New Crowdin translations by GitHub Action

Auto translate strings
Fix: remove some redundant pagers (#14487 )
2026-10-19 14:28:14 +00:00 · 2026-10-19 12:31:23 +00:00 · 2026-10-19 06:20:40 +00:00 · 2026-10-18 23:19:24 -07:00 · 2026-10-19 06:05:02 +00:00 · 2026-10-18 23:03:43 -07:00
143 changed files with 29841 additions and 28327 deletions
@@ -31,9 +31,19 @@ body:
      value: |
        #### 🤖 Use of AI tools

-        If this report was generated, in whole or in part, by an AI tool or agent you **must** clearly say so in the description below. Failing to clearly disclose this is a violation of our [Code of Conduct](https://github.com/paperless-ngx/paperless-ngx/blob/main/CODE_OF_CONDUCT.md).
+        If this report was generated, in whole or in part, by an AI tool or agent you **must** say so using the field below. Failing to clearly disclose this is a violation of our [Code of Conduct](https://github.com/paperless-ngx/paperless-ngx/blob/main/CODE_OF_CONDUCT.md).

        Reports written by an AI agent must describe the _observed behavior only_: what happened, how to reproduce it, logs etc. Do **not** include code analysis, speculation about the root cause, or suggest code fixes.
+  - type: dropdown
+    id: ai-usage
+    attributes:
+      label: AI usage
+      description: Was any part of this report written by an AI tool or agent?
+      options:
+        - No AI tools were used
+        - Yes, AI tools helped write this report
+    validations:
+      required: true
  - type: textarea
    id: description
    attributes:
@@ -43,6 +43,12 @@ jobs:
            const haystack = `${issue.title}\n${issue.body ?? ''}`;
            const honeypot = haystack.toUpperCase().includes('ASLOP-PR-VERIFY');

+            // The form's required "AI usage" dropdown renders as a `### AI usage` section. An agent
+            // that follows the template trips the honeypot even when it discloses, so only treat
+            // the honeypot as undisclosed AI use when the reporter did not answer "Yes" here.
+            const aiUsage = (issue.body ?? '').match(/^###\s+AI usage\s*\n+\s*(.+?)\s*$/m)?.[1] ?? '';
+            const disclosedAI = aiUsage.toLowerCase().startsWith('yes');
+
            // Issues opened through the form always get the template's default labels. GitHub
            // applies them a second or two *after* creation, so re-read them instead of trusting
            // the webhook payload, and retry before concluding that there are none.
@@ -55,19 +61,30 @@ jobs:
              if (labels.some((label) => templateLabels.includes(label))) break;
            }
            const bypassedTemplate = !labels.some((label) => templateLabels.includes(label));
-            core.info(`Labels: [${labels.join(', ')}], honeypot: ${honeypot}, bypassed template: ${bypassedTemplate}`);
+            core.info(
+              `Labels: [${labels.join(', ')}], honeypot: ${honeypot}, AI usage: "${aiUsage}", ` +
+                `bypassed template: ${bypassedTemplate}`
+            );

-            if (!honeypot && !bypassedTemplate) {
-              core.info('No slop signals found');
+            if (!bypassedTemplate && (disclosedAI || !honeypot)) {
+              if (disclosedAI) {
+                core.info('AI use disclosed, labeling only');
+                await github.rest.issues.addLabels({ ...common, labels: ['ai'] });
+              } else {
+                core.info('No slop signals found');
+              }
              return;
            }

-            // The honeypot is only ever tripped deliberately, so that message can name the cause.
            // A missing template label only tells us the issue did not come from the form, which
-            // is reason enough to close it, but not proof of how it was written.
-            const body = honeypot
+            // is reason enough to close it, but not proof of how it was written. It takes priority:
+            // a hand-built body can carry the honeypot *and* a disclosure, and the form message is
+            // the only one that is accurate for both. Reaching the honeypot message means the issue
+            // came from the form without disclosing AI usage, so that message can name the cause.
+            const body = honeypot && !bypassedTemplate
              ? 'This issue was automatically closed because it contains a marker that is only visible to ' +
-                'automated tools, which indicates it was generated by an AI agent without being disclosed as such.\n\n' +
+                'automated tools, which indicates it was generated by an AI agent, but the "AI usage" field does not ' +
+                'disclose this.\n\n' +
                `Please see our [contributing guidelines](${contributing}) and [Code of Conduct](${codeOfConduct}). ` +
                'You are welcome to open a new issue that describes the problem you observed in your own words.'
              : 'This issue was automatically closed because it was not opened using our bug report form. ' +
@@ -1,5 +1,54 @@
 # Changelog

+## paperless-ngx 3.3.1
+
+### Bug Fixes
+
+- Fix: use a root document's effective content for the LLM index and pr… [@stumpylog](https://github.com/stumpylog) ([#14423](https://github.com/paperless-ngx/paperless-ngx/pull/14423))
+- Fix: index document versions as their root document [@stumpylog](https://github.com/stumpylog) ([#14422](https://github.com/paperless-ngx/paperless-ngx/pull/14422))
+- Fix: authorize document versions by their root in the single-object permission check [@stumpylog](https://github.com/stumpylog) ([#14421](https://github.com/paperless-ngx/paperless-ngx/pull/14421))
+- Fix: Provide better error messages to users for invalid JSON [@stumpylog](https://github.com/stumpylog) ([#14419](https://github.com/paperless-ngx/paperless-ngx/pull/14419))
+- Fix: authorize document versions by their root and speed up permission id sets [@stumpylog](https://github.com/stumpylog) ([#14396](https://github.com/paperless-ngx/paperless-ngx/pull/14396))
+- Chore: update the db options warning [@shamoon](https://github.com/shamoon) ([#14398](https://github.com/paperless-ngx/paperless-ngx/pull/14398))
+- Fix: bulk reprocess latest version for root documents [@shamoon](https://github.com/shamoon) ([#14385](https://github.com/paperless-ngx/paperless-ngx/pull/14385))
+- Fix: consistently use root doc for version action permissions [@shamoon](https://github.com/shamoon) ([#14384](https://github.com/paperless-ngx/paperless-ngx/pull/14384))
+- Fix: Don't attempt to index created dates which are not representable in the FTS index [@stumpylog](https://github.com/stumpylog) ([#14390](https://github.com/paperless-ngx/paperless-ngx/pull/14390))
+- Fix: retry a search index rebuild that was interrupted [@stumpylog](https://github.com/stumpylog) ([#14379](https://github.com/paperless-ngx/paperless-ngx/pull/14379))
+
+### Documentation
+
+- Chore: silence gotenberg startup warning [@slankes](https://github.com/slankes) ([#14405](https://github.com/paperless-ngx/paperless-ngx/pull/14405))
+- Documentation: remove MARIADB\_HOST from MariaDB compose files [@shamoon](https://github.com/shamoon) ([#14378](https://github.com/paperless-ngx/paperless-ngx/pull/14378))
+- Documentation: Updates the troubleshooting with 2 common database collation issues [@stumpylog](https://github.com/stumpylog) ([#14370](https://github.com/paperless-ngx/paperless-ngx/pull/14370))
+
+### Maintenance
+
+- Chore: Upgrade runners to Ubuntu 26.04 [@stumpylog](https://github.com/stumpylog) ([#14347](https://github.com/paperless-ngx/paperless-ngx/pull/14347))
+
+### Dependencies
+
+- Chore(deps): Bump the npm\_and\_yarn group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14417](https://github.com/paperless-ngx/paperless-ngx/pull/14417))
+
+### All App Changes
+
+<details>
+<summary>12 changes</summary>
+
+- Chore: share the authorizing owner rule between the id sets and the trash filter [@stumpylog](https://github.com/stumpylog) ([#14425](https://github.com/paperless-ngx/paperless-ngx/pull/14425))
+- Fix: use a root document's effective content for the LLM index and pr… [@stumpylog](https://github.com/stumpylog) ([#14423](https://github.com/paperless-ngx/paperless-ngx/pull/14423))
+- Fix: index document versions as their root document [@stumpylog](https://github.com/stumpylog) ([#14422](https://github.com/paperless-ngx/paperless-ngx/pull/14422))
+- Fix: authorize document versions by their root in the single-object permission check [@stumpylog](https://github.com/stumpylog) ([#14421](https://github.com/paperless-ngx/paperless-ngx/pull/14421))
+- Fix: Provide better error messages to users for invalid JSON [@stumpylog](https://github.com/stumpylog) ([#14419](https://github.com/paperless-ngx/paperless-ngx/pull/14419))
+- Chore(deps): Bump the npm\_and\_yarn group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#14417](https://github.com/paperless-ngx/paperless-ngx/pull/14417))
+- Fix: authorize document versions by their root and speed up permission id sets [@stumpylog](https://github.com/stumpylog) ([#14396](https://github.com/paperless-ngx/paperless-ngx/pull/14396))
+- Chore: update the db options warning [@shamoon](https://github.com/shamoon) ([#14398](https://github.com/paperless-ngx/paperless-ngx/pull/14398))
+- Fix: bulk reprocess latest version for root documents [@shamoon](https://github.com/shamoon) ([#14385](https://github.com/paperless-ngx/paperless-ngx/pull/14385))
+- Fix: consistently use root doc for version action permissions [@shamoon](https://github.com/shamoon) ([#14384](https://github.com/paperless-ngx/paperless-ngx/pull/14384))
+- Fix: Don't attempt to index created dates which are not representable in the FTS index [@stumpylog](https://github.com/stumpylog) ([#14390](https://github.com/paperless-ngx/paperless-ngx/pull/14390))
+- Fix: retry a search index rebuild that was interrupted [@stumpylog](https://github.com/stumpylog) ([#14379](https://github.com/paperless-ngx/paperless-ngx/pull/14379))
+
+</details>
+
 ## paperless-ngx 3.3.0

 ### Features / Enhancements
@@ -43,7 +43,7 @@ dependencies = [
  "drf-spectacular~=0.30",
  "drf-spectacular-sidecar>=2026.7.1,<2026.10",
  "drf-writable-nested~=0.7.1",
-  "filelock~=3.32.0",
+  "filelock>=3.32,<4.1",
  "flower>=2.0.1,<2.3",
  "gotenberg-client[httpx]~=1.0",
  "httpx-oauth~=0.17",
@@ -15,6 +15,8 @@ module.exports = {
        tsconfig: '<rootDir>/tsconfig.spec.json',
        stringifyContentPathRegex: '\\.(html|svg)$',
        useESM: true,
+        // Disable the builder's deprecated override; tsconfig.spec.json enables isolation.
+        isolatedModules: false,
      },
    ],
  },
@@ -102,25 +102,34 @@
    </button>
  }

