DateTimeAttr

fixes
2026-03-10 08:15:57 +01:00 · 2026-03-09 14:06:41 -07:00 · 2026-03-09 14:06:16 -07:00 · 2026-03-09 13:08:58 -07:00 · 2026-03-09 12:49:39 -07:00 · 2026-03-09 14:11:14 -04:00
35 changed files with 889 additions and 937 deletions
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -84,6 +84,8 @@ intake policy](https://github.com/netbox-community/netbox/wiki/Issue-Intake-Poli

 * It's very important that you not submit a pull request until a relevant issue has been opened **and** assigned to you. Otherwise, you risk wasting time on work that may ultimately not be needed.

+* Community members are limited to a maximum of **three open PRs** at any time. This is to avoid the accumulation of too much parallel work and maintain focus on already PRs under review. If you already have three NetBox PRs open, please wait for at least one of them to be merged (or closed) before opening another.
+
 * New pull requests should generally be based off of the `main` branch. This branch, in keeping with the [trunk-based development](https://trunkbaseddevelopment.com/) approach, is used for ongoing development and bug fixes and always represents the newest stable code, from which releases are periodically branched. (If you're developing for an upcoming minor release, use `feature` instead.)

 * In most cases, it is not necessary to add a changelog entry: A maintainer will take care of this when the PR is merged. (This helps avoid merge conflicts resulting from multiple PRs being submitted simultaneously.)
@@ -96,10 +98,10 @@ intake policy](https://github.com/netbox-community/netbox/wiki/Issue-Intake-Poli
      greater than 80 characters in length

 > [!CAUTION]
-> Any contributions which include AI-generated or reproduced content will be rejected.
+> Any contributions which include solely AI-generated or reproduced content will be rejected. All PRs must be submitted by a human.

 * Some other tips to keep in mind:
-  * If you'd like to volunteer for someone else's issue, please post a comment on that issue letting us know. (This will allow the maintainers to assign it to you.)
+  * If you'd like to volunteer for someone else's issue, please post a comment on that issue letting us know. (GitHub allows only people who have commented on an issue to be assigned as its owner.)
  * Check out our [developer docs](https://docs.netbox.dev/en/stable/development/getting-started/) for tips on setting up your development environment.
  * All new functionality must include relevant tests where applicable.

--- a/docs/integrations/webhooks.md
+++ b/docs/integrations/webhooks.md
@@ -23,9 +23,9 @@ For example, you might create a NetBox webhook to [trigger a Slack message](http

 The following data is available as context for Jinja2 templates:

-* `event` - The type of event which triggered the webhook: created, updated, or deleted.
-* `model` - The NetBox model which triggered the change.
+* `event` - The type of event which triggered the webhook: `created`, `updated`, or `deleted`.
 * `timestamp` - The time at which the event occurred (in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format).
+* `object_type` - The NetBox model which triggered the change in the form `app_label.model_name`.
 * `username` - The name of the user account associated with the change.
 * `request_id` - The unique request ID. This may be used to correlate multiple changes associated with a single request.
 * `data` - A detailed representation of the object in its current state. This is typically equivalent to the model's representation in NetBox's REST API.
@@ -38,18 +38,20 @@ If no body template is specified, the request body will be populated with a JSON
 ```json
 {
    "event": "created",
-    "timestamp": "2021-03-09 17:55:33.968016+00:00",
-    "model": "site",
+    "timestamp": "2026-03-06T15:11:23.503186+00:00",
+    "object_type": "dcim.site",
    "username": "jstretch",
-    "request_id": "fdbca812-3142-4783-b364-2e2bd5c16c6a",
+    "request_id": "17af32f0-852a-46ca-a7d4-33ecd0c13de6",
    "data": {
-        "id": 19,
+        "id": 4,
+        "url": "/api/dcim/sites/4/",
+        "display_url": "/dcim/sites/4/",
+        "display": "Site 1",
        "name": "Site 1",
        "slug": "site-1",
-        "status": 
+        "status": {
            "value": "active",
-            "label": "Active",
-            "id": 1
+            "label": "Active"
        },
        "region": null,
        ...
@@ -57,8 +59,10 @@ If no body template is specified, the request body will be populated with a JSON
    "snapshots": {
        "prechange": null,
        "postchange": {
-            "created": "2021-03-09",
-            "last_updated": "2021-03-09T17:55:33.851Z",
+            "created": "2026-03-06T15:11:23.484Z",
+            "owner": null,
+            "description": "",
+            "comments": "",
            "name": "Site 1",
            "slug": "site-1",
            "status": "active",
--- a/docs/models/extras/webhook.md
+++ b/docs/models/extras/webhook.md
@@ -77,14 +77,14 @@ The file path to a particular certificate authority (CA) file to use when valida

 ## Context Data

-The following context variables are available in to the text and link templates.
+The following context variables are available to the text and link templates.

-| Variable     | Description                                        |
-|--------------|----------------------------------------------------|
-| `event`      | The event type (`create`, `update`, or `delete`)   |
-| `timestamp`  | The time at which the event occured                |
-| `model`      | The type of object impacted                        |
-| `username`   | The name of the user associated with the change    |
-| `request_id` | The unique request ID                              |
-| `data`       | A complete serialized representation of the object |
-| `snapshots`  | Pre- and post-change snapshots of the object       |
+| Variable      | Description                                          |
+|---------------|------------------------------------------------------|
+| `event`       | The event type (`created`, `updated`, or `deleted`)  |
+| `timestamp`   | The time at which the event occurred                 |
+| `object_type` | The type of object impacted (`app_label.model_name`) |
+| `username`    | The name of the user associated with the change      |
+| `request_id`  | The unique request ID                                |
+| `data`        | A complete serialized representation of the object   |
+| `snapshots`   | Pre- and post-change snapshots of the object         |
--- a/netbox/dcim/filtersets.py
+++ b/netbox/dcim/filtersets.py
@@ -306,12 +306,9 @@ class LocationFilterSet(TenancyFilterSet, ContactModelFilterSet, NestedGroupMode
        fields = ('id', 'name', 'slug', 'facility', 'description')

    def search(self, queryset, name, value):
-        # extended in order to include querying on Location.facility
-        queryset = super().search(queryset, name, value)
-
+        # Extend `search()` to include querying on Location.facility
        if value.strip():
-            queryset = queryset | queryset.model.objects.filter(facility__icontains=value)
-
+            return super().search(queryset, name, value) | queryset.filter(facility__icontains=value)
        return queryset


--- a/netbox/dcim/forms/bulk_import.py
+++ b/netbox/dcim/forms/bulk_import.py
@@ -1529,8 +1529,11 @@ class CableImportForm(PrimaryModelImportForm):

        model = content_type.model_class()
        try:
-            if device.virtual_chassis and device.virtual_chassis.master == device and \
-                    model.objects.filter(device=device, name=name).count() == 0:
+            if (
+                device.virtual_chassis and
+                device.virtual_chassis.master == device and
+                not model.objects.filter(device=device, name=name).exists()
+            ):
                termination_object = model.objects.get(device__in=device.virtual_chassis.members.all(), name=name)
            else:
                termination_object = model.objects.get(device=device, name=name)
--- a/netbox/dcim/graphql/filters.py
+++ b/netbox/dcim/graphql/filters.py
@@ -267,32 +267,32 @@ class DeviceFilter(
    longitude: Annotated['FloatLookup', strawberry.lazy('netbox.graphql.filter_lookups')] | None = (
        strawberry_django.filter_field()
    )
-    console_ports: Annotated['ConsolePortFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
-        strawberry_django.filter_field()
+    consoleports: Annotated['ConsolePortFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='console_ports')
    )
-    console_server_ports: Annotated['ConsoleServerPortFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
-        strawberry_django.filter_field()
+    consoleserverports: Annotated['ConsoleServerPortFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='console_server_ports')
    )
-    power_outlets: Annotated['PowerOutletFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
-        strawberry_django.filter_field()
+    poweroutlets: Annotated['PowerOutletFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='power_outlets')
    )
-    power_ports: Annotated['PowerPortFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
-        strawberry_django.filter_field()
+    powerports: Annotated['PowerPortFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='power_ports')
    )
    interfaces: Annotated['InterfaceFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
        strawberry_django.filter_field()
    )
-    front_ports: Annotated['FrontPortFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
-        strawberry_django.filter_field()
+    frontports: Annotated['FrontPortFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='front_ports')
    )
-    rear_ports: Annotated['RearPortFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
-        strawberry_django.filter_field()
+    rearports: Annotated['RearPortFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='rear_ports')
    )
-    device_bays: Annotated['DeviceBayFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
-        strawberry_django.filter_field()
+    devicebays: Annotated['DeviceBayFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='device_bays')
    )
-    module_bays: Annotated['ModuleBayFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
-        strawberry_django.filter_field()
+    modulebays: Annotated['ModuleBayFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='module_bays')
    )
    modules: Annotated['ModuleFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
        strawberry_django.filter_field()
@@ -383,36 +383,36 @@ class DeviceTypeFilter(ImageAttachmentFilterMixin, WeightFilterMixin, PrimaryMod
    rear_image: Annotated['ImageAttachmentFilter', strawberry.lazy('extras.graphql.filters')] | None = (
        strawberry_django.filter_field()
    )
-    console_port_templates: (
-        Annotated['ConsolePortTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None
-    ) = strawberry_django.filter_field()
-    console_server_port_templates: (
+    consoleporttemplates: Annotated['ConsolePortTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='console_port_templates')
+    )
+    consoleserverporttemplates: (
        Annotated['ConsoleServerPortTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None
-    ) = strawberry_django.filter_field()
-    power_port_templates: (
-        Annotated['PowerPortTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None
-    ) = strawberry_django.filter_field()
-    power_outlet_templates: (
-        Annotated['PowerOutletTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None
-    ) = strawberry_django.filter_field()
-    interface_templates: (
