The following Bash commands will ensure that you continue receiving updates from the new package repository configuration. The update procedure, package structure and general commands are unchanged.

Upgrade Instructions

Command for Ubuntu 26.04

sudo curl -fsSL "https://go.packager.io/srv/deb/inventree/InvenTree/gpg-key.gpg" -o /usr/share/keyrings/InvenTree.gpg
sudo curl -fsSL "https://go.packager.io/srv/inventree/InvenTree/stable/installer/ubuntu/26.04.list" -o /etc/apt/sources.list.d/InvenTree.list
sudo apt update
sudo apt install -y inventree

Command for Ubuntu 24.04

sudo curl -fsSL "https://go.packager.io/srv/deb/inventree/InvenTree/gpg-key.gpg" -o /usr/share/keyrings/InvenTree.gpg
sudo curl -fsSL "https://go.packager.io/srv/inventree/InvenTree/stable/installer/ubuntu/24.04.list" -o /etc/apt/sources.list.d/InvenTree.list
sudo apt update
sudo apt install -y inventree

Command for Debian 13

sudo curl -fsSL "https://go.packager.io/srv/deb/inventree/InvenTree/gpg-key.gpg" -o /usr/share/keyrings/InvenTree.gpg
sudo curl -fsSL "https://go.packager.io/srv/inventree/InvenTree/beta/installer/debian/13.list" -o /etc/apt/sources.list.d/InvenTree.list
sudo apt update
sudo apt install -y inventree

Supported OS versions - you might need to upgrade

We are phasing out versions of Ubuntu and Debian that are at, or approaching, end of support, particularly as Python 3.11 has only one year until EOL.

If you are on Ubuntu 20.04 (LTS) - which many of the old Docker droplet deployments were on - it is strongly recommended to update to 26.04 (LTS) to continue receiving updates. This will likely also require you to update your postgres version to at least 14, recommended is 17 or 18. Note that postgres updates should be done in single version steps (13 -> 14 -> 15 -> 16 -> 17 -> 18) or with pgupgrade.
The volunteer InvenTree core team does not have the resources to assist with individual upgrades.

Additional Notes on OS version selections

As of InvenTree version 1.5.3, the supported versions are Debian 13 and Ubuntu 24.04 / 26.04 LTS. This is mainly because Bookworm is the only supported Debian release shipping Python 3.11 (as does Ubuntu 22.04).

As Python 3.11 has received only security updates since 2024 and will reach EOL in October 2027, the libraries on which we depend have increasingly announced that they will soon end support for it. Although most still support it, this is likely to change. Therefore, we are raising the minimum versions in advance so that we are not caught off guard by dependency issues that require urgent releases.

Python 3.12 also has some nice QoL features that developers using Python 3.14 (myself included) can forget are relatively new. It also drops distutils and a few importlib functions. Raising the minimum versions allows us to drop shims and use these newer features.

Acknowledgements

We are very thankful to Cyril Rohr for packager.io and the support provided on various issues and questions throughout the years. We are not switching away from his solutions, but using the newer version, go.packager.io, as the old one is being sunset in the near future.

Changelog

Major changes are documented in the CHANGELOG.md file in the repository. For a full list of changes, please refer to the release notes.

Update Procedure

To update to the latest version of InvenTree, please follow the updating instructions provided in the InvenTree documentation. Note that the particular update procedure may vary depending on your installation method.

Breaking Changes

While we strive to maintain backward compatibility, there are some breaking changes in this release. While many of these are minor, and should not affect most users, we recommend that you review the list of breaking changes to ensure that your installation will continue to function as expected after the update. Each breaking change is documented in detail at the links below:

API Throttling Enabled by Default

PR #11951 enables API request throttling by default, providing a first line of defense against trivial denial-of-service abuse of API endpoints. The default limits are intentionally generous so as to minimize impact on most instances, but administrators of smaller or resource-constrained instances should review the new throttling configuration.

Bump Minimum Python Version

PR #12223 raises the minimum supported Python version to 3.12, and drops pre-built packages for Debian 11 and Ubuntu 22.04. Users running InvenTree on an older Python version, or on one of these older distributions, will need to upgrade their environment before installing this release.

Table Field Refactor

PR #12274 rewrites how “table” fields are rendered in UI forms, fixing a number of performance issues where rows were needlessly re-created on every update. As part of this refactor, each row now requires a unique ID value. Any custom plugins that use “table” field types in UI forms will need to be adjusted to match the new configuration.

Refactor API for Duplicating Objects

PR #12294 consolidates the various object-duplication endpoints behind a single DuplicateOptionsSerializer, and extends duplication support to additional models (including the ability to copy notes). Integrations which rely on the previous per-model duplication endpoints should be reviewed against the new consolidated API.

Adjust Default Behavior of “migrate” Command

PR #12320 changes the default behavior of the invoke update command so that it no longer automatically generates new migration files when the database schema has changed. This prevents installations from ending up with out-of-line migration files that were not committed to the repository. Developers who rely on migrations being auto-generated during update will need to generate them explicitly.

Remove Dead Pricing Code on Part Model

PR #12357 removes a number of legacy pricing methods from the Part model, in preparation for a larger pricing refactor. While this does not affect any internally called code, any plugins relying on these legacy methods being available will need to be adjusted.

Remove MPTT Mixin from StockItem Model

PR #12360 removes the MPTT tree mixin from the StockItem model. The model never made real use of MPTT’s tree features, but paid the cost of expensive tree rebuilds and fragile concurrency locking on every bulk stock operation. Removing it reduces database load and eliminates a class of concurrency issues during bulk stock actions. External clients should note that the tree-related fields previously exposed on StockItem are no longer available via the API.

