DefectDojo/django-DefectDojo 3.3.0

3.3.0 🌈

on GitHub

Please consult the Upgrade notes in the documentation for specific instructions for this release, and general upgrade instructions. Below is an automatically generated list of all PRs merged since the previous release.

Changes since 3.2.400

• test(integration): wait for DataTables before clicking engagement links to fix a stale-element flake @blakeaowens (#15882)
• fix(unittests): pin the rate-limit window in test_api_token_auth_is_rate_limited @blakeaowens (#15883)
• docs(shell): sidebar rail (collapse, flyouts, unified Global Search, badge icons) @blakeaowens (#15871)
• fix(unittests): stop leaking a crum current-user override across tests @blakeaowens (#15880)
• docs(mcp): document tag filtering on the findings tools @Maffooch (#15877)
• docs: document the /api/v2/ Custom Fields API and stop pointing automation at /api/vue @Maffooch (#15876)
• Pin outbound connections to an already-checked address @svader0 (#15835)
• fix(fortify): only flag suppressed FPR findings as false_p (reimport closing all findings) @BrunoTerres (#15839)
• docs(engagements): explain the locked Asset field and its copy button @Jino-T (#15873)
• fix(product): defer list count annotations @kocaemre (#15447)
• docs(connectors): JFrog artifact mode scopes nested child images to their own latest build @paulOsinski (#15868)
• fix(login): render login page when the Site row for SITE_ID is missing @Maffooch (#15843)
• fix(parser): make xeol severity parsing deterministic without wall clock @P6-36-216 (#15813)
• Remove the redundant table-wide file cleanup from the manage-files view @svader0 (#15836)
• docs: match the Pro UI's renamed buttons and Email labels @blakeaowens (#15870)
• feat(api-v3): let a downstream distribution supply the assets router's write schemas @valentijnscholten (#15826)
• docs(feature-flags): restart tag clears after a restart; mark data migrations complete @Maffooch (#15872)
• docs(connectors): location inventory from asset connectors @svader0 (#15838)
• refactor(importers): one existence lookup for findings deleted mid-import @valentijnscholten (#15825)
• Set finding mitigation from Dependency Track affected version ranges @webdevred (#15366)
• refactor(importers): extract the import-history write into an overridable hook @Maffooch (#15866)
• update changelog @paulOsinski (#15844)
• fix(parsers): drop unique ids that repeat within a report (SARIF family, Generic JSON) @devGregA (#15817)
• docs(connectors): explain the two wiz data classes and the import filter @svader0 (#15791)
• docs(assets): document the Bulk Edit action on the All Assets list @paulOsinski (#15787)
• docs(organizations): the type-scoped grants UI @devGregA (#15764)
• docs: 3.3.x upgrade notes for the three deduplication identity changes @devGregA (#15761)
• docs(connectors): Wiz imports without Projects via a tenant-level Record @svader0 (#15752)
• docs(connectors): document GitHub issue import on the GHAS connector @devGregA (#15755)
• docs: Fix typos @9alexx3 (#15747)
• docs: asset exposure and deployment context @devGregA (#15679)
• docs: notifications follow every organization membership @devGregA (#15628)
• docs(connectors): document the data-visibility warnings @svader0 (#15634)
• docs(notifications): document the Connector Health Warning notification @svader0 (#15646)
• docs(organizations): roles scoped to an organization type @devGregA (#15673)
• docs(connectors): note that Location is pre-filled for single-host tools @svader0 (#15714)
• docs(federal): document PAIN-keyed FedRAMP VDR remediation deadlines @devGregA (#15719)
• docs(rules-engine-2): document the missing-scan trigger @devGregA (#15731)
• docs(psirt): Feed Rules, the no-SBOM matching path, and advisory-to-case @devGregA (#15735)
• docs(rules-engine-2): document exploit-evidence, reachability and asset-exposure condition fields @devGregA (#15713)
• fix: Add CISA KEV date parsing for Anchore Grype parser @Kasyap7 (#15730)
• docs(psirt): who can use PSIRT, and why the permission beats the role @devGregA (#15741)
• docs(assets): how to reach Asset Versions and per-version claims in the UI @devGregA (#15670)
• docs(asset-hierarchy): relationship types, and direct vs indirect vulnerabilities @devGregA (#15672)
• docs: where to find Asset types and aliases in the UI (asset model Phase 4) @devGregA (#15645)
• refactor(dedupe): one definition of the location prefetch @valentijnscholten (#15520)
• fix(dedupe): order locations/endpoints inside hash_code, and catch set-order leaks in parsers @valentijnscholten (#15513)
• refactor(importers): track reimport finding buckets by id, not instance @valentijnscholten (#15600)
• refactor(importers): extract persist_new_findings as a bulk-write seam @valentijnscholten (#15599)
• docs: asset kinds and per-source asset aliases @devGregA (#15633)
• docs: asset versions, BOM snapshots, and per-version SBOM/VEX export @devGregA (#15629)
• fix(ci): drop duplicated db-snapshot steps that make dev's unit test suite unrunnable @devGregA (#15614)
• refactor(reimporter): a seam for deferring the new-finding write @devGregA (#15621)
• docs: organization types + non-exclusive membership @devGregA (#15619)
• refactor(importers): reconcile a finding's child rows before the finding is written @devGregA (#15620)
• refactor(locations): let locations be recorded before the finding is written @devGregA (#15597)
• docs(sensei): add the Sensei Advisor page @devGregA (#15594)
• feat(locations): make the endpoint->location migration resumable and memory-bounded @devGregA (#15590)
• perf(locations): clean and stringify each URL location once per import @devGregA (#15588)
• docs(connectors): a connector's field mappings can be customised per scan type @devGregA (#15579)
• docs(universal parser): document editing field mappings from the UI @devGregA (#15583)
• docs: the sidebar page now covers the whole menu, not just Settings @devGregA (#15591)
• docs: Exporting SBOMs and VEX (Pro) @devGregA (#15584)
• docs(psirt): PSIRT module documentation @devGregA (#15555)
• docs: DISA STIG checklist import and the CCI control crosswalk @devGregA (#15571)
• docs(notifications): note where notification settings live in the Pro UI @Maffooch (#15567)
• docs(universal parser): field mappings can be edited, with identity classified and versioned @devGregA (#15556)
• fix(reimporter): always dispatch the final post-processing batch @devGregA (#15548)
• ci: port the bugfix CI stack to dev @devGregA (#15549)
• refactor(finding): extract save()'s field derivation so batched writers can reuse it @devGregA (#15489)

