feat(container)!: Update image ghcr.io/paperless-ngx/paperless-ngx (2.20.15 → 3.0.3) by bot-akira[bot] · Pull Request #3672 · axeII/home-ops

bot-akira · 2026-07-22T19:24:43Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
ghcr.io/paperless-ngx/paperless-ngx	major	`2.20.15` → `3.0.3`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

paperless-ngx/paperless-ngx (ghcr.io/paperless-ngx/paperless-ngx)

`v3.0.3`: Paperless-ngx v3.0.3

Compare Source

paperless-ngx 3.0.3

Bug Fixes

Fixhancement: PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT @shamoon (#13281)
Fix: preserve document fields during Gotenberg conversion to PDF @stumpylog (#13271)
Fix: Makes the email date aware as soon as possible during parsing @stumpylog (#13266)
Fix: Handle a plain string as Celery sometimes provides for the traceback @stumpylog (#13267)
Fix: Emit the torch index into the requirements.txt for people still using it @stumpylog (#13265)
Fix: handle notes without a user when building the search index @matthiasmast (#13260)

Documentation

Docs: warn bare-metal users about stale files when upgrading @stumpylog (#13296)
Documentation: Add the NumPy CPU baseline increase to the migration guide @stumpylog (#13269)

Maintenance

Fix: Emit the torch index into the requirements.txt for people still using it @stumpylog (#13265)

All App Changes

6 changes

Fixhancement: PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT @shamoon (#13281)
Tweak: adjust top navbar wrapping when AI chat button visible @shamoon (#13280)
Fix: preserve document fields during Gotenberg conversion to PDF @stumpylog (#13271)
Fix: Makes the email date aware as soon as possible during parsing @stumpylog (#13266)
Fix: Handle a plain string as Celery sometimes provides for the traceback @stumpylog (#13267)
Fix: handle notes without a user when building the search index @matthiasmast (#13260)

`v3.0.2`: Paperless-ngx v3.0.2

Compare Source

paperless-ngx 3.0.2

Bug Fixes

Fix: fix broken migration in 3.0.1 @shamoon (#13242)

All App Changes

Fix: fix broken migration in 3.0.1 @shamoon (#13242)

`v3.0.1`: Paperless-ngx v3.0.1

Compare Source

[!WARNING]
An issue with database migrations prevents v3.0.1 from running, users should upgrade to v3.0.2

paperless-ngx 3.0.1

Bug Fixes

Fix: selection_data re-derives the filtered document set 5 times over @stumpylog (#13229)
Fix: exclude source document from its own RAG similarity results @stumpylog (#13233)
Fix: split mailrule maximum_age clamp into its own migration @stumpylog (#13231)
Chore: mark yes in confirm button for translation @shamoon (#13225)
Fix: correct URL for W001 check @shamoon (#13220)
Fix: ensure create dialog uses correct attribute type @shamoon (#13221)
Fix: correct database engine from postgres to postgresql @OberstVonGatow (#13213)
Fix: remove unnecessary .distinct() dominating document list queries @stumpylog (#13205)
Fix: also wrap non-breaking words in chat messages, handle whitespace @shamoon (#13211)
Fix: tag/custom-field document_count scales badly with tag count @stumpylog (#13203)
Fix: batch document user_can_change checks to avoid per-row N+1 @stumpylog (#13204)
Fix: fix app title restoration @shamoon (#13208)
Fix: handle long wrapping titles in AI chat document list @shamoon (#13206)

Dependencies

Chore(deps-dev): Bump postcss from 8.5.6 to 8.5.22 in /src/paperless_mail/templates in the npm_and_yarn group across 1 directory @dependabot[bot] (#13236)
Chore(deps): Bump pyasn1 from 0.6.3 to 0.6.4 in the uv group across 1 directory @dependabot[bot] (#13237)
Chore(deps): Bump the uv group across 1 directory with 8 updates @dependabot[bot] (#13189)

