(FILENAME_FORMAT="{correspondent}/{title}")
     @mock.patch("documents.signals.handlers.generate_unique_filename")
     def testFilenameHandlingUnstableFormat(self, m):

src/documents/tests/test_file_handling.py

@@ -1341,41 +1341,6 @@ class TestFilenameGeneration(DirectoriesMixin, TestCase):
             Path("somepath/asn-201-400/asn-3xx/Does Matter.pdf"),
         )
 
-    def test_template_related_context_keeps_legacy_string_coercion(self):
-        """
-        GIVEN:
-            - A storage path template that uses related objects directly as strings
-        WHEN:
-            - Filepath for a document with this format is called
-        THEN:
-            - Related objects coerce to their names (legacy behavior)
-            - Explicit attribute access remains available for new templates
-        """
-        sp = StoragePath.objects.create(
-            name="PARTNER",
-            path=(
-                "{{ document.storage_path|lower }} / "
-                "{{ document.correspondent|lower|replace('mi:', 'mieter/') }} / "
-                "{{ document_type|lower }} / "
-                "{{ title|lower }}"
-            ),
-        )
-        doc = Document.objects.create(
-            title="scan_017562",
-            created=datetime.date(2025, 7, 2),
-            added=timezone.make_aware(datetime.datetime(2026, 3, 3, 11, 53, 16)),
-            mime_type="application/pdf",
-            checksum="test-checksum",
-            storage_path=sp,
-            correspondent=Correspondent.objects.create(name="mi:kochkach"),
-            document_type=DocumentType.objects.create(name="Mietvertrag"),
-        )
-
-        self.assertEqual(
-            generate_filename(doc),
-            Path("partner/mieter/kochkach/mietvertrag/scan_017562.pdf"),
-        )
-
     @override_settings(
         FILENAME_FORMAT="{{creation_date}}/{{ title_name_str }}",
     )
@@ -1417,11 +1382,11 @@ class TestFilenameGeneration(DirectoriesMixin, TestCase):
     def test_template_with_security(self):
         """
         GIVEN:
-            - Filename format with an unavailable document attribute
+            - Filename format with one or more undefined variables
         WHEN:
             - Filepath for a document with this format is called
         THEN:
-            - The missing attribute is logged
+            - The first undefined variable is logged
             - The default format is used
         """
         doc_a = Document.objects.create(
@@ -1443,7 +1408,7 @@ class TestFilenameGeneration(DirectoriesMixin, TestCase):
             self.assertEqual(len(capture.output), 1)
             self.assertEqual(
                 capture.output[0],
-                "ERROR:paperless.templating:Template variable error: 'dict object' has no attribute 'save'",
+                "WARNING:paperless.templating:Template attempted restricted operation: <bound method Model.save of <Document: 2020-06-25 Does Matter>> is not safely callable",
             )
 
     def test_template_with_custom_fields(self):
@@ -1734,21 +1699,6 @@ class TestCustomFieldFilenameUpdates(
         self.assertTrue(Path(self.doc.source_path).is_file())
         self.assertLessEqual(m.call_count, 1)
 
-    @override_settings(FILENAME_FORMAT=None)
-    def test_overlong_storage_path_keeps_existing_filename(self):
-        initial_filename = generate_filename(self.doc)
-        Document.objects.filter(pk=self.doc.pk).update(filename=str(initial_filename))
-        self.doc.refresh_from_db()
-        Path(self.doc.source_path).parent.mkdir(parents=True, exist_ok=True)
-        Path(self.doc.source_path).touch()
-
-        self.doc.storage_path = StoragePath.objects.create(path="a" * 1100)
-        self.doc.save()
-
-        self.doc.refresh_from_db()
-        self.assertEqual(Path(self.doc.filename), initial_filename)
-        self.assertTrue(Path(self.doc.source_path).is_file())
-
 
 class TestPathDateLocalization:
     """