-        Annotated['InterfaceTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None
-    ) = strawberry_django.filter_field()
-    front_port_templates: (
-        Annotated['FrontPortTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None
-    ) = strawberry_django.filter_field()
-    rear_port_templates: (
-        Annotated['RearPortTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None
-    ) = strawberry_django.filter_field()
-    device_bay_templates: (
-        Annotated['DeviceBayTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None
-    ) = strawberry_django.filter_field()
-    module_bay_templates: (
-        Annotated['ModuleBayTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None
-    ) = strawberry_django.filter_field()
-    inventory_item_templates: (
-        Annotated['InventoryItemTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None
-    ) = strawberry_django.filter_field()
+    ) = strawberry_django.filter_field(name='console_server_port_templates')
+    powerporttemplates: Annotated['PowerPortTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='power_port_templates')
+    )
+    poweroutlettemplates: Annotated['PowerOutletTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='power_outlet_templates')
+    )
+    interfacetemplates: Annotated['InterfaceTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='interface_templates')
+    )
+    frontporttemplates: Annotated['FrontPortTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='front_port_templates')
+    )
+    rearporttemplates: Annotated['RearPortTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='rear_port_templates')
+    )
+    devicebaytemplates: Annotated['DeviceBayTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='device_bay_templates')
+    )
+    modulebaytemplates: Annotated['ModuleBayTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='module_bay_templates')
+    )
+    inventoryitemtemplates: Annotated['InventoryItemTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='inventory_item_templates')
+    )
    console_port_template_count: FilterLookup[int] | None = strawberry_django.filter_field()
    console_server_port_template_count: FilterLookup[int] | None = strawberry_django.filter_field()
    power_port_template_count: FilterLookup[int] | None = strawberry_django.filter_field()
@@ -696,32 +696,32 @@ class ModuleFilter(ConfigContextFilterMixin, PrimaryModelFilter):
    )
    serial: StrFilterLookup[str] | None = strawberry_django.filter_field()
    asset_tag: StrFilterLookup[str] | None = strawberry_django.filter_field()
-    console_ports: Annotated['ConsolePortFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
-        strawberry_django.filter_field()
+    consoleports: Annotated['ConsolePortFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='console_ports')
    )
-    console_server_ports: Annotated['ConsoleServerPortFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
-        strawberry_django.filter_field()
+    consoleserverports: Annotated['ConsoleServerPortFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='console_server_ports')
    )
-    power_outlets: Annotated['PowerOutletFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
-        strawberry_django.filter_field()
+    poweroutlets: Annotated['PowerOutletFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='power_outlets')
    )
-    power_ports: Annotated['PowerPortFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
-        strawberry_django.filter_field()
+    powerports: Annotated['PowerPortFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='power_ports')
    )
    interfaces: Annotated['InterfaceFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
        strawberry_django.filter_field()
    )
-    front_ports: Annotated['FrontPortFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
-        strawberry_django.filter_field()
+    frontports: Annotated['FrontPortFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='front_ports')
    )
-    rear_ports: Annotated['RearPortFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
-        strawberry_django.filter_field()
+    rearports: Annotated['RearPortFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='rear_ports')
    )
-    device_bays: Annotated['DeviceBayFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
-        strawberry_django.filter_field()
+    devicebays: Annotated['DeviceBayFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='device_bays')
    )
-    module_bays: Annotated['ModuleBayFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
-        strawberry_django.filter_field()
+    modulebays: Annotated['ModuleBayFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='module_bays')
    )
    modules: Annotated['ModuleFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
        strawberry_django.filter_field()
@@ -765,36 +765,33 @@ class ModuleTypeFilter(ImageAttachmentFilterMixin, WeightFilterMixin, PrimaryMod
    airflow: BaseFilterLookup[Annotated['ModuleAirflowEnum', strawberry.lazy('dcim.graphql.enums')]] | None = (
        strawberry_django.filter_field()
    )
-    console_port_templates: (
-        Annotated['ConsolePortTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None
-    ) = strawberry_django.filter_field()
-    console_server_port_templates: (
+    consoleporttemplates: Annotated['ConsolePortTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='console_port_templates')
+    )
+    consoleserverporttemplates: (
        Annotated['ConsoleServerPortTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None
-    ) = strawberry_django.filter_field()
-    power_port_templates: (
-        Annotated['PowerPortTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None
-    ) = strawberry_django.filter_field()
-    power_outlet_templates: (
-        Annotated['PowerOutletTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None
-    ) = strawberry_django.filter_field()
-    interface_templates: (
-        Annotated['InterfaceTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None
-    ) = strawberry_django.filter_field()
-    front_port_templates: (
-        Annotated['FrontPortTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None
-    ) = strawberry_django.filter_field()
-    rear_port_templates: (
-        Annotated['RearPortTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None
-    ) = strawberry_django.filter_field()
-    device_bay_templates: (
-        Annotated['DeviceBayTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None
-    ) = strawberry_django.filter_field()
-    module_bay_templates: (
-        Annotated['ModuleBayTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None
-    ) = strawberry_django.filter_field()
-    inventory_item_templates: (
-        Annotated['InventoryItemTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None
-    ) = strawberry_django.filter_field()
+    ) = strawberry_django.filter_field(name='console_server_port_templates')
+    powerporttemplates: Annotated['PowerPortTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='power_port_templates')
+    )
+    poweroutlettemplates: Annotated['PowerOutletTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='power_outlet_templates')
+    )
+    interfacetemplates: Annotated['InterfaceTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='interface_templates')
+    )
+    frontporttemplates: Annotated['FrontPortTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='front_port_templates')
+    )
+    rearporttemplates: Annotated['RearPortTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='rear_port_templates')
+    )
+    devicebaytemplates: Annotated['DeviceBayTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='device_bay_templates')
+    )
+    modulebaytemplates: Annotated['ModuleBayTemplateFilter', strawberry.lazy('dcim.graphql.filters')] | None = (
+        strawberry_django.filter_field(name='module_bay_templates')
+    )
    module_count: ComparisonFilterLookup[int] | None = strawberry_django.filter_field()


--- a/netbox/dcim/views.py
+++ b/netbox/dcim/views.py
@@ -16,7 +16,7 @@ from circuits.models import Circuit, CircuitTermination
 from extras.ui.panels import CustomFieldsPanel, ImageAttachmentsPanel, TagsPanel
 from extras.views import ObjectConfigContextView, ObjectRenderConfigView
 from ipam.models import ASN, VLAN, IPAddress, Prefix, VLANGroup
-from ipam.tables import InterfaceVLANTable, VLANTranslationRuleTable
+from ipam.tables import VLANTranslationRuleTable
 from netbox.object_actions import *
 from netbox.ui import actions, layout
 from netbox.ui.panels import (
@@ -389,7 +389,7 @@ class SiteGroupView(GetRelatedModelsMixin, generic.ObjectView):
                title=_('Child Groups'),
                filters={'parent_id': lambda ctx: ctx['object'].pk},
                actions=[
-                    actions.AddObject('dcim.Region', url_params={'parent': lambda ctx: ctx['object'].pk}),
+                    actions.AddObject('dcim.SiteGroup', url_params={'parent': lambda ctx: ctx['object'].pk}),
                ],
            ),
        ]
@@ -3230,21 +3230,6 @@ class InterfaceView(generic.ObjectView):
        )
        lag_interfaces_table.configure(request)

-        # Get assigned VLANs and annotate whether each is tagged or untagged
-        vlans = []
-        if instance.untagged_vlan is not None:
-            vlans.append(instance.untagged_vlan)
-            vlans[0].tagged = False
-        for vlan in instance.tagged_vlans.restrict(request.user).prefetch_related('site', 'group', 'tenant', 'role'):
-            vlan.tagged = True
-            vlans.append(vlan)
-        vlan_table = InterfaceVLANTable(
-            interface=instance,
-            data=vlans,
-            orderable=False
-        )
-        vlan_table.configure(request)
-
        # Get VLAN translation rules
        vlan_translation_table = None
        if instance.vlan_translation_policy:
@@ -3260,7 +3245,6 @@ class InterfaceView(generic.ObjectView):
            'bridge_interfaces_table': bridge_interfaces_table,
            'child_interfaces_table': child_interfaces_table,
            'lag_interfaces_table': lag_interfaces_table,
-            'vlan_table': vlan_table,
            'vlan_translation_table': vlan_translation_table,
        }

--- a/netbox/extras/management/commands/runscript.py
+++ b/netbox/extras/management/commands/runscript.py
@@ -81,7 +81,7 @@ class Command(BaseCommand):
                    logger.error(f'\t{field}: {error.get("message")}')
            raise CommandError()

-        # Remove extra fields from ScriptForm before passng data to script
+        # Remove extra fields from ScriptForm before passing data to script
        form.cleaned_data.pop('_schedule_at')
        form.cleaned_data.pop('_interval')
        form.cleaned_data.pop('_commit')
@@ -94,10 +94,12 @@ class Command(BaseCommand):
            data=form.cleaned_data,
            request=NetBoxFakeRequest({
                'META': {},
+                'COOKIES': {},
                'POST': data,
                'GET': {},
                'FILES': {},
                'user': user,
+                'method': 'POST',
                'path': '',
                'id': uuid.uuid4()
            }),
--- a/netbox/extras/managers.py
+++ b/netbox/extras/managers.py
@@ -0,0 +1,67 @@
+from django.db import router
+from django.db.models import signals
+from taggit.managers import _TaggableManager
+from taggit.utils import require_instance_manager
+
+__all__ = (
+    'NetBoxTaggableManager',
+)
+
+
+class NetBoxTaggableManager(_TaggableManager):
+    """
+    Extends taggit's _TaggableManager to replace the per-tag get_or_create loop in add() with a
+    single bulk_create() call, reducing SQL queries from O(N) to O(1) when assigning tags.
