Merge 'release-1.11' to 'develop' with resolved conflicts.

[ogenstad]

Why

Bring latest changes from release-1.11 to develop.

Replaces #10236

What changed

• All changes from the release-1.11 branch
• Trivial merge conflict in backend/infrahub/core/migrations/query/attribute_rename.py

The signature of AttributeRenameQuery.query_init changed **kwargs: dict[str, Any] -> **kwargs: Any, and then two removed methods above this one had to be deleted.

[codspeed-hq]

Merging this PR will not alter performance

✅ 13 untouched benchmarks

---

_{Comparing pog-release-1.11-to-develop (438afdc) with develop (e8b22b7)}

[cubic-dev-ai]

7 issues found across 127 files

Confidence score: 3/5

• backend/infrahub/database/validation.py does not exclude deleted or closed relationship versions from the duplicate-path check, so valid attribute or edge updates may be rejected as duplicates — add optional matching and active-edge filters to the Cypher queries.
• docs/docs/release-notes/infrahub/release-1_11_0.mdx claims its Breaking changes summary is complete while omitting documented changes, and docs/sidebars.ts renames IPAM URLs without updating docs/redirects-pending/ipam.yml; reconcile the release content and redirect tracking.
• docs/docs/ipam/build-your-ipam-schema.mdx references an undefined or unloaded ServiceGeneric, while dev/guides/backend/creating-migrations.md cites a decorator example with the wrong transaction name; align both examples with the actual definitions and implementation.
• tests/e2e/preferences/test_global_preferences.py does not verify that the inherited value is correct, and .vale/styles/spelling-exceptions.txt contains a duplicate netmask entry; strengthen the value assertion and remove the duplicate exception.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".vale/styles/spelling-exceptions.txt">

<violation number="1" location=".vale/styles/spelling-exceptions.txt:164">
P3: Custom agent: **Flag AI Slop and Fabricated Changes**

The added `netmask` entry duplicates the existing entry after `Neo4j`. Remove one of the two entries to keep the spelling exception list unique.</violation>
</file>

<file name="backend/infrahub/database/validation.py">

<violation number="1" location="backend/infrahub/database/validation.py:189">
P2: Custom agent: **Check Cypher queries that update attributes/edges for optional matching and active-edge checks**

The duplicate-path check includes deleted or closed relationship versions because it never filters `e` to the active, `to IS NULL` edge. Filter historical edges before grouping so `verify_graph()` reports only duplicate current paths.</violation>
</file>

<file name="dev/guides/backend/creating-migrations.md">

<violation number="1" location="dev/guides/backend/creating-migrations.md:73">
P3: The doc tells the reader to reapply `@retry_db_transaction(name="schema_migration")` and cites `node_relationship_remove.py` as the worked example, but that file's decorator actually uses `name="relationship_remove_schema_migration"` (node_relationship_remove.py:260). Align the doc with the cited example (or drop the explicit name) so the retry metric label matches the code it points to, instead of colliding with the base class's `schema_migration` retry counter.</violation>
</file>

<file name="docs/sidebars.ts">

<violation number="1" location="docs/sidebars.ts:164">
P2: The IPAM sidebar entries are renamed from released page URLs to new ones, but the redirect-tracking document docs/redirects-pending/ipam.yml still lists the old paths (ip-namespaces, building-your-schema, automate-with-resource-manager) as the intended structure. Per the docs AGENTS.md binding rule, renamed/deleted published pages need a redirect entry; update redirects-pending/ipam.yml (and the stale reference in docs/release-notes/infrahub/docs-restructure.mdx) to map the old URLs to the new build-your-ipam-schema / use-namespaces / allocate-ips-and-prefixes pages so the old published URLs keep resolving.</violation>
</file>

<file name="tests/e2e/preferences/test_global_preferences.py">

<violation number="1" location="tests/e2e/preferences/test_global_preferences.py:66">
P3: The test verifies only that an organisation default exists and its source hint appears, not that the correct value is inherited. The tooltip text is `From the organisation default: <value>` and the substring assertion passes for any value, so a regression that inherits the wrong format would not be caught. Assert that the inherited value equals GLOBAL_DATE_FORMAT on the read-only page (and optionally that the ISO browser default is not shown) to give the test its stated purpose.</violation>
</file>

