Credit Miget for hosting the public demo

Documentation: Add v3.3.0 changelog (#14362 )
Co-authored-by: shamoon <4887959+shamoon@users.noreply.github.com>
2026-10-08 09:07:13 +00:00 · 2026-10-06 09:24:27 -07:00 · 2026-10-05 21:14:19 -07:00 · 2026-10-05 20:34:24 -07:00 · 2026-10-05 20:33:36 -07:00 · 2026-09-23 08:27:18 -07:00
35 changed files with 293 additions and 484 deletions
@@ -80,7 +80,7 @@ jobs:
    needs: changes
    if: needs.changes.outputs.backend_changed == 'true'
    name: "Python ${{ matrix.python-version }}"
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
    strategy:
@@ -114,7 +114,7 @@ jobs:
          packages: unpaper tesseract-ocr imagemagick ghostscript poppler-utils
      - name: Configure ImageMagick
        run: |
-          sudo cp docker/rootfs/etc/ImageMagick-6/paperless-policy.xml /etc/ImageMagick-7/policy.xml
+          sudo cp docker/rootfs/etc/ImageMagick-6/paperless-policy.xml /etc/ImageMagick-6/policy.xml
      - name: Install Python dependencies
        env:
          PYTHON_VERSION: ${{ steps.setup-python.outputs.python-version }}
@@ -158,7 +158,7 @@ jobs:
    needs: changes
    if: needs.changes.outputs.backend_changed == 'true'
    name: Check project typing
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
    env:
@@ -24,10 +24,10 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - runner: ubuntu-26.04
+          - runner: ubuntu-24.04
            arch: amd64
            platform: linux/amd64
-          - runner: ubuntu-26.04-arm
+          - runner: ubuntu-24.04-arm
            arch: arm64
            platform: linux/arm64
    runs-on: ${{ matrix.runner }}
@@ -163,7 +163,7 @@ jobs:
          archive: false
  merge-and-push:
    name: Merge and Push Manifest
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    needs: build-arch
    if: needs.build-arch.outputs.should-push == 'true'
    environment: image-publishing
@@ -65,7 +65,7 @@ jobs:
    needs: changes
    if: needs.changes.outputs.docs_changed == 'true'
    name: Build Documentation
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    steps:
      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
      - name: Checkout
@@ -102,7 +102,7 @@ jobs:
    name: Deploy Documentation
    needs: [changes, build]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.changes.outputs.docs_changed == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      pages: write
      id-token: write
@@ -72,7 +72,7 @@ jobs:
    needs: changes
    if: needs.changes.outputs.frontend_changed == 'true'
    name: Install Dependencies
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
@@ -104,7 +104,7 @@ jobs:
    name: Lint
    needs: [changes, install-dependencies]
    if: needs.changes.outputs.frontend_changed == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
@@ -137,7 +137,7 @@ jobs:
    name: "Unit Tests (${{ matrix.shard-index }}/${{ matrix.shard-count }})"
    needs: [changes, install-dependencies]
    if: needs.changes.outputs.frontend_changed == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
    strategy:
@@ -188,10 +188,10 @@ jobs:
    name: E2E Tests
    needs: [changes, install-dependencies]
    if: needs.changes.outputs.frontend_changed == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
-    container: mcr.microsoft.com/playwright:v1.62.1-resolute
+    container: mcr.microsoft.com/playwright:v1.62.1-noble
    env:
      PLAYWRIGHT_BROWSERS_PATH: /ms-playwright
      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
@@ -246,7 +246,7 @@ jobs:
    name: Frontend Build
    needs: [changes, unit-tests, e2e-tests]
    if: needs.changes.outputs.frontend_changed == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
@@ -14,7 +14,7 @@ permissions: {}
 jobs:
  wait-for-docker:
    name: Wait for Docker Build
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      checks: read
      statuses: read
@@ -30,7 +30,7 @@ jobs:
  build-release:
    name: Build Release
    needs: wait-for-docker
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
@@ -73,7 +73,7 @@ jobs:
        timeout-minutes: 12
        uses: $/.github/actions/apt-install
        with:
-          packages: gettext libleptonica6
+          packages: gettext liblept5
      # ---- Build Documentation ----
      - name: Build documentation
        env:
@@ -145,7 +145,7 @@ jobs:
  publish-release:
    name: Publish Release
    needs: build-release
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      contents: write
      pull-requests: write
@@ -197,7 +197,7 @@ jobs:
    name: Append Changelog
    needs: publish-release
    if: needs.publish-release.outputs.prerelease == 'false'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      contents: write
      pull-requests: write
@@ -15,7 +15,7 @@ permissions:
 jobs:
  zizmor:
    name: Run zizmor
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
      actions: read
@@ -29,7 +29,7 @@ jobs:
        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
  semgrep:
    name: Semgrep CE
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    container:
      image: semgrep/semgrep:1.155.0@sha256:cc869c685dcc0fe497c86258da9f205397d8108e56d21a86082ea4886e52784d
    if: github.actor != 'dependabot[bot]'
@@ -17,7 +17,7 @@ jobs:
  cleanup-images:
    name: Cleanup Image Tags for ${{ matrix.primary-name }}
    if: github.repository_owner == 'paperless-ngx'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    environment: registry-maintenance
    strategy:
      fail-fast: false
@@ -42,7 +42,7 @@ jobs:
  cleanup-untagged-images:
    name: Cleanup Untagged Images Tags for ${{ matrix.primary-name }}
    if: github.repository_owner == 'paperless-ngx'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    needs:
      - cleanup-images
    environment: registry-maintenance
@@ -21,7 +21,7 @@ on:
 jobs:
  analyze:
    name: Analyze
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      actions: read
      contents: read
@@ -13,7 +13,7 @@ jobs:
  synchronize-with-crowdin:
    name: Crowdin Sync
    if: github.repository_owner == 'paperless-ngx'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    environment: translation-sync
    steps:
      - name: Checkout
@@ -7,7 +7,7 @@ jobs:
    # Note: peakoss/anti-slop does not support the `issues` event yet (all of its
    # issue inputs are still commented out upstream), so the checks that the PR Bot
    # workflow gets from the action are implemented manually here.
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-latest
    permissions:
      issues: write
    steps:
@@ -4,7 +4,7 @@ on:
    types: [opened]
 jobs:
  Anti-slop:
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-latest
    permissions:
      contents: read
      issues: read
@@ -24,7 +24,7 @@ jobs:
            ASLOP-PR-VERIFY
  pr-bot:
    name: Automated PR Bot
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-latest
    # Runs after Anti-slop so the welcome comment can see whether the PR was closed
    # instead of racing it. Still runs if that job fails, so labeling is not lost.
    needs: Anti-slop
@@ -12,7 +12,7 @@ permissions:
 jobs:
  pr_opened_or_reopened:
    name: pr_opened_or_reopened
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    permissions:
      # write permission is required for autolabeler
      pull-requests: write
@@ -9,7 +9,7 @@ jobs:
  stale:
    name: 'Stale'
    if: github.repository_owner == 'paperless-ngx'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      issues: write
      pull-requests: write
@@ -34,7 +34,7 @@ jobs:
  lock-threads:
    name: 'Lock Old Threads'
    if: github.repository_owner == 'paperless-ngx'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      issues: write
      pull-requests: write
@@ -58,7 +58,7 @@ jobs:
  close-answered-discussions:
    name: 'Close Answered Discussions'
    if: github.repository_owner == 'paperless-ngx'
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    permissions:
      discussions: write
    steps:
@@ -117,7 +117,7 @@ jobs:
  close-outdated-discussions:
    name: 'Close Outdated Discussions'
    if: github.repository_owner == 'paperless-ngx'
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    permissions:
      discussions: write
    steps:
@@ -211,7 +211,7 @@ jobs:
  close-unsupported-feature-requests:
    name: 'Close Unsupported Feature Requests'
    if: github.repository_owner == 'paperless-ngx'
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    permissions:
      discussions: write
    steps:
@@ -8,7 +8,7 @@ env:
 jobs:
  generate-translate-strings:
    name: Generate Translation Strings
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
    environment: translation-sync
    permissions:
      contents: write
@@ -21,7 +21,7 @@ Paperless-ngx is a document management system that transforms your physical docu

