papra Updates & Release Notes

#1312 aded832 Thanks @CorentinTh! - Greatly improved the performances when updating and deleting document from the sezarch index, avoiding unnecessary table scans. Noticeable improvement on large document collections (10k+ documents).

#1313 94f2a68 Thanks @CorentinTh! - Added visual loading state to the rename document modal.

#1317 35ce235 Thanks @CorentinTh! - Fix the coercion of AUTO_TAGGING_DEFAULT_MAX_TAGS that caused a validation error when the value is a string instead of a number. Now correctly converts the string to a number, preventing the validation error.

#1320 2ef3148 Thanks @CorentinTh! - Fix auto tagging schema definition for some ai providers (notably OpenAI and Anthropic), as they do not support all JSON schema features. It's really nice to have a common spec, if only all providers respected it...

#1323 74d98b2 Thanks @CorentinTh! - Added better logging when an error occurs during the structured data generation.

#1200 68fbacb Thanks @CorentinTh!

• Added AI auto-tagging. When document content is extracted, it can now be automatically tagged using AI. The system uses tag names and descriptions to determine the most relevant tags for the document, and can optionally create new tags if they don't already exist.

#1283 62ae3a0 Thanks @CorentinTh!

• Add support for external document content extraction/ocr, with multiple provider, and support for combining providers using document type filtering and fallback. Currently supported providers are:
  • Mistral OCR
  • Azure Document Intelligence
  • Docling server
  • Custom HTTP endpoint (configurable)
  • Internal Papra extraction engine (default)

#1179 63ec093 Thanks @CorentinTh!

• Replace the AWS S3 SDK (@aws-sdk/client-s3 + @aws-sdk/lib-storage) with the zero-dependency s3mini for document S3 storage. This removes 97 transitive packages (~23 MB unpacked) from the server, replacing them with a single more performant and dependency-free package.

#1246 677f81e Thanks @CorentinTh!

• Extracted and translated remaining hard coded texts, improving localization for non-English languages.

#1240 874354f Thanks @CorentinTh!

• Added mobile friendly hamburger menu in account settings.

#1172 0e970aa Thanks @CorentinTh!

• Set S3 checksum verification headers to "when required" to fix Backblaze B2 storage issues.

#1219 aef57ce Thanks @CorentinTh!

• Pined the Dockerfile node version sha to reduce supply chain attack surface.

#1152 632ac0f Thanks @CorentinTh!

• Fix the document preview being shrunk by very long document name not containing common break characters (spaces, dashes, ...)

#1184 e2c3aa6 Thanks @CorentinTh!

• Updated tesseract.js to v7 which should increase extraction performance by 15 to 35% on images, source.

#1235 ae42102 Thanks @CorentinTh!

• Added mobile friendly hamburger menu in organization settings.

#1196 4250141 Thanks @CorentinTh!

• Added missing translations in all non-English languages.

#1201 167fb8c Thanks @CorentinTh!

• Auto tagging can be configured per organization, with a dedicated page in organization settings. Owners can manage the following settings:
  • Enable or disable auto tagging for their organization.
  • Enable the creation of new tags if relevant tags do not exist.
  • Configure the maximum number of tags that can be automatically added to a document.

#1173 c541b1f Thanks @CorentinTh!

• Added the possibility to configure the file size polling interval for ingestion folder watchers.
• INGESTION_FOLDER_WATCHER_FILE_STABILITY_THRESHOLD_MS: The amount of time in milliseconds for a file size to remain constant before being consumed. This helps to avoid processing files that are still being written to (e.g., scanners, cameras, network shares, etc.).
• INGESTION_FOLDER_WATCHER_FILE_STABILITY_POLL_INTERVAL_MS: The interval in milliseconds at which the file size is polled while waiting for write to finish.

#1292 923e27a Thanks @CorentinTh!

• Document sort order fallback to the importation date when the sort order is set to other sort orders.

#1192 edbd368 Thanks @Pallavikumarimdb!

• Sort documents by document date instead of the created date.

#1296 df9f6c6 Thanks @CorentinTh!

• Fixed the inline tag picker lowercasing the typed name when suggesting a new tag, so newly created tags now keep their original casing (e.g. typing "Invoices" no longer suggests "invoices").

#1232 e853d09 Thanks @CorentinTh!

• Make the top navigation bar mobile-friendly: the search, import, and admin buttons now collapse to icon-only on small screens, and the user settings dropdown is now available on mobile devices.

#1155 e6de1ee Thanks @CorentinTh!

