Chore: enable flake8-datetimez (DTZ) ruff rules

Full category (10/10 codes are all default in ruff 0.16). Of 54 hits, 46 were in test fixture code constructing naive datetimes for comparison/input purposes only - added DTZ to the existing per-file-ignores for */tests/*.py alongside E501/SIM117. The 8 production hits: - documents/consumer.py, documents/views.py (index_last_modified): suppressed with noqa - timezone.make_aware() requires a naive datetime, so wrapping fromtimestamp() in tz= would break it - documents/double_sided.py (x2): switched to datetime.now(tz=UTC).timestamp() - behavior-identical since .timestamp() returns the same epoch value regardless of the attached tz, but now explicit - documents/views.py (x2, upload temp file mtime): suppressed with noqa - mktime() requires a local time tuple, so an aware/UTC now() would introduce a timezone-offset bug - documents/workflows/ai.py (AI suggested date parsing): suppressed with noqa - only .date() is used, time/tz is discarded - paperless_mail/mail.py (IMAP fetch date filter): switched date.today() to timezone.localdate(), which respects settings.TIME_ZONE instead of the system clock - a real correctness improvement when they differ - paperless_mail/views.py (placeholder name string): switched datetime.datetime.now() to timezone.now(), matching the app's existing aware-datetime convention
Chore: enable tryceratops (TRY002/004/201/203/401) ruff rules
2026-08-27 21:23:20 +00:00 · 2026-08-27 11:00:12 -07:00 · 2026-08-27 10:50:32 -07:00 · 2026-08-27 10:37:18 -07:00 · 2026-08-27 10:23:38 -07:00 · 2026-08-27 10:21:27 -07:00
170 changed files with 162064 additions and 92378 deletions
@@ -59,10 +59,13 @@ The following are not generally considered vulnerabilities unless accompanied by
 - large uploads or resource usage that do not bypass documented limits or privileges
 - IDOR / access control claims regarding the ability to attach an un-viewable object to a document. This is expected behavior.
 - claims based solely on the presence of a library, framework feature or code pattern without a working exploit
- reports that rely on admin-level access, workflow-editing privileges, shell access, or other high-trust roles unless they demonstrate an unintended privilege boundary bypass
+- pickle deserialization of internal data from trusted components such as the Redis-compatible broker or Paperless-ngx data directory
+- users with permission to edit users granting themselves additional privileges; this is expected behavior for that trusted permission
+- reports that rely on admin-level access, application-configuration access, workflow-editing privileges, shell access, or other high-trust roles unless they demonstrate an unintended privilege boundary bypass
 - optional webhook, mail, AI, OCR, or integration behavior described without a product-level vulnerability
 - missing limits or hardening settings presented without concrete impact
 - generic AI or static-analysis output that is not confirmed against the current codebase and a real deployment scenario
+- metadata names visible in a document's custom storage path, even when the user cannot access the underlying metadata object; this is expected behavior
 - the ability to attach objects that a user cannot access to a document by ID is an intentional design choice, and not considered a vulnerability

