Introduces production PyPI publishing triggered by v* tag pushes, while
Test PyPI now requires manual dispatch. Both indexes never receive the
same run, ensuring proper separation between rehearsal and production.
Fixes#22786
Clarifies that backslashes in constraint values must be escaped in JSON.
Includes example showing regex pattern escaping and adds table entry
demonstrating regex constraint usage.
Fixes#22498
Introduce experimental Python package installation workflow as an
alternative to release archive and Git methods. Document package layout,
setup command, upgrade procedure, and migration path for existing
deployments.
Fixes#22604
Add initial Python package support for NetBox, including wheel and sdist
builds, generated package metadata, and Test PyPI publishing for maintainer
validation.
Add package-aware CLI support, `netbox setup` scaffolding for instance-local
files, and centralized wheel-vs-checkout path handling while preserving the
existing source/archive install layout.
Bundle pre-rendered embedded documentation in the wheel, and extend CI to
verify dependency pins, wheel metadata, artifact contents, CLI behavior, sdist
rebuilds, and smoke-test upgrades.
Expose an event's prechange and postchange snapshots to event rule
condition evaluation, making snapshots.prechange.<attr> and
snapshots.postchange.<attr> available through the existing dot-path
syntax.
Add changed and unchanged snapshot operators for comparing an attribute
across the two snapshots without requiring a condition value. These
operators support rules such as firing only when a field transitions to a
specific state.
Make condition values optional only for snapshot operators by introducing
a missing-value sentinel, while preserving value requirements for all
other operators. Reject invalid combinations such as using changed or
unchanged with an explicit value or with an attr starting with snapshots.
Fail closed when condition paths traverse invalid snapshot structures,
including raw scalar snapshot values such as status strings, by treating
unresolvable snapshot-operator paths as missing and converting invalid
direct paths to InvalidCondition.
Document the new snapshot path syntax, changed and unchanged operators,
create/delete snapshot behavior, and the serialization differences
between snapshot data and REST API data. Add regression and integration
tests covering validation, transition behavior, null snapshot edge cases,
direct snapshot paths, and event rule evaluation.
Add PUT/PATCH support to ScriptModuleViewSet for replacing Script Module
content in place. Modules can be addressed by numeric ID or file name,
and the uploaded file name must match the existing file path.
The module's scripts are re-synchronized from the new content after
successful update.
Fixes#22544
* refactor(forms): Add GenericObjectChoiceField
Replace separate scope_type/scope and parent_object_type/parent field
pairs with unified GenericObjectChoiceField. Introduce
GenericObjectFormMixin to handle GFK descriptor initialization and
assignment.
This removes redundant HTMX/queryset setup logic from ScopedForm,
VLANGroupForm, and ServiceForm by delegating GFK presentation to a
single reusable field and mixin pair. Field query param references now
use `$scope_object_id` instead of `$scope` to match the subwidget name.
Fixes#19821
* fix(forms): Skip validation on HTMX bulk-edit dependent field refresh
Render bulk-edit form unbound when an HTMX request changes a dependent
field (e.g. content type) without clicking Apply. This prevents
validation errors from surfacing before the user submits.
Cache ContentType lookups in GenericObjectChoiceField and sync widget
references before setting queryset to ensure choices land on the
rendered subwidget.
* fix(ipam): Update scope query params for GenericObjectChoiceField
Change available-prefix Add links to use `scope_content_type` and
`scope_object_id` query parameters instead of `scope_type` and `scope`.
This aligns with the GenericObjectChoiceField subwidget naming
introduced in the earlier refactor.
* refactor(models): Simplify GFK handling in clone_fields
Replace `scope_type`/`scope_id` pairs with bare `scope` GFK names in
clone_fields across models. Update CloningMixin to emit GFK subwidget
parameters (`scope_content_type`, `scope_object_id`) directly when a
GenericForeignKey appears in clone_fields.
