inventree/InvenTree
2
0 Fork 0
mirror of https://github.com/inventree/InvenTree.git synced 2026-11-10 10:57:52 +00:00
Code Activity
18,490 Commits 7 Branches 182 Tags
315b5bd134e3942f4a5b446d8ee4a6ee90ec8ff9
Commit Graph
18490 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Matthias Mair 315b5bd134 Merge commit from fork 
* remove mfa disableing on the token flow

* also check for mfa in token issuance
 2026-11-03 20:26:16 +11:00
Matthias Mair 4121d9a8a5 Merge commit from fork 
* fix basic auth without mfa

* refactor order to use new basic auth class

* remove session auth taht would bybpass mfa (mfa thing fixed in another session)

* allign with other PRs

prep for merge with https://github.com/inventree/InvenTree/pull/13169/

* fix schema generation
 2026-11-03 20:23:32 +11:00
Matthias Mair 16fa2ee5cd Merge commit from fork 
* fix oauth scopes

* fix typing
 2026-11-03 20:20:10 +11:00
Oliver 62d363a99d [UI] Context details for plugin actions (#13172) 
* [UI] Context details for plugin actions

Adds additional target instance context when registering custom UI actions

* Add CHANGELOG entry

* Improve test
 2026-11-03 17:22:26 +11:00
Oliver 461186bee9 [UI] Launch forms directly from plugin (#13174) 
* [UI] Launch forms directly from plugin

Provide ability for plugins to dynamically launch modal forms, without specifying the underlying react components.

This allows (for example) a primary action on a detail page to launch a new native API form

* Add CHANGELOG entry
 2026-11-03 16:41:33 +11:00
Oliver ad723c15e4 Update frontend plugin lib (#13173) 
* Update frontend plugin lib

* Bump package.json version
 2026-11-03 15:37:53 +11:00
Oliver c3948f56ed Implement stock adjust barcode actions (#13170) 2026-11-03 12:03:33 +11:00
Oliver c9ba1169f4 [UI] Copy error button (#13168) 
Adds button to copy UI error information
 2026-11-03 10:36:54 +11:00
Oliver 2310b54e26 [UI] Handle duplicate cameras (#13167) 
Fixes https://github.com/inventree/InvenTree/issues/13164
 2026-11-03 10:33:48 +11:00
Oliver bc8c1aefa2 CustomUnit fixes (#13161) 
* CustomUnit fixes

- Require staff access for data import
- Prevent overload of built-in units

* fix unit tests
 2026-11-03 09:16:08 +11:00
Oliver 2629cde722 Data Import Fixes (#13162) 
- Improved validation of data import session
- Handle FieldError if incorrect filter field is provided
- Prevent model traversal via import session filtering
- Added regression tests
 2026-11-02 20:41:47 +11:00
Oliver b4cdbf3d07 [UI] Improved notification links (#13159) 
Handle internal notification links which are stored as a fully qualified URL. These can now be routed internally rather than reloading the whole page
 2026-11-02 14:47:24 +11:00
github-actions[bot] dcec25f777 New Crowdin translations by GitHub Action (#13127) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-11-02 14:00:49 +11:00
Oliver 4fb0226ecc [bug] Settings fix (#13156) 
* Fix error when generating default settings

- Prevent database error on conflicting rows
- Can be caused by concurrent user requests

* ignore conflicts for TipResult
 2026-11-02 12:09:09 +11:00
dependabot[bot]andMatthias Mair 84fa789caf chore(deps): bump python from 3.14.8-slim-trixie to 3.14.10-slim-trixie in /contrib/container (#13124) 
* chore(deps): bump python in /contrib/container

Bumps python from 3.14.8-slim-trixie to 3.15.0-slim-trixie.