src/documents/tests/test_index.py

@@ -1,7 +1,6 @@
 from datetime import datetime
 from unittest import mock
 
-from django.conf import settings
 from django.contrib.auth.models import User
 from django.test import SimpleTestCase
 from django.test import TestCase
@@ -180,7 +179,7 @@ class TestRewriteNaturalDateKeywords(SimpleTestCase):
             (
                 "added:this year",
                 datetime(2025, 7, 15, 12, 0, 0, tzinfo=timezone.utc),
-                ("added:[20250101", "TO 20251231"),
+                ("added:[20250101", "TO 20250715"),
             ),
             (
                 "added:previous year",
@@ -252,120 +251,3 @@ class TestRewriteNaturalDateKeywords(SimpleTestCase):
         result = self._rewrite_with_now("added:today", fixed_now)
         # Should convert to UTC properly
         self.assertIn("added:[20250719", result)
-
-
-class TestIndexResilience(DirectoriesMixin, SimpleTestCase):
-    def _assert_recreate_called(self, mock_create_in):
-        mock_create_in.assert_called_once()
-        path_arg, schema_arg = mock_create_in.call_args.args
-        self.assertEqual(path_arg, settings.INDEX_DIR)
-        self.assertEqual(schema_arg.__class__.__name__, "Schema")
-
-    def test_transient_missing_segment_does_not_force_recreate(self):
-        """
-        GIVEN:
-            - Index directory exists
-        WHEN:
-            - open_index is called
-            - Opening the index raises FileNotFoundError once due to a
-              transient missing segment
-        THEN:
-            - Index is opened successfully on retry
-            - Index is not recreated
-        """
-        file_marker = settings.INDEX_DIR / "file_marker.txt"
-        file_marker.write_text("keep")
-        expected_index = object()
-
-        with (
-            mock.patch("documents.index.exists_in", return_value=True),
-            mock.patch(
-                "documents.index.open_dir",
-                side_effect=[FileNotFoundError("missing"), expected_index],
-            ) as mock_open_dir,
-            mock.patch(
-                "documents.index.create_in",
-            ) as mock_create_in,
-            mock.patch(
-                "documents.index.rmtree",
-            ) as mock_rmtree,
-        ):
-            ix = index.open_index()
-
-        self.assertIs(ix, expected_index)
-        self.assertGreaterEqual(mock_open_dir.call_count, 2)
-        mock_rmtree.assert_not_called()
-        mock_create_in.assert_not_called()
-        self.assertEqual(file_marker.read_text(), "keep")
-
-    def test_transient_errors_exhaust_retries_and_recreate(self):
-        """
-        GIVEN:
-            - Index directory exists
-        WHEN:
-            - open_index is called
-            - Opening the index raises FileNotFoundError multiple times due to
-              transient missing segments
-        THEN:
-            - Index is recreated after retries are exhausted
-        """
-        recreated_index = object()
-
-        with (
-            self.assertLogs("paperless.index", level="ERROR") as cm,
-            mock.patch("documents.index.exists_in", return_value=True),
-            mock.patch(
-                "documents.index.open_dir",
-                side_effect=FileNotFoundError("missing"),
-            ) as mock_open_dir,
-            mock.patch("documents.index.rmtree") as mock_rmtree,
-            mock.patch(
-                "documents.index.create_in",
-                return_value=recreated_index,
-            ) as mock_create_in,
-        ):
-            ix = index.open_index()
-
-        self.assertIs(ix, recreated_index)
-        self.assertEqual(mock_open_dir.call_count, 4)
-        mock_rmtree.assert_called_once_with(settings.INDEX_DIR)
-        self._assert_recreate_called(mock_create_in)
-        self.assertIn(
-            "Error while opening the index after retries, recreating.",
-            cm.output[0],
-        )
-
-    def test_non_transient_error_recreates_index(self):
-        """
-        GIVEN:
-            - Index directory exists
-        WHEN:
-            - open_index is called
-            - Opening the index raises a "non-transient" error
-        THEN:
-            - Index is recreated
-        """
-        recreated_index = object()
-
-        with (
-            self.assertLogs("paperless.index", level="ERROR") as cm,
-            mock.patch("documents.index.exists_in", return_value=True),
-            mock.patch(
-                "documents.index.open_dir",
-                side_effect=RuntimeError("boom"),
-            ),
-            mock.patch("documents.index.rmtree") as mock_rmtree,
-            mock.patch(
-                "documents.index.create_in",
-                return_value=recreated_index,
-            ) as mock_create_in,
-        ):
-            ix = index.open_index()
-
-        self.assertIs(ix, recreated_index)
-        mock_rmtree.assert_called_once_with(settings.INDEX_DIR)
-        self._assert_recreate_called(mock_create_in)
-        self.assertIn(
-            "Error while opening the index, recreating.",
-            cm.output[0],
-        )

src/documents/tests/test_tag_hierarchy.py

@@ -147,16 +147,6 @@ class TestTagHierarchy(APITestCase):
         assert serializer.data  # triggers serialization
         assert "document_count_filter" in context
 
