Paperless-ngx - Package Updates

[Package Updates]

[1.46.3]

• Update paperless-ngx to 2.20.2
• Full Changelog
• Tweakhancement: dim inactive users in users-groups list @shamoon (#11537)
• Fix: Expanded SVG validation whitelist and additional checks @stumpylog (#11590)
• Fix: normalize allowed SVG tag and attribute names, add version @shamoon (#11586)
• Fix: pass additional arguments to TagSerializer for permissions @shamoon (#11576)

[Package Updates]

[1.46.4]

• Update paperless-ngx to 2.20.3
• Full Changelog
• This release addresses a security issue (GHSA-7cq3-mhxq-w946) and is recommended for all users. Thank you to the community members who reported this.

[Package Updates]

[1.46.5]

• Update paperless-ngx to 2.20.4
• Full Changelog
• Fix: propagate metadata override created value @shamoon (#11659)
• Fix: support ordering by storage path name @shamoon (#11661)
• Fix: validate cf integer values within PostgreSQL range @shamoon (#11666)
• Fixhancement: add error handling and retry when opening index @shamoon (#11731)
• Fix: fix recurring workflow to respect latest run time @shamoon (#11735)

[Package Updates]

[1.47.1]

• Update paperless-ngx to 2.20.6
• Full Changelog
• Fix: extract all ids for nested tags @shamoon (#11888)
• Fix: prevent note deletion outside doc @shamoon e4b861d
• Performance: improve treenode inefficiencies @shamoon (#11606)
• Fixhancement: change date calculation for 'this year' to include future documents @shamoon (#11884)
• Fix: Running management scripts under rootless could fail @stumpylog (#11870)
• Fix: use correct field id for overrides @shamoon (#11869)

[Package Updates]

[1.47.3]

• Update paperless-ngx to 2.20.8
• Full Changelog
• Compare Source
• This release addresses a security issue (GHSA-7qqc-wrcw-2fj9) and is recommended for all users. Our sincere thank you to the community members who reported this.

[Package Updates]

[1.48.0]

• Update gotenberg to 8.27.0

[Package Updates]

[1.48.1]

• Update paperless-ngx to 2.20.9
• Full Changelog
• Fixhancement: config option reset @​shamoon (#​12176)
• Fix: correct page count by separating display vs collection sizes for tags @​shamoon (#​12170)

[Package Updates]

[1.48.3]

• Update paperless-ngx to 2.20.11
• Full Changelog
• Fix: correct dropdown list active color in dark mode @​shamoon (#​12328)
• Fixhancement: clear descendant selections in dropdown when parent toggled @​shamoon (#​12326)
• Fix: prevent wrapping with larger amounts of tags on small cards, reset moreTags setting to correct count @​shamoon (#​12302)
• Fix: prevent stale db filename during workflow actions @​shamoon (#​12289)

[Package Updates]

[1.48.4]

• Update paperless-ngx to 2.20.12
• Full Changelog
• Fix: Scope the workflow saves to prevent clobbering filename/archive_filename @​stumpylog (#​12390)
• Fix: don't try to usermod/groupmod when non-root + update docs (#<!---->12365) @​stumpylog (#​12391)
• Fix: avoid moving files if already moved @​shamoon (#​12389)
• Fix: remove pagination from document notes api spec @​shamoon (#​12388)
• Fix: fix file button hover color in dark mode @​shamoon (#​12367)
• Fixhancement: only offer basic auth for appropriate requests @​shamoon (#​12362)
• Fix: Scope the workflow saves to prevent clobbering filename/archive_filename @​stumpylog (#​12390)
• Fix: avoid moving files if already moved @​shamoon (#​12389)
• Fix: remove pagination from document notes api spec @​shamoon (#​12388)
• Fix: fix file button hover color in dark mode @​shamoon (#​12367)

[Package Updates]

[1.50.0]

• Update gotenberg to 8.29.0
• Full Changelog
• ExifTool Arbitrary File Write: The /forms/pdfengines/metadata/write endpoint allowed users to pass FileName and Directory pseudo-tags in the metadata JSON, enabling file rename/move to arbitrary paths. User-supplied metadata is now filtered through a blocklist before being passed to ExifTool.
• Chromium file:// Sub-Resource Restriction: When converting HTML/Markdown via file://, sub-resources are now restricted to the request's working directory, preventing cross-request file access in /tmp.
• Full OpenTelemetry Support: Distributed tracing, metrics export, and structured logging: all configurable via standard OTEL environment variables (OTEL_TRACES_EXPORTER, OTEL_METRICS_EXPORTER, OTEL_LOGS_EXPORTER, OTEL_EXPORTER_OTLP_ENDPOINT, etc.). Every HTTP request gets a span. External tool calls (Chromium, LibreOffice, QPDF, pdfcpu, pdftk, ExifTool, webhook delivery, download-from) create child spans. Trace context is propagated to outbound HTTP calls via W3C headers.
• Structured Logging Migration: Migrated from custom logging module to slog-based structured logging with OTEL log bridge. Supports auto/JSON/text formats with optional GCP-compatible field names.
• Binary Path as Peer Service: server.address span attribute now uses the actual binary path (e.g., /usr/bin/qpdf) instead of the software name.
• Telemetry Control for System Routes: New flags to disable telemetry for noisy system routes, all defaulting to disabled: --api-disable-root-route-telemetry, --api-disable-debug-route-telemetry, --api-disable-version-route-telemetry, --prometheus-disable-route-telemetry. The existing --api-disable-health-check-route-telemetry default changed from false to true.
• Idle Shutdown: New --chromium-idle-shutdown-timeout flag (default: 0s, disabled) to automatically stop Chromium after a configurable idle period, reclaiming memory on low-traffic servers. The process re-launches lazily on the next request.
• Network Almost Idle Event: New skipNetworkAlmostIdleEvent form field (default: true). When set to false, Gotenberg waits for a "network almost idle" event (at most 2 open connections for 500ms) before conversion. This provides a middle ground between the existing skipNetworkIdleEvent (strict, 0 connections) and no wait at all useful for pages with long-polling or analytics connections that never fully close.
• PDF Viewer Preferences (#​1316 15 new form fields for controlling PDF viewer behavior: initialView, initialPage, magnification, zoom, pageLayout, firstPageOnLeft, resizeWindowToInitialPage, centerWindow, openInFullScreenMode, displayPDFDocumentTitle, hideViewerMenubar, hideViewerToolbar, hideViewerWindowControls, useTransitionEffects, openBookmarkLevels.
• Event Callbacks (#​1473 New optional Gotenberg-Webhook-Events-Url header. When set, structured JSON events (webhook.success, webhook.error) are POSTed after each webhook operation, with correlationId and timestamp. Additive: existing Gotenberg-Webhook-Url and Gotenberg-Webhook-Error-Url continue to work unchanged.