Update all stable non-major dependencies #158
No reviewers
Labels
No labels
bug
duplicate
enhancement
help wanted
invalid
question
renovate
waiting on upstream
wontfix
No milestone
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
CCCHH/ansible-infra!158
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/all-stable-minor"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
v2.26.0→v2.28.013.1.0→13.2.115.18→15.1918.4→18.68.8.0→8.10.1v0.33.1→v0.34.0v3.13.1→v3.14.03.9.0→3.10.0v26.6.0→v26.8.0v4.6.4→v4.7.01.11.1→1.12.0Release Notes
binwiederhier/ntfy (docker.io/binwiederhier/ntfy)
v2.28.0Compare Source
This is a hardening release. A single topic on ntfy.sh was polled continuously with
poll=1and nosincecursor, which replays a topic's entire cache on every request. The changes below bound what one replay can cost, close two fields that had no size limit at all, and fix an ordering bug found while digging into it.Bug fixes + maintenance:
/topic1,topic2/json?poll=1, #1297)40057and40058). Neither field had a size limit before, unlike the message body; on ntfy.sh the 99.9th percentile is 212 bytes for titles and 244 for tagssincecursor returns a topic's entire cache, which was previously unbounded and could reach tens of megabytes on a busy topic, so one request could allocate that much on the server. The newest messages that fit are kept and a truncated response carries anX-Messages-Truncated: 1headervisitor-attachment-daily-bandwidth-limitnow also covers messages replayed from the message cache by poll requests, not just attachment traffic. A poll without asincecursor returns a topic's entire cache, so a topic that is cheap to fill can be re-read for many times its own size; polls beyond the budget are rejected with HTTP 429 (error code 42905) before anything is written. Note that heavy pollers now consume the same budget as attachment downloads, so operators serving both may want to raise the limitv2.27.0Compare Source
This release lets you sign in with your verified email address instead of your username, which should help if you ever signed up with an email and then forgot which username you picked. It also hardens the message templating engine against a few ways a small template could eat a lot of memory, and it drops the "experimental" label from PostgreSQL support, which has been running ntfy.sh for a while now.
I also did a bunch of refactoring in, mostly in preparation for being able to cluster ntfy nodes and scale the service horizontally. It'll be a while until then, ... baby steps.
Security:
Template: yes) to 32 KB, limitprintfwidths and precisions to below 1000, and limitindent/nindentto 100 spaces, preventing excessive memory use from a single small templateFeatures:
Bug fixes + maintenance:
twiliopackagemetricspackageuser_phonetable in the SQLite user database referencing a dropped table after the v2.14 schema migration; repaired automatically by a new migrationv2.26.3Compare Source
This is a hotfix release, useful pretty much only for ntfy.sh. It was adds the ability to track abusive IPs mor efficiently, reducing the load on the IP banning services and preventing them from falling behind and leaving abusers unbanned for too long. It works by tracking HTTP errors, and writing out a ban file that fail2ban can read and ban offenders instantly. See ban-feed for details.
