papra Updates & Release Notes

Patch Changes

• #1324 8a3653c Thanks @CorentinTh! - Collapse the mobile menu sheet when navigating to a new page.
• #1453 a64cbba Thanks @CorentinTh! - Fixed an issue where setting AUTH_IS_REGISTRATION_ENABLED=false hid the sign-up interface but did not block email and password registrations made directly through the authentication API.
• #1442 03f4ad4 Thanks @sp71! - Include the tag name in the tag deletion confirmation message.
• #1407 30760f5 Thanks @CorentinTh! - Added a deletion confirmation modal when deleting a tagging rule, to prevent accidental deletion of tagging rules.
• #1326 0247a7a Thanks @CorentinTh! - Added some database indexes for better performances.
• #1416 5d43402 Thanks @ybizeul! - Fix PDF content preview rendering issue after navigation
• #1420 510c162 Thanks @qmarlats! - Fixed the batch document selection remaining in "select all matching documents" mode after unselecting documents.
• #1365 881796e Thanks @CorentinTh! - Increased and made configurable the timeout of content extraction external service.

Docling, Mistral OCR, and Azure DI can now take up to 5 minutes to process a document, instead of the previous 30 seconds, configurable via DOCLING_REQUEST_TIMEOUT_MS, MISTRAL_OCR_REQUEST_TIMEOUT_MS and AZURE_DI_REQUEST_TIMEOUT_MS respectively.

• #1432 a0ce312 Thanks @CorentinTh! - Prevent stripe webhook forgery for apps with unconfigured webhooks secrets.
• Thank you to Andrew Gonzalez (@bruhdev1290) for the responsible disclosure of this issue.
• #1362 8adb16d Thanks @CorentinTh! - Fix mistral ocr replacing tables with external references, no more tbl-0.md in extracted content, the tables are now properly extracted and included in the content.
• #1357 bad01b7 Thanks @CorentinTh! - Added a skeleton loader in the sidenav organization picker when fetching organizations
• #1352 0de24f5 Thanks @MarcSerraPeralta! - Added Catalan language
• #1348 12e1d4b Thanks @CorentinTh! - Security fix: document share links belonging to a soft-deleted organization were still publicly accessible. Public access (document metadata, file download, and password verification) now stops with a 410 Gone as soon as the organization is deleted, and resumes automatically if the organization is restored during the grace period.
• Thank you to Thammachart Sittharod for the responsible disclosure of this issue.
• #1406 d178643 Thanks @CorentinTh! - Security fix: revoke all user sessions on password reset.
• Thank you to MMartinez for the responsible disclosure of this issue.

#1312 aded832 Thanks @CorentinTh! - Greatly improved the performances when updating and deleting document from the sezarch index, avoiding unnecessary table scans. Noticeable improvement on large document collections (10k+ documents).

#1313 94f2a68 Thanks @CorentinTh! - Added visual loading state to the rename document modal.

#1317 35ce235 Thanks @CorentinTh! - Fix the coercion of AUTO_TAGGING_DEFAULT_MAX_TAGS that caused a validation error when the value is a string instead of a number. Now correctly converts the string to a number, preventing the validation error.

#1320 2ef3148 Thanks @CorentinTh! - Fix auto tagging schema definition for some ai providers (notably OpenAI and Anthropic), as they do not support all JSON schema features. It's really nice to have a common spec, if only all providers respected it...

#1323 74d98b2 Thanks @CorentinTh! - Added better logging when an error occurs during the structured data generation.

#1200 68fbacb Thanks @CorentinTh!

• Added AI auto-tagging. When document content is extracted, it can now be automatically tagged using AI. The system uses tag names and descriptions to determine the most relevant tags for the document, and can optionally create new tags if they don't already exist.

#1283 62ae3a0 Thanks @CorentinTh!

• Add support for external document content extraction/ocr, with multiple provider, and support for combining providers using document type filtering and fallback. Currently supported providers are:
  • Mistral OCR
  • Azure Document Intelligence
  • Docling server
  • Custom HTTP endpoint (configurable)
  • Internal Papra extraction engine (default)

#1179 63ec093 Thanks @CorentinTh!

• Replace the AWS S3 SDK (@aws-sdk/client-s3 + @aws-sdk/lib-storage) with the zero-dependency s3mini for document S3 storage. This removes 97 transitive packages (~23 MB unpacked) from the server, replacing them with a single more performant and dependency-free package.

#1246 677f81e Thanks @CorentinTh!

• Extracted and translated remaining hard coded texts, improving localization for non-English languages.

