v1.1.0

The first tagged release. Until now every merge to main published an indistinguishable :latest, so this is the first build you can pin, and the first place the changes below are written down.

Read this before upgrading

Four changes need action or will surprise you.

APP_URL is now required for email. Verification and password-reset links are built from it and from nothing else. With it unset those emails are not sent, and the log says so. Previously the link came from the request's Host header, which anyone could forge into a genuine-looking mail pointing at their own site. Set it to the address users open Filadex at:

- APP_URL=https://filadex.example.com

The default admin can no longer use the API until its password is changed. admin/admin could previously drive every route while still on the default password; the "forced change" was only a redirect in the web interface. It is now enforced server-side: every route except changing the password, reading your own account and logging out answers 403. The default account is also only created when no admin exists at all, so renaming it no longer brings a second one back on the next restart.

Case-variant manufacturer names are merged on upgrade. Manufacturers are now unique case-insensitively. If your database holds both Prusa and prusa, the migration keeps the older row and deletes the other. Spools are unaffected, because a spool stores its manufacturer as its own text, but the picklist will show one entry where it showed two. Take a snapshot before upgrading.

Spool names generated from a scan no longer include the manufacturer. A Bambu spool that used to come out as "Bambu Lab Bambu Lab PLA Basic Black" is now "PLA Basic Black".

New

• Community filament catalogs. Open Filament Database and SpoolmanDB, searchable from the Add Filament screen, held in memory and cached to disk rather than in a database table. Daily background sync, per-source refresh and status in Settings.
• Barcode and GTIN scanning. Scan a spool to look it up in the community catalogs, scan to find a spool you already own, and scan Filadex's own printed labels. Where one barcode matches several product variants you are asked which.
• Registration policy. An admin switch that turns off public sign-up while leaving manual account creation intact. The login screen hides the link and /register explains itself.
• Custom manufacturers and materials. Explicit "Other" and "Custom" entries with a checkbox controlling whether the value is saved to your catalog, so a one-off spool need not pollute it.
• Similarity prompts. Scanned metadata that closely resembles an existing catalog entry now asks rather than silently creating a near-duplicate, with an admin-managed list of generic words ("Lab", "Filament", "3D") excluded from matching.
• Polish, alongside English and German, and <html lang> now follows the chosen language. A language selector appears on every screen you can reach before signing in.
• PUID / PGID for the container, so it can own its data directory as the right user on a NAS.

Security

A full audit was carried out against cbec119; these are its results.

• Sessions are refused after a password change, reset or admin-set password. Pending reset and verification tokens are stored hashed and are no longer returned by /api/auth/me, which previously turned a stolen cookie into a permanent takeover.
• Registration no longer discloses which email addresses have accounts, and an unverified registration can be replaced by the address's real owner.
• The public share endpoint returns only the fields the page shows. It used to include purchase price, purchase date, storage location and custom fields, and it could be used to enumerate account ids.
• CSV exports no longer carry live spreadsheet formulas.
• Spool writes are validated, so a bad status or date is a 400 rather than stored.
• An unmatched /api path answers a JSON 404 instead of the web app with a 200.
• Only failed login attempts count against the rate limit.
• The container runs as an unprivileged user with a health check, and backup snapshots are written 0600.
• Production dependency advisories: 23 down to 0.

Fixes

Password reset links no longer point wherever the request says; language chosen before signing in survives the sign-in; the QR scanner no longer stops the camera on the wrong condition; scanning a black spool no longer records it as blue; PCTG no longer parses as PC; editing a spool no longer rewrites a material whose name carries a parenthetical; starter data actually seeds on a fresh PostgreSQL install; deleted catalog entries stay deleted across a restart; and a SQLite database on a bind-mounted NAS volume is writable.

Known

• Generic terms are not seeded on upgrade (#37). A fresh install gets the 12 defaults; an upgraded one gets none, so the similarity prompt will be more eager than it should be until an admin adds them in Settings.
• Existing SQLite installs have no system_settings row from the migration and create it lazily at first use. This is harmless, but do not assume the row exists.

Verified

Both engines, on the upgrade path from a pre-release database and on a fresh install: migrations apply cleanly, all data is preserved, the application boots and every endpoint answers. Unit suite 625 passing, browser suite 43 passing, zero dependency advisories.