forward-netbox 2.2.2__tar.gz → 2.2.3__tar.gz

{forward_netbox-2.2.2 → forward_netbox-2.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forward-netbox
-Version: 2.2.2
+Version: 2.2.3
 Summary: NetBox plugin to sync Forward data into NetBox via built-in NQE queries
 License: MIT
 License-File: LICENSE
@@ -31,7 +31,8 @@ Forward 26.6 is the baseline for async NQE.
 
 | Plugin Release | NetBox Version | Status |
 | --- | --- | --- |
-| `v2.2.2` | `4.6.3` required; needs netbox-branching `1.1.0+` | Current release; Fix 504 gateway timeouts on large syncs: stop recomputing change-explainability on every poll during a long merge + back off poll to 15s |
+| `v2.2.3` | `4.6.3` required; needs netbox-branching `1.1.0+` | Current release; Field-feedback fixes: delete-count labeling, vsys/vdom auto-link, skip empty VRFs, per-device CVE list, churn pinpoint, query-ID status clarify |
+| `v2.2.2` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.3`; Fix 504 gateway timeouts on large syncs: stop recomputing change-explainability on every poll during a long merge + back off poll to 15s |
 | `v2.2.1` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.2`; Add read-only forward_apply_identity_audit diagnostic to pinpoint 1-created/1-deleted idempotency churn |
 | `v2.2.0` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.1`; Fix devices mis-assigned the ACI platform; link Palo vsys / Fortinet vdom firewalls to their physical chassis |
 | `v2.1.5` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.0`; Fix Prune orphans erroring on empty sites that still hold a VLAN/VM/prefix (delete only truly-empty sites) |

{forward_netbox-2.2.2 → forward_netbox-2.2.3}/README.md

@@ -8,7 +8,8 @@ Forward 26.6 is the baseline for async NQE.
 
 | Plugin Release | NetBox Version | Status |
 | --- | --- | --- |
-| `v2.2.2` | `4.6.3` required; needs netbox-branching `1.1.0+` | Current release; Fix 504 gateway timeouts on large syncs: stop recomputing change-explainability on every poll during a long merge + back off poll to 15s |
+| `v2.2.3` | `4.6.3` required; needs netbox-branching `1.1.0+` | Current release; Field-feedback fixes: delete-count labeling, vsys/vdom auto-link, skip empty VRFs, per-device CVE list, churn pinpoint, query-ID status clarify |
+| `v2.2.2` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.3`; Fix 504 gateway timeouts on large syncs: stop recomputing change-explainability on every poll during a long merge + back off poll to 15s |
 | `v2.2.1` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.2`; Add read-only forward_apply_identity_audit diagnostic to pinpoint 1-created/1-deleted idempotency churn |
 | `v2.2.0` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.1`; Fix devices mis-assigned the ACI platform; link Palo vsys / Fortinet vdom firewalls to their physical chassis |
 | `v2.1.5` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.0`; Fix Prune orphans erroring on empty sites that still hold a VLAN/VM/prefix (delete only truly-empty sites) |

{forward_netbox-2.2.2 → forward_netbox-2.2.3}/forward_netbox/__init__.py

@@ -8,7 +8,7 @@ class NetboxForwardConfig(PluginConfig):
     name = "forward_netbox"
     verbose_name = "Forward Field Integration"
     description = "Sync Forward data into NetBox using built-in NQE queries."
-    version = "2.2.2"
+    version = "2.2.3"
     base_url = "forward"
     min_version = "4.6.3"
 

{forward_netbox-2.2.2 → forward_netbox-2.2.3}/forward_netbox/jobs.py

@@ -167,13 +167,15 @@ def _maybe_enqueue_backfilled_tag_refresh(sync):
 