Optional Field Permissions

PR #12529 fixes a permission gap where “optional fields” exposing cross-model relations were returned regardless of whether the requesting user had permission to view the related model. These optional fields are now excluded from API responses if the user lacks view permission on the associated model, so integrations that depended on always receiving these fields may need to handle their absence.

Security Fixes

A number of security vulnerabilities have been fixed in this release.

Fix Permissions for Group and RuleSet Endpoints

PR #12563 tightens access to the group and RuleSet API endpoints, which previously only checked the is_staff flag. These endpoints now also require the user to hold the StaffRole permission, closing a gap that allowed staff users without the appropriate role to view or modify permission rulesets.

Additional SSRF Protections

PR #12595 further tightens the protections around fetching data from external URLs, reducing the risk of server-side request forgery (SSRF) when InvenTree makes outgoing requests on a user’s behalf.

Database Changes

This release includes a number of changes to the underlying database schema and data validation. As always, a backup of your database is recommended before performing the update.

Fix for UUID Fields

PR #12301 introduces a custom UUID field to work around a Django 5.0 change to UUIDField handling on MariaDB. This resolves migration issues that could occur when updating existing UUID columns on MariaDB-backed installations.

Fix Currency Choices for PartPricing Model

PR #12336 removes the dynamically-generated currency choices from the PartPricing model definition, moving that validation into the API serializer instead, along with a dedicated validator to ensure only supported currency codes can be assigned.

Unique Parameters

PR #12388 adds uniqueness validation options to the ParameterTemplate model, allowing administrators to enforce that values for a given parameter template must be unique across parts.

Data Import Fix

PR #12568 fixes an encoding issue that could occur when importing date values from Excel files during the data import process.

New Features

Tree Select in Form Fields

PR #12217 adds a hierarchical “tree select” control for choosing stock locations and part categories in UI forms, making it much easier to navigate deeply nested location and category structures when filling out a form.

Snippet Editor

PR #12299 adds a dedicated UI for managing report assets and snippets, making it easier to create and maintain reusable template fragments for report and label generation.

Form Submission Shortcut

PR #12328 adds a keyboard shortcut (Ctrl + Enter) to submit the currently open form, speeding up repetitive data-entry workflows.

Break Apart Assemblies

PR #12310 introduces a long-requested “disassembly” feature, allowing an assembly to be broken apart back into its constituent BOM items. The feature is supported for untracked, tracked (serialized), and mixed assemblies, and preserves the originating purchase order and build order history on the resulting stock items.

Preview Drawer

PR #12117 adds a global “preview drawer” which provides a quick-view of a part, stock item, order, or other object without navigating away from the current page. Preview rendering is available for all core models, and is also exposed to plugins so they can supply their own preview content.

Bug Fixes

As always, we have provided a number of bug fixes with this release. Thanks to the many community members who have contributed to identifying and resolving these issues!

Contributing

InvenTree is an open source project, and we welcome contributions from the community. There are many ways to contribute to the project, including code contributions, translation efforts, documentation improvements, and financial support.

New Contributors

As always we would like to thank all of our contributors for their hard work and dedication to the InvenTree project. In particular, we would like to welcome the following new contributors who have made their first contributions in this release:

• @suzunn made their first contribution in https://github.com/inventree/InvenTree/pull/12215
• @ledvinap made their first contribution in https://github.com/inventree/InvenTree/pull/12332
• @br413 made their first contribution in https://github.com/inventree/InvenTree/pull/12413
• @Leopoldius made their first contribution in https://github.com/inventree/InvenTree/pull/12424
• @aamirasmal15 made their first contribution in https://github.com/inventree/InvenTree/pull/12423
• @impuls42 made their first contribution in https://github.com/inventree/InvenTree/pull/12432
• @snipe made their first contribution in https://github.com/inventree/InvenTree/pull/12452
• @bhumin18 made their first contribution in https://github.com/inventree/InvenTree/pull/12440
• @hanielee made their first contribution in https://github.com/inventree/InvenTree/pull/12392
• @jayasree-007 made their first contribution in https://github.com/inventree/InvenTree/pull/12533

Code Contributions

Check out our GitHub page for a list of outstanding issues and feature requests. If you are a developer or want to become one, you can help to contribute to the project by submitting a pull request.

Translation

Our translation efforts continue to grow, with coverage increasing across a wide range of languages. We are grateful to all of our translators who have contributed to making InvenTree accessible to users around the world.

If you are interested in contributing to the translation efforts, please visit our Crowdin project and join the community of translators.

Documentation / Technical Writing

If you have experience with technical writing, you can help to improve the InvenTree documentation. We are always looking for help to improve the documentation and make it more accessible to new users.

Report Bugs

If you encounter a bug in InvenTree, please report it on our GitHub issues page. Please ensure that you provide as much information as possible to help us diagnose and fix the issue.

Financial Contributions

Sponsorships help to keep this project sustainable, and buys time for the core developers to commit to the project. A recurring or one off sponsorship is a great way to help InvenTree development to continue at full steam!

The work undertaken to keep InvenTree running is done by a very small group of core developers, who do so in their spare time (and are not sponsored by their employers to work on InvenTree). If you benefit from the InvenTree project, please consider contributing to maintain vibrant development of this software!

• GitHub

If you are using InvenTree in a commercial setting, please consider sponsoring the project to help support ongoing development and maintenance. Your support is greatly appreciated and helps to ensure that InvenTree remains a viable and sustainable project for years to come.

If your company benefits from InvenTree, please consider a one time sponsorship or a recurring sponsorship to help support the project.

Changelog

Major changes are documented in the CHANGELOG.md file in the repository. For a full list of changes, please refer to the release notes.

Update Procedure

To update to the latest version of InvenTree, please follow the updating instructions provided in the InvenTree documentation. Note that the particular update procedure may vary depending on your installation method.

