NAV

The first feature release of the 5.15 series of NAV is now out!

The source code is available for download at GitHub.

New packages for Debian 12 (Bookworm) and 11 (Bullseye) are available in our APT repository.

Please be extra aware of config file changes, especially in ipdevpoll.conf. Look out for *.dpkg-dist files in /etc/nav and make sure to update your running config.

Security

• In preparation for properly protecting against CSRF attacks throughout NAV:
  • Added CSRF tokens to AJAX POST requests (#3465)
  • Removed CSRF tokens from GET requests (#3472)

Removed

• Removed unused vendored Foundation CSS stylesheets (#3479)
• Removed vendored Foundation JavaScript library from codebase (#3542)

Added

• Show VLAN netident in ipdevinfo port list (#2160)
• Dashboards are now shareable between users (#2344)
• Show device MAC address in the Device Info tab of ipdevinfo (#3222)
• Added Django 5.2 and Python 3.13 to default test matrix (#3467)
• Improved user feedback in PortAdmin by loading live port details in background, after initial page load (#3544)
• Added search results preview in navbar (#3577)
• Documented how to enable IPv6 connectivity inside devcontainer (Docker)

Changed

• Updated NAPALM dependency to 5.1.0 (#3495)
• Replaced SeedDB IP Device “check connectivity” JavaScript with HTMX, including improved user feedback (#3560)

Non-visible and developer-centric changes

• The dated Foundation JavaScript libraries and CSS stylesheets are being replaced by a combination of HTMX-based features, new internal libraries and newer alternative libraries. The goal is to keep the outward user interface more or less unchanged:

  • Use HTMX modals in SeedDB Patch tool (#3461)
  • Replaced tooltip in status actions with accessible help text toggle (#3463)
  • Replaced Foundation Joyride with Driver.js implementation (#3468)
  • Replaced Foundation Topbar JS with JQuery (#3476)
  • Replaced Foundation Equalizer with JQuery (#3477)
  • Replaced foundation alert plugin with custom JavaScript (#3481)
  • Replaced native tooltips with NAV tooltips (#3482)
  • Replaced navlet modals with HTMX implementation (#3487)
  • Replaced search hint modals in Radius tool with HTMX (#3494)
  • Replaced radius detail modals with HTMX (#3514)
  • Added fit-content size to modals to support large content
  • Replace IPAM subnet diagram help modal with HTMX
  • Replaced “about logging” modal with HTMX
  • Replaced Foundation dropdowns with custom implementation
  • Replaced “import dashboard” modal with HTMX
  • Replaced Machine Tracker modals with HTMX
  • Replaced modals in ipdevinfo tool with HTMX
  • Replaced threshold form help modal with HTMX
  • Added custom NAV tooltip as replacement for Foundation JS (#3449)
  • Added reusable HTMX modal utilities and styles (#3461)
  • Added modal closing behaviour controls for close button visibility and outside click handling (#3537)
  • Added support for positioning popover on multiple sides (#3550)
  • Replaced feedback modal in Portadmin with HTMX (#3540)
  • Replaced Foundation dropdowns with popovers (#3531)
  • Upgraded tinysort dependency (#3580)
  • Replaced Foundation Clearing Lightbox with custom Lightbox plugin for room/location picture gallery (#3530)
  • Use fixed position tooltips in status widgets and SeedDB list tree (#3576)
  • Added support for controlling popovers with client side events (#3578)
  • Replaced outdated timepicker library with flatpickr (#3587)

• Modernized Django URL config, mostly by replacing usage of re_path() with path() (#3515, (#3548, (#3631)

Fixed

• Protect against unexpected NUL bytes in SNMP strings by stripping them (#2479)
• Fixed bug where status widget tooltip gets stuck (#3301)
• Show friendly error message in Arnold when attempting to block ports on switches that do not feature a writeable management profile (#3383)
• Fixed bug where ipdevinfo job refresh does not display error messages properly (#3385)
• Made it possible to un-revoke JWT refresh token by recreating the token (#3457)
• Fixed broken all-time searches in Radius tool (#3500)
• Removed “no racks” alert after adding a new rack to a room (#3506)
• Show distinct filter groups in Groups and Permissions modal in Alert Profiles (#3523)
• Show errors on invalid IP in Network Explorer search (#3534)
• Fixed saving rooms/locations with active alerts widgets after editing (#3561)
• Fixed sudo-ing to the default (anonymous) account (#3571)
• Fixed PortAdmin bug where restarting interfaces fails (#3589)
• Fixed tooltips in Device History and Subnet Matrix tools (#3591)
• Enabled GetBulk / bulkwalk operations under synchronous SNMP v3 communication (enormously speeding up PortAdmin SNMPv3 queries) (#3594)
• Adjusted size and position of “close modal” icon to avoid overlap with text
• Fixed bug where QR Code button is not clickable

Release notes

We always advise you to have a look at NAV’s accompanying release notes before upgrading.

