grokability/snipe-it v8.7.0 on GitHub

Caution

This version of Snipe-IT REQUIRES PHP 8.2.0 or greater, 8.4+ recommended. PHP 8.2 is still in security release support until 31 Dec 2026, but let's not play that game

Buckle up, friends. This one has been simmering on develop for a while and it turned into a proper feast. 1,182 commits across 136 pull requests, several long-running feature branches finally released, and a lot of little "oh crap THAT was still broken?" cleanups along the way. Grab a coffee.

The Highlight Reel

Replenish and orders (for real this time)

Accessories, consumables, and components now have proper "add stock" and "remove stock" flows with a ledger. Instead of admins hand-editing the qty field on a parent row and hoping for the best, every quantity change writes an action-log entry with the delta, a note, and (optionally) an order number. This leads the way to orders being a real first-class object that you can start from and add things to. (That's not here yet, but it's coming.)

We skipped licenses for now, as they have a more complex structure, but we wanted to get at least these three into your hands now.

LDAP wizard, from monolith to multi-step

The mile-long "LDAP settings" blade has been retired to a nice pasture. In its place: a four-step Livewire wizard (Connection → Auth + Scope → Attribute Mapping → Sync + Defaults) with a per-step "Test connection" button so you can find out you fat-fingered the bind DN before you save. Department and group sync now runs on first login too, so people don't show up in Snipe-IT as departmentless ghosts until an admin manually pokes them. We still include - for now - a link to the old LDAP form just in case any issues come up.

We also fixed a handful of fields that were not named correctly and therefore were never correctly mapping. Yay!

SCIM: now with Okta and Microsoft Entra multi-company support

Entra/Okta (and possibly others) were rejecting Snipe-IT's SCIM responses for multi-company setups. Not anymore. Also fixed: SCIM group handling, SCIM addresses handling, and a nested-attributes case that could throw a 500. If you've been avoiding automated SCIM provisioning because it "mostly" worked, come back and try again. (Srsly, SCIM rules.)

Requestable accessories

Users can now request accessories from the requestable-items link, not just assets and asset models. Same familiar request flow, same admin queue, just with a wider net of things people can ask for. (We're going to be refactoring requestables in the next few weeks as well, to work out some of the friction points folks have been surfacing over time.)

Superuser Impersonation

Superusers can now impersonate other users to reproduce a bug report without needing the user's password. Great for "I clicked the button and nothing happened" requests where you can't tell if it's a permission gate, a browser thing, or wishful thinking.

This is OP by design, so it requires extra steps. You'll need to add ALLOW_USER_IMPERSONATION=your-username to your .env (with your-username being the username you want to grant impersonation abilities to) to enable this. Superusers cannot impersonate each other.

Transfer all items between users

When someone leaves the company, one click moves every asset/ accessory/consumable/license assigned to them over to their replacement.

Optional password on user creation

For SSO-only shops or orgs where the user is never going to login, the "password required" fields are now optional. If the "this user can login" button is checked, the password field is required, otherwise it's hidden.

Quickscan check-in by serial

Quickscan check-in now accepts either an asset tag OR a serial number. Barcodes can vary in what they encode, so this stops the "wait, our label prints the serial not the tag" problems.

Component report

Long-requested. A proper component-level report showing what's assigned where, plus its own bulk actions.

Importer wizard

The CSV importer got the same treatment as LDAP: proper wizard flow with column mapping, preview, and clearer error surfacing when a row won't take. alert_on_response on category imports now actually gets read, API-driven asset imports stop writing null created_by, and the general "why did this row fail" story is a whole lot better.

Backup + restore safety net

Restore actually validates the uploaded archive now, AND takes a safety backup of the current database BEFORE it wipes anything. If the restore then blows up, you get a pointer to the pre-restore backup file instead of an empty database and a heart attack. Backups also got a tooltip explaining the pruning behavior, and the pre-restore snapshot honors your DB prefix if you're using one.

Bulk everything (well, almost)

Bulk operations expanded to (deep breath): audit, delete-accessories, delete-companies, delete-departments, delete-depreciations, delete-status-labels, delete-imports, delete-licenses, checkin-with-location. The refactored bulk-actions dropdown now dynamically enables/disables actions based on what's actually valid for the selected rows, so you can't accidentally try to "bulk restore" a batch of items that aren't deleted.

FMCS Floater Mode

We added a new setting in Admin > General called "floater mode". This allows items/users with no company assigned to "float" and be visible to everyone. With floater mode enabled with FMCS:

A user in Company A can see their own company's records AND every uncompanied record.
A user with no company can see every record in the system.
An asset with no company can be checked out to anyone.
Any asset can be checked out to a target that has no company.

Read more about FMCS and floater mode in the docs!