Breaking Changes

While we strive to maintain backward compatibility, there are some breaking changes in this release. While many of these are minor, and should not affect most users, we recommend that you review the list of breaking changes to ensure that your installation will continue to function as expected after the update. Each breaking change is documented in detail at the links below:

Adjust API Endpoint Status Code Return Values

PR #11723 removes various API quirks and aligns the InvenTree API with REST conventions: some operations have been moved to the correct HTTP methods (e.g. GET → POST), HTTP status codes now follow standard conventions rather than custom values, and custom permissions on the notifications endpoint have been removed. Users with custom API integrations should review their code for reliance on the previous non-standard behavior.

Enforce Order “issued_by” Field as Read-Only

PR #11816 makes the issued_by field on BuildOrder (and related order models) read-only in the API; it is now automatically populated with the user who created the order and can no longer be manually overridden. Any integrations or scripts that previously wrote to this field will need to be updated.

Node.js Build Environment Upgraded to v24

PR #11893 upgrades the frontend build environment from Node.js 20 (which reached end-of-life on April 30, 2025) to Node.js 24. Developers building InvenTree from source must upgrade their local Node.js installation to v24 or later.

Report and Label Plugin Context Changes

PR #11941 fixes a long-standing bug where user information was unavailable in report and label generation contexts. As part of this fix, the signatures for custom report plugin methods (add_report_context(), add_label_context(), and report_callback()) have changed: they now receive an explicit user object instead of a request object (which was previously always None in background workers). Plugin developers must update their implementations accordingly.

Remove Remote Image Download Support

PR #11962 removes the remote_image field from the Part API endpoint, eliminating the ability to supply a remote URL to download a part image from an external source. This feature was removed due to security concerns around server-side outgoing requests; image uploads via other mechanisms (such as clipboard paste) remain supported.

Fix Resistor RKM Notation Parsing

PR #12065 corrects how RKM-style resistor values (e.g. 10R, 4R7) are parsed by ensuring the R delimiter is interpreted as ohms rather than being misread by the unit parser. Parts or parameters that previously relied on the incorrect parsing behavior may need to be reviewed.

Fix Meaning of SHIPPED Status in SalesOrderStatusGroups

PR #12107 corrects a misclassification of the SHIPPED sales order status: it has been moved from the COMPLETE group to the ACTIVE group in SalesOrderStatusGroups. Any external code or integrations that filter orders based on these status groups will need to be updated to reflect this corrected grouping.

Report Printing Permission Enforcement

PR #12142 tightens permissions for report and label printing: users must now have VIEW permission on the target model in order to print a report against it, and printing against disabled templates is blocked. Users or integrations that previously relied on printing without explicit view permissions may find certain print actions now return a permission error.

Security Fixes

A number of security vulnerabilities have been fixed in this release.

Django Security Update

PR #11907 bumps Django to the latest security release, addressing vulnerability GHSA-5h8x-9c6f-2j8m. All users are encouraged to update promptly to benefit from this patch.

Admin Interface Permission Restrictions

PR #12036 tightens Django admin permissions to align with the API’s own access controls. Scheduled tasks are now read-only in the admin panel and certain actions are restricted to superusers only, reducing the risk of unauthorized modification of critical system configuration through the admin interface.

Report Printing Permission Enforcement

PR #12142 enforces that users must hold VIEW permission on the target model in order to print a report or label against it, and prevents printing against disabled templates. This closes a path by which users could access model data indirectly through the report printing API without the appropriate permissions.

Switch Node.js Version Manager from n to nvm

PR #12140 replaces the n Node.js version manager with nvm (Node Version Manager) in the Docker build and CI environment. Using the officially maintained nvm toolchain reduces supply-chain risk compared to the third-party n package.

PDF Report Generation Security Hardening

PR #12160 hardens the WeasyPrint-based PDF report generator against two classes of attack. The file:// URI scheme is now fully disabled in report templates, preventing arbitrary server-side file reads, and SSRF protections have been added for remote URL lookups — with remote URL fetching disabled by default. Users whose report templates reference remote URLs will need to explicitly enable that capability via the new configuration setting.

API Permissions Fix

PR #12168 improves API security by reducing the scope of permissions required for certain API endpoints.

Security Advisories

The following security advisories have been published in relation to this release:

• https://github.com/inventree/InvenTree/security/advisories/GHSA-45f6-v6jq-99f7
• https://github.com/inventree/InvenTree/security/advisories/GHSA-7w96-99fj-8g7x
• https://github.com/inventree/InvenTree/security/advisories/GHSA-568x-qh23-wh8g
• https://github.com/inventree/InvenTree/security/advisories/GHSA-xjpv-cwpw-7qx8
• https://github.com/inventree/InvenTree/security/advisories/GHSA-c9wp-mw98-gfrj
• https://github.com/inventree/InvenTree/security/advisories/GHSA-6pm3-m334-mr4j

For more information, please refer to our security advisories page

New Features

Transfer Orders

PR #11281 introduces a new Transfer Order type for formalizing and tracking internal stock movements between locations. Users can create transfer orders with specific source and destination locations, allocate stock to line items, and complete the transfer to move inventory — providing a full audit trail for inter-location stock movements.

BOM Permission Ruleset

PR #11825 adds a dedicated permission ruleset for Bill of Materials management, allowing administrators to control which user groups can view, edit, or modify BOMs independently of other part permissions. Existing user permissions are preserved via a data migration.

BOM Row Expand

PR #11809 enables multi-level BOM expansion in the UI, letting users expand individual BOM rows to inspect nested subassemblies inline without switching away from the BOM view. A user-level setting controls whether subassembly expansion is shown by default.