-  <ngb-pagination
-    [pageSize]="pageSize"
-    [collectionSize]="totalTasks()"
-    [page]="page"
-    [maxSize]="5"
-    [rotate]="true"
-    size="sm"
-    aria-label="Tasks pagination"
-    (pageChange)="setPage($event)">
-  </ngb-pagination>
+  @if (selectedSection !== TaskSection.All && totalTasks() > pageSize) {
+    <ngb-pagination
+      [pageSize]="pageSize"
+      [collectionSize]="totalTasks()"
+      [page]="page"
+      [maxSize]="5"
+      [rotate]="true"
+      size="sm"
+      aria-label="Tasks pagination"
+      (pageChange)="setPage($event)">
+    </ngb-pagination>
+  }
 </div>

 <ng-template let-tasks="tasks" let-section="section" #tasksTemplate>
-  <div class="section-header d-flex align-items-center justify-content-between mb-2">
-    <div>
-      <h5 class="mb-0">{{ sectionLabel(section) }}</h5>
-      <div class="small text-muted">
-        <ng-container i18n>{tasks.length, plural, =1 {1 task} other {{{tasks.length}} tasks}}</ng-container>
-      </div>
+  <div class="section-header mb-2">
+    <h5 class="mb-0">{{ sectionLabel(section) }}</h5>
+    @let count = sectionCount(section);
+    @let hasMore = selectedSection === TaskSection.All && count > tasks.length;
+    <div class="small text-muted">
+      @if (hasMore) {
+        <ng-container i18n>{{tasks.length}} of {{count}} tasks</ng-container>
+        <button class="btn btn-link show-all p-0 ms-2 align-baseline" type="button" (click)="setSection(section)">
+          <ng-container i18n>Show all</ng-container><i-bs class="ms-1" width="1em" height="1em" name="arrow-right"></i-bs>
+        </button>
+      } @else {
+        <ng-container i18n>{count, plural, =1 {1 task} other {{{count}} tasks}}</ng-container>
+      }
    </div>
  </div>

@@ -169,10 +178,9 @@
              <div>{{ taskDisplayName(task) }}</div>
              <div class="small text-muted">
                @if (taskShowsSeparateTypeLabel(task)) {
-                  <span>{{ task.task_type_display }}</span>
-                  <span class="mx-1">&bull;</span>
+                  <span class="me-2">{{ task.task_type_display }}</span>
                }
-                <span>{{ task.trigger_source_display }}</span>
+                <span class="text-nowrap"><i-bs class="me-1" width="1em" height="1em" name="box-arrow-in-right"></i-bs>{{ task.trigger_source_display }}</span>
              </div>
            </td>
            <td class="d-none d-lg-table-cell created-col">{{ task.date_created | customDate:'short' }}</td>
@@ -72,3 +72,7 @@ pre {
 tbody tr:nth-last-child(2) td {
    border-bottom: none !important;
 }
+
+.section-header .show-all {
+    font-size: inherit;
+}
@@ -223,16 +223,6 @@ describe('TasksComponent', () => {
      )
      .flush(paginatedTasks)

-    httpTestingController
-      .expectOne(
-        (req) =>
-          req.url === `${environment.apiBaseUrl}tasks/` &&
-          req.params.get('acknowledged') === 'false' &&
-          req.params.get('page_size') === '25' &&
-          req.params.get('page') === '1'
-      )
-      .flush(paginatedTasks)
-
    httpTestingController
      .expectOne(
        (req) =>
@@ -241,8 +231,30 @@ describe('TasksComponent', () => {
          !req.params.has('status')
      )
      .flush(sectionCountResponse)
+
+    flushTaskLists(10)
  })

+  // answers task list requests with the fixture tasks matching their status filter
+  function flushTaskLists(pageSize: number, count?: number) {
+    httpTestingController
+      .match(
+        (req) =>
+          req.url === `${environment.apiBaseUrl}tasks/` &&
+          req.params.get('page_size') === `${pageSize}`
+      )
+      .forEach((req) => {
+        const statuses = req.request.params.getAll('status')
+        const results = tasks.filter((task) => statuses.includes(task.status))
+        req.flush({ count: count ?? results.length, results })
+      })
+  }
+
+  function selectSection(section: TaskSection, count: number) {
+    component.setSection(section)
+    flushTaskLists(25, count)
+  }
+
  it('should display task sections with counts', () => {
    expect(component.selectedSection).toBe(TaskSection.All)
    expect(component.selectedTaskType).toBeNull()
@@ -338,6 +350,7 @@ describe('TasksComponent', () => {
  })

  it('should render pagination controls next to the task filter', () => {
+    selectSection(TaskSection.Completed, 30)
    fixture.detectChanges()

    const controls = fixture.debugElement.query(By.css('.task-controls'))
@@ -348,6 +361,51 @@ describe('TasksComponent', () => {
    expect(pagination).not.toBeNull()
  })

+  it('should only paginate a section with more than one page of tasks', () => {
+    const pagination = () =>
+      fixture.debugElement.query(By.css('ngb-pagination'))
+
+    fixture.detectChanges()
+    expect(pagination()).toBeNull()
+
+    selectSection(TaskSection.Completed, 2)
+    fixture.detectChanges()
+    expect(pagination()).toBeNull()
+  })
+
+  it('should load the all tasks overview one section at a time', () => {
+    expect(component.tasksForSection(TaskSection.NeedsAttention)).toHaveLength(
+      2
+    )
+    expect(component.tasksForSection(TaskSection.InProgress)).toHaveLength(3)
+    expect(component.tasksForSection(TaskSection.Completed)).toHaveLength(2)
+    expect(component.totalTasks()).toBe(7)
+  })
+
+  it('should show section totals and link truncated sections to their full list', () => {
+    component.sectionCounts.update((counts) => ({
+      ...counts,
+      [TaskSection.Completed]: 27,
+    }))
+    fixture.detectChanges()
+
+    const header = (label: string) =>
+      fixture.debugElement
+        .queryAll(By.css('.section-header'))
+        .find((h) => h.nativeElement.textContent.includes(label))
+
+    expect(header('Needs attention').nativeElement.textContent).toContain(
+      '2 tasks'
+    )
+    expect(header('Needs attention').query(By.css('button'))).toBeNull()
+
+    expect(header('Recently completed').nativeElement.textContent).toContain(
+      '2 of 27 tasks'
+    )
+    header('Recently completed').query(By.css('button')).nativeElement.click()
+    expect(component.selectedSection).toBe(TaskSection.Completed)
+  })
+
  it('should apply the selected section to the server-side task query', () => {
    component.setSection(TaskSection.NeedsAttention)

@@ -368,55 +426,56 @@ describe('TasksComponent', () => {
  it('should apply task type and trigger source filters to the server-side task query', () => {
    component.setTaskType(PaperlessTaskType.SanityCheck)

-    httpTestingController
-      .expectOne(
+    expect(
+      httpTestingController.match(
        (request) =>
          request.url === `${environment.apiBaseUrl}tasks/` &&
-          request.params.get('page_size') === '25' &&
+          request.params.get('page_size') === '10' &&
          request.params.get('task_type') === PaperlessTaskType.SanityCheck
      )
-      .flush({ count: 1, results: [tasks[6]] })
+    ).toHaveLength(3)

    component.setTriggerSource(PaperlessTaskTriggerSource.System)

-    httpTestingController
-      .expectOne(
+    expect(
+      httpTestingController.match(
        (request) =>
          request.url === `${environment.apiBaseUrl}tasks/` &&
-          request.params.get('page_size') === '25' &&
+          request.params.get('page_size') === '10' &&
          request.params.get('task_type') === PaperlessTaskType.SanityCheck &&
          request.params.get('trigger_source') ===
            PaperlessTaskTriggerSource.System
      )
-      .flush({ count: 1, results: [tasks[6]] })
+    ).toHaveLength(3)
  })

  it('should apply text filters to the server-side task query', () => {
    component.filterText = 'invoice'
    jest.advanceTimersByTime(150)

-    httpTestingController
-      .expectOne(
+    expect(
+      httpTestingController.match(
        (request) =>
          request.url === `${environment.apiBaseUrl}tasks/` &&
-          request.params.get('page_size') === '25' &&
+          request.params.get('page_size') === '10' &&
          request.params.get('name') === 'invoice'
      )
-      .flush({ count: 1, results: [tasks[0]] })
+    ).toHaveLength(3)

    component.setFilterTarget(TaskFilterTargetID.Result)

-    httpTestingController
-      .expectOne(
+    expect(
+      httpTestingController.match(
        (request) =>
          request.url === `${environment.apiBaseUrl}tasks/` &&
-          request.params.get('page_size') === '25' &&
+          request.params.get('page_size') === '10' &&
          request.params.get('result') === 'invoice'
      )
-      .flush({ count: 0, results: [] })
+    ).toHaveLength(3)
  })

  it('should load a different task page when pagination changes', () => {
+    selectSection(TaskSection.Completed, 30)
    component.setPage(2)

    const pageTwoTasks = {
@@ -440,6 +499,7 @@ describe('TasksComponent', () => {
  })

  it('should not replace section counts with current-page counts', () => {
+    selectSection(TaskSection.Completed, 30)
    component.setPage(2)

    httpTestingController
@@ -455,11 +515,21 @@ describe('TasksComponent', () => {
        results: [tasks[0]],
      })

+    expect(component.sectionCount(TaskSection.All)).toBe(7)
    expect(component.sectionCount(TaskSection.NeedsAttention)).toBe(2)
    expect(component.sectionCount(TaskSection.InProgress)).toBe(3)
    expect(component.sectionCount(TaskSection.Completed)).toBe(2)
  })

+  it('should stop loading when the overview fails to load', () => {
+    component.setSection(TaskSection.All)
+    httpTestingController
+      .match((req) => req.params.get('page_size') === '10')[0]
+      .flush('', { status: 500, statusText: 'Error' })
+
+    expect(component.loading()).toBe(false)
+  })
+
  it('should expose stable task type options and disable empty ones', () => {
    expect(component.taskTypeOptions.map((option) => option.value)).toContain(
      PaperlessTaskType.TrainClassifier
@@ -15,6 +15,9 @@ import {
  distinctUntilChanged,
  filter,
  first,
+  forkJoin,
+  map,
+  Observable,
  Subject,
  takeUntil,
  timer,
@@ -25,6 +28,7 @@ import {
  PaperlessTaskTriggerSource,
  PaperlessTaskType,
 } from 'src/app/data/paperless-task'
+import { Results } from 'src/app/data/results'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
 import { TasksService } from 'src/app/services/tasks.service'
@@ -169,6 +173,7 @@ export class TasksComponent
  public expandedTask: number
  public autoRefreshEnabled: boolean = true
  public readonly pageSize = 25
+  public readonly overviewSize = 10
  public page: number = 1
  readonly totalTasks = signal(0)
  readonly sectionCounts = signal<Record<TaskSection, number>>({
@@ -484,13 +489,6 @@ export class TasksComponent
    return this.sectionCounts()[section]
  }

