LoginSign Up
← Back to all sparks
N

Nautobot

INFRA · APIS
Velocity5.0

Network source of truth and network automation platform

networktocode.com/nautobot ↗

Nautobot patched the same permissions hole on both branches, then spent the release making the UI usable without sight.

network automationsecurity advisoriesaccessibilityrest apilong-term support
◆Current state
Nautobot maintains two supported lines, 3.2 and 2.4, and ships them the same afternoon with the same advisory fix. The August 17 pair closes GHSA-x69f-q4wj-vx72 — legacy console-connection, power-connection and interface-connection REST endpoints that never enforced object-level permissions. Around that, 3.2.3 carries the first substantial accessibility work visible in this window, and both branches keep absorbing dependency CVEs.
◆Where it's heading
The authorization audit that forced breaking API changes in 3.2.0 and 2.4.38 is still running, and it is now reaching the endpoints nobody looks at — the legacy connection APIs kept for compatibility. Alongside it a second thread has opened: a skip-to-content link, screen-reader live regions for HTMX updates, text alternatives for rack elevations, and badge colors chosen by measured WCAG contrast rather than perceived brightness. The documentation changes follow the same instinct as the code, spelling out which permissions amount to code execution rather than assuming operators know.
◆Prediction
Expect the remaining legacy DCIM endpoints to get the same object-level permission treatment, and the accessibility work to continue as numbered items under one issue rather than a separate release — it is being folded into the ordinary patch cadence.

◆Recent moves

  1. 1d ago

    Accessibility pass lands beside a legacy-endpoint permissions fix

    The advisory fix closes object-level permission enforcement on the legacy console-connection and power-connection endpoints, extending the authorization sweep that has driven this whole release line into the compatibility corners of the API. The accessibility batch alongside it is new to the arc: keyboard bypass links, live regions so HTMX-injected messages are announced, alt content for rack elevation SVGs, and contrast-measured badge colors.

    View source ↗
  2. 1d ago

    Same permissions advisory backported to the 2.4 branch

    The 2.4 branch takes the same advisory within a minute of its 3.2 twin, covering one endpoint more — interface-connections. The accompanying documentation updates spell out which permissions should stay with highly trusted users and how Secrets access becomes privilege escalation, continuing the pattern of patching expectations alongside code.

    View source ↗
  3. 15d ago

    Cable termination filter and GraphQL OpenTelemetry corrections

    A broad fix release covering the fallout of the 3.2 cable data model change, GraphQL telemetry that recorded API-token requests as anonymous, and a scheduler that silently produced no JobResult when no worker was running. Repair work on the surfaces 3.2.0 rearranged.

    View source ↗
  4. 15d ago

    Many-to-many change logging and GitRepository sync permissions

    The 2.4 counterpart of the same day, carrying the many-to-many change-logging fix and closing a GitRepository sync endpoint that skipped object-level restrictions. Both branches were treated as first-class recipients of the same corrections.

    View source ↗
  5. 21d ago

    Public API constants and a widened cryptography range

    Two constants promoted into the public apps API and a widened cryptography range to unblock apps that had not moved to v49. Housekeeping in service of the ecosystem rather than the core.

    View source ↗
  6. 23d ago

    REST API permission enforcement on related objects; job_kwargs required

    The release that set this cycle's terms: CVE fixes that break REST and GraphQL clients, required job_kwargs on job execution APIs, and device component foreign keys that now resolve through module bays. Nautobot chose correct authorization over compatibility and told operators to expect TypeErrors.

    View source ↗