 
 def _maybe_enqueue_vsys_parent_link(sync):
-    """Opt-in: after a successful sync, link virtual-context firewalls (Palo vsys /
+    """After a successful sync, link virtual-context firewalls (Palo vsys /
     Fortinet vdom) to their physical chassis via the ``forward_parent_device``
-    custom field. Enabled per sync with ``auto_link_vsys_parents=True`` (matches
-    the other post-sync overlays); otherwise run ``forward_link_vsys_parents`` by
-    hand. Non-destructive and never affects the sync result.
+    custom field. Non-destructive, idempotent, and never affects the sync result.
+
+    Runs by DEFAULT (unlike the opt-in overlays): a blank ``Parent Device`` on
+    every vsys/vdom is a confusing default, so the link auto-refreshes each sync
+    unless the sync explicitly opts out with ``auto_link_vsys_parents=False``.
     """
-    if not (sync.parameters or {}).get("auto_link_vsys_parents"):
+    if (sync.parameters or {}).get("auto_link_vsys_parents") is False:
         return
     try:
         from django.utils.module_loading import import_string
@@ -188,6 +190,28 @@ def _maybe_enqueue_vsys_parent_link(sync):
         logger.warning("Auto vsys parent-link enqueue failed: %s", exc)
 
 
+def _maybe_enqueue_auto_prune(sync):
+    """Opt-in: after a successful sync, run "Prune orphans" (delete out-of-scope
+    devices + empty orphan sites). OFF by default because it deletes NetBox data;
+    enable per sync with ``auto_prune_orphans=True``. The prune keeps its own
+    guards (refuses when the Forward scope returned 0 devices). Never lets a prune
+    problem affect the sync result.
+    """
+    if not (sync.parameters or {}).get("auto_prune_orphans"):
+        return
+    try:
+        from django.utils.module_loading import import_string
+
+        Job.enqueue(
+            import_string("forward_netbox.jobs.prune_forward_orphans"),
+            instance=sync,
+            user=sync.user,
+            name=f"{sync.name} - prune orphans (auto)",
+        )
+    except Exception as exc:  # pragma: no cover - defensive
+        logger.warning("Auto prune-orphans enqueue failed: %s", exc)
+
+
 def sync_forwardsync(job, *args, **kwargs):
     sync = ForwardSync.objects.get(pk=job.object_id)
 
@@ -198,6 +222,7 @@ def sync_forwardsync(job, *args, **kwargs):
         _maybe_enqueue_device_analysis_refresh(sync)
         _maybe_enqueue_backfilled_tag_refresh(sync)
         _maybe_enqueue_vsys_parent_link(sync)
+        _maybe_enqueue_auto_prune(sync)
         job.terminate()
     except Exception as exc:
         safe_save_job_data(job, sync)

forward_netbox-2.2.3/forward_netbox/migrations/0030_forwarddeviceanalysis_cve_ids.py

@@ -0,0 +1,18 @@
+# Generated by Django 6.0.6 on 2026-07-01 17:10
+from django.db import migrations
+from django.db import models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("forward_netbox", "0029_forward_parent_device_cf"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="forwarddeviceanalysis",
+            name="cve_ids",
+            field=models.JSONField(blank=True, default=list),
+        ),
+    ]

{forward_netbox-2.2.2 → forward_netbox-2.2.3}/forward_netbox/models.py

@@ -959,6 +959,9 @@ class ForwardDeviceAnalysis(ForwardPluginModelDocsMixin, ChangeLoggedModel):
     collection_result = models.CharField(max_length=64, blank=True, default="")
     blast_radius = models.PositiveIntegerField(default=0)
     cve_count = models.PositiveIntegerField(default=0)
+    # The actual confirmed-vulnerable CVE IDs behind cve_count, so the device
+    # panel can list them (not just the exposure number).
+    cve_ids = models.JSONField(default=list, blank=True)
     up_interfaces = models.PositiveIntegerField(default=0)
     detail = models.CharField(max_length=255, blank=True, default="")
     snapshot_id = models.CharField(max_length=100, blank=True, default="")

{forward_netbox-2.2.2 → forward_netbox-2.2.3}/forward_netbox/queries/forward_device_analysis.nqe