+    """
+
+    @require_instance_manager
+    def add(self, *tags, through_defaults=None, tag_kwargs=None, **kwargs):
+        self._remove_prefetched_objects()
+        if tag_kwargs is None:
+            tag_kwargs = {}
+        db = router.db_for_write(self.through, instance=self.instance)
+
+        tag_objs = self._to_tag_model_instances(tags, tag_kwargs)
+        new_ids = {t.pk for t in tag_objs}
+
+        # Determine which tags are not already assigned to this object
+        lookup = self._lookup_kwargs()
+        vals = set(
+            self.through._default_manager.using(db)
+            .values_list("tag_id", flat=True)
+            .filter(**lookup, tag_id__in=new_ids)
+        )
+        new_ids -= vals
+
+        if not new_ids:
+            return
+
+        signals.m2m_changed.send(
+            sender=self.through,
+            action="pre_add",
+            instance=self.instance,
+            reverse=False,
+            model=self.through.tag_model(),
+            pk_set=new_ids,
+            using=db,
+        )
+
+        # Use a single bulk INSERT instead of one get_or_create per tag.
+        self.through._default_manager.using(db).bulk_create(
+            [
+                self.through(tag=tag, **lookup, **(through_defaults or {}))
+                for tag in tag_objs
+                if tag.pk in new_ids
+            ],
+            ignore_conflicts=True,
+        )
+
+        signals.m2m_changed.send(
+            sender=self.through,
+            action="post_add",
+            instance=self.instance,
+            reverse=False,
+            model=self.through.tag_model(),
+            pk_set=new_ids,
+            using=db,
+        )
--- a/netbox/ipam/tables/vlans.py
+++ b/netbox/ipam/tables/vlans.py
@@ -1,19 +1,17 @@
 import django_tables2 as tables
 from django.utils.safestring import mark_safe
 from django.utils.translation import gettext_lazy as _
-from django_tables2.utils import Accessor

 from dcim.models import Interface
 from dcim.tables.template_code import INTERFACE_LINKTERMINATION, LINKTERMINATION
 from ipam.models import *
 from netbox.tables import NetBoxTable, OrganizationalModelTable, PrimaryModelTable, columns
-from tenancy.tables import TenancyColumnsMixin, TenantColumn
+from tenancy.tables import TenancyColumnsMixin
 from virtualization.models import VMInterface

 from .template_code import *

 __all__ = (
-    'InterfaceVLANTable',
    'VLANDevicesTable',
    'VLANGroupTable',
    'VLANMembersTable',
@@ -198,47 +196,6 @@ class VLANVirtualMachinesTable(VLANMembersTable):
        exclude = ('id', )


-class InterfaceVLANTable(NetBoxTable):
-    """
-    List VLANs assigned to a specific Interface.
-    """
-    vid = tables.Column(
-        linkify=True,
-        verbose_name=_('VID')
-    )
-    tagged = columns.BooleanColumn(
-        verbose_name=_('Tagged'),
-        false_mark=None
-    )
-    site = tables.Column(
-        verbose_name=_('Site'),
-        linkify=True
-    )
-    group = tables.Column(
-        accessor=Accessor('group__name'),
-        verbose_name=_('Group')
-    )
-    tenant = TenantColumn(
-        verbose_name=_('Tenant'),
-    )
-    status = columns.ChoiceFieldColumn(
-        verbose_name=_('Status'),
-    )
-    role = tables.Column(
-        verbose_name=_('Role'),
-        linkify=True
-    )
-
-    class Meta(NetBoxTable.Meta):
-        model = VLAN
-        fields = ('vid', 'tagged', 'site', 'group', 'name', 'tenant', 'status', 'role', 'description')
-        exclude = ('id', )
-
-    def __init__(self, interface, *args, **kwargs):
-        self.interface = interface
-        super().__init__(*args, **kwargs)
-
-
 #
 # VLAN Translation
 #
--- a/netbox/netbox/api/serializers/features.py
+++ b/netbox/netbox/api/serializers/features.py
@@ -53,8 +53,11 @@ class TaggableModelSerializer(serializers.Serializer):

    def _save_tags(self, instance, tags):
        if tags:
+            # Cache tags on instance so serialize_object() can reuse them without a DB query
+            instance._tags = tags
            instance.tags.set([t.name for t in tags])
        else:
+            instance._tags = []
            instance.tags.clear()

        return instance
--- a/netbox/netbox/graphql/pagination.py
+++ b/netbox/netbox/graphql/pagination.py
@@ -2,6 +2,8 @@ import strawberry
 from strawberry.types.unset import UNSET
 from strawberry_django.pagination import _QS, apply

+from netbox.config import get_config
+
 __all__ = (
    'OffsetPaginationInfo',
    'OffsetPaginationInput',
@@ -47,4 +49,14 @@ def apply_pagination(
        # Ignore `offset` when `start` is set
        pagination.offset = 0

+    # Enforce MAX_PAGE_SIZE on the pagination limit
+    max_page_size = get_config().MAX_PAGE_SIZE
+    if max_page_size:
+        if pagination is None:
+            pagination = OffsetPaginationInput(limit=max_page_size)
+        elif pagination.limit in (None, UNSET) or pagination.limit > max_page_size:
+            pagination.limit = max_page_size
+        elif pagination.limit <= 0:
+            pagination.limit = max_page_size
+
    return apply(pagination, queryset, related_field_id=related_field_id)
--- a/netbox/netbox/middleware.py
+++ b/netbox/netbox/middleware.py
@@ -40,15 +40,24 @@ class CoreMiddleware:
        with apply_request_processors(request):
            response = self.get_response(request)

-        # Check if language cookie should be renewed
-        if request.user.is_authenticated and settings.SESSION_SAVE_EVERY_REQUEST:
-            if language := request.user.config.get('locale.language'):
-                response.set_cookie(
-                    key=settings.LANGUAGE_COOKIE_NAME,
-                    value=language,
-                    max_age=request.session.get_expiry_age(),
-                    secure=settings.SESSION_COOKIE_SECURE,
-                )
+        # Set or renew the language cookie based on the user's preference. This handles two cases:
+        # 1. The user just logged in (via any auth backend): the user_logged_in signal stores the preferred language on
+        #    the request so we set the cookie here on the login response.