Happy NAVing everyone!

The first maintenance release of the 5.14 series of NAV is now out!

The source code is available for download at GitHub.

New packages for Debian 12 (Bookworm) and 11 (Bullseye) are available in our APT repository.

Please be extra aware of config file changes, especially in ipdevpoll.conf. Look out for *.dpkg-dist files in /etc/nav and make sure to update your running config.

Fixed

• Correctly display current chosen filter in Status tool (#3442)
• Fixed showing activity graphs in port details in ipdevinfo (#3484)

Release notes

We always advise you to have a look at NAV’s accompanying release notes before upgrading.

Happy NAVing everyone!

The first feature release of the 5.14 series of NAV is now out!

The source code is available for download at GitHub.

New packages for Debian 12 (Bookworm) and 11 (Bullseye) are available in our APT repository.

Please be extra aware of config file changes, especially in ipdevpoll.conf. Look out for *.dpkg-dist files in /etc/nav and make sure to update your running config.

Added

User-visible additions

• New SQL reports in the Report tool:
  • Added an operational entities SQL report. (#1947)
  • Added an Events detected last 24 hours SQL report. (#3305)
• Collection job refreshing from web UI:
  • Added button to refresh ipdevpoll background jobs directly from IP Device Info tool. (#3350)
  • ipdevpoll can now immediately reschedule jobs on incoming refresh events on the NAV event queue. Refreshes can be ordered from the command line using the navrefresh program. (#2626)
• Added QR code link features:
  • Added link to “My Stuff” menu to generate QR code link to current page. (#2897)
  • Added button to SeedDB that downloads a ZIP file with QR Codes linking to the selected netboxes/rooms. (#2899)
  • Added config option to switch between generating SVG or PNG QR codes. (#2916)
• API additions:
  • Added API endpoint for looking up vendor of MAC address. (#3337)
  • Added API endpoint for the NetboxEntity model. (#3378)
  • JWT token signing features:
    • Added API endpoint for JWT refresh tokens. (#3270)
    • Added new tab to User and API administration tool for managing JWT refresh tokens. (#3273)
    • Expiration times for issued JWT refresh tokens can be configured via jwt.conf. (#3016)
    • Added support for including API endpoint read/write permission claims to JWT tokens.
• Added password security warnings:
  • Show a banner if the logged in user’s password is insecure or old and it should be changed. (#3345)
  • Show a banner to admins if other users’ passwords are insecure or old. (#3346)
• Added support for the T3611 sensor from Comet. (#3307)
• Added support for fetching DHCP pool statistics from Kea DHCP API. (#2931)

Developer-centric additions

• Added HTMX as new front-end library. (#3386)
• Document practical usage of devcontainer for developers. (#3398)
• Added developer utilities for easily dumping/loading production data into devcontainer.

Changed

User-visible changes

• Replaced QuickSelect component picker with dynamic HTMX-based search in Maintenance tool. (#3425)
• Replaced QuickSelect component picker with dynamic HTMX-based search in Device history tool. (#3434)
• Dependency changes:
  • Updated NAPALM dependency to 5.0 (#2358)
  • Updated django-rest-framework to version 3.14+, for proper compatibility Django 4.2 (#3403)

Developer-centric changes

• Replaced usage of twisted.internet.defer.returnValue with regular Python return, due to deprecation in newest Twisted version. (#2955)
• Redefined NAV account model to be usable as a Django user model. (#3332)
• Remove unused ColumnsForm (#3243)

Fixed

• Fixed missing ARP API endpoint documentation for IP address filtering. (#3215)
• Fixed broken location history searches from location view page. (#3360)
• Restored ISO timestamps in the web UI (as they were before NAV 5.13) (#3369)
• Fixed broken Add to dashboard functionality for boolean value sensors (#3394)
• Fixed sorting by timestamp columns in threshold rule table and Useradmin API-token table. (#3410)
• Take advantage of auxiliary end_time indexes on ARP table to improve prefix usage lookups in API. (#3413)
• Made Docker test environment usable for devs on Apple silicon Macs.

Release notes

We always advise you to have a look at NAV’s accompanying release notes before upgrading.

Happy NAVing everyone!

The second maintenance release of the 5.13 series of NAV is now out!

The source code is available for download at GitHub.

New packages for Debian 12 (Bookworm) and 11 (Bullseye) are available in our APT repository.

Please be extra aware of config file changes, especially in ipdevpoll.conf. Look out for *.dpkg-dist files in /etc/nav and make sure to update your running config.

