# OctoPrint changelog > The snappy web interface for your 3D printer. - Vendor: Gina Häußge - Category: Design Tools - Official site: https://octoprint.org - Tracked by: What's New (https://whatsnew.fyi/product/octoprint) - Harvested from: GitHub (OctoPrint/OctoPrint) - Entries below: 10 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. ## Releases ### 2.0.0rc4 - Date: 2026-07-14 - Version: 2.0.0rc4 - Original notes: https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc4 - Permalink: https://whatsnew.fyi/product/octoprint/releases/2.0.0rc4 - Labels: Pre-release - **security** — Add reauth requirement for setting defaultReauthenticationTimeout via UI/settings API - **fixed** — Limit settings paths available with SETTINGS_READ permission to frontend relevant settings

###### ⚠️ Important note on release candidates This is a **R**elease **C**andidate of OctoPrint. It is not a stable release: severe bugs can occur, and they can be bad enough that they make a manual downgrade to an earlier version necessary - maybe even from the command line. You should be comfortable with and capable of possibly having to do this before installing an RC. ###### 🔁 Feedback on this RC Please provide *general* feedback on this RC [in this ticket](https://github.com/OctoPrint/OctoPrint/issues/5434). An "All is working fine" is valuable feedback as well because it tells me people are actually testing this RC and just not finding problems with it. **If you run into any obvious bugs, please follow ["How to file a bug report"](https://github.com/OctoPrint/OctoPrint/blob/master/CONTRIBUTING.md#how-to-file-a-bug-report)** - I need logs and reproduction steps to fix issues, not just the information that something doesn't work. Thanks! ###### Things to take a closer look at For this RC, these things should get a closer look while testing, if possible: 1. proper behaviour when using the included web interface as well as any third party clients at your disposal 2. printing via a serial connection 3. managing files on your printer's storage via a serial connection 4. blocklisted serial ports and/or baud rates are properly migrated to the serial connector (one per line, *not* comma-separated) 5. **if your printer's disconnected state happens to be "after error", please report back on which connector you used and what the reported error is** 6. if you have a Klipper/Moonraker based printer available: can you use it through OctoPrint when you install the [Moonraker Connector](https://github.com/OctoPrint/OctoPrint-MoonrakerConnector)? 7. if you have a Bambu based printer available: can you use it through OctoPrint when you install the [Bambu Connector](https://github.com/OctoPrint/OctoPrint-BambuConnector)? > [!NOTE] > As I'm still seeing a lot of so far unexplained "error" states, please take special note of item 5! ###### ✋ Heads-ups [The heads-ups from 2.0.0rc1 still apply!](https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc1) ###### 🐛 Bug fixes ###### Core - [#5425](https://github.com/OctoPrint/OctoPrint/issues/5425): Add reauth requirement for setting `defaultReauthenticationTimeout` via UI/settings API. - [#5429](https://github.com/OctoPrint/OctoPrint/issues/5429): Limit settings paths available with `SETTINGS_READ` permission to frontend relevant settings. ###### 🎉 Special thanks to all the contributors! Special thanks to everyone who contributed to this RC and provided full, analyzable bug reports! ###### 🔗 More information - [Commits](https://github.com/OctoPrint/OctoPrint/compare/2.0.0rc3...2.0.0rc4) ### 2.0.0rc3 - Date: 2026-06-23 - Version: 2.0.0rc3 - Original notes: https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc3 - Permalink: https://whatsnew.fyi/product/octoprint/releases/2.0.0rc3 - Labels: Pre-release - **security** — Fix XSS in Suppressed Command Notifications allowing injection of arbitrary HTML and JavaScript into notifications - **security** — Fix file exfiltration vulnerability via parameter injection on upload endpoints - **added** — Add the used printer connector to various printer related events - **added** — Add support for hiding non-stock marks on the temperature graph - **added** — Add Printing chart marker showing start of actual job processing after initial preheating and leveling - **added** — Add more filter options to the plugin repository browser to filter out commercial or AI developed plugins - **added** — Add display of the ai-developed attribute in the plugin repository - **fixed** — Fix Hide successfully printed files option in the file list breaking its processing due to JS errors inside the filter - **fixed** — Fix /api/job throwing an error in case of a non-int progress - **fixed** — Fix crash in Printer.get_current_temperatures when printer connector doesn't support temperature offsets - **fixed** — Fix download filenames containing a comma - **fixed** — Fix stopping and starting of analysis queue - **changed** — Update gcode-thumbnail-tool to fix extraction of thumbnails generated by Creality Print 7.x - **fixed** — Fix versioning without available tags

###### ⚠️ Important note on release candidates This is a **R**elease **C**andidate of OctoPrint. It is not a stable release: severe bugs can occur, and they can be bad enough that they make a manual downgrade to an earlier version necessary - maybe even from the command line. You should be comfortable with and capable of possibly having to do this before installing an RC. ###### 🔁 Feedback on this RC Please provide *general* feedback on this RC [in this ticket](https://github.com/OctoPrint/OctoPrint/issues/5423). An "All is working fine" is valuable feedback as well because it tells me people are actually testing this RC and just not finding problems with it. **If you run into any obvious bugs, please follow ["How to file a bug report"](https://github.com/OctoPrint/OctoPrint/blob/master/CONTRIBUTING.md#how-to-file-a-bug-report)** - I need logs and reproduction steps to fix issues, not just the information that something doesn't work. Thanks! ###### Things to take a closer look at For this RC, these things should get a closer look while testing, if possible: 1. proper behaviour when using the included web interface as well as any third party clients at your disposal 2. printing via a serial connection 3. managing files on your printer's storage via a serial connection 4. blocklisted serial ports and/or baud rates are properly migrated to the serial connector (one per line, *not* comma-separated) 5. if your printer's disconnected state happens to be "after error", please report back on which connector you used and what the reported error is 6. if you have a Klipper/Moonraker based printer available: can you use it through OctoPrint when you install the [Moonraker Connector](https://github.com/OctoPrint/OctoPrint-MoonrakerConnector)? 7. if you have a Bambu based printer available: can you use it through OctoPrint when you install the [Bambu Connector](https://github.com/OctoPrint/OctoPrint-BambuConnector)? ###### ✋ Heads-ups [The heads-ups from 2.0.0rc1 still apply!](https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc1) ###### 🔒 Security fixes - **XSS in Suppressed Command Notifications**, severity Moderate (4.6): OctoPrint versions up to and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Suppressed Command notifications popups generated by the printer. An attacker who successfully convinces a victim to print a specially crafted file could exploit this issue to disrupt ongoing prints, extract information (including sensitive configuration settings, if the targeted user has the necessary permissions for that), or perform other actions on behalf of the targeted user within the OctoPrint instance. See also the [GitHub Security Advisory](https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-p6qx-ghxm-389h) and [CVE-2026-35163](https://nvd.nist.gov/vuln/detail/CVE-2026-35163). - **File exfiltration possible via further parameter injection on upload endpoints**, severity High (7.0): OctoPrint versions up until and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 contain a vulnerability that allows an attacker with the `FILE_UPLOAD` permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload folder where they then can be downloaded from. This vulnerability was already reported as [GHSA-m9jh-jf9h-x3h2/CVE-2025-48067](https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-m9jh-jf9h-x3h2) but the fix provided in OctoPrint 1.11.2 turned out to be incomplete. The primary risk lies in the potential e _[Truncated at 4000 characters — full notes: https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc3]_ ### 1.11.8 - Date: 2026-06-23 - Version: 1.11.8 - Original notes: https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.8 - Permalink: https://whatsnew.fyi/product/octoprint/releases/1.11.8 - **security** — Fix XSS vulnerability in Suppressed Command Notifications that allowed injection of arbitrary HTML and JavaScript into notification popups - **security** — Fix file exfiltration vulnerability on upload endpoints that allowed users with FILE_UPLOAD permission to exfiltrate files from the host - **fixed** — Fix thread leak when connecting to a serial port that doesn't respond to handshake attempts

##### ✋ Heads-ups **The heads-ups from previous 1.11.x releases still apply**, please read their