Features:
ban-file, ntfy tracks a weighted strike budget per visitor and appends abusive IPs to a file that fail2ban can tail and ban on sight (ban-file,ban-window,ban-threshold,ban-weights; see ban-feed)grafana/grafana (docker.io/grafana/grafana)
v13.2.1Security
Bug fixes
v13.2.0Security
Features and enhancements
Bug fixes
InlineToastcontents are announced by screenreaders #128488, @ashharrison90Breaking changes
Plugin development fixes & changes
aria-currenton active page #128494, @ashharrison90colorIndex#129579, @ashharrison90v13.1.5Security
v13.1.4Security
Bug fixes
v13.1.3v13.1.2Bug fixes
v13.1.1Features and enhancements
Bug fixes
InlineToastcontents are announced by screenreaders #128687, @grafana-writer[bot]Plugin development fixes & changes
aria-currenton active page #128518, @grafana-writer[bot]redis/docker-library-redis (docker.io/library/redis)
v8.10.1Compare Source
v8.10.0Compare Source
v8.8.2Compare Source
v8.8.1Compare Source
prometheus/alertmanager (docker.io/prom/alertmanager)
v0.34.0: 0.34.0 / 2026-08-16Compare Source
reasonlabel onalertmanager_notifications_failed_totalnow distinguishesauthError(HTTP 401/403) andrateLimited(HTTP 429) from the genericclientError. Dashboards/alerts matchingreason="clientError"for these codes must be updated. #5332inhibition_muted_alertevents. #5315external_idsupport in sigv4 configuration. #5157toDateandmustToDatefunctions. #5327reasononalertmanager_notifications_failed_total. #5332proxy_urlinto partialhttp_config. #5379payloadstring values verbatim instead of reinterpreting JSON leaves that look like YAML (e.g. values ending with a colon). #5304prometheus/prometheus (docker.io/prom/prometheus)
v3.14.0: 3.14.0 / 2026-08-17Compare Source
statsquery parameter of/api/v1/queryand/api/v1/query_rangefor values other thantrueandall. Other values still enable basic statistics but now return a deprecation warning; they will be rejected in the next major release. #19124/api/v1/status/confignow correctly showsseparator: ""andreplacement: ""in relabel configs when explicitly set to empty, instead of omitting them. #18653__meta_hetzner_datacenterlabel forhcloudtargets, following its removal from the Hetzner Cloud API. #19269promql-duration-exprfeature flag is now a no-op. #19033first_over_timeto stable. It no longer requires thepromql-experimental-functionsfeature flag. #19093oci_sd_configs). #18919start_timestamp(instant-vector)function returning the start timestamp of each sample in the given vector. Requires theuse-start-timestampsfeature flag. #19089rate()andincrease()to use start timestamps as an alternative for rate extrapolation. Hidden behind theuse-start-timestampsfeature flag. #18619histograms-st-encodingfeature flag. #18609k8s.pod.nameandk8s_pod_nameboth becomek8s_pod_name), and expose theprometheus_api_otlp_translation_warnings_totalcounter labelled bycategoryto track such warnings. #18957--remote-write.pathflag topush metricsfor backends that use a non-default remote-write endpoint. #19086prometheus_tsdb_head_native_histogram_seriesandprometheus_tsdb_head_native_histogram_bucketsgauges tracking the number of native histogram series and buckets in the head. #19170step(),range(),min_of(),max_of()) in range selectors and subqueries. #18625{job=~"foo|bar|baz"}). #18833promtool check configfrom making AWS metadata service (IMDS) network calls when theregionfield is omitted in EC2, ECS, RDS, MSK, ElastiCache, and Lightsail service discovery configs. #19037docker_sdanddockerswarm_sdonunix,npipe, andtcphosts. Previously an unresponsive daemon could freeze discovery indefinitely, silently pinning targets to a stale snapshot. #19237mad_over_timereturning 0 instead ofNaNwhen the range contains aNaNsample. #19040--enable-feature=promql-binop-fill-modifiersincheck rules, which previously rejected validfill()/fill_left()/fill_right()expressions. #19153AZURE_FEDERATED_TOKEN_FILEenvironment variable for workload identity authentication instead of hardcoding the token file path. #18973rule_group_last_rule_duration_sum_secondsandrule_group_last_restore_duration_secondsseries when a rule group is removed or renamed on reload. Previously each reload leaked two series per dropped group, growing/metricscardinality over time. #19107stale_series_compaction_thresholdis used in the config file. #19016prometheus_tsdb_head_stale_seriesover-counting and early eviction of series that change between float, integer histogram, and float histogram sample types. #19183--enable-feature=xor2-encodingcould silently revert to XOR after compaction. #19145--web.enable-admin-apiis enabled. #19025v3.13.2: 3.13.2 / 2026-07-29Compare Source
