xoriin/NetMap v1.7.0

NetMap v1.7.0

on GitHub

[1.7.0] - 2026-10-17

Added

• Two-factor authentication for local sign-in — users can turn on an authenticator-app code (TOTP) from Profile → Security by re-entering their password, scanning a QR code or entering the key manually, then confirming one code. Setup issues ten single-use recovery codes that can be copied or downloaded, and the dialog cannot be dismissed until the user confirms they are saved; recovery codes can be regenerated, and two-factor authentication turned off, after re-entering the password and a current code. Sign-in then asks for the 6-digit code, or a recovery code, after the password. SuperAdmins can require it for administrators or for all local users under Admin → Security; affected users without it are asked to set it up at their next sign-in. SuperAdmins can reset a user's two-factor authentication from Admin → Users, and a locked-out operator can run docker exec <container> netmap-admin reset-2fa <username> on the host. Resets sign the user out everywhere and are audited. Single sign-on, API keys, and password resets are unaffected, and failed codes count toward the existing login lockout and appear in Login history as "Failed (2FA code)".
• Inactivity logout is optional — Admin → System has a Log out inactive users switch. When it is off, users stay signed in until they sign out, their session expires, their password changes, or an administrator revokes the session; the HttpOnly refresh cookie, CSRF protection, and session revocation are unchanged. New installations start with it off. Upgraded installations keep their existing timeout (15 minutes unless it was changed). The unused IDLE_TIMEOUT_MINUTES environment variable has been removed from the documentation; the timeout has always been set in Admin.
• Branded HTML email templates — SMTP alerts and account emails now include a responsive NetMap-styled HTML version alongside the original plain-text fallback. SuperAdmins can choose the approved Login banner or clean stripe, set a brand name and accent, upload a bounded raster logo, add an installation link and footer, and include existing support details. Password-reset structure, expiry guidance, and security wording remain controlled by NetMap rather than accepting arbitrary HTML. Emails using the default logo no longer arrive with an image attachment — the logo is linked from the public NetMap repository rather than embedded, and recipients' mail clients never contact your installation. The settings show a live, scaled preview of the actual email as it will be sent, updated as you edit and before saving.
• Portable encrypted database backups — Admin backup managers can download a passphrase-protected .nmbak file using authenticated AES-GCM encryption with a memory-hard Scrypt key derivation. SuperAdmins can validate and restore encrypted backups without sharing the source installation's signing key; the passphrase is never stored by NetMap.
• Check a device now — authorised Monitoring users can run one device's enabled checks immediately from its details or port configuration, updating normal history and alerts without checking the rest of the fleet (#44).
• Scheduled backup destination and naming — operators can mount a destination with BACKUP_DIR; SuperAdmins can choose a filename prefix and date order. UTC time and a unique suffix prevent overwrites, and existing backups remain available (#43).
• Resizable Security event columns — drag any column divider in the Security event table to resize it; widths are saved per browser, and double-clicking a divider or choosing Reset columns restores the responsive default layout.
• Documentation link in the sidebar — a Documentation button above the theme toggle opens docs.netmap.dev in a new tab. It matches the other sidebar footer controls, shows as an icon with a tooltip when the sidebar is collapsed, and appears in the mobile bottom bar.
• Your profile photo in the sidebar — the Profile option displays your saved photo, with the usual icon as a fallback.

Changed

• External IPs are now a flat address register — recording an address needs only the address itself; provider, account, and location stay available for organisation but are no longer required first. A single public IP or a /32 can now be tracked directly, and Purpose (label) is optional again so an address can be released without deleting it (#42). Locations can be created inline from the same Add/Edit form. The former Provider → Service/area → Allocation → Address hierarchy, its utilisation/capacity view, and the Inventory → Cloud assets page are removed — a cloud asset was always just an inventory device, and "available" is now a status on a recorded address rather than spare block capacity. Existing installs upgrade automatically with no data loss: assignments and free addresses inside existing allocations are carried forward as address rows, with the allocation's name/service/description preserved as a note. The upgrade checks itself: it counts what it should carry forward against what it wrote and rolls the whole upgrade back on any mismatch, and it reports ranges it cannot read instead of dropping them. A location that still holds addresses cannot be deleted, and location names are unique.
• Secure sign-in cookies follow HTTPS automatically — when AUTH_COOKIE_SECURE is not set, sign-in cookies are marked Secure whenever APP_URL uses HTTPS. An explicit AUTH_COOKIE_SECURE value is still honoured, with a startup warning if it is false on HTTPS. HSTS stays opt-in: NetMap logs a startup warning while SECURE_HSTS_ENABLED is off for an HTTPS APP_URL, but never refuses to start. Upgrade note: if your APP_URL is https:// but you also sign in over plain HTTP (for example by IP address), use the HTTPS address or set AUTH_COOKIE_SECURE=false. Missing HTTPS security settings never block startup; instead SuperAdmins see a warning on every workspace until Secure cookies, HSTS, and security headers are enabled.
• Password-reset and account emails now use the configured SMTP notification profile — a successful SMTP profile test now represents the settings used for self-service password resets, administrator resets, and welcome emails. Existing legacy SMTP settings remain supported as a fallback, and delivery failures are recorded in server logs while the public reset endpoint keeps its non-enumerating response. Administrator-initiated resets and welcome emails now log delivery failures too, and a reset that is skipped because APP_URL is not configured is logged as a warning instead of failing silently.
• The unauthenticated settings endpoint returns only sign-in page fields — GET /api/v1/admin/settings/public now returns the app name, login message, announcement, and support contacts instead of every system setting. Signed-in clients read the rest from GET /api/v1/admin/settings/app.
• Login abuse protection covers source IPs by default — failed-login throttling now combines the existing per-account threshold with a higher shared-NAT-safe IP threshold, and lockout responses include Retry-After.
• Uploads and imported data are bounded and verified — avatars and provider icons are decoded and inspected server-side, active SVG content and external references are rejected, device imports are capped at 5 MB and 5,000 rows, restore uploads stop at 256 MB, and notification/saved-search payloads have explicit limits.
• CSV exports are safe to open in spreadsheets — text that could be interpreted as a spreadsheet formula is neutralised while genuine numeric values remain numeric.
• Release images are checked before publication — CI scans the full Git history for secrets and blocks high-severity Python, production npm, and fixable container findings (Semgrep stays report-only while its baseline is triaged). Every image must also boot fresh and legacy HTTPS configurations on amd64 and arm64, and upgrade data from the published stable image with migrations, data and restart health verified, before it is published.
• Every workspace follows one design system — Overview, Inventory, Locations, Monitoring, IPAM, Tools, Security, and Exports share the same summary cards, spacing, content anchors, announcement banner placement, 44px panel title bars, and the common buttons, inputs, selects, searches, alerts, status pills, and loading skeletons. Summary cards drop their extra helper line and show a larger value and label. Admin System cards use helper-size introductions, and Restore from backup uses a themed file picker that shows the chosen file name.

