Update all stable non-major dependencies #158
No reviewers
Labels
No labels
bug
duplicate
enhancement
help wanted
invalid
question
renovate
waiting on upstream
wontfix
No milestone
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
CCCHH/ansible-infra!158
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/all-stable-minor"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
v2.26.0→v2.32.013.1.0→13.2.415.18→15.1918.4→18.63.14-trixie→3.15-trixie8.8.0→8.10.2v0.33.1→v0.34.1v3.13.1→v3.15.13.9.0→3.10.1v3.1.0→v3.2.0v5.36.0→v5.37.0v26.6.0→v26.10.1v4.6.4→v4.7.31.11.1→1.12.0Release Notes
binwiederhier/ntfy (docker.io/binwiederhier/ntfy)
v2.32.0Compare Source
This release prepares ntfy.sh for a passive cluster node: jobs that write to the shared database run only on the cluster leader, and each database store now records the oldest schema version it works with. Streaming subscriptions also tell proxies not to buffer them.
Features:
Incremental: ?1header (RFC 10036) on streaming subscriptions, so proxies that support it forward messages without buffering (#2056, thanks to @bt90 for the suggestion)Bug fixes + maintenance:
?tpl=<name>) ignoring the priority sent with the request when the file has noprioritykey (#2045, thanks to @6801318d8d for reporting)auth-usersthrough the admin API (#2062, thanks to @daniloamiranda for reporting)v2.31.1Compare Source
This release fixes the database load that made us roll back ntfy.sh from v2.31.0: reconnecting with
since=<message ID>read every message of the topic from the database. A new index makes these reconnects cheap, cheaper than in v2.30.0. It also lets ntfy start with a warning on a newer database schema, so later rollbacks need no manual step.Bug fixes + maintenance:
since=<message ID>reading every message of the topic from the database, which overloaded ntfy.sh's database right after the v2.31.0 upgrade; the message cache gets a new index: (topic, published, id) on PostgreSQL, (topic, published, time) on SQLite (#2058)Upgrade notes:
since=<message ID>reconnects). Downgrading to v2.31.0 or earlier afterwards requires setting the version back by hand first:UPDATE schema_version SET version = 16 WHERE store = 'message'on PostgreSQL, orUPDATE schemaVersion SET version = 16 WHERE id = 1in the SQLitecache-file. From this release on, a newer schema only logs a warning (#2059)v2.31.0Compare Source
This release fixes messages that could be lost when a client reconnects, e.g. a phone switching networks, right when messages are published: every server now reads newly written messages from its message cache once a second and sends them to the subscribers that missed them. In load tests with server restarts and crashes, this brought lost messages down from 465 to 2 out of about 615,000. It also adds a
/v1/readyendpoint for load balancers, and continues the experimental clustering work with node roles.Features:
/v1/readyfor load balancers, and the node's role to/v1/health; with clustering, a node with no other active node leads right away instead of after a one-minute hold-off (#2050)experimental-cluster-roleto run apassivenode that never leads and never takes over another node's subscribers, e.g. one that is not behind the load balancer (#2049)Bug fixes + maintenance:
Upgrade notes:
since=<message ID>now also returns the messages published in the same second as that message, so none are skipped when several servers write out of order. The ntfy apps and web app drop these by ID; your own scripts may see a few duplicates (#2040)UPDATE schema_version SET version = 1 WHERE store = 'node_registry'(#2049)v2.30.0Compare Source
This release links attachments in email notifications, adds SMTP LOGIN auth (e.g. for OVH and Outlook), and fixes the PostgreSQL memory growth that came with v2.29.0. It also ships the first experimental version of clustering: several ntfy servers sharing one PostgreSQL database. Clustering is not ready for production yet.