@@ -30,16 +30,17 @@ let physicalLinks =
          where i.operStatus == OperStatus.UP
          foreach l in i.links
          select l)
-let vulnerabilities =
-  length(foreach c in device.cveFindings
-         where c.isVulnerable
-         select c.cveId)
+let cveIds =
+  foreach c in device.cveFindings
+  where c.isVulnerable
+  select c.cveId
 select {
   name: device.name,
   reachable: device.snapshotInfo.result == DeviceSnapshotResult.completed,
   collection_result: toString(device.snapshotInfo.result),
   blast_radius: physicalLinks,
-  cve_count: vulnerabilities,
+  cve_count: length(cveIds),
+  cve_ids: cveIds,
   up_interfaces: upInterfaces,
   detail: device.locationName
 }

{forward_netbox-2.2.2 → forward_netbox-2.2.3}/forward_netbox/queries/forward_vrfs.nqe

@@ -19,6 +19,20 @@ foreach ni in device.networkInstances
 where ni.name != "default"
 where toString(ni.instanceType) != "NetworkInstanceType.DEFAULT_INSTANCE"
 where isEmpty(forward_netbox_shard_keys) || ni.name in forward_netbox_shard_keys
+// Skip VRFs with no addressing: NetBox derives prefixes/IPs from subinterface
+// addresses keyed by networkInstanceName, so a VRF whose subinterfaces carry no
+// IPv4/IPv6 address imports as an empty VRF and re-imports every sync. Only emit
+// a VRF that has at least one addressed subinterface (mirrors how the prefix/IP
+// queries associate addressing to a VRF).
+where !isEmpty(
+  foreach interface in device.interfaces
+  foreach subinterface in interface.subinterfaces
+  where isPresent(subinterface.networkInstanceName)
+    && subinterface.networkInstanceName == ni.name
+    && (!isEmpty(subinterface.ipv4.addresses)
+      || !isEmpty(subinterface.ipv6.addresses))
+  select subinterface.networkInstanceName
+)
 select distinct {
   name: ni.name,
   rd: null : String,

{forward_netbox-2.2.2 → forward_netbox-2.2.3}/forward_netbox/templates/forward_netbox/forwardsync_health.html

@@ -551,11 +551,11 @@
                 <td>{{ item.commit_message }}</td>
                 <td>
                   {% if item.severity == "pass" %}
-                    <span class="badge text-bg-success">{{ item.status }}</span>
+                    <span class="badge text-bg-success">{{ item.status_label|default:item.status }}</span>
                   {% elif item.severity == "warn" %}
-                    <span class="badge text-bg-warning">{{ item.status }}</span>
+                    <span class="badge text-bg-warning">{{ item.status_label|default:item.status }}</span>
                   {% else %}
-                    <span class="badge text-bg-secondary">{{ item.status }}</span>
+                    <span class="badge text-bg-secondary" title="{{ item.message }}">{{ item.status_label|default:item.status }}</span>
                   {% endif %}
                 </td>
                 <td>{{ item.message }}</td>

{forward_netbox-2.2.2 → forward_netbox-2.2.3}/forward_netbox/templates/forward_netbox/inc/device_analysis_panel.html

@@ -34,6 +34,14 @@
           {% endif %}
         </td>
       </tr>
+      {% if analysis.cve_ids %}
+      <tr>
+        <th scope="row">{% trans "CVEs" %}</th>
+        <td class="lh-lg">
+          {% for cve in analysis.cve_ids %}<a href="https://nvd.nist.gov/vuln/detail/{{ cve|urlencode }}" target="_blank" rel="noopener"><code>{{ cve }}</code></a>{% if not forloop.last %} {% endif %}{% endfor %}
+        </td>
+      </tr>
+      {% endif %}
       {% if analysis.detail %}
       <tr>
         <th scope="row">{% trans "Location" %}</th>

{forward_netbox-2.2.2 → forward_netbox-2.2.3}/forward_netbox/templates/forward_netbox/inc/execution_insights.html

@@ -74,7 +74,8 @@
                 </div>
                 <div class="text-end text-muted small">
                   <div>{{ item.execution_mode }} / {{ item.fetch_mode }}</div>
-                  <div>{{ item.row_count }} rows, {{ item.delete_count }} deletes</div>
+                  {# delete_count is PLANNED intent from the Forward snapshot diff (rows Forward stopped reporting), computed before apply. The APPLIED delete count is the ingestion's num_deleted / change log — an item already absent from NetBox plans a delete but applies none, so these legitimately differ. Label as planned to avoid contradicting the change log. #}
+                  <div>{{ item.row_count }} rows, {{ item.delete_count }} delete(s) planned</div>
                 </div>
               </div>
             </li>