BOM Compare

PR #11853 adds a BOM comparison tool accessible from the part detail view, allowing side-by-side comparison of two assemblies’ Bills of Materials. Comparisons can also be linked to directly via URL parameters.

Maximum Stock Level

PR #11914 adds a maximum stock level field to parts, complementing the existing minimum stock tracking to provide full min/max inventory management. A new “high stock” filter in the part table makes it easy to identify items that have exceeded their upper limit.

Attachment Image Thumbnails

PR #11961 improves attachment handling by detecting image attachments and displaying thumbnail previews in the attachment table. This release also adds a configurable maximum file upload size for administrators.

Sales Order Auto-Allocate

PR #12000 brings automatic stock allocation to sales orders, matching the existing behavior on build orders. Users can auto-allocate available stock to order line items with configurable sorting preferences (e.g. by expiry date or serial number), and can bulk-delete allocations through the UI and API.

Stock Item Creation Date

PR #12011 adds a creation_date field to the StockItem model, capturing when each stock item first entered the system. The field is exposed in the API (with filtering and ordering support) and displayed in the stock item table.

Hot Module Replacement for Plugins

PR #12060 enables Hot Module Replacement (HMR) and React Fast Refresh in the Vite development server for InvenTree plugins. Plugin developers can now see code changes reflected instantly without a full page reload, significantly speeding up the plugin development workflow.

Tags Support

PR #12077 introduces a comprehensive tagging system across InvenTree, covering parts, orders, companies, stock items, and more. Tags can be managed via the API and used to filter tables, providing a flexible way to categorize and locate items without changing the data model.

Saved Table Filter Sets

PR #12079 allows users to save named sets of table filters and reload them with a single click. This is particularly useful for frequently repeated filter configurations across tables and calendar views.

Calendar Month Scrolling

PR #12092 enables multi-month scrolling in calendar views, making it much easier to plan and schedule across extended time horizons. A configurable “calendar horizon” parameter allows the view to be set back to a single month if preferred.

Table Column Filters

PR #12103 exposes filter controls directly in table column headers, so users can add, edit, or remove filters without opening a separate filter panel. Active filters are also indicated visually on the relevant column headers.

Remember Last Used Print Template and Printer

PR #12146 persists the user’s last selected label template and printer plugin per model type, so the printing dialog reopens with the same settings as the previous session. This eliminates the need to reselect template and printer on every print action.

Hotkey Helper Modal

PR #12128 adds a hotkey registration system and a discoverable helper modal that lists all currently active keyboard shortcuts — including those registered by plugins and mounted components. The modal is accessible via the spotlight interface, making it easy for users to find and learn available shortcuts.

Calendar Event Tooltips

PR #11980 adds detailed tooltips to calendar event entries across purchase order and build calendar views. Hovering over an event now shows contextual information without requiring the user to navigate away from the calendar.

Line Number Natural Sort

PR #11885 fixes the sorting of line numbers on orders so they sort numerically (1, 2, 3, 10) rather than alphabetically (1, 10, 2, 3). This improves the readability of order line items and ensures a more intuitive ordering.

Bug Fixes

As always, we have provided a number of bug fixes with this release. Thanks to the many community members who have contributed to identifying and resolving these issues!

Contributing

InvenTree is an open source project, and we welcome contributions from the community. There are many ways to contribute to the project, including code contributions, translation efforts, documentation improvements, and financial support.

New Contributors

As always we would like to thank all of our contributors for their hard work and dedication to the InvenTree project. In particular, we would like to welcome the following new contributors who have made their first contributions in this release:

• @hartigdan made their first contribution in https://github.com/inventree/InvenTree/pull/11735
• @ZhangzrJerry made their first contribution in https://github.com/inventree/InvenTree/pull/11746
• @DanielDango made their first contribution in https://github.com/inventree/InvenTree/pull/11868
• @robertsilen made their first contribution in https://github.com/inventree/InvenTree/pull/11950
• @Idea-Junkie made their first contribution in https://github.com/inventree/InvenTree/pull/11369
• @xhivo97 made their first contribution in https://github.com/inventree/InvenTree/pull/12060
• @getpwnam made their first contribution in https://github.com/inventree/InvenTree/pull/12078
• @NerosKi made their first contribution in https://github.com/inventree/InvenTree/pull/12094
• @Nasawa made their first contribution in https://github.com/inventree/InvenTree/pull/12151
• @Sanidhyavijay24 made their first contribution in https://github.com/inventree/InvenTree/pull/12146
• @kaizeenn made their first contribution in https://github.com/inventree/InvenTree/pull/12162
• @johnluetke made their first contribution in https://github.com/inventree/InvenTree/pull/11982
• @geekcj12 made their first contribution in https://github.com/inventree/InvenTree/pull/12203
• @aslushnikov made their first contribution in https://github.com/inventree/InvenTree/pull/12219
• @reid-p made their first contribution in https://github.com/inventree/InvenTree/pull/12227

Code Contributions

Check out our GitHub page for a list of outstanding issues and feature requests. If you are a developer or want to become one, you can help to contribute to the project by submitting a pull request.

Translation

Our translation efforts continue to grow, with coverage increasing across a wide range of languages. We are grateful to all of our translators who have contributed to making InvenTree accessible to users around the world.

If you are interested in contributing to the translation efforts, please visit our Crowdin project and join the community of translators.

Documentation / Technical Writing

If you have experience with technical writing, you can help to improve the InvenTree documentation. We are always looking for help to improve the documentation and make it more accessible to new users.

Report Bugs

If you encounter a bug in InvenTree, please report it on our GitHub issues page. Please ensure that you provide as much information as possible to help us diagnose and fix the issue.

Financial Contributions

Sponsorships help to keep this project sustainable, and buys time for the core developers to commit to the project. A recurring or one off sponsorship is a great way to help InvenTree development to continue at full steam!