Features:
experimental-cluster-listen; this is not ready for production yet (#2005, #2008, #2012, #2013)Bug fixes + maintenance:
Dockerfile-buildfailing to build: use Go 1.26 and add theclusterpackage (#1962, thanks to @ElectricTea for reporting)org.opencontainers.image.versionlabel on release Docker images (#1921/#1936, thanks to @Plazzmex for reporting and @w1977-0 for the fix)attachment-expiry-durationis longer thancache-duration, since attachments never outlive their message (#1053, thanks to @ctschach for reporting)INSERTfor any batch size (#2011)ntfy publishfailing with "invalid header field value" when sending a multi-line message or title along with a file (#1808, thanks to @quantenzitrone for reporting)Documentation:
v2.29.0Compare Source
This release fixes cache writes under load. On ntfy.sh, hourly cron bursts overwhelmed the batch writer: messages took up to 40s to reach the database (so
poll=1andsince=missed them) and publishes stalled. Batches are now written in one statement, publishes no longer wait on the writer, and PostgreSQL connections stay idle instead of reconnecting.Features:
X-Timezoneheader,timezonequery param or JSON field; the web app sends the browser's timezone (#1967/#1924, thanks @beemines)At: 2026-12-10T11:00:00-05:00(#1931, thanks @ALPHACOM-Brehmer)Bug fixes + maintenance:
INSERTper batch, non-blocking publishes (100-batch buffer), and no scheduled-message lookup unless a sequence ID is set (#2006)ntfy servehandlesSIGTERM/SIGINTgracefullypool_max_idle_connsnow defaults topool_max_conns, so PostgreSQL connections are reused instead of re-openedsince=<message-id>replaying a topic's full history when the ID wasn't on the read replica yet; it's now resolved on the primarymessages_cachedinstead of aCOUNT(*)every minuteContent-Typehas parameters or is uppercase (#1995, thanks @cipherprofessor)0001-01-01end time and merged start/end lines (#1946/#1940, thanks @justadityaraj and @deferred)time/tzdata) so named time zones work on ARM Docker images and minimal runtimesv2.28.0Compare Source
This is a hardening release. A single topic on ntfy.sh was polled continuously with
poll=1and nosincecursor, which replays a topic's entire cache on every request. The changes below bound what one replay can cost, close two fields that had no size limit at all, and fix an ordering bug found while digging into it.Bug fixes + maintenance:
/topic1,topic2/json?poll=1, #1297)40057and40058). Neither field had a size limit before, unlike the message body; on ntfy.sh the 99.9th percentile is 212 bytes for titles and 244 for tagssincecursor returns a topic's entire cache, which was previously unbounded and could reach tens of megabytes on a busy topic, so one request could allocate that much on the server. The newest messages that fit are kept and a truncated response carries anX-Messages-Truncated: 1headervisitor-attachment-daily-bandwidth-limitnow also covers messages replayed from the message cache by poll requests, not just attachment traffic. A poll without asincecursor returns a topic's entire cache, so a topic that is cheap to fill can be re-read for many times its own size; polls beyond the budget are rejected with HTTP 429 (error code 42905) before anything is written. Note that heavy pollers now consume the same budget as attachment downloads, so operators serving both may want to raise the limitv2.27.0Compare Source
This release lets you sign in with your verified email address instead of your username, which should help if you ever signed up with an email and then forgot which username you picked. It also hardens the message templating engine against a few ways a small template could eat a lot of memory, and it drops the "experimental" label from PostgreSQL support, which has been running ntfy.sh for a while now.
I also did a bunch of refactoring in, mostly in preparation for being able to cluster ntfy nodes and scale the service horizontally. It'll be a while until then, ... baby steps.
Security:
Template: yes) to 32 KB, limitprintfwidths and precisions to below 1000, and limitindent/nindentto 100 spaces, preventing excessive memory use from a single small templateFeatures:
Bug fixes + maintenance:
twiliopackagemetricspackageuser_phonetable in the SQLite user database referencing a dropped table after the v2.14 schema migration; repaired automatically by a new migrationv2.26.3Compare Source
This is a hotfix release, useful pretty much only for ntfy.sh. It was adds the ability to track abusive IPs mor efficiently, reducing the load on the IP banning services and preventing them from falling behind and leaving abusers unbanned for too long. It works by tracking HTTP errors, and writing out a ban file that fail2ban can read and ban offenders instantly. See ban-feed for details.
