Cobblr 2026.8.1

Cobblr 2026.8.1

Changes from 2026.8.0 (10 August) through 27 August: 114 features, 128 improvements, 155 fixes, 397 in all. This is the first stable in 17 days, and most of that time went into scanning, purchases, and the assistant. Features and improvements are listed in full below; the fixes are in the changelog, linked at the end. This is the part worth reading first.

Read before upgrading

• A self-host instance now refuses to start in production with a placeholder secret. If your .env still carries a template default for the session key, the credential-encryption key, or the database password, the server stops with a message instead of running on a publicly known signing key. Generate real values (the setup builder does it, or the openssl one-liners in the template) and it starts as normal. This is the only change in 8.1 that can stop an existing install from booting.
• Migrations are additive. Nothing in this range drops or renames a column, so 2026.8.0 can be run against a database that 8.1 has migrated, if you need to roll back.
• A blank line in .env no longer prevents startup. An empty value now means "not set", which is what compose passes anyway.
• The self-host stack now takes a nightly database dump you can restore from, instead of relying on a copy of the data directory taken while Postgres is running.

Security and stability fixes

The first two had no user-facing symptom and are the reason to upgrade even if nothing else here applies to you.

• Requesting an API token with a scope the build did not recognise silently minted an unrestricted one. Unknown scopes were dropped, an empty scope list meant "full access", and the caller got a credential more powerful than the one they asked for. It now fails with unknown_scope and mints nothing.
• A dropped tenant database could take down the whole API. The provisioning pool had no error handler, so a Postgres admin_shutdown during tenant teardown terminated the Node process, and every request failed until a restart. It now logs and carries on. This was hitting roughly one CI run in ten before it was found.
• Closed several authorization gaps: a sandboxed app can no longer change workspace configuration through its scoped token; a workspace admin can no longer demote or remove an owner; the forwarded Discord button endpoint requires a token minted for it; a removed platform admin loses impersonation immediately rather than for the life of an outstanding token; a guest can no longer be handed a capability grant.
• A required password reset is enforced server-side, not only in the app. Signup invites default to a 14-day expiry instead of living forever, and requesting a new reset link invalidates older ones.

What changed, by area

Scanning (84 entries). A forwarded receipt now keeps the whole purchase: who sold it, what it actually cost after any discount, and when it is due to arrive. A confirmed receipt fills in your own custom fields by what they mean rather than what you named them ("Acquired from", "Source" and "Bought from" all work). Scanning a screenshot of a listing crops the item's own picture out of the page for its catalog photo. Replay is now safe: it re-applies today's processing to an older scan and can no longer overwrite a good name with a worse one, which the previous fallback could.

Purchases (25 entries). Paste a tracking number and Cobblr works out the carrier, follows the parcel on its own schedule, and only asks about an order when there is something to answer. It works while the receipt is still in the scan inbox. FedEx connects directly; a tracking service on your own network can be reached through an edge bridge.

Ask Cobb (78 entries). He can now see your attention feed, activity log, notifications, maintenance and calendar, your lists, saved views, automations, apps, templates and units, and the actual items in your scan inbox rather than just a count. He can run the actions he could previously only describe, and answers stream in as they are written. A delete always waits for your confirmation, even when changes are set to apply automatically.

Fields. A field can hold a person from the workspace. A custom field can carry a role that says what it means (identifier, expiry, category, packaging, assignee). A dropdown value can carry a one-off note beside it without becoming a permanent choice.

Elsewhere. An edge bridge installs and updates its own driver packages. A Cobblr account can sign you in to a surface and hand you a workspace on the spot. Self-hosted instances serve their own MCP endpoint. The empty Locations page has a button to create your first location again; the put-away walk opens reliably after Accept all; customising a starter template validates instead of returning an error.

Still rough

Digifab (sending jobs to printers and laser cutters, watching for failed prints) is in and marked experimental. Browser push is not a finished notification channel and no longer claims to be. The nightly e2e suite had been failing for six weeks before this release and was repaired as part of it; expect it to catch more in the coming days.

Images

ghcr.io/cobblrhq/cobblr-{api,web,db,caddy}:2026.8.1, amd64 and arm64. 2026.8, stable and latest all point at this build. Self-hosting guide and setup builder: https://docs.cobblr.xyz

