What librenms/librenms shipped
Written by FoxPlug from the repository's own releases; not affiliated with Librenms. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/librenms/librenms; Librenms did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Replaced the old arp, fdb and ip search pages with a single network search page that adds NDP search, an export button, a mac format selector and search history. Pull request #21113
- Updated the project to Laravel 13. Pull request #20802
- Added Arista PSU and fan operational state sensors using ENTITY-STATE-MIB with component labels from ENTITY-MIB. Pull request #21150
- Added a librenms-worker service that can run discovery and polling as queued jobs on Laravel Horizon when
schedule_type.pollerandschedule_type.discoveryare set to worker. Pull request #20958 - Handled the extra VDOM or interface index that FortiOS 7.4 and later append to BGP4-MIB tables when append-index is enabled. Pull request #21160
- Read optics from snIfOpticalLaneMonitoringTable for Ironware devices where snIfOpticalMonitoringInfoTable is no longer filled. Pull request #21173
- Detected SNMPv3 timeouts in hasConnectionError so connection errors are thrown for v3 devices that stop answering. Pull request #21158
- Moved MEF discovery and polling into a modern module class, LibreNMS\Modules\Mef. Pull request #21126
- Moved CISCO-CEF discovery and polling into a modern module class, LibreNMS\Modules\CiscoCef. Pull request #21127
- Fixed the php-fpm max children reached graph on the apps overview page by correcting the graph name. Pull request #21174
Why it matters
This week moves more legacy discovery and polling code into modern module classes and brings a single network search page that replaces the older arp, fdb and ip pages. Device support improves with Arista PSU and fan state sensors, FortiOS BGP index handling and Ironware optics, while a Laravel 13 update and a new worker service for queued discovery and polling change how the project runs.
Changelog entry
- Replaced the arp, fdb and ip search pages with a new network search page that adds NDP search, export and search history. Pull request #21113
- Updated to Laravel 13. Pull request #20802
- Added Arista PSU and fan operational state sensors from ENTITY-STATE-MIB. Pull request #21150
- Added a librenms-worker service that can run discovery and polling as queued jobs on Horizon. Pull request #20958
- Handled non-standard BGP4-MIB indexes on FortiOS 7.4 and later. Pull request #21160
- Read optics from snIfOpticalLaneMonitoringTable for Ironware devices. Pull request #21173
- Detected SNMPv3 timeouts in hasConnectionError. Pull request #21158
- Moved MEF discovery and polling to the modern Mef module. Pull request #21126
- Moved CISCO-CEF discovery and polling to the modern CiscoCef module. Pull request #21127
- Fixed the php-fpm max children reached graph on the apps overview page. Pull request #21174
- Allowed renaming a device that has no RRD folder. Pull request #21135
- Moved Lantronix SLC devices to the management type and added temperature and power supply sensors. Pull request #21095
This week: a new network search page with NDP search and export, Laravel 13, Arista PSU and fan state sensors, a librenms-worker service for queued polling and discovery, plus FortiOS BGP index and Ironware optics fixes.
This week in LibreNMS: the old arp, fdb and ip search pages are replaced by one network search page with NDP search, export and search history. The project moves to Laravel 13. Arista devices gain PSU and fan operational state sensors, and a new librenms-worker service can run discovery and polling as queued jobs on Horizon. Device handling improves for FortiOS 7.4 and later BGP4-MIB indexes, Ironware optics, and SNMPv3 timeout detection. MEF and CISCO-CEF discovery and polling also move into modern module classes.