Features:
ban-file, ntfy tracks a weighted strike budget per visitor and appends abusive IPs to a file that fail2ban can tail and ban on sight (ban-file,ban-window,ban-threshold,ban-weights; see ban-feed)grafana/grafana (docker.io/grafana/grafana)
v13.2.4Security
Features and enhancements
Bug fixes
v13.2.3Security
v13.2.2Security
Bug fixes
v13.2.1Security
Bug fixes
v13.2.0Security
Features and enhancements
Bug fixes
InlineToastcontents are announced by screenreaders #128488, @ashharrison90Breaking changes
Plugin development fixes & changes
aria-currenton active page #128494, @ashharrison90colorIndex#129579, @ashharrison90v13.1.8Security
Features and enhancements
Bug fixes
v13.1.7Security
v13.1.6Security
Bug fixes
v13.1.5Security
v13.1.4Security
Bug fixes
v13.1.3v13.1.2Bug fixes
v13.1.1Features and enhancements
Bug fixes
InlineToastcontents are announced by screenreaders #128687, @grafana-writer[bot]Plugin development fixes & changes
aria-currenton active page #128518, @grafana-writer[bot]redis/docker-library-redis (docker.io/library/redis)
v8.10.2Compare Source
v8.10.1Compare Source
v8.10.0Compare Source
v8.8.3Compare Source
v8.8.2Compare Source
v8.8.1Compare Source
prometheus/alertmanager (docker.io/prom/alertmanager)
v0.34.1: 0.34.1 / 2026-09-17Compare Source
v0.34.0: 0.34.0 / 2026-08-16Compare Source
reasonlabel onalertmanager_notifications_failed_totalnow distinguishesauthError(HTTP 401/403) andrateLimited(HTTP 429) from the genericclientError. Dashboards/alerts matchingreason="clientError"for these codes must be updated. #5332inhibition_muted_alertevents. #5315external_idsupport in sigv4 configuration. #5157toDateandmustToDatefunctions. #5327reasononalertmanager_notifications_failed_total. #5332proxy_urlinto partialhttp_config. #5379payloadstring values verbatim instead of reinterpreting JSON leaves that look like YAML (e.g. values ending with a colon). #5304prometheus/prometheus (docker.io/prom/prometheus)
v3.15.1: 3.15.1 / 2026-10-21Compare Source
net/http,net/textproto,crypto/tlsandhtml/template.v3.15.0: 3.15.0 / 2026-09-24Compare Source
endwas not aligned tostepcaused subqueries inside it to evaluate past the parent's last actual step, inflatingpeakSamplesin the query stats and against thequery.max-sampleslimit, and wasting storage I/O reading samples that were never used in the result. Add tests to prevent regression of the fix made in #18081. #18598--log.level; useruntime.log_levelconfiguration to supply the default level. #19511runtime.log_levelon configuration reload. #19511--auto-gomemlimit.refresh-intervalflag to periodically re-detect the container or system memory limit and updateGOMEMLIMITat runtime. #18843__meta_docker_container_imageand__meta_docker_container_image_id. #19386--enable-feature=st-storageflag now automatically enables XOR2 float chunk encoding and ST-capable histogram chunk encoding, so you no longer need to passxor2-encodingandhistograms-st-encodingalongside it. #19518session_nameandtagsfields for STS AssumeRole sessions. The previously undocumentedservice_namefield is now also documented. #19569zstd-scrape. #19502--enable-feature=xor2-encodingis deprecated; usestorage.tsdb.chunk_encoding.floats: xor2instead. Check that other software reading the TSDB directly (e.g. Thanos sidecar) supports XOR2 before enabling. #19461prometheus_tsdb_head_appenders_created_totalmetric. #19411_countand_sumseries in scrape appender v2. #19323prometheus_tsdb_head_series_pending_commit_underflow_totalto report pending-sample reservation underflows. #19470request_concurrency. #19506info()enrichment for composite expressions with mixed@/offset references or selector-free vector branches, preventing metadata from being evaluated at an unrelated timestamp. #19387request_concurrencyinstead of hanging service discovery indefinitely. #19524prometheus_sd_last_update_timestamp_secondsseries for a config that is removed on reload. #19131DetectResetno longer misses a counter reset when a populated bucket behind an empty one disappears, which could make histogramrate()/increase()undercount. #19367.*\|(foo)\|.*). #19516anchoredorsmoothedmodifier when the selected series has no samples inside the query window, for example a query evaluated inside a scrape gap. #19431@is used as the matrix argument of a call that is not step-invariant (for examplequantile_over_time(scalar(x), metric[...:...] @ T)). #19187@ start()/@ end()before range selectors, matching the existing rejection of literal offsets and@ <timestamp>. #19406histogram_quantileandhistogram_fraction. #19330firstOOOChunkIDmodulo 2^23 instead of growing unbounded. #19216__meta_kubernetes_service_loadbalancer_ipfromstatus.loadBalancer.ingress, falling back to deprecatedspec.loadBalancerIP. #19404tsdb dumpsilently dropping native histogram samples. #18051Manager.TargetsDroppedCountsto avoid miscounting dropped targets. #19304v3.14.0: 3.14.0 / 2026-08-17Compare Source
