fix selected item sorting

.github/workflows/codeql.yml

@@ -30,13 +30,13 @@ jobs:
       uses: actions/checkout@v4
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
         config-file: .github/codeql/codeql-config.yml
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@v3
       with:
         category: "/language:${{matrix.language}}"

netbox/core/api/serializers_/data.py

@@ -44,4 +44,3 @@ class DataFileSerializer(NetBoxModelSerializer):
             'id', 'url', 'display_url', 'display', 'source', 'path', 'last_updated', 'size', 'hash',
         ]
         brief_fields = ('id', 'url', 'display', 'path')
-        read_only_fields = ['path', 'last_updated', 'size', 'hash']

netbox/core/models/data.py

@@ -12,7 +12,7 @@ from django.core.validators import RegexValidator
 from django.db import models
 from django.urls import reverse
 from django.utils import timezone
-from django.utils.translation import gettext_lazy as _
+from django.utils.translation import gettext as _
 
 from netbox.constants import CENSOR_TOKEN, CENSOR_TOKEN_CHANGED
 from netbox.models import PrimaryModel
@@ -128,9 +128,7 @@ class DataSource(JobsMixin, PrimaryModel):
         # Ensure URL scheme matches selected type
         if self.backend_class.is_local and self.url_scheme not in ('file', ''):
             raise ValidationError({
-                'source_url': _("URLs for local sources must start with {scheme} (or specify no scheme)").format(
-                    scheme='file://'
-                )
+                'source_url': "URLs for local sources must start with file:// (or specify no scheme)"
             })
 
     def save(self, *args, **kwargs):

netbox/dcim/forms/mixins.py

@@ -140,6 +140,9 @@ class FrontPortFormMixin(forms.Form):
         widget=forms.SelectMultiple(attrs={'size': 8})
     )
 
+    port_mapping_model = PortMapping
+    parent_field = 'device'
+
     def clean(self):
         super().clean()
 
@@ -200,22 +203,3 @@ class FrontPortFormMixin(forms.Form):
                 using=connection,
                 update_fields=None
             )
-
-    def _get_rear_port_choices(self, parent_filter, front_port):
-        """
-        Return a list of choices representing each available rear port & position pair on the parent object (identified
-        by a Q filter), excluding those assigned to the specified instance.
-        """
-        occupied_rear_port_positions = [
-            f'{mapping.rear_port_id}:{mapping.rear_port_position}'
-            for mapping in self.port_mapping_model.objects.filter(parent_filter).exclude(front_port=front_port.pk)
-        ]
-
-        choices = []
-        for rear_port in self.rear_port_model.objects.filter(parent_filter):
-            for i in range(1, rear_port.positions + 1):
-                pair_id = f'{rear_port.pk}:{i}'
-                if pair_id not in occupied_rear_port_positions:
-                    pair_label = f'{rear_port.name}:{i}'
-                    choices.append((pair_id, pair_label))
-        return choices

netbox/dcim/forms/model_forms.py

@@ -733,9 +733,10 @@ class ModuleForm(ModuleCommonForm, PrimaryModelForm):
     )
     module_bay = DynamicModelChoiceField(
         label=_('Module bay'),
-        queryset=ModuleBay.objects.all(),
+        queryset=ModuleBay.objects.order_by('name'),
         query_params={
-            'device_id': '$device'
+            'device_id': '$device',
+            'ordering': 'name',
         },
         context={
             'disabled': 'installed_module',
@@ -1124,8 +1125,9 @@ class FrontPortTemplateForm(FrontPortFormMixin, ModularComponentTemplateForm):
         ),
     )
 
+    # Override FrontPortFormMixin attrs
     port_mapping_model = PortTemplateMapping
-    rear_port_model = RearPortTemplate
+    parent_field = 'device_type'
 
     class Meta:
         model = FrontPortTemplate
@@ -1136,14 +1138,13 @@ class FrontPortTemplateForm(FrontPortFormMixin, ModularComponentTemplateForm):
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
 