-    def test_tag_list_can_order_by_document_count_with_children(self) -> None:
-        self.document.tags.add(self.child)
-
-        response = self.client.get(
-            "/api/tags/",
-            {"ordering": "document_count"},
-        )
-
-        assert response.status_code == 200
-
     def test_cannot_set_parent_to_self(self):
         tag = Tag.objects.create(name="Selfie")
         resp = self.client.patch(

src/documents/tests/test_workflows.py

@@ -25,7 +25,6 @@ from rest_framework.test import APIClient
 from rest_framework.test import APITestCase
 
 from documents.file_handling import create_source_path_directory
-from documents.file_handling import generate_filename
 from documents.file_handling import generate_unique_filename
 from documents.signals.handlers import run_workflows
 from documents.workflows.webhooks import send_webhook
@@ -558,6 +557,50 @@ class TestWorkflows(
         expected_str = f"Document filename {test_file.name} does not match"
         self.assertIn(expected_str, cm.output[1])
 
+    def test_workflow_match_filename_diacritics_normalized(self):
+        """
+        GIVEN:
+            - Consumption workflow filtering on filename with diacritics
+        WHEN:
+            - File with decomposed Unicode filename is consumed
+        THEN:
+            - Workflow still matches and applies overrides
+        """
+        trigger = WorkflowTrigger.objects.create(
+            type=WorkflowTrigger.WorkflowTriggerType.CONSUMPTION,
+            sources=f"{DocumentSource.ApiUpload},{DocumentSource.ConsumeFolder},{DocumentSource.MailFetch}",
+            filter_filename="*račun*",
+        )
+        action = WorkflowAction.objects.create(
+            assign_title="Diacritics matched",
+        )
+        action.save()
+
+        w = Workflow.objects.create(
+            name="Workflow 1",
+            order=0,
+        )
+        w.triggers.add(trigger)
+        w.actions.add(action)
+        w.save()
+
+        decomposed_name = "rac\u030cun.pdf"
+        test_file = shutil.copy(
+            self.SAMPLE_DIR / "simple.pdf",
+            self.dirs.scratch_dir / decomposed_name,
+        )
+
+        with mock.patch("documents.tasks.ProgressManager", DummyProgressManager):
+            tasks.consume_file(
+                ConsumableDocument(
+                    source=DocumentSource.ConsumeFolder,
+                    original_file=test_file,
+                ),
+                None,
+            )
+            document = Document.objects.first()
+            self.assertEqual(document.title, "Diacritics matched")
+
     def test_workflow_no_match_path(self):
         """
         GIVEN:
@@ -899,63 +942,6 @@ class TestWorkflows(
         expected_str = f"Document matched {trigger} from {w}"
         self.assertIn(expected_str, cm.output[0])
 
