forward-netbox 2.7.2__tar.gz → 2.7.4__tar.gz

{forward_netbox-2.7.2 → forward_netbox-2.7.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forward-netbox
-Version: 2.7.2
+Version: 2.7.4
 Summary: NetBox plugin to sync Forward data into NetBox via built-in NQE queries
 License: MIT
 License-File: LICENSE
@@ -28,7 +28,7 @@ Provides-Extra: peering
 Provides-Extra: routing
 Requires-Dist: httpx (>0.26,<0.29)
 Requires-Dist: netbox-cisco-aci (==0.4.0) ; (python_version >= "3.12" and python_version < "3.15") and (extra == "aci" or extra == "integrations")
-Requires-Dist: netbox-dlm (>=0.4.1,<0.7.0) ; extra == "dlm" or extra == "integrations"
+Requires-Dist: netbox-dlm (>=0.4.1,<0.8.0) ; extra == "dlm" or extra == "integrations"
 Requires-Dist: netbox-peering-manager (==0.3.0) ; (python_version >= "3.12" and python_version < "3.15") and (extra == "peering" or extra == "integrations")
 Requires-Dist: netbox-routing (==0.4.3) ; (python_version >= "3.12" and python_version < "3.15") and (extra == "routing" or extra == "integrations")
 Requires-Dist: netboxlabs-netbox-branching (>=1.1.1,<1.2.0)
@@ -106,15 +106,16 @@ See the
 
 ## Release Compatibility
 
-The `2.7.2` release candidate requires NetBox `4.6.x` (>= `4.6.5`, tested on `4.6.6`) and `netbox-branching` `1.1.x` (tested on `1.1.2`). Expand for the published release history and candidate notes.
+The `2.7.4` release candidate requires NetBox `4.6.x` (>= `4.6.5`, tested on `4.6.6`) and `netbox-branching` `1.1.x` (tested on `1.1.2`). Expand for the published release history and candidate notes.
 