+        # 2. SESSION_SAVE_EVERY_REQUEST is enabled: renew the language cookie on every request to keep it in sync with
+        #    the session expiry.
+        if hasattr(request, '_language_cookie'):
+            language = request._language_cookie
+        elif request.user.is_authenticated and settings.SESSION_SAVE_EVERY_REQUEST:
+            language = request.user.config.get('locale.language')
+        else:
+            language = None
+        if language:
+            response.set_cookie(
+                key=settings.LANGUAGE_COOKIE_NAME,
+                value=language,
+                max_age=request.session.get_expiry_age(),
+                secure=settings.SESSION_COOKIE_SECURE,
+            )

        # Attach the unique request ID as an HTTP header.
        response['X-Request-ID'] = request.id
--- a/netbox/netbox/models/features.py
+++ b/netbox/netbox/models/features.py
@@ -15,6 +15,7 @@ from core.choices import JobStatusChoices, ObjectChangeActionChoices
 from core.models import ObjectType
 from extras.choices import *
 from extras.constants import CUSTOMFIELD_EMPTY_VALUES
+from extras.managers import NetBoxTaggableManager
 from extras.utils import is_taggable
 from netbox.config import get_config
 from netbox.constants import CORE_APPS
@@ -487,11 +488,12 @@ class JournalingMixin(models.Model):
 class TagsMixin(models.Model):
    """
    Enables support for tag assignment. Assigned tags can be managed via the `tags` attribute,
-    which is a `TaggableManager` instance.
+    which is a `NetBoxTaggableManager` instance.
    """
    tags = TaggableManager(
        through='extras.TaggedItem',
        ordering=('weight', 'name'),
+        manager=NetBoxTaggableManager,
    )

    class Meta:
--- a/netbox/netbox/tests/test_graphql.py
+++ b/netbox/netbox/tests/test_graphql.py
@@ -283,6 +283,53 @@ class GraphQLAPITestCase(APITestCase):
        self.assertEqual(len(data['data']['site_list']), 1)
        self.assertEqual(data['data']['site_list'][0]['name'], 'Site 7')

+    @override_settings(MAX_PAGE_SIZE=3)
+    def test_max_page_size(self):
+        self.add_permissions('dcim.view_site')
+        url = reverse('graphql')
+
+        # Request without explicit limit should be capped by MAX_PAGE_SIZE
+        query = """
+        {
+            site_list {
+                id name
+            }
+        }
+        """
+        response = self.client.post(url, data={'query': query}, format='json', **self.header)
+        self.assertHttpStatus(response, status.HTTP_200_OK)
+        data = json.loads(response.content)
+        self.assertNotIn('errors', data)
+        self.assertEqual(len(data['data']['site_list']), 3)
+
+        # Request with limit exceeding MAX_PAGE_SIZE should be capped
+        query = """
+        {
+            site_list(pagination: {limit: 100}) {
+                id name
+            }
+        }
+        """
+        response = self.client.post(url, data={'query': query}, format='json', **self.header)
+        self.assertHttpStatus(response, status.HTTP_200_OK)
+        data = json.loads(response.content)
+        self.assertNotIn('errors', data)
+        self.assertEqual(len(data['data']['site_list']), 3)
+
+        # Request with limit under MAX_PAGE_SIZE should be respected
+        query = """
+        {
+            site_list(pagination: {limit: 2}) {
+                id name
+            }
+        }
+        """
+        response = self.client.post(url, data={'query': query}, format='json', **self.header)
+        self.assertHttpStatus(response, status.HTTP_200_OK)
+        data = json.loads(response.content)
+        self.assertNotIn('errors', data)
+        self.assertEqual(len(data['data']['site_list']), 2)
+
    def test_pagination_conflict(self):
        url = reverse('graphql')
        query = """
--- a/netbox/netbox/ui/attrs.py
+++ b/netbox/netbox/ui/attrs.py
@@ -10,6 +10,7 @@ __all__ = (
    'BooleanAttr',
    'ChoiceAttr',
    'ColorAttr',
+    'DateTimeAttr',
    'GPSCoordinatesAttr',
    'GenericForeignKeyAttr',
    'ImageAttr',
@@ -367,6 +368,26 @@ class GPSCoordinatesAttr(ObjectAttribute):
        })


+class DateTimeAttr(ObjectAttribute):
+    """
+    A date or datetime attribute.
+
+    Parameters:
+        spec (str): Controls the rendering format. Use 'date' for date-only rendering,
+                    or 'seconds'/'minutes' for datetime rendering with the given precision.
+    """
+    template_name = 'ui/attrs/datetime.html'
+
+    def __init__(self, *args, spec='seconds', **kwargs):
+        super().__init__(*args, **kwargs)
+        self.spec = spec
+
+    def get_context(self, obj, context):
+        return {
+            'spec': self.spec,
+        }
+
+
 class TimezoneAttr(ObjectAttribute):
    """
    A timezone value. Includes the numeric offset from UTC.
--- a/netbox/templates/core/rq_queue_list.html
+++ b/netbox/templates/core/rq_queue_list.html
@@ -28,7 +28,7 @@
    </div>
  </div>

-  <div class="card">
+  <div class="card table-responsive">
    {% render_table table %}
  </div>
 {% endblock content %}
--- a/netbox/templates/dcim/interface.html
+++ b/netbox/templates/dcim/interface.html
@@ -86,6 +86,11 @@
              <th scope="row">{% trans "Q-in-Q SVLAN" %}</th>
              <td>{{ object.qinq_svlan|linkify|placeholder }}</td>
            </tr>
+          {% elif object.mode %}
+            <tr>
+              <th scope="row">{% trans "Untagged VLAN" %}</th>
+              <td>{{ object.untagged_vlan|linkify|placeholder }}</td>
+            </tr>
          {% endif %}
          <tr>
            <th scope="row">{% trans "Transmit power (dBm)" %}</th>
@@ -411,7 +416,10 @@
  </div>
  <div class="row mb-3">
    <div class="col col-md-12">
-      {% include 'inc/panel_table.html' with table=vlan_table heading="VLANs" %}
+      <div class="card">
+        <h2 class="card-header">{% trans "VLANs" %}</h2>
+        {% htmx_table 'ipam:vlan_list' interface_id=object.pk %}
+      </div>
    </div>
  </div>
  {% if object.is_lag %}
--- a/netbox/templates/ui/attrs/datetime.html
+++ b/netbox/templates/ui/attrs/datetime.html
@@ -0,0 +1 @@
+{% load helpers %}{% if spec == 'date' %}{{ value|isodate }}{% else %}{{ value|isodatetime:spec }}{% endif %}
--- a/netbox/templates/users/attrs/full_name.html
+++ b/netbox/templates/users/attrs/full_name.html
@@ -0,0 +1 @@
+{% load helpers %}{{ object.get_full_name|placeholder }}
--- a/netbox/templates/users/group.html
+++ b/netbox/templates/users/group.html
@@ -1,60 +1,3 @@
 {% extends 'generic/object.html' %}
-{% load i18n %}
-{% load helpers %}
-{% load render_table from django_tables2 %}
-
-{% block title %}{% trans "Group" %} {{ object.name }}{% endblock %}

 {% block subtitle %}{% endblock %}
-
-{% block content %}
-  <div class="row mb-3">
-    <div class="col-md-6">
-      <div class="card">
-        <h2 class="card-header">{% trans "Group" %}</h2>
-        <table class="table table-hover attr-table">
-          <tr>
-            <th scope="row">{% trans "Name" %}</th>
-            <td>{{ object.name }}</td>
-          </tr>
-          <tr>
-            <th scope="row">{% trans "Description" %}</th>
-            <td>{{ object.description|placeholder }}</td>
-          </tr>
-        </table>
-      </div>
-    </div>
-    <div class="col-md-6">
-      <div class="card">
-        <h2 class="card-header">{% trans "Users" %}</h2>
-        <div class="list-group list-group-flush">
-          {% for user in object.users.all %}
-            <a href="{% url 'users:user' pk=user.pk %}" class="list-group-item list-group-item-action">{{ user }}</a>
-          {% empty %}
-            <div class="list-group-item text-muted">{% trans "None" %}</div>
-          {% endfor %}
-        </div>
-      </div>
-      <div class="card">
-        <h2 class="card-header">{% trans "Assigned Permissions" %}</h2>
-        <div class="list-group list-group-flush">
-          {% for perm in object.object_permissions.all %}
