chore(deps): update nautobot to v3.1.8

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
ghcr.io/nautobot/nautobot	final	patch	3.1.6-py3.12 → 3.1.8-py3.12
nautobot		patch	==3.1.6 → ==3.1.8
networktocode/nautobot		patch	3.1.6 → 3.1.8

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

nautobot/nautobot (ghcr.io/nautobot/nautobot)

v3.1.8: - 2026-07-17

Compare Source

v3.1.8 (2026-07-17)

Security in v3.1.8

• GHSA-56v6-2fhr-wxgq - Fixed stored XSS vulnerabilities when rendering Relationship description and Module Family name fields.
• GHSA-q4c5-2j6f-r476 - Fixed an authorization bypass in the REST API where a user with only add_approvalworkflowstageresponse permission could POST to create "approved" responses, bypassing the intended approver checks and self-approving a workflow. The standalone ApprovalWorkflowStageResponse endpoint has been removed; responses are now exposed as read-only nested data on the approval workflow stage, filtered by view permission.
• #​9218 - Updated dependency django to >=5.2.16,<5.3 to mitigate CVE-2026-48588, CVE-2026-53877, and CVE-2026-53878.
• #​9219 - Updated dependency Pillow to >=12.3.0,<13 to mitigate multiple CVEs.

Added in v3.1.8

• #​9037 - Added a "Go to page" input field to the paginator for quickly jumping to a specific page in multi-page tables.

Changed in v3.1.8

• #​9149 - Changed removing a VRF from a Device or VirtualMachine to raise an error if that VRF is still attached to one of the interfaces.
• #​9149 - Changed attaching a VRF to a VM interface via API/ORM to raise an error if the parent Virtual Machine does not have that VRF assigned.
• #​9210 - Object counts on the home page are now displayed with thousands separators (e.g., 1,009,518).
• #​9250 - Enhanced the REST API queryset optimizer to automatically pre-fetch the related objects traversed by a model's natural key to avoid N+1 queries.

Removed in v3.1.8

• GHSA-q4c5-2j6f-r476 - Removed the unused ApprovalWorkflowStageResponse UI view registration, which was never linked.

Fixed in v3.1.8

• #​9144 - Fixed the CustomField description field no longer being rendered as Markdown on the Custom Field detail view.
• #​9161 - Fixed the broken Operational Compliance documentation link in the Application Marketplace, which returned a 404 due to a trailing quotation mark in the URL.
• #​9179 - Fixed dynamic group membership incorrectly returning no members when a filter specified multiple conjoined values (such as multiple tags), which should match objects having all of the given values.
• #​9250 - Fixed an N+1 query when listing Interfaces via the REST API.

Dependencies in v3.1.8

• #​9219 - Updated dependency regex to >=2026.6.28.

Documentation in v3.1.8

• #​9100 - Documented that VRF and Location associations cannot be set via Prefix CSV/bulk import and must be assigned via the UI or the REST API assignment endpoints.
• #​9201 - Added documentation clarifying that __init__.py files are required in both the Git repository root and the custom_validators/ folder for Data Compliance Rules to be discovered from a remote Git repository.
• #​9215 - Fixed docs bug in the EVENT_BROKERS setting documentation.

Housekeeping in v3.1.8

• #​9165 - Fixed invoke lint --fix to continue running in the event of a linting failure.
• #​9165 - Removed proper name fix from the markdownlint fix command.
• #​9216 - Changed the default max_locks_per_transaction for Postgres to 512 for test runs with many parallel workers.
• #​9216 - Backported Django 6.0 fix for parallel test runs with --buffer.
• #​9216 - Changed a virtualization test to create its VLANGroup directly instead of via a factory.
• #​9219 - Updated development dependency faker to ^40.28.1.
• #​9219 - Updated development dependency mkdocstrings to ~1.0.5.
• #​9219 - Updated development dependency ruff to ~0.15.21.

Contributors

• @​Poleron402
• @​collin-wicker
• @​glennmatthews
• @​gsnider2195
• @​joewesch
• @​loganknecht
• @​nathanhitchcock
• @​netcanon
• @​pastoreerrante
• @​renovate

New Contributors

• @​netcanon made their first contribution in #​9144
• @​collin-wicker made their first contribution in #​9211
• @​Poleron402 made their first contribution in #​9206

Full Changelog: nautobot/nautobot@v3.1.7...v3.1.8

v3.1.7: - 2026-07-06

Compare Source

v3.1.7 (2026-07-06)

Added in v3.1.7

• #​6614 - Added nested lookup support to LinkedCountColumn, allowing it to display a single related object rather than a count when a single object is present.
• #​7946 - Added the obj Jinja2 variable to data validation regex rules to align with Nautobot's conventions.
• #​9145 - Added missing filter forms for various models to make them usable with Dynamic Groups.

Changed in v3.1.7

• #​6614 - Updated the IP address table to display the device or virtual machine names when an IP address is assigned to an interface on a single device/VM, rather than always showing a count.
• #​6614 - Updated the cloud network Circuits column to display the circuit ID when a cloud network is related to a single circuit, rather than always showing a count.

Deprecated in v3.1.7

• #​7946 - Deprecated the object Jinja2 variable in data validation regex rules in favor of obj; object will be removed in Nautobot 4.0.

Fixed in v3.1.7

• #​8287 - Fixed Git repository synchronization to not leave lingering git subprocesses.
• #​9047 - Fixed a bug that caused the application to crash when creating an Interface with a required Custom Field despite providing a value for it.
• #​9047 - Fixed application crashes from errors on fields that are not declared in some forms.
• #​9113 - Fixed an IntegrityError raised on every request after the first when EXTERNAL_AUTH_DEFAULT_PERMISSIONS is configured for externally-authenticated users.
• #​9117 - Fixed edit/delete actions on a Dynamic Group's Members tab returning the user to the group's detail page instead of the Members tab.
• #​9132 - Moved the charset declaration to be the first tag in <head>.
• #​9186 - Fixed prefix_length__lte filter value being corrupted (e.g. ['16']) when adding another filter in the Prefix list view.
• #​9186 - Fixed within_include filter field in PrefixFilterForm not supporting multiple values.
• #​9186 - Fixed MultiValueCharField splitting a bare string value into per-character choices.

Dependencies in v3.1.7

• #​9081 - Updated dependency nh3 to >=0.3.6,<0.4

Housekeeping in v3.1.7

• #​9081 - Updated documentation dependency mkdocstrings-python to ~2.0.5.
• #​9081 - Updated development dependency pylint to ~4.0.6.
• #​9081 - Updated development dependency pymarkdownlnt to ~0.9.38.
• #​9081 - Updated development dependency ruff to ~0.15.20.
• #​9146 - Changed lint task to support --fix flag in order to apply fixes for all.
• #​9163 - Fixed some incorrect logic in the generic bulk delete view test.

Contributors

• @​dsoftait
• @​gsnider2195
• @​joewesch
• @​loganknecht
• @​nathanhitchcock
• @​nkallergis
• @​renovate

Full Changelog: nautobot/nautobot@v3.1.6...v3.1.7

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.