LoginSign Up
← Back to all sparks
N

Nautobot

INFRA · APIS
Velocity5.0

Network source of truth and network automation platform

networktocode.com/nautobot ↗

Nautobot 3.3 alpha 2 adds test helpers and a cable location filter after 3.2.9's token-leak fix.

network-automationsecuritypermissionsapitesting
◆Current state
Nautobot's 3.2 and 2.4 lines still ship same-day security releases every two weeks; on November 9 v3.2.9 and v2.4.46 fixed a flaw where the Export Object List job let users read other users' API token keys. The 3.3 feature line opened the same day with REST API rate limiting and JSON and YAML exports. v3.3.0a2 on November 13 mostly adds Playwright helpers for App test suites, along with a location filter on the cable connection form and a fix for a login page that reloaded every 15 seconds.
◆Where it's heading
3.3 is moving through alphas quickly, four days apart, while the security audit continues on the stable lines. The Playwright helpers suggest Nautobot wants App developers to test against its UI with shared tooling rather than custom scripts.
◆Prediction
More 3.3 alphas or a beta should follow within weeks, alongside the next pair of 3.2.x and 2.4.x security releases on the two-week rhythm.

◆Recent moves

  1. 15h ago

    v3.3.0a2: Playwright test helpers and a cable location filter

    The second 3.3 alpha is mostly Playwright helpers for App test suites, plus a cable-form location filter and a login-page reload fix. It moves 3.3 forward without adding to the rate-limiting and export features of alpha 1.

    View source ↗
  2. 4d ago

    v3.3.0a1: API rate limits, unassigned primary IPs, JSON/YAML export

    The first 3.3 alpha adds REST API rate limiting, JSON and YAML export for every model, request-timing headers and recent-run durations on the job form. It also lets a device's primary IP exist without an interface, and in a breaking change existing IP-to-interface assignments can no longer be edited, only deleted and recreated.

    View source ↗
  3. 4d ago

    v3.2.9: users could read other users' API token keys

    v3.2.9 fixes a vulnerability where the Export Object List job let users read other users' API token keys, and stops export and import jobs handling tokens at all. Three more bypasses of the sensitive-fields controls are closed, and SSO deployments with a custom pipeline may need a config change.

    View source ↗
  4. 4d ago

    v2.4.46: API token key leak and sensitive-field bypasses fixed

    The same token-key and sensitive-field fixes on the 2.4 line, published an hour before v3.2.9. It keeps the pattern of patching both supported lines on the same day.

    View source ↗
  5. 17d ago

    v3.2.8: object-visibility fixes, stored XSS and permission helpers

    The fullest statement of the audit so far: object-visibility holes across jobs, imports and REST lookups, stored XSS, and new helpers so Apps can apply the same limits. The IP address merge tool also gains real object-level permission checks.

    View source ↗
  6. 17d ago

    v2.4.45: visibility and XSS fixes reach the 2.4 line

    The same object-visibility and stored XSS fixes on the 2.4 line, published about an hour before v3.2.8. Keeping the older branch at parity is part of this security round.

    View source ↗