<file name="docs/docs/release-notes/infrahub/release-1_11_0.mdx">

<violation number="1" location="docs/docs/release-notes/infrahub/release-1_11_0.mdx:46">
P2: The "Before upgrading ▸ Breaking changes" summary presents itself as complete ("The full Breaking changes section below explains the impact of each"), and its matching "## Breaking changes" section covers only four items. Several other upgrades-blocking changes exist only in the Full changelog and are absent from both: the GraphQL `extensions.code` string migration (line 488), the restricted_namespaces inheritance restriction which the notes themselves say makes the upgrade fail to complete if violated (line 506), the reserved `node_metadata` name (line 474), and `BuiltinIPPrefix.resource_pool` now returning `CoreIPPool` (line 583). An operator reading the summary would miss required pre-upgrade actions for these. Either add the missing changes to the upfront summary or soften the completeness claim.</violation>
</file>

<file name="docs/docs/ipam/build-your-ipam-schema.mdx">

<violation number="1" location="docs/docs/ipam/build-your-ipam-schema.mdx:159">
P2: The extensions example pairs `IpamIPPrefix` with `peer: ServiceGeneric`, but nothing in this guide defines or loads `ServiceGeneric` — the first example's node is `Service` in the `Customer` namespace (`CustomerService`). Copying the block verbatim will fail schema load. Point the peer at the `CustomerService` node defined in the guide (or instruct the reader to load the Service Catalog schema that provides `ServiceGeneric`).</violation>
</file>

<sub>Shadow auto-approve: would not auto-approve because issues were found.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Custom agent: Check Cypher queries that update attributes/edges for optional matching and active-edge checks

The duplicate-path check includes deleted or closed relationship versions because it never filters e to the active, to IS NULL edge. Filter historical edges before grouping so verify_graph() reports only duplicate current paths.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At backend/infrahub/database/validation.py, line 189:

<comment>The duplicate-path check includes deleted or closed relationship versions because it never filters `e` to the active, `to IS NULL` edge. Filter historical edges before grouping so `verify_graph()` reports only duplicate current paths.</comment>

<file context>
@@ -98,10 +171,322 @@ async def verify_no_edges_added_after_node_delete(db: InfrahubDatabase) -> None:
+async def _check_duplicate_paths(db: InfrahubDatabase, kinds: list[str] | None) -> list[GraphViolation]:
+    """Verify that no duplicate paths exist at the database level."""
+    query = """
+MATCH path = (p)-[e]->(q)
+WHERE %(kind_filter)s
+WITH
</file context>

[cubic-dev-ai]

P2: The IPAM sidebar entries are renamed from released page URLs to new ones, but the redirect-tracking document docs/redirects-pending/ipam.yml still lists the old paths (ip-namespaces, building-your-schema, automate-with-resource-manager) as the intended structure. Per the docs AGENTS.md binding rule, renamed/deleted published pages need a redirect entry; update redirects-pending/ipam.yml (and the stale reference in docs/release-notes/infrahub/docs-restructure.mdx) to map the old URLs to the new build-your-ipam-schema / use-namespaces / allocate-ips-and-prefixes pages so the old published URLs keep resolving.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/sidebars.ts, line 164:

<comment>The IPAM sidebar entries are renamed from released page URLs to new ones, but the redirect-tracking document docs/redirects-pending/ipam.yml still lists the old paths (ip-namespaces, building-your-schema, automate-with-resource-manager) as the intended structure. Per the docs AGENTS.md binding rule, renamed/deleted published pages need a redirect entry; update redirects-pending/ipam.yml (and the stale reference in docs/release-notes/infrahub/docs-restructure.mdx) to map the old URLs to the new build-your-ipam-schema / use-namespaces / allocate-ips-and-prefixes pages so the old published URLs keep resolving.</comment>