The work undertaken to keep InvenTree running is done by a very small group of core developers, who do so in their spare time (and are not sponsored by their employers to work on InvenTree). If you benefit from the InvenTree project, please consider contributing to maintain vibrant development of this software!

• GitHub

If you are using InvenTree in a commercial setting, please consider sponsoring the project to help support ongoing development and maintenance. Your support is greatly appreciated and helps to ensure that InvenTree remains a viable and sustainable project for years to come.

If your company benefits from InvenTree, please consider a one time sponsorship or a recurring sponsorship to help support the project.

Changelog

Major changes are documented in the CHANGELOG.md file in the InvenTree repository.

For a full list of changes made in this release, please refer to the release notes.

Update Procedure

To update to the latest version of InvenTree, please follow the updating instructions provided in the InvenTree documentation. Note that the particular update procedure may vary depending on your installation method.

Breaking Changes

The following changes may require updates to custom plugins, API clients, or other integrations with the InvenTree application. Please review these changes carefully before updating to version 1.3.0.

Supplier Part Model Changes

In #11303 we have made a change to the implementation of the supplier part model. While this will not impact most InvenTree users, it may change how custom plugins or external API clients interact with the InvenTree application.

Previously, the Part model had a default_supplier field, which pointed to a single instance of the SupplierPart model. This field has been removed, and instead the SupplierPart model has a primary field - which is a boolean field indicating whether this supplier part is the primary supplier for the associated part. This change allows for more flexible supplier management.

Plugin Data Import

In #11648 we have added the ability to import custom plugin data from an external data file during the import process. This allows custom plugin data to be migrated across InvenTree instances if required.

Sqlite Support

In #11500 we have made some changes to our support for Sqlite databases. The default implementation now uses a significantly longer connection timeout, and uses write-ahead logging (WAL) mode by default. This should help to reduce the likelihood of database lockouts when using Sqlite, particularly in environments where multiple users may be accessing the database concurrently.

Security Fixes

There have been a number of security fixes included in this release. We would like to thank the security researchers who have responsibly disclosed these issues to us, and we encourage anyone who discovers a potential security vulnerability in InvenTree to report it to us via our security policy.

Advisories

The following security advisories have been resolved in this release:

• GHSA-cx85-vr3q-9x4m
• GHSA-m8j2-vfmq-p6qg
• GHSA-rhc5-7c3r-c769
• GHSA-qh5j-c28q-c4rg
• GHSA-7c3q-vwcv-2vp7
• GHSA-r8q5-3595-3jh2
• GHSA-84jh-x777-8pqq
• GHSA-m9j7-jw3m-fr22

Refer to the individual advisories for more information about the vulnerabilities that were resolved.

Pull Requests

In addition to the above advisories, the following pull requests were merged to resolve minor security issues:

• #11580 - reduces user scope of the DataOutput API endpoint
• #11602 - reduces user scope of the DataImport API endpoint
• #11579 - improves data security around static and media file access
• #11659 - adds security banner for superuser accounts

Project Dependencies

We strive to maintain up-to-date dependencies in the InvenTree project, and we have updated a number of dependencies in this release.

New Features

Order Line Numbering

In #11692 we have introduced a “line number” field to external orders, allowing users to specify individual line numbers for each order line. This allows for more flexible ordering and better integration with external systems.

Generic Parameter Filtering

In #11383 we have significantly overhauled the “parameter filtering” system, allowing for more flexible grouping / filtering of parameters.

Import by Natural Keys

#11288 we have added the ability to import data using natural keys, allowing for more intuitive and human-readable data imports. This allows imported data to be mapped to existing database entries using natural keys, rather than relying on internal database IDs. This is particularly useful when migrating data between InvenTree instances, or when importing data from external sources.

Auto-Allocate Tracked Parts

#10887 adds the ability to auto-allocate tracked parts against a build order. This helps to streamline the build allocation process, by providing the auto-allocation feature which has already been available for non-tracked parts.

Copy Data Cells

#11406 introduces the ability to easily copy data directly from table cells. A small but often-requested feature, this allows users to quickly copy data from the InvenTree interface without needing to open individual detail views.

Zero Quantity BOM

In #11437 we have added the ability to create a Bill of Materials (BOM) entry with zero quantity. This allows for more flexible BOM management, particularly in cases where a BOM may be used for reference purposes without needing to specify quantities.

Plugin Cache Busting

#11565 adds a cache-busting mechanism for plugin assets, ensuring that users always receive the latest version of plugin files without needing to manually clear their browser or proxy-server cache. When used in conjunction with the InvenTree plugin creator, this allows plugin developers to easily ensure that users receive the latest version of their plugin assets without needing to worry about caching issues.

Keep Forms Open

#11074 allows certain forms to remain open after submission, allowing users to quickly submit multiple entries without needing to repeatedly open and close the form. This is particularly useful for data entry tasks where multiple similar entries need to be created in quick succession.

Task Monitoring

#11527 introduces the ability to monitor the progress of a single long-running background task via the API. This allows the frontend to provide progress feedback to users when performing long-running operations, and automatically refresh the required data once the task has completed.

Bug Fixes

As always, we have provided a number of bug fixes with this release. Thanks to the many community members who have contributed to identifying and resolving these issues!