 <details>
 <summary>Release compatibility history</summary>
 
 | Plugin Release | NetBox Version | Status |
 | --- | --- | --- |
-| `v2.7.2` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.6`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Release candidate; Fix: **a query bound by ID no longer has to prove a commit before it can run**. A map bound to a Forward query by direct ID with no stored commit was rejected before execution, and because one ineligible map empties the whole plan, nothing was scheduled and the sync ended having fetched nothing - while every Forward call returned 200. The plugin was resolving a commit on Forward's behalf by walking the query history for one whose source matched its own bundled copy; Forward never required it, and the execution payload already omitted it for head. A query ID now executes at Forward's latest. An explicitly stored commit is still honoured, and diff execution is unchanged because there the two commits are part of the request path. A query whose parameters have moved on now fails on its own model, naming the map, instead of silently emptying the run. Fix: **a run whose model comes back far smaller than its baseline is refused**. Dropping the commit check removed the comparison that used to notice a query changing underneath a map, which left one case invisible: a query that still accepts the same parameters and still returns the same shape, but fewer rows. Those rows are authoritative, so the absent ones reconcile as deletions with nothing reported. A model returning more than 30% fewer rows than its last promoted baseline, and at least 20 fewer, now blocks the run before anything is staged. It is on by default and a sync with no drift policy is still covered; a policy can widen or disable it, the absence of one cannot. A first run, a diff run, a model already failing, and a scope the operator narrowed are all excluded. Fix: **a failed sync now says why, per model**. The reason was reduced to an exception class name before anything recorded it, so no log, database row, or support bundle could recover it - one deployment ran five consecutive failed syncs that could not be diagnosed from any evidence it produced. Failures now carry a catalogued reason alongside the class, resolved once in a shared place rather than as another per-case exception. Two paths that composed their own message, and two job outcomes that were exported as redacted because they were phrased differently, were folded into it. Messages that embed collected values are still reduced to wording and slugs. Release flow: **a post-release commit that carries executable content fails the harness**. The first commit after a release tag must be documentation only, and it cannot be reclaimed once taken, so getting it wrong makes every later release unverifiable. No migration beyond the drift-policy fields, which apply themselves, and no operator step; upgrade and re-run the sync. |
-| `v2.7.1` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.6`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Current release; Fix: **a merge delete blocked by a hidden PROTECT reference is now predicted instead of discovered at apply time**. 2.7.0 shipped this as a known limitation because widening the predictor on reasoning alone kept a device that should have been deleted; the predictor now accounts for the provenance rows the merge clears inside the same transaction, so a delete is scheduled when nothing outside the merge still protects the row and is still refused when something does. Fix: **a CVE and the software version referencing it no longer fail when both are created in the same merge**. The dependency graph modelled scalar foreign keys but not many-to-many references, so the target could be ordered after the row pointing at it. Latent since 2.5.11 and only reachable once the CVE maps were enabled. Fix: **deleting an ingestion now takes its own scope-reconciliation rows with it**. Those rows protect the ingestion, so an ingestion that had reconciled could never be removed and the refusal named a model the operator has no way to clear. Fix: **the ingestion issues list no longer returns a 500**. The view was registered but its URL was never included, so the list route resolved to nothing while the detail route worked. A test now sweeps every model with a detail route for the same omission. Fix: **a row NetBox can never accept is now recorded as skipped rather than failed**. Any failed row blocks baseline promotion, and without promotion there is no bookkeeping and drift reports Not measured, so a handful of permanently unsatisfiable addresses could mask thousands of correct changes. Integrity and unrecognised errors still fail and still block. Security: takes the `cryptography` fix for CVE-2026-69247. Release flow: dependency advisories are audited before the gate rather than after the tag, a skipped post-release step now fails the harness instead of passing quietly, and a release opens its own close-out work. No migration and no operator step; upgrade and re-run the sync. |
+| `v2.7.4` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.6`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Release candidate. Published as `2.7.4`: `2.7.3` was tagged but never published, so no `2.7.3` artifact exists on PyPI - the release commit recorded no `## Release Authorization` evidence, and the publish workflow refuses a tag whose plan cannot show which gates ran against that exact tree, so it stopped before building anything. 2.7.4 is the same tree with that evidence recorded. Fix: **one interface NetBox refuses no longer fails the whole sync**. A `ValidationError` raised while validating an interface left the apply engine entirely and surfaced as a terminating failure that named no model and no row, so a run that had staged 172 changes ended having applied none and the only evidence produced identified neither the device nor the interface. The row is now recorded against `dcim.interface` and the rest of the shard proceeds. Fix: **a rejection now says which rule rejected it, not just which field**. The rule catalogue read only the errors NetBox declines to attach to a field, which made a rule legible exactly when NetBox would not name a field and illegible whenever it did. `untagged_vlan` alone carries two unrelated NetBox rules - an interface whose mode admits no untagged VLAN, and a VLAN outside the device's site - with different causes and different fixes, and no evidence the plugin produced could tell them apart. Every field is read now, both rules are catalogued, and the field and the rule are reported together. Fix: **a rejection about state the sync did not write is skipped rather than failed**. Validation covers the whole object while an update writes only the fields that differ, so an untagged VLAN left behind by a device that moved sites fails a later sync that changes only the MTU. Refusing to write is right; calling it a failure is not, because a failure also fails the row's dependents and no retry can change the answer. A catalogued rule on a field the row does not write is now recorded and skipped. A rule the catalogue cannot name stays a failure, deliberately. Fix: **both apply paths reach the same verdict**. The bulk engine and the row-oriented adapter had come to opposite conclusions about the same interface while each was locally correct, and the parity harness could not see it because both write nothing in that case. One shared rule now answers it for both. Fix: **the merge stops filing its own defects as unfixable**. Every validation rejection at merge counted as unsatisfiable, which is right for a rule that belongs to the destination and wrong for a rejection the merge itself caused, where retrying is the correct response. Only a catalogued rule landing on a field the change writes moves; an uncatalogued rule still skips, so nothing can newly block a baseline. Fix: **a spent baseline is no longer called the current one**. Every ingestion that promotes leaves a baseline record behind, and promotion only marks the previous one superseded - it clears the contents but keeps the row, which goes on protecting its ingestion. The refusal told an operator with three undeletable ingestions that each was the baseline for the sync, true of at most one, and pointed at a repair the product does not offer. It now says the record is spent, that it still protects the ingestion, and that nothing releases it today. Collecting spent baselines is still a known gap. Feature: **a command that finds the interfaces NetBox will refuse**. `forward_interface_vlan_audit` reports every interface whose untagged VLAN belongs to another site, and every interface carrying one with no 802.1Q mode, naming the device, the interface, both sites and the VLAN ID. Persisted diagnostics carry schema identifiers and never collected values, which is why a rejected row cannot name itself; this computes the answer on demand and writes it to the operator's console instead. Fix: **an ingestion whose baseline has been superseded can be deleted**. Every ingestion that promotes leaves a baseline record behind, and promotion only marks the previous one superseded - it clears the contents but keeps the row, which goes on protecting its ingestion. Nothing ever removed one, so every ingestion that had promoted was permanently undeletable and the backlog grew by one per successful sync. A spent record now goes with its ingestion; the live one is still kept, by every route rather than only through the delete button. Fix: **an ingestion whose job is still running is refused**, the same protection a sync already had. Deleting one mid-flight removed the job record while its worker carried on against it. Fix: **a skipped row says which model it was waiting for**, and says skipped rather than failed. Six identical rows naming only an exception class told an operator nothing about which parent was missing. Rows skipped while pruning are the inverse case and now name the records still referencing the object, which is why the prune was refused. Compatibility: **netbox-dlm `0.7.0` is accepted**, validated against the full suite rather than accepted on its changelog. No migration and no operator step; upgrade and re-run the sync. |
+| `v2.7.2` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.6`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Current release; Fix: **a query bound by ID no longer has to prove a commit before it can run**. A map bound to a Forward query by direct ID with no stored commit was rejected before execution, and because one ineligible map empties the whole plan, nothing was scheduled and the sync ended having fetched nothing - while every Forward call returned 200. The plugin was resolving a commit on Forward's behalf by walking the query history for one whose source matched its own bundled copy; Forward never required it, and the execution payload already omitted it for head. A query ID now executes at Forward's latest. An explicitly stored commit is still honoured, and diff execution is unchanged because there the two commits are part of the request path. A query whose parameters have moved on now fails on its own model, naming the map, instead of silently emptying the run. Fix: **a run whose model comes back far smaller than its baseline is refused**. Dropping the commit check removed the comparison that used to notice a query changing underneath a map, which left one case invisible: a query that still accepts the same parameters and still returns the same shape, but fewer rows. Those rows are authoritative, so the absent ones reconcile as deletions with nothing reported. A model returning more than 30% fewer rows than its last promoted baseline, and at least 20 fewer, now blocks the run before anything is staged. It is on by default and a sync with no drift policy is still covered; a policy can widen or disable it, the absence of one cannot. A first run, a diff run, a model already failing, and a scope the operator narrowed are all excluded. Fix: **a failed sync now says why, per model**. The reason was reduced to an exception class name before anything recorded it, so no log, database row, or support bundle could recover it - one deployment ran five consecutive failed syncs that could not be diagnosed from any evidence it produced. Failures now carry a catalogued reason alongside the class, resolved once in a shared place rather than as another per-case exception. Two paths that composed their own message, and two job outcomes that were exported as redacted because they were phrased differently, were folded into it. Messages that embed collected values are still reduced to wording and slugs. Release flow: **a post-release commit that carries executable content fails the harness**. The first commit after a release tag must be documentation only, and it cannot be reclaimed once taken, so getting it wrong makes every later release unverifiable. No migration beyond the drift-policy fields, which apply themselves, and no operator step; upgrade and re-run the sync. |
