`NEWDEV_devParentRelType` is declared as an array but defaults to a string: "Error decoding JSON object" on every scan, and new devices get `devParentRelType='[]'`

[tpanchal-iclr]

What installation are you running?

Production (netalertx) 📦 (ghcr.io/jokob-sk/netalertx:26.9.0, also seen on 26.7.1)

Is there an existing issue for this?

• I have searched the existing open and closed issues and I checked the docs https://docs.netalertx.com/

The issue occurs in the following browsers

• N/A - This is an issue with the backend

Current Behavior

Every scan logs this during Creating new devices, even when no new devices were found (captured with LOG_LEVEL='debug'; debug adds no traceback, only the raw value on the next line):

02:45:19 [Scheduler] run for CSVBCKP: NO
02:45:19 [Scheduler] run for DBCLNP: NO
02:45:19 [Scheduler] run for MAINT: NO
02:45:19 [Scheduler] run for VNDRPDT: NO
02:45:19 [Process Scan]  Processing scan results
02:45:19 [Process Scan]  Exclude ignored devices
02:45:19 [Process Scan] Print Stats
02:45:19 [Scan Stats] Devices Detected.......: 31
02:45:19 [Scan Stats] New Devices............: 0
02:45:19 [Scan Stats] Down Alerts............: 0
02:45:19 [Scan Stats] New Down Alerts........: 0
02:45:19 [Scan Stats] New Connections........: 64
02:45:19 [Scan Stats] Disconnections.........: 0
02:45:19 [Scan Stats] IP Changes.............: 0
02:45:19 [Scan Stats] Scan Method Statistics:
02:45:19     ARPSCAN: 29
02:45:19     INTRNT: 1
02:45:19     local_MAC: 1
02:45:19 [Process Scan] Stats end
02:45:19 [Process Scan] Sessions Events (connect / disconnect)
02:45:20 [Process Scan] Creating new devices
02:45:20 [setting_value_to_python_type] Error decoding JSON object: Expecting value: line 1 column 1 (char 0)
02:45:20 default
02:45:20 [Process Scan] Updating Devices Info
02:45:20 [Process Scan] Updating Sync Hub Node
02:45:20 [Process Scan] Updating devLastConnection from CurrentScan
02:45:20 [Process Scan] Updating Presence from CurrentScan
02:45:20 [Process Scan] Updating NICs presence
02:45:20 [Process Scan] Updating forced presence
02:45:20 [Process Scan] Updating Vendors
02:45:20 [Process Scan] Updating v4 and v6 IPs
02:45:20 [Process Scan] Guessing Icons
02:45:20 [Process Scan] Pairing session events (connection / disconnection) 
02:45:20 [Process Scan] Creating sessions snapshot

The value that fails to parse is default, from NEWDEV_devParentRelType, which is not set in app.conf. Every device created so far has the literal string [] as its relationship type:

SELECT devParentRelType, COUNT(*), MIN(devFirstConnection), MAX(devFirstConnection) FROM Devices GROUP BY 1;
('[]', 95, '2026-04-16 04:25:16', '2026-09-08 02:15:25')

Cause. The setting's type and its default value disagree:

• server/plugins/newdev_template/config.json (L1460–1471 at v26.9.0, unchanged on main) declares devParentRelType with "dataType": "array" (select, transformers: ["deviceRelType"]) and "default_value": "default", a plain string.
• server/helper.py setting_value_to_python_type(), array branch (L330–333): json.loads("default") raises. The function logs the error and returns [].
• server/scan/device_handling.py L723 builds the new-device defaults with '{sanitize_SQL_input(get_setting_value("NEWDEV_devParentRelType"))}', so [] is written into devParentRelType as text.

Why this can't be fixed in config. A valid array value such as NEWDEV_devParentRelType=['default'] parses, but the insert expects a scalar. sanitize_SQL_input() only escapes strings and returns lists unchanged, so the f-string would render '['default']' into the SQL. I read this from the code and did not test it, because it would probably break new-device creation.

UI_theme ('Light') and UI_TOPOLOGY_ORDER ('Name') have the same array-type/string-value mismatch in the Settings table. They don't show up in the backend log, so they may only be read by the frontend.

Expected Behavior

• No JSON decode error on scans.
• New devices get devParentRelType='default' (or whichever single relationship type is configured).

