Neops Core 2.1.2
Released 2026-09-23
Core 2.1.2 adds the backend contract for safe sorting in dynamic entity tables, makes credential updates safer, and gives operators clearer evidence when workflows or integrations fail.
At a glance
| Area | What changed | Why it matters |
|---|---|---|
| Entity search | Core advertises the supported sort fields for devices, interfaces, clients, and groups. | Clients can disable invalid sorting before it reaches Elasticsearch. |
| Credential management | save_credentials supports SSH keys, preserves fields that were not supplied again, and shows masked configuration. |
Rotating one secret no longer clears unrelated credential values. |
| Workflow diagnostics | Missing or ambiguous sub-task references name the workflow step and task_uniquename. |
Operators can find the broken reference without tracing through Django internals. |
| Provider traffic | HTTP integrations send User-Agent: neops-<name>. |
Proxy and vendor logs can distinguish Neops requests from generic Python traffic. |
Highlights
Entity tables can ask Core what is sortable
The GraphQL API now returns the public ordering keys supported by each entity index. Core validates public camelCase names and accepted legacy names before creating the Elasticsearch sort clause. Existing null handling remains in place, and Core adds an ID tie-breaker so rows with the same value keep a stable order.
The devices, interfaces, clients, and groups indexes now store the timestamps, serial values, and relationship counts used by dynamic tables. Core keeps relationship counts synchronized after direct updates, background jobs, reparenting, many-to-many changes, soft deletion, restoration, and hard deletion.
Neops Web SDK 5.2.1 uses this capability to disable unsupported table sorting with an explanation instead of sending a query that the backend cannot honor.
Credential rotation preserves existing values
save_credentials now accepts an SSH key directly with --key or from a file with --key-file.
Only fields supplied on the command line are updated.
Existing URLs, usernames, passwords, tokens, and keys remain unchanged when they are omitted.
For example, this updates only the SSH key, then displays the stored configuration with secret values masked:
uv run python manage.py save_credentials neops_git_sync \
--key-file /etc/neops/keys/id_ed25519
uv run python manage.py save_credentials neops_git_sync
Failures point to the configuration that needs attention
When a generic workflow step refers to a missing task, the error now includes both the step name and the unresolved task_uniquename.
The workflow still stops, but the first error line identifies what needs to be corrected.
Provider requests also carry an integration-specific user agent.
For example, traffic from the NetBox provider no longer appears only as a generic python-requests client in access logs.
Upgrade notes
Rebuild the devices, interfaces, clients, and groups Elasticsearch indexes after deploying Core 2.1.2. Existing documents need the new sortable timestamps, serial values, and relationship counts:
Autobahn was updated to 26.7.1 to address CVE-2026-77528.
The Docker images, GraphQL npm packages, Python client, and GitHub release published successfully.
The Helm chart push failed because Quay returned 401 Unauthorized.
Do not expect the 2.1.2 chart until the failed release job is rerun with working registry permissions.
Technical details