+| `v2.7.1` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.6`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Superseded by `v2.7.2`; Fix: **a merge delete blocked by a hidden PROTECT reference is now predicted instead of discovered at apply time**. 2.7.0 shipped this as a known limitation because widening the predictor on reasoning alone kept a device that should have been deleted; the predictor now accounts for the provenance rows the merge clears inside the same transaction, so a delete is scheduled when nothing outside the merge still protects the row and is still refused when something does. Fix: **a CVE and the software version referencing it no longer fail when both are created in the same merge**. The dependency graph modelled scalar foreign keys but not many-to-many references, so the target could be ordered after the row pointing at it. Latent since 2.5.11 and only reachable once the CVE maps were enabled. Fix: **deleting an ingestion now takes its own scope-reconciliation rows with it**. Those rows protect the ingestion, so an ingestion that had reconciled could never be removed and the refusal named a model the operator has no way to clear. Fix: **the ingestion issues list no longer returns a 500**. The view was registered but its URL was never included, so the list route resolved to nothing while the detail route worked. A test now sweeps every model with a detail route for the same omission. Fix: **a row NetBox can never accept is now recorded as skipped rather than failed**. Any failed row blocks baseline promotion, and without promotion there is no bookkeeping and drift reports Not measured, so a handful of permanently unsatisfiable addresses could mask thousands of correct changes. Integrity and unrecognised errors still fail and still block. Security: takes the `cryptography` fix for CVE-2026-69247. Release flow: dependency advisories are audited before the gate rather than after the tag, a skipped post-release step now fails the harness instead of passing quietly, and a release opens its own close-out work. No migration and no operator step; upgrade and re-run the sync. |
 | `v2.7.0` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.6`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Superseded by `v2.7.1`; Fix: **every ingestion was undeletable, and the refusal explained nothing**. `ForwardIngestionProvenanceMixin` declares its ingestion foreign key as PROTECT with `related_name="+"`, and Django hides such relations from `_meta.related_objects` - which is exactly what the protection check iterated, so of the five PROTECT relations pointing at an ingestion it could see one. An ingestion held only by device identities reported no refusal, so the delete view fell through to NetBox's confirmation page, rendered one dependent row per synced device, and then failed with `ProtectedError` on confirm. Every ingestion owns one identity per device, which is why the count grew with every sync rather than staying at one. Fix: **a primary IP moving between devices now converges**. The ownership proof was read through the active branch, and a branch is a snapshot of the moment it was provisioned, so an identity finalized after that provision was invisible and read as "not ours" - suppressing a release we were entitled to make. The holder lookup and the writes stay branch-native; only the ownership proof is pinned to the control plane. Feature: **CIMC firmware is reported into device lifecycle**. netbox-dlm `0.6.0` adds `InventoryItemSoftware`, so the firmware running on each Cisco management controller now lands in DLM alongside every device's OS version. The version is read from the SNMP sysDescr Forward already collects, so the map requests no additional collection; an endpoint whose sysDescr carries no firmware clause yields no row rather than a guessed one. Opt-in, and it attaches to the inventory items the CIMC endpoint map creates. Fix: **an optional plugin version that did not match exactly silently disabled its whole integration**. `required_package_version` was an equality gate, and an unmatched version skips every model of that integration; it now expresses a set of supported versions, the same shape the fast baseline already uses for the same reason. Known limitation: a merge delete blocked by one of those hidden PROTECT relations is still not predicted, so it is scheduled and fails at apply time, and a failed row blocks baseline promotion. Widening the merge predictor was tried and measured: it silently kept a device that should have been deleted, because the merge clears that reference in the same transaction. Deferred rather than shipped on reasoning. No migration and no operator step; upgrade and re-run the sync. |
 | `v2.6.12` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.6`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Superseded by `v2.7.0`; Published as `2.6.12`: `2.6.10` and `2.6.11` were tagged but never published, so no artifact exists for either and PyPI went from `2.6.9` to this release. 2.6.12 carries both tranches plus the release-path fix below. Fix: **a merge failure that names no field now names its rule**. A non-field validation error reports `__all__` — a field name meaning "no field" — so a customer's `ipam.ipaddress` merge failure was indistinguishable from any other cause. NetBox interpolates the message before raising, putting the address inside the string, so it cannot be persisted as-is: known rules resolve to slugs this plugin defines, and anything uncatalogued is reduced to wording with every value-bearing token masked. Confirmed in the field: a failure that had read only `ValidationError` now reads `violating primary-ip-reassignment-blocked`. Fix: **a row NetBox refuses on its own validation rule no longer wedges the baseline**. Any failed row blocks baseline promotion, and re-running cannot change a validation rejection because the rule belongs to the destination rather than the incoming data, so a few permanently unsatisfiable addresses could stop thousands of correct changes from ever being attested. Those rows are recorded and skipped; integrity and other errors still fail and still block. Fix: **the ingestion log download contains the issues behind the run** — message, exception and structured diagnosis, with an explicit truncation flag past 200 rows. The exception text was previously discarded before anything persisted it, so searching server logs for it could not have matched on any deployment. Fix: **the one ingestion that cannot be deleted no longer reads as an error** — it is the baseline, the durable record of what has already converged, and NetBox protects it deliberately; the refusal now says so and is raised as a warning. Fix: **the scope reconciliation refresh button no longer returns a 500 while also queueing a job that never runs**. The view handed the job class to the queue where a callable was required; RQ rejects a class, but only at dispatch, which happens on transaction commit — after the Job row is already written. Fix: **a failed ownership reconciliation names which conflict refused it**. Eight sites raised the error bare and the message was stripped before the job record was written, so the customer-visible failure carried the exception class and nothing else. The messages embed device names, so an allowlist maps each known conflict to a slug, and an unmatched message is recorded as unrecognised rather than falling silent. Release flow: **the release provenance gate is now satisfiable**. Two of its requirements had not been jointly satisfiable since the 2.6 series began: every commit in the reviewed range must still have a successful main-push run, which GitHub expires, while the security-bootstrap check required the three scanner files to appear in a diff from the anchor — true only while the anchor sat immediately before the single commit that introduced them. A fixed anchor expires runs and a moved anchor empties that diff, which is why `2.6.10` and then `2.6.11` both failed at the tag. The scanner is now verified at the release commit against pinned digests, which is strictly stronger than the diff test it replaces because that test never looked at content, and which frees the anchor to advance. No migration and no operator step; upgrade and re-run the sync. |
 | `v2.6.9` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.6`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Superseded by `v2.6.12`; Published as `2.6.9`: `2.6.7` and `2.6.8` were tagged but never published, so no artifact exists for either — a release-time gate resolved the version to upgrade from by reading git tags, and a tag records only what was tagged, not what reached the index. 2.6.9 carries both tranches plus the fixes below. Fix: **a merge failure names the constraint or field it violated** in the issue list, not only in the record behind it — the detail had been stored since 2.6.6 but the list still showed just the exception class, so a merge `ValidationError` looked identical whatever caused it. Fix: **the one ingestion that cannot be deleted says so first**. Deleting the baseline ingestion rendered every dependent object — one per synced device — and only then refused, so the refusal arrived after several hundred device names. Release flow: the upgrade gate moved out of the tag-triggered publish into pull-request CI, where a failure blocks a merge rather than consuming a version number that cannot be reused, and the version to upgrade from is resolved from the package index rather than from tags. Fix: **a module whose type re-creates a component another module already owns** no longer fails the row. NetBox adopts an existing component only when it belongs to no module, so a console port already claimed by a different module can be neither adopted nor recreated and the database rejects the duplicate name; because a failed row blocks baseline promotion, one such module stalled a whole sync. The collision is now detected before the write and reported as a rolled-up skip. Fix: **two devices resolving the same management address** no longer fail the ingestion. NetBox allows an address to be the primary IP of exactly one device, and the `Mgmt_`-tag path assigned it without checking, so a shared management address ended the sync at `dcim_device_primary_ip4_id_key` after every workload had already been staged. Each address is claimed once and the conflicts are reported. Release flow: the build job now checks out with tags, and a harness check fails closed if a job running a tag-dependent task ever loses them again. Convergence, diagnosability and apply-performance release. Fix: **a device could fail to adopt its primary IP** with `The specified IP address is not assigned to this device` — when the device and the address both already existed and a sync only re-pointed them, nothing ordered the two updates and whichever change was recorded first won. A race, which is why it presented as a single device out of thousands and never reproduced. Fix: **a delete the database will always refuse no longer fails the row** — a delete held by a PROTECT reference that survives the run was still attempted, and because any failed row blocks baseline promotion, one operator-owned object could wedge a sync's convergence bookkeeping indefinitely. It is now reported and skipped, leaving the intent visible in drift. Fix: **a failed sync explains itself in the UI** — a terminating failure recorded no model and no detail, so the one issue that says why a run died was the least informative thing on the page and the constraint was recoverable only from server logs. Constraint, table and invalid-field names are now recorded on every sync failure, in the issue message and over the API; the key values behind them still are not. Fix: **one invalid MAC row no longer aborts the whole batch**, and two stored rows sharing a canonical address are reported instead of one being overwritten at random. Feature: **an opt-in COPY/SQL apply engine for MAC addresses**, off by default and version-pinned, measured 8.98x faster on a realistic mix with full fallback to the existing engine. Performance: **IP address creation issues a third fewer queries** by not re-fetching an interface and device that validation never needed. Feature: **a license-tier refusal from Forward is named as one** — organization-authored queries require a NETWORK-facet tier and CVE data additionally requires SECURITY, so the failure says which capability is missing instead of surfacing a raw HTTP error. Fix: **an optional plugin can be upgraded again** — `netbox-dlm` was pinned to an exact `0.4.1`, so `0.5.0` was refused at install; worse, the fast baseline, set-based merge and COPY/SQL engines each compared the whole optional-plugin tuple exactly, so getting past the install pin would have switched all three off with nothing an operator could see — turning a first sync from minutes into hours. Each engine now lists the versions validated against it, and `0.5.0` is one of them; anything unlisted is still refused. Fix: **NetBox and Branching patch releases no longer block the plugin** — the plugin refused to load on anything but NetBox `4.6.5` and `netbox-branching` `1.1.1`, so a patch upgrade to `4.6.6` or `1.1.2` stopped it dead; and where it did load, the version-pinned engines switched themselves off silently. Any `4.6.x` and `1.1.x` is accepted now, with behavioural contract checks in place of version equality: the set-based merge engine verifies the live MAC search index and the fast baseline verifies the fields of every model it loads directly, so a patch that really does change something underneath still fails closed. NetBox `4.6.6` added a third indexed MAC field, which is exactly what that check catches — set-based merge (opt-in, off by default) declines there until it emits that field. Release flow: the gate no longer has to run on port 8000, and an upgrade from the previous release is tested before publish rather than only a clean install. No migration and no operator step; upgrade and re-run the sync. |

