Download Latest Version v8.7.0 source code.zip (27.4 MB)
Email in envelope

Get an email when there's a new version of Snipe-IT

Home / v8.7.0
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2026-08-11 28.9 kB
0
v8.7.0 source code.tar.gz 2026-08-11 23.0 MB
2 2 weekly downloads
v8.7.0 source code.zip 2026-08-11 27.4 MB
18 18 weekly downloads
Totals: 3 Items   50.4 MB 20

[!CAUTION]
This version of Snipe-IT REQUIRES PHP 8.2.0 or greater, 8.4+ recommended. PHP 8.2 is still in security release support until 31 Dec 2026, but let's not play that game

Buckle up, friends. This one has been simmering on develop for a while and it turned into a proper feast. 1,182 commits across 136 pull requests, several long-running feature branches finally released, and a lot of little "oh crap THAT was still broken?" cleanups along the way. Grab a coffee.

let-me-explain-sum-up

The Highlight Reel

Replenish and orders (for real this time)

Accessories, consumables, and components now have proper "add stock" and "remove stock" flows with a ledger. Instead of admins hand-editing the qty field on a parent row and hoping for the best, every quantity change writes an action-log entry with the delta, a note, and (optionally) an order number. This leads the way to orders being a real first-class object that you can start from and add things to. (That's not here yet, but it's coming.)

Replenish flow

We skipped licenses for now, as they have a more complex structure, but we wanted to get at least these three into your hands now.

LDAP wizard, from monolith to multi-step

The mile-long "LDAP settings" blade has been retired to a nice pasture. In its place: a four-step Livewire wizard (Connection → Auth + Scope → Attribute Mapping → Sync + Defaults) with a per-step "Test connection" button so you can find out you fat-fingered the bind DN before you save. Department and group sync now runs on first login too, so people don't show up in Snipe-IT as departmentless ghosts until an admin manually pokes them. We still include - for now - a link to the old LDAP form just in case any issues come up.

LDAP wizard

We also fixed a handful of fields that were not named correctly and therefore were never correctly mapping. Yay!

SCIM: now with Okta and Microsoft Entra multi-company support

Entra/Okta (and possibly others) were rejecting Snipe-IT's SCIM responses for multi-company setups. Not anymore. Also fixed: SCIM group handling, SCIM addresses handling, and a nested-attributes case that could throw a 500. If you've been avoiding automated SCIM provisioning because it "mostly" worked, come back and try again. (Srsly, SCIM rules.)

Requestable accessories

Users can now request accessories from the requestable-items link, not just assets and asset models. Same familiar request flow, same admin queue, just with a wider net of things people can ask for. (We're going to be refactoring requestables in the next few weeks as well, to work out some of the friction points folks have been surfacing over time.)

Superuser Impersonation

Superusers can now impersonate other users to reproduce a bug report without needing the user's password. Great for "I clicked the button and nothing happened" requests where you can't tell if it's a permission gate, a browser thing, or wishful thinking.

Impersonation

This is OP by design, so it requires extra steps. You'll need to add ALLOW_USER_IMPERSONATION=your-username to your .env (with your-username being the username you want to grant impersonation abilities to) to enable this. Superusers cannot impersonate each other.

Transfer all items between users

When someone leaves the company, one click moves every asset/ accessory/consumable/license assigned to them over to their replacement.

Transfer user items

Optional password on user creation

For SSO-only shops or orgs where the user is never going to login, the "password required" fields are now optional. If the "this user can login" button is checked, the password field is required, otherwise it's hidden.

No-password user creation

Quickscan check-in by serial

Quickscan check-in now accepts either an asset tag OR a serial number. Barcodes can vary in what they encode, so this stops the "wait, our label prints the serial not the tag" problems.

Component report

Long-requested. A proper component-level report showing what's assigned where, plus its own bulk actions.

Component report

Importer wizard

The CSV importer got the same treatment as LDAP: proper wizard flow with column mapping, preview, and clearer error surfacing when a row won't take. alert_on_response on category imports now actually gets read, API-driven asset imports stop writing null created_by, and the general "why did this row fail" story is a whole lot better.

Importer wizard

Backup + restore safety net

Restore actually validates the uploaded archive now, AND takes a safety backup of the current database BEFORE it wipes anything. If the restore then blows up, you get a pointer to the pre-restore backup file instead of an empty database and a heart attack. Backups also got a tooltip explaining the pruning behavior, and the pre-restore snapshot honors your DB prefix if you're using one.

