<![CDATA[Paperless-ngx - Package Updates]]>You can use this thread to track updates to the Paperless-ngx package.

Please open issues in a separate topic instead of replying here.

]]>https://forum.cloudron.io/topic/6308/paperless-ngx-package-updatesRSS for NodeWed, 13 May 2026 04:07:11 GMTMon, 10 Jan 2022 11:42:11 GMT60<![CDATA[Reply to Paperless-ngx - Package Updates on Fri, 01 May 2026 10:19:39 GMT]]>[1.52.0]

  • Update gotenberg to 8.32.0
  • Full Changelog
  • Reverted SSRF defaults (breaking vs 8.31.0). 8.31.0 blocked private-IP destinations by default, which broke deployments running Gotenberg inside a private network. 8.32.0 restores the 8.30.x permissive defaults. Operators with internet-facing APIs opt into the strict posture via the new flags below.
  • Rejected file:// at /forms/chromium/convert/url. Submitting url=file:///tmp/... used to let an unauthenticated caller enumerate the request working directory and read other in-flight uploads as rendered PDFs. The route now returns HTTP 400 for any file:// URL.
  • Required uploaded file for image / pdf stamp and watermark sources. Twelve callsites accepted stampSource=pdf or watermarkSource=pdf with an expression pointing at any path the Gotenberg process could open, even when no file was uploaded. Handlers now return HTTP 400 unless the caller uploaded a matching file.
  • Scoped file:// sub-resources to the request working directory. Crafted HTML could reference another request's file:///tmp/<reqdir>/.... The CDP request handler now restricts file:// sub-resources to the current request's directory. /convert/url and /screenshot/url reject every file:// sub-resource outright.
  • Hardened Chromium against DNS rebinding. A short-TTL DNS authority could return a public IP at validation and a private IP at connect. A loopback HTTP / CONNECT proxy now sits between Chromium and the network, resolves DNS once, and pins the dial to the resolved IP. Skipped when --chromium-proxy-server or --chromium-host-resolver-rules is set.
  • Filtered LibreOffice outbound fetches through a proxy. Uploaded OOXML, RTF, and ODF files can embed external URLs that LibreOffice's libcurl resolves below every Go-side SSRF filter. LibreOffice now routes every outbound fetch through an in-process forward proxy on the same gotenberg.DecideOutbound path Chromium and webhook delivery use. See the four new flags below.
  • Recovered webhook async panics. High-concurrency webhooks could panic the async goroutine and crash the whole process. The goroutine now snapshots the request context and recovers any future panic through the existing error path.
  • LibreOffice outbound URL filtering. Four flags mirror the Chromium and webhook layout: --libreoffice-allow-list, --libreoffice-deny-list, --libreoffice-deny-private-ips, --libreoffice-deny-public-ips. All default permissive.
  • IP-class filtering on four modules. chromium, webhook, api-download-from, and libreoffice each accept matching deny-private-ips and deny-public-ips flags. All default to false.
  • Charts print as blank rectangles (#1531, #1532, #1534, #1535😞 chromedp v0.15.0 suspended the BeginFrame-driven callback dispatch loop under emulatedMediaType=print. requestAnimationFrame, ResizeObserver, IntersectionObserver, CSS transitionend, and CSS animationend all stopped firing. Pinning chromedp back to v0.14.2 restores native dispatch.
]]>https://forum.cloudron.io/post/124253https://forum.cloudron.io/post/124253Fri, 01 May 2026 10:19:39 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Mon, 27 Apr 2026 13:51:57 GMT]]>[1.51.3]

  • Update paperless-ngx to 2.20.15
  • Full Changelog
  • Fix: use only allauth login/logout endpoints @shamoon (#12639)
  • Fix: correctly scope mail account enumeration @shamoon (#12636)
  • Fix: prevent intermediate change event when CustomFieldQueryAtom operator changes type @ggouzi (#12597)
  • Fix: reject invalid requests to API notes endpoint @ggouzi (#12582)
]]>https://forum.cloudron.io/post/124052https://forum.cloudron.io/post/124052Mon, 27 Apr 2026 13:51:57 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Sat, 18 Apr 2026 07:25:24 GMT]]>[1.51.2]