{forward_netbox-2.7.2 → forward_netbox-2.7.4}/README.md

@@ -64,15 +64,16 @@ See the
 
 ## Release Compatibility
 
-The `2.7.2` release candidate requires NetBox `4.6.x` (>= `4.6.5`, tested on `4.6.6`) and `netbox-branching` `1.1.x` (tested on `1.1.2`). Expand for the published release history and candidate notes.
+The `2.7.4` release candidate requires NetBox `4.6.x` (>= `4.6.5`, tested on `4.6.6`) and `netbox-branching` `1.1.x` (tested on `1.1.2`). Expand for the published release history and candidate notes.
 
 <details>
 <summary>Release compatibility history</summary>
 
 | Plugin Release | NetBox Version | Status |
 | --- | --- | --- |
-| `v2.7.2` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.6`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Release candidate; Fix: **a query bound by ID no longer has to prove a commit before it can run**. A map bound to a Forward query by direct ID with no stored commit was rejected before execution, and because one ineligible map empties the whole plan, nothing was scheduled and the sync ended having fetched nothing - while every Forward call returned 200. The plugin was resolving a commit on Forward's behalf by walking the query history for one whose source matched its own bundled copy; Forward never required it, and the execution payload already omitted it for head. A query ID now executes at Forward's latest. An explicitly stored commit is still honoured, and diff execution is unchanged because there the two commits are part of the request path. A query whose parameters have moved on now fails on its own model, naming the map, instead of silently emptying the run. Fix: **a run whose model comes back far smaller than its baseline is refused**. Dropping the commit check removed the comparison that used to notice a query changing underneath a map, which left one case invisible: a query that still accepts the same parameters and still returns the same shape, but fewer rows. Those rows are authoritative, so the absent ones reconcile as deletions with nothing reported. A model returning more than 30% fewer rows than its last promoted baseline, and at least 20 fewer, now blocks the run before anything is staged. It is on by default and a sync with no drift policy is still covered; a policy can widen or disable it, the absence of one cannot. A first run, a diff run, a model already failing, and a scope the operator narrowed are all excluded. Fix: **a failed sync now says why, per model**. The reason was reduced to an exception class name before anything recorded it, so no log, database row, or support bundle could recover it - one deployment ran five consecutive failed syncs that could not be diagnosed from any evidence it produced. Failures now carry a catalogued reason alongside the class, resolved once in a shared place rather than as another per-case exception. Two paths that composed their own message, and two job outcomes that were exported as redacted because they were phrased differently, were folded into it. Messages that embed collected values are still reduced to wording and slugs. Release flow: **a post-release commit that carries executable content fails the harness**. The first commit after a release tag must be documentation only, and it cannot be reclaimed once taken, so getting it wrong makes every later release unverifiable. No migration beyond the drift-policy fields, which apply themselves, and no operator step; upgrade and re-run the sync. |
-| `v2.7.1` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.6`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Current release; Fix: **a merge delete blocked by a hidden PROTECT reference is now predicted instead of discovered at apply time**. 2.7.0 shipped this as a known limitation because widening the predictor on reasoning alone kept a device that should have been deleted; the predictor now accounts for the provenance rows the merge clears inside the same transaction, so a delete is scheduled when nothing outside the merge still protects the row and is still refused when something does. Fix: **a CVE and the software version referencing it no longer fail when both are created in the same merge**. The dependency graph modelled scalar foreign keys but not many-to-many references, so the target could be ordered after the row pointing at it. Latent since 2.5.11 and only reachable once the CVE maps were enabled. Fix: **deleting an ingestion now takes its own scope-reconciliation rows with it**. Those rows protect the ingestion, so an ingestion that had reconciled could never be removed and the refusal named a model the operator has no way to clear. Fix: **the ingestion issues list no longer returns a 500**. The view was registered but its URL was never included, so the list route resolved to nothing while the detail route worked. A test now sweeps every model with a detail route for the same omission. Fix: **a row NetBox can never accept is now recorded as skipped rather than failed**. Any failed row blocks baseline promotion, and without promotion there is no bookkeeping and drift reports Not measured, so a handful of permanently unsatisfiable addresses could mask thousands of correct changes. Integrity and unrecognised errors still fail and still block. Security: takes the `cryptography` fix for CVE-2026-69247. Release flow: dependency advisories are audited before the gate rather than after the tag, a skipped post-release step now fails the harness instead of passing quietly, and a release opens its own close-out work. No migration and no operator step; upgrade and re-run the sync. |
+| `v2.7.4` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.6`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Release candidate. Published as `2.7.4`: `2.7.3` was tagged but never published, so no `2.7.3` artifact exists on PyPI - the release commit recorded no `## Release Authorization` evidence, and the publish workflow refuses a tag whose plan cannot show which gates ran against that exact tree, so it stopped before building anything. 2.7.4 is the same tree with that evidence recorded. Fix: **one interface NetBox refuses no longer fails the whole sync**. A `ValidationError` raised while validating an interface left the apply engine entirely and surfaced as a terminating failure that named no model and no row, so a run that had staged 172 changes ended having applied none and the only evidence produced identified neither the device nor the interface. The row is now recorded against `dcim.interface` and the rest of the shard proceeds. Fix: **a rejection now says which rule rejected it, not just which field**. The rule catalogue read only the errors NetBox declines to attach to a field, which made a rule legible exactly when NetBox would not name a field and illegible whenever it did. `untagged_vlan` alone carries two unrelated NetBox rules - an interface whose mode admits no untagged VLAN, and a VLAN outside the device's site - with different causes and different fixes, and no evidence the plugin produced could tell them apart. Every field is read now, both rules are catalogued, and the field and the rule are reported together. Fix: **a rejection about state the sync did not write is skipped rather than failed**. Validation covers the whole object while an update writes only the fields that differ, so an untagged VLAN left behind by a device that moved sites fails a later sync that changes only the MTU. Refusing to write is right; calling it a failure is not, because a failure also fails the row's dependents and no retry can change the answer. A catalogued rule on a field the row does not write is now recorded and skipped. A rule the catalogue cannot name stays a failure, deliberately. Fix: **both apply paths reach the same verdict**. The bulk engine and the row-oriented adapter had come to opposite conclusions about the same interface while each was locally correct, and the parity harness could not see it because both write nothing in that case. One shared rule now answers it for both. Fix: **the merge stops filing its own defects as unfixable**. Every validation rejection at merge counted as unsatisfiable, which is right for a rule that belongs to the destination and wrong for a rejection the merge itself caused, where retrying is the correct response. Only a catalogued rule landing on a field the change writes moves; an uncatalogued rule still skips, so nothing can newly block a baseline. Fix: **a spent baseline is no longer called the current one**. Every ingestion that promotes leaves a baseline record behind, and promotion only marks the previous one superseded - it clears the contents but keeps the row, which goes on protecting its ingestion. The refusal told an operator with three undeletable ingestions that each was the baseline for the sync, true of at most one, and pointed at a repair the product does not offer. It now says the record is spent, that it still protects the ingestion, and that nothing releases it today. Collecting spent baselines is still a known gap. Feature: **a command that finds the interfaces NetBox will refuse**. `forward_interface_vlan_audit` reports every interface whose untagged VLAN belongs to another site, and every interface