---
updated-dependencies:
- dependency-name: python
  dependency-version: 3.15.0-slim-trixie
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Update Dockerfile

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Matthias Mair <code@mjmair.com>
 2026-11-02 10:43:29 +11:00
Oliver 1b8bdad061 Token improvements (#13155) 
- More secure masking of tokens
- Fix lowercase bug
- Use consistent date checking
 2026-11-02 10:33:19 +11:00
dependabot[bot]andMatthias Mair 61a2c2af5f chore(deps): bump pypdf from 6.21.2 to 6.21.4 in /src/backend (#13144) 
* chore(deps): bump pypdf from 6.21.2 to 6.21.4 in /src/backend

Bumps [pypdf](https://github.com/py-pdf/pypdf) from 6.21.2 to 6.21.4.
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](https://github.com/py-pdf/pypdf/compare/6.21.2...6.21.4)

---
updated-dependencies:
- dependency-name: pypdf
  dependency-version: 6.21.4
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix style

* also bump pyasn1

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Matthias Mair <code@mjmair.com>
 2026-11-02 07:08:21 +11:00
Oliver 9bb7d23f80 Logout user when deleting UserSession (#13145) 2026-11-02 07:07:54 +11:00
Oliver b5cfd9528e Fix for revoking token (#13149) 
- Do not revoke if already revoked
- Prevents overwrite of previous revoking information
 2026-11-02 07:07:24 +11:00
Oliver f12d7f88a7 Fix for token issue message (#13150) 
Fix for translated strings
 2026-11-02 07:06:52 +11:00
Oliver 04c1a73697 Check if user is active when checking token (#13148) 
* Check if user is active when checking token

* Ensure token rejection logs a warning
 2026-11-02 07:06:27 +11:00
Oliver 581fef33bc Add playwright test for MFA login flow (#13146) 2026-11-01 22:26:26 +11:00
Matthias Mair f36321a918 add state transtion graph export (#13136) 2026-11-01 20:43:27 +11:00
dependabot[bot] c1cd45fd83 chore(deps): bump follow-redirects in /src/frontend (#13143) 
Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.16.1 to 1.16.2.
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.16.1...v1.16.2)

---
updated-dependencies:
- dependency-name: follow-redirects
  dependency-version: 1.16.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-11-01 17:48:30 +11:00
Matthias Mair df7f9521d7 feat: add notification on token issuance (#13141) 
* add notification on token issuance

* add entries

* fix link url

* increate test timing

* ignore fallback line

* add test for notification
 2026-11-01 14:08:58 +11:00
dependabot[bot]andMatthias Mair daa1c304f4 chore(deps): bump the dependencies group across 2 directories with 21 updates (#13142) 
* chore(deps): bump the dependencies group across 2 directories with 21 updates

Bumps the dependencies group with 2 updates in the /contrib/dev_reqs directory: [jc](https://github.com/kellyjonbrazil/jc) and [pip](https://github.com/pypa/pip).
Bumps the dependencies group with 19 updates in the /src/backend directory:

| Package | From | To |
| --- | --- | --- |
| [asgiref](https://github.com/django/asgiref) | `3.12.1` | `3.13.0` |
| [blessed](https://github.com/jquast/blessed) | `1.51.0` | `1.52.0` |
| [boto3](https://github.com/boto/boto3) | `1.43.114` | `1.43.118` |
| [botocore](https://github.com/boto/botocore) | `1.43.114` | `1.43.118` |
| [django-dbbackup](https://github.com/Archmonger/django-dbbackup) | `5.3.1` | `5.4.0` |
| [django-mptt](https://github.com/django-mptt/django-mptt) | `0.19.1` | `0.20.0` |
| [django-structlog](https://github.com/jrobichaud/django-structlog) | `10.1.0` | `11.0.0` |
| [dulwich](https://github.com/dulwich/dulwich) | `1.2.17` | `1.2.19` |
| [googleapis-common-protos](https://github.com/googleapis/google-cloud-python) | `1.75.5` | `1.76.0` |
| [grpcio](https://github.com/grpc/grpc) | `1.84.0` | `1.84.1` |
| [markdown](https://github.com/Python-Markdown/markdown) | `3.11.1` | `3.11.2` |
| [pint](https://github.com/hgrecco/pint) | `0.26.1` | `0.26.2` |
| [pycparser](https://github.com/eliben/pycparser) | `3.11` | `3.12` |
| [python-dateutil](https://github.com/dateutil/dateutil) | `2.9.0.post0` | `3.0.0` |
| [s3transfer](https://github.com/boto/s3transfer) | `0.19.2` | `0.19.3` |
| [sentry-sdk](https://github.com/getsentry/sentry-python) | `2.72.0` | `2.73.0` |
| [wcwidth](https://github.com/jquast/wcwidth) | `0.9.2` | `0.9.4` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.16.2` | `7.17.0` |
| [prek](https://github.com/j178/prek) | `0.5.6` | `0.5.7` |



