xoriin/NetMap v1.5.0

NetMap v1.5.0

on GitHub

[1.5.0] - 2026-08-02

Community acknowledgements

• Thanks to @WindowsStar for suggesting DHCP-aware monitoring, HTTP/HTTPS monitors, a distinct paused-device health state, and expected-offline monitoring.
• Thanks to @MFKDGAF for suggesting external IP tracking and for highlighting where the network-discovery documentation needed to be clearer.

Added

• Endpoint heartbeats in the Monitoring table — standalone HTTP/HTTPS endpoints now show their latest 30 check results inline, matching the at-a-glance heartbeat treatment used by inventory devices without requiring the endpoint popup.
• External IP address management — IPAM now tracks provider-assigned public allocations alongside internal subnets without mixing their data. Choose Add subnet → External range and enter either a CIDR or a start–end range containing at least two usable addresses. Each allocation records provider/account references, owner, service, status, tags, notes, utilization, and a paged per-address map. Public-range validation rejects private or special-purpose records, overlapping allocations are blocked, and resizing cannot orphan an existing assignment. Migration 0061_external_ip_tracking.
• DHCP-aware service checks — Monitoring can safely validate an inventory device acting as an IPv4 DHCP server. The device-scoped check sends DHCPINFORM to UDP 67 and requires a matching DHCPACK; it never discovers, requests, renews, reserves, or releases an address. Probe failures now retain a clear diagnostic in the device monitoring drilldown, and the all-in-one image includes only the low-port bind capability required for the DHCP client reply.
• Expected device state monitoring — writable users can mark a device as expected online or expected offline from its Monitoring popup using the themed Upside down switch. Fleet health, status details, filtering, alerts, and row state distinguish a deliberately offline device from an unexpected outage.
• Device type filter in Inventory — a device type picker sits alongside the group, location, and status filters. It lists only the types actually present in your inventory rather than all built-ins, with the same icons and colours as the table.
• Device type icons and colours in the device dialog — the Add/Edit Device window's Device type picker now shows each type's icon and colour instead of a plain dropdown.
• Colour-coded VLAN/group, location, and device type columns in Inventory — these columns now show coloured chips instead of inline dropdowns and plain text, so the table reads at a glance. Colours are managed in Admin → Device icons (a colour picker beside each device type, plus a Group & location colours panel); anything without an explicit colour gets a stable automatic colour derived from its name. Device type chips tint their existing icon rather than adding a separate swatch. The same chips appear in the device details panel, and the group/location filter dropdowns above the table show matching swatches. Per-device group and location are still changed from the device details panel (double-click the field) or the Inventory bulk-edit menu. Migration 0057_topology_group_color.
• Turn colour-coded columns off — Profile → Appearance has an on/off switch for the coloured chips. It's a per-account preference stored on the server, so it follows you across browsers and devices and doesn't affect anyone else. When off, the chips stay the same shape and size but render neutral grey, so nothing shifts in the table. Migration 0058_user_entity_colors.
• Bulk-edit dropdowns match the table — the VLAN / Group, Device type, and Location pickers in Inventory's Bulk menu now show the same colour swatches and device-type icons as the table rows, so a value is recognisable at a glance instead of by reading each label.
• Resizable Inventory columns — the Inventory table's columns can be dragged to resize like the Monitoring fleet table, with widths saved per browser; double-click any divider to restore the default layout.
• Advanced HTTP/HTTPS monitor options — standalone monitors now support flexible accepted status codes and ranges, custom headers, JSON/form/text/XML request bodies, Basic/Bearer/OAuth2 client-credentials/mTLS authentication, encrypted write-only secrets, proxies, custom CAs, redirect limits, separate retry intervals, cache busting, inverted monitors, keyword assertions, JSON-path assertions, descriptions, tags, response-size diagnostics, and TLS issuer/expiry tracking. The polished add/edit dialog uses focused General, Request, Validation, and Security folder tabs attached directly to one shared settings window—the same visual construction as the Monitoring Devices/Monitors switcher—and reveals only options relevant to the selected method and authentication type. The monitor overview shows assertion, request, authentication, and certificate health at a glance. Admin → Alerts adds a certificate-expiry trigger that can target one monitor or all monitors. Existing monitors retain their configured status range through migration 0056_monitor_http_options.
• API keys for external access — external scripts and integrations can now call the NetMap REST API with registered API keys instead of a browser session. Create keys from Profile → API keys (name + optional 30/90/365-day expiry; the key is shown once at creation), send them in an X-API-Key header, and revoke them at any time; SuperAdmins can view and revoke any user's keys from Admin → Security → API Keys. A key carries exactly its owner's role permissions (evaluated live, so role changes apply immediately), every existing /api/v1 endpoint works over API keys with the same JSON responses and permission gates as the web app, and keys are stored only as HMAC-SHA256 hashes — never in plaintext. Built-in abuse protection: per-key request rate limiting (default 120 requests/minute, configurable via API_KEY_RATE_LIMIT_*) and automatic lockout of sources repeatedly presenting invalid keys, both persistent across restarts. Key lifecycle events (create/revoke/lockout) are audit-logged. The syslog live-event WebSocket still requires a session token (documented limitation). See docs/API_ACCESS.md for a usage guide. Migrations 0045_api_keys, 0046_api_key_rate_limit.
• Shareable topology layouts — the Topology toolbar gains a Layouts manager: save the current canvas arrangement under a name, load or delete saved layouts, and share a layout with other users via a short share code. Another user enters the code to import their own independent copy (positions and display preferences). Codes can be revoked at any time; imported copies are unaffected. Migration 0048_layout_share_codes.
• What's New shown once per user — the post-update What's New popup is now acknowledged per user account on the server instead of per browser, so it no longer re-appears in new browsers, devices, or after cleared site data — and each user on a shared machine gets their own one-time showing. It can still be reopened any time from Admin → Version → What's New. Migration 0047_user_whats_new_ack.
