paperless-ngx Release Notes

Note
This release addresses a security issue (GHSA-x395-6h48-wr8v) and is recommended for all users. Our sincere thank you to the community members who reported this.

paperless-ngx 2.20.7

Breaking

Filename template rendering now uses a restricted safe document context for storage paths. Templates relying on unexpected/undocumented document model properties may no longer render and will fall back to default filename formatting.

Bug Fixes

• Fix: correct user dropdown button icon styling @shamoon (#12092)
• Fix: fix broken docker create_classifier command in 2.20.6 @shamoon (#11965)
• Performance fix: use subqueries to improve object retrieval in large installs @shamoon (#11950)

All App Changes

3 changes

• Fix: correct user dropdown button icon styling @shamoon (#12092)
• Fix: fix broken docker create_classifier command in 2.20.6 @shamoon (#11965)
• Performance fix: use subqueries to improve object retrieval in large installs @shamoon (#11950)

Note

This release addresses two security issues (GHSA-jqwv-hx7q-fxh3 and GHSA-w47q-3m69-84v8) and is recommended for all users. Our sincere thank you to the community members who reported these.

paperless-ngx 2.20.6

Bug Fixes

• Fix: extract all ids for nested tags @shamoon (#11888)
• Fix: prevent note deletion outside doc @shamoon e4b861d
• Performance: improve treenode inefficiencies @shamoon (#11606)
• Fixhancement: change date calculation for 'this year' to include future documents @shamoon (#11884)
• Fix: Running management scripts under rootless could fail @stumpylog (#11870)
• Fix: use correct field id for overrides @shamoon (#11869)

All App Changes

• 6 changes
• Fix: extract all ids for nested tags @shamoon (#11888)
• Fix: prevent note deletion outside doc @shamoon e4b861d
• Performance: improve treenode inefficiencies @shamoon (#11606)
• Fixhancement: change date calculation for 'this year' to include future documents @shamoon (#11884)
• Fix: Running management scripts under rootless could fail @stumpylog (#11870)
• Fix: use correct field id for overrides @shamoon (#11869)

paperless-ngx 2.20.5

Bug Fixes

• Fix: ensure horizontal scroll for long tag names in list, wrap tags without parent @shamoon (#11811)
• Fix: use explicit order field for workflow actions @shamoon @stumpylog (#11781)

All App Changes

2 changes

• Fix: ensure horizontal scroll for long tag names in list, wrap tags without parent @shamoon (#11811)
• Fix: use explicit order field for workflow actions @shamoon @stumpylog (#11781)

Note

This release addresses a security issue (GHSA-28cf-xvcf-hw6m) and is recommended for all users. Thank you to the community members who reported this.

paperless-ngx 2.20.4

Bug Fixes

• Fix: propagate metadata override created value @shamoon (#11659)
• Fix: support ordering by storage path name @shamoon (#11661)
• Fix: validate cf integer values within PostgreSQL range @shamoon (#11666)
• Fixhancement: add error handling and retry when opening index @shamoon (#11731)
• Fix: fix recurring workflow to respect latest run time @shamoon (#11735)

All App Changes

5 changes

• Fix: propagate metadata override created value @shamoon (#11659)
• Fix: support ordering by storage path name @shamoon (#11661)
• Fix: validate cf integer values within PostgreSQL range @shamoon (#11666)
• Fixhancement: add error handling and retry when opening index @shamoon (#11731)
• Fix: fix recurring workflow to respect latest run time @shamoon (#11735)

Note

This release addresses two security issues (GHSA-6653-vcx4-69mc and GHSA-24x5-wp64-9fcc) and is recommended for all users. Thank you to the community members who reported these.

paperless-ngx 2.20.2

Features / Enhancements

• Tweakhancement: dim inactive users in users-groups list @shamoon (#11537)

Bug Fixes

• Fix: Expanded SVG validation whitelist and additional checks @stumpylog (#11590)
• Fix: normalize allowed SVG tag and attribute names, add version @shamoon (#11586)
• Fix: pass additional arguments to TagSerializer for permissions @shamoon (#11576)

Maintenance

• Chore(deps): Bump actions/checkout from 5 to 6 in the actions group @dependabot[bot] (#11515)

Dependencies

6 changes

• Chore: update Angular dependencies to 20.3.15 @shamoon (#11568)
• Chore(deps): Bump actions/checkout from 5 to 6 in the actions group @dependabot[bot] (#11515)
• Chore(deps-dev): Bump webpack from 5.102.1 to 5.103.0 in /src-ui @dependabot[bot] (#11513)
• Chore(deps-dev): Bump @playwright/test from 1.56.1 to 1.57.0 in /src-ui @dependabot[bot] (#11514)
• Chore(deps-dev): Bump the frontend-eslint-dependencies group in /src-ui with 3 updates @dependabot[bot] (#11512)
• docker(deps): bump astral-sh/uv from 0.9.14-python3.12-trixie-slim to 0.9.15-python3.12-trixie-slim @dependabot[bot] (#11533)