statsquery parameter of/api/v1/queryand/api/v1/query_rangefor values other thantrueandall. Other values still enable basic statistics but now return a deprecation warning; they will be rejected in the next major release. #19124/api/v1/status/confignow correctly showsseparator: ""andreplacement: ""in relabel configs when explicitly set to empty, instead of omitting them. #18653__meta_hetzner_datacenterlabel forhcloudtargets, following its removal from the Hetzner Cloud API. #19269promql-duration-exprfeature flag is now a no-op. #19033first_over_timeto stable. It no longer requires thepromql-experimental-functionsfeature flag. #19093oci_sd_configs). #18919start_timestamp(instant-vector)function returning the start timestamp of each sample in the given vector. Requires theuse-start-timestampsfeature flag. #19089rate()andincrease()to use start timestamps as an alternative for rate extrapolation. Hidden behind theuse-start-timestampsfeature flag. #18619histograms-st-encodingfeature flag. #18609k8s.pod.nameandk8s_pod_nameboth becomek8s_pod_name), and expose theprometheus_api_otlp_translation_warnings_totalcounter labelled bycategoryto track such warnings. #18957--remote-write.pathflag topush metricsfor backends that use a non-default remote-write endpoint. #19086prometheus_tsdb_head_native_histogram_seriesandprometheus_tsdb_head_native_histogram_bucketsgauges tracking the number of native histogram series and buckets in the head. #19170step(),range(),min_of(),max_of()) in range selectors and subqueries. #18625{job=~"foo|bar|baz"}). #18833promtool check configfrom making AWS metadata service (IMDS) network calls when theregionfield is omitted in EC2, ECS, RDS, MSK, ElastiCache, and Lightsail service discovery configs. #19037docker_sdanddockerswarm_sdonunix,npipe, andtcphosts. Previously an unresponsive daemon could freeze discovery indefinitely, silently pinning targets to a stale snapshot. #19237mad_over_timereturning 0 instead ofNaNwhen the range contains aNaNsample. #19040--enable-feature=promql-binop-fill-modifiersincheck rules, which previously rejected validfill()/fill_left()/fill_right()expressions. #19153AZURE_FEDERATED_TOKEN_FILEenvironment variable for workload identity authentication instead of hardcoding the token file path. #18973rule_group_last_rule_duration_sum_secondsandrule_group_last_restore_duration_secondsseries when a rule group is removed or renamed on reload. Previously each reload leaked two series per dropped group, growing/metricscardinality over time. #19107stale_series_compaction_thresholdis used in the config file. #19016prometheus_tsdb_head_stale_seriesover-counting and early eviction of series that change between float, integer histogram, and float histogram sample types. #19183--enable-feature=xor2-encodingcould silently revert to XOR after compaction. #19145--web.enable-admin-apiis enabled. #19025v3.13.5: 3.13.5 / 2026-10-21Compare Source
net/http,net/textproto,crypto/tlsandhtml/template.v3.13.4: 3.13.4 / 2026-09-29Compare Source
rate(x[1m])over a constant histogram. #19682v3.13.3: 3.13.3 / 2026-09-07Compare Source
v3.13.2: 3.13.2 / 2026-07-29Compare Source
What's Changed
Full Changelog: https://github.com/prometheus/prometheus/compare/v3.13.1...v3.13.2
prometheus-pve/prometheus-pve-exporter (docker.io/prompve/prometheus-pve-exporter)
v3.10.1Compare Source
Changed
v3.10.0Compare Source
What's Changed
Full Changelog: https://github.com/prometheus-pve/prometheus-pve-exporter/compare/v3.9.0...v3.10.0
the-draupnir-project/Draupnir (ghcr.io/the-draupnir-project/draupnir)
v3.2.0Compare Source
[3.2.0] - 2026-10-14
Minor Changes
Patch Changes
a0ddfc0: Fix overly strict client capabilities check. Reported and fixed by @bones-was-here in #1102. This makes Draupnir bot mode deployable again on Conduit and Dendrite based homeserver deployments.4e949dd: Fix an issue where Draupnir would sometimes not redact events left by a user who left the room. Reported by @ll-SKY-ll in #1184.2a39b21: MakeinitialManagerthe uncommented option in thedefault.yamlconfig file instead ofmanagementRoom. This means that Draupnir will create the management room for new deployments.TwiN/gatus (ghcr.io/twin/gatus)
v5.37.0Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/TwiN/gatus/compare/v5.36.0...v5.37.0
ansible/ansible-lint (https://github.com/ansible/ansible-lint)
v26.10.1Compare Source
What's Changed
Full Changelog: https://github.com/ansible/ansible-lint/compare/v26.10.0...v26.10.1
v26.10.0Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/ansible/ansible-lint/compare/v26.9.0...v26.10.0
v26.9.0Compare Source
Features
examplesection in filemeta/argument_specs.yml(#5164) @berndfingerFixes