{forward_netbox-2.2.2 → forward_netbox-2.2.3}/forward_netbox/tests/test_apply_identity_audit.py

@@ -39,6 +39,36 @@ class ApplyIdentityAuditTest(TestCase):
         self.assertEqual(result["would_create_count"], 0)
         self.assertFalse(result["churn_suspect"])
 
+    def test_churn_pairs_names_the_object_and_diff(self):
+        # The 1/1 churn signature should pinpoint the SAME logical object and the
+        # exact key disagreement (here: underscore vs dash in the slug).
+        # Both keys must differ for it to be churn (a matching name would match
+        # on the name lookup_set): NetBox slug dc_one / name "DC 1"; Forward
+        # slug dc-one / name "DC One".
+        Site.objects.create(name="DC 1", slug="dc_one")
+        rows = [{"slug": "dc-one", "name": "DC One"}]
+        result = audit_model_identity("dcim.site", rows)
+        self.assertTrue(result["churn_suspect"])
+        self.assertEqual(len(result["churn_pairs"]), 1)
+        pair = result["churn_pairs"][0]
+        self.assertIn("dc_one", pair["netbox"])
+        self.assertIn("dc-one", pair["forward"])
+        self.assertEqual(pair["differs_on"], "underscore-vs-dash")
+        self.assertGreater(pair["similarity"], 0.8)
+
+    def test_device_name_churn_is_audited(self):
+        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer
+
+        site = Site.objects.create(name="S", slug="s")
+        mfr = Manufacturer.objects.create(name="M", slug="m")
+        dt = DeviceType.objects.create(manufacturer=mfr, model="DT", slug="dt")
+        role = DeviceRole.objects.create(name="R", slug="r")
+        Device.objects.create(name="fw01-vsys1", device_type=dt, role=role, site=site)
+        # Forward now emits a trailing-space variant -> name-key flip-flop.
+        result = audit_model_identity("dcim.device", [{"name": "fw01-vsys1 "}])
+        self.assertTrue(result["churn_suspect"])
+        self.assertEqual(result["churn_pairs"][0]["differs_on"], "whitespace")
+
     def test_audit_filters_to_enabled_models(self):
         Site.objects.create(name="A", slug="a")
         sync = SimpleNamespace(get_model_strings=lambda: ["dcim.site", "dcim.device"])
@@ -46,5 +76,6 @@ class ApplyIdentityAuditTest(TestCase):
         payload = audit_apply_identity(
             sync, fetch_rows=lambda s, model: canned.get(model, [])
         )
-        self.assertEqual(payload["models_audited"], ["dcim.site"])
+        # dcim.device is now an audited model; with no device rows it is clean.
+        self.assertEqual(payload["models_audited"], ["dcim.site", "dcim.device"])
         self.assertEqual(payload["churn_suspect_models"], [])

forward_netbox-2.2.3/forward_netbox/tests/test_execution_insights_delete_label.py

@@ -0,0 +1,42 @@
+from django.template.loader import render_to_string
+from django.test import TestCase
+
+
+class ExecutionInsightsDeleteLabelTest(TestCase):
+    """The per-model panel shows delete_count, which is PLANNED intent from the
+    Forward snapshot diff (rows Forward stopped reporting), computed before apply.
+    An item already absent from NetBox plans a delete but applies none, so this
+    number legitimately differs from the applied num_deleted / change log. It must
+    be labeled "planned" so it does not read as "48 deleted" and contradict an
+    empty change log (the sync-23 confusion).
+    """
+
+    def _render(self):
+        return render_to_string(
+            "forward_netbox/inc/execution_insights.html",
+            {
+                "latest_execution_insights": {
+                    "available": True,
+                    "top_model_results": [
+                        {
+                            "model": "dcim.inventoryitem",
+                            "query_name": "Forward Inventory Items",
+                            "execution_mode": "query_path",
+                            "fetch_mode": "nqe_parameters",
+                            "row_count": 61129,
+                            "delete_count": 48,
+                        }
+                    ],
+                }
+            },
+        )
+
+    def test_delete_count_is_labeled_planned(self):
+        html = self._render()
+        self.assertIn("48 delete(s) planned", html)
+
+    def test_bare_deleted_label_is_gone(self):
+        # The old "{n} deletes" label read as applied and contradicted the change
+        # log; it must not reappear.
+        html = self._render()
+        self.assertNotIn("48 deletes", html)