-  private setSectionCount(section: TaskSection, count: number) {
-    this.sectionCounts.update((counts) => ({
-      ...counts,
-      [section]: count,
-    }))
-  }
-
  sectionShowsResults(section: TaskSection): boolean {
    return section !== TaskSection.InProgress
  }
@@ -737,21 +735,12 @@ export class TasksComponent
    this.reloadSectionCounts()

    this.loading.set(true)
-    this.tasksService
-      .list(
-        this.page,
-        this.pageSize,
-        this.getParamsForSection(this.selectedSection)
-      )
+    this.listTasks()
      .pipe(first(), takeUntil(this.unsubscribeNotifier))
      .subscribe({
        next: (result) => {
          this.pagedTasks.set(result.results)
          this.totalTasks.set(result.count)
-          this.setSectionCount(TaskSection.All, result.count)
-          if (this.selectedSection !== TaskSection.All) {
-            this.setSectionCount(this.selectedSection, result.count)
-          }
          this.loading.set(false)
          if (
            this.page > 1 &&
@@ -767,4 +756,30 @@ export class TasksComponent
        },
      })
  }
+
+  private listTasks(): Observable<Results<PaperlessTask>> {
+    if (this.selectedSection !== TaskSection.All) {
+      return this.tasksService.list(
+        this.page,
+        this.pageSize,
+        this.getParamsForSection(this.selectedSection)
+      )
+    }
+
+    // All is an overview of each section to avoid splitting sections across pages
+    return forkJoin(
+      this.sections.map((section) =>
+        this.tasksService.list(
+          1,
+          this.overviewSize,
+          this.getParamsForSection(section)
+        )
+      )
+    ).pipe(
+      map((results) => ({
+        count: results.reduce((sum, result) => sum + result.count, 0),
+        results: results.flatMap((result) => result.results),
+      }))
+    )
+  }
 }
@@ -154,6 +154,31 @@ describe('UsersAndGroupsComponent', () => {
    jest.useRealTimers()
  })

+  it('should logout current user under base href if password changed', () => {
+    jest.useFakeTimers()
+    const base = document.createElement('base')
+    base.href = '/paperless/'
+    document.head.appendChild(base)
+    completeSetup()
+    let modal: NgbModalRef
+    modalService.activeInstances.subscribe((refs) => (modal = refs[0]))
+    component.editUser(users[0])
+    const navSpy = jest
+      .spyOn(navUtils, 'setLocationHref')
+      .mockImplementation(() => {})
+    const editDialog = modal.componentInstance as UserEditDialogComponent
+    editDialog.passwordIsSet = true
+    settingsService.currentUser.set(users[0]) // simulate logged in as same user
+    editDialog.succeeded.emit(users[0])
+    fixture.detectChanges()
+    jest.advanceTimersByTime(2600)
+    expect(navSpy).toHaveBeenCalledWith(
+      `${window.location.origin}/paperless/accounts/logout/?next=/paperless/accounts/login/?next=/paperless/`
+    )
+    base.remove()
+    jest.useRealTimers()
+  })
+
  it('should support edit / create group, show error if needed', () => {
    completeSetup()
    let modal: NgbModalRef
@@ -116,8 +116,9 @@ export class UsersAndGroupsComponent
            $localize`Password has been changed, you will be logged out momentarily.`
          )
          setTimeout(() => {
+            const basePath = new URL(document.baseURI).pathname
            setLocationHref(
-              `${window.location.origin}/accounts/logout/?next=/accounts/login/?next=/`
+              `${window.location.origin}${basePath}accounts/logout/?next=${basePath}accounts/login/?next=${basePath}`
            )
          }, 2500)
        } else {
@@ -218,6 +218,38 @@ describe('ProfileEditDialogComponent', () => {
    jest.useRealTimers()
  })

+  it('should logout under base href on save if password changed', () => {
+    jest.useFakeTimers()
+    const base = document.createElement('base')
+    base.href = '/paperless/'
+    document.head.appendChild(base)
+    const getSpy = jest.spyOn(profileService, 'get')
+    getSpy.mockReturnValue(of(profile))
+    const getProvidersSpy = jest.spyOn(
+      profileService,
+      'getSocialAccountProviders'
+    )
+    getProvidersSpy.mockReturnValue(of(socialAccountProviders))
+    component.ngOnInit()
+    component['newPassword'] = 'new*pass'
+    component.form.get('password').patchValue('new*pass')
+    component.form.get('password_confirm').patchValue('new*pass')
+
+    const updateSpy = jest.spyOn(profileService, 'update')
+    updateSpy.mockReturnValue(of(null))
+    const navSpy = jest
+      .spyOn(navUtils, 'setLocationHref')
+      .mockImplementation(() => {})
+    component.save()
+    expect(updateSpy).toHaveBeenCalled()
+    jest.advanceTimersByTime(2600)
+    expect(navSpy).toHaveBeenCalledWith(
+      `${window.location.origin}/paperless/accounts/logout/?next=/paperless/accounts/login/?next=/paperless/`
+    )
+    base.remove()
+    jest.useRealTimers()
+  })
+
  it('should support auth token copy', () => {
    jest.useFakeTimers()
    const getSpy = jest.spyOn(profileService, 'get')
@@ -210,8 +210,9 @@ export class ProfileEditDialogComponent
              $localize`Password has been changed, you will be logged out momentarily.`
            )
            setTimeout(() => {
+              const basePath = new URL(document.baseURI).pathname
              setLocationHref(
-                `${window.location.origin}/accounts/logout/?next=/accounts/login/?next=/`
+                `${window.location.origin}${basePath}accounts/logout/?next=${basePath}accounts/login/?next=${basePath}`
              )
            }, 2500)
          }
@@ -1,6 +1,6 @@
 <div class="d-flex align-items-center">
  <div class="btn-group">
-    <button type="button" class="btn btn-sm btn-outline-primary" (click)="clickSuggest()" [disabled]="disabled() || loading() || (suggestions() && !aiEnabled())" [aria-label]="noSuggestions ? 'No suggestions' : 'Suggest'" i18n-aria-label>
+    <button type="button" class="btn btn-sm btn-outline-primary" (click)="clickSuggest()" [disabled]="disabled() || loading()" [aria-label]="noSuggestions ? 'No suggestions' : 'Suggest'" i18n-aria-label>
      @if (loading()) {
        <div class="spinner-border spinner-border-sm" role="status"></div>
      } @else if (noSuggestions) {
@@ -18,46 +18,44 @@
      }
    </button>

-    @if (aiEnabled()) {
-      <div class="btn-group" ngbDropdown #dropdown="ngbDropdown" [popperOptions]="popperOptions">
-        <button type="button" class="btn btn-sm btn-outline-primary" ngbDropdownToggle [disabled]="disabled() || loading() || !suggestions()" aria-expanded="false" aria-controls="suggestionsDropdown" aria-label="Suggestions dropdown">
-          <span class="visually-hidden" i18n>Show suggestions</span>
-        </button>
+    <div class="btn-group" ngbDropdown #dropdown="ngbDropdown" [popperOptions]="popperOptions">
+      <button type="button" class="btn btn-sm btn-outline-primary" ngbDropdownToggle [disabled]="disabled() || loading() || !suggestions()" aria-expanded="false" aria-controls="suggestionsDropdown" aria-label="Suggestions dropdown">
+        <span class="visually-hidden" i18n>Show suggestions</span>
+      </button>

-        <div ngbDropdownMenu aria-labelledby="suggestionsDropdown" class="shadow suggestions-dropdown">
-          <div class="list-group list-group-flush small pb-0">
-            @if (novelSuggestions === 0 && fieldSuggestions === 0) {
-              <div class="list-group-item text-muted fst-italic">
-                <small class="text-muted small fst-italic" i18n>No novel suggestions</small>
-              </div>
+      <div ngbDropdownMenu aria-labelledby="suggestionsDropdown" class="shadow suggestions-dropdown">
+        <div class="list-group list-group-flush small pb-0">
+          @if (novelSuggestions === 0 && fieldSuggestions === 0) {
+            <div class="list-group-item text-muted fst-italic">
+              <small class="text-muted small fst-italic" i18n>No novel suggestions</small>
+            </div>
+          }
+          @if (suggestions()?.suggested_tags?.length > 0) {
+            <small class="list-group-item text-uppercase text-muted small"><i-bs class="me-2" name="tags"></i-bs><ng-container i18n>Tags</ng-container></small>
+            @for (tag of suggestions().suggested_tags; track tag) {
+              <button type="button" class="list-group-item list-group-item-action bg-light" (click)="addTag.emit(tag)">{{ tag }}</button>
            }
-            @if (suggestions()?.suggested_tags?.length > 0) {
-              <small class="list-group-item text-uppercase text-muted small"><i-bs class="me-2" name="tags"></i-bs><ng-container i18n>Tags</ng-container></small>
-              @for (tag of suggestions().suggested_tags; track tag) {
-                <button type="button" class="list-group-item list-group-item-action bg-light" (click)="addTag.emit(tag)">{{ tag }}</button>
-              }
+          }
+          @if (suggestions()?.suggested_document_types?.length > 0) {
+            <div class="list-group-item text-uppercase text-muted small"><i-bs class="me-2" name="hash"></i-bs><ng-container i18n>Document Types</ng-container></div>
+            @for (type of suggestions().suggested_document_types; track type) {
+              <button type="button" class="list-group-item list-group-item-action bg-light" (click)="addDocumentType.emit(type)">{{ type }}</button>
            }
-            @if (suggestions()?.suggested_document_types?.length > 0) {
-              <div class="list-group-item text-uppercase text-muted small"><i-bs class="me-2" name="hash"></i-bs><ng-container i18n>Document Types</ng-container></div>
-              @for (type of suggestions().suggested_document_types; track type) {
-                <button type="button" class="list-group-item list-group-item-action bg-light" (click)="addDocumentType.emit(type)">{{ type }}</button>
-              }
+          }
+          @if (suggestions()?.suggested_correspondents?.length > 0) {
+            <div class="list-group-item text-uppercase text-muted small"><i-bs class="me-2" name="person"></i-bs><ng-container i18n>Correspondents</ng-container></div>
+            @for (correspondent of suggestions().suggested_correspondents; track correspondent) {
+              <button type="button" class="list-group-item list-group-item-action bg-light" (click)="addCorrespondent.emit(correspondent)">{{ correspondent }}</button>
            }
-            @if (suggestions()?.suggested_correspondents?.length > 0) {
-              <div class="list-group-item text-uppercase text-muted small"><i-bs class="me-2" name="person"></i-bs><ng-container i18n>Correspondents</ng-container></div>
-              @for (correspondent of suggestions().suggested_correspondents; track correspondent) {
-                <button type="button" class="list-group-item list-group-item-action bg-light" (click)="addCorrespondent.emit(correspondent)">{{ correspondent }}</button>
-              }
-            }
-            @if (fieldSuggestions > 0) {
-              <div class="list-group-item text-muted fst-italic">
-                <small class="text-muted small fst-italic" i18n>{fieldSuggestions, plural, =1 {1 suggestion available below} other {{{fieldSuggestions}} suggestions available below}}</small>
-              </div>
-            }
-          </div>
+          }
+          @if (fieldSuggestions > 0) {
+            <div class="list-group-item text-muted fst-italic">
+              <small class="text-muted small fst-italic" i18n>{fieldSuggestions, plural, =1 {1 suggestion available below} other {{{fieldSuggestions}} suggestions available below}}</small>
+            </div>
+          }
        </div>
      </div>
-    }
+    </div>
  </div>