• Fix the displayed max organization count on the user admin page

#960 f4b361e Thanks @anbraten!

• Added the ability to save search queries as views, allowing quick access to frequently used searches. Saved views can be accessed from the sidebar.

#1130 4fc4f68 Thanks @CorentinTh!

• Added document sharing by link: generate a public link to share a document with anyone, without requiring a Papra account. Links can optionally be password-protected and given an expiration date, can be disabled/re-enabled, and are all manageable from a new organization-level "Share links" page.
• Laid out the base for the rate limit system.

#1111 1ecd2c8 Thanks @CorentinTh!

• Fix admin layout pushing the sidenav out of view when page content is long.

#1121 3a67507 Thanks @CorentinTh!

• Added the possibility to disable the initial startup execution of all scheduled tasks by setting the RUN_SCHEDULED_TASKS_ON_STARTUP_DEFAULT=false environment variable, mainly usefull for instance that reboot often, dev environments or fast startup requirements (few ms gained). Each task startup configuration remain individually configurable with their dedicated environment variable.

#1135 d73933a Thanks @CorentinTh!

• Added api-key permissions for managing custom properties

#1141 f93d6e1 Thanks @CorentinTh!

• Custom property definition deletion endpoint (DELETE /api/organizations/:organizationId/custom-properties/:propertyDefinitionId) now returns a 204 with no body instead of a 200 with an empty object.

#1133 a0f2455 Thanks @CorentinTh!

• Added the possibility to add notes to documents, which can be used to add additional information or context to a document.

#1109 d9bc129 Thanks @CorentinTh!

• Added the possibility to delete a user in the admin user details page.

#996 2a8bdec Thanks @magic0whi!

• Fix preview of pdfs without embedded fonts by packaging cmaps and custom fonts in the app assets. Increasing the bundle size by ~2mb, but it's worth it for the improved UX and compatibility with a wider range of pdfs.

#1080 47d44e0 Thanks @CorentinTh!

• Fixed an authorization issue where tag updates and deletions were not scoped to the organization in the URL. Tag mutation endpoints are now correctly scoped to the requested organization.
• Addressing GHSA-wrx4-3vff-jm94, credit to @TinkAnet for the responsible disclosure.

#1074 e2e7fd4 Thanks @CorentinTh!

• Limited search query to 1024 characters

#1099 086dccb Thanks @CorentinTh!

• Webhooks no longer follow http redirects (3xx responses) when sending requests.
• Addressing GHSA-5g86-85rp-f9hx, credit to @FredrikEV for the responsible disclosure.

#1061 93c369d Thanks @CorentinTh!

• Html-ish characters in email templates are now escaped instead of sanitized-out

#1067 79d4cac Thanks @CorentinTh!

• Increased default max file size from 10MB to 25MB (can still be customized using DOCUMENT_STORAGE_MAX_UPLOAD_SIZE, disable by setting it to 0).

#1010 927c7d6 Thanks @CorentinTh!

• Removed logging of a polluting empty error cause (with stack trace) when an error is thrown without a cause.

#1082 e8d19af Thanks @CorentinTh!

• Added batch selection in the document page, allowing to select multiple documents (or all matching the current search) and either manage tags or delete them in one go.

#1080 47d44e0 Thanks @CorentinTh!

• Tag deletion endpoint now returns a 204 No Content status code instead of 200 OK with an empty JSON object, and a 404 Not Found status code is returned when trying to delete a tag that does not exists for the organization.

#1015 5bdf0da Thanks @JohnCuba!

• Synchronized the document pagination of the home page in query params to permit sharing and navigation.

#1096 2bb75ce Thanks @CorentinTh!

• Updated some critical dependencies (better-auth, drizzle-orm, hono, ...) to fix transitive vulnerabilities. Please do not hesitate to report any regression you may encounter, especially if it is related to authentication or database access. Thanks!

#1034 c5ccac5 Thanks @CorentinTh!

• Added content preview for yaml files

#1027 b154d2f Thanks @CorentinTh!

• Removed weird shadows on ui components in light mode

#1091 4ab0f32 Thanks @CorentinTh!

• The documents page content now uses the whole width of the page

#1082 e8d19af Thanks @CorentinTh!

• Added a batch document tag management API endpoint.

#1097 928ffc3 Thanks @CorentinTh!

• Switched docker image pnpm installation from corepack to npm global installation, as Node.js 26 image no longer ships corepack.

#1090 5ea8ca3 Thanks @CorentinTh!

• Added sorting option in the documents list, allowing to sort documents by name, or creation date, in ascending or descending order.