 Paperless-ngx is the official successor to the original [Paperless](https://github.com/the-paperless-project/paperless) & [Paperless-ng](https://github.com/jonaswinkler/paperless-ng) projects and is designed to distribute the responsibility of advancing and supporting the project among a team of people. [Consider joining us!](#community-support)

-Thanks to the generous folks at [DigitalOcean](https://m.do.co/c/8d70b916d462), a demo is available at [demo.paperless-ngx.com](https://demo.paperless-ngx.com) using login `demo` / `demo`. _Note: demo content is reset frequently and confidential information should not be uploaded._
+Thanks to the generous folks at [Miget](https://miget.com), a demo is available at [demo.paperless-ngx.com](https://demo.paperless-ngx.com) using login `demo` / `demo`. _Note: demo content is reset frequently and confidential information should not be uploaded._

 - [Features](#features)
 - [Getting started](#getting-started)
@@ -33,12 +33,12 @@ Thanks to the generous folks at [DigitalOcean](https://m.do.co/c/8d70b916d462),
 - [Related Projects](#related-projects)
 - [Important Note](#important-note)

-<p align="right">This project is supported by:<br/>
-  <a href="https://m.do.co/c/8d70b916d462" style="padding-top: 4px; display: block;">
+<p align="right">Demo hosting provided by:<br/>
+  <a href="https://miget.com" style="padding-top: 4px; display: block;">
    <picture>
-      <source media="(prefers-color-scheme: dark)" srcset="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_white.svg" width="140px">
-      <source media="(prefers-color-scheme: light)" srcset="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" width="140px">
-      <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_black_.svg" width="140px">
+      <source media="(prefers-color-scheme: dark)" srcset="docs/assets/sponsors/miget-white.png" width="140px">
+      <source media="(prefers-color-scheme: light)" srcset="docs/assets/sponsors/miget-black.png" width="140px">
+      <img src="docs/assets/sponsors/miget-black.png" alt="Miget" width="140px">
    </picture>
  </a>
 </p>
@@ -1,5 +1,130 @@
 # Changelog