{forward_netbox-2.2.2 → forward_netbox-2.2.3}/forward_netbox/tests/test_jobs.py

@@ -64,6 +64,40 @@ class ForwardJobsTest(TestCase):
             enqueue.assert_called_once()
             self.assertEqual(enqueue.call_args.kwargs["instance"], self.sync)
 
+    def test_vsys_parent_link_enqueues_by_default_and_respects_opt_out(self):
+        from forward_netbox.jobs import _maybe_enqueue_vsys_parent_link
+
+        # DEFAULT-ON: no parameter -> the parent-link overlay enqueues (a blank
+        # Parent Device on every vsys/vdom is a confusing default).
+        with patch("forward_netbox.jobs.Job.enqueue") as enqueue:
+            _maybe_enqueue_vsys_parent_link(self.sync)
+            enqueue.assert_called_once()
+            self.assertEqual(enqueue.call_args.kwargs["instance"], self.sync)
+
+        # Explicit opt-out with auto_link_vsys_parents=False -> no enqueue.
+        self.sync.parameters = {
+            **self.sync.parameters,
+            "auto_link_vsys_parents": False,
+        }
+        with patch("forward_netbox.jobs.Job.enqueue") as enqueue:
+            _maybe_enqueue_vsys_parent_link(self.sync)
+            enqueue.assert_not_called()
+
+    def test_auto_prune_orphans_enqueues_only_when_enabled(self):
+        from forward_netbox.jobs import _maybe_enqueue_auto_prune
+
+        # OFF by default (it deletes NetBox data): no enqueue.
+        with patch("forward_netbox.jobs.Job.enqueue") as enqueue:
+            _maybe_enqueue_auto_prune(self.sync)
+            enqueue.assert_not_called()
+
+        # Opt-in via auto_prune_orphans: enqueues the prune job.
+        self.sync.parameters = {**self.sync.parameters, "auto_prune_orphans": True}
+        with patch("forward_netbox.jobs.Job.enqueue") as enqueue:
+            _maybe_enqueue_auto_prune(self.sync)
+            enqueue.assert_called_once()
+            self.assertIn("prune orphans", enqueue.call_args.kwargs["name"])
+
     def test_record_timeout_issue_creates_single_issue_per_ingestion_phase(self):
         issue_1 = record_timeout_issue(
             self.ingestion,

{forward_netbox-2.2.2 → forward_netbox-2.2.3}/forward_netbox/tests/test_models.py

@@ -1604,6 +1604,10 @@ class ForwardSyncModelTest(TestCase):
             parameters={
                 "snapshot_id": LATEST_PROCESSED_SNAPSHOT,
                 "dcim.device": True,
+                # Isolate this test to the recurring-reschedule enqueue; the
+                # vsys/vdom parent-link overlay is default-on and would add a
+                # second enqueue (covered by its own test).
+                "auto_link_vsys_parents": False,
             },
         )
         user = get_user_model().objects.create_user(username="recurring-user")

{forward_netbox-2.2.2 → forward_netbox-2.2.3}/forward_netbox/tests/test_scope_module_ui.py