-    def test_workflow_assign_custom_field_keeps_storage_filename_in_sync(self) -> None:
-        """
-        GIVEN:
-            - Existing document with a storage path template that depends on a custom field
-            - Existing workflow triggered on document update assigning that custom field
-        WHEN:
-            - Workflow runs for the document
-        THEN:
-            - The database filename remains aligned with the moved file on disk
-        """
-        storage_path = StoragePath.objects.create(
-            name="workflow-custom-field-path",
-            path="{{ custom_fields|get_cf_value('Custom Field 1', 'none') }}/{{ title }}",
-        )
-        doc = Document.objects.create(
-            title="workflow custom field sync",
-            mime_type="application/pdf",
-            checksum="workflow-custom-field-sync",
-            storage_path=storage_path,
-            original_filename="workflow-custom-field-sync.pdf",
-        )
-        CustomFieldInstance.objects.create(
-            document=doc,
-            field=self.cf1,
-            value_text="initial",
-        )
-
-        generated = generate_unique_filename(doc)
-        destination = (settings.ORIGINALS_DIR / generated).resolve()
-        create_source_path_directory(destination)
-        shutil.copy(self.SAMPLE_DIR / "simple.pdf", destination)
-        Document.objects.filter(pk=doc.pk).update(filename=generated.as_posix())
-        doc.refresh_from_db()
-
-        trigger = WorkflowTrigger.objects.create(
-            type=WorkflowTrigger.WorkflowTriggerType.DOCUMENT_UPDATED,
-        )
-        action = WorkflowAction.objects.create(
-            type=WorkflowAction.WorkflowActionType.ASSIGNMENT,
-            assign_custom_fields_values={self.cf1.pk: "cars"},
-        )
-        action.assign_custom_fields.add(self.cf1.pk)
-        workflow = Workflow.objects.create(
-            name="Workflow custom field filename sync",
-            order=0,
-        )
-        workflow.triggers.add(trigger)
-        workflow.actions.add(action)
-        workflow.save()
-
-        run_workflows(WorkflowTrigger.WorkflowTriggerType.DOCUMENT_UPDATED, doc)
-
-        doc.refresh_from_db()
-        expected_filename = generate_filename(doc)
-        self.assertEqual(Path(doc.filename), expected_filename)
-        self.assertTrue(doc.source_path.is_file())
-
     def test_document_added_workflow(self):
         trigger = WorkflowTrigger.objects.create(
             type=WorkflowTrigger.WorkflowTriggerType.DOCUMENT_ADDED,
@@ -1004,6 +990,35 @@ class TestWorkflows(
         self.assertEqual(doc.correspondent, self.c2)
         self.assertEqual(doc.title, f"Doc created in {created.year}")
 
+    def test_document_added_filename_diacritics_normalized(self):
+        trigger = WorkflowTrigger.objects.create(
+            type=WorkflowTrigger.WorkflowTriggerType.DOCUMENT_ADDED,
+            filter_filename="*račun*",
+        )
+        action = WorkflowAction.objects.create(
+            assign_title="Matched diacritics",
+        )
+        w = Workflow.objects.create(
+            name="Workflow 1",
+            order=0,
+        )
+        w.triggers.add(trigger)
+        w.actions.add(action)
+        w.save()
+
+        doc = Document.objects.create(
+            title="sample test",
+            correspondent=self.c,
+            original_filename="rac\u030cun.pdf",
+        )
+
+        document_consumption_finished.send(
+            sender=self.__class__,
+            document=doc,
+        )
+
+        self.assertEqual(doc.title, "Matched diacritics")
+
     def test_document_added_no_match_filename(self):
         trigger = WorkflowTrigger.objects.create(
             type=WorkflowTrigger.WorkflowTriggerType.DOCUMENT_ADDED,
@@ -2152,68 +2167,6 @@ class TestWorkflows(
             doc.refresh_from_db()
             self.assertIsNone(doc.owner)
 
-    def test_workflow_scheduled_recurring_respects_latest_run(self):
-        """
-        GIVEN:
-            - Scheduled workflow marked as recurring with a 1-day interval
-            - Document that matches the trigger
-            - Two prior runs exist: one 2 days ago and one 1 hour ago
-        WHEN:
-            - Scheduled workflows are checked again
-        THEN:
-            - Workflow does not run because the most recent run is inside the interval
-        """
-        trigger = WorkflowTrigger.objects.create(
-            type=WorkflowTrigger.WorkflowTriggerType.SCHEDULED,
-            schedule_date_field=WorkflowTrigger.ScheduleDateField.CREATED,
-            schedule_is_recurring=True,
-            schedule_recurring_interval_days=1,
-        )
-        action = WorkflowAction.objects.create(
-            assign_title="Doc assign owner",
-            assign_owner=self.user2,
-        )
-        w = Workflow.objects.create(
-            name="Workflow 1",
-            order=0,
-        )
-        w.triggers.add(trigger)
-        w.actions.add(action)
-        w.save()
-
-        doc = Document.objects.create(
-            title="sample test",
-            correspondent=self.c,
-            original_filename="sample.pdf",
-            created=timezone.now().date() - timedelta(days=3),
-        )
-
-        WorkflowRun.objects.create(
-            workflow=w,
-            document=doc,
-            type=WorkflowTrigger.WorkflowTriggerType.SCHEDULED,
-            run_at=timezone.now() - timedelta(days=2),
-        )
-        WorkflowRun.objects.create(
-            workflow=w,
-            document=doc,
-            type=WorkflowTrigger.WorkflowTriggerType.SCHEDULED,
-            run_at=timezone.now() - timedelta(hours=1),
-        )
-
-        tasks.check_scheduled_workflows()
-
-        doc.refresh_from_db()
-        self.assertIsNone(doc.owner)
-        self.assertEqual(
-            WorkflowRun.objects.filter(
-                workflow=w,
-                document=doc,
-                type=WorkflowTrigger.WorkflowTriggerType.SCHEDULED,
-            ).count(),
-            2,
-        )
-
     def test_workflow_scheduled_trigger_negative_offset_customfield(self):
         """
         GIVEN:

src/documents/utils.py

@@ -1,5 +1,7 @@
 import logging
 import shutil
+import unicodedata
+from os import PathLike
 from os import utime
 from pathlib import Path
 from subprocess import CompletedProcess
@@ -16,6 +18,14 @@ def _coerce_to_path(
     return Path(source).resolve(), Path(dest).resolve()
 
 
+def normalize_nfc(value: str | PathLike[str] | None) -> str | None:
+    """Return NFC-normalized string for filesystem-safe comparisons."""
+
+    if value is None:
+        return None
+    return unicodedata.normalize("NFC", str(value))
+
+
 def copy_basic_file_stats(source: Path | str, dest: Path | str) -> None:
     """
     Copies only the m_time and a_time attributes from source to destination.

src/documents/views.py

@@ -32,6 +32,7 @@ from django.db.models import Count
 from django.db.models import IntegerField
 from django.db.models import Max
 from django.db.models import Model
+from django.db.models import Q
 from django.db.models import Sum
 from django.db.models import When
 from django.db.models.functions import Length
@@ -127,7 +128,6 @@ from documents.matching import match_storage_paths
 from documents.matching import match_tags
 from documents.models import Correspondent
 from documents.models import CustomField
-from documents.models import CustomFieldInstance
 from documents.models import Document
 from documents.models import DocumentType
 from documents.models import Note
@@ -147,7 +147,6 @@ from documents.permissions import PaperlessAdminPermissions
 from documents.permissions import PaperlessNotePermissions
 from documents.permissions import PaperlessObjectPermissions
 from documents.permissions import ViewDocumentsPermissions
-from documents.permissions import annotate_document_count_for_related_queryset
 from documents.permissions import get_document_count_filter_for_user
 from documents.permissions import get_objects_for_user_owner_aware
 from documents.permissions import has_perms_owner_aware
@@ -371,37 +370,22 @@ class PermissionsAwareDocumentCountMixin(BulkPermissionMixin, PassUserMixin):
     Mixin to add document count to queryset, permissions-aware if needed
     """
 
-    # Default is simple relation path, override for through-table/count specialization.
-    document_count_through = None
-    document_count_source_field = None
-
     def get_document_count_filter(self):
         request = getattr(self, "request", None)
         user = getattr(request, "user", None) if request else None
         return get_document_count_filter_for_user(user)
 
     def get_queryset(self):
-        base_qs = super().get_queryset()
-
-        # Use optimized through-table counting when configured.
-        if self.document_count_through:
-            user = getattr(getattr(self, "request", None), "user", None)
-            return annotate_document_count_for_related_queryset(
-                base_qs,
-                through_model=self.document_count_through,
-                related_object_field=self.document_count_source_field,
-                user=user,
-            )
-
-        # Fallback: simple Count on relation with permission filter.
         filter = self.get_document_count_filter()
-        return base_qs.annotate(
-            document_count=Count("documents", filter=filter),
+        return (
+            super()
+            .get_queryset()
+            .annotate(document_count=Count("documents", filter=filter))
         )
 
 
 @extend_schema_view(**generate_object_with_permissions_schema(CorrespondentSerializer))
-class CorrespondentViewSet(PermissionsAwareDocumentCountMixin, ModelViewSet):
+class CorrespondentViewSet(ModelViewSet, PermissionsAwareDocumentCountMixin):
     model = Correspondent
 
     queryset = Correspondent.objects.select_related("owner").order_by(Lower("name"))
@@ -438,10 +422,8 @@ class CorrespondentViewSet(PermissionsAwareDocumentCountMixin, ModelViewSet):
 
