v4.6.4-ls362

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v4.6.4-ls361...v4.6.4-ls362

Remote Changes:

Enhancements

• #21710 - Render JSON schema enum options as a dropdown selection in module and device profile attribute forms
• #22174 - Include the dns_name of primary & out-of-band IP addresses in event payloads
• #22279 - Add a 1C8P:8C1P breakout cable profile
• #22548 - Improve the styling of action buttons in the navigation sidebar

Performance Improvements

• #22169 - Improve performance of the image attachments view when using S3 storage
• #22442 - Avoid repeated serializer instantiation in GFKSerializerField
• #22526 - Chunk bulk updates to custom field data to better handle a large number of records

Bug Fixes

• #21310 - Fix LDAP group lookup failure when a returned row contains a null value
• #22439 - Enforce object-level permissions on custom links rendered via the custom_links template tag
• #22440 - Remove errant changelog relation from GraphQL schema
• #22480 - Restore inline browser display of device front/rear images instead of forcing a download
• #22489 - Update the cached virtual chassis name on member devices in the search index when a virtual chassis is renamed
• #22501 - Return JSON rather than an HTML error page for GraphQL API exceptions
• #22507 - Also check is_active in the superuser bypass for restrict() and IsSuperuser
• #22543 - Prevent deletion of an existing custom script's file when re-uploading a same-named script via the REST API
• #22561 - Fix AttributeError when importing IP addresses with is_primary/is_oob set but no device assigned

Accessibility

• #22527 - Announce quick search results to screen readers
• #22528 - Make the Results/Filters tabs keyboard-operable
• #22529 - Allow the left sidebar accordion to be toggled with the spacebar
• #22530 - Remove hidden <select> inputs from the accessibility tree
• #22531 - Associate a label with the "Saved Filter" combobox for screen readers
• #22532 - Provide an accessible name for the empty checkbox column header cell in object tables

v4.6.4-ls361

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v4.6.3-ls360...v4.6.4-ls361

Remote Changes:

Enhancements

• #21710 - Render JSON schema enum options as a dropdown selection in module and device profile attribute forms
• #22174 - Include the dns_name of primary & out-of-band IP addresses in event payloads
• #22279 - Add a 1C8P:8C1P breakout cable profile
• #22548 - Improve the styling of action buttons in the navigation sidebar

Performance Improvements

• #22169 - Improve performance of the image attachments view when using S3 storage
• #22442 - Avoid repeated serializer instantiation in GFKSerializerField
• #22526 - Chunk bulk updates to custom field data to better handle a large number of records

Bug Fixes

• #21310 - Fix LDAP group lookup failure when a returned row contains a null value
• #22439 - Enforce object-level permissions on custom links rendered via the custom_links template tag
• #22440 - Remove errant changelog relation from GraphQL schema
• #22480 - Restore inline browser display of device front/rear images instead of forcing a download
• #22489 - Update the cached virtual chassis name on member devices in the search index when a virtual chassis is renamed
• #22501 - Return JSON rather than an HTML error page for GraphQL API exceptions
• #22507 - Also check is_active in the superuser bypass for restrict() and IsSuperuser
• #22543 - Prevent deletion of an existing custom script's file when re-uploading a same-named script via the REST API
• #22561 - Fix AttributeError when importing IP addresses with is_primary/is_oob set but no device assigned

Accessibility

• #22527 - Announce quick search results to screen readers
• #22528 - Make the Results/Filters tabs keyboard-operable
• #22529 - Allow the left sidebar accordion to be toggled with the spacebar
• #22530 - Remove hidden <select> inputs from the accessibility tree
• #22531 - Associate a label with the "Saved Filter" combobox for screen readers
• #22532 - Provide an accessible name for the empty checkbox column header cell in object tables

v4.6.3-ls360

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v4.6.3-ls359...v4.6.3-ls360

Remote Changes:

Enhancements

• #17598 - Add bulk creation support for VLANs
• #21666 - Add MU connector type for fiber ports and cables
• #22361 - Introduce an ArrayAttr UI panel attribute for rendering array field values
• #22457 - Use hmac.compare_digest() for constant-time authentication of API tokens

Performance Improvements

• #21870 - Optimize prefix availability calculations
• #22375 - Improve efficiency of filtering VLANs by interface

Bug Fixes

• #21338 - Include connected endpoint data in interface webhooks generated during cable creation
• #21895 - Restore pagination controls for job log entries (previously limited to 50 rows)
• #22210 - Respect saved filters when rendering IPAM child availability views in additional tabs
• #22237 - Fix server error when opening the standalone "Add Table Configuration" page
• #22245 - Include the id field in the OpenAPI request schemas for bulk PATCH/PUT endpoints
• #22251 - Re-parent child module bays when a multi-bay module is moved to a new bay
• #22273 - Fix migration failure when a service has several thousand ports defined
• #22303 - Add the missing fields parameter to the OpenAPI schema
• #22324 - Fix GraphQL filtering of custom field choice set extra choices
• #22340 - Display a token's allowed IPs as comma-separated strings rather than IPNetwork objects
• #22346 - Render SSO/SAML authentication failures as a login page message instead of an HTTP 500 error
• #22357 - Remove the unused local_context_data field from dcim.Module (which no longer inherits from ConfigContextModel)
• #22376 - Fix AssertionError in event rule script jobs when a device type has an image attached
• #22388 - Pin redis-py to <8.0 to avoid a startup failure on older Redis releases
• #22397 - Fix AttributeError exception when an unauthenticated user attempts to export devices
• #22399 - Enforce object permissions on the related object when serving static media
• #22427 - Validate JSONFilter.path to prevent ORM operator injection over JSONField contents in the GraphQL API
• #22429 - Enforce ObjectPermission constraints on grant_token in the REST API
• #22431 - Use a cryptographically secure random number generator when generating API tokens
• #22444 - Fix KeyError exception on the power feed detail view when the locale is not English
• #22448 - Ensure all object representations are escaped under handle_protectederror()
• #22454 - Fix serialization of decimal custom field values to avoid spurious changelog entries
• #22466 - Fix test failure against SSL-enabled PosgtreSQL

Deprecations

• #22392 - Deprecate support for Redis 5.x (to be removed in v4.7)

v4.6.3-ls359

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v4.6.3-ls358...v4.6.3-ls359

Remote Changes:

Enhancements

• #17598 - Add bulk creation support for VLANs
• #21666 - Add MU connector type for fiber ports and cables
• #22361 - Introduce an ArrayAttr UI panel attribute for rendering array field values
• #22457 - Use hmac.compare_digest() for constant-time authentication of API tokens

Performance Improvements

• #21870 - Optimize prefix availability calculations
• #22375 - Improve efficiency of filtering VLANs by interface

Bug Fixes

• #21338 - Include connected endpoint data in interface webhooks generated during cable creation
• #21895 - Restore pagination controls for job log entries (previously limited to 50 rows)
• #22210 - Respect saved filters when rendering IPAM child availability views in additional tabs
• #22237 - Fix server error when opening the standalone "Add Table Configuration" page
• #22245 - Include the id field in the OpenAPI request schemas for bulk PATCH/PUT endpoints
• #22251 - Re-parent child module bays when a multi-bay module is moved to a new bay
• #22273 - Fix migration failure when a service has several thousand ports defined
• #22303 - Add the missing fields parameter to the OpenAPI schema
• #22324 - Fix GraphQL filtering of custom field choice set extra choices
• #22340 - Display a token's allowed IPs as comma-separated strings rather than IPNetwork objects
• #22346 - Render SSO/SAML authentication failures as a login page message instead of an HTTP 500 error
• #22357 - Remove the unused local_context_data field from dcim.Module (which no longer inherits from ConfigContextModel)
• #22376 - Fix AssertionError in event rule script jobs when a device type has an image attached
• #22388 - Pin redis-py to <8.0 to avoid a startup failure on older Redis releases
• #22397 - Fix AttributeError exception when an unauthenticated user attempts to export devices
• #22399 - Enforce object permissions on the related object when serving static media
• #22427 - Validate JSONFilter.path to prevent ORM operator injection over JSONField contents in the GraphQL API
• #22429 - Enforce ObjectPermission constraints on grant_token in the REST API
• #22431 - Use a cryptographically secure random number generator when generating API tokens
• #22444 - Fix KeyError exception on the power feed detail view when the locale is not English
• #22448 - Ensure all object representations are escaped under handle_protectederror()
• #22454 - Fix serialization of decimal custom field values to avoid spurious changelog entries
• #22466 - Fix test failure against SSL-enabled PosgtreSQL