 ## Transparency
@@ -1,5 +1,220 @@
 # Changelog

+## paperless-ngx 3.1.0
+
+### Features / Enhancements
+
+- Enhancement: Apply AI suggestions workflow action [@shamoon](https://github.com/shamoon) ([#13639](https://github.com/paperless-ngx/paperless-ngx/pull/13639))
+- Enhancement: welcome widget visual tweaks [@shamoon](https://github.com/shamoon) ([#13794](https://github.com/paperless-ngx/paperless-ngx/pull/13794))
+- Enhancement: support using remote OCR engines selectively [@shamoon](https://github.com/shamoon) ([#13633](https://github.com/paperless-ngx/paperless-ngx/pull/13633))
+- Enhancement: websocket heartbeat [@oktupol](https://github.com/oktupol) ([#13739](https://github.com/paperless-ngx/paperless-ngx/pull/13739))
+- Enhancement: more v3 ui tweaks [@shamoon](https://github.com/shamoon) ([#13774](https://github.com/paperless-ngx/paperless-ngx/pull/13774))
+- Tweak: better support long list of views in documents list [@shamoon](https://github.com/shamoon) ([#13769](https://github.com/paperless-ngx/paperless-ngx/pull/13769))
+- QoL: add count badge to versions dropdown [@shamoon](https://github.com/shamoon) ([#13753](https://github.com/paperless-ngx/paperless-ngx/pull/13753))
+- Tweakhancement: add jitter to IMAP polling schedule [@shamoon](https://github.com/shamoon) ([#13734](https://github.com/paperless-ngx/paperless-ngx/pull/13734))
+- Enhancement: sync OIDC groups to superuser and staff roles [@BeSovereign](https://github.com/BeSovereign) ([#13060](https://github.com/paperless-ngx/paperless-ngx/pull/13060))
+- Enhancement: merge documents as versions [@shamoon](https://github.com/shamoon) ([#13515](https://github.com/paperless-ngx/paperless-ngx/pull/13515))
+- Tweak: adjust modal proportions for small screens [@shamoon](https://github.com/shamoon) ([#13728](https://github.com/paperless-ngx/paperless-ngx/pull/13728))
+- Refactor: render paperless\_ai prompts via Jinja2 templates instead of f-strings [@stumpylog](https://github.com/stumpylog) ([#13698](https://github.com/paperless-ngx/paperless-ngx/pull/13698))
+- Tweak: small visual tweaks / improvements \& fixes [@shamoon](https://github.com/shamoon) ([#13700](https://github.com/paperless-ngx/paperless-ngx/pull/13700))
+- Enhancement: prefer existing tags, types, correspondents, and storage paths in AI suggestions [@stumpylog](https://github.com/stumpylog) ([#13676](https://github.com/paperless-ngx/paperless-ngx/pull/13676))
+- Tweak: tweak permissions menu labels for shared user-dependent views [@shamoon](https://github.com/shamoon) ([#13685](https://github.com/paperless-ngx/paperless-ngx/pull/13685))
+- Feature: Allow selection of compression type and and level during export [@stumpylog](https://github.com/stumpylog) ([#13661](https://github.com/paperless-ngx/paperless-ngx/pull/13661))
+- Enhancement: customizable icons for saved views [@shamoon](https://github.com/shamoon) ([#13388](https://github.com/paperless-ngx/paperless-ngx/pull/13388))
+- Enhancement: Add --url argument to document\_fuzzy\_match to improve output [@lukyjay](https://github.com/lukyjay) ([#13123](https://github.com/paperless-ngx/paperless-ngx/pull/13123))
+- Feature: Updates remote OCR parser to respect the OCR mode setting [@stumpylog](https://github.com/stumpylog) ([#13408](https://github.com/paperless-ngx/paperless-ngx/pull/13408))
+- Tweak: improve no ML suggestions UX [@shamoon](https://github.com/shamoon) ([#13621](https://github.com/paperless-ngx/paperless-ngx/pull/13621))
+- Performance: reduce memory and I/O overhead of the document exporter during zip exports [@stumpylog](https://github.com/stumpylog) ([#13490](https://github.com/paperless-ngx/paperless-ngx/pull/13490))
+- QoL: make name button text on attribute pages selectable [@shamoon](https://github.com/shamoon) ([#13592](https://github.com/paperless-ngx/paperless-ngx/pull/13592))
+- Performance: More efficient mail fetching [@stumpylog](https://github.com/stumpylog) ([#13432](https://github.com/paperless-ngx/paperless-ngx/pull/13432))
+
+### Bug Fixes
+
+- Fix: prevent config autocomplete craziness [@shamoon](https://github.com/shamoon) ([#13808](https://github.com/paperless-ngx/paperless-ngx/pull/13808))
+- Fix/performance: prevent token reuse in dropdown filtering, also a perf thing [@shamoon](https://github.com/shamoon) ([#13804](https://github.com/paperless-ngx/paperless-ngx/pull/13804))
+- Fix: exclude version documents from bulk edit "all" [@shamoon](https://github.com/shamoon) ([#13791](https://github.com/paperless-ngx/paperless-ngx/pull/13791))
+- Fix: fix bottom mobile nav buttons on Android [@shamoon](https://github.com/shamoon) ([#13780](https://github.com/paperless-ngx/paperless-ngx/pull/13780))
+- Fix: lazy import guardian modules to fix search language setting [@shamoon](https://github.com/shamoon) ([#13768](https://github.com/paperless-ngx/paperless-ngx/pull/13768))
+- Fix: version indexing fixes [@shamoon](https://github.com/shamoon) ([#13737](https://github.com/paperless-ngx/paperless-ngx/pull/13737))
+- Fix: append charset to file response for text files [@shamoon](https://github.com/shamoon) ([#13759](https://github.com/paperless-ngx/paperless-ngx/pull/13759))
+- Chore: pin Apache Tika images to 3.3.1 [@shamoon](https://github.com/shamoon) ([#13758](https://github.com/paperless-ngx/paperless-ngx/pull/13758))
+- Fix: align bulk edit object perms with document model [@shamoon](https://github.com/shamoon) ([#13757](https://github.com/paperless-ngx/paperless-ngx/pull/13757))
+- Fix: use selected version for doc detail emailing [@shamoon](https://github.com/shamoon) ([#13738](https://github.com/paperless-ngx/paperless-ngx/pull/13738))
+- Fix: hide version delete button without global perms [@shamoon](https://github.com/shamoon) ([#13735](https://github.com/paperless-ngx/paperless-ngx/pull/13735))
+- Fix: dont re-render path template when checking collisions [@shamoon](https://github.com/shamoon) ([#13718](https://github.com/paperless-ngx/paperless-ngx/pull/13718))
+- Fix: DocumentClassifierSchema bounds [@shamoon](https://github.com/shamoon) ([#13707](https://github.com/paperless-ngx/paperless-ngx/pull/13707))
+- Fix: remove shadow around attribute pages [@shamoon](https://github.com/shamoon) ([#13696](https://github.com/paperless-ngx/paperless-ngx/pull/13696))
+- Zen: correct dropdown corner radius visual defect [@shamoon](https://github.com/shamoon) ([#13695](https://github.com/paperless-ngx/paperless-ngx/pull/13695))
+- Fix: handle Android keyboard popper overlay [@shamoon](https://github.com/shamoon) ([#13694](https://github.com/paperless-ngx/paperless-ngx/pull/13694))
+- Fix: only show create when there is text, hide set values if no fields in cf bulk edit dropdown [@shamoon](https://github.com/shamoon) ([#13688](https://github.com/paperless-ngx/paperless-ngx/pull/13688))
+- Fix: reopen a fresh Tantivy index per write to prevent orphaned segment files [@stumpylog](https://github.com/stumpylog) ([#13682](https://github.com/paperless-ngx/paperless-ngx/pull/13682))
+- Fix: fix validation of workflow title assignment [@maxtruxa](https://github.com/maxtruxa) ([#13659](https://github.com/paperless-ngx/paperless-ngx/pull/13659))
+- Fix: dont clip search dropdown on mobile [@shamoon](https://github.com/shamoon) ([#13675](https://github.com/paperless-ngx/paperless-ngx/pull/13675))
+- Fix: include sharelink bundle perms in WebUI [@shamoon](https://github.com/shamoon) ([#13664](https://github.com/paperless-ngx/paperless-ngx/pull/13664))
+- Fix: add pagination to saved views management page [@shamoon](https://github.com/shamoon) ([#13646](https://github.com/paperless-ngx/paperless-ngx/pull/13646))
+- Fix: fixes for workflow assign custom field values [@shamoon](https://github.com/shamoon) ([#13630](https://github.com/paperless-ngx/paperless-ngx/pull/13630))
+- Fix: deny deactivated users in permission filtering and auto-login [@stumpylog](https://github.com/stumpylog) ([#13623](https://github.com/paperless-ngx/paperless-ngx/pull/13623))
+- Fix: check bulk mail delete permissions for the whole batch up front [@stumpylog](https://github.com/stumpylog) ([#13620](https://github.com/paperless-ngx/paperless-ngx/pull/13620))
+- Fix: Allow DRF to validate the maximum API key length [@stumpylog](https://github.com/stumpylog) ([#13614](https://github.com/paperless-ngx/paperless-ngx/pull/13614))
+- Fix: render PDF form values in annotation layer [@shamoon](https://github.com/shamoon) ([#13607](https://github.com/paperless-ngx/paperless-ngx/pull/13607))
+- QoL: disable name button without perms [@shamoon](https://github.com/shamoon) ([#13606](https://github.com/paperless-ngx/paperless-ngx/pull/13606))
+- Fix: prevent debounce overwrites in advanced search field, also improve Esc behavior [@shamoon](https://github.com/shamoon) ([#13602](https://github.com/paperless-ngx/paperless-ngx/pull/13602))
+- Fix: raise ParseError on remote OCR failure instead of silently continuing [@stumpylog](https://github.com/stumpylog) ([#13574](https://github.com/paperless-ngx/paperless-ngx/pull/13574))
+- Fix: use selected version when creating share links [@shamoon](https://github.com/shamoon) ([#13571](https://github.com/paperless-ngx/paperless-ngx/pull/13571))
+- Fix: reject bulk edit permissions requests without the correct key [@shamoon](https://github.com/shamoon) ([#13563](https://github.com/paperless-ngx/paperless-ngx/pull/13563))
+- Fix: correctly serve app logo specified in env [@shamoon](https://github.com/shamoon) ([#13561](https://github.com/paperless-ngx/paperless-ngx/pull/13561))
+- Fix: prevent workflow passwords field type error [@shamoon](https://github.com/shamoon) ([#13552](https://github.com/paperless-ngx/paperless-ngx/pull/13552))
+- Fix: correct Firefox print regression [@shamoon](https://github.com/shamoon) ([#13543](https://github.com/paperless-ngx/paperless-ngx/pull/13543))
+- Fix: hide some saved view operations on management page without permissions [@shamoon](https://github.com/shamoon) ([#13542](https://github.com/paperless-ngx/paperless-ngx/pull/13542))
+- Fix: disable pdfjs selection rendering [@shamoon](https://github.com/shamoon) ([#13538](https://github.com/paperless-ngx/paperless-ngx/pull/13538))
+- Fix: hide sidebar drag grips with insufficient permissions [@shamoon](https://github.com/shamoon) ([#13536](https://github.com/paperless-ngx/paperless-ngx/pull/13536))
+- Fix: don't re-queue a consume-folder file that is already queued and awaiting consumption [@stumpylog](https://github.com/stumpylog) ([#13526](https://github.com/paperless-ngx/paperless-ngx/pull/13526))
+- Fix: correct multi-search non-adjacent queries [@shamoon](https://github.com/shamoon) ([#13504](https://github.com/paperless-ngx/paperless-ngx/pull/13504))
+- Fix: Content-Disposition filename normalization [@shamoon](https://github.com/shamoon) ([#13514](https://github.com/paperless-ngx/paperless-ngx/pull/13514))
+- Fix: prevent duplicated text query with multiple date queries [@shamoon](https://github.com/shamoon) ([#13522](https://github.com/paperless-ngx/paperless-ngx/pull/13522))
+- Fix: crash filtering document link custom fields with an unset or unrelated field present [@ggouzi](https://github.com/ggouzi) ([#13518](https://github.com/paperless-ngx/paperless-ngx/pull/13518))
+- Fix: parse unpadded yyyy-mm-dd date input regardless of locale [@Se1foo](https://github.com/Se1foo) ([#13501](https://github.com/paperless-ngx/paperless-ngx/pull/13501))
+
+### Documentation
+
+- Documentation: clarify default OCR mode changes in v3 [@shamoon](https://github.com/shamoon) ([#13666](https://github.com/paperless-ngx/paperless-ngx/pull/13666))
+- Fix: fixes for workflow assign custom field values [@shamoon](https://github.com/shamoon) ([#13630](https://github.com/paperless-ngx/paperless-ngx/pull/13630))
+- Documentation: add wiki links for AI stuff and parser plugins [@shamoon](https://github.com/shamoon) ([#13626](https://github.com/paperless-ngx/paperless-ngx/pull/13626))
+
+### Maintenance
+
+- Chore(deps): Bump the actions group across 1 directory with 20 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13481](https://github.com/paperless-ngx/paperless-ngx/pull/13481))
+
+### Dependencies
+
+<details>
+<summary>23 changes</summary>
+
+- Chore: Upgrade Docker image to Python 3.14 [@stumpylog](https://github.com/stumpylog) ([#13721](https://github.com/paperless-ngx/paperless-ngx/pull/13721))
+- Chore(deps): Bump the uv group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13709](https://github.com/paperless-ngx/paperless-ngx/pull/13709))
+- Chore: update, reorg some npm deps [@shamoon](https://github.com/shamoon) ([#13716](https://github.com/paperless-ngx/paperless-ngx/pull/13716))
+- Chore: update fpdf2 to 2.8.8 [@shamoon](https://github.com/shamoon) ([#13629](https://github.com/paperless-ngx/paperless-ngx/pull/13629))
+- Chore: update pnpm, add blockExoticSubdeps [@shamoon](https://github.com/shamoon) ([#13628](https://github.com/paperless-ngx/paperless-ngx/pull/13628))
+- Chore(deps): Bump h2 from 4.3.0 to 4.4.1 in the uv group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13593](https://github.com/paperless-ngx/paperless-ngx/pull/13593))
+- Chore(deps): Bump pdfjs-dist from 6.1.200 to 6.2.108 in /src-ui in the npm\_and\_yarn group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13594](https://github.com/paperless-ngx/paperless-ngx/pull/13594))
+- Chore(deps): Bump cryptography from 48.0.1 to 50.0.0 in the uv group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13588](https://github.com/paperless-ngx/paperless-ngx/pull/13588))
+- Chore(deps): Bump the utilities-patch group across 1 directory with 6 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13539](https://github.com/paperless-ngx/paperless-ngx/pull/13539))
+- Chore(deps): Bump the utilities-minor group across 1 directory with 20 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13535](https://github.com/paperless-ngx/paperless-ngx/pull/13535))
+- Chore(deps): Bump aiohttp from 3.14.1 to 3.14.3 in the uv group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13537](https://github.com/paperless-ngx/paperless-ngx/pull/13537))
+- Chore(deps-dev): Bump zensical from 0.0.47 to 0.0.51 in the development group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13533](https://github.com/paperless-ngx/paperless-ngx/pull/13533))
+- Chore(deps-dev): Bump postcss from 8.5.22 to 8.5.25 in /src/paperless\_mail/templates in the npm\_and\_yarn group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13534](https://github.com/paperless-ngx/paperless-ngx/pull/13534))
+- Chore(deps): Bump the pre-commit-dependencies group across 1 directory with 4 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13532](https://github.com/paperless-ngx/paperless-ngx/pull/13532))
+- Chore: ruff 0.16 upgrade [@stumpylog](https://github.com/stumpylog) ([#13531](https://github.com/paperless-ngx/paperless-ngx/pull/13531))
+- Chore(deps): Bump the actions group across 1 directory with 20 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13481](https://github.com/paperless-ngx/paperless-ngx/pull/13481))
+- docker(deps): bump astral-sh/uv from 0.11.28-python3.12-trixie-slim to 0.11.32-python3.12-trixie-slim @[dependabot[bot]](https://github.com/apps/dependabot) ([#13472](https://github.com/paperless-ngx/paperless-ngx/pull/13472))
+- docker-compose(deps): bump nginx from 1.31.2-alpine to 1.31.3-alpine in /docker/compose @[dependabot[bot]](https://github.com/apps/dependabot) ([#13470](https://github.com/paperless-ngx/paperless-ngx/pull/13470))
+- docker-compose(deps): Bump greenmail/standalone from 2.1.9 to 2.1.11 in /docker/compose @[dependabot[bot]](https://github.com/apps/dependabot) ([#13469](https://github.com/paperless-ngx/paperless-ngx/pull/13469))
+- Chore(deps): Bump the frontend-angular-dependencies group across 1 directory with 18 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13476](https://github.com/paperless-ngx/paperless-ngx/pull/13476))
+- Chore(deps-dev): Bump @playwright/test from 1.61.1 to 1.62.0 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#13480](https://github.com/paperless-ngx/paperless-ngx/pull/13480))
+- Chore(deps-dev): Bump the frontend-eslint-dependencies group across 1 directory with 4 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13477](https://github.com/paperless-ngx/paperless-ngx/pull/13477))
+- Chore(deps-dev): Bump @types/node from 26.1.0 to 26.1.1 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#13479](https://github.com/paperless-ngx/paperless-ngx/pull/13479))
+
+</details>
+
+### All App Changes
+
+<details>
+<summary>91 changes</summary>
+
+- Fix: prevent config autocomplete craziness [@shamoon](https://github.com/shamoon) ([#13808](https://github.com/paperless-ngx/paperless-ngx/pull/13808))
+- Fix/performance: prevent token reuse in dropdown filtering, also a perf thing [@shamoon](https://github.com/shamoon) ([#13804](https://github.com/paperless-ngx/paperless-ngx/pull/13804))
+- Enhancement: Apply AI suggestions workflow action [@shamoon](https://github.com/shamoon) ([#13639](https://github.com/paperless-ngx/paperless-ngx/pull/13639))
+- Fix: exclude version documents from bulk edit "all" [@shamoon](https://github.com/shamoon) ([#13791](https://github.com/paperless-ngx/paperless-ngx/pull/13791))
+- Enhancement: welcome widget visual tweaks [@shamoon](https://github.com/shamoon) ([#13794](https://github.com/paperless-ngx/paperless-ngx/pull/13794))
+- Performance: fetch note authors with prefetch instead of one query each [@shamoon](https://github.com/shamoon) ([#13790](https://github.com/paperless-ngx/paperless-ngx/pull/13790))
+- Tweak: more misc UI tweaks [@shamoon](https://github.com/shamoon) ([#13783](https://github.com/paperless-ngx/paperless-ngx/pull/13783))
+- Enhancement: support using remote OCR engines selectively [@shamoon](https://github.com/shamoon) ([#13633](https://github.com/paperless-ngx/paperless-ngx/pull/13633))
+- Fix: fix bottom mobile nav buttons on Android [@shamoon](https://github.com/shamoon) ([#13780](https://github.com/paperless-ngx/paperless-ngx/pull/13780))
+- Enhancement: websocket heartbeat [@oktupol](https://github.com/oktupol) ([#13739](https://github.com/paperless-ngx/paperless-ngx/pull/13739))
+- Fix: lazy import guardian modules to fix search language setting [@shamoon](https://github.com/shamoon) ([#13768](https://github.com/paperless-ngx/paperless-ngx/pull/13768))
+- Enhancement: more v3 ui tweaks [@shamoon](https://github.com/shamoon) ([#13774](https://github.com/paperless-ngx/paperless-ngx/pull/13774))
+- Chore: add some missing UI accessibility labels [@shamoon](https://github.com/shamoon) ([#13772](https://github.com/paperless-ngx/paperless-ngx/pull/13772))
+- Chore: refactor permission checkbox live changes [@shamoon](https://github.com/shamoon) ([#13771](https://github.com/paperless-ngx/paperless-ngx/pull/13771))
+- Tweak: better support long list of views in documents list [@shamoon](https://github.com/shamoon) ([#13769](https://github.com/paperless-ngx/paperless-ngx/pull/13769))
+- Fix: version indexing fixes [@shamoon](https://github.com/shamoon) ([#13737](https://github.com/paperless-ngx/paperless-ngx/pull/13737))
+- Fix: append charset to file response for text files [@shamoon](https://github.com/shamoon) ([#13759](https://github.com/paperless-ngx/paperless-ngx/pull/13759))
+- Fix: align bulk edit object perms with document model [@shamoon](https://github.com/shamoon) ([#13757](https://github.com/paperless-ngx/paperless-ngx/pull/13757))
+- QoL: add count badge to versions dropdown [@shamoon](https://github.com/shamoon) ([#13753](https://github.com/paperless-ngx/paperless-ngx/pull/13753))
+- Tweakhancement: add jitter to IMAP polling schedule [@shamoon](https://github.com/shamoon) ([#13734](https://github.com/paperless-ngx/paperless-ngx/pull/13734))
+- Fix: use selected version for doc detail emailing [@shamoon](https://github.com/shamoon) ([#13738](https://github.com/paperless-ngx/paperless-ngx/pull/13738))
+- Fix: hide version delete button without global perms [@shamoon](https://github.com/shamoon) ([#13735](https://github.com/paperless-ngx/paperless-ngx/pull/13735))
+- Enhancement: sync OIDC groups to superuser and staff roles [@BeSovereign](https://github.com/BeSovereign) ([#13060](https://github.com/paperless-ngx/paperless-ngx/pull/13060))
+- Enhancement: merge documents as versions [@shamoon](https://github.com/shamoon) ([#13515](https://github.com/paperless-ngx/paperless-ngx/pull/13515))
+- Tweak: adjust modal proportions for small screens [@shamoon](https://github.com/shamoon) ([#13728](https://github.com/paperless-ngx/paperless-ngx/pull/13728))
+- Refactor: render paperless\_ai prompts via Jinja2 templates instead of f-strings [@stumpylog](https://github.com/stumpylog) ([#13698](https://github.com/paperless-ngx/paperless-ngx/pull/13698))
+- Chore(deps): Bump the uv group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13709](https://github.com/paperless-ngx/paperless-ngx/pull/13709))
+- Fix: dont re-render path template when checking collisions [@shamoon](https://github.com/shamoon) ([#13718](https://github.com/paperless-ngx/paperless-ngx/pull/13718))
+- Chore: update, reorg some npm deps [@shamoon](https://github.com/shamoon) ([#13716](https://github.com/paperless-ngx/paperless-ngx/pull/13716))
+- Fix: DocumentClassifierSchema bounds [@shamoon](https://github.com/shamoon) ([#13707](https://github.com/paperless-ngx/paperless-ngx/pull/13707))
+- Tweak: small visual tweaks / improvements \& fixes [@shamoon](https://github.com/shamoon) ([#13700](https://github.com/paperless-ngx/paperless-ngx/pull/13700))
+- Fix: remove shadow around attribute pages [@shamoon](https://github.com/shamoon) ([#13696](https://github.com/paperless-ngx/paperless-ngx/pull/13696))
+- Zen: correct dropdown corner radius visual defect [@shamoon](https://github.com/shamoon) ([#13695](https://github.com/paperless-ngx/paperless-ngx/pull/13695))
+- Fix: handle Android keyboard popper overlay [@shamoon](https://github.com/shamoon) ([#13694](https://github.com/paperless-ngx/paperless-ngx/pull/13694))
+- Enhancement: prefer existing tags, types, correspondents, and storage paths in AI suggestions [@stumpylog](https://github.com/stumpylog) ([#13676](https://github.com/paperless-ngx/paperless-ngx/pull/13676))
+- Fix: only show create when there is text, hide set values if no fields in cf bulk edit dropdown [@shamoon](https://github.com/shamoon) ([#13688](https://github.com/paperless-ngx/paperless-ngx/pull/13688))
+- Fix: reopen a fresh Tantivy index per write to prevent orphaned segment files [@stumpylog](https://github.com/stumpylog) ([#13682](https://github.com/paperless-ngx/paperless-ngx/pull/13682))
+- Tweak: tweak permissions menu labels for shared user-dependent views [@shamoon](https://github.com/shamoon) ([#13685](https://github.com/paperless-ngx/paperless-ngx/pull/13685))
+- Fix: fix validation of workflow title assignment [@maxtruxa](https://github.com/maxtruxa) ([#13659](https://github.com/paperless-ngx/paperless-ngx/pull/13659))
+- Feature: Allow selection of compression type and and level during export [@stumpylog](https://github.com/stumpylog) ([#13661](https://github.com/paperless-ngx/paperless-ngx/pull/13661))
+- Fix: dont clip search dropdown on mobile [@shamoon](https://github.com/shamoon) ([#13675](https://github.com/paperless-ngx/paperless-ngx/pull/13675))
+- Fix: include sharelink bundle perms in WebUI [@shamoon](https://github.com/shamoon) ([#13664](https://github.com/paperless-ngx/paperless-ngx/pull/13664))
+- Enhancement: customizable icons for saved views [@shamoon](https://github.com/shamoon) ([#13388](https://github.com/paperless-ngx/paperless-ngx/pull/13388))
+- Enhancement: Add --url argument to document\_fuzzy\_match to improve output [@lukyjay](https://github.com/lukyjay) ([#13123](https://github.com/paperless-ngx/paperless-ngx/pull/13123))
+- Feature: Updates remote OCR parser to respect the OCR mode setting [@stumpylog](https://github.com/stumpylog) ([#13408](https://github.com/paperless-ngx/paperless-ngx/pull/13408))
+- Performance: pass document chat queries as a QuerySet instead of a materialized.list [@stumpylog](https://github.com/stumpylog) ([#13638](https://github.com/paperless-ngx/paperless-ngx/pull/13638))
+- Fix: add pagination to saved views management page [@shamoon](https://github.com/shamoon) ([#13646](https://github.com/paperless-ngx/paperless-ngx/pull/13646))
+- Fix: fixes for workflow assign custom field values [@shamoon](https://github.com/shamoon) ([#13630](https://github.com/paperless-ngx/paperless-ngx/pull/13630))
+- Fix: deny deactivated users in permission filtering and auto-login [@stumpylog](https://github.com/stumpylog) ([#13623](https://github.com/paperless-ngx/paperless-ngx/pull/13623))
+- Chore: update fpdf2 to 2.8.8 [@shamoon](https://github.com/shamoon) ([#13629](https://github.com/paperless-ngx/paperless-ngx/pull/13629))
+- Chore: update pnpm, add blockExoticSubdeps [@shamoon](https://github.com/shamoon) ([#13628](https://github.com/paperless-ngx/paperless-ngx/pull/13628))
+- Fix: check bulk mail delete permissions for the whole batch up front [@stumpylog](https://github.com/stumpylog) ([#13620](https://github.com/paperless-ngx/paperless-ngx/pull/13620))
+- Tweak: improve no ML suggestions UX [@shamoon](https://github.com/shamoon) ([#13621](https://github.com/paperless-ngx/paperless-ngx/pull/13621))
+- Fix: Allow DRF to validate the maximum API key length [@stumpylog](https://github.com/stumpylog) ([#13614](https://github.com/paperless-ngx/paperless-ngx/pull/13614))
+- Performance: unify permission-filtering backends, fixes Correspondent/Tag list slowness [@stumpylog](https://github.com/stumpylog) ([#13601](https://github.com/paperless-ngx/paperless-ngx/pull/13601))
+- Performance: generalize permitted\_document\_ids into permitted\_object\_ids for any model [@stumpylog](https://github.com/stumpylog) ([#13578](https://github.com/paperless-ngx/paperless-ngx/pull/13578))
+- Fix: render PDF form values in annotation layer [@shamoon](https://github.com/shamoon) ([#13607](https://github.com/paperless-ngx/paperless-ngx/pull/13607))
+- QoL: disable name button without perms [@shamoon](https://github.com/shamoon) ([#13606](https://github.com/paperless-ngx/paperless-ngx/pull/13606))
+- Fix: prevent debounce overwrites in advanced search field, also improve Esc behavior [@shamoon](https://github.com/shamoon) ([#13602](https://github.com/paperless-ngx/paperless-ngx/pull/13602))
+- Performance: reduce memory and I/O overhead of the document exporter during zip exports [@stumpylog](https://github.com/stumpylog) ([#13490](https://github.com/paperless-ngx/paperless-ngx/pull/13490))
+- Chore(deps): Bump h2 from 4.3.0 to 4.4.1 in the uv group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13593](https://github.com/paperless-ngx/paperless-ngx/pull/13593))
+- Chore(deps): Bump pdfjs-dist from 6.1.200 to 6.2.108 in /src-ui in the npm\_and\_yarn group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13594](https://github.com/paperless-ngx/paperless-ngx/pull/13594))
+- QoL: make name button text on attribute pages selectable [@shamoon](https://github.com/shamoon) ([#13592](https://github.com/paperless-ngx/paperless-ngx/pull/13592))
+- Fix: raise ParseError on remote OCR failure instead of silently continuing [@stumpylog](https://github.com/stumpylog) ([#13574](https://github.com/paperless-ngx/paperless-ngx/pull/13574))
+- Fix: use selected version when creating share links [@shamoon](https://github.com/shamoon) ([#13571](https://github.com/paperless-ngx/paperless-ngx/pull/13571))
+- Chore: specify AI chat refine template [@shamoon](https://github.com/shamoon) ([#13564](https://github.com/paperless-ngx/paperless-ngx/pull/13564))
+- Fix: reject bulk edit permissions requests without the correct key [@shamoon](https://github.com/shamoon) ([#13563](https://github.com/paperless-ngx/paperless-ngx/pull/13563))
+- Fix: correctly serve app logo specified in env [@shamoon](https://github.com/shamoon) ([#13561](https://github.com/paperless-ngx/paperless-ngx/pull/13561))
+- Fix: prevent workflow passwords field type error [@shamoon](https://github.com/shamoon) ([#13552](https://github.com/paperless-ngx/paperless-ngx/pull/13552))
+- Chore(deps): Bump the utilities-patch group across 1 directory with 6 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13539](https://github.com/paperless-ngx/paperless-ngx/pull/13539))
+- Chore(deps): Bump the utilities-minor group across 1 directory with 20 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13535](https://github.com/paperless-ngx/paperless-ngx/pull/13535))
+- Performance: More efficient mail fetching [@stumpylog](https://github.com/stumpylog) ([#13432](https://github.com/paperless-ngx/paperless-ngx/pull/13432))
+- Performance: eliminate per-document guardian permission-check causing high CPU on document lists [@stumpylog](https://github.com/stumpylog) ([#13505](https://github.com/paperless-ngx/paperless-ngx/pull/13505))
+- Fix: correct Firefox print regression [@shamoon](https://github.com/shamoon) ([#13543](https://github.com/paperless-ngx/paperless-ngx/pull/13543))
+- Fix: hide some saved view operations on management page without permissions [@shamoon](https://github.com/shamoon) ([#13542](https://github.com/paperless-ngx/paperless-ngx/pull/13542))
+- Chore(deps): Bump aiohttp from 3.14.1 to 3.14.3 in the uv group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13537](https://github.com/paperless-ngx/paperless-ngx/pull/13537))
+- Chore(deps-dev): Bump zensical from 0.0.47 to 0.0.51 in the development group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13533](https://github.com/paperless-ngx/paperless-ngx/pull/13533))
+- Fix: disable pdfjs selection rendering [@shamoon](https://github.com/shamoon) ([#13538](https://github.com/paperless-ngx/paperless-ngx/pull/13538))
+- Fix: hide sidebar drag grips with insufficient permissions [@shamoon](https://github.com/shamoon) ([#13536](https://github.com/paperless-ngx/paperless-ngx/pull/13536))
+- Chore(deps-dev): Bump postcss from 8.5.22 to 8.5.25 in /src/paperless\_mail/templates in the npm\_and\_yarn group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13534](https://github.com/paperless-ngx/paperless-ngx/pull/13534))
+- Chore: ruff 0.16 upgrade [@stumpylog](https://github.com/stumpylog) ([#13531](https://github.com/paperless-ngx/paperless-ngx/pull/13531))
+- Fix: don't re-queue a consume-folder file that is already queued and awaiting consumption [@stumpylog](https://github.com/stumpylog) ([#13526](https://github.com/paperless-ngx/paperless-ngx/pull/13526))
+- Fix: correct multi-search non-adjacent queries [@shamoon](https://github.com/shamoon) ([#13504](https://github.com/paperless-ngx/paperless-ngx/pull/13504))
+- Fix: Content-Disposition filename normalization [@shamoon](https://github.com/shamoon) ([#13514](https://github.com/paperless-ngx/paperless-ngx/pull/13514))
+- Fix: prevent duplicated text query with multiple date queries [@shamoon](https://github.com/shamoon) ([#13522](https://github.com/paperless-ngx/paperless-ngx/pull/13522))
+- Fix: crash filtering document link custom fields with an unset or unrelated field present [@ggouzi](https://github.com/ggouzi) ([#13518](https://github.com/paperless-ngx/paperless-ngx/pull/13518))
+- Fix: parse unpadded yyyy-mm-dd date input regardless of locale [@Se1foo](https://github.com/Se1foo) ([#13501](https://github.com/paperless-ngx/paperless-ngx/pull/13501))
+- Chore(deps): Bump the frontend-angular-dependencies group across 1 directory with 18 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13476](https://github.com/paperless-ngx/paperless-ngx/pull/13476))
+- Chore(deps-dev): Bump @playwright/test from 1.61.1 to 1.62.0 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#13480](https://github.com/paperless-ngx/paperless-ngx/pull/13480))
+- Chore(deps-dev): Bump the frontend-eslint-dependencies group across 1 directory with 4 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13477](https://github.com/paperless-ngx/paperless-ngx/pull/13477))
+- Chore(deps-dev): Bump @types/node from 26.1.0 to 26.1.1 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#13479](https://github.com/paperless-ngx/paperless-ngx/pull/13479))
+
+</details>
+
 ## paperless-ngx 3.0.5