<file context>
@@ -161,9 +161,11 @@ const sidebars: SidebarsConfig = {
-            'ipam/ip-namespaces',
-            'ipam/building-your-schema',
-            'ipam/automate-with-resource-manager',
+            'ipam/build-your-ipam-schema',
+            'ipam/use-namespaces',
+            'ipam/allocate-ips-and-prefixes',
</file context>

[cubic-dev-ai]

P2: The "Before upgrading ▸ Breaking changes" summary presents itself as complete ("The full Breaking changes section below explains the impact of each"), and its matching "## Breaking changes" section covers only four items. Several other upgrades-blocking changes exist only in the Full changelog and are absent from both: the GraphQL extensions.code string migration (line 488), the restricted_namespaces inheritance restriction which the notes themselves say makes the upgrade fail to complete if violated (line 506), the reserved node_metadata name (line 474), and BuiltinIPPrefix.resource_pool now returning CoreIPPool (line 583). An operator reading the summary would miss required pre-upgrade actions for these. Either add the missing changes to the upfront summary or soften the completeness claim.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/docs/release-notes/infrahub/release-1_11_0.mdx, line 46:

<comment>The "Before upgrading ▸ Breaking changes" summary presents itself as complete ("The full Breaking changes section below explains the impact of each"), and its matching "## Breaking changes" section covers only four items. Several other upgrades-blocking changes exist only in the Full changelog and are absent from both: the GraphQL `extensions.code` string migration (line 488), the restricted_namespaces inheritance restriction which the notes themselves say makes the upgrade fail to complete if violated (line 506), the reserved `node_metadata` name (line 474), and `BuiltinIPPrefix.resource_pool` now returning `CoreIPPool` (line 583). An operator reading the summary would miss required pre-upgrade actions for these. Either add the missing changes to the upfront summary or soften the completeness claim.</comment>

<file context>
@@ -0,0 +1,637 @@
+> - **Generated OpenAPI clients:** Code that depends on the previous component schema names in `openapi.json` needs to be updated and regenerated.
+> - **API backpressure:** Under sustained overload Infrahub now rejects requests with `429 Too Many Requests` and a `Retry-After` header. The web UI and the Python SDK handle this for you; a custom integration that calls the API directly is expected to handle it itself.
+>
+> The full Breaking changes section below explains the impact of each and the action to take.
+
+### Upgrade preparation
</file context>

[cubic-dev-ai]

P2: The extensions example pairs IpamIPPrefix with peer: ServiceGeneric, but nothing in this guide defines or loads ServiceGeneric — the first example's node is Service in the Customer namespace (CustomerService). Copying the block verbatim will fail schema load. Point the peer at the CustomerService node defined in the guide (or instruct the reader to load the Service Catalog schema that provides ServiceGeneric).

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/docs/ipam/build-your-ipam-schema.mdx, line 159:

<comment>The extensions example pairs `IpamIPPrefix` with `peer: ServiceGeneric`, but nothing in this guide defines or loads `ServiceGeneric` — the first example's node is `Service` in the `Customer` namespace (`CustomerService`). Copying the block verbatim will fail schema load. Point the peer at the `CustomerService` node defined in the guide (or instruct the reader to load the Service Catalog schema that provides `ServiceGeneric`).</comment>

<file context>
@@ -0,0 +1,169 @@
+    - kind: IpamIPPrefix
+      relationships:
+        - name: service
+          peer: ServiceGeneric
+          cardinality: one
+          direction: outbound
</file context>

Suggested change

	peer: ServiceGeneric
	peer: CustomerService

[cubic-dev-ai]

P3: Custom agent: Flag AI Slop and Fabricated Changes

The added netmask entry duplicates the existing entry after Neo4j. Remove one of the two entries to keep the spelling exception list unique.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .vale/styles/spelling-exceptions.txt, line 164:

<comment>The added `netmask` entry duplicates the existing entry after `Neo4j`. Remove one of the two entries to keep the spelling exception list unique.</comment>

<file context>
@@ -153,13 +153,15 @@ menu_placement
 namespace
 namespaces
 nats
+netmask
 Nautobot
 Neo4j
</file context>

[cubic-dev-ai]