Deprecations

• #22392 - Deprecate support for Redis 5.x (to be removed in v4.7)

v4.6.3-ls358

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v4.6.2-ls357...v4.6.3-ls358

Remote Changes:

Enhancements

• #17598 - Add bulk creation support for VLANs
• #21666 - Add MU connector type for fiber ports and cables
• #22361 - Introduce an ArrayAttr UI panel attribute for rendering array field values
• #22457 - Use hmac.compare_digest() for constant-time authentication of API tokens

Performance Improvements

• #21870 - Optimize prefix availability calculations
• #22375 - Improve efficiency of filtering VLANs by interface

Bug Fixes

• #21338 - Include connected endpoint data in interface webhooks generated during cable creation
• #21895 - Restore pagination controls for job log entries (previously limited to 50 rows)
• #22210 - Respect saved filters when rendering IPAM child availability views in additional tabs
• #22237 - Fix server error when opening the standalone "Add Table Configuration" page
• #22245 - Include the id field in the OpenAPI request schemas for bulk PATCH/PUT endpoints
• #22251 - Re-parent child module bays when a multi-bay module is moved to a new bay
• #22273 - Fix migration failure when a service has several thousand ports defined
• #22303 - Add the missing fields parameter to the OpenAPI schema
• #22324 - Fix GraphQL filtering of custom field choice set extra choices
• #22340 - Display a token's allowed IPs as comma-separated strings rather than IPNetwork objects
• #22346 - Render SSO/SAML authentication failures as a login page message instead of an HTTP 500 error
• #22357 - Remove the unused local_context_data field from dcim.Module (which no longer inherits from ConfigContextModel)
• #22376 - Fix AssertionError in event rule script jobs when a device type has an image attached
• #22388 - Pin redis-py to <8.0 to avoid a startup failure on older Redis releases
• #22397 - Fix AttributeError exception when an unauthenticated user attempts to export devices
• #22399 - Enforce object permissions on the related object when serving static media
• #22427 - Validate JSONFilter.path to prevent ORM operator injection over JSONField contents in the GraphQL API
• #22429 - Enforce ObjectPermission constraints on grant_token in the REST API
• #22431 - Use a cryptographically secure random number generator when generating API tokens
• #22444 - Fix KeyError exception on the power feed detail view when the locale is not English
• #22448 - Ensure all object representations are escaped under handle_protectederror()
• #22454 - Fix serialization of decimal custom field values to avoid spurious changelog entries
• #22466 - Fix test failure against SSL-enabled PosgtreSQL

Deprecations

• #22392 - Deprecate support for Redis 5.x (to be removed in v4.7)

v4.6.2-ls357

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v4.6.2-ls356...v4.6.2-ls357

Remote Changes:

Enhancements

• #17127 - Add a user preference for selecting metric or imperial units of measurement
• #19336 - Convert the filtering of tabbed list views from JavaScript to HTMX
• #19460 - Support additional template variables for greater flexibility when constructing map URLs
• #20804 - Support bulk renaming of the label field on device components
• #21261 - Allow setting quick_add on an ObjectVar in custom scripts
• #21952 - Improve robustness of the RQ worker liveness check
• #22109 - Include child dependency counts in the module type REST API representation
• #22212 - Make designated environment parameters available within Jinja2 templates via the new env() filter
• #22239 - Rename the "Save" button on the table configuration form to "Apply" for clarity
• #22255 - Allow plugins to register custom serializer resolvers for get_serializer_for_model()

