v8.8.1

> [!CAUTION]  
>  **This  version of Snipe-IT REQUIRES PHP 8.2.0 or greater, 8.4+ recommended.** PHP 8.2 is still in security release support until 31 Dec 2026, but let's not play that game - and some of the new features we're working on will require PHP 8.3+, so... get on that, ferreal!

Happy Monday (or Tuesday, depending on timezone), nerds!

Whew! We've moving at light speed, but so much good stuff to share with you. 

<details>
<summary>Cringey millennial meme</summary>
<img width="348" height="261" alt="kid" src="https://github.com/user-attachments/assets/6cab011a-6878-4c0b-8d67-3cb0deacf07e" />
</details>

LOTS of work on the new sync adapters - and **thank you** ALL who have given us feedback on them. We don't have direct access to every one of them, so your quick feedback has been able to help us improve them for everyone. They *are* still in beta, but we love that folks are already integrating them. Of all the features we've released in the past few years, this one really seems to have landed, and we're thrilled. 

## The Highlight Reel

There have been **673 commits** since the last tagged release (v8.8.0), **77 issues resolved**, and **81 security fixes**.

<details>
<summary>Cringey millennial security-meme</summary>
<img width="250" height="150" alt="computer-panic" src="https://github.com/user-attachments/assets/93bc76e9-9710-481b-8708-7638ebe67b3b" />
</details>

Don't be too spooked by the CVEs in the changelog. None of them ever hit production as they're largely dev tools or dependencies that never surface in the end product, but it's important to keep up to date on these things. 

### 🎥 Checkbox multi-select dropdowns

Some (where appropriate) multi-select dropdowns in Snipe-IT now render with actual checkboxes next to each option. You'll mostly see this on very long lists where the "tag-style" multi-select kind of sucked. 

![Checkbox multi-select demo](https://github.com/user-attachments/assets/569e2e05-af73-4831-9533-97f36493f638)

### 🎥 Label Editor

You can now build, tweak, preview and save your own label layouts without fighting template files thanks to some [big changes with the label engine](https://github.com/grokability/snipe-it/pull/18938). Great work from @Godmartinz! 

Create a new custom label from scratch, go nuts! Choose either a sheet or tape label, configure its dimensions and layout, and then customize its content, supported features, and appearance in the label editor.

<img width="800" height="773" alt="CleanShot 2026-08-13 at 10 45 47" src="https://github.com/user-attachments/assets/9f9600dd-1465-449f-8225-8f3546a7723c" />

You can also import a previously exported custom label configuration from a JSON file or by pasting the configuration text. The imported label can then be reviewed, edited, and saved as a new custom label. This allows for crowdsourcing labels, which we're hoping will help the entire community. 

... and tons more. Check it out here: https://github.com/grokability/snipe-it/pull/18938

![Label editor demo](https://github.com/user-attachments/assets/a11b306f-db12-4cf2-9bbe-a1495091d32a)

### 🎥 Bulk actions and archive for Components, Consumables, and Accessories - and marking Consumables as "consumed"

You can now bulk edit, bulk delete, bulk check in, and archive without actually deleting. Consumables got a similar pass, and we added a new "mark as consumed" option for assignments that aren't coming back.

![Components bulk demo](https://github.com/user-attachments/assets/e37cb29c-14d7-474e-9ad9-a6ff5d29d3bd)

### Bulk reminders for unaccepted items

We added a select-all or selective send checkbox UI to the unaccepted items UI. (Note: That interface has also moved *out* of the reports section, since it kinda didn't belong there to start with.)

We also added a new API endpoint so you can wire this up to a cron and send regular reminders at whatever cadence you like.

<img width="1509" height="803" alt="Screenshot 2026-10-19 at 10 50 18 PM" src="https://github.com/user-attachments/assets/d4669986-8cd8-453b-ab8a-ae5e1fa15e84" />


<img width="935" height="603" alt="Screenshot 2026-10-19 at 10 50 29 PM" src="https://github.com/user-attachments/assets/64d74046-bdb4-4710-97dd-25250b1479f9" />

### Company-specific webhooks for check-in and check-out

If you run FMCS with per-company Slack or Teams channels, check-in and check-out webhooks now route to the company's own integration instead of a shared global one. 