Week of October 26, 2026
What shipped
- Grouped recovery notifications are now sent when a fault recovers before the dispatcher reaches the alert, fixing lost recoveries reported since 26.10.0. Pull request #21097
- Manually set BGP peer descriptions are kept on discovery for operating systems such as Junos that do not report a peer description. Pull request #21123
- HrStorage volumes larger than the signed Integer32 range, such as Windows volumes over 8 TiB with 4 KiB clusters, are no longer skipped. Pull request #21051
- Nokia-isam converts hex-encoded ifHC counters to integers, restoring port graphs for ethernet uplinks and VDSL lines. Pull request #21050
- FortiGate adds 5G modem sensors for LTE RSSI, RSRQ, RSRP, 5G RSRP and SNR, plus session status. Pull request #21049
- IHSE Draco tera matrix support adds hardware and firmware discovery and health monitoring, including temperatures, fan and PSU states, slot states and KVM port states. Pull request #21094
- Riedel MediorNet adds YAML-based OS support with CPU load, temperatures, fan speed, PSU, card, fiber-link and synchronization states. Pull request #21096
- Eaton UPS Network-M2 adds a state sensor per outlet group, treating on, off and pending states as ok and failed states as critical. Pull request #21111
- Eaton UPS Network-M2 adds battery and output state sensors so reported failures and unprotected output are visible. Pull request #21092
- Support for the Didactum Monitoring System adds state, temperature and voltage sensors. Pull request #20995
Why it matters
This week tightens alerting and polling behavior people depend on, restoring grouped recovery notifications and fixing skipped large storage volumes and empty ISAM port graphs. It also broadens device coverage with new drivers and sensors for IHSE Draco tera, Riedel MediorNet, FortiGate 5G modems, Eaton equipment and Didactum, while removing old helpers and unused code.
Changelog entry
- Send grouped recovery notifications when a fault recovers before the dispatcher reaches the alert. Pull request #21097
- Keep manually set BGP peer descriptions on discovery for OSes that do not report one. Pull request #21123
- Do not skip hrStorage volumes with more than 2^31 allocation units due to Integer32 overflow. Pull request #21051
- Convert nokia-isam hex-encoded ifHC counters to integers so port graphs populate. Pull request #21050
- Add FortiGate 5G modem signal and SNR sensors plus session status. Pull request #21049
- Add Eaton UPS Network-M2 outlet group state sensors. Pull request #21111
- Add Eaton UPS Network-M2 battery and output state sensors. Pull request #21092
- Add IHSE Draco tera detection, hardware and firmware discovery, and health monitoring. Pull request #21094
- Add Riedel MediorNet OS support with load, temperature, fan, PSU, card and sync states. Pull request #21096
- Add Didactum Monitoring System support with state, temperature and voltage sensors. Pull request #20995
- Set Zyxel NWA device type to wireless. Pull request #20943
- Drop low limits from nokia-isam board temperature sensors to stop false critical states. Pull request #21125
This week: grouped recovery notifications fixed, large hrStorage volumes no longer skipped, ISAM port graphs restored, BGP peer descriptions kept, plus new support for IHSE Draco tera, Riedel MediorNet, FortiGate 5G modems and more Eaton sensors.
This week's changes focus on reliability and device coverage. Grouped recovery notifications are now sent when a fault recovers before the dispatcher reaches the alert, Windows hrStorage volumes above the signed Integer32 range are no longer skipped, Nokia ISAM port graphs are restored by converting hex-encoded ifHC counters, and manually set BGP peer descriptions survive discovery. New support includes IHSE Draco tera matrices, Riedel MediorNet, FortiGate 5G modem signal and session sensors, Eaton Network-M2 outlet group and battery state sensors, and the Didactum Monitoring System. Cleanup work removed legacy helpers and unused web functions.
Week of October 19, 2026
What shipped
- Polling methods and secrets moved out of the devices table and device attributes into two new models, with per-method settings, an enabled flag and availability impact. Pull request #19409
- Added the lnms scan:network command, which replaces the old python snmp-scan.py. Pull request #20966
- Replaced the bootgrid search and legacy filter form on the Faults and Alert History pages with the same filter bar used on the Devices page, with saved filter support. Pull request #20950
- Shipped the 26.10.2 bug fix release, following the 26.10.1 release that reverted a change causing issues for users with old fping versions. Release
- Mapped RFC 4273 BGP trap names to the existing BGP established and backward transition handlers, which previously only matched the older BGP4-MIB names. Pull request #21020
- Added Dell SONiC S5248F detection with version, hardware and serial discovery, so the device is no longer detected as PowerConnect. Pull request #21009
- Fixed per-entity fault acknowledgements so an unrelated acknowledged fault is no longer returned to active when a rule gains or loses a matching port. Pull request #20984
- Fixed the device Config tab failing on backups that contain invalid UTF-8. Pull request #21022
- Restored the timezone in device API dates after toDateTimeString dropped it. Pull request #21038
- Fping 4.0 or newer is now required, and the check for fping6 existence was removed. Pull request #21013
Why it matters
This week adds a new network scan command and a filter bar on the Faults and Alert History pages, while moving device polling settings and credentials into new models. It also fixes a set of regressions around timezones in the device API, fault acknowledgements, config tab backups and rrd handling, and ships two bug fix releases.
