Breaking Changes

• PostgreSQL 14 is no longer supported. NetBox now requires PostgreSQL 15 or later: The upgrade script will abort when connected to an earlier release. (NetBox v4.6 reported this as a warning.)
• Redis 5.x is no longer supported. NetBox now requires Redis 6.0 or later.
• Selection and multiple selection custom field values are now returned as objects specifying both the raw value and its human-friendly label (e.g. {"value": "datacenter", "label": "Data Center"}) in both the REST and GraphQL APIs. These fields continue to accept the raw value on write.
• The protocol and ports fields on the ipam.Service and ipam.ServiceTemplate models have been replaced by a unified port_mappings field, which supports multiple protocols per service. The legacy fields are retained (as deprecated) in the REST and GraphQL APIs, but at the ORM level they are now read-only properties derived from port_mappings: Passing protocol or ports to the model raises a TypeError, and assigning to service.ports raises an AttributeError.
• Because protocol is now filtered against the port_mappings array rather than a dedicated model field, the character-based REST filter lookups previously generated for it (protocol__ic, protocol__isw, protocol__empty, etc.) are no longer available. The port__empty lookup has been removed as well.
• The GraphQL filters for ipam.Service and ipam.ServiceTemplate have changed shape: The nested ports integer lookup has been replaced by the flat port, port__gt, port__gte, port__lt, and port__lte parameters (each accepting a list of values), alongside the new port_mappings parameter. Additionally, the members of ServiceProtocolEnum have been renamed to drop a spurious ROLE_ prefix (e.g. ROLE_TCP is now TCP).
• Config context data is now pre-rendered and cached for each device and virtual machine, and is always included in their REST API representations. The DeviceWithConfigContextSerializer and VirtualMachineWithConfigContextSerializer classes have been removed (merged into the base serializers), and the ?exclude=config_context query parameter is now silently ignored.
• Failed bulk create and update operations via the REST API now return a structured response of the form {"detail": ..., "errors": [{"index": N, "errors": {...}}]}, correlating each error with the index of the offending object in the submitted list. (Bulk operations remain all-or-none.)
• API token plaintexts can no longer be specified by the client when creating a token via the REST API. The token field is now read-only, and any value supplied is ignored. (This restriction was already in effect in the web UI.)
• Executing a custom script via the REST API now requires that the calling token have its write ability enabled.
• Updates to the global search cache are now deferred to a background task. As a result, a newly created or modified object may not appear in search results for a brief period. (When no background worker is running, the index is updated synchronously as before.)
• Nested group models (Region, SiteGroup, Location, DeviceRole, Platform, TenantGroup, ContactGroup, WirelessLANGroup, etc.) are now backed by a PostgreSQL ltree column rather than django-mptt. The MPTT-backed NestedGroupModel base class is retained for backward compatibility with plugins, but is deprecated: New code should use NestedLtreeGroupModel instead.
• django-tables2 has been upgraded to v3.0, which renames its querystring template tag to querystring_replace and removes the RelatedLinkColumn class.
• The request object passed to custom link templates is now a sanitized subset of the current request. Only the id, path, path_info, method, GET, and user attributes are available; cookies, headers, and session state are no longer accessible.
• URL custom field values are now validated against the ALLOWED_URL_SCHEMES configuration parameter. A value entered without a scheme is assumed to use https and stored as an absolute URL.
• Webhooks now support a configurable timeout. If you have lowered RQ_DEFAULT_TIMEOUT to 60 seconds or less, you must also set WEBHOOK_DEFAULT_TIMEOUT to a lower value; NetBox will refuse to start otherwise.
• Specifying an email server under the EMAIL configuration parameter is now mandatory in order to send mail: A deployment which does not define EMAIL['SERVER'] will raise an InvalidMailer exception when attempting to send, rather than failing at the SMTP connection.
• The upgrade script now runs the rebuild_config_context_cache management command to populate the new config context cache. This may extend the duration of the upgrade for deployments with a large number of devices and virtual machines.
• Removal of deprecated behavior
  • The housekeeping management command has been removed. (Its constituent tasks are performed by the individual management commands introduced in NetBox v4.6.)
  • NetBox's custom querystring template tag has been removed in favor of Django's built-in tag of the same name.
  • The legacy Sentry configuration parameters SENTRY_DSN, SENTRY_SAMPLE_RATE, SENTRY_SEND_DEFAULT_PII, and SENTRY_TRACES_SAMPLE_RATE have been removed. Use SENTRY_CONFIG instead.
  • The obsolete DEFAULT_ACTION_PERMISSIONS constant has been removed.
  • Support for legacy view action mappings has been dropped, and the LEGACY_ACTIONS constant has been removed.
  • Registered models are no longer populated under registry['models']. (Use ObjectType.objects.public() instead.) The registry['denormalized_fields'] store has been removed as well.
  • The backward compatibility shims for OptionalLimitOffsetPagination (now NetBoxPagination), ExpandableIPAddressField (now ExpandableIPNetworkField), and expand_ipaddress_pattern() (now expand_ipnetwork_pattern()) have been removed.
  • The request_id and username keys have been removed from the context available to outgoing webhooks. Use request.id and request.user instead.
  • The automatic reverse relationship created by OwnerMixin (e.g. site_set) has been removed.

