Update all stable non-major dependencies #158
No reviewers
Labels
No labels
bug
duplicate
enhancement
help wanted
host: grafana
host: netbox
invalid
question
renovate
waiting on upstream
wontfix
No milestone
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
CCCHH/ansible-infra!158
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/all-stable-minor"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
v2.26.0→v2.38.08.38.1→8.40.013.1.0→13.3.115.18→15.2018.4→18.73.14-trixie→3.15-trixie8.8.0→8.10.3v0.33.1→v0.35.0v3.13.1→v3.16.03.9.0→3.11.0v5.36.0→v5.38.0v26.6.0→v26.11.0v4.6.4→v4.7.51.11.1→1.12.0Release Notes
binwiederhier/ntfy (docker.io/binwiederhier/ntfy)
v2.38.0Compare Source
This release shares every visitor's rate limits across the nodes of a cluster: a client spread over several nodes is now limited once instead of once per node, and a node that restarts or crashes takes the limits over from its peers instead of forgetting them. It also fixes a denial-of-service bug in message templating, where a crafted template could build an oversized string and crash the server, and builds ntfy with Go 1.27.4 (security fixes).
Features:
Bug fixes + maintenance:
replace,regexReplaceAllandjoinfunctions now cap the size of the string they build, so a template can no longer amplify small inputs into a multi-gigabyte string and crash the server with an out-of-memory error (thanks to Robert Flosbach of Neodyme for the responsible disclosure)Security:
net/httpv2.37.2Compare Source
Changelog
0510957Merge pull request #2169 from binwiederhier/release-2380v2.37.1Compare Source
This release fixes a database slowdown in v2.37.0 when using
visitor-subscriber-rate-limitingwith a user database: the subscriber activity of UnifiedPush topics was written far too often.Bug fixes + maintenance:
visitor-subscriber-rate-limitingand a user database, write a UnifiedPush topic's subscriber activity every one to two hours instead of every 5 minutes, spread over time, and not at all when a poll or reconnect only repeats the same subscriber; on ntfy.sh, v2.37.0's writes of ~45k topics every 5 minutes, all due in the same minute, slowed down the database (#2151)v2.37.0Compare Source
This release makes UnifiedPush work across several servers: the subscriber who pays for a topic's pushes is shared through the database, and app servers are told with
410 Gonewhen a subscription has been abandoned for 4 days. It also addsRetry-Afterand the draftRateLimitheaders to rate limit responses, and frees the memory of one-off visitors sooner.Features:
visitor-subscriber-rate-limiting, the subscriber of a UnifiedPush topic (who pays for its pushes) is kept in the user database and shared by all servers, so a push to any server is billed to the subscriber instead of answered with 507 (#2136; see subscriber-based rate limiting)Retry-Afterheader with HTTP 429 responses that are caused by a rate limit with a known wait, e.g. the request, e-mail or daily message limits (#2142; see rate limiting)RateLimit-PolicyandRateLimitheaders with publish responses (and with every 429 caused by a limit with a quota), for the request and daily message limits (#2143; see rate limiting)ntfy_topics_unifiedpush_total: the UnifiedPush topics whose subscriber state a server keeps in memory (#2136)Behavior changes:
visitor-subscriber-rate-limiting, a UnifiedPush push to a topic that has had no subscriber (subscribe, poll or open stream) for 4 days is answered with410(error code 41002) instead of507, so app servers like Mastodon remove the expired subscription (#664, #2136); a Matrix push to such a topic gets its pushkey rejected (before: after 12 hours without a subscriber on the server that got the push)visitor-subscriber-rate-limiting, UnifiedPush messages are counted against the subscriber's account only while it has a tier, and against the subscriber's IP address otherwise (also after the account lost its tier or was deleted); a tier change applies to the next message (#2136)0.001), auth failures (42909) now weigh 2 instead of 10, and a UnifiedPush push without a subscriber (50701) or to an abandoned topic (41002) weighs 0.05, so app servers pushing to many offline phones are not banned for it (#2147)visitorsstat and thentfy_visitors_totalmetric therefore count the visitors of roughly the last minute, not of the last day (#2126)visitor-topic-creation-limit-burst) (#2136)Bug fixes + maintenance:
ntfy_cluster_messages_wasted_total) and no longer keeps that idle topic in memory (#2140)v2.36.0Compare Source
This release keeps the daily limits across restarts and, with PostgreSQL, shares them between servers, so a visitor gets one daily allowance in total. Each visitor's day now starts at its own time instead of midnight UTC. It also adds an experimental local admin socket.
Features:
/v1/account(stats.reset_at) show when it resets (#2131, see message limits)experimental-listen-admin-unix, off by default) that serves the admin API without credentials to whoever can open it; the shipped systemd unit setsRuntimeDirectory=ntfyfor it (see admin socket)ntfy_db_upper PostgreSQL pool, and health-check the primary like the replicas (#2133)Upgrade notes:
stats_*columns of the user table are zeroed and no longer usedvisitor-email-limit-replenish)base-urlor amessage-size-limitabove 4K is set, so an invalid config that used to start now fails at startup (#1969, thanks to @mikejgray for the contribution)Bug fixes + maintenance:
ntfy pub --wait-pidnow waits for processes owned by other users instead of failing with "not running" (#1710, thanks to @bekoeppel for the contribution)v2.35.0Compare Source
This release keeps what a user already spent when their tier changes, and makes a tier's daily email limit a hard cap. It also fixes intermittent 403s under concurrent requests from the same IP, and the Matrix push gateway storing messages under a protected topic on SQLite.
Security:
/sec%00retwas authorized against an unmatched topic and then stored under the protected topicsecret(SQLite only; on PostgreSQL the request was denied; thanks to Efe Çam for reporting)Features:
Bug fixes + maintenance:
visitor-email-limit-burst)ip:<prefix>oruser:<id>, instead of in each visitor, which uses less memory per visitor and takes a global lock off the request path1T) in size settings such as attachment and tier limits, matching how sizes are displayed (#2078, thanks to @cangen185-sudo for the contribution)v2.34.0Compare Source
This release prepares the experimental cluster to run behind load balancers: nodes drain on shutdown instead of dropping all of their clients at once, ntfy can listen on several addresses, and access changes reach every node. It also fixes a revoked or deleted user keeping some of their subscriptions, on every server.
Features:
listen-http, so a load balancer can hold more than ~63k connections to one ntfy nodeexperimental-cluster-drain-delay,experimental-cluster-drain-duration), so its clients move to the other nodes without a reconnect storm (experimental, see draining on shutdown)Security:
ntfy accessCLI, and now runs every 67 seconds instead of 87Bug fixes + maintenance:
log-level-overridesis on: the subscriptions' topic stayed locked for goodlog-level-overrideschanges (e.g. on a config reload with SIGHUP) while the server logsv2.33.1Compare Source
This release builds ntfy with Go 1.27.3 (security fixes, including rejecting the compromised eMudhra intermediate CAs), and adds monitoring for the experimental cluster: each node's view of its peers, per-peer and database connection pool metrics.
The v2.33.0 release had an issue that made it crash on older CPU architectures. The v2.33.1 release fixes that (see #2092).
Features:
ntfy cluster status,/v1/cluster/statuson the cluster listener, and per-peer metrics, so a link that only works in one direction is visible (experimental clustering, see cluster status)ntfy_db_pool_*: connections in use, and queries that waited for a free connection, per pool), to sizepool_max_conns(see PostgreSQL)Security:
crypto/tls,net/http,html/templateand others) and 1.27.3 (crypto/x509: certificate chains through the compromised eMudhra intermediate CAs are rejected)Bug fixes + maintenance:
v2.33.0Compare Source
v2.32.0Compare Source
This release prepares ntfy.sh for a passive cluster node: jobs that write to the shared database run only on the cluster leader, and each database store now records the oldest schema version it works with. Streaming subscriptions also tell proxies not to buffer them.