release notes as well for a full picture of what you should be aware of and what changed! ##### ⛈ Issues while updating? On every new OctoPrint release we see some people run into the same issues with outdated or broken environments all over again. If you encounter a problem during update, please check [this collection of the most common issues](https://community.octoprint.org/t/my-octoprint-update-fails/37880) encountered over the past couple of release cycles first, and test if the included fixes solve your problem. ##### ♻ Changes ###### 🔒 Security fixes - **XSS in Suppressed Command Notifications**, severity Moderate (4.6): OctoPrint versions up to and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Suppressed Command notifications popups generated by the printer. An attacker who successfully convinces a victim to print a specially crafted file could exploit this issue to disrupt ongoing prints, extract information (including sensitive configuration settings, if the targeted user has the necessary permissions for that), or perform other actions on behalf of the targeted user within the OctoPrint instance. See also the [GitHub Security Advisory](https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-p6qx-ghxm-389h) and [CVE-2026-35163](https://nvd.nist.gov/vuln/detail/CVE-2026-35163). - **File exfiltration possible via further parameter injection on upload endpoints**, severity High (7.0): OctoPrint versions up until and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 contain a vulnerability that allows an attacker with the `FILE_UPLOAD` permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload folder where they then can be downloaded from. This vulnerability was already reported as [GHSA-m9jh-jf9h-x3h2/CVE-2025-48067](https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-m9jh-jf9h-x3h2) but the fix provided in OctoPrint 1.11.2 turned out to be incomplete. The primary risk lies in the potential exfiltration of secrets stored inside OctoPrint's config, or further system files. By removing important runtime files, this could also be used to impact the availability of the host after an attempted server restart. Given that the attacker requires a user account with file upload permissions, the actual impact of this should however hopefully be minimal in most cases. See also the [GitHub Security Advisory](https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-j4h9-pm27-4rfw) and [CVE-2026-54134](https://nvd.nist.gov/vuln/detail/CVE-2026-54134). ###### 🐛 Bug fixes - [#5420](https://github.com/OctoPrint/OctoPrint/issues/5420): Fix thread leak when connecting to a serial port that doesn't respond to the handshake attempts. ##### 🎉 Special thanks to all the contributors! Special thanks to everyone who contributed to this bugfix release, especially @jacopotediosi for his PR! Also a big thank you to @jacopotediosi and @seankohjs for responsibly disclosing the security vulnerabilities fixed in this release. ##### 🔗 More information - [Commits](https://github.com/OctoPrint/OctoPrint/compare/1.11.7...1.11.8) - Release candidates: - As this is a bugfix release, there were no release candidates ### 2.0.0rc2 - Date: 2026-05-19 - Version: 2.0.0rc2 - Original notes: https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc2 - Permalink: https://whatsnew.fyi/product/octoprint/releases/2.0.0rc2 - Labels: Pre-release - **added** — Add option to the sidebar file manager's menu to recursively refresh the current storage's and path's thumbnails if supported - **added** — Add health check hint for unusable gcode_thumbnail_tool with link to FAQ entry - **added** — Add support for forgejo_release and forgejo_commit version check types for version checks against Forgejo code forges such as Codeberg - **added** — Add codeberg_release and codeberg_commit version check types which internally map to forgejo_* with the correct forge parameter - **added** — Add migration for terminal filters to new filter prefixes - **changed** — Improve migration guide for terminal filters - **changed** — Add more examples to the migration guide and deprecation list - **changed** — Add docs for octoprint.util.version - **fixed** — Fix evaluation of print parameter on upload API - **fixed** — Fix deselection of current print job not working - **fixed** — Allow None filament weight in /api/job response - **fixed** — Gracefully handle unavailability of gcode_thumbnail_tool due to missing OS dependencies - **fixed** — Fix file/folder move from root directory - **fixed** — Fix file commands on storage root - **fixed** — Fix repo file links still pointing to master vs main - **fixed** — Fix broken availability logic on connection