• Interactive offline bar on Overview — the offline-devices banner now expands in place (like the IPAM conflicts banner) into a detail panel listing each offline device with its IP, type, group, and last-checked time, plus a jump to Inventory.
• Topology: find device — a search box in the topology toolbar filters by name, hostname, or IP; picking a match pans and zooms to the device with a highlight pulse.
• Topology: path highlighting — a new Path mode highlights the shortest link path between two clicked devices and dims everything else, making "what does this depend on?" answerable at a glance. Click the background or exit Path mode to clear.
• Topology: status-change pulses — devices whose live status changed since the previous poll briefly pulse amber, so an outage or recovery draws the eye without hunting for colour changes.
• Topology: link speeds — links can carry a speed (10 Mbps – 100 Gbps) set in the link form; edges render thicker for faster links and the speed appears in the edge label. Migration 0049_relationship_link_speed.
• Topology: mini-map — a corner overview shows all node positions and the current viewport rectangle; click anywhere on it to pan the main canvas. Built in-house, no new dependencies.
• Topology: shared-layout preview — before importing a shared layout code, a Preview button shows the layout's name, node count, last update, and a dot-plot of its arrangement.
• Topology: bulk select and assign — shift-drag box-selects multiple devices; a floating action bar assigns the selection to a group and/or site in one operation (dragging one selected node moves the whole selection, as before).
• Ping-loss percentage alert rule — Admin → Alerts now offers a "Ping loss above threshold" trigger: fires when a device's ICMP probe failure rate over a configurable trailing window (default 60 minutes) reaches a configurable percentage threshold, reusing the existing notification channels and cooldown. Migration 0050_alert_rule_ping_loss.
• IP reservation expiry reminders — Admin → System can enable a background check that notifies configured notification channels a set number of days before an IPAM reservation's expiry date (default 3 days), so reservations don't lapse unnoticed.
• PDF export for the topology canvas — the Topology toolbar's export menu gains a PDF option alongside PNG/SVG, rendering the canvas — including zone, device, and edge labels — as a single-page landscape PDF with no new dependency.
• Dedicated login history view in Admin Security — the Login & Audit History panel gains an "All activity" / "Login history" toggle; login history shows time, user, result (success, failed, blocked by rate limit, blocked by SSO requirement, or logout), and source IP for each event.
• Support contact info in Admin System settings — SuperAdmins can set a support email and/or URL that's appended to password-reset emails ("Need help? Contact …"), giving users somewhere to turn if a reset doesn't work.
• Restore dry-run validation — Admin → System → Database backup & restore now validates an uploaded backup file before touching the live database: signature, SQLite integrity check, expected-table check, and a preview of device/user/subnet/table counts and file size. Restoring is only offered after validation passes, and now requires typing restore to confirm — this replaces the live database entirely and cannot be undone.
• HTTP/HTTPS monitoring — service checks (Monitoring → service checks) gain full HTTP/HTTPS support: request method (GET/HEAD/POST/PUT/DELETE/OPTIONS/PATCH), an expected response-status range (default 200–399, configurable), an optional per-check timeout override, an opt-in "verify TLS certificate" toggle (checks default to unverified since self-signed certs are common on LAN devices), and a "follow redirects" toggle. Every check now records response time and — for HTTP/HTTPS — the returned status code, shown in the Monitoring table's service badges and the device drilldown panel. Migration 0052_service_check_http_options.
• Service check alert rules — Admin → Alerts gains two new triggers: "Service check goes down" fires the moment a specific (or any) service check transitions from up to down, and "Service check response time above threshold" fires when a check's response time exceeds a configurable millisecond threshold. Both can be scoped to one service check or left to apply fleet-wide, and reuse the existing notification channels and cooldown. Migration 0053_alert_rule_service_check.
• Scheduled backups with retention — Admin → System gains a background backup schedule: enable it, pick an interval (6h/12h/daily/weekly) and how many backups to keep, and NetMap writes a signed backup to disk on that cadence, automatically deleting the oldest copies beyond the retention count. The same panel lists existing scheduled backups with size and timestamp, and lets you download or delete any of them.
• Login history CSV export — the Login History view in Admin → Security gains an Export CSV button, downloading the currently filtered (all-users or single-user) login history as a CSV with time, user, result, and source IP.
• Clear all network changes — the Network changes dialog (Overview and Inventory) gains a Clear all button that resolves every pending change at once, with a typed confirmation for 5 or more. Rows are also clickable now — new device, IP change, and field change rows jump to Inventory, disappeared-device rows jump to Monitoring — making the list feel interactive instead of a static log.
• Standalone HTTP/HTTPS uptime monitoring — Monitoring now supports Uptime-Kuma-style monitors that track any HTTP/HTTPS endpoint independently of inventory devices: method, expected status range, timeout, TLS verification, redirect following, retries-before-down, and a per-monitor check interval (20s–1h). Monitors are checked by a dedicated background scheduler, keep 30 days of check history, and report 24h/7d uptime and average response time. The Monitoring page gains a "Monitors" tab — styled as a folder tab attached directly to the existing Devices table panel rather than a separate page — with its own stat row, add/edit/pause/delete controls, and a drilldown showing a heartbeat strip and recent check history per monitor. Two new alert rule triggers, "Standalone monitor goes down" and "Standalone monitor response time above threshold", reuse the existing notification channels and cooldown and can be scoped to one monitor or fleet-wide. Migrations 0054_alert_rule_monitor plus the new monitors/monitor_check_history tables.
• Monitoring device table gains a fixed sticky header — the Devices table on the Monitoring page now scrolls within its own panel (column headers stay pinned) instead of the whole page scrolling past the header row.