Changelog entry
- Polling methods and secrets now live in two new models instead of the devices table and device attributes. Pull request #19409
- Added lnms scan:network command, replacing the old python snmp-scan.py. Pull request #20966
- Faults and Alert History pages now use the Devices filter bar with saved filter support. Pull request #20950
- Per-entity fault acknowledgements are preserved when a rule gains or loses a matching port. Pull request #20984
- Fixed the device Config tab failing on backups containing invalid UTF-8. Pull request #21022
- Device API dates include the timezone again. Pull request #21038
- Mapped RFC 4273 BGP trap names to existing BGP handlers. Pull request #21020
- Added Dell SONiC S5248F detection and version, hardware and serial discovery. Pull request #21009
- Added hardware, version and serial discovery for Microsemi SyncServer S650. Pull request #20886
- Added hardware model discovery from sysDescr for Raritan KVM. Pull request #20960
- Fping 4.0 or newer is now required. Pull request #21013
- 26.10.2 bug fix release. Release
This week in LibreNMS: lnms scan:network replaces the old python scanner, polling methods and secrets get their own models, and the Faults and Alert History pages get a filter bar. Plus fixes for device API timezones, fault acknowledgements and more.
This week in LibreNMS: a new lnms scan:network command replaces the old python snmp-scan.py, device polling settings and credentials move into two new models, and the Faults and Alert History pages now use the same filter bar as the Devices page. We also fixed timezone handling in device API dates, per-entity fault acknowledgements, the device Config tab on backups with invalid UTF-8, and rrd file naming, and added detection for Dell SONiC S5248F plus RFC 4273 BGP trap mapping. Two bug fix releases went out.
Week of October 12, 2026
What shipped
- Enforced per-device permissions in legacy API v0 handlers so users only see data for devices they can access. Pull request #20913
- Fixed write authorization for devices, components and bills on update and delete. Pull request #20919
- Fixed legacy API write authorization for alert ack/unmute, service changes and BGP description edits. Pull request #20918
- Required update access to each affected device in web forms including the device dependency editor and port notes. Pull request #20917
- Escaped values in the Oxidized node list to fix an XSS issue. Pull request #20916
- HTML encoded the overlib tooltip attribute to fix an XSS issue. Pull request #20915
- Escaped device-supplied data on F5 load balancer, CBQoS, processor health and packages pages. Pull request #20914
- Restricted raw SQL array values in legacy dbInsert and dbUpdate to only allow the known NOW() expression. Pull request #20908
- Hid the dashboard editor menu entry when not on the dashboard and fixed some invalid HTML. Pull request #20941
- Improved device config page performance on Firefox by rendering CSS counters as one string and fixing wrapped line numbers. Pull request #20892
Why it matters
This week focused heavily on security and authorization fixes across the legacy API, web forms and several pages, closing multiple XSS and access control issues. These changes mean users can only see and modify data for devices they are permitted to access, and device-supplied values are escaped before reaching HTML. The release also includes performance and UI fixes that make the device config page faster on Firefox and tidy up the dashboard menu.