#1098 7acca43 Thanks @CorentinTh!

• Updated pnpm to v11

#1020 015bb53 Thanks @CorentinTh!

• Added some size limits on the webhooks creation and update API endpoints parameters.
• Names are limited to 128 characters.
• Secret keys are limited to 256 characters.
• URLs are limited to 2048 characters.

#1025 9c6985b Thanks @CorentinTh!

• When reopening the quick search modal with existing query, the input content is automatically selected to allow easy replacement or editing.

#1033 5d55e41 Thanks @CorentinTh!

• Changed the server endpoint validation library from zod to valibot, and improved some validation schemas in the process.

#1097 928ffc3 Thanks @CorentinTh!

• Updated to Node.js 26

#1016 07d7109 Thanks @JohnCuba!

• Removed native clear button of search bar in safari.

#1072 71d093f Thanks @mvlanga!

• Added a download file option in document list action menu

#1089 aef3ef2 Thanks @CorentinTh!

• Added sortField and sortOrder query parameters to the document list/search endpoint (GET /api/organizations/:organizationId/documents), allowing documents to be sorted by createdAt, updatedAt, name, or documentDate in ascending or descending order.

#1074 e2e7fd4 Thanks @CorentinTh!

• Add batch document trash API endpoint.

#1099 086dccb Thanks @CorentinTh!

• Webhooks ssrf validation is now enforced when sending webhook requests, preventing potential TOCTOU dns rebinding attacks (the exploitation window was very small and only theoretical though).

#1003 ad5e42d Thanks @JohnCuba!

• Increased the sidebar collapsing breakpoint to improve the UX on tablets and small laptops.

#1016 07d7109 Thanks @JohnCuba!

• Removed useless close button in the small-screen sidebar sheet.

#1003 ad5e42d Thanks @JohnCuba!

• Prevented the users and organizations tables from forcing horizontal scrolling in the admin panels.

#1021 133d235 Thanks @CorentinTh!

• Prevented long documents name from pushing the right columns out of the container.

Minor Changes

• #993 17b501a Thanks @CorentinTh! - Breaking change regarding webhook URLs

Added SSRF protection for webhook URLs. Webhook URLs are now validated to ensure they do not point to private or reserved IP addresses, preventing potential server-side request forgery attacks.

So webhooks pointing to private IPs (e.g. http://192.168.0.1/some/stuff), or with domains resolving to private IPs (e.g. http://myservice.local/some/stuff) will be blocked unless explicitly allowed.

Two new configuration options are available:

WEBHOOK_SSRF_PROTECTION_ENABLED Set to false to fully disable SSRF protection. This is not recommended, prefer using the allowlist below instead.

WEBHOOK_URL_ALLOWED_HOSTNAMES A comma-separated list of hostnames (IP addresses or domain names) that are explicitly trusted and exempt from SSRF checks (e.g. internal services you control).

Addressing GHSA-cjw7-qg95-58mq, credit to @Toothless5143 for the responsible disclosure.

Patch Changes

• #986 884d470 Thanks @CorentinTh! - Removed currently unused expiresAt placeholder fields in the internal API key creation endpoint to avoid confusions, as non-ui (so non-standard) creation of API keys can set an expiration date, which is not currently enforced by the system.

Addressing GHSA-866c-mc22-wvv5, credit to @Toothless5143 for the responsible disclosure.

• #992 9039b48 Thanks @CorentinTh! - Properly return a "document already has tag" error when trying to add a tag to a document that already has it, instead of a generic 500 error when using an hosted Turso db.

• #992 9039b48 Thanks @CorentinTh! - Api now returns a 409 status code instead of a 400 when either creating a tag that already exists or adding a tag to a document that already has it.

• #995 327eda0 Thanks @CorentinTh! - Properly sanitize user name before including it in the email content to prevent potential XSS or html injection attacks.

Addressing GHSA-6f8x-2rc9-vgh4, credit to @Toothless5143 for the responsible disclosure.

• #981 f336b84 Thanks @CorentinTh! - Moved the theme picker to the user settings dropdown

• #984 8fe222b Thanks @CorentinTh! - App environment configuration validation is now a bit stricter, with slightly different error messages. And the following specific changes:

  Boolean env variables previously considered non-truthy values as false. Now they will throw a validation error if the value is not a valid boolean-ish value

  AUTH_PROVIDERS_CUSTOMS json parsing now accepts only valid boolean values for the pkce property, while before it accepted any non-true value as false

  Stricter AUTH_FORBIDDEN_EMAIL_DOMAINS domain validation