All App Changes

17 changes

Chore(deps-dev): Bump postcss from 8.5.6 to 8.5.22 in /src/paperless_mail/templates in the npm_and_yarn group across 1 directory @dependabot[bot] (#13236)
Fix: selection_data re-derives the filtered document set 5 times over @stumpylog (#13229)
Chore: reword "Settings > Default permissions" description for clarity @NotaInutilis (#13232)
Chore(deps): Bump pyasn1 from 0.6.3 to 0.6.4 in the uv group across 1 directory @dependabot[bot] (#13237)
Chore(deps): Bump the uv group across 1 directory with 8 updates @dependabot[bot] (#13189)
Fix: exclude source document from its own RAG similarity results @stumpylog (#13233)
Fix: split mailrule maximum_age clamp into its own migration @stumpylog (#13231)
Chore: mark yes in confirm button for translation @shamoon (#13225)
Fix: correct URL for W001 check @shamoon (#13220)
Fix: ensure create dialog uses correct attribute type @shamoon (#13221)
Fix: correct database engine from postgres to postgresql @OberstVonGatow (#13213)
Fix: remove unnecessary .distinct() dominating document list queries @stumpylog (#13205)
Fix: also wrap non-breaking words in chat messages, handle whitespace @shamoon (#13211)
Fix: tag/custom-field document_count scales badly with tag count @stumpylog (#13203)
Fix: batch document user_can_change checks to avoid per-row N+1 @stumpylog (#13204)
Fix: fix app title restoration @shamoon (#13208)
Fix: handle long wrapping titles in AI chat document list @shamoon (#13206)

`v3.0.0`: Paperless-ngx v3.0.0

Compare Source

paperless-ngx 3.0.0

Breaking Changes

[BREAKING] Remove the positional arguments from the pre/post consume scripts @stumpylog (#12573)
[BREAKING] Decouple OCR control from archive file control @stumpylog (#12448)
[BREAKING] Chore: drop support for api versions < 9 @shamoon (#12284)
[BREAKING] Chore: Drop support for Python 3.10 @stumpylog (#12234)
[BREAKING] Chore: Refactor advanced database settings to allow more user configuration @stumpylog (#12165)
[BREAKING] Remove API v1 compatability @stumpylog (#12166)
[BREAKING] Remove pybzar as a barcode reader @stumpylog (#12065)
[BREAKING] Remove support for document and thumbnail encryption @stumpylog (#11850)
[BREAKING] Feature: Simplify and improve the consumer @stumpylog (#11753)

Notable Changes

Feature: Replace Whoosh with tantivy search backend @stumpylog (#12471)
Feature: document parser plugin framework @stumpylog (#12294)
Feature: document file versions @shamoon (#12061)
Feature: sharelink bundles @shamoon (#11682)
Feature: Paperless AI @shamoon (#10319)
Feature: Remote OCR (Azure AI) @shamoon (#10320)

