Merge c111c08315 into c6672538ac

Closes #20068: Enable defining profile attributes when importing module types

.github/ISSUE_TEMPLATE/01-feature_request.yaml

@@ -15,7 +15,7 @@ body:
     attributes:
       label: NetBox version
       description: What version of NetBox are you currently running?
-      placeholder: v4.4.6
+      placeholder: v4.4.7
     validations:
       required: true
   - type: dropdown

.github/ISSUE_TEMPLATE/02-bug_report.yaml

@@ -27,7 +27,7 @@ body:
     attributes:
       label: NetBox Version
       description: What version of NetBox are you currently running?
-      placeholder: v4.4.6
+      placeholder: v4.4.7
     validations:
       required: true
   - type: dropdown

contrib/generated_schema.json

@@ -186,6 +186,7 @@
                         "usb-3-micro-b",
                         "molex-micro-fit-1x2",
                         "molex-micro-fit-2x2",
+                        "molex-micro-fit-2x3",
                         "molex-micro-fit-2x4",
                         "dc-terminal",
                         "saf-d-grid",
@@ -293,6 +294,7 @@
                         "usb-c",
                         "molex-micro-fit-1x2",
                         "molex-micro-fit-2x2",
+                        "molex-micro-fit-2x3",
                         "molex-micro-fit-2x4",
                         "dc-terminal",
                         "eaton-c39",

docs/configuration/system.md

@@ -232,6 +232,9 @@ STORAGES = {
     },
     "scripts": {
         "BACKEND": "extras.storage.ScriptFileSystemStorage",
+        "OPTIONS": {
+            "allow_overwrite": True,
+        },
     },
 }
 ```
@@ -247,6 +250,7 @@ STORAGES = {
         "OPTIONS": { 
             'access_key': 'access key', 
             'secret_key': 'secret key',
+            "allow_overwrite": True,
         }
     }, 
 }

docs/customization/custom-scripts.md

@@ -95,7 +95,7 @@ An example fieldset definition is provided below:
 
 ```python
 class MyScript(Script):
-    class Meta:
+    class Meta(Script.Meta):
         fieldsets = (
             ('First group', ('field1', 'field2', 'field3')),
             ('Second group', ('field4', 'field5')),
@@ -510,7 +510,7 @@ from extras.scripts import *
 
 class NewBranchScript(Script):
 
-    class Meta:
+    class Meta(Script.Meta):
         name = "New Branch"
         description = "Provision a new branch site"
         field_order = ['site_name', 'switch_count', 'switch_model']

docs/development/models.md

@@ -12,7 +12,7 @@ Depending on its classification, each NetBox model may support various features
 
 | Feature                                                    | Feature Mixin           | Registry Key        | Description                                                                             |
 |------------------------------------------------------------|-------------------------|---------------------|-----------------------------------------------------------------------------------------|
-| [Bookmarks](../features/customization.md#bookmarks)        | `BookmarksMixin`        | `bookmarks`         | These models can be bookmarked natively in the user interface                           |
+| [Bookmarks](../features/user-preferences.md#bookmarks)     | `BookmarksMixin`        | `bookmarks`         | These models can be bookmarked natively in the user interface                           |
 | [Change logging](../features/change-logging.md)            | `ChangeLoggingMixin`    | `change_logging`    | Changes to these objects are automatically recorded in the change log                   |
 | Cloning                                                    | `CloningMixin`          | `cloning`           | Provides the `clone()` method to prepare a copy                                         |
 | [Contacts](../features/contacts.md)                        | `ContactsMixin`         | `contacts`          | Contacts can be associated with these models                                            |

docs/release-notes/version-4.4.md

@@ -1,5 +1,36 @@
 # NetBox v4.4
 
+## v4.4.7 (2025-11-25)
+
+### Enhancements
+
+* [#20371](https://github.com/netbox-community/netbox/issues/20371) - Add Molex Micro-Fit 2x3 for power ports & power outlets
+* [#20731](https://github.com/netbox-community/netbox/issues/20731) - Enable specifying `data_source` & `data_file` when bulk import config templates
+* [#20820](https://github.com/netbox-community/netbox/issues/20820) - Enable filtering of custom fields by object type
+* [#20823](https://github.com/netbox-community/netbox/issues/20823) - Disallow creation of API tokens with an expiration date in the past
+* [#20841](https://github.com/netbox-community/netbox/issues/20841) - Support advanced filtering for available rack types when creating/editing a rack
+
+### Bug Fixes
+
+* [#20134](https://github.com/netbox-community/netbox/issues/20134) - Prevent out-of-band HTMX content swaps in embedded tables
+* [#20432](https://github.com/netbox-community/netbox/issues/20432) - Fix tracing of cables across multiple circuits in parallel
+* [#20465](https://github.com/netbox-community/netbox/issues/20465) - Ensure that scripts are updated immediately when a new file is uploaded
+* [#20638](https://github.com/netbox-community/netbox/issues/20638) - Correct OpenAPI schema for bulk create operations
+* [#20649](https://github.com/netbox-community/netbox/issues/20649) - Enforce view permissions on REST API endpoint for custom scripts
+* [#20740](https://github.com/netbox-community/netbox/issues/20740) - Ensure permissions constraints are enforced when executing custom scripts via the REST API
+* [#20743](https://github.com/netbox-community/netbox/issues/20743) - Pass request context to custom script when triggered by an event rule
+* [#20766](https://github.com/netbox-community/netbox/issues/20766) - Fix inadvertent translations on server error page
+* [#20775](https://github.com/netbox-community/netbox/issues/20775) - Fix `TypeError` exception when bulk renaming unnamed devices
+* [#20822](https://github.com/netbox-community/netbox/issues/20822) - Add missing `auto_sync_enabled` field in bulk edit forms
+* [#20827](https://github.com/netbox-community/netbox/issues/20827) - Fix UI styling issue when toggling between light and dark mode
+* [#20839](https://github.com/netbox-community/netbox/issues/20839) - Fix filtering by object type in UI for custom links and saved filters
+* [#20840](https://github.com/netbox-community/netbox/issues/20840) - Remove extraneous references to airflow for RackType model
+* [#20844](https://github.com/netbox-community/netbox/issues/20844) - Fix object type filter for L2VPN terminations
+* [#20859](https://github.com/netbox-community/netbox/issues/20859) - Prevent dashboard crash due to exception raised by a widget
+* [#20865](https://github.com/netbox-community/netbox/issues/20865) - Enforce proper min/max values for latitude & longitude fields
+
+---
+
 ## v4.4.6 (2025-11-11)
 
 ### Enhancements

netbox/core/api/schema.py

@@ -12,6 +12,7 @@ from drf_spectacular.utils import Direction
 
 from netbox.api.fields import ChoiceField
 from netbox.api.serializers import WritableNestedSerializer
+from netbox.api.viewsets import NetBoxModelViewSet
 
 # see netbox.api.routers.NetBoxRouter
 BULK_ACTIONS = ("bulk_destroy", "bulk_partial_update", "bulk_update")
@@ -49,6 +50,11 @@ class ChoiceFieldFix(OpenApiSerializerFieldExtension):
             )
 
 
+def viewset_handles_bulk_create(view):
+    """Check if view automatically provides list-based bulk create"""
+    return isinstance(view, NetBoxModelViewSet)
+
+
 class NetBoxAutoSchema(AutoSchema):
     """
     Overrides to drf_spectacular.openapi.AutoSchema to fix following issues:
@@ -128,6 +134,36 @@ class NetBoxAutoSchema(AutoSchema):
 
         return response_serializers
 
+    def _get_request_for_media_type(self, serializer, direction='request'):
+        """
+        Override to generate oneOf schema for serializers that support both
+        single object and array input (NetBoxModelViewSet POST operations).
+
+        Refs: #20638
+        """
+        # Get the standard schema first
+        schema, required = super()._get_request_for_media_type(serializer, direction)
+
+        # If this serializer supports arrays (marked in get_request_serializer),
+        # wrap the schema in oneOf to allow single object OR array
+        if (
+            direction == 'request' and
+            schema is not None and
+            getattr(self.view, 'action', None) == 'create' and
+            viewset_handles_bulk_create(self.view)
+        ):
+            return {
+                'oneOf': [
+                    schema,  # Single object
+                    {
+                        'type': 'array',
+                        'items': schema,  # Array of objects
+                    }
+                ]
+            }, required
+
+        return schema, required
+
     def _get_serializer_name(self, serializer, direction, bypass_extensions=False) -> str:
         name = super()._get_serializer_name(serializer, direction, bypass_extensions)
 