Features:
Incremental: ?1header (RFC 10036) on streaming subscriptions, so proxies that support it forward messages without buffering (#2056, thanks to @bt90 for the suggestion)Bug fixes + maintenance:
?tpl=<name>) ignoring the priority sent with the request when the file has noprioritykey (#2045, thanks to @6801318d8d for reporting)auth-usersthrough the admin API (#2062, thanks to @daniloamiranda for reporting)v2.31.1Compare Source
This release fixes the database load that made us roll back ntfy.sh from v2.31.0: reconnecting with
since=<message ID>read every message of the topic from the database. A new index makes these reconnects cheap, cheaper than in v2.30.0. It also lets ntfy start with a warning on a newer database schema, so later rollbacks need no manual step.Bug fixes + maintenance:
since=<message ID>reading every message of the topic from the database, which overloaded ntfy.sh's database right after the v2.31.0 upgrade; the message cache gets a new index: (topic, published, id) on PostgreSQL, (topic, published, time) on SQLite (#2058)Upgrade notes:
since=<message ID>reconnects). Downgrading to v2.31.0 or earlier afterwards requires setting the version back by hand first:UPDATE schema_version SET version = 16 WHERE store = 'message'on PostgreSQL, orUPDATE schemaVersion SET version = 16 WHERE id = 1in the SQLitecache-file. From this release on, a newer schema only logs a warning (#2059)v2.31.0Compare Source
This release fixes messages that could be lost when a client reconnects, e.g. a phone switching networks, right when messages are published: every server now reads newly written messages from its message cache once a second and sends them to the subscribers that missed them. In load tests with server restarts and crashes, this brought lost messages down from 465 to 2 out of about 615,000. It also adds a
/v1/readyendpoint for load balancers, and continues the experimental clustering work with node roles.Features:
/v1/readyfor load balancers, and the node's role to/v1/health; with clustering, a node with no other active node leads right away instead of after a one-minute hold-off (#2050)experimental-cluster-roleto run apassivenode that never leads and never takes over another node's subscribers, e.g. one that is not behind the load balancer (#2049)Bug fixes + maintenance:
Upgrade notes:
since=<message ID>now also returns the messages published in the same second as that message, so none are skipped when several servers write out of order. The ntfy apps and web app drop these by ID; your own scripts may see a few duplicates (#2040)UPDATE schema_version SET version = 1 WHERE store = 'node_registry'(#2049)v2.30.0Compare Source
This release links attachments in email notifications, adds SMTP LOGIN auth (e.g. for OVH and Outlook), and fixes the PostgreSQL memory growth that came with v2.29.0. It also ships the first experimental version of clustering: several ntfy servers sharing one PostgreSQL database. Clustering is not ready for production yet.
Features:
experimental-cluster-listen; this is not ready for production yet (#2005, #2008, #2012, #2013)Bug fixes + maintenance:
Dockerfile-buildfailing to build: use Go 1.26 and add theclusterpackage (#1962, thanks to @ElectricTea for reporting)org.opencontainers.image.versionlabel on release Docker images (#1921/#1936, thanks to @Plazzmex for reporting and @w1977-0 for the fix)attachment-expiry-durationis longer thancache-duration, since attachments never outlive their message (#1053, thanks to @ctschach for reporting)INSERTfor any batch size (#2011)ntfy publishfailing with "invalid header field value" when sending a multi-line message or title along with a file (#1808, thanks to @quantenzitrone for reporting)Documentation:
v2.29.0Compare Source
This release fixes cache writes under load. On ntfy.sh, hourly cron bursts overwhelmed the batch writer: messages took up to 40s to reach the database (so
poll=1andsince=missed them) and publishes stalled. Batches are now written in one statement, publishes no longer wait on the writer, and PostgreSQL connections stay idle instead of reconnecting.Features:
X-Timezoneheader,timezonequery param or JSON field; the web app sends the browser's timezone (#1967/#1924, thanks @beemines)At: 2026-12-10T11:00:00-05:00(#1931, thanks @ALPHACOM-Brehmer)Bug fixes + maintenance:
INSERTper batch, non-blocking publishes (100-batch buffer), and no scheduled-message lookup unless a sequence ID is set (#2006)ntfy servehandlesSIGTERM/SIGINTgracefullypool_max_idle_connsnow defaults topool_max_conns, so PostgreSQL connections are reused instead of re-openedsince=<message-id>replaying a topic's full history when the ID wasn't on the read replica yet; it's now resolved on the primarymessages_cachedinstead of aCOUNT(*)every minuteContent-Typehas parameters or is uppercase (#1995, thanks @cipherprofessor)0001-01-01end time and merged start/end lines (#1946/#1940, thanks @justadityaraj and @deferred)time/tzdata) so named time zones work on ARM Docker images and minimal runtimesv2.28.0Compare Source
This is a hardening release. A single topic on ntfy.sh was polled continuously with
poll=1and nosincecursor, which replays a topic's entire cache on every request. The changes below bound what one replay can cost, close two fields that had no size limit at all, and fix an ordering bug found while digging into it.Bug fixes + maintenance:
/topic1,topic2/json?poll=1, #1297)40057and40058). Neither field had a size limit before, unlike the message body; on ntfy.sh the 99.9th percentile is 212 bytes for titles and 244 for tagssincecursor returns a topic's entire cache, which was previously unbounded and could reach tens of megabytes on a busy topic, so one request could allocate that much on the server. The newest messages that fit are kept and a truncated response carries anX-Messages-Truncated: 1headervisitor-attachment-daily-bandwidth-limitnow also covers messages replayed from the message cache by poll requests, not just attachment traffic. A poll without asincecursor returns a topic's entire cache, so a topic that is cheap to fill can be re-read for many times its own size; polls beyond the budget are rejected with HTTP 429 (error code 42905) before anything is written. Note that heavy pollers now consume the same budget as attachment downloads, so operators serving both may want to raise the limitv2.27.0Compare Source
This release lets you sign in with your verified email address instead of your username, which should help if you ever signed up with an email and then forgot which username you picked. It also hardens the message templating engine against a few ways a small template could eat a lot of memory, and it drops the "experimental" label from PostgreSQL support, which has been running ntfy.sh for a while now.
I also did a bunch of refactoring in, mostly in preparation for being able to cluster ntfy nodes and scale the service horizontally. It'll be a while until then, ... baby steps.
Security:
Template: yes) to 32 KB, limitprintfwidths and precisions to below 1000, and limitindent/nindentto 100 spaces, preventing excessive memory use from a single small templateFeatures:
Bug fixes + maintenance:
twiliopackagemetricspackageuser_phonetable in the SQLite user database referencing a dropped table after the v2.14 schema migration; repaired automatically by a new migrationv2.26.3Compare Source
This is a hotfix release, useful pretty much only for ntfy.sh. It was adds the ability to track abusive IPs mor efficiently, reducing the load on the IP banning services and preventing them from falling behind and leaving abusers unbanned for too long. It works by tracking HTTP errors, and writing out a ban file that fail2ban can read and ban offenders instantly. See ban-feed for details.