New Features

Cooling Infrastructure Modeling (#22447)

NetBox has long modeled power distribution end to end, but had no equivalent for cooling. This release introduces a cooling data model which deliberately mirrors the power model, so that the concepts and workflows feel familiar.

Two new top-level models parallel PowerPanel and PowerFeed: CoolingSource represents facility-level cooling plant (a chiller, cooling tower, dry cooler, or facility water system) scoped to a site or location, and CoolingFeed represents a coolant loop delivered from a source to a rack. Two new device components parallel PowerPort and PowerOutlet: CoolingIntake represents a coolant intake on a device (e.g. a server cold-plate connection or a CDU's facility water inlet), and CoolingOutflow represents a coolant outlet on a CDU or manifold which supplies downstream equipment. Each intake may reference the upstream outflow which serves it, and both components have corresponding device type templates. CDUs and manifolds are modeled as ordinary devices carrying these components.

Lightweight descriptive attributes have also been added for users who want to record cooling characteristics without modeling the full plumbing: a cooling_method field (air, liquid, hybrid, or immersion) on the Device, DeviceType, and ModuleType models, and cooling_capability (air-only, hybrid, or liquid-only) and cooling_capacity fields on the Rack and RackType models.

Channelized Subinterfaces (#20972)

Channelized (breakout) interfaces can now be modeled natively. A new channels field on the Interface model indicates the number of physical channels into which an interface is divided, and each channel is represented by a subinterface of the new generic channel type, bound to its parent via the new channel_id field. A single cable terminates to the channelized parent interface, and NetBox traces a distinct cable path for each channel subinterface. Both fields are available on interface templates as well.

Multi-Protocol Application Services (#20285)

Application services and service templates can now expose the same port on multiple protocols — for example, DNS listening on both tcp/53 and udp/53. The single-protocol protocol and ports fields have been replaced by a unified port_mappings field, represented in the APIs as a flat list of protocol/port strings (e.g. ["tcp/80", "udp/53"]). New port_mappings, protocol, and port filters are available in the UI and in both APIs, with the latter two correlated so that they must be satisfied by a single mapping.

Module Bay Types (#19731)

A new ModuleBayType model has been introduced to convey which kinds of modules a module bay is able ...