netbox/core/tests/test_openapi_schema.py

@@ -0,0 +1,108 @@
+"""
+Unit tests for OpenAPI schema generation.
+
+Refs: #20638
+"""
+import json
+from django.test import TestCase
+
+
+class OpenAPISchemaTestCase(TestCase):
+    """Tests for OpenAPI schema generation."""
+
+    def setUp(self):
+        """Fetch schema via API endpoint."""
+        response = self.client.get('/api/schema/', {'format': 'json'})
+        self.assertEqual(response.status_code, 200)
+        self.schema = json.loads(response.content)
+
+    def test_post_operation_documents_single_or_array(self):
+        """
+        POST operations on NetBoxModelViewSet endpoints should document
+        support for both single objects and arrays via oneOf.
+
+        Refs: #20638
+        """
+        # Test representative endpoints across different apps
+        test_paths = [
+            '/api/core/data-sources/',
+            '/api/dcim/sites/',
+            '/api/users/users/',
+            '/api/ipam/ip-addresses/',
+        ]
+
+        for path in test_paths:
+            with self.subTest(path=path):
+                operation = self.schema['paths'][path]['post']
+
+                # Get the request body schema
+                request_schema = operation['requestBody']['content']['application/json']['schema']
+
+                # Should have oneOf with two options
+                self.assertIn('oneOf', request_schema, f"POST {path} should have oneOf schema")
+                self.assertEqual(
+                    len(request_schema['oneOf']), 2,
+                    f"POST {path} oneOf should have exactly 2 options"
+                )
+
+                # First option: single object (has $ref or properties)
+                single_schema = request_schema['oneOf'][0]
+                self.assertTrue(
+                    '$ref' in single_schema or 'properties' in single_schema,
+                    f"POST {path} first oneOf option should be single object"
+                )
+
+                # Second option: array of objects
+                array_schema = request_schema['oneOf'][1]
+                self.assertEqual(
+                    array_schema['type'], 'array',
+                    f"POST {path} second oneOf option should be array"
+                )
+                self.assertIn('items', array_schema, f"POST {path} array should have items")
+
+    def test_bulk_update_operations_require_array_only(self):
+        """
+        Bulk update/patch operations should require arrays only, not oneOf.
+        They don't support single object input.
+
+        Refs: #20638
+        """
+        test_paths = [
+            '/api/dcim/sites/',
+            '/api/users/users/',
+        ]
+
+        for path in test_paths:
+            for method in ['put', 'patch']:
+                with self.subTest(path=path, method=method):
+                    operation = self.schema['paths'][path][method]
+                    request_schema = operation['requestBody']['content']['application/json']['schema']
+
+                    # Should be array-only, not oneOf
+                    self.assertNotIn(
+                        'oneOf', request_schema,
+                        f"{method.upper()} {path} should NOT have oneOf (array-only)"
+                    )
+                    self.assertEqual(
+                        request_schema['type'], 'array',
+                        f"{method.upper()} {path} should require array"
+                    )
+                    self.assertIn(
+                        'items', request_schema,
+                        f"{method.upper()} {path} array should have items"
+                    )
+
+    def test_bulk_delete_requires_array(self):
+        """
+        Bulk delete operations should require arrays.
+
+        Refs: #20638
+        """
+        path = '/api/dcim/sites/'
+        operation = self.schema['paths'][path]['delete']
+        request_schema = operation['requestBody']['content']['application/json']['schema']
+
+        # Should be array-only
+        self.assertNotIn('oneOf', request_schema, "DELETE should NOT have oneOf")
+        self.assertEqual(request_schema['type'], 'array', "DELETE should require array")
+        self.assertIn('items', request_schema, "DELETE array should have items")

netbox/dcim/choices.py

@@ -461,6 +461,7 @@ class PowerPortTypeChoices(ChoiceSet):
     # Molex
     TYPE_MOLEX_MICRO_FIT_1X2 = 'molex-micro-fit-1x2'
     TYPE_MOLEX_MICRO_FIT_2X2 = 'molex-micro-fit-2x2'
+    TYPE_MOLEX_MICRO_FIT_2X3 = 'molex-micro-fit-2x3'
     TYPE_MOLEX_MICRO_FIT_2X4 = 'molex-micro-fit-2x4'
     # Direct current (DC)
     TYPE_DC = 'dc-terminal'
@@ -588,6 +589,7 @@ class PowerPortTypeChoices(ChoiceSet):
         ('Molex', (
             (TYPE_MOLEX_MICRO_FIT_1X2, 'Molex Micro-Fit 1x2'),
             (TYPE_MOLEX_MICRO_FIT_2X2, 'Molex Micro-Fit 2x2'),
+            (TYPE_MOLEX_MICRO_FIT_2X3, 'Molex Micro-Fit 2x3'),
             (TYPE_MOLEX_MICRO_FIT_2X4, 'Molex Micro-Fit 2x4'),
         )),
         ('DC', (
@@ -710,6 +712,7 @@ class PowerOutletTypeChoices(ChoiceSet):
     # Molex
     TYPE_MOLEX_MICRO_FIT_1X2 = 'molex-micro-fit-1x2'
     TYPE_MOLEX_MICRO_FIT_2X2 = 'molex-micro-fit-2x2'
+    TYPE_MOLEX_MICRO_FIT_2X3 = 'molex-micro-fit-2x3'
     TYPE_MOLEX_MICRO_FIT_2X4 = 'molex-micro-fit-2x4'
     # Direct current (DC)
     TYPE_DC = 'dc-terminal'
@@ -831,6 +834,7 @@ class PowerOutletTypeChoices(ChoiceSet):
         ('Molex', (
             (TYPE_MOLEX_MICRO_FIT_1X2, 'Molex Micro-Fit 1x2'),
             (TYPE_MOLEX_MICRO_FIT_2X2, 'Molex Micro-Fit 2x2'),
+            (TYPE_MOLEX_MICRO_FIT_2X3, 'Molex Micro-Fit 2x3'),
             (TYPE_MOLEX_MICRO_FIT_2X4, 'Molex Micro-Fit 2x4'),
         )),
         ('DC', (

netbox/dcim/forms/bulk_import.py

@@ -5,6 +5,7 @@ from django.core.exceptions import ObjectDoesNotExist
 from django.utils.safestring import mark_safe
 from django.utils.translation import gettext_lazy as _
 
+from circuits.models import Circuit
 from dcim.choices import *
 from dcim.constants import *
 from dcim.models import *
@@ -472,14 +473,30 @@ class ModuleTypeImportForm(NetBoxModelImportForm):
         required=False,
         help_text=_('Unit for module weight')
     )
+    attribute_data = forms.JSONField(
+        label=_('Attributes'),
+        required=False,
+        help_text=_('Attribute values for the assigned profile, passed as a dictionary')
+    )
 
     class Meta:
         model = ModuleType
         fields = [
             'manufacturer', 'model', 'part_number', 'description', 'airflow', 'weight', 'weight_unit', 'profile',
-            'comments', 'tags'
+            'attribute_data', 'comments', 'tags',
         ]
 
+    def clean(self):
+        super().clean()
+
+        # Attribute data may be included only if a profile is specified
+        if self.cleaned_data.get('attribute_data') and not self.cleaned_data.get('profile'):
+            raise forms.ValidationError(_("Profile must be specified if attribute data is provided."))
+
+        # Default attribute_data to an empty dictionary if a profile is specified (to enforce schema validation)
+        if self.cleaned_data.get('profile') and not self.cleaned_data.get('attribute_data'):
+            self.cleaned_data['attribute_data'] = {}
+
 
 class DeviceRoleImportForm(NetBoxModelImportForm):
     parent = CSVModelChoiceField(
@@ -1398,19 +1415,52 @@ class MACAddressImportForm(NetBoxModelImportForm):
 #
 
 class CableImportForm(NetBoxModelImportForm):
+    """
+    CSV bulk import form for cables.
+
+    Supports dynamic parent model resolution - terminations are identified by their parent
+    object (device, circuit, or power panel) and termination name.
+
+    The parent field resolves to different models based on the termination type
+    See CABLE_PARENT_MAPPING for supported termination types.
+    """
+
+    # Map cable termination content types to their parent model and lookup field.
+    #
+    # This mapping enables dynamic parent model resolution during cable CSV imports.
+    # Each entry maps a termination type to a tuple of (parent_content_type, accessor):
+    #
+    # Format: 'app.model': ('parent_app.ParentModel', 'accessor')
+    #
+    CABLE_PARENT_MAPPING = {
+        'dcim.interface': ('dcim.Device', 'name'),
+        'dcim.consoleport': ('dcim.Device', 'name'),
+        'dcim.consoleserverport': ('dcim.Device', 'name'),
+        'dcim.powerport': ('dcim.Device', 'name'),
+        'dcim.poweroutlet': ('dcim.Device', 'name'),
+        'dcim.frontport': ('dcim.Device', 'name'),
+        'dcim.rearport': ('dcim.Device', 'name'),
+        'circuits.circuittermination': ('circuits.Circuit', 'cid'),
+        'dcim.powerfeed': ('dcim.PowerPanel', 'name'),
+    }
+    # Map parent model name to (parent_field_name, termination_name_field, value_transform)
+    TERMINATION_FIELDS = {
+        'Circuit': ('circuit', 'term_side', str.upper),
+        'Device': ('device', 'name', None),
+        'PowerPanel': ('power_panel', 'name', None),
+    }
+
     # Termination A
     side_a_site = CSVModelChoiceField(
         label=_('Side A site'),
         queryset=Site.objects.all(),
         required=False,
         to_field_name='name',
-        help_text=_('Site of parent device A (if any)'),
+        help_text=_('Site of parent A (if any)')
     )
-    side_a_device = CSVModelChoiceField(
-        label=_('Side A device'),
-        queryset=Device.objects.all(),
-        to_field_name='name',
-        help_text=_('Device name')
+    side_a_parent = forms.CharField(
+        label=_('Side A parent'),
+        help_text=_('Device name, Circuit CID, or Power Panel name')
     )
     side_a_type = CSVContentTypeField(
         label=_('Side A type'),
@@ -1429,13 +1479,11 @@ class CableImportForm(NetBoxModelImportForm):
         queryset=Site.objects.all(),
         required=False,
         to_field_name='name',
-        help_text=_('Site of parent device B (if any)'),
+        help_text=_('Site of parent B (if any)')
     )
-    side_b_device = CSVModelChoiceField(
-        label=_('Side B device'),
-        queryset=Device.objects.all(),
-        to_field_name='name',
-        help_text=_('Device name')
+    side_b_parent = forms.CharField(
+        label=_('Side B parent'),
+        help_text=_('Device name, Circuit CID, or Power Panel name')
     )
     side_b_type = CSVContentTypeField(
         label=_('Side B type'),
@@ -1484,7 +1532,7 @@ class CableImportForm(NetBoxModelImportForm):
     class Meta:
         model = Cable
         fields = [
-            'side_a_site', 'side_a_device', 'side_a_type', 'side_a_name', 'side_b_site', 'side_b_device', 'side_b_type',
+            'side_a_site', 'side_a_parent', 'side_a_type', 'side_a_name', 'side_b_site', 'side_b_parent', 'side_b_type',
             'side_b_name', 'type', 'status', 'tenant', 'label', 'color', 'length', 'length_unit', 'description',
             'comments', 'tags',
         ]
@@ -1492,21 +1540,6 @@ class CableImportForm(NetBoxModelImportForm):
     def __init__(self, data=None, *args, **kwargs):
         super().__init__(data, *args, **kwargs)
 
