Upstream watch 2026-W35

[github-actions]

Weekly upstream watch. Check items off as they are triaged; record port verdicts in the
porting PRs via Upstream-commit: <sha> ported|skipped — reason trailers.
(Upstream refs are backticked on purpose — listings must not cross-link upstream.)

New upstream commits (80)

• f02ebbc93 design: NFC/RFID tag support, phase 1 and phase 2 (design) — port / skip?
• f261dee61 Fix one dead websocket subscriber starving a whole pool (spoolman, tests) — port / skip?
• de533bc74 NFC phase 1 backend: tag identity, lookup, and the scan relay (migrations, spoolman, tests, tests_integration) — port / skip?
• 3f1d3b4c7 Fix mixed naive/aware clocks in the scan relay, and hand off the frontend (design, spoolman, tests) — port / skip?
• 419a4763d design: revise NFC phase 1 with the scanner contract and build plan (design) — port / skip?
• ac7865ecb Trim the tag endpoint's docstring and parameter descriptions (spoolman) — port / skip?
• 64e70076f Make BackupResponse.path required, as it already always is (spoolman) — port / skip?
• d67a2afbe Merge remote-tracking branch 'origin/master' into worktree-nfc-design-docs (spoolman) — port / skip?
• 91dec4693 client_v2: give toasts a neutral kind (client_v2) — port / skip?
• 9ec5181d4 client_v2: link NFC tags to spools, and act on a reader's scans (client_v2) — port / skip?
• b4292398f tests_frontend_v2: cover tags, and stop assuming a filament is on page 1 (tests_frontend_v2) — port / skip?
• 9d77b0811 design: record what the NFC frontend decided, and two traps it hit (design) — port / skip?
• 5144b64a8 scripts: add a fake tag reader (pyproject.toml, scripts) — port / skip?
• ff2e3ec31 client_v2: keep scans off the pages you are configuring (client_v2, tests_frontend_v2) — port / skip?
• d43552bd2 Generalise the tag table beyond spools before it ships (design, migrations, spoolman, tests, tests_integration) — port / skip?
• 01c7ff65b client_v2: stop keeping a second copy of a reader's name (client_v2) — port / skip?
• fb1567a9b client_v2: say what the scanner settings actually do (client_v2, tests_frontend_v2) — port / skip?
• 38b77a9b1 Updated some strings (client_v2) — port / skip?
• 6a786bac8 design: draft the Tag scanners wiki page (design) — port / skip?
• 21e0b71ef design: draw the tag scan flow instead of spelling it in ASCII (design) — port / skip?
• 5b39b2848 design: give the diagram boxes a title and a subtitle (design) — port / skip?
• 6e289d76c client_v2: show colors and material in the filament filter (client_v2) — port / skip?
• 5624a0a60 client_v2: pick several filter values without reopening the menu (client_v2) — port / skip?
• 6d97cd34b design: rename the diagram boxes to what they are (design) — port / skip?
• 7e2e98b30 design: correct two claims the shipped relay made false (design) — port / skip?
• 61e1b62a3 Translated using Weblate (Lithuanian) (client) — port / skip?
• 2edd96dbb Translated using Weblate (Thai) (client) — port / skip?
• 6fd64f9ed Merge pull request #1095 from Donkie/weblate (.) — port / skip?
• 83ea5001f Keep the NFC design notes out of the source tree (design) — port / skip?
• 61e2c0c27 client_v2: keep the frontend suite in step with the filter menu (client_v2, tests_frontend_v2) — port / skip?
• fa39c6d08 client_v2: flip the sort direction from the chip's own arrow (client_v2) — port / skip?
• 713cb51f0 client_v2: reveal truncated text on hover (client_v2) — port / skip?
• 33ad8d717 Show filaments you have no spools of (client_v2, spoolman, tests_integration) — port / skip?
• 1b4beb959 Merge pull request #1094 from Donkie/client-v2-filter-menu (.) — port / skip?
• 5b480f7db tests_frontend_v2: catch the tag spec up with the renamed strings (tests_frontend_v2) — port / skip?
