NetMap v1.8.0

[1.8.0] - 2026-11-01

Security

• New sign-in emails — users get an email when their account signs in from a browser it has not seen before (password, two-factor or single sign-on), with the time, browser, IP address and sign-in method. The first browser an account uses, including the first sign-in after upgrading, is remembered without an email. SuperAdmins can turn this off for everyone under Admin → Security → Sign-In Alerts, and each user under Profile → Preferences. Needs an email address and an account email server; sending never delays sign-in. API: new_device_alerts on /auth/me and new_device_alerts_enabled in admin settings.
• Update DOMPurify to 3.4.17, fixing three critical sanitizer bypasses (GHSA-cg2g-xh64-v4q7, GHSA-mrv2-3pqr-j5jr, GHSA-c6gr-qvv4-5v3f); update Vite, source-map-js, Pillow and certifi, and require patched Mako in the Python environment and both Docker images (Dependabot alerts #61–63 and the image-parser and certificate-trust issues found in the same audit). Image workflow tokens are read-only by default, with write access reserved for tagged release publication.
• Each sign-in is its own session: signing out ends only that device, and reusing an old refresh token ends that sign-in's whole session. Sign out everywhere ends every session at once. Changing your password or two-factor settings ends your other sessions (this device stays signed in), and an admin changing a user's role, status, password or two-factor ends all of that user's sessions.
• Stronger sign-in and password protection: pending password reset links stop working once the password is changed; repeated wrong current passwords on password change lock the account like failed sign-ins; failed sign-ins older than the lockout window no longer count, and a lockout stays in force through its final second; the forgot-password limit holds when the client address is unknown and is also capped per account; sign-ins for unknown and disabled users take the same time as real ones. New netmap-admin unlock-login <username> clears a user's per-account sign-in lockout (not client-address throttles).
• Account safeguards: first-run setup creates exactly one admin, even under concurrent requests; the last active SuperAdmin can no longer be demoted or disabled, including by single sign-on role mapping (the sign-in goes ahead and a warning is logged and audited); changing your own email from the Admin user screen is refused (use your Profile), and admin email edits are audited.
• Single sign-on asks for the NetMap authenticator code (or to set one up) for accounts that use two-factor authentication or whose role requires it; it can trust the provider's recent MFA sign-in instead (mfa_policy=trust_idp). Setting up two-factor authentication at sign-in counts down when you've made too many attempts.
• Behaviour change — SSO link by email is off for new installs and kept on for existing SSO installs, with a SuperAdmin warning that can be acknowledged in SSO settings ("I understand, keep it on"); it returns if the issuer, client ID or link-by-email setting changes. SSO settings in .env or /etc/netmap/netmap.env are honoured on upgrade, so an explicit OIDC_LINK_BY_EMAIL=false is kept. Admin, two-factor and disabled accounts are never linked automatically, only a provider-verified email is used, and signing in as an email an unlinked account already uses is refused with the generic "no linked account" message instead of creating a second account.
• Behaviour change — email changes: changing or clearing your profile email asks for your current password, plus an authentication code when two-factor authentication is on. Accounts created by single sign-on with no NetMap password confirm by signing in again at their provider (5 requests per 15 minutes); where the provider or an administrator manages the email it stays read-only. You can link or unlink single sign-on from your Profile with your password (and code), but not unlink it from an account without a NetMap password. User responses include has_local_password (accounts created by single sign-on are found from the audit log on upgrade, migration 0089).
• Creating, editing and deleting monitors needs the monitoring configuration permission.
• Also hardened: live log streams re-check the session every 15 seconds and close when it ends or the token expires; discovery scan targets must lie fully inside private address ranges; API keys of disabled users are refused before they use any rate-limit quota.