Features / Enhancements

[Beta] Paperless-ngx v3.0.0 Beta @shamoon (#12713)
Tweakhancement (beta): allow some bulk operations with all @shamoon (#13193)
Security (beta): enforce current permissions in autocomplete @shamoon (#13188)
Security (beta): bound email linkification @shamoon (#13187)
Change: update root modified timestamp on version changes @shamoon (#13170)
Performance: add DB indexes for common query/sort patterns @stumpylog (#13167)
Performance: use NgOptimizedImage for thumbnail lazy loading @shamoon (#13169)
Performance: Tantivy indexing optimization @Merinorus (#13053)
Chorehancement: update to Angular v22, 'zoneless' / 'reactive' @shamoon (#13114)
Enhancement (beta): support LLM timeout config @shamoon (#13002)
Enhancement: ignore diacritics, support multiple substring matching for UI filtering @shamoon (#13021)
Enhancement(beta): replace LanceDB vector store with sqlite-vec @stumpylog (#12990)
Enhancement (beta): Switch the AI vector store to LanceDB @stumpylog (#12944)
Fixhancement (beta): tasks dismiss all @shamoon (#12949)
Enhancement (beta): add direct LLM language setting @shamoon (#12906)
Enhancement: try to respect language for AI suggestions @shamoon (#12894)
Enhancement: AI LLM chunk size and context window config @shamoon (#12891)
Enhancement: support ollama embeddings @shamoon (#12753)
Tweakhancment: Include the last applied 'documents' migration in the log @stumpylog (#12757)
Enhancement: version-aware thumbnail etag @shamoon (#12754)
Documentation: Update v3 migration docs @shamoon (#12752)
Feature: Further reduce document importer memory usage @stumpylog (#12707)
Tweakhancement: use fixed position instead of display none for printing @shamoon (#12706)
Enhancement: Paperless-ngx v3 Logo @shamoon (#12673)
Tweakhancement: localize some more task result messages @shamoon (#12672)
Enhancement: chat message document links @shamoon (#12670)
Tweakhancement: make upload notification open an anchor link @shamoon (#12659)
Tweakhancement: tweak tasks UI, make open doc an anchor @shamoon (#12658)
Enhancement: show small task summary in system status @shamoon (#12634)
Enhancement: new Tasks UI @shamoon (#12614)
Feature: Allow monitoring access to tasks summary @stumpylog (#12624)
Tweak: remove stale index warning @shamoon (#12616)
Enhancement: add highlighting to title + content searches @shamoon (#12593)
Feature: Redesign the task system @stumpylog (#12584)
Feature: Tune SQLite default settings for increased speed @stumpylog (#12580)
Feature: Document fuzzy match improvements @stumpylog (#12579)
Enhancement: validate and sanitize uploaded logos @shamoon (#12551)
Enhancement: add view_global_statistics and view_system_status permissions @shamoon (#12530)
Fixhancement: include sharelinks + bundles in export/import @shamoon (#12479)
Enhancement: unify text search to use tantivy @shamoon (#12485)
Feature: Consumer logging correlation @stumpylog (#12510)
Security enhancement: allow opt-in blocking internal mail hosts @shamoon (#12502)
Feature: Replace Whoosh with tantivy search backend @stumpylog (#12471)
Fixhancement: include trashed documents in document exporter/importer @JanKleine (#12425)
Tweakhancement: show file extension in StoragePath test @shamoon (#12452)
Feature: Transition all checksums to use SHA256 @stumpylog (#12432)
Enhancement: auto-hide the search bar on mobile @shamoon (#12404)
Change: sort custom fields alphabetically by default @shamoon (#12358)
Feature: Add progress information to the classifier training for a better ux @stumpylog (#12331)
Feature: document parser plugin framework @stumpylog (#12294)
Enhancement: Make the StatusConsumer truly async @stumpylog (#12298)
Feature: Migrate import/export to rich progress @stumpylog (#12260)
Enhancement: Show more document details in merge dialog @svenstaro (#12271)
Enhancement: saved view sharing @shamoon (#12142)
Enhancement: “live” document updates @shamoon (#12141)
Enhancement: Improve the retagger output using rich @stumpylog (#12194)
Enhancement: Transition sanity check to rich and improve output @stumpylog (#12182)
Enhancement: Switch all indexing to use rich @stumpylog (#12193)
Feature: Switch progress bar library to rich @stumpylog (#12169)
Enhancment: Formatted filename for single document downloads @JanKleine (#12095)
Feature: document file versions @shamoon (#12061)
Enhancement: prevent duplicate mail processing across rules @shamoon (#12159)
Feature: move to trash action for workflows @JanKleine (#11176)
Tweakhancement: reset to page 1 on reset filters @shamoon (#12143)
Enhancement: consolidate management lists into document attributes section @shamoon (#12045)
Enhancement: option to stop processing further mail rules @shamoon (#12053)
Tweak: improve 2-digit year parsing @shamoon (#12044)
Enhancement: pngx pdf viewer @shamoon (#12043)
Fixhancement: improve ASN handling with PDF operations @shamoon (#11689)
Feature: Enable users to customize date parsing via plugins @stumpylog (#11931)
Feature: password removal workflow action @shamoon (#11665)
Enhancement: per-type object page sizing @shamoon (#11977)
Enhancement: improve filter drop-down performance with virtual scrolling @shamoon (#11973)
Tweakhancement: tweak bulk delete text @shamoon (#11967)
Feature: support split documents based on tag barcodes @schober-ch (#11645)
Enhancement: Add setting for default PDF Editor mode @JanKleine (#11927)
Fixhancement: auto-queue llm index if needed @shamoon (#11891)
Feature: sharelink bundles @shamoon (#11682)
Enhancement: user control of doc details fields @shamoon (#11906)
Enhancement: improve relative dates in date filter @JanKleine (#11899)
Enhancement: allow duplicates with warnings, UI for discovery @shamoon (#11815)
Enhancement: configurable SSO groups claim @Gabgobie (#11841)
Enhancement: support select all for management lists @shamoon (#11889)
Tweakhancement: display document id, with copy @shamoon (#11896)
Enhancement: Add support for app oidc @paulgessinger (#11756)
Enhancement: Add 'any of' workflow trigger filters @shamoon (#11683)
Enhancement: support doc_id placeholder in workflow templates @shamoon (#11847)
Performance: improve treenode inefficiencies @shamoon (#11606)
Feature: Remote OCR (Azure AI) @shamoon (#10320)
Feature: password removal action @shamoon (#11656)
Tweakhancement: use anchor element for management list quick filter buttons @shamoon (#11692)
Feature: Indonesian translation @shamoon (#11641)