 ### Bug Fixes
@@ -8,6 +8,12 @@ common [OCR](#ocr) related settings and some frontend settings. If set, these wi
 preference over the settings via environment variables. If not set, the environment setting
 or applicable default will be utilized instead.

+!!! warning
+
+    Changing configuration from the UI requires the `AppConfig` permission, which applies
+    instance-wide and should be treated as an admin-level permission. See
+    [global permissions](usage.md#global-permissions).
+
 - If you run paperless on docker, `paperless.conf` is not used.
  Rather, configure paperless by copying necessary options to
  `docker-compose.env`.
@@ -1125,6 +1131,10 @@ they use underscores instead of dashes.
        so specifying invalid options may prevent paperless from consuming
        any documents.  Use with caution!

+        These arguments are passed directly to OCRmyPDF, so this setting should only
+        be changed by trusted users. This applies to the `AppConfig` permission as well,
+        which allows setting these arguments from the UI.
+
    Specify arguments as a JSON dictionary. Keep note of lower case
    booleans and double quoted parameter names and strings. Examples:

@@ -427,27 +427,27 @@ Global permissions define what areas of the app and API endpoints users can acce
 determine if a user can create, edit, delete or view _any_ documents, but individual documents themselves
 still have "object-level" permissions.

-| Type             | Details                                                                                                                                                                                                                         |
-| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| AppConfig        | _Change_ or higher permissions grants access to the "Application Configuration" area.                                                                                                                                           |
-| Correspondent    | Add, edit, delete or view Correspondents.                                                                                                                                                                                       |
-| CustomField      | Add, edit, delete or view Custom Fields.                                                                                                                                                                                        |
-| Document         | Add, edit, delete or view Documents.                                                                                                                                                                                            |
-| DocumentType     | Add, edit, delete or view Document Types.                                                                                                                                                                                       |
-| Group            | Add, edit, delete or view Groups.                                                                                                                                                                                               |
-| GlobalStatistics | View aggregate object counts and statistics. This does not grant access to view individual documents.                                                                                                                           |
-| MailAccount      | Add, edit, delete or view Mail Accounts.                                                                                                                                                                                        |
-| MailRule         | Add, edit, delete or view Mail Rules.                                                                                                                                                                                           |
-| Note             | Add, edit, delete or view Notes.                                                                                                                                                                                                |
-| PaperlessTask    | View or dismiss (_Change_) File Tasks.                                                                                                                                                                                          |
-| SavedView        | Add, edit, delete or view Saved Views.                                                                                                                                                                                          |
-| ShareLink        | Add, delete or view Share Links.                                                                                                                                                                                                |
-| StoragePath      | Add, edit, delete or view Storage Paths.                                                                                                                                                                                        |
-| SystemMonitoring | View the system status dialog, tasks summary and their API endpoints. Admin users also retain system status access.                                                                                                             |
-| Tag              | Add, edit, delete or view Tags.                                                                                                                                                                                                 |
-| UISettings       | Add, edit, delete or view the UI settings that are used by the web app.<br/>:warning: **Users that will access the web UI must be granted at least _View_ permissions.**                                                        |
-| User             | Add, edit, delete or view other user accounts via Settings > Users & Groups and `/api/users/`. These permissions are not needed for users to edit their own profile via "My Profile" or `/api/profile/`.                        |
-| Workflow         | Add, edit, delete or view Workflows.<br/>Note that Workflows are global; all users who can access workflows see the same set. Workflows have other permission implications — see [Workflow permissions](#workflow-permissions). |
+| Type             | Details                                                                                                                                                                                                                                                                                              |
+| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| AppConfig        | _Change_ or higher permissions grants access to the "Application Configuration" area.<br/>:warning: **This is a trusted, admin-level permission.** Application configuration applies instance-wide and some settings, such as OCR arguments, are passed directly to the underlying processing tools. |
+| Correspondent    | Add, edit, delete or view Correspondents.                                                                                                                                                                                                                                                            |
+| CustomField      | Add, edit, delete or view Custom Fields.                                                                                                                                                                                                                                                             |
+| Document         | Add, edit, delete or view Documents.                                                                                                                                                                                                                                                                 |
+| DocumentType     | Add, edit, delete or view Document Types.                                                                                                                                                                                                                                                            |
+| Group            | Add, edit, delete or view Groups.                                                                                                                                                                                                                                                                    |
+| GlobalStatistics | View aggregate object counts and statistics. This does not grant access to view individual documents.                                                                                                                                                                                                |
+| MailAccount      | Add, edit, delete or view Mail Accounts.                                                                                                                                                                                                                                                             |
+| MailRule         | Add, edit, delete or view Mail Rules.                                                                                                                                                                                                                                                                |
+| Note             | Add, edit, delete or view Notes.                                                                                                                                                                                                                                                                     |
+| PaperlessTask    | View or dismiss (_Change_) File Tasks.                                                                                                                                                                                                                                                               |
+| SavedView        | Add, edit, delete or view Saved Views.                                                                                                                                                                                                                                                               |
+| ShareLink        | Add, delete or view Share Links.                                                                                                                                                                                                                                                                     |
+| StoragePath      | Add, edit, delete or view Storage Paths.                                                                                                                                                                                                                                                             |
+| SystemMonitoring | View the system status dialog, tasks summary and their API endpoints. Admin users also retain system status access.                                                                                                                                                                                  |
+| Tag              | Add, edit, delete or view Tags.                                                                                                                                                                                                                                                                      |
+| UISettings       | Add, edit, delete or view the UI settings that are used by the web app.<br/>:warning: **Users that will access the web UI must be granted at least _View_ permissions.**                                                                                                                             |
+| User             | Add, edit, delete or view other user accounts via Settings > Users & Groups and `/api/users/`. These permissions are not needed for users to edit their own profile via "My Profile" or `/api/profile/`.                                                                                             |
+| Workflow         | Add, edit, delete or view Workflows.<br/>Note that Workflows are global; all users who can access workflows see the same set. Workflows have other permission implications — see [Workflow permissions](#workflow-permissions).                                                                      |