Fixed

• Relax API permissions for endpoints used by NAV web GUI tools intended for non-admin users. Several tools stopped working for non-admin users as a result of the permissions lockdown in the 5.13.1 security fix.
  • Relax permissions for API interface view endpoint (#3373)
  • Relax permissions for API prefix usage view endpoint (#3374)
  • Relax permissions for API list room endpoint (#3375)

Release notes

We always advise you to have a look at NAV’s accompanying release notes before upgrading.

Happy NAVing everyone!

The first maintenance release of the 5.13 series of NAV is now out, and contains a security patch for a serious privilege escalation vulnerability in the web GUI. We recommend that all users upgrade as soon as possible.

The source code is available for download at GitHub.

New packages for Debian 12 (Bookworm) and 11 (Bullseye) are available in our APT repository.

Please be extra aware of config file changes, especially in ipdevpoll.conf. Look out for *.dpkg-dist files in /etc/nav and make sure to update your running config.

Security

• Lock down API access for unprivileged users

  By default, NAV granted full API access to logged-in users, regardless of their configured privilege level. This would give unprivileged users access to manipulate NAV configuration and even elevate their own user privileges to administrator level. Read the full security advisory here.

Changed

• Update NAPALM dependency to 5.0 to keep NAV web GUI working (#2358)

Fixed

• Fix filtering of ‘Last seen’ and sorting by ‘Last active’ in netbox interfaces view in room info (#3329)

Release notes

We always advise you to have a look at NAV’s accompanying release notes before upgrading.

Happy NAVing everyone!

The first feature release of the 5.13 series of NAV is now out!

The source code is available for download at GitHub.

New packages for Debian 12 (Bookworm) and 11 (Bullseye) are available in our APT repository.

Please be extra aware of config file changes, especially in ipdevpoll.conf. Look out for *.dpkg-dist files in /etc/nav and make sure to update your running config.

Security

• Omit Palo Alto API keys from ARP plugin log output (#3251)

Added

• Add option for showing OUI vendor name in Machine Tracker searches (#3292)
• Add cronjob for populating database with OUI data nightly (#3320)
• Run test suite by default on Python 3.11 and Django 4.2 (#2850)
• Added tests for device history search (#3261)

Changed

• Upgraded Django requirement to 4.2 (#2789)
• Upgraded and cleaned up various Docker environments used for development and testing to Debian Bookworm / Python 3.11 (#3284)

Fixed

• Fix minor incompatibilities with Django 4.2 (#2850)
• Fixed non-responsive search function in room map widget (#3207)
• Validate interval inputs in several search forms to avoid unhandled overflow errors (switch port activity, radius top talkers report, radius error log search, radius account log search) (#3242, #3245, #3246, #3247)
• Verify that multiple quarantine rules cannot be added with identical VLANs in Arnold (#3244)
• Fixed broken module history view in device history (#3258)
• Stop sending error mails to site admins from graphite-web proxy endpoint when graphite response code is in the 5XX range (#3259)
• Ignore case of sysname in IP device info (#3262)
• Add user-agent header when downloading OUI text file (#3291)

Release notes

We always advise you to have a look at NAV’s accompanying release notes before upgrading.

Happy NAVing everyone!

The first feature release of the 5.12 series of NAV is now out!

The source code is available for download at GitHub.

New packages for 11 (Bullseye) are available in our APT repository as usual. We haven’t started building packages for Debian 12 (Bookworm) yet, as NAV does not yet support running under Python 3.11.

Please be extra aware of config file changes, especially in ipdevpoll.conf. Look out for *.dpkg-dist files in /etc/nav and make sure to update your running config.

Removed

• Removed dependencies django-crispy-forms and crispy-forms-foundation (#2794)

Added

• Active maintenance tasks that only reference deleted components will be automatically cancelled (#3229)
• Alert profiles filter match value dropdowns now support interactive value searches (#3238)
• Added support for setting access port VLANs for Cisco Small Business switches in PortAdmin (by reverting to non-Cisco-specific handler routines for this subgroup of products) (#3249)

Changed

• Switched to building CSS from Sass using webpack instead of deprecated libsass. (#2849)
• Run tests using tox version 4 (#2973)
• The ipdevpoll plugin to fetch ARP cache data from a netbox’s Palo Alto firewall API is now configured through a new management profile type assigned to that netbox (#3147)
• The old-style setup.py script was removed and installation docs were updated (#3176)
• Ensure that CSRF token info is included in all forms that have been refactored to remove the django-crispy-forms dependency (#3157)

Fixed

• Alert profiles filter match value dropdowns now support more than the old hard limit of 1000 choices (#2908)
• Disable deletion of the default dashboard (#3150)
• Rooms and locations with periods in their IDs can now be properly retrieved from the corresponding API endpoints (#3186)
• Fix spurious crashing when loading some Netmap layer 3 views (#3225)
• Improve description of deleted maintenance components (#3228)
• Stop SNMP-based arp plugin from stepping on the paloaltoarp plugins toes. Note that this requires updating the plugin order in the ip2mac job in ipdevpoll.conf (#3252)
• Ensure that each account has exactly one default dashboard

Release notes

We always advise you to have a look at NAV’s accompanying release notes before upgrading.