-        if data:
-            # Limit choices for side_a_device to the assigned side_a_site
-            if side_a_site := data.get('side_a_site'):
-                side_a_device_params = {f'site__{self.fields["side_a_site"].to_field_name}': side_a_site}
-                self.fields['side_a_device'].queryset = self.fields['side_a_device'].queryset.filter(
-                    **side_a_device_params
-                )
-
-            # Limit choices for side_b_device to the assigned side_b_site
-            if side_b_site := data.get('side_b_site'):
-                side_b_device_params = {f'site__{self.fields["side_b_site"].to_field_name}': side_b_site}
-                self.fields['side_b_device'].queryset = self.fields['side_b_device'].queryset.filter(
-                    **side_b_device_params
-                )
-
     def _clean_side(self, side):
         """
         Derive a Cable's A/B termination objects.
@@ -1515,31 +1548,118 @@ class CableImportForm(NetBoxModelImportForm):
         """
         assert side in 'ab', f"Invalid side designation: {side}"
 
-        device = self.cleaned_data.get(f'side_{side}_device')
         content_type = self.cleaned_data.get(f'side_{side}_type')
+        site = self.cleaned_data.get(f'side_{side}_site')
+        parent_value = self.cleaned_data.get(f'side_{side}_parent')
         name = self.cleaned_data.get(f'side_{side}_name')
-        if not device or not content_type or not name:
+
+        if not parent_value or not content_type or not name:  # pragma: no cover
             return None
 
-        model = content_type.model_class()
+        # Get the parent model mapping from the submitted content_type
+        parent_map = self.CABLE_PARENT_MAPPING.get(f'{content_type.app_label}.{content_type.model}')
+        # This should never happen
+        assert parent_map, (
+            'Unknown cable termination content type parent mapping: '
+            f'{content_type.app_label}.{content_type.model}'
+        )
+
+        parent_content_type, parent_accessor = parent_map
+        parent_app_label, parent_model_name = parent_content_type.split('.')
+
+        # Get the parent model class
         try:
-            if device.virtual_chassis and device.virtual_chassis.master == device and \
-                    model.objects.filter(device=device, name=name).count() == 0:
-                termination_object = model.objects.get(device__in=device.virtual_chassis.members.all(), name=name)
-            else:
-                termination_object = model.objects.get(device=device, name=name)
-            if termination_object.cable is not None and termination_object.cable != self.instance:
-                raise forms.ValidationError(
-                    _("Side {side_upper}: {device} {termination_object} is already connected").format(
-                        side_upper=side.upper(), device=device, termination_object=termination_object
-                    )
-                )
-        except ObjectDoesNotExist:
+            parent_ct = ContentType.objects.get(app_label=parent_app_label.lower(), model=parent_model_name.lower())
+            parent_model: Device | PowerPanel | Circuit = parent_ct.model_class()
+        except ContentType.DoesNotExist:  # pragma: no cover
+            # This should never happen
+            raise AssertionError(f'Unknown cable termination parent content type: {parent_content_type}')
+
+        # Build query for parent lookup
+        parent_query = {parent_accessor: parent_value}
+        # Add site to query if provided
+        if site:
+            parent_query['site'] = site
+
+        # Look up the parent object
+        try:
+            parent_object = parent_model.objects.get(**parent_query)
+        except parent_model.DoesNotExist:
             raise forms.ValidationError(
-                _("{side_upper} side termination not found: {device} {name}").format(
-                    side_upper=side.upper(), device=device, name=name
+                _('Side {side_upper}: {model_name} not found: {value}').format(
+                    side_upper=side.upper(), model_name=parent_model.__name__, value=parent_value
                 )
             )
+        except parent_model.MultipleObjectsReturned:
+            raise forms.ValidationError(
+                _('Side {side_upper}: Multiple {model_name} objects found: {value}').format(
+                    side_upper=side.upper(), model_name=parent_model.__name__, value=parent_value
+                )
+            )
+
+        # Get the termination model class
+        termination_model = content_type.model_class()
+
+        # Build the query to find the termination object
+        field_mapping = self.TERMINATION_FIELDS.get(parent_model.__name__)
+        if not field_mapping:  # pragma: no cover
+            return None
+
+        parent_field, name_field, value_transform = field_mapping
+        query = {parent_field: parent_object}
+
+        if value_transform:
+            name = value_transform(name)
+
+        if name:
+            query[name_field] = name
+
+        # Add site to query if provided (for site-scoped parents)
+        if site and parent_field in ('device', 'power_panel'):
+            query[f'{parent_field}__site'] = site
+
+        # Look up the termination object
+        try:
+            # Handle virtual chassis for device-based terminations
+            if (parent_field == 'device' and
+                parent_object.virtual_chassis and
+                parent_object.virtual_chassis.master == parent_object and
+                termination_model.objects.filter(**query).count() == 0):
+                query[f'{parent_field}__in'] = parent_object.virtual_chassis.members.all()
+                query.pop(parent_field, None)
+                termination_object = termination_model.objects.get(**query)
+            else:
+                termination_object = termination_model.objects.get(**query)
+
+            # Check if already connected to a cable
+            if termination_object.cable is not None and termination_object.cable != self.instance:
+                raise forms.ValidationError(
+                    _('Side {side_upper}: {parent} {termination} is already connected').format(
+                        side_upper=side.upper(), parent=parent_object, termination=termination_object
+                    )
+                )
+
+            # Circuit terminations can also be connected to provider networks
+            if (name_field == 'term_side' and
+                hasattr(termination_object, '_provider_network') and
+                termination_object._provider_network is not None):
+                raise forms.ValidationError(
+                    _('Side {side_upper}: {parent} {termination} is already connected to a provider network').format(
+                        side_upper=side.upper(), parent=parent_object, termination=termination_object
+                    )
+                )
+        except termination_model.DoesNotExist:
+            raise forms.ValidationError(
+                _('Side {side_upper}: {model_name} not found: {parent} {name}').format(
+                    side_upper=side.upper(),
+                    model_name=termination_model.__name__,
+                    parent=parent_object, name=name or '',
+                ),
+            )
+        except termination_model.MultipleObjectsReturned:  # pragma: no cover
+            # This should never happen
+            raise AssertionError('Multiple termination objects returned for query: {query}'.format(query=query))
+
         setattr(self.instance, f'{side}_terminations', [termination_object])
         return termination_object
 

netbox/dcim/forms/filtersets.py

@@ -278,11 +278,6 @@ class RackBaseFilterForm(NetBoxModelFilterSetForm):
             choices=BOOLEAN_WITH_BLANK_CHOICES
         )
     )
-    airflow = forms.MultipleChoiceField(
-        label=_('Airflow'),
-        choices=add_blank_choice(RackAirflowChoices),
-        required=False
-    )
     weight = forms.DecimalField(
         label=_('Weight'),
         required=False,
@@ -381,6 +376,11 @@ class RackFilterForm(TenancyFilterForm, ContactModelFilterForm, RackBaseFilterFo
         },
         label=_('Rack type')
     )
+    airflow = forms.MultipleChoiceField(
+        label=_('Airflow'),
+        choices=add_blank_choice(RackAirflowChoices),
+        required=False
+    )
     serial = forms.CharField(
         label=_('Serial'),
         required=False

netbox/dcim/forms/model_forms.py

@@ -269,7 +269,8 @@ class RackForm(TenancyForm, NetBoxModelForm):
         label=_('Rack Type'),
         queryset=RackType.objects.all(),
         required=False,
-        help_text=_("Select a pre-defined rack type, or set physical characteristics below.")
+        selector=True,
+        help_text=_("Select a pre-defined rack type, or set physical characteristics below."),
     )
     comments = CommentField()
 

netbox/dcim/migrations/0216_latitude_longitude_validators.py

@@ -0,0 +1,69 @@
+import decimal
+
+import django.core.validators
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ('dcim', '0215_rackreservation_status'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='device',
+            name='latitude',
+            field=models.DecimalField(
+                blank=True,
+                decimal_places=6,
+                max_digits=8,
+                null=True,
+                validators=[
+                    django.core.validators.MinValueValidator(decimal.Decimal('-90.0')),
+                    django.core.validators.MaxValueValidator(decimal.Decimal('90.0'))
+                ],
+            ),
+        ),
+        migrations.AlterField(
+            model_name='device',
+            name='longitude',
+            field=models.DecimalField(
+                blank=True,
+                decimal_places=6,
+                max_digits=9,
+                null=True,
+                validators=[
+                    django.core.validators.MinValueValidator(decimal.Decimal('-180.0')),
+                    django.core.validators.MaxValueValidator(decimal.Decimal('180.0'))
+                ],
+            ),
+        ),
+        migrations.AlterField(
+            model_name='site',
+            name='latitude',
+            field=models.DecimalField(
+                blank=True,
+                decimal_places=6,
+                max_digits=8,
+                null=True,
+                validators=[
+                    django.core.validators.MinValueValidator(decimal.Decimal('-90.0')),
+                    django.core.validators.MaxValueValidator(decimal.Decimal('90.0'))
+                ],
+            ),
+        ),
+        migrations.AlterField(
+            model_name='site',
+            name='longitude',
+            field=models.DecimalField(
+                blank=True,
+                decimal_places=6,
+                max_digits=9,
+                null=True,
+                validators=[
+                    django.core.validators.MinValueValidator(decimal.Decimal('-180.0')),
+                    django.core.validators.MaxValueValidator(decimal.Decimal('180.0'))
+                ],
+            ),
+        ),
+    ]

netbox/dcim/models/cables.py

@@ -10,6 +10,7 @@ from django.utils.translation import gettext_lazy as _
 from core.models import ObjectType
 from dcim.choices import *
 from dcim.constants import *
+from dcim.exceptions import UnsupportedCablePath
 from dcim.fields import PathField
 from dcim.utils import decompile_path_node, object_to_path_node
 from netbox.choices import ColorChoices
@@ -28,8 +29,6 @@ __all__ = (
     'CableTermination',
 )
 
-from ..exceptions import UnsupportedCablePath
-
 trace_paths = Signal()
 
 
@@ -615,7 +614,7 @@ class CablePath(models.Model):
         Cable or WirelessLink connects (interfaces, console ports, circuit termination, etc.). All terminations must be
         of the same type and must belong to the same parent object.
         """
-        from circuits.models import CircuitTermination
+        from circuits.models import CircuitTermination, Circuit
 
         if not terminations:
             return None
@@ -637,8 +636,11 @@ class CablePath(models.Model):
                 raise UnsupportedCablePath(_("All mid-span terminations must have the same termination type"))
 