@@ -384,6 +384,7 @@ class ScopeModuleUiTest(TestCase):
                     "collection_result": "DeviceSnapshotResult.completed",
                     "blast_radius": 7,
                     "cve_count": 2,
+                    "cve_ids": ["CVE-2022-5678", "CVE-2021-1234"],
                     "up_interfaces": 5,
                     "detail": "DC1",
                 },
@@ -421,6 +422,8 @@ class ScopeModuleUiTest(TestCase):
         self.assertTrue(analysis.reachable)
         self.assertEqual(analysis.blast_radius, 7)
         self.assertEqual(analysis.cve_count, 2)
+        # CVE IDs stored (deduped + sorted) so the panel can list them.
+        self.assertEqual(analysis.cve_ids, ["CVE-2021-1234", "CVE-2022-5678"])
         self.assertEqual(analysis.up_interfaces, 5)
         self.assertEqual(analysis.collection_result, "completed")
         # The failed device surfaces the specific Forward collection error token.
@@ -442,6 +445,9 @@ class ScopeModuleUiTest(TestCase):
         )
         rendered = panel.right_page()
         self.assertIn("Forward Analysis", rendered)
+        # The actual CVE IDs behind the exposure count are listed + linked to NVD.
+        self.assertIn("CVE-2021-1234", rendered)
+        self.assertIn("nvd.nist.gov/vuln/detail/CVE-2022-5678", rendered)
         # Deep-link pivot into the Forward app.
         self.assertIn("Open in Forward", rendered)
         self.assertIn("https://fwd.app", rendered)

{forward_netbox-2.2.2 → forward_netbox-2.2.3}/forward_netbox/tests/test_vsys_parent.py

@@ -39,6 +39,25 @@ class VsysParentTest(TestCase):
         self.assertEqual(vsys.custom_field_data.get(PARENT_DEVICE_CF), chassis.pk)
         # The physical chassis itself is never linked.
         self.assertIn(chassis.custom_field_data.get(PARENT_DEVICE_CF), (None, ""))
+        # The context is also modeled as a VirtualDeviceContext under the chassis.
+        from dcim.models import VirtualDeviceContext
+
+        self.assertEqual(result["vdc_created"], 1)
+        self.assertTrue(
+            VirtualDeviceContext.objects.filter(
+                device=chassis, name=vsys.name, status="active"
+            ).exists()
+        )
+        # Re-running is idempotent — the VDC is found, not re-created.
+        again = link_vsys_parents(
+            None, fetch_rows=self._rows([(vsys.name, chassis.name)])
+        )
+        self.assertEqual(again["vdc_created"], 0)
+        self.assertEqual(again["vdc_existing"], 1)
+        self.assertEqual(
+            VirtualDeviceContext.objects.filter(device=chassis, name=vsys.name).count(),
+            1,
+        )
 
     def test_orphan_parent_not_linked(self):
         # vsys present in NetBox, but its physical chassis is not collected.

{forward_netbox-2.2.2 → forward_netbox-2.2.3}/forward_netbox/utilities/apply_identity_audit.py

@@ -16,12 +16,20 @@
 #   * would_delete — NetBox objects matched by no Forward row.
 # A model with would_create AND would_delete both small (often 1/1) names the
 # churning object and shows the differing key. NEVER writes anything.
+import difflib
+
 from .apply_engine_bulk import lookup_key_from_object
 from .apply_engine_bulk import lookup_key_from_values
 
 # Identity mirrors apply_engine_bulk's simple-model specs. The Forward query for
 # each model emits the lookup fields directly (slug/name/rd/vid/site_slug); we
 # read those off the row rather than recomputing slugify.
+#
+# dcim.device is also audited (name-level, best-effort): it is the largest model
+# and the most likely carrier of a "1 created + 1 deleted" name-key flip-flop
+# (e.g. a virtual-context firewall whose Forward name drifts). It is NOT a simple
+# dimension — name uniqueness is site-scoped — so a device legitimately moved
+# between sites can show here; treat device pairs as a lead, not a verdict.
 SIMPLE_MODEL_IDENTITY = {
     "dcim.site": {"lookup_sets": (("slug",), ("name",)), "row": ("slug", "name")},
     "dcim.manufacturer": {
@@ -35,11 +43,13 @@ SIMPLE_MODEL_IDENTITY = {
     "dcim.platform": {"lookup_sets": (("slug",), ("name",)), "row": ("slug", "name")},
     "dcim.devicetype": {"lookup_sets": (("slug",),), "row": ("slug",)},
     "ipam.vrf": {"lookup_sets": (("rd",), ("name",)), "row": ("rd", "name")},
+    "dcim.device": {"lookup_sets": (("name",),), "row": ("name",)},
 }
 SIMPLE_MODELS = tuple(SIMPLE_MODEL_IDENTITY)
 
 
 def _model_class(model_string):
+    from dcim.models import Device
     from dcim.models import DeviceRole
     from dcim.models import DeviceType
     from dcim.models import Manufacturer
@@ -54,9 +64,58 @@ def _model_class(model_string):
         "dcim.platform": Platform,
         "dcim.devicetype": DeviceType,
         "ipam.vrf": VRF,
+        "dcim.device": Device,
     }[model_string]
 