 #### Detailed Explanation of Object Permissions {#object-permissions}

@@ -1,6 +1,6 @@
 [project]
 name = "paperless-ngx"
-version = "3.0.5"
+version = "3.1.0"
 description = "A community-supported supercharged document management system: scan, index and archive all your physical documents"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -186,29 +186,110 @@ line-ending = "lf"
 # https://docs.astral.sh/ruff/rules/
 select = [ "E4", "E7", "E9", "F" ]
 extend-select = [
-  "COM",  # https://docs.astral.sh/ruff/rules/#flake8-commas-com
-  "DJ",   # https://docs.astral.sh/ruff/rules/#flake8-django-dj
-  "EXE",  # https://docs.astral.sh/ruff/rules/#flake8-executable-exe
-  "FBT",  # https://docs.astral.sh/ruff/rules/#flake8-boolean-trap-fbt
-  "FLY",  # https://docs.astral.sh/ruff/rules/#flynt-fly
-  "G201", # https://docs.astral.sh/ruff/rules/#flake8-logging-format-g
-  "I",    # https://docs.astral.sh/ruff/rules/#isort-i
-  "ICN",  # https://docs.astral.sh/ruff/rules/#flake8-import-conventions-icn
-  "INP",  # https://docs.astral.sh/ruff/rules/#flake8-no-pep420-inp
-  "ISC",  # https://docs.astral.sh/ruff/rules/#flake8-implicit-str-concat-isc
-  "PIE",  # https://docs.astral.sh/ruff/rules/#flake8-pie-pie
-  "PLC",  # https://docs.astral.sh/ruff/rules/#pylint-pl
-  "PLE",  # https://docs.astral.sh/ruff/rules/#pylint-pl
-  "PTH",  # https://docs.astral.sh/ruff/rules/#flake8-use-pathlib-pth
-  "Q",    # https://docs.astral.sh/ruff/rules/#flake8-quotes-q
-  "RSE",  # https://docs.astral.sh/ruff/rules/#flake8-raise-rse
-  "RUF",  # https://docs.astral.sh/ruff/rules/#ruff-specific-rules-ruf
-  "SIM",  # https://docs.astral.sh/ruff/rules/#flake8-simplify-sim
-  "T20",  # https://docs.astral.sh/ruff/rules/#flake8-print-t20
-  "TC",   # https://docs.astral.sh/ruff/rules/#flake8-type-checking-tc
-  "TID",  # https://docs.astral.sh/ruff/rules/#flake8-tidy-imports-tid
-  "UP",   # https://docs.astral.sh/ruff/rules/#pyupgrade-up
-  "W",    # https://docs.astral.sh/ruff/rules/#pycodestyle-e-w
+  "ASYNC",   # https://docs.astral.sh/ruff/rules/#flake8-async-async
+  "B002",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B003",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B004",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B005",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B006",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B008",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B009",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B010",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B012",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B013",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B014",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B015",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B016",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B017",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B018",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B019",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B020",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B021",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B022",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B023",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B025",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B026",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B029",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B030",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B031",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B032",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B033",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B035",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "B039",    # https://docs.astral.sh/ruff/rules/#flake8-bugbear-b
+  "C4",      # https://docs.astral.sh/ruff/rules/#flake8-comprehensions-c4
+  "COM",     # https://docs.astral.sh/ruff/rules/#flake8-commas-com
+  "D419",    # https://docs.astral.sh/ruff/rules/#pydocstyle-d
+  "DJ",      # https://docs.astral.sh/ruff/rules/#flake8-django-dj
+  "DTZ",     # https://docs.astral.sh/ruff/rules/#flake8-datetimez-dtz
+  "EXE",     # https://docs.astral.sh/ruff/rules/#flake8-executable-exe
+  "FA",      # https://docs.astral.sh/ruff/rules/#flake8-future-annotations-fa
+  "FBT",     # https://docs.astral.sh/ruff/rules/#flake8-boolean-trap-fbt
+  "FLY",     # https://docs.astral.sh/ruff/rules/#flynt-fly
+  "FURB",    # https://docs.astral.sh/ruff/rules/#refurb-furb
+  "G010",    # https://docs.astral.sh/ruff/rules/#flake8-logging-format-g
+  "G101",    # https://docs.astral.sh/ruff/rules/#flake8-logging-format-g
+  "G201",    # https://docs.astral.sh/ruff/rules/#flake8-logging-format-g
+  "G202",    # https://docs.astral.sh/ruff/rules/#flake8-logging-format-g
+  "I",       # https://docs.astral.sh/ruff/rules/#isort-i
+  "ICN",     # https://docs.astral.sh/ruff/rules/#flake8-import-conventions-icn
+  "INP",     # https://docs.astral.sh/ruff/rules/#flake8-no-pep420-inp
+  "INT001",  # https://docs.astral.sh/ruff/rules/#flake8-gettext-int
+  "INT002",  # https://docs.astral.sh/ruff/rules/#flake8-gettext-int
+  "INT003",  # https://docs.astral.sh/ruff/rules/#flake8-gettext-int
+  "ISC",     # https://docs.astral.sh/ruff/rules/#flake8-implicit-str-concat-isc
+  "LOG001",  # https://docs.astral.sh/ruff/rules/#flake8-logging-log
+  "LOG002",  # https://docs.astral.sh/ruff/rules/#flake8-logging-log
+  "LOG009",  # https://docs.astral.sh/ruff/rules/#flake8-logging-log
+  "LOG014",  # https://docs.astral.sh/ruff/rules/#flake8-logging-log
+  "LOG015",  # https://docs.astral.sh/ruff/rules/#flake8-logging-log
+  "N999",    # https://docs.astral.sh/ruff/rules/#pep8-naming-n
+  "PERF101", # https://docs.astral.sh/ruff/rules/#perflint-perf
+  "PERF102", # https://docs.astral.sh/ruff/rules/#perflint-perf
+  "PERF402", # https://docs.astral.sh/ruff/rules/#perflint-perf
+  "PGH005",  # https://docs.astral.sh/ruff/rules/#pygrep-hooks-pgh
+  "PIE",     # https://docs.astral.sh/ruff/rules/#flake8-pie-pie
+  "PLC",     # https://docs.astral.sh/ruff/rules/#pylint-pl
+  "PLE",     # https://docs.astral.sh/ruff/rules/#pylint-pl
+  "PLR0124", # https://docs.astral.sh/ruff/rules/#pylint-pl
+  "PLR0133", # https://docs.astral.sh/ruff/rules/#pylint-pl
+  "PLR0206", # https://docs.astral.sh/ruff/rules/#pylint-pl
+  "PLR0402", # https://docs.astral.sh/ruff/rules/#pylint-pl
+  "PLR1704", # https://docs.astral.sh/ruff/rules/#pylint-pl
+  "PLR1708", # https://docs.astral.sh/ruff/rules/#pylint-pl
+  "PLR1711", # https://docs.astral.sh/ruff/rules/#pylint-pl
+  "PLR1716", # https://docs.astral.sh/ruff/rules/#pylint-pl
+  "PLR1722", # https://docs.astral.sh/ruff/rules/#pylint-pl
+  "PLR1730", # https://docs.astral.sh/ruff/rules/#pylint-pl
+  "PLR1733", # https://docs.astral.sh/ruff/rules/#pylint-pl
+  "PLR1736", # https://docs.astral.sh/ruff/rules/#pylint-pl
+  "PLR2044", # https://docs.astral.sh/ruff/rules/#pylint-pl
+  "PLW",     # https://docs.astral.sh/ruff/rules/#pylint-pl
+  "PT010",   # https://docs.astral.sh/ruff/rules/#flake8-pytest-style-pt
+  "PT014",   # https://docs.astral.sh/ruff/rules/#flake8-pytest-style-pt
+  "PT020",   # https://docs.astral.sh/ruff/rules/#flake8-pytest-style-pt
+  "PT025",   # https://docs.astral.sh/ruff/rules/#flake8-pytest-style-pt
+  "PT026",   # https://docs.astral.sh/ruff/rules/#flake8-pytest-style-pt
+  "PT031",   # https://docs.astral.sh/ruff/rules/#flake8-pytest-style-pt
+  "PTH",     # https://docs.astral.sh/ruff/rules/#flake8-use-pathlib-pth
+  "Q",       # https://docs.astral.sh/ruff/rules/#flake8-quotes-q
+  "RSE",     # https://docs.astral.sh/ruff/rules/#flake8-raise-rse
+  "RUF",     # https://docs.astral.sh/ruff/rules/#ruff-specific-rules-ruf
+  "S102",    # https://docs.astral.sh/ruff/rules/#flake8-bandit-s
+  "S110",    # https://docs.astral.sh/ruff/rules/#flake8-bandit-s
+  "S112",    # https://docs.astral.sh/ruff/rules/#flake8-bandit-s
+  "SIM",     # https://docs.astral.sh/ruff/rules/#flake8-simplify-sim
+  "T100",    # https://docs.astral.sh/ruff/rules/#flake8-debugger-t10
+  "T20",     # https://docs.astral.sh/ruff/rules/#flake8-print-t20
+  "TC",      # https://docs.astral.sh/ruff/rules/#flake8-type-checking-tc
+  "TID",     # https://docs.astral.sh/ruff/rules/#flake8-tidy-imports-tid
+  "TRY002",  # https://docs.astral.sh/ruff/rules/#tryceratops-try
+  "TRY004",  # https://docs.astral.sh/ruff/rules/#tryceratops-try
+  "TRY201",  # https://docs.astral.sh/ruff/rules/#tryceratops-try
+  "TRY203",  # https://docs.astral.sh/ruff/rules/#tryceratops-try
+  "TRY401",  # https://docs.astral.sh/ruff/rules/#tryceratops-try
+  "UP",      # https://docs.astral.sh/ruff/rules/#pyupgrade-up
+  "W",       # https://docs.astral.sh/ruff/rules/#pycodestyle-e-w
+  "YTT",     # https://docs.astral.sh/ruff/rules/#flake8-2020-ytt
 ]
 ignore = [
  "DJ001",
@@ -224,6 +305,7 @@ per-file-ignores."*/migrations/*.py" = [
 ]
 # Testing
 per-file-ignores."*/tests/*.py" = [
+  "DTZ",
  "E501",
  "SIM117",
 ]
@@ -296,11 +296,11 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">89</context>
+          <context context-type="linenumber">91</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">91</context>
+          <context context-type="linenumber">93</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/dashboard/dashboard.component.html</context>
@@ -323,11 +323,11 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">98</context>
+          <context context-type="linenumber">100</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">100</context>
+          <context context-type="linenumber">102</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/share-link-bundle-dialog/share-link-bundle-dialog.component.html</context>
@@ -374,16 +374,16 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">56</context>
-        </context-group>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">280</context>
+          <context context-type="linenumber">58</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
          <context context-type="linenumber">282</context>
        </context-group>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
+          <context context-type="linenumber">284</context>
+        </context-group>
      </trans-unit>
      <trans-unit id="5890330709052835856" datatype="html">
        <source>The dashboard can be used to show saved views, such as an &apos;Inbox&apos;. Views are found under Manage &gt; Saved Views once you have created some.</source>
@@ -727,11 +727,11 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">316</context>
+          <context context-type="linenumber">318</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">318</context>
+          <context context-type="linenumber">320</context>
        </context-group>
      </trans-unit>
      <trans-unit id="2272120016352772836" datatype="html">
@@ -1142,11 +1142,11 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">240</context>
+          <context context-type="linenumber">242</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">242</context>
+          <context context-type="linenumber">244</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/manage/saved-views/saved-views.component.html</context>
@@ -1723,7 +1723,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">211</context>
+          <context context-type="linenumber">213</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
@@ -1836,11 +1836,11 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">303</context>
+          <context context-type="linenumber">305</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">305</context>
+          <context context-type="linenumber">307</context>
        </context-group>
      </trans-unit>
      <trans-unit id="8492095365580052820" datatype="html">
@@ -2617,11 +2617,11 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">264</context>
+          <context context-type="linenumber">266</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">266</context>
+          <context context-type="linenumber">268</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3818027200170621545" datatype="html">
@@ -2978,11 +2978,11 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">294</context>
+          <context context-type="linenumber">296</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">296</context>
+          <context context-type="linenumber">298</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4569276013106377105" datatype="html">
@@ -3291,104 +3291,104 @@
        <source>by Paperless-ngx</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">23,24</context>
+          <context context-type="linenumber">24,25</context>
        </context-group>
      </trans-unit>
      <trans-unit id="7228136119811576789" datatype="html">
        <source>User menu</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">40</context>
+          <context context-type="linenumber">42</context>
        </context-group>
      </trans-unit>
      <trans-unit id="2448391510242468907" datatype="html">
        <source>Logged in as <x id="INTERPOLATION" equiv-text="{{this.settingsService.displayName}}"/></source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">48,49</context>
+          <context context-type="linenumber">50,51</context>
        </context-group>
      </trans-unit>
      <trans-unit id="2127032578120864096" datatype="html">
        <source>My Profile</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">52</context>
+          <context context-type="linenumber">54</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3797778920049399855" datatype="html">
        <source>Logout</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">59</context>
+          <context context-type="linenumber">61</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4895326106573044490" datatype="html">
        <source>Documentation</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">64</context>
+          <context context-type="linenumber">66</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">324,325</context>
+          <context context-type="linenumber">326,327</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">327</context>
+          <context context-type="linenumber">329</context>
        </context-group>
      </trans-unit>
      <trans-unit id="472206565520537964" datatype="html">
        <source>Saved views</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">108,109</context>
+          <context context-type="linenumber">110,111</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">138,139</context>
+          <context context-type="linenumber">140,141</context>
        </context-group>
      </trans-unit>
      <trans-unit id="6988090220128974198" datatype="html">
        <source>Open documents</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">147,148</context>
+          <context context-type="linenumber">149,150</context>
        </context-group>
      </trans-unit>
      <trans-unit id="5687256342387781369" datatype="html">
        <source>Close all</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">169</context>
+          <context context-type="linenumber">171</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">171</context>
+          <context context-type="linenumber">173</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3897348120591552265" datatype="html">
        <source>Manage</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">180,181</context>
+          <context context-type="linenumber">182,183</context>
        </context-group>
      </trans-unit>
      <trans-unit id="8008131619909556709" datatype="html">
        <source>Attributes</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">188</context>
+          <context context-type="linenumber">190</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">190</context>
+          <context context-type="linenumber">192</context>
        </context-group>
      </trans-unit>
      <trans-unit id="7437910965833684826" datatype="html">
        <source>Correspondents</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">216</context>
+          <context context-type="linenumber">218</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.html</context>
@@ -3407,7 +3407,7 @@
        <source>Document types</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">221</context>
+          <context context-type="linenumber">223</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/manage/document-attributes/document-attributes.component.ts</context>
@@ -3418,7 +3418,7 @@
        <source>Storage paths</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">226</context>
+          <context context-type="linenumber">228</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/manage/document-attributes/document-attributes.component.ts</context>
@@ -3429,7 +3429,7 @@
        <source>Custom fields</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">231</context>
+          <context context-type="linenumber">233</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/bulk-editor/bulk-editor.component.html</context>
@@ -3448,11 +3448,11 @@
        <source>Workflows</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">249</context>
+          <context context-type="linenumber">251</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">251</context>
+          <context context-type="linenumber">253</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/manage/workflows/workflows.component.html</context>
@@ -3463,78 +3463,78 @@
        <source>Mail</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">257</context>
+          <context context-type="linenumber">259</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">259</context>
+          <context context-type="linenumber">261</context>
        </context-group>
      </trans-unit>
      <trans-unit id="7844706011418789951" datatype="html">
        <source>Administration</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">274,275</context>
+          <context context-type="linenumber">276,277</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3008420115644088420" datatype="html">
        <source>Configuration</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">287</context>
+          <context context-type="linenumber">289</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">289</context>
+          <context context-type="linenumber">291</context>
        </context-group>
      </trans-unit>
      <trans-unit id="1534029177398918729" datatype="html">
        <source>GitHub</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">334</context>
+          <context context-type="linenumber">336</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4112664765954374539" datatype="html">
        <source>is available.</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">344</context>
+          <context context-type="linenumber">346</context>
        </context-group>
      </trans-unit>
      <trans-unit id="1175891574282637937" datatype="html">
        <source>Click to view.</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">344</context>
+          <context context-type="linenumber">346</context>
        </context-group>
      </trans-unit>
      <trans-unit id="9811291095862612" datatype="html">
        <source>Paperless-ngx can automatically check for updates</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">348</context>
+          <context context-type="linenumber">350</context>
        </context-group>
      </trans-unit>
      <trans-unit id="894819944961861800" datatype="html">
        <source> How does this work? </source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">356</context>
+          <context context-type="linenumber">358</context>
        </context-group>
      </trans-unit>
      <trans-unit id="509090351011426949" datatype="html">
        <source>Update available</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">368</context>
+          <context context-type="linenumber">370</context>
        </context-group>
      </trans-unit>
      <trans-unit id="1329827712962827905" datatype="html">
        <source>Configure update checking</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">373</context>
+          <context context-type="linenumber">375</context>
        </context-group>
      </trans-unit>
      <trans-unit id="1542489069631984294" datatype="html">
@@ -4639,7 +4639,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/input/select/select.component.html</context>
-          <context context-type="linenumber">53</context>
+          <context context-type="linenumber">58</context>
        </context-group>
      </trans-unit>
      <trans-unit id="5324147361912094446" datatype="html">
@@ -6488,7 +6488,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/input/select/select.component.html</context>
-          <context context-type="linenumber">71</context>
+          <context context-type="linenumber">76</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/input/tags/tags.component.html</context>
@@ -6614,6 +6614,13 @@
        </context-group>
        <note priority="1" from="description">Used for both types, correspondents, storage paths</note>
      </trans-unit>
+      <trans-unit id="6945988051184690124" datatype="html">
+        <source>Remove item</source>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/input/select/select.component.html</context>
+          <context context-type="linenumber">41</context>
+        </context-group>
+      </trans-unit>
      <trans-unit id="3686284950598311784" datatype="html">
        <source>Private</source>
        <context-group purpose="location">
@@ -1,6 +1,6 @@
 {
  "name": "paperless-ngx-ui",
-  "version": "3.0.5",
+  "version": "3.1.0",
  "scripts": {
    "preinstall": "npx only-allow pnpm",
    "ng": "ng",
@@ -6,7 +6,7 @@
    infoLink="configuration">
 </pngx-page-header>