             # All mid-span terminations must all be attached to the same device
-            if (not isinstance(terminations[0], PathEndpoint) and not
-                    all(t.parent_object == terminations[0].parent_object for t in terminations[1:])):
+            if (
+                not isinstance(terminations[0], PathEndpoint) and
+                not isinstance(terminations[0].parent_object, Circuit) and
+                not all(t.parent_object == terminations[0].parent_object for t in terminations[1:])
+            ):
                 raise UnsupportedCablePath(_("All mid-span terminations must have the same parent object"))
 
             # Check for a split path (e.g. rear port fanning out to multiple front ports with
@@ -782,32 +784,39 @@ class CablePath(models.Model):
 
             elif isinstance(remote_terminations[0], CircuitTermination):
                 # Follow a CircuitTermination to its corresponding CircuitTermination (A to Z or vice versa)
-                if len(remote_terminations) > 1:
-                    is_split = True
+                qs = Q()
+                for remote_termination in remote_terminations:
+                    qs |= Q(
+                        circuit=remote_termination.circuit,
+                        term_side='Z' if remote_termination.term_side == 'A' else 'A'
+                    )
+
+                # Get all circuit terminations
+                circuit_terminations = CircuitTermination.objects.filter(qs)
+
+                if not circuit_terminations.exists():
                     break
-                circuit_termination = CircuitTermination.objects.filter(
-                    circuit=remote_terminations[0].circuit,
-                    term_side='Z' if remote_terminations[0].term_side == 'A' else 'A'
-                ).first()
-                if circuit_termination is None:
-                    break
-                elif circuit_termination._provider_network:
+                elif all([ct._provider_network for ct in circuit_terminations]):
                     # Circuit terminates to a ProviderNetwork
                     path.extend([
-                        [object_to_path_node(circuit_termination)],
-                        [object_to_path_node(circuit_termination._provider_network)],
+                        [object_to_path_node(ct) for ct in circuit_terminations],
+                        [object_to_path_node(ct._provider_network) for ct in circuit_terminations],
                     ])
                     is_complete = True
                     break
-                elif circuit_termination.termination and not circuit_termination.cable:
+                elif all([ct.termination and not ct.cable for ct in circuit_terminations]):
                     # Circuit terminates to a Region/Site/etc.
                     path.extend([
-                        [object_to_path_node(circuit_termination)],
-                        [object_to_path_node(circuit_termination.termination)],
+                        [object_to_path_node(ct) for ct in circuit_terminations],
+                        [object_to_path_node(ct.termination) for ct in circuit_terminations],
                     ])
                     break
+                elif any([ct.cable in links for ct in circuit_terminations]):
+                    # No valid path
+                    is_split = True
+                    break
 
-                terminations = [circuit_termination]
+                terminations = circuit_terminations
 
             else:
                 # Check for non-symmetric path

netbox/dcim/models/devices.py

@@ -646,6 +646,10 @@ class Device(
         decimal_places=6,
         blank=True,
         null=True,
+        validators=[
+            MinValueValidator(decimal.Decimal('-90.0')),
+            MaxValueValidator(decimal.Decimal('90.0'))
+        ],
         help_text=_("GPS coordinate in decimal format (xx.yyyyyy)")
     )
     longitude = models.DecimalField(
@@ -654,6 +658,10 @@ class Device(
         decimal_places=6,
         blank=True,
         null=True,
+        validators=[
+            MinValueValidator(decimal.Decimal('-180.0')),
+            MaxValueValidator(decimal.Decimal('180.0'))
+        ],
         help_text=_("GPS coordinate in decimal format (xx.yyyyyy)")
     )
     services = GenericRelation(

netbox/dcim/models/sites.py

@@ -1,5 +1,8 @@
+import decimal
+
 from django.contrib.contenttypes.fields import GenericRelation
 from django.core.exceptions import ValidationError
+from django.core.validators import MaxValueValidator, MinValueValidator
 from django.db import models
 from django.utils.translation import gettext_lazy as _
 from timezone_field import TimeZoneField
@@ -210,6 +213,10 @@ class Site(ContactsMixin, ImageAttachmentsMixin, PrimaryModel):
         decimal_places=6,
         blank=True,
         null=True,
+        validators=[
+            MinValueValidator(decimal.Decimal('-90.0')),
+            MaxValueValidator(decimal.Decimal('90.0'))
+        ],
         help_text=_('GPS coordinate in decimal format (xx.yyyyyy)')
     )
     longitude = models.DecimalField(
@@ -218,6 +225,10 @@ class Site(ContactsMixin, ImageAttachmentsMixin, PrimaryModel):
         decimal_places=6,
         blank=True,
         null=True,
+        validators=[
+            MinValueValidator(decimal.Decimal('-180.0')),
+            MaxValueValidator(decimal.Decimal('180.0'))
+        ],
         help_text=_('GPS coordinate in decimal format (xx.yyyyyy)')
     )
 

netbox/dcim/tables/racks.py

@@ -100,7 +100,7 @@ class RackTypeTable(NetBoxTable):
         model = RackType
         fields = (
             'pk', 'id', 'model', 'manufacturer', 'form_factor', 'u_height', 'starting_unit', 'width', 'outer_width',
-            'outer_height', 'outer_depth', 'mounting_depth', 'airflow', 'weight', 'max_weight', 'description',
+            'outer_height', 'outer_depth', 'mounting_depth', 'weight', 'max_weight', 'description',
             'comments', 'instance_count', 'tags', 'created', 'last_updated',
         )
         default_columns = (

netbox/dcim/tests/test_cablepaths.py

@@ -2270,6 +2270,80 @@ class CablePathTestCase(TestCase):
         CableTraceSVG(interface1).render()
         CableTraceSVG(interface2).render()
 
+    def test_223_interface_to_interface_via_multiple_circuit_terminations(self):
+        provider = Provider.objects.first()
+        circuit_type = CircuitType.objects.first()
+        circuit1 = self.circuit
+        circuit2 = Circuit.objects.create(provider=provider, type=circuit_type, cid='Circuit 2')
+        interface1 = Interface.objects.create(device=self.device, name='Interface 1')
+        interface2 = Interface.objects.create(device=self.device, name='Interface 2')
+        circuittermination1_A = CircuitTermination.objects.create(
+            circuit=circuit1,
+            termination=self.site,
+            term_side='A'
+        )
+        circuittermination1_Z = CircuitTermination.objects.create(
+            circuit=circuit1,
+            termination=self.site,
+            term_side='Z'
+        )
+        circuittermination2_A = CircuitTermination.objects.create(
+            circuit=circuit2,
+            termination=self.site,
+            term_side='A'
+        )
+        circuittermination2_Z = CircuitTermination.objects.create(
+            circuit=circuit2,
+            termination=self.site,
+            term_side='Z'
+        )
+
+        # Create cables
+        cable1 = Cable(
+            a_terminations=[interface1],
+            b_terminations=[circuittermination1_A, circuittermination2_A]
+        )
+        cable2 = Cable(
+            a_terminations=[interface2],
+            b_terminations=[circuittermination1_Z, circuittermination2_Z]
+        )
+        cable1.save()
+        cable2.save()
+
+        self.assertEqual(CablePath.objects.count(), 2)
+
+        path1 = self.assertPathExists(
+            (
+                interface1,
+                cable1,
+                (circuittermination1_A, circuittermination2_A),
+                (circuittermination1_Z, circuittermination2_Z),
+                cable2,
+                interface2
+
+            ),
+            is_active=True,
+            is_complete=True,
+        )
+        interface1.refresh_from_db()
+        self.assertPathIsSet(interface1, path1)
+
+        path2 = self.assertPathExists(
+            (
+                interface2,
+                cable2,
+                (circuittermination1_Z, circuittermination2_Z),
+                (circuittermination1_A, circuittermination2_A),
+                cable1,
+                interface1
+
+            ),
+            is_active=True,
+            is_complete=True,
+        )
+        interface2.refresh_from_db()
+        self.assertPathIsSet(interface2, path2)
+
     def test_301_create_path_via_existing_cable(self):
         """
         [IF1] --C1-- [FP1] [RP1] --C2-- [RP2] [FP2] --C3-- [IF2]
@@ -2510,3 +2584,33 @@ class CablePathTestCase(TestCase):
             is_active=True
         )
         self.assertEqual(CablePath.objects.count(), 0)
+
+    def test_402_exclude_circuit_loopback(self):
+        interface = Interface.objects.create(device=self.device, name='Interface 1')
+        circuittermination1 = CircuitTermination.objects.create(
+            circuit=self.circuit,
+            termination=self.site,
+            term_side='A'
+        )
+        circuittermination2 = CircuitTermination.objects.create(
+            circuit=self.circuit,
+            termination=self.site,
+            term_side='Z'
+        )
+
+        # Create cables
+        cable = Cable(
+            a_terminations=[interface],
+            b_terminations=[circuittermination1, circuittermination2]
+        )
+        cable.save()
+
+        path = self.assertPathExists(
+            (interface, cable, (circuittermination1, circuittermination2)),
+            is_active=True,
+            is_complete=False,
+            is_split=True
+        )
+        self.assertEqual(CablePath.objects.count(), 1)
+        interface.refresh_from_db()
+        self.assertPathIsSet(interface, path)