What's Changed
Full Changelog: https://github.com/prometheus/prometheus/compare/v3.13.1...v3.13.2
prometheus-pve/prometheus-pve-exporter (docker.io/prompve/prometheus-pve-exporter)
v3.10.0Compare Source
Added
ansible/ansible-lint (https://github.com/ansible/ansible-lint)
v26.8.0Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/ansible/ansible-lint/compare/v26.6.0...v26.8.0
netbox-community/netbox (netbox)
v4.7.0: - 2026-09-02Compare Source
Breaking Changes
{"value": "datacenter", "label": "Data Center"}) in both the REST and GraphQL APIs. These fields continue to accept the raw value on write.protocolandportsfields on theipam.Serviceandipam.ServiceTemplatemodels have been replaced by a unifiedport_mappingsfield, which supports multiple protocols per service. The legacy fields are retained (as deprecated) in the REST and GraphQL APIs, but at the ORM level they are now read-only properties derived fromport_mappings: Passingprotocolorportsto the model raises aTypeError, and assigning toservice.portsraises anAttributeError. This restriction applies only at the ORM level: The REST API continues to accept the legacy pair on write, translating it intoport_mappings.protocolis now filtered against theport_mappingsarray rather than a dedicated model field, the character-based REST filter lookups previously generated for it (protocol__ic,protocol__isw,protocol__empty, etc.) are no longer available. Theport__emptylookup has been removed as well.ipam.Serviceandipam.ServiceTemplatehave changed shape: The nestedportsinteger lookup has been replaced by the flatport,port__gt,port__gte,port__lt, andport__lteparameters (each accepting a list of values), alongside the newport_mappingsparameter. Additionally, the members ofServiceProtocolEnumhave been renamed to drop a spuriousROLE_prefix (e.g.ROLE_TCPis nowTCP).DeviceWithConfigContextSerializerandVirtualMachineWithConfigContextSerializerclasses have been removed (merged into the base serializers), and the?exclude=config_contextquery parameter is now silently ignored.{"detail": ..., "errors": [{"index": N, "errors": {...}}]}, correlating each error with the index of the offending object in the submitted list. (Bulk operations remain all-or-none.)tokenfield is now read-only, and any value supplied is ignored. (This restriction was already in effect in the web UI.)usernameargument has been removed fromextras.webhooks.send_webhook()(the value remains available to webhook templates asrequest.user). Any webhook jobs still enqueued when the workers are restarted will fail with aTypeError, so the background queues should be allowed to drain before upgrading.ltreecolumn rather than django-mptt. This covers the nested group models (Region, SiteGroup, Location, DeviceRole, Platform, TenantGroup, ContactGroup, WirelessLANGroup, etc.) as well as ModuleBay, InventoryItem, and InventoryItemTemplate. Thelft,rght,tree_id, andlevelcolumns have been dropped from every migrated model:levelremains available as a Python property, but can no longer be used in a queryset filter ororder_by()clause. NetBox'sltreeimplementation deliberately covers only the subset of MPTT's API which NetBox itself uses (get_ancestors(),get_descendants(),get_children(), andadd_related_count()); methods such asget_root(),get_family(),is_leaf_node(),move_to(), andinsert_at()are no longer available. The MPTT-backedNestedGroupModelbase class is retained for backward compatibility with plugins, but is deprecated: New code should useNestedLtreeGroupModelinstead.querystringtemplate tag toquerystring_replaceand removes theRelatedLinkColumnclass.social-auth-app-djangoandsocial-auth-corehave been upgraded to v6.0 and v5.1 respectively, each a major release. Deployments which employ single sign-on should test authentication against a non-production instance before upgrading.requestobject passed to custom link templates is now a sanitized subset of the current request. Only theid,path,path_info,method,GET, anduserattributes