Bug Fixes

Fix (beta): prevent pdfjs offsetParent warning @shamoon (#13197)
Fix (beta): dont include hidden buttons in virtual scroll container height @shamoon (#13194)
Fix (beta): fix custom field bulk editing for 'all' @shamoon (#13191)
Security (beta): two small permission check fixes @shamoon (#13186)
Fix (beta): short-circuit ObjectOwnedOrGrantedPermissionsFilter for superusers @stumpylog (#13183)
Fix (beta): compute num_notes via a subquery instead of Count()+distinct @stumpylog (#13182)
Fix: prevent tag assignment from reverting other pending workflow assignments @stumpylog (#13178)
Fix(beta): cache per-request effective-document resolution for thumb/metadata/preview @stumpylog (#13166)
Fix: fallback from archive version for share links @shamoon (#13163)
Fix: better handle saved view errors in dashboard widgets @shamoon (#13164)
Fix (beta): convert chat component to signal-backed Angular @shamoon (#13152)
Fix: HTTP 500 filtering documents by tags + custom field query on MariaDB @stumpylog (#13143)
Fix: scope ProcessedMail UID deduplication by IMAP UIDVALIDITY @chouquette (#12839)
Fix: allow setting any UID and GID when running rootless @Tahvok (#13090)
Fix (beta): fix sidebar document close button @shamoon (#13136)
Fix: include wasm assets in pdf.js-based viewer @shamoon (#13122)
Fix: fix ui labels from md5 to sha256 @shamoon (#13119)
Fixhancement: dont assign empty title in workflow with broken template @shamoon (#13112)
Fix: clamp mailrule max age before migration @shamoon (#13093)
Fix: use latest document version for bulk download @shamoon (#13103)
Fix (beta): handle relative date with comma query @shamoon (#13087)
Fix (beta): fix sanity checker affected document counts @NgoQuocViet2001 (#13052)
Fix (beta): preserve Unicode in localization prompt @shamoon (#13055)
Fix: change tantivy token limit to title field max length @shamoon (#13046)
Fix: include last-modified in doc etag @shamoon (#13044)
Fix (beta): Stream chunks during compaction to prevent oom on smaller installs @stumpylog (#13014)
Fixhancement (beta): truncate embedding queries for small chunk size @shamoon (#13028)
Fix(beta): Workaround a Tantivy panic in more like this searching @stumpylog (#13026)
Fix (beta): Catch consumer files created during watcher re-creations @stumpylog (#13013)
Fix (beta): restore v2 (Whoosh) advanced-search query compatibility @stumpylog (#13010)
Fix (beta): retry celery ping and report warning on no response @shamoon (#13012)
Fix (beta): don't send chat message on Enter while composing with IME (CJK) @mzyy94 (#12999)
Fix: Apply unicode normalization to all paths and path components @stumpylog (#12993)
Fix: Handle the UTF 16 and BOM text files better @stumpylog (#12994)
Fix (beta): avoid DRF update calling save on all fields @shamoon (#12992)
Fix: release pooled DB connection during AI LLM/embedding calls @stumpylog (#12983)
Fix: health-check pooled DB connections and close the pool on worker shutdown @stumpylog (#12977)
Fix: wrap long titles in delete confirm dialog @shamoon (#12973)
Fix (beta): fix re-ordering in merge dialog @shamoon (#12967)
Fix (beta): move task filtering to backend fully @shamoon (#12956)
Fix (beta): avoid unnecessary creating new PDF with pw removal workflow @shamoon (#12948)
Fixhancement (beta): tasks dismiss all @shamoon (#12949)
Fix (beta): correct chat message bg color @shamoon (#12955)
Fix (beta): respect disable state for suggest endpoint, require change perms @shamoon (#12942)
Fix: Ensure checksum comparision is using SHA256 @stumpylog (#12939)
Fix: Restrict the AI backend at settings configure time @stumpylog (#12903)
Fix (beta): correctly apply i18n in suggestions dropdown @shamoon (#12905)
Fix: Lock AI index during reading and don't index documents many times during a bulk update @stumpylog (#12899)
Fix: Minor fixes for the AI indexing @stumpylog (#12893)
Fix (beta): dont use tool calling with ollama @shamoon (#12896)
Fix: Improvements for security around the AI @stumpylog (#12895)
Fix: correctly show timestamp tooltip on history item @nathanaelhoun (#12879)
Fix: Fold query and autocomplete terms with Tantivy's ascii_fold so special letters match @stumpylog (#12868)
Fix: Don't store autocomplete_word, only index it @stumpylog (#12867)
Fix: Preserve Whoosh date range swapping in Tantviy @stumpylog (#12866)
Fix: Always release search index writer @stumpylog (#12865)