+## paperless-ngx 3.3.0
+
+### Features / Enhancements
+
+- Enhancement: more control over suggestion requests [@shamoon](https://github.com/shamoon) ([#14258](https://github.com/paperless-ngx/paperless-ngx/pull/14258))
+- Chorehancement: set manifest CORS for credentials [@shamoon](https://github.com/shamoon) ([#14307](https://github.com/paperless-ngx/paperless-ngx/pull/14307))
+- Enhancement: include Django admin with 2FA [@shamoon](https://github.com/shamoon) ([#14270](https://github.com/paperless-ngx/paperless-ngx/pull/14270))
+- Feature: propagate resolved secrets to interactive container shells [@stumpylog](https://github.com/stumpylog) ([#14254](https://github.com/paperless-ngx/paperless-ngx/pull/14254))
+- Enhancement: support separate embedding API key [@furkanural](https://github.com/furkanural) ([#14067](https://github.com/paperless-ngx/paperless-ngx/pull/14067))
+- Enhancement: support passthrough extra params for LLMs [@shamoon](https://github.com/shamoon) ([#14202](https://github.com/paperless-ngx/paperless-ngx/pull/14202))
+- Feature: store barcode contents, list and search them [@jurassicparkicecream](https://github.com/jurassicparkicecream) ([#14276](https://github.com/paperless-ngx/paperless-ngx/pull/14276))
+
+### Bug Fixes
+
+- Fix: Set the ProcessedMail owner based on the rule owner in all cases [@stumpylog](https://github.com/stumpylog) ([#14356](https://github.com/paperless-ngx/paperless-ngx/pull/14356))
+- Fix: Ensure log rotation settings are converted to integers [@stumpylog](https://github.com/stumpylog) ([#14343](https://github.com/paperless-ngx/paperless-ngx/pull/14343))
+- Fix: Wrap apt calls into a retry so we can ideally jump a slow mirror [@stumpylog](https://github.com/stumpylog) ([#14344](https://github.com/paperless-ngx/paperless-ngx/pull/14344))
+- Fix: ship pdf.js CMaps so CJK documents render in the viewer [@MrOggy85](https://github.com/MrOggy85) ([#14318](https://github.com/paperless-ngx/paperless-ngx/pull/14318))
+- Fix: use version page\_count for versioned document [@shamoon](https://github.com/shamoon) ([#14280](https://github.com/paperless-ngx/paperless-ngx/pull/14280))
+- Fix: allow pointer events for pdf links in pngx viewer [@shamoon](https://github.com/shamoon) ([#14264](https://github.com/paperless-ngx/paperless-ngx/pull/14264))
+- Fix: During a move to the trash directory, only attempt to copy metadata [@stumpylog](https://github.com/stumpylog) ([#14250](https://github.com/paperless-ngx/paperless-ngx/pull/14250))
+- Fix: convert file mtime to the configured time zone directly [@stumpylog](https://github.com/stumpylog) ([#14249](https://github.com/paperless-ngx/paperless-ngx/pull/14249))
+- Fix: ensure documentDeleted subscription is discarded [@shamoon](https://github.com/shamoon) ([#14247](https://github.com/paperless-ngx/paperless-ngx/pull/14247))
+- Chore: Fix bugs in the test suite [@stumpylog](https://github.com/stumpylog) ([#14244](https://github.com/paperless-ngx/paperless-ngx/pull/14244))
+- Fix: ensure bulk operations are checked against version root [@shamoon](https://github.com/shamoon) ([#14246](https://github.com/paperless-ngx/paperless-ngx/pull/14246))
+- Fix: indexing after document-added workflows signal [@shamoon](https://github.com/shamoon) ([#14242](https://github.com/paperless-ngx/paperless-ngx/pull/14242))
+- Fix: Record full tag and custom field lists in bulk edit audit log [@stumpylog](https://github.com/stumpylog) ([#14236](https://github.com/paperless-ngx/paperless-ngx/pull/14236))
+- Chore: update pikepdf for ocrmypdf requirement [@shamoon](https://github.com/shamoon) ([#14235](https://github.com/paperless-ngx/paperless-ngx/pull/14235))
+- Fix: handle legacy bulk edit split page range with missing page\_count [@shamoon](https://github.com/shamoon) ([#14212](https://github.com/paperless-ngx/paperless-ngx/pull/14212))
+- Fix: ignore invalid EXIF orientation when generating image archives [@zhzy0077](https://github.com/zhzy0077) ([#14203](https://github.com/paperless-ngx/paperless-ngx/pull/14203))
+
+### Documentation
+
+- Documentation: correct duplicates info [@shamoon](https://github.com/shamoon) ([#14243](https://github.com/paperless-ngx/paperless-ngx/pull/14243))
+
+### Maintenance
+
+- Chore(deps): Bump the actions group across 1 directory with 4 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14332](https://github.com/paperless-ngx/paperless-ngx/pull/14332))
+- Fix: Wrap apt calls into a retry so we can ideally jump a slow mirror [@stumpylog](https://github.com/stumpylog) ([#14344](https://github.com/paperless-ngx/paperless-ngx/pull/14344))
+- Chore(deps): Bump the actions group across 1 directory with 10 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14301](https://github.com/paperless-ngx/paperless-ngx/pull/14301))
+
+### Dependencies
+
+<details>
+<summary>27 changes</summary>
+
+- Chore(deps): Bump django-filter from 25.2 to 26.1 @[dependabot[bot]](https://github.com/apps/dependabot) ([#14337](https://github.com/paperless-ngx/paperless-ngx/pull/14337))
+- Chore(deps): Bump the utilities-patch group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14338](https://github.com/paperless-ngx/paperless-ngx/pull/14338))
+- Chore(deps): Bump the pre-commit-dependencies group across 1 directory with 3 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14351](https://github.com/paperless-ngx/paperless-ngx/pull/14351))
+- Chore(deps-dev): Bump types-channels from 4.3.0.20260408 to 4.3.0.20260518 @[dependabot[bot]](https://github.com/apps/dependabot) ([#14335](https://github.com/paperless-ngx/paperless-ngx/pull/14335))
+- docker(deps): Bump astral-sh/uv from 0.12.20-python3.14-trixie-slim to 0.12.23-python3.14-trixie-slim @[dependabot[bot]](https://github.com/apps/dependabot) ([#14327](https://github.com/paperless-ngx/paperless-ngx/pull/14327))
+- Chore(deps): Bump the actions group across 1 directory with 4 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14332](https://github.com/paperless-ngx/paperless-ngx/pull/14332))
+- Chore(deps): Bump the uv group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14325](https://github.com/paperless-ngx/paperless-ngx/pull/14325))
+- Chore(deps): Bump the frontend-angular-dependencies group across 1 directory with 13 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14329](https://github.com/paperless-ngx/paperless-ngx/pull/14329))
+- Chore(deps-dev): Bump prettier from 3.9.8 to 3.9.9 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#14331](https://github.com/paperless-ngx/paperless-ngx/pull/14331))
+- Chore(deps-dev): Bump the frontend-eslint-dependencies group across 1 directory with 3 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14330](https://github.com/paperless-ngx/paperless-ngx/pull/14330))
+- Chore(deps-dev): Bump zensical from 0.0.64 to 0.0.65 in the development group @[dependabot[bot]](https://github.com/apps/dependabot) ([#14326](https://github.com/paperless-ngx/paperless-ngx/pull/14326))
+- Chore(deps): Bump the uv group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14314](https://github.com/paperless-ngx/paperless-ngx/pull/14314))
+- Chore(deps): Bump the utilities-minor group across 1 directory with 7 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14305](https://github.com/paperless-ngx/paperless-ngx/pull/14305))
+- docker-compose(deps): bump greenmail/standalone from 2.1.13 to 2.1.14 in /docker/compose @[dependabot[bot]](https://github.com/apps/dependabot) ([#14281](https://github.com/paperless-ngx/paperless-ngx/pull/14281))
+- docker(deps): Bump astral-sh/uv from 0.12.16-python3.14-trixie-slim to 0.12.20-python3.14-trixie-slim @[dependabot[bot]](https://github.com/apps/dependabot) ([#14282](https://github.com/paperless-ngx/paperless-ngx/pull/14282))
+- Chore(deps): Bump the pre-commit-dependencies group across 1 directory with 3 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14283](https://github.com/paperless-ngx/paperless-ngx/pull/14283))
+- Chore(deps): Bump the utilities-patch group across 1 directory with 6 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14297](https://github.com/paperless-ngx/paperless-ngx/pull/14297))
+- Chore(deps): Bump the actions group across 1 directory with 10 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14301](https://github.com/paperless-ngx/paperless-ngx/pull/14301))
+- Chore(deps-dev): Bump the frontend-jest-dependencies group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14286](https://github.com/paperless-ngx/paperless-ngx/pull/14286))
+- Chore(deps-dev): Bump eslint from 10.10.0 to 10.11.0 in /src-ui in the frontend-eslint-dependencies group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#14287](https://github.com/paperless-ngx/paperless-ngx/pull/14287))
+- Chore(deps-dev): Bump @types/node from 26.5.0 to 26.6.2 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#14288](https://github.com/paperless-ngx/paperless-ngx/pull/14288))
+- Chore(deps-dev): Bump prettier from 3.9.6 to 3.9.8 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#14289](https://github.com/paperless-ngx/paperless-ngx/pull/14289))
+- Chore(deps): Bump the frontend-angular-dependencies group across 1 directory with 10 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14285](https://github.com/paperless-ngx/paperless-ngx/pull/14285))
+- Chore: replace bleach with turbohtml [@gaborbernat](https://github.com/gaborbernat) ([#14269](https://github.com/paperless-ngx/paperless-ngx/pull/14269))
+- Chore(deps): Bump autobahn from 25.12.2 to 26.7.1 in the uv group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#14231](https://github.com/paperless-ngx/paperless-ngx/pull/14231))
+- Chore: update pikepdf for ocrmypdf requirement [@shamoon](https://github.com/shamoon) ([#14235](https://github.com/paperless-ngx/paperless-ngx/pull/14235))
+- Chore(deps): Bump the pre-commit-dependencies group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14133](https://github.com/paperless-ngx/paperless-ngx/pull/14133))
+
+</details>
+
+### All App Changes
+
+<details>
+<summary>41 changes</summary>
+
+- Feature: store barcode contents, list and search them [@jurassicparkicecream](https://github.com/jurassicparkicecream) ([#14276](https://github.com/paperless-ngx/paperless-ngx/pull/14276))
+- Fix: Set the ProcessedMail owner based on the rule owner in all cases [@stumpylog](https://github.com/stumpylog) ([#14356](https://github.com/paperless-ngx/paperless-ngx/pull/14356))
+- Chore(deps): Bump django-filter from 25.2 to 26.1 @[dependabot[bot]](https://github.com/apps/dependabot) ([#14337](https://github.com/paperless-ngx/paperless-ngx/pull/14337))
+- Chore(deps): Bump the utilities-patch group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14338](https://github.com/paperless-ngx/paperless-ngx/pull/14338))
+- Chore(deps-dev): Bump types-channels from 4.3.0.20260408 to 4.3.0.20260518 @[dependabot[bot]](https://github.com/apps/dependabot) ([#14335](https://github.com/paperless-ngx/paperless-ngx/pull/14335))
+- Chore(deps): Bump the uv group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14325](https://github.com/paperless-ngx/paperless-ngx/pull/14325))
+- Fix: Ensure log rotation settings are converted to integers [@stumpylog](https://github.com/stumpylog) ([#14343](https://github.com/paperless-ngx/paperless-ngx/pull/14343))
+- Chore(deps): Bump the frontend-angular-dependencies group across 1 directory with 13 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14329](https://github.com/paperless-ngx/paperless-ngx/pull/14329))
+- Chore(deps-dev): Bump prettier from 3.9.8 to 3.9.9 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#14331](https://github.com/paperless-ngx/paperless-ngx/pull/14331))
+- Chore(deps-dev): Bump the frontend-eslint-dependencies group across 1 directory with 3 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14330](https://github.com/paperless-ngx/paperless-ngx/pull/14330))
+- Fix: ship pdf.js CMaps so CJK documents render in the viewer [@MrOggy85](https://github.com/MrOggy85) ([#14318](https://github.com/paperless-ngx/paperless-ngx/pull/14318))
+- Chore(deps-dev): Bump zensical from 0.0.64 to 0.0.65 in the development group @[dependabot[bot]](https://github.com/apps/dependabot) ([#14326](https://github.com/paperless-ngx/paperless-ngx/pull/14326))
+- Enhancement: more control over suggestion requests [@shamoon](https://github.com/shamoon) ([#14258](https://github.com/paperless-ngx/paperless-ngx/pull/14258))
+- Chore(deps): Bump the uv group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14314](https://github.com/paperless-ngx/paperless-ngx/pull/14314))
+- Chore: anchor admin url pattern [@shamoon](https://github.com/shamoon) ([#14316](https://github.com/paperless-ngx/paperless-ngx/pull/14316))
+- Chorehancement: set manifest CORS for credentials [@shamoon](https://github.com/shamoon) ([#14307](https://github.com/paperless-ngx/paperless-ngx/pull/14307))
+- Chore(deps): Bump the utilities-minor group across 1 directory with 7 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14305](https://github.com/paperless-ngx/paperless-ngx/pull/14305))
+- Chore(deps): Bump the utilities-patch group across 1 directory with 6 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14297](https://github.com/paperless-ngx/paperless-ngx/pull/14297))
+- Chore(deps-dev): Bump the frontend-jest-dependencies group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14286](https://github.com/paperless-ngx/paperless-ngx/pull/14286))
+- Chore(deps-dev): Bump eslint from 10.10.0 to 10.11.0 in /src-ui in the frontend-eslint-dependencies group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#14287](https://github.com/paperless-ngx/paperless-ngx/pull/14287))
+- Chore(deps-dev): Bump @types/node from 26.5.0 to 26.6.2 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#14288](https://github.com/paperless-ngx/paperless-ngx/pull/14288))
+- Chore(deps-dev): Bump prettier from 3.9.6 to 3.9.8 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#14289](https://github.com/paperless-ngx/paperless-ngx/pull/14289))
+- Chore(deps): Bump the frontend-angular-dependencies group across 1 directory with 10 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14285](https://github.com/paperless-ngx/paperless-ngx/pull/14285))
+- Fix: use version page\_count for versioned document [@shamoon](https://github.com/shamoon) ([#14280](https://github.com/paperless-ngx/paperless-ngx/pull/14280))
+- Chore: replace bleach with turbohtml [@gaborbernat](https://github.com/gaborbernat) ([#14269](https://github.com/paperless-ngx/paperless-ngx/pull/14269))
+- Enhancement: include Django admin with 2FA [@shamoon](https://github.com/shamoon) ([#14270](https://github.com/paperless-ngx/paperless-ngx/pull/14270))
+- Fix: allow pointer events for pdf links in pngx viewer [@shamoon](https://github.com/shamoon) ([#14264](https://github.com/paperless-ngx/paperless-ngx/pull/14264))
+- Feature: propagate resolved secrets to interactive container shells [@stumpylog](https://github.com/stumpylog) ([#14254](https://github.com/paperless-ngx/paperless-ngx/pull/14254))
+- Fix: During a move to the trash directory, only attempt to copy metadata [@stumpylog](https://github.com/stumpylog) ([#14250](https://github.com/paperless-ngx/paperless-ngx/pull/14250))
+- Fix: convert file mtime to the configured time zone directly [@stumpylog](https://github.com/stumpylog) ([#14249](https://github.com/paperless-ngx/paperless-ngx/pull/14249))
+- Fix: ensure documentDeleted subscription is discarded [@shamoon](https://github.com/shamoon) ([#14247](https://github.com/paperless-ngx/paperless-ngx/pull/14247))
+- Chore: Fix bugs in the test suite [@stumpylog](https://github.com/stumpylog) ([#14244](https://github.com/paperless-ngx/paperless-ngx/pull/14244))
+- Fix: ensure bulk operations are checked against version root [@shamoon](https://github.com/shamoon) ([#14246](https://github.com/paperless-ngx/paperless-ngx/pull/14246))
+- Enhancement: support separate embedding API key [@furkanural](https://github.com/furkanural) ([#14067](https://github.com/paperless-ngx/paperless-ngx/pull/14067))
+- Enhancement: support passthrough extra params for LLMs [@shamoon](https://github.com/shamoon) ([#14202](https://github.com/paperless-ngx/paperless-ngx/pull/14202))
+- Chore(deps): Bump autobahn from 25.12.2 to 26.7.1 in the uv group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#14231](https://github.com/paperless-ngx/paperless-ngx/pull/14231))
+- Fix: indexing after document-added workflows signal [@shamoon](https://github.com/shamoon) ([#14242](https://github.com/paperless-ngx/paperless-ngx/pull/14242))
+- Fix: Record full tag and custom field lists in bulk edit audit log [@stumpylog](https://github.com/stumpylog) ([#14236](https://github.com/paperless-ngx/paperless-ngx/pull/14236))
+- Chore: update pikepdf for ocrmypdf requirement [@shamoon](https://github.com/shamoon) ([#14235](https://github.com/paperless-ngx/paperless-ngx/pull/14235))
+- Fix: handle legacy bulk edit split page range with missing page\_count [@shamoon](https://github.com/shamoon) ([#14212](https://github.com/paperless-ngx/paperless-ngx/pull/14212))
+- Fix: ignore invalid EXIF orientation when generating image archives [@zhzy0077](https://github.com/zhzy0077) ([#14203](https://github.com/paperless-ngx/paperless-ngx/pull/14203))
+
+</details>
+
 ## paperless-ngx 3.2.1