* Update pre-populated links
---------
Co-authored-by: Jeremy Stretch <jstretch@netboxlabs.com>
Defer CachedValue updates from post_save/post_delete signal handlers to a
SearchCacheJob that runs after the surrounding transaction commits. Coalesce
pending updates per database alias and savepoint scope, preserving rollback
semantics while reducing synchronous write latency.
When no worker is available, or Redis cannot be reached during dispatch, apply
the update inline so existing single-process installs continue to behave
correctly. Replay the originating database alias during deferred reads and
writes so cache updates remain routed to the schema that emitted the signal.
Keep deferral private to CachedValueSearchBackend so custom SEARCH_BACKEND
implementations continue to use the existing synchronous cache/remove contract.
Move the job runner to search/jobs.py and keep the CachedValue-specific update
logic on the backend.
Document the eventual consistency of global search results and add coverage for
coalescing, rollback/savepoint behavior, worker dispatch, inline fallback,
deleted objects, and the custom backend contract.
Adds a nullable DurationField computed as completed - started, set in
Job.terminate(). Exposes it as an orderable table column, detail-panel
attr, REST API field, and UI/API range filters (execution_time__gte /
execution_time__lte).
A plain stored field (not a GeneratedField) keeps the migration
metadata-only, avoiding a full table rewrite on core_job.
* #21025: WIP
* Fixes#22357: Remove unused `local_context_data` field from dcim.Module (#22364)
* Add partial index for checking null CC data
* Ensure the data returned by get_config_context() is safe for mutation
* Implement selective backup queryset annotation to avoid n+1 overhead on cold cache
* Fix migration conflict
* Replace MPTT with Ltree per #21418
Bulk write operations (create/update/delete a JSON list at a model's list
endpoint) can opt into background processing with the ?background=true query
parameter. The request is validated synchronously and, if accepted, an
AsyncAPIJob is enqueued and a 202 Accepted is returned with the job id and
poll URL; the write is performed later by a worker that re-invokes the same
viewset action, so behavior matches the synchronous path (including
all-or-nothing transaction semantics).
- AsyncAPIJob reconstructs the request in the worker, re-applies object
permissions, runs within the request processors (change logging/events),
and captures the action's response into job.data as {status_code, data}.
- Handled rejections are translated to match the synchronous API: APIException
via handle_exception(), and AbortRequest/ProtectedError/RestrictedError via a
new NetBoxModelViewSet.exception_to_response() helper. These terminate the
job as "failed" (reserving "errored" for unexpected crashes).
- Background processing is refused with 503 when no worker is servicing the
queue, and rejected with 400 when combined with an If-Match precondition
(which cannot be honored once execution is deferred).
- Single-object writes, GET requests, and non-list payloads ignore the
parameter and run synchronously.
exception_to_response() intentionally duplicates the translation logic in
dispatch() rather than dispatch() being refactored to call it; consolidating
the two is left as a follow-up to keep this change off the synchronous hot path.
* Address code review feedback (#21992)
- Carry the request's scheme and host into the background worker so absolute
URLs in the captured job result point at the real server instead of a
hardcoded http://localhost/.
- Emit the same protected-delete warning log in exception_to_response() that
dispatch() produces, restoring application-log parity for background failures.
- Drop the inert `_authenticator = None` assignment: setting request.user
already prevents lazy re-authentication via the public API, and nothing on
the worker's action path reads the authenticator.
- Remove the redundant success-path job.save() (JobRunner.handle() ->
terminate() persists job.data) and hoist the AsyncAPIJob import in mixins.py
to module level (no real import cycle through it).
- Add a test asserting result URLs reflect the request host.
* Fix IPv6 host parsing in background API request reconstruction
Parse the carried host with urlsplit (and pass it verbatim as HTTP_HOST)
instead of host.partition(':'), which split bracketed IPv6 hosts like
[::1]:8443 on their inner colons. Extract request construction into
AsyncAPIJob._build_request and add a test asserting the IPv6 host round-trips.