netbox/dcim/tests/test_forms.py

@@ -1,8 +1,9 @@
 from django.test import TestCase
 
+from circuits.models import Circuit, CircuitTermination, CircuitType, Provider, ProviderNetwork
 from dcim.choices import (
-    DeviceFaceChoices, DeviceStatusChoices, InterfaceModeChoices, InterfaceTypeChoices, PortTypeChoices,
-    PowerOutletStatusChoices,
+    CableTypeChoices, DeviceFaceChoices, DeviceStatusChoices, InterfaceModeChoices, InterfaceTypeChoices,
+    PortTypeChoices, PowerOutletStatusChoices,
 )
 from dcim.forms import *
 from dcim.models import *
@@ -411,3 +412,204 @@ class InterfaceTestCase(TestCase):
         self.assertNotIn('untagged_vlan', form.cleaned_data.keys())
         self.assertNotIn('tagged_vlans', form.cleaned_data.keys())
         self.assertNotIn('qinq_svlan', form.cleaned_data.keys())
+
+
+class CableImportFormTestCase(TestCase):
+    """
+    Test cases for CableImportForm error handling and edge cases.
+
+    Note: Happy path scenarios (successful cable creation) are covered by
+    dcim.tests.test_views.CableTestCase which tests the bulk import view.
+    These tests focus on validation errors and edge cases not covered by the view tests.
+    """
+
+    @classmethod
+    def setUpTestData(cls):
+        # Create sites
+        cls.site_a = Site.objects.create(name='Site A', slug='site-a')
+        cls.site_b = Site.objects.create(name='Site B', slug='site-b')
+
+        # Create manufacturer and device type
+        manufacturer = Manufacturer.objects.create(name='Manufacturer 1', slug='manufacturer-1')
+        device_type = DeviceType.objects.create(
+            manufacturer=manufacturer,
+            model='Device Type 1',
+            slug='device-type-1',
+        )
+        role = DeviceRole.objects.create(name='Device Role 1', slug='device-role-1', color='ff0000')
+
+        # Create devices
+        cls.device_a1 = Device.objects.create(
+            name='Device-A1',
+            device_type=device_type,
+            role=role,
+            site=cls.site_a,
+        )
+        cls.device_a2 = Device.objects.create(
+            name='Device-A2',
+            device_type=device_type,
+            role=role,
+            site=cls.site_a,
+        )
+        # Device with same name in different site
+        cls.device_b_duplicate = Device.objects.create(
+            name='Device-A1',  # Same name as device_a1
+            device_type=device_type,
+            role=role,
+            site=cls.site_b,
+        )
+
+        # Create interfaces
+        cls.interface_a1_eth0 = Interface.objects.create(
+            device=cls.device_a1,
+            name='eth0',
+            type=InterfaceTypeChoices.TYPE_1GE_FIXED,
+        )
+        cls.interface_a2_eth0 = Interface.objects.create(
+            device=cls.device_a2,
+            name='eth0',
+            type=InterfaceTypeChoices.TYPE_1GE_FIXED,
+        )
+
+        # Create circuit for testing circuit not found error
+        provider = Provider.objects.create(name='Provider 1', slug='provider-1')
+        circuit_type = CircuitType.objects.create(name='Circuit Type 1', slug='circuit-type-1')
+        cls.circuit = Circuit.objects.create(
+            provider=provider,
+            type=circuit_type,
+            cid='CIRCUIT-001',
+        )
+        cls.circuit_term_a = CircuitTermination.objects.create(
+            circuit=cls.circuit,
+            term_side='A',
+        )
+
+        # Create provider network for testing provider network validation
+        cls.provider_network = ProviderNetwork.objects.create(
+            provider=provider,
+            name='Provider Network 1',
+        )
+
+    def test_device_not_found(self):
+        """Test error when parent device is not found."""
+        form = CableImportForm(data={
+            'side_a_site': 'Site A',
+            'side_a_parent': 'NonexistentDevice',
+            'side_a_type': 'dcim.interface',
+            'side_a_name': 'eth0',
+            'side_b_site': 'Site A',
+            'side_b_parent': 'Device-A2',
+            'side_b_type': 'dcim.interface',
+            'side_b_name': 'eth0',
+            'type': CableTypeChoices.TYPE_CAT6,
+            'status': 'connected',
+        })
+        self.assertFalse(form.is_valid())
+        self.assertIn('Side A: Device not found: NonexistentDevice', str(form.errors))
+
+    def test_circuit_not_found(self):
+        """Test error when circuit is not found."""
+        form = CableImportForm(data={
+            'side_a_site': None,
+            'side_a_parent': 'NONEXISTENT-CID',
+            'side_a_type': 'circuits.circuittermination',
+            'side_a_name': 'A',
+            'side_b_site': 'Site A',
+            'side_b_parent': 'Device-A1',
+            'side_b_type': 'dcim.interface',
+            'side_b_name': 'eth0',
+            'type': CableTypeChoices.TYPE_MMF_OM4,
+            'status': 'connected',
+        })
+        self.assertFalse(form.is_valid())
+        self.assertIn('Side A: Circuit not found: NONEXISTENT-CID', str(form.errors))
+
+    def test_termination_not_found(self):
+        """Test error when termination is not found on parent."""
+        form = CableImportForm(data={
+            'side_a_site': 'Site A',
+            'side_a_parent': 'Device-A1',
+            'side_a_type': 'dcim.interface',
+            'side_a_name': 'eth999',  # Nonexistent interface
+            'side_b_site': 'Site A',
+            'side_b_parent': 'Device-A2',
+            'side_b_type': 'dcim.interface',
+            'side_b_name': 'eth0',
+            'type': CableTypeChoices.TYPE_CAT6,
+            'status': 'connected',
+        })
+        self.assertFalse(form.is_valid())
+        self.assertIn('Side A: Interface not found', str(form.errors))
+
+    def test_termination_already_cabled(self):
+        """Test error when termination is already connected to a cable."""
+        # Create an existing cable
+        existing_cable = Cable.objects.create(type=CableTypeChoices.TYPE_CAT6, status='connected')
+        self.interface_a1_eth0.cable = existing_cable
+        self.interface_a1_eth0.save()
+
+        form = CableImportForm(data={
+            'side_a_site': 'Site A',
+            'side_a_parent': 'Device-A1',
+            'side_a_type': 'dcim.interface',
+            'side_a_name': 'eth0',
+            'side_b_site': 'Site A',
+            'side_b_parent': 'Device-A2',
+            'side_b_type': 'dcim.interface',
+            'side_b_name': 'eth0',
+            'type': CableTypeChoices.TYPE_CAT6,
+            'status': 'connected',
+        })
+        self.assertFalse(form.is_valid())
+        self.assertIn('already connected', str(form.errors))
+
+    def test_circuit_termination_with_provider_network(self):
+        """Test error when circuit termination is already connected to a provider network."""
+        from django.contrib.contenttypes.models import ContentType
+
+        # Connect circuit termination to provider network
+        circuit_term = CircuitTermination.objects.get(pk=self.circuit_term_a.pk)
+        pn_ct = ContentType.objects.get_for_model(ProviderNetwork)
+        circuit_term.termination_type = pn_ct
+        circuit_term.termination_id = self.provider_network.pk
+        circuit_term.save()
+
+        try:
+            form = CableImportForm(data={
+                'side_a_site': None,
+                'side_a_parent': 'CIRCUIT-001',
+                'side_a_type': 'circuits.circuittermination',
+                'side_a_name': 'A',
+                'side_b_site': 'Site A',
+                'side_b_parent': 'Device-A1',
+                'side_b_type': 'dcim.interface',
+                'side_b_name': 'eth0',
+                'type': CableTypeChoices.TYPE_MMF_OM4,
+                'status': 'connected',
+            })
+            self.assertFalse(form.is_valid())
+            self.assertIn('already connected to a provider network', str(form.errors))
+        finally:
+            # Clean up: remove provider network connection
+            circuit_term.termination_type = None
+            circuit_term.termination_id = None
+            circuit_term.save()
+
+    def test_multiple_parents_without_site(self):
+        """Test error when multiple parent objects are found without site scoping."""
+        # Device-A1 exists in both site_a and site_b
+        # Try to find device without specifying site
+        form = CableImportForm(data={
+            'side_a_site': '',  # Empty site - should cause multiple matches
+            'side_a_parent': 'Device-A1',
+            'side_a_type': 'dcim.interface',
+            'side_a_name': 'eth0',
+            'side_b_site': 'Site A',
+            'side_b_parent': 'Device-A2',
+            'side_b_type': 'dcim.interface',
+            'side_b_name': 'eth0',
+            'type': CableTypeChoices.TYPE_CAT6,
+            'status': 'connected',
+        })
+        self.assertFalse(form.is_valid())
+        self.assertIn('Multiple Device objects found', str(form.errors))

netbox/dcim/tests/test_views.py

@@ -11,6 +11,7 @@ from core.models import ObjectType
 from dcim.choices import *
 from dcim.constants import *
 from dcim.models import *
+from circuits.models import Circuit, CircuitTermination, CircuitType, Provider
 from ipam.models import ASN, RIR, VLAN, VRF
 from netbox.choices import CSVDelimiterChoices, ImportFormatChoices, WeightUnitChoices
 from tenancy.models import Tenant
@@ -3495,7 +3496,7 @@ class CableTestCase(
             Interface(device=devices[4], name='Interface 2', type=InterfaceTypeChoices.TYPE_1GE_FIXED),
             Interface(device=devices[4], name='Interface 3', type=InterfaceTypeChoices.TYPE_1GE_FIXED),
 
-            # Device 1, Site 2
+            # Device 5, Site 2
             Interface(device=devices[5], name='Interface 1', type=InterfaceTypeChoices.TYPE_1GE_FIXED),
             Interface(device=devices[5], name='Interface 2', type=InterfaceTypeChoices.TYPE_1GE_FIXED),
             Interface(device=devices[5], name='Interface 3', type=InterfaceTypeChoices.TYPE_1GE_FIXED),
@@ -3507,6 +3508,22 @@ class CableTestCase(
         )
         Interface.objects.bulk_create(interfaces)
 