extra_varstoimport_playbooksyntax check (#5148) @shvenkat-rhinclude_tasksrelative paths (#5159) @shvenkat-rhinclude_taskspaths from playbook dir (#5184) @shvenkat-rhwarn_listafter--fixrewrites task names (#5085) @santosh7676--offline(#5183) @shvenkat-rhno-jinja-whenon string-embedded jinja (#5103) @f1047validate_argspecto play schema (#5187) @sameeralam3127Performance
get_deps_versions()result (#5113) @BlackDarkMaintenance
.github/SECURITY.md(#5165) @gundalowWhat's Changed
New Contributors
Full Changelog: https://github.com/ansible/ansible-lint/compare/v26.8.0...v26.9.0
v26.8.0Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/ansible/ansible-lint/compare/v26.6.0...v26.8.0
netbox-community/netbox (netbox)
v4.7.3: - 2026-10-13Compare Source
Enhancements
Performance Improvements
Bug Fixes
highlightparameter to prevent the disclosure of data the user is not permitted to viewaddpermissionTypeErrorexception when creating a device type with a front or rear image via the REST APIqsearch filter for tunnel terminationsinstalled_modulewhile creating a module bay via the REST APIFieldErrorexception when filtering circuits and virtual circuits by provider accountFieldErrorexception when filtering front & rear ports (and their templates) byrear_port_idorfront_port_idFieldErrorexception when searching circuit group assignmentsAttributeErrorexception when executing a bulk edit as a background job__emptylookup to numeric and date/time filtersv4.7.2: - 2026-09-29Compare Source
Enhancements
Cable.update_dependent_objects()hook to rebuild cable paths and related attributes after writes which bypasssave()Bug Fixes
return_urlparameter used for the cancel button on the IP address assignment viewsyncaction for synced data modelsv4.7.1: - 2026-09-15Compare Source
Enhancements
Bug Fixes
ßcan be matchedlengthorlength_unitfieldform-actioncontent security policy__n) filter lookup for multiple selection custom fieldspg_dump(see the warning above)typeand rack typeform_factorfieldsv4.7.0: - 2026-09-02Compare Source
Breaking Changes
{"value": "datacenter", "label": "Data Center"}) in both the REST and GraphQL APIs. These fields continue to accept the raw value on write.protocolandportsfields on theipam.Serviceandipam.ServiceTemplatemodels have been replaced by a unifiedport_mappingsfield, which supports multiple protocols per service. The legacy fields are retained (as deprecated) in the REST and GraphQL APIs, but at the ORM level they are now read-only properties derived fromport_mappings: Passingprotocolorportsto the model raises aTypeError, and assigning toservice.portsraises anAttributeError. This restriction applies only at the ORM level: The REST API continues to accept the legacy pair on write, translating it intoport_mappings.protocolis now filtered against theport_mappingsarray rather than a dedicated model field, the character-based REST filter lookups previously generated for it (protocol__ic,protocol__isw,protocol__empty, etc.) are no longer available. Theport__emptylookup has been removed as well.ipam.Serviceandipam.ServiceTemplatehave changed shape: The nestedportsinteger lookup has been replaced by the flatport,port__gt,port__gte,port__lt, andport__lteparameters (each accepting a list of values), alongside the newport_mappingsparameter. Additionally, the members ofServiceProtocolEnumhave been renamed to drop a spuriousROLE_prefix (e.g.ROLE_TCPis nowTCP).DeviceWithConfigContextSerializerandVirtualMachineWithConfigContextSerializerclasses have been removed (merged into the base serializers), and the?exclude=config_contextquery parameter is now silently ignored.{"detail": ..., "errors": [{"index": N, "errors": {...}}]}, correlating each error with the index of the offending object in the submitted list. (Bulk operations remain all-or-none.)tokenfield is now read-only, and any value supplied is ignored. (This restriction was already in effect in the web UI.)usernameargument has been removed fromextras.webhooks.send_webhook()(the value remains available to webhook templates asrequest.user). Any webhook jobs still enqueued when the workers are restarted will fail with aTypeError, so the background queues should be allowed to drain before upgrading.ltreecolumn rather than django-mptt. This covers the nested group models (Region, SiteGroup, Location, DeviceRole, Platform, TenantGroup, ContactGroup, WirelessLANGroup, etc.) as well as ModuleBay, InventoryItem, and InventoryItemTemplate. Thelft,rght,tree_id, andlevelcolumns have been dropped from every migrated model:levelremains available as a Python property, but can no longer be used in a queryset filter ororder_by()clause. NetBox'sltreeimplementation deliberately covers only the subset of MPTT's API which NetBox itself uses (get_ancestors(),get_descendants(),get_children(), andadd_related_count()); methods such asget_root(),get_family(),is_leaf_node(),move_to(), andinsert_at()are no longer available. The MPTT-backedNestedGroupModelbase class is retained for backward