  @if (aiEnabled()) {
@@ -251,6 +251,37 @@ describe('SuggestionsDropdownComponent', () => {
    expect(fixture.nativeElement.textContent).toContain('No novel suggestions')
  })

+  it('should open ML date suggestions with AI disabled', () => {
+    const getSuggestions = jest.spyOn(component.getSuggestions, 'emit')
+    fixture.componentRef.setInput('aiEnabled', false)
+    fixture.componentRef.setInput('fetchedSources', [SuggestionSource.ML])
+    fixture.componentRef.setInput('suggestions', {
+      dates: ['2026-01-04', '2026-02-01'],
+    })
+    fixture.componentRef.setInput('appliedCreated', '2026-01-04')
+    fixture.detectChanges()
+
+    const button = fixture.nativeElement.querySelector('button')
+    expect(button.disabled).toBeFalsy()
+    expect(button.querySelector('.badge').textContent.trim()).toBe('1')
+
+    button.click()
+    fixture.detectChanges()
+
+    expect(component.dropdown.isOpen()).toBeTruthy()
+    expect(fixture.nativeElement.textContent).toContain(
+      '1 suggestion available below'
+    )
+    expect(getSuggestions).not.toHaveBeenCalled()
+    expect(
+      fixture.nativeElement.querySelector('button[title="Suggestion options"]')
+    ).toBeNull()
+
+    button.click()
+    fixture.detectChanges()
+    expect(component.dropdown.isOpen()).toBeFalsy()
+  })
+
  it('should fetch unfetched sources and show existing suggestions', () => {
    jest.spyOn(component.getSuggestions, 'emit')
    fixture.componentRef.setInput('aiEnabled', true)
@@ -53,11 +53,7 @@ export class SuggestionsDropdownComponent {
  addCorrespondent: EventEmitter<string> = new EventEmitter()

  public clickSuggest(): void {
-    if (
-      this.disabled() ||
-      this.loading() ||
-      (this.suggestions() && !this.aiEnabled())
-    ) {
+    if (this.disabled() || this.loading()) {
      return
    }

@@ -25,6 +25,8 @@
            @if (displayFields().includes(field)) {
              <th
                scope="col"
+                class="text-truncate"
+                [title]="getColumnTitle(field)"
                [ngClass]="{
                  'd-none d-md-table-cell': i > 1,
                  'w-25': field === DisplayField.CREATED || field === DisplayField.ADDED
@@ -484,6 +484,22 @@ describe('FilterEditorComponent', () => {
    expect(component.textFilter).toBeNull()
  })

+  it('should ingest title filter rules alongside a fulltext query with date created', () => {
+    component.filterRules = [
+      {
+        rule_type: FILTER_SIMPLE_TITLE,
+        value: 'foo',
+      },
+      {
+        rule_type: FILTER_FULLTEXT_QUERY,
+        value: 'created:[-1 week to now]',
+      },
+    ]
+    expect(component.dateCreatedRelativeDate).toEqual(1) // RELATIVE_DATE_QUERYSTRINGS['-1 week to now']
+    expect(component.textFilter).toEqual('foo')
+    expect(component.textFilterTarget).toEqual('title') // TEXT_FILTER_TARGET_TITLE
+  })
+
  it('should ingest text filter rules for fulltext query that include date added', () => {
    expect(component.dateAddedRelativeDate).toBeNull()
    component.filterRules = [
@@ -1845,7 +1861,7 @@ describe('FilterEditorComponent', () => {
    ])
  })

-  it('should carry over text filtering on date created with relative date', () => {
+  it('should keep text filtering separate from date created relative date', () => {
    component.textFilter = 'foo'
    const dateCreatedDropdown = fixture.debugElement.queryAll(
      By.directive(DatesDropdownComponent)
@@ -1855,14 +1871,18 @@ describe('FilterEditorComponent', () => {
    fixture.detectChanges()
    tick(400)
    expect(component.filterRules).toEqual([
+      {
+        rule_type: FILTER_SIMPLE_TEXT,
+        value: 'foo',
+      },
      {
        rule_type: FILTER_FULLTEXT_QUERY,
-        value: 'foo,created:[-1 week to now]',
+        value: 'created:[-1 week to now]',
      },
    ])
  })

-  it('should carry over text filtering once with created and added relative dates', () => {
+  it('should keep text filtering separate from created and added relative dates', () => {
    component.textFilter = 'foo'
    const datesDropdown = fixture.debugElement.query(
      By.directive(DatesDropdownComponent)
@@ -1873,14 +1893,18 @@ describe('FilterEditorComponent', () => {
    fixture.detectChanges()
    tick(400)
    expect(component.filterRules).toEqual([
+      {
+        rule_type: FILTER_SIMPLE_TEXT,
+        value: 'foo',
+      },
      {
        rule_type: FILTER_FULLTEXT_QUERY,
-        value: 'foo,created:[-1 week to now],added:[-1 month to now]',
+        value: 'created:[-1 week to now],added:[-1 month to now]',
      },
    ])
  })

-  it('should convert legacy title filters into full text query when adding a created relative date', () => {
+  it('should keep legacy title filters as a title search when adding a created relative date', () => {
    component.filterRules = [
      {
        rule_type: FILTER_TITLE,
@@ -1895,14 +1919,18 @@ describe('FilterEditorComponent', () => {
    fixture.detectChanges()
    tick(400)
    expect(component.filterRules).toEqual([
+      {
+        rule_type: FILTER_SIMPLE_TITLE,
+        value: 'foo',
+      },
      {
        rule_type: FILTER_FULLTEXT_QUERY,
-        value: 'foo,created:[-1 week to now]',
+        value: 'created:[-1 week to now]',
      },
    ])
  })

-  it('should convert simple title filters into full text query when adding a created relative date', () => {
+  it('should keep simple title filters as a title search when adding a created relative date', () => {
    component.filterRules = [
      {
        rule_type: FILTER_SIMPLE_TITLE,
@@ -1917,9 +1945,13 @@ describe('FilterEditorComponent', () => {
    fixture.detectChanges()
    tick(400)
    expect(component.filterRules).toEqual([
+      {
+        rule_type: FILTER_SIMPLE_TITLE,
+        value: 'foo',
+      },
      {
        rule_type: FILTER_FULLTEXT_QUERY,
-        value: 'foo,created:[-1 week to now]',
+        value: 'created:[-1 week to now]',
      },
    ])
  })
@@ -2005,7 +2037,7 @@ describe('FilterEditorComponent', () => {
    ])
  })

-  it('should carry over text filtering on date added with relative date', () => {
+  it('should keep text filtering separate from date added relative date', () => {
    component.textFilter = 'foo'
    const datesDropdown = fixture.debugElement.query(
      By.directive(DatesDropdownComponent)
@@ -2015,9 +2047,13 @@ describe('FilterEditorComponent', () => {
    fixture.detectChanges()
    tick(400)
    expect(component.filterRules).toEqual([
+      {
+        rule_type: FILTER_SIMPLE_TEXT,
+        value: 'foo',
+      },
      {
        rule_type: FILTER_FULLTEXT_QUERY,
-        value: 'foo,added:[-1 week to now]',
+        value: 'added:[-1 week to now]',
      },
    ])
  })
@@ -1083,23 +1083,6 @@ export class FilterEditorComponent
        (fr) => fr.rule_type == FILTER_FULLTEXT_QUERY
      )

-      // if had a title / content search and added a relative date we need to carry it over...
-      if (
-        !existingRule &&
-        this._textFilter?.length > 0 &&
-        (this.textFilterTarget == TEXT_FILTER_TARGET_TITLE_CONTENT ||
-          this.textFilterTarget == TEXT_FILTER_TARGET_TITLE)
-      ) {
-        existingRule = filterRules.find(
-          (fr) =>
-            fr.rule_type == FILTER_TITLE_CONTENT ||
-            fr.rule_type == FILTER_SIMPLE_TEXT ||
-            fr.rule_type == FILTER_TITLE ||
-            fr.rule_type == FILTER_SIMPLE_TITLE
-        )
-        existingRule.rule_type = FILTER_FULLTEXT_QUERY
-      }
-
      let queryArgs = existingRule?.value.split(',') ?? []
      if (this.dateCreatedRelativeDate !== null) {
        const rd = RELATIVE_DATE_QUERYSTRINGS.find(
@@ -11,7 +11,7 @@
      <div class="input-group input-group-sm w-auto d-none d-md-flex">
        <label class="input-group-text bg-transparent border-0" for="managementPageSize" i18n>Show:</label>
      </div>
-      <div class="input-group input-group-sm w-auto me-3">
+      <div class="input-group input-group-sm w-auto">
        <select id="managementPageSize" class="form-select form-select-sm small" [(ngModel)]="pageSize">
          <option [ngValue]="25">25</option>
          <option [ngValue]="50">50</option>
@@ -19,7 +19,9 @@
        </select>
        <span class="input-group-text text-muted d-none d-md-flex" i18n>per page</span>
      </div>
-      <ngb-pagination [pageSize]="pageSize" [collectionSize]="collectionSize()" [page]="page()" [maxSize]="5" (pageChange)="page.set($event); reloadData()" size="sm" aria-label="Pagination"></ngb-pagination>
+      @if (collectionSize() > pageSize) {
+        <ngb-pagination [pageSize]="pageSize" [collectionSize]="collectionSize()" [page]="page()" [maxSize]="5" (pageChange)="page.set($event); reloadData()" class="ms-3" size="sm" aria-label="Pagination"></ngb-pagination>
+      }
    </div>
  </div>