Updates `jc` from 1.26.0 to 1.26.1
- [Release notes](https://github.com/kellyjonbrazil/jc/releases)
- [Changelog](https://github.com/kellyjonbrazil/jc/blob/master/CHANGELOG)
- [Commits](https://github.com/kellyjonbrazil/jc/compare/v1.26.0...v1.26.1)

Updates `pip` from 26.2.1 to 
- [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst)
- [Commits](https://github.com/pypa/pip/commits)

Updates `pip` from 26.2.1 to 
- [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst)
- [Commits](https://github.com/pypa/pip/commits)

Updates `asgiref` from 3.12.1 to 3.13.0
- [Changelog](https://github.com/django/asgiref/blob/main/CHANGELOG.txt)
- [Commits](https://github.com/django/asgiref/compare/3.12.1...3.13.0)

Updates `blessed` from 1.51.0 to 1.52.0
- [Release notes](https://github.com/jquast/blessed/releases)
- [Changelog](https://github.com/jquast/blessed/blob/master/docs/history.rst)
- [Commits](https://github.com/jquast/blessed/compare/1.51...1.52)

Updates `boto3` from 1.43.114 to 1.43.118
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.43.114...1.43.118)

Updates `botocore` from 1.43.114 to 1.43.118
- [Commits](https://github.com/boto/botocore/compare/1.43.114...1.43.118)

Updates `django-dbbackup` from 5.3.1 to 5.4.0
- [Release notes](https://github.com/Archmonger/django-dbbackup/releases)
- [Changelog](https://github.com/Archmonger/django-dbbackup/blob/master/CHANGELOG.md)
- [Commits](https://github.com/Archmonger/django-dbbackup/compare/5.3.1...5.4.0)

Updates `django-mptt` from 0.19.1 to 0.20.0
- [Changelog](https://github.com/django-mptt/django-mptt/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/django-mptt/django-mptt/compare/0.19.1...0.20)

Updates `django-structlog` from 10.1.0 to 11.0.0
- [Changelog](https://github.com/jrobichaud/django-structlog/blob/main/docs/changelog.rst)
- [Commits](https://github.com/jrobichaud/django-structlog/compare/10.1.0...11.0.0)

Updates `dulwich` from 1.2.17 to 1.2.19
- [Release notes](https://github.com/dulwich/dulwich/releases)
- [Changelog](https://github.com/jelmer/dulwich/blob/main/NEWS)
- [Commits](https://github.com/dulwich/dulwich/compare/dulwich-1.2.17...dulwich-1.2.19)

Updates `googleapis-common-protos` from 1.75.5 to 1.76.0
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-python/compare/googleapis-common-protos-v1.75.5...googleapis-common-protos-v1.76.0)

Updates `grpcio` from 1.84.0 to 1.84.1
- [Release notes](https://github.com/grpc/grpc/releases)
- [Commits](https://github.com/grpc/grpc/compare/v1.84.0...v1.84.1)

Updates `markdown` from 3.11.1 to 3.11.2
- [Release notes](https://github.com/Python-Markdown/markdown/releases)
- [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md)
- [Commits](https://github.com/Python-Markdown/markdown/compare/3.11.1...3.11.2)

Updates `pint` from 0.26.1 to 0.26.2
- [Changelog](https://github.com/hgrecco/pint/blob/master/CHANGES)
- [Commits](https://github.com/hgrecco/pint/compare/0.26.1...0.26.2)

