Bambuddy v0.2.3.1
Adds some important fixes for A1, A1 Mini, P1 and P1S which could prevent prints from not starting after uploading to printer.
⚠ Upgrade Notes — Read Before Updating
The in-app Update button does not reliably perform the one-time migration from 0.2.2.x to 0.2.3.x. Please do this one upgrade from the command line using one of the paths below. Once you're on 0.2.3, the in-app Update button works normally again for all future releases. Full guide: UPDATING.md.
Docker
First make sure your docker-compose.yml image: line points at :latest or :0.2.3.1 — if it pins an older tag (e.g. :0.2.2.2), docker compose pull will just re-fetch that tag. If your compose file is older than 0.2.3, also refresh it from the repo; recent releases added cap_add: NET_BIND_SERVICE, extra virtual-printer ports for bridge mode, and an optional PostgreSQL block.
docker compose pull
docker compose up -dNative install (install.sh or manual git clone)
The bundled update.sh now stops the service, snapshots the database via the built-in backup API, fast-forwards to origin/main, installs Python dependencies, rebuilds the frontend, restarts the service, and rolls back automatically if any step fails.
sudo /opt/bambuddy/install/update.shInstalled from a GitHub ZIP/tarball? Those installs have no .git directory and cannot be upgraded in place. See the UPDATING.md recovery procedure for backup-and-reinstall steps.
Take a backup first. update.sh takes one automatically; Docker and fully-manual paths do not. Settings → Backup → Create Backup produces a full ZIP.
New Features
- (file-manager): collapse folders by default toggle (#996) — Add a "Collapse" toggle in the File Manager sidebar header next to "Wrap". When enabled, the folder tree opens with only top-level folders visible on every page load;
- (i18n): add zh-TW locale — Contributed by @Minidoracat
Improved
Fixed
- ⚠️ (printer): bed-jog "Home Z" could crash bed into toolhead on H2C/H2D/H2S/X1 (#1052) — Critical safety fix. The bed-jog dialog's "Home Z" button sent a bare
G28 Zover gcode_line. On Bambu printers where the Z endstop is at the top (bed moves UP into it — H2C, H2D, H2S, X1 family),G28 Zskips the toolhead-park step that a fullG28runs first, so the bed rises at full speed with nothing getting out of the way. - ** (printer): suppress "not homed" re-prompt after Auto Home (#1052 follow-up)** — The bed-jog "not homed" warning modal was gated on a session-scoped "warned" flag set only by the "Move anyway" button. Clicking "Auto Home" sent the G28 and closed the modal but never set the flag, so the next jog click in the same session re-prompted — even though the printer was now homed.
- (queue): update LibraryFile.print_count and last_printed_at on completion (#1008) — Both fields have existed on the model and been shown in the File Manager for some time, but nothing ever wrote to them — every file in every library appeared to have never been printed.
- **(firmware): parse P2S/X2D wiki anchors without dash and full-width parens (#1030) ** — The wiki scraper silently returned no versions for P2S and X2D, causing Bambuddy to fall back to the Bambu Lab download page, which still listed
01.01.01.00 as "latest" even though 01.02.00.00 shipped on 2026-04-09. - (frontend): thumbnails blank until reload after sign-in — On auth-enabled instances, logging out and back in left the File Manager (and occasionally the Archives page) full of broken thumbnails until a manual page reload. Thumbnail URLs are gated by a short-lived camera stream token that tags cannot send via Authorization headers, so the token is appended as ?token=… at render time.
- (archive): truncation of large 3MF uploads on sendfile short-return (#1032) — On bare-metal Raspberry Pi OS bookworm / armv7l / Python 3.11, 3MF files larger than a few megabytes arrived complete via the virtual-printer FTP server but the copy into data/archives/ was silently truncated. The archive row was still written, the printer card looked fine, and the problem only surfaced later when opening the archive — the subsequent zipfile.ZipFile() in GET /archives/{id}/plates raised BadZipFile and the UI came up blank with no thumbnail, plate list, or filament data.
- ** (smart-plug): restore MQTT subscriptions for per-type topic configs on startup (#1010)** — Users integrating a Shelly plug through an external MQTT broker (ioBroker, Zigbee2MQTT, HA's MQTT broker, etc.) lost the plug's power/state/energy readings after every Bambuddy restart. The only fix was opening Settings → Smart Plugs, renaming the topic to a dummy
value, saving, renaming back, and saving again. - (printers): stop controls row overflowing in Chrome at narrow card widths
- (obico): clear Status banner on next successful detection cycle (#172)
- (ftp): wait for zombie thread to complete before giving up on download (#1014)
- (mqtt): cap task_id at int32 max to prevent P1S dispatch stalls (#1042)
- ** Facebook and some other OAuth providers issue authorization codes that exceed 512 characters** — Raised max_length for the code and state query parameters from 512 to 2048. The OAuth 2.0 spec (RFC 6749) does not define a maximum authorization code length; 2048 characters aligns with limits used by major providers. Contributed by @netscout2001
Changes
- Change the color catalog's default manufacturer filter from "Bambu Lab" to "All Manufacturers" (#1039)
Security
- chore(docker): switch runtime image to Debian Trixie — Picks up ffmpeg 5 → 7 (HEVC/AV1 improvements), OpenSSL 3.0 → 3.3, and two more years of APT package freshness. Frontend-builder stays on Bookworm until the Node.js image team publishes Trixie variants.
- **(security): suppress three Debian-postponed CVEs in Trivy scans ** — Add CVE-2026-6385, CVE-2026-30997 and CVE-2026-6192 to .trivyignore. All three are marked "vulnerable / postponed" in both bookworm and trixie by the Debian Security Tracker with no upstream fix yet, so the Trivy container scan will keep re-raising them on every run.
Contributors
Thank you to the contributors who helped make this release possible:
- @netscout2001 — Two-Factor Authentication + OIDC/SSO implementation, OIDC callback length, OIDC issuer trailing-slash fixes (×2), auto-link existing accounts toggle, H2C nozzle rack slot report (#933, #973, #985, #995, #1024, #943)
- @Minidoracat — (i18n): add zh-TW locale (#1025)