-        # Populate rear port choices based on parent DeviceType or ModuleType
         if device_type_id := self.data.get('device_type') or self.initial.get('device_type'):
-            parent_filter = Q(device_type=device_type_id)
-        elif module_type_id := self.data.get('module_type') or self.initial.get('module_type'):
-            parent_filter = Q(module_type=module_type_id)
+            device_type = DeviceType.objects.get(pk=device_type_id)
         else:
             return
-        self.fields['rear_ports'].choices = self._get_rear_port_choices(parent_filter, self.instance)
+
+        # Populate rear port choices
+        self.fields['rear_ports'].choices = self._get_rear_port_choices(device_type, self.instance)
 
         # Set initial rear port mappings
         if self.instance.pk:
@@ -1152,6 +1153,27 @@ class FrontPortTemplateForm(FrontPortFormMixin, ModularComponentTemplateForm):
                 for mapping in PortTemplateMapping.objects.filter(front_port_id=self.instance.pk)
             ]
 
+    def _get_rear_port_choices(self, device_type, front_port):
+        """
+        Return a list of choices representing each available rear port & position pair on the device type, excluding
+        those assigned to the specified instance.
+        """
+        occupied_rear_port_positions = [
+            f'{mapping.rear_port_id}:{mapping.rear_port_position}'
+            for mapping in device_type.port_mappings.exclude(front_port=front_port.pk)
+        ]
+
+        choices = []
+        for rear_port in RearPortTemplate.objects.filter(device_type=device_type):
+            for i in range(1, rear_port.positions + 1):
+                pair_id = f'{rear_port.pk}:{i}'
+                if pair_id not in occupied_rear_port_positions:
+                    pair_label = f'{rear_port.name}:{i}'
+                    choices.append(
+                        (pair_id, pair_label)
+                    )
+        return choices
+
 
 class RearPortTemplateForm(ModularComponentTemplateForm):
     fieldsets = (
@@ -1598,9 +1620,6 @@ class FrontPortForm(FrontPortFormMixin, ModularDeviceComponentForm):
         ),
     )
 
-    port_mapping_model = PortMapping
-    rear_port_model = RearPort
-
     class Meta:
         model = FrontPort
         fields = [
@@ -1611,12 +1630,13 @@ class FrontPortForm(FrontPortFormMixin, ModularDeviceComponentForm):
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
 
-        # Populate rear port choices
         if device_id := self.data.get('device') or self.initial.get('device'):
-            parent_filter = Q(device=device_id)
+            device = Device.objects.get(pk=device_id)
         else:
             return
-        self.fields['rear_ports'].choices = self._get_rear_port_choices(parent_filter, self.instance)
+
+        # Populate rear port choices
+        self.fields['rear_ports'].choices = self._get_rear_port_choices(device, self.instance)
 
         # Set initial rear port mappings
         if self.instance.pk:
@@ -1625,6 +1645,27 @@ class FrontPortForm(FrontPortFormMixin, ModularDeviceComponentForm):
                 for mapping in PortMapping.objects.filter(front_port_id=self.instance.pk)
             ]
 
+    def _get_rear_port_choices(self, device, front_port):
+        """
+        Return a list of choices representing each available rear port & position pair on the device, excluding those
+        assigned to the specified instance.
+        """
+        occupied_rear_port_positions = [
+            f'{mapping.rear_port_id}:{mapping.rear_port_position}'
+            for mapping in device.port_mappings.exclude(front_port=front_port.pk)
+        ]
+
+        choices = []
+        for rear_port in RearPort.objects.filter(device=device):
+            for i in range(1, rear_port.positions + 1):
+                pair_id = f'{rear_port.pk}:{i}'
+                if pair_id not in occupied_rear_port_positions:
+                    pair_label = f'{rear_port.name}:{i}'
+                    choices.append(
+                        (pair_id, pair_label)
+                    )
+        return choices
+
 
 class RearPortForm(ModularDeviceComponentForm):
     fieldsets = (

netbox/dcim/signals.py

@@ -211,16 +211,12 @@ def sync_cached_scope_fields(instance, created, **kwargs):
     for model in (Prefix, Cluster, WirelessLAN):
         qs = model.objects.filter(**filters)
 