All App Changes

12 changes

• Fix: Expanded SVG validation whitelist and additional checks @stumpylog (#11590)
• Fixhancement: pass ordering to tag children @shamoon (#11556)
• Performance: avoid unnecessary filename operations on bulk custom field updates @shamoon (#11558)
• Fix: normalize allowed SVG tag and attribute names, add version @shamoon (#11586)
• Chore: refactor workflows code @shamoon (#11563)
• Fix: pass additional arguments to TagSerializer for permissions @shamoon (#11576)
• Chore: update Angular dependencies to 20.3.15 @shamoon (#11568)
• Chore(deps-dev): Bump webpack from 5.102.1 to 5.103.0 in /src-ui @dependabot[bot] (#11513)
• Chore(deps-dev): Bump @playwright/test from 1.56.1 to 1.57.0 in /src-ui @dependabot[bot] (#11514)
• Chore(deps-dev): Bump the frontend-eslint-dependencies group in /src-ui with 3 updates @dependabot[bot] (#11512)
• Tweakhancement: dim inactive users in users-groups list @shamoon (#11537)
• Chore: add some output of social login errors @shamoon (#11527)

paperless-ngx 2.20.1

Bug Fixes

• Fix: set search term when using advanced search from global search @shamoon (#11503)
• Fix: change async handling of select custom field updates @shamoon (#11490)
• Fix: skip SSL for MariaDB ping in init script @danielrheinbay (#11491)
• Fix: handle allauth groups location breaking change @shamoon (#11471)

Dependencies

• docker(deps): Bump astral-sh/uv from 0.9.10-python3.12-trixie-slim to 0.9.11-python3.12-trixie-slim @dependabot[bot] (#11450)
• Chore(deps): Bump @angular/common from 20.3.12 to 20.3.14 in /src-ui @dependabot[bot] (#11481)

All App Changes

4 changes

• Fix: set search term when using advanced search from global search @shamoon (#11503)
• Fix: change async handling of select custom field updates @shamoon (#11490)
• Chore(deps): Bump @angular/common from 20.3.12 to 20.3.14 in /src-ui @dependabot[bot] (#11481)
• Fix: handle allauth groups location breaking change @shamoon (#11471)

paperless-ngx 2.20.0

Notable Changes

• Feature: Upgrade underlying Docker image to Trixie @stumpylog (#10562)

Features / Enhancements

• Feature: Upgrade underlying Docker image to Trixie @stumpylog (#10562)
• Fixhancement: more log viewer improvements @shamoon (#11426)
• Performance: Replace duplicated static files with symlinks @stumpylog (#11418)
• Enhancement: add more relative dates, support modified @shamoon (#11411)
• Performance: make move files after select custom field change async @shamoon (#11391)
• Enhancement: Use a better check for the MariaDB server to be ready @stumpylog (#11396)
• Enhancement: speed-up docker container startup @flrgh (#11134)

Bug Fixes

• Fix: prevent focus loss from change detection in cf query dropdown @shamoon (#11409)
• Fix: sort editing filterable dropdowns sooner @shamoon (#11404)
• Fix: support for custom field ordering w advanced search @shamoon (#11383)

Maintenance

• Chore(deps): Bump the actions group with 7 updates @dependabot[bot] (#11259)

Dependencies

• 16 changes
• Chore: Upgrades psycopg to 3.2.12 @stumpylog (#11420)
• Chore(deps-dev): Bump glob from 10.4.1 to 10.5.0 in /src/paperless_mail/templates @dependabot[bot] (#11413)
• docker-compose(deps): bump gotenberg/gotenberg from 8.24 to 8.25 in /docker/compose @dependabot[bot] (#11393)
• Chore(deps): Bump the frontend-angular-dependencies group in /src-ui with 21 updates @dependabot[bot] (#11260)
• Chore(deps-dev): Bump @playwright/test from 1.55.1 to 1.56.1 in /src-ui @dependabot[bot] (#11263)
• Chore(deps-dev): Bump webpack from 5.102.0 to 5.102.1 in /src-ui @dependabot[bot] (#11264)
• Chore(deps-dev): Bump the frontend-eslint-dependencies group in /src-ui with 4 updates @dependabot[bot] (#11262)
• Chore(deps-dev): Bump jest-preset-angular from 15.0.2 to 15.0.3 in /src-ui in the frontend-jest-dependencies group @dependabot[bot] (#11261)
• Chore(deps-dev): Bump @types/node from 24.6.1 to 24.9.2 in /src-ui @dependabot[bot] (#11265)
• Chore(deps): Bump the small-changes group across 1 directory with 11 updates @dependabot[bot] (#11337)
• Chore(deps): Bump django-auditlog from 3.2.1 to 3.3.0 @dependabot[bot] (#11021)
• Chore(deps): Bump the actions group with 7 updates @dependabot[bot] (#11259)
• Chore(deps): Bump drf-spectacular-sidecar from 2025.9.1 to 2025.10.1 @dependabot[bot] (#11019)
• Chore(deps): Bump django-filter from 25.1 to 25.2 @dependabot[bot] (#11020)
• Chore(deps): Update django-allauth[mfa,socialaccount] requirement from ~=65.4.0 to ~=65.12.1 @dependabot[bot] (#11198)
• docker(deps): bump astral-sh/uv from 0.9.9-python3.12-bookworm-slim to 0.9.10-python3.12-bookworm-slim @dependabot[bot] (#11394)