Performance Improvements

• #22787 - Avoid N+1 queries when resolving generic relations (e.g. assigned objects) via the GraphQL API
• #22835 - Improve performance when provisioning new custom fields
• #22837 - Omit implicit pagination when prefetching to-one relations via the GraphQL API
• #22877 - Improve caching logic when retrieving custom fields via get_for_model()

Bug Fixes

• #22694 - Clear a device's stale rack assignment when changing its site
• #22745 - Enforce object permissions on custom script write operations via the REST API
• #22805 - Avoid re-executing the LDAP configuration file on every permission check
• #22821 - Prevent the deletion of a tenant group from creating duplicate tenant names or slugs
• #22825 - Fix cable path tracing for paths which originate from a circuit termination and traverse only pass-through ports
• #22828 - Validate that a webhook's payload URL is a valid URL or Jinja2 template when saving
• #22844 - Allow a null value for base_choices when creating a custom field choice set via the REST API
• #22848 - Ensure deterministic ordering of duplicate IP addresses to avoid repeating an object across paginated REST API results
• #22852 - Honor a custom script's notifications_default setting when the script is run from an event rule
• #22865 - Reference the appropriate component template types on the GraphQL type for inventory item templates
• #22879 - Improve the contrast of unselected radio buttons and checkboxes in dark mode
• #22882 - Fix support for the DISTINCT filter on nested GraphQL list fields
• #22894 - Sanitize the error message rendered when an exception occurs in CustomLinkColumn

Performance Improvements

• #22810 - Skip cached scope rebuild for sites and locations when scope fields are unchanged
• #22813 - Avoid extraneous database queries when fetching custom field data via the GraphQL API
• #22822 - Avoid an extra database query when including rack reservation units via the GraphQL API
• #22823 - Avoid extraneous database queries when fetching the IP address or prefix family via the GraphQL API

Bug Fixes

• #22738 - Correctly evaluate IP availability for users whose permissions are constrained by a custom field on a related object
• #22800 - Filter circuit group assignments by member type to avoid displaying assignments belonging to a virtual circuit with the same ID

Enhancements

• #19273 - Enable the selection of VLANs scoped to a device's cluster or cluster group when assigning VLANs to interfaces
• #22522 - Render colored badges for custom field choices in tables
• #22623 - Change the default color of the DHCP IP address status from green to purple to distinguish it from "available"
• #22685 - Introduce an "any" lookup for the tag and tag_id filters to match objects assigned any of the specified tags
• #22753 - Add a header_safe Jinja2 filter for sanitizing HTTP header values

Performance Improvements

• #22497 - Improve the speed of bulk object deletion by avoiding per-object cascade handling and N+1 counter updates
• #22687 - Avoid an unnecessary queryset evaluation when rendering export templates

Bug Fixes

• #21988 - Ensure view permissions are enforced when referencing a related object by its attributes in the REST API
• #22513 - Make JournalEntry.created_by immutable after creation to prevent audit trail spoofing
• #22565 - Include circuit distance when calculating the total length of a cable path
• #22588 - Restrict the VLANs available for assignment to a prefix scoped to a site group
• #22644 - Record changes to front/rear port mappings in the changelog
• #22654 - Redact server filesystem paths from tracebacks rendered by ConfigTemplate debug mode
• #22656 - Pre-populate interface attributes when using "Create & Add Another"
• #22662 - Avoid raising a DataError exception when a cable length exceeds the maximum supported value
• #22675 - Validate the URL scheme of RSS feed entries to prevent DOM-based cross-site scripting
• #22677 - Display validation errors for form fields which lack HTML5 constraints
• #22682 - Prevent the deletion of a site group from cascading to prefixes scoped to its member sites
• #22690 - Restore the left border on the quick search field
• #22697 - Return to the scripts list when cancelling out of the "add script" form
• #22707 - Fix the resolution of port mappings when {vc_position} is used on device type component templates
• #22712 - Highlight relevant dropdown fields when form validation fails
• #22717 - Fix KeyError raised when validating a device assigned to a cluster scoped to a different location
• #22719 - Avoid raising a KeyError for malformed IP address and prefix values submitted via the REST API
• #22720 - Raise a protected-deletion error rather than a TypeError when deleting a virtual chassis with a cross-chassis LAG
• #22729 - Escape object names when populating the Content-Disposition header of file responses
• #22736 - Include the comments field of ASNs in the global search index
• #22737 - Clear stale connector metadata from cable endpoints when deleting a profiled cable
• #22748 - Ensure ContentTypeField respects its declared queryset to prevent the selection of non-public object types
• #22752 - Restore the rear port fields on the front port bulk import form
• #22766 - Fix the GraphQL length lookup for array filters
• #22767 - Include the comments field of several models in the global search indexes
• #22768 - Store a null value rather than an empty string for cable_end when removing a cable
• #22773 - Fix TypeError exception when bulk adding module bays to devices
• #22790 - Enforce saved filter visibility when applied via the filter or filter_id query parameter