Fix: Handle CJK title, content and metadata searching @stumpylog (#12862)
Fix: Restrict date query rewrites to date or datetime fields only @stumpylog (#12864)
Fix: Missing call to tanvity wait_merging_threads @stumpylog (#12863)
Fix: Handle tanvity index lock contention @stumpylog (#12856)
Fix (beta): better catch chat errors @shamoon (#12854)
Security (beta): fixes for v3 beta @shamoon (#12838)
Fix (beta): normalize long punctuation chunks to improve embedding @shamoon (#12848)
Fix: use chord.on_error before apply_async @shamoon (#12842)
Fix: Don't use smaller integer fields for some workflow fields @stumpylog (#12834)
Fix: Password removal source file location @stumpylog (#12830)
Fix (beta): use correct html button type for custom field buttons @shamoon (#12819)
Fix: Defer password removal workflow action until the file is in place @stumpylog (#12814)
Fix: Allow setting allauth rate limit configuration settings @stumpylog (#12798)
Fix: Don't embed the metadata which is already embedded into the context @stumpylog (#12795)
Fix: Sanitize dash or plus from the text search path @stumpylog (#12789)
Fix: improve new tasks ui layout across screen sizes @shamoon (#12784)
Fix: Update parser contract to require empty strings, not None @shamoon (#12775)
Fix: Use a persistent, writeable location for hugging face models @stumpylog (#12771)
Fix: create LLM_INDEX_DIR before writing meta.json on first run @pReya (#12759)
Tweakhancment: Include the last applied 'documents' migration in the log @stumpylog (#12757)
Fix: use response synthesizer for RAG doc chat @shamoon (#12751)
Fix: only update modified field in notes actions @shamoon (#12750)
Fix: Handle dash or plus operators in search queries @stumpylog (#12734)
Fixes trash preview when a document has deleted versions @stumpylog (#12742)
Fix: exclude versions from stats count @shamoon (#12738)
Fixes celery chords by using Redis as our result backend @stumpylog (#12741)
Fix: bump version.py to 3.0.0 also @shamoon (#12736)
Fix: makes the font cache folder writeable to all users @stumpylog (#12726)
Fixes Whoosh year only queries to be rewritten to Tantivy date syntax @stumpylog (#12725)
Fix: pass allow parallel tool calls in LLM client @shamoon (#12718)
Fix: Handle passwords for removal action as lists @stumpylog (#12716)
Bumps all our versions to 3.0.0 @stumpylog (#12715)
Fix: avoid unnecessary close_old_connections in Celery task dispatch @stumpylog (#12701)
Fix: apply tag changes directly to document in db @shamoon (#12664)
Fix: Use FileResponse for file API responses @stumpylog (#12638)
Fix: Changes bare metal webserver to use uvloop @stumpylog (#12626)
Fixhancement: Exact custom field monetary exact searching @stumpylog (#12592)
Fix: relative added date check visibility @shamoon (#12600)
Fix: prevent intermediate change event when CustomFieldQueryAtom operator changes type @ggouzi (#12597)
Fix: reject invalid requests to API notes endpoint @ggouzi (#12582)
Fixhancement: include sharelinks + bundles in export/import @shamoon (#12479)
Fix: Respect workflow change_groups during consumption @stumpylog (#12431)
Fix: Don't try to update the user when running as non-root @stumpylog (#12365)
Fix: use maxsplit=1 in Redis URL parsing to handle URLs with multiple colons @cryptomilk (#12239)
Fixhancement: show sequential + id version labels, fix padding @shamoon (#12196)
Fix: correct user dropdown button icon styling @shamoon (#12092)
Fix: Handle an OOM kill of celery workers in the task handler @stumpylog (#12040)
Fix: re-run ASN check after barcode detection @shamoon (#11681)
Fix: prevent infinite loading crash in mail component @shamoon (#11978)
Fix: fix broken docker create_classifier command in 2.20.6 @shamoon (#11965)
Fix: ensure css color-scheme for dark mode @shamoon (#11855)
Fix: fix tag list horizontal scroll, again @shamoon (#11839)
Fix: ensure horizontal scroll for long tag names in list, wrap tags without parent @shamoon (#11811)
Fix: use explicit order field for workflow actions @shamoon (#11781)
Fix: fix recurring workflow to respect latest run time @shamoon (#11735)
Fixhancement: add error handling and retry when opening index @shamoon (#11731)
Fix: validate cf integer values within PostgreSQL range @shamoon (#11666)
Fix: support ordering by storage path name @shamoon (#11661)
Fix: propagate metadata override created value @shamoon (#11659)
Fix: prevent ASN collisions for merge operations @shamoon (#11634)

