Nemo

Latest version: v7.0.2

Safety actively analyzes 712615 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 1 of 24

7.0.2

Improvements
- Updated to use `python3 -m` instead of `pip` in Dockerfile
- Replaced `var` with `let` for variable declarations to enhance code consistency and modernity in a few places
- Now automatically loading customization email templates when there is a `customization_<customization_key>_templates.html` file (helpful for plugins)
- Updated customization template loading to work from `templates/<plugin_name>/customizations/` too instead of being forced to use the global templates directory (also helpful for plugins)

API
- Added tests for API lists
- Added staff assistance requests endpoint to API

Bug fixes
- Removed direct dependency on admin app for interlocks to avoid issues when the admin app is not installed
- Fixed issue with personal schedule checkbox showing in the calendar when not applicable
- Fixed hybrid reservation and use feed not working properly when there are both reservations and use events

Libraries
- gunicorn 20.1.0 -> 23.0.0

7.0.1

Improvements
- Added Training email category
- Updated tool credential detailed admin list to include password
- Restricted list of staff that can be allowed to view tool credentials to only "active" staff

Bug fixes
- Fixed username display in tool freed time notification
- Fixed a few html/js/css display issues
- Fixed old reference to NEMO 6.1.0 (instead of 7.0.0)
- Fixed help text on document display order

7.0.0

Breaking changes
- Dropped support for python 3.8 (end-of-life was reached in October 2024).
- Added support for Python 3.13.
- Removed dependency on `pytz` which is deprecated. Plugins will have to manually add that requirement it if they need it.

Upgrade notes
- This is a major release. It is recommended to wait until new compatible plugin versions are released before updating.
- The code for sensors has been moved to its own plugin, if you were using it you need to remove `NEMO.apps.sensors` from the list of INSTALLED_APPS in `settings.py` and follow the instructions to install [NEMO-Sensors](https://github.com/usnistgov/NEMO-sensors).
- The code for contracts and procurements has been moved to its own plugin, if you were using it you need to remove `NEMO.apps.contracts` from the list of INSTALLED_APPS in `settings.py` and follow the instructions to install [NEMO-Contracts](https://github.com/usnistgov/NEMO-contracts).
- A new email template needs to be added for the tool required unanswered questions email, which can be found [here](https://github.com/usnistgov/NEMO/blob/master/resources/emails/tool_required_unanswered_questions_email.html).
- The `out_of_time_reservation_email` template needs to be updated to the new version which can be found [here](https://github.com/usnistgov/NEMO/blob/master/resources/emails/out_of_time_reservation_email.html).
- The `adjustment_request_notification_email` template needs to be updated to the new version which can be found [here](https://github.com/usnistgov/NEMO/blob/master/resources/emails/adjustment_request_notification_email.html).
- To use the new periodic interlock status report feature, add the `nemo_email_interlock_status_report` systemd service and timer available in the [systemd folder](https://github.com/usnistgov/NEMO/tree/master/resources/systemd).

New features
- Added new Staff assistance requests:
- staff assistance requests have to be enabled in Customization -> User requests.
- users can create assistance requests, which are sent to all technical staff members. Staff members cannot create assistance requests.
- emails are sent and notifications are added in requests menu.
- any staff can reply and mark the request as resolved.
- Tool usage counter updates (Thanks `UPenn Singh Center` for the contribution!):
- added way to increase or decrease counters
- added multiple checkboxes to decide who can reset the counter (staff/superusers/qualified users)
- added flag to not send reset notification to facility members
- Adjustment request updates:
- added a way to mark charges as waived and request it in adjustment requests. Thanks `Cornell NanoScale Facility` and `MIT.nano` for the contribution!
- customizations are now in a separate section
- requests can be linked to a charge without requiring changing one of the fields
- users can now request adjustments for non-remote charges done on their behalf. The staff member operating the tool can also request adjustments for that same charge.
- Dynamic form updates (used in pre/post usage and reservations questions):
- added new dynamic form question of type "radio_report_problem" to automatically report tool issues from pre/post usage questions. Thanks `UPenn Singh Center` for the contribution!
- added a way to specify initial data. This is the first step toward allowing editing of questions (153).
- added `form_row` and `row_cell` to allow customization of the form display into a grid.
- added `inline` property to radio buttons and checkboxes to display the options inline instead of vertically.
- added support for option groups in dropdown questions by enabling the use of a dictionary in the `labels` property:

labels = {
"Category 1": ["Choice1", "Choice2"],
"Category 2": "Choice3"
}

- Added staff activity in `My usage` page for staff to view the activities they have performed on behalf of users.
- Added readonly Detailed administration audit log to keep track of what users are doing in detailed admin. Thanks `UPenn Singh Center` for the contribution!
- Added interlock ping function and systemd service to get periodic reports of interlocks responding to pings. Thanks `Stanford SNF` for the contribution!
- Projects can now have one or multiple configurable `Project types`. Thanks `Cornell NanoScale Facility` for the contribution!

