logo InvenTree
go back Back

1.7.0 Release

03 Nov 2026 Oliver

InvenTree 1.7.0 has been released! This release includes a critical security fix, a number of new features, improvements, and bug fixes. We recommend all users to update to this version as soon as possible.

Changelog

Major changes are documented in the CHANGELOG.md file in the repository. For a full list of changes, please refer to the release notes.

Update Procedure

To update to the latest version of InvenTree, please follow the updating instructions provided in the InvenTree documentation. Note that the particular update procedure may vary depending on your installation method.

Security Fixes

This release contains a fix for a critical, low-complexity privilege escalation vulnerability, affecting a range of releases since 2025. Full details, including the associated security advisory, will be published shortly after release — please see our earlier announcement and watch our security advisories page for the disclosure. If you have not already done so, please update to 1.7.0 as a priority.

A number of other security vulnerabilities and hardening improvements are also included in this release.

Security Advisories

The following security advisories have been published in relation to this release:

CSV Export Formula Injection

PR #13084 sanitizes user-controlled data before it is written into exported CSV files, preventing CSV injection attacks where a crafted cell value could execute a formula when the export is opened in a spreadsheet application. PR #13110 is a follow-up fix which relaxes this escaping for legitimate numeric values.

Report Data Hardening

PR #13111 hardens data access during report generation, excluding sensitive data from the report rendering context and preventing database writes from being triggered as a side effect of generating a report or label.

Session & Token Hardening

Several related fixes tighten up session and API token handling in this release:

Additional Hardening

This release also includes routine security-related dependency updates, including CA certificate updates (PR #13057) and a batch of Python dependency security patches (PR #13108).

Breaking Changes

While we strive to maintain backward compatibility, there are some breaking changes in this release. While many of these are minor, and should not affect most users, we recommend that you review the list of breaking changes to ensure that your installation will continue to function as expected after the update. Each breaking change is documented in detail at the links below:

Pricing Model Refactor

PR #13034 moves pricing functionality into a new, dedicated pricing app, with its own API endpoints and a new “pricing” permission role. Existing users with part role permissions automatically retain pricing access via a data migration, laying the groundwork for further pricing improvements in future releases.

Stock Tracking Replaced by Audit Log

PR #13101 removes the legacy “stock item tracking” model and its associated API endpoints, migrating existing entries into the new global audit log introduced in this same release (see “Changelog / Edit History” under New Features, below). The old stock tracking table only ever captured a subset of model changes; the audit log provides a more complete and consistent record. Any external client applications which read stock tracking data via the old API will need to be updated to use the new /api/audit/ endpoints.

New Features

Changelog / Edit History

PR #13069 introduces a global audit log, built on django-auditlog, which tracks changes made to internal data throughout the system. The log is exposed via new read-only /api/audit/ endpoints, and replaces the previous, more limited stock tracking table (see Breaking Changes, above).

Token Issuance Notifications

PR #13141 notifies a user whenever a new API token is issued against their account — whether via the API, the UI, or by an administrator — and separately warns administrators if no email backend is configured, meaning such security alerts cannot be delivered.

Plugin-Launched Forms & Action Context

PR #13174 allows plugins to dynamically launch native modal forms without needing to supply their own React components — for example, triggering a built-in API form from a custom primary action. PR #13172 complements this by passing the current page’s target model and instance ID through to plugin-registered primary actions, giving plugins more context about where they were triggered from.

Stock Adjustment Barcode Actions

PR #13170 implements a number of previously-stubbed stock adjustment actions for barcode scanning, rounding out barcode-driven workflows for adjusting stock.

Default Stock Location from Part

PR #12916 automatically selects the default stock location for a new stock item, if one has been configured against the part being stocked.

Instance Identity Proof for Federation

PR #13030 adds an optional mechanism for an InvenTree instance to cryptographically prove its identity to a federation participant, without exposing its instance ID directly. A time-limited, replayable proof is computed using HKDF and HMAC, and can be requested as an optional parameter on the root API response — early groundwork for future federation work.

Badge Tooltips

PR #13074 adds explanatory tooltips to the status badges shown on detail pages, making it clearer at a glance what each badge represents.

Bug Fixes

As always, we have provided a number of bug fixes with this release. Thanks to the many community members who have contributed to identifying and resolving these issues!

Contributing

InvenTree is an open source project, and we welcome contributions from the community. There are many ways to contribute to the project, including code contributions, translation efforts, documentation improvements, and financial support.

New Contributors

As always we would like to thank all of our contributors for their hard work and dedication to the InvenTree project. In particular, we would like to welcome the following new contributors who have made their first contributions in this release:

Code Contributions

Check out our GitHub page for a list of outstanding issues and feature requests. If you are a developer or want to become one, you can help to contribute to the project by submitting a pull request.

Translation

Our translation efforts continue to grow, with coverage increasing across a wide range of languages. We are grateful to all of our translators who have contributed to making InvenTree accessible to users around the world.

If you are interested in contributing to the translation efforts, please visit our Crowdin project and join the community of translators.

Documentation / Technical Writing

If you have experience with technical writing, you can help to improve the InvenTree documentation. We are always looking for help to improve the documentation and make it more accessible to new users.

Report Bugs

If you encounter a bug in InvenTree, please report it on our GitHub issues page. Please ensure that you provide as much information as possible to help us diagnose and fix the issue.

Financial Contributions

Sponsorships help to keep this project sustainable, and buys time for the core developers to commit to the project. A recurring or one off sponsorship is a great way to help InvenTree development to continue at full steam!

The work undertaken to keep InvenTree running is done by a very small group of core developers, who do so in their spare time (and are not sponsored by their employers to work on InvenTree). If you benefit from the InvenTree project, please consider contributing to maintain vibrant development of this software!

If you are using InvenTree in a commercial setting, please consider sponsoring the project to help support ongoing development and maintenance. Your support is greatly appreciated and helps to ensure that InvenTree remains a viable and sustainable project for years to come.

If your company benefits from InvenTree, please consider a one time sponsorship or a recurring sponsorship to help support the project.