UI + accessibility

CSS sticky columns replace the bootstrap-table fixed-columns extension across the board. No more jagged / drifting last-column overlay on narrow viewports. The old fixed-columns extension is out of the bundle entirely.
Alert menu now Livewire-driven, no more full-page refresh to see a new alert appear, and this should result in faster page loads overall for folks who have the "show alerts in menu" option checked.
Accessibility pass. Aria labels, alt tags, help-text component, inline error component. WCAG AAA is the target.
Advanced-search deeplinks. The filter modal now writes ?filter[...] to the URL, so you can share "everyone in Sales with a laptop older than 4 years" with a coworker just by pasting the link.

Datepicker Custom Field Type

Where appropriate, datepickers have been replaced by a date time picker, where precise times can be selected - and datetime picker is now an available custom field type.

We added a neat little preview for your custom fields as well, so you can see exactly what your users will see in the asset form.

Bug fixes/features worth a callout

Duplicate checkout requests on double-click no longer create duplicate rows.
Maintenance responsible-party now respects a deliberate clear (null) instead of silently filling in the acting user (#19452).
Currency exports normalized across every table's XLSX / CSV output (#19415).
MS Teams webhook payloads formatted correctly.
EULA PDF no longer chokes on nested markdown, and the end-user download works too.
Checkin location choices were refactored to be more consistent across checkout screens.
Category / model view pages should run faster now, as we fixed an N+1 loading issue.
Login Page now respects light/dark mode previously selected
FMCS+Location Scoping now allows you to download a CSV of the mismatched items

Parent companies

One-level company hierarchy is here. Set a company's parent, and child companies inherit the FMCS scoping rules you'd expect. If you've been building out org structure with a bunch of top-level companies because you had no other option, you can now group them the way your organization actually looks, and you don't have to add people to every single sub-company manually if they should be able to manage items from several companies.

Upgrading

Same as always: php upgrade.php from your Snipe-IT directory. Full walkthrough at snipe-it.readme.io/docs/upgrading.

Docs note: we're in the middle of updating the docs to reflect all the new features, screenshots, and changes in this release. If you see something in the app that isn't in the docs yet, that's why. We're working through them.