#1240 874354f Thanks @CorentinTh!

• Added mobile friendly hamburger menu in account settings.

#1172 0e970aa Thanks @CorentinTh!

• Set S3 checksum verification headers to "when required" to fix Backblaze B2 storage issues.

#1219 aef57ce Thanks @CorentinTh!

• Pined the Dockerfile node version sha to reduce supply chain attack surface.

#1152 632ac0f Thanks @CorentinTh!

• Fix the document preview being shrunk by very long document name not containing common break characters (spaces, dashes, ...)

#1184 e2c3aa6 Thanks @CorentinTh!

• Updated tesseract.js to v7 which should increase extraction performance by 15 to 35% on images, source.

#1235 ae42102 Thanks @CorentinTh!

• Added mobile friendly hamburger menu in organization settings.

#1196 4250141 Thanks @CorentinTh!

• Added missing translations in all non-English languages.

#1201 167fb8c Thanks @CorentinTh!

• Auto tagging can be configured per organization, with a dedicated page in organization settings. Owners can manage the following settings:
  • Enable or disable auto tagging for their organization.
  • Enable the creation of new tags if relevant tags do not exist.
  • Configure the maximum number of tags that can be automatically added to a document.

#1173 c541b1f Thanks @CorentinTh!

• Added the possibility to configure the file size polling interval for ingestion folder watchers.
• INGESTION_FOLDER_WATCHER_FILE_STABILITY_THRESHOLD_MS: The amount of time in milliseconds for a file size to remain constant before being consumed. This helps to avoid processing files that are still being written to (e.g., scanners, cameras, network shares, etc.).
• INGESTION_FOLDER_WATCHER_FILE_STABILITY_POLL_INTERVAL_MS: The interval in milliseconds at which the file size is polled while waiting for write to finish.

#1292 923e27a Thanks @CorentinTh!

• Document sort order fallback to the importation date when the sort order is set to other sort orders.

#1192 edbd368 Thanks @Pallavikumarimdb!

• Sort documents by document date instead of the created date.

#1296 df9f6c6 Thanks @CorentinTh!

• Fixed the inline tag picker lowercasing the typed name when suggesting a new tag, so newly created tags now keep their original casing (e.g. typing "Invoices" no longer suggests "invoices").

#1232 e853d09 Thanks @CorentinTh!

• Make the top navigation bar mobile-friendly: the search, import, and admin buttons now collapse to icon-only on small screens, and the user settings dropdown is now available on mobile devices.

#1155 e6de1ee Thanks @CorentinTh!

• Fix the displayed max organization count on the user admin page

#960 f4b361e Thanks @anbraten!

• Added the ability to save search queries as views, allowing quick access to frequently used searches. Saved views can be accessed from the sidebar.

#1130 4fc4f68 Thanks @CorentinTh!

• Added document sharing by link: generate a public link to share a document with anyone, without requiring a Papra account. Links can optionally be password-protected and given an expiration date, can be disabled/re-enabled, and are all manageable from a new organization-level "Share links" page.
• Laid out the base for the rate limit system.

#1111 1ecd2c8 Thanks @CorentinTh!

• Fix admin layout pushing the sidenav out of view when page content is long.

#1121 3a67507 Thanks @CorentinTh!

• Added the possibility to disable the initial startup execution of all scheduled tasks by setting the RUN_SCHEDULED_TASKS_ON_STARTUP_DEFAULT=false environment variable, mainly usefull for instance that reboot often, dev environments or fast startup requirements (few ms gained). Each task startup configuration remain individually configurable with their dedicated environment variable.

#1135 d73933a Thanks @CorentinTh!

• Added api-key permissions for managing custom properties

#1141 f93d6e1 Thanks @CorentinTh!

• Custom property definition deletion endpoint (DELETE /api/organizations/:organizationId/custom-properties/:propertyDefinitionId) now returns a 204 with no body instead of a 200 with an empty object.

#1133 a0f2455 Thanks @CorentinTh!

• Added the possibility to add notes to documents, which can be used to add additional information or context to a document.

#1109 d9bc129 Thanks @CorentinTh!

• Added the possibility to delete a user in the admin user details page.

#996 2a8bdec Thanks @magic0whi!

• Fix preview of pdfs without embedded fonts by packaging cmaps and custom fonts in the app assets. Increasing the bundle size by ~2mb, but it's worth it for the improved UX and compatibility with a wider range of pdfs.

#1080 47d44e0 Thanks @CorentinTh!