Improvements
- Updated the out of time reservation email to notify users when they are over staying. Thanks r-xyz for the contribution!
- Added hybrid reservation + usage calendar feed option.
- Made the tool required unanswered questions email customizable in file & email templates.
- Projects are now shown in the user's page following the project selection template for consistency.
- In tool control data usage history tab, the `date` field for pre and post run data will now be called `Start date` for pre run data and `End date` for post run data.
- Added ability to customize the farewell_screen page display the same way as the welcome_screen.
- When there are no tools or areas, the Calendar main menu item will now be hidden.
- Added end date field when creating a reservation in the kiosk (only time was available previously). Thanks r-xyz for the contribution!. Fixes 253.
- Now sending email with required questions when someone else forces someone off (even if they are not staff or user office).
- Updated char field length using predefined length: SMALL (100), MEDIUM (255), LARGE (1024) for consistency across NEMO.
- Now using reservation title when sending ICS calendar invites. Thanks `UPenn Singh Center` for the contribution!
- Added an option in customization to show the username in the tool freed time email notification. Thanks `UPenn Singh Center` for the contribution!
- Now showing pre/post usage data in calendar usage details.
- In Usage data history, added operator information. Thanks `MIT.nano` for the contribution!
- Added customization option to show tool documents in a separate tab in tool control (instead of at the bottom). Thanks `MIT.nano` for the contribution!
- Added option to only show qualified tools in the Kiosk (instead of all the tools the user cannot reserve/engage). Thanks `MIT.nano` for the contribution!
- Added `?category=` query parameter to Kiosk URL to go show only tool of a specific category. Thanks `MIT.nano` for the contribution!
- Added an option (in Customization -> Tool) to show who has a reservation next in tool control.
- Added new environment variables to Dockerfile to customize the container's configuration. This allows more flexibility for workers and threads:
- NEMO_EXTRA_PIP_PACKAGES (to add plugins or other packages to be installed on start)
- GUNICORN_WORKER_CLASS (default is `gthread`)
- GUNICORN_WORKER_COUNT (default is `cpu_count() * 2 + 1 with a max of 9`)
- GUNICORN_THREAD_COUNT (default is `8`)
- GUNICORN_KEEPALIVE_SECONDS (default is `300`)
- GUNICORN_CAPTURE_OUTPUT (default is `True`)
- In Detailed administration -> Email logs, added the date when email was sent in the detailed view.
- Now displaying project PIs in Detailed administration -> Projects
- Added new type of AdminEmailHandler for django to limit the number of error emails sent within a certain timeframe. This option can be configured in `settings.py` using `LOGGING_ERROR_EMAIL_PERIOD_SECONDS` and `LOGGING_ERROR_EMAIL_MAX_EMAILS`
- Added a new option for using tools, for "training". This new mode will automatically take the trainer to the `record training` page in NEMO and link the usage event back to the training after it is successfully recorded. The usage event will also have a `training` field set to True when it was used for training. Thanks `MIT.nano` for the contribution!
- Added `critical` flag in app config so NEMO doesn't start if there is a plugin is set as critical and has an error on startup.
- Added an option to automatically shut down a tool when a safety hazard is reported, even if the shutdown flag on the report is not True. Thanks `Cornell NanoScale Facility` for the contribution!
- Added json dictionary of extra arguments for interlock cards. For modbusTCP implementations, the "timeout" key/value can be specified as the timeout for the connection. Thanks `MIT.nano` for the contribution!
- Improved highlighting for required questions in Dynamic forms. Thanks r-xyz for the contribution! Fixes 256.
- Added new autocomplete widget for admin fields.
- Added new `NEMO.plugins.utils` python file with utility functions for plugins. Added a function to dynamically add new notification types.
- Added an `enable` flag on reservation questions.
- If an SMTP connection error is detected (AuthenticationError, ConnectError or ServerDisconnected) when sending an email, NEMO will automatically retry it once.
- Added utility function to rename files in storage when their name depends on the tool name (for example tool image) and that tool name is updated in NEMO. Previously those files would keep the old name forever.
- Added links to projects from User's page and links to users from Project's page. Thanks `Stanford SNF` for the contribution!
- Added new maximum future reservations policy for tools and areas. Thanks `MIT.nano` for the contribution!
- Added options to always notify the person who has a reservation next when the current reservation is shortened. Thanks `MIT.nano` for the contribution!
- Added a `Control` button in mobile calendar view to easily switch to the tool control page for that tool. Thanks `Cornell NanoScale Facility` for the contribution!
- Added tool status icon in mobile calendar view. Thanks `Cornell NanoScale Facility` for the contribution!