Features:
ban-file, ntfy tracks a weighted strike budget per visitor and appends abusive IPs to a file that fail2ban can tail and ban on sight (ban-file,ban-window,ban-threshold,ban-weights; see ban-feed)gotenberg/gotenberg (docker.io/gotenberg/gotenberg)
v8.40.0: 8.40.0Compare Source
Security Fixes ⚠️
userPasswordandownerPasswordas positional arguments, and it reads an argument that starts with@as a file of further arguments. A password of@/proc/self/cmdline, with newlines in the other one, injected options such as--add-attachment, and the returned PDF embedded any file thegotenberguser can read. QPDF now receives--user-password=and--owner-password=, and every password encrypts the PDF as typed.*_DENY_PRIVATE_IPSchecks let through ranges that IANA marks as not globally reachable, such as the IPv6 benchmarking range2001:2::/48, while they refused its IPv4 twin198.18.0.0/15. They now refuse every such block:0.0.0.0/8, where Docker Desktop answers its host gateway,192.0.0.0/24, the documentation ranges,192.88.99.0/24and240.0.0.0/4in IPv4, and the whole2001::/23block,3fff::/20,5f00::/16and100:0:0:1::/64in IPv6.emSign ECC Root CA - G3until its component updater fetched a CRLSet, about two minutes after each start, and never without access to Google's update servers. Every Chromium restart opened the window again. A managed policy now distrustsemSign ECC Root CA - G3,emSign Root TLS CA - G3andAAA Certificate Servicesat startup.--chromium-host-resolver-rules. Any host-resolver rule turned the pinning proxy off, and with it the only layer that refuses a WebSocket handshake: with--chromium-deny-private-ipsset, a page, or a Web Worker, could open a WebSocket to a private address, and Gotenberg only logged it. Gotenberg now applies the rules itself, with Chromium'sMAPandEXCLUDEsemantics, in its outbound checks and in the proxy, so the IP-class checks judge the address a rule maps a host to.Behavior Changes
--chromium-host-resolver-rulesstops Gotenberg at startup. Chromium skipped a rule it could not parse, so a typo silently sent requests elsewhere.MAPrule knows works as the URL to print, where it returned403before. Hops carried by the environment proxy keep their original host.--chromium-proxy-serverwith an outbound policy logs a warning at startup. WebSocket handshakes reach that proxy without Gotenberg's checks, so enforce the policy there.*_DENY_PRIVATE_IPSchecks refuse more ranges. See the security fix above. The rule covers whole blocks, so a few anycast services inside192.0.0.0/24and2001::/23are refused too.linux/386image needsseccomp=unconfinedon Docker 29.4 and later. Docker's default seccomp profile now deniessocketcallon i386, to block theAF_ALGsockets of CVE-2026-31431, and Gotenberg opens its sockets through it on that architecture. The container fails to start withlisten tcp :3000: socket: function not implemented. Run it with--security-opt seccomp=unconfined, or with a copy of Docker's default profile that allowssocketcall, and keep the host kernel patched. This comes from Docker and affects earlier releases too.Bug Fixes
pdfaon/forms/libreoffice/convertreturned a PDF that was not PDF/A (#1705). Each document got the formats before the merge, which undid them. The formats now apply once, to the merged file, as on/forms/pdfengines/merge. Thanks @APX403.500(#1707). Only an empty content area returned400. Ascaleoutside 0.1 to 2, a negative margin, a zero paper size and every other print parameter Chromium rejects now return400too. Thanks @SergeevDmitry.optimizeImagesswapped images between the pages of a merged PDF (#1708). Two merged documents may give their images the same name, such asX5. Extracted images are now matched by page and name. Thanks @APX403.optimizeImagesmade charts larger (#1714). Charts and other flat-color images often take more space as JPEG than in their lossless stream. A replacement is now kept only when it makes the file smaller, so the pass never grows a PDF. Thanks @APX403.Chore
156.0.8078.79.26.8.2.python3-distutils-extra, and the 45 unused packages it pulled in, from the images that ship LibreOffice (#1711, #1710). Thanks @yusufgngor.v2.15.0in the Makefile, so local and CI linting match.v8.39.0: 8.39.0Compare Source
Security Fixes ⚠️
joption alias and stop loading ExifTool config files. The metadata check blockedjsonbut not its aliasj. A metadata key could import a JSON file carrying aHardLinkpseudo-tag, plant~/.ExifTool_config, and have the next ExifTool run execute it as Perl. The keysj,addtagsfromfile, andalltagsfromfilenow return400, and Gotenberg always runs ExifTool with-config "".http://andhttps://URLs on the URL routes. The default deny-list only coveredfile://, sodevtools://devtools/bundled/devtools_app.htmlloaded Chromium's privileged DevTools page, andwaitForExpressionran there with access to local files./forms/chromium/convert/urland/forms/chromium/screenshot/urlnow return400for any other scheme.wss://deny rules to WebSocket handshakes. The pinning proxy matched CONNECT tunnels againsthttps://host:port, so a deny rule anchored on a path, such as^https?://host/, or onwss://refused the plain request but let the handshake through. The proxy now matches tunnels against each scheme's root URL, and a handshake whose full URL is denied fails the conversion with a generic403.emSign ECC Root CA - G3andAAA Certificate Services, whose intermediates have recoverable private keys. The OS bundle now comes fromca-certificates20250419+deb13u1, and the Java trust store used by PDFtk drops both roots. Correction: Chromium 156 still accepted these chains for about two minutes after each start, until its component updater fetched a CRLSet, and never without access to Google's update servers. The next release, 8.40.0, distrusts both roots in Chromium from the first request. Thanks @hrueger.New Features
failOnConsoleMessageTypesfor Chromium (#1667). Fails the conversion with409when the page logs a console message of one of the given types (log,debug,info,warning,error,assert). The response lists the messages. Thanks @jschneider.pdfaform field now acceptsPDF/A-4on every route that supports it, through the LibreOffice PDF engine. Thanks @henningda.Gotenberg-Versionresponse header (#1693). Set on every authenticated route, error responses included, and on webhook deliveries. It is not set on401responses or/health(#1694). Thanks @fragkakis.Behavior Changes
chrome://,devtools://,data:, and any other scheme besideshttpandhttpsnow return400.~/.ExifTool_config. The metadata keysj,addtagsfromfile, andalltagsfromfilenow return400. Prefix them with a group, for exampleXMP:j, to write a tag of that name.XRECHNUNGFactur-X profile embedsxrechnung.xml. See the bug fix below.Bug Fixes
502on uploads behind HTTP/2 proxies (#1112). Behind Cloud Run with anh2cport, the proxy sent large DATA frames, Go answered with a flood of WINDOW_UPDATE frames, and the proxy dropped the connection mid-upload. Gotenberg now advertises the 16 KiB HTTP/2 default frame size (#1700). Thanks @TessilimiTheo and @geoherna.--api-tls-cert-fileand--api-tls-key-filewith absolute paths left Gotenberg running without accepting connections. Both paths work again, and a missing or unreadable file now fails the startup (#1691). Thanks @n-rodriguez.stampSourceorwatermarkSourcereturned400(#1692). Since 8.36.0, a blank source failed the merge, split, Chromium, and LibreOffice routes. An empty source is skipped again. Thanks @APX403.bearerin lower case (#1696). The Authorization scheme is now matched case-insensitively, as RFC 9110 requires. Thanks @MaxFreedomPollard.XRECHNUNGFactur-X profile embeddedfactur-x.xml(#1701). The spec requiresxrechnung.xmlfor this profile, both as the embedded file and infx:DocumentFileName. Other levels keepfactur-x.xml. Thanks @nhh.Chore