  • Update gotenberg to 8.31.0
]]>https://forum.cloudron.io/post/123621https://forum.cloudron.io/post/123621Sat, 18 Apr 2026 07:25:24 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Wed, 15 Apr 2026 05:51:22 GMT]]>[1.51.1]

]]>https://forum.cloudron.io/post/123433https://forum.cloudron.io/post/123433Wed, 15 Apr 2026 05:51:22 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Tue, 07 Apr 2026 06:58:20 GMT]]>[1.51.0]

  • Update gotenberg to 8.30.1
]]>https://forum.cloudron.io/post/122985https://forum.cloudron.io/post/122985Tue, 07 Apr 2026 06:58:20 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Tue, 31 Mar 2026 06:29:57 GMT]]>[1.50.1]

]]>https://forum.cloudron.io/post/122723https://forum.cloudron.io/post/122723Tue, 31 Mar 2026 06:29:57 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Sun, 29 Mar 2026 06:24:48 GMT]]>[1.50.0]

  • Update gotenberg to 8.29.0
  • Full Changelog
  • ExifTool Arbitrary File Write: The /forms/pdfengines/metadata/write endpoint allowed users to pass FileName and Directory pseudo-tags in the metadata JSON, enabling file rename/move to arbitrary paths. User-supplied metadata is now filtered through a blocklist before being passed to ExifTool.
  • Chromium file:// Sub-Resource Restriction: When converting HTML/Markdown via file://, sub-resources are now restricted to the request's working directory, preventing cross-request file access in /tmp.
  • Full OpenTelemetry Support: Distributed tracing, metrics export, and structured logging: all configurable via standard OTEL environment variables (OTEL_TRACES_EXPORTER, OTEL_METRICS_EXPORTER, OTEL_LOGS_EXPORTER, OTEL_EXPORTER_OTLP_ENDPOINT, etc.). Every HTTP request gets a span. External tool calls (Chromium, LibreOffice, QPDF, pdfcpu, pdftk, ExifTool, webhook delivery, download-from) create child spans. Trace context is propagated to outbound HTTP calls via W3C headers.
  • Structured Logging Migration: Migrated from custom logging module to slog-based structured logging with OTEL log bridge. Supports auto/JSON/text formats with optional GCP-compatible field names.
  • Binary Path as Peer Service: server.address span attribute now uses the actual binary path (e.g., /usr/bin/qpdf) instead of the software name.
  • Telemetry Control for System Routes: New flags to disable telemetry for noisy system routes, all defaulting to disabled: --api-disable-root-route-telemetry, --api-disable-debug-route-telemetry, --api-disable-version-route-telemetry, --prometheus-disable-route-telemetry. The existing --api-disable-health-check-route-telemetry default changed from false to true.
  • Idle Shutdown: New --chromium-idle-shutdown-timeout flag (default: 0s, disabled) to automatically stop Chromium after a configurable idle period, reclaiming memory on low-traffic servers. The process re-launches lazily on the next request.
  • Network Almost Idle Event: New skipNetworkAlmostIdleEvent form field (default: true). When set to false, Gotenberg waits for a "network almost idle" event (at most 2 open connections for 500ms) before conversion. This provides a middle ground between the existing skipNetworkIdleEvent (strict, 0 connections) and no wait at all useful for pages with long-polling or analytics connections that never fully close.
  • PDF Viewer Preferences (#​1316😞 15 new form fields for controlling PDF viewer behavior: initialView, initialPage, magnification, zoom, pageLayout, firstPageOnLeft, resizeWindowToInitialPage, centerWindow, openInFullScreenMode, displayPDFDocumentTitle, hideViewerMenubar, hideViewerToolbar, hideViewerWindowControls, useTransitionEffects, openBookmarkLevels.
  • Event Callbacks (#​1473😞 New optional Gotenberg-Webhook-Events-Url header. When set, structured JSON events (webhook.success, webhook.error) are POSTed after each webhook operation, with correlationId and timestamp. Additive: existing Gotenberg-Webhook-Url and Gotenberg-Webhook-Error-Url continue to work unchanged.
]]>https://forum.cloudron.io/post/122652https://forum.cloudron.io/post/122652Sun, 29 Mar 2026 06:24:48 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Sat, 21 Mar 2026 07:15:39 GMT]]>[1.48.4]