 
 @extend_schema_view(**generate_object_with_permissions_schema(TagSerializer))
-class TagViewSet(PermissionsAwareDocumentCountMixin, ModelViewSet):
+class TagViewSet(ModelViewSet, PermissionsAwareDocumentCountMixin):
     model = Tag
-    document_count_through = Document.tags.through
-    document_count_source_field = "tag_id"
 
     queryset = Tag.objects.select_related("owner").order_by(
         Lower("name"),
@@ -466,51 +448,8 @@ class TagViewSet(PermissionsAwareDocumentCountMixin, ModelViewSet):
     def get_serializer_context(self):
         context = super().get_serializer_context()
         context["document_count_filter"] = self.get_document_count_filter()
-        if hasattr(self, "_children_map"):
-            context["children_map"] = self._children_map
         return context
 
-    def list(self, request, *args, **kwargs):
-        """
-        Build a children map once to avoid per-parent queries in the serializer.
-        """
-        queryset = self.filter_queryset(self.get_queryset())
-        ordering = OrderingFilter().get_ordering(request, queryset, self) or (
-            Lower("name"),
-        )
-        queryset = queryset.order_by(*ordering)
-
-        all_tags = list(queryset)
-        descendant_pks = {pk for tag in all_tags for pk in tag.get_descendants_pks()}
-
-        if descendant_pks:
-            user = getattr(getattr(self, "request", None), "user", None)
-            children_source = list(
-                annotate_document_count_for_related_queryset(
-                    Tag.objects.filter(
-                        pk__in=descendant_pks | {t.pk for t in all_tags},
-                    ).select_related("owner"),
-                    through_model=self.document_count_through,
-                    related_object_field=self.document_count_source_field,
-                    user=user,
-                ).order_by(*ordering),
-            )
-        else:
-            children_source = all_tags
-
-        children_map = {}
-        for tag in children_source:
-            children_map.setdefault(tag.tn_parent_id, []).append(tag)
-        self._children_map = children_map
-
-        page = self.paginate_queryset(queryset)
-        serializer = self.get_serializer(page, many=True)
-        response = self.get_paginated_response(serializer.data)
-        if descendant_pks:
-            # Include children in the "all" field, if needed
-            response.data["all"] = [tag.pk for tag in children_source]
-        return response
-
     def perform_update(self, serializer):
         old_parent = self.get_object().get_parent()
         tag = serializer.save()
@@ -520,7 +459,7 @@ class TagViewSet(PermissionsAwareDocumentCountMixin, ModelViewSet):
 
 
 @extend_schema_view(**generate_object_with_permissions_schema(DocumentTypeSerializer))
-class DocumentTypeViewSet(PermissionsAwareDocumentCountMixin, ModelViewSet):
+class DocumentTypeViewSet(ModelViewSet, PermissionsAwareDocumentCountMixin):
     model = DocumentType
 
     queryset = DocumentType.objects.select_related("owner").order_by(Lower("name"))
@@ -1121,7 +1060,7 @@ class DocumentViewSet(
             ):
                 return HttpResponseForbidden("Insufficient permissions to delete notes")
 
-            note = Note.objects.get(id=int(request.GET.get("id")), document=doc)
+            note = Note.objects.get(id=int(request.GET.get("id")))
             if settings.AUDIT_LOG_ENABLED:
                 LogEntry.objects.log_create(
                     instance=doc,
@@ -1725,8 +1664,6 @@ class PostDocumentView(GenericAPIView):
     parser_classes = (parsers.MultiPartParser,)
 
     def post(self, request, *args, **kwargs):
-        if not request.user.has_perm("documents.add_document"):
-            return HttpResponseForbidden("Insufficient permissions")
         serializer = self.get_serializer(data=request.data)
         serializer.is_valid(raise_exception=True)
 
@@ -1850,13 +1787,6 @@ class SelectionDataView(GenericAPIView):
         serializer.is_valid(raise_exception=True)
 
         ids = serializer.validated_data.get("documents")
-        permitted_documents = get_objects_for_user_owner_aware(
-            request.user,
-            "documents.view_document",
-            Document,
-        )
-        if permitted_documents.filter(pk__in=ids).count() != len(ids):
-            return HttpResponseForbidden("Insufficient permissions")
 
         correspondents = Correspondent.objects.annotate(
             document_count=Count(
@@ -2373,7 +2303,7 @@ class BulkDownloadView(GenericAPIView):
 