Updates `pycparser` from 3.11 to 3.12
- [Release notes](https://github.com/eliben/pycparser/releases)
- [Commits](https://github.com/eliben/pycparser/compare/release_v3.11...release_v3.12)

Updates `python-dateutil` from 2.9.0.post0 to 3.0.0
- [Release notes](https://github.com/dateutil/dateutil/releases)
- [Changelog](https://github.com/dateutil/dateutil/blob/master/NEWS)
- [Commits](https://github.com/dateutil/dateutil/compare/2.9.0.post0...3.0.0)

Updates `s3transfer` from 0.19.2 to 0.19.3
- [Changelog](https://github.com/boto/s3transfer/blob/develop/CHANGELOG.rst)
- [Commits](https://github.com/boto/s3transfer/compare/0.19.2...0.19.3)

Updates `sentry-sdk` from 2.72.0 to 2.73.0
- [Release notes](https://github.com/getsentry/sentry-python/releases)
- [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md)
- [Commits](https://github.com/getsentry/sentry-python/compare/2.72.0...2.73.0)

Updates `wcwidth` from 0.9.2 to 0.9.4
- [Release notes](https://github.com/jquast/wcwidth/releases)
- [Changelog](https://github.com/jquast/wcwidth/blob/master/docs/history.rst)
- [Commits](https://github.com/jquast/wcwidth/compare/0.9.2...0.9.4)

Updates `coverage` from 7.16.2 to 7.17.0
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](https://github.com/coveragepy/coveragepy/compare/7.16.2...7.17.0)

Updates `prek` from 0.5.6 to 0.5.7
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/main/CHANGELOG.md)
- [Commits](https://github.com/j178/prek/compare/v0.5.6...v0.5.7)

---
updated-dependencies:
- dependency-name: jc
  dependency-version: 1.26.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: pip
  dependency-version:
  dependency-type: direct:production
  dependency-group: dependencies
- dependency-name: pip
  dependency-version:
  dependency-type: direct:production
  dependency-group: dependencies
- dependency-name: asgiref
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: blessed
  dependency-version: 1.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: boto3
  dependency-version: 1.43.118
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: botocore
  dependency-version: 1.43.118
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: django-dbbackup
  dependency-version: 5.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: django-mptt
  dependency-version: 0.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: django-structlog
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: dulwich
  dependency-version: 1.2.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: googleapis-common-protos
  dependency-version: 1.76.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: grpcio
  dependency-version: 1.84.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: markdown
  dependency-version: 3.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: pint
  dependency-version: 0.26.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: pycparser
  dependency-version: '3.12'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: python-dateutil
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: s3transfer
  dependency-version: 0.19.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: sentry-sdk
  dependency-version: 2.73.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: wcwidth
  dependency-version: 0.9.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: coverage
  dependency-version: 7.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: prek
  dependency-version: 0.5.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix style

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Matthias Mair <code@mjmair.com>
 2026-11-01 14:04:39 +11:00
Matthias Mair b2c2f926e7 Fix doc links / setup (#13140) 
* fix various doc links

* update generated start page

* switch to properdocs

* bump deps

* pin mkdocs before 2.0 so deps dont break

* fix link
 2026-11-01 08:34:25 +11:00
Oliver d96174cddb [bug] better handling of empty values for audit log (#13134) 
* [bug] better handling of empty values for audit log

* reverse unrelated commits
 2026-10-30 14:43:12 +11:00
Oliver e6bc21b66f [UI] Link fixing (#13117) 
* Use <Link> in navbar

* Use <Link> in PanelGroup

* <Link> in main navigation menu

* Update Breadcrumbs

* Refactor search drawer results

* Update NavigationTree and SearchDrawer

* Fix Link elements for dashboard widgets

* Adjust login helpers for playwright

* update playwright tests
 2026-10-30 10:17:51 +11:00
Oliver a0540d3185 Reduce verbosity of migration output (#13130) 2026-10-30 08:15:43 +11:00
Oliver 1dc2419652 [UI] Part description in build table (#13129) 
* Add "part description" column to build table