-            <a href="{% url 'users:objectpermission' pk=perm.pk %}" class="list-group-item list-group-item-action">{{ perm }}</a>
-          {% empty %}
-            <div class="list-group-item text-muted">{% trans "None" %}</div>
-          {% endfor %}
-        </div>
-      </div>
-      <div class="card">
-        <h2 class="card-header">{% trans "Owner Membership" %}</h2>
-        <div class="list-group list-group-flush">
-          {% for owner in object.owners.all %}
-            <a href="{% url 'users:owner' pk=owner.pk %}" class="list-group-item list-group-item-action">{{ owner }}</a>
-          {% empty %}
-            <div class="list-group-item text-muted">{% trans "None" %}</div>
-          {% endfor %}
-        </div>
-      </div>
-    </div>
-  </div>
-{% endblock %}
--- a/netbox/templates/users/objectpermission.html
+++ b/netbox/templates/users/objectpermission.html
@@ -1,93 +1,5 @@
 {% extends 'generic/object.html' %}
 {% load i18n %}
-{% load helpers %}
-{% load render_table from django_tables2 %}

 {% block title %}{% trans "Permission" %} {{ object.name }}{% endblock %}
-
 {% block subtitle %}{% endblock %}
-
-{% block content %}
-  <div class="row mb-3">
-    <div class="col-md-6">
-      <div class="card">
-        <h2 class="card-header">{% trans "Permission" %}</h2>
-        <table class="table table-hover attr-table">
-          <tr>
-            <th scope="row">{% trans "Name" %}</th>
-            <td>{{ object.name }}</td>
-          </tr>
-          <tr>
-            <th scope="row">{% trans "Description" %}</th>
-            <td>{{ object.description|placeholder }}</td>
-          </tr>
-          <tr>
-            <th scope="row">{% trans "Enabled" %}</th>
-            <td>{% checkmark object.enabled %}</td>
-          </tr>
-        </table>
-      </div>
-      <div class="card">
-        <h2 class="card-header">{% trans "Actions" %}</h2>
-        <table class="table table-hover attr-table">
-          <tr>
-            <th scope="row">{% trans "View" %}</th>
-            <td>{% checkmark object.can_view %}</td>
-          </tr>
-          <tr>
-            <th scope="row">{% trans "Add" %}</th>
-            <td>{% checkmark object.can_add %}</td>
-          </tr>
-          <tr>
-            <th scope="row">{% trans "Change" %}</th>
-            <td>{% checkmark object.can_change %}</td>
-          </tr>
-          <tr>
-            <th scope="row">{% trans "Delete" %}</th>
-            <td>{% checkmark object.can_delete %}</td>
-          </tr>
-        </table>
-      </div>
-      <div class="card">
-        <h2 class="card-header">{% trans "Constraints" %}</h2>
-        <div class="card-body">
-          {% if object.constraints %}
-            <pre>{{ object.constraints|json }}</pre>
-          {% else %}
-            <span class="text-muted">None</span>
-          {% endif %}
-        </div>
-      </div>
-    </div>
-    <div class="col-md-6">
-      <div class="card">
-        <h2 class="card-header">{% trans "Object Types" %}</h2>
-        <ul class="list-group list-group-flush">
-          {% for user in object.object_types.all %}
-            <li class="list-group-item">{{ user }}</li>
-          {% endfor %}
-        </ul>
-      </div>
-      <div class="card">
-        <h2 class="card-header">{% trans "Assigned Users" %}</h2>
-        <div class="list-group list-group-flush">
-          {% for user in object.users.all %}
-            <a href="{% url 'users:user' pk=user.pk %}" class="list-group-item list-group-item-action">{{ user }}</a>
-          {% empty %}
-            <div class="list-group-item text-muted">{% trans "None" %}</div>
-          {% endfor %}
-        </div>
-      </div>
-      <div class="card">
-        <h2 class="card-header">{% trans "Assigned Groups" %}</h2>
-        <div class="list-group list-group-flush">
-          {% for group in object.groups.all %}
-            <a href="{% url 'users:group' pk=group.pk %}" class="list-group-item list-group-item-action">{{ group }}</a>
-          {% empty %}
-            <div class="list-group-item text-muted">{% trans "None" %}</div>
-          {% endfor %}
-        </div>
-      </div>
-    </div>
-  </div>
-{% endblock %}
--- a/netbox/templates/users/owner.html
+++ b/netbox/templates/users/owner.html
@@ -11,50 +11,3 @@
 {% endblock %}

 {% block subtitle %}{% endblock %}
-
-{% block content %}
-  <div class="row">
-    <div class="col-md-6">
-      <div class="card">
-        <h2 class="card-header">{% trans "Owner" %}</h2>
-        <table class="table table-hover attr-table">
-          <tr>
-            <th scope="row">{% trans "Name" %}</th>
-            <td>{{ object.name }}</td>
-          </tr>
-          <tr>
-            <th scope="row">{% trans "Group" %}</th>
-            <td>{{ object.group|linkify|placeholder }}</td>
-          </tr>
-          <tr>
-            <th scope="row">{% trans "Description" %}</th>
-            <td>{{ object.description|placeholder }}</td>
-          </tr>
-        </table>
-      </div>
-      <div class="card">
-        <h2 class="card-header">{% trans "Groups" %}</h2>
-        <div class="list-group list-group-flush">
-          {% for group in object.user_groups.all %}
-            <a href="{% url 'users:group' pk=group.pk %}" class="list-group-item list-group-item-action">{{ group }}</a>
-          {% empty %}
-            <div class="list-group-item text-muted">{% trans "None" %}</div>
-          {% endfor %}
-        </div>
-      </div>
-      <div class="card">
-        <h2 class="card-header">{% trans "Users" %}</h2>
-        <div class="list-group list-group-flush">
-          {% for user in object.users.all %}
-            <a href="{% url 'users:user' pk=user.pk %}" class="list-group-item list-group-item-action">{{ user }}</a>
-          {% empty %}
-            <div class="list-group-item text-muted">{% trans "None" %}</div>
-          {% endfor %}
-        </div>
-      </div>
-    </div>
-    <div class="col-md-6">
-      {% include 'inc/panels/related_objects.html' with filter_name='owner_id' %}
-    </div>
-  </div>
-{% endblock %}
--- a/netbox/templates/users/ownergroup.html
+++ b/netbox/templates/users/ownergroup.html
@@ -1,46 +1,3 @@
 {% extends 'generic/object.html' %}
-{% load i18n %}
-{% load helpers %}
-{% load render_table from django_tables2 %}

 {% block subtitle %}{% endblock %}
-
-{% block extra_controls %}
-  {% if perms.users.add_owner %}
-    <a href="{% url 'users:owner_add' %}?group={{ object.pk }}" class="btn btn-primary">
-      <i class="mdi mdi-plus-thick" aria-hidden="true"></i> {% trans "Add Owner" %}
-    </a>
-  {% endif %}
-{% endblock extra_controls %}
-
-{% block content %}
-  <div class="row mb-3">
-    <div class="col-md-6">
-      <div class="card">
-        <h2 class="card-header">{% trans "Group" %}</h2>
-        <table class="table table-hover attr-table">
-          <tr>
-            <th scope="row">{% trans "Name" %}</th>
-            <td>{{ object.name }}</td>
-          </tr>
-          <tr>
-            <th scope="row">{% trans "Description" %}</th>
-            <td>{{ object.description|placeholder }}</td>
-          </tr>
-        </table>
-      </div>
-    </div>
-    <div class="col-md-6">
-      <div class="card">
-        <h2 class="card-header">{% trans "Members" %}</h2>
-        <div class="list-group list-group-flush">
-          {% for owner in object.members.all %}
-            <a href="{% url 'users:owner' pk=owner.pk %}" class="list-group-item list-group-item-action">{{ owner }}</a>
-          {% empty %}
-            <div class="list-group-item text-muted">{% trans "None" %}</div>
-          {% endfor %}
-        </div>
-      </div>
-    </div>
-  </div>
-{% endblock %}
--- a/netbox/templates/users/panels/object_types.html
+++ b/netbox/templates/users/panels/object_types.html
@@ -0,0 +1,11 @@
+{% load i18n %}
+<div class="card">
+  <h2 class="card-header">{% trans "Object Types" %}</h2>
+  <ul class="list-group list-group-flush">
