Fishbowl 2026.4: granular import/export rights, USPS validation restored, and credit-return tax fixes

Fishbowl shipped version 2026.4 (26.4). This one is about control: who can import and export what, how passwords age, and a stack of accounting fixes that clean up credit returns and Canadian tax.

What’s new

114 granular import/export access rights. Every individual import and export operation now has its own user right, so you can let a user group import receiving data without also letting them export your customer list. Existing groups are automatically granted all of them on upgrade, so nothing changes until you start tightening. If you’ve ever audited who can pull a full parts export, you’ll want to.
Require notes on inventory adjustments and moves. Two new Inventory module options force users to explain themselves when adjusting quantities or moving stock. Off by default, but if you fight cycle-count mysteries, turn them on. Future-you will thank present-you at reconciliation time. We’ve built this exact control into beep1 mobile projects for customers who needed it: pick a reason from a short list (damaged, lost, and so on), then explain yourself with a minimum number of characters. The inventory record already captures the who, what, and where; requiring the why is what makes the trail worth reading.
Password expiration. Administrators can require password resets on a configurable schedule (default 30 days). Honestly, we’re not fans of forced rotation: it nudges people toward incrementing a digit each cycle, and even the author of the original guidance has since walked it back. Current NIST advice recommends against periodic resets. The option is there if your compliance regime requires it, but think twice before turning it on.
Temporary passwords via users.csv import. A new optional Password column assigns a temporary password when creating users in bulk. New users only, admin only.
USPS address validation works again. USPS changed their API out from under the old integration; 26.4 rewires it to the current one.
REST API: tracking data on shipments. GET /api/shipments/:id now returns part tracking (lots, serials, expirations) on ship items, one less reason for shipping integrations to fall back to the legacy API.

Fixes worth noting

Three tax and cost fixes with direct accounting impact:

QuickBooks Desktop Canadian tax rounding. With CAD as home currency, exports were rounding tax up a cent, leaving every affected invoice a penny off in QBD and requiring manual correction. Fixed.
Credit returns duplicated from Sales Orders now flip TaxJar and QBO Automated Sales Tax lines negative. Previously the tax lines stayed positive on the credit, quietly inflating tax totals.
Purchase Order CSV imports keep full cost precision again. A regression introduced in 2026.1 rounded imported unit costs to two decimals. If you imported POs with fractional-cent costs on 26.1 through 26.3, it may be worth spot-checking those orders.

Also notable:

Zero-change cycle counts are recorded instead of silently discarded. This closes a real gap: “we counted and it matched” and “we never counted it” used to look identical in the inventory log, which made “when did we last count this part?” unanswerable from the system. Expect it to nudge some activity reports, but operationally it’s all upside.
Transfer Order CSV imports validate UOMs per line, closing a hole that could corrupt order, pick, and inventory records with invalid units.
Receiving Data CSV imports assign the right billed unit cost when one order line arrives across multiple rows.
Non-inventory credit returns reverse COGS correctly with a negative cost instead of overstating cost of goods sold.

If tightening import/export rights or auditing the cost-rounding regression sounds like your week, get in touch.