PrintStash v0.8.5: redact audit secrets and fix S3 startup

PrintStash v0.8.5 fixed a credential exposure in audit-log change records and a startup failure with real S3-compatible stores. It also tightened login handling and reduced repeated work on printer and library pages.

Upgrade with a current backup available:

docker compose pull
docker compose up -d

Rotate credentials if audit readers were not trusted

The generic change hook wrote raw before and after values for every changed database field. That could place printer API keys, S3 credentials, Spoolman and MakerWorld tokens, JWT material, and password or token hashes in GET /admin/audit responses.

v0.8.5 redacted sensitive fields and migrated existing audit rows to scrub captured values. If anyone with audit access should not have seen those secrets, rotate them after the upgrade. The migration cannot make an already copied value private again.

Login and refresh endpoints also received separate per-IP limits of 10 requests per minute. Backup creation and restore events joined the audit log.

For deployments where the API sits behind a proxy, FORWARDED_ALLOW_IPS lets uvicorn trust client IP headers from that proxy. Set it to the proxy’s address or network, not a broad value on a publicly reachable API port.

S3 and R2 can create a missing bucket

The missing-bucket path checked a response field that boto’s ClientError did not set. On MinIO, S3, and compatible services, a first startup could therefore fail instead of creating the configured bucket.

The check was corrected and covered by integration tests against a real SeaweedFS instance.

Printer job fixes

A send to a provider without upload support could create a job in UPLOADING before returning a 409. Capability validation now runs before the job row is created.

The send dialog stopped retaining a revision that had been trashed elsewhere and fell back to the model’s recommended revision. Mixed send failures also named the printer and reason instead of reporting only a count.

The cleanup loop began running once at startup before sleeping. Short-lived deployments no longer had to stay up for an hour before expired trash and old notification deliveries were considered.

Less repeated database work

• New file versions used SELECT MAX() instead of loading every file for the model.
• Active print-job lookup was cached per printer until the tracked file changed or the job ended.
• Collection and model-detail permission checks were batched for the page.
• Filament and printer profile usage counts selected only the columns they needed.

CI added bandit, pip-audit, and an upgrade job that replayed migrations from the oldest supported database. Release tags were also checked for strict semantic versioning.

Upgrading from v0.8.2 or earlier also includes two important fixes. v0.8.3 stopped cleanup from deleting locally stored collection documents and added those files to backups. v0.8.4 rejected the default JWT secret, enforced repaired SQLite foreign keys, closed a DNS-rebinding window, coordinated restore with background jobs, and froze print cost at completion time.

Read the full changelog before upgrading an older server.