156.0.8078.47.v0.16.3and bumped Go to1.27.3, which fix several HIGH CVEs in the Go standard library andgolang.org/xmodules (#1695). Thanks @sergeykad.1.1.0, which supports Lambda SnapStart (#1704). Thanks @michael-follmann.v2.15.0.grafana/grafana (docker.io/grafana/grafana)
v13.3.1Security
Features and enhancements
v13.3.0Security
Features and enhancements
Add variable +btn to add filters, links and annos as well #130841, @mdvictortrackResources#130792, @ashharrison90Bug fixes
Breaking changes
Plugin development fixes & changes
isDefaultfromDataSourceInstanceListItem#133886, @leventebaloghv13.2.6Security
Features and enhancements
Bug fixes
v13.2.5Security
Features and enhancements
Bug fixes
v13.2.4Security
Features and enhancements
Bug fixes
v13.2.3Security
v13.2.2Security
Bug fixes
v13.2.1Security
Bug fixes
v13.2.0Security
Features and enhancements
Bug fixes
InlineToastcontents are announced by screenreaders #128488, @ashharrison90Breaking changes
Plugin development fixes & changes
aria-currenton active page #128494, @ashharrison90colorIndex#129579, @ashharrison90v13.1.10Security
Features and enhancements
v13.1.9Security
Features and enhancements
v13.1.8Security
Features and enhancements
Bug fixes
v13.1.7Security
v13.1.6Security
Bug fixes
v13.1.5Security
v13.1.4Security
Bug fixes
v13.1.3v13.1.2Bug fixes
v13.1.1Security
Features and enhancements
redis/docker-library-redis (docker.io/library/redis)
v8.10.3Compare Source
v8.10.2Compare Source
v8.10.1Compare Source
v8.10.0Compare Source
v8.8.4Compare Source
v8.8.3Compare Source
v8.8.2Compare Source
v8.8.1Compare Source
prometheus/alertmanager (docker.io/prom/alertmanager)
v0.35.0: 0.35.0 / 2026-11-09Compare Source
auto-gomemlimitfeature flag to the--auto-gomemlimitcommand-line flag. This is a breaking change: the--enable-feature=auto-gomemlimitoption has been removed. #5464typespackage in favor of thealertpackage. #5585name. This is a breaking change: configurations with unnamed outputs fail to load. The name identifies the output in metrics and logs instead of its URL, broker or topic. #5393events/v2schema. This is a breaking change: alert labels, alert annotations, group labels, silence annotations, and muted-alert labels are JSON maps, and protobuf consumers must use the new schema. #5409, #5500%APPDATA%and%ProgramData%on Windows. #5073/api/v2/under the version-neutral/api/prefix, exposing the Connect, gRPC, and gRPC-Web protocols plus the gRPC Health Checking Protocol and server reflection. The first service isstatus.v3.StatusService. #5377, #5506, #5507, #5508, #5509metadatafield. #5022alertmanager_notifications_failed_total. #5659message_textoption to set the message text shown in desktop and push notifications. #5595post_updates_to_threadoption to post subsequent notifications of an alert group as replies in the thread of the initial message. #5540timeoutoption to limit how long a notification request may take. #5127addDurationfunction to shift a timestamp by a duration such as-30mand return it in Unix milliseconds. #5550joinfunction to accept slices and arrays of any type. #5233friday:monday. #5579/ui/alongside the existing UI. #5502, #5538, #5539, #5537/api/v2/alerts/groupsby evaluating mutes only once per alert and group. #5674memeberlisttypo in error messages. #5472Removetemplate function. #5297http_configofjira_config. #5571projectandissue_typeinjira_configas templated strings. #5549victorops_api_keyandvictorops_api_key_filein the global config. #5168rocketchat_configdefaults and field types. #5591tracingconfig key, which was misspelled astraciing. #5437alertmanager_silencesmetric. #5460Failed to read remote state: user state length (...) exceeds limiterrors. #5640/-/reloadendpoint getting stuck when the client cancels the request. #5234update_alertsis enabled. #5465alertmanager_notifications_failed_totalinstead ofreason="other". #5505token_fileanduser_key_filecontents so keys stored in files with a trailing newline are accepted. #5590update_messagerelies onglobal.slack_api_url. #5589Retry-Afterheader instead of dropping them. #5048alertmanager_notifications_failed_total. #5375days_of_monthresolving one day early in months with a DST transition. #5447Retry-Afterheader instead of dropping them. #5548corp_idandapi_secretinstead of sending a token request with empty values. #5688v0.34.2: 0.34.2 / 2026-10-29Compare Source
api/v2now disallows cross-origin requests. This is a breaking change. The new--web.cors.originflag can be used to restore the previous behaviour. #5664crypto/x509. CVE-2026-111943v0.34.1: 0.34.1 / 2026-09-17Compare Source
v0.34.0: 0.34.0 / 2026-08-16Compare Source
reasonlabel onalertmanager_notifications_failed_totalnow distinguishesauthError(HTTP 401/403) andrateLimited(HTTP 429) from the genericclientError. Dashboards/alerts matchingreason="clientError"for these codes must be updated. #5332inhibition_muted_alertevents. #5315external_idsupport in sigv4 configuration. #5157toDateandmustToDatefunctions. #5327reasononalertmanager_notifications_failed_total. #5332proxy_urlinto partialhttp_config. #5379payloadstring values verbatim instead of reinterpreting JSON leaves that look like YAML (e.g. values ending with a colon). #5304prometheus/prometheus (docker.io/prom/prometheus)
v3.16.0: 3.16.0 / 2026-11-04Compare Source
batch_sizeto 1000. #19731prometheus_remote_storage_metadata_total,prometheus_remote_storage_metadata_failed_total,prometheus_remote_storage_metadata_retried_total, andprometheus_remote_storage_metadata_bytes_totalmetrics for Remote Write 2.0 queues. #20080prometheus_api_remote_write_without_metadata_appended_samples_totaleven whenmetadata-wal-recordsis disabled. #19812/api/v1/query_exemplars. #19896X-Prometheus-Use-Start-TimestampsHTTP header. #19066integral()function for computing integral-over-time of range vectors behind the--enable-feature=promql-experimental-functionsflag. #14440--enable-feature=query-cost. #20028anchored,smoothed). This feature is hidden behinduse-start-timestampsfeature flag. #18966convert_nhcb_to_classicto convert NHCB to classic histograms for external systems that dont support NHCBs. #17205--allow-incompatible-block-durationso users can specify any max-block-duration instead of being restricted to the default Prometheus block durations. #19363@modifier. #19863unique.Handle. #20040NHCBParser. #19880timeoutandlookback_deltavalues that overflow int64 instead of turning them into a negative duration #19658prometheus_api_otlp_out_of_order_exemplars_total, not every rejected exemplar. #20030trace_idorspan_idfiltered attribute in addition to a trace or span ID. The trace context now takes precedence over the colliding attribute, as required by the OpenTelemetry specification. #20004le="+Inf"twice when a histogram's explicit bounds end at+Inf, and warn about the bound. #19425_bucketseries and preserve them when scraping both native and classic histograms. #20020rad()anddeg()conversions. #19901__type__and__unit__labels inwithoutaggregations,absent(),info(), and binary operator fill matching. #19986==,!=,changes()andcount_valueson native histograms giving wrong results insidehistogram_count(),histogram_sum()andhistogram_avg(). #20024foo[range():1s]. #19729min_ofandmax_of. #19742histogram_quantile,histogram_quantilesandhistogram_fractionand return correct value instead of NaN if there are normal buckets. #20057rate(x[1m])over constant histogram. #19682limitis set on/api/v1/search/label_values, instead of an arbitrary subset #19694prometheus_tsdb_wal_corruptions_totalwhen WAL corruption is detected during checkpoint creation, so the metric reflects corruption found at compaction time rather than only after a restart-triggered repair. #19858stripDomain. #19908http2: true. The server now correctly advertisesh2via ALPN and multiplexes concurrent requests over a single connection. #19848PrometheusRemoteStorageFailuresalert denominator. #19877--enable-featurewhen evaluating rules intest rules. #20046v3.15.1: 3.15.1 / 2026-10-21Compare Source