-        # Bulk update cached fields to avoid O(N) performance issues with large datasets.
-        # This does not trigger post_save signals, avoiding spurious change log entries.
-        objects_to_update = []
         for obj in qs:
             # Recompute cache using the same logic as save()
             obj.cache_related_objects()
-            objects_to_update.append(obj)
-
-        if objects_to_update:
-            model.objects.bulk_update(
-                objects_to_update,
-                ['_location', '_site', '_site_group', '_region']
-            )
+            obj.save(update_fields=[
+                '_location',
+                '_site',
+                '_site_group',
+                '_region',
+            ])

netbox/dcim/views.py

@@ -1845,7 +1845,6 @@ class ModuleTypeBulkEditView(generic.BulkEditView):
 class ModuleTypeBulkRenameView(generic.BulkRenameView):
     queryset = ModuleType.objects.all()
     filterset = filtersets.ModuleTypeFilterSet
-    field_name = 'model'
 
 
 @register_model_view(ModuleType, 'bulk_delete', path='delete', detail=False)

netbox/extras/api/serializers_/configcontexts.py

@@ -28,7 +28,7 @@ class ConfigContextProfileSerializer(PrimaryModelSerializer):
     )
     data_file = DataFileSerializer(
         nested=True,
-        required=False
+        read_only=True
     )
 
     class Meta:
@@ -143,7 +143,7 @@ class ConfigContextSerializer(OwnerMixin, ChangeLogMessageSerializer, ValidatedM
     )
     data_file = DataFileSerializer(
         nested=True,
-        required=False
+        read_only=True
     )
 
     class Meta:

netbox/extras/tests/test_api.py

@@ -1,5 +1,4 @@
 import datetime
-import hashlib
 
 from django.contrib.contenttypes.models import ContentType
 from django.urls import reverse
@@ -8,7 +7,7 @@ from rest_framework import status
 
 from core.choices import ManagedFileRootPathChoices
 from core.events import *
-from core.models import DataFile, DataSource, ObjectType
+from core.models import ObjectType
 from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Rack, Location, RackRole, Site
 from extras.choices import *
 from extras.models import *
@@ -732,51 +731,6 @@ class ConfigContextProfileTest(APIViewTestCases.APIViewTestCase):
         )
         ConfigContextProfile.objects.bulk_create(profiles)
 
-    def test_update_data_source_and_data_file(self):
-        """
-        Regression test: Ensure data_source and data_file can be assigned via the API.
-
-        This specifically covers PATCHing a ConfigContext with integer IDs for both fields.
-        """
-        self.add_permissions(
-            'core.view_datafile',
-            'core.view_datasource',
-            'extras.view_configcontextprofile',
-            'extras.change_configcontextprofile',
-        )
-        config_context_profile = ConfigContextProfile.objects.first()
-
-        # Create a data source and file
-        datasource = DataSource.objects.create(
-            name='Data Source 1',
-            type='local',
-            source_url='file:///tmp/netbox-datasource/',
-        )
-        # Generate a valid dummy YAML file
-        file_data = b'profile: configcontext\n'
-        datafile = DataFile.objects.create(
-            source=datasource,
-            path='dir1/file1.yml',
-            last_updated=now(),
-            size=len(file_data),
-            hash=hashlib.sha256(file_data).hexdigest(),
-            data=file_data,
-        )
-
-        url = self._get_detail_url(config_context_profile)
-        payload = {
-            'data_source': datasource.pk,
-            'data_file': datafile.pk,
-        }
-        response = self.client.patch(url, payload, format='json', **self.header)
-        self.assertHttpStatus(response, status.HTTP_200_OK)
-
-        config_context_profile.refresh_from_db()
-        self.assertEqual(config_context_profile.data_source_id, datasource.pk)
-        self.assertEqual(config_context_profile.data_file_id, datafile.pk)
-        self.assertEqual(response.data['data_source']['id'], datasource.pk)
-        self.assertEqual(response.data['data_file']['id'], datafile.pk)
-
 
 class ConfigContextTest(APIViewTestCases.APIViewTestCase):
     model = ConfigContext
@@ -858,51 +812,6 @@ class ConfigContextTest(APIViewTestCases.APIViewTestCase):
         rendered_context = device.get_config_context()
         self.assertEqual(rendered_context['bar'], 456)
 