Fixed

• Password resets respond straight away — "Forgot password?" now answers immediately and sends the email afterwards, so the page no longer waits on the mail server (and takes the same time whether or not the account exists). In Admin → Users, Reset PW closes as soon as you save, shows a "Resetting…" notification, then reports whether the reset email was sent, failed, or was skipped because the user has no email address or account email is not set up.
• Devices without an IP address are no longer probed — monitoring and live status skip ping, TCP fallback and service checks for a device with no address and report it as Unknown, instead of retrying a blank address every cycle and logging ICMP probe failed for :.
• Topology scroll-wheel zoom is steady again — each wheel tick now zooms the map by the same small step (about 15% for a normal mouse wheel, smoothly on trackpads). Previously the map library guessed the scroll device from the first few ticks, and in some browsers, page-zoom or display-scaling setups it guessed wrong and zoomed about 2.5× per tick.
• The separate-container backend starts again — docker-compose.yml and docker-compose.prod.yml build the backend from docker/backend.Dockerfile, which still installed the old python-jose library and lacked pyotp, so the backend stopped at startup with No module named 'jwt'. It now installs the same packages as the all-in-one image. The all-in-one xoriin/netmap image was not affected.
• Alert cooldowns survive database reloads — device and endpoint alerts consistently compare stored UTC timestamps, allowing repeated alerts after the cooldown expires (#46).
• Overview includes endpoint outages — all enabled offline endpoints appear in Current outages, including endpoints that are not favourites. Status refreshes every 30 seconds and when the window regains focus, with visible refresh errors (#45).
• The Security live stream recovers from dropped connections — a dropped firewall-event connection now reconnects automatically with increasing back-off, keeps itself alive with a periodic heartbeat, and reloads the event list after reconnecting so events received while offline are not missed. The topbar shows whether the stream is connecting, connected, reconnecting, or paused.
• Firewall live auto-scroll stays attached to the active stream — new matching events now move the committed table viewport back to the newest row, and switching auto-scroll off or on no longer closes and recreates the live WebSocket connection.
• Security saved-search controls fill the filter sidebar — the saved-search picker and its action button now stack at full sidebar width instead of squeezing side by side.
• Monitoring's favourite column header stays on top while scrolling — scrolling the Devices table no longer lets rows slide over the header cell above the star column.
• Monitoring no longer loops while updating the topbar status — its relative-time formatter now has a stable identity, preventing repeated context updates and React maximum-update-depth warnings when Devices or Endpoints is open.
• Sidebar buttons stay at the bottom when every menu is expanded — the navigation list now scrolls on its own between the logo and the footer, so Collapse sidebar, Dark/Light mode, Sign out and the version line stay anchored to the bottom of the window instead of being pushed out of view. Applies to the expanded and collapsed sidebar in both themes.
• Save profile photos beside the photo controls — a Save photo button appears after changing or removing your photo, with errors shown there. Account details save separately.
• The container image picks up Debian security updates promptly — the image build now applies pending Debian package updates instead of inheriting whatever the Python base image shipped, clearing the OpenSSL fixes (CVE-2026-75804, CVE-2026-84782) that the base image had not yet absorbed. The CI image scan also always builds from a fresh base without layer caching, so a cached layer can no longer hide a newly fixed vulnerability.
• The container image no longer carries avoidable helper-tool vulnerabilities — startup now drops to the configured application user with Debian's maintained setpriv instead of the Go-based gosu binary, and build-only Python packaging tools are removed from the runtime image after dependencies are installed.
• Dependency advisories are resolved — PyJWT, urllib3, OAuthLib, AnyIO, and DOMPurify now resolve to versions above every currently reported patched-version floor. The locked backend and frontend dependency sets pass their production vulnerability audits with no known findings.