---

Features

• fields: Fields can now hold a person. Pick a Member field in the field builder and the field becomes a dropdown of everyone in the workspace, showing their name rather than an id, with Unassigned as a real option. Renaming someone updates it everywhere, and a person who has left still shows on records they were on.
• scan: You can now crop your own scan photo into the item's catalog picture, instead of taking whatever the web turned up.
• fields: Four new field roles describe how something came to be yours: where you got it, when, what it cost you, and who sold it. Mark your own fields with these and a receipt can fill them in for you, whatever you happen to have named them. "Acquired from", "Bought from" and "Source" are the same idea, and saying so is what lets Cobblr work on all three.
• fields: A dropdown field can carry a one-off note beside its value. Pick "eBay" from the list and note the specific seller next to it, and the record reads "eBay · detroitaxle". The value stays "eBay", so grouping, filters and saved views still gather every eBay purchase together however many sellers you have noted. Useful when a detail is worth keeping but does not deserve a permanent spot in your choices list.
• fields: A custom field can say what it means, not just what it is called. Fields you create yourself can now carry a role from a short standard list (identifier, expiry, category, packaging, assignee), the same list bundles use. A field named "Best before" and one named "Use by" are the same idea, and saying so lets Cobblr fill it in for you, match it against a field someone else made, and warn you before you end up with two fields for one thing.
• scan: A confirmed receipt fills in your own fields. If you have a field marked as "acquired from", "acquired on" or "acquired for", a receipt fills them in for you: where you bought it, when, and what it actually cost after any discount. It matches on what your fields MEAN, not what you named them, so "Acquired from", "Source" and "Bought from" all work. On a marketplace the individual seller is kept alongside the shop rather than replacing it.
• scan: A forwarded receipt now keeps the whole purchase, not just the item. Alongside the line items, Cobblr reads who sold it, what it actually cost you after any discount, and when it is due to arrive. Marketplace orders keep the shop and the individual seller as separate facts, because you shop at one again and probably never deal with the other twice.
• scan: Replay now means "re-apply the latest processing", and it can no longer make an item worse. What the AI works out about an item (its name, brand, category, what the photo shows) is stored on the item. Everything after that (which table it belongs in, which fields fill, the pack size, a decoded serial, the catalog photo) is worked out from that stored answer by Cobblr's own code. Replay redoes the second half with the code as it is today and never touches the first, so it costs nothing, returns immediately, and has no new information to overwrite anything with. Previously it re-asked the AI for a copy of an answer it already had, and when that copy could not be found, degraded to a keyword guess that could overwrite a good name with a worse one. Use it to bring an item you scanned last month up to date with an improvement that shipped since. Re-run AI is still the one that takes a fresh look. Scan names that an earlier replay truncated are restored automatically.
• scan: You can paste a screenshot straight into the scan inbox's search box, instead of saving it to disk first so you can drag it back in. Pasting text still searches as it always did.
• purchases: An order with an expected arrival date now asks you whether it turned up, on the day it was due, instead of sitting open forever.
• devices: An edge bridge can now install and update driver packages from Cobblr, instead of you editing a config file on the machine it runs on.
• auth: A Cobblr account can now sign you in to a surface directly, instead of that account only existing to be verified.
• auth: Signing in with a Cobblr account on a surface that welcomes new people now gets you a workspace on the spot, instead of a dead end.
• scan: Scan a screenshot of a listing and Cobblr crops the item's photo out of it. Upload a marketplace or shop screenshot and the item's own picture is cut out of the page, away from the chrome, price, buttons and seller, and used as the catalog photo. It is a picture of the actual item you are gettin...

Cobblr 2026.8.0

The first public release of Cobblr, a self-hosted app you shape yourself, for keeping track of things no off-the-shelf app quite fits.

Highlights

Capture first, structure later. A new workspace opens by asking what you want to keep track of. Scan something, or write it down ("3 skeins of blue worsted wool"). Once a few things cluster, Cobblr offers to build the right tracker in a tap and files everything you captured into it.

Scanning that keeps up with you. Plug in a USB or Bluetooth barcode scanner and it works hands-free. Photograph a pile of unrelated things and the inbox asks what to do with them. Live Sort tells you where to put each item as you scan it, and can name new bins itself on an empty workspace.

A print farm cockpit. One Fleet view across every connection, with live nozzle and bed temperatures, embedded webcam feeds, pause and resume, and a cross-machine queue that drips jobs onto whichever printer frees up next. A finished print does not close your task until you confirm the part came out good.

Print farm safety. A printer that just finished is flagged "needs clearing" and skipped by the auto-assigner until you say it is ready, so a fresh print never lands on an occupied bed.

Floor plans that do work. Draw your space to scale, floors as tabs, rooms that zoom. Then scan into a location on the plan, or print a label for it.

Labels, including from your phone. Print straight to a Bluetooth thermal label printer, or to a networked one, in custom sizes down to the millimetre.

Receipts by email. Forward a store receipt and Cobblr parses the line items into a labelled group in your scan inbox, then replies to you in the same thread.

Consumables that track themselves. Give a spool or a cone a capacity and Cobblr keeps a consumption ledger: what drew it down, by how much, and what is left. A print that declares its filament writes a row automatically.

Ask Cobb. The built-in assistant can read and change your workspace, with per-area permissions you set in the chat, and every change it makes is tracked and undoable. Bring your own model through OpenRouter, or teach it answers with no AI at all.

Integrations. Homebox as a live sync connector, Spoolman for filament, and an MCP server so an external AI assistant can read and write your workspace.

Install

Multi-arch images (amd64 and arm64), so a Raspberry Pi runs the same compose file as a server:

ghcr.io/cobblrhq/cobblr-api:2026.8.0
ghcr.io/cobblrhq/cobblr-web:2026.8.0
ghcr.io/cobblrhq/cobblr-db:2026.8.0
ghcr.io/cobblrhq/cobblr-caddy:2026.8.0

stable and latest also point at this release. The setup builder at
docs.cobblr.xyz/setup-builder generates your compose
file and .env; SELF_HOSTING.md is the full guide, including how to get
real HTTPS on a local box (which the camera needs).

Full changelog

941 entries since 2026-06-17, far too many for this page. The readable version is on the
community forum: Changelog: August 2026.

Licence

FSL-1.1-ALv2 (Functional Source License): source-available, free to run and modify, converting
to Apache 2.0 two years from this release. See LICENSE.md.

Images for this release were built from core commit bbdd178e.