* Add part description on build detail page
 2026-10-29 13:15:08 +11:00
Oliver c5253560e8 [UI] Add "on_order" column to SupplierPartTable (#13128) 
* [UI] Add "on_order" column to SupplierPartTable

* Add 'on_order' filter for SupplierPart

* Update table

* Fix PR ref
 2026-10-29 10:41:09 +11:00
dependabot[bot]andMatthias Mair f9a73273f6 chore(deps): bump follow-redirects in /src/frontend (#13051) 
Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.16.0 to 1.16.1.
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.16.0...v1.16.1)

---
updated-dependencies:
- dependency-name: follow-redirects
  dependency-version: 1.16.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Matthias Mair <code@mjmair.com>
 2026-10-29 08:26:58 +11:00
dependabot[bot] f0db87f0f2 chore(deps): bump the dependencies group with 5 updates (#13126) 
Bumps the dependencies group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/setup-python](https://github.com/actions/setup-python) | `7.0.0` | `7.1.0` |
| [j178/prek-action](https://github.com/j178/prek-action) | `3.0.1` | `3.1.0` |
| [oasdiff/oasdiff-action/diff](https://github.com/oasdiff/oasdiff-action) | `0.1.18` | `0.1.20` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.39.0` | `4.39.1` |
| [crowdin/github-action](https://github.com/crowdin/github-action) | `3.4.0` | `3.5.0` |


Updates `actions/setup-python` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/5fda3b95a4ea91299a34e894583c3862153e4b97...6d4fd22b20465ccc0f7354476588e8df7c9ca0e0)

Updates `j178/prek-action` from 3.0.1 to 3.1.0
- [Release notes](https://github.com/j178/prek-action/releases)
- [Commits](https://github.com/j178/prek-action/compare/1382ad72dea72f9d53832f2bcb65b3e87a947204...44924fe9ef4a6f88253c4b6b1bf11c689d3ce53d)

Updates `oasdiff/oasdiff-action/diff` from 0.1.18 to 0.1.20
- [Release notes](https://github.com/oasdiff/oasdiff-action/releases)
- [Commits](https://github.com/oasdiff/oasdiff-action/compare/b9325c9e0a27ab65b0da3b766522cedec6be81dc...9ce3a29eb0e6478dd0140932a678c7fb59d08f22)

Updates `github/codeql-action/upload-sarif` from 4.39.0 to 4.39.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee...9b3254085494b55a0f7c4c2b3d2d52cc712ce370)

Updates `crowdin/github-action` from 3.4.0 to 3.5.0
- [Release notes](https://github.com/crowdin/github-action/releases)
- [Commits](https://github.com/crowdin/github-action/compare/72955432d4aa4f6dd64cf17eeb88dd34d6ba064c...959dc74ac104447731cba99a016f85d0ae719788)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: j178/prek-action
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: oasdiff/oasdiff-action/diff
  dependency-version: 0.1.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.39.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: crowdin/github-action
  dependency-version: 3.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-29 08:26:26 +11:00
マサハル電機andTSUBASA 86b6c5fbfc fix(frontend): ignore Enter during IME composition (#13122) 
Co-authored-by: TSUBASA <246341638+highvoltagescientist-arch@users.noreply.github.com>
 2026-10-28 20:40:40 +11:00
github-actions[bot] eb84f0eb1e New Crowdin translations by GitHub Action (#13106) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-10-28 18:48:13 +11:00
Oliver c1683db714 Consumable fix (#13120) 
* Disable "consumable" attribute on PartDetail page

* Update playwright tests
 2026-10-28 14:54:28 +11:00
Oliver 60db8a924e Updates for AutoCreateBuildPlugin (#13118) 2026-10-28 10:42:44 +11:00
OliverandCopilot Autofix powered by AI 3e55d413ec [report] Harden data access for reports (#13111) 
* [report] Harden data access for reports

- Exclude sensitive data
- Prevent database writes during report generation

* Fix typo

* Add regression test against model traversal

* Add webhook endpoint and message to imports

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Remove some models from BLOCKED_MODELS

* Revert READ_ONLY requirement

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-10-28 01:06:45 +11:00
dependabot[bot]andOliver 4f80cda960 chore(deps): bump @fullcalendar/react (#13088) 
Bumps the dependencies group with 1 update in the /src/frontend directory: [@fullcalendar/react](https://github.com/fullcalendar/fullcalendar/tree/HEAD/packages/react).


