Papra changelog
Here are the changelogs of the docker images released by Papra.
For version after v0.9.6, Papra uses Calver as a versioning system with the format YY.M.N where M is the month number (1-12, not zero-padded, where 1 = January and 12 = December) and N is the number of releases in the month starting at 0 (e.g. 26.5.11 is the 12th release of May 2026).
v26.2.2
-
In the advanced PDF viewer, added empty placeholders for thumbnails to prevent layout shifts.
-
Fix an issue in the advanced PDF that caused the outline panel to appear empty
v26.2.1
-
Fixed an issue preventing the "about Papra" dialog from opening.
v26.2.0
-
Added a "Open with..." button for documents along with a complete PDF viewer page with standard features such as thumbnails, outline, attachments, and document properties.
-
Replaced
date-fnsfunctions with in-house implementations to avoid pulling the 30MB lib (mainly due to locale data). -
Added explicit error when trying to update a tag with a name that already exists
-
In the search queries, tag filters are now case-insensitive, so
tag:Importantandtag:importantwill match the same tag (as tags names are case-insensitive). -
Synchronized pagination state in the URL on the documents list page.
-
Trim tag names and descriptions on creation and update to avoid leading/trailing spaces.
-
Added a button to generate a random color in the tag creation/edition modal.
-
Significantly reduced the size of the rootless docker image by preventing file duplications due to
chownoperations, gaining ~230MB, more than 30% reduction in size. -
Added an option to limit the number of tags that can be created in an organization, defaulting to 200. Configurable via the
MAX_TAGS_PER_ORGANIZATIONenvironment variable. -
Excluded Synology specific files for the ingestion folder
-
Coerce MIME type of intake email attachments when declared as
application/octet-streamor empty, using magic bytes detection with extension-based fallback. -
Fixed a race condition that could incorrectly show the "Email verified" page after successful login, even when email verification had not been completed or was not required.
-
Improved the document tag picker UI and UX, allowing tags to be managed from the document list.
-
Added tagging rules creation/update loading states
-
Removed misleading "git missing" error log on app startup when git isn't available, like in Docker env.
-
Tag names uniqueness enforced with case insensitivity per organization. Migration will ensure deduplication by appending prefixes in case of existing collisions.
-
Added small header in organization creation page to quickly access the invitations when first organization is being created
-
The command palette state no longer resets when opening it, allowing to keep the search query and results when closing and reopening it.
-
Added tag creation/update button loading state
-
Enforced the length of the intake email webhook secret (
INTAKE_EMAILS_WEBHOOK_SECRET) to be between 16 and 128 characters to match the OwlRelay API validation requirements. -
Prevented multiple tagging-rules creation attempts when clicking the create button quickly.
-
Prevented multiple tag creation attempts when clicking the create button quickly.
-
Api breaking change: removed the
/api/organizations/:organizationId/documents/searchendpoint in favor of the existing/api/organizations/:organizationId/documentswith an optionalsearchQueryquery parameter. The new/api/organizations/:organizationId/documentsendpoint now behave as the old/searchendpoint, with all documents being returned whensearchQueryis empty. Note that the response fieldtotalCountof the old/searchendpoint has been renamed todocumentsCountin the new endpoint.Before:
GET /api/organizations/:organizationId/documents/search?searchQuery=invoice&pageIndex=1&pageSize=20 Response: { documents: Document[]; totalCount: number; } GET /api/organizations/:organizationId/documents?pageIndex=1&pageSize=20 Response: { documents: Document[]; documentsCount: number; }After:
GET /api/organizations/:organizationId/documents?searchQuery=invoice&pageIndex=1&pageSize=20 Response: { documents: Document[]; documentsCount: number; } -
Security fix: prevented unauthorized listing to organization tags and webhooks. An authenticated user could list the tags and webhooks of an organization they are not a member of by sending requests to the corresponding endpoints by knowing the organization ID. Credit to Sergio Cabrera, security researcher, for responsibly disclosing this vulnerability.
v26.1.0
-
Renamed the internal distribution package from
@papra/dockerto@papra/app. New release tags will use the format@papra/[email protected]instead of@papra/[email protected]. -
Tag list: order tags by creation date descending (newest on top)
-
When navigating to / and having only one organization, get redirected to that organization
-
Fix tag automatic search link issue when tags have spaces, before
tag:my tagwould not work, now generatetag:"my tag"to fix it. -
Hide the "Don't have an account? Register" link on the login page when new account registration is disabled.