Documentation

[Beta] Paperless-ngx v3.0.0 Beta @shamoon ([#12713](https://redirect.github.com/paperless-ngx/paperless-ngx/pull/

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

This is a merge commit the virtual branches in your workspace. Due to GitButler managing multiple virtual branches, you cannot switch back and forth between git branches and virtual branches easily. If you switch to another branch, GitButler will need to be reinitialized. If you commit on this branch, GitButler will throw it away. Here are the branches that are currently applied: - feat/rook-ceph-v20.2.2 (refs/gitbutler/feat/rook-ceph-v20.2.2) branch head: 439fb15 For more information about what we're doing here, check out our docs: https://docs.gitbutler.com/features/branch-management/integration-branch

🔐 Fix 1password secret format - single string values in stringData

🔐 Fix 1password credentials: base64 JSON in stringData for OP_SESSION

This is placeholder commit and will be replaced by a merge of your virtual branches. Due to GitButler managing multiple virtual branches, you cannot switch back and forth between git branches and virtual branches easily. If you switch to another branch, GitButler will need to be reinitialized. If you commit on this branch, GitButler will throw it away. For more information about what we're doing here, check out our docs: https://docs.gitbutler.com/features/branch-management/integration-branch

✨ Migrate 1Password from Connect to SDK provider

hotfix: rotate secret token

… upgrade

fix(tuppr): disable GrafanaDashboard to prevent finalizer blocking on…

…test

feat(helm): update chart external-secrets (2.7.0 → 2.8.0)

fix(tuppr): set maintenance window to 23:15 Paris for tonight's test

…ssing onepasswordSDK)

fix: remove stale inline schema from 1password ClusterSecretStore

fix(tuppr): restore Sunday maintenance window, remove broken ceph hooks

… hooks

… hooks fix(tuppr): add ExternalSecrets for rook-ceph secrets, re-enable ceph hooks

…netes provider

fix(tuppr): fix ClusterSecretStore kubernetes provider

fix(tuppr): add CA provider to kubernetes ClusterSecretStore

…r hook jobs

fix(tuppr): add SOPS-encrypted rook-ceph secrets for hook jobs

bot-akira · 2026-07-22T19:24:56Z

konflate — summary

Note

+4 added · 45 changed · −12 removed — 61 resources · 30 apps · 11 CRDs

Blast radius

Kustomization kube-system/external-secrets — 15 dependents (Kustomization kube-system/external-secrets-stores +14 more)
Kustomization kube-system/external-secrets-stores — 14 dependents (Kustomization default/atuin, Kustomization default/home-assistant, Kustomization default/paperless +11 more)
Kustomization media/radarr — 1 dependent (Kustomization media/recyclarr)
Kustomization system-upgrade/tuppr — 1 dependent (Kustomization system-upgrade/tuppr-cr)

Warning

⚠ Cautions

StatefulSet default/minecraft — spec.replicas is 0 — the workload will be scaled to no pods
61 resources · 30 apps — large change set — more ground to cover than a typical PR; review with extra care

Image changes

image	from	to
`docker.io/1password/connect-api`	`sha256:e915c0c84397…`	`∅`
`docker.io/1password/connect-sync`	`sha256:6297ca6136c0…`	`∅`
`docker.io/getmeili/meilisearch`	`v1.49.0`	`v1.50.0`
`ghcr.io/external-secrets/external-secrets`	`v2.7.0`	`v2.8.0`
`ghcr.io/home-operations/home-assistant`	`sha256:547d0fcb67ce…`	`sha256:7a6951bc274d…`
`ghcr.io/home-operations/konflate`	`sha256:eae4b2e069ef…`	`sha256:e0529cc2a809…`
`ghcr.io/home-operations/prowlarr`	`sha256:5014bec2085b…`	`sha256:9dc56404214b…`
`ghcr.io/home-operations/radarr`	`sha256:ca30ff27d24c…`	`sha256:c82ca292d70a…`
`ghcr.io/home-operations/tuppr`	`sha256:d33453fbeadf…`	`sha256:ffd3ed0abba7…`
`ghcr.io/itzg/minecraft-server`	`2026.7.0-java21`	`2026.7.2-java21`
`ghcr.io/lukasdietrich/glance-k8s/glance-k8s`	`sha256:5c9a5f537935…`	`sha256:fe738335cae8…`
`ghcr.io/paperless-ngx/paperless-ngx`	`sha256:6c86cad80397…`	`sha256:17312f00bac0…`
`registry.k8s.io/sig-storage/snapshot-conversion-webhook`	`v8.6.0`	`∅`

View the full rendered diff →

_{konflate · rendered b26e696 · advisory, not a gate}

github-advanced-security · 2026-07-22T19:28:28Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

…3662) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

….3) (#3661) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

…→ 2026.7.2) (#3659) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

…→ v46.1.20) (#3653) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

…2026.7.2 → 2026.7.3) (#3669) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

….3.2 → 0.4.1) (#3668) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

…a86) (#3667) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

… 1.46.2) (#3664) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

… → v1.50.0) (#3654) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

…0514 → 6.4.0.10523) (#3649) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