Updates `@fullcalendar/react` from 6.1.21 to 6.1.22
- [Release notes](https://github.com/fullcalendar/fullcalendar/releases)
- [Changelog](https://github.com/fullcalendar/fullcalendar/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fullcalendar/fullcalendar/commits/v6.1.22/packages/react)

---
updated-dependencies:
- dependency-name: "@fullcalendar/react"
  dependency-version: 6.1.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Oliver <oliver.henry.walters@gmail.com>
 2026-10-27 17:58:47 +11:00
Oliver 7c03b6fcf2 Frontend coverage (#13114) 
* Shipment row actions

* Test return order parametric view

* SalesOrderLineItem actions

* sales order parametric view

* playwright tests for sales order allocations
 2026-10-27 16:45:43 +11:00
Oliver c4280c2a03 [Refactor] Stock tracking audit (#13101) 
* Add "event_type" and "notes" support to AuditLog model

* Register history entries for stock items

* record stock edited events as normal updates

* Remove legacy tracking entry generation code

* Updated unit tests for all stock event types

* remove legacy endpoints

* remove legacy tables from UI

* Updated docs

* Data migration

* Remove old models

* Update docs

* Updated playwright tests

* Fix broken links

* Update CHANGELOG.md

* Cache CID value

* Fix migration tests

* Increase query threshold for unit test

* Fix bug and add regression test

* mark migration as one-way

* flush events in the correct order

* improve prefetch

* Adjust row rendering
 2026-10-27 15:14:15 +11:00
Matthias Mair 2ee5764b3b fix various sec warnings (#13108) 2026-10-27 14:41:28 +11:00
Oliver 6c65d96ece Export escape fix (#13110) 
* Allow numeric values to be exported unescapted

* Updated docs

* Explicit regression tests
 2026-10-27 11:55:24 +11:00
dependabot[bot]andMatthias Mair 8075ef58d9 chore(deps): bump the dependencies group across 1 directory with 10 updates (#13105) 
* chore(deps): bump the dependencies group across 1 directory with 10 updates

Bumps the dependencies group with 10 updates in the /src/backend directory:

| Package | From | To |
| --- | --- | --- |
| [blessed](https://github.com/jquast/blessed) | `1.50.0` | `1.51.0` |
| [boto3](https://github.com/boto/boto3) | `1.43.113` | `1.43.114` |
| [botocore](https://github.com/boto/botocore) | `1.43.113` | `1.43.114` |
| [django-money](https://github.com/django-money/django-money) | `3.6.1` | `3.6.2` |
| [django-mptt](https://github.com/django-mptt/django-mptt) | `0.18.0` | `0.19.1` |
| [fonttools](https://github.com/fonttools/fonttools) | `4.66.1` | `4.67.0` |
| [paramiko](https://github.com/paramiko/paramiko) | `5.0.0` | `5.1.0` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.13.0` | `4.13.5` |
| [pluggy](https://github.com/pytest-dev/pluggy) | `1.6.0` | `1.7.0` |
| [prek](https://github.com/j178/prek) | `0.5.5` | `0.5.6` |



Updates `blessed` from 1.50.0 to 1.51.0
- [Release notes](https://github.com/jquast/blessed/releases)
- [Changelog](https://github.com/jquast/blessed/blob/master/docs/history.rst)
- [Commits](https://github.com/jquast/blessed/compare/1.50...1.51)

Updates `boto3` from 1.43.113 to 1.43.114
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.43.113...1.43.114)

Updates `botocore` from 1.43.113 to 1.43.114
- [Commits](https://github.com/boto/botocore/compare/1.43.113...1.43.114)