Fixed

• Container readiness waits for the backend — nginx no longer starts before Uvicorn has created its Unix socket, eliminating transient /api/health 502 responses during slow database maintenance. Startup allows up to five minutes for the backend, fails clearly if it exits, and prints netmap: startup complete only after the full nginx-to-Uvicorn health path responds successfully.
• Inventory latency matches Monitoring — the Inventory Latency column now shows the same 24-hour average RTT used by Monitoring and refreshes its values in place.
• IPAM map legend colours are visible — the portalled subnet-detail window now carries the IPAM status palette into its legend, so Device, DHCP lease/range, Reserved, Gateway, Free, and Net/Broadcast keys remain distinct in both themes.
• Topology group headers stay clear of device icons — group cards now reserve a dedicated title/count inset large enough for the rendered device frames and labels at normal canvas zoom, and the pointer-transparent header layer remains above device overlays so nearby status dots or icons cannot clip its text.
• API keys can be identified without exposing them — Profile and Admin Security show only a password-style mask plus the final four characters of each key, never its lookup prefix or secret. New key suffixes are stored at creation; existing keys acquire the suffix after their next successful use. Migration 0060_api_key_display_suffix.
• Monitoring filters and favourites are consistent with Inventory — device-type and status selectors use the same icon/colour-aware control treatment as Inventory, Monitoring device types come from the same canonical inventory data, and the fixed favourite column now stays at the left edge in both tables.
• Discovery documentation now points to the actual workflow — the README directs users to Inventory → Scan or Topology → Scan, clarifies that Nmap is bundled inside the NetMap container, distinguishes discovery from CSV/JSON import, and explains the host-networking/SNMP options for MAC discovery.
• Inventory bulk menu closes when you click away — the Bulk menu previously stayed open until you clicked its own button again; it now dismisses on an outside click or Escape. Escape closes an open dropdown inside the menu first, rather than the whole menu.
• Popups now share one readable application-wide palette — Add/Edit Device, Location, Discovery Scan, Add/Edit Link, VLAN, IPAM, Admin, confirmation, Monitoring, and other shared dialogs now inherit the same lifted navy hierarchy introduced by the monitor editor: distinct header/footer and section surfaces, darker inputs, blue-grey borders, brighter labels, muted supporting text, and restrained focus states. The palette is defined through shared --nm-modal-* tokens and components.css, with a canonical example and agent rules documented to prevent workspace-specific popup colours from drifting apart.
• Monitoring tab colours now match Inventory — the Devices/Monitors switcher and the General/Request/Validation/Security monitor-editor tabs use the same restrained teal hover and selected states as the Inventory quick-filter tabs, plus the standard accent focus ring. Their default outlines and attached panel seams now use the softer standard border so the controls do not look individually boxed in. The monitor editor now follows the readable Monitoring popup palette as well: a lifted navy header and form surface, darker inputs, blue-grey field borders, brighter labels, and quieter supporting text. The shared states adapt consistently in light and dark mode.
• Monitor editor stays still while changing tabs — the Add/Edit Monitor dialog now keeps a stable responsive height, with General, Request, Validation, and Security scrolling inside the shared settings window instead of resizing and re-centering the entire popup whenever their content heights differ.
• General monitor setup no longer needs its own scrollbar — identity fields now use a compact name/method and description/tags layout, retry timing sits alongside the other schedule values, and status validation, inversion, and cache busting live under their relevant Validation or Request tabs. General remains fully visible at normal dialog sizes while advanced tabs retain scrolling when conditional settings require it.
• Monitors tab layout and HTTP overview — Devices and Monitors remain separate rendered views, with background-free rounded tabs attached to the active table window. The Monitors window now has a dedicated table header like Devices: endpoint count, status selector, name/URL search, and Add monitor in the top-right action area. Its responsive table keeps metric/action columns readable, lets URL consume available space, and scrolls instead of crushing cells. Clicking a monitor opens the same hero-style drilldown used by devices, tailored for HTTP: uptime and latest response summary, success/failure rate, fastest/slowest/p95 response, common/latest HTTP status, failure streak, request/TLS/redirect configuration, heartbeat, and recent response history. The popup is portalled outside the scroll-heavy table tree and uses a non-blurred dimmer so opening and scrolling it does not force the browser to continuously repaint the table beneath it.