 
+def _pair_churn(would_create, would_delete, *, limit=10):
+    """Match each would_delete (NetBox stored) to its most-similar would_create
+    (Forward computed) so the diagnostic names the churning object and the exact
+    key disagreement, instead of two disconnected lists.
+
+    ``would_create`` / ``would_delete`` are lists of (key, label) tuples — key is
+    the raw comparable string, label is the human-readable display. Returns
+    ``[{netbox, forward, similarity, differs_on}]`` for the best matches.
+    """
+    pairs = []
+    remaining = list(would_create)
+    for del_key, del_label in would_delete:
+        best = None
+        best_ratio = 0.0
+        for idx, (cre_key, cre_label) in enumerate(remaining):
+            ratio = difflib.SequenceMatcher(None, del_key, cre_key).ratio()
+            if ratio > best_ratio:
+                best_ratio = ratio
+                best = (idx, cre_key, cre_label)
+        if best is None:
+            continue
+        idx, cre_key, cre_label = best
+        pairs.append(
+            {
+                "netbox": del_label,
+                "forward": cre_label,
+                "similarity": round(best_ratio, 3),
+                "differs_on": _describe_diff(del_key, cre_key),
+            }
+        )
+        remaining.pop(idx)
+    pairs.sort(key=lambda p: p["similarity"], reverse=True)
+    return pairs[:limit]
+
+
+def _describe_diff(netbox_key, forward_key):
+    """Short human hint for why two near-identical keys disagree."""
+    if netbox_key == forward_key:
+        return "identical"
+    if netbox_key.lower() == forward_key.lower():
+        return "case"
+    if netbox_key.strip() == forward_key.strip():
+        return "whitespace"
+    if netbox_key.replace("_", "-") == forward_key.replace("_", "-"):
+        return "underscore-vs-dash"
+    return "other"
+
+
 def audit_model_identity(model_string, rows, *, sample_limit=15):
     """Compare Forward ``rows`` against NetBox objects for ``model_string`` and
     report the would-create / would-delete leftovers (the churn candidates)."""
@@ -76,7 +135,7 @@ def audit_model_identity(model_string, rows, *, sample_limit=15):
 
     netbox_keys = {lookup_set: set() for lookup_set in lookup_sets}
     netbox_count = 0
-    would_delete = []
+    would_delete = []  # (primary_key, label)
     for obj in model.objects.all().iterator():
         netbox_count += 1
         obj_keys = {
@@ -98,9 +157,10 @@ def audit_model_identity(model_string, rows, *, sample_limit=15):
             key_parts = ", ".join(
                 f"{field}={getattr(obj, field, None)}" for field in lookup_sets[0]
             )
-            would_delete.append(f"{obj} ({key_parts})")
+            primary_key = obj_keys[lookup_sets[0]] or str(obj)
+            would_delete.append((str(primary_key), f"{obj} ({key_parts})"))
 
-    would_create = []
+    would_create = []  # (primary_key, label)
     for row in rows:
         values = {field: (row.get(field) or None) for field in row_fields}
         matched = False
@@ -113,19 +173,32 @@ def audit_model_identity(model_string, rows, *, sample_limit=15):
             label = " / ".join(
                 str(values.get(field)) for field in row_fields if values.get(field)
             )
-            would_create.append(label or "?")
+            primary_key = lookup_key_from_values(
+                values, lookup_sets[0], model_string=model_string
+            )
+            would_create.append((str(primary_key), label or "?"))
 