• Fixed an authorization issue where tag updates and deletions were not scoped to the organization in the URL. Tag mutation endpoints are now correctly scoped to the requested organization.
• Addressing GHSA-wrx4-3vff-jm94, credit to @TinkAnet for the responsible disclosure.

#1074 e2e7fd4 Thanks @CorentinTh!

• Limited search query to 1024 characters

#1099 086dccb Thanks @CorentinTh!

• Webhooks no longer follow http redirects (3xx responses) when sending requests.
• Addressing GHSA-5g86-85rp-f9hx, credit to @FredrikEV for the responsible disclosure.

#1061 93c369d Thanks @CorentinTh!

• Html-ish characters in email templates are now escaped instead of sanitized-out

#1067 79d4cac Thanks @CorentinTh!

• Increased default max file size from 10MB to 25MB (can still be customized using DOCUMENT_STORAGE_MAX_UPLOAD_SIZE, disable by setting it to 0).

#1010 927c7d6 Thanks @CorentinTh!

• Removed logging of a polluting empty error cause (with stack trace) when an error is thrown without a cause.

#1082 e8d19af Thanks @CorentinTh!

• Added batch selection in the document page, allowing to select multiple documents (or all matching the current search) and either manage tags or delete them in one go.

#1080 47d44e0 Thanks @CorentinTh!

• Tag deletion endpoint now returns a 204 No Content status code instead of 200 OK with an empty JSON object, and a 404 Not Found status code is returned when trying to delete a tag that does not exists for the organization.

#1015 5bdf0da Thanks @JohnCuba!

• Synchronized the document pagination of the home page in query params to permit sharing and navigation.

#1096 2bb75ce Thanks @CorentinTh!

• Updated some critical dependencies (better-auth, drizzle-orm, hono, ...) to fix transitive vulnerabilities. Please do not hesitate to report any regression you may encounter, especially if it is related to authentication or database access. Thanks!

#1034 c5ccac5 Thanks @CorentinTh!

• Added content preview for yaml files

#1027 b154d2f Thanks @CorentinTh!

• Removed weird shadows on ui components in light mode

#1091 4ab0f32 Thanks @CorentinTh!

• The documents page content now uses the whole width of the page

#1082 e8d19af Thanks @CorentinTh!

• Added a batch document tag management API endpoint.

#1097 928ffc3 Thanks @CorentinTh!

• Switched docker image pnpm installation from corepack to npm global installation, as Node.js 26 image no longer ships corepack.

#1090 5ea8ca3 Thanks @CorentinTh!

• Added sorting option in the documents list, allowing to sort documents by name, or creation date, in ascending or descending order.

#1098 7acca43 Thanks @CorentinTh!

• Updated pnpm to v11

#1020 015bb53 Thanks @CorentinTh!

• Added some size limits on the webhooks creation and update API endpoints parameters.
• Names are limited to 128 characters.
• Secret keys are limited to 256 characters.
• URLs are limited to 2048 characters.

#1025 9c6985b Thanks @CorentinTh!

• When reopening the quick search modal with existing query, the input content is automatically selected to allow easy replacement or editing.

#1033 5d55e41 Thanks @CorentinTh!

• Changed the server endpoint validation library from zod to valibot, and improved some validation schemas in the process.

#1097 928ffc3 Thanks @CorentinTh!

• Updated to Node.js 26

#1016 07d7109 Thanks @JohnCuba!

• Removed native clear button of search bar in safari.

#1072 71d093f Thanks @mvlanga!

• Added a download file option in document list action menu

#1089 aef3ef2 Thanks @CorentinTh!

• Added sortField and sortOrder query parameters to the document list/search endpoint (GET /api/organizations/:organizationId/documents), allowing documents to be sorted by createdAt, updatedAt, name, or documentDate in ascending or descending order.

#1074 e2e7fd4 Thanks @CorentinTh!

• Add batch document trash API endpoint.

#1099 086dccb Thanks @CorentinTh!

• Webhooks ssrf validation is now enforced when sending webhook requests, preventing potential TOCTOU dns rebinding attacks (the exploitation window was very small and only theoretical though).

#1003 ad5e42d Thanks @JohnCuba!

• Increased the sidebar collapsing breakpoint to improve the UX on tablets and small laptops.

#1016 07d7109 Thanks @JohnCuba!

• Removed useless close button in the small-screen sidebar sheet.

#1003 ad5e42d Thanks @JohnCuba!

• Prevented the users and organizations tables from forcing horizontal scrolling in the admin panels.

#1021 133d235 Thanks @CorentinTh!

• Prevented long documents name from pushing the right columns out of the container.