This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+4 more
Summary
AI summaryLinked DMS documents now show compact first-page thumbnails in lists and pickers.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
Proxies thumbnails server-side with visibility enforcement and admin-only access for the picker. Proxies thumbnails server-side with visibility enforcement and admin-only access for the picker. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
| Feature | Medium |
Adds compact first-page thumbnails for linked DMS documents in document lists. Adds compact first-page thumbnails for linked DMS documents in document lists. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Feature | Low |
Renders thumbnail over category glyph for Paperless-linked documents in the list. Renders thumbnail over category glyph for Paperless-linked documents in the list. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
| Feature | Low |
Previews each hit with thumbnail, filename, and file type in "Link from DMS" picker. Previews each hit with thumbnail, filename, and file type in "Link from DMS" picker. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
| Feature | Low |
Opens original document in DMS in a new tab from the picker preview. Opens original document in DMS in a new tab from the picker preview. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
| Feature | Low |
Restricts thumbnail rendering to a raster-image allowlist with `nosniff` header and strict CSP. Restricts thumbnail rendering to a raster-image allowlist with `nosniff` header and strict CSP. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
| Feature | Low |
Gracefully falls back to category icon when preview cannot be generated (e.g., providers without thumbnail endpoint). Gracefully falls back to category icon when preview cannot be generated (e.g., providers without thumbnail endpoint). Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
Full changelog
Added
- Linked DMS documents now show a compact first-page thumbnail so the right file can be recognized without opening it (#533). In the documents list, Paperless-linked documents render a thumbnail over the category glyph, and the "Link from DMS" picker previews each hit with a thumbnail plus filename and file type before linking. The picker preview also opens the original document in the DMS in a new tab. Thumbnails are proxied server-side (visibility-enforced for the list, admin-only for the picker), restricted to a raster-image allowlist with
nosniffand a strict CSP, and gracefully fall back to the category icon whenever a preview cannot be generated (for example providers without a thumbnail endpoint, such as Papra).
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- v0.71.3 Changes WebDAV backup default path from "/oikos/backups/" to "/yuvomi/backups/".
- v0.66.0 Repository URL changed to `https://github.com/ulsklyc/yuvomi`.
- v0.66.0 Docker image moved to `ghcr.io/ulsklyc/yuvomi`.
- v0.66.0 Project renamed from Oikos to Yuvomi.
- v0.62.0 Changes event dialog to unified sync target picker across Google and CalDAV calendars.
Beta — feedback welcome: [email protected]