-
Added the
has:tagssearch filter to check for the presence or absence (-has:tagsorNOT has:tags) of tags on documents. -
Properly tree-shake all demo assets to reduce the size of production non-demo build. Reducing the bundle assets by
70kB (55kB on main chunk + removed demo chunk of ~15kB). -
Added Greek language support
-
Added Russian language support
v26.0.0
-
API Breaking Change: Document search endpoint now returns complete documents along with total count matching the search query, and no longer nests results under
searchResults.Before:
// GET /api/organizations/:organizationId/documents/search?searchQuery=foobar { searchResults: { documents: [ { id: 'doc_1', name: 'Document 1.pdf' }, { id: 'doc_2', name: 'Document 2.pdf' }, ], }, }After:
// GET /api/organizations/:organizationId/documents/search?searchQuery=foobar { documents: [ { id: 'doc_1', name: 'Document 1.pdf', mimeType: 'application/pdf' /* ...otherProps */ }, { id: 'doc_2', name: 'Document 2.pdf', mimeType: 'application/pdf' /* ...otherProps */ }, ], totalCount: 42, } -
Added a "Show more results" option in quick search when there is more document not displayed
-
Improved search speed by using document and organization ids in index The first restart after updating may take up to few minutes as the search index is rebuilt
-
The documents page can now be used with advanced search queries
-
Auto assign admin role to the first user registering
-
Added about page and modal with version informations
-
Added a dedicated increased timeout for the document upload route
-
Added a feedback message upon request timeout
-
Added support for two factor authentication
-
Organizations listing and details in the admin dashboard
-
Added advanced search syntax support
-
Properly cleanup orphan file when the same document exists in trash
-
Added query params sync for the search query in the documents search page for deep linking and browser state navigation
-
Removed the possibility to filter by tag in the
/api/organizations/:organizationId/documentsroute, use the/api/organizations/:organizationId/documents/searchroute instead.# Before: GET /api/organizations/:organizationId/documents?tags=yourTagId # After: GET /api/organizations/:organizationId/documents/search?query=tag:yourTagNameOrId -
Changed config key
config.server.routeTimeoutMstoconfig.server.defaultRouteTimeoutMs(env variable remains the same) -
Added api endpoint to check current API key (GET /api/api-keys/current)
v25.12.0
-
Document search indexing and synchronization is now asynchronous, and no longer relies on database triggers. This significantly improves the responsiveness of the application when adding, updating, trashing, restoring, or deleting documents. It's even more noticeable when dealing with a large number of documents or on low-end hardware.
-
Enforcing the auth secret to be at least 32 characters long for security reasons
-
Now throw an error if AUTH_SECRET is not set in production mode
-
Added a platform administration dashboard
-
Added support for Simplified Chinese language
-
Fixed an issue where the document icon didn't load for unknown file types
v25.11.0
-
Added the possibility to filter out some email domain names for new registration
-
Lazy load some demo-mode specific code to reduce production client bundle
-
Added translations for document table headers
-
Added some logging context when an intake email is received
-
Api breaking change: the document search endpoint return format changed, impacting any custom clients consuming it.