Changelog entry
- Enforce per-device permissions in legacy API v0 handlers. Pull request #20913
- Fix device, component and bill write authorization. Pull request #20919
- Fix legacy API write authorization for alerts, services and BGP descriptions. Pull request #20918
- Require update access to each affected device in web forms. Pull request #20917
- Fix XSS in Oxidized page by escaping values. Pull request #20916
- Fix overlib tooltip XSS by HTML encoding the attribute. Pull request #20915
- Escape device data on F5 load balancer, CBQoS, processor health and packages pages. Pull request #20914
- Restrict raw SQL values in legacy dbInsert/dbUpdate to NOW() only. Pull request #20908
- Hide dashboard editor menu entry when not on the dashboard and fix invalid HTML. Pull request #20941
- Improve device config page performance on Firefox. Pull request #20892
- Prefer primary IPs for syslog lookup. Pull request #20928
- Sync device status in router.db for RANCID integration. Pull request #20895
This week: per-device permissions enforced across legacy API and web forms, several XSS issues fixed, raw SQL values restricted, and device config page made faster on Firefox. See the pull requests for details.
This week's changes focus on security and authorization. Per-device permissions are now enforced in legacy API v0 handlers and web forms, so users only see and modify data for devices they can access. Write authorization was fixed for devices, components, bills, alerts, services and BGP descriptions. Several XSS issues were addressed by escaping device-supplied data on pages including Oxidized, overlib tooltips, F5 load balancer, CBQoS, processor health and packages. Raw SQL array values in legacy dbInsert/dbUpdate are now limited to the known NOW() expression. On the performance side, the device config page is much faster on Firefox, and the dashboard editor menu entry is hidden when not on the dashboard.
Week of October 5, 2026
What shipped
- Scheduled polling adds experimental queue-based polling and discovery, configured through lnms migrate and QUEUE_CONNECTION in.env. Pull request #16319
- ArubaOS-CX now reports fan and module state sensors so failed fans and line modules appear in state sensors. Pull request #20661
- NTP application graphing was enhanced. Pull request #20338
- The Discovery Protocols module was modernized. Pull request #20849
- RRD failures now back off and retry instead of permanently disabling RRD. Pull request #20825
- Ports discovery only stores known port columns instead of using walked SNMP keys as column names. Pull request #20796
- ARP search interface sorting now uses the correct
port_ifdescrcolumn. Pull request #20845 - Printer toner graphs were fixed. Pull request #20844
- The inventory tab crash was fixed by moving parse_entity_state() into InventoryController. Pull request #20840
- Ignition log collection was disabled to stop a memory leak. Pull request #20841
Why it matters
This week fixed several user-visible breakages, including printer toner graphs, ARP search sorting and the inventory tab. It also improved state monitoring for ArubaOS-CX fans and modules, and made RRD recover after failures instead of staying disabled. Scheduled polling arrived as an experimental option for queue-based polling and discovery.
Changelog entry
- Add experimental scheduled polling: queue-based polling and discovery. Pull request #16319
- Add arubaos-cx fan and module state sensors. Pull request #20661
- Enhance NTP application graphing. Pull request #20338
- RRD: back off and retry on failures instead of permanently disabling. Pull request #20825
- Only store known port columns in ports discovery. Pull request #20796
- Fix ARP search interface sorting column name. Pull request #20845
- Fix printer toner graphs. Pull request #20844
- Fix inventory tab crash by moving parse_entity_state() into InventoryController. Pull request #20840
- Disable Ignition log collection to stop a memory leak. Pull request #20841
- Fix api/v0/alerts API call. Pull request #20823
- Fix device settings toggles being set incorrectly. Pull request #20817
- Fix validate cli crash and output. Pull request #20837
This week: experimental scheduled polling landed, ArubaOS-CX fan and module state sensors were added, RRD now retries after failures, and fixes went in for printer toner graphs, ARP search sorting and the inventory tab.
This week brought an experimental scheduled polling option for queue-based polling and discovery, plus new ArubaOS-CX fan and module state sensors. RRD no longer disables permanently on failures and instead backs off and retries. Several fixes landed too: printer toner graphs, ARP search interface sorting, the inventory tab crash, validate cli output, and Ignition log collection was disabled to stop a memory leak.