Bug Fixes

• #21091 - Declare proper request & response schema types for the device/VM config rendering API endpoints
• #22158 - Cache empty config revision state to avoid per-request queries polluting database connections
• #22163 - Fix ValueError raised by CircuitTerminationForm when a termination type is set but the target object is blank
• #22180 - Ensure custom scripts added via a remote data source are validated
• #22187 - Fix erroneous cable path retracing when using a cable profile
• #22219 - Add missing required form field indicator to InlineFields rows
• #22228 - Validate vid_ranges bounds metadata in VLANGroup.save() to avoid miscounts and a crash on singleton ranges
• #22232 - Prevent duplicate scheduled background jobs from being created
• #22233 - Fix site_id filter on the cables REST API returning no results when both endpoints are circuit terminations
• #22247 - Display the verbose name instead of the internal model name for the related object type on the custom field detail page
• #22270 - Avoid recording a spurious UPDATE change record after DELETE for objects with reverse SET_NULL relations
• #22282 - Fix fetch() on S3Backend to reliably resolve object keys
• #22283 - Restrict the Job queryset in ScriptResultView to authorized objects
• #22286 - Mark the name and description fields on the GraphQL ConfigContextProfileFilter as optional
• #22287 - Fix GraphQL EventRuleFilter.action_object_type being typed as a string lookup against a ContentType foreign key
• #22301 - Avoid name conflict when multiple plugins introduce taggable models of the same name
• #22307 - Fix inconsistent enforcement of grant_token permissions between the UI and REST API
• #22325 - Fix AttributeError when creating a custom field choice set with base choices
• #22328 - Avoid out-of-memory crash in DynamicMultipleChoiceField with large choice sets

v4.6.2-ls356

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v4.6.1-ls355...v4.6.2-ls356

Remote Changes:

Enhancements

• #17127 - Add a user preference for selecting metric or imperial units of measurement
• #19336 - Convert the filtering of tabbed list views from JavaScript to HTMX
• #19460 - Support additional template variables for greater flexibility when constructing map URLs
• #20804 - Support bulk renaming of the label field on device components
• #21261 - Allow setting quick_add on an ObjectVar in custom scripts
• #21952 - Improve robustness of the RQ worker liveness check
• #22109 - Include child dependency counts in the module type REST API representation
• #22212 - Make designated environment parameters available within Jinja2 templates via the new env() filter
• #22239 - Rename the "Save" button on the table configuration form to "Apply" for clarity
• #22255 - Allow plugins to register custom serializer resolvers for get_serializer_for_model()

Bug Fixes

• #21091 - Declare proper request & response schema types for the device/VM config rendering API endpoints
• #22158 - Cache empty config revision state to avoid per-request queries polluting database connections
• #22163 - Fix ValueError raised by CircuitTerminationForm when a termination type is set but the target object is blank
• #22180 - Ensure custom scripts added via a remote data source are validated
• #22187 - Fix erroneous cable path retracing when using a cable profile
• #22219 - Add missing required form field indicator to InlineFields rows
• #22228 - Validate vid_ranges bounds metadata in VLANGroup.save() to avoid miscounts and a crash on singleton ranges
• #22232 - Prevent duplicate scheduled background jobs from being created
• #22233 - Fix site_id filter on the cables REST API returning no results when both endpoints are circuit terminations
• #22247 - Display the verbose name instead of the internal model name for the related object type on the custom field detail page
• #22270 - Avoid recording a spurious UPDATE change record after DELETE for objects with reverse SET_NULL relations
• #22282 - Fix fetch() on S3Backend to reliably resolve object keys
• #22283 - Restrict the Job queryset in ScriptResultView to authorized objects
• #22286 - Mark the name and description fields on the GraphQL ConfigContextProfileFilter as optional
• #22287 - Fix GraphQL EventRuleFilter.action_object_type being typed as a string lookup against a ContentType foreign key
• #22301 - Avoid name conflict when multiple plugins introduce taggable models of the same name
• #22307 - Fix inconsistent enforcement of grant_token permissions between the UI and REST API
• #22325 - Fix AttributeError when creating a custom field choice set with base choices
• #22328 - Avoid out-of-memory crash in DynamicMultipleChoiceField with large choice sets