net/http,net/textproto,crypto/tlsandhtml/template.v3.15.0: 3.15.0 / 2026-09-24Compare Source
endwas not aligned tostepcaused subqueries inside it to evaluate past the parent's last actual step, inflatingpeakSamplesin the query stats and against thequery.max-sampleslimit, and wasting storage I/O reading samples that were never used in the result. Add tests to prevent regression of the fix made in #18081. #18598--log.level; useruntime.log_levelconfiguration to supply the default level. #19511runtime.log_levelon configuration reload. #19511--auto-gomemlimit.refresh-intervalflag to periodically re-detect the container or system memory limit and updateGOMEMLIMITat runtime. #18843__meta_docker_container_imageand__meta_docker_container_image_id. #19386--enable-feature=st-storageflag now automatically enables XOR2 float chunk encoding and ST-capable histogram chunk encoding, so you no longer need to passxor2-encodingandhistograms-st-encodingalongside it. #19518session_nameandtagsfields for STS AssumeRole sessions. The previously undocumentedservice_namefield is now also documented. #19569zstd-scrape. #19502--enable-feature=xor2-encodingis deprecated; usestorage.tsdb.chunk_encoding.floats: xor2instead. Check that other software reading the TSDB directly (e.g. Thanos sidecar) supports XOR2 before enabling. #19461prometheus_tsdb_head_appenders_created_totalmetric. #19411_countand_sumseries in scrape appender v2. #19323prometheus_tsdb_head_series_pending_commit_underflow_totalto report pending-sample reservation underflows. #19470request_concurrency. #19506info()enrichment for composite expressions with mixed@/offset references or selector-free vector branches, preventing metadata from being evaluated at an unrelated timestamp. #19387request_concurrencyinstead of hanging service discovery indefinitely. #19524prometheus_sd_last_update_timestamp_secondsseries for a config that is removed on reload. #19131DetectResetno longer misses a counter reset when a populated bucket behind an empty one disappears, which could make histogramrate()/increase()undercount. #19367.*\|(foo)\|.*). #19516anchoredorsmoothedmodifier when the selected series has no samples inside the query window, for example a query evaluated inside a scrape gap. #19431@is used as the matrix argument of a call that is not step-invariant (for examplequantile_over_time(scalar(x), metric[...:...] @ T)). #19187@ start()/@ end()before range selectors, matching the existing rejection of literal offsets and@ <timestamp>. #19406histogram_quantileandhistogram_fraction. #19330firstOOOChunkIDmodulo 2^23 instead of growing unbounded. #19216__meta_kubernetes_service_loadbalancer_ipfromstatus.loadBalancer.ingress, falling back to deprecatedspec.loadBalancerIP. #19404tsdb dumpsilently dropping native histogram samples. #18051Manager.TargetsDroppedCountsto avoid miscounting dropped targets. #19304v3.14.0: 3.14.0 / 2026-08-17Compare Source
statsquery parameter of/api/v1/queryand/api/v1/query_rangefor values other thantrueandall. Other values still enable basic statistics but now return a deprecation warning; they will be rejected in the next major release. #19124/api/v1/status/confignow correctly showsseparator: ""andreplacement: ""in relabel configs when explicitly set to empty, instead of omitting them. #18653__meta_hetzner_datacenterlabel forhcloudtargets, following its removal from the Hetzner Cloud API. #19269promql-duration-exprfeature flag is now a no-op. #19033first_over_timeto stable. It no longer requires thepromql-experimental-functionsfeature flag. #19093oci_sd_configs). #18919start_timestamp(instant-vector)function returning the start timestamp of each sample in the given vector. Requires theuse-start-timestampsfeature flag. #19089rate()andincrease()to use start timestamps as an alternative for rate extrapolation. Hidden behind theuse-start-timestampsfeature flag. #18619histograms-st-encodingfeature flag. #18609k8s.pod.nameandk8s_pod_nameboth becomek8s_pod_name), and expose theprometheus_api_otlp_translation_warnings_totalcounter labelled bycategoryto track such warnings. #18957--remote-write.pathflag topush metricsfor backends that use a non-default remote-write endpoint. #19086prometheus_tsdb_head_native_histogram_seriesandprometheus_tsdb_head_native_histogram_bucketsgauges tracking the number of native histogram series and buckets in the head. #19170step(),range(),min_of(),max_of()) in range selectors and subqueries. #18625{job=~"foo|bar|baz"}). #18833promtool check configfrom making AWS metadata service (IMDS) network calls when theregionfield is omitted in EC2, ECS, RDS, MSK, ElastiCache, and Lightsail service discovery configs. #19037docker_sdanddockerswarm_sdonunix,npipe, andtcphosts. Previously an unresponsive daemon could freeze discovery indefinitely, silently pinning targets to a stale snapshot. #19237mad_over_timereturning 0 instead ofNaNwhen the range contains aNaNsample. #19040--enable-feature=promql-binop-fill-modifiersincheck rules, which previously rejected validfill()/fill_left()/fill_right()expressions. #19153AZURE_FEDERATED_TOKEN_FILEenvironment variable for workload identity authentication instead of hardcoding the token file path. #18973rule_group_last_rule_duration_sum_secondsandrule_group_last_restore_duration_secondsseries when a rule group is removed or renamed on reload. Previously each reload leaked two series per dropped group, growing/metricscardinality over time. #19107stale_series_compaction_thresholdis used in the config file. #19016prometheus_tsdb_head_stale_seriesover-counting and early eviction of series that change between float, integer histogram, and float histogram sample types. #19183--enable-feature=xor2-encodingcould silently revert to XOR after compaction. #19145--web.enable-admin-apiis enabled. #19025v3.13.5: 3.13.5 / 2026-10-21Compare Source
net/http,net/textproto,crypto/tlsandhtml/template.v3.13.4: 3.13.4 / 2026-09-29Compare Source
rate(x[1m])over a constant histogram. #19682v3.13.3: 3.13.3 / 2026-09-07Compare Source
v3.13.2: 3.13.2 / 2026-07-29Compare Source
What's Changed
Full Changelog: https://github.com/prometheus/prometheus/compare/v3.13.1...v3.13.2
prometheus-pve/prometheus-pve-exporter (docker.io/prompve/prometheus-pve-exporter)
v3.11.0Compare Source
Added
v3.10.2Compare Source
Changed
v3.10.1Compare Source
What's Changed
Full Changelog: https://github.com/prometheus-pve/prometheus-pve-exporter/compare/v3.10.0...v3.10.1
v3.10.0Compare Source
Added
TwiN/gatus (ghcr.io/twin/gatus)
v5.38.0Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/TwiN/gatus/compare/v5.37.0...v5.38.0
v5.37.0Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/TwiN/gatus/compare/v5.36.0...v5.37.0
ansible/ansible-lint (https://github.com/ansible/ansible-lint)
v26.11.0Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/ansible/ansible-lint/compare/v26.10.1...v26.11.0
v26.10.1Compare Source
What's Changed
Full Changelog: https://github.com/ansible/ansible-lint/compare/v26.10.0...v26.10.1
v26.10.0Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/ansible/ansible-lint/compare/v26.9.0...v26.10.0
v26.9.0Compare Source
Features
examplesection in filemeta/argument_specs.yml(#5164) @berndfingerFixes
extra_varstoimport_playbooksyntax check (#5148) @shvenkat-rhinclude_tasksrelative paths (#5159) @shvenkat-rhinclude_taskspaths from playbook dir (#5184) @shvenkat-rhwarn_listafter--fixrewrites task names (#5085) @santosh7676--offline(#5183) @shvenkat-rhno-jinja-whenon string-embedded jinja (#5103) @f1047validate_argspecto play schema (#5187) @sameeralam3127Performance