-    def test_update_data_source_and_data_file(self):
-        """
-        Regression test: Ensure data_source and data_file can be assigned via the API.
-
-        This specifically covers PATCHing a ConfigContext with integer IDs for both fields.
-        """
-        self.add_permissions(
-            'core.view_datafile',
-            'core.view_datasource',
-            'extras.view_configcontext',
-            'extras.change_configcontext',
-        )
-        config_context = ConfigContext.objects.first()
-
-        # Create a data source and file
-        datasource = DataSource.objects.create(
-            name='Data Source 1',
-            type='local',
-            source_url='file:///tmp/netbox-datasource/',
-        )
-        # Generate a valid dummy YAML file
-        file_data = b'context: config\n'
-        datafile = DataFile.objects.create(
-            source=datasource,
-            path='dir1/file1.yml',
-            last_updated=now(),
-            size=len(file_data),
-            hash=hashlib.sha256(file_data).hexdigest(),
-            data=file_data,
-        )
-
-        url = self._get_detail_url(config_context)
-        payload = {
-            'data_source': datasource.pk,
-            'data_file': datafile.pk,
-        }
-        response = self.client.patch(url, payload, format='json', **self.header)
-        self.assertHttpStatus(response, status.HTTP_200_OK)
-
-        config_context.refresh_from_db()
-        self.assertEqual(config_context.data_source_id, datasource.pk)
-        self.assertEqual(config_context.data_file_id, datafile.pk)
-        self.assertEqual(response.data['data_source']['id'], datasource.pk)
-        self.assertEqual(response.data['data_file']['id'], datafile.pk)
-
 
 class ConfigTemplateTest(APIViewTestCases.APIViewTestCase):
     model = ConfigTemplate

netbox/ipam/forms/model_forms.py

@@ -372,8 +372,8 @@ class IPAddressForm(TenancyForm, PrimaryModelForm):
                     'virtual_machine_id': instance.assigned_object.virtual_machine.pk,
                 })
 
-        # Disable object assignment fields if the IP address is designated as primary or OOB
-        if self.initial.get('primary_for_parent') or self.initial.get('oob_for_parent'):
+        # Disable object assignment fields if the IP address is designated as primary
+        if self.initial.get('primary_for_parent'):
             self.fields['interface'].disabled = True
             self.fields['vminterface'].disabled = True
             self.fields['fhrpgroup'].disabled = True

netbox/ipam/models/ip.py

@@ -940,13 +940,6 @@ class IPAddress(ContactsMixin, PrimaryModel):
                     _("Cannot reassign IP address while it is designated as the primary IP for the parent object")
                 )
 
-            # can't use is_oob_ip as self.assigned_object might be changed
-            if hasattr(original_parent, 'oob_ip') and original_parent.oob_ip_id == self.pk:
-                if parent != original_parent:
-                    raise ValidationError(
-                        _("Cannot reassign IP address while it is designated as the OOB IP for the parent object")
-                    )
-
         # Validate IP status selection
         if self.status == IPAddressStatusChoices.STATUS_SLAAC and self.family != 6:
             raise ValidationError({

netbox/netbox/graphql/filters.py

@@ -3,7 +3,7 @@ from typing import TYPE_CHECKING
 
 import strawberry_django
 from strawberry import ID
-from strawberry_django import ComparisonFilterLookup, FilterLookup
+from strawberry_django import FilterLookup
 
 from core.graphql.filter_mixins import ChangeLoggingMixin
 from extras.graphql.filter_mixins import CustomFieldsFilterMixin, JournalEntriesFilterMixin, TagsFilterMixin
@@ -23,7 +23,7 @@ __all__ = (
 
