v1.2.0

Highlights

Embeddings and reranking can now point at their own endpoint with their own credentials, independently of the chat provider. Two new HTTP rerank backends come with it.

Upgrading

Nothing to do — this release needs no migration and changes no behaviour for an existing install.

Every new field defaults to empty, and empty means "inherit from the LLM section" (D-27), so each role resolves exactly where it resolved before. Settings persist as a single JSON blob, so existing rows pick up the defaults without an Alembic revision.

Two things to be aware of if you start using the new fields:

• A role that names its own endpoint no longer inherits the chat key. Previously, inheritance was keyed on provider type alone, so pointing embeddings or reranking at a third-party host would have sent your chat provider's key to that host. A role with its own endpoint must now bring its own key, or send none. Sending none is supported — self-hosted vLLM, LocalAI and TEI often need no auth, and those requests use the documented EMPTY placeholder.
• Repointing embeddings at a different endpoint now triggers a re-index prompt. The check used to compare only provider and model name, so moving to a different server running the same model would have silently mixed two incompatible vector spaces in one collection. Rotating a key against the same endpoint does not prompt — identical vectors, no re-index needed.

What's Changed

• Per-role provider routing (#219) — embed_base_url / embed_credentials and rerank_base_url / rerank_api_key, each settable in the AI Provider tab. embed_provider = "openai" no longer requires llm_provider = "openai".
• Two new rerank methods (#219) — cohere_api (the Cohere rerank wire format, also spoken by Jina, vLLM and Infinity) and tei (Hugging Face Text Embeddings Inference), alongside the existing llm, local and api.
• Fix: Select custom fields are handled correctly (#197).
• Japanese translation added by @lockdlock (#153).
• Build: .claude is excluded from the Docker build context (#189).
• CI: the npm audit gate is scoped to newly-introduced advisories, with Python bumps grouped (#185).
• 65 dependency updates.

Full changelog: v1.1.2...v1.2.0

v1.1.2

If you are running 1.1.1, upgrade. 1.1.1 renders a blank page and the UI is completely unusable. This release fixes it and contains nothing else of substance.

Fixes

1.1.1 rendered a blank page (#135)

react was bumped to 19.2.8 in 1.1.1 while react-dom stayed behind at 19.2.7. React 19 refuses to run with a version skew between the two packages, so createRoot threw before anything mounted:

Uncaught Error: Minified React error #527
  → "Incompatible React versions: react 19.2.8 / react-dom 19.2.7"

Nothing catches that — there is no error boundary above ReactDOM.createRoot — so #root stayed empty and every page was white.

The backend was never affected. In 1.1.1 the API, the inbox poller, cron jobs and document analysis all kept working normally; /, the JS and the CSS all returned 200. Only the browser-side mount failed, so no data was lost or mis-processed while you were on 1.1.1 — you just could not see or drive any of it from the UI.

Both packages now resolve to 19.2.8.

Upgrade note: none — pull the image and restart. If the page is still blank afterwards, you are being served a cached index.html pointing at the old bundle hash; hard-reload once (Cmd/Ctrl-Shift-R).

Why CI did not catch this

tsc, eslint, check:i18n and vite build all pass on a react/react-dom skew — the failure only exists at runtime in a browser, which nothing in the pipeline exercised. Worth keeping in mind when reviewing future Dependabot bumps that touch a paired package: react and react-dom must always be bumped together.

Maintenance

• Bumped the transitive dev dependency brace-expansion 5.0.7 → 5.0.8 to clear GHSA-mh99-v99m-4gvg (high, DoS via unbounded expansion). Dev-only — it reached the tree through eslint → minimatch and was never shipped in the runtime image. The frontend CI job gates on npm audit --audit-level=low, so this advisory had already turned that job red on 1.1.1.
• Synced the stale version field in frontend/package-lock.json, which the 1.1.1 bump missed.

Full Changelog: v1.1.1...v1.1.2

v1.1.1

What's in 1.1.1

Maintenance release — dependency and security housekeeping. No user-facing feature
changes, no schema or settings migrations. Upgrading is a straight image pull.

Fixes

• Re-embed cleanup (#115) — stale tracking rows for documents deleted in
  Paperless are now dropped instead of being retried on every flush. Transient
  Paperless NGX outages no longer spam the log or purge live vectors.
• Security alerts cleared (#116) — all 16 open Dependabot alerts resolved
  (Pillow, setuptools, torch, starlette, aiohttp, cryptography, brace-expansion).

Maintenance

• CI actions moved to current majors: checkout v7, setup-node v7, setup-uv v7,
  cache v6, docker/setup-buildx v4.
• Routine dependency bumps across backend (boto3, openai, fastapi, anthropic,
  greenlet, pypdfium2) and frontend (react, mantine, react-i18next, postcss).

v1.1.0

Minor release. Two behaviour fixes worth reading before you upgrade, plus dependency maintenance.

Fixes

Entity creation is now gated per entity type (#97)

Previously, create_missing was a single flag OR-ed across the three creation policies and then applied to every entity type. Setting allow_new on tags alone also silently created correspondents, document types and storage paths — defeating an explicit existing_only on each of them.

Each type is now gated on its own policy:

Config	Created before	Created now
tags=allow_new, rest existing_only	tags, correspondents, document types, storage paths	tags only
all existing_only	nothing	nothing
all allow_new	all four	all four

Upgrade note: if you were relying (knowingly or not) on allow_new on one type creating the others, that no longer happens. Set allow_new explicitly on each type you want created.

Also in #97:

• New setting: storage_path_creation_policy (default existing_only, env PIQ_STORAGE_PATH_CREATION_POLICY). Storage paths previously had no policy at all and were created unconditionally whenever any other type allowed it.
• Bulk-approve now creates entities, matching single-approve. It previously omitted the flag entirely and silently dropped new tags — the same suggestion behaved differently depending on which button you clicked. Bulk-approve also records the acting user now.
• Auto-applied changes are audited as change_source=automation, not human. Unattended writes were previously indistinguishable from reviewed ones in the audit log. Filter the Audit page by automation to see exactly what auto-apply did on your behalf.
• Removed a dead create_entity() method that could create entities from the analyze-time client.

Documented as D-25 in docs/DECISIONS.md.

Grooming description editor showed stale text (#98)

In Grooming → Descriptions, selecting an entity and running Generate left the editor showing the pre-generation description. The freshly generated text was fetched but never rendered until you clicked away and back.

The editor now re-syncs when the description actually changes, while still not clobbering an unsaved edit on an unrelated refresh. Also fixed: switching entity type mid-generation reloaded the previous type's entities.

Frontend lint is now enforced at --max-warnings=0. eslint src exits 0 on warnings-only, so the gate had been advisory — which is why the editor bug sat reported-but-unfixed for weeks.

Dependencies

fastapi 0.139.0 · uvicorn 0.51.0 · anthropic 0.116.0 · openai 2.45.0 · boto3 1.43.46 · pypdfium2 5.11.0 · croniter 6.2.4 · @mantine/core 9.4.1 · i18next 26.3.6 · react-i18next 17.0.9 · typescript-eslint 8.63.0 · ruff 0.15.21 · hypothesis 6.156.6

Images

ghcr.io/knows-cloud/paperless-iq:1.1.0
ghcr.io/knows-cloud/paperless-iq:1.1
ghcr.io/knows-cloud/paperless-iq:latest

Full changelog: 92a6cd2...v1.1.0