 ### Bug Fixes
@@ -76,7 +76,9 @@ is not supported by any of the available parsers.

 **A:** Not by default. As of v3, a file whose contents match an existing document is still
 consumed, and the duplicate is flagged in the UI — open the document and check the
-**Duplicates** tab to review documents that share the same content. If you prefer the old
+**Duplicates** tab to review documents that share the same content, or filter the document
+list by **Duplicates** to find all of them (see
+[Duplicate documents](usage.md#duplicate-documents)). If you prefer the old
 behavior of rejecting duplicates during consumption, set
 [`PAPERLESS_CONSUMER_DELETE_DUPLICATES`](configuration.md#PAPERLESS_CONSUMER_DELETE_DUPLICATES)
 to `true`.
@@ -13,9 +13,9 @@ physical documents into a searchable online archive so you can keep, well, _less
 [Demo](https://demo.paperless-ngx.com){ .md-button .md-button--secondary target=\_blank }

 <div style="display: flex; justify-content: end; margin-top: -1.5rem;">
-  <a href="https://m.do.co/c/8d70b916d462" target="_blank">
-    <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/PoweredByDO/DO_Powered_by_Badge_white.svg#only-dark" class="no-lightbox" width="150px">
-    <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/PoweredByDO/DO_Powered_by_Badge_black.svg#only-light" class="no-lightbox" width="150px">
+  <a href="https://miget.com" target="_blank" aria-label="Demo hosting provided by Miget">
+    <img src="assets/sponsors/miget-white.png#only-dark" alt="Miget" class="no-lightbox" width="150px">
+    <img src="assets/sponsors/miget-black.png#only-light" alt="Miget" class="no-lightbox" width="150px">
  </a>
 </div>

@@ -299,19 +299,18 @@ for details.
 ### Duplicate documents

 By default, Paperless-ngx **does not reject duplicates**. If you consume a file whose
-contents exactly match an existing document (same checksum), the new copy is still
-consumed and a warning is logged. The task entry for the upload also flags that a
-duplicate was detected and links to the existing document(s).
+contents match an existing document (same original or archive checksum), the new copy is
+still consumed and a warning is logged.

-To review duplicates, open a document and switch to the **Duplicates** tab on the
-document detail page. It lists other documents that share the same content, including any
-that are in the trash (shown with a badge), and links to each so you can decide which to
-keep.
+When a document has duplicates, a **Duplicates** tab appears on its detail page, listing
+the other documents you can view that share the same content (including any in the trash).
+To find all documents with duplicates, choose **Duplicates** in the document list's text
+filter dropdown, or use `has_duplicates=true` in the REST API.

 If you would rather reject duplicates at consumption time (the pre-v3 behavior), set
 [`PAPERLESS_CONSUMER_DELETE_DUPLICATES`](configuration.md#PAPERLESS_CONSUMER_DELETE_DUPLICATES)
 to `true`. The duplicate file is then deleted instead of consumed, and the task fails with
-a "document already exists" message.
+a "Document already exists" message linking to the existing document.