+    churn_suspect = bool(would_create) and bool(would_delete)
     return {
         "model": model_string,
         "forward_rows": len(rows),
         "netbox_count": netbox_count,
         "would_create_count": len(would_create),
         "would_delete_count": len(would_delete),
-        "would_create_sample": sorted(would_create)[:sample_limit],
-        "would_delete_sample": sorted(would_delete)[:sample_limit],
+        "would_create_sample": sorted(label for _, label in would_create)[
+            :sample_limit
+        ],
+        "would_delete_sample": sorted(label for _, label in would_delete)[
+            :sample_limit
+        ],
         # The churn signature: both sides non-empty and small => one logical
         # object with two different keys (create the new, delete the orphan).
-        "churn_suspect": bool(would_create) and bool(would_delete),
+        "churn_suspect": churn_suspect,
+        # Pinpoint: pair each stale NetBox object with the Forward row most likely
+        # to be the SAME logical object, and name the exact key disagreement.
+        "churn_pairs": (
+            _pair_churn(would_create, would_delete) if churn_suspect else []
+        ),
     }
 
 

{forward_netbox-2.2.2 → forward_netbox-2.2.3}/forward_netbox/utilities/device_analysis.py

@@ -43,6 +43,23 @@ def _coerce_int(value):
         return 0
 
 
+# Bound the stored CVE-id list so a device with a very large finding set can't
+# bloat the row; the count (cve_count) remains authoritative for the total.
+_CVE_IDS_LIMIT = 200
+
+
+def _coerce_cve_ids(value):
+    if not isinstance(value, (list, tuple)):
+        return []
+    seen = []
+    for item in value:
+        cve = str(item or "").strip()
+        if cve and cve not in seen:
+            seen.append(cve)
+    seen.sort()
+    return seen[:_CVE_IDS_LIMIT]
+
+
 def refresh_device_analysis(sync) -> dict:
     """Upsert ForwardDeviceAnalysis rows from the device-analysis NQE.
 
@@ -80,6 +97,7 @@ def refresh_device_analysis(sync) -> dict:
                     )[:64],
                     "blast_radius": _coerce_int(row.get("blast_radius")),
                     "cve_count": _coerce_int(row.get("cve_count")),
+                    "cve_ids": _coerce_cve_ids(row.get("cve_ids")),
                     "up_interfaces": _coerce_int(row.get("up_interfaces")),
                     "detail": str(row.get("detail") or "")[:255],
                     "snapshot_id": str(snapshot_id or ""),

{forward_netbox-2.2.2 → forward_netbox-2.2.3}/forward_netbox/utilities/model_validation.py

@@ -332,6 +332,12 @@ def clean_forward_sync(sync):
             "skip_unchanged_snapshot",
             "set_primary_ip_from_mgmt_tag",
             "diff_fallback_mode",
+            # Post-sync overlay toggles (opt-in, except vsys parent-link which is
+            # default-on and opts OUT with auto_link_vsys_parents=False).
+            "auto_tag_backfilled",
+            "auto_refresh_device_analysis",
+            "auto_link_vsys_parents",
+            "auto_prune_orphans",
             BRANCH_RUN_STATE_PARAMETER,
             MODEL_CHANGE_DENSITY_PARAMETER,
             MODEL_CHANGE_DENSITY_PROFILE_PARAMETER,

{forward_netbox-2.2.2 → forward_netbox-2.2.3}/forward_netbox/utilities/query_binding_resolution.py

@@ -430,6 +430,15 @@ def _committed_query_source(committed_query: dict) -> str:
     return ""
 
 
+# Friendly, non-alarming display labels for the raw drift status codes (the raw
+# code is kept for keying/counting; only the badge text changes). "unverified"
+# is expected + non-blocking for org-managed direct query IDs, so it should not
+# read like an error.
+_QUERY_DRIFT_STATUS_LABELS = {
+    "direct_query_id_unverified": "Org-managed (pinned)",
+}
+
+
 def _query_drift_result(
     query_map: ForwardNQEMap,
     *,
@@ -449,6 +458,9 @@ def _query_drift_result(
         "model": query_map.model_string,
         "mode": query_map.execution_mode,
         "status": status,
+        "status_label": _QUERY_DRIFT_STATUS_LABELS.get(
+            status, status.replace("_", " ").capitalize()
+        ),
         "severity": severity,
         "message": message,
         "remediation": remediation,