Week of September 28, 2026
What shipped
- Settings system rewritten with direct setting links and Vue.js v2 removed. Pull request #20743
- Device ports tab migrated to Laravel with server-side paging, filtering, and bulk actions. Pull request #20749
- Device modules settings page redesigned for better usability. Pull request #20730
- All billing pages migrated to Laravel. Pull request #20723
- Search navigation speed improved by fixing pending requests and incomplete results. Pull request #20726
- Device overview page optimization for ports reduces slowness on many links. Pull request #20727
- UTF-8 encoding handling in ENTITY-MIB strings prevents discovery crashes on non-UTF-8 data. Pull request #20738
- OSPF neighbor table out-of-order handling fixed for Aruba procurve switches. Pull request #20713
- Legacy ospfv3 polling module file removed as it's now handled by modern module class. Pull request #20751
- Twenty-five legacy discovery module adapter files removed after migrating to LibreNMS\Modules classes. Pull request #20752
Why it matters
This week focused on modernizing the codebase by migrating more UI pages to Laravel, removing legacy module files, and fixing device discovery and polling issues. Multiple performance optimizations and compatibility fixes improve stability on various hardware platforms.
Changelog entry
- Settings system rewritten with direct setting links; Vue.js v2 removed Pull request #20743
- Device ports tab migrated to Laravel with server-side paging, filtering, and bulk actions Pull request #20749
- All billing pages migrated to Laravel Pull request #20723
- Device modules settings page redesigned Pull request #20730
- Search navigation speed improved Pull request #20726
- Device overview page optimized for ports Pull request #20727
- UTF-8 encoding handling in ENTITY-MIB strings prevents discovery crashes Pull request #20738
- OSPF neighbor table ordering fixed for procurve switches Pull request #20713
- SG300 series temperature sensor exception added Pull request #20332
- Legacy ospfv3 polling module file removed Pull request #20751
- 25 legacy discovery module adapter files removed Pull request #20752
- GitHub pull request auto-labeling added Pull request #20759
Settings rewritten, ports page rebuilt in Laravel, modules page redesigned, billing migrated, search and device overview faster, UTF-8 and OSPF handling fixed, legacy files removed.
This week's LibreNMS updates include major UI modernization with the settings system rewritten, device ports and billing pages migrated to Laravel, and a redesigned modules settings interface. Performance improvements address slowdowns in search navigation and device overview rendering. Bug fixes handle UTF-8 encoding in ENTITY-MIB strings and OSPF table ordering issues on Aruba switches. Legacy module adapter files continue being removed as the modern module system handles these responsibilities.
Week of September 21, 2026
What shipped
- 26.9.1 bugfix release fixes billing polling, custom map pan/zoom, and IPMI locale issues. Release
- Device filter options now respect user permissions for location, device group, and poller group. Pull request #20643
- Device status reason now displayed when polling or discovering a down device. Pull request #20640
- IPMI sensor threshold float parsing fixed to handle locale and dirty-check issues. Pull request #20576
- ZFS wait-time graphs corrected to display milliseconds instead of raw nanoseconds. Pull request #20616
- PingCheck deferred alerts now execute for child devices using correct device lookup. Pull request #20610
- Fping can now run without specifying address family, letting fping choose automatically. Pull request #20641
- Email address parsing improved using Symfony Mime to correctly handle quoted names. Pull request #20605
- Key:rotate command no longer blocks on confirmation when run with --no-interaction flag. Pull request #20639
Why it matters
This week addresses stability and correctness across core features: billing calculations work again, IPMI sensors parse thresholds properly in all locales, and permission checks prevent unauthorized filter visibility. Several data display fixes ensure ZFS graphs and device status messages show accurate information.
Changelog entry
- Permission checks added for device filter options (location, device group, poller group) Pull request #20643
- Device status reason included when polling or discovering a down device Pull request #20640
- ZFS wait-time graphs now display milliseconds instead of nanoseconds Pull request #20616
- PingCheck deferred alerts fixed for child device lookups Pull request #20610
- Email address parsing improved with Symfony Mime for quoted names Pull request #20605
- IPMI sensor threshold float parsing fixed for locale handling Pull request #20576
- Fping can run without specifying address family Pull request #20641
- Key:rotate --no-interaction flag no longer blocks on confirmation Pull request #20639
- ZFS pool disk wait graphs fixed to read correct RRD file for Write series Pull request #20615
26.9.1 released. Fixes billing polling, IPMI sensor parsing with locale handling, and custom map settings. Permission checks tighten device filter visibility.