Backup safety

Bulk everything (well, almost)

Bulk operations expanded to (deep breath): audit, delete-accessories, delete-companies, delete-departments, delete-depreciations, delete-status-labels, delete-imports, delete-licenses, checkin-with-location. The refactored bulk-actions dropdown now dynamically enables/disables actions based on what's actually valid for the selected rows, so you can't accidentally try to "bulk restore" a batch of items that aren't deleted.

FMCS Floater Mode

We added a new setting in Admin > General called "floater mode". This allows items/users with no company assigned to "float" and be visible to everyone. With floater mode enabled with FMCS:

  • A user in Company A can see their own company's records AND every uncompanied record.
  • A user with no company can see every record in the system.
  • An asset with no company can be checked out to anyone.
  • Any asset can be checked out to a target that has no company.

Read more about FMCS and floater mode in the docs!

UI + accessibility

  • CSS sticky columns replace the bootstrap-table fixed-columns extension across the board. No more jagged / drifting last-column overlay on narrow viewports. The old fixed-columns extension is out of the bundle entirely.
  • Alert menu now Livewire-driven, no more full-page refresh to see a new alert appear, and this should result in faster page loads overall for folks who have the "show alerts in menu" option checked.
  • Accessibility pass. Aria labels, alt tags, help-text component, inline error component. WCAG AAA is the target.
  • Advanced-search deeplinks. The filter modal now writes ?filter[...] to the URL, so you can share "everyone in Sales with a laptop older than 4 years" with a coworker just by pasting the link.

Datepicker Custom Field Type

Where appropriate, datepickers have been replaced by a date time picker, where precise times can be selected - and datetime picker is now an available custom field type.

Datepicker

We added a neat little preview for your custom fields as well, so you can see exactly what your users will see in the asset form.

Bug fixes/features worth a callout

  • Duplicate checkout requests on double-click no longer create duplicate rows.
  • Maintenance responsible-party now respects a deliberate clear (null) instead of silently filling in the acting user (#19452).
  • Currency exports normalized across every table's XLSX / CSV output (#19415).
  • MS Teams webhook payloads formatted correctly.
  • EULA PDF no longer chokes on nested markdown, and the end-user download works too.
  • Checkin location choices were refactored to be more consistent across checkout screens.
  • Category / model view pages should run faster now, as we fixed an N+1 loading issue.
  • Login Page now respects light/dark mode previously selected
  • FMCS+Location Scoping now allows you to download a CSV of the mismatched items

Parent companies

One-level company hierarchy is here. Set a company's parent, and child companies inherit the FMCS scoping rules you'd expect. If you've been building out org structure with a bunch of top-level companies because you had no other option, you can now group them the way your organization actually looks, and you don't have to add people to every single sub-company manually if they should be able to manage items from several companies.

Parent company selector

Upgrading

Same as always: php upgrade.php from your Snipe-IT directory. Full walkthrough at snipe-it.readme.io/docs/upgrading.

Docs note: we're in the middle of updating the docs to reflect all the new features, screenshots, and changes in this release. If you see something in the app that isn't in the docs yet, that's why. We're working through them.

What's Changed

Boring Code Stuff for Nerdy Nerds

  • PHPStan (larastan) + PHPMD wired into CI with baselines. New code holds a higher bar than the baseline.
  • Laravel Boost added as a dev dependency (v2.5.1).
  • Console commands. Orphan log cleanup, modernized purge command, better summary output.
  • Static analysis on PRs. CI runs analysis on every push and won't let baseline regressions slip through silently.

Security

This release includes 44 security fixes across authorization, cross-tenant scoping, SSRF / LFR, CSV formula injection, filesystem write-failure handling, race conditions, and a chunk of general hardening. Individual advisories are being held in draft until the fleet has had a chance to upgrade. We'll update these release notes once people have had a chance to update to latest.

Reporter shoutouts

Huge thanks to the security researchers who reported responsibly through the GitHub Security tab this cycle:

  • @arpitjain099
  • @christopherfi-dev
  • @m0xath
  • @pavelkohout396
  • @PizzaStev3
  • @QwesiRED
  • @tonghuaroot
  • @Vectrain51
  • @W1nterFr3ak

New Contributors

Full Changelog: https://github.com/grokability/snipe-it/compare/v8.6.3...v8.7.0

Source: README.md, updated 2026-08-11