get_deps_versions()result (#5113) @BlackDarkMaintenance
.github/SECURITY.md(#5165) @gundalowWhat's Changed
New Contributors
Full Changelog: https://github.com/ansible/ansible-lint/compare/v26.8.0...v26.9.0
v26.8.0Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/ansible/ansible-lint/compare/v26.6.0...v26.8.0
netbox-community/netbox (netbox)
v4.7.5: - 2026-11-10Compare Source
Enhancements
Performance Improvements
interfaceor device components bydevicelink_peersandconnected_endpointsBug Fixes
dcim.0245_consolidate_unique_constraintson installations whose location, region, or site group unique constraints have auto-generated namescount_ipaddresses) which is omitted from the response bybrieforfieldsasn_countfield in the REST API representation of ASN ranges{module}placeholders in component labels and module bay templates when installing a module, rather than raising an exception or resolving them to an empty string<string>) in error tracebacksIntegrityErrorexception when completing a job whose owner already has a notification for itFileNotFoundErrorexception when synchronizing a local data source whose subdirectory paths repeat the root path (e.g./scripts/scripts_old/)nullto several filters (e.g.present_in_vrf_id,available_at_site, andinterface_id), and support filtering data sources bysync_interval=nullWHITELISTED_DOMAINSandWHITELISTED_EMAILS) by addingauth_allowedto the defaultSOCIAL_AUTH_PIPELINEupdate_dependent_objects()for wireless links, circuit terminations, and channel subinterfaces, to rebuild cable paths after writes which bypasssave()v4.7.4: - 2026-10-27Compare Source
Enhancements
__emptylookup for boolean custom field filtersobject_change_ids) in event data and webhook payloadsPerformance Improvements
displayfield via GraphQLBug Fixes
query_paramsof a custom scriptObjectVarto its object selectorfinalizeenvironment parameter for export and config templates only from the template's saved recordBigIntin the GraphQL APIconfig_contextfield when selected within an inline or named fragmentCircuitStatusEnum, with values prefixed bySTATUS_(consistent with other status enums)v4.7.3: - 2026-10-13Compare Source
Enhancements
Performance Improvements
Bug Fixes
highlightparameter to prevent the disclosure of data the user is not permitted to viewaddpermissionTypeErrorexception when creating a device type with a front or rear image via the REST APIqsearch filter for tunnel terminationsinstalled_modulewhile creating a module bay via the REST APIFieldErrorexception when filtering circuits and virtual circuits by provider accountFieldErrorexception when filtering front & rear ports (and their templates) byrear_port_idorfront_port_idFieldErrorexception when searching circuit group assignmentsAttributeErrorexception when executing a bulk edit as a background job__emptylookup to numeric and date/time filtersv4.7.2: - 2026-09-29Compare Source
Enhancements
Cable.update_dependent_objects()hook to rebuild cable paths and related attributes after writes which bypasssave()Bug Fixes
return_urlparameter used for the cancel button on the IP address assignment viewsyncaction for synced data modelsv4.7.1: - 2026-09-15Compare Source
Enhancements
Bug Fixes
ßcan be matchedlengthorlength_unitfieldform-actioncontent security policy__n) filter lookup for multiple selection custom fieldspg_dump(see the warning above)typeand rack typeform_factorfieldsv4.7.0: - 2026-09-02Compare Source
Breaking Changes
{"value": "datacenter", "label": "Data Center"}) in both the REST and GraphQL APIs. These fields continue to accept the raw value on write.protocolandportsfields on theipam.Serviceandipam.ServiceTemplatemodels have been replaced by a unifiedport_mappingsfield, which supports multiple protocols per service. The legacy fields are retained (as deprecated) in the REST and GraphQL APIs, but at the ORM level they are now read-only properties derived fromport_mappings: Passingprotocolorportsto the model raises aTypeError, and assigning toservice.portsraises anAttributeError. This restriction applies only at the ORM level: The REST API continues to accept the legacy pair on write, translating it intoport_mappings.protocolis now filtered against theport_mappingsarray rather than a dedicated model field, the character-based REST filter lookups previously generated for it (protocol__ic,protocol__isw,protocol__empty, etc.) are no longer available. Theport__emptylookup has been removed as well.ipam.Serviceandipam.ServiceTemplatehave changed shape: The nestedportsinteger lookup has been replaced by the flatport,port__gt,port__gte,port__lt, andport__lteparameters (each accepting a list of values), alongside the newport_mappingsparameter. Additionally, the members ofServiceProtocolEnumhave been renamed to drop a spuriousROLE_prefix (e.g.ROLE_TCPis nowTCP).DeviceWithConfigContextSerializerandVirtualMachineWithConfigContextSerializerclasses have been removed (merged into the base serializers), and the?exclude=config_contextquery parameter is now silently ignored.{"detail": ..., "errors": [{"index": N, "errors": {...}}]}, correlating each error with the index of the offending object in the submitted list. (Bulk operations remain all-or-none.)tokenfield is now read-only, and any value supplied is ignored. (This restriction was already in effect in the web UI.)usernameargument has been removed fromextras.webhooks.send_webhook()(the value remains available to webhook templates asrequest.user). Any webhook jobs still enqueued when the workers are restarted will fail with aTypeError, so the background queues should be allowed to drain before upgrading.ltreecolumn rather than django-mptt. This covers the nested group models (Region, SiteGroup, Location, DeviceRole, Platform, TenantGroup, ContactGroup, WirelessLANGroup, etc.) as well as ModuleBay, InventoryItem, and InventoryItemTemplate. Thelft,rght,tree_id, andlevelcolumns have been dropped from every migrated model:levelremains available as a Python property, but can no longer be used in a queryset filter ororder_by()clause. NetBox'sltreeimplementation deliberately covers only the subset of MPTT's API which NetBox itself uses (get_ancestors(),get_descendants(),get_children(), andadd_related_count()); methods such asget_root(),get_family(),is_leaf_node(),move_to(), andinsert_at()are no longer available. The MPTT-backedNestedGroupModelbase class is retained for backward compatibility with plugins, but is deprecated: New code should useNestedLtreeGroupModelinstead.querystringtemplate tag toquerystring_replaceand removes theRelatedLinkColumnclass.social-auth-app-djangoandsocial-auth-corehave been upgraded to v6.0 and v5.1 respectively, each a major release. Deployments which employ single sign-on should test authentication against a non-production instance before upgrading.requestobject passed to custom link templates is now a sanitized subset of the current request. Only theid,path,path_info,method,GET, anduserattributes are available; cookies, headers, and session state are no longer accessible.ALLOWED_URL_SCHEMESconfiguration parameter. A value entered without a scheme is assumed to usehttpsand stored as an absolute URL.RQ_DEFAULT_TIMEOUTto 60 seconds or less, you must also setWEBHOOK_DEFAULT_TIMEOUTto a lower value; NetBox will refuse to start otherwise.EMAILconfiguration parameter is now mandatory in order to send mail: A deployment which does not defineEMAIL['SERVER']will raise anInvalidMailerexception when attempting to send, rather than failing at the SMTP connection.MAILERSsetting rather than the individualEMAIL_*settings which it supersedes.EMAIL_HOST,EMAIL_PORT,EMAIL_HOST_USER,EMAIL_HOST_PASSWORD,EMAIL_USE_SSL,EMAIL_USE_TLS,EMAIL_TIMEOUT,EMAIL_SSL_CERTFILE, andEMAIL_SSL_KEYFILEare