1.5 KiB
paperless-ngx — triage (group C, 2026-10-27)
Pin: ghcr.io/paperless-ngx/paperless-ngx:2.20.15 (+ postgres:18-alpine, redis:7-alpine — not in scope). No gate field; app login is the only door; no public sign-up (allauth signup off by default); admin from env. AI features do not exist in 2.x.
Notices (2)
- GHSA-c8f3-pqr2-rr24 (medium, AI classification on ownerless docs): NOT-A-FINDING — range "3.0–3.3.2"; AI features arrived in 3.0.0, our 2.20.15 is below.
- GHSA-2jhj-xqrq-rmrq (low, path traversal when FILENAME_FORMAT_REMOVE_NONE): REAL by range (
<= 3.1.1), fixed 3.1.2 (release note names it). Needs a user who can edit a storage-path/filename template AND the env PAPERLESS_FILENAME_FORMAT_REMOVE_NONE=true — our compose does not set it => NOT reachable on a box.
Fix
Smallest: 3.1.2. No 2.20.x after 2.20.15 (release list read; ghcr has 2.20.15, 3.1.2, 3.3.4). TARGET (only path): 3.3.4 (tag style no v). Same main: NO. Breaking (3.0.0 notes): consume-script positional args removed; OCR/archive control decoupled; API < v9 and API v1 dropped; Python 3.10 dropped; advanced DB settings refactored; pyzbar removed; document/thumbnail ENCRYPTION removed; consumer reworked; Whoosh -> tantivy search index (index rebuild). 3.3.4 itself = dependency security (certifi, Pillow, aiohttp). Lane: BIG_STEP, not urgent (the one real notice is low and not reachable).
Classifier note
c8f3's package name is misspelt "papaerless-ngx" and the range is "3.0–3.3.2" (en dash) — the classifier should have parsed it as >=3.0 and dropped it for 2.20.15.