Enhancements

• #18828 - Add MDC connector type for fiber ports and cables
• #22544 - Provide a REST API method to update or overwrite an existing custom script module
• #22629 - Enforce a lower maximum uploaded image size (50 megapixels) than the Pillow default
• #22649 - Add Korean language support

Performance Improvements

• #22551 - Add a prefetch hint to the GraphQL tags field to avoid N+1 queries on list endpoints
• #22589 - Cache serializers to avoid repeated reinstantiation on the cables list REST API endpoint

Bug Fixes

• #22154 - Correct the OpenAPI schema for relation counts on nested (brief) object representations
• #22500 - Return the configured maintenance mode message for REST API requests
• #22521 - Honor RAM_BASE_UNIT for the default memory of a virtual machine type
• #22539 - Restore the available IPs button for users with constrained permissions
• #22566 - Avoid name collisions when a custom script's filename matches a core app label
• #22568 - Fix uncaught ValueError (HTTP 500) when an invalid filter_id query parameter is provided
• #22573 - Remove persistent scrollbar on the navigation menu in Chrome
• #22578 - Ensure shared objects are treated consistently across the UI and REST API
• #22582 - Use a theme-aware color for interface list row separators in dark mode
• #22598 - Fix ValueError exception when viewing background tasks under RQ 2.10
• #22617 - Require the "change" permission (rather than "add") when editing objects via the bulk import form
• #22626 - Ensure custom link names are escaped when rendering fails
• #22632 - Fix ValueError raised by object-level permission checks for cross-app proxy models
• #22652 - Explicitly disable autoescaping for config templates rendered via SandboxedEnvironment
• #22657 - Escape the exception message in the render_widget template tag before marking it safe

Enhancements

• #21710 - Render JSON schema enum options as a dropdown selection in module and device profile attribute forms
• #22174 - Include the dns_name of primary & out-of-band IP addresses in event payloads
• #22279 - Add a 1C8P:8C1P breakout cable profile
• #22548 - Improve the styling of action buttons in the navigation sidebar

Performance Improvements

• #22169 - Improve performance of the image attachments view when using S3 storage
• #22442 - Avoid repeated serializer instantiation in GFKSerializerField
• #22526 - Chunk bulk updates to custom field data to better handle a large number of records

Bug Fixes

• #21310 - Fix LDAP group lookup failure when a returned row contains a null value
• #22439 - Enforce object-level permissions on custom links rendered via the custom_links template tag
• #22440 - Remove errant changelog relation from GraphQL schema
• #22480 - Restore inline browser display of device front/rear images instead of forcing a download
• #22489 - Update the cached virtual chassis name on member devices in the search index when a virtual chassis is renamed
• #22501 - Return JSON rather than an HTML error page for GraphQL API exceptions
• #22507 - Also check is_active in the superuser bypass for restrict() and IsSuperuser
• #22543 - Prevent deletion of an existing custom script's file when re-uploading a same-named script via the REST API
• #22561 - Fix AttributeError when importing IP addresses with is_primary/is_oob set but no device assigned

Accessibility

• #22527 - Announce quick search results to screen readers
• #22528 - Make the Results/Filters tabs keyboard-operable
• #22529 - Allow the left sidebar accordion to be toggled with the spacebar
• #22530 - Remove hidden <select> inputs from the accessibility tree
• #22531 - Associate a label with the "Saved Filter" combobox for screen readers
• #22532 - Provide an accessible name for the empty checkbox column header cell in object tables