no longer defined, andEMAIL_BACKENDis no longer consulted. Plugin code which reads any of these, or which callsdjango.core.mail.get_connection()with an explicit backend (now raising aRuntimeError), must be updated. TheEMAILconfiguration parameter itself is unchanged.rebuild_config_context_cachemanagement command to populate the new config context cache. This issues oneUPDATEper device and virtual machine, and may extend the duration of the upgrade considerably for deployments with a large number of either. The command skips objects whose cache is already populated, so it is safe to interrupt and re-run; it may also be deferred until after NetBox is back online, as any object whose cache is empty falls back to rendering its config context on demand.BULK_UPDATE_CHUNK_SIZEobjects in total.populate_custom_field_defaults()method has been removed fromCustomFieldsMixin.CustomField.objects.get_for_model()and thecustom_fieldsproperty ofCustomFieldsMixinnow return a list rather than a queryset, andget_for_model()returns only those fields which are active: Any whose stored data is being updated by a background job is omitted (see field status) unless selected via itsstatusesargument.housekeepingmanagement command has been removed. (Its constituent tasks are performed by the individual management commands introduced in NetBox v4.6.)querystringtemplate tag has been removed in favor of Django's built-in tag of the same name. The two are not interchangeable: Django's tag reads the current request from the template context, so therequestargument must be dropped ({% querystring request page=1 %}becomes{% querystring page=1 %}; passingrequestraises aTemplateSyntaxError). It also returns a bare?where NetBox's tag returned an empty string.SENTRY_DSN,SENTRY_SAMPLE_RATE,SENTRY_SEND_DEFAULT_PII, andSENTRY_TRACES_SAMPLE_RATEhave been removed. UseSENTRY_CONFIGinstead.DEFAULT_ACTION_PERMISSIONSconstant has been removed.LEGACY_ACTIONSconstant has been removed.registry['models']. (UseObjectType.objects.public()instead.) Theregistry['denormalized_fields']store has been removed as well.OptionalLimitOffsetPagination(nowNetBoxPagination),ExpandableIPAddressField(nowExpandableIPNetworkField), andexpand_ipaddress_pattern()(nowexpand_ipnetwork_pattern()) have been removed.request_idandusernamekeys have been removed from the context available to outgoing webhooks. Userequest.idandrequest.userinstead.OwnerMixin(e.g.site_set) has been removed.New Features
Cooling Infrastructure Modeling (#22447)
NetBox has long modeled power distribution end to end, but had no equivalent for cooling. This release introduces a cooling data model which deliberately mirrors the power model, so that the concepts and workflows feel familiar.
Two new top-level models parallel PowerPanel and PowerFeed: CoolingSource represents facility-level cooling plant (a chiller, cooling tower, dry cooler, or facility water system) scoped to a site or location, and CoolingFeed represents a coolant loop delivered from a source to a rack. Two new device components parallel PowerPort and PowerOutlet: CoolingIntake represents a coolant intake on a device (e.g. a server cold-plate connection or a CDU's facility water inlet), and CoolingOutflow represents a coolant outlet on a CDU or manifold which supplies downstream equipment. Each intake may reference the upstream outflow which serves it, and both components have corresponding device type templates. CDUs and manifolds are modeled as ordinary devices carrying these components.
Lightweight descriptive attributes have also been added for users who want to record cooling characteristics without modeling the full plumbing: a
cooling_methodfield (air, liquid, hybrid, or immersion) on the Device, DeviceType, and ModuleType models, andcooling_capability(air-only, hybrid, or liquid-only) andcooling_capacityfields on the Rack and RackType models.Channelized Subinterfaces (#20972)
Channelized (breakout) interfaces can now be modeled natively. A new
channelsfield on the Interface model indicates the number of physical channels into which an interface is divided, and each channel is represented by a subinterface of the new genericchanneltype, bound to its parent via the newchannel_idfield. A single cable terminates to the channelized parent interface, and NetBox traces a distinct cable path for each channel subinterface. Both fields are available on interface templates as well.Multi-Protocol Application Services (#20285)
Application services and service templates can now expose the same port on multiple protocols — for example, DNS listening on both
tcp/53andudp/53. The single-protocolprotocolandportsfields have been replaced by a unifiedport_mappingsfield, represented in the APIs as a flat list ofprotocol/portstrings (e.g.["tcp/80", "udp/53"]). Newport_mappings,protocol, andportfilters are available in the UI and in both APIs, with the latter two correlated so that they must be satisfied by a single mapping.Module Bay Types (#19731)
A new ModuleBayType model has been introduced to convey which kinds of modules a module bay is able to accommodate (e.g. an SFP28 cage or a PCIe x16 slot). Bay types can be assigned to module bays, module bay templates, and module types; where both a bay and a module type declare bay types, NetBox validates that the two sets share at least one type in common before permitting installation. Bay types assigned to a module bay template propagate automatically to each instantiated module bay.
Relocating Installed Modules (#15289)
An installed module can now be moved to a different module bay, including a bay on a different device, rather than having to be deleted and recreated. A move relocates the module's entire subtree — its components, its own module bays, and any child modules installed within them — and re-resolves any component names, labels, and positions derived from the module type's templates for the destination bay. Cross-device moves are permitted only where the moved components carry no active topology or device-scoped configuration.
Background Processing for REST API Requests (#21992)
Bulk write operations via the REST API can now be processed as a background job rather than synchronously, avoiding proxy and gateway timeouts on large batches. Appending
?background=trueto a bulk write request enqueues a job and immediately returns anHTTP 202 Acceptedresponse containing the job's ID and URL; the job'sdatafield records the response the synchronous request would have returned. Note that validation is deferred to the worker, so a202response indicates only that the request was accepted, and the job's final status must be inspected to confirm the outcome.Per-Object Errors for Bulk Operations (#20054)
When a bulk create or update via the REST API fails validation, the response now identifies each offending object by its index within the submitted list, along with its specific field errors, rather than reporting only the first failure. This enables clients to correct and resubmit only the objects which actually failed.
Pre-Rendered Config Context Data (#21025)
Rather than compiling config context data on demand from the full set of applicable ConfigContext instances, NetBox now pre-renders each device's and virtual machine's merged context data and caches it on the object itself. The cache is invalidated automatically whenever an upstream change is detected — a config context being created, modified, or deleted, or a change to an attribute which determines which contexts apply — and repopulated by a non-blocking background job. During the brief window between invalidation and re-render, reads fall back to the original on-demand rendering path, so the data returned is always correct rather than stale.
