This release brings a major new Calibration Assistant, a complete camera-streaming rework on go2rtc, a full security hardening pass, and a modern testing + tooling foundation.
Calibration Assistant
- New Calibration Assistant connects to your printer over SSH/SCP, parses Klipper configuration, and runs bed-mesh and input-shaper analysis with rendered reports — all from a dedicated desktop dialog (874f9de, 40e0c1c)
go2rtc Camera Streaming
- Replaced the legacy RTSP/JSMpeg stack with the go2rtc streaming gateway for low-latency WebRTC/MSE/MJPEG playback on both desktop and WebUI, with managed binary lifecycle and automatic stream configuration (462f35a, b3ebb4f)
- Auto-detect OEM cameras from printer-reported stream URLs, with intelligent fallback probing of
http://<printer-ip>:8080/?action=streamwhen firmware omits the URL (f4a62ed, 7d585d5, 64b17af) - Retired CameraProxyService, RtspStreamService, PortAllocator, and JSMpeg canvas rendering (462f35a)
Notifications
- Discord notifications can now include a camera snapshot of the print (89267c3)
- Corrected time and ETA reporting across the WebUI and Discord alerts (6135d60)
Material Station (IFS)
- The IFS material station is now a first-class GridStack component with responsive layouts (1×4, 4×1, 2×2, compact) and dynamic spool sizing, replacing the old dialog (e14e058)
Theme Profiles & UI
- Create, rename, and delete custom theme profiles on both Desktop and WebUI (67b6971, 24f765d)
- Resizable UI components with updated default sizes (5931146)
Debug Logging
- New file-based debug logging system with session management, log rotation, and network-specific logs for connection troubleshooting (be53b98)
--debug/--debug-networkCLI flags for desktop and headless, a Settings toggle with a nested network option, and WebUI endpoints to list/download logs (be53b98)
Per-Printer Legacy Mode
- Legacy API mode is now a per-printer setting instead of a global override, with full settings/UI plumbing for 5M-series fallback (7bf2db9)
Testing & Reliability
- Browser Playwright coverage for the built WebUI — asset versioning, auth, WebSocket login, and context switching — backed by a fixture server (d967df9)
- Emulator-backed and live Electron Playwright coverage across 5M Pro, 5M, AD5X, Adventurer 3/4, plus multi-printer discovery, with dedicated Windows-friendly scripts (dc58252, c9c0348, 5a5f62d)
- Greatly expanded Jest coverage across managers, services, WebUI server/routes, static client modules, and build utilities (5d7e7e5)
- Aligned runtime discovery with the latest
@ghosttypes/ff-apiand kept printer-tab state synchronized; no-cache WebUI assets prevent stale mixes (6de2a87, 3d57598, 5d7e7e5)
Security
- Hardened the WebUI: path-traversal protection on job filenames, timing-safe auth comparison, security headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy), stored-XSS prevention, PBKDF2 password hashing (210k iterations) with automatic migration, per-installation dynamic secrets, and a secured go2rtc proxy binding (3d51c6e, 6366705, e2905d6, 235a225, d98e809, 649f704, 4c7433b, 98ea4ec)
- Resolved all 67 open Dependabot alerts (23 high / 35 moderate / 9 low → 0) (4a9d494, 9420edd, cb979aa)