• Monitoring page loads faster — the device list endpoint's 24-hour and 7-day uptime rollups had to read a row from the table for every history record they aggregated, which on a week of fleet history meant hundreds of thousands of scattered reads on each uncached load; a wider index now answers both from the index alone, and the heartbeat query no longer builds full ORM objects for records it only reads a few fields from. The page also paints its summary cards and toolbar as soon as the fleet summary arrives instead of waiting for the slower per-device rollups. Migration 0055_monitor_history_uptime_index.
• Monitoring page no longer scrolls as a whole — the device table's panel was sized with a hardcoded estimate of the height of the page header, stat cards, and offline-alert bar above it. Whenever that estimate was wrong — the alert bar appearing, stat cards wrapping on a narrow window — the panel overshot the viewport and reaching the bottom of the table scrolled the entire page, pushing the pagination controls out of reach. The panel is now sized from the space actually left over, so only the table scrolls and the pagination bar stays put.
• Monitoring column resizing only resizes the column being dragged — shrinking a column in the Devices or Monitors table handed the freed space to the other columns, so neighbouring columns visibly moved during a drag. Each column now keeps its width until it is dragged itself, and the table scrolls sideways when the columns outgrow the panel. Double-clicking any column divider resets every column to its default width.
• "Database is locked" errors under concurrent load — saving a topology layout (or any other write) could intermittently fail with a 500 while background work held the SQLite write lock. Four causes were addressed: the standalone monitor service no longer keeps a database connection checked out while it runs HTTP probes and sends notifications; the daily history-retention purges (device monitor history, monitor check history, notification deliveries) now delete in small committed batches instead of one long transaction that blocked every other writer; the lock wait was raised from 5 to 20 seconds; and the connection pool was enlarged so the request threadpool no longer competes with background services for connections.
• Topology autosave no longer writes an audit entry every few seconds — dragging the canvas autosaves roughly every two seconds, and each save was recording a topology.layout_saved audit row, adding write pressure and burying real activity in Admin → Security's audit log. Explicit named-layout saves are still audited.
• Overview and Inventory summary cards now clickable, matching Monitoring — Inventory's Devices/Online/Offline cards apply the matching status filter (click again to clear), same as Monitoring already did. Overview's Total devices card jumps to Inventory, Online jumps to Monitoring, and Offline expands the offline-devices panel in place — previously only Monitoring's cards responded to clicks.
• Overview's Users card replaced with Avg RTT — the account-count card wasn't a useful at-a-glance network health signal; it now shows fleet-wide average response time (same data already used by Monitoring) and jumps to Monitoring on click.
• Overview's remaining summary cards now clickable — Groups / VLANs jumps to the VLANs workspace, Links jumps to Topology, completing click-through navigation for every card in the row.
• Paused devices no longer counted as offline on Overview — devices with monitoring paused (or a non-active lifecycle) were appearing in the Overview offline bar and offline counts. They are now tracked as their own "Paused" category in the health donut and breakdown, and the reachability percentage is measured against actively monitored devices only.
• Fewer false-positive network-change observations — when a previously "disappeared" device comes back in a later scheduled sweep, its open observation is now resolved automatically; devices that recently went through a disappear-and-return cycle (typical wifi clients) don't re-raise a disappeared alert for 7 days; and resolving a "new device" observation now permanently dismisses that hardware (by MAC; 14 days by IP when no MAC is known) instead of re-alerting every time it rejoins the network.
• Network-changes review readability — long entries in the changes-detected review dialog (new devices, previously discovered hosts) now wrap instead of being cut off with an ellipsis.
• Container startup tolerant of restricted chown on bind mounts — if the container can't chown /app/data or /tmp/nginx (some rootless or managed bind-mount setups reject it), startup now logs a warning and continues instead of failing, assuming the mount is already writable.
• Announcement banner misaligned on Topology, Inventory, and Security — the announcement banner shown below the page header was offset from the content beneath it on these three routes (a fixed side margin didn't account for each route's own container padding). It now lines up exactly with the page content on all three, in both themes.