Before
// Get /api/organizations/:organizationId/documents/search { documents: { id: string; name: string; mimeType: string; // ... other document fields } []; }After
// Get /api/organizations/:organizationId/documents/search { searchResults: { documents: { id: string; name: string; } []; } } -
Limit concurrent browser upload to avoid network crashes
-
Made the tags clickable in the tag list
-
Intake email edge case: use original destination addresses when available for intake emails when forwarded
-
Upgraded to node v24
-
Added Dutch translation
-
Improved server authentication logging
-
Improved unique constraints error when dealing with hosted libsql db
-
Fix tags table overflow for long tag descriptions: added some text wrapping for the description
-
Fix environment variable
DOCUMENT_STORAGE_S3_FORCE_PATH_STYLEvalidation schema to account for boolean string
v25.10.2
-
Added an email verification confirmation/expiration page
-
Improved graceful shutdown
-
Reduced client bundle size by removing date-fns
-
Fix client redirection issue on non-existent organization
-
Added text extraction support for
.docx,.odt,.rtf,.pptxand.odp -
Updated pnpm version
-
Added global errors handlers
-
Added missing translations in the tagging rule form
-
Choose between
All conditions must matchandAny condition must matchin tagging rules -
Fixed the webhook last triggered date always showing "never" in the webhook list.
-
Improved the translation of dates and relative time
-
Added the possibility to start either just the api, just the workers, or both (default)
-
Fix webhook creation form preventing to create webhooks without secrets
-
Fixed wrongly formatted [object Object] feedback message in auth pages
v25.10.1
-
Removed unnecessary left icon navbar
-
Added deleted and total document counts and sizes in the
/api/organizations/:organizationId/documents/statisticsroute -
Added server hostname configuration
-
Lighten the client bundle by removing lodash dep
-
Fix weird navigation freeze when direct navigation to organizations
-
Made the validation more permissive for incoming intake email webhook addresses, allowing RFC 5322 compliant email addresses instead of just simple emails.
-
Prevent small flash of wrong theme on initial load for slower connections
-
Redacted webhook signing secret in api update response
-
Reduced the client bundle size by switching to posthog-lite
-
Use organization max file size limit for pre-upload validation
-
Redesigned the organization picker in the sidenav
v25.10.0
-
Use calendar based versioning for docker images
-
Drop docker armv7 support
-
Added soft deletion with grace period for organizations
-
Added a page to view organization usage
-
Save document activity log when auto tagging rule is applied
-
Trigger tag-added webhooks when auto tagging rule is applied
v0.9.6
-
Added env variable to configure ip header for rate limit
-
Fixed the api validation of tag colors to make it case incensitive
v0.9.5
-
Properly handle file names encoding (utf8 instead of latin1) to support non-ASCII characters.
-
Prevented organization deletion by non-organization owner
v0.9.4
-
Added an option to disable PRAGMA statements from sqlite task service migrations
-
Added fallbacks env variables for the task worker id
-
Added organizations permissions for api keys
v0.9.3
-
Added the possibility to define patterns for email intake username generation
-
Split the intake-email username generation from the email address creation, some changes regarding the configuration when using the
randomdriver.# Old configuration INTAKE_EMAILS_DRIVER=random-username INTAKE_EMAILS_EMAIL_GENERATION_DOMAIN=mydomain.com # New configuration INTAKE_EMAILS_DRIVER=catch-all INTAKE_EMAILS_CATCH_ALL_DOMAIN=mydomain.com INTAKE_EMAILS_USERNAME_DRIVER=random -
Added the possibility to configure OwlRelay domain
v0.9.2
-
Fix to allow cross docker volume file moving when consumption is done
-
Added the possibility to define a Libsql/Sqlite driver for the tasks service
-
Enhanced security by serving files as attachement and with an octet-stream content type
-
Fix an issue preventing to disable the max upload size
-
Removed the "open in new tab" button for security improvement (xss prevention)
v0.9.1
-
Fix cleanup state when a too-big-file is uploaded
-
Added a client side guard for rejecting too-big files
-
