netbox-community/netbox-topology-views v5.0.0-beta.1

on GitHub

⚠️ Breaking changes

• The topology respects object-level permissions.:
• Saving coordinates needs the matching permission for each node type: add/change on coordinate, circuitcoordinate, powerpanelcoordinate or powerfeedcoordinate.

🔒 Security

• Fixed several XSS issues. Node and cable tooltips are now escaped (provider, type, site, location, rack, serial, labels, etc.). Topology data is embedded with json_script. PNG export escapes label text. The image picker no longer uses innerHTML.
• Fixed path traversal in role image settings. Only image files inside the plugin's image directories are accepted.
• Removed the client-supplied user_id from the Individual Options form.
• Content types for role images are limited to the supported models.

🐛 Fixes

• Fixed circuit handling. Each circuit cable is now processed once, and circuit links are only drawn when both ends are visible.
• Fixed grid snapping. It no longer fails on JavaScript globals, and grid_size is parsed reliably from the query string or from saved filters.
• Fixed settings being cached across requests: get_query_settings no longer uses lru_cache.
• Fixed changing the theme re-enabling physics on the graph.
• Coordinate saving failures are now reported in a toast.
• Fixed RoleImage static URLs that had a doubled leading slash.
• Image file extensions are matched case-insensitively.
• Fixed the __str__ typo on IndividualOptions.

✨ Improvements

• A layout progress bar is shown while the graph settles. Physics stops automatically once the graph is stable, after 1000 iterations or after 15 seconds, so large topologies no longer spin indefinitely.
• The graph background and border follow the NetBox (Tabler) theme variables.
• Error toasts stay visible for 8 seconds, and image save errors show the server's message.
• Added a CoordinateGroup FilterSet, and filtersets are wired into the coordinate REST API endpoints.
• Default coordinate groups are created with get_or_create (CoordinateGroup.get_default()). Coordinate saves are atomic and record change-log snapshots.
• Cleanup: removed the Python < 3.9 code paths, unused imports and the unused location_button.html template.

Full Changelog: v4.7.0...v5.0.0-beta.1