logo InvenTree
go back Back

1.6.0 Release

18 Oct 2026 Oliver

InvenTree 1.6.0 has been released! This release includes a number of new features, improvements, and bug fixes. We recommend all users to update to this version as soon as possible.

Changelog

Major changes are documented in the CHANGELOG.md file in the repository. For a full list of changes, please refer to the release notes.

Update Procedure

To update to the latest version of InvenTree, please follow the updating instructions provided in the InvenTree documentation. Note that the particular update procedure may vary depending on your installation method.

Breaking Changes

While we strive to maintain backward compatibility, there are some breaking changes in this release. While many of these are minor, and should not affect most users, we recommend that you review the list of breaking changes to ensure that your installation will continue to function as expected after the update. Each breaking change is documented in detail at the links below:

Notes Refactor

PR #11971 is a major refactor of how notes are handled throughout InvenTree. Notes are now stored in a dedicated table (in line with how attachments and parameters are handled), support multiple separate notes per item, and are accessed via the new /api/note/ endpoint rather than a notes field on individual models. Existing notes data (including embedded images) is automatically migrated into the new table, with markdown content converted to HTML. Any external client applications which read or write the notes field directly via the API will need to be updated to use the new endpoint.

Formal State Transitions

PR #12507 switches build and order status transitions to a more formal finite-state-machine approach. As part of this change, attempting an invalid or repeated state transition now raises a ValidationError instead of silently failing. Plugins which implement custom transitions should review this change and adjust their usage accordingly to take advantage of the new safeguards.

Tags Filter Renamed

PR #12672 renames the tags filter — added in 1.4.0 for filtering models by tag — to tag_name, to avoid a name clash with the tags field exposed on the same endpoints. Any integration filtering tagged objects via ?tags= must be updated to use ?tag_name= instead.

Squash Migrations Prior to 1.0.0

PR #12830 squashes all database migrations predating the 1.0.0 release. Any installation still running a pre-1.0.0 version of InvenTree must first update to 1.0.0 before updating to this release.

API Token Storage Hardened

PR #12850 changes how API tokens are stored, replacing plaintext storage with a peppered HMAC-SHA256 digest, so that gaining read access to the database (for example via a side-channel or IDOR vulnerability) can no longer be used to recover usable API tokens. Newly-issued tokens use a longer “v2” format; existing tokens continue to work, but since the raw token value can no longer be read back from the database, calling /api/user/me/token/ now always reissues (and invalidates) the token rather than returning the existing value.

Security Fixes

A number of security vulnerabilities have been fixed in this release.

Attachment API Permission Bypass

PR #12689 fixes a flaw in the Attachment API where user role permissions were not checked against the owning model, allowing any authenticated user to enumerate and download attachments they should not have had access to. The API now checks the requesting user’s view permissions and returns PermissionDenied where appropriate.

Metadata Endpoint Information Disclosure

PR #12771 restricts the generic metadata API endpoints to a fixed set of safe lookup fields, closing a path where arbitrary field names could be used to perform unintended database queries and recover data outside the intended scope.

Data Import Session Retargeting

PR #12809 prevents the target model type of a data import session from being changed after the import has started, closing a gap where a user could bypass the authorization check performed against the original target model.

Stock Locate Permission Check

PR #13000 adds a missing permission check to the “locate stock” plugin action endpoint, which previously allowed any authenticated user to trigger the action and enumerate stock regardless of their assigned role.

Additional Hardening

A number of smaller permission and hardening fixes are also included in this release:

Security Advisories

The following security advisories have been published in relation to this release:

For more information, please refer to our security advisories page

Database Changes

This release includes a number of changes to the underlying database schema and data validation. As always, a backup of your database is recommended before performing the update.

Legacy Session Table Cleanup

PR #12675 removes a legacy database table left behind on older installations that predate the removal of the django-user-sessions package, fixing a foreign-key error that could occur when deleting a user. PR #12697 is a follow-up fix ensuring this migration also runs correctly on MySQL-backed installations.

Notes Migration Fix for MySQL

PR #12808 fixes the data migration introduced by the notes refactor (PR #11971), which did not run correctly on MySQL due to differences in how that backend returns rows created via bulk_create. Migration regression testing is now performed against all supported database backends to catch this class of issue earlier.

Shipment & Address Contact Fields

PR #13016 adds a contact field to the SalesOrderShipment model, and phone_number and email fields to the Address model, allowing more complete contact details to be recorded against shipments and addresses.

New Features

Internal Companies & Purchase Order Delivery Address

PR #13017 introduces the concept of an “internal” company — a flag on the Company model used to represent your own organization, configurable via the new INVENTREE_DEFAULT_INTERNAL_COMPANY setting and exposed to report templates as internal_company. Building on this, PR #9768 adds a dedicated delivery address field to purchase orders, which must reference an internal company.

Docker Compose Health Checks

PR #12124 adds health checks to each container in the Docker Compose stack, with dependent containers now waiting for their dependencies to report healthy before starting (for example, the worker waits on the server, and the server waits on the database and cache).

Cut-to-Length BOM Items

PR #12422 adds piece_count and piece_size fields to BOM items, for assemblies that require a number of discrete pieces cut from continuous stock such as cable, tubing, or structural profiles. When a piece size is specified, the total required quantity is calculated automatically, while still preserving the per-piece information needed for purchasing and production.