• 6dce8717a Fold the empty-group query back into find_groups (client_v2, spoolman, tests_integration) — port / skip?
• 9a98e8ba5 Translated using Weblate (German) (client_v2) — port / skip?
• 052d3e9eb Translated using Weblate (German) (client_v2) — port / skip?
• 328c508c3 Translated using Weblate (Lithuanian) (client_v2) — port / skip?
• bd877c1ec Translated using Weblate (Thai) (client_v2) — port / skip?
• f9c2c3838 Merge pull request #1098 from Donkie/weblatev2 (.) — port / skip?
• 48221c270 Translated using Weblate (Thai) (client) — port / skip?
• 8d65e53e7 Merge pull request #1100 from Donkie/weblate (.) — port / skip?
• 96065fbd9 Translated using Weblate (Polish) (client_v2) — port / skip?
• afb3094c1 Translated using Weblate (Polish) (client) — port / skip?
• 565abec74 Merge pull request #1101 from Donkie/weblatev2 (.) — port / skip?
• 1f2670cf8 Merge pull request #1102 from Donkie/weblate (.) — port / skip?
• 90492ff75 client_v2: make the no-spools filaments an opt-in view (client_v2) — port / skip?
• 6ab045cde Merge remote-tracking branch 'origin/master' into client-v2-issue-1080-rest (client_v2) — port / skip?
• 9aea271ee Give phase 2 somewhere to record a tag's instance identity (migrations, spoolman) — port / skip?
• 97758f2c4 Let prettier respect the working tree's line endings (client, client_v2) — port / skip?
• 21c7b9884 Close the sqlite connections used to write a backup (spoolman) — port / skip?
• 413254b79 Merge pull request #1104 from jpapiez/upstream-fix-backup-connections (.) — port / skip?
• 8d9eb7395 Merge pull request #1105 from jpapiez/upstream-chore-prettier-eol (.) — port / skip?
• 332b3e0fe Revert "Give phase 2 somewhere to record a tag's instance identity" (migrations, spoolman) — port / skip?
• 9bb8973af Translated using Weblate (German) (client_v2) — port / skip?
• 8b71fb934 Translated using Weblate (German) (client_v2) — port / skip?
• 785984e68 Merge pull request #1106 from Donkie/weblatev2 (.) — port / skip?
• 35d10f899 Translated using Weblate (Portuguese) (client) — port / skip?
• 9935d7488 Merge pull request #1107 from Donkie/weblate (.) — port / skip?
• 8465481ab Translated using Weblate (German) (client_v2) — port / skip?
• ed732170d Translated using Weblate (German) (client_v2) — port / skip?
• 13f7667bf Translated using Weblate (German) (client_v2) — port / skip?
• aa5821f00 Translated using Weblate (German) (client_v2) — port / skip?
• dc72f3d5e Translated using Weblate (German) (client_v2) — port / skip?
• ce1c781ae Translated using Weblate (German) (client_v2) — port / skip?
• 5799fac1a Translated using Weblate (German) (client_v2) — port / skip?
• 852884795 Translated using Weblate (German) (client_v2) — port / skip?
• 91d5dc8f4 Translated using Weblate (German) (client_v2) — port / skip?
• a9e50559b Merge pull request #1109 from Donkie/weblatev2 (.) — port / skip?
• 9775c2c42 Merge pull request #1097 from Donkie/client-v2-issue-1080-rest (.) — port / skip?
• 931e3c9b3 Merge remote-tracking branch 'origin/master' into worktree-nfc-design-docs (client_v2, spoolman) — port / skip?
• f841da656 Point SpoolTag.from_db at the class the table actually has (spoolman) — port / skip?
• ba891d583 client_v2: let a scanned tag keep the view you were in (client_v2) — port / skip?
• 9f048a34c Merge pull request #1096 from Donkie/worktree-nfc-design-docs (.) — port / skip?
• f45899510 build(deps): bump brace-expansion in /client (client) — port / skip?
• 05a1b12e3 Merge pull request #1110 from Donkie/dependabot/npm_and_yarn/client/multi-e855e31deb (.) — port / skip?
• 205de5f0c Update FUNDING.yml (.github) — port / skip?
• a03909536 Replace Ko-fi buttons with GitHub Sponsors (README.md, client, client_v2) — port / skip?
• 009f9e3ba Merge pull request #1111 from Donkie/github-sponsors-button (.) — port / skip?