### Sync adapters updates

A ton happened on the adapter side this release, in no small part to the incredibly quick feedback we got from the community.

<details>
<summary>Cringey millennial thanks meme</summary>
<img width="500" height="211" alt="thanks-satan" src="https://github.com/user-attachments/assets/c89ca44b-4195-41b1-a70e-efef6a68c5d8" />
</details>

- The Intune settings page gained a new Custom Extras widget where you can pair any Snipe-IT custom field with a dot-path into the vendor record (for example `hardwareInformation.systemManagementBIOSVersion`), and we'll be rolling this out to the other adapters in follow-up releases.
- Intune's preset field list grew from 4 to 28, now including Wi-Fi MAC, storage total and free, encryption state, IMEI, MEID, Azure AD device info, enrollment profile, management cert expiration, and more.
- Intune gained an opt-in per-device enrichment checkbox for Ethernet MAC and Physical Memory, since Graph's LIST endpoint returns null for those (off by default because it adds a Graph call per device).
- Intune also picked up scope tag filters, so you can narrow a sync to tagged devices only.
- Every adapter now has a Model Fieldset default on its settings page, so any asset model the adapter has to auto-create gets linked to that fieldset.
- Every adapter now has a Skip-adding-new-assets checkbox, for folks who want sync to only update existing records and never create.
- AxM MAC addresses now come out colon-formatted and uppercased (`01:23:45:67:89:AB`), so the `mac_address` custom-field validator stops rejecting them.
- AxM dual-SIM IMEIs are now handled correctly, with `abm_imei_1` and `abm_imei_2` as separate mapping targets (see the upgrade note below if you had `abm_imei` mapped).
- Jamf Pro asset-tag push now writes to `general.assetTag` instead of `userAndLocation.assetTag`, which Jamf was silently discarding.
- Sync adapter pagination no longer loses the query string on the last page.
- `last_seen` now honors `APP_TIMEZONE` properly.
- Model constraints are enforced across adapters and the importer.
- Breadcrumb trails now extend into adapter sub-tabs so you know where you are (🎥 in [#19859](https://github.com/grokability/snipe-it/pull/19859)).

> [!NOTE]  
>  **Sync Adapters are still in beta** They're coming along *great*, but it's important to know that they're a work in progress. We're working tirelessly to make them fit every integration, but they are still beta, so use them at your own risk.


### Entra SCIM de-provisioning no longer fails when employeeNumber changes

If an Entra tenant flipped a user to inactive in the same PATCH that updated their `employeeNumber`, the whole PATCH would 500 on the enterprise-schema op and the user wouldn't actually get deactivated. We now scan every schema node for the attribute before giving up. If you were hitting the Entra de-provisioning failure, you'll get working de-provisioning back automatically after upgrade with no config change needed.

Docs note: we're in the middle of updating [the docs](https://snipe-it.readme.io) to reflect all the new features, screenshots, and changes in this release. If you see something in the app that isn't in the docs yet, that's why. We're working through them.

# Upgrading

Same as always, run `php upgrade.php` from your Snipe-IT directory. Full walkthrough at [snipe-it.readme.io/docs/upgrading](https://snipe-it.readme.io/docs/upgrading).


### A couple of upgrade heads-ups

<details>
<summary>Cringey millennial knowing stuff meme</summary>
<img width="500" height="300" alt="ed-guy-with-the-gun" src="https://github.com/user-attachments/assets/b8a49041-ad32-4ca9-bfc3-3eb87886baed" />

</details>

- If you were using the AxM adapter and had `abm_imei` mapped to a custom field, you'll need to re-map it to `abm_imei_1` (and optionally `abm_imei_2` for dual-SIM devices), because the old key is no longer in the picker.
- If you had any custom integration on the Jamf side relying on `userAndLocation.assetTag`, you'll want to update it, because the push now writes to `general.assetTag` where Jamf actually stores asset tags.