carrying one with no 802.1Q mode, naming the device, the interface, both sites and the VLAN ID. Persisted diagnostics carry schema identifiers and never collected values, which is why a rejected row cannot name itself; this computes the answer on demand and writes it to the operator's console instead. Fix: **an ingestion whose baseline has been superseded can be deleted**. Every ingestion that promotes leaves a baseline record behind, and promotion only marks the previous one superseded - it clears the contents but keeps the row, which goes on protecting its ingestion. Nothing ever removed one, so every ingestion that had promoted was permanently undeletable and the backlog grew by one per successful sync. A spent record now goes with its ingestion; the live one is still kept, by every route rather than only through the delete button. Fix: **an ingestion whose job is still running is refused**, the same protection a sync already had. Deleting one mid-flight removed the job record while its worker carried on against it. Fix: **a skipped row says which model it was waiting for**, and says skipped rather than failed. Six identical rows naming only an exception class told an operator nothing about which parent was missing. Rows skipped while pruning are the inverse case and now name the records still referencing the object, which is why the prune was refused. Compatibility: **netbox-dlm `0.7.0` is accepted**, validated against the full suite rather than accepted on its changelog. No migration and no operator step; upgrade and re-run the sync. |
+| `v2.7.2` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.6`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Current release; Fix: **a query bound by ID no longer has to prove a commit before it can run**. A map bound to a Forward query by direct ID with no stored commit was rejected before execution, and because one ineligible map empties the whole plan, nothing was scheduled and the sync ended having fetched nothing - while every Forward call returned 200. The plugin was resolving a commit on Forward's behalf by walking the query history for one whose source matched its own bundled copy; Forward never required it, and the execution payload already omitted it for head. A query ID now executes at Forward's latest. An explicitly stored commit is still honoured, and diff execution is unchanged because there the two commits are part of the request path. A query whose parameters have moved on now fails on its own model, naming the map, instead of silently emptying the run. Fix: **a run whose model comes back far smaller than its baseline is refused**. Dropping the commit check removed the comparison that used to notice a query changing underneath a map, which left one case invisible: a query that still accepts the same parameters and still returns the same shape, but fewer rows. Those rows are authoritative, so the absent ones reconcile as deletions with nothing reported. A model returning more than 30% fewer rows than its last promoted baseline, and at least 20 fewer, now blocks the run before anything is staged. It is on by default and a sync with no drift policy is still covered; a policy can widen or disable it, the absence of one cannot. A first run, a diff run, a model already failing, and a scope the operator narrowed are all excluded. Fix: **a failed sync now says why, per model**. The reason was reduced to an exception class name before anything recorded it, so no log, database row, or support bundle could recover it - one deployment ran five consecutive failed syncs that could not be diagnosed from any evidence it produced. Failures now carry a catalogued reason alongside the class, resolved once in a shared place rather than as another per-case exception. Two paths that composed their own message, and two job outcomes that were exported as redacted because they were phrased differently, were folded into it. Messages that embed collected values are still reduced to wording and slugs. Release flow: **a post-release commit that carries executable content fails the harness**. The first commit after a release tag must be documentation only, and it cannot be reclaimed once taken, so getting it wrong makes every later release unverifiable. No migration beyond the drift-policy fields, which apply themselves, and no operator step; upgrade and re-run the sync. |
+| `v2.7.1` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.6`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Superseded by `v2.7.2`; Fix: **a merge delete blocked by a hidden PROTECT reference is now predicted instead of discovered at apply time**. 2.7.0 shipped this as a known limitation because widening the predictor on reasoning alone kept a device that should have been deleted; the predictor now accounts for the provenance rows the merge clears inside the same transaction, so a delete is scheduled when nothing outside the merge still protects the row and is still refused when something does. Fix: **a CVE and the software version referencing it no longer fail when both are created in the same merge**. The dependency graph modelled scalar foreign keys but not many-to-many references, so the target could be ordered after the row pointing at it. Latent since 2.5.11 and only reachable once the CVE maps were enabled. Fix: **deleting an ingestion now takes its own scope-reconciliation rows with it**. Those rows protect the ingestion, so an ingestion that had reconciled could never be removed and the refusal named a model the operator has no way to clear. Fix: **the ingestion issues list no longer returns a 500**. The view was registered but its URL was never included, so the list route resolved to nothing while the detail route worked. A test now sweeps every model with a detail route for the same omission. Fix: **a row NetBox can never accept is now recorded as skipped rather than failed**. Any failed row blocks baseline promotion, and without promotion there is no bookkeeping and drift reports Not measured, so a handful of permanently unsatisfiable addresses could mask thousands of correct changes. Integrity and unrecognised errors still fail and still block. Security: takes the `cryptography` fix for CVE-2026-69247. Release flow: dependency advisories are audited before the gate rather than after the tag, a skipped post-release step now fails the harness instead of passing quietly, and a release opens its own close-out work. No migration and no operator step; upgrade and re-run the sync. |
 | `v2.7.0` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.6`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Superseded by `v2.7.1`; Fix: **every ingestion was undeletable, and the refusal explained nothing**. `ForwardIngestionProvenanceMixin` declares its ingestion foreign key as PROTECT with `related_name="+"`, and Django hides such relations from `_meta.related_objects` - which is exactly what the protection check iterated, so of the five PROTECT relations pointing at an ingestion it could see one. An ingestion held only by device identities reported no refusal, so the delete view fell through to NetBox's confirmation page, rendered one dependent row per synced device, and then failed with `ProtectedError` on confirm. Every ingestion owns one identity per device, which is why the count grew with every sync rather than staying at one. Fix: **a primary IP moving between devices now converges**. The ownership proof was read through the active branch, and a branch is a snapshot of the moment it was provisioned, so an identity finalized after that provision was invisible and read as "not ours" - suppressing a release we were entitled to make. The holder lookup and the writes stay branch-native; only the ownership proof is pinned to the control plane. Feature: **CIMC firmware is reported into device lifecycle**. netbox-dlm `0.6.0` adds `InventoryItemSoftware`, so the firmware running on each Cisco management controller now lands in DLM alongside every device's OS version. The version is read from the SNMP sysDescr Forward already collects, so the map requests no additional collection; an endpoint whose sysDescr carries no firmware clause yields no row rather than a guessed one. Opt-in, and it attaches to the inventory items the CIMC endpoint map creates. Fix: **an optional plugin version that did not match exactly silently disabled its whole integration**. `required_package_version` was an equality gate, and an unmatched version skips every model of that integration; it now expresses a set of supported versions, the same shape the fast baseline already uses for the same reason. Known limitation: a merge delete blocked by one of those hidden PROTECT relations is still not predicted, so it is scheduled and fails at apply time, and a failed row blocks baseline promotion. Widening the merge predictor was tried and measured: it silently kept a device that should have been deleted, because the merge clears that reference in the same transaction. Deferred rather than shipped on reasoning. No migration and no operator step; upgrade and re-run the sync. |