 ## Document Suggestions

@@ -1,6 +1,6 @@
 [project]
 name = "paperless-ngx"
-version = "3.2.1"
+version = "3.3.0"
 description = """\
  A community-supported supercharged document management system: scan, index and archive all your physical documents\
  """
@@ -1,6 +1,6 @@
 {
  "name": "paperless-ngx-ui",
-  "version": "3.2.1",
+  "version": "3.3.0",
  "scripts": {
    "preinstall": "npx only-allow pnpm",
    "ng": "ng",
@@ -8,7 +8,7 @@ export const environment = {
  apiVersion: '10', // match src/paperless/settings.py
  appTitle: DEFAULT_APP_TITLE,
  tag: 'prod',
-  version: '3.2.1',
+  version: '3.3.0',
  webSocketHost: window.location.host,
  webSocketProtocol: window.location.protocol == 'https:' ? 'wss:' : 'ws:',
  webSocketBaseUrl: base_url.pathname + 'ws/',
@@ -31,7 +31,6 @@ from documents.search._query import parse_user_query
 from documents.search._schema import _write_sentinels
 from documents.search._schema import build_schema
 from documents.search._schema import open_or_rebuild_index
-from documents.search._schema import rebuild_in_progress
 from documents.search._schema import wipe_index
 from documents.search._tokenizer import ascii_fold
 from documents.search._tokenizer import autocomplete_tokens
@@ -1111,44 +1110,39 @@ class TantivyBackend:
                flushing a segment, deferring merge work; they do not avoid it.
        """
        wipe_index(self._path)
-        # The marker covers the window where the empty index is already stamped
-        # as current but not yet populated, so an interrupted rebuild is retried.
-        with rebuild_in_progress(self._path):
-            new_index = tantivy.Index(build_schema(), path=str(self._path))
-            _write_sentinels(self._path)
-            register_tokenizers(new_index, settings.SEARCH_LANGUAGE)
+        new_index = tantivy.Index(build_schema(), path=str(self._path))
+        _write_sentinels(self._path)
+        register_tokenizers(new_index, settings.SEARCH_LANGUAGE)

-            # Point instance at the new index so _build_tantivy_doc uses it
-            old_index, old_schema = self._raw_index, self._raw_schema
-            self._raw_index = new_index
-            self._raw_schema = new_index.schema
-            # Stream documents one-by-one (so the progress bar advances per
-            # document) while fetching viewer permissions one SQL query per
-            # chunk. The stream is Sized, so iter_wrapper can still discover
-            # the total.
-            documents_stream = _DocumentViewerStream(documents, chunk_size=1000)
-            try:
-                writer = new_index.writer(heap_size=writer_heap_bytes)
-                for document, (viewer_ids, viewer_group_ids) in iter_wrapper(
-                    documents_stream,
-                ):
-                    doc = self._build_tantivy_doc(
-                        document,
-                        viewer_ids=viewer_ids,
-                        viewer_group_ids=viewer_group_ids,
-                    )
-                    writer.add_document(doc)
-                writer.commit()
-                # Wait for background merge threads to finish so all segments
-                # are fully merged and persisted before the index is considered
-                # rebuilt.
-                writer.wait_merging_threads()
-                new_index.reload()
-            except BaseException:  # pragma: no cover
-                # Restore old index on failure so the backend remains usable
-                self._raw_index = old_index
-                self._raw_schema = old_schema
-                raise
+        # Point instance at the new index so _build_tantivy_doc uses it
+        old_index, old_schema = self._raw_index, self._raw_schema
+        self._raw_index = new_index
+        self._raw_schema = new_index.schema
+        # Stream documents one-by-one (so the progress bar advances per
+        # document) while fetching viewer permissions one SQL query per chunk.
+        # The stream is Sized, so iter_wrapper can still discover the total.
+        documents_stream = _DocumentViewerStream(documents, chunk_size=1000)
+        try:
+            writer = new_index.writer(heap_size=writer_heap_bytes)
+            for document, (viewer_ids, viewer_group_ids) in iter_wrapper(
+                documents_stream,
+            ):
+                doc = self._build_tantivy_doc(
+                    document,
+                    viewer_ids=viewer_ids,
+                    viewer_group_ids=viewer_group_ids,
+                )
+                writer.add_document(doc)
+            writer.commit()
+            # Wait for background merge threads to finish so all segments are
+            # fully merged and persisted before the index is considered rebuilt.
+            writer.wait_merging_threads()
+            new_index.reload()
+        except BaseException:  # pragma: no cover
+            # Restore old index on failure so the backend remains usable
+            self._raw_index = old_index
+            self._raw_schema = old_schema
+            raise


 def chunked(iterable, size):
@@ -4,7 +4,6 @@ import hashlib
 import json
 import logging
 import shutil
-from contextlib import contextmanager
 from typing import TYPE_CHECKING
 from typing import Final
 from typing import NamedTuple
@@ -17,7 +16,6 @@ from whoosh_compat import FieldKind
 from documents.search._fields import PUBLIC_FIELDS

 if TYPE_CHECKING:
-    from collections.abc import Iterator
    from pathlib import Path

 logger = logging.getLogger("paperless.search")
@@ -30,11 +28,6 @@ logger = logging.getLogger("paperless.search")
 # v3 - barcodes JSON field for stored barcode contents
 SCHEMA_VERSION: Final[int] = 3

-# Present in the index directory from the moment a full rebuild starts until it
-# finishes. If a rebuild is interrupted it is left behind, so the half-built
-# index is not mistaken for a complete one.
-REBUILD_MARKER: Final[str] = ".rebuilding"
-

 class FieldDescriptor(NamedTuple):
    """One tantivy field, in declaration order.
@@ -262,9 +255,9 @@ def needs_rebuild(index_dir: Path) -> bool:
    """
    Check if the search index needs rebuilding.

-    True if a previous full rebuild never finished (the rebuild marker is still
-    present), or if the index's stamped settings no longer match the current
-    configuration. See _settings_mismatch().
+    Reads .index_settings.json to compare the stored schema version, search
+    language and schema fingerprint against the current configuration. Returns
+    True if the file is missing, unparsable, or any value mismatches.

    Args:
        index_dir: Path to the search index directory
@@ -272,40 +265,6 @@ def needs_rebuild(index_dir: Path) -> bool:
    Returns:
        True if the index needs rebuilding, False if it's up to date
    """
-    if (index_dir / REBUILD_MARKER).exists():
-        logger.warning("Previous search index rebuild did not finish - rebuilding.")
-        return True
-    return _settings_mismatch(index_dir)
-
-
-@contextmanager
-def rebuild_in_progress(index_dir: Path) -> Iterator[None]:
-    """
-    Flag the index as incomplete for the duration of a full rebuild.
-
-    The marker is cleared only if the block exits cleanly. There is deliberately
-    no try/finally: an exception must leave the marker behind so the next
-    needs_rebuild() check retries the rebuild.
-    """
-    marker = index_dir / REBUILD_MARKER
-    marker.touch()
-    yield
-    marker.unlink(missing_ok=True)
-
-
-def _settings_mismatch(index_dir: Path) -> bool:
-    """
-    Check the stamped settings against the current configuration.
-
-    Reads .index_settings.json to compare the stored schema version, search
-    language and schema fingerprint. Returns True if the file is missing,
-    unparsable, or any value mismatches.
-
-    This deliberately ignores the rebuild marker: open_or_rebuild_index() uses it
-    so that a process opening the index while another process is mid-rebuild
-    (or after one died) does not wipe the partial index out from under it.
-    Repopulating is the job of ``document_index reindex``.
-    """
    settings_file = index_dir / ".index_settings.json"
    if not settings_file.exists():
        return True
@@ -374,7 +333,7 @@ def open_or_rebuild_index(index_dir: Path | None = None) -> tantivy.Index:
        index_dir = cast("Path", settings.INDEX_DIR)
    if not index_dir.exists():
        return tantivy.Index(build_schema())
-    if _settings_mismatch(index_dir):
+    if needs_rebuild(index_dir):
        wipe_index(index_dir)
        idx = tantivy.Index(build_schema(), path=str(index_dir))
        _write_sentinels(index_dir)
@@ -90,7 +90,6 @@ from documents.templating.utils import convert_format_str_to_template_format
 from documents.templating.workflows import validate_workflow_template
 from documents.validators import uri_validator
 from documents.validators import url_validator
-from documents.versioning import get_root_document
 from documents.versioning import has_prefetched_effective_content
 from documents.versioning import sort_versions_newest_first