## Quick update on the official mobile app

Thanks (yet again) for all of the feedback! You've all been amazing, and we should be ready to go into public beta by the end of the month!

## What's Changed
* Notifications: Fixed #19719 - Added location to checkout and checkin email by @marcusmoore in https://github.com/grokability/snipe-it/pull/19740
* Fixed #19752 - add checkbox to skip adding new assets if no existing match in Snipe-IT by @snipe in https://github.com/grokability/snipe-it/pull/19756
* Sync Adapters: Fixed #19755 - preserve query string when pagination is empty by @snipe in https://github.com/grokability/snipe-it/pull/19757
* Fixed #19754 - handle two IMEI numbers, format MAC addresses by @snipe in https://github.com/grokability/snipe-it/pull/19758
* Fixed #19745 - added additional known fields from Intune API by @snipe in https://github.com/grokability/snipe-it/pull/19759
* De-normed company ID on calendar events table by @snipe in https://github.com/grokability/snipe-it/pull/19764
* Notifications: 🖼️ Run Check in/outs through Company specific webhook integrations by @Godmartinz in https://github.com/grokability/snipe-it/pull/19669
* Depreciations: Adds Diminishing Values Depreciation by @Godmartinz in https://github.com/grokability/snipe-it/pull/19331
* Sync Adapters: Fixed #19765 - `last_seen` not honoring `APP_TIMEZONE` by @snipe in https://github.com/grokability/snipe-it/pull/19768
* Fixed #19762 - enforce model constraints on sync adapters, importer by @snipe in https://github.com/grokability/snipe-it/pull/19771
* Fixed incorrect namespace reference in action_logs table by @marcusmoore in https://github.com/grokability/snipe-it/pull/19748
* Notifications: Replace "Asset" with "Accessory" in accessory checkin email by @marcusmoore in https://github.com/grokability/snipe-it/pull/19742
* Notifications: Remove extra QTY in consumable checked out email by @marcusmoore in https://github.com/grokability/snipe-it/pull/19741
* Tests: Pass `private_key_bits` to `openssl_pkey_new` in tests by @marcusmoore in https://github.com/grokability/snipe-it/pull/19739
* Calendar Events: Fixes calendar reservations for deleted assets by @Godmartinz in https://github.com/grokability/snipe-it/pull/19776
* Fixed #19770 - Restore tool not pruning files by @snipe in https://github.com/grokability/snipe-it/pull/19773
* 🎥 Adds a new Label Editor by @Godmartinz in https://github.com/grokability/snipe-it/pull/18938
* Acceptances - Fixed #19080 - Allow resending accepted checkout acceptances by @marcusmoore in https://github.com/grokability/snipe-it/pull/19638
* More enum replacements (part two of #19773) by @snipe in https://github.com/grokability/snipe-it/pull/19782
* 🎥 Console: Orphan file detector improvements by @snipe in https://github.com/grokability/snipe-it/pull/19783
* Sync Adapters: Added scope tag filters for InTune by @snipe in https://github.com/grokability/snipe-it/pull/19788
* Fixes CVE-2024-24821, CVE-2026-107380, CVE-2026-107379 in enshrined/svg-sanitize by @joelpittet in https://github.com/grokability/snipe-it/pull/19794
* Fixes CVE-2026-67434 in squizlabs/php_codesniffer by @joelpittet in https://github.com/grokability/snipe-it/pull/19795
* Fixes CVE-2026-45073 in symfony/cache by @joelpittet in https://github.com/grokability/snipe-it/pull/19796
* Fixes PKSA-m4t9-vsgq-8khn and PKSA-m2dq-1fhr-29b1 in league/commonmark by @joelpittet in https://github.com/grokability/snipe-it/pull/19797
* Fixes CVE-2026-54133 in mtdowling/jmespath.php by @joelpittet in https://github.com/grokability/snipe-it/pull/19798
* Fixes PKSA-32g2-byr9-drtw in paragonie/sodium_compat - Incorrect Ed25519 public key validation by @joelpittet in https://github.com/grokability/snipe-it/pull/19800