are available; cookies, headers, and session state are no longer accessible.ALLOWED_URL_SCHEMESconfiguration parameter. A value entered without a scheme is assumed to usehttpsand stored as an absolute URL.RQ_DEFAULT_TIMEOUTto 60 seconds or less, you must also setWEBHOOK_DEFAULT_TIMEOUTto a lower value; NetBox will refuse to start otherwise.EMAILconfiguration parameter is now mandatory in order to send mail: A deployment which does not defineEMAIL['SERVER']will raise anInvalidMailerexception when attempting to send, rather than failing at the SMTP connection.MAILERSsetting rather than the individualEMAIL_*settings which it supersedes.EMAIL_HOST,EMAIL_PORT,EMAIL_HOST_USER,EMAIL_HOST_PASSWORD,EMAIL_USE_SSL,EMAIL_USE_TLS,EMAIL_TIMEOUT,EMAIL_SSL_CERTFILE, andEMAIL_SSL_KEYFILEare no longer defined, andEMAIL_BACKENDis no longer consulted. Plugin code which reads any of these, or which callsdjango.core.mail.get_connection()with an explicit backend (now raising aRuntimeError), must be updated. TheEMAILconfiguration parameter itself is unchanged.rebuild_config_context_cachemanagement command to populate the new config context cache. This issues oneUPDATEper device and virtual machine, and may extend the duration of the upgrade considerably for deployments with a large number of either. The command skips objects whose cache is already populated, so it is safe to interrupt and re-run; it may also be deferred until after NetBox is back online, as any object whose cache is empty falls back to rendering its config context on demand.BULK_UPDATE_CHUNK_SIZEobjects in total.populate_custom_field_defaults()method has been removed fromCustomFieldsMixin.CustomField.objects.get_for_model()and thecustom_fieldsproperty ofCustomFieldsMixinnow return a list rather than a queryset, andget_for_model()returns only those fields which are active: Any whose stored data is being updated by a background job is omitted (see field status) unless selected via itsstatusesargument.housekeepingmanagement command has been removed. (Its constituent tasks are performed by the individual management commands introduced in NetBox v4.6.)querystringtemplate tag has been removed in favor of Django's built-in tag of the same name. The two are not interchangeable: Django's tag reads the current request from the template context, so therequestargument must be dropped ({% querystring request page=1 %}becomes{% querystring page=1 %}; passingrequestraises aTemplateSyntaxError). It also returns a bare?where NetBox's tag returned an empty string.SENTRY_DSN,SENTRY_SAMPLE_RATE,SENTRY_SEND_DEFAULT_PII, andSENTRY_TRACES_SAMPLE_RATEhave been removed. UseSENTRY_CONFIGinstead.DEFAULT_ACTION_PERMISSIONSconstant has been removed.LEGACY_ACTIONSconstant has been removed.registry['models']. (UseObjectType.objects.public()instead.) Theregistry['denormalized_fields']store has been removed as well.OptionalLimitOffsetPagination(nowNetBoxPagination),ExpandableIPAddressField(nowExpandableIPNetworkField), andexpand_ipaddress_pattern()(nowexpand_ipnetwork_pattern()) have been removed.request_idandusernamekeys have been removed from the context available to outgoing webhooks. Userequest.idandrequest.userinstead.OwnerMixin(e.g.site_set) has been removed.New Features
Cooling Infrastructure Modeling (#22447)
NetBox has long modeled power distribution end to end, but had no equivalent for cooling. This release introduces a cooling data model which deliberately mirrors the power model, so that the concepts and workflows feel familiar.
Two new top-level models parallel PowerPanel and PowerFeed: CoolingSource represents facility-level cooling plant (a chiller, cooling tower, dry cooler, or facility water system) scoped to a site or location, and CoolingFeed represents a coolant loop delivered from a source to a rack. Two new device components parallel PowerPort and PowerOutlet: CoolingIntake represents a coolant intake on a device (e.g. a server cold-plate connection or a CDU's facility water inlet), and CoolingOutflow represents a coolant outlet on a CDU or manifold which supplies downstream equipment. Each intake may reference the upstream outflow which serves it, and both components have corresponding device type templates. CDUs and manifolds are modeled as ordinary devices carrying these components.