@@ -2895,7 +2894,7 @@ class ShareLinkSerializer(OwnedObjectSerializer):
            and has_perms_owner_aware(
                self.user,
                "view_document",
-                get_root_document(document),
+                document,
            )
        ):
            return document
@@ -16,10 +16,7 @@ from documents.search._backend import TantivyBackend
 from documents.search._backend import WriteBatch
 from documents.search._backend import get_backend
 from documents.search._backend import reset_backend
-from documents.search._schema import REBUILD_MARKER
-from documents.search._schema import needs_rebuild
 from documents.signals.handlers import add_to_index
-from paperless_testing.dirs import PaperlessDirs
 from paperless_testing.factories import CorrespondentFactory
 from paperless_testing.factories import DocumentFactory
 from paperless_testing.factories import DocumentTypeFactory
@@ -826,53 +823,6 @@ class TestRebuild:
        backend.rebuild(Document.objects.all(), iter_wrapper=wrapper)
        assert 30 in seen

-    def test_successful_rebuild_leaves_index_up_to_date(
-        self,
-        backend: TantivyBackend,
-        paperless_dirs: PaperlessDirs,
-    ) -> None:
-        """
-        GIVEN:
-            - A backend and one document
-        WHEN:
-            - rebuild() completes
-        THEN:
-            - needs_rebuild() is False and no rebuild marker remains
-        """
-        DocumentFactory.create()
-
-        backend.rebuild(Document.objects.all())
-
-        assert needs_rebuild(paperless_dirs.index_dir) is False
-        assert not (paperless_dirs.index_dir / REBUILD_MARKER).exists()
-
-    def test_interrupted_rebuild_is_retried(
-        self,
-        backend: TantivyBackend,
-        paperless_dirs: PaperlessDirs,
-    ) -> None:
-        """
-        GIVEN:
-            - A rebuild that dies while indexing documents (e.g. the database
-              connection is lost)
-        WHEN:
-            - needs_rebuild() is checked afterwards
-        THEN:
-            - It is True, even though the empty index was already stamped with
-              current settings, so the next start rebuilds instead of reporting
-              the index as up to date
-        """
-        DocumentFactory.create()
-
-        def die(pairs):
-            raise RuntimeError("terminating connection due to administrator command")
-            yield  # pragma: no cover
-
-        with pytest.raises(RuntimeError):
-            backend.rebuild(Document.objects.all(), iter_wrapper=die)
-
-        assert needs_rebuild(paperless_dirs.index_dir) is True
-
    def test_includes_group_granted_viewers(self, backend: TantivyBackend) -> None:
        """Rebuild must index viewer ids for group-only grants, not just direct ones.

@@ -8,7 +8,6 @@ from auditlog.models import LogEntry  # type: ignore[import-untyped]
 from django.contrib.contenttypes.models import ContentType
 from django.core.files.uploadedfile import SimpleUploadedFile
 from django.test import TestCase as DjangoTestCase
-from django.test import override_settings
 from django.utils import timezone
 from rest_framework import status
 from rest_framework.test import APITestCase
@@ -17,17 +16,13 @@ from documents.data_models import DocumentSource
 from documents.filters import EffectiveContentFilter
 from documents.filters import TitleContentFilter
 from documents.models import Document
-from documents.models import Note
-from documents.models import ShareLink
 from documents.versioning import annotate_effective_content
 from documents.views import DocumentSelectionMixin
 from paperless_testing.dirs import DirectoriesMixin
 from paperless_testing.factories import DocumentFactory
 from paperless_testing.factories import UserFactory
 from paperless_testing.http import read_streaming_response
-from paperless_testing.permissions import grant_all_global
 from paperless_testing.permissions import grant_global
-from paperless_testing.permissions import grant_object

 if TYPE_CHECKING:
    from pathlib import Path
@@ -1048,128 +1043,3 @@ class TestBulkSelectionExcludesVersions(DjangoTestCase):
        )

        self.assertEqual(selected, [root.id])
-
-
-class TestVersionActionPermissions(DirectoriesMixin, APITestCase):
-    def setUp(self):
-        super().setUp()
-        self.user = UserFactory()
-        grant_all_global(self.user)
-        self.client.force_authenticate(self.user)
-        self.root = DocumentFactory(owner=UserFactory())
-        self.version = DocumentFactory(root_document=self.root, owner=None)
-
-    @override_settings(AUDIT_LOG_ENABLED=True)
-    def test_actions_reject_stale_version_ownership(self):
-        note = Note.objects.create(document=self.version, note="Version note")
-        for owner in (None, self.user):
-            self.version.owner = owner
-            self.version.save(update_fields=["owner"])
-            for action in (
-                "notes",
-                "suggestions",
-                "ai_suggestions",
-                "history",
-                "share_links",
-            ):
-                with self.subTest(owner=owner, action=action):
-                    response = self.client.get(
-                        f"/api/documents/{self.version.pk}/{action}/",
-                    )
-                    self.assertEqual(response.status_code, 403)
-            response = self.client.post(
-                f"/api/documents/{self.version.pk}/notes/",
-                {"note": "New note"},
-            )
-            self.assertEqual(response.status_code, 403)
-            response = self.client.delete(
-                f"/api/documents/{self.version.pk}/notes/?id={note.pk}",
-            )
-            self.assertEqual(response.status_code, 403)
-            response = self.client.post(
-                "/api/share_links/",
-                {"document": self.version.pk, "file_version": "original"},
-            )
-            self.assertEqual(response.status_code, 403)
-            response = self.client.post(
-                "/api/share_link_bundles/",
-                {"document_ids": [self.version.pk], "file_version": "original"},
-                format="json",
-            )
-            self.assertEqual(response.status_code, 400)
-            response = self.client.post(
-                "/api/documents/email/",
-                {
-                    "documents": [self.version.pk],
-                    "addresses": "recipient@example.com",
-                    "subject": "Version",
-                    "message": "Version",
-                },
-                format="json",
-            )
-            self.assertEqual(response.status_code, 403)
-            with (
-                mock.patch("documents.views.AIConfig") as ai_config,
-                mock.patch("documents.views.stream_chat_with_documents") as chat,
-            ):
-                ai_config.return_value.ai_enabled = True
-                response = self.client.post(
-                    "/api/documents/chat/",
-                    {"q": "Version?", "document_id": self.version.pk},
-                    format="json",
-                )
-            self.assertEqual(response.status_code, 403)
-            chat.assert_not_called()
-        self.assertTrue(Note.objects.filter(pk=note.pk).exists())
-        self.assertFalse(ShareLink.objects.exists())
-
-    @mock.patch("documents.views.build_share_link_bundle.apply_async")
-    def test_root_permissions_allow_sharing_a_private_version(self, build_mock):
-        self.version.owner = UserFactory()
-        self.version.save(update_fields=["owner"])
-        grant_object(self.user, self.root, "view_document", "change_document")
-        note = Note.objects.create(document=self.version, note="Version note")
-        response = self.client.get(f"/api/documents/{self.version.pk}/notes/")
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual(response.data[0]["id"], note.pk)
-        response = self.client.post(
-            "/api/share_links/",
-            {"document": self.version.pk, "file_version": "original"},
-        )
-        self.assertEqual(response.status_code, 201)
-        self.assertEqual(ShareLink.objects.get().document_id, self.version.pk)
-        response = self.client.get(f"/api/documents/{self.version.pk}/share_links/")
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual(len(response.data), 1)
-        response = self.client.post(
-            "/api/share_link_bundles/",
-            {"document_ids": [self.version.pk], "file_version": "original"},
-            format="json",
-        )
-        self.assertEqual(response.status_code, 201)
-        build_mock.assert_called_once()
-
-    def test_root_view_permission_does_not_allow_note_changes(self):
-        grant_object(self.user, self.root, "view_document")
-        note = Note.objects.create(document=self.version, note="Version note")
-        response = self.client.get(f"/api/documents/{self.version.pk}/notes/")
-        self.assertEqual(response.status_code, 200)
-        response = self.client.post(
-            f"/api/documents/{self.version.pk}/notes/",
-            {"note": "New note"},
-        )
-        self.assertEqual(response.status_code, 403)
-        response = self.client.delete(
-            f"/api/documents/{self.version.pk}/notes/?id={note.pk}",
-        )
-        self.assertEqual(response.status_code, 403)
-        self.assertTrue(Note.objects.filter(pk=note.pk).exists())
-
-    @override_settings(AUDIT_LOG_ENABLED=True)
-    def test_history_uses_root_ownership(self):
-        self.root.owner = self.user
-        self.root.save(update_fields=["owner"])
-        self.version.owner = UserFactory()
-        self.version.save(update_fields=["owner"])
-        response = self.client.get(f"/api/documents/{self.version.pk}/history/")
-        self.assertEqual(response.status_code, 200)
@@ -279,71 +279,3 @@ class TestTrashAPI(DirectoriesMixin, APITestCase):
            Document.objects.filter(root_document=root).values_list("id", flat=True),
            [version.pk for version in versions],
        )
-
-    def test_api_trash_version_follows_root_owner(self) -> None:
-        """
-        GIVEN:
-            - A deleted version of user2's document, owned by nobody
-            - A deleted version of the user's document, owned by user2
-        WHEN:
-            - The user lists the trash and tries to restore or empty the versions
-        THEN:
-            - Only the version of the user's own document is listed
-            - The other version can't be restored or emptied
-            - The version of the user's own document can be restored
-        """
-        user2 = UserFactory(username="user2")
-        other_root = Document.objects.create(
-            title="other root",
-            checksum="other-root",
-            mime_type="application/pdf",
-            owner=user2,
-        )
-        other_version = Document.objects.create(
-            title="other version",
-            checksum="other-version",
-            mime_type="application/pdf",
-            root_document=other_root,
-            version_index=1,
-        )
-        other_version.delete()
-        own_root = Document.objects.create(
-            title="own root",
-            checksum="own-root",
-            mime_type="application/pdf",
-            owner=self.user,
-        )
-        own_version = Document.objects.create(
-            title="own version",
-            checksum="own-version",
-            mime_type="application/pdf",
-            owner=user2,
-            root_document=own_root,
-            version_index=1,
-        )
-        own_version.delete()
-
-        resp = self.client.get("/api/trash/")
-        self.assertEqual(resp.status_code, status.HTTP_200_OK)
-        self.assertEqual(
-            [doc["id"] for doc in resp.data["results"]],
-            [own_version.pk],
-        )
-
-        for action in ("restore", "empty"):
-            with self.subTest(action=action):
-                resp = self.client.post(
-                    "/api/trash/",
-                    {"action": action, "documents": [other_version.pk]},
-                )
-                self.assertEqual(resp.status_code, status.HTTP_403_FORBIDDEN)
-                self.assertTrue(
-                    Document.deleted_objects.filter(pk=other_version.pk).exists(),
-                )
-
-        resp = self.client.post(
-            "/api/trash/",
-            {"action": "restore", "documents": [own_version.pk]},
-        )
-        self.assertEqual(resp.status_code, status.HTTP_200_OK)
-        self.assertTrue(Document.objects.filter(pk=own_version.pk).exists())
@@ -1550,16 +1550,13 @@ class DocumentViewSet(
    )
    def suggestions(self, request, pk=None):
        doc = get_object_or_404(
-            Document.objects.select_related(
-                "owner",
-                "root_document__owner",
-            ).prefetch_related("versions"),
+            Document.objects.select_related("owner").prefetch_related("versions"),
            pk=pk,
        )
        if request.user is not None and not has_perms_owner_aware(
            request.user,
            "change_document",
-            get_root_document(doc),
+            doc,
        ):
            return HttpResponseForbidden("Insufficient permissions")

