PrintStash v0.11.4: large libraries and stricter data safety

v0.11.4 is a patch number with an additive index migration and new cursor pagination endpoints. Back up before upgrading. The release focuses on large libraries, archive integrity, and failure cases that should stop cleanly instead of leaving partial state behind.

Large libraries do less work

Model browsing can now sort the complete filtered library by date, name, print success, last print, duration, filament, or cost without making the browser drain every page first. Desktop collection navigation uses a smaller outliner response, while mobile skips that extra tree entirely.

Facet counts and vault totals each use one aggregate database round trip. Background job polling stops when there is no work, pauses in hidden tabs, and backs off after transient errors. Shared volume scans also coalesce progress writes instead of committing for every unchanged file.

Portable archives have matching limits

Library export now applies the same entry and uncompressed-size limits as import. It verifies every source Artifact while streaming, so PrintStash will not produce an archive that its own importer rejects. Both directions keep hashing, ZIP, storage, and database work in bounded chunks and off the async event loop.

Permanent deletion also follows storage ownership more carefully. PrintStash removes vault-owned blobs, thumbnails, cached meshes, Collection images, Document files, and embedded images when their final owner is gone. Files indexed from your own NAS or shared volume remain yours and are not deleted from that source.

Sessions and administrator changes fail closed

Password resets, account activation changes, role changes, and logout now invalidate every access and refresh session for that account. Concurrent refresh-token rotation is atomic, and expired tokens are pruned in bounded batches.

First-run setup commits the configuration, initial administrator, and completion marker together. Concurrent administrator changes cannot deactivate or demote the final active superuser. OIDC provisioning pauses during restore, and cookie-authenticated mutations keep the correct actor in the audit log.

One API process per vault

PrintStash now enforces the deployment shape it supports: one API process for each vault. Startup claims a vault lock and refuses a second process, and the detailed health response reports the topology. Do not run multiple Uvicorn workers or API replicas against one vault.

PostgreSQL remains an optional database, with a real PostgreSQL 16 contract suite covering fresh migrations, enums, partial indexes, and concurrent token use. The built-in backup and restore flow is for SQLite. PostgreSQL operators should use pg_dump and their normal restore tooling.

The bundled local S3 profile now runs pinned SeaweedFS 4.41 instead of archived MinIO. Existing PrintStash MinIO volumes remain available through the minio-legacy profile so you can migrate the objects deliberately.

Upgrade notes

The database changes are append-only indexes and a constraint that keeps one live default printer. Migration repairs existing duplicate defaults deterministically before adding the constraint. Take a backup, pull the new images, and start the stack normally. Migrations run before the API starts.

See the upgrade guide for the commands and rollback path. The known limitations page covers the single-process topology and PostgreSQL backup boundary.

See the v0.11.4 GitHub release or read the full changelog.