Paperless-ngx 3.4.0 landed on 29 October, and it is a feature release rather than the security maintenance update 3.3.4 was. Three changes are visible from the interface, one is visible in the dependency list, and the rest is the sort of cleanup you notice only when something stops misbehaving.

Titles built from custom fields

Workflow title templates can now pull in custom fields (#14564). If you have been naming documents by hand because a workflow could not reach the field you cared about, that changes. Custom-field queries also understand relative dates now (#14549), so a saved view or a filter can ask for something recent instead of a fixed date range.

The workflow tag fields gained a smaller change: child and parent tags can now be toggled independently (#14400).

Thumbnails move to poppler, and ImageMagick leaves the list

PDF thumbnails are now generated through poppler utilities (#14420), and a dependency item in the same release reads, spelling included, “Drop ImageMagik as a dependency” (#14440). The release does not draw the line between them, but the thumbnail work is the visible reason ImageMagick is no longer needed. What that means for an install is narrower than it sounds: ImageMagick comes off the project’s own dependency list, which is not the same as ImageMagick disappearing from a host.

A shorter path through OIDC

There is an authentication change worth reading twice before you upgrade: local 2FA is skipped for “trusted OIDC AMR” (#14403). In the release’s term, a login that arrives through OIDC and carries an AMR claim the instance trusts no longer stops for the local second factor. Whether that is the behaviour you want depends on your identity provider and your policy; the release states the change and does not argue it. If you run OIDC and local 2FA together today, that is the line to check before the next login.

The quiet fixes

Most of the fix list is small, and the small ones are what a document manager runs into. On a document edit, re-indexing now runs after workflow actions (#14558), which is a change of order rather than a new step, and the release does not describe the symptom. Folder exports with --delete no longer fail on a stale manifest.json.tmp (#14526). Barcode handling no longer defers tag assignment when the barcode will not result in a split (#14497), revoked and expired tasks now show a better result (#14566), and the schema view stops running document permission queries (#14503). The tasks badge loads faster as well (#14552).

Smaller interface items sit in the same release: an upload count on the button with fewer notifications, changes to document details, an upload button in the navbar, and markdown support in the AI chat. They are listed in the notes rather than described here, because the release body is long and this is a selection from it.

Dependencies, with no identifiers

The maintenance items are dependency bumps, and the release gives no identifiers for them. uv moves to 0.13 “for the eMudhra CA fixes” (#14532), which is the certificate authority incident arriving as a build toolchain update. brotli, djangorestframework, filelock, msgpack and setuptools are bumped “for security fixes” (#14575), alongside frontend dependencies (#14581) and django-allauth 65.20 with oauthlib 4.0 (#14570). Read that as the project’s own description. No CVE numbers are given, and this piece is not going to supply any.

Upgrading is the usual path for this project: pull the new image and bring it back up. The notes describe no manual step beyond that.

If you run workflows with templated titles or OIDC logins, 3.4.0 is worth the pull now. Otherwise it is a small feature release with a useful set of fixes, and the re-index and export ones are the likeliest to save you a confused afternoon. This release follows our 23 October piece on 3.3.4, which covered the security maintenance update rather than these features.