Snapshot-Aware Event Rule Conditions (#18159)
Event rule conditions can now inspect the pre-change and post-change snapshots captured at the time of an event, rather than only the object's current data. New
changedandunchangedoperators compare an attribute's value across the two snapshots, and thesnapshots.prechange.<attr>andsnapshots.postchange.<attr>dot-path syntax exposes either snapshot to any standard operator. This makes it possible to express the long-requested "fire only when status changes to active" rule, avoiding webhooks and scripts triggered by unrelated updates. A newregexoperator has been added as well, and conditions which reference an attribute that cannot be resolved now fail closed and log an error rather than silently disabling the rule.Enhancements
mac_addressfieldis_primaryfield to the MAC address REST API representationFIELD_CHOICESend_of_lifedate field to device types and module types to aid in hardware lifecycle planningnulls_firstparameter to control the placement of empty values when ordering by a custom fieldWEBHOOK_DEFAULT_TIMEOUTconfiguration parameterBULK_UPDATE_CHUNK_SIZEconfiguration parameter to bound the number of rows affected by a single bulkUPDATEstatementALLOWED_URL_SCHEMESwhen validating URL custom field valuessocial-auth-coreto permit the installation of newer PyJWT versionsPerformance Improvements
ltreeimplementation for hierarchical modelsPlugins
GenericObjectChoiceFieldandGenericObjectFormMixinto represent a generic foreign key relation as a single form fieldEventRuleActionDeprecations
JINJA2_FILTERSconfiguration parameter has been renamed toJINJA_FILTERS. The old name remains supported, but will be removed in NetBox v5.0.form_factor,width,outer_width,outer_height,outer_depth, andouter_unitfields on the Rack model have been deprecated, and will be removed in NetBox v5.0. These values will instead be inferred from the rack's assigned rack type, which will become a mandatory assignment.protocolandportsfields on application services and service templates have been deprecated in favor ofport_mappings, and will be removed from the REST & GraphQL APIs in NetBox v5.0.NestedGroupModelbase class has been deprecated in favor ofNestedLtreeGroupModel, and will be removed in a future release.Other Changes
querystringtemplate tag in favor of Django's built-in tagNULLS NOT DISTINCThousekeepingmanagement commandDEFAULT_ACTION_PERMISSIONSconstantmodelskey from the application registryOptionalLimitOffsetPaginationExpandableIPAddressFieldexpand_ipaddress_pattern()*TestMixinsuffixOwnerMixinjinja_filters,get_jinja_context(),register_jinja_filters()) for consistency withJINJA_FILTERSAppConfig.ready()and break its import cyclerequest_idandusernamekeys from the webhook contextv4.6.10: - 2026-09-01Compare Source
Performance Improvements
SerializedPKRelatedFieldBug Fixes
MetaattributesSerializedPKRelatedFieldfieldsownerfield on the power outlet and service formsupdate_fieldsto avoid consuming a generator inVLANGroup.save()andCircuitTermination.save()v4.6.9: - 2026-08-25Compare Source
Enhancements
Performance Improvements
Bug Fixes
current_requestand the query cache when an exception is raised within anevent_tracking()blockSideNavinstance for the top headerrunscriptmanagement commandv4.6.8: - 2026-08-11Compare Source
Performance Improvements
get_for_model()Bug Fixes
base_choiceswhen creating a custom field choice set via the REST APInotifications_defaultsetting when the script is run from an event ruleDISTINCTfilter on nested GraphQL list fieldsCustomLinkColumnv4.6.7: - 2026-07-30Compare Source
Performance Improvements
Bug Fixes
v4.6.6: - 2026-07-28Compare Source
Enhancements
tagandtag_idfilters to match objects assigned any of the specified tagsheader_safeJinja2 filter for sanitizing HTTP header valuesPerformance Improvements
Bug Fixes
JournalEntry.created_byimmutable after creation to prevent audit trail spoofingDataErrorexception when a cable length exceeds the maximum supported value{vc_position}is used on device type component templatesKeyErrorraised when validating a device assigned to a cluster scoped to a different locationKeyErrorfor malformed IP address and prefix values submitted via the REST APITypeErrorwhen deleting a virtual chassis with a cross-chassis LAGContent-Dispositionheader of file responsescommentsfield of ASNs in the global search indexContentTypeFieldrespects its declared queryset to prevent the selection of non-public object typeslengthlookup for array filterscommentsfield of several models in the global search indexescable_endwhen removing a cableTypeErrorexception when bulk adding module bays to devicesfilterorfilter_idquery parameterv4.6.5: - 2026-07-14Compare Source
Enhancements
Performance Improvements
tagsfield to avoid N+1 queries on list endpointsBug Fixes
RAM_BASE_UNITfor the default memory of a virtual machine typeValueError(HTTP 500) when an invalidfilter_idquery parameter is providedValueErrorexception when viewing background tasks under RQ 2.10ValueErrorraised by object-level permission checks for cross-app proxy modelsSandboxedEnvironmentrender_widgettemplate tag before marking it safeConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.
You can view your changes at https://staging.infra-docs.hamburg.ccc.de/pr158/
c155e3e756b0bbe97a27b0bbe97a274ad8444cbf4ad8444cbf6f136110a16f136110a15a70f4bada5a70f4bada294de3c583294de3c5832db68efcd72db68efcd7e69f644095e69f6440959d57a5ac589d57a5ac58319502a5dc319502a5dcb0620fbfd1b0620fbfd16b4e455cc36b4e455cc3c77934ca6fc77934ca6fe7ac450d7be7ac450d7bcd7a64f46ccd7a64f46c4f890641334f8906413324ffc0f8e024ffc0f8e07b10ee2dea7b10ee2dea2280194c9c2280194c9cbfeef72160bfeef72160b030340bc8b030340bc89173f157b59173f157b52851c4dc222851c4dc229afdedeb629afdedeb6284eaa6b23184eaa6b23172c6c81d5f72c6c81d5fb4bd9d9932b4bd9d99322788f8c39d2788f8c39d250cda919c250cda919cd54c5ef459d54c5ef4594fdbb897474fdbb897479b9f56ea509b9f56ea5027cc1dda1027cc1dda10e16d684c79e16d684c79c2ffb5b7a8c2ffb5b7a8f98f5bc888f98f5bc888d4a512a8d1d4a512a8d148c42ed7ea48c42ed7ea212a889a33212a889a339871ecb0d99871ecb0d96df8a15a266df8a15a26ff7d01fcdaff7d01fcdaa1af8184b2a1af8184b2a9a1e58163a9a1e581630ec52411e40ec52411e45e351a09d95e351a09d977e2474bc777e2474bc7fa87bb41b5fa87bb41b5253a3f87ef253a3f87ef23d998911e23d998911ee3b6ea7b1fe3b6ea7b1f2d1cc8bc902d1cc8bc90a583581deca583581dece828f3467fe828f3467fc91ae48f5ac91ae48f5af0f84ecf4ff0f84ecf4fa9449688d5a9449688d50d36c1fadf0d36c1fadfa09292688ba09292688bf2ffc4bc90f2ffc4bc901578ab90e71578ab90e70b44b534d70b44b534d7f569ded2bef569ded2beb3a4aac904b3a4aac904b3b48f106ab3b48f106a1815e87aae1815e87aaeb082a7f298b082a7f2986f2a27e93b6f2a27e93bacb71a6f63acb71a6f632bcc0554d12bcc0554d1cf4d88b190cf4d88b19078bfdf70fa78bfdf70faa56d7521aca56d7521acf1545e6dc2f1545e6dc294d20c55b494d20c55b401d411bb3a01d411bb3a171550d259171550d259988cf78a52988cf78a52482a71a876482a71a876ed5a17655fed5a17655f22fdcc944022fdcc9440ce19c4630cce19c4630c2a902234142a90223414674c4122c0674c4122c09e7ba0ac179e7ba0ac170b24fd27d40b24fd27d46913b5d1946913b5d1945fdae5b5585fdae5b558e2bb1452f5e2bb1452f5a66268e0aca66268e0ace9d8b59bccView command line instructions
Checkout
From your project repository, check out a new branch and test the changes.