 | `v2.6.12` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.6`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Superseded by `v2.7.0`; Published as `2.6.12`: `2.6.10` and `2.6.11` were tagged but never published, so no artifact exists for either and PyPI went from `2.6.9` to this release. 2.6.12 carries both tranches plus the release-path fix below. Fix: **a merge failure that names no field now names its rule**. A non-field validation error reports `__all__` — a field name meaning "no field" — so a customer's `ipam.ipaddress` merge failure was indistinguishable from any other cause. NetBox interpolates the message before raising, putting the address inside the string, so it cannot be persisted as-is: known rules resolve to slugs this plugin defines, and anything uncatalogued is reduced to wording with every value-bearing token masked. Confirmed in the field: a failure that had read only `ValidationError` now reads `violating primary-ip-reassignment-blocked`. Fix: **a row NetBox refuses on its own validation rule no longer wedges the baseline**. Any failed row blocks baseline promotion, and re-running cannot change a validation rejection because the rule belongs to the destination rather than the incoming data, so a few permanently unsatisfiable addresses could stop thousands of correct changes from ever being attested. Those rows are recorded and skipped; integrity and other errors still fail and still block. Fix: **the ingestion log download contains the issues behind the run** — message, exception and structured diagnosis, with an explicit truncation flag past 200 rows. The exception text was previously discarded before anything persisted it, so searching server logs for it could not have matched on any deployment. Fix: **the one ingestion that cannot be deleted no longer reads as an error** — it is the baseline, the durable record of what has already converged, and NetBox protects it deliberately; the refusal now says so and is raised as a warning. Fix: **the scope reconciliation refresh button no longer returns a 500 while also queueing a job that never runs**. The view handed the job class to the queue where a callable was required; RQ rejects a class, but only at dispatch, which happens on transaction commit — after the Job row is already written. Fix: **a failed ownership reconciliation names which conflict refused it**. Eight sites raised the error bare and the message was stripped before the job record was written, so the customer-visible failure carried the exception class and nothing else. The messages embed device names, so an allowlist maps each known conflict to a slug, and an unmatched message is recorded as unrecognised rather than falling silent. Release flow: **the release provenance gate is now satisfiable**. Two of its requirements had not been jointly satisfiable since the 2.6 series began: every commit in the reviewed range must still have a successful main-push run, which GitHub expires, while the security-bootstrap check required the three scanner files to appear in a diff from the anchor — true only while the anchor sat immediately before the single commit that introduced them. A fixed anchor expires runs and a moved anchor empties that diff, which is why `2.6.10` and then `2.6.11` both failed at the tag. The scanner is now verified at the release commit against pinned digests, which is strictly stronger than the diff test it replaces because that test never looked at content, and which frees the anchor to advance. No migration and no operator step; upgrade and re-run the sync. |
 | `v2.6.9` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.6`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Superseded by `v2.6.12`; Published as `2.6.9`: `2.6.7` and `2.6.8` were tagged but never published, so no artifact exists for either — a release-time gate resolved the version to upgrade from by reading git tags, and a tag records only what was tagged, not what reached the index. 2.6.9 carries both tranches plus the fixes below. Fix: **a merge failure names the constraint or field it violated** in the issue list, not only in the record behind it — the detail had been stored since 2.6.6 but the list still showed just the exception class, so a merge `ValidationError` looked identical whatever caused it. Fix: **the one ingestion that cannot be deleted says so first**. Deleting the baseline ingestion rendered every dependent object — one per synced device — and only then refused, so the refusal arrived after several hundred device names. Release flow: the upgrade gate moved out of the tag-triggered publish into pull-request CI, where a failure blocks a merge rather than consuming a version number that cannot be reused, and the version to upgrade from is resolved from the package index rather than from tags. Fix: **a module whose type re-creates a component another module already owns** no longer fails the row. NetBox adopts an existing component only when it belongs to no module, so a console port already claimed by a different module can be neither adopted nor recreated and the database rejects the duplicate name; because a failed row blocks baseline promotion, one such module stalled a whole sync. The collision is now detected before the write and reported as a rolled-up skip. Fix: **two devices resolving the same management address** no longer fail the ingestion. NetBox allows an address to be the primary IP of exactly one device, and the `Mgmt_`-tag path assigned it without checking, so a shared management address ended the sync at `dcim_device_primary_ip4_id_key` after every workload had already been staged. Each address is claimed once and the conflicts are reported. Release flow: the build job now checks out with tags, and a harness check fails closed if a job running a tag-dependent task ever loses them again. Convergence, diagnosability and apply-performance release. Fix: **a device could fail to adopt its primary IP** with `The specified IP address is not assigned to this device` — when the device and the address both already existed and a sync only re-pointed them, nothing ordered the two updates and whichever change was recorded first won. A race, which is why it presented as a single device out of thousands and never reproduced. Fix: **a delete the database will always refuse no longer fails the row** — a delete held by a PROTECT reference that survives the run was still attempted, and because any failed row blocks baseline promotion, one operator-owned object could wedge a sync's convergence bookkeeping indefinitely. It is now reported and skipped, leaving the intent visible in drift. Fix: **a failed sync explains itself in the UI** — a terminating failure recorded no model and no detail, so the one issue that says why a run died was the least informative thing on the page and the constraint was recoverable only from server logs. Constraint, table and invalid-field names are now recorded on every sync failure, in the issue message and over the API; the key values behind them still are not. Fix: **one invalid MAC row no longer aborts the whole batch**, and two stored rows sharing a canonical address are reported instead of one being overwritten at random. Feature: **an opt-in COPY/SQL apply engine for MAC addresses**, off by default and version-pinned, measured 8.98x faster on a realistic mix with full fallback to the existing engine. Performance: **IP address creation issues a third fewer queries** by not re-fetching an interface and device that validation never needed. Feature: **a license-tier refusal from Forward is named as one** — organization-authored queries require a NETWORK-facet tier and CVE data additionally requires SECURITY, so the failure says which capability is missing instead of surfacing a raw HTTP error. Fix: **an optional plugin can be upgraded again** — `netbox-dlm` was pinned to an exact `0.4.1`, so `0.5.0` was refused at install; worse, the fast baseline, set-based merge and COPY/SQL engines each compared the whole optional-plugin tuple exactly, so getting past the install pin would have switched all three off with nothing an operator could see — turning a first sync from minutes into hours. Each engine now lists the versions validated against it, and `0.5.0` is one of them; anything unlisted is still refused. Fix: **NetBox and Branching patch releases no longer block the plugin** — the plugin refused to load on anything but NetBox `4.6.5` and `netbox-branching` `1.1.1`, so a patch upgrade to `4.6.6` or `1.1.2` stopped it dead; and where it did load, the version-pinned engines switched themselves off silently. Any `4.6.x` and `1.1.x` is accepted now, with behavioural contract checks in place of version equality: the set-based merge engine verifies the live MAC search index and the fast baseline verifies the fields of every model it loads directly, so a patch that really does change something underneath still fails closed. NetBox `4.6.6` added a third indexed MAC field, which is exactly what that check catches — set-based merge (opt-in, off by default) declines there until it emits that field. Release flow: the gate no longer has to run on port 8000, and an upgrade from the previous release is tested before publish rather than only a clean install. No migration and no operator step; upgrade and re-run the sync. |