Contributing

New Contributors

As always we would like to thank all of our contributors for their hard work and dedication to the InvenTree project. In particular, we would like to welcome the following new contributors who have made their first contributions in this release:

• @tinpham5614 made their first contribution in https://github.com/inventree/InvenTree/pull/11406
• @JustusRijke made their first contribution in https://github.com/inventree/InvenTree/pull/11411
• @jmerro-c3d made their first contribution in https://github.com/inventree/InvenTree/pull/11374
• @tigger2000ttfn made their first contribution in https://github.com/inventree/InvenTree/pull/11484
• @justynbell made their first contribution in https://github.com/inventree/InvenTree/pull/11508
• @Knirps1 made their first contribution in https://github.com/inventree/InvenTree/pull/11512
• @nino-tan-smartee made their first contribution in https://github.com/inventree/InvenTree/pull/11536
• @bbzylstra made their first contribution in https://github.com/inventree/InvenTree/pull/10862
• @amm10090 made their first contribution in https://github.com/inventree/InvenTree/pull/11612
• @spamik made their first contribution in https://github.com/inventree/InvenTree/pull/11074

Code Contributions

Check out our GitHub page for a list of outstanding issues and feature requests. If you are a developer or want to become one, you can help to contribute to the project by submitting a pull request.

Translation

Our translation efforts continue to grow, with coverage increasing across a wide range of languages. We are grateful to all of our translators who have contributed to making InvenTree accessible to users around the world.

If you are interested in contributing to the translation efforts, please visit our Crowdin project and join the community of translators.

Report Bugs

If you encounter a bug in InvenTree, please report it on our GitHub issues page. Please ensure that you provide as much information as possible to help us diagnose and fix the issue.

Documentation / Technical Writing

If you have experience with technical writing, you can help to improve the InvenTree documentation. We are always looking for help to improve the documentation and make it more accessible to new users.

Financial Support

Sponsorships help to keep this project sustainable, and buys time for the core developers to commit to the project. A recurring or one off sponsorship is a great way to help InvenTree development to continue at full steam!

The work undertaken to keep InvenTree running is done by a very small group of core developers, who do so in their spare time (and are not sponsored by their employers to work on InvenTree). If you benefit from the InvenTree project, please consider contributing to maintain vibrant development of this software!

• GitHub

If you are using InvenTree in a commercial setting, please consider sponsoring the project to help support ongoing development and maintenance. Your support is greatly appreciated and helps to ensure that InvenTree remains a viable and sustainable project for years to come.

If your company benefits from InvenTree, please consider a one time sponsorship or a recurring sponsorship to help support the project.

Changelog

For a full list of changes made in this release, please refer to the release notes.

Security Advisories

The InvenTree development team has been working closely with the community to identify and resolve security issues in the InvenTree codebase. We have published the following security advisories related to this release:

• GHSA-84jh-x777-8pqq
• GHSA-r8q5-3595-3jh2
• GHSA-7c3q-vwcv-2vp7
• GHSA-qh5j-c28q-c4rg
• GHSA-m9j7-jw3m-fr22

For specific information regarding the vulnerabilities that have been fixed in this release, please refer to the individual advisories linked above.

Update Procedure

To update to the latest version of InvenTree, please follow the updating instructions provided in the InvenTree documentation. Note that the particular update procedure may vary depending on your installation method.

Acknowledgements

We would like to express our thanks to the community members who have contributed to identifying and resolving security issues in the InvenTree codebase. Your contributions are greatly appreciated and help to make InvenTree a more secure and reliable tool for everyone.

Steps to take now

We are not aware of active exploitation of this vulnerability, but we recommend that users take the following steps to mitigate risks:

• Do not expose your InvenTree instance to the public internet without hardening steps as laid out in the threat model
• Ensure registration is disabled till the release
• Ensure you trust all users registered on your instance, especially those with staff or higher permissions

The vulnerability has a low complexity and can be expected to be exploited once released. It is important to prepare to update or take your system off the public internet.

Security Policy

As always with security related themes we remind all users, security researchers, and intrested parties of our security policy.

If you have discovered a security vulnerability, please report it to us via the channels described in the policy. We take all reports seriously and will work to address any vulnerabilities in a timely manner.

We would like to thank the security researcher who reported this and several other vulnerabilities in a responsible manner, and we encourage others to do the same in the future. The reporter will be credited in the disclosure and CVE entry.

Attention: This release has no support for PostgreSQL 13 - our docs contain information regading PostgreSQL updates. At least PostgreSQL 14 is required, we recommend PostgreSQL 18.

This release includes numerous new features, improvements, and bug fixes.

Changelog

Major changes are documented in the CHANGELOG.md file in the InvenTree repository.

For a full list of changes made in this release, please refer to the release notes.

Update Procedure

To update to the latest version of InvenTree, please follow the updating instructions provided in the InvenTree documentation. Note that the particular update procedure may vary depending on your installation method.

Breaking Changes

Django Update

#10730 updated the core Django version to 5.2 lts.

As part of this update, the following breaking changes have been introduced:

PostgreSQL 14

The minimum supported version of PostgreSQL has been increased to 14. This means that users running PostgreSQL 13 will need to perform a manual update of their database in order to continue using InvenTree with the latest version. For more information, please refer to our update guide for a walkthrough of the database update procedure.

Python 3.11

The minimum supported python version has been increased to 3.11. This means that users running Python 3.10 or earlier will need to update their python installation in order to run InvenTree 1.2.0.

API changes

#11035 all metadata endpoints were unified into a generic one.

#11021 tags were removed from a few APIs by default, they can be enabled using a dedicated filter if need be

New Features

Generic Parameters

#10699 adds support for generic parameters across multiple model types. Previously, parameters were only support for parts. Read more about parameter support on the InvenTree documentation.

PDF Input Controls

#10969 adds support for input controls (check boxes, text boxes, etc) to the report generation framework.

Bug Fixes

There have been a significant number of bug fixes in this release. Thanks to the many community members who have contributed to identifying and resolving these issues!

Some long standing issues with SSO registration settings being enforced too strict have been resolved. User feedback and flow during multifactor-registration enforcement was also improved greatly.