Updates `django-money` from 3.6.1 to 3.6.2
- [Release notes](https://github.com/django-money/django-money/releases)
- [Changelog](https://github.com/django-money/django-money/blob/main/docs/changes.rst)
- [Commits](https://github.com/django-money/django-money/commits)

Updates `django-mptt` from 0.18.0 to 0.19.1
- [Changelog](https://github.com/django-mptt/django-mptt/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/django-mptt/django-mptt/compare/0.18...0.19.1)

Updates `fonttools` from 4.66.1 to 4.67.0
- [Release notes](https://github.com/fonttools/fonttools/releases)
- [Changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst)
- [Commits](https://github.com/fonttools/fonttools/compare/4.66.1...4.67.0)

Updates `paramiko` from 5.0.0 to 5.1.0
- [Commits](https://github.com/paramiko/paramiko/compare/5.0.0...5.1.0)

Updates `platformdirs` from 4.13.0 to 4.13.5
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](https://github.com/tox-dev/platformdirs/compare/4.13.0...4.13.5)

Updates `pluggy` from 1.6.0 to 1.7.0
- [Changelog](https://github.com/pytest-dev/pluggy/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pytest-dev/pluggy/compare/1.6.0...1.7.0)

Updates `prek` from 0.5.5 to 0.5.6
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/main/CHANGELOG.md)
- [Commits](https://github.com/j178/prek/compare/v0.5.5...v0.5.6)

---
updated-dependencies:
- dependency-name: blessed
  dependency-version: 1.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: boto3
  dependency-version: 1.43.114
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: botocore
  dependency-version: 1.43.114
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: django-money
  dependency-version: 3.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: django-mptt
  dependency-version: 0.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: fonttools
  dependency-version: 4.67.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: paramiko
  dependency-version: 5.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: platformdirs
  dependency-version: 4.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: pluggy
  dependency-version: 1.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: prek
  dependency-version: 0.5.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix style

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Matthias Mair <code@mjmair.com>
 2026-10-27 11:34:06 +11:00
Miklós MártonandOliver dbffb960f7 Select default location for new stock items if it is set for a part (#12916) 
* Select default location for new stock items in the case if it is set for a part

Fixes #12304

* Add playwright test to check that the part's default stock location has
precedence on the category's default stock location

* Rename test cases for clarity in pui_forms.spec.ts

* Adjust formatting

---------

Co-authored-by: Oliver <oliver.henry.walters@gmail.com>
 2026-10-26 22:58:45 +11:00
dependabot[bot]andOliver Walters f05b8b44e4 chore(deps): bump brotli from 1.2.0 to 1.2.1 in /src/backend (#13092) 
* chore(deps): bump brotli from 1.2.0 to 1.2.1 in /src/backend

Bumps [brotli](https://github.com/google/brotli) from 1.2.0 to 1.2.1.
- [Release notes](https://github.com/google/brotli/releases)
- [Changelog](https://github.com/google/brotli/blob/go/brotli/v1.2.1/CHANGELOG.md)
- [Commits](https://github.com/google/brotli/compare/v1.2.0...go/brotli/v1.2.1)

---
updated-dependencies:
- dependency-name: brotli
  dependency-version: 1.2.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* Update requirements.txt

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Oliver Walters <oliver.henry.walters@gmail.com>
 2026-10-26 22:48:19 +11:00
github-actions[bot] f61e6d79b3 New Crowdin translations by GitHub Action (#13095) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-10-26 17:59:43 +11:00
Oren 6d0ae8dfb5 fix(frontend): hide news widget from default dashboard for non-superusers (#13099) 
defaultLayouts only places the news widget for superusers, but
defaultWidgets always included it, so non-superusers saw a
"Requires Superuser" alert on a fresh dashboard.
 2026-10-26 14:15:38 +11:00
Oren bab82bf808 fix(backend): reject duplicate email when creating a user via the API (#13100) 
UserCreateSerializer did not check whether the email address was
already in use (signup does, via allauth). Email based flows such as
the login link look users up by email and silently send nothing when
more than one user matches, while the API still reports success.

Two existing tests reused one email for several users; give them
distinct addresses.
 2026-10-26 11:28:40 +11:00