compatibility with plugins, but is deprecated: New code should useNestedLtreeGroupModelinstead.querystringtemplate tag toquerystring_replaceand removes theRelatedLinkColumnclass.social-auth-app-djangoandsocial-auth-corehave been upgraded to v6.0 and v5.1 respectively, each a major release. Deployments which employ single sign-on should test authentication against a non-production instance before upgrading.requestobject passed to custom link templates is now a sanitized subset of the current request. Only theid,path,path_info,method,GET, anduserattributes are available; cookies, headers, and session state are no longer accessible.ALLOWED_URL_SCHEMESconfiguration parameter. A value entered without a scheme is assumed to usehttpsand stored as an absolute URL.RQ_DEFAULT_TIMEOUTto 60 seconds or less, you must also setWEBHOOK_DEFAULT_TIMEOUTto a lower value; NetBox will refuse to start otherwise.EMAILconfiguration parameter is now mandatory in order to send mail: A deployment which does not defineEMAIL['SERVER']will raise anInvalidMailerexception when attempting to send, rather than failing at the SMTP connection.MAILERSsetting rather than the individualEMAIL_*settings which it supersedes.EMAIL_HOST,EMAIL_PORT,EMAIL_HOST_USER,EMAIL_HOST_PASSWORD,EMAIL_USE_SSL,EMAIL_USE_TLS,EMAIL_TIMEOUT,EMAIL_SSL_CERTFILE, andEMAIL_SSL_KEYFILEare no longer defined, andEMAIL_BACKENDis no longer consulted. Plugin code which reads any of these, or which callsdjango.core.mail.get_connection()with an explicit backend (now raising aRuntimeError), must be updated. TheEMAILconfiguration parameter itself is unchanged.rebuild_config_context_cachemanagement command to populate the new config context cache. This issues oneUPDATEper device and virtual machine, and may extend the duration of the upgrade considerably for deployments with a large number of either. The command skips objects whose cache is already populated, so it is safe to interrupt and re-run; it may also be deferred until after NetBox is back online, as any object whose cache is empty falls back to rendering its config context on demand.BULK_UPDATE_CHUNK_SIZEobjects in total.populate_custom_field_defaults()method has been removed fromCustomFieldsMixin.CustomField.objects.get_for_model()and thecustom_fieldsproperty ofCustomFieldsMixinnow return a list rather than a queryset, andget_for_model()returns only those fields which are active: Any whose stored data is being updated by a background job is omitted (see field status) unless selected via itsstatusesargument.housekeepingmanagement command has been removed. (Its constituent tasks are performed by the individual management commands introduced in NetBox v4.6.)querystringtemplate tag has been removed in favor of Django's built-in tag of the same name. The two are not interchangeable: Django's tag reads the current request from the template context, so therequestargument must be dropped ({% querystring request page=1 %}becomes{% querystring page=1 %}; passingrequestraises aTemplateSyntaxError). It also returns a bare?where NetBox's tag returned an empty string.SENTRY_DSN,SENTRY_SAMPLE_RATE,SENTRY_SEND_DEFAULT_PII, andSENTRY_TRACES_SAMPLE_RATEhave been removed. UseSENTRY_CONFIGinstead.DEFAULT_ACTION_PERMISSIONSconstant has been removed.LEGACY_ACTIONSconstant has been removed.registry['models']. (UseObjectType.objects.public()instead.) Theregistry['denormalized_fields']store has been removed as well.OptionalLimitOffsetPagination(nowNetBoxPagination),ExpandableIPAddressField(nowExpandableIPNetworkField), andexpand_ipaddress_pattern()(nowexpand_ipnetwork_pattern()) have been removed.request_idandusernamekeys have been removed from the context available to outgoing webhooks. Userequest.idandrequest.userinstead.OwnerMixin(e.g.site_set) has been removed.New Features
Cooling Infrastructure Modeling (#22447)
NetBox has long modeled power distribution end to end, but had no equivalent for cooling. This release introduces a cooling data model which deliberately mirrors the power model, so that the concepts and workflows feel familiar.
Two new top-level models parallel PowerPanel and PowerFeed: CoolingSource represents facility-level cooling plant (a chiller, cooling tower, dry cooler, or facility water system) scoped to a site or location, and CoolingFeed represents a coolant loop delivered from a source to a rack. Two new device components parallel PowerPort and PowerOutlet: CoolingIntake represents a coolant intake on a device (e.g. a server cold-plate connection or a CDU's facility water inlet), and CoolingOutflow represents a coolant outlet on a CDU or manifold which supplies downstream equipment. Each intake may reference the upstream outflow which serves it, and both components have corresponding device type templates. CDUs and manifolds are modeled as ordinary devices carrying these components.
