[PR #282] [MERGED] v0.1.8 #986

New issue

Closed

opened 2026-05-06 12:34:21 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 12:34:21 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/maziggy/bambuddy/pull/282
Author: @maziggy
Created: 2/6/2026
Status: ✅ Merged
Merged: 2/6/2026
Merged by: @maziggy

Base: main ← Head: 0.1.8

📝 Commits (10+)

6e82cc6 Add per-filament Spoolman usage tracking with G-code parsing
5703cea fix linting isssues
2c086dd ruff format changes
33b9360 pre-commit changes
0a39b12 Merge branch 'maziggy:main' into feature/accurate-usage-tracking
ce4683a Use defusedxml in test files for Bandit compliance
b428591 Remove 24-hour queue item expiration logic
905e176 Fix FTP settings UI: add selects, persist connection timeout
0dcb154 Merge branch '0.1.8b' into feature/accurate-usage-tracking
73be964 Merge pull request #277 from bambuman/feature/accurate-usage-tracking

📊 Changes

105 files changed (+4140 additions, -1938 deletions)

View changed files

➕ .codeql/javascript-bambuddy.qls (+16 -0)
➕ .codeql/python-bambuddy.qls (+89 -0)
📝 .gitignore (+3 -0)
➕ .trivyignore (+3 -0)
📝 CHANGELOG.md (+31 -2)
📝 backend/app/api/routes/archives.py (+49 -51)
📝 backend/app/api/routes/auth.py (+8 -23)
📝 backend/app/api/routes/camera.py (+42 -38)
📝 backend/app/api/routes/cloud.py (+2 -2)
📝 backend/app/api/routes/external_links.py (+6 -6)
📝 backend/app/api/routes/github_backup.py (+4 -4)
📝 backend/app/api/routes/kprofiles.py (+4 -4)
📝 backend/app/api/routes/library.py (+53 -62)
📝 backend/app/api/routes/maintenance.py (+1 -1)
📝 backend/app/api/routes/notifications.py (+4 -4)
📝 backend/app/api/routes/pending_uploads.py (+9 -9)
📝 backend/app/api/routes/print_queue.py (+19 -19)
📝 backend/app/api/routes/printers.py (+26 -30)
📝 backend/app/api/routes/projects.py (+6 -6)
📝 backend/app/api/routes/settings.py (+21 -10)

...and 80 more files

📄 Description

v0.1.8

Bambuddy v0.1.8 Release Notes

Highlights

This release focuses on security hardening, FTP reliability, and print accuracy improvements, alongside several community-contributed enhancements.

Enhancements

Per-Filament Spoolman Usage Tracking (PR #277)

Reports exact filament consumption per spool to Spoolman after each print
Parses G-code from 3MF files for layer-by-layer extrusion data (multi-material support)
New settings: "Disable AMS Estimated Weight Sync" and "Report Partial Usage for Failed Prints"
Persists tracking data in SQLite for reliability across restarts

3D Model Viewer Improvements (PR #262)

Plate selector for multi-plate 3MF files with thumbnail previews
Object count display per plate and total
Fullscreen toggle with resizable split view
Pagination for files with many plates (50+)

Virtual Printer Proxy Mode Improvements

SSDP proxy for cross-network setups with slicer network interface selection
FTP proxy now listens on port 990 (matching Bambu Studio expectations)
Automatic directory permission checking at startup

Pushover Image Attachments (PR #253)

Camera finish photo images now attached directly to Pushover notifications

File Manager Print/Schedule Consistency (PR #258)

File Manager print and schedule actions now match Archives page behavior

Bug Fixes

Authentication Required Error After Initial Setup (#257) — Token clearing on 401 responses is now more selective
Filament Hover Card Overlapping Nav Bar (#259) — Hover card positioning accounts for the fixed header
Filament Statistics Incorrectly Multiplied by Quantity (#229) — Removed incorrect * quantity multiplication
Print Queue Status Does Not Match Printer Status (#249) — Queue shows "Paused" when printer is paused
Queue Scheduled Time Wrong Timezone (#233) — Datetime picker now correctly uses local timezone
Mobile Layout Issues (#255) — Fixed header buttons overflowing on mobile devices
AMS Auto-Matching Selects Wrong Slot (#245) — Uses color as tiebreaker when multiple trays share the same filament type
A1/A1 Mini FTP Upload Failures (#271) — Replaced storbinary() with manual chunked transfer
P1S/P1P FTP Upload Failures — Restored SSL session reuse for vsFTPd-based printers
FTP Auto-Detection for A1 Printers — Tries encrypted data channel first, falls back automatically
Queue Print Time for Multi-Plate Files (PR #274) — Shows per-plate time instead of total
Safari Camera Stream Failing — Fixed Service Worker scope issue in Safari
Virtual Printer Proxy Error (PR #260) — Fixed proxy connection handling
Docker Permissions — Added PUID/PGID support to docker-compose.yml