@@ -70,7 +72,7 @@
        }
      </div>
    }
-    @if (collectionSize() > 20) {
+    @if (collectionSize() > pageSize) {
      <ngb-pagination class="ms-auto" [pageSize]="pageSize" [collectionSize]="collectionSize()" [page]="page()" [maxSize]="5" (pageChange)="page.set($event); reloadData()" size="sm" aria-label="Pagination"></ngb-pagination>
    }
  </div>
@@ -93,15 +93,17 @@
        [disabled]="selectedMailIds().size === 0"
        (confirm)="deleteSelected()">
      </pngx-confirm-button>
-      <div class="ms-auto">
-        <ngb-pagination
-          [collectionSize]="processedMails().length"
-          [(page)]="page"
-          [pageSize]="50"
-          [maxSize]="5"
-          (pageChange)="loadProcessedMails()">
-        </ngb-pagination>
-      </div>
+      @if (processedMails().length > 50) {
+        <div class="ms-auto">
+          <ngb-pagination
+            [collectionSize]="processedMails().length"
+            [(page)]="page"
+            [pageSize]="50"
+            [maxSize]="5"
+            (pageChange)="loadProcessedMails()">
+          </ngb-pagination>
+        </div>
+      }
    </div>
  }
 </div>
@@ -41,6 +41,7 @@ import {
  bell,
  bodyText,
  bookmark,
+  boxArrowInRight,
  boxArrowUp,
  boxArrowUpRight,
  boxes,
@@ -293,6 +294,7 @@ const icons = {
  braces,
  bodyText,
  bookmark,
+  boxArrowInRight,
  boxArrowUp,
  boxArrowUpRight,
  boxes,
@@ -54,6 +54,10 @@ def _predict_with_threshold(classifier, X, threshold: float) -> int | None:
    cutoff so that uncertain predictions are discarded rather than assigned.
    """
    probas = classifier.predict_proba(X)[0]
+    if len(classifier.classes_) == 1:
+        # scikit-learn treats a single-class fit as binary, so predict_proba
+        # returns [1 - p, p] for one class. Column 0 is the real class.
+        probas = probas[:1]
    best_idx = int(probas.argmax())
    best_class = int(classifier.classes_[best_idx])

@@ -130,12 +130,14 @@ class DocumentMetadataOverrides:
            get_users_with_perms(
                doc,
                only_with_perms_in=["view_document"],
+                with_group_users=False,
            ).values_list("id", flat=True),
        )
        overrides.change_users = list(
            get_users_with_perms(
                doc,
                only_with_perms_in=["change_document"],
+                with_group_users=False,
            ).values_list("id", flat=True),
        )
        overrides.custom_fields = {
@@ -3,6 +3,7 @@ from itertools import islice
 from pathlib import Path
 from typing import TYPE_CHECKING
 from typing import Any
+from typing import Final

 from allauth.mfa.models import Authenticator
 from allauth.socialaccount.models import SocialAccount
@@ -70,6 +71,15 @@ from paperless.models import ApplicationConfiguration
 from paperless_mail.models import MailAccount
 from paperless_mail.models import MailRule

+# Derived names replace the original's extension with these suffixes
+THUMBNAIL_SUFFIX: Final[str] = "-thumbnail.webp"
+ARCHIVE_SUFFIX: Final[str] = "-archive.pdf"
+# Leave room for the longest derived suffix, which replaces the original's extension
+MAX_BASE_NAME_BYTES: Final[int] = Document.MAX_PUBLIC_FILENAME_BYTES - max(
+    len(THUMBNAIL_SUFFIX),
+    len(ARCHIVE_SUFFIX),
+)
+

 def serialize_queryset_batched(
    queryset: "QuerySet[Any]",
@@ -512,10 +522,16 @@ class Command(CryptMixin, PaperlessCommand):
                    counter=filename_counter,
                )
            else:
-                base_name = document.get_public_filename(counter=filename_counter)
+                base_name = document.get_public_filename(
+                    counter=filename_counter,
+                    max_bytes=MAX_BASE_NAME_BYTES,
+                )

-            if base_name not in self.exported_files:
-                self.exported_files.add(base_name)
+            # The thumbnail and archive names are derived from the stem, so
+            # uniqueness must hold without the original's extension
+            unique_key = str(Path(base_name).with_suffix(""))
+            if unique_key not in self.exported_files:
+                self.exported_files.add(unique_key)
                break
            else:
                filename_counter += 1
@@ -538,7 +554,7 @@ class Command(CryptMixin, PaperlessCommand):
        document_dict[EXPORTER_FILE_NAME] = original_arc

        if not self.no_thumbnail:
-            thumbnail_name = base_name.parent / (base_name.stem + "-thumbnail.webp")
+            thumbnail_name = base_name.parent / (base_name.stem + THUMBNAIL_SUFFIX)
            if self.use_folder_prefix:
                thumbnail_name = Path("thumbnails") / thumbnail_name
            thumbnail_arc = thumbnail_name.as_posix()
@@ -547,7 +563,7 @@ class Command(CryptMixin, PaperlessCommand):
            thumbnail_arc = None

        if not self.no_archive and document.has_archive_version:
-            archive_name = base_name.parent / (base_name.stem + "-archive.pdf")
+            archive_name = base_name.parent / (base_name.stem + ARCHIVE_SUFFIX)
            if self.use_folder_prefix:
                archive_name = Path("archive") / archive_name
            archive_arc = archive_name.as_posix()
@@ -66,7 +66,7 @@ def iter_manifest_records(path: Path) -> Generator[dict, None, None]:
    """Yield records one at a time from a manifest JSON array via ijson."""
    try:
        with path.open("rb") as f:
-            yield from ijson.items(f, "item")
+            yield from ijson.items(f, "item", use_float=True)
    except ijson.JSONError as e:
        raise CommandError(f"Failed to parse manifest file {path}: {e}") from e

@@ -157,6 +157,8 @@ class StoragePath(MatchingModel):

 class Document(SoftDeleteModel, ModelWithOwner):  # type: ignore[django-manager-missing]
    MAX_STORED_FILENAME_LENGTH: Final[int] = 1024
+    # Per-component limit of common filesystems (ext4, XFS, btrfs, ZFS, APFS)
+    MAX_PUBLIC_FILENAME_BYTES: Final[int] = 255

    correspondent = models.ForeignKey(
        Correspondent,
@@ -484,28 +486,37 @@ class Document(SoftDeleteModel, ModelWithOwner):  # type: ignore[django-manager-
    def archive_file(self):
        return Path(self.archive_path).open("rb")

-    def get_public_filename(self, *, archive=False, counter=0, suffix=None) -> str:
+    def get_public_filename(
+        self,
+        *,
+        archive: bool = False,
+        counter: int = 0,
+        max_bytes: int = MAX_PUBLIC_FILENAME_BYTES,
+    ) -> str:
        """
        Returns a sanitized filename for the document, not including any paths.
+
+        The name fits in max_bytes (UTF-8). A long title is shortened before
+        the counter and extension are appended, because sanitize_filename
+        truncates from the end. The tail is cut only when max_bytes is
+        smaller than the tail itself.
        """
        # Root owns metadata for all versions
        context_document = (
            self.root_document if self.root_document_id is not None else self
        )
-        result = str(context_document)

-        if counter:
-            result += f"_{counter:02}"
+        extension = ".pdf" if archive else self.file_type
+        tail = f"_{counter:02}{extension}" if counter else extension

-        if suffix:
-            result += suffix
+        head_bytes = max(0, max_bytes - len(tail.encode()))
+        head = str(context_document).encode()[:head_bytes].decode(errors="ignore")

-        if archive:
-            result += ".pdf"
-        else:
-            result += self.file_type
-
-        return pathvalidate.sanitize_filename(result, replacement_text="-")
+        return pathvalidate.sanitize_filename(
+            head + tail,
+            replacement_text="-",
+            max_len=max_bytes,
+        )

    @property
    def file_type(self):
@@ -511,6 +511,28 @@ def restrict_queryset_to_visible(
    return queryset.filter(pk__in=permitted_object_ids(user, queryset.model, perm))


+def user_is_active_superuser(user: User | None) -> bool:
+    """
+    True only for an active, authenticated superuser.
+    """
+    return user is not None and user_is_unrestricted(user)
+
+
+def restrict_queryset_to_owner_visible(
+    queryset: QuerySet[ModelT],
+    user: User | None,
+    perm: str,
+) -> QuerySet[ModelT]:
+    """
+    Like ``restrict_queryset_to_visible``, but ``user=None`` sees only unowned
+    rows (``permitted_object_ids(None, ...)`` semantics) instead of every row.
+    See ``user_is_active_superuser``.
+    """
+    if user_is_active_superuser(user):
+        return queryset
+    return queryset.filter(pk__in=permitted_object_ids(user, queryset.model, perm))
+
+
 def permitted_document_ids(
    user: User | None,
    *,
@@ -926,6 +926,7 @@ class TantivyBackend:
        sort_field: str | None = None,
        sort_reverse: bool = False,
        search_mode: SearchMode = SearchMode.QUERY,
+        filter_query: str | None = None,
        limit: int | None = None,
    ) -> list[int]:
        """
@@ -941,6 +942,7 @@ class TantivyBackend:
            sort_field: Field to sort by (None for relevance ranking)
            sort_reverse: Whether to reverse the sort order
            search_mode: Query parsing mode (QUERY, TEXT, or TITLE)
+            filter_query: Optional advanced query results must also match
            limit: Maximum number of IDs to return (None = all matching docs)