Lightweight descriptive attributes have also been added for users who want to record cooling characteristics without modeling the full plumbing: a
cooling_methodfield (air, liquid, hybrid, or immersion) on the Device, DeviceType, and ModuleType models, andcooling_capability(air-only, hybrid, or liquid-only) andcooling_capacityfields on the Rack and RackType models.Channelized Subinterfaces (#20972)
Channelized (breakout) interfaces can now be modeled natively. A new
channelsfield on the Interface model indicates the number of physical channels into which an interface is divided, and each channel is represented by a subinterface of the new genericchanneltype, bound to its parent via the newchannel_idfield. A single cable terminates to the channelized parent interface, and NetBox traces a distinct cable path for each channel subinterface. Both fields are available on interface templates as well.Multi-Protocol Application Services (#20285)
Application services and service templates can now expose the same port on multiple protocols — for example, DNS listening on both
tcp/53andudp/53. The single-protocolprotocolandportsfields have been replaced by a unifiedport_mappingsfield, represented in the APIs as a flat list ofprotocol/portstrings (e.g.["tcp/80", "udp/53"]). Newport_mappings,protocol, andportfilters are available in the UI and in both APIs, with the latter two correlated so that they must be satisfied by a single mapping.Module Bay Types (#19731)
A new ModuleBayType model has been introduced to convey which kinds of modules a module bay is able to accommodate (e.g. an SFP28 cage or a PCIe x16 slot). Bay types can be assigned to module bays, module bay templates, and module types; where both a bay and a module type declare bay types, NetBox validates that the two sets share at least one type in common before permitting installation. Bay types assigned to a module bay template propagate automatically to each instantiated module bay.
Relocating Installed Modules (#15289)
An installed module can now be moved to a different module bay, including a bay on a different device, rather than having to be deleted and recreated. A move relocates the module's entire subtree — its components, its own module bays, and any child modules installed within them — and re-resolves any component names, labels, and positions derived from the module type's templates for the destination bay. Cross-device moves are permitted only where the moved components carry no active topology or device-scoped configuration.
Background Processing for REST API Requests (#21992)
Bulk write operations via the REST API can now be processed as a background job rather than synchronously, avoiding proxy and gateway timeouts on large batches. Appending
?background=trueto a bulk write request enqueues a job and immediately returns anHTTP 202 Acceptedresponse containing the job's ID and URL; the job'sdatafield records the response the synchronous request would have returned. Note that validation is deferred to the worker, so a202response indicates only that the request was accepted, and the job's final status must be inspected to confirm the outcome.Per-Object Errors for Bulk Operations (#20054)
When a bulk create or update via the REST API fails validation, the response now identifies each offending object by its index within the submitted list, along with its specific field errors, rather than reporting only the first failure. This enables clients to correct and resubmit only the objects which actually failed.
Pre-Rendered Config Context Data (#21025)
Rather than compiling config context data on demand from the full set of applicable ConfigContext instances, NetBox now pre-renders each device's and virtual machine's merged context data and caches it on the object itself. The cache is invalidated automatically whenever an upstream change is detected — a config context being created, modified, or deleted, or a change to an attribute which determines which contexts apply — and repopulated by a non-blocking background job. During the brief window between invalidation and re-render, reads fall back to the original on-demand rendering path, so the data returned is always correct rather than stale.
Snapshot-Aware Event Rule Conditions (#18159)
Event rule conditions can now inspect the pre-change and post-change snapshots captured at the time of an event, rather than only the object's current data. New
changedandunchangedoperators compare an attribute's value across the two snapshots, and thesnapshots.prechange.<attr>andsnapshots.postchange.<attr>dot-path syntax exposes either snapshot to any standard operator. This makes it possible to express the long-requested "fire only when status changes to active" rule, avoiding webhooks and scripts triggered by unrelated updates. A newregexoperator has been added as well, and conditions which reference an attribute that cannot be resolved now fail closed and log an error rather than silently disabling the rule.Enhancements