* Address review feedback (#21992)
- Make the bulk mixins safe to use without BackgroundOperationMixin: guard the
_background_requested / _maybe_background_bulk_create calls with a getattr
fallback so BulkUpdateModelMixin/BulkDestroyModelMixin/SequentialBulkCreatesMixin
retain their standalone behavior in custom viewset composition.
- Add a test covering the background ProtectedError/RestrictedError path: a bulk
delete of a protected object records the same 409 the synchronous API returns
(job failed, status_code 409, object preserved), via exception_to_response().
Follow-up to #22363: align the plugin hook names with the already-renamed
JINJA_FILTERS setting (#22288) and with the rest of the codebase's 'Jinja'
spelling convention.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add support for literal `{lat}` and `{lon}` placeholders in `MAPS_URL`
when rendering GPS coordinate links. Existing configurations continue to
work by falling back to appending `lat,lon` when no coordinate placeholders
are present.
Move map URL handling into shared UI helpers so `GPSCoordinatesAttr` and
`AddressAttr` use consistent placeholder detection. When `MAPS_URL` contains
coordinate placeholders, suppress address-based map links to avoid rendering
invalid URLs.
Add tests for placeholder replacement, decimal coordinate values, fallback
behavior, and address link suppression. Also document the address link behavior
in the `MAPS_URL` configuration description.
Adds warning and examples for validating NetBox objects before saving
in Custom Scripts. Direct ORM writes bypass UI/API validation and can
introduce invalid data. Recommends calling `full_clean()` explicitly.
Fixes#22249
Fix miscounting of total_vlan_ids when VLANGroup vid_ranges use
non-canonical bounds (e.g. '[]'). Normalize ranges to '[)' on save and
add migration to recompute existing totals. Prevent division-by-zero in
utilization queries for legacy rows with miscounted totals.
Fixes#22228
Allow IP ranges where start_address equals end_address to model
single-IP pools like DHCP or NAT reservations. Add validation tests,
filterset coverage, and display logic to render both endpoints.
Fixes#21993
Display a warning in the UI whenever a user goes to provision a v1
token (both via the admin token form and the user profile token form).
Update documentation to note that v1 tokens are deprecated and will be
removed in NetBox v5.0.
Removes the deprecated querystring template tag from utilities/templatetags/
helpers.py and updates all 30 call sites across templates to use Django's
built-in querystring tag (available since Django 5.1). The request argument
is dropped since the built-in tag reads from the template context automatically.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
PostgreSQL 14 reaches end-of-life in November 2026 and Django 6.1 will
require PostgreSQL 15+. Updates all documentation references from 14 to
15, and removes the "needed on PostgreSQL 15 and later" conditional
comment from the database creation instructions (since 15 is now the
minimum).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Drops the deprecated registry['models'] key, the __getitem__ deprecation
warning, and the population code in register_model(). Registered models
should be retrieved via ObjectType.objects.public() instead.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Drops the LEGACY_ACTIONS constant and ActionsMixin._convert_legacy_actions()
method. Action views must now define the actions attribute as a list of
ObjectAction subclasses rather than as a legacy permission dict.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Removes SENTRY_DSN, SENTRY_SAMPLE_RATE, SENTRY_SEND_DEFAULT_PII, and
SENTRY_TRACES_SAMPLE_RATE. These were superseded by SENTRY_CONFIG in
v4.4.2. Documentation updated to use SENTRY_CONFIG exclusively.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Removes the deprecated _DEFAULT_ACTION_PERMISSIONS dict and its
__getattr__ compatibility shim from netbox/constants.py. Action
permissions should be defined via ObjectAction subclasses.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The command was deprecated in v4.6.0; all housekeeping tasks are now
handled automatically by NetBox's built-in job scheduler.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Jeremy Stretch
Martin Hauser
bctiemann
Arthur
Jason Novinger
mburggraf
Brian Tiemann
mburggraf