* Fixes CVE-2026-55599 and CVE-2026-84308 in phpseclib/phpseclib by @joelpittet in https://github.com/grokability/snipe-it/pull/19801
* Fixes CVE-2026-102279 in laravel/framework by @joelpittet in https://github.com/grokability/snipe-it/pull/19802
* Fixes CVE-2026-81887 in livewire/livewire by @joelpittet in https://github.com/grokability/snipe-it/pull/19803
* Temporarily align css-loader dependencies while awaiting Vite migration by @joelpittet in https://github.com/grokability/snipe-it/pull/19804
* Security: update brace-expansion to 1.1.21 by @joelpittet in https://github.com/grokability/snipe-it/pull/19814
* 🎥 Added checkbox select2s for multiselect boxes by @snipe in https://github.com/grokability/snipe-it/pull/19815
* Bump shivammathur/setup-php from 2.37.2 to 2.40.0 by @dependabot[bot] in https://github.com/grokability/snipe-it/pull/19817
* Sync Adapters: Added default fieldset selection for newly created models by @snipe in https://github.com/grokability/snipe-it/pull/19821
* Continue converting query scopes into builders by @snipe in https://github.com/grokability/snipe-it/pull/19830
* Add Token support for AWS services by @uberbrady in https://github.com/grokability/snipe-it/pull/19829
* Install IDE-Helper dev package by @snipe in https://github.com/grokability/snipe-it/pull/19831
* Converted accessory, asset model, component and consumable query scopes to builders by @snipe in https://github.com/grokability/snipe-it/pull/19832
* Last of the builder conversions by @snipe in https://github.com/grokability/snipe-it/pull/19833
* Fixed RB-21669 - chunk purge rows so they don’t blow past mysql limits by @snipe in https://github.com/grokability/snipe-it/pull/19836
* Fixed #19624 - install mariadb-client on docker installs by @snipe in https://github.com/grokability/snipe-it/pull/19838
* Fixed #19636 - Added sed rewrite for Apache non-standard ports by @snipe in https://github.com/grokability/snipe-it/pull/19839
* Some phpstan cleanup, cleaned up orphaned comments from the builder move by @snipe in https://github.com/grokability/snipe-it/pull/19842
* Nicer print view on detail pages with info panels by @snipe in https://github.com/grokability/snipe-it/pull/19843
* 🎥 Components: Added bulk edit/delete, ability to archive, and bulk checkin by @snipe in https://github.com/grokability/snipe-it/pull/19847
* Fixes CVE-2026-108082 in symfony/http-foundation by @joelpittet in https://github.com/grokability/snipe-it/pull/19845
* Fixed #19470 - Add archiving to accessories by @snipe in https://github.com/grokability/snipe-it/pull/19855
* Fixes: CVE-2026-109413 - symfony/yaml Unbounded Recursion in the YAML Inline Lexer Lets a Document Crash the Process by @joelpittet in https://github.com/grokability/snipe-it/pull/19844
* Added #19696: Sophos Central sync adapter by @bjhinkle in https://github.com/grokability/snipe-it/pull/19825
* Add archive and bulk to consumables, added ability to mark assignments as "consumed" by @snipe in https://github.com/grokability/snipe-it/pull/19858
* 🎥 Extend the adapter breadcrumb scheme to other tabs by @snipe in https://github.com/grokability/snipe-it/pull/19859
* Fixed #19620 - Made avatar db column wider to accommodate long external URLs by @snipe in https://github.com/grokability/snipe-it/pull/19860
* Fixed #19809 - link Needs Attention to specific views by @snipe in https://github.com/grokability/snipe-it/pull/19861
* Labels: Fixes row count of Avery_3490_A by @Godmartinz in https://github.com/grokability/snipe-it/pull/19846
* Fixed: Custom User Label 404 redirect route by @marcusmoore in https://github.com/grokability/snipe-it/pull/19864
* Fixed #19811 - added bulk unaccepted reminders by @snipe in https://github.com/grokability/snipe-it/pull/19863


**Full Changelog**: https://github.com/grokability/snipe-it/compare/v8.8.0...v8.8.1