+        ConsolePort.objects.create(device=devices[0], name='Console 1')
+        ConsoleServerPort.objects.create(device=devices[1], name='Console Server 1')
+
+        power_panel = PowerPanel.objects.create(site=sites[0], name='Power Panel 1')
+        PowerFeed.objects.create(power_panel=power_panel, name='Feed 1')
+        PowerPort.objects.create(device=devices[0], name='PSU1')
+
+        provider = Provider.objects.create(name='Provider 1', slug='provider-1')
+        circuit_type = CircuitType.objects.create(name='Circuit Type 1', slug='circuit-type-1')
+        circuit = Circuit.objects.create(provider=provider, type=circuit_type, cid='CIRCUIT-001')
+        circuit_terminations = (
+            CircuitTermination(circuit=circuit, term_side='A'),
+            CircuitTermination(circuit=circuit, term_side='Z'),
+        )
+        CircuitTermination.objects.bulk_create(circuit_terminations)
+
         cable1 = Cable(a_terminations=[interfaces[0]], b_terminations=[interfaces[3]], type=CableTypeChoices.TYPE_CAT6)
         cable1.save()
         cable2 = Cable(a_terminations=[interfaces[1]], b_terminations=[interfaces[4]], type=CableTypeChoices.TYPE_CAT6)
@@ -3532,7 +3549,7 @@ class CableTestCase(
 
         cls.csv_data = {
             'default': (
-                "side_a_device,side_a_type,side_a_name,side_b_device,side_b_type,side_b_name",
+                "side_a_parent,side_a_type,side_a_name,side_b_parent,side_b_type,side_b_name",
                 "Device 4,dcim.interface,Interface 1,Device 5,dcim.interface,Interface 1",
                 "Device 3,dcim.interface,Interface 2,Device 4,dcim.interface,Interface 2",
                 "Device 3,dcim.interface,Interface 3,Device 4,dcim.interface,Interface 3",
@@ -3545,12 +3562,28 @@ class CableTestCase(
             'site-filtering': (
                 # Ensure that CSV bulk import supports assigning terminations from parent devices
                 # that share the same device name, provided those devices belong to different sites.
-                "side_a_site,side_a_device,side_a_type,side_a_name,side_b_site,side_b_device,side_b_type,side_b_name",
+                "side_a_site,side_a_parent,side_a_type,side_a_name,side_b_site,side_b_parent,side_b_type,side_b_name",
                 "Site 1,Device 3,dcim.interface,Interface 1,Site 2,Device 1,dcim.interface,Interface 1",
                 "Site 1,Device 3,dcim.interface,Interface 2,Site 2,Device 1,dcim.interface,Interface 2",
                 "Site 1,Device 3,dcim.interface,Interface 3,Site 2,Device 1,dcim.interface,Interface 3",
                 "Site 1,Device 1,dcim.interface,Device 2 Interface,Site 2,Device 1,dcim.interface,Interface 4",
                 "Site 1,Device 1,dcim.interface,Device 3 Interface,Site 2,Device 1,dcim.interface,Interface 5",
+            ),
+            'circuits': (
+                # Test circuit termination to interface cables
+                "side_a_parent,side_a_type,side_a_name,side_b_site,side_b_parent,side_b_type,side_b_name",
+                "CIRCUIT-001,circuits.circuittermination,A,Site 1,Device 4,dcim.interface,Interface 2",
+                "CIRCUIT-001,circuits.circuittermination,z,Site 2,Device 5,dcim.interface,Interface 2",
+            ),
+            'power': (
+                # Test power feed to power port cables
+                "side_a_site,side_a_parent,side_a_type,side_a_name,side_b_site,side_b_parent,side_b_type,side_b_name",
+                "Site 1,Power Panel 1,dcim.powerfeed,Feed 1,Site 1,Device 1,dcim.powerport,PSU1",
+            ),
+            'console': (
+                # Test console port to console server port cables
+                "side_a_site,side_a_parent,side_a_type,side_a_name,side_b_site,side_b_parent,side_b_type,side_b_name",
+                "Site 1,Device 1,dcim.consoleport,Console 1,Site 1,Device 2,dcim.consoleserverport,Console Server 1",
             )
         }
 

netbox/extras/api/serializers_/configtemplates.py

@@ -23,6 +23,6 @@ class ConfigTemplateSerializer(ChangeLogMessageSerializer, TaggableModelSerializ
         fields = [
             'id', 'url', 'display_url', 'display', 'name', 'description', 'environment_params', 'template_code',
             'mime_type', 'file_name', 'file_extension', 'as_attachment', 'data_source', 'data_path', 'data_file',
-            'data_synced', 'tags', 'created', 'last_updated',
+            'auto_sync_enabled', 'data_synced', 'tags', 'created', 'last_updated',
         ]
         brief_fields = ('id', 'url', 'display', 'name', 'description')

netbox/extras/api/views.py

@@ -267,6 +267,14 @@ class ScriptViewSet(ModelViewSet):
     _ignore_model_permissions = True
     lookup_value_regex = '[^/]+'  # Allow dots
 
+    def initial(self, request, *args, **kwargs):
+        super().initial(request, *args, **kwargs)
+
+        # Restrict the view's QuerySet to allow only the permitted objects
+        if request.user.is_authenticated:
+            action = 'run' if request.method == 'POST' else 'view'
+            self.queryset = self.queryset.restrict(request.user, action)
+
     def _get_script(self, pk):
         # If pk is numeric, retrieve script by ID
         if pk.isnumeric():
@@ -290,10 +298,12 @@ class ScriptViewSet(ModelViewSet):
         """
         Run a Script identified by its numeric PK or module & name and return the pending Job as the result
         """
-        if not request.user.has_perm('extras.run_script'):
-            raise PermissionDenied("This user does not have permission to run scripts.")
 
         script = self._get_script(pk)
+
+        if not request.user.has_perm('extras.run_script', obj=script):
+            raise PermissionDenied("This user does not have permission to run this script.")
+
         input_serializer = serializers.ScriptInputSerializer(
             data=request.data,
             context={'script': script}

netbox/extras/dashboard/widgets.py

@@ -209,7 +209,10 @@ class ObjectCountsWidget(DashboardWidget):
                     url = get_action_url(model, action='list')
                 except NoReverseMatch:
                     url = None
-                qs = model.objects.restrict(request.user, 'view')
+                try:
+                    qs = model.objects.restrict(request.user, 'view')
+                except AttributeError:
+                    qs = model.objects.all()
                 # Apply any specified filters
                 if url and (filters := self.config.get('filters')):
                     params = dict_to_querydict(filters)

netbox/extras/events.py

@@ -134,11 +134,18 @@ def process_event_rules(event_rules, object_type, event_type, data, username=Non
 
             # Enqueue a Job to record the script's execution
             from extras.jobs import ScriptJob
+            params = {
+                "instance": event_rule.action_object,
+                "name": script.name,
+                "user": user,
+                "data": event_data
+            }
+            if snapshots:
+                params["snapshots"] = snapshots
+            if request:
+                params["request"] = copy_safe_request(request)
             ScriptJob.enqueue(
-                instance=event_rule.action_object,
-                name=script.name,
-                user=user,
-                data=event_data
+                **params
             )
 
         # Notification groups

netbox/extras/forms/bulk_edit.py

@@ -398,8 +398,12 @@ class ConfigTemplateBulkEditForm(ChangelogMessageMixin, BulkEditForm):
         required=False,
         widget=BulkEditNullBooleanSelect()
     )
-
-    nullable_fields = ('description', 'mime_type', 'file_name', 'file_extension')
+    auto_sync_enabled = forms.NullBooleanField(
+        label=_('Auto sync enabled'),
+        required=False,
+        widget=BulkEditNullBooleanSelect()
+    )
+    nullable_fields = ('description', 'mime_type', 'file_name', 'file_extension', 'auto_sync_enabled',)
 
 
 class ImageAttachmentBulkEditForm(ChangelogMessageMixin, BulkEditForm):

netbox/extras/forms/bulk_import.py

@@ -5,7 +5,7 @@ from django.contrib.postgres.forms import SimpleArrayField
 from django.core.exceptions import ObjectDoesNotExist
 from django.utils.translation import gettext_lazy as _
 
-from core.models import ObjectType
+from core.models import DataFile, DataSource, ObjectType
 from extras.choices import *
 from extras.models import *
 from netbox.events import get_event_type_choices
@@ -160,14 +160,41 @@ class ConfigContextProfileImportForm(NetBoxModelImportForm):
 
 
 class ConfigTemplateImportForm(CSVModelForm):
+    data_source = CSVModelChoiceField(
+        label=_('Data source'),
+        queryset=DataSource.objects.all(),
+        required=False,
+        to_field_name='name',
+        help_text=_('Data source which provides the data file')
+    )
+    data_file = CSVModelChoiceField(
+        label=_('Data file'),
+        queryset=DataFile.objects.all(),
+        required=False,
+        to_field_name='path',
+        help_text=_('Data file containing the template code')
+    )
+    auto_sync_enabled = forms.BooleanField(
+        required=False,
+        label=_('Auto sync enabled'),
+        help_text=_("Enable automatic synchronization of template content when the data file is updated")
+    )
 
     class Meta:
         model = ConfigTemplate
         fields = (
-            'name', 'description', 'template_code', 'environment_params', 'mime_type', 'file_name', 'file_extension',
-            'as_attachment', 'tags',
+            'name', 'description', 'template_code', 'data_source', 'data_file', 'auto_sync_enabled',
+            'environment_params', 'mime_type', 'file_name', 'file_extension', 'as_attachment', 'tags',
         )
 
+    def clean(self):
+        super().clean()
+
+        # Make sure template_code is None when it's not included in the uploaded data
+        if not self.data.get('template_code') and not self.data.get('data_file'):
+            raise forms.ValidationError(_("Must specify either local content or a data file"))
+        return self.cleaned_data['template_code']
+
 
 class SavedFilterImportForm(CSVModelForm):
     object_types = CSVMultipleContentTypeField(

