Paperless-ngx published v3.3.4 on 22 October as a stable release, and its note is short enough to quote whole: “This security maintenance release updates dependencies to address the eMudhra / emSign CA certificate security incident and security vulnerabilities in Pillow and aiohttp. These issues affect third-party dependencies rather than Paperless-ngx’s own code. Updating is recommended for all users.”

That framing is worth taking at face value. Nothing in the release suggests a flaw in Paperless-ngx itself, and there is no exploitation report attached to it. It is dependency housekeeping on a widely run self-hosted app, and one of those dependencies carries this week’s CA story.

What is being updated

The release lists two changes, both chores: “Update certifi for eMudhra CA incident” (#14533) and “Update uv to 0.13 for the eMudhra CA fixes” (#14532). The note links a Python discussion of the incident, which is the right place to look if you want the CA background rather than the app changelog.

certifi is the trust store the app uses for outbound TLS, so the eMudhra compromise reaches Paperless-ngx the way it reaches most Python software: a refreshed bundle of roots, arriving as an ordinary dependency update. The Pillow and aiohttp entries are the other half. The release note gives no CVE identifiers and no severity for either, and this piece is not going to supply numbers the project did not publish.

The documented update path

The project’s administration docs give the Docker route in their own order, and it starts before the commands: “First of all, make sure no active processes (like consumption) are running, then make a backup.”

Then stop the stack:

cd /path/to/paperless
docker compose down

Then pull and start:

docker compose pull
docker compose up

The foreground up is deliberate, and the docs explain why: “Running docker compose up will also apply any new database migrations. If you see everything working, press CTRL+C once to gracefully stop paperless. Then you can start paperless-ngx with -d to have it run in the background.” Watch the migrations run, confirm the web interface comes up, stop it, and start it again with docker compose up -d.

Two things the docs make clear by contrast. The install instructions written for a fresh setup use docker compose up -d directly; the update section runs up in the foreground first because the migration output is the thing you want to watch. And the same page carries a variant for people who build the image themselves rather than pulling it, which swaps the pull for git pull and docker compose build.

Worth a slot on the list

Because the app bundles certifi, this is a trust-store refresh arriving through an ordinary update rather than a special CA exercise, which is how most people will end up taking the eMudhra fix. The Pillow and aiohttp bumps touch libraries a document pipeline leans on, so the project’s “recommended for all users” is not boilerplate.

It is also not an emergency. Update when you next touch the box, take the backup the docs ask for before you start, and let the migrations finish before you walk away.

Sources: the v3.3.4 release record and release page, plus the project’s administration docs.