v4.6.1-ls355

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v4.6.1-ls354...v4.6.1-ls355

Remote Changes:

Enhancements

• #16851 - Correct errant and missing ARIA labels throughout the UI
• #20776 - Add changelog message support for bulk rename operations
• #20808 - Display the names of installed devices when selecting a rack position
• #21938 - Display geographic hierarchy for circuit terminations assigned to sites, locations, or regions
• #21993 - Allow IP ranges comprising a single IP address
• #22057 - Add filter support for notifications and subscriptions to GraphQL API
• #22192 - Introduce HTTP_CLIENT_IP_HEADERS configuration parameter to customize HTTP headers used to determine client IP address

Performance Improvements

• #22060 - Implement GraphQL query depth limiting (via GRAPHQL_MAX_QUERY_DEPTH) to guard against excessively complex queries
• #22061 - Add prefetch hints to various GraphQL type mixins to improve query efficiency
• #22102 - Add GIN index on CablePath to optimize filtering of cable paths by node
• #22104 - Avoid retracing cable paths during cable deletion
• #22146 - Avoid renumbering MPTT trees when creating module bays

Bug Fixes

• #21934 - Fix striped table rows overriding conditional row color highlighting for virtual/LAG interfaces
• #22055 - Fix API exceptions being silently consumed by middleware without reporting to Sentry
• #22079 - Fix security vulnerability allowing arbitrary code execution via ExportTemplate environment_params (CVE-2026-29514)
• #22081 - REST API should return plaintext for new v2 tokens upon creation
• #22183 - Fix spurious changelog entries for interface_b generated when saving an unchanged wireless link
• #22190 - Restore tenant and tenant group column options for circuits group table configuration
• #22198 - Restrict export template queryset to authorized objects in REST API and list views
• #22202 - Fix crash in system housekeeping job when no stable releases are available
• #22206 - Fix TypeError exception raised by table config validation when ordering attribute is null
• #22207 - Fix missing explicit object_type field annotation on TableConfigType GraphQL type
• #22208 - Add missing user_id FK filter on job filterset
• #22209 - Add missing cable_id FK filter on cable termination filterset
• #22227 - Fix display of IP address detail view when multiple NAT assignments exist
• #22236 - Fix support for user changelog message when saving table configurations via the REST API

Deprecations

• #22128 - Deprecate support for v1 API tokens (to be removed in v5.0)
• #22141 - Deprecate support for PostgreSQL 14 (to be removed in v4.7)

v4.6.1-ls354

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v4.6.1-ls353...v4.6.1-ls354

Remote Changes:

Enhancements

• #16851 - Correct errant and missing ARIA labels throughout the UI
• #20776 - Add changelog message support for bulk rename operations
• #20808 - Display the names of installed devices when selecting a rack position
• #21938 - Display geographic hierarchy for circuit terminations assigned to sites, locations, or regions
• #21993 - Allow IP ranges comprising a single IP address
• #22057 - Add filter support for notifications and subscriptions to GraphQL API
• #22192 - Introduce HTTP_CLIENT_IP_HEADERS configuration parameter to customize HTTP headers used to determine client IP address

Performance Improvements

• #22060 - Implement GraphQL query depth limiting (via GRAPHQL_MAX_QUERY_DEPTH) to guard against excessively complex queries
• #22061 - Add prefetch hints to various GraphQL type mixins to improve query efficiency
• #22102 - Add GIN index on CablePath to optimize filtering of cable paths by node
• #22104 - Avoid retracing cable paths during cable deletion
• #22146 - Avoid renumbering MPTT trees when creating module bays

