xiao-villamor/PrintStash v0.12.0

v0.12.0 — material-aware fleet and reliability hardening

on GitHub

Back up before upgrading. This release includes additive database migrations and deployment/dependency changes; PostgreSQL, MinIO, and lite-image users should review UPGRADE.md.

Added

• Material-aware fleet dispatch. Printer tools and material feeds now track
  their source, Bambu AMS and Moonraker active-Spoolman state can synchronize
  automatically, and G-code preflight compares material and nozzle metadata
  before a direct send. Fleet batches add copy counts, group constraints,
  priority lanes, audited mismatch overrides, optional operator release gates,
  and an at-a-glance printer board
  (#73).
• Preview settings now control interactive 3D/G-code render sharpness, downloaded screenshot resolution, and generated Model image resolution, with a background action to recreate existing Model previews.
• Import jobs now publish durable completion metadata, explicit complete/partial outcomes, thumbnail status and stable reasons, restart recovery, monotonic progress, structured metrics/logs, and no-store polling.
• A memory-bounded streaming STL fallback generates 640×480 WebP thumbnails for oversized or otherwise unrasterizable meshes, including Vault Maintenance repair and Bulk upload flows (#67).
• Bambu LAN beta now records externally started prints using the identity fields reported by the printer and makes a best-effort capture of exact G-code or project files while they remain in the printer's FTPS cache, clearly labelling metadata-only history when no Artifact can be recovered.
• Separate printstash-api full and printstash-api-lite images expose browser, STEP, and thumbnail capabilities through authenticated health details; lite retains NumPy/Pillow/Trimesh thumbnailing without Chromium or OpenCASCADE.
• A transitional, idempotent MinIO-to-SeaweedFS helper copies objects without deletion and verifies their downloaded content with a digest-pinned rclone image.

Changed

• New password hashes use Argon2; successful login transparently upgrades legacy bcrypt hashes while preserving bcrypt's historical 72-byte behavior only for legacy verification.
• Mesh processing now uses NumPy 2, Trimesh 5's load_mesh(), and Cascadio 0.1.1, including STEP support in full amd64 and arm64 images.
• PostgreSQL now uses Psycopg 3 for sync and optional async engines. aiosqlite moved to the opt-in async-db extra, and unused asyncpg/Psycopg 2 dependencies were removed.
• FastAPI, Starlette, SQLModel, SQLAlchemy, Alembic, Uvicorn, WebSockets, and compatible patch/minor dependencies were refreshed; direct runtime dependencies and deptry checks now make dependency ownership explicit.
• Patchright and Cascadio moved to browser, step, and full extras. The lite API image is more than 700 MiB smaller than full without losing mesh thumbnail generation.
• The normal Compose stack no longer contains MinIO; SeaweedFS remains the bundled S3-compatible service, while external MinIO endpoints remain supported.

Fixed

• Vault Maintenance now derives severity totals from the findings it actually
  returns, shows the complete finding count, and skips missing-file checks for
  trashed Models, Artifacts, Documents, Collection images, and external links.
• Printer-card image visibility now reloads and synchronizes from its saved
  browser preference, while browsers without a saved language start in English
  instead of inheriting the browser locale.
• Confirmation dialogs now translate their title, description, Cancel,
  destructive action, and Close label consistently, expose an accessible
  dialog name, remove empty header spacing, and stack long actions on narrow
  screens.
• Startup and hourly maintenance no longer infer file ownership by recursively deleting unindexed objects from configured storage. First-run local vault paths must now be writable, dedicated empty directories; failed uploads clean up only their exact destinations, and occupied paths are never overwritten. Existing NAS and Nextcloud folders belong under External Libraries.
• Task Center is now the single import-job transition owner, emits one terminal event per job, rejects stale/out-of-order polling responses, resumes active work after reload/connectivity changes, and coordinates one post-Bulk refresh.
• Import jobs cannot report completion before Model, Artifact, Metadata, primary storage, and expected thumbnail outputs are visible from a fresh session.
• Oversized valid STL uploads no longer silently finish without thumbnails, and partial thumbnail outcomes remain visible and repairable instead of masquerading as complete success (#67).
• STEP tessellation now runs in a disposable child process with a cgroup-aware memory budget and timeout, so an overly complex file degrades without taking down the API process.
• OIDC login now accepts issuer URLs that differ only by a trailing slash, fixing Authentik PER_PROVIDER configurations while continuing to reject genuinely mismatched issuers (#71).

Security

• Long, Unicode, and malformed password inputs and damaged legacy hashes now fail in controlled paths, and dependency CI adds weekly uv lock updates plus explicit vulnerability/dependency hygiene gates.

Full changelog: v0.11.4...v0.12.0