]]>https://forum.cloudron.io/post/122264https://forum.cloudron.io/post/122264Sat, 21 Mar 2026 07:15:39 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Mon, 16 Mar 2026 02:15:04 GMT]]>[1.48.3]

]]>https://forum.cloudron.io/post/121921https://forum.cloudron.io/post/121921Mon, 16 Mar 2026 02:15:04 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Sun, 01 Mar 2026 09:01:21 GMT]]>[1.48.1]

]]>https://forum.cloudron.io/post/120968https://forum.cloudron.io/post/120968Sun, 01 Mar 2026 09:01:21 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Mon, 23 Feb 2026 08:45:05 GMT]]>[1.48.0]

  • Update gotenberg to 8.27.0
]]>https://forum.cloudron.io/post/120600https://forum.cloudron.io/post/120600Mon, 23 Feb 2026 08:45:05 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Sun, 22 Feb 2026 11:07:44 GMT]]>[1.47.3]

  • Update paperless-ngx to 2.20.8
  • Full Changelog
  • Compare Source
  • This release addresses a security issue (GHSA-7qqc-wrcw-2fj9) and is recommended for all users. Our sincere thank you to the community members who reported this.
]]>https://forum.cloudron.io/post/120580https://forum.cloudron.io/post/120580Sun, 22 Feb 2026 11:07:44 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Sat, 31 Jan 2026 10:52:14 GMT]]>[1.47.1]

]]>https://forum.cloudron.io/post/119442https://forum.cloudron.io/post/119442Sat, 31 Jan 2026 10:52:14 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Wed, 14 Jan 2026 07:55:01 GMT]]>[1.46.5]

]]>https://forum.cloudron.io/post/118461https://forum.cloudron.io/post/118461Wed, 14 Jan 2026 07:55:01 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Fri, 19 Dec 2025 10:23:16 GMT]]>[1.46.4]

  • Update paperless-ngx to 2.20.3
  • Full Changelog
  • This release addresses a security issue (GHSA-7cq3-mhxq-w946) and is recommended for all users. Thank you to the community members who reported this.
]]>https://forum.cloudron.io/post/117328https://forum.cloudron.io/post/117328Fri, 19 Dec 2025 10:23:16 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Sat, 13 Dec 2025 08:21:45 GMT]]>[1.46.3]

  • Update paperless-ngx to 2.20.2
  • Full Changelog
  • Tweakhancement: dim inactive users in users-groups list @shamoon (#11537)
  • Fix: Expanded SVG validation whitelist and additional checks @stumpylog (#11590)
  • Fix: normalize allowed SVG tag and attribute names, add version @shamoon (#11586)
  • Fix: pass additional arguments to TagSerializer for permissions @shamoon (#11576)
]]>https://forum.cloudron.io/post/116951https://forum.cloudron.io/post/116951Sat, 13 Dec 2025 08:21:45 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Thu, 04 Dec 2025 15:36:35 GMT]]>[1.46.2]

  • Update gotenberg to 8.25.1
]]>https://forum.cloudron.io/post/116502https://forum.cloudron.io/post/116502Thu, 04 Dec 2025 15:36:35 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Tue, 02 Dec 2025 08:14:22 GMT]]>[1.46.1]

]]>https://forum.cloudron.io/post/116332https://forum.cloudron.io/post/116332Tue, 02 Dec 2025 08:14:22 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Sun, 23 Nov 2025 15:06:47 GMT]]>[1.46.0]