What's Changed

SCIM: added throttle by @snipe in #19194
Custom Reports: Fix action logs sub query select to item_id. by @Godmartinz in #19196
Styling - Fixed FD-56071 - Apply nav and link colors appropriately by @marcusmoore in #19202
Bump actions/checkout from 6 to 7 by @dependabot[bot] in #19211
Bulk Asset Checkin: Fixed #19214 Added option to change location by @snipe in #19216
Bulk Asset Edit: Fixes #19081 - Prevent Bulk Edit custom fields from populating default values. by @Godmartinz in #19159
🎥 API/Settings: Added optional requirement for non-generic user agent by @snipe in #19218
Assets: Fixed #19229 - give first serial focus if cloning by @snipe in #19237
Bump actions/cache from 5 to 6 by @dependabot[bot] in #19240
Fixed #18554: Custom Component Report by @marcusmoore in #19145
Branding Uploads: Fixed #18267 branding s3 empty path by @snipe in #19241
Custom Asset Report: Fixed #18281 - isolate asset tag in “checked out to" by @snipe in #19242
🖼️ Users: Added user maintenances count and tab by @snipe in #19243
Category Detail Pages: Speed up category view and models associated by @snipe in #19247
FMCS scoping: drop unique DB constraint, scope in the importer by @snipe in #19251
Adds parent::prepareForValidation to UpdateAssetRequest by @spencerrlongg in #19250
Webhooks: Update validation to only http/https only, optional internal config flag by @snipe in #19255
SCIM Groups: Fixed RB-21764 by @snipe in #19257
Labels: Adds Dymo 2112284 [FD-56190] by @Godmartinz in #19249
Factories: Manually set non-fillable properties in CheckoutAcceptanceFactory by @marcusmoore in #19233
Acceptances: Extract CreateCheckoutAcceptanceAction by @marcusmoore in #19234
General Settings: Fix alignment of model dropdown label by @Godmartinz in #19245
Update GitHub Actions security by @marcusmoore in #19244
Floater mode: tightened superuser gate by @snipe in #19232
Importer: Fixed FD-56113 - scope to user who uploaded by @snipe in #19260
Companies: Added bulk delete, fixed #19261 by @snipe in #19262
Companies: Added parent company functionality by @snipe in #19230
FMCS Location+Parent Scoping: Fixed FD-53555 - Adds company-scoped dropdown for parent location in GUI by @snipe in #19185
Advanced Search: Added clear search to pills, made deeplinking work w… by @snipe in #19264
Status Labels: Added bulk delete on index by @snipe in #19266
Departments: Added bulk delete by @snipe in #19267
Depreciations: Added bulk delete from index by @snipe in #19268
Assets API: Fixed #18727 and #16883 - added bulk asset edit and audit API endpoints by @snipe in #19271
Added bulk delete accessories by @snipe in #19272
Importer: Fixed 18338 - Added pagination and bulk delete by @snipe in #19273
Better handle target cannot be blank erroring by @snipe in #19274
Added blade components for checkboxes, radios, and inline checkboxes by @snipe in #19259
Refactor the label engine into partials for easier maintainability by @snipe in #18928
BS Tables Export: Fixed #19270 - load fonts for Cyrillic fix by @snipe in #19276
🎥 Superusers: Adds the ability to login as another non-superuser by @snipe in #19280
Backup Restore: Refactored code, improve error messaging, speed up MySQL import by @uberbrady in #19285
User Print All: Fixes #19177 - change license count target to direct licenses by @Godmartinz in #19283
🎥 Bootstrap Tables: Fixed #18973 -Show API error if bootstrap tables errors by @snipe in #19287
Rename company_id on users table by @snipe in #19290
Accessibility: Added aria labels to flash messages and static callouts by @snipe in #19291
Added inline error blade component, converted notifications blade into component by @snipe in #19292
Auth: Fixed FD-56498 - check username case for non-local logins by @snipe in #19293
2FA: Fixed FD-56499 - Stricter 2FA enforcement for existing PATs on API by @snipe in #19294
Accessibility: Added missing alt tags, aria labels by @snipe in #19297
Added form help text component by @snipe in #19298
SCIM: For empty addresses, we were returning empty arrays instead of skipping by @uberbrady in #19300
EULA PDF: Fixed #18176 - preserve nested markdown lists in acceptance PDF by @TowyTowy in #19295
Componentize forms by @snipe in #19301
Add image rendering style for QR images by @krmax44 in #19304
Backups: Fixed #19305 - show tooltip explaining that backup deleting … by @snipe in #19308
Fixed #19302 - add focus to serials if auto increment is on by @snipe in #19309
🎥 Checkouts: Added side panel for current checkouts to all target types and checkout screens by @snipe in #19307
CSV Import: Fixed #13995 - purchase date silently stored as 1970-01-01 for unparseable dates by @TowyTowy in #19306
CSV Import: License importer stores 1970-01-01 for unparseable expiration & termination dates by @TowyTowy in #19310
Added chunking and memory tracking in seeders by @snipe in #19311
CSV Import: User importer rejects the entire row when start/end dates aren't exactly Y-m-d by @TowyTowy in #19313
Make accessories requestable by @olivierlambert in #19169
🎥 Fixed #17063, #18776, #8855, and #11580 - Added datetime picker by @snipe in #19315
CSV Import: update mode silently resets requestable and cannot clear byod by @TowyTowy in #19316
Update edit profile form to use blade components by @snipe in #19318
Migrate settings > asset tags and settings > api keys to new blade components by @snipe in #19319
Migrate change password page to new form components by @snipe in #19321
🎥 Bulk Checkout / Checkin: Rejection Warning Side Panel + Related Cleanup by @snipe in #19322
Componentize bulk delete forms by @snipe in #19323
File Uploads: Fixed FD-56588 - tighter controls on model files by @snipe in #19324
Kits: Fixed FD-56594 - tightened up kit API routes, fixed typo by @snipe in #19325
Bulk Asset Restore: Fixed FD-56301 - tighter guards on bulk restoring by @snipe in #19327
Added case-sensitivity note for login by @snipe in #19328
Consumable checkout: Fixed FD-56262 - use auth()->id instead of $user->id by @snipe in #19329
