New release candidate: 2.0.0rc7

This one was not planned, but then I got a bug and a security report for 2.0.0rc*, and so here we are: the seventh release candidate for the upcoming 2.0.0 release, fixing said issues and also improving one thing in the new functionality and something in the docs:

🔒 Security fixes

  • Stored XSS via saved connection parameters, severity Low (2.4): OctoPrint versions 2.0.0rc1 up until version 2.0.0rc6 are susceptible to cross-site scripting via a specially crafted default port or baudrate setting on the bundled Serial Connector plugin, supplied via the API as new defaults during a connect request.

    See also the GitHub Security Advisory. A CVE has been requested but not yet been assigned by GitHub.

✨ Improvements

Serial Connector

  • #5469: Support printer firmware that doesn’t send File selected after File opened messages (e.g. Prusa Buddy Firmware).

Docs

  • Explain special handling of multipart requests.

🐛 Bug fixes

Core

  • #5469: Properly handle empty print job progress. Can happen if for some reason the printer’s job cannot be found.

For heads-ups, highlights and fancy pictures, please see the earlier post about 2.0.0rc1.

You can find the full changelog and release notes as usual on GitHub.

Special thanks to everyone who contributed to this release candidate and provided full, analyzable bug reports, you help making the next release as stable as possible! And of course also thank you to everyone who helped fund the development that went into this release candidate!

Also another Thank you! to @mahn-don for the responsible disclosure of vulnerabilities fixed in this release.

As the past RCs have shown me that a lot of people appear to be unaware of this: Please do not install this RC if you expect a fully stable version. It is not a stable release, it is a release candidate: severe bugs may occur, and they might be bad enough that they make a manual downgrade to an earlier version necessary - maybe even from the command line.

You should feel comfortable with and capable of possibly having to do this before installing an RC.

If you want to and can help test this release candidate, you can find information on how to switch to the "Release Candidates" release channel in this guide if not already done (also linked below).

Please provide feedback on this RC. For general feedback you can use this ticket on the tracker. The information that everything works fine for you is also valuable feedback 😄. For bug reports please follow How to file a bug report - I need logs and reproduction steps to fix issues, not just the information that something doesn't work so make sure to fill out all fields of the issue template.

While testing the release candidate, please take a closer look at these things:

  • Proper behaviour when using the included web interface as well as any third party clients at your disposal.

  • Printing via serial connection.

  • Managing files on your printers storage via a serial connection.

  • Blocklisted serial ports and/or baud rates are properly migrated to the serial connector (one per line, not comma-separated).

  • If your printer’s disconnected state happens to be “after error”, please report back on which connector you used and what the reported error is.

  • If you have a Klipper/Moonraker based printer available: can you use it through OctoPrint when you install the Moonraker Connector (work in progress)?

  • If you have a Bambu based printer available: can you use it through OctoPrint when you install the Bambu Connector (work in progress)?

Thanks!

Depending on the feedback regarding this version I'll look into fixing any observed regressions and bugs and pushing out a follow-up version as soon as possible and necessary.

Discuss!

Author
Gina Häußge
Published
20 Oct 2026
Category
Release