-<form [formGroup]="configForm" (ngSubmit)="saveConfig()" class="pb-4">
+<form [formGroup]="configForm" (ngSubmit)="saveConfig()" class="pb-4" autocomplete="off">

    <ul ngbNav #nav="ngbNav" class="nav-tabs">
        @for (category of optionCategories; track category) {
@@ -44,7 +44,7 @@
                                                        @case (ConfigOptionType.String) { <pngx-input-text [formControlName]="option.key" [error]="errors[option.key]"></pngx-input-text> }
                                                        @case (ConfigOptionType.JSON) { <pngx-input-text [formControlName]="option.key" [error]="errors[option.key]"></pngx-input-text> }
                                                        @case (ConfigOptionType.File) { <pngx-input-file [formControlName]="option.key" (upload)="uploadFile($event, option.key)" [error]="errors[option.key]"></pngx-input-file> }
-                                                        @case (ConfigOptionType.Password) { <pngx-input-password [formControlName]="option.key" [error]="errors[option.key]"></pngx-input-password> }
+                                                        @case (ConfigOptionType.Password) { <pngx-input-password [formControlName]="option.key" [error]="errors[option.key]" autocomplete="new-password"></pngx-input-password> }
                                                    }
                                                </div>
                                                @if (option.note) {
@@ -4,27 +4,29 @@
    (click)="closeMobileSearch(); toggleMenuCollapsed()">
    <i-bs width="1.5em" height="1.5em" name="list"></i-bs>
  </button>
-  <a class="navbar-brand d-flex align-items-center me-0 ps-md-3 py-0 order-sm-0"
+  <div class="navbar-brand-container order-sm-0">
+    <a class="navbar-brand d-flex align-items-center me-0 ps-md-3 py-0"
    [ngClass]="{ 'slim': slimSidebarEnabled, '' : !slimSidebarEnabled }"
    routerLink="/dashboard"
    tourAnchor="tour.intro">
-    @if (!hasCustomBranding) {
-      <pngx-logo extra_classes="navbar-official-logo px-1" height="2.4rem"></pngx-logo>
-      <pngx-brand-mark class="brand-mark brand-mark-slim d-none"></pngx-brand-mark>
-    } @else {
-      @if (customAppLogo) {
-        <img class="brand-logo" [src]="customAppLogo" alt="" />
+      @if (!hasCustomBranding) {
+        <pngx-logo extra_classes="navbar-official-logo px-1" height="2.4rem"></pngx-logo>
+        <pngx-brand-mark class="brand-mark brand-mark-slim d-none"></pngx-brand-mark>
      } @else {
-        <pngx-brand-mark class="brand-mark"></pngx-brand-mark>
-      }
-      <div class="brand-copy ms-2 text-truncate" [class.d-md-none]="slimSidebarEnabled">
-        <span class="brand-title text-truncate">{{ appTitle }}</span>
-        @if (customAppTitle) {
-          <span class="byline text-uppercase font-monospace" i18n>by Paperless-ngx</span>
+        @if (customAppLogo) {
+          <img class="brand-logo" [src]="customAppLogo" alt="" />
+        } @else {
+          <pngx-brand-mark class="brand-mark"></pngx-brand-mark>
        }
-      </div>
-    }
-  </a>
+        <div class="brand-copy ms-2 text-truncate" [class.d-md-none]="slimSidebarEnabled">
+          <span class="brand-title text-truncate">{{ appTitle }}</span>
+          @if (customAppTitle) {
+            <span class="byline text-uppercase font-monospace" i18n>by Paperless-ngx</span>
+          }
+        </div>
+      }
+    </a>
+  </div>
  <div class="search-container flex-grow-1 py-2 pb-3 pb-sm-2 me-sm-auto order-3 order-sm-1"
    [class.mobile-hidden]="mobileSearchHidden()">
    <div class="col-12 header-search mx-auto">
@@ -37,7 +39,7 @@
    }
    <pngx-toasts-dropdown></pngx-toasts-dropdown>
    <li ngbDropdown class="nav-item dropdown">
-      <button class="btn navbar-action border-0" id="userDropdown" ngbDropdownToggle aria-label="User menu" i18n-aria-label>
+      <button class="btn navbar-action border-0 me-1 me-md-2" id="userDropdown" ngbDropdownToggle aria-label="User menu" i18n-aria-label>
        <i-bs width="1.3em" height="1.3em" name="person-circle"></i-bs>
        <span class="small ms-2 d-none d-sm-inline">
          {{this.settingsService.displayName}}
@@ -362,6 +362,7 @@ main {
  }

  ::ng-deep .navbar-official-logo {
+    will-change: filter; // Safari repaints the whole navbar on filter change without this
    filter: drop-shadow(0 1px 2px rgba(var(--pngx-navbar-brand-shadow-rgb), .3));
    transition: filter .15s ease-in-out;

@@ -436,6 +437,19 @@ main {
  padding-right: .5rem;
 }

+// true center the search with equal flex widths
+@media (min-width: 768px) {
+  .navbar-brand-container,
+  .navbar > ul {
+    display: flex; // so the brand link stays as wide as its contents
+    flex: 1 1 0;
+  }
+
+  .navbar > ul {
+    justify-content: flex-end;
+  }
+}
+
 :host ::ng-deep .navbar-action {
  display: inline-flex;
  align-items: center;
@@ -476,6 +490,7 @@ main {
    text-align: left;
  }

+  .navbar-brand-container,
  .navbar-brand {
    grid-area: brand;
    min-width: 0;
@@ -40,6 +40,10 @@ describe('PasswordComponent', () => {
    // expect(component.value).toEqual('foo')
  })

+  it('should not offer itself to browser autofill by default', () => {
+    expect(input.getAttribute('autocomplete')).toEqual('off')
+  })
+
  it('should support toggling field visibility', () => {
    expect(input.type).toEqual('password')
    component.showReveal = true
@@ -25,7 +25,7 @@ export class PasswordComponent extends AbstractInputComponent<string> {
  showReveal: boolean = false

  @Input()
-  autocomplete: string
+  autocomplete: string = 'off'

  public textVisible: boolean = false

@@ -36,11 +36,16 @@
          (focus)="clearLastSearchTerm()"
          (clear)="clearLastSearchTerm()"
          (blur)="onBlur()">
-          <ng-template ng-label-tmp let-item="item">
-            @if (iconField && item[iconField]) {
-              <i-bs class="me-2" [name]="item[iconField]"></i-bs>
+          <ng-template ng-label-tmp let-item="item" let-clear="clear">
+            @if (multiple && !disabled) {
+              <span class="ng-value-icon left" role="button" tabindex="0" (click)="clear(item)" (keydown.enter)="clear(item)" aria-label="Remove item" i18n-aria-label>×</span>
            }
-            <span [title]="item[bindLabel]">{{item[bindLabel]}}</span>
+            <span class="ng-value-label" [title]="item[bindLabel]">
+              @if (iconField && item[iconField]) {
+                <i-bs class="me-2" [name]="item[iconField]"></i-bs>
+              }
+              {{item[bindLabel]}}
+            </span>
          </ng-template>
          <ng-template ng-option-tmp let-item="item">
              @if (iconField && item[iconField]) {
@@ -24,6 +24,12 @@ describe('TextComponent', () => {
    input = component.inputField.nativeElement
  })

+  it('should not offer itself to browser autofill by default', () => {
+    expect(
+      component.inputField.nativeElement.getAttribute('autocomplete')
+    ).toEqual('off')
+  })
+
  it('should support use of input field', () => {
    expect(component.value).toBeUndefined()
    input.value = 'foo'
@@ -28,7 +28,7 @@ import { AbstractInputComponent } from '../abstract-input'
 })
 export class TextComponent extends AbstractInputComponent<string> {
  @Input()
-  autocomplete: string
+  autocomplete: string = 'off'

  @Input()
  placeholder: string = ''
@@ -15,6 +15,35 @@ describe('text search utilities', () => {
    expect(matchesSearchText('taxes 2026', 'tax receipt')).toBeFalsy()
  })

+  it('does not let two terms match the same word', () => {
+    expect(matchesSearchText('Another Tag', 'another tag th')).toBeFalsy()
+    expect(matchesSearchText('Another Tag', 'another tag ag')).toBeFalsy()
+    expect(matchesSearchText('Another Tag', 'another tag e')).toBeFalsy()
+    expect(matchesSearchText('Another Tag', 'another tag')).toBeTruthy()
+    expect(matchesSearchText('Another Tag', 'tag another')).toBeTruthy()
+  })
+
+  it('matches a single term anywhere in the value', () => {
+    expect(matchesSearchText('Another Tag', 'anoth')).toBeTruthy()
+    expect(matchesSearchText('Another Tag', 'th')).toBeTruthy()
+  })
+
+  it('treats punctuation as a separator on both sides', () => {
+    expect(matchesSearchText('medical-history', 'medical history')).toBeTruthy()
+    expect(matchesSearchText('medical history', 'medical-history')).toBeTruthy()
+    expect(matchesSearchText('medical-history', 'medical dental')).toBeFalsy()
+  })
+
+  it('matches longer terms first so they cannot be starved', () => {
+    expect(matchesSearchText('tagger tag', 'tag tagger')).toBeTruthy()
+  })
+
+  it('handles a query with no usable terms', () => {
+    expect(matchesSearchText('Another Tag', '')).toBeTruthy()
+    // Still filters, so the dropdown can offer to create a tag named "---"
+    expect(matchesSearchText('Another Tag', '---')).toBeFalsy()
+  })
+
  it('matches a large set of tag names without blocking input', () => {
    const tagNames = Array.from(
      { length: 1280 },
@@ -3,13 +3,18 @@ import { diacritics } from 'normalize-diacritics/diacritics'
 export type SearchTextValue =
  string | number | boolean | bigint | null | undefined

+const NON_ASCII = /[^\x00-\x7F]/
+const SEPARATORS = /[^\p{L}\p{N}]+/u
+
 export function normalizeSearchText(value: SearchTextValue): string {
-  const normalized = diacritics.reduce(
-    (text, replacement) => {
-      return text.replace(replacement.diacritics, replacement.letter)
-    },
-    String(value ?? '')
-  )
+  const text = String(value ?? '')
+
+  // Nothing in the table matches ASCII, so skip normaliation
+  if (!NON_ASCII.test(text)) return text.toLocaleLowerCase()
+
+  const normalized = diacritics.reduce((text, replacement) => {
+    return text.replace(replacement.diacritics, replacement.letter)
+  }, text)

  return normalized.toLocaleLowerCase()
 }
@@ -18,8 +23,28 @@ export function matchesSearchText(
  value: SearchTextValue,
  searchText: SearchTextValue
 ): boolean {
-  const normalizedValue = normalizeSearchText(value)
-  const searchTerms = normalizeSearchText(searchText).trim().split(/\s+/)
+  const query = normalizeSearchText(searchText)
+  const terms = query.split(SEPARATORS).filter(Boolean)

-  return searchTerms.every((term) => normalizedValue.includes(term))
+  // Empty or punctuation-only query, nothing to split into terms
+  if (terms.length === 0) {
+    return normalizeSearchText(value).includes(query.trim())
+  }
+
+  const words = normalizeSearchText(value).split(SEPARATORS).filter(Boolean)
+  const claimed = new Array<boolean>(words.length).fill(false)
+
+  // Each term takes a word of its own, longest first, so that "another tag th"
+  // doesn't match "Another Tag" by finding the "th" inside "another"
+  return terms
+    .sort((a, b) => b.length - a.length)
+    .every((term) => {
+      for (let i = 0; i < words.length; i++) {
+        if (!claimed[i] && words[i].includes(term)) {
+          claimed[i] = true
+          return true
+        }
+      }
+      return false
+    })
 }
@@ -8,7 +8,7 @@ export const environment = {
  apiVersion: '10', // match src/paperless/settings.py
  appTitle: DEFAULT_APP_TITLE,
  tag: 'prod',
-  version: '3.0.5',
+  version: '3.1.0',
  webSocketHost: window.location.host,
  webSocketProtocol: window.location.protocol == 'https:' ? 'wss:' : 'ws:',
  webSocketBaseUrl: base_url.pathname + 'ws/',
@@ -507,8 +507,8 @@ def rotate(
            logger.info(
                f"Queued new rotated version for document {pair.root_doc.id} by {degrees} degrees",
            )
-        except Exception as e:
-            logger.exception(f"Error rotating document {pair.root_doc.id}: {e}")
+        except Exception:
+            logger.exception(f"Error rotating document {pair.root_doc.id}")

    return "OK"

@@ -554,9 +554,9 @@ def merge(
            affected_docs.append(doc.id)
            if handoff_asn is None and doc.archive_serial_number is not None:
                handoff_asn = doc.archive_serial_number
-        except Exception as e:
+        except Exception:
            logger.exception(
-                f"Error merging document {doc.id}, it will not be included in the merge: {e}",
+                f"Error merging document {doc.id}, it will not be included in the merge",
            )
    if len(affected_docs) == 0:
        logger.warning("No documents were merged")
@@ -805,8 +805,8 @@ def split(
            else:
                group(consume_tasks).delay()

-    except Exception as e:
-        logger.exception(f"Error splitting document {doc.id}: {e}")
+    except Exception:
+        logger.exception(f"Error splitting document {doc.id}")

    return "OK"