Security

CodeQL Zero-Finding Baseline — Reduced findings from 591 to 0 with custom query suites
Log Injection Prevention — Converted ~700 f-string log calls to parameterized %s style
Exception Handling Hardened — Narrowed ~265 bare except blocks to specific exception types
SSRF Mitigations — URL validation for Home Assistant and IP validation for Tasmota integrations
Stack Trace Exposure Fixed — Generic error messages in HTTP responses
XXE Prevention — Replaced xml.etree with defusedxml across all 3MF parsing
Path Injection Fixed — Added path traversal validation to attachment and timelapse endpoints
Security Scanning in CI/CD — Added Bandit, Trivy, pip-audit, and npm-audit with GitHub Security integration
Hashlib Security Annotations — Added usedforsecurity=False to non-security hashes
Unused Code Removal — Removed ~30 redundant imports, variables, and dead code paths

Added

Windows Portable Launcher — start_bambuddy.bat for double-click-to-run on Windows, auto-downloads Python and Node.js

Community Contributors

Thank you to everyone who contributed to this release!

@MisterBeardy — 3D model viewer plate selector improvements (PR #262) and per-plate print time fix for queue (PR #274)
@bambuman — Per-filament Spoolman usage tracking with G-code parsing (PR #277)
@sbcrumb — Pushover notification image attachments (PR #253)
@cadtoolbox — File Manager print/schedule consistency with Archives page (PR #258)
@karaktaka — Virtual printer proxy error fix (PR #260)
@nmori — Windows portable launcher (start_bambuddy.bat)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/maziggy/bambuddy/pull/282 **Author:** [@maziggy](https://github.com/maziggy) **Created:** 2/6/2026 **Status:** ✅ Merged **Merged:** 2/6/2026 **Merged by:** [@maziggy](https://github.com/maziggy) **Base:** `main` ← **Head:** `0.1.8` --- ### 📝 Commits (10+) - [`6e82cc6`](https://github.com/maziggy/bambuddy/commit/6e82cc611e79442a43e11b8e9612eea0301c47f0) Add per-filament Spoolman usage tracking with G-code parsing - [`5703cea`](https://github.com/maziggy/bambuddy/commit/5703cea3f2902d312ab4f133d42af457c58dac30) fix linting isssues - [`2c086dd`](https://github.com/maziggy/bambuddy/commit/2c086dd91ada7511357bcd514c5c232aee5f9355) ruff format changes - [`33b9360`](https://github.com/maziggy/bambuddy/commit/33b9360e7a5bb56d9516a287a4fb72358b1e0e32) pre-commit changes - [`0a39b12`](https://github.com/maziggy/bambuddy/commit/0a39b120645c99c5b2d0f6e005ded315b8fd69fb) Merge branch 'maziggy:main' into feature/accurate-usage-tracking - [`ce4683a`](https://github.com/maziggy/bambuddy/commit/ce4683ad3f7ad4fbc964d176f8a1e0ceb8f67729) Use defusedxml in test files for Bandit compliance - [`b428591`](https://github.com/maziggy/bambuddy/commit/b4285913a9719244173a60f99b4153ac73bad21e) Remove 24-hour queue item expiration logic - [`905e176`](https://github.com/maziggy/bambuddy/commit/905e1762de7671c5f30d894e5979494d8f020c2f) Fix FTP settings UI: add selects, persist connection timeout - [`0dcb154`](https://github.com/maziggy/bambuddy/commit/0dcb154ae318fb9074b3da7ec1d7c418bb0d2d92) Merge branch '0.1.8b' into feature/accurate-usage-tracking - [`73be964`](https://github.com/maziggy/bambuddy/commit/73be96497ceb9d48bde8fa4441ea3966f3e7e7d1) Merge pull request #277 from bambuman/feature/accurate-usage-tracking ### 📊 Changes **105 files changed** (+4140 additions, -1938 deletions) <details> <summary>View changed files</summary> ➕ `.codeql/javascript-bambuddy.qls` (+16 -0) ➕ `.codeql/python-bambuddy.qls` (+89 -0) 📝 `.gitignore` (+3 -0) ➕ `.trivyignore` (+3 -0) 📝 `CHANGELOG.md` (+31 -2) 📝 `backend/app/api/routes/archives.py` (+49 -51) 📝 `backend/app/api/routes/auth.py` (+8 -23) 📝 `backend/app/api/routes/camera.py` (+42 -38) 📝 `backend/app/api/routes/cloud.py` (+2 -2) 📝 `backend/app/api/routes/external_links.py` (+6 -6) 📝 `backend/app/api/routes/github_backup.py` (+4 -4) 📝 `backend/app/api/routes/kprofiles.py` (+4 -4) 📝 `backend/app/api/routes/library.py` (+53 -62) 📝 `backend/app/api/routes/maintenance.py` (+1 -1) 📝 `backend/app/api/routes/notifications.py` (+4 -4) 📝 `backend/app/api/routes/pending_uploads.py` (+9 -9) 📝 `backend/app/api/routes/print_queue.py` (+19 -19) 📝 `backend/app/api/routes/printers.py` (+26 -30) 📝 `backend/app/api/routes/projects.py` (+6 -6) 📝 `backend/app/api/routes/settings.py` (+21 -10) _...and 80 more files_ </details> ### 📄 Description v0.1.8 Bambuddy v0.1.8 Release Notes **Highlights** This release focuses on security hardening, FTP reliability, and print accuracy improvements, alongside several community-contributed enhancements. --- **Enhancements** Per-Filament Spoolman Usage Tracking (PR #277) - Reports exact filament consumption per spool to Spoolman after each print - Parses G-code from 3MF files for layer-by-layer extrusion data (multi-material support) - New settings: "Disable AMS Estimated Weight Sync" and "Report Partial Usage for Failed Prints" - Persists tracking data in SQLite for reliability across restarts 3D Model Viewer Improvements (PR #262) - Plate selector for multi-plate 3MF files with thumbnail previews - Object count display per plate and total - Fullscreen toggle with resizable split view - Pagination for files with many plates (50+) Virtual Printer Proxy Mode Improvements - SSDP proxy for cross-network setups with slicer network interface selection - FTP proxy now listens on port 990 (matching Bambu Studio expectations) - Automatic directory permission checking at startup Pushover Image Attachments (PR #253) - Camera finish photo images now attached directly to Pushover notifications File Manager Print/Schedule Consistency (PR #258) - File Manager print and schedule actions now match Archives page behavior --- **Bug Fixes** - Authentication Required Error After Initial Setup (#257) — Token clearing on 401 responses is now more selective - Filament Hover Card Overlapping Nav Bar (#259) — Hover card positioning accounts for the fixed header - Filament Statistics Incorrectly Multiplied by Quantity (#229) — Removed incorrect * quantity multiplication - Print Queue Status Does Not Match Printer Status (#249) — Queue shows "Paused" when printer is paused - Queue Scheduled Time Wrong Timezone (#233) — Datetime picker now correctly uses local timezone - Mobile Layout Issues (#255) — Fixed header buttons overflowing on mobile devices - AMS Auto-Matching Selects Wrong Slot (#245) — Uses color as tiebreaker when multiple trays share the same filament type - A1/A1 Mini FTP Upload Failures (#271) — Replaced storbinary() with manual chunked transfer - P1S/P1P FTP Upload Failures — Restored SSL session reuse for vsFTPd-based printers - FTP Auto-Detection for A1 Printers — Tries encrypted data channel first, falls back automatically - Queue Print Time for Multi-Plate Files (PR #274) — Shows per-plate time instead of total - Safari Camera Stream Failing — Fixed Service Worker scope issue in Safari - Virtual Printer Proxy Error (PR #260) — Fixed proxy connection handling - Docker Permissions — Added PUID/PGID support to docker-compose.yml --- **Security** - CodeQL Zero-Finding Baseline — Reduced findings from 591 to 0 with custom query suites - Log Injection Prevention — Converted ~700 f-string log calls to parameterized %s style - Exception Handling Hardened — Narrowed ~265 bare except blocks to specific exception types - SSRF Mitigations — URL validation for Home Assistant and IP validation for Tasmota integrations - Stack Trace Exposure Fixed — Generic error messages in HTTP responses - XXE Prevention — Replaced xml.etree with defusedxml across all 3MF parsing - Path Injection Fixed — Added path traversal validation to attachment and timelapse endpoints - Security Scanning in CI/CD — Added Bandit, Trivy, pip-audit, and npm-audit with GitHub Security integration - Hashlib Security Annotations — Added usedforsecurity=False to non-security hashes - Unused Code Removal — Removed ~30 redundant imports, variables, and dead code paths --- **Added** - Windows Portable Launcher — start_bambuddy.bat for double-click-to-run on Windows, auto-downloads Python and Node.js --- **Community Contributors** Thank you to everyone who contributed to this release! - @MisterBeardy — 3D model viewer plate selector improvements (PR #262) and per-plate print time fix for queue (PR #274) - @bambuman — Per-filament Spoolman usage tracking with G-code parsing (PR #277) - @sbcrumb — Pushover notification image attachments (PR #253) - @cadtoolbox — File Manager print/schedule consistency with Archives page (PR #258) - @karaktaka — Virtual printer proxy error fix (PR #260) - @nmori — Windows portable launcher (start_bambuddy.bat) --- --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>