All App Changes

• 19 changes
• Fixhancement: more log viewer improvements @shamoon (#11426)
• Chore: Upgrades psycopg to 3.2.12 @stumpylog (#11420)
• Enhancement: add more relative dates, support modified @shamoon (#11411)
• Chore(deps-dev): Bump glob from 10.4.1 to 10.5.0 in /src/paperless_mail/templates @dependabot[bot] (#11413)
• Performance: make move files after select custom field change async @shamoon (#11391)
• Fix: prevent focus loss from change detection in cf query dropdown @shamoon (#11409)
• Fix: sort editing filterable dropdowns sooner @shamoon (#11404)
• Chore(deps): Bump the frontend-angular-dependencies group in /src-ui with 21 updates @dependabot[bot] (#11260)
• Chore(deps-dev): Bump @playwright/test from 1.55.1 to 1.56.1 in /src-ui @dependabot[bot] (#11263)
• Chore(deps-dev): Bump webpack from 5.102.0 to 5.102.1 in /src-ui @dependabot[bot] (#11264)
• Chore(deps-dev): Bump the frontend-eslint-dependencies group in /src-ui with 4 updates @dependabot[bot] (#11262)
• Chore(deps-dev): Bump jest-preset-angular from 15.0.2 to 15.0.3 in /src-ui in the frontend-jest-dependencies group @dependabot[bot] (#11261)
• Chore(deps-dev): Bump @types/node from 24.6.1 to 24.9.2 in /src-ui @dependabot[bot] (#11265)
• Chore(deps): Bump the small-changes group across 1 directory with 11 updates @dependabot[bot] (#11337)
• Chore(deps): Bump django-auditlog from 3.2.1 to 3.3.0 @dependabot[bot] (#11021)
• Chore(deps): Bump drf-spectacular-sidecar from 2025.9.1 to 2025.10.1 @dependabot[bot] (#11019)
• Chore(deps): Bump django-filter from 25.1 to 25.2 @dependabot[bot] (#11020)
• Chore(deps): Update django-allauth[mfa,socialaccount] requirement from ~=65.4.0 to ~=65.12.1 @dependabot[bot] (#11198)
• Fix: support for custom field ordering w advanced search @shamoon (#11383)

paperless-ngx 2.19.6

Bug Fixes

• Chore: include password validation on user edit @shamoon (#11308)
• Fix: include BASE_URL when constructing doc_url for workflows @ebardsley (#11360)
• Fixhancement: refactor email attachment logic @shamoon (#11336)
• Fixhancement: trim whitespace for some text searches @shamoon (#11357)
• Fix: update Outlook refresh token when refreshed @shamoon (#11341)
• Fix: only cache remote version data for version checking @shamoon (#11320)
• Fix: include replace none logic in storage path preview, improve jinja conditionals for empty metadata @shamoon (#11315)

Dependencies

• docker(deps): bump astral-sh/uv from 0.9.7-python3.12-bookworm-slim to 0.9.9-python3.12-bookworm-slim @dependabot[bot] (#11338)

All App Changes

7 changes

• Fix: include BASE_URL when constructing doc_url for workflows @ebardsley (#11360)
• Fixhancement: refactor email attachment logic @shamoon (#11336)
• Fixhancement: trim whitespace for some text searches @shamoon (#11357)
• Fix: update Outlook refresh token when refreshed @shamoon (#11341)
• Fix: only cache remote version data for version checking @shamoon (#11320)
• Fix: include replace none logic in storage path preview, improve jinja conditionals for empty metadata @shamoon (#11315)
• Chore: include password validation on user edit @shamoon (#11308)