Checkouts: Fixed FD-56263 - disallow checkouts to soft-deleted targets by @snipe in #19330
Quickscan Audit: Fixed #17143 - allow audit by asset tag or serial number by @snipe in #19332
Optimize/Modernize snipeit:purge artisan command by @snipe in #19333
Added console command to cleanup orphaned action_logs by @snipe in #19335
Screenshot script by @snipe in #19337
Maintenances: renamed completion_date to expected_completion_date by @snipe in #19339
SCIM: Return 400 instead of 500 when a client sends a filter-key body by @snipe in #19340
Data Purge: Fixed #17580, code refinements from #19333 by @snipe in #19338
Locations Print Assigned: Fixed #19093 - accessories not showing by @snipe in #19342
Redirects: Fixed #15214 - return to index page with query string by @snipe in #19345
Docker+Proxy: Fixed #6852 - Removed headers in trustedproxy config by @snipe in #19346
Profile EULA view: Fixed #19344 - fixed permissions on downloading EULAS by @snipe in #19348
SCIM: Fixed #19347 - added complex comparison for enterprise schemas by @snipe in #19349
FMCS+Floater: Fixed #19192 - make company required if floater is disabled by @snipe in #19341
Better handle SCIM with malformed key attributes by @snipe in #19353
Labels: Adds warranty and warranty expiration date as label field options by @Godmartinz in #19355
🖼️ Locations + Companies: always show parent in dropdown select lists by @snipe in #19356
🎥 Fixed #5834 - Added transfer from one user to another by @snipe in #19350
add migration to restore defaults for labels by @Godmartinz in #19357
🎥 User Create/Edit: Added #19213 - allow skipping password if user cannot login by @snipe in #19359
Removed orphaned API routes by @marcusmoore in #19361
User Create/Edit: Convert to blade components by @snipe in #19363
Upgrade our forked version of laravel-scim-server to handle ordering by @uberbrady in #19358
Alert Menu: Switch to Livewire + kill low-inventory N+1 by @snipe in #19364
Importer: Fixed FD-56678 - Scope to users/superadmins by @snipe in #19365
🎥 Importer improvements by @snipe in #19366
Updated settings section to form blade components by @snipe in #19367
🎥 Ldap wizard by @snipe in #19368
More inline "demo locked" passes by @snipe in #19370
🖼️ CSS: Moved inline to overrides.less, added light/dark to login/error pages by @snipe in #19371
Convert hardware edit/create to component fields by @snipe in #19373
Added maintenance bulk actions (complete and delete) by @snipe in #19383
Harden internal URL redirect safety by @snipe in #19386
Fixes #19235: use total var to avoid multiple database queries by @Sxderp in #19236
Compare usernames case insensitively by @snipe in #19391
Importer: Fixed FD-56712 - Guard against asset importer created_by null by @snipe in #19402
FMCS+Floater Mode: Fixed #19394 - dropdowns in floater mode by @snipe in #19404
Fixed #19401 - simplify checkin screen location choices by @snipe in #19403
🎥 FMCS+Location Scoping: Added download CSV to location scope check by @snipe in #19409
Asset Audit: Fixed #17168 - added bulk audit to API and UI by @snipe in #19410
Licenses: Bulk actions refactor with licenses, added bulk checkin and delete to licenses by @snipe in #19413
Fixed MS Teams type error by @snipe in #19420
Bump actions/stale from 10 to 11 by @dependabot[bot] in #19424
Fixed #19414 - mojibake fix for importer by @snipe in #19425
Added phpstan ruleset and baseline, added phpmd back by @snipe in #19436
Update CLAUDE.md with lint commands and architecture notes by @KeplerAeroIT in #19434
Backup: Accounted for prefix during pre-restore backup by @marcusmoore in #19433
Added HEMA labels template by @FloVnst in #19382
Stable secondary sort on the uploaded-files listing by @rodchristiansen in #19376
Fixed #19428 - added StorageHelper for EULA and labels in S3 by @snipe in #19437
LDAP: Fixed #19206 - groups not syncing on first login by @snipe in #19438
LDAP: fixed typos, deliver the summary in a table in cli mode by @snipe in #19439
🎥 Replenish/Remove Consumables, Accessories and Components by @snipe in #19392
Installed Laravel Boost by @marcusmoore in #19431
Got multicompany support working with Entra SCIM by @uberbrady in #19440
Fixed #19415 - standardize currency on table export by @snipe in #19441
Fixed category importer silently ignoring the alert_on_response column by @TowyTowy in #19432
Fixed #19442 - Print button not working on Safari by @snipe in #19449
🎥 Fixed #19443 - better wrapping on small screens by @snipe in #19451
Labels: [FD-56300] Adds Zebra Z-Ultimate 10022964 & 18939 by @Godmartinz in #19430
Fixed #19458 - remove sticky column, fully remove BS tables sticky column extension by @snipe in #19460

Boring Code Stuff for Nerdy Nerds

PHPStan (larastan) + PHPMD wired into CI with baselines. New code holds a higher bar than the baseline.
Laravel Boost added as a dev dependency (v2.5.1).
Console commands. Orphan log cleanup, modernized purge command, better summary output.
Static analysis on PRs. CI runs analysis on every push and won't let baseline regressions slip through silently.

Security

This release includes 44 security fixes across authorization, cross-tenant scoping, SSRF / LFR, CSV formula injection, filesystem write-failure handling, race conditions, and a chunk of general hardening. Individual advisories are being held in draft until the fleet has had a chance to upgrade. We'll update these release notes once people have had a chance to update to latest.

Reporter shoutouts

Huge thanks to the security researchers who reported responsibly through the GitHub Security tab this cycle:

New Contributors

@TowyTowy made their first contribution in #19295
@krmax44 made their first contribution in #19304
@olivierlambert made their first contribution in #19169
@KeplerAeroIT made their first contribution in #19434
@FloVnst made their first contribution in #19382
@rodchristiansen made their first contribution in #19376

Full Changelog: v8.6.3...v8.7.0