{forward_netbox-2.7.2 → forward_netbox-2.7.4}/forward_netbox/__init__.py

@@ -5,7 +5,7 @@ class NetboxForwardConfig(PluginConfig):
     name = "forward_netbox"
     verbose_name = "Forward"
     description = "Sync Forward data into NetBox using built-in NQE queries."
-    version = "2.7.2"
+    version = "2.7.4"
     base_url = "forward"
     min_version = "4.6.5"
     max_version = "4.6.99"

{forward_netbox-2.7.2 → forward_netbox-2.7.4}/forward_netbox/exceptions.py

@@ -70,6 +70,7 @@ class ForwardDataError(ForwardSyncError):
         defaults: dict | None = None,
         data: dict | None = None,
         issue_id: int | None = None,
+        dependency: str | None = None,
     ):
         super().__init__(message)
         self.model_string = model_string
@@ -77,6 +78,13 @@ class ForwardDataError(ForwardSyncError):
         self.defaults = defaults or {}
         self.data = data or {}
         self.issue_id = issue_id
+        # The model whose absence (or whose surviving children) caused this.
+        # A schema identifier the plugin defines, so unlike `context` — which
+        # carries the device or platform NAME and is reduced to key names before
+        # anything persists it — this one can be recorded. Without it a skipped
+        # row records only the exception class, and a customer reading six
+        # identical rows has no way to learn which parent was missing.
+        self.dependency = dependency or ""
 
 
 class ForwardSearchError(ForwardDataError):

forward_netbox-2.7.4/forward_netbox/management/commands/forward_interface_vlan_audit.py

@@ -0,0 +1,30 @@
+import json
+
+from django.core.management.base import BaseCommand
+
+from forward_netbox.utilities.interface_vlan_audit import audit_interface_untagged_vlans
+
+
+class Command(BaseCommand):
+    help = (
+        "Read-only audit of interfaces NetBox will refuse on their untagged VLAN. "
+        "Reports each interface whose untagged VLAN belongs to a different site "
+        "than its device (and is not global), and each interface carrying an "
+        "untagged VLAN with no 802.1Q mode. A sync records which rule rejected a "
+        "row but not which row, because persisted diagnostics carry no customer "
+        "data — this names the interfaces on your console instead. Never writes."
+    )
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            "--limit",
+            type=int,
+            default=25,
+            help="Rows listed per rule. Counts are always exact; 0 lists none.",
+        )
+
+    def handle(self, *args, **options):
+        payload = audit_interface_untagged_vlans(
+            sample_limit=int(options.get("limit") or 0)
+        )
+        self.stdout.write(json.dumps(payload, indent=2, default=str))

forward_netbox-2.7.4/forward_netbox/migrations/0050_contributor_baseline_cascade.py