Security

• Upgraded postcss to 8.5.25 — resolves the source-map path traversal and arbitrary .map file disclosure advisory GHSA-r28c-9q8g-f849 in the frontend build toolchain.
• Upgraded Pillow to 12.3.0 — resolves 13 advisories (CVE-2026-59197/59198/59199/59205/54060/55379/55380 and others): heap out-of-bounds read/write bugs in ImageFilter.RankFilter, Image.paste()/Image.crop(), ImageCmsTransform.apply(), and McIdas AREA file loading; decompression-bomb-check bypasses in BdfFontFile, GdImageFile, FontFile.compile(), and PdfParser.PdfStream.decode(); a JPEG2000 tiled-decode memory-growth DoS; an EpsImagePlugin infinite-loop DoS; and an OS command injection in ImageShow.WindowsViewer.get_command(). Pillow is a transitive dependency (via reportlab for PDF export) — the app has no direct PIL imports.
• Upgraded pydantic-settings to 2.14.2 — resolves NestedSecretsSettingsSource following symlinks outside secrets_dir, which could read arbitrary local files and bypass secrets_dir_max_size (GHSA-4xgf-cpjx-pc3j). NetMap's Settings does not use secrets_dir, so this dependency was not actually reachable, but the fix is applied regardless.
• Upgraded dompurify to 3.4.12 — resolves CUSTOM_ELEMENT_HANDLING bypassing the afterSanitizeElements hook for allowed custom elements (GHSA-c2j3-45gr-mqc4).