Enhancements

• #17598 - Add bulk creation support for VLANs
• #21666 - Add MU connector type for fiber ports and cables
• #22361 - Introduce an ArrayAttr UI panel attribute for rendering array field values
• #22457 - Use hmac.compare_digest() for constant-time authentication of API tokens

Performance Improvements

• #21870 - Optimize prefix availability calculations
• #22375 - Improve efficiency of filtering VLANs by interface

Bug Fixes

• #21338 - Include connected endpoint data in interface webhooks generated during cable creation
• #21895 - Restore pagination controls for job log entries (previously limited to 50 rows)
• #22210 - Respect saved filters when rendering IPAM child availability views in additional tabs
• #22237 - Fix server error when opening the standalone "Add Table Configuration" page
• #22245 - Include the id field in the OpenAPI request schemas for bulk PATCH/PUT endpoints
• #22251 - Re-parent child module bays when a multi-bay module is moved to a new bay
• #22273 - Fix migration failure when a service has several thousand ports defined
• #22303 - Add the missing fields parameter to the OpenAPI schema
• #22324 - Fix GraphQL filtering of custom field choice set extra choices
• #22340 - Display a token's allowed IPs as comma-separated strings rather than IPNetwork objects
• #22346 - Render SSO/SAML authentication failures as a login page message instead of an HTTP 500 error
• #22357 - Remove the unused local_context_data field from dcim.Module (which no longer inherits from ConfigContextModel)
• #22376 - Fix AssertionError in event rule script jobs when a device type has an image attached
• #22388 - Pin redis-py to <8.0 to avoid a startup failure on older Redis releases
• #22397 - Fix AttributeError exception when an unauthenticated user attempts to export devices
• #22399 - Enforce object permissions on the related object when serving static media
• #22427 - Validate JSONFilter.path to prevent ORM operator injection over JSONField contents in the GraphQL API
• #22429 - Enforce ObjectPermission constraints on grant_token in the REST API
• #22431 - Use a cryptographically secure random number generator when generating API tokens
• #22444 - Fix KeyError exception on the power feed detail view when the locale is not English
• #22448 - Ensure all object representations are escaped under handle_protectederror()
• #22454 - Fix serialization of decimal custom field values to avoid spurious changelog entries
• #22466 - Fix test failure against SSL-enabled PosgtreSQL

Deprecations

• #22392 - Deprecate support for Redis 5.x (to be removed in v4.7)

Enhancements

• #17127 - Add a user preference for selecting metric or imperial units of measurement
• #19336 - Convert the filtering of tabbed list views from JavaScript to HTMX
• #19460 - Support additional template variables for greater flexibility when constructing map URLs
• #20804 - Support bulk renaming of the label field on device components
• #21261 - Allow setting quick_add on an ObjectVar in custom scripts
• #21952 - Improve robustness of the RQ worker liveness check
• #22109 - Include child dependency counts in the module type REST API representation
• #22212 - Make designated environment parameters available within Jinja2 templates via the new env() filter
• #22239 - Rename the "Save" button on the table configuration form to "Apply" for clarity
• #22255 - Allow plugins to register custom serializer resolvers for get_serializer_for_model()