@@ -0,0 +1,49 @@
+import django.db.models.deletion
+from django.db import migrations
+from django.db import models
+
+
+# Contributor baselines are main-schema convergence evidence, like the ownership
+# rows in 0047. Branch schemas must not receive independent constraints for them.
+fake_on_branch = True
+
+
+class Migration(migrations.Migration):
+    """Let an ingestion take its spent contributor baseline with it.
+
+    `ForwardContributorBaseline.ingestion` was PROTECT, and nothing anywhere
+    deletes a baseline. Promotion marks the previous generation SUPERSEDED,
+    deletes its relations and empties its payload — but keeps the row, which
+    goes on protecting its ingestion. So every ingestion that ever promoted
+    became permanently undeletable and the backlog grew by one per successful
+    sync; a customer reported three at once, and the refusal named a record he
+    had no way to remove.
+
+    The live baseline must still be kept, and CASCADE alone would not keep it.
+    That guarantee moves from the database to `refuse_ingestion_delete_with_live
+    _baseline` in `signals.py`, a `pre_delete` receiver, which fires for
+    querysets as well as instances and so covers every path the PROTECT
+    constraint covered. It is a deliberate trade: PROTECT could not express
+    "keep this one, collect that one", and expressing it in Python is what makes
+    the spent rows collectable at all.
+
+    Reversible: the reverse restores PROTECT. It can fail only if an ingestion
+    was deleted while this was applied and its spent baseline went with it —
+    which is the point of applying it — and no reverse resurrects those rows.
+    """
+
+    dependencies = [
+        ("forward_netbox", "0049_drift_policy_row_shrink_floor"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="forwardcontributorbaseline",
+            name="ingestion",
+            field=models.OneToOneField(
+                on_delete=django.db.models.deletion.CASCADE,
+                related_name="contributor_baseline",
+                to="forward_netbox.forwardingestion",
+            ),
+        ),
+    ]

{forward_netbox-2.7.2 → forward_netbox-2.7.4}/forward_netbox/models.py

@@ -1168,7 +1168,13 @@ class ForwardContributorBaseline(ForwardPluginModelDocsMixin, models.Model):
     )
     ingestion = models.OneToOneField(
         ForwardIngestion,
-        on_delete=models.PROTECT,
+        # CASCADE, not PROTECT: promotion leaves the previous generation
+        # SUPERSEDED with its relations deleted and its payload emptied, and
+        # nothing ever removed that husk, so every ingestion that promoted
+        # became permanently undeletable. PROTECT cannot express "keep the live
+        # one, collect the spent one"; the live one is kept by a `pre_delete`
+        # receiver instead - see `refuse_ingestion_delete_with_live_baseline`.
+        on_delete=models.CASCADE,
         related_name="contributor_baseline",
     )
     parent_baseline = models.ForeignKey(

{forward_netbox-2.7.2 → forward_netbox-2.7.4}/forward_netbox/signals.py

@@ -143,6 +143,59 @@ def cancel_enqueued_jobs_on_sync_delete(sender, instance, **kwargs):
         job.delete()
 
 
+@receiver(pre_delete, sender=ForwardIngestion)
+def refuse_ingestion_delete_with_live_baseline(sender, instance, **kwargs):
+    """Keep the live contributor baseline, and any ingestion still running.
+
+    Two guarantees that used to belong to the database, moved here when
+    `ForwardContributorBaseline.ingestion` became CASCADE so spent baselines
+    could be collected. PROTECT could not distinguish the live generation from
+    a superseded husk; this can, and unlike a check in the delete view it fires
+    for `queryset.delete()` too, so no path loses a baseline the sync still
+    depends on.
+
+    The running-job half closes the same hole `cancel_enqueued_jobs_on_sync_delete`
+    closes for a sync. `ForwardIngestion` carries `JobsMixin` as well, so its
+    `Job` rows cascade through the SQL collector and bypass `Job.delete()`'s
+    RQ-cancel override - deleting a mid-flight ingestion would drop the job row
+    while its worker kept running against it.
+    """
+    from .models import ForwardContributorBaseline
+
+    baseline = ForwardContributorBaseline.objects.filter(
+        ingestion=instance,
+        is_current=True,
+    ).first()
+    if baseline is not None:
+        raise ProtectedError(
+            "Cannot delete the ingestion holding this sync's current "
+            "contributor baseline; run the sync again so a newer ingestion "
+            "promotes its own, then delete this one.",
+            [baseline],
+        )
+
+    ingestion_type = ContentType.objects.get_for_model(
+        ForwardIngestion, for_concrete_model=False
+    )
+    referenced_job_ids = {
+        job_id
+        for job_id in (instance.job_id, instance.merge_job_id)
+        if job_id is not None
+    }
+    running = list(
+        Job.objects.filter(
+            Q(object_type=ingestion_type, object_id=instance.pk)
+            | Q(pk__in=referenced_job_ids),
+            status=JobStatusChoices.STATUS_RUNNING,
+        ).order_by("pk")
+    )
+    if running:
+        raise ProtectedError(
+            "Cannot delete a Forward ingestion while one of its jobs is " "running.",
+            running,
+        )
+
+
 def acquire_job_schedule_transaction_lock():
     """Serialize deletion through the surrounding transaction's commit."""
     if not connection.in_atomic_block:

{forward_netbox-2.7.2 → forward_netbox-2.7.4}/forward_netbox/tests/test_dlm_integration.py

@@ -1036,3 +1036,51 @@ class DependencySkipIssueRollupTest(TestCase):
         self.assertEqual(
             ForwardIngestionIssue.objects.filter(ingestion=ingestion).count(), 4
         )
+
+
+class DependencySkipNamesTheMissingParentTest(SimpleTestCase):
+    """A skipped row must say which parent was missing.
+
+    A customer's ingestion showed six rows reading exactly
+    `netbox_dlm.softwareversion row processing failed (ForwardDependencySkipError).`
+    The raiser's own message names the platform, but it embeds the platform NAME
+    so it cannot be persisted, and `context` is reduced to key names before
+    storage. The model label is a schema identifier, so it can be.
+    """
+
+    def test_the_missing_platform_is_named_on_the_exception(self):
+        from forward_netbox.exceptions import ForwardDependencySkipError
+        from forward_netbox.utilities.sync_dlm import _lookup_platform
+
+        runner = Mock()
+        runner._get_unique_or_raise.return_value = None
+        with self.assertRaises(ForwardDependencySkipError) as caught:
+            _lookup_platform(
+                runner,
+                {"platform": "some-platform", "platform_slug": "some-platform"},
+                "netbox_dlm.softwareversion",
+                "DLM software version",
+            )
+        self.assertEqual("dcim.platform", caught.exception.dependency)
+
+    def test_the_missing_device_type_is_named(self):
+        from forward_netbox.exceptions import ForwardDependencySkipError
+        from forward_netbox.utilities.sync_dlm import _lookup_device_type
+
+        runner = Mock()
+        runner._get_unique_or_raise.return_value = None
+        with self.assertRaises(ForwardDependencySkipError) as caught:
+            _lookup_device_type(
+                runner,
+                {"device_type": "some-model", "device_type_slug": "some-model"},
+                "netbox_dlm.hardwarenotice",
+                "DLM hardware notice",
+            )
+        self.assertEqual("dcim.devicetype", caught.exception.dependency)
+
+    def test_a_raiser_that_names_nothing_still_records_what_it_did_before(self):
+        # Most of the plugin's 30-odd raisers are untouched, and they must keep
+        # today's behaviour rather than record an empty slug.
+        from forward_netbox.exceptions import ForwardDependencySkipError
+
+        self.assertEqual("", ForwardDependencySkipError("nope").dependency)