Fix favicons display issues on firefox
-
Fix i18n messages when a file-too-big error happens
-
Clean all upload method to happen through the import status modal
v0.9.0
-
Dropped support for the dedicated backblaze b2 storage driver as b2 now fully support s3 client
-
Added documents encryption layer
-
Stream file upload instead of full in-memory loading
-
Fix a bug where the ingestion folder was not working when the done or error destination folder path (
INGESTION_FOLDER_POST_PROCESSING_MOVE_FOLDER_PATHandINGESTION_FOLDER_ERROR_FOLDER_PATH) were absolute. -
Use node file streams in ingestion folder for smaller RAM footprint
-
Fixed an issue where tags assigned to only deleted documents won't show up in the tag list
-
Properly handle missing files errors in storage drivers
-
Lazy load the PDF viewer to reduce the main chunk size
-
Allow for more complex intake-email origin adresses
-
Simplified i18n tooling + improved performances
-
Prevent infinit loading in search modal when an error occure
-
Improved the UX of the document content edition panel
-
Added content edition support in demo mode
v0.8.2
-
Fix a regression bug that executed tagging rules before the file content was extracted
v0.8.1
-
Removed dev-dependency needed in production build
v0.8.0
-
Completely rewrote the migration mechanism
-
The file content extraction (like OCR) is now done asynchronously by the task runner
-
Fixed the impossibility to delete a tag that has been assigned to a document
-
Added new webhook events: document:updated, document:tag:added, document:tag:removed
-
Webhooks invocation is now defered
-
Added diacritics and improved wording for Romanian translation
-
Added feedback when an error occurs while deleting a tag
-
Simplified the organization intake email list
-
Added Italian (it) language support
-
Improved feedback message in case of invalid origin configuration
v0.7.0
-
v0.7 release
v0.6.4
-
Fix permission issue for non 1000:1000 rootless user
-
Added configuration for the ocr language using DOCUMENTS_OCR_LANGUAGES
-
Improve file preview for text-like files (.env, yaml, extension-less text files,...)
-
Fix weird centering in document page for long filenames
-
Added the possibility to disable login via email, to support sso-only auth
-
Introduce APP_BASE_URL to mutualize server and client base url
-
Fixes 400 error when submitting tags with uppercase hex colour codes.
-
Added Romanian (ro) translation
-
Added Brazilian Portuguese (pt-BR) language support
-
Fix back to organization link in organization settings
-
Added Polish (pl) language support
-
Updated dependencies
-
Added Spanish (es) translation
-
Added European Portuguese (pt) translation
-
Added tag color swatches and picker
v0.6.3
-
Added a /llms.txt on main website
-
Allow for adding/removing tags to document using api keys
-
Add German translation
v0.6.2
-
Ensure database directory exists when running scripts (like migrations)
-
Fixed version release link
v0.6.1
-
Fix content disposition header to support non-ascii filenames
v0.6.0
-
Set CLIENT_BASE_URL default value to http://localhost:1221 in Dockerfiles
-
Added document activity log
-
Added pending invitation management page
-
Added support for classic SMTP client for email sending
-
Reworked the email sending system to be more flexible and allow for different drivers to be used.
EMAILS_DRY_RUNhas been removed and you can now useEMAILS_DRIVER=loggerconfig option to log emails instead of sending them. -
Disable "Manage subscription" from organization setting by default
-
I18n: full support for French language
-
Fixed an issue with the reset-password page navigation guard that prevented reset
v0.5.1
-
Set email setting to dry-run by default in docker
v0.5.0
-
Added support for custom oauth2 providers
-
Ensure local database directory en boot
-
Added invitation system to add users to an organization
-
Fix register page description
v0.4.0
-
Properly hard delete files in storage driver
-
Added support for b2 document storage
-
Added support for azure blob document storage
-
Added webhook management
-
Added API keys support
-
Added document searchable content edit
-
Fix ingestion config coercion
-
Added tag creation button in document page
-
Improved tag selector input wrapping
-
Properly handle file names without extensions
-
Wrap text in document preview
-
Excluded deleted documents from doc count