Skip to content

feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.3.0 - #6621

Open
tinfoild[bot] wants to merge 1 commit into
mainfrom
renovate/ghcr.io-paperless-ngx-paperless-ngx-3.x
Open

feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.3.0#6621
tinfoild[bot] wants to merge 1 commit into
mainfrom
renovate/ghcr.io-paperless-ngx-paperless-ngx-3.x

Conversation

@tinfoild

@tinfoild tinfoild Bot commented Jul 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change OpenSSF
ghcr.io/paperless-ngx/paperless-ngx major 2.20.15 → 3.3.0 OpenSSF Scorecard

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

paperless-ngx/paperless-ngx (ghcr.io/paperless-ngx/paperless-ngx)

v3.3.0: Paperless-ngx v3.3.0

Compare Source

paperless-ngx 3.3.0
Features / Enhancements
Bug Fixes
Documentation
Maintenance
Dependencies
27 changes
All App Changes
41 changes

v3.2.1: Paperless-ngx v3.2.1

Compare Source

paperless-ngx 3.2.1
Bug Fixes
Dependencies
All App Changes
4 changes

v3.2.0: Paperless-ngx v3.2.0

Compare Source

paperless-ngx 3.2.0
Features / Enhancements
Bug Fixes
Dependencies
29 changes
All App Changes
80 changes

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Singapore)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jul 22, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying jjgadgets-biohazard with  Cloudflare Pages  Cloudflare Pages

Latest commit: 18379b3
Status:🚫  Build failed.

View logs

@ciel-shieru

ciel-shieru commented Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-24 08:16 UTC
🤖 Scanner: Ciel Security Scanner
🔗 PR: #6621 — feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.0.2
📦 Packages checked: 1
🔍 Sources: NVD, OSV.dev, GHSA, GHSL, CISA KEV, FortiGuard, CVE.org, Changelog
⚠️ Vulnerabilities found: 0

Severity Summary

Severity Count
CRITICAL 0
HIGH 0
MEDIUM / MODERATE 0
LOW 0
UNKNOWN / NEEDS VERIFICATION 0
Total 0

Results

Package: ghcr.io/paperless-ngx/paperless-ngx

  • Ecosystem: Docker
  • Old version: 2.20.15 — CLEAN
  • New version: 3.0.2 — CLEAN

Vulnerabilities in version 2.20.15

No known vulnerabilities found.

Vulnerabilities in version 3.0.2

No known vulnerabilities found.

Source scan summary

Source Status Notes
OSV.dev ✅ Scanned No results for this package in any ecosystem
NVD ✅ Scanned CVE-2024-35184 (MEDIUM, CVSS 5.5) — fixed in 2.8.6, not applicable to either version; unrelated "Paperless" CVEs excluded (MeetingHub, Yokogawa)
GHSA ✅ Scanned 15 repo advisories reviewed — all patched in versions ≤ 2.20.15, not applicable
GHSL ✅ Scanned No GHSL publications found
CISA KEV ✅ Scanned No entries for this product
FortiGuard ✅ Scanned No advisories found
CVE.org ✅ Scanned No CVEs found for this exact package
Changelog ✅ Scanned v2.20.15→v3.0.2 includes breaking changes, features (AI, tantivy search), and security enhancements — no new CVEs introduced

Non-applicable findings (verified and excluded)