@@ -858,8 +858,8 @@ def delete_pages(
        logger.info(
            f"Queued new version for document {pair.root_doc.id} after deleting pages {pages}",
        )
-    except Exception as e:
-        logger.exception(f"Error deleting pages from document {pair.root_doc.id}: {e}")
+    except Exception:
+        logger.exception(f"Error deleting pages from document {pair.root_doc.id}")

    return "OK"

@@ -986,7 +986,7 @@ def edit_pdf(
                group(consume_tasks).delay()

    except Exception as e:
-        logger.exception(f"Error editing document {pair.root_doc.id}: {e}")
+        logger.exception(f"Error editing document {pair.root_doc.id}")
        raise ValueError(
            f"An error occurred while editing the document: {e}",
        ) from e
@@ -1097,7 +1097,7 @@ def remove_password(

        except Exception as e:
            logger.exception(
-                f"Error removing password from document {pair.root_doc.id}: {e}",
+                f"Error removing password from document {pair.root_doc.id}",
            )
            raise ValueError(
                f"An error occurred while removing the password: {e}",
@@ -69,8 +69,8 @@ def load_classifier(*, raise_exception: bool = False) -> DocumentClassifier | No
        Path(settings.MODEL_FILE).unlink()
        classifier = None
        if raise_exception:
-            raise e
-    except ClassifierModelCorruptError as e:
+            raise
+    except ClassifierModelCorruptError:
        # there's something wrong with the model file.
        logger.exception(
            "Unrecoverable error while loading document "
@@ -79,17 +79,17 @@ def load_classifier(*, raise_exception: bool = False) -> DocumentClassifier | No
        Path(settings.MODEL_FILE).unlink()
        classifier = None
        if raise_exception:
-            raise e
-    except OSError as e:
+            raise
+    except OSError:
        logger.exception("IO error while loading document classification model")
        classifier = None
        if raise_exception:
-            raise e
-    except Exception as e:  # pragma: no cover
+            raise
+    except Exception:  # pragma: no cover
        logger.exception("Unknown error while loading document classification model")
        classifier = None
        if raise_exception:
-            raise e
+            raise

    return classifier

@@ -216,7 +216,7 @@ class ConsumerPluginMixin:
            current_progress,
            max_progress,
            document_id=document_id,
-            owner_id=self.metadata.owner_id if self.metadata.owner_id else None,
+            owner_id=self.metadata.owner_id or None,
            users_can_view=(self.metadata.view_users or [])
            + (self.metadata.change_users or []),
            groups_can_view=(self.metadata.view_groups or [])
@@ -674,9 +674,7 @@ class ConsumerPlugin(
                            document=document,
                            logging_group=self.logging_group,
                            classifier=classifier,
-                            original_file=self.unmodified_original
-                            if self.unmodified_original
-                            else self.working_copy,
+                            original_file=self.unmodified_original or self.working_copy,
                        )

                        # After everything is in the database, copy the files into
@@ -849,7 +847,7 @@ class ConsumerPlugin(
        else:
            stats = Path(self.input_doc.original_file).stat()
            create_date = timezone.make_aware(
-                datetime.datetime.fromtimestamp(stats.st_mtime),
+                datetime.datetime.fromtimestamp(stats.st_mtime),  # noqa: DTZ006 - make_aware() requires a naive datetime
            )
            self.log.debug(f"Creation date from st_mtime: {create_date}")

@@ -963,7 +961,7 @@ class ConsumerPlugin(
        try:
            copy_basic_file_stats(source, target)
        except Exception:  # pragma: no cover
-            pass
+            self.log.debug("Unable to copy file stats from %s to %s", source, target)


 class ConsumerPreflightPlugin(
@@ -78,7 +78,9 @@ class CollatePlugin(NoCleanupPluginMixin, NoSetupPluginMixin, ConsumeTaskPlugin)
            stats = staging.stat()
            # if the file is older than the timeout, we don't consider
            # it valid
-            if (dt.datetime.now().timestamp() - stats.st_mtime) > TIMEOUT_SECONDS:
+            if (
+                dt.datetime.now(tz=dt.UTC).timestamp() - stats.st_mtime
+            ) > TIMEOUT_SECONDS:
                logger.warning("Outdated double sided staging file exists, deleting it")
                staging.unlink()
            else:
@@ -134,7 +136,7 @@ class CollatePlugin(NoCleanupPluginMixin, NoSetupPluginMixin, ConsumeTaskPlugin)
            shutil.move(pdf_file, staging)
            # update access to modification time so we know if the file
            # is outdated when another file gets uploaded
-            timestamp = dt.datetime.now().timestamp()
+            timestamp = dt.datetime.now(tz=dt.UTC).timestamp()
            os.utime(staging, (timestamp, timestamp))
            logger.info(
                "Got scan with odd numbered pages of double-sided scan, moved it to %s",
@@ -734,7 +734,7 @@ class CustomFieldQueryParser:
        )

        # Check if any of the requested IDs are missing.
-        missing_ids = set(value) - set(link.document_id for link in links)
+        missing_ids = set(value) - {link.document_id for link in links}
        if missing_ids:
            # The result should be an empty set in this case.
            return Q(id__in=[])
@@ -631,23 +631,25 @@ class Command(BaseCommand):
                ):
                    # Process each change
                    for change_type, path in changes:
-                        path = Path(path).resolve()
+                        resolved_path = Path(path).resolve()
                        if change_type == Change.deleted:
                            # Consumed (or otherwise removed); a later file
                            # reusing this name must not be skipped as
                            # already-queued.
-                            queued.discard(path)
-                        if not path.is_file():
+                            queued.discard(resolved_path)
+                        if not resolved_path.is_file():
                            continue
-                        if path in queued:
+                        if resolved_path in queued:
                            # Already queued and awaiting consumption; a stray
                            # event (NAS metadata touch, AV scan, etc.) while
                            # the file sits on disk mid-consumption must not
                            # cause it to be queued a second time (GH #13511).
-                            logger.debug(f"Ignoring event for queued file: {path}")
+                            logger.debug(
+                                f"Ignoring event for queued file: {resolved_path}",
+                            )
                            continue
-                        logger.debug(f"Event: {change_type.name} for {path}")
-                        tracker.track(path, change_type)
+                        logger.debug(f"Event: {change_type.name} for {resolved_path}")
+                        tracker.track(resolved_path, change_type)

                    # Check for stable files
                    for stable_path in tracker.get_stable_files():
@@ -30,6 +30,10 @@ if TYPE_CHECKING:
 logger = logging.getLogger("paperless.matching")


+class UnsupportedWorkflowTriggerTypeError(Exception):
+    pass
+
+
 def log_reason(
    matching_model: MatchingModel | WorkflowTrigger,
    document: Document,
@@ -691,7 +695,9 @@ def document_matches_workflow(
                )
            else:
                # New trigger types need to be explicitly checked above
-                raise Exception(f"Trigger type {trigger_type} not yet supported")
+                raise UnsupportedWorkflowTriggerTypeError(
+                    f"Trigger type {trigger_type} not yet supported",
+                )

            if trigger_matched:
                logger.info(f"Document matched {trigger} from {workflow}")
@@ -377,7 +377,7 @@ class Document(SoftDeleteModel, ModelWithOwner):  # type: ignore[django-manager-
        from documents.versioning import versions_newest_first

        if hasattr(self, "effective_content"):
-            return getattr(self, "effective_content")
+            return self.effective_content

        if self.root_document_id is not None or self.pk is None:
            return self.content
@@ -41,7 +41,7 @@ def get_default_file_extension(mime_type: str) -> str:
            return supported[mime_type]

    ext = mimetypes.guess_extension(mime_type)
-    return ext if ext else ""
+    return ext or ""


 def is_file_ext_supported(ext: str) -> bool:
@@ -43,8 +43,8 @@ def _discover_parser_class() -> type[DateParserPluginBase]:
                valid_plugins.append(ep)
            else:
                logger.warning(f"Plugin {ep.name} does not subclass DateParser.")
-        except Exception as e:
-            logger.exception(f"Unable to load date parser plugin {ep.name}: {e}")
+        except Exception:
+            logger.exception(f"Unable to load date parser plugin {ep.name}")

    if not valid_plugins:
        return RegexDateParserPlugin
@@ -91,8 +91,8 @@ class DateParserPluginBase(ABC):
                },
                locales=self.config.languages,
            )
-        except Exception as e:
-            logger.exception(f"Error while parsing date string '{date_string}': {e}")
+        except Exception:
+            logger.exception(f"Error while parsing date string '{date_string}'")
            return None

    def _filter_date(
@@ -59,11 +59,10 @@ def safe_regex_match(pattern: str, text: str, *, flags: int = 0):
    try:
        validate_regex_pattern(pattern)
        compiled = regex.compile(pattern, flags=flags)
-    except (regex.error, ValueError) as exc:
+    except (regex.error, ValueError):
        logger.exception(
-            "Error while processing regular expression %s: %s",
+            "Error while processing regular expression %s",
            textwrap.shorten(pattern, width=80, placeholder="…"),
-            exc,
        )
        return None

@@ -86,11 +85,10 @@ def safe_regex_sub(pattern: str, repl: str, text: str, *, flags: int = 0) -> str
    try:
        validate_regex_pattern(pattern)
        compiled = regex.compile(pattern, flags=flags)
-    except (regex.error, ValueError) as exc:
+    except (regex.error, ValueError):
        logger.exception(
-            "Error while processing regular expression %s: %s",
+            "Error while processing regular expression %s",
            textwrap.shorten(pattern, width=80, placeholder="…"),
-            exc,
        )
        return None

@@ -1142,7 +1142,7 @@ def get_backend() -> TantivyBackend:
    Returns:
        Thread-safe singleton TantivyBackend instance
    """
-    global _backend, _backend_path
+    global _backend, _backend_path  # noqa: PLW0603 - module-level singleton, no class to hold this state

    current_path: Path = settings.INDEX_DIR

@@ -1173,7 +1173,7 @@ def reset_backend() -> None:
    Forces creation of a new backend instance on the next get_backend() call.
    Used for test isolation and when switching between different index directories.
    """
-    global _backend, _backend_path
+    global _backend, _backend_path  # noqa: PLW0603 - module-level singleton, no class to hold this state

    with _backend_lock:
        if _backend is not None:
@@ -240,7 +240,7 @@ def parse_user_query(
            DEFAULT_SEARCH_FIELDS,
            field_boosts=_FIELD_BOOSTS,
            # (prefix=True, distance=1, transposition_cost_one=True) — edit-distance fuzziness
-            fuzzy_fields={f: (True, 1, True) for f in DEFAULT_SEARCH_FIELDS},
+            fuzzy_fields=dict.fromkeys(DEFAULT_SEARCH_FIELDS, (True, 1, True)),
        )
        # 0.1 boost keeps fuzzy hits ranked below exact matches (intentional)
        clauses.append((tantivy.Occur.Should, tantivy.Query.boost_query(fuzzy, 0.1)))
@@ -433,7 +433,7 @@ class OwnedObjectSerializer(
            return set()

        ctype = ContentType.objects.get_for_model(first_obj)
-        object_pks = list(obj.pk for obj in objects)
+        object_pks = [obj.pk for obj in objects]
        pk_type = type(first_obj.pk)

        def get_pks_for_permission_type(model):
@@ -727,7 +727,7 @@ class TagSerializer(MatchingModelSerializer, OwnedObjectSerializer):
                self.instance.clean()
            except ValidationError as e:
                logger.debug("Tag parent validation failed: %s", e)
-                raise e
+                raise
            finally:
                self.instance.tn_parent = original_parent
        else:
@@ -737,7 +737,7 @@ class TagSerializer(MatchingModelSerializer, OwnedObjectSerializer):
                temp.clean()
            except ValidationError as e:
                logger.debug("Tag parent validation failed: %s", e)
-                raise e
+                raise

        return super().validate(attrs)

@@ -1147,7 +1147,7 @@ class DocumentSerializer(
    def to_representation(self, instance):
        doc = super().to_representation(instance)
        if "content" in self.fields and hasattr(instance, "effective_content"):
-            doc["content"] = getattr(instance, "effective_content") or ""
+            doc["content"] = instance.effective_content or ""
        if self.truncate_content and "content" in self.fields:
            doc["content"] = doc.get("content")[0:550]
        return doc
@@ -1857,8 +1857,8 @@ class BulkEditSerializer(
        if isinstance(custom_fields, dict):
            try:
                ids = [int(i[0]) for i in custom_fields.items()]
-            except Exception as e:
-                logger.exception(f"Error validating custom fields: {e}")
+            except Exception:
+                logger.exception("Error validating custom fields")
                raise serializers.ValidationError(
                    f"{name} must be a list of integers or a dict of id:value pairs, see the log for details",
                )
@@ -2056,13 +2056,12 @@ class BulkEditSerializer(
            for doc in docs:
                if "-" in doc:
                    pages.append(
-                        [
-                            x
-                            for x in range(
+                        list(
+                            range(
                                int(doc.split("-")[0]),
                                int(doc.split("-")[1]) + 1,
-                            )
-                        ],
+                            ),
+                        ),
                    )
                else:
                    pages.append([int(doc)])
@@ -2923,7 +2922,7 @@ class ShareLinkBundleSerializer(OwnedObjectSerializer):
        return share_link_bundle

    def get_document_count(self, obj: ShareLinkBundle) -> int:
-        return getattr(obj, "document_total") or obj.documents.count()
+        return obj.document_total or obj.documents.count()


 class BulkEditObjectsSerializer(SerializerWithPerms, SetPermissionsMixin):
@@ -636,7 +636,7 @@ def update_filename_and_move_files(
                #  so this is not the end of the world.
                # B: if moving the original file failed, nothing has changed
                #  anyway.
-                pass
+                logger.exception("Error reverting document changes")