Bug Fixes

• #21091 - Declare proper request & response schema types for the device/VM config rendering API endpoints
• #22158 - Cache empty config revision state to avoid per-request queries polluting database connections
• #22163 - Fix ValueError raised by CircuitTerminationForm when a termination type is set but the target object is blank
• #22180 - Ensure custom scripts added via a remote data source are validated
• #22187 - Fix erroneous cable path retracing when using a cable profile
• #22219 - Add missing required form field indicator to InlineFields rows
• #22228 - Validate vid_ranges bounds metadata in VLANGroup.save() to avoid miscounts and a crash on singleton ranges
• #22232 - Prevent duplicate scheduled background jobs from being created
• #22233 - Fix site_id filter on the cables REST API returning no results when both endpoints are circuit terminations
• #22247 - Display the verbose name instead of the internal model name for the related object type on the custom field detail page
• #22270 - Avoid recording a spurious UPDATE change record after DELETE for objects with reverse SET_NULL relations
• #22282 - Fix fetch() on S3Backend to reliably resolve object keys
• #22283 - Restrict the Job queryset in ScriptResultView to authorized objects
• #22286 - Mark the name and description fields on the GraphQL ConfigContextProfileFilter as optional
• #22287 - Fix GraphQL EventRuleFilter.action_object_type being typed as a string lookup against a ContentType foreign key
• #22301 - Avoid name conflict when multiple plugins introduce taggable models of the same name
• #22307 - Fix inconsistent enforcement of grant_token permissions between the UI and REST API
• #22325 - Fix AttributeError when creating a custom field choice set with base choices
• #22328 - Avoid out-of-memory crash in DynamicMultipleChoiceField with large choice sets

Enhancements

• #16851 - Correct errant and missing ARIA labels throughout the UI
• #20776 - Add changelog message support for bulk rename operations
• #20808 - Display the names of installed devices when selecting a rack position
• #21938 - Display geographic hierarchy for circuit terminations assigned to sites, locations, or regions
• #21993 - Allow IP ranges comprising a single IP address
• #22057 - Add filter support for notifications and subscriptions to GraphQL API
• #22192 - Introduce HTTP_CLIENT_IP_HEADERS configuration parameter to customize HTTP headers used to determine client IP address

Performance Improvements

• #22060 - Implement GraphQL query depth limiting (via GRAPHQL_MAX_QUERY_DEPTH) to guard against excessively complex queries
• #22061 - Add prefetch hints to various GraphQL type mixins to improve query efficiency
• #22102 - Add GIN index on CablePath to optimize filtering of cable paths by node
• #22104 - Avoid retracing cable paths during cable deletion
• #22146 - Avoid renumbering MPTT trees when creating module bays

Bug Fixes

• #21934 - Fix striped table rows overriding conditional row color highlighting for virtual/LAG interfaces
• #22055 - Fix API exceptions being silently consumed by middleware without reporting to Sentry
• #22079 - Fix security vulnerability allowing arbitrary code execution via ExportTemplate environment_params (CVE-2026-29514)
• #22081 - REST API should return plaintext for new v2 tokens upon creation
• #22183 - Fix spurious changelog entries for interface_b generated when saving an unchanged wireless link
• #22190 - Restore tenant and tenant group column options for circuits group table configuration
• #22198 - Restrict export template queryset to authorized objects in REST API and list views
• #22202 - Fix crash in system housekeeping job when no stable releases are available
• #22206 - Fix TypeError exception raised by table config validation when ordering attribute is null
• #22207 - Fix missing explicit object_type field annotation on TableConfigType GraphQL type
• #22208 - Add missing user_id FK filter on job filterset
• #22209 - Add missing cable_id FK filter on cable termination filterset
• #22227 - Fix display of IP address detail view when multiple NAT assignments exist
• #22236 - Fix support for user changelog message when saving table configurations via the REST API

Deprecations

• #22128 - Deprecate support for v1 API tokens (to be removed in v5.0)
• #22141 - Deprecate support for PostgreSQL 14 (to be removed in v4.7)

New Features

Virtual Machine Types (#5795)

A new VirtualMachineType model has been introduced to enable categorization of virtual machines by instance type, analogous to how DeviceType categorizes physical hardware. VM types can be defined once and reused across many virtual machines.

Cable Bundles (#20151)

A new CableBundle model allows individual cables to be grouped together to represent physical cable runs that are managed as a unit; e.g. a bundle of 48 CAT6 cables between two patch panels. (Please note that this feature is not suitable for modeling individual fiber strands within a single cable.)

Rack Groups (#20961)

A flat RackGroup model has been reintroduced to provide a lightweight secondary axis of rack organization (e.g. by row or aisle) that is independent of the location hierarchy. Racks carry an optional foreign key to a RackGroup, and RackGroup can also serve as a scope for VLANGroup assignments.