Finding Severity Reason not applicable
CVE-2024-35184 / GHSA-72w4-hxqq-c256 LOW Fixed in 2.8.6; both versions are later
GHSA-g6fw-vp8x-gr4j MEDIUM Fixed in 2.14.0; both versions are later
GHSA-6p53-hqqw-8j62 MEDIUM Fixed in 2.18.0; both versions are later
GHSA-6653-vcx4-69mc LOW Fixed in 2.20.2; both versions are later
GHSA-24x5-wp64-9fcc LOW Fixed in 2.20.2; both versions are later
GHSA-7cq3-mhxq-w946 LOW Fixed in 2.20.3; both versions are later
GHSA-28cf-xvcf-hw6m MEDIUM Fixed in 2.20.4; both versions are later
GHSA-w47q-3m69-84v8 MEDIUM Fixed in 2.20.6; both versions are later
GHSA-jqwv-hx7q-fxh3 LOW Fixed in 2.20.6; both versions are later
GHSA-x395-6h48-wr8v MEDIUM Fixed in 2.20.7; both versions are later
GHSA-7qqc-wrcw-2fj9 MEDIUM Fixed in 2.20.8; both versions are later
GHSA-386h-chg4-cfw9 MEDIUM Fixed in 2.20.9; both versions are later
GHSA-59xh-5vwx-4c4q HIGH Fixed in 2.20.11; both versions are later
GHSA-96jx-fj7m-qh6x MEDIUM Fixed in 2.20.12; both versions are later
GHSA-8c6x-pfjq-9gr7 LOW Fixed in 2.20.15; old version has the fix

Changelog Security Highlights (2.20.15 → 3.0.2)

  • v3.0.0 — Security: enforce current permissions in autocomplete; bound email linkification; validate/sanitize uploaded logos; opt-in blocking internal mail hosts; permission check fixes
  • v3.0.2 — Bug fix only (broken migration repair)

Recommendations

  • MERGE PRIORITY: LOW — No security vulnerabilities found in either version. All 15 previously disclosed GHSA advisories are patched in both the old (2.20.15) and new (3.0.2) versions. Merge at own discretion.
  • ⚠️ This is a major version bump (2.x → 3.x) with breaking changes. Review the v3.0.0 release notes for breaking changes including dropped Python 3.10 support, API version changes, removed features (document encryption, pybzar barcode reader), and pre/post consume script changes.

⚠️ This comment was posted by an automated security scanner (Ciel).
To re-scan, trigger the renovate-security-scanner skill.

@tinfoild
tinfoild Bot force-pushed the renovate/ghcr.io-paperless-ngx-paperless-ngx-3.x branch from c682ffb to 4d77132 Compare July 24, 2026 00:02
@tinfoild tinfoild Bot changed the title feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.0.0 feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.0.1 Jul 24, 2026
@ciel-shieru

ciel-shieru commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-24 01:05 UTC
🤖 Scanner: Ciel Security Scanner (fast mode: OSV.dev + NVD + GHSA)
🔗 PR: #6621 — feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.0.1
📦 Package: ghcr.io-paperless-ngx-paperless-ngx (ecosystem: container)
📊 Versions: old=? → new=3.0.1

Severity Summary

Severity Count
CRITICAL 0
HIGH 0
MEDIUM / MODERATE 0
LOW 1
UNKNOWN / NEEDS VERIFICATION 0
Total 1

Results

Package: ghcr.io-paperless-ngx-paperless-ngx

  • Old version: unknown
  • New version: 3.0.1
  • Ecosystem: container

Raw findings (truncated)

=== NEW: 3.0.1 ===
=== OSV.dev query for ghcr.io-paperless-ngx-paperless-ngx@3.0.1 (ecosystem: container) ===
No vulnerabilities found on OSV.dev for ghcr.io-paperless-ngx-paperless-ngx@3.0.1

=== NVD query for 'ghcr.io-paperless-ngx-paperless-ngx' (version filter: 3.0.1) ===
No CVEs found on NVD for keyword: ghcr.io-paperless-ngx-paperless-ngx

=== GHSA query for ghcr.io-paperless-ngx-paperless-ngx (ecosystem: container) ===
{"message":"Invalid request.\n\nInvalid input: `container` is not a possible value. Must be one of the following: rubygems, npm, pip, maven, nuget, composer, go, rust, erlang, actions, pub, other, swift.","documentation_url":"https://docs.github.com/rest/security-advisories/global-advisories#list-global-security-advisories","status":"422"}No GHSA advisories found

Recommendations

  • Review the findings above before merging.
  • Verify version-range applicability of each CVE before treating as actionable.

⚠️ This comment was posted by an automated security scanner (Ciel, fast mode).
To re-scan, trigger the renovate-security-scanner skill.