@@ -1613,16 +1610,13 @@ class DocumentViewSet(
    @method_decorator(cache_control(no_cache=True))
    def ai_suggestions(self, request, pk=None):
        doc = get_object_or_404(
-            Document.objects.select_related(
-                "owner",
-                "root_document__owner",
-            ).prefetch_related("versions"),
+            Document.objects.select_related("owner").prefetch_related("versions"),
            pk=pk,
        )
        if request.user is not None and not has_perms_owner_aware(
            request.user,
            "change_document",
-            get_root_document(doc),
+            doc,
        ):
            return HttpResponseForbidden("Insufficient permissions")

@@ -1862,20 +1856,15 @@ class DocumentViewSet(
        currentUser = request.user
        try:
            doc = (
-                Document.objects.select_related("owner", "root_document__owner")
+                Document.objects.select_related("owner")
                .prefetch_related("notes")
-                .only(
-                    "pk",
-                    "owner__id",
-                    "root_document__id",
-                    "root_document__owner__id",
-                )
+                .only("pk", "owner__id")
                .get(pk=pk)
            )
            if currentUser is not None and not has_perms_owner_aware(
                currentUser,
                "view_document",
-                get_root_document(doc),
+                doc,
            ):
                return HttpResponseForbidden("Insufficient permissions to view notes")
        except Document.DoesNotExist:
@@ -1897,7 +1886,7 @@ class DocumentViewSet(
                if currentUser is not None and not has_perms_owner_aware(
                    currentUser,
                    "change_document",
-                    get_root_document(doc),
+                    doc,
                ):
                    return HttpResponseForbidden(
                        "Insufficient permissions to create notes",
@@ -1940,7 +1929,7 @@ class DocumentViewSet(
            if currentUser is not None and not has_perms_owner_aware(
                currentUser,
                "change_document",
-                get_root_document(doc),
+                doc,
            ):
                return HttpResponseForbidden("Insufficient permissions to delete notes")

@@ -1984,13 +1973,11 @@ class DocumentViewSet(
    def share_links(self, request, pk=None):
        currentUser = request.user
        try:
-            doc = Document.objects.select_related("owner", "root_document__owner").get(
-                pk=pk,
-            )
+            doc = Document.objects.select_related("owner").get(pk=pk)
            if currentUser is not None and not has_perms_owner_aware(
                currentUser,
                "change_document",
-                get_root_document(doc),
+                doc,
            ):
                return HttpResponseForbidden(
                    "Insufficient permissions to add share link",
@@ -2021,11 +2008,10 @@ class DocumentViewSet(
        if not settings.AUDIT_LOG_ENABLED:
            return HttpResponseBadRequest("Audit log is disabled")
        try:
-            doc = Document.objects.select_related("root_document__owner").get(pk=pk)
-            root_doc = get_root_document(doc)
+            doc = Document.objects.get(pk=pk)
            if not request.user.has_perm("auditlog.view_logentry") or (
-                root_doc.owner is not None
-                and root_doc.owner != request.user
+                doc.owner is not None
+                and doc.owner != request.user
                and not request.user.is_superuser
            ):
                return HttpResponseForbidden(
@@ -2113,13 +2099,14 @@ class DocumentViewSet(
        message = validated_data.get("message")
        use_archive_version = validated_data.get("use_archive_version", True)

-        documents = Document.objects.filter(pk__in=document_ids).select_related(
-            "root_document__owner",
-        )
-        if request.user is not None:
-            permitted_ids = set(permitted_document_ids(request.user))
-            if any(get_root_document(doc).pk not in permitted_ids for doc in documents):
-                return HttpResponseForbidden("Insufficient permissions")
+        documents = Document.objects.filter(pk__in=document_ids)
+        if (
+            request.user is not None
+            and documents.exclude(
+                pk__in=permitted_document_ids(request.user),
+            ).exists()
+        ):
+            return HttpResponseForbidden("Insufficient permissions")

        try:
            attachments: list[EmailAttachment] = []
@@ -2443,17 +2430,11 @@ class ChatStreamingView(GenericAPIView[Any]):

        if doc_id:
            try:
-                document = Document.objects.select_related(
-                    "root_document__owner",
-                ).get(id=doc_id)
+                document = Document.objects.get(id=doc_id)
            except Document.DoesNotExist:
                return HttpResponseBadRequest("Document not found")