New upstream issues (12)

• Donkie/Spoolman#1108 Display RGB value alongside HEX color code — fix / implement / skip?
• Donkie/Spoolman#1103 New interface, how do change a filament name? — fix / implement / skip?
• Donkie/Spoolman#1099 Spoolman android NFC tag reading vs Spoolpainter — fix / implement / skip?
• Donkie/Spoolman#1093 client_v2: Show the full text in a tooltip when it is truncated — fix / implement / skip?
• Donkie/Spoolman#1092 client_v2: Show filaments with zero spools when grouping by filament — fix / implement / skip?
• Donkie/Spoolman#1091 client_v2: Flip the sort direction with a single click on the arrow — fix / implement / skip?
• Donkie/Spoolman#1090 client_v2: Mark filter values that are already active — fix / implement / skip?
• Donkie/Spoolman#1089 client_v2: Keep the filter menu open to select several values at once — fix / implement / skip?
• Donkie/Spoolman#1088 client_v2: Distinguish same-named filaments in the filter menu by material — fix / implement / skip?
• Donkie/Spoolman#1087 client_v2: Show color swatches in the filament filter menu — fix / implement / skip?
• Donkie/Spoolman#1086 Update Wiki docker_compose — fix / implement / skip?
• Donkie/Spoolman#1085 Live updates from Spoolman aren't working. Spoolman is blocking Fluidd's browser origin — fix / implement / skip?

[sherrmann]

Consolidated triage: W31–W35

Triaged all 363 non-merge upstream commits in 103e029..upstream/master (v0.24.0 → v0.26.1) in one pass rather than week by week, since W31–W34 are largely subsumed by W35. Closing those four in favour of this comment.

Bulk classification

Bucket	Count
SKIP — Weblate / docs / design / version bumps	134
SKIP — client_v2 / tests_frontend_v2 only	184
SKIP — upstream's own NFC stack (divergent)	9
SKIP — fork already has it	7
PORT — bugfix	20
PORT — feature	3
REVIEW — needs a human call	6

So ~87% is noise or client_v2, and the real signal is ~29 commits.

Decision 1 — client_v2: diverge

Upstream has rewritten the frontend in Svelte 5 + SvelteKit with a hand-rolled component kit (no component library), 285 commits / 28.5k LOC over six weeks, and now serves it by default with the React client behind SPOOLMAN_LEGACY_CLIENT. Upstream's client/ is effectively frozen — since 2026-07-12 it has received Weblate updates, dependabot bumps and four small fixes, nothing more.

Following is not viable here. This fork's client/ is 273 files / 41.6k LOC with 129 fork commits against it, and carries pages client_v2 has no equivalent of at all — calibration (3.2k LOC), orders (2.2k), locations (1.6k), printing (4k), the home dashboard (2.5k), low-stock — plus the AI chat drawer, Scan-to-Spool, the NFC modals, and 31 locales × 1,114 keys against upstream's 608. Following would mean rewriting ~40k LOC into a framework supplying none of the AntD Table/Form/Modal primitives this fork leans on, re-translating ~15k units, and back-porting /spool/group, /search and /tag first — for no user-visible gain.

Verdict: stay on client/ and accept becoming its de-facto maintainer (cheap — upstream ships almost nothing there). Keep taking upstream backend commits. Port concepts not code where they're good: server-side grouped/aggregated spool listing is a genuinely better data flow and is backend work adoptable independently. Reassess in ~6 months as a fresh decision, not a deferred obligation.

Decision 2 — websocket pool starvation: confirmed, fixed in #393

f261dee61 reproduces here. SubscriptionTree.send checks socket state and then awaits send_text unguarded — a TOCTOU, since a socket can begin closing in between and starlette then raises. The exception escaped the loop, skipping every remaining subscriber on the node, the dead-socket cleanup, and the descent into child nodes. One tab closing at the wrong instant silently stopped a live update reaching every other client on that pool, Moonraker included.