Contributing

New Contributors

As always we would like to thank all of our contributors for their hard work and dedication to the InvenTree project. In particular, we would like to welcome the following new contributors who have made their first contributions in this release:

• @lehoangnam040 made their first contribution in https://github.com/inventree/InvenTree/pull/10751
• @kquinsland made their first contribution in https://github.com/inventree/InvenTree/pull/10900
• @ttftw made their first contribution in https://github.com/inventree/InvenTree/pull/10952
• @mlam19 made their first contribution in https://github.com/inventree/InvenTree/pull/10969
• @CapnKernel made their first contribution in https://github.com/inventree/InvenTree/pull/11011
• @fargito made their first contribution in https://github.com/inventree/InvenTree/pull/11095
• @B-z-F made their first contribution in https://github.com/inventree/InvenTree/pull/11100
• @plaes made their first contribution in https://github.com/inventree/InvenTree/pull/11161
• @wlcx made their first contribution in https://github.com/inventree/InvenTree/pull/11147
• @tomermurray made their first contribution in https://github.com/inventree/InvenTree/pull/11102

Code Contributions

Check out our GitHub page for a list of outstanding issues and feature requests. If you are a developer or want to become one, you can help to contribute to the project by submitting a pull request.

Translation

Our translation efforts continue to grow, with coverage increasing across a wide range of languages. We are grateful to all of our translators who have contributed to making InvenTree accessible to users around the world.

If you are interested in contributing to the translation efforts, please visit our Crowdin project and join the community of translators.

Report Bugs

If you encounter a bug in InvenTree, please report it on our GitHub issues page. Please ensure that you provide as much information as possible to help us diagnose and fix the issue.

Documentation / Technical Writing

If you have experience with technical writing, you can help to improve the InvenTree documentation. We are always looking for help to improve the documentation and make it more accessible to new users.

Financial Support

Sponsorships help to keep this project sustainable, and buys time for the core developers to commit to the project. A recurring or one off sponsorship is a great way to help InvenTree development to continue at full steam!

The work undertaken to keep InvenTree running is done by a very small group of core developers, who do so in their spare time (and are not sponsored by their employers to work on InvenTree). If you benefit from the InvenTree project, please consider contributing to maintain vibrant development of this software!

• GitHub

If you are using InvenTree in a commercial setting, please consider sponsoring the project to help support ongoing development and maintenance. Your support is greatly appreciated and helps to ensure that InvenTree remains a viable and sustainable project for years to come.

If your company benefits from InvenTree, please consider a one time sponsorship or a recurring sponsorship to help support the project.

For users running with a PostgreSQL database, Django 5.2 requires a minimum version of PostgreSQL 14. This means that users running PostgreSQL 13 will need to perform a manual update of their database in order to continue using InvenTree with the latest version.

If you are attempting to update to InvenTree 1.2.0 while still running PostgreSQL 13, you will encounter the following error message:

django.db.utils.NotSupportedError: PostgreSQL 14 or later is required (found 13.23).

In such a case, you will need to perform a database update procedure to migrate your existing database from PostgreSQL 13 to PostgreSQL 14 (or later). This process involves backing up your existing database, installing the new version of PostgreSQL, and then restoring your data into the new database.

Migration Guide

Note: This procedure was updated on 2026-02-19

Our documentation provides a detailed database migration guide to assist users with this process. We recommend that users perform a backup of their database before attempting the migration, and follow the instructions carefully to ensure a smooth transition to the new database version.

Following is an example of the steps involved in migrating an InvenTree installation from a PostgreSQL 13 database to a PostgreSQL 17 database, in the context of a docker installation. The same principles apply for non-docker installations, but the particular commands may differ.

PostgreSQL 17 is recommended as the target version, as it is supported by both the 1.1.x and 1.2.x versions of InvenTree.

Starting Conditions

The starting conditions for this migration are as follows:

• InvenTree is installed via docker / docker compose (as per the docker installation instructions)
• The InvenTree version is pinned to 1.1.12 in the .env file
• The database is running PostgreSQL 13 (set via the docker-compose.yml file).

We also have a data directory, external to the docker containers, with the following structure:

Target Conditions

The new installation will be running InvenTree 1.2.0 with PostgreSQL 17

Data Backup

It is prudent to perform a regular backup of the database, before following the migration procedure. This can be done using the invoke backup command, as described in the documentation. This will create a backup of the database and media files in the data/backup directory.

Step 1. Ensure Starting Conditions are Met

• postgres:13 is set in docker-compose.yml
• INVENTREE_VERSION=1.1.12 is set in .env
• Database schema has been updated to the latest version:

docker compose up inventree-db -d
docker compose run --rm inventree-server invoke update
docker compose down

Step 2. Perform Manual Backup

The first step is to perform a backup of the existing database. This step must be performed with the old setup (postgres 13 / InvenTree 1.1.12), before we perform any updates to the software.

First, let’s confirm that we are running the expected version of InvenTree (1.1.12).

To perform the backup, we run the following commands:

docker compose up inventree-db -d
docker compose run --rm inventree-server pg_dump postgresql://pguser@inventree-db:5432/inventree -f /home/inventree/data/backup/db_migrations.sql
docker compose down

Note: You will be prompted for the password for the pguser user. This is the password that you set in the .env file (default is pgpassword).

Note: Do not change the path to the migrations file, this is the internal docker container path, and should not be changed.

This will create a backup of the database and media files in the inventree-data/backup directory (external to the docker containers). The database backup will be saved as db_migrations.sql.

Confirm that the backup files have been created before continuing to the next step.

Step 3. Move Database Directory

The PostgreSQL database files are stored in the inventree-data/pgdb directory. We need to remove these files, as they are specific to PostgreSQL 13 and will not be compatible with PostgreSQL 17. Rather than deleting them, we will move them to a backup location, just in case we need to revert back to the old setup.

mv inventree-data/pgdb inventree-data/pgdb_backup

Confirm that the pgdb directory has been moved to the backup location before continuing to the next step. The pgdb directory should no longer exist in the inventree-data directory.