 
 @extend_schema_view(**generate_object_with_permissions_schema(StoragePathSerializer))
-class StoragePathViewSet(PermissionsAwareDocumentCountMixin, ModelViewSet):
+class StoragePathViewSet(ModelViewSet, PermissionsAwareDocumentCountMixin):
     model = StoragePath
 
     queryset = StoragePath.objects.select_related("owner").order_by(
@@ -2418,10 +2348,7 @@ class StoragePathViewSet(PermissionsAwareDocumentCountMixin, ModelViewSet):
         """
         Test storage path against a document
         """
-        serializer = StoragePathTestSerializer(
-            data=request.data,
-            context={"request": request},
-        )
+        serializer = StoragePathTestSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
 
         document = serializer.validated_data.get("document")
@@ -2893,7 +2820,7 @@ class WorkflowViewSet(ModelViewSet):
     )
 
 
-class CustomFieldViewSet(PermissionsAwareDocumentCountMixin, ModelViewSet):
+class CustomFieldViewSet(ModelViewSet):
     permission_classes = (IsAuthenticated, PaperlessObjectPermissions)
 
     serializer_class = CustomFieldSerializer
@@ -2905,11 +2832,35 @@ class CustomFieldViewSet(PermissionsAwareDocumentCountMixin, ModelViewSet):
     filterset_class = CustomFieldFilterSet
 
     model = CustomField
-    document_count_through = CustomFieldInstance
-    document_count_source_field = "field_id"
 
     queryset = CustomField.objects.all().order_by("-created")
 
+    def get_queryset(self):
+        filter = (
+            Q(fields__document__deleted_at__isnull=True)
+            if self.request.user is None or self.request.user.is_superuser
+            else (
+                Q(
+                    fields__document__deleted_at__isnull=True,
+                    fields__document__id__in=get_objects_for_user_owner_aware(
+                        self.request.user,
+                        "documents.view_document",
+                        Document,
+                    ).values_list("id", flat=True),
+                )
+            )
+        )
+        return (
+            super()
+            .get_queryset()
+            .annotate(
+                document_count=Count(
+                    "fields",
+                    filter=filter,
+                ),
+            )
+        )
+
 
 @extend_schema_view(
     get=extend_schema(

src/documents/workflows/utils.py

@@ -20,6 +20,9 @@ def get_workflows_for_trigger(
     wrap it in a list; otherwise fetch enabled workflows for the trigger with
     the prefetches used by the runner.
     """
+    if workflow_to_run is not None:
+        return [workflow_to_run]
+
     annotated_actions = (
         WorkflowAction.objects.select_related(
             "assign_correspondent",
@@ -102,25 +105,10 @@ def get_workflows_for_trigger(
         )
     )
 
-    action_prefetch = Prefetch(
-        "actions",
-        queryset=annotated_actions.order_by("order", "pk"),
-    )
-
-    if workflow_to_run is not None:
-        return (
-            Workflow.objects.filter(pk=workflow_to_run.pk)
-            .prefetch_related(
-                action_prefetch,
-                "triggers",
-            )
-            .distinct()
-        )
-
     return (
         Workflow.objects.filter(enabled=True, triggers__type=trigger_type)
         .prefetch_related(
-            action_prefetch,
+            Prefetch("actions", queryset=annotated_actions),
             "triggers",
         )
         .order_by("order")

src/locale/en_US/LC_MESSAGES/django.po

@@ -2,7 +2,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: paperless-ngx\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-12-12 17:41+0000\n"
+"POT-Creation-Date: 2025-12-29 14:49+0000\n"
 "PO-Revision-Date: 2022-02-17 04:17\n"
 "Last-Translator: \n"
 "Language-Team: English\n"
@@ -1219,35 +1219,35 @@ msgstr ""
 msgid "workflow runs"
 msgstr ""
 
-#: documents/serialisers.py:640
+#: documents/serialisers.py:642
 msgid "Invalid color."
 msgstr ""
 
-#: documents/serialisers.py:1826
+#: documents/serialisers.py:1835
 #, python-format
 msgid "File type %(type)s not supported"
 msgstr ""
 