LibreNMS 26.9.1 is out with important fixes. Billing polling restored, IPMI sensor thresholds now parse correctly across locales, and device filter options properly respect user permissions. ZFS wait-time graphs display accurate milliseconds. Several additional refinements to device status reporting and ping functionality round out this maintenance release.
Week of September 14, 2026
What shipped
- Escaped default alert title definition to fix security vulnerability GHSA-9qcg-rgg9-mpjg. Pull request #20547
- Converted legacy API tokens to modern Sanctum tokens with backward compatibility for old format. Pull request #20528
- Added support for Palo Alto Networks Prisma SD-WAN ION appliances across 16 models. Pull request #20556
- Added SNR-OLT-GPON-16-2AC GPON OLT support with hardware, firmware, CPU, memory, temperature and transceiver discovery. Pull request #20558
- Added PoE power sensors for Netgear GS324TP with total budget and consumption reporting. Pull request #20480
- Health sensors widget now supports table mode with sorting by value and 100 entry hard cap. Pull request #20368
- Added complete Swedish translation covering all 27 PHP modules and JSON catalogue. Pull request #20167
- Replaced SnmpQueryMock with SnmprecSnmpBackend to read snmprec files directly with test optimizations. Pull request #20529
- Added error handling in Time::dateToMinutes() to catch malformed dates like those from APC UPS devices. Pull request #20577
- Fixed BGP peer discovery duplicates by setting
context_namein OS-specific modules and adding migration. Pull request #20560
Why it matters
This week includes critical security fixes for alert titles and API token handling, expanded device support for Palo Alto and Netgear equipment, and modernized token authentication. The Swedish translation and improved test infrastructure also enhance the project's accessibility and development experience.
Changelog entry
- Security: Escaped default alert title definition (GHSA-9qcg-rgg9-mpjg) Pull request #20547
- Security: Sanitized user and group inputs in LDAP search filters Pull request #20542
- Security: Prevented directory traversal in nfsen channel parameter Pull request #20540
- Security: Escaped device displayName and
sensor_descrin views Pull request #20539 - Security: Fixed oxidized XSS vulnerability Pull request #20538
- API: Converted legacy tokens to Sanctum with backward compatibility Pull request #20528
- Device: Added Palo Alto Networks Prisma SD-WAN ION support Pull request #20556
- Device: Added SNR-OLT-GPON-16-2AC GPON OLT support Pull request #20558
- Sensors: Added PoE power sensors for Netgear GS324TP Pull request #20480
- Sensors: Added Vertiv PDU GTHD temperature and humidity discovery Pull request #20567
- Widgets: Health sensors widget now supports table mode with sorting Pull request #20368
- UI: Improved custom maps with better zoom, dark mode, and mobile experience Pull request #20535
- Localization: Added complete Swedish translation Pull request #20167
- Fixes: Added error handling for malformed dates in Time::dateToMinutes() Pull request #20577
- Fixes: Fixed BGP peer discovery duplicates Pull request #20560
- Fixes: Fixed inventory loop due to duplicate index Pull request #20518
- Fixes: Device filter status down no longer affected by disable notify flag Pull request #20580
- Fixes: Fixed yaml snmpget exists checks comparison Pull request #20532
- Testing: Replaced SnmpQueryMock with SnmprecSnmpBackend for direct snmprec reading Pull request #20529
This week: security fixes for alert titles and LDAP injection, Palo Alto Prisma SD-WAN support, Netgear PoE sensors, Swedish translation, and API token modernization. Plus BGP duplicate fixes and improved error handling for malformed device data.
LibreNMS releases this week include important security updates addressing alert title escaping and LDAP filter sanitization, plus expanded device support for Palo Alto Networks Prisma SD-WAN ION and Netgear PoE switches. Major infrastructure improvements include modernized Sanctum-based API token handling with legacy support, a complete Swedish translation, and optimized SNMP test backend. Bug fixes address BGP peer duplicates, malformed date handling from UPS devices, and graph query parsing.