        Returns:
@@ -948,6 +950,13 @@ class TantivyBackend:
        """
        self._ensure_open()
        user_query = self._parse_query(query, search_mode)
+        if filter_query is not None:
+            user_query = user_query.and_must_match(
+                tantivy.Query.const_score_query(
+                    self._parse_query(filter_query, SearchMode.QUERY),
+                    0.0,  # zero so doesn't affect relevance
+                ),
+            )
        final_query = self._apply_permission_filter(user_query, user)

        searcher = self._index.searcher()
@@ -835,6 +835,7 @@ class TestBulkEditAPI(DirectoriesMixin, APITestCase):
        for filters in (
            {"text": "new doc 2017-03-16"},
            {"title_search": "apple"},
+            {"title_search": "apple", "query": "created:[-1 year to now]"},
        ):
            with self.subTest(filters=filters):
                get_backend.return_value.search_ids.return_value = [self.doc2.id]
@@ -886,7 +887,7 @@ class TestBulkEditAPI(DirectoriesMixin, APITestCase):
                    "all": True,
                    "filters": {
                        "text": "B",
-                        "query": "c1",
+                        "title_search": "c1",
                    },
                    "method": "set_storage_path",
                    "parameters": {"storage_path": self.sp1.id},
@@ -245,8 +245,68 @@ class TestDocumentSearchApi(DirectoriesMixin, APITestCase):
        self.assertEqual(response.data["count"], 1)
        self.assertEqual(response.data["results"][0]["id"], title_match.id)

+    def test_simple_search_combined_with_query_filter(self) -> None:
+        """
+        GIVEN:
+            - A document with the term in its title, created this year
+            - A document with the term only in its content, created this year
+            - A document with the term in its title, created years ago
+        WHEN:
+            - A title or text search is combined with a relative created
+              date query, as the filter editor sends it
+        THEN:
+            - The simple search keeps its own field scope and the query only
+              narrows the results (issue #14436)
+        """
+        this_year = timezone.localdate().replace(month=1, day=1)
+        title_match = Document.objects.create(
+            title="foo report",
+            content="nothing relevant",
+            checksum="F1",
+            created=this_year,
+            pk=21,
+        )
+        content_match = Document.objects.create(
+            title="something else",
+            content="foo appears here",
+            checksum="F2",
+            created=this_year,
+            pk=22,
+        )
+        old_title_match = Document.objects.create(
+            title="foo archive",
+            content="nothing relevant",
+            checksum="F3",
+            created=datetime.date(2001, 1, 1),
+            pk=23,
+        )
+        backend = get_backend()
+        for doc in (title_match, content_match, old_title_match):
+            backend.add_or_update(doc)
+
+        query = "created:[-1 year to now]"
+        response = self.client.get(
+            "/api/documents/",
+            {"title_search": "foo", "query": query},
+        )
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertEqual(
+            [r["id"] for r in response.data["results"]],
+            [title_match.id],
+        )
+
+        response = self.client.get(
+            "/api/documents/",
+            {"text": "foo", "query": query},
+        )
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertCountEqual(
+            [r["id"] for r in response.data["results"]],
+            [title_match.id, content_match.id],
+        )
+
    def test_search_rejects_multiple_search_modes(self) -> None:
-        response = self.client.get("/api/documents/?text=bank&query=bank")
+        response = self.client.get("/api/documents/?text=bank&title_search=bank")
        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
        self.assertEqual(
            response.data["detail"],
@@ -14,6 +14,7 @@ from django.test import override_settings
 from django.test.utils import CaptureQueriesContext
 from pytest_django.fixtures import Settings
 from pytest_mock import MockerFixture
+from sklearn.neural_network import MLPClassifier

 from documents.classifier import ClassifierModelCorruptError
 from documents.classifier import DocumentClassifier
@@ -1036,6 +1037,49 @@ def test_classifier_match_threshold_default() -> None:
    assert settings.CLASSIFIER_MATCH_THRESHOLD == 0.3


+class TestPredictWithThresholdSingleClass:
+    @pytest.fixture
+    def single_class_model(self) -> tuple[MLPClassifier, np.ndarray]:
+        X = np.random.default_rng(0).random((2, 5))
+        return MLPClassifier(tol=0.01, random_state=0).fit(X, [3, 3]), X[:1]
+
+    def test_returns_only_class(
+        self,
+        single_class_model: tuple[MLPClassifier, np.ndarray],
+    ) -> None:
+        """
+        GIVEN:
+            - A classifier fitted on a single class (every document shares one label)
+        WHEN:
+            - A prediction is requested with the threshold disabled
+        THEN:
+            - No error is raised and the only class is returned
+        """
+        classifier, X = single_class_model
+
+        assert _predict_with_threshold(classifier, X, threshold=0.0) == 3
+
+    def test_applies_threshold(
+        self,
+        single_class_model: tuple[MLPClassifier, np.ndarray],
+    ) -> None:
+        """
+        GIVEN:
+            - A classifier fitted on a single class
+        WHEN:
+            - A prediction is requested
+        THEN:
+            - The class's confidence is still compared against the threshold
+        """
+        classifier, X = single_class_model
+        confidence = classifier.predict_proba(X)[0][0]
+
+        assert _predict_with_threshold(classifier, X, threshold=confidence - 0.01) == 3
+        assert (
+            _predict_with_threshold(classifier, X, threshold=confidence + 0.01) is None
+        )
+
+
 class TestPreprocessContent:
    @pytest.fixture
    def samples(self) -> Path:
@@ -34,8 +34,10 @@ from documents.tests.utils import GetConsumerMixin
 from paperless_mail.models import MailRule
 from paperless_testing.assertions import FileSystemAssertsMixin
 from paperless_testing.dirs import DirectoriesMixin
+from paperless_testing.factories import DocumentFactory
 from paperless_testing.factories import UserFactory
 from paperless_testing.fakes.progress import FakeProgressManager
+from paperless_testing.permissions import grant_object


 class _BaseNewStyleParser:
@@ -1683,6 +1685,32 @@ class TestMetadataOverrides(TestCase):
        self.assertEqual(base.actor_id, 2)
        self.assertEqual(base.version_label, "v2")

+    def test_from_document_copies_user_and_group_grants_separately(self) -> None:
+        """
+        GIVEN:
+            - A document with view and change granted directly to one user and
+              to a group with another user as a member
+        WHEN:
+            - Overrides are built from the document
+        THEN:
+            - The user lists hold only the directly granted user
+            - The group lists hold the group
+        """
+        direct_user = UserFactory()
+        group_member = UserFactory()
+        group = Group.objects.create(name="group")
+        group_member.groups.add(group)
+        document = DocumentFactory()
+        grant_object(direct_user, document, "view_document", "change_document")
+        grant_object(group, document, "view_document", "change_document")
+
+        overrides = DocumentMetadataOverrides.from_document(document)
+
+        self.assertEqual(overrides.view_users, [direct_user.pk])
+        self.assertEqual(overrides.change_users, [direct_user.pk])
+        self.assertEqual(overrides.view_groups, [group.pk])
+        self.assertEqual(overrides.change_groups, [group.pk])
+

 class TestBarcodeApplyDetectedASN(TestCase):
    """
@@ -4,13 +4,16 @@ from datetime import date
 from pathlib import Path
 from unittest import mock

+import pytest
 from django.test import TestCase
 from django.test import override_settings
 from faker import Faker
+from pytest_mock import MockerFixture

 from documents.models import Correspondent
 from documents.models import Document
 from documents.tasks import empty_trash
+from paperless_testing.factories import DocumentFactory


 class TestDocument(TestCase):
@@ -257,3 +260,72 @@ def test_suggestion_content() -> None:
    )
    doc.content = content_over_limit
    assert doc.suggestion_content == expected_cropped_content
+
+
+class TestPublicFilenameLength:
+    @pytest.fixture(autouse=True)
+    def _no_parser_registry(self, mocker: MockerFixture) -> None:
+        # The parser registry reads ApplicationConfiguration from the database
+        extensions = {"application/pdf": ".pdf", "image/jpeg": ".jpg"}
+        mocker.patch(
+            "documents.models.get_default_file_extension",
+            side_effect=extensions.__getitem__,
+        )
+
+    LIMIT = Document.MAX_PUBLIC_FILENAME_BYTES
+
+    @pytest.mark.parametrize(
+        ("title", "archive", "counter", "max_bytes", "tail"),
+        [
+            pytest.param("a" * 300, False, 0, LIMIT, ".jpg", id="ascii"),
+            pytest.param("a" * 300, True, 0, LIMIT, ".pdf", id="archive"),
+            pytest.param("ä" * 200, False, 0, LIMIT, ".jpg", id="umlaut"),
+            pytest.param("ä" * 200, False, 1, LIMIT, "_01.jpg", id="count"),
+            pytest.param("a" * 300, False, 1, 100, "_01.jpg", id="max"),
+        ],
+    )
+    def test_long_title_keeps_tail_within_limit(
+        self,
+        title: str,
+        *,
+        archive: bool,
+        counter: int,
+        max_bytes: int,
+        tail: str,
+    ) -> None:
+        """
+        GIVEN:
+            - A document whose title alone is longer than the byte limit
+        WHEN:
+            - The public file name is generated
+        THEN:
+            - The name ends with the counter and extension
+            - The name fits in the limit
+        """
+        name = DocumentFactory.build(
+            title=title,
+            mime_type="image/jpeg",
+        ).get_public_filename(
+            archive=archive,
+            counter=counter,
+            max_bytes=max_bytes,
+        )
+
+        assert name.endswith(tail)
+        assert len(name.encode()) <= max_bytes
+
+    def test_long_title_counters_give_distinct_names(self) -> None:
+        """
+        GIVEN:
+            - A document whose title alone is longer than the byte limit
+        WHEN:
+            - Public file names are generated with increasing counters
+        THEN:
+            - Each counter produces a distinct name
+        """
+        doc = DocumentFactory.build(title="ä" * 200, mime_type="application/pdf")
+
+        names = [doc.get_public_filename(counter=counter) for counter in range(3)]
+
+        assert len(set(names)) == 3
+        assert all(len(n.encode()) <= self.LIMIT for n in names)
@@ -2,6 +2,7 @@ import hashlib
 import json
 import shutil
 import tempfile
+from datetime import date
 from datetime import timedelta
 from io import StringIO
 from pathlib import Path
@@ -44,14 +45,19 @@ from documents.models import Workflow
 from documents.models import WorkflowAction
 from documents.models import WorkflowTrigger
 from documents.sanity_checker import check_sanity
+from documents.settings import EXPORTER_ARCHIVE_NAME
 from documents.settings import EXPORTER_FILE_NAME
 from documents.settings import EXPORTER_SHARE_LINK_BUNDLE_NAME
+from documents.settings import EXPORTER_THUMBNAIL_NAME
 from documents.tests.utils import SampleDirMixin
+from paperless.models import ApplicationConfiguration
 from paperless_mail.models import MailAccount
 from paperless_testing.assertions import FileSystemAssertsMixin
 from paperless_testing.dirs import DirectoriesMixin
+from paperless_testing.dirs import PaperlessDirs
 from paperless_testing.dirs import paperless_environment
 from paperless_testing.factories import DocumentBarcodeFactory
+from paperless_testing.factories import DocumentFactory
 from paperless_testing.permissions import grant_object