Lightweight descriptive attributes have also been added for users who want to record cooling characteristics without modeling the full plumbing: a
cooling_methodfield (air, liquid, hybrid, or immersion) on the Device, DeviceType, and ModuleType models, andcooling_capability(air-only, hybrid, or liquid-only) andcooling_capacityfields on the Rack and RackType models.Channelized Subinterfaces (#20972)
Channelized (breakout) interfaces can now be modeled natively. A new
channelsfield on the Interface model indicates the number of physical channels into which an interface is divided, and each channel is represented by a subinterface of the new genericchanneltype, bound to its parent via the newchannel_idfield. A single cable terminates to the channelized parent interface, and NetBox traces a distinct cable path for each channel subinterface. Both fields are available on interface templates as well.Multi-Protocol Application Services (#20285)
Application services and service templates can now expose the same port on multiple protocols — for example, DNS listening on both
tcp/53andudp/53. The single-protocolprotocolandportsfields have been replaced by a unifiedport_mappingsfield, represented in the APIs as a flat list ofprotocol/portstrings (e.g.["tcp/80", "udp/53"]). Newport_mappings,protocol, andportfilters are available in the UI and in both APIs, with the latter two correlated so that they must be satisfied by a single mapping.Module Bay Types (#19731)
A new ModuleBayType model has been introduced to convey which kinds of modules a module bay is able to accommodate (e.g. an SFP28 cage or a PCIe x16 slot). Bay types can be assigned to module bays, module bay templates, and module types; where both a bay and a module type declare bay types, NetBox validates that the two sets share at least one type in common before permitting installation. Bay types assigned to a module bay template propagate automatically to each instantiated module bay.
Relocating Installed Modules (#15289)
An installed module can now be moved to a different module bay, including a bay on a different device, rather than having to be deleted and recreated. A move relocates the module's entire subtree — its components, its own module bays, and any child modules installed within them — and re-resolves any component names, labels, and positions derived from the module type's templates for the destination bay. Cross-device moves are permitted only where the moved components carry no active topology or device-scoped configuration.
Background Processing for REST API Requests (#21992)
Bulk write operations via the REST API can now be processed as a background job rather than synchronously, avoiding proxy and gateway timeouts on large batches. Appending
?background=trueto a bulk write request enqueues a job and immediately returns anHTTP 202 Acceptedresponse containing the job's ID and URL; the job'sdatafield records the response the synchronous request would have returned. Note that validation is deferred to the worker, so a202response indicates only that the request was accepted, and the job's final status must be inspected to confirm the outcome.Per-Object Errors for Bulk Operations (#20054)
When a bulk create or update via the REST API fails validation, the response now identifies each offending object by its index within the submitted list, along with its specific field errors, rather than reporting only the first failure. This enables clients to correct and resubmit only the objects which actually failed.
Pre-Rendered Config Context Data (#21025)
Rather than compiling config context data on demand from the full set of applicable ConfigContext instances, NetBox now pre-renders each device's and virtual machine's merged context data and caches it on the object itself. The cache is invalidated automatically whenever an upstream change is detected — a config context being created, modified, or deleted, or a change to an attribute which determines which contexts apply — and repopulated by a non-blocking background job. During the brief window between invalidation and re-render, reads fall back to the original on-demand rendering path, so the data returned is always correct rather than stale.