Added

• Notification details — Admin → Alerts → Delivery History shows each notification's device and what it said, can show failed notifications only, and opens any notification to see the exact text sent (with Copy), the method, the provider's result, the rule and trigger, and how the same alert went through your other methods. The text is kept for 30 days from 1.8.0 onwards.
• Release notices — NetMap can show short notices from the NetMap project, such as a warning about a breaking change before you upgrade, without a new release. The server reads a public JSON file (xoriin/netmap-notices, or NOTICE_FEED_URL) every hour and sends nothing about the installation. Info and warning notices show to everyone until dismissed; breaking notices show to SuperAdmins until each of them acknowledges it. Admin → System → Release Notices lists them, checks now, and turns the feed off.
• Personal chart views — an icon-only Visual options control on every chart chooses the chart type and shows or places the chart, bars and legend independently, with value formats for Ring and Number readouts. Save choices to your account, cancel previews, reset one chart, or reset every chart from Profile preferences.
• Status pages — people with the new Manage status pages permission build pages from Monitoring → Status pages, each showing hand-picked devices, HTTP monitors and service checks in named, collapsible, drag-to-reorder groups with optional icons. A page is Public (/status/<slug>, no sign-in) or Private (signed-in users only), and visitors only ever see group and display names, never addresses, hostnames, URLs or usernames. Rows show uptime, status and an interactive 60-slot heartbeat, and can reveal opt-in extras (response-time graph, availability over 24 hours to 30 days, average and p95 response time, failed-check rate). Pages follow the light, Slate and Zinc themes and take a logo, title, accent colour and custom CSS, validated against a strict allowlist and applied only inside a sandboxed frame; SuperAdmins can set default CSS under Admin → System. The editor keeps a live preview beside every tab. API: layout groups accept icon, and public groups carry data-group and data-icon for CSS.
• Incidents and notices on status pages — an incident log per page (Investigating, Identified, Monitoring, Resolved) with public and internal updates, an optional ticket link and a 30-day Past incidents list, plus one-line notices with an optional expiry. Alert rules can Open an incident on status pages after a set number of consecutive breaching checks (on by default for offline, unexpected state, service down and monitor down rules), moving it to Monitoring on recovery; an open manual incident absorbs automatic breaches for the same item. Integration tokens (nmsp_…) let outside systems set notices, run their own incidents and schedule presentation-only maintenance through /api/v1/status-integrations/…, limited to chosen pages, 60 writes a minute and an Idempotency-Key, and audited by name. Closed records are pruned after 365 days.
• Scheduled maintenance — maintenance windows with a title, description, times, affected items and the pages that announce them: upcoming windows show from seven days ahead, affected items show Under maintenance and are excluded from availability, and finished windows move to Past incidents. The separate Suppress monitoring alerts setting also silences notifications for those items across NetMap, needs Manage status pages and Manage alert rules, is never available to integration tokens and can't be changed once a window has started.
• Inventory → Cloud assets — returns over the external-IP register, laid out like Devices: summary cards with a ring by type, provider, location, kind and monitoring filters, flat rows, favourites and the same contextual sidebar, with monitoring health kept separate from address state. Add assets with plain or custom types, add them to Inventory through the normal device form, edit fields in place, and link, change or unlink the Inventory device. Linked assets show the device's latency and status, and Show in Devices opens the device with Back returning to the asset. Viewing cloud details never enables monitoring; the metadata is also editable through a permission-checked API.
• Topology: Reset to defaults — the Display menu has a Reset to defaults button for node size, spacing, devices per row or rings, label sizes and the background, leaving group positions and the Grid/Radial choice alone.