@@ -1397,6 +1403,45 @@ class TestCryptExportImport(
        social_token = SocialToken.objects.first()
        self.assertIsNotNone(social_token)

+    def test_import_passphrase_with_float_field(self) -> None:
+        """
+        GIVEN:
+            - An application configuration with a float field set
+        WHEN:
+            - Export and import are run with a passphrase
+        THEN:
+            - The import succeeds and the float value is preserved
+        """
+        ApplicationConfiguration.objects.update_or_create(
+            pk=1,
+            defaults={"rotate_pages_threshold": 12.5},
+        )
+
+        call_command(
+            "document_exporter",
+            "--no-progress-bar",
+            "--passphrase",
+            "securepassword",
+            self.target,
+            skip_checks=True,
+        )
+
+        ApplicationConfiguration.objects.all().delete()
+
+        call_command(
+            "document_importer",
+            "--no-progress-bar",
+            "--passphrase",
+            "securepassword",
+            self.target,
+            skip_checks=True,
+        )
+
+        self.assertEqual(
+            ApplicationConfiguration.objects.get().rotate_pages_threshold,
+            12.5,
+        )
+
    def test_import_crypt_no_passphrase(self) -> None:
        """
        GIVEN:
@@ -1462,3 +1507,140 @@ class TestCryptExportImport(
            ("No passphrase was given, sensitive fields will be in plaintext"),
            stdout.read(),
        )
+
+
+@pytest.mark.management
+@pytest.mark.django_db
+class TestExportDerivedFileNameCollisions:
+    def test_same_stem_different_extension_get_distinct_derived_files(
+        self,
+        paperless_dirs: PaperlessDirs,
+        tmp_path: Path,
+    ) -> None:
+        """
+        GIVEN:
+            - Two documents with the same title and created date
+            - One original is a PDF, the other a PNG, both with archive and thumbnail
+        WHEN:
+            - The exporter runs
+        THEN:
+            - Each document is exported under a distinct original, thumbnail and archive name
+            - Each exported file holds its own document's content
+        """
+        for pk, (filename, mime_type) in enumerate(
+            [("collide.pdf", "application/pdf"), ("collide.png", "image/png")],
+            start=1,
+        ):
+            (paperless_dirs.originals_dir / filename).write_bytes(
+                f"original {pk}".encode(),
+            )
+            (paperless_dirs.archive_dir / f"{pk:07}.pdf").write_bytes(
+                f"archive {pk}".encode(),
+            )
+            (paperless_dirs.thumbnail_dir / f"{pk:07}.webp").write_bytes(
+                f"thumbnail {pk}".encode(),
+            )
+            DocumentFactory(
+                pk=pk,
+                title="collide",
+                created=date(2026, 10, 7),
+                filename=filename,
+                archive_filename=f"{pk:07}.pdf",
+                mime_type=mime_type,
+            )
+
+        target = tmp_path / "export"
+        target.mkdir()
+        call_command(
+            "document_exporter",
+            str(target),
+            "--no-progress-bar",
+            skip_checks=True,
+        )
+
+        manifest = json.loads((target / "manifest.json").read_text())
+        records = {r["pk"]: r for r in manifest if r["model"] == "documents.document"}
+
+        for key in (
+            EXPORTER_FILE_NAME,
+            EXPORTER_THUMBNAIL_NAME,
+            EXPORTER_ARCHIVE_NAME,
+        ):
+            assert records[1][key] != records[2][key]
+
+        for pk in (1, 2):
+            record = records[pk]
+            assert (target / record[EXPORTER_FILE_NAME]).read_text() == f"original {pk}"
+            assert (
+                target / record[EXPORTER_THUMBNAIL_NAME]
+            ).read_text() == f"thumbnail {pk}"
+            assert (
+                target / record[EXPORTER_ARCHIVE_NAME]
+            ).read_text() == f"archive {pk}"
+
+    def test_long_titles_export_within_file_name_limit(
+        self,
+        paperless_dirs: PaperlessDirs,
+        tmp_path: Path,
+    ) -> None:
+        """
+        GIVEN:
+            - Two documents with the same created date and the same title
+            - The title alone is longer than 255 bytes and contains umlauts
+        WHEN:
+            - The exporter runs
+        THEN:
+            - The export finishes with distinct original, thumbnail and archive names
+            - Every exported file name fits in the byte limit
+            - Each exported file holds its own document's content
+        """
+        for pk in (1, 2):
+            (paperless_dirs.originals_dir / f"{pk:07}.pdf").write_bytes(
+                f"original {pk}".encode(),
+            )
+            (paperless_dirs.archive_dir / f"{pk:07}.pdf").write_bytes(
+                f"archive {pk}".encode(),
+            )
+            (paperless_dirs.thumbnail_dir / f"{pk:07}.webp").write_bytes(
+                f"thumbnail {pk}".encode(),
+            )
+            DocumentFactory(
+                pk=pk,
+                title="Bestellbestätigung " * 15,
+                created=date(2026, 10, 15),
+                filename=f"{pk:07}.pdf",
+                archive_filename=f"{pk:07}.pdf",
+                mime_type="application/pdf",
+            )
+
+        target = tmp_path / "export"
+        target.mkdir()
+        call_command(
+            "document_exporter",
+            str(target),
+            "--no-progress-bar",
+            skip_checks=True,
+        )
+
+        manifest = json.loads((target / "manifest.json").read_text())
+        records = {r["pk"]: r for r in manifest if r["model"] == "documents.document"}
+
+        for key in (
+            EXPORTER_FILE_NAME,
+            EXPORTER_THUMBNAIL_NAME,
+            EXPORTER_ARCHIVE_NAME,
+        ):
+            assert records[1][key] != records[2][key]
+
+        for pk in (1, 2):
+            record = records[pk]
+            for key, content in (
+                (EXPORTER_FILE_NAME, f"original {pk}"),
+                (EXPORTER_THUMBNAIL_NAME, f"thumbnail {pk}"),
+                (EXPORTER_ARCHIVE_NAME, f"archive {pk}"),
+            ):
+                assert (
+                    len(Path(record[key]).name.encode())
+                    <= Document.MAX_PUBLIC_FILENAME_BYTES
+                )
+                assert (target / record[key]).read_text() == content
@@ -7,6 +7,7 @@ from unittest import mock

 from django.conf import settings
 from django.contrib.auth.models import User
+from django.test import override_settings
 from django.utils import timezone
 from rest_framework import serializers
 from rest_framework import status
@@ -225,6 +226,25 @@ class ShareLinkBundleAPITests(DirectoriesMixin, APITestCase):
        self.assertEqual(response.status_code, status.HTTP_302_FOUND)
        self.assertIn("sharelink_notfound=1", response["Location"])

+    @override_settings(LOGIN_URL="/paperless/accounts/login/")
+    def test_unknown_share_link_redirects_under_subpath(self) -> None:
+        """
+        GIVEN:
+            - Paperless is served under a subpath
+        WHEN:
+            - An unknown public share link is requested
+        THEN:
+            - The redirect to the login page keeps the subpath
+        """
+        self.client.logout()
+        response = self.client.get("/share/unknownsharelink/")
+
+        self.assertEqual(response.status_code, status.HTTP_302_FOUND)
+        self.assertEqual(
+            response["Location"],
+            "/paperless/accounts/login/?sharelink_notfound=1",
+        )
+
    def test_share_link_missing_file_redirects(self) -> None:
        """
        GIVEN:
@@ -6176,6 +6176,50 @@ class TestApplyAISuggestionsWorkflowAction(

        self.assertEqual(self.doc.tags.count(), 0)

+    def test_unowned_document_does_not_get_private_objects_by_id(self) -> None:
+        """
+        GIVEN:
+            - An unowned document
+            - AI suggestions selecting another user's private tag and
+              correspondent by ID, plus an unowned tag
+        WHEN:
+            - The suggestions are applied
+        THEN:
+            - Only the unowned tag is assigned; an unowned document must not
+              be treated as unrestricted
+        """
+        self.doc.owner = None
+        self.doc.save(update_fields=["owner"])
+        other = User.objects.create(username="someone-else")
+        private_tag = Tag.objects.create(name="Private Tag", owner=other)
+        public_tag = Tag.objects.create(name="Public Tag", owner=None)
+        private_correspondent = Correspondent.objects.create(
+            name="Private Correspondent",
+            owner=other,
+        )
+        action = self.make_action(
+            ai_suggestion_fields=[
+                WorkflowAction.AISuggestionField.TAGS,
+                WorkflowAction.AISuggestionField.CORRESPONDENT,
+            ],
+        )
+        suggestions: ClassificationSuggestions = {
+            **SUGGESTIONS,
+            "tags": {
+                "existing_ids": [private_tag.pk, public_tag.pk],
+                "new_names": [],
+            },
+            "correspondents": {
+                "existing_ids": [private_correspondent.pk],
+                "new_names": [],
+            },
+        }
+
+        self.apply(action, suggestions)
+
+        self.assertEqual(list(self.doc.tags.all()), [public_tag])
+        self.assertIsNone(self.doc.correspondent)
+
    def test_unparsable_dates_are_skipped(self) -> None:
        """
        GIVEN:
@@ -289,6 +289,7 @@ logger = logging.getLogger("paperless.api")
 # clauses efficiently, so this threshold mainly protects SQLite users.
 _TANTIVY_INTERSECT_THRESHOLD = 5_000
 _TANTIVY_SEARCH_PARAM_NAMES = ("text", "title_search", "query", "more_like_id")
+_TANTIVY_COMBINABLE_SEARCH_PARAMS = ({"text", "query"}, {"title_search", "query"})

 # whoosh-compat's fieldname tagger (used only for SearchMode.QUERY, via the
 # whoosh grammar in parse_user_query) is O(n^2) in plain word characters:
@@ -308,6 +309,18 @@ _TANTIVY_SEARCH_PARAM_NAMES = ("text", "title_search", "query", "more_like_id")
 _MAX_QUERY_LENGTH: Final[int] = 4096


+def _validate_tantivy_search_params(active: list[str]) -> None:
+    # may also have a filter query alongside a simple search e.g. relative dates
+    if len(active) > 1 and set(active) not in _TANTIVY_COMBINABLE_SEARCH_PARAMS:
+        raise ValidationError(
+            {
+                "detail": _(
+                    "Specify only one of text, title_search, query, or more_like_id.",
+                ),
+            },
+        )
+
+
 def _get_tantivy_query_and_mode(params):
    from documents.search import QueryTooLongError
    from documents.search import SearchMode
@@ -321,9 +334,15 @@ def _get_tantivy_query_and_mode(params):
    else:
        return None  # pragma: no cover