Persistent Previous/Next Navigation

PR #12585 improves detail-page navigation from filtered tables: Previous and Next controls now remember the filtered result set via the URL, and a subtle “x of y” indicator shows your position within it, making it much easier to step through a filtered list of parts, orders, or other items.

Bulk-Edit Return Order Line Items

PR #12635 allows the outcome of multiple return order line items to be changed at once, rather than editing each line individually.

Expanded Identity Federation: SCIM, OIDC & SAML

This release brings together a larger identity federation initiative. PR #12713 adds SCIM 2.0 support for provisioning users and groups from an external identity provider. PR #12731 switches the built-in OIDC/OAuth2 provider on by default (previously available but opt-in), and consolidates the related settings into the Admin Center. PR #12799 rounds this out with a guided SAML configuration helper in the frontend, making it easier to connect InvenTree to a SAML-based identity provider.

Plugin Well-Known URLs

PR #12698 adds a mixin allowing plugins to register entries under the .well-known path, useful for authentication discovery and other system integrations.

Faster Bulk Data Import

PR #12792 adds an opt-in bulk-create mode to the import-records management task, dramatically speeding up large dataset imports (in testing, a 1.2 million row dataset dropped from around 16 minutes to roughly 1 minute).

Stock Location Owner Field in the UI

PR #12826 exposes the Owner field on the stock location create/edit form, restoring parity with the stock item form and matching documented (but previously missing) UI behavior.

Rotated Table Headers

PR #12837 adds a user setting which renders long table column titles vertically rather than horizontally, saving significant horizontal space in parameter-heavy tables. The option is off by default.

Hide Unused Order Types from the UI

PR #12842 adds administrator toggles to fully hide Sales Order, Purchase Order, or Build Order functionality from the interface, for instances that don’t make use of them.

Plugin Custom Pages

PR #12900 adds a new route UI feature type, allowing plugins to register entirely new frontend pages (served under /web/plugin/<plugin>/...) in addition to the existing panel and dashboard widget integration points.

Default Receive Location

PR #12911 adds a global setting to configure a default stock location for receiving items against purchase orders.

Global Batch Code for Purchase Order Receipt

PR #12912 adds a batch code that can be set once when receiving a purchase order and applied across all received items, with the option to override it on individual line items.

Background Task Timeouts & Single-Shot Mode

PR #12913 adds per-task timeout configuration and an optional single-shot mode (disabling automatic retry on failure) for background tasks, giving more control over long-running or non-idempotent jobs.

Per-User Notification Localization

PR #12944 renders notification emails and in-app messages in each recipient’s own language preference, rather than the server process’s default locale, with efficient per-locale batching for email delivery.

Nested BOM Display

PR #12952 implements a true nested BOM view, replacing the previous reduced-dataset subassembly table and displaying the total quantity of each sub-item — including across multiplier chains of nested subassemblies.

Pinned, Resizable Navigation Sidebar

PR #12974 adds an optional side-by-side navigation tree that stays pinned alongside the main content. It can be resized via a splitter (collapsing automatically when dragged small), and toggled on from user settings or a pin button in the header.

First-Time User Guide

PR #12978 adds a short, dismissible onboarding tour for new users, along with backend data structures to support further guided tours in future releases.

Plugin Reload Cycle Detection

PR #13007 improves automatic plugin reload handling and documents its limitations — binary plugins and changed dependencies cannot be hot-reloaded. The system now detects and reports plugin reload cycles instead of looping indefinitely.

Bug Fixes

As always, we have provided a number of bug fixes with this release. Thanks to the many community members who have contributed to identifying and resolving these issues!

Contributing

InvenTree is an open source project, and we welcome contributions from the community. There are many ways to contribute to the project, including code contributions, translation efforts, documentation improvements, and financial support.

New Contributors

As always we would like to thank all of our contributors for their hard work and dedication to the InvenTree project. In particular, we would like to welcome the following new contributors who have made their first contributions in this release:

Code Contributions

Check out our GitHub page for a list of outstanding issues and feature requests. If you are a developer or want to become one, you can help to contribute to the project by submitting a pull request.

Translation

Our translation efforts continue to grow, with coverage increasing across a wide range of languages. We are grateful to all of our translators who have contributed to making InvenTree accessible to users around the world.

If you are interested in contributing to the translation efforts, please visit our Crowdin project and join the community of translators.

Documentation / Technical Writing

If you have experience with technical writing, you can help to improve the InvenTree documentation. We are always looking for help to improve the documentation and make it more accessible to new users.

Report Bugs

If you encounter a bug in InvenTree, please report it on our GitHub issues page. Please ensure that you provide as much information as possible to help us diagnose and fix the issue.

Financial Contributions

Sponsorships help to keep this project sustainable, and buys time for the core developers to commit to the project. A recurring or one off sponsorship is a great way to help InvenTree development to continue at full steam!

The work undertaken to keep InvenTree running is done by a very small group of core developers, who do so in their spare time (and are not sponsored by their employers to work on InvenTree). If you benefit from the InvenTree project, please consider contributing to maintain vibrant development of this software!

If you are using InvenTree in a commercial setting, please consider sponsoring the project to help support ongoing development and maintenance. Your support is greatly appreciated and helps to ensure that InvenTree remains a viable and sustainable project for years to come.

If your company benefits from InvenTree, please consider a one time sponsorship or a recurring sponsorship to help support the project.