API
- Removed pagination on readonly API endpoints (Permission, ContentType, ) to be consistent with other API endpoints.
- Added serializer field for MultiEmailField, so it can be handled properly in the API.
- All charge types (UsageEvent, AreaAccessRecord, ConsumableWithdrawal, StaffCharge, TrainingSession, Reservation) now have `waived` and `waived_by` fields.
- Added user documents to API. Thanks r-xyz for the contribution!
- Added a `/metadata` endpoint to provide information about NEMO's version, plugins and packages installed, os version etc.
- Added a `/api/media/<path>` endpoint to serve media files directly from storage.
- Fixed wrong api filters for `weekdays_start_time` and `weekdays_end_time`, datetime filters were used instead of time only filters.
- Added project types endpoint.

Bug fixes
- Fixed tool configuration options not being ordered properly (now ordered by configuration display order).
- Fixed adjustment request link not showing in email template sent to users.
- Fixed impersonate permission not working for anyone else than admins. The feature will now work for anyone given that permission but they can only impersonate someone with a lower role: Admins can impersonate everyone, Facility managers can impersonate everyone except admins, and staff members can only impersonate regular users.
- Removed links on footer for Kiosk and Area access pages which would allow users to access NEMO as the kiosk user.
- Allow relative path to work for landing page choices when NEMO is deployed on a subpath. Thanks r-xyz for the contribution!. Fixes 249.
- Removed dependency on `distutils` which is not a part of standard python library anymore.
- Added timeout on tool information tooltip in Kiosk pages to prevent it from staying open after the user's session times out. Thanks r-xyz for the contribution!. Fixes 246.
- Fixed a bug when NEMO would throw error 500 instead of returning a bad request (400) when an exception happens when looking up comments and tasks.
- Now emailing tool problems to qualified users as BCC instead of exposing their emails to everyone.
- Fixed reservation policy issues when policy is off during weekdays and weekend:
- reservation time during off hours is not taken into account anymore when checking reservation rules (if reservation time overlaps with off time).
- reservations scheduled during off hours are also not taken into account when calculating total reservation time in the future and reservation count per day.
- Fixed validation issues not being displayed in Broadcast email form.
- Fixed bug preventing tool notifications from being sent correctly to all qualified users.
- Fixed a bug allowing duplicate usage events, area access records or reservations to be created at the same time by adding locks that are thread safe and worker safe, as well as adding the `preload_app = True` setting in Gunicorn.
- Fixed the inefficiency of the method used to set alerts as expired. It used to mark all previous alerts as expired even if they already had the expired flag on.
- In Calendar when more information is needed to create a reservation/outage, fixed the logic that is sending the additional parameters so it overrides previous ones instead of appending to them. This was only really an issue when sending lists of parameter values.
- Fixed incorrect redirect parameters when using mobile calendar view.
- The Jumbotron will no longer throw a 404 when it has no watermark.

Libraries
- cryptography -> 44.0.1
- Django -> 4.2.19
- django-filter -> 25.1
- drf-excel -> 2.5.2
- Pillow -> 11.1.0
- packaging -> 24.2
- pymodbus -> 3.8.6

6.0.3

Bug fixes
- fixed issue with task notification being sent from the last qualified user instead of the reporter

Libraries
- django 4.2.11 -> 4.2.15 (vulnerability)

6.0.2

Not secure
Bug fixes
- fixed error with first day of the week format for moment.js which created issues with daterangepicker in sensor data pages

6.0.1

Not secure
Bug fixes
- fixed a bug from Django 4.2 upgrade preventing rates from being loaded correctly on start
- fixed a validation bug in dynamic form with formula type questions

Page 1 of 24

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.