Step 4. Update PostgreSQL Version

Next, we need to update the PostgreSQL version in the docker-compose.yml file. Change the version from postgres:13 to postgres:17:

Pull down the updated docker images:

docker compose pull

Step 4. Restore Data from Backup

Now we can restore the data from the backup we created previously, into the new PostgreSQL 17 database. Run the following commands:

docker compose up inventree-db -d
docker compose run --rm inventree-server psql postgresql://pguser@inventree-db:5432/inventree -f /home/inventree/data/backup/db_migrations.sql
docker compose down

This will restore the database and media files from the backup we created previously.

Step 5. Verify Database Update

Launch the InvenTree server, and confirm that you can still access your data via the web interface.

docker compose up -d

Once you have confirmed that the data is accessible, you can stop the server again:

docker compose down

Step 6. Update InvenTree Version

Next, we need to update the InvenTree version in the .env file. Change the version from 1.1.12 to 1.2.0:

Then, we need to pull down the updated InvenTree server image:

docker compose pull

Next, run the InvenTree update procedure:

docker compose up inventree-db -d
docker compose run --rm inventree-server invoke update

Step 7. Verify New Setup

Finally, we can start the new setup and verify that everything is working as expected.

docker compose up -d

Then, you should be able to access your InvenTree instance again, and confirm that you are running the new version (1.2.0):

We can also see that the correct versions of both PostgreSQL and InvenTree are running in the docker containers:

Step 8. Celebrate!

Congratulations! You have successfully migrated your InvenTree installation to the latest version, with an updated PostgreSQL database. You can now enjoy the new features and improvements that come with InvenTree 1.2.0, while also benefiting from the enhanced performance and security of PostgreSQL 17.

Please consider sponsoring the project, to help us continue to maintain and improve InvenTree for all users. Your support is greatly appreciated!

This is the first major update since our 1.0.0 stable release, and includes numerous new features, improvements, and bug fixes to enhance your experience with InvenTree.

Changelog

Major changes are documented in the CHANGELOG.md file in the InvenTree repository.

For a full list of changes made in this release, please refer to the release notes.

Update Procedure

To update to the latest version of InvenTree, please follow the updating instructions provided in the InvenTree documentation. Note that the particular update procedure may vary depending on your installation method.

New Features

Partial Build Output Complete

#10499 adds the ability to complete only a partial quantity of a build output. This allows for finer control over the manufacturing process.

Build Output Adjustments

#10600 allows users to perform stock adjustment actions (count, transfer, etc) on stock items which are in production, i.e. associated with a build output. This provides greater flexibility in managing stock during the manufacturing process.

Report Helper Functions

There have been several additions to the report helper functions, in particular relating to maths and currency operations. Refer to the report documentation for more information on how to use these new functions.

Supplier Part Attachments

In #10724 we added support for uploading attachments against supplier parts. This allows users to associate relevant documents (e.g. datasheets, certifications, etc) directly with supplier parts.

Bug Fixes

There have been a significant number of bug fixes in this release. Thanks to the many community members who have contributed to identifying and resolving these issues!

Contributing

New Contributors

As always we would like to thank all of our contributors for their hard work and dedication to the InvenTree project. In particular, we would like to welcome the following new contributors who have made their first contributions in this release:

• @BbqGamer made their first contribution in #10426
• @hhhapz made their first contribution in #10485
• @wolfpackmars2 made their first contribution in #10481
• @neilbeukes made their first contribution in #10497
• @austenwho made their first contribution in #10551
• @KaranLala made their first contribution in #10549
• @akhilsingh-git made their first contribution in #10722

Translation

Our translation efforts continue to grow, with coverage increasing across a wide range of languages. We are grateful to all of our translators who have contributed to making InvenTree accessible to users around the world.

If you are interested in contributing to the translation efforts, please visit our Crowdin project and join the community of translators.

Code Contributions

Check out our GitHub page for a list of outstanding issues and feature requests. If you are a developer, you can help to contribute to the project by submitting a pull request.

In particular, we are looking for assistance with frontend development, as we work to complete the new user interface and improve the overall UI/UX of the project.

Report Bugs

If you encounter a bug in InvenTree, please report it on our GitHub issues page. Please ensure that you provide as much information as possible to help us diagnose and fix the issue.

Documentation / Technical Writing

If you have experience with technical writing, you can help to improve the InvenTree documentation. We are always looking for help to improve the documentation and make it more accessible to new users.

Financial Support

Sponsorships help to keep this project sustainable, and buys time for the core developers to commit to the project. A recurring or one off sponsorship is a great way to help InvenTree development to continue at full steam!

The work undertaken to keep InvenTree running is done by a very small group of core developers, who do so in their spare time (and are not sponsored by their employers to work on InvenTree). If you benefit from the InvenTree project, please consider contributing to maintain vibrant development of this software!

• GitHub

If you are using InvenTree in a commercial setting, please consider sponsoring the project to help support ongoing development and maintenance. Your support is greatly appreciated and helps to ensure that InvenTree remains a viable and sustainable project for years to come.

If your company benefits from InvenTree, please consider a one time sponsorship or a recurring sponsorship to help support the project.

This plugin encourgaes users to perform regular stocktakes of inventory items in a rolling fashion, ensuring that stock levels are consistently accurate without the need for a complete inventory shutdown.

By presenting users with a dashboard widget that highlights stock items that are overdue for stocktake, the plugin helps maintain inventory accuracy and reduces the risk of stock discrepancies.

For more information about the plugin, please refer to the plugin reference or the GitHub page.