netbox/extras/forms/filtersets.py

@@ -42,17 +42,20 @@ class CustomFieldFilterForm(SavedFiltersMixin, FilterForm):
     model = CustomField
     fieldsets = (
         FieldSet('q', 'filter_id'),
-        FieldSet(
-            'type', 'related_object_type_id', 'group_name', 'weight', 'required', 'unique', 'choice_set_id',
-            name=_('Attributes')
-        ),
+        FieldSet('object_type_id', 'type', 'group_name', 'weight', 'required', 'unique', name=_('Attributes')),
+        FieldSet('choice_set_id', 'related_object_type_id', name=_('Type Options')),
         FieldSet('ui_visible', 'ui_editable', 'is_cloneable', name=_('Behavior')),
         FieldSet('validation_minimum', 'validation_maximum', 'validation_regex', name=_('Validation')),
     )
-    related_object_type_id = ContentTypeMultipleChoiceField(
+    object_type_id = ContentTypeMultipleChoiceField(
         queryset=ObjectType.objects.with_feature('custom_fields'),
         required=False,
-        label=_('Related object type')
+        label=_('Object types'),
+    )
+    related_object_type_id = ContentTypeMultipleChoiceField(
+        queryset=ObjectType.objects.public(),
+        required=False,
+        label=_('Related object type'),
     )
     type = forms.MultipleChoiceField(
         choices=CustomFieldTypeChoices,
@@ -136,12 +139,12 @@ class CustomLinkFilterForm(SavedFiltersMixin, FilterForm):
     model = CustomLink
     fieldsets = (
         FieldSet('q', 'filter_id'),
-        FieldSet('object_type', 'enabled', 'new_window', 'weight', name=_('Attributes')),
+        FieldSet('object_type_id', 'enabled', 'new_window', 'weight', name=_('Attributes')),
     )
-    object_type = ContentTypeMultipleChoiceField(
+    object_type_id = ContentTypeMultipleChoiceField(
         label=_('Object types'),
         queryset=ObjectType.objects.with_feature('custom_links'),
-        required=False
+        required=False,
     )
     enabled = forms.NullBooleanField(
         label=_('Enabled'),
@@ -230,12 +233,12 @@ class SavedFilterFilterForm(SavedFiltersMixin, FilterForm):
     model = SavedFilter
     fieldsets = (
         FieldSet('q', 'filter_id'),
-        FieldSet('object_type', 'enabled', 'shared', 'weight', name=_('Attributes')),
+        FieldSet('object_type_id', 'enabled', 'shared', 'weight', name=_('Attributes')),
     )
-    object_type = ContentTypeMultipleChoiceField(
+    object_type_id = ContentTypeMultipleChoiceField(
         label=_('Object types'),
         queryset=ObjectType.objects.public(),
-        required=False
+        required=False,
     )
     enabled = forms.NullBooleanField(
         label=_('Enabled'),
@@ -476,7 +479,7 @@ class ConfigTemplateFilterForm(SavedFiltersMixin, FilterForm):
     model = ConfigTemplate
     fieldsets = (
         FieldSet('q', 'filter_id', 'tag'),
-        FieldSet('data_source_id', 'data_file_id', name=_('Data')),
+        FieldSet('data_source_id', 'data_file_id', 'auto_sync_enabled', name=_('Data')),
         FieldSet('mime_type', 'file_name', 'file_extension', 'as_attachment', name=_('Rendering'))
     )
     data_source_id = DynamicModelMultipleChoiceField(
@@ -492,6 +495,13 @@ class ConfigTemplateFilterForm(SavedFiltersMixin, FilterForm):
             'source_id': '$data_source_id'
         }
     )
+    auto_sync_enabled = forms.NullBooleanField(
+        label=_('Auto sync enabled'),
+        required=False,
+        widget=forms.Select(
+            choices=BOOLEAN_WITH_BLANK_CHOICES
+        )
+    )
     tag = TagFilterField(ConfigTemplate)
     mime_type = forms.CharField(
         required=False,

netbox/extras/jobs.py

@@ -2,11 +2,14 @@ import logging
 import traceback
 from contextlib import ExitStack
 
-from django.db import transaction
+from django.db import router, transaction
+from django.db import DEFAULT_DB_ALIAS
 from django.utils.translation import gettext as _
 
 from core.signals import clear_events
+from dcim.models import Device
 from extras.models import Script as ScriptModel
+from netbox.context_managers import event_tracking
 from netbox.jobs import JobRunner
 from netbox.registry import registry
 from utilities.exceptions import AbortScript, AbortTransaction
@@ -42,10 +45,21 @@ class ScriptJob(JobRunner):
                 # A script can modify multiple models so need to do an atomic lock on
                 # both the default database (for non ChangeLogged models) and potentially
                 # any other database (for ChangeLogged models)
-                with transaction.atomic():
-                    script.output = script.run(data, commit)
-                    if not commit:
-                        raise AbortTransaction()
+                changeloged_db = router.db_for_write(Device)
+                with transaction.atomic(using=DEFAULT_DB_ALIAS):
+                    # If branch database is different from default, wrap in a second atomic transaction
+                    # Note: Don't add any extra code between the two atomic transactions,
+                    # otherwise the changes might get committed to the default database
+                    # if there are any raised exceptions.
+                    if changeloged_db != DEFAULT_DB_ALIAS:
+                        with transaction.atomic(using=changeloged_db):
+                            script.output = script.run(data, commit)
+                            if not commit:
+                                raise AbortTransaction()
+                    else:
+                        script.output = script.run(data, commit)
+                        if not commit:
+                            raise AbortTransaction()
             except AbortTransaction:
                 script.log_info(message=_("Database changes have been reverted automatically."))
                 if script.failed:
@@ -108,14 +122,14 @@ class ScriptJob(JobRunner):
         script.request = request
         self.logger.debug(f"Request ID: {request.id if request else None}")
 
-        # Execute the script. If commit is True, wrap it with the event_tracking context manager to ensure we process
-        # change logging, event rules, etc.
         if commit:
             self.logger.info("Executing script (commit enabled)")
-            with ExitStack() as stack:
-                for request_processor in registry['request_processors']:
-                    stack.enter_context(request_processor(request))
-                self.run_script(script, request, data, commit)
         else:
             self.logger.warning("Executing script (commit disabled)")
+
+        with ExitStack() as stack:
+            for request_processor in registry['request_processors']:
+                if not commit and request_processor is event_tracking:
+                    continue
+                stack.enter_context(request_processor(request))
             self.run_script(script, request, data, commit)

netbox/extras/tables/tables.py

@@ -632,6 +632,10 @@ class ConfigTemplateTable(NetBoxTable):
         orderable=False,
         verbose_name=_('Synced')
     )
+    auto_sync_enabled = columns.BooleanColumn(
+        verbose_name=_('Auto Sync Enabled'),
+        orderable=False,
+    )
     mime_type = tables.Column(
         verbose_name=_('MIME Type')
     )

netbox/extras/templatetags/dashboard.py

@@ -1,4 +1,6 @@
 from django import template
+from django.utils.safestring import mark_safe
+from django.utils.translation import gettext as _
 
 
 register = template.Library()
@@ -8,4 +10,16 @@ register = template.Library()
 def render_widget(context, widget):
     request = context['request']
 
-    return widget.render(request)
+    try:
+        return widget.render(request)
+    except Exception as e:
+        message1 = _('An error was encountered when attempting to render this widget:')
+        message2 = _('Please try reconfiguring the widget, or remove it from your dashboard.')
+        return mark_safe(f"""
+            <p>
+              <span class="text-danger"><i class="mdi mdi-alert"></i></span>
+              {message1}
+            </p>
+            <p class="font-monospace ps-3">{e}</p>
+            <p>{message2}</p>
+        """)

netbox/extras/tests/test_api.py

@@ -894,18 +894,13 @@ class ScriptTest(APITestCase):
 
     def setUp(self):
         super().setUp()
+        self.add_permissions('extras.view_script')
 
         # Monkey-patch the Script model to return our TestScriptClass above
         Script.python_class = self.python_class
 
     def test_get_script(self):
-        module = ScriptModule.objects.get(
-            file_root=ManagedFileRootPathChoices.SCRIPTS,
-            file_path='script.py',
-        )
-        script = module.scripts.all().first()
-        url = reverse('extras-api:script-detail', kwargs={'pk': script.pk})
-        response = self.client.get(url, **self.header)
+        response = self.client.get(self.url, **self.header)
 
         self.assertEqual(response.data['name'], self.TestScriptClass.Meta.name)
         self.assertEqual(response.data['vars']['var1'], 'StringVar')

netbox/netbox/configuration_example.py

@@ -243,6 +243,9 @@ SESSION_FILE_PATH = None
 #     },
 #     "scripts": {
 #         "BACKEND": "extras.storage.ScriptFileSystemStorage",
+#         "OPTIONS": {
+#             "allow_overwrite": True,
+#         },
 #     },
 # }
 

netbox/netbox/settings.py

@@ -291,6 +291,9 @@ DEFAULT_STORAGES = {
     },
     "scripts": {
         "BACKEND": "extras.storage.ScriptFileSystemStorage",
+        "OPTIONS": {
+            "allow_overwrite": True,
+        },
     },
 }
 STORAGES = DEFAULT_STORAGES | STORAGES

netbox/netbox/views/generic/bulk_views.py

@@ -851,12 +851,12 @@ class BulkRenameView(GetReturnURLMixin, BaseMultiObjectView):
             replace = form.cleaned_data['replace']
             if form.cleaned_data['use_regex']:
                 try:
-                    obj.new_name = re.sub(find, replace, getattr(obj, self.field_name, ''))
+                    obj.new_name = re.sub(find, replace, getattr(obj, self.field_name, '') or '')
                 # Catch regex group reference errors
                 except re.error:
                     obj.new_name = getattr(obj, self.field_name)
             else:
-                obj.new_name = getattr(obj, self.field_name, '').replace(find, replace)
+                obj.new_name = (getattr(obj, self.field_name, '') or '').replace(find, replace)
             renamed_pks.append(obj.pk)
 
         return renamed_pks

netbox/netbox/views/generic/object_views.py

@@ -559,6 +559,7 @@ class ComponentCreateView(GetReturnURLMixin, BaseObjectView):
         form.instance._replicated_base = hasattr(self.form, "replication_fields")
 
         if form.is_valid():
+            changelog_message = form.cleaned_data.pop('changelog_message', '')
             new_components = []
             data = deepcopy(request.POST)
             pattern_count = len(form.cleaned_data[self.form.replication_fields[0]])
@@ -585,6 +586,9 @@ class ComponentCreateView(GetReturnURLMixin, BaseObjectView):
                         # Create the new components
                         new_objs = []
                         for component_form in new_components:
+                            # Record changelog message (if any)
+                            if changelog_message:
+                                component_form.instance._changelog_message = changelog_message
                             obj = component_form.save()
                             new_objs.append(obj)
 

netbox/project-static/package.json

@@ -30,7 +30,7 @@
     "gridstack": "12.3.3",
     "htmx.org": "2.0.8",
     "query-string": "9.3.1",
-    "sass": "1.94.0",
+    "sass": "1.94.2",
     "tom-select": "2.4.3",
     "typeface-inter": "3.18.1",
     "typeface-roboto-mono": "1.1.13"

netbox/project-static/styles/overrides/_tabler.scss

@@ -162,3 +162,18 @@ pre code {
   vertical-align: .05em;
   height: auto;
 }
+
+// Theme-based visibility utilities
+// Tabler's .hide-theme-* utilities expect data-bs-theme on :root, but NetBox applies
+// it to body. These overrides use higher specificity selectors to ensure theme-based
+// visibility works correctly. The :root:not(.dummy) pattern provides the additional
+// specificity needed to override Tabler's :root:not() rules.
+:root:not(.dummy) body[data-bs-theme='light'] .hide-theme-light,
+:root:not(.dummy) body[data-bs-theme='dark'] .hide-theme-dark {
+  display: none !important;
+}
+
+:root:not(.dummy) body[data-bs-theme='dark'] .hide-theme-light,
+:root:not(.dummy) body[data-bs-theme='light'] .hide-theme-dark {
+  display: inline-flex !important;
+}

netbox/project-static/yarn.lock

@@ -3190,10 +3190,10 @@ safe-regex-test@^1.1.0:
     es-errors "^1.3.0"
     is-regex "^1.2.1"
 