P3: The doc tells the reader to reapply @retry_db_transaction(name="schema_migration") and cites node_relationship_remove.py as the worked example, but that file's decorator actually uses name="relationship_remove_schema_migration" (node_relationship_remove.py:260). Align the doc with the cited example (or drop the explicit name) so the retry metric label matches the code it points to, instead of colliding with the base class's schema_migration retry counter.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At dev/guides/backend/creating-migrations.md, line 73:

<comment>The doc tells the reader to reapply `@retry_db_transaction(name="schema_migration")` and cites `node_relationship_remove.py` as the worked example, but that file's decorator actually uses `name="relationship_remove_schema_migration"` (node_relationship_remove.py:260). Align the doc with the cited example (or drop the explicit name) so the retry metric label matches the code it points to, instead of colliding with the base class's `schema_migration` retry counter.</comment>

<file context>
@@ -68,6 +70,8 @@ Set `minimum_version` to the current `GRAPH_VERSION` (the migration runs when up
 
 **Transient database errors.** `SchemaMigration` and `GraphMigration` own their transaction and carry `retry_db_transaction`, so a transient error (a deadlock, or an entity a concurrent migration removed) is replayed on a fresh transaction with backoff and jitter instead of failing the migration; their inner query loops let those errors propagate to the transaction owner. This matters when migrations of the same kind run concurrently (schema path migrations execute as a batch). The catch-all `except` shown above belongs to `ArbitraryMigration`/`execute` overrides that run serially during upgrade and record every error as a failed `MigrationResult`; if you override `execute` to own a transaction on a concurrent path, add `retry_db_transaction` and do not catch retriable errors inside the transaction. See [Database Schema — Transaction Retry](../../knowledge/backend/database-schema.md#transaction-retry).
 
+**Overriding `execute` discards the decorator.** A `SchemaMigration` subclass that overrides `execute` to open its own transaction must reapply `@retry_db_transaction(name="schema_migration")` — `node_relationship_remove.py` is the worked example. A subclass that only guards a condition and then delegates to `super().execute(...)` is already covered by the base and must not add it again, or the two retries nest.
+
 ### Step 2: Bump `GRAPH_VERSION`
</file context>

Suggested change

**Overriding `execute` discards the decorator.** A `SchemaMigration` subclass that overrides `execute` to open its own transaction must reapply `@retry_db_transaction(name="schema_migration")` — `node_relationship_remove.py` is the worked example. A subclass that only guards a condition and then delegates to `super().execute(...)` is already covered by the base and must not add it again, or the two retries nest.

**Overriding `execute` discards the decorator.** A `SchemaMigration` subclass that overrides `execute` to open its own transaction must reapply `@retry_db_transaction` with a migration-specific name — `node_relationship_remove.py` reapplies it as `@retry_db_transaction(name="relationship_remove_schema_migration")` and is the worked example. A subclass that only guards a condition and then delegates to `super().execute(...)` is already covered by the base and must not add it again, or the two retries nest.

[cubic-dev-ai]

P3: The test verifies only that an organisation default exists and its source hint appears, not that the correct value is inherited. The tooltip text is From the organisation default: <value> and the substring assertion passes for any value, so a regression that inherits the wrong format would not be caught. Assert that the inherited value equals GLOBAL_DATE_FORMAT on the read-only page (and optionally that the ISO browser default is not shown) to give the test its stated purpose.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At tests/e2e/preferences/test_global_preferences.py, line 66:

<comment>The test verifies only that an organisation default exists and its source hint appears, not that the correct value is inherited. The tooltip text is `From the organisation default: <value>` and the substring assertion passes for any value, so a regression that inherits the wrong format would not be caught. Assert that the inherited value equals GLOBAL_DATE_FORMAT on the read-only page (and optionally that the ISO browser default is not shown) to give the test its stated purpose.</comment>

<file context>
@@ -0,0 +1,66 @@
+        # focus, while hover goes through the warm-up delay — the deterministic
+        # option for CI.
+        await read_only_page.get_by_role("button", name="Where this value comes from").first.focus()
+        await expect(read_only_page.get_by_text("From the organisation default")).to_be_visible()
</file context>