            # restore old values on the instance
            instance.filename = old_filename
@@ -1101,10 +1101,11 @@ def _extract_input_data(
                if v is None or k.startswith("_"):
                    continue
                if isinstance(v, datetime.date):
-                    v = v.isoformat()
+                    override_dict[k] = v.isoformat()
                elif isinstance(v, Path):
-                    v = str(v)
-                override_dict[k] = v
+                    override_dict[k] = str(v)
+                else:
+                    override_dict[k] = v
            if override_dict:
                data["overrides"] = override_dict
        return data
@@ -217,9 +217,9 @@ def consume_file(
                overrides.filename or input_doc.original_file.name,
                self.request.id,
            ) as status_mgr,
-            TemporaryDirectory(dir=settings.SCRATCH_DIR) as tmp_dir,
+            TemporaryDirectory(dir=settings.SCRATCH_DIR) as tmp_dir_name,
        ):
-            tmp_dir = Path(tmp_dir)
+            tmp_dir = Path(tmp_dir_name)
            msg = None
            for plugin_class in plugins:
                plugin_name = plugin_class.NAME
@@ -261,7 +261,7 @@ def consume_file(
                    )

                except Exception as e:
-                    logger.exception(f"{plugin_name} failed: {e}")
+                    logger.exception(f"{plugin_name} failed")
                    status_mgr.send_progress(
                        ProgressStatusOptions.FAILED,
                        f"{e}",
@@ -495,8 +495,8 @@ def empty_trash(doc_ids=None) -> None:
                content_type=ContentType.objects.get_for_model(Document),
                object_id__in=deleted_document_ids,
            ).delete()
-    except Exception as e:  # pragma: no cover
-        logger.exception(f"Error while emptying trash: {e}")
+    except Exception:  # pragma: no cover
+        logger.exception("Error while emptying trash")
    finally:
        models.signals.post_delete.disconnect(
            cleanup_document_deletion,
@@ -832,9 +832,8 @@ def build_share_link_bundle(bundle_id: int) -> None:
        logger.info("Built share link bundle %s", bundle.pk)
    except Exception as exc:
        logger.exception(
-            "Failed to build share link bundle %s: %s",
+            "Failed to build share link bundle %s",
            bundle_id,
-            exc,
        )
        bundle.status = ShareLinkBundle.Status.FAILED
        bundle.last_error = {
@@ -78,6 +78,10 @@ class PlaceholderString(str):
    def __ne__(self, other) -> bool:
        return not self.__eq__(other)

+    def __hash__(self) -> int:
+        # Equal to both "-none-" and "none", so hash to a single canonical value
+        return hash("-none-")
+

 NO_VALUE_PLACEHOLDER = PlaceholderString("-none-")

@@ -138,9 +138,9 @@ def parse_w_workflow_placeholders(

        # We're good!
        return rendered_template
-    except UndefinedError as e:
+    except UndefinedError:
        # The undefined class logs this already for us
-        raise e
+        raise
    except TemplateSyntaxError as e:
        logger.warning(f"Template syntax error in title generation: {e}")
    except SecurityError as e:
@@ -150,5 +150,5 @@ def parse_w_workflow_placeholders(
        logger.warning(
            f"Invalid title format '{text}', workflow not applied: {e}",
        )
-        raise e
+        raise
    return None
@@ -296,7 +296,7 @@ class TestRegexDateParser:

            # simulate parse failure for malformed input
            if "99/99/9999" in date_string or "bad date" in date_string:
-                raise Exception("parse failed for malformed date")
+                raise Exception("parse failed for malformed date")  # noqa: TRY002 - simulates a generic parser failure

            return None

@@ -57,13 +57,13 @@ class MultiprocessCommand(PaperlessCommand):

    def handle(self, *args, **options):
        items = list(range(5))
-        results = []
-        for result in self.process_parallel(
-            _double_value,
-            items,
-            description="Processing...",
-        ):
-            results.append(result)
+        results = list(
+            self.process_parallel(
+                _double_value,
+                items,
+                description="Processing...",
+            ),
+        )
        successes = sum(1 for r in results if r.success)
        self.stdout.write(f"Successes: {successes}")

@@ -66,7 +66,7 @@ class TestWriteBatchLockRetry:
        )
        mock_sleep = mocker.patch(
            "documents.search._backend.time.sleep",
-            side_effect=lambda s: sleep_values.append(s),
+            side_effect=sleep_values.append,
        )

        # Should not raise — 4th attempt succeeds
@@ -111,7 +111,7 @@ class TestWriteBatchLockRetry:
        sleep_values: list[float] = []
        mocker.patch(
            "documents.search._backend.time.sleep",
-            side_effect=lambda s: sleep_values.append(s),
+            side_effect=sleep_values.append,
        )
        for _ in range(50):
            sleep_values.clear()
@@ -1003,8 +1003,8 @@ class TestBulkEditAPI(DirectoriesMixin, APITestCase):
            for correspondent in response.data[field]:
                self.assertEqual(correspondent["document_count"], 0)
            self.assertCountEqual(
-                map(lambda c: c["id"], response.data[field]),
-                map(lambda c: c["id"], Entity.objects.values("id")),
+                (c["id"] for c in response.data[field]),
+                (c["id"] for c in Entity.objects.values("id")),
            )

    def test_api_selection_data(self) -> None:
@@ -18,8 +18,8 @@ class MockOpenIDProvider:

    def get_brands(self):
        default_servers = [
-            dict(id="yahoo", name="Yahoo", openid_url="http://me.yahoo.com"),
-            dict(id="hyves", name="Hyves", openid_url="http://hyves.nl"),
+            {"id": "yahoo", "name": "Yahoo", "openid_url": "http://me.yahoo.com"},
+            {"id": "hyves", "name": "Hyves", "openid_url": "http://hyves.nl"},
        ]
        return default_servers

@@ -205,12 +205,12 @@ class TestBarcode(
            - Barcode is detected on page 1 (zero indexed)
        """

-        for test_file in [
+        for test_filename in [
            "patch-code-t-middle-reverse.pdf",
            "patch-code-t-middle-distorted.pdf",
            "patch-code-t-middle-fuzzy.pdf",
        ]:
-            test_file = self.BARCODE_SAMPLE_DIR / test_file
+            test_file = self.BARCODE_SAMPLE_DIR / test_filename

            with self.get_reader(test_file) as reader:
                reader.detect()
@@ -777,7 +777,7 @@ class TestPDFActions(DirectoriesMixin, TestCase):
        sig.set.return_value.apply_async.side_effect = Exception("boom")
        mock_consume_file.return_value = sig

-        with self.assertRaises(Exception):
+        with self.assertRaises(Exception):  # noqa: B017 - mock injects a bare Exception
            bulk_edit.merge(doc_ids, delete_originals=True)

        self.doc1.refresh_from_db()
@@ -1318,7 +1318,7 @@ class TestPDFActions(DirectoriesMixin, TestCase):
        sig.apply_async.side_effect = Exception("boom")
        mock_chord.return_value = sig

-        with self.assertRaises(Exception):
+        with self.assertRaises(Exception):  # noqa: B017 - mock injects a bare Exception
            bulk_edit.edit_pdf(doc_ids, operations, delete_original=True)

        self.doc2.refresh_from_db()
@@ -1430,7 +1430,7 @@ class TestPDFActions(DirectoriesMixin, TestCase):
            {"page": 9999},  # invalid page, forces error during PDF load
        ]
        with self.assertLogs("paperless.bulk_edit", level="ERROR"):
-            with self.assertRaises(Exception):
+            with self.assertRaises(ValueError):
                bulk_edit.edit_pdf(doc_ids, operations)
        mock_group.assert_not_called()
        mock_consume_file.assert_not_called()
@@ -783,7 +783,7 @@ class TestClassifier(DirectoriesMixin, TestCase):

        Path(settings.MODEL_FILE).touch()
        mock_load.side_effect = Exception()
-        with self.assertRaises(Exception):
+        with self.assertRaises(Exception):  # noqa: B017 - mock injects a bare Exception
            load_classifier(raise_exception=True)


@@ -137,7 +137,7 @@ class FaultyParser(_BaseNewStyleParser):

 class FaultyGenericExceptionParser(_BaseNewStyleParser):
    def parse(self, document_path, mime_type, *, produce_archive: bool = True) -> None:
-        raise Exception("Generic exception.")
+        raise Exception("Generic exception.")  # noqa: TRY002 - deliberately not a ParseError


 def fake_magic_from_file(file, *, mime=False):  # NOSONAR
@@ -1333,7 +1333,7 @@ class PreConsumeTestCase(DirectoriesMixin, GetConsumerMixin, TestCase):
            script_calls = [
                call
                for call in m.call_args_list
-                if call.args and call.args[0] and call.args[0][0] not in ("pdftotext",)
+                if call.args and call.args[0] and call.args[0][0] != "pdftotext"
            ]
            self.assertEqual(script_calls, [])

@@ -44,6 +44,7 @@ from documents import tasks
 from documents.data_models import ConsumableDocument
 from documents.data_models import DocumentMetadataOverrides
 from documents.data_models import DocumentSource
+from documents.matching import UnsupportedWorkflowTriggerTypeError
 from documents.matching import document_matches_workflow
 from documents.matching import existing_document_matches_workflow
 from documents.matching import prefilter_documents_by_workflowtrigger
@@ -2851,7 +2852,13 @@ class TestWorkflows(
        doc = Document.objects.create(
            title="test",
        )
-        self.assertRaises(Exception, document_matches_workflow, doc, w, 99)
+        self.assertRaises(
+            UnsupportedWorkflowTriggerTypeError,
+            document_matches_workflow,
+            doc,
+            w,
+            99,
+        )

    def test_removal_action_document_updated_workflow(self) -> None:
        """
@@ -5573,6 +5580,41 @@ class TestApplyAISuggestionsWorkflowAction(
        self.doc.refresh_from_db()
        return changed

+    def test_fields_persist_when_tags_are_applied_in_the_same_run(self) -> None:
+        """
+        GIVEN:
+            - A document that already has a filename, as any consumed document does
+            - Suggestions carrying both a document type and tags
+        WHEN:
+            - The suggestions are applied
+        THEN:
+            - The document type is still set after the tags are added
+
+        Adding tags fires m2m_changed, and update_filename_and_move_files
+        refreshes the document from the database. Assigning fields and then
+        adding tags before saving loses those assignments, and only for
+        documents with a filename, so it does not reproduce on a bare
+        Document.objects.create().
+        """
+        self.doc.filename = "originals/original.pdf"
+        self.doc.save(update_fields=["filename"])
+
+        action = self.make_action(ai_create_missing=True)
+        changed = self.apply(action)
+
+        self.assertIn("document_type", changed)
+        self.assertIn("tags", changed)
+        self.assertIsNotNone(
+            self.doc.document_type,
+            "document_type was reported as applied but did not persist",
+        )
+        self.assertEqual(self.doc.document_type.name, "Suggested Document Type")
+        self.assertEqual(self.doc.correspondent.name, "Existing Correspondent")
+        self.assertCountEqual(
+            [t.name for t in self.doc.tags.all()],
+            ["Existing Tag", "Suggested Tag"],
+        )
+
    def test_document_added_trigger_queues_task(self) -> None:
        """
        GIVEN:
@@ -21,28 +21,32 @@ def uri_validator(value: str, allowed_schemes: set[str] | None = None) -> None:
        parts = urlparse(value)
        if not parts.scheme:
            raise ValidationError(
-                _(f"Unable to parse URI {value}, missing scheme"),
+                _("Unable to parse URI %(value)s, missing scheme"),
                params={"value": value},
            )
        elif not parts.netloc and not parts.path:
            raise ValidationError(
-                _(f"Unable to parse URI {value}, missing net location or path"),
+                _("Unable to parse URI %(value)s, missing net location or path"),
                params={"value": value},
            )

        if allowed_schemes and parts.scheme not in allowed_schemes:
            raise ValidationError(
                _(
-                    f"URI scheme '{parts.scheme}' is not allowed. Allowed schemes: {', '.join(allowed_schemes)}",
+                    "URI scheme '%(scheme)s' is not allowed. Allowed schemes: %(allowed_schemes)s",
                ),
-                params={"value": value, "scheme": parts.scheme},
+                params={
+                    "value": value,
+                    "scheme": parts.scheme,
+                    "allowed_schemes": ", ".join(allowed_schemes),
+                },
            )

    except ValidationError:
        raise
    except Exception as e:
        raise ValidationError(
-            _(f"Unable to parse URI {value}"),
+            _("Unable to parse URI %(value)s"),
            params={"value": value},
        ) from e

@@ -1440,7 +1440,7 @@ class DocumentViewSet(
        try:
            lang = detect(doc.content)
        except Exception:
-            pass
+            logger.debug("Unable to detect language for document %s", doc.pk)
        meta["lang"] = lang

        return Response(meta)
@@ -1478,13 +1478,12 @@ class DocumentViewSet(
            with get_date_parser() as date_parser:
                gen = date_parser.parse(doc.filename, doc.content)
                dates = sorted(
-                    {
-                        i
-                        for i in itertools.islice(
+                    set(
+                        itertools.islice(
                            gen,
                            settings.NUMBER_OF_SUGGESTED_DATES,
-                        )
-                    },
+                        ),
+                    ),
                )

        resp_data = {
@@ -1568,21 +1567,16 @@ class DocumentViewSet(
            except ValueError as exc:
                logger.exception(
                    "Invalid AI configuration while generating suggestions for "
-                    "document %s: %s",
+                    "document %s",
                    doc.pk,
-                    exc,
-                    exc_info=True,
                )
                raise ValidationError(
                    {"ai": [_("Invalid AI configuration.")]},
                ) from exc
-            except LLMTimeoutError as exc:
+            except LLMTimeoutError:
                logger.exception(
-                    "AI backend timed out while generating suggestions for "
-                    "document %s: %s",
+                    "AI backend timed out while generating suggestions for document %s",
                    doc.pk,
-                    exc,
-                    exc_info=True,
                )
                return Response(
                    {"ai": [_("AI backend request timed out.")]},
@@ -2055,7 +2049,7 @@ class DocumentViewSet(
            doc_name, doc_data = serializer.validated_data.get("document")
            version_label = serializer.validated_data.get("version_label")

-            t = int(mktime(datetime.now().timetuple()))
+            t = int(mktime(datetime.now().timetuple()))  # noqa: DTZ005 - mktime() requires a local time tuple

            settings.SCRATCH_DIR.mkdir(parents=True, exist_ok=True)

@@ -3325,7 +3319,7 @@ class PostDocumentView(GenericAPIView[Any]):
        cf = serializer.validated_data.get("custom_fields")
        from_webui = serializer.validated_data.get("from_webui")

-        t = int(mktime(datetime.now().timetuple()))
+        t = int(mktime(datetime.now().timetuple()))  # noqa: DTZ005 - mktime() requires a local time tuple

        settings.SCRATCH_DIR.mkdir(parents=True, exist_ok=True)

@@ -4135,7 +4129,7 @@ class UiSettingsView(GenericAPIView[Any]):
            user_resp["last_name"] = user.last_name

        # strip <app_label>.
-        roles = map(lambda perm: re.sub(r"^\w+.", "", perm), user.get_all_permissions())
+        roles = (re.sub(r"^\w+.", "", perm) for perm in user.get_all_permissions())
        return Response(
            {
                "user": user_resp,
@@ -5162,11 +5156,11 @@ class SystemStatusView(PassUserMixin):
                f"{m.app}.{m.name}"
                for m in MigrationRecorder.Migration.objects.all().order_by("id")
            ]
-        except Exception as e:  # pragma: no cover
+        except Exception:  # pragma: no cover
            applied_migrations = []
            db_status = "ERROR"
            logger.exception(
-                f"System status detected a possible problem while connecting to the database: {e}",
+                "System status detected a possible problem while connecting to the database",
            )
            db_error = "Error connecting to database, check logs for more detail."

@@ -5182,10 +5176,10 @@ class SystemStatusView(PassUserMixin):
            try:
                client.ping()
                redis_status = "OK"
-            except Exception as e:
+            except Exception:
                redis_status = "ERROR"
                logger.exception(
-                    f"System status detected a possible problem while connecting to redis: {e}",
+                    "System status detected a possible problem while connecting to redis",
                )
                redis_error = "Error connecting to redis, check logs for more detail."