Suggested fix

Declare devParentRelType as a single-value setting. The column holds one relationship type, and the scan code treats it as a scalar: device_handling.py compares == "nic", and device_instance.py defaults to "default". That means "dataType": "string" with a select element, keeping default_value: "default" and the deviceRelType transformer. Alternatively, keep the array type, change default_value to ["default"], and have device_handling.py insert the first element.

Existing installs would then want a one-time UPDATE Devices SET devParentRelType='default' WHERE devParentRelType='[]'.

Steps To Reproduce

1. Run 26.9.0 with NEWDEV_devParentRelType not set in app.conf (the default).
2. Let any device scanner run (e.g. ARPSCAN).
3. app.log shows Error decoding JSON object … default under Creating new devices, and new rows in Devices have devParentRelType='[]'.

Relevant app.conf settings

NEWDEV_devParentRelType   (not set; built-in default used)

docker-compose.yml

services:
  netalertx:
    image: ghcr.io/jokob-sk/netalertx:26.9.0
    network_mode: host
    cap_add: [NET_ADMIN, NET_RAW, NET_BIND_SERVICE]
    environment:
      - TZ=${TZ}
      - PORT=20211
      - LISTEN_ADDR=127.0.0.1
    volumes:
      - netalertx-config:/data/config
      - netalertx-db:/data/db

Debug or Trace enabled

• I confirm I set LOG_LEVEL to debug or trace

Relevant app.log section

See Current Behavior (one ARPSCAN + INTRNT cycle at debug level; the lines before it only list LAN devices, omitted for privacy).

Docker Logs

docker logs netalertx for the same scan (it mirrors app.log):

02:45:19 [Scan Stats] New Devices............: 0
02:45:19 [Scan Stats] Down Alerts............: 0
02:45:19 [Scan Stats] New Down Alerts........: 0
02:45:19 [Scan Stats] New Connections........: 64
02:45:19 [Scan Stats] Disconnections.........: 0
02:45:19 [Scan Stats] IP Changes.............: 0
02:45:19 [Scan Stats] Scan Method Statistics:
02:45:19     ARPSCAN: 29
02:45:19     INTRNT: 1
02:45:19     local_MAC: 1
02:45:19 [Process Scan] Stats end
02:45:19 [Process Scan] Sessions Events (connect / disconnect)
02:45:20 [Process Scan] Creating new devices
02:45:20 [setting_value_to_python_type] Error decoding JSON object: Expecting value: line 1 column 1 (char 0)
02:45:20 default
02:45:20 [Process Scan] Updating Devices Info
02:45:20 [Process Scan] Updating Sync Hub Node
02:45:20 [Process Scan] Updating devLastConnection from CurrentScan
02:45:20 [Process Scan] Updating Presence from CurrentScan
02:45:20 [Process Scan] Updating NICs presence
02:45:20 [Process Scan] Updating forced presence
02:45:20 [Process Scan] Updating Vendors
02:45:20 [Process Scan] Updating v4 and v6 IPs
02:45:20 [Process Scan] Guessing Icons
02:45:20 [Process Scan] Pairing session events (connection / disconnection) 
02:45:20 [Process Scan] Creating sessions snapshot

[jokob-sk]

Thanks for the report. This should be available/fixed in the next release.
It would be great if you could test the ghcr.io/netalertx/netalertx-dev-unsafe Docker image in ~15 minutes (or once the latest GitHub Action finishes).

⚠️ Please back up everything first, or ideally spin up a separate container (make sure you use a unique PORT and GRAPHQL_PORT if running instances concurrently) with its own DB and config (a copy of your current setup), as database changes may occur.

After updating:

• Click the 🔄 refresh button in the blue header at the top
• Hard refresh your browser cache (shift + reload) to force js and css files reload

👉 If I don’t receive confirmation that this works, I may revert the changes to avoid introducing bugs.

Disclaimer: Running the dev container long-term may lead to data loss, as upgrade paths are not guaranteed.

Thanks in advance,
j

[Marvelous2095]

Confirming here as well, since this is the original report: tested in a separate container with a fresh volume, before/after (details in #1798, #1798 (comment)): with the 26.9.0 release image all new devices got devParentRelType = '[]' and the log showed Error decoding JSON object; with the dev image (revision cd1d0ed, and again with netalertx-dev-unsafe:unsafe built 2026-09-21T07:31Z) new devices get default and there is no JSON error. So the fix works; please keep it.