Snapshot-Aware Event Rule Conditions (#18159)
Event rule conditions can now inspect the pre-change and post-change snapshots captured at the time of an event, rather than only the object's current data. New
changedandunchangedoperators compare an attribute's value across the two snapshots, and thesnapshots.prechange.<attr>andsnapshots.postchange.<attr>dot-path syntax exposes either snapshot to any standard operator. This makes it possible to express the long-requested "fire only when status changes to active" rule, avoiding webhooks and scripts triggered by unrelated updates. A newregexoperator has been added as well, and conditions which reference an attribute that cannot be resolved now fail closed and log an error rather than silently disabling the rule.Enhancements
mac_addressfieldis_primaryfield to the MAC address REST API representationFIELD_CHOICESend_of_lifedate field to device types and module types to aid in hardware lifecycle planningnulls_firstparameter to control the placement of empty values when ordering by a custom fieldWEBHOOK_DEFAULT_TIMEOUTconfiguration parameterBULK_UPDATE_CHUNK_SIZEconfiguration parameter to bound the number of rows affected by a single bulkUPDATEstatementALLOWED_URL_SCHEMESwhen validating URL custom field valuessocial-auth-coreto permit the installation of newer PyJWT versionsPerformance Improvements
ltreeimplementation for hierarchical modelsPlugins
GenericObjectChoiceFieldandGenericObjectFormMixinto represent a generic foreign key relation as a single form fieldEventRuleActionDeprecations
JINJA2_FILTERSconfiguration parameter has been renamed toJINJA_FILTERS. The old name remains supported, but will be removed in NetBox v5.0.form_factor,width,outer_width,outer_height,outer_depth, andouter_unitfields on the Rack model have been deprecated, and will be removed in NetBox v5.0. These values will instead be inferred from the rack's assigned rack type, which will become a mandatory assignment.protocolandportsfields on application services and service templates have been deprecated in favor ofport_mappings, and will be removed from the REST & GraphQL APIs in NetBox v5.0.NestedGroupModelbase class has been deprecated in favor ofNestedLtreeGroupModel, and will be removed in a future release.Other Changes
querystringtemplate tag in favor of Django's built-in tagNULLS NOT DISTINCThousekeepingmanagement commandDEFAULT_ACTION_PERMISSIONSconstantmodelskey from the application registryOptionalLimitOffsetPaginationExpandableIPAddressFieldexpand_ipaddress_pattern()*TestMixinsuffixOwnerMixinjinja_filters,get_jinja_context(),register_jinja_filters()) for consistency withJINJA_FILTERSAppConfig.ready()and break its import cyclerequest_idandusernamekeys from the webhook contextv4.6.10: - 2026-09-01Compare Source
Performance Improvements
SerializedPKRelatedFieldBug Fixes
MetaattributesSerializedPKRelatedFieldfieldsownerfield on the power outlet and service formsupdate_fieldsto avoid consuming a generator inVLANGroup.save()andCircuitTermination.save()v4.6.9: - 2026-08-25Compare Source
Enhancements
Performance Improvements
Bug Fixes
current_requestand the query cache when an exception is raised within anevent_tracking()blockSideNavinstance for the top headerrunscriptmanagement commandv4.6.8: - 2026-08-11Compare Source
Performance Improvements
get_for_model()Bug Fixes
base_choiceswhen creating a custom field choice set via the REST APInotifications_defaultsetting when the script is run from an event ruleDISTINCTfilter on nested GraphQL list fieldsCustomLinkColumnv4.6.7: - 2026-07-30Compare Source
Performance Improvements
Bug Fixes
v4.6.6: - 2026-07-28Compare Source
Enhancements
tagandtag_idfilters to match objects assigned any of the specified tagsheader_safeJinja2 filter for sanitizing HTTP header valuesPerformance Improvements
Bug Fixes
JournalEntry.created_byimmutable after creation to prevent audit trail spoofingDataErrorexception when a cable length exceeds the maximum supported value{vc_position}is used on device type component templatesKeyErrorraised when validating a device assigned to a cluster scoped to a different locationKeyErrorfor malformed IP address and prefix values submitted via the REST APITypeErrorwhen deleting a virtual chassis with a cross-chassis LAGContent-Dispositionheader of file responsescommentsfield of ASNs in the global search indexContentTypeFieldrespects its declared queryset to prevent the selection of non-public object typeslengthlookup for array filterscommentsfield of several models in the global search indexescable_endwhen removing a cableTypeErrorexception when bulk adding module bays to devicesfilterorfilter_idquery parameterv4.6.5: - 2026-07-14Compare Source
Enhancements
Performance Improvements
tagsfield to avoid N+1 queries on list endpointsBug Fixes
RAM_BASE_UNITfor the default memory of a virtual machine typeValueError(HTTP 500) when an invalidfilter_idquery parameter is providedValueErrorexception when viewing background tasks under RQ 2.10ValueErrorraised by object-level permission checks for cross-app proxy modelsSandboxedEnvironmentrender_widgettemplate tag before marking it safeConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.
You can view your changes at https://staging.infra-docs.hamburg.ccc.de/pr158/
c155e3e756b0bbe97a27b0bbe97a274ad8444cbf4ad8444cbf6f136110a1View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.