@tinfoild
tinfoild Bot force-pushed the renovate/ghcr.io-paperless-ngx-paperless-ngx-3.x branch from 4d77132 to 476096b Compare July 24, 2026 03:27
@tinfoild tinfoild Bot changed the title feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.0.1 feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.0.2 Jul 24, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/ghcr.io-paperless-ngx-paperless-ngx-3.x branch from 476096b to 01b8859 Compare July 26, 2026 00:03
@tinfoild tinfoild Bot changed the title feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.0.2 feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.0.3 Jul 26, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/ghcr.io-paperless-ngx-paperless-ngx-3.x branch from 01b8859 to c617f4f Compare July 28, 2026 06:35
@tinfoild tinfoild Bot changed the title feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.0.3 feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.0.4 Jul 28, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/ghcr.io-paperless-ngx-paperless-ngx-3.x branch from c617f4f to a3a9d1e Compare August 1, 2026 21:58
@tinfoild tinfoild Bot changed the title feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.0.4 feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.0.5 Aug 1, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/ghcr.io-paperless-ngx-paperless-ngx-3.x branch from a3a9d1e to 2f2bf50 Compare August 27, 2026 03:00
@tinfoild tinfoild Bot changed the title feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.0.5 feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.1.0 Aug 27, 2026
@tinfoild

tinfoild Bot commented Aug 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

kube/kustomization/out00

--- kube/clusters/biohazard/flux Kustomization: flux-system/0-biohazard-config Kustomization: paperless-ngx/paperless-ngx-pvc

+++ kube/clusters/biohazard/flux Kustomization: flux-system/0-biohazard-config Kustomization: paperless-ngx/paperless-ngx-pvc

@@ -277,13 +277,13 @@

       RGID: '1000'
       RUID: '1000'
       SC: file
       SIZE: 100Gi
       SNAP: file
       SNAP_ACCESSMODE: ReadOnlyMany
-      VS_APP_CURRENT_VERSION: ghcr.io/paperless-ngx/paperless-ngx:2.20.15@sha256:6c86cad803970ea782683a8e80e7403444c5bf3cf70de63b4d3c8e87500db92f
+      VS_APP_CURRENT_VERSION: ghcr.io/paperless-ngx/paperless-ngx:3.3.0@sha256:6b94799bc769a063b3340cc5847402e626d4d91d29a295a8e747f8e9bead4207
     substituteFrom:
     - kind: Secret
       name: biohazard-vars
       optional: false
     - kind: Secret
       name: biohazard-secrets
--- kube/deploy/core/storage/volsync/template Kustomization: paperless-ngx/paperless-ngx-pvc ReplicationSource: paperless-ngx/paperless-ngx-data-r2-updates-restic

+++ kube/deploy/core/storage/volsync/template Kustomization: paperless-ngx/paperless-ngx-pvc ReplicationSource: paperless-ngx/paperless-ngx-data-r2-updates-restic

@@ -53,8 +53,8 @@

       daily: 14
       within: 7d
     storageClassName: file
     volumeSnapshotClassName: file
   sourcePVC: paperless-ngx-data
   trigger:
-    manual: ghcr.io/paperless-ngx/paperless-ngx:2.20.15@sha256:6c86cad803970ea782683a8e80e7403444c5bf3cf70de63b4d3c8e87500db92f
+    manual: ghcr.io/paperless-ngx/paperless-ngx:3.3.0@sha256:6b94799bc769a063b3340cc5847402e626d4d91d29a295a8e747f8e9bead4207
 
--- kube/deploy/core/storage/volsync/template Kustomization: paperless-ngx/paperless-ngx-pvc VolumeSnapshot: paperless-ngx/paperless-ngx-data-ve87500db92f

+++ kube/deploy/core/storage/volsync/template Kustomization: paperless-ngx/paperless-ngx-pvc VolumeSnapshot: paperless-ngx/paperless-ngx-data-ve87500db92f