…5483 → 2.5.2.5491) (#3673) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

….20.15 → 3.0.3) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

bot-akira Bot and others added 30 commits July 18, 2026 17:46

feat(helm): update chart external-secrets (2.7.0 → 2.8.0)

a94fb2d

Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

🔐 Fix 1password secret format - single string values in stringData

8a7de0f

🔐 Fix 1password secret format - single string values in stringData

38a152f

🔐 Fix 1password secret format - single string values in stringData

🔐 Fix 1password credentials: base64 JSON in stringData for OP_SESSION

c2aab65

🔐 Fix 1password credentials: base64 JSON in stringData for OP_SESSION

43c4cc9

🔐 Fix 1password credentials: base64 JSON in stringData for OP_SESSION

✨ Migrate 1Password from Connect to SDK provider

40817ce

Merge remote-tracking branch 'origin/main' into feat/onepassword-sdk

869a60d

✨ Migrate 1Password from Connect to SDK provider

a1a490e

✨ Migrate 1Password from Connect to SDK provider

hotfix: rotate secret token

703066e

Merge pull request #3633 from axeII/fix/issue

a1054ff

hotfix: rotate secret token

fix(tuppr): disable GrafanaDashboard to prevent finalizer blocking on…

55e9f5d

… upgrade

Merge pull request #3634 from axeII/al-branch-398

e345607

fix(tuppr): disable GrafanaDashboard to prevent finalizer blocking on…

fix(tuppr): set maintenance window to 23:15 Paris time for tonight's …

9b3319d

…test

Merge pull request #3627 from axeII/renovate/external-secrets-2.x

12c5ac5

feat(helm): update chart external-secrets (2.7.0 → 2.8.0)

fix(tuppr): set maintenance window to 23:15 Paris for tonight's test

3664cd2

fix(tuppr): set maintenance window to 23:15 Paris for tonight's test

fix: remove stale inline schema from 1password ClusterSecretStore (mi…

8209de1

…ssing onepasswordSDK)

fix: remove stale inline schema from 1password ClusterSecretStore

5ec9b82

fix: remove stale inline schema from 1password ClusterSecretStore

fix(tuppr): restore Sunday maintenance window, remove broken ceph hooks

fc43d3d

fix(tuppr): restore Sunday maintenance window, remove broken ceph hooks

dd9298e

fix(tuppr): restore Sunday maintenance window, remove broken ceph hooks

fix(tuppr): add ExternalSecrets for rook-ceph secrets, re-enable ceph…

6709f7c

… hooks

fix(tuppr): add ExternalSecrets for rook-ceph secrets, re-enable ceph…

226e6a4

… hooks fix(tuppr): add ExternalSecrets for rook-ceph secrets, re-enable ceph hooks

fix(tuppr): rename ClusterSecretStore, use default pod auth for kuber…

d3d3b96

…netes provider

fix(tuppr): fix ClusterSecretStore kubernetes provider

815a5b0

fix(tuppr): fix ClusterSecretStore kubernetes provider

fix(tuppr): add CA provider to kubernetes ClusterSecretStore

e7a16c8

fix(tuppr): add CA provider to kubernetes ClusterSecretStore

d0af2fc

fix(tuppr): add CA provider to kubernetes ClusterSecretStore

fix(tuppr): add SOPS-encrypted rook-ceph secrets to system-upgrade fo…

a8b2370

…r hook jobs

fix(tuppr): add SOPS-encrypted rook-ceph secrets for hook jobs

c27cf30

fix(tuppr): add SOPS-encrypted rook-ceph secrets for hook jobs

chore: bump Kubernetes to v1.36.2 (supported by Talos v1.13.6)

56fff8c

bot-akira Bot added type/major renovate/container labels Jul 22, 2026

github-actions Bot added the area/kubernetes label Jul 22, 2026

bot-akira Bot added 5 commits July 23, 2026 05:26

ci(github-action)!: Update action actions/labeler (v6.2.0 → v7.0.0) (#…

1cfad42

…3662) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

fix(container): update image ghcr.io/unpoller/unpoller (v3.3.1 → v3.3…

0ef6292

….3) (#3661) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

fix(container): update image ghcr.io/itzg/minecraft-server (2026.7.0 …

094ed25

…→ 2026.7.2) (#3659) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

ci(github-action)!: Update action actions/checkout to v7.0.1 (#3658)

