Stack Watch
Self-hosted update briefs — is it safe to update, or wait?
Disclaimer: Automated heuristics over public release notes and vulnerability databases (OSV / NVD). Can be wrong or incomplete. Always back up first and validate upgrades yourself. Stack Watch does not invent CVE IDs or issue counts. This is an MVP research project, not a live paid service.
Home / Paperless-ngx / v3.3.2

Paperless-ngx v3.3.2

UPDATE_WITH_CARE

Security-related language in release notes; update after a backup if you are affected.

Published: 2026-10-16T06:15:29Z · GitHub release

Summary of changes

## paperless-ngx 3.3.2 Note This release addresses a security issue (GHSA-c8f3-pqr2-rr24) and is recommended for all users. Our sincere thank you to the community members for reporting this. ## Bug Fixes - Fix: copy only direct user grants in DocumentMetadataOverrides.from_document @stumpylog (#14452) - Fix: support combined text/query searches @shamoon (#14443) - Fix: make exporter derived file names unique when originals differ only by extension @stumpylog (#14429) ## Dependencies - Chore(deps): Bump filelock from 3.32.6 to 4.0.12 @dependabot[bot] (#14336) - Chore(deps): Bump the uv group across 1 directory with 3 updates @dependabot[bot] (#14418) ## All App Changes 5 changes - Fix: copy only direct user grants in DocumentMetadataOverrides.from_document @stumpylog (#14452) - Chore(deps): Bump filelock from 3.32.6 to 4.0.12 @dependabot[bot] (#14336) …

Breaking changes

None detected by heuristics.

CVEs linked to this release

None linked from release notes or OSV fixed-in match.

Linked issues / PRs mentioned

5

Back up first

Always back up first. Stack Watch briefs are automated heuristics over public release notes and vulnerability databases. They can be wrong or incomplete. You are responsible for validating upgrades in your own environment. We never invent CVE IDs or issue counts — if a number is missing, it was not found.