Changed

• Phone layout: on phones NetMap has its own layout — bottom tabs (Home, Inventory, Monitor, Map) with a More sheet, a section switcher for Inventory, Monitoring, IPAM and Admin, devices, endpoints, status pages and groups as cards with filters behind a Filters button, device popups as full-screen pages, dialogs as bottom sheets and a compact Topology toolbar.
• Faster loading: profile pictures are stored as small WebP images (existing ones are shrunk on upgrade), so signing in no longer downloads a multi-megabyte user record; restoring a session signs in once instead of twice; identical requests at the same moment share one call; most workspaces show their last data immediately and refresh in the background; versioned app files are cached for a year; and the full icon set and other pages download after the app is on screen.
• New look in light and dark mode. Light mode uses a near-white page with slate-navy panel headers, clearer alert and notice bars, and summary cards tinted per status. Dark mode moves to the Tailwind Slate palette, with a neutral Zinc style available in Profile → Preferences → Dark mode style. Admin, popups, tables, charts, menus and the Topology header share the same surfaces in every theme, and NetMap follows the browser's light or dark preference until you choose one.
• Consistent controls: hover, scrollbars, dropdowns, buttons, search boxes and panel headers use one shared style in light, Slate and Zinc. Success and danger buttons are neutral with a coloured outline, every search box shares one design, panel headers use Title Case with an icon, and redundant helper text is gone.
• Workspaces open with a chart beside their summary cards, with forms and short lists in a side column (Security, Alerts, Automation, Groups, Endpoints, Monitoring and more), and pages animate in with motion off for reduced-motion users. Pages stop widening on very wide screens (up to about 2,400px of content) while 1080p looks the same; Topology still uses the full width.
• Charts: column charts show their totals and lift on hover, rings show breakdown bars beside their readout, legends line up colour, name, value and share, and bar lists line up labels, bars and values across rows.
• The login page has a word-by-word text reveal and a subtle form entrance, and its brand panel is dark slate in both themes.
• Overview is reorganised: a Network health card with a column per status (click to open Monitoring filtered to it) beside six summary cards, Device types and Top groups side by side, and Current outages, Slowest devices and an Endpoints summary beside Favourites. The offline banner and Offline card jump to Current outages, and clicking a favourite endpoint opens its details.
• Monitoring: Highest latency and Devices by VLAN sit side by side and follow the table filters, the tables take their natural height, and Endpoints adds Certificates Expiring, listing the TLS certificates that expire soonest with days remaining. (#56)
• Monitoring popups: device and endpoint popups share an interactive heartbeat (hover for details, click to pin, arrow keys to step) and a larger response-time graph with zoom, long lists scroll inside their section, Check now sits beside Pause monitoring, and the endpoint popup shows the certificate issuer's organisation with the full issuer on hover.
• Scan (Discover devices) runs in the background: the dialog shows progress and elapsed time, the scan keeps running if you close it, only one manual scan runs at a time, and Stop scan cancels it. Host names come from parallel reverse-DNS lookups after the sweep, so a subnet without reverse DNS no longer hits the scan timeout. API: POST /api/v1/discovery/scans returns 202 with a scan to poll at GET /api/v1/discovery/scans/{scan_id}, or 409 with scan_id while another is running; POST /api/v1/discovery/scans/{scan_id}/cancel stops it. (#36)
• Inventory: Devices and Cloud assets open with a ring by type beside the summary cards; the Devices search stays in line with the filter buttons; the table grows with the page size; the Filters button shows how many filters are applied and clears them; and Enter on a Devices field starts editing it.
• IPAM is more compact: an Address space gauge beside the summary cards, the networks table at full width, and reservations, DHCP leases and Busiest subnets in a side column. The subnet view adds an address map of numbered tiles with the address, status and name on hover, Reserve for free addresses, and a usage bar.
• Locations show devices per location as a ring and VLANs as columns (click one to open that subnet in IPAM); Security opens with a Traffic mix ring, Top sources and compact ingestion counters.
• Admin is organised into labelled task panels with creation forms apart from libraries. Single Sign-On is a two-by-two grid of equal boxes, and two-column forms keep fields level when a label wraps.
• Admin System: a Version card with update status and What's new beside six summary cards, and storage, device status and backup-size charts above the syslog details; backups download from one Download a backup panel, and Upload backup waits until a file (and passphrase) is ready.
• Admin Notifications charts the last 14 days of deliveries and each method's recent activity and failures, with a methods-by-type ring. The list of supported services under the methods is gone; Add method offers each guided method and Custom Apprise URL for the rest.
• Groups permission lists scroll with a granted count, the security audit history is one line per event, and SNMP profiles show port, timeout and retries and can be edited.
• Tools and Exports only show what your role can use (cards you lack rights for are hidden instead of disabled), Exports shows recent download activity, and the passive and active network tool permissions describe what they allow accurately.
• Every API date and time is returned in UTC with a Z suffix.
• The all-in-one image records the real client address and scheme behind its nginx.

Fixed

• Long device names on Topology are no longer cut off: map labels wrap, and the device list and details heading show the whole name.
• Monitoring no longer shows "No VLAN" for devices whose topology group has a VLAN, and its VLAN colours match the VLANs page.
• Endpoint popups on Monitoring and Overview show new checks while open instead of freezing, and the TLS certificate section keeps its Expires and Days remaining values visible instead of blank or cut off. (#56)
• Monitoring table headers run to the table's edge and line up with their data, and every endpoint heartbeat mark is visible.
• Device monitoring keeps its configured cadence when service checks are slow, so they no longer create false stale or unavailable gaps.
• Sign-out notices stay visible on the sign-in screen, a one-minute timeout reads "1 minute", and a rejected request that can't refresh the session opens the sign-in screen with "Session expired. Sign in again." instead of leaving a broken page.
• Inactivity logout stays disabled after saving and reloading Admin settings (the stored 0 is no longer read as one minute).
• The Security live event stream stays connected through token rotation and filter changes, reconnects after its token expires (for example after sleep), and ignores malformed messages.
• Profile and user responses report single sign-on as the sign-in source whenever an account is linked, and SuperAdmins can open the live syslog stream.
• Expand an existing External IP range—for example, /26 to /24—by entering the larger range in Add external IP. Only missing addresses are added; existing details, statuses, locations and device links are preserved. (#53)
• IPAM tables use the shared table surface, and External IP columns and row actions stay aligned on narrower screens.
• Inventory live ping matches scheduled monitoring for public-IP devices, and workspace deep links survive session restoration.
• Tools keeps its narrow-width layout from first paint instead of switching about two seconds after load.
• Topology no longer restarts its live-status poll on every graph change, rebuilds the map in one batched update and cancels a pending layout save after navigating away.
• Discovery no longer holds the database during nmap, SNMP and notifications, viewing observations no longer writes to the database, and the live syslog stream no longer blocks the server while it checks who is connecting.