LoginSign Up
← Back to all sparks
N

Nautobot

INFRA · APIS
Velocity5.0

Network source of truth and network automation platform

networktocode.com/nautobot ↗

A security advisory cycle forced Nautobot to break its REST API on both supported branches at once.

network source of truthsecurity advisoriesbreaking api changesdual branchgraphql
◆Current state
3.2.0 and 2.4.38 shipped the same day in late July carrying CVE fixes that the notes state introduce breaking changes, most often surfacing as unexpected TypeError, AttributeError or KeyError for REST and GraphQL clients. The central change, from advisory GHSA-h8rv-c7c8-cvmx, is that the REST API now enforces object-level view permissions when traversing to related objects via ?depth — beyond depth 1 a related object the caller cannot view is reduced to id, object_type, url and display instead of being serialised in full. 3.2.0 also makes job_kwargs required for create_schedule, enqueue_job, execute_job and run_job_for_testing, with a temporary fallback that warns. 3.1.8 closed an authorization bypass letting a user self-approve a workflow, and 2.4.37 fixed stored XSS in Relationship and Module Family fields.
◆Where it's heading
Nautobot is running two supported lines in parallel and treating them as equals: 3.2.2 and 2.4.39 both shipped on 3 August with the same many-to-many change-logging fix. The security work in this window is not incidental — the advisories cluster around authorization boundaries that the API had been permissive about, and closing them meant accepting a compatibility break rather than preserving behaviour. The documentation change acknowledging that managing a Git repository grants arbitrary code execution on the worker is the same instinct applied to expectations rather than code.
◆Prediction
The job_kwargs fallback is explicitly temporary and warns when used, so its removal in a later release is the stated next step. Expect the paired 2.4.z and 3.x releases to continue landing together.

◆Recent moves

  1. 3d ago

    Cable termination filter and GraphQL OpenTelemetry corrections

    Adds a termination_id filter to CableFilterSet, extends many-to-many change logging so both associated objects get an entry, and corrects GraphQL OpenTelemetry spans to use semantic-convention keys and record the authenticated user rather than anonymous for API-token requests.

    View source ↗
  2. 4d ago

    Many-to-many change logging and GitRepository sync permissions

    The 2.4 branch's counterpart, shipped the same day: the same many-to-many change-logging fix plus restoration of missing change logs, webhooks and events for many-to-many records created via the REST API, and object-level permission enforcement on GitRepository sync.

    View source ↗
  3. 9d ago

    Public API constants and a widened cryptography range

    Two constants added to the public API and the acceptable cryptography version range widened to accommodate apps that do not yet support v49.

    View source ↗
  4. 11d ago

    REST API permission enforcement on related objects; job_kwargs required

    The 3.2 release, whose CVE fixes deliberately break compatibility: the REST API now enforces object-level view permissions when traversing related objects via ?depth, reducing unviewable objects to a brief representation, and job_kwargs becomes required across the job execution APIs with a temporary warning fallback.

    View source ↗
  5. 11d ago

    Security-driven breaking API changes on the 2.4 branch

    The same security-driven breaking changes applied to the 2.4 branch, so long-term-support deployments get the authorization fixes without moving to 3.x.

    View source ↗
  6. 14d ago

    Dependency updates mitigating CVEs

    Dependency updates only — npm development dependencies, Django, Pillow and gitpython moved forward to mitigate a list of CVEs.

    View source ↗