 @dataclass
 class BaseModelFilter:
-    id: ComparisonFilterLookup[ID] | None = strawberry_django.filter_field()
+    id: FilterLookup[ID] | None = strawberry_django.filter_field()
 
 
 class ChangeLoggedModelFilter(ChangeLoggingMixin, BaseModelFilter):

netbox/netbox/ui/panels.py

@@ -164,7 +164,7 @@ class ObjectAttributesPanel(ObjectPanel, metaclass=ObjectAttributesPanelMeta):
         """
         label = name[:1].upper() + name[1:]
         label = label.replace('_', ' ')
-        return _(label)
+        return label
 
     def get_context(self, context):
         # Determine which attributes to display in the panel based on only/exclude args

netbox/project-static/src/select/classes/dynamicTomSelect.ts

@@ -75,10 +75,16 @@ export class DynamicTomSelect extends TomSelect {
   load(value: string) {
     const self = this;
 
+    // Save current selection before clearing
+    const currentValue = self.getValue();
+
     // Automatically clear any cached options. (Only options included
     // in the API response should be present.)
     self.clearOptions();
 
+    // Clear user_options to prevent the pre-selected option from being treated specially
+    (self as any).user_options = {};
+
     // Populate the null option (if any) if not searching
     if (self.nullOption && !value) {
       self.addOption(self.nullOption);
@@ -98,16 +104,29 @@ export class DynamicTomSelect extends TomSelect {
       .then(response => response.json())
       .then(apiData => {
         const results: Dict[] = apiData.results;
-        const options: Dict[] = [];
-        for (const result of results) {
+
+        // Add options and manually set $order to ensure correct sorting
+        results.forEach((result, index) => {
           const option = self.getOptionFromData(result);
-          options.push(option);
+          self.addOption(option);
+          // Set $order after addOption() to override any special handling of pre-selected items
+          const key = option[self.settings.valueField as string] as string;
+          if (self.options[key]) {
+            (self.options[key] as any).$order = index;
           }
-        return options;
-      })
-      // Pass the options to the callback function
-      .then(options => {
-        self.loadCallback(options, []);
+        });
+
+        self.loading--;
+        if (self.loading === 0) {
+          self.wrapper.classList.remove(self.settings.loadingClass as string);
+        }
+
+        // Restore the current selection
+        if (currentValue && !self.items.includes(currentValue as string)) {
+          self.items.push(currentValue as string);
+        }
+
+        self.refreshOptions(false);
       })
       .catch(() => {
         self.loadCallback([], []);

netbox/project-static/src/select/dynamic.ts

@@ -49,6 +49,9 @@ export function initDynamicSelects(): void {
       labelField: LABEL_FIELD,
       maxOptions: MAX_OPTIONS,
 
+      // Preserve API response order
+      sortField: '$order',
+
       // Disable local search (search is performed on the backend)
       searchField: [],
 

netbox/translations/en/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-01-16 05:04+0000\n"
+"POT-Creation-Date: 2026-01-13 05:05+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -2435,7 +2435,7 @@ msgstr ""
 msgid "Change logging is not supported for this object type ({type})."
 msgstr ""
 
-#: netbox/core/models/config.py:21 netbox/core/models/data.py:284
+#: netbox/core/models/config.py:21 netbox/core/models/data.py:282
 #: netbox/core/models/files.py:29 netbox/core/models/jobs.py:60
 #: netbox/extras/models/models.py:847 netbox/extras/models/notifications.py:39
 #: netbox/extras/models/notifications.py:195
@@ -2541,63 +2541,58 @@ msgstr ""
 msgid "Unknown backend type: {type}"
 msgstr ""
 
-#: netbox/core/models/data.py:131
-#, python-brace-format
-msgid "URLs for local sources must start with {scheme} (or specify no scheme)"
-msgstr ""
-
-#: netbox/core/models/data.py:182
+#: netbox/core/models/data.py:180
 msgid "Cannot initiate sync; syncing already in progress."
 msgstr ""
 