-#: documents/serialisers.py:1870
+#: documents/serialisers.py:1879
 #, python-format
 msgid "Custom field id must be an integer: %(id)s"
 msgstr ""
 
-#: documents/serialisers.py:1877
+#: documents/serialisers.py:1886
 #, python-format
 msgid "Custom field with id %(id)s does not exist"
 msgstr ""
 
-#: documents/serialisers.py:1894 documents/serialisers.py:1904
+#: documents/serialisers.py:1903 documents/serialisers.py:1913
 msgid ""
 "Custom fields must be a list of integers or an object mapping ids to values."
 msgstr ""
 
-#: documents/serialisers.py:1899
+#: documents/serialisers.py:1908
 msgid "Some custom fields don't exist or were specified twice."
 msgstr ""
 
-#: documents/serialisers.py:2014
+#: documents/serialisers.py:2023
 msgid "Invalid variable detected."
 msgstr ""
 
@@ -1767,82 +1767,86 @@ msgid "Hungarian"
 msgstr ""
 
 #: paperless/settings.py:789
-msgid "Italian"
+msgid "Indonesian"
 msgstr ""
 
 #: paperless/settings.py:790
-msgid "Japanese"
+msgid "Italian"
 msgstr ""
 
 #: paperless/settings.py:791
-msgid "Korean"
+msgid "Japanese"
 msgstr ""
 
 #: paperless/settings.py:792
-msgid "Luxembourgish"
+msgid "Korean"
 msgstr ""
 
 #: paperless/settings.py:793
-msgid "Norwegian"
+msgid "Luxembourgish"
 msgstr ""
 
 #: paperless/settings.py:794
-msgid "Dutch"
+msgid "Norwegian"
 msgstr ""
 
 #: paperless/settings.py:795
-msgid "Polish"
+msgid "Dutch"
 msgstr ""
 
 #: paperless/settings.py:796
-msgid "Portuguese (Brazil)"
+msgid "Polish"
 msgstr ""
 
 #: paperless/settings.py:797
-msgid "Portuguese"
+msgid "Portuguese (Brazil)"
 msgstr ""
 
 #: paperless/settings.py:798
-msgid "Romanian"
+msgid "Portuguese"
 msgstr ""
 
 #: paperless/settings.py:799
-msgid "Russian"
+msgid "Romanian"
 msgstr ""
 
 #: paperless/settings.py:800
-msgid "Slovak"
+msgid "Russian"
 msgstr ""
 
 #: paperless/settings.py:801
-msgid "Slovenian"
+msgid "Slovak"
 msgstr ""
 
 #: paperless/settings.py:802
-msgid "Serbian"
+msgid "Slovenian"
 msgstr ""
 
 #: paperless/settings.py:803
-msgid "Swedish"
+msgid "Serbian"
 msgstr ""
 
 #: paperless/settings.py:804
-msgid "Turkish"
+msgid "Swedish"
 msgstr ""
 
 #: paperless/settings.py:805
-msgid "Ukrainian"
+msgid "Turkish"
 msgstr ""
 
 #: paperless/settings.py:806
-msgid "Vietnamese"
+msgid "Ukrainian"
 msgstr ""
 
 #: paperless/settings.py:807
-msgid "Chinese Simplified"
+msgid "Vietnamese"
 msgstr ""
 
 #: paperless/settings.py:808
+msgid "Chinese Simplified"
+msgstr ""
+
+#: paperless/settings.py:809
 msgid "Chinese Traditional"
 msgstr ""
 

src/paperless/settings.py

@@ -786,6 +786,7 @@ LANGUAGES = [
     ("fi-fi", _("Finnish")),
     ("fr-fr", _("French")),
     ("hu-hu", _("Hungarian")),
+    ("id-id", _("Indonesian")),
     ("it-it", _("Italian")),
     ("ja-jp", _("Japanese")),
     ("ko-kr", _("Korean")),

src/paperless/version.py

@@ -1,6 +1,6 @@
 from typing import Final
 
-__version__: Final[tuple[int, int, int]] = (2, 20, 10)
+__version__: Final[tuple[int, int, int]] = (2, 20, 3)
 # Version string like X.Y.Z
 __full_version_str__: Final[str] = ".".join(map(str, __version__))
 # Version string like X.Y