LoginSign Up
← Back to all sparks
N

Nautobot

INFRA · APIS
Velocity5.0

Network source of truth and network automation platform

networktocode.com/nautobot ↗

Nautobot ships SSO group control and a Saved View permissions rework to both branches at once.

network-automationssopermissionssaved-viewsbranch-backportsfiltersets
◆Current state
Nautobot maintains two branches in parallel and cuts them minutes apart. The 08-31 pair carries the same core work to both: an SSO_SYNC_GROUPS setting that restricts which claimed groups are synced, group sync that now properly revokes memberships and staff status when the claim empties, a Saved View set-default endpoint that needs no Saved View permissions, and two GitPython security bumps. The 3.2 branch alone takes a filterset overhaul that stops many filters returning duplicate rows.
◆Where it's heading
The permissions surface is where the sustained attention is. Saved Views get ownership and permission checks applied consistently across form, API and default-setting paths, an old association endpoint is deprecated in favour of a scoped one, and the documentation is filled in around who actually needs which grant. Alongside it, SSO group handling is being tightened from both ends — restricting what syncs in, and correctly revoking what should no longer apply.
◆Prediction
With the user-saved-view-associations endpoints now deprecated and the filter distinct flag derived rather than defaulted, expect the next releases to remove those endpoints on the 3.x line and continue the app-facing filterset test rollout.

◆Recent moves

  1. 16d ago

    SSO group scoping and a filterset distinct overhaul

    The 3.2 cut of the shared work, plus a filterset overhaul the 2.4 branch does not get: distinct is now derived from a filter's field path rather than always applied, which both fixes duplicate results on to-many traversals and removes an unnecessary distinct from many UI, REST and GraphQL queries. New public filter mixins and a test asserting the rule land for app authors alongside it.

    View source ↗
  2. 16d ago

    SSO group scoping and Saved View permissions backported to 2.4

    The same SSO group scoping, Saved View permission rework and GitPython security bumps backported to the 2.4 branch four minutes earlier, minus the filterset work. It also picks up a SAML-specific fix so group attributes are read from SAML responses, which the SSO documentation now warns supports only one identity provider at a time.

    View source ↗
  3. 1mo ago

    Accessibility pass lands beside a legacy-endpoint change

    Two weeks earlier, the same branch paired an accessibility pass with a legacy-endpoint change — the recurring shape of this feed, where interface work and API housekeeping travel together.

    View source ↗
  4. 1mo ago

    Same permissions advisory backported to the 2.4 branch

    The 2.4 counterpart of that release, carrying the same permissions advisory. It is the clearest earlier instance of the same-day dual-branch cut this feed produces every few weeks.

    View source ↗
  5. 1mo ago

    Cable termination filter and GraphQL OpenTelemetry tracing

    A cable termination filter and GraphQL OpenTelemetry instrumentation — filter coverage and query observability, both of which the August 31 release continues in its filterset and tracing work.

    View source ↗
  6. 1mo ago

    Many-to-many change logging and GitRepository handling

    Many-to-many change logging and GitRepository handling on the 2.4 branch. Change logging across many-to-many relations is the sort of audit gap that matters in a source-of-truth system, where an unlogged relation edit is invisible after the fact.

    View source ↗