+    {% for object_type in object.object_types.all %}
+      <li class="list-group-item">{{ object_type }}</li>
+    {% empty %}
+      <li class="list-group-item text-muted">{% trans "None" %}</li>
+    {% endfor %}
+  </ul>
+</div>
--- a/netbox/templates/users/user.html
+++ b/netbox/templates/users/user.html
@@ -1,85 +1,3 @@
 {% extends 'generic/object.html' %}
-{% load i18n %}
-
-{% block title %}{% trans "User" %} {{ object.username }}{% endblock %}

 {% block subtitle %}{% endblock %}
-
-{% block content %}
-  <div class="row">
-    <div class="col-md-6">
-      <div class="card">
-        <h2 class="card-header">{% trans "User" %}</h2>
-        <table class="table table-hover attr-table">
-          <tr>
-            <th scope="row">{% trans "Username" %}</th>
-            <td>{{ object.username }}</td>
-          </tr>
-          <tr>
-            <th scope="row">{% trans "Full Name" %}</th>
-            <td>{{ object.get_full_name|placeholder }}</td>
-          </tr>
-          <tr>
-            <th scope="row">{% trans "Email" %}</th>
-            <td>{{ object.email|placeholder }}</td>
-          </tr>
-          <tr>
-            <th scope="row">{% trans "Account Created" %}</th>
-            <td>{{ object.date_joined|isodate }}</td>
-          </tr>
-          <tr>
-            <th scope="row">{% trans "Last Login" %}</th>
-            <td>{{ object.last_login|isodatetime:"minutes"|placeholder }}</td>
-          </tr>
-          <tr>
-            <th scope="row">{% trans "Active" %}</th>
-            <td>{% checkmark object.is_active %}</td>
-          </tr>
-          <tr>
-            <th scope="row">{% trans "Superuser" %}</th>
-            <td>{% checkmark object.is_superuser %}</td>
-          </tr>
-        </table>
-      </div>
-    </div>
-    <div class="col-md-6">
-      <div class="card">
-        <h2 class="card-header">{% trans "Assigned Groups" %}</h2>
-        <div class="list-group list-group-flush">
-          {% for group in object.groups.all %}
-            <a href="{% url 'users:group' pk=group.pk %}" class="list-group-item list-group-item-action">{{ group }}</a>
-          {% empty %}
-            <div class="list-group-item text-muted">{% trans "None" %}</div>
-          {% endfor %}
-        </div>
-      </div>
-      <div class="card">
-        <h2 class="card-header">{% trans "Assigned Permissions" %}</h2>
-        <div class="list-group list-group-flush">
-          {% for perm in object.object_permissions.all %}
-            <a href="{% url 'users:objectpermission' pk=perm.pk %}" class="list-group-item list-group-item-action">{{ perm }}</a>
-          {% empty %}
-            <div class="list-group-item text-muted">{% trans "None" %}</div>
-          {% endfor %}
-        </div>
-      </div>
-      <div class="card">
-        <h2 class="card-header">{% trans "Owner Membership" %}</h2>
-        <div class="list-group list-group-flush">
-          {% for owner in object.owners.all %}
-            <a href="{% url 'users:owner' pk=owner.pk %}" class="list-group-item list-group-item-action">{{ owner }}</a>
-          {% empty %}
-            <div class="list-group-item text-muted">{% trans "None" %}</div>
-          {% endfor %}
-        </div>
-      </div>
-    </div>
-  </div>
-  {% if perms.core.view_objectchange %}
-    <div class="row">
-      <div class="col-md-12">
-        {% include 'users/inc/user_activity.html' with user=object table=changelog_table %}
-      </div>
-    </div>
-  {% endif %}
-{% endblock %}
--- a/netbox/translations/en/LC_MESSAGES/django.po
+++ b/netbox/translations/en/LC_MESSAGES/django.po
--- a/netbox/users/signals.py
+++ b/netbox/users/signals.py
@@ -1,6 +1,6 @@
 import logging

-from django.contrib.auth.signals import user_login_failed
+from django.contrib.auth.signals import user_logged_in, user_login_failed
 from django.db.models.signals import post_save
 from django.dispatch import receiver

@@ -23,6 +23,18 @@ def log_user_login_failed(sender, credentials, request, **kwargs):
        logger.info(f"Failed login attempt for username: {username}")


+@receiver(user_logged_in)
+def set_language_on_login(sender, user, request, **kwargs):
+    """
+    Store the user's preferred language on the request so that middleware can set the language cookie. This ensures the
+    language preference is applied even when logging in via an external auth provider (e.g. social-app-django) that
+    does not go through NetBox's LoginView.
+    """
+    if hasattr(user, 'config'):
+        if language := user.config.get('locale.language'):
+            request._language_cookie = language
+
+
@receiver(post_save, sender=User)
 def create_userconfig(instance, created, raw=False, **kwargs):
    """
--- a/netbox/users/ui/panels.py
+++ b/netbox/users/ui/panels.py
@@ -23,3 +23,38 @@ class TokenExamplePanel(panels.Panel):
    actions = [
        actions.CopyContent('token-example')
    ]
+
+
+class UserPanel(panels.ObjectAttributesPanel):
+    username = attrs.TextAttr('username')
+    full_name = attrs.TemplatedAttr(
+        'get_full_name',
+        label=_('Full name'),
+        template_name='users/attrs/full_name.html',
+    )
+    email = attrs.TextAttr('email')
+    date_joined = attrs.DateTimeAttr('date_joined', label=_('Account created'), spec='date')
+    last_login = attrs.DateTimeAttr('last_login', label=_('Last login'), spec='minutes')
+    is_active = attrs.BooleanAttr('is_active', label=_('Active'))
+    is_superuser = attrs.BooleanAttr('is_superuser', label=_('Superuser'))
+
+
+class ObjectPermissionPanel(panels.ObjectAttributesPanel):
+    name = attrs.TextAttr('name')
+    description = attrs.TextAttr('description')
+    enabled = attrs.BooleanAttr('enabled')
+
+
+class ObjectPermissionActionsPanel(panels.ObjectAttributesPanel):
+    title = _('Actions')
+
+    can_view = attrs.BooleanAttr('can_view', label=_('View'))
+    can_add = attrs.BooleanAttr('can_add', label=_('Add'))
+    can_change = attrs.BooleanAttr('can_change', label=_('Change'))
+    can_delete = attrs.BooleanAttr('can_delete', label=_('Delete'))
+
+
+class OwnerPanel(panels.ObjectAttributesPanel):
+    name = attrs.TextAttr('name')
+    group = attrs.RelatedObjectAttr('group', linkify=True)
+    description = attrs.TextAttr('description')
--- a/netbox/users/views.py
+++ b/netbox/users/views.py
@@ -1,9 +1,18 @@
 from django.db.models import Count
+from django.utils.translation import gettext_lazy as _

 from core.models import ObjectChange
 from core.tables import ObjectChangeTable
 from netbox.object_actions import AddObject, BulkDelete, BulkEdit, BulkExport, BulkImport, BulkRename
-from netbox.ui import layout
+from netbox.ui import actions, layout
+from netbox.ui.panels import (
+    ContextTablePanel,
+    JSONPanel,
+    ObjectsTablePanel,
+    OrganizationalObjectPanel,
+    RelatedObjectsPanel,
+    TemplatePanel,
+)
 from netbox.views import generic
 from users.ui import panels
 from utilities.query import count_related
@@ -86,7 +95,39 @@ class UserListView(generic.ObjectListView):
@register_model_view(User)
 class UserView(generic.ObjectView):
    queryset = User.objects.all()
-    template_name = 'users/user.html'
+    layout = layout.SimpleLayout(
+        left_panels=[
+            panels.UserPanel(),
+        ],
+        right_panels=[
+            ObjectsTablePanel(
+                'users.Group', title=_('Assigned Groups'), filters={'user_id': lambda ctx: ctx['object'].pk}
+            ),
+            ObjectsTablePanel(
+                'users.ObjectPermission',
+                title=_('Assigned Permissions'),
+                filters={'user_id': lambda ctx: ctx['object'].pk},
+            ),
+            ObjectsTablePanel(
+                'users.Owner', title=_('Owner Membership'), filters={'user_id': lambda ctx: ctx['object'].pk}
+            ),
+        ],
+        bottom_panels=[
+            ContextTablePanel(
+                'changelog_table',
+                title=_('Recent Activity'),