Upstream fixed this in two halves; the wrong-node cleanup half was already fixed here independently in #230, so only the unguarded write needed porting. Three regression tests added — the existing _FakeWS never raised on write, which is why #230 was covered thoroughly and this was not.

Decision 3 — NFC: diverged, and currently incompatible in both directions

Upstream built its own tag support and the two designs have no interop. This fork exposes seven /nfc/* RPCs that always return 200 with a {success, message} envelope, keys tag identity as a spool extra field (nfc_tag_id, format-prefixed string, no uniqueness — declined deliberately), decodes TigerTag/Qidi/OpenPrintTag content, and has no relay: only the tab that started a scan reacts.

Upstream instead has a tag table keyed on the normalised hardware UID with a unique index, generalised beyond spools (target_type of spool/filament/location), REST semantics with real status codes (201/204/409 on conflict), a websocket scan relay with reader pairing and debounce, and it never decodes tag contents — the payload is carried opaquely as base64, so encrypted Bambu/Creality tags work.

One hazard worth noting: an upstream-targeting client calling GET /spool?tag=<uid> against this fork gets the entire spool list, because FastAPI silently drops the undeclared query param — so a conforming client takes spool #1 as the match. That is a silent-wrong-answer failure, not an error.

Recommendation: upstream's core insight is right — keying on hardware UID works for vendor tags we can never decrypt, and the extra-field scheme has no uniqueness at all. Adopt the tag table, normalize_uid, ?tag=/POST/DELETE /spool/{id}/tag and the scan relay as the canonical surface, keep /nfc/* as a deprecated fork-only superset, and keep what upstream lacks entirely (the three codecs, auto-create-from-tag, tag writing, the USB reader, TigerTag enrichment). We have one piece of luck: no tag table exists here, so upstream's migration is purely additive. That stops being true once users have identity in spool_field.

Actionable ports (non-security)

sha	what	why it matters here
21c7b988	Close sqlite connections used to write a backup	with sqlite3.connect(...) never closes; the pending-file rename then fails with WinError 32. Breaks backups on Windows — same pattern at spoolman/database/database.py:134
ae3208a9	Let an extra field's value be cleared again	Can't unset a choice/int/datetime field once set, and filament/vendor PATCH replaces extra wholesale instead of merging per-key, destroying other custom fields. Touches the v1 client
6ade4051+29248503	Notify spools when their filament changes	Editing a filament never re-broadcasts its spools' derived fields, so WS subscribers see stale data. Port the final invalidation approach, not the naive O(spools) fan-out
ecd43bd5	Color-similarity search scales with matches, not catalog size	Identical implementation here (filament.py:548); the docstring already admits "not so efficient"
c8be881e	Keep never-used spools at the bottom	Postgres/CockroachDB default NULLS FIRST on DESC inverts "last used" ordering; SQLite/MySQL don't. Both are supported here
505faf3b	selectin instead of joined for extra-fields	Joined eager-load cross-multiplies to ~35k rows for a 30-spool page
5d812e26	400 instead of 500 on malformed sort params	?sort=name with no :dir currently 500s
2e396d6c	Fail loudly when the SPA base-path rewrite matches nothing	Same unchecked .replace() at spoolman/client.py:136
95230eaa	Guard JSON.parse of currency settings	v1 client; unhandled parse crashes the UI
64e70076	BackupResponse.path required	One-line; default=None contradicts the annotation
5c5e8b44	Ignore K8s service-link SPOOLMAN_PORT	K8s sets tcp://..., crashing uvicorn
18f11441	Drag-reorder extra-field choices	Backend already accepts it; only the UI never exposed it
913e9116	EXTERNAL_DB_NAME override	We point at our own catalog fork but still display upstream's name

Needs a human call (REVIEW): the extra-field filter/date-range cluster (dd16672a, 2c84acfd, b6d220a3, 179ea3b4, d7486d5d) against our own divergent extra_field_query.py, and b885108a (spool overriding inherited values) against our divergent override migration history.

Separately, upstream landed a backend security audit series that has no counterpart here. Handling that outside this listing.

Watermark

65 commits sit after the 99932ce watermark and were never filed in any watch issue — including two of the real bugfixes above (21c7b988, f261dee6).