@@ -1,16 +0,0 @@

----
-apiVersion: snapshot.storage.k8s.io/v1
-kind: VolumeSnapshot
-metadata:
-  labels:
-    app.kubernetes.io/name: paperless-ngx
-    kustomize.toolkit.fluxcd.io/name: paperless-ngx-pvc
-    kustomize.toolkit.fluxcd.io/namespace: paperless-ngx
-    pvc.home.arpa/volsync: 'true'
-  name: paperless-ngx-data-ve87500db92f
-  namespace: paperless-ngx
-spec:
-  source:
-    persistentVolumeClaimName: paperless-ngx-data
-  volumeSnapshotClassName: file
-
--- kube/deploy/core/storage/volsync/template Kustomization: paperless-ngx/paperless-ngx-pvc VolumeSnapshot: paperless-ngx/paperless-ngx-data-v8e9bead4207

+++ kube/deploy/core/storage/volsync/template Kustomization: paperless-ngx/paperless-ngx-pvc VolumeSnapshot: paperless-ngx/paperless-ngx-data-v8e9bead4207

@@ -0,0 +1,16 @@

+---
+apiVersion: snapshot.storage.k8s.io/v1
+kind: VolumeSnapshot
+metadata:
+  labels:
+    app.kubernetes.io/name: paperless-ngx
+    kustomize.toolkit.fluxcd.io/name: paperless-ngx-pvc
+    kustomize.toolkit.fluxcd.io/namespace: paperless-ngx
+    pvc.home.arpa/volsync: 'true'
+  name: paperless-ngx-data-v8e9bead4207
+  namespace: paperless-ngx
+spec:
+  source:
+    persistentVolumeClaimName: paperless-ngx-data
+  volumeSnapshotClassName: file
+
--- kube/deploy/apps/paperless-ngx/app Kustomization: paperless-ngx/paperless-ngx-app HelmRelease: paperless-ngx/paperless-ngx

+++ kube/deploy/apps/paperless-ngx/app Kustomization: paperless-ngx/paperless-ngx-app HelmRelease: paperless-ngx/paperless-ngx

@@ -72,13 +72,13 @@

               USERMAP_UID: 1000
             envFrom:
             - secretRef:
                 name: paperless-ngx-secrets
             image:
               repository: ghcr.io/paperless-ngx/paperless-ngx
-              tag: 2.20.15@sha256:6c86cad803970ea782683a8e80e7403444c5bf3cf70de63b4d3c8e87500db92f
+              tag: 3.3.0@sha256:6b94799bc769a063b3340cc5847402e626d4d91d29a295a8e747f8e9bead4207
             probes:
               liveness:
                 enabled: true
               readiness:
                 enabled: true
               startup:

@tinfoild
tinfoild Bot force-pushed the renovate/ghcr.io-paperless-ngx-paperless-ngx-3.x branch from 2f2bf50 to 8f978c1 Compare August 31, 2026 10:38
@tinfoild tinfoild Bot changed the title feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.1.0 feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.1.1 Aug 31, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/ghcr.io-paperless-ngx-paperless-ngx-3.x branch from 8f978c1 to 88887cb Compare September 1, 2026 17:47
@tinfoild tinfoild Bot changed the title feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.1.1 feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.1.2 Sep 1, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/ghcr.io-paperless-ngx-paperless-ngx-3.x branch from 88887cb to 077bf6d Compare September 4, 2026 05:37
@tinfoild tinfoild Bot changed the title feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.1.2 feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.1.3 Sep 4, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/ghcr.io-paperless-ngx-paperless-ngx-3.x branch from 077bf6d to 02237e1 Compare September 19, 2026 06:12
@tinfoild tinfoild Bot changed the title feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.1.3 feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.2.0 Sep 19, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/ghcr.io-paperless-ngx-paperless-ngx-3.x branch from 02237e1 to d98b07e Compare September 20, 2026 22:37
@tinfoild tinfoild Bot changed the title feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.2.0 feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.2.1 Sep 20, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/ghcr.io-paperless-ngx-paperless-ngx-3.x branch from d98b07e to 18379b3 Compare October 6, 2026 10:42
@tinfoild tinfoild Bot changed the title feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.2.1 feat(oci/paperless-ngx)!: Update 2.20.15 ➼ 3.3.0 Oct 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

kube/deploy/apps renovate/datasource/docker renovate/type/major

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ciel-shieru