ETag Support for REST API (#21356)

The REST API now returns an ETag header on responses for individual objects, derived from the object's last-updated timestamp. Clients can supply an If-Match header on PUT/PATCH requests to guard against conflicting concurrent updates; if the object has been modified since the ETag was issued, the server returns a 412 (Precondition Failed) response.

Cursor-based Pagination for REST API (#21363)

A new start query parameter has been introduced as an efficient alternative to the existing offset parameter for paginating large result sets. Rather than scanning the table up to a relative offset, the start parameter filters for objects with a primary key equal to or greater than the given value, enabling constant-time pagination regardless of result set size.

Enhancements

• #12024 - Permit virtual machines to be assigned to devices without a cluster
• #14329 - Improve diff highlighting for custom field data in change logs
• #15513 - Add bulk creation support for IP prefixes
• #17654 - Support role assignment for ASNs
• #19025 - Support optional schema validation for JSON custom fields
• #19034 - Annotate total reserved unit count on rack reservations
• #19138 - Include NAT addresses for primary & out-of-band IP addresses in REST API
• #19648 - Add a color custom field type
• #19796 - Support {module} position inheritance for nested module bays
• #19953 - Enable debugging support for ConfigTemplate rendering
• #20123 - Introduce options to control adoption/replication of device components via REST API (replicates UI behavior)
• #20152 - Support for marking module and device bays as disabled
• #20162 - Provide an option to execute as a background job when adding components to devices in bulk
• #20163 - Add changelog message support for bulk device component creation
• #20698 - Add read-only total_vlan_ids attribute on VLAN group representation in REST & GraphQL APIs
• #20916 - Include stack trace for unhandled exceptions in job logs
• #21157 - Include all public model classes in export template context
• #21409 - Introduce CHANGELOG_RETAIN_CREATE_LAST_UPDATE configuration parameter to retain creation & most recent update record in change log for each object
• #21575 - Introduce {vc_position} template variable for device component template name/label
• #21662 - Increase rf_channel_frequency precision to 3 decimal places
• #21702 - Include a serialized representation of the HTTP request in each webhook
• #21720 - Align HTTP basic auth regex of EnhancedURLValidator with Django's URLValidator
• #21751 - Disable notifications for scripts running in the background
• #21770 - Enable specifying columns to include/exclude on embedded tables
• #21771 - Add support for partial tag assignment (add_tags) and removal (remove_tags) via REST API
• #21780 - Add changelog message support to bulk creation of IP addresses
• #21865 - Allow setting empty INTERNAL_IPS to enable debug toolbar for all clients
• #21924 - Improve styling and consistency of floating bulk action controls
• #22062 - Display API token ID & plaintext one time immediately upon creation

Performance Improvements

• #21455 - Ensure PostgreSQL indexes exist to support the default ordering of each model
• #21688 - Reduce per-position ORM lookups when tracing cable paths
• #21788 - Optimize bulk object export to avoid timeout errors on large querysets

Plugins

• #20924 - Introduce support for declarative layouts and reusable UI components
• #21357 - Provide an API for plugins to register custom model actions (for permission assignment)

Deprecations

• #21284 - Deprecate the username and request_id fields in event data
• #21304 - Deprecate the housekeeping management command
• #21331 - Deprecate NetBox's custom querystring template tag
• #21881 - Deprecate legacy Sentry configuration parameters
• #21884 - Deprecate the obsolete DEFAULT_ACTION_PERMISSIONS mapping
• #21887 - Deprecate support for legacy view actions
• #21890 - Deprecate models key in application registry
• #21936 - Deprecate the LOGIN_REQUIRED configuration parameter
• #22046 - Deprecate OptionalLimitOffsetPagination
• #22047 - Deprecate ExpandableIPAddressField
• #22048 - Deprecate the expand_ipaddress_pattern() utility function

Other Changes

• #20984 - Upgrade to Django 6.0
• #21635 - Migrate documentation site from mkdocs to Zensical