@@ -5215,10 +5209,10 @@ class SystemStatusView(PassUserMixin):
                else:
                    celery_active = "WARNING"
                    celery_error = "Celery worker responded unexpectedly."
-        except Exception as e:
+        except Exception:
            celery_active = "ERROR"
            logger.exception(
-                f"System status detected a possible problem while connecting to celery: {e}",
+                "System status detected a possible problem while connecting to celery",
            )
            celery_error = "Error connecting to celery, check logs for more detail."

@@ -5233,13 +5227,15 @@ class SystemStatusView(PassUserMixin):
            index_dir = settings.INDEX_DIR
            mtimes = [p.stat().st_mtime for p in index_dir.iterdir() if p.is_file()]
            index_last_modified = (
-                make_aware(datetime.fromtimestamp(max(mtimes))) if mtimes else None
+                make_aware(datetime.fromtimestamp(max(mtimes)))  # noqa: DTZ006 - make_aware() requires a naive datetime
+                if mtimes
+                else None
            )
-        except Exception as e:
+        except Exception:
            index_status = "ERROR"
            index_error = "Error opening index, check logs for more detail."
            logger.exception(
-                f"System status detected a possible problem while opening the index: {e}",
+                "System status detected a possible problem while opening the index",
            )
            index_last_modified = None

@@ -66,7 +66,7 @@ def build_workflow_action_context(
        else None
    )

-    filename = document.original_file if document.original_file else ""
+    filename = document.original_file or ""
    return {
        "title": overrides.title
        if overrides and overrides.title
@@ -179,9 +179,9 @@ def execute_email_action(
            f"Sent {n_messages} notification email(s) to {action.email.to}",
            extra={"group": logging_group},
        )
-    except Exception as e:
+    except Exception:
        logger.exception(
-            f"Error occurred sending notification email: {e}",
+            "Error occurred sending notification email",
            extra={"group": logging_group},
        )

@@ -265,9 +265,9 @@ def execute_webhook_action(
            f"Webhook to {action.webhook.url} queued",
            extra={"group": logging_group},
        )
-    except Exception as e:
+    except Exception:
        logger.exception(
-            f"Error occurred sending webhook: {e}",
+            "Error occurred sending webhook",
            extra={"group": logging_group},
        )

@@ -47,7 +47,7 @@ def resolve_date(dates: list[str]) -> date | None:
    """
    for value in dates:
        try:
-            return datetime.strptime(value, "%Y-%m-%d").date()
+            return datetime.strptime(value, "%Y-%m-%d").date()  # noqa: DTZ007 - only the calendar date is used, time/tz is discarded
        except (TypeError, ValueError):
            logger.debug("Ignoring unparsable suggested date %s", value)
    return None
@@ -226,20 +226,20 @@ def apply_ai_suggestions_to_document(
            document.created = created
            updated_fields.append("created")

+    tags_to_add: list[Tag] = []
    if AISuggestionField.TAGS in selected:
        choice = suggestions["tags"]
        names = choice["new_names"]
-        tags = resolve_tags(
+        tags_to_add = resolve_tags(
            names,
            resolve_tag_ids(choice["existing_ids"], owner)
            + match_tags_by_name(names, owner),
            create_missing=create_missing,
            owner=owner,
        )
-        if tags:
+        if tags_to_add:
            # Suggested tags are always added, so overwrite_existing
            # does not really apply here
-            document.add_nested_tags(tags)
            updated_fields.append("tags")

    if updated_fields:
@@ -249,6 +249,10 @@ def apply_ai_suggestions_to_document(
        ]
        document.save(update_fields=[*direct_updated_fields, "modified"])

+    # Tags at the end so m2m_changed doesn't trigger db and overwrite other changes
+    if tags_to_add:
+        document.add_nested_tags(tags_to_add)
+
    logger.info(
        "Applied AI suggestions %s to document %s",
        updated_fields or "(none)",
@@ -70,6 +70,6 @@ def send_webhook(
        logger.error(
            f"Failed attempt sending webhook to {url}: {e}",
        )
-        raise e
+        raise
    finally:
        transport.close()
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
stumpylog	6b47534841	Chore: enable flake8-datetimez (DTZ) ruff rules Full category (10/10 codes are all default in ruff 0.16). Of 54 hits, 46 were in test fixture code constructing naive datetimes for comparison/input purposes only - added DTZ to the existing per-file-ignores for /tests/.py alongside E501/SIM117. The 8 production hits: - documents/consumer.py, documents/views.py (index_last_modified): suppressed with noqa - timezone.make_aware() requires a naive datetime, so wrapping fromtimestamp() in tz= would break it - documents/double_sided.py (x2): switched to datetime.now(tz=UTC).timestamp() - behavior-identical since .timestamp() returns the same epoch value regardless of the attached tz, but now explicit - documents/views.py (x2, upload temp file mtime): suppressed with noqa - mktime() requires a local time tuple, so an aware/UTC now() would introduce a timezone-offset bug - documents/workflows/ai.py (AI suggested date parsing): suppressed with noqa - only .date() is used, time/tz is discarded - paperless_mail/mail.py (IMAP fetch date filter): switched date.today() to timezone.localdate(), which respects settings.TIME_ZONE instead of the system clock - a real correctness improvement when they differ - paperless_mail/views.py (placeholder name string): switched datetime.datetime.now() to timezone.now(), matching the app's existing aware-datetime convention	2026-08-27 11:00:12 -07:00
stumpylog	c6e3f7a0c4	Chore: enable tryceratops (TRY002/004/201/203/401) ruff rules Only the 5 default-subset codes; the rest of tryceratops is opt-in. - 9 TRY201 (raise e -> raise) autofixed, preserving the traceback identically while dropping the redundant exception name - 26 TRY401 (redundant exception object passed to logger.exception, which already logs it) fixed by removing the duplicate from the message; three sites still needed the exception object for something else (re-raising, or a separate logger.error call) and kept their binding - 6 TRY002 (raise bare Exception): 2 production sites (documents/ matching.py, paperless_mail/preprocessor.py) got dedicated exception classes, with their tests narrowed to match instead of asserting a blind Exception; the other 4 are deliberate generic failures in test doubles/fixtures, suppressed with noqa	2026-08-27 10:50:32 -07:00
stumpylog	dc7b649625	Chore: enable pylint warning (PLW) ruff rules Full category (not just the ruff-0.16 default subset). 35 hits: - 4 PLW0108 (unnecessary lambda) autofixed - 6 PLW2901 (loop/with variable shadowed) renamed to distinct names - 2 PLW1510 (subprocess.run without explicit check) given check=False, matching existing behavior exactly - 6 PLW0602 (global declared but never assigned) removed - these were all in-place mutations (.append/.insert), not reassignments, so `global` was already a no-op - 7 PLW0603 (global statement) suppressed with noqa - these are genuine lazy-init singletons with no class to hold the state; refactoring them is a separate, larger change - 6 PLW1508 (non-str/None env var default) fixed using the existing get_int_from_env/get_float_from_env typed helpers instead of raw os.getenv, which also fixes a real bug: LOGROTATE_MAX_SIZE and LOGROTATE_MAX_BACKUPS were never wrapped in int(), so a string env var value would have flowed into RotatingFileHandler as a string - 1 PLW1641 (__eq__ without __hash__) fixed by adding __hash__ to PlaceholderString	2026-08-27 10:37:18 -07:00
stumpylog	a4075c49b2	Chore: enable flake8-gettext (INT001/002/003) ruff rules All 4 hits in documents/validators.py were f-strings inside gettext _() calls, which resolves the string before translation and breaks extraction (confirmed: locale .po files literally contain the raw "{value}" placeholder as msgid text). Fixed by using %(name)s-style placeholders with Django ValidationError's existing params= kwarg, which was already being passed but silently unused.	2026-08-27 10:23:38 -07:00
stumpylog	70b1c86ad3	Chore: enable flake8-bandit S102/S110/S112 ruff rules 3 S110 (try-except-pass) hits, all fixed by adding a log call in the except block rather than silently swallowing the exception, matching this codebase's existing %s lazy-formatting logging convention. Behavior is unchanged (still no re-raise) in all three spots.	2026-08-27 10:21:27 -07:00
stumpylog	8f5f577634	Chore: enable flake8-bugbear (B) default-subset ruff rules 3 B009 (getattr with a constant string, rewrite as attribute access) hits autofixed. 7 B017 (assert blind Exception) hits: one narrowed to the actual ValueError raised by bulk_edit.edit_pdf, the other six suppressed with noqa since the code under test genuinely raises (or a mock genuinely injects) a bare Exception, so a narrower assertion would be wrong. Only the 29 B codes ruff 0.16 enables by default; the rest of flake8-bugbear needs a separate, deliberate decision.	2026-08-27 10:17:16 -07:00
stumpylog	65b6db7b63	Chore: enable flake8-logging-format G101/G202 ruff rules G202 (redundant exc_info=True passed to logger.exception, which already includes the traceback) had 2 hits in documents/views.py, fixed manually since ruff has no autofix for it. G101 (hardcoded password string) had zero hits.	2026-08-27 10:11:50 -07:00
stumpylog	6f843bda8d	Chore: enable flake8-2020 (YTT) ruff rules Zero current violations. Full category (10/10 codes are all part of ruff 0.16's default rule set already, so there's no non-default subset to defer).	2026-08-27 10:09:20 -07:00
stumpylog	b7267815e3	Chore: enable flake8-debugger T100 ruff rule Zero current violations. Only T100 (import of pdb/ipdb/etc.) is part of ruff 0.16's default rule set.	2026-08-27 10:09:03 -07:00
stumpylog	c9bf18646a	Chore: enable flake8-pytest-style (PT) default-subset ruff rules Zero current violations. Only the 6 PT codes ruff 0.16 enables by default; the full flake8-pytest-style linter has thousands of hits here and needs a separate, deliberate decision.	2026-08-27 10:08:45 -07:00
stumpylog	8d1af73dc4	Chore: enable pylint refactor (PLR) default-subset ruff rules Zero current violations. Only the 13 PLR codes ruff 0.16 enables by default; the rest of pylint-refactor (e.g. PLR2004, PLR0913) has hundreds of hits here and needs a separate, deliberate decision.	2026-08-27 10:08:24 -07:00
stumpylog	515866a381	Chore: enable pygrep-hooks PGH005 ruff rule Zero current violations. Only PGH005 (invalid-mock-methods) is part of ruff 0.16's default rule set; the rest of pygrep-hooks is opt-in.	2026-08-27 10:08:03 -07:00
stumpylog	a91a2ab7e6	Chore: enable pep8-naming N999 ruff rule Zero current violations. Only N999 (invalid-module-name) is part of ruff 0.16's default rule set; the rest of pep8-naming is opt-in.	2026-08-27 10:07:44 -07:00
stumpylog	6d49f6e283	Chore: enable flake8-logging (LOG001/002/009/014/015) ruff rules Zero current violations. Only these five LOG codes are part of ruff 0.16's default rule set; the rest of the linter is opt-in.	2026-08-27 10:07:27 -07:00
stumpylog	ccd39118c2	Chore: enable pydocstyle D419 ruff rule Zero current violations. Only D419 (empty-docstring) is part of ruff 0.16's default rule set; the rest of pydocstyle is opt-in.	2026-08-27 10:07:05 -07:00
stumpylog	9c9771b5fc	Chore: enable flake8-async (ASYNC) ruff rules Zero current violations. Full category (not just the ruff-0.16 default subset) since the rest is equally applicable async-blocking guidance for this codebase's Channels/websocket code.	2026-08-27 10:06:48 -07:00
stumpylog	73e872d5f7	Chore: enable FA, G010, and PERF101/102/402 ruff rules All part of ruff 0.16's expanded default rule set. FA and G010 had zero existing violations; PERF402's one occurrence needed a manual fix since ruff can't safely autofix a multi-line call expression.	2026-08-27 09:59:41 -07:00
stumpylog	d3e6ef8c02	Chore: enable refurb (FURB) ruff rules FURB is part of ruff 0.16's expanded default rule set and is almost entirely autofixable.	2026-08-27 09:56:55 -07:00
stumpylog	18af45959f	Chore: enable flake8-comprehensions (C4) ruff rules C4 is part of ruff 0.16's expanded default rule set and is almost entirely autofixable, making it a low-risk first step towards adopting the new defaults.	2026-08-27 09:55:24 -07:00
github-actions[bot]GitHub Crowdin Bot	02b2f55248	New Crowdin translations by GitHub Action (#13811 ) Co-authored-by: Crowdin Bot <support+bot@crowdin.com>	2026-08-27 00:28:39 -07:00
shamoon	a2ea3b9e76	Update SECURITY.md	2026-08-27 00:21:03 -07:00
shamoon	a298568962	Security: harden is_public_ip	2026-08-27 00:21:03 -07:00
shamoon	f6f37898e8	Chore: use PinnedIMAP4	2026-08-27 00:21:02 -07:00
GitHub Actions	0cfe33720a	Auto translate strings	2026-08-27 04:29:13 +00:00
shamoonandGitHub	14b17ddf8d	Fix: navbar brand anchor size + Safari position jitter (#13810 )	2026-08-26 21:28:01 -07:00
github-actions[bot]andGitHub	9009fbb4e9	Documentation: Add v3.1.0 changelog (#13809 )	2026-08-26 19:13:04 -07:00
shamoon	94651d817d	Merge branch 'dev'	2026-08-26 18:42:21 -07:00
shamoon	1630e78aac	Bump version to 3.1.0	2026-08-26 18:07:04 -07:00
github-actions[bot]GitHub Crowdin Bot shamoon	4e79553489	New Crowdin translations by GitHub Action (#13496 ) Co-authored-by: Crowdin Bot <support+bot@crowdin.com> Co-authored-by: shamoon <4887959+shamoon@users.noreply.github.com>	2026-08-26 18:06:05 -07:00
shamoon	f24d58a383	Tweak: true center search in navbar	2026-08-26 18:02:14 -07:00
shamoonandGitHub	d486dd1205	Fix: prevent config autocomplete craziness (#13808 )	2026-08-26 17:46:34 -07:00
shamoon	406bc1a233	Fix: defer add_nested_tags in ai workflow to avoid losing unsaved changes	2026-08-26 14:18:40 -07:00
GitHub Actions	808746c28c	Auto translate strings	2026-08-26 21:03:06 +00:00
shamoon	ff6d73ce17	Fix missing clear button on select choices	2026-08-26 14:01:04 -07:00
shamoonandGitHub	b4068d38bc	Fix/performance: prevent token re-use in dropdown filtering, also a perf thing (#13804 )	2026-08-26 13:18:09 -07:00
shamoon	139739c2a2	Fix: handle social account sync groups claim sent as str	2026-08-26 12:37:29 -07:00
shamoon	aad75b4981	Docs: clarify app config trust	2026-08-26 01:39:50 -07:00