button - **fixed** — Fix Update User button in access settings - **fixed** — Fix some template permission checks broken during removal of deprecated code - **fixed** — Fix support for pip VCS URL schemes as archive URL - **fixed** — Fix error handling in serial detection to not stop the whole detection workflow when a serial error occurs

###### ⚠️ Important note on release candidates This is a **R**elease **C**andidate of OctoPrint. It is not a stable release: severe bugs can occur, and they can be bad enough that they make a manual downgrade to an earlier version necessary - maybe even from the command line. You should be comfortable with and capable of possibly having to do this before installing an RC. ###### 🔁 Feedback on this RC Please provide *general* feedback on this RC [in this ticket](https://github.com/OctoPrint/OctoPrint/issues/5403). An "All is working fine" is valuable feedback as well because it tells me people are actually testing this RC and just not finding problems with it. **If you run into any obvious bugs, please follow ["How to file a bug report"](https://github.com/OctoPrint/OctoPrint/blob/master/CONTRIBUTING.md#how-to-file-a-bug-report)** - I need logs and reproduction steps to fix issues, not just the information that something doesn't work. Thanks! ###### Things to take a closer look at For this RC, these things should get a closer look while testing, if possible: 1. proper behaviour when using the included web interface as well as any third party clients at your disposal 2. printing via a serial connection 3. managing files on your printer's storage via a serial connection 4. blocklisted serial ports and/or baud rates are properly migrated to the serial connector (one per line, *not* comma-separated) 5. if your printer's disconnected state happens to be "after error", please report back on which connector you used and what the reported error is 6. if you have a Klipper/Moonraker based printer available: can you use it through OctoPrint when you install the [Moonraker Connector](https://github.com/OctoPrint/OctoPrint-MoonrakerConnector)? 7. if you have a Bambu based printer available: can you use it through OctoPrint when you install the [Bambu Connector](https://github.com/OctoPrint/OctoPrint-BambuConnector)? ###### ✋ Heads-ups [The heads-ups from 2.0.0rc1 still apply!](https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc1) ###### ✨ Improvements ###### Core - [#5385](https://github.com/OctoPrint/OctoPrint/pull/5385): Add migration for terminal filters to new filter prefixes. Also improve migration guide accordingly. ###### Core UI - Add option to the sidebar file manager's menu to (recursively) refresh the current storage's & path's thumbnails (if supported). ###### Healthcheck Plugin - Add health check hint for unusable `gcode_thumbnail_tool` with link to [the FAQ entry](https://community.octoprint.org/t/octoprint-tells-me-that-the-gcode-thumbnail-tool-is-unavailable/66368). ###### Software Update Plugin - Add support for `forgejo_release` and `forgejo_commit` version check types, which enable version checks against [Forgejo](https://forgejo.org/) code forges such as [Codeberg](https://codeberg.org/). For Codeberg specifically, there's also `codeberg_release` and `codeberg_commit` which internally gets remapped to `forgejo_*` with the correct `forge` parameter. ###### Docs - Add more examples to the migration guide and deprecation list. - Add docs for `octoprint.util.version`. ###### 🐛 Bug fixes ###### Core - [#5377](https://github.com/OctoPrint/OctoPrint/issues/5377) (regression): Fix evaluation of print parameter on upload API. - [#5379](https://github.com/OctoPrint/OctoPrint/pull/5379) (regression): Fix deselection of current print job not working. - [#5380](https://github.com/OctoPrint/OctoPrint/pull/5380) (regression): Allow `None` filament weight in `/api/job` response. - [#5390](https://github.com/OctoPrint/OctoPrint/issues/ _[Truncated at 4000 characters — full notes: https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc2]_ ### 2.0.0rc1 - Date: 2026-04-27 - Version: 2.0.0rc1 - Original notes: https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc1 - Permalink: https://whatsnew.fyi/product/octoprint/releases/2.0.0rc1 - Labels: Pre-release - **changed** — OctoPrint now requires Python 3.9 or higher, dropping support for Python 3.7 and 3.8 - **changed** — The accessControl.trustedRemoteUser setting has been replaced with a list of trusted authentication proxies that must be configured in accessControl.trustedRemoteUser - **removed** — Numerous long-deprecated methods and endpoints have been removed, affecting third-party plugins and clients - **removed** — Calling octoprint without a subcommand is no longer supported; use octoprint serve to run the server instead

##### ⚠️ Important note on release candidates This is a **R**elease **C**andidate of OctoPrint. It is not a stable release: severe bugs can occur, and they can be bad enough that they make a manual downgrade to an earlier version necessary - maybe even from the command line. You should be comfortable with and capable of possibly having to do this before installing an RC. > [!NOTE] > Should you get stuck due to a plugin that got broken by this RC (due to removing deprecated things), remember that you can always access a recovery page at `/recovery/` that allows you to restart in safe mode! ##### 🔁 Feedback on this RC Please provide *general* feedback on this RC [in this ticket](https://github.com/OctoPrint/OctoPrint/issues/5373). An "All is working fine" is valuable feedback as well because it tells me people are actually testing this RC and just not finding problems with it. **If you run into any obvious bugs, please follow ["How to file a bug report"](https://github.com/foosel/OctoPrint/blob/master/CONTRIBUTING.md#how-to-file-a-bug-report)** - I need logs and reproduction steps to fix issues, not just the information that something doesn't work. Thanks! ###### Things to take a closer look at For this RC, these things should get a closer look while testing, if possible: - proper behaviour when using the included web interface as well as any third party clients at your disposal - printing via a serial connection - managing files on your printer's storage via a serial connection - If you have a Klipper/Moonraker based printer available: can you use it through OctoPrint when you install the [Moonraker Connector](https://github.com/OctoPrint/OctoPrint-MoonrakerConnector)? - If you have a Bambu based printer available: can you use it through OctoPrint when you install the [Bambu Connector](https://github.com/OctoPrint/OctoPrint-BambuConnector)? ##### ✋ Heads-ups ###### ☝️ OctoPrint 2.0.0 requires Python 3.9+ This release of OctoPrint requires **Python 3.9+**. Python 3.7 & 3.8, still supported by OctoPrint 1.11.x, are no longer supported. [Please also see this FAQ entry on OctoPrint's Python version requirements](https://community.octoprint.org/t/61076). ###### 🔐 A new setting is available to configure trusted authentication proxies So far, if you set `accessControl.trustRemoteUser` to `true` in your `config.yaml`, OctoPrint would trust any incoming `X-Remote-User` header. That could of course in theory be abused if your OctoPrint instance was reachable directly in addition through your trusted authentication proxy. In OctoPrint 2.0.0, the `accessControl.trustedRemoteUser` setting has been replaced with a list of trusted authentication proxies. This defaults to empty, but if you had `trustedRemoteUser` enabled it will get set to your list of configured trusted reverse proxies. OctoPrint will now only accept and evaluate the `X-Remote-User` header if the request it is seeing came via any of your configured trusted authentication proxies - which must also be among your trusted reverse proxies. If you are currently using the `accessControl.trustedRemoteUser` feature in OctoPrint, you will want to check whether your list of trusted reverse proxies is configured correctly & contains your trusted authentication proxy prior to upgrading. And once upgraded, you'll want to limit the list of trusted authentication proxies further to only those of your reverse proxies that actually provide authentication. ###### 🧩 Plugin authors need to check if they are still using any of the now removed deprecated features OctoPrint has been logging deprecations warnings for some of its A _[Truncated at 4000 characters — full notes: https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc1]_ ### 1.11.7 - Date: 2026-02-18 - Version: 1.11.7 - Original notes: https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.7 - Permalink: https://whatsnew.fyi/product/octoprint/releases/1.11.7 - **fixed** — Add custom parser for User Agent under Prusa Slicer's webview, fixing an UI loading error - **fixed** — Use the right capability for registering active position autoreporting - **fixed** — Fix checkboxes not showing for unrendered timelapses - **fixed** — Fix response behaviour on missing subgroups on access management API - **fixed** — Don't send session cookies if login mechanism is apikey - **fixed** — Correctly convert timezone in Last-Modified - **fixed** — Fix help and generated output for octoprint user activate and deactivate commands - **fixed** — Fix cleanup tab always staying empty in Plugin Manager

##### ✋ Heads-ups **The heads-ups from previous 1.11.x releases still apply**, please read their release notes as well for a full picture of what you should be aware of and what changed! ##### ⛈ Issues while updating? On every new OctoPrint release we see some people run into the same issues with outdated or broken environments all over again. If you encounter a problem during update, please check [this collection of the most common issues](https://community.octoprint.org/t/my-octoprint-update-fails/37880) encountered over the past couple of release cycles first, and test if the included fixes solve your problem. ##### ♻ Changes ###### 🔒 Security fixes - **XSS in Action Commands Notification and Prompt**, severity Moderate (4.6): OctoPrint versions up to and including 1.11.3 are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Action Commands notification and prompt popups. An attacker who successfully convinces a victim to print a specially crafted file could exploit this issue to disrupt ongoing prints, extract information (including sensitive configuration settings, if the targeted user has the necessary permissions for that), or perform other actions on behalf of the targeted user within the OctoPrint instance. If popups have been disabled for both Action Command notifications and prompts, this vulnerability does not have an impact. See also the [GitHub Security Advisory](https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-crvm-xjhm-9h29) and [CVE-2025-64187](https://nvd.nist.gov/vuln/detail/CVE-2025-64187) ###### Minor security fixes - Protected the execution of system commands with a reauthentication request. ###### ✨ Features & improvements ###### Gcode Viewer Plugin - Got rid of some unused calculations in the gcode parser, greatly improving loading performance. ###### Plugin Manager Plugin & Software Update Plugin - [#5204](https://github.com/OctoPrint/OctoPrint/issues/5204): The Plugin Manager and the Software Update Plugin will now detect if they are about to install an OctoPrint plugin that still uses the legacy `setup.py` that depends on `octoprint_setuptools`, and add necessary parameters to `pip` for installation to work even under pip >= 25.3 (specifically `--no-build-isolation --use-pep517`). This solves errors installing plugins when the `pip` version in OctoPrint's virtual environment has been upgraded to 25.3 or newer. See also [this FAQ item](https://community.octoprint.org/t/65241). ###### 🐛 Bug fixes ###### Core - [#5193](https://github.com/OctoPrint/OctoPrint/issues/5193): Persist cache key used for file metadata in UI to reduce the likelihood of triggering a file data polling loop. - [#5199](https://github.com/OctoPrint/OctoPrint/issues/5199): Trigger the reload overlay when encountering a CSRF error during a server reconnect. That fixes the "Server Offline" error encountered when restoring from a backup. - Pinned the `psutil` dependency less aggressively again, after a broken release was pulled by piwheels. - Pinned the `click` dependency to a version below 8.3 due to breaking changes. This is a temporary solution for the 1.11.x release in particular, 1.12.0 will ship with full compatibility to current `click` releases again. - Pinned the `markupsafe` dependency to <=3.0.2 under Python 3.9 and armv7 due to the stock Python 3 environment found on Debian Bullseye that matches these parameters containing a buggy `toml` library that can no longer parse the packaging file of recent releases. ##### 🎉 Special thanks to all the contributors! Special thanks to everyone who cont _[Truncated at 4000 characters — full notes: https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.4]_ ### 1.11.3 - Date: 2025-09-09 - Version: 1.11.3 - Original notes: https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.3 - Permalink: https://whatsnew.fyi/product/octoprint/releases/1.11.3 - **security** — Fix RCE in OctoPrint via unsanitized filename in file upload (CVE-2025-58180), a high severity vulnerability allowing authenticated attackers to upload files under specially crafted filenames that could enable arbitrary command execution if included in system event handler commands - **security** — Remove unused and unneeded cookie setter functionality in LargeResponseHandler that could be used to break returned responses through user input - **added** — Add new CLI command to trigger the appkey request workflow via octoprint plugin appkeys:request-key - **added** — Allow configuring whether to enable shell mode on a system event hook in the Event Manager Plugin - **added** — Add new healthcheck to check for deprecated global API key being set and possibly used, disabled by default and will be enabled with 