+                actions=[
+                    actions.LinkAction(
+                        view_name='core:objectchange_list',
+                        url_params={'user_id': lambda ctx: ctx['object'].pk},
+                        label=_('View All'),
+                        button_icon='arrow-right-thick',
+                        permissions=['core.view_objectchange'],
+                    ),
+                ],
+            ),
+        ],
+    )

    def get_extra_context(self, request, instance):
        changelog = ObjectChange.objects.valid_models().restrict(request.user, 'view').filter(user=instance)[:20]
@@ -154,7 +195,22 @@ class GroupListView(generic.ObjectListView):
@register_model_view(Group)
 class GroupView(generic.ObjectView):
    queryset = Group.objects.all()
-    template_name = 'users/group.html'
+    layout = layout.SimpleLayout(
+        left_panels=[
+            OrganizationalObjectPanel(),
+        ],
+        right_panels=[
+            ObjectsTablePanel('users.User', filters={'group_id': lambda ctx: ctx['object'].pk}),
+            ObjectsTablePanel(
+                'users.ObjectPermission',
+                title=_('Assigned Permissions'),
+                filters={'group_id': lambda ctx: ctx['object'].pk},
+            ),
+            ObjectsTablePanel(
+                'users.Owner', title=_('Owner Membership'), filters={'user_group_id': lambda ctx: ctx['object'].pk}
+            ),
+        ],
+    )


@register_model_view(Group, 'add', detail=False)
@@ -212,7 +268,22 @@ class ObjectPermissionListView(generic.ObjectListView):
@register_model_view(ObjectPermission)
 class ObjectPermissionView(generic.ObjectView):
    queryset = ObjectPermission.objects.all()
-    template_name = 'users/objectpermission.html'
+    layout = layout.SimpleLayout(
+        left_panels=[
+            panels.ObjectPermissionPanel(),
+            panels.ObjectPermissionActionsPanel(),
+            JSONPanel('constraints', title=_('Constraints')),
+        ],
+        right_panels=[
+            TemplatePanel('users/panels/object_types.html'),
+            ObjectsTablePanel(
+                'users.User', title=_('Assigned Users'), filters={'permission_id': lambda ctx: ctx['object'].pk}
+            ),
+            ObjectsTablePanel(
+                'users.Group', title=_('Assigned Groups'), filters={'permission_id': lambda ctx: ctx['object'].pk}
+            ),
+        ],
+    )


@register_model_view(ObjectPermission, 'add', detail=False)
@@ -255,7 +326,7 @@ class ObjectPermissionBulkDeleteView(generic.BulkDeleteView):
@register_model_view(OwnerGroup, 'list', path='', detail=False)
 class OwnerGroupListView(generic.ObjectListView):
    queryset = OwnerGroup.objects.annotate(
-       owner_count=count_related(Owner, 'group')
+        owner_count=count_related(Owner, 'group')
    )
    filterset = filtersets.OwnerGroupFilterSet
    filterset_form = forms.OwnerGroupFilterForm
@@ -263,14 +334,26 @@ class OwnerGroupListView(generic.ObjectListView):


@register_model_view(OwnerGroup)
-class OwnerGroupView(GetRelatedModelsMixin, generic.ObjectView):
+class OwnerGroupView(generic.ObjectView):
    queryset = OwnerGroup.objects.all()
-    template_name = 'users/ownergroup.html'
-
-    def get_extra_context(self, request, instance):
-        return {
-            'related_models': self.get_related_models(request, instance),
-        }
+    layout = layout.SimpleLayout(
+        left_panels=[
+            OrganizationalObjectPanel(),
+        ],
+        right_panels=[
+            ObjectsTablePanel(
+                'users.Owner',
+                filters={'group_id': lambda ctx: ctx['object'].pk},
+                title=_('Members'),
+                actions=[
+                    actions.AddObject(
+                        'users.Owner',
+                        url_params={'group': lambda ctx: ctx['object'].pk},
+                    ),
+                ],
+            ),
+        ],
+    )


@register_model_view(OwnerGroup, 'add', detail=False)
@@ -326,7 +409,16 @@ class OwnerListView(generic.ObjectListView):
@register_model_view(Owner)
 class OwnerView(GetRelatedModelsMixin, generic.ObjectView):
    queryset = Owner.objects.all()
-    template_name = 'users/owner.html'
+    layout = layout.SimpleLayout(
+        left_panels=[
+            panels.OwnerPanel(),
+            ObjectsTablePanel('users.Group', filters={'owner_id': lambda ctx: ctx['object'].pk}),
+            ObjectsTablePanel('users.User', filters={'owner_id': lambda ctx: ctx['object'].pk}),
+        ],
+        right_panels=[
+            RelatedObjectsPanel(),
+        ],
+    )

    def get_extra_context(self, request, instance):
        return {
--- a/netbox/utilities/constants.py
+++ b/netbox/utilities/constants.py
@@ -38,6 +38,7 @@ FILTER_TREENODE_NEGATION_LOOKUP_MAP = dict(
 # HTTP Request META safe copy
 #

+# Non-HTTP_ META keys to include when copying a request (whitelist)
 HTTP_REQUEST_META_SAFE_COPY = [
    'CONTENT_LENGTH',
    'CONTENT_TYPE',
@@ -61,6 +62,13 @@ HTTP_REQUEST_META_SAFE_COPY = [
    'SERVER_PORT',
 ]

+# HTTP_ META keys known to carry sensitive data; excluded when copying a request (denylist)
+HTTP_REQUEST_META_SENSITIVE = {
+    'HTTP_AUTHORIZATION',
+    'HTTP_COOKIE',
+    'HTTP_PROXY_AUTHORIZATION',
+}
+

 #
 # CSV-style format delimiters
--- a/netbox/utilities/request.py
+++ b/netbox/utilities/request.py
@@ -8,7 +8,7 @@ from netaddr import AddrFormatError, IPAddress

 from netbox.registry import registry

-from .constants import HTTP_REQUEST_META_SAFE_COPY
+from .constants import HTTP_REQUEST_META_SAFE_COPY, HTTP_REQUEST_META_SENSITIVE

 __all__ = (
    'NetBoxFakeRequest',
@@ -45,11 +45,14 @@ def copy_safe_request(request, include_files=True):
        request: The original request object
        include_files: Whether to include request.FILES.
    """
-    meta = {
-        k: request.META[k]
-        for k in HTTP_REQUEST_META_SAFE_COPY
-        if k in request.META and isinstance(request.META[k], str)
-    }
+    meta = {}
+    for k, v in request.META.items():
+        if not isinstance(v, str):
+            continue
+        if k in HTTP_REQUEST_META_SAFE_COPY:
+            meta[k] = v
+        elif k.startswith('HTTP_') and k not in HTTP_REQUEST_META_SENSITIVE:
+            meta[k] = v
    data = {
        'META': meta,
        'COOKIES': request.COOKIES,
--- a/netbox/utilities/tests/test_request.py
+++ b/netbox/utilities/tests/test_request.py
@@ -1,7 +1,42 @@
+from django.contrib.auth.models import AnonymousUser
 from django.test import RequestFactory, TestCase
 from netaddr import IPAddress

-from utilities.request import get_client_ip
+from utilities.request import copy_safe_request, get_client_ip
+
+
+class CopySafeRequestTests(TestCase):
+    def setUp(self):
+        self.factory = RequestFactory()
+
+    def _make_request(self, **kwargs):
+        request = self.factory.get('/', **kwargs)
+        request.user = AnonymousUser()
+        return request
+
+    def test_standard_meta_keys_copied(self):
+        request = self._make_request(HTTP_USER_AGENT='TestAgent/1.0')
+        fake = copy_safe_request(request)
+        self.assertEqual(fake.META.get('HTTP_USER_AGENT'), 'TestAgent/1.0')
+
+    def test_arbitrary_http_headers_copied(self):
+        """Arbitrary HTTP_ headers (e.g. X-NetBox-*) should be included."""
+        request = self._make_request(HTTP_X_NETBOX_BRANCH='my-branch')
+        fake = copy_safe_request(request)
+        self.assertEqual(fake.META.get('HTTP_X_NETBOX_BRANCH'), 'my-branch')
+
+    def test_sensitive_headers_excluded(self):
+        """Authorization and Cookie headers must not be copied."""
+        request = self._make_request(HTTP_AUTHORIZATION='Bearer secret')
+        fake = copy_safe_request(request)
+        self.assertNotIn('HTTP_AUTHORIZATION', fake.META)
+
+    def test_non_string_meta_values_excluded(self):
+        """Non-string META values must not be copied."""
