DefectDojo/django-DefectDojo 3.2.100

3.2.100 🌈

on GitHub

Please consult the Upgrade notes in the documentation for specific instructions for this release, and general upgrade instructions. Below is an automatically generated list of all PRs merged since the previous release.

Changes since 3.2.0

• chore(ci): replace unmaintained release-drafter fork with upstream v7.5.1 @Maffooch (#15439)
• docs(integrations): document the Slack, Microsoft Teams, and Email messaging connectors @blakeaowens (#15530)
• chore(ci): migrate release-drafter version-resolver to categories @Maffooch (#15440)
• Update Django version to 5.2.16 @Maffooch (#15602)
• fix(notes): visible_notes handles a paginated list, not just a queryset @devGregA (#15593)
• fix(notes): filter note visibility when the caller already has a list @devGregA (#15586)
• docs(sso): point SCIM setup at Authorization Connectors, and at Diagnostics @devGregA (#15581)
• docs(triage): document the Root Cause API endpoints @devGregA (#15578)
• docs(triage): document covered CVE root causes @devGregA (#15576)
• docs(sso): document SCIM provisioning for DefectDojo Pro @devGregA (#15577)
• fix(engagement): re-home finding endpoints/locations when moving or copying to a new product @Maffooch (#15575)
• docs maintenance @paulOsinski (#15564)
• docs(api): describe the background import response and how to poll it @valentijnscholten (#15572)
• Scope CI/CD Infrastructure detail fields to the matching configuration permission @svader0 (#15574)
• docs(triage): document the Phase 2 correlation surfaces @devGregA (#15560)
• feat(locations): migrate_locations_to_endpoints - reverse of the endpoint conversion @devGregA (#15550)
• docs(connectors): the request form now requires a base URL and credentials @devGregA (#15568)
• docs(reports): document the classic report engine removal and the migration @Maffooch (#15566)
• fix(dedupe): prefetch locations, not endpoints, in the batch dedupe loader @Maffooch (#15508)
• Preserve raw CycloneDX VEX analysis on parsed findings @Jino-T (#15382)
• Fix/engagement history 500 @paulOsinski (#15518)
• Apply the global template gate to the search page's template results @svader0 (#15494)
• Upstream/Downstream Connectors docs overhaul @paulOsinski (#15266)
• fix(notifications): don't send an empty webhook header name @valentijnscholten (#15511)
• docs(reports): drop the BETA label from the Report Builder sidebar reference @devGregA (#15525)
• Consistent autoescaping in the shared notification fallback template @svader0 (#15497)
• ci: harden input handling in the Helm chart docs workflow @svader0 (#15493)
• docs(connectors): document the Tenable Web App Scanning connector @devGregA (#15562)
• docs(sensei): several connections per provider, connection-scoped setup, refreshed screenshots @Maffooch (#15563)
• fix(importers): detect a deleted import target from the write-back itself @valentijnscholten (#15512)
• docs(sensei): document design-stage threat modeling @devGregA (#15516)
• docs(triage): add Root Cause Correlation page @devGregA (#15554)
• ci: balance the UI groups by measured time, not by file count @devGregA (#15553)
• docs: add DefectDojo Cloud architecture page with deployment and tier diagrams @devGregA (#15552)
• Name the POST permission on the risk acceptance API @devGregA (#15519)
• [docs] 3.2 changelog, maintenance @paulOsinski (#15517)
• fix(snyk): render Snyk's raw reachability values instead of a derived boolean @devGregA (#15523)
• docs(ci): record the live merge-queue ruleset beside the trigger it feeds @devGregA (#15545)
• ci: restore the migrated database instead of migrating it four times @devGregA (#15507)
• ci: follow-ups from the migration-graph review — push scoping and the misdiagnosing heredoc @devGregA (#15529)
• ci: two-tier checks — light pull-request runs, the full suite in the queue @devGregA (#15528)
• ci: run the Selenium matrix as 10 file groups, not 113 single-file jobs @devGregA (#15524)
• ci: retry the two Docker Hub pulls the integration jobs depend on @devGregA (#15522)
• ci: report required checks on merge_group, and add one stable gate context @devGregA (#15521)
• docs(connectors): document the Wiz service account scope and project-visibility requirements @devGregA (#15514)
• ci: run the parallel-safe unit test phase in parallel @devGregA (#15505)

🚩 Database migration

• Scope Location metadata and tags to the owning product @svader0 (#15495)
• Make a private note private @svader0 (#15570)
• fix: six bugs from the open bug backlog (metrics charts, Burp aggregation, file titles, risk acceptance dates, notifications, finding groups) @devGregA (#15498)

🐛 Bug Fixes

• fix(notes): apply the private-note rule to an already-evaluated list @devGregA (#15582)
• fix(tags): order tag-count decrements so concurrent removals cannot deadlock @Maffooch (#15486)
• fix(dedupe): skip findings deleted between the loop scan and the repair @Maffooch (#15569)
• fix(dedupe): drop duplicate links whose original was deleted mid-batch @Maffooch (#15503)
• fix(importers): stop an empty engagement status failing every save @Maffooch (#15557)
• fix(dedupe): resolve inbound duplicate references inside the delete transaction @valentijnscholten (#15510)
• Fix two API v2 500s: non-string vulnerability_id values, and the endpoints prefetch on the test imports list @Maffooch (#15509)
• Risk acceptance: keep the requested expiration date, add expire/reinstate API actions, and fix broken links and the SonarQube status sync @devGregA (#15500)

🖌 Updates in UI

• Make a private note private @svader0 (#15570)
• Escape popover attribute values through one shared helper @svader0 (#15551)
• fix: six bugs from the open bug backlog (metrics charts, Burp aggregation, file titles, risk acceptance dates, notifications, finding groups) @devGregA (#15498)

🔧 Improved code quality with linters

• ci(migrations): fail fast when the migration graph has multiple leaves @devGregA (#15501)

🧰 Maintenance