mac_addressfieldis_primaryfield to the MAC address REST API representationFIELD_CHOICESend_of_lifedate field to device types and module types to aid in hardware lifecycle planningnulls_firstparameter to control the placement of empty values when ordering by a custom fieldWEBHOOK_DEFAULT_TIMEOUTconfiguration parameterBULK_UPDATE_CHUNK_SIZEconfiguration parameter to bound the number of rows affected by a single bulkUPDATEstatementALLOWED_URL_SCHEMESwhen validating URL custom field valuessocial-auth-coreto permit the installation of newer PyJWT versionsPerformance Improvements
ltreeimplementation for hierarchical modelsPlugins
GenericObjectChoiceFieldandGenericObjectFormMixinto represent a generic foreign key relation as a single form fieldEventRuleActionDeprecations
JINJA2_FILTERSconfiguration parameter has been renamed toJINJA_FILTERS. The old name remains supported, but will be removed in NetBox v5.0.form_factor,width,outer_width,outer_height,outer_depth, andouter_unitfields on the Rack model have been deprecated, and will be removed in NetBox v5.0. These values will instead be inferred from the rack's assigned rack type, which will become a mandatory assignment.protocolandportsfields on application services and service templates have been deprecated in favor ofport_mappings, and will be removed from the REST & GraphQL APIs in NetBox v5.0.NestedGroupModelbase class has been deprecated in favor ofNestedLtreeGroupModel, and will be removed in a future release.Other Changes
querystringtemplate tag in favor of Django's built-in tagNULLS NOT DISTINCThousekeepingmanagement commandDEFAULT_ACTION_PERMISSIONSconstantmodelskey from the application registryOptionalLimitOffsetPaginationExpandableIPAddressFieldexpand_ipaddress_pattern()*TestMixinsuffixOwnerMixinjinja_filters,get_jinja_context(),register_jinja_filters()) for consistency withJINJA_FILTERSAppConfig.ready()and break its import cyclerequest_idandusernamekeys from the webhook contextv4.6.10: - 2026-09-01Compare Source
Performance Improvements
SerializedPKRelatedFieldBug Fixes
MetaattributesSerializedPKRelatedFieldfieldsownerfield on the power outlet and service formsupdate_fieldsto avoid consuming a generator inVLANGroup.save()andCircuitTermination.save()v4.6.9: - 2026-08-25Compare Source
Enhancements
Performance Improvements
Bug Fixes
current_requestand the query cache when an exception is raised within anevent_tracking()blockSideNavinstance for the top headerrunscriptmanagement commandv4.6.8: - 2026-08-11Compare Source
Performance Improvements
get_for_model()Bug Fixes
base_choiceswhen creating a custom field choice set via the REST APInotifications_defaultsetting when the script is run from an event ruleDISTINCTfilter on nested GraphQL list fieldsCustomLinkColumnv4.6.7: - 2026-07-30Compare Source
Performance Improvements
Bug Fixes
v4.6.6: - 2026-07-28Compare Source
Enhancements
tagandtag_idfilters to match objects assigned any of the specified tagsheader_safeJinja2 filter for sanitizing HTTP header valuesPerformance Improvements
Bug Fixes
JournalEntry.created_byimmutable after creation to prevent audit trail spoofingDataErrorexception when a cable length exceeds the maximum supported value{vc_position}is used on device type component templatesKeyErrorraised when validating a device assigned to a cluster scoped to a different locationKeyErrorfor malformed IP address and prefix values submitted via the REST APITypeErrorwhen deleting a virtual chassis with a cross-chassis LAGContent-Dispositionheader of file responsescommentsfield of ASNs in the global search indexContentTypeFieldrespects its declared queryset to prevent the selection of non-public object typeslengthlookup for array filterscommentsfield of several models in the global search indexescable_endwhen removing a cableTypeErrorexception when bulk adding module bays to devicesfilterorfilter_idquery parameterv4.6.5: - 2026-07-14Compare Source
Enhancements
Performance Improvements
tagsfield to avoid N+1 queries on list endpointsBug Fixes
RAM_BASE_UNITfor the default memory of a virtual machine typeValueError(HTTP 500) when an invalidfilter_idquery parameter is providedValueErrorexception when viewing background tasks under RQ 2.10ValueErrorraised by object-level permission checks for cross-app proxy modelsSandboxedEnvironmentrender_widgettemplate tag before marking it safeConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.
You can view your changes at https://staging.infra-docs.hamburg.ccc.de/pr158/
c155e3e756b0bbe97a27b0bbe97a274ad8444cbf4ad8444cbf6f136110a16f136110a15a70f4bada5a70f4bada294de3c583294de3c5832db68efcd72db68efcd7e69f644095e69f6440959d57a5ac589d57a5ac58319502a5dc319502a5dcb0620fbfd1b0620fbfd16b4e455cc36b4e455cc3c77934ca6fc77934ca6fe7ac450d7be7ac450d7bcd7a64f46ccd7a64f46c4f890641334f8906413324ffc0f8e024ffc0f8e07b10ee2dea7b10ee2dea2280194c9c2280194c9cbfeef72160bfeef72160b030340bc8b030340bc89173f157b59173f157b52851c4dc222851c4dc229afdedeb629afdedeb6284eaa6b23184eaa6b23172c6c81d5f72c6c81d5fb4bd9d9932b4bd9d99322788f8c39d2788f8c39d250cda919c250cda919cd54c5ef459d54c5ef4594fdbb897474fdbb897479b9f56ea509b9f56ea5027cc1dda1027cc1dda10e16d684c79e16d684c79c2ffb5b7a8c2ffb5b7a8f98f5bc888f98f5bc888d4a512a8d1d4a512a8d148c42ed7ea48c42ed7ea212a889a33212a889a339871ecb0d99871ecb0d96df8a15a266df8a15a26ff7d01fcdaff7d01fcdaa1af8184b2a1af8184b2a9a1e58163a9a1e581630ec52411e40ec52411e45e351a09d95e351a09d977e2474bc777e2474bc7fa87bb41b5fa87bb41b5253a3f87ef253a3f87ef23d998911e23d998911ee3b6ea7b1fe3b6ea7b1f2d1cc8bc90View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.