+        request = self._make_request()
+        request.META['HTTP_X_CUSTOM_INT'] = 42
+        fake = copy_safe_request(request)
+        self.assertNotIn('HTTP_X_CUSTOM_INT', fake.META)


 class GetClientIPTests(TestCase):
--- a/netbox/virtualization/views.py
+++ b/netbox/virtualization/views.py
@@ -13,7 +13,7 @@ from dcim.tables import DeviceTable
 from extras.ui.panels import CustomFieldsPanel, ImageAttachmentsPanel, TagsPanel
 from extras.views import ObjectConfigContextView, ObjectRenderConfigView
 from ipam.models import IPAddress, VLANGroup
-from ipam.tables import InterfaceVLANTable, VLANTranslationRuleTable
+from ipam.tables import VLANTranslationRuleTable
 from ipam.ui.panels import FHRPGroupAssignmentsPanel
 from netbox.object_actions import (
    AddObject,
@@ -594,7 +594,11 @@ class VMInterfaceView(generic.ObjectView):
                    ),
                ],
            ),
-            ContextTablePanel('vlan_table', title=_('Assigned VLANs')),
+            ObjectsTablePanel(
+                model='ipam.VLAN',
+                title=_('Assigned VLANs'),
+                filters={'vminterface_id': lambda ctx: ctx['object'].pk},
+            ),
            ContextTablePanel('vlan_translation_table', title=_('VLAN Translation')),
            ContextTablePanel('child_interfaces_table', title=_('Child Interfaces')),
        ],
@@ -620,24 +624,8 @@ class VMInterfaceView(generic.ObjectView):
            )
            vlan_translation_table.configure(request)

-        # Get assigned VLANs and annotate whether each is tagged or untagged
-        vlans = []
-        if instance.untagged_vlan is not None:
-            vlans.append(instance.untagged_vlan)
-            vlans[0].tagged = False
-        for vlan in instance.tagged_vlans.restrict(request.user).prefetch_related('site', 'group', 'tenant', 'role'):
-            vlan.tagged = True
-            vlans.append(vlan)
-        vlan_table = InterfaceVLANTable(
-            interface=instance,
-            data=vlans,
-            orderable=False
-        )
-        vlan_table.configure(request)
-
        return {
            'child_interfaces_table': child_interfaces_tables,
-            'vlan_table': vlan_table,
            'vlan_translation_table': vlan_translation_table,
        }

--- a/netbox/vpn/models/l2vpn.py
+++ b/netbox/vpn/models/l2vpn.py
@@ -126,8 +126,8 @@ class L2VPNTermination(NetBoxModel):
        if self.assigned_object:
            obj_id = self.assigned_object.pk
            obj_type = ObjectType.objects.get_for_model(self.assigned_object)
-            if L2VPNTermination.objects.filter(assigned_object_id=obj_id, assigned_object_type=obj_type).\
-                    exclude(pk=self.pk).count() > 0:
+            terminations = L2VPNTermination.objects.filter(assigned_object_id=obj_id, assigned_object_type=obj_type)
+            if terminations.exclude(pk=self.pk).exists():
                raise ValidationError(
                    _('L2VPN Termination already assigned ({assigned_object})').format(
                        assigned_object=self.assigned_object
Author	SHA1	Message	Date
Arthur	ea61efa66a	DateTimeAttr	2026-03-09 14:06:41 -07:00
Arthur	6353aca557	DateTimeAttr	2026-03-09 14:06:16 -07:00
Arthur	9c5a0d5297	fixes	2026-03-09 13:08:58 -07:00
Arthur	819d637efc	Merge branch 'main' into 21566-user	2026-03-09 12:49:39 -07:00
Arthur Hanson	b5bd8905ca	#21330 optimize the assignment of tags when saving an object (#21595 ) * #21330 optimize object tag creation * ruff fixes * optimize * review changes * fix * Update netbox/extras/managers.py Co-authored-by: Jeremy Stretch <jstretch@netboxlabs.com> --------- Co-authored-by: Jeremy Stretch <jstretch@netboxlabs.com>	2026-03-09 14:11:14 -04:00
Jeremy Stretch	cb5521f818	Closes #21468 : copy_safe_request() should retain non-sensitive HTTP request headers (#21577 ) - Define `HTTP_REQUEST_META_SENSITIVE` to serve as a blacklist for known-sensitive headers - Modify `copy_safe_request()` to copy all non-sensitive headers (ignoring any not defined as strings) - Add the `CopySafeRequestTests` test suite	2026-03-09 16:54:00 +01:00
Jeremy Stretch	3cb854b7d5	Closes #21611 : Replace calls to .count() with .exists() (#21612 ) Replace two boolean evaluations of .count() with .exists()	2026-03-09 16:46:38 +01:00
Jeremy Stretch	d980837da0	Fixes #20385 : Ensure GraphQL API respects `MAX_PAGE_SIZE` (#21617 ) - Extend `apply_pagination()` to check for and apply `MAX_PAGE_SIZE` - Add a test	2026-03-09 14:58:23 +01:00
github-actions	5c19afc07c	Update source translation strings	2026-03-07 05:14:28 +00:00
Arthur	e3758811a5	review changes	2026-03-06 13:09:24 -08:00
Jeremy Stretch	67defb3228	Fixes #21531 : Fix search functionality for location when combined with other filters (#21599 )	2026-03-06 11:54:10 -06:00
Martin Hauser	cca4cc61b6	Fixes #21512 : Fix GraphQL filtering for device, module components, templates (#21602 )	2026-03-06 11:23:45 -06:00
Martin Hauser	758b230403	docs(webhooks): Update context variables and example payload (#21607 ) Clarify webhook context variable names and event types. Replace `model` with `object_type`, update event values to match actual output (`created` vs. `create`), and refresh example JSON to reflect the current API response format, including new fields like `display` and `display_url`. Fixes #21489	2026-03-06 09:04:30 -08:00
Jeremy Stretch	8ea33df148	Fixes #20915 : Ensure preferred language is applied during SSO login (#21590 )	2026-03-06 10:00:33 -06:00
Jeremy Stretch	685c1afdcf	Update CONTRIBUTING.md (#21606 ) - Enforce a limit of three open PRs per community contributor - Clarify AI content policy - Misc rewording	2026-03-06 16:32:19 +01:00
Martin Hauser	d62a0d7d8d	fix(extras): Add missing COOKIES and method to NetBoxFakeRequest Populate COOKIES dict and set method to POST in runscript command's NetBoxFakeRequest. Ensures the fake request object more closely mimics a real Django request, preventing potential issues with code expecting these attributes. Fixes #21486	2026-03-06 09:52:26 -05:00
bctiemann	1c527366c9	Merge pull request #21597 from netbox-community/21012-interface-vlans-list Fixes #21012: Ensure all tagged VLANs assigned to an interface are listed under the interface detail UI view	2026-03-06 09:18:33 -05:00
Jeremy Stretch	e1684fb645	Display the interface's untagged VLAN in the attributes table	2026-03-06 07:37:46 -05:00
Jeremy Stretch	969ae81574	Fixes #21380 : Fix display of the background workers list on small screens (#21598 ) Wrap the table in a `.table-responsive` to enable horizontal scrolling within the table body.	2026-03-06 07:45:01 +01:00
github-actions	baec71fcaf	Update source translation strings	2026-03-06 05:17:32 +00:00
Jeremy Stretch	44abeeff5a	Fixes #21012 : Ensure all tagged VLANs assigned to an interface are listed under the interface detail UI view	2026-03-05 16:35:31 -05:00
Martin Hauser	93e01d5b07	fix(dcim): Correct object type for child Site Group actions Replace `dcim.Region` with `dcim.SiteGroup` in child Site Group actions for the DCIM view. Ensures the correct model is referenced when adding child Site Groups, improving functionality and aligning with the expected behavior. Fixes #21586	2026-03-05 13:59:18 -05:00
Arthur	6dd246acb7	cleanup	2026-03-04 13:47:19 -08:00
Arthur	5c4b1550e2	cleanup	2026-03-04 13:35:57 -08:00
Arthur	b0100a062c	fix subtitle block	2026-03-04 13:31:44 -08:00
Arthur	4c9dd25c20	add missing templates	2026-03-04 12:39:01 -08:00
Arthur	a0642aed94	cleanup	2026-03-04 12:29:26 -08:00
Arthur	68a6e2569e	cleanup	2026-03-04 10:56:26 -08:00
Arthur	810bb56776	fixes - update names and column layout	2026-03-04 10:46:30 -08:00
Arthur	5ae503428a	21566 migrate Users object to declarative layouts	2026-03-03 15:40:32 -08:00
Arthur	55c2e59241	21566 migrate Users object to declarative layouts	2026-03-03 15:17:43 -08:00
				`@@ -0,0 +1 @@`
				`{% load helpers %}{% if spec == 'date' %}{{ value\|isodate }}{% else %}{{ value\|isodatetime:spec }}{% endif %}`
				`@@ -0,0 +1 @@`
				`{% load helpers %}{{ object.get_full_name\|placeholder }}`