1.12.0 - **changed** — Introduce new shell parameter on type: system commands to explicitly configure whether commands should be run in a shell or directly, currently defaulting to true and changing to false in 1.13.0 - **changed** — Event Manager Plugin UI improvements - **fixed** — Fix unwanted side effect on HierarchicalChainMap._unflatten that could make it impossible to reset the run-time value of a dict-based setting back to an empty dict - **fixed** — Remove uses of the cgi module which has been deprecated and removed from Python 3.13+ - **fixed** — Add note that the global API key will be removed with the release of OctoPrint 1.13.0 - **fixed** — Pin psutil dependency to version 6.0.0 to work around a problem with its builds available on piwheels - **fixed** — Fix access request handling on newly opened page in Application Keys Plugin - **fixed** — Use proper name for filesViewModel instead of deprecated name gcodeFilesViewModel in Upload Manager Plugin - **deprecated** — Global API key is deprecated and will be removed in OctoPrint 1.13.0, users should switch to Application Keys instead

##### ✋ Heads-ups **The heads-ups from 1.11.0 still apply**, please read this release's [release notes](https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.0) as well for a full picture of what you should be aware of and what changed! ###### 🔒 Explicitly configure whether to use shell mode for your system event subscriptions OctoPrint 1.11.3 introduces a new `shell` parameter on `type: system` commands that allows to specify whether the command should be run in a shell (`true`, *currently* the default) or directly (`false`, the *future* default). Running commands in a shell has security implications as a misconfigured command with placeholders coming from external, potential untrusted sources can lead to arbitrary command execution. However, running commands in a shell also allows for more powerful scripting and also access to the shell’s environment, making it often unnecessary to set the full paths of commands that are supposed to be run. OctoPrint so far has been running system commands defined in event hooks within a shell. Starting with OctoPrint 1.11.3, OctoPrint will log a message to `octoprint.log` when it encounters a system hook that hasn’t yet explicitly configured `shell`, and default to enabling shell mode. From 1.13.0 onward, **this behaviour will change**, and OctoPrint will default to not enabling shell mode in such cases, to further reduce the attack surface. You should make an explicit decision now. Try to make your commands work without having to enable shell mode, and thoroughly vet your commands and parameter processing if you have to enable shell mode. The bundled Event Manager's UI has been adjusted to allow you to configured the `shell` parameter. ###### 🔥 Switch to Application Keys, the global API key will be removed in 1.13.0 The global API key has been deprecated for a long time now. So far the deprecation notice said it would be removed in OctoPrint 2.0, however this now has been rescheduled to OctoPrint 1.13.0. OctoPrint 1.12.0 will prepare this removal further and ship with a new health check enabled that will detect if you have a global API key set. OctoPrint 1.13.0 will then remove it altogether. Instead of using the global key you should create individual [Application Keys](https://docs.octoprint.org/en/main/bundledplugins/appkeys.html) for your third party clients. That way they get permissions matching the user account used for key creation and you can also revoke access to one app without having to change the keys for all other apps. It's also recommended to create a user account without admin access and use that for third party clients where possible. ##### ⛈ Issues while updating? On every new OctoPrint release we see some people run into the same issues with outdated or broken environments all over again. If you encounter a problem during update, please check [this collection of the most common issues](https://community.octoprint.org/t/my-octoprint-update-fails/37880) encountered over the past couple of release cycles first, and test if the included fixes solve your problem. ##### ♻ Changes ###### 🔒 Security fixes - **RCE in OctoPrint via Unsanitized Filename in File Upload**, severity High (7.5): OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename becomes included in a command defined in a system event handler and said event gets triggered. If no event handlers executing system commands with uploaded filenames as parameters have been configured, this _[Truncated at 4000 characters — full notes: https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.3]_