Nautobot vs GitHub

3.2.0 and 2.4.38 shipped the same day in late July carrying CVE fixes that the notes state introduce breaking changes, most often surfacing as unexpected TypeError, AttributeError or KeyError for REST and GraphQL clients. The central change, from advisory GHSA-h8rv-c7c8-cvmx, is that the REST API now enforces object-level view permissions when traversing to related objects via ?depth — beyond depth 1 a related object the caller cannot view is reduced to id, object_type, url and display instead of being serialised in full. 3.2.0 also makes job_kwargs required for create_schedule, enqueue_job, execute_job and run_job_for_testing, with a temporary fallback that warns. 3.1.8 closed an authorization bypass letting a user self-approve a workflow, and 2.4.37 fixed stored XSS in Relationship and Module Family fields.

Nautobot is running two supported lines in parallel and treating them as equals: 3.2.2 and 2.4.39 both shipped on 3 August with the same many-to-many change-logging fix. The security work in this window is not incidental — the advisories cluster around authorization boundaries that the API had been permissive about, and closing them meant accepting a compatibility break rather than preserving behaviour. The documentation change acknowledging that managing a Git repository grants arbitrary code execution on the worker is the same instinct applied to expectations rather than code.

The job_kwargs fallback is explicitly temporary and warns when used, so its removal in a later release is the stated next step. Expect the paired 2.4.z and 3.x releases to continue landing together.