-#: netbox/core/models/data.py:195
+#: netbox/core/models/data.py:193
 msgid ""
 "There was an error initializing the backend. A dependency needs to be "
 "installed: "
 msgstr ""
 
-#: netbox/core/models/data.py:288 netbox/core/models/files.py:33
+#: netbox/core/models/data.py:286 netbox/core/models/files.py:33
 #: netbox/netbox/models/features.py:67
 msgid "last updated"
 msgstr ""
 
-#: netbox/core/models/data.py:298 netbox/dcim/models/cables.py:622
+#: netbox/core/models/data.py:296 netbox/dcim/models/cables.py:622
 msgid "path"
 msgstr ""
 
-#: netbox/core/models/data.py:301
+#: netbox/core/models/data.py:299
 msgid "File path relative to the data source's root"
 msgstr ""
 
-#: netbox/core/models/data.py:305 netbox/ipam/models/ip.py:507
+#: netbox/core/models/data.py:303 netbox/ipam/models/ip.py:507
 msgid "size"
 msgstr ""
 
-#: netbox/core/models/data.py:308
+#: netbox/core/models/data.py:306
 msgid "hash"
 msgstr ""
 
-#: netbox/core/models/data.py:312
+#: netbox/core/models/data.py:310
 msgid "Length must be 64 hexadecimal characters."
 msgstr ""
 
-#: netbox/core/models/data.py:314
+#: netbox/core/models/data.py:312
 msgid "SHA256 hash of the file data"
 msgstr ""
 
-#: netbox/core/models/data.py:328
+#: netbox/core/models/data.py:326
 msgid "data file"
 msgstr ""
 
-#: netbox/core/models/data.py:329
+#: netbox/core/models/data.py:327
 msgid "data files"
 msgstr ""
 
-#: netbox/core/models/data.py:402
+#: netbox/core/models/data.py:400
 msgid "auto sync record"
 msgstr ""
 
-#: netbox/core/models/data.py:403
+#: netbox/core/models/data.py:401
 msgid "auto sync records"
 msgstr ""
 
@@ -11245,13 +11240,7 @@ msgid ""
 "parent object"
 msgstr ""
 
-#: netbox/ipam/models/ip.py:947
-msgid ""
-"Cannot reassign IP address while it is designated as the OOB IP for the "
-"parent object"
-msgstr ""
-
-#: netbox/ipam/models/ip.py:953
+#: netbox/ipam/models/ip.py:946
 msgid "Only IPv6 addresses can be assigned SLAAC status"
 msgstr ""
 
@@ -12500,8 +12489,8 @@ msgstr ""
 msgid "Delete Selected"
 msgstr ""
 
-#: netbox/netbox/plugins/navigation.py:53
-#: netbox/netbox/plugins/navigation.py:89
+#: netbox/netbox/plugins/navigation.py:55
+#: netbox/netbox/plugins/navigation.py:88
 msgid "Permissions must be passed as a tuple or list."
 msgstr ""
 
@@ -12509,7 +12498,7 @@ msgstr ""
 msgid "Buttons must be passed as a tuple or list."
 msgstr ""
 
-#: netbox/netbox/plugins/navigation.py:95
+#: netbox/netbox/plugins/navigation.py:92
 msgid "Button color must be a choice within ButtonColorChoices."
 msgstr ""
 

scripts/git-hooks/pre-commit

@@ -0,0 +1,16 @@
+#!/bin/sh
+# TODO: Remove this file in NetBox v4.3
+# This script has been maintained to ease transition to the pre-commit tool.
+
+exec 1>&2
+
+EXIT=0
+RED='\033[0;31m'
+YELLOW='\033[0;33m'
+NOCOLOR='\033[0m'
+
+printf "${YELLOW}The pre-commit hook script is obsolete. Please use pre-commit instead:${NOCOLOR}\n"
+printf "  pip install pre-commit\n"
+printf "  pre-commit install${NOCOLOR}\n"
+
+exit 1