-            if not has_perms_owner_aware(
-                request.user,
-                "view_document",
-                get_root_document(document),
-            ):
+            if not has_perms_owner_aware(request.user, "view_document", document):
                return HttpResponseForbidden("Insufficient permissions")

            documents = Document.objects.filter(pk=document.pk)
@@ -4796,7 +4777,6 @@ class ShareLinkBundleViewSet(PassUserMixin, ModelViewSet[ShareLinkBundle]):
        document_ids = serializer.validated_data["document_ids"]
        documents_qs = Document.objects.filter(pk__in=document_ids).select_related(
            "owner",
-            "root_document__owner",
        )
        found_ids = set(documents_qs.values_list("pk", flat=True))
        missing = sorted(set(document_ids) - found_ids)
@@ -4813,7 +4793,7 @@ class ShareLinkBundleViewSet(PassUserMixin, ModelViewSet[ShareLinkBundle]):
        documents = list(documents_qs)
        permitted_ids = set(permitted_document_ids(request.user))
        for document in documents:
-            if get_root_document(document).pk not in permitted_ids:
+            if document.pk not in permitted_ids:
                raise ValidationError(
                    {
                        "document_ids": _(
@@ -5607,23 +5587,6 @@ class TrashView(ListModelMixin, PassUserMixin):
    class _TrashPermittedObjectsFilter(PermittedObjectsFilter):
        include_granted = False

-        def filter_queryset(self, request, queryset, view):
-            if request.user.is_superuser or not request.user.is_active:
-                return super().filter_queryset(request, queryset, view)
-
-            # A version belongs to whoever owns its root
-            def owned_or_unowned(prefix: str) -> Q:
-                return Q(**{f"{prefix}owner": request.user}) | Q(
-                    **{f"{prefix}owner__isnull": True},
-                )
-
-            return queryset.filter(
-                (Q(root_document__isnull=True) & owned_or_unowned(""))
-                | (
-                    Q(root_document__isnull=False) & owned_or_unowned("root_document__")
-                ),
-            )
-
    filter_backends = (_TrashPermittedObjectsFilter,)
    pagination_class = StandardPagination

@@ -5653,18 +5616,13 @@ class TrashView(ListModelMixin, PassUserMixin):
            if doc_ids is not None
            else self.filter_queryset(self.get_queryset()).all()
        )
-        # Versions are authorized by their root document
-        if (
-            docs.annotate(root_id=Coalesce("root_document_id", "id"))
-            .exclude(
-                root_id__in=permitted_document_ids(
-                    request.user,
-                    perm="delete_document",
-                    include_deleted=True,
-                ),
-            )
-            .exists()
-        ):
+        if docs.exclude(
+            pk__in=permitted_document_ids(
+                request.user,
+                perm="delete_document",
+                include_deleted=True,
+            ),
+        ).exists():
            return HttpResponseForbidden("Insufficient permissions")
        action = serializer.validated_data.get("action")
        if action == "restore":
@@ -2,7 +2,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: paperless-ngx\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-10-06 15:12+0000\n"
+"POT-Creation-Date: 2026-10-05 16:26+0000\n"
 "PO-Revision-Date: 2022-02-17 04:17\n"
 "Last-Translator: \n"
 "Language-Team: English\n"
@@ -1941,8 +1941,25 @@ msgstr ""
 msgid "As a final step, please complete the following form:"
 msgstr ""

+#: documents/validators.py:24
+#, python-brace-format
+msgid "Unable to parse URI {value}, missing scheme"
+msgstr ""
+
+#: documents/validators.py:29
+#, python-brace-format
+msgid "Unable to parse URI {value}, missing net location or path"
+msgstr ""
+
 #: documents/validators.py:36
-msgid ", "
+msgid ""
+"URI scheme '{parts.scheme}' is not allowed. Allowed schemes: {', '."
+"join(allowed_schemes)}"
+msgstr ""
+
+#: documents/validators.py:45
+#, python-brace-format
+msgid "Unable to parse URI {value}"
 msgstr ""

 #: documents/views.py:336 documents/views.py:2729
@@ -137,20 +137,9 @@ class TestNginxService:
    reason="No Gotenberg/Tika servers to test with",
 )
 class TestParserLive:
-    # Rasterizer versions shift a few pixels, so compare perceptual hashes by
-    # Hamming distance (out of 18 * 18 = 324 bits) rather than for equality
-    MAX_HASH_DISTANCE = 8
-
-    @classmethod
-    def assert_thumbnails_similar(cls, generated: Path, expected: Path) -> None:
-        distance = average_hash(Image.open(generated), 18) - average_hash(
-            Image.open(expected),
-            18,
-        )
-        assert distance <= cls.MAX_HASH_DISTANCE, (
-            f"Thumbnail {generated} differs from {expected} by {distance} bits "
-            f"(max {cls.MAX_HASH_DISTANCE})"
-        )
+    @staticmethod
+    def imagehash(file: Path, hash_size: int = 18) -> str:
+        return f"{average_hash(Image.open(file), hash_size)}"

    def test_get_thumbnail(
        self,
@@ -179,7 +168,12 @@ class TestParserLive:
        assert thumb.exists()
        assert thumb.is_file()

-        self.assert_thumbnails_similar(thumb, simple_txt_email_thumbnail_file)
+        assert self.imagehash(thumb) == self.imagehash(
+            simple_txt_email_thumbnail_file,
+        ), (
+            f"Created thumbnail {thumb} differs from expected file "
+            f"{simple_txt_email_thumbnail_file}"
+        )

    def test_tika_parse_successful(self, mail_parser: MailDocumentParser) -> None:
        """
@@ -261,7 +255,7 @@ class TestParserLive:
        THEN:
            - Gotenberg shall be called to generate the PDF
            - The archive PDF shall contain the expected content
-            - The generated thumbnail shall be perceptually close to the expected image
+            - The generated thumbnail shall match the expected image hash
        """
        util_call_with_backoff(mail_parser.parse, [html_email_file, "message/rfc822"])

@@ -278,4 +272,14 @@ class TestParserLive:
            html_email_file,
            "message/rfc822",
        )
-        self.assert_thumbnails_similar(generated_thumbnail, html_email_thumbnail_file)
+        generated_thumbnail_hash = self.imagehash(generated_thumbnail)
+
+        # The created PDF is not reproducible, but the converted image
+        # should always look the same
+        expected_hash = self.imagehash(html_email_thumbnail_file)
+
+        assert generated_thumbnail_hash == expected_hash, (
+            f"PDF thumbnail differs from expected. "
+            f"Generated: {generated_thumbnail}, "
+            f"Hash: {generated_thumbnail_hash} vs {expected_hash}"
+        )
@@ -1,6 +1,6 @@
 from typing import Final

-__version__: Final[tuple[int, int, int]] = (3, 2, 1)
+__version__: Final[tuple[int, int, int]] = (3, 3, 0)
 # Version string like X.Y.Z
 __full_version_str__: Final[str] = ".".join(map(str, __version__))
 # Version string like X.Y
@@ -2971,7 +2971,7 @@ wheels = [

 [[package]]
 name = "paperless-ngx"
-version = "3.2.1"
+version = "3.3.0"
 source = { virtual = "." }
 dependencies = [
    { name = "azure-ai-documentintelligence" },
Author	SHA1	Message	Date
shamoon	4b3e91df14	Credit Miget for hosting the public demo	2026-10-06 09:24:27 -07:00
github-actions[bot]andshamoon	94f10b8622	Documentation: Add v3.3.0 changelog (#14362 ) Co-authored-by: shamoon <4887959+shamoon@users.noreply.github.com>	2026-10-05 21:14:19 -07:00
shamoon	6f7ed1d4a7	Bump version to 3.3.0	2026-10-05 20:34:24 -07:00
shamoon	0428bf6955	Merge branch 'dev'	2026-10-05 20:33:36 -07:00
shamoon	c63afb47b2	Documentation: correct duplicates info (#14243 )	2026-09-23 08:27:18 -07:00