-sass@1.94.0:
-  version "1.94.0"
-  resolved "https://registry.yarnpkg.com/sass/-/sass-1.94.0.tgz#a04198d8940358ca6ad537d2074051edbbe7c1a7"
-  integrity sha512-Dqh7SiYcaFtdv5Wvku6QgS5IGPm281L+ZtVD1U2FJa7Q0EFRlq8Z3sjYtz6gYObsYThUOz9ArwFqPZx+1azILQ==
+sass@1.94.2:
+  version "1.94.2"
+  resolved "https://registry.yarnpkg.com/sass/-/sass-1.94.2.tgz#198511fc6fdd2fc0a71b8d1261735c12608d4ef3"
+  integrity sha512-N+7WK20/wOr7CzA2snJcUSSNTCzeCGUTFY3OgeQP3mZ1aj9NMQ0mSTXwlrnd89j33zzQJGqIN52GIOmYrfq46A==
   dependencies:
     chokidar "^4.0.0"
     immutable "^5.0.2"

netbox/release.yaml

@@ -1,3 +1,3 @@
-version: "4.4.6"
+version: "4.4.7"
 edition: "Community"
-published: "2025-11-11"
+published: "2025-11-25"

netbox/templates/dcim/racktype.html

@@ -24,10 +24,6 @@
             <th scope="row">{% trans "Description" %}</th>
             <td>{{ object.description|placeholder }}</td>
           </tr>
-          <tr>
-            <th scope="row">{% trans "Airflow" %}</th>
-            <td>{{ object.get_airflow_display|placeholder }}</td>
-          </tr>
         </table>
       </div>
       {% include 'dcim/inc/panels/racktype_dimensions.html' %}

netbox/templates/extras/configtemplate.html

@@ -62,6 +62,10 @@
             <th scope="row">{% trans "Data Synced" %}</th>
             <td>{{ object.data_synced|placeholder }}</td>
           </tr>
+          <tr>
+            <th scope="row">{% trans "Auto Sync Enabled" %}</th>
+            <td>{% checkmark object.auto_sync_enabled %}</td>
+          </tr>
         </table>
       </div>
       {% include 'inc/panels/tags.html' %}

netbox/templates/htmx/table.html

@@ -17,15 +17,17 @@
 
 {% if request.htmx %}
   {# Include the updated object count for display elsewhere on the page #}
-  <div hx-swap-oob="innerHTML:.total-object-count">{{ table.rows|length }}</div>
+  {% if not table.embedded %}
+    <div hx-swap-oob="innerHTML:.total-object-count">{{ table.rows|length }}</div>
+  {% endif %}
 
   {# Include the updated "save" link for the table configuration #}
-  {% if table.config_params %}
+  {% if table.config_params and not table.embedded %}
     <a class="dropdown-item" hx-swap-oob="outerHTML:#table_save_link" href="{% url 'extras:tableconfig_add' %}?{{ table.config_params }}&return_url={{ request.path }}" id="table_save_link">Save</a>
   {% endif %}
 
   {# Update the bulk action buttons with new query parameters #}
-  {% if actions %}
+  {% if actions and not table.embedded %}
     <div class="bulk-action-buttons" hx-swap-oob="outerHTML:.bulk-action-buttons">
       {% action_buttons actions model multi=True %}
     </div>

netbox/users/models/tokens.py

@@ -1,8 +1,10 @@
 import binascii
 import os
+import zoneinfo
 
 from django.conf import settings
 from django.contrib.postgres.fields import ArrayField
+from django.core.exceptions import ValidationError
 from django.core.validators import MinLengthValidator
 from django.db import models
 from django.urls import reverse
@@ -86,6 +88,24 @@ class Token(models.Model):
     def partial(self):
         return f'**********************************{self.key[-6:]}' if self.key else ''
 
+    def clean(self):
+        super().clean()
+
+        # Prevent creating a token with a past expiration date
+        # while allowing updates to existing tokens.
+        if self.pk is None and self.is_expired:
+            current_tz = zoneinfo.ZoneInfo(settings.TIME_ZONE)
+            now = timezone.now().astimezone(current_tz)
+            current_time_str = f'{now.date().isoformat()} {now.time().isoformat(timespec="seconds")}'
+
+            # Translators: {current_time} is the current server date and time in ISO format,
+            # {timezone} is the configured server time zone (for example, "UTC" or "Europe/Berlin").
+            message = _('Expiration time must be in the future. '
+                        'Current server time is {current_time} ({timezone}).'
+                        ).format(current_time=current_time_str, timezone=current_tz.key)
+
+            raise ValidationError({'expires': message})
+
     def save(self, *args, **kwargs):
         if not self.key:
             self.key = self.generate_key()

netbox/users/tests/test_models.py

@@ -1,6 +1,72 @@
-from django.test import TestCase
+from datetime import timedelta
 
-from users.models import User
+from django.core.exceptions import ValidationError
+from django.test import TestCase
+from django.utils import timezone
+
+from users.models import User, Token
+from utilities.testing import create_test_user
+
+
+class TokenTest(TestCase):
+    """
+    Test class for testing the functionality of the Token model.
+    """
+
+    @classmethod
+    def setUpTestData(cls):
+        """
+        Set up test data for the Token model.
+        """
+        cls.user = create_test_user('User 1')
+
+    def test_is_expired(self):
+        """
+        Test the is_expired property.
+        """
+        # Token with no expiration
+        token = Token(user=self.user, expires=None)
+        self.assertFalse(token.is_expired)
+
+        # Token with future expiration
+        token.expires = timezone.now() + timedelta(days=1)
+        self.assertFalse(token.is_expired)
+
+        # Token with past expiration
+        token.expires = timezone.now() - timedelta(days=1)
+        self.assertTrue(token.is_expired)
+
+    def test_cannot_create_token_with_past_expiration(self):
+        """
+        Test that creating a token with an expiration date in the past raises a ValidationError.
+        """
+        past_date = timezone.now() - timedelta(days=1)
+        token = Token(user=self.user, expires=past_date)
+
+        with self.assertRaises(ValidationError) as cm:
+            token.clean()
+        self.assertIn('expires', cm.exception.error_dict)
+
+    def test_can_update_existing_expired_token(self):
+        """
+        Test that updating an already expired token does NOT raise a ValidationError.
+        """
+        # Create a valid token first with an expiration date in the past
+        # bypasses the clean() method
+        token = Token.objects.create(user=self.user)
+        token.expires = timezone.now() - timedelta(days=1)
+        token.save()
+
+        # Try to update the description
+        token.description = 'New Description'
+        try:
+            token.clean()
+            token.save()
+        except ValidationError:
+            self.fail('Updating an expired token should not raise ValidationError')
+
+        token.refresh_from_db()
+        self.assertEqual(token.description, 'New Description')
 
 
 class UserConfigTest(TestCase):

netbox/vpn/filtersets.py

@@ -2,6 +2,7 @@ import django_filters
 from django.db.models import Q
 from django.utils.translation import gettext as _
 
+from core.models import ObjectType
 from dcim.models import Device, Interface
 from ipam.models import IPAddress, RouteTarget, VLAN
 from netbox.filtersets import NetBoxModelFilterSet, OrganizationalModelFilterSet
@@ -429,6 +430,10 @@ class L2VPNTerminationFilterSet(NetBoxModelFilterSet):
         queryset=VLAN.objects.all(),
         label=_('VLAN (ID)'),
     )
+    assigned_object_type_id = django_filters.ModelMultipleChoiceFilter(
+        queryset=ObjectType.objects.all(),
+        field_name='assigned_object_type'
+    )
     assigned_object_type = ContentTypeFilter()
 
     class Meta:

pyproject.toml

@@ -3,7 +3,7 @@
 
 [project]
 name = "netbox"
-version = "4.4.6"
+version = "4.4.7"
 requires-python = ">=3.10"
 description = "The premier source of truth powering network automation."
 readme = "README.md"

requirements.txt

@@ -10,9 +10,9 @@ django-pglocks==1.0.4
 django-prometheus==2.4.1
 django-redis==6.0.0
 django-rich==2.2.0
-django-rq==3.1
+django-rq==3.2.1
 django-storages==1.14.6
-django-tables2==2.7.5
+django-tables2==2.8.0
 django-taggit==6.1.0
 django-timezone-field==7.1
 djangorestframework==3.16.1
@@ -23,21 +23,21 @@ gunicorn==23.0.0
 Jinja2==3.1.6
 jsonschema==4.25.1
 Markdown==3.10
-mkdocs-material==9.6.22
+mkdocs-material==9.7.0
 mkdocstrings==0.30.1
 mkdocstrings-python==1.19.0
 netaddr==1.3.0
 nh3==0.3.2
 Pillow==12.0.0
-psycopg[c,pool]==3.2.12
+psycopg[c,pool]==3.2.13
 PyYAML==6.0.3
 requests==2.32.5
-rq==2.6.0
+rq==2.6.1
 social-auth-app-django==5.6.0
 social-auth-core==4.8.1
 sorl-thumbnail==12.11.0
-strawberry-graphql==0.285.0
-strawberry-graphql-django==0.67.0
+strawberry-graphql==0.287.0
+strawberry-graphql-django==0.67.2
 svgwrite==1.4.3
 tablib==3.9.0
 tzdata==2025.2