Happy NAVing everyone!

The first feature release of the 5.11 series of NAV is now out!

The source code is available for download at GitHub.

New packages for 11 (Bullseye) are available in our APT repository as usual. We haven’t started building packages for Debian 12 (Bookworm) yet, as NAV does not yet support running under Python 3.11.

Please be extra aware of config file changes. Look out for *.dpkg-dist files in /etc/nav and make sure to update your running config.

Removed

• Dropped support for Python 3.7 (#2790)

Added

• Post lifecycle event when power supplies or fans are removed (#2982)
• Post lifecycle event when a module or chassis is deleted via the status or device history tools (#2983)
• Database model for representing Organizationally Unique Identifiers (OUI) to identify vendors for MAC addresses
• Script for populating database with OUIs and corresponding vendors from IEEE (#2945)
• Module for generating JWTs (#2948)
• Documentation for configuring and using JWT tokens in NAV API (#2618)

Changed

• Upgraded dependencies after dropping support for Python 3.7 (#2790)
• Changed Sphinx version to 7.4.7 (#2826)
• Changed required PostgreSQL version to 13 (#2892)
• Moved the test suite’s web crawler complexity away from the test discovery phase to the test phase itself. This reduces the number of generated test cases from N to 2 (where N is the number of reachable NAV pages) (#2966)
• Link to the doc for using docker for development from the README and mention what ports are used when using docker for development (#2978)
• Many user-facing forms of the web user interface have been refactored in order to remove a dependency that keeps NAV incompatible with Python 3.11. This should not affect looks or functionality. This work is still ongoing in the master branch and we hope it will be complete by NAV version 5.12.

Fixed

• Correctly delete an IP Device’s existing function value when empty field value is submitted in the IP Device IP Device edit form (#2269)
• Fixed crash bug when reordering filters within a filter group in Alert Profiles (#2979)
• Fixed IPAM API crash bug that caused unnecessary error reports sent as e-mail to site admins (#2989)
• Fixed bad tooltip grammar in ipdevinfo “degraded aggregate link” badge
• Make the test suite easier to run under MacOS
• Skip tests when 3rd party requirements are missing, instead of outright failing

Security

• Ensure that CSRF token info is preserved when refactoring crispy forms to non-crispy equivalents. This means that flat_form.html and _form_content.html templates will include CSRF token info if form method is set to POST. (#3056)

Release notes

We always advise you to have a look at NAV’s accompanying release notes before upgrading.

Happy NAVing everyone!

The second maintenance release of the 5.10 series of NAV is now out!

The source code is available for download at GitHub.

New packages for Debian 10 (Buster) and 11 (Bullseye) are available in our APT repository as usual. We haven’t started building packages for Debian 12 (Bookworm) yet, as NAV does not yet support running under Python 3.11.

Do note that 5.10 is the last series we will package for Debian 10, as NAV 5.11 will drop support for Python versions older than 3.9

Please be extra aware of config file changes. Look out for *.dpkg-dist files in /etc/nav and make sure to update your running config.

Changed

• snmptrapd renamed to navtrapd to avoid naming conflicts with Net-SNMP programs (#2926)

Fixed

• Replace incorrect fix for premature ARP record closure introduced in 5.10.1 (#2910)

Release notes

We always advise you to have a look at NAV’s accompanying release notes before upgrading.

Happy NAVing everyone!

The first maintenance release of the 5.10 series of NAV is now out!

The source code is available for download at GitHub.

New packages for Debian 10 (Buster) and 11 (Bullseye) are available in our APT repository as usual. We haven’t started building packages for Debian 12 (Bookworm) yet, as NAV does not yet support running under Python 3.11.

Do note that 5.10 is the last series we will package for Debian 10, as NAV 5.11 will drop support for Python versions older than 3.9

Please be extra aware of config file changes. Look out for *.dpkg-dist files in /etc/nav and make sure to update your running config.

Fixed

• Fix Machine Tracker DNS search crashing from exhausting all available file descriptors (#2669)
• ARP records of unreachable devices are now closed by navclean cron job at configurable expiry intervals, rather than immediately as a response to a short ICMP packet loss (#2913)
• Palo Alto API XML responses are now parsed based on keys instead of indexes (#2924)

Release notes

We always advise you to have a look at NAV’s accompanying release notes before upgrading.

Happy NAVing everyone!