  • Update paperless-ngx to 2.20.0
  • Full Changelog
  • Feature: Upgrade underlying Docker image to Trixie @stumpylog (#10562)
  • Fixhancement: more log viewer improvements @shamoon (#11426)
  • Performance: Replace duplicated static files with symlinks @stumpylog (#11418)
  • Enhancement: add more relative dates, support modified @shamoon (#11411)
  • Performance: make move files after select custom field change async @shamoon (#11391)
  • Enhancement: Use a better check for the MariaDB server to be ready @stumpylog (#11396)
  • Enhancement: speed-up docker container startup @flrgh (#11134)
  • Fix: prevent focus loss from change detection in cf query dropdown @shamoon (#11409)
  • Fix: sort editing filterable dropdowns sooner @shamoon (#11404)
  • Fix: support for custom field ordering w advanced search @shamoon (#11383)
]]>https://forum.cloudron.io/post/115827https://forum.cloudron.io/post/115827Sun, 23 Nov 2025 15:06:47 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Mon, 17 Nov 2025 07:48:06 GMT]]>[1.45.0]

  • Update gotenberg to 8.25.0
]]>https://forum.cloudron.io/post/115481https://forum.cloudron.io/post/115481Mon, 17 Nov 2025 07:48:06 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Sun, 16 Nov 2025 10:00:44 GMT]]>[1.44.6]

]]>https://forum.cloudron.io/post/115450https://forum.cloudron.io/post/115450Sun, 16 Nov 2025 10:00:44 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Fri, 07 Nov 2025 06:48:20 GMT]]>[1.44.5]

]]>https://forum.cloudron.io/post/114987https://forum.cloudron.io/post/114987Fri, 07 Nov 2025 06:48:20 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Tue, 04 Nov 2025 06:48:07 GMT]]>[1.44.4]

  • Update paperless-ngx to 2.19.4
  • Full Changelog
  • Fix: use original_file when attaching docs to workflow emails with added trigger @shamoon (#11266)
  • Fix: mark 'Select' button in doc list for translation @shamoon (#11278)
  • Fix: respect fields parameter for created field @shamoon (#11251)
  • Fix: improve legibility of processed mail error popover in light mode @shamoon (#11258)
  • Fixhancement: truncate large logs, improve auto-scroll @shamoon (#11239)
  • Fix: delay iframe DOM removal, handle onafterprint error for print in FF @shamoon (#11237)
  • Fix: de-deduplicate children in tag list when filtering @shamoon (#11229)
  • Performance: re-enable virtual scroll, bump ng-select @shamoon (#11279)
  • Performance: use virtual scroll container and log level parsing for logs view @MickLesk (#11233)
]]>https://forum.cloudron.io/post/114830https://forum.cloudron.io/post/114830Tue, 04 Nov 2025 06:48:07 GMT<![CDATA[Reply to Paperless-ngx - Package Updates on Thu, 30 Oct 2025 08:29:09 GMT]]>[1.44.3]

  • Update paperless-ngx to 2.19.3
  • Full Changelog
  • Fix: remove unnecessary permission requirements for new email endpoint @shamoon (#11215)
  • Fix: refactor nested sorting in filterable dropdowns @shamoon (#11214)
  • Fix: add root tag filtering for tag list page consistency, fix toggle all @shamoon (#11208)
  • Fix: support ConsumableDocument in email attachments @shamoon (#11196)
  • Fix: add missing import for ConfirmButtonComponent in user-edit-dialog @shamoon (#11167)
  • Fix: resolve migration warning in 2.19.2 @shamoon (#11157)
  • Change: make workflow action only title draggable @shamoon (#11209)
  • Change: change workflowrun to softdeletemodel @shamoon (#11194)
]]>https://forum.cloudron.io/post/114593https://forum.cloudron.io/post/114593Thu, 30 Oct 2025 08:29:09 GMT