22da2ab

Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

ci(github-action): update action renovatebot/github-action (v46.1.19 …

7c7ca9e

…→ v46.1.20) (#3653) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

bot-akira Bot force-pushed the renovate/ghcr.io-paperless-ngx-paperless-ngx-3.x branch from ab0ba0f to 1147714 Compare July 23, 2026 23:51

bot-akira Bot changed the title ~~feat(container)!: Update image ghcr.io/paperless-ngx/paperless-ngx (2.20.15 → 3.0.0)~~ feat(container)!: Update image ghcr.io/paperless-ngx/paperless-ngx (2.20.15 → 3.0.1) Jul 23, 2026

bot-akira Bot force-pushed the renovate/ghcr.io-paperless-ngx-paperless-ngx-3.x branch from 1147714 to e0d1803 Compare July 24, 2026 01:31

bot-akira Bot changed the title ~~feat(container)!: Update image ghcr.io/paperless-ngx/paperless-ngx (2.20.15 → 3.0.1)~~ feat(container)!: Update image ghcr.io/paperless-ngx/paperless-ngx (2.20.15 → 3.0.2) Jul 24, 2026

bot-akira Bot added 11 commits July 24, 2026 05:21

fix(container): update image ghcr.io/home-operations/home-assistant (…

bb392e2

…2026.7.2 → 2026.7.3) (#3669) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

feat(container): update image ghcr.io/home-operations/charts/tuppr (0…

6e9d8bc

….3.2 → 0.4.1) (#3668) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

ci(github-action): update action github/codeql-action (7188fc3 → e4fb…

97252bc

…a86) (#3667) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

fix(container): update image ghcr.io/coredns/charts/coredns (1.46.1 →…

c02752f

… 1.46.2) (#3664) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

fix(container): update image grafana/grafana (13.1.0 → 13.1.1) (#3663)

be265b6

Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

feat(container): update image docker.io/getmeili/meilisearch (v1.49.0…

540992f

… → v1.50.0) (#3654) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

feat(container): update image ghcr.io/home-operations/radarr (6.3.0.1…

b95a055

…0514 → 6.4.0.10523) (#3649) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

fix(container): update image ghcr.io/home-operations/prowlarr (2.5.2.…

356858c

…5483 → 2.5.2.5491) (#3673) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

fix(container): update image grafana/loki (3.7.3 → 3.7.4) (#3670)

e7a725e

Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

feat(helm): update chart snapshot-controller (5.1.1 → 5.2.0) (#3666)

d0fcb90

Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com> Co-authored-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

feat(container)!: Update image ghcr.io/paperless-ngx/paperless-ngx (2…

b26e696

….20.15 → 3.0.3) Signed-off-by: bot-akira[bot] <159718293+bot-akira[bot]@users.noreply.github.com>

bot-akira Bot force-pushed the renovate/ghcr.io-paperless-ngx-paperless-ngx-3.x branch from e0d1803 to b26e696 Compare July 25, 2026 23:52

bot-akira Bot changed the title ~~feat(container)!: Update image ghcr.io/paperless-ngx/paperless-ngx (2.20.15 → 3.0.2)~~ feat(container)!: Update image ghcr.io/paperless-ngx/paperless-ngx (2.20.15 → 3.0.3) Jul 25, 2026

bot-akira Bot added the needs-review label Jul 26, 2026

axeII force-pushed the main branch from 57964d4 to 6486283 Compare July 26, 2026 15:07

Navigation Menu

feat(container)!: Update image ghcr.io/paperless-ngx/paperless-ngx (2.20.15 → 3.0.3) - #3672

feat(container)!: Update image ghcr.io/paperless-ngx/paperless-ngx (2.20.15 → 3.0.3)#3672
bot-akira[bot] wants to merge 63 commits into
mainfrom
renovate/ghcr.io-paperless-ngx-paperless-ngx-3.x

bot-akira Bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

bot-akira Bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

github-advanced-security AI commented Jul 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

bot-akira Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v3.0.3: Paperless-ngx v3.0.3

paperless-ngx 3.0.3

Bug Fixes

Documentation

Maintenance

All App Changes

v3.0.2: Paperless-ngx v3.0.2

paperless-ngx 3.0.2

Bug Fixes

All App Changes

v3.0.1: Paperless-ngx v3.0.1

paperless-ngx 3.0.1

Bug Fixes

Dependencies

All App Changes

v3.0.0: Paperless-ngx v3.0.0

paperless-ngx 3.0.0

Breaking Changes

Notable Changes

Features / Enhancements

Bug Fixes

Documentation

Configuration

Uh oh!

bot-akira Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

konflate — summary

Uh oh!

github-advanced-security AI commented Jul 22, 2026

What Enabling Code Scanning Means:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

bot-akira Bot commented Jul 22, 2026 •

edited

Loading

`v3.0.3`: Paperless-ngx v3.0.3

`v3.0.2`: Paperless-ngx v3.0.2

`v3.0.1`: Paperless-ngx v3.0.1

`v3.0.0`: Paperless-ngx v3.0.0

bot-akira Bot commented Jul 22, 2026 •

edited

Loading