-    if len(raw) > _MAX_QUERY_LENGTH:
-        raise QueryTooLongError(len(raw), _MAX_QUERY_LENGTH)
-    return raw, mode
+    filter_query = (
+        str(params["query"])
+        if mode is not SearchMode.QUERY and "query" in params
+        else None
+    )
+    for value in (raw, filter_query):
+        if value is not None and len(value) > _MAX_QUERY_LENGTH:
+            raise QueryTooLongError(len(value), _MAX_QUERY_LENGTH)
+    return raw, mode, filter_query


 def _get_more_like_id(query_params: dict[str, Any], user: User | None) -> int:
@@ -2566,15 +2585,9 @@ class UnifiedSearchViewSet(DocumentViewSet):

        def parse_search_params() -> SearchParams:
            """Extract query string, search mode, and ordering from request."""
-            active = self._get_active_search_params(request)
-            if len(active) > 1:
-                raise ValidationError(
-                    {
-                        "detail": _(
-                            "Specify only one of text, title_search, query, or more_like_id.",
-                        ),
-                    },
-                )
+            _validate_tantivy_search_params(
+                self._get_active_search_params(request),
+            )

            ordering_param = request.query_params.get("ordering", "")
            sort_reverse = ordering_param.startswith("-")
@@ -2636,7 +2649,9 @@ class UnifiedSearchViewSet(DocumentViewSet):
            filtered_qs: QuerySet[Document],
        ) -> SearchResultPage:
            """Handle text/title/query search: IDs, ORM intersection, page highlights."""
-            query_str, search_mode = _get_tantivy_query_and_mode(request.query_params)
+            query_str, search_mode, filter_query = _get_tantivy_query_and_mode(
+                request.query_params,
+            )

            # "score" is not a real Tantivy sort field — it means relevance order,
            # which is Tantivy's default when no sort field is specified.
@@ -2649,6 +2664,7 @@ class UnifiedSearchViewSet(DocumentViewSet):
                ),
                sort_reverse=sort_reverse,
                search_mode=search_mode,
+                filter_query=filter_query,
            )
            ordered_ids = intersect_and_order(
                all_ids,
@@ -2883,14 +2899,7 @@ class DocumentSelectionMixin:
        ]
        if not search_filters:
            return None
-        if len(search_filters) > 1:
-            raise ValidationError(
-                {
-                    "detail": _(
-                        "Specify only one of text, title_search, query, or more_like_id.",
-                    ),
-                },
-            )
+        _validate_tantivy_search_params(search_filters)

        from documents.search import SearchQueryError
        from documents.search import get_backend
@@ -2909,11 +2918,14 @@ class DocumentSelectionMixin:
                    user=search_user,
                )
            else:
-                query_str, search_mode = _get_tantivy_query_and_mode(filters)
+                query_str, search_mode, filter_query = _get_tantivy_query_and_mode(
+                    filters,
+                )
                search_ids = backend.search_ids(
                    query_str,
                    user=search_user,
                    search_mode=search_mode,
+                    filter_query=filter_query,
                )
        except SearchQueryError as e:
            # Same user-fixable-query mapping as the search list endpoint:
@@ -4899,7 +4911,7 @@ class SharedLinkView(View):
                share_link.expiration is not None
                and share_link.expiration < timezone.now()
            ):
-                return HttpResponseRedirect("/accounts/login/?sharelink_expired=1")
+                return HttpResponseRedirect(f"{settings.LOGIN_URL}?sharelink_expired=1")
            try:
                return serve_file(
                    doc=share_link.document,
@@ -4908,14 +4920,16 @@ class SharedLinkView(View):
                    disposition="inline",
                )
            except FileNotFoundError:
-                return HttpResponseRedirect("/accounts/login/?sharelink_notfound=1")
+                return HttpResponseRedirect(
+                    f"{settings.LOGIN_URL}?sharelink_notfound=1",
+                )

        bundle = ShareLinkBundle.objects.filter(slug=slug).first()
        if bundle is None:
-            return HttpResponseRedirect("/accounts/login/?sharelink_notfound=1")
+            return HttpResponseRedirect(f"{settings.LOGIN_URL}?sharelink_notfound=1")

        if bundle.expiration is not None and bundle.expiration < timezone.now():
-            return HttpResponseRedirect("/accounts/login/?sharelink_expired=1")
+            return HttpResponseRedirect(f"{settings.LOGIN_URL}?sharelink_expired=1")

        if bundle.status in {
            ShareLinkBundle.Status.PENDING,
Author	SHA1	Message	Date
Crowdin Bot	a39b093f6d	New Crowdin translations by GitHub Action	2026-10-19 12:31:23 +00:00
GitHub Actions	c21deaa452	Auto translate strings	2026-10-19 06:20:40 +00:00
shamoon	c47766121d	Fix: remove some redundant pagers (#14487 )	2026-10-18 23:19:24 -07:00
GitHub Actions	979bcd3896	Auto translate strings	2026-10-19 06:05:02 +00:00
shamoon	d450f03d5f	Fix: prevent weird wrapping of dashboard widget column titles (#14486 )	2026-10-18 23:03:43 -07:00
GitHub Actions	730c2d8688	Auto translate strings	2026-10-19 03:23:47 +00:00
shamoon	b1738c85d7	Fix: dont paginate 'all' tasks view across sections (#14484 )	2026-10-18 20:22:18 -07:00
Trenton H	a8b835fcd0	Fix: use float parsing for importer manifest records with a passphrase (#14483 )	2026-10-18 15:16:13 -07:00
GitHub Actions	41498113d3	Auto translate strings	2026-10-18 14:29:34 +00:00
Jaime Velaz Dominguez Claude Opus 5.5 shamoon	309a4b004d	Fix: respect subpath in logout, share link and auto-login redirects (#14476 ) --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: shamoon <4887959+shamoon@users.noreply.github.com>	2026-10-18 14:28:15 +00:00
GitHub Actions	961f7fd672	Auto translate strings	2026-10-18 00:30:41 +00:00
shamoon	de94657e17	Fix: dont tie suggestions button to ai enabled any more (#14478 )	2026-10-17 17:29:29 -07:00
Trenton H	0cb2cdbfdd	Fix: handle single-class classifier in threshold prediction (#14471 ) (#14473 ) scikit-learn treats a single-class fit as binary, so predict_proba returns [1 - p, p] for one class and argmax could index past classes_. Use only column 0, the real class, so the confidence threshold still applies.	2026-10-16 10:47:58 -07:00
GitHub Actions	1f3d451a3a	Auto translate strings	2026-10-16 17:12:50 +00:00
Trenton H	183cfd2da4	Fix: keep counter and extension when shortening long public filenames (#14472 ) get_public_filename relied on sanitize_filename to truncate, which cuts from the end and so dropped the counter and extension of long titles. Multi-byte titles could also exceed the 255 byte filesystem limit. Shorten the title by UTF-8 bytes before appending the counter and extension. The exporter reserves room for its longer derived thumbnail and archive suffixes.	2026-10-16 10:11:34 -07:00
shamoon	30a24ee02e	Chore: disable deprecated ts-jest isolation override	2026-10-15 22:51:55 -07:00
github-actions[bot]andCrowdin Bot	1943c99b27	New Crowdin translations by GitHub Action (#14449 ) Co-authored-by: Crowdin Bot <support+bot@crowdin.com>	2026-10-15 22:51:00 -07:00
shamoon	8b26ecafb6	Fix: prevent ownerless docs leaking others in to LLM prompts	2026-10-15 22:42:34 -07:00
Trenton H	d4a57204eb	Fix: copy only direct user grants in DocumentMetadataOverrides.from_document (#14452 ) get_users_with_perms includes group members by default, so PDF actions such as merge and split gave them direct grants on the new documents, which outlived their group membership.	2026-10-15 15:11:28 -07:00
dependabot[bot]	c50c6f5517	Chore(deps): Bump filelock from 3.32.6 to 4.0.12 (#14336 ) Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.32.6 to 4.0.12. - [Release notes](https://github.com/tox-dev/py-filelock/releases) - [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst) - [Commits](https://github.com/tox-dev/py-filelock/compare/3.32.6...4.0.12) --- updated-dependencies: - dependency-name: filelock dependency-version: 4.0.3 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-14 16:11:12 -07:00
GitHub Actions	34a6c718fa	Auto translate strings	2026-10-14 15:18:54 +00:00
shamoon	14aaa42777	Fix: support combined text/query searches (#14443 )	2026-10-14 08:17:22 -07:00
shamoon	c86c822bc7	Fix ai auto-close message	2026-10-13 12:15:28 -07:00
dependabot[bot]	b23b118a49	Chore(deps): Bump the uv group across 1 directory with 3 updates (#14418 ) Bumps the uv group with 3 updates in the / directory: [banks](https://github.com/masci/banks), [fsspec](https://github.com/fsspec/filesystem_spec) and [multidict](https://github.com/aio-libs/multidict). Updates `banks` from 2.4.5 to 2.5.1 - [Release notes](https://github.com/masci/banks/releases) - [Commits](https://github.com/masci/banks/compare/v2.4.5...v2.5.1) Updates `fsspec` from 2026.1.0 to 2026.6.0 - [Commits](https://github.com/fsspec/filesystem_spec/compare/2026.1.0...2026.6.0) Updates `multidict` from 6.7.1 to 6.9.1 - [Release notes](https://github.com/aio-libs/multidict/releases) - [Changelog](https://github.com/aio-libs/multidict/blob/master/CHANGES.rst) - [Commits](https://github.com/aio-libs/multidict/compare/v6.7.1...v6.9.1) --- updated-dependencies: - dependency-name: banks dependency-version: 2.5.1 dependency-type: indirect - dependency-name: fsspec dependency-version: 2026.6.0 dependency-type: indirect - dependency-name: multidict dependency-version: 6.9.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-13 17:25:40 +00:00
Trenton H	6e717817c6	Fix: make exporter derived file names unique when originals differ only by extension (#14429 )	2026-10-12 15:14:08 -07:00
shamoon	3e0fa73771	Chore: adjust issue auto-triage	2026-10-12 14:16:45 -07:00
github-actions[bot]andshamoon	2b00cf6a95	Documentation: Add v3.3.1 changelog (#14427 ) * Changelog v3.3.1 - GHA * Update changelog for paperless-ngx 3.3.1 Removed MARIADB_HOST documentation from MariaDB compose files. --------- Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: shamoon <4887959+shamoon@users.noreply.github.com>	2026-10-12 13:22:46 -07:00