Bug Fixes

• #21934 - Fix striped table rows overriding conditional row color highlighting for virtual/LAG interfaces
• #22055 - Fix API exceptions being silently consumed by middleware without reporting to Sentry
• #22079 - Fix security vulnerability allowing arbitrary code execution via ExportTemplate environment_params (CVE-2026-29514)
• #22081 - REST API should return plaintext for new v2 tokens upon creation
• #22183 - Fix spurious changelog entries for interface_b generated when saving an unchanged wireless link
• #22190 - Restore tenant and tenant group column options for circuits group table configuration
• #22198 - Restrict export template queryset to authorized objects in REST API and list views
• #22202 - Fix crash in system housekeeping job when no stable releases are available
• #22206 - Fix TypeError exception raised by table config validation when ordering attribute is null
• #22207 - Fix missing explicit object_type field annotation on TableConfigType GraphQL type
• #22208 - Add missing user_id FK filter on job filterset
• #22209 - Add missing cable_id FK filter on cable termination filterset
• #22227 - Fix display of IP address detail view when multiple NAT assignments exist
• #22236 - Fix support for user changelog message when saving table configurations via the REST API

Deprecations

• #22128 - Deprecate support for v1 API tokens (to be removed in v5.0)
• #22141 - Deprecate support for PostgreSQL 14 (to be removed in v4.7)

v4.6.1-ls353

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v4.6.0-ls352...v4.6.1-ls353

Remote Changes:

Enhancements

• #16851 - Correct errant and missing ARIA labels throughout the UI
• #20776 - Add changelog message support for bulk rename operations
• #20808 - Display the names of installed devices when selecting a rack position
• #21938 - Display geographic hierarchy for circuit terminations assigned to sites, locations, or regions
• #21993 - Allow IP ranges comprising a single IP address
• #22057 - Add filter support for notifications and subscriptions to GraphQL API
• #22192 - Introduce HTTP_CLIENT_IP_HEADERS configuration parameter to customize HTTP headers used to determine client IP address

Performance Improvements

• #22060 - Implement GraphQL query depth limiting (via GRAPHQL_MAX_QUERY_DEPTH) to guard against excessively complex queries
• #22061 - Add prefetch hints to various GraphQL type mixins to improve query efficiency
• #22102 - Add GIN index on CablePath to optimize filtering of cable paths by node
• #22104 - Avoid retracing cable paths during cable deletion
• #22146 - Avoid renumbering MPTT trees when creating module bays

Bug Fixes

• #21934 - Fix striped table rows overriding conditional row color highlighting for virtual/LAG interfaces
• #22055 - Fix API exceptions being silently consumed by middleware without reporting to Sentry
• #22079 - Fix security vulnerability allowing arbitrary code execution via ExportTemplate environment_params (CVE-2026-29514)
• #22081 - REST API should return plaintext for new v2 tokens upon creation
• #22183 - Fix spurious changelog entries for interface_b generated when saving an unchanged wireless link
• #22190 - Restore tenant and tenant group column options for circuits group table configuration
• #22198 - Restrict export template queryset to authorized objects in REST API and list views
• #22202 - Fix crash in system housekeeping job when no stable releases are available
• #22206 - Fix TypeError exception raised by table config validation when ordering attribute is null
• #22207 - Fix missing explicit object_type field annotation on TableConfigType GraphQL type
• #22208 - Add missing user_id FK filter on job filterset
• #22209 - Add missing cable_id FK filter on cable termination filterset
• #22227 - Fix display of IP address detail view when multiple NAT assignments exist
• #22236 - Fix support for user changelog message when saving table configurations via the REST API

Deprecations

• #22128 - Deprecate support for v1 API tokens (to be removed in v5.0)
• #22141 - Deprecate support for PostgreSQL 14 (to be removed in v4.7)