🚩 Changes to settings.dist.py / local_settings.py

• fix(importers): accept .spdx files for scan import @Maffooch (#15875)
• Add Aqua Supply Chain connector docs and dedup registration @svader0 (#15874)
• Add Seal Security CSV parser @amita-seal (#15592)
• chore(deps): switch django-tagulous from fork to upstream 2.2.2 @valentijnscholten (#15828)
• Add Open Pentest Format (OPF) parser @Su1ph3r (#15558)
• fix(dedupe): give Checkmarx Scan detailed a hash_code field list @devGregA (#15580)
• feat: API v3 (alpha) — parallel /api/v3-alpha/ with slim refs, expand, and a tested query-count contract @valentijnscholten (#15304)
• fix(dedupe): hash Checkmarx One on the vendor id it already matches on @devGregA (#15663)
• fix(dedupe): stop Xeol finding identity depending on the wall clock @devGregA (#15658)
• feat(i18n): full platform internationalization with per-user language selection @devGregA (#15622)
• feat(parsers): fifteen new file-import parsers @devGregA (#15611)
• feat(parsers): add 39 file-import parsers (with tests, fixtures, and docs) @devGregA (#15595)
• feat(api-tokens): API token expiry and revoke-by-key endpoint @svader0 (#14932)
• refactor(ui): remove the classic Bootstrap UI @Maffooch (#15565)
• feat(parsers): add fifty-six file parsers for vendors with no importer @devGregA (#15482)

🚩 Database migration

• feat(risk-acceptance): add option to restore Verified when a Risk Acceptance expires @Maffooch (#15878)
• feat(product): editable platform/lifecycle/origin lookup tables @Maffooch (#15869)
• chore(deps): switch django-tagulous from fork to upstream 2.2.2 @valentijnscholten (#15828)
• fix(migrations): make the ui_use_tailwind removal idempotent @Maffooch (#15842)
• perf(finding): drop four dojo_finding indexes that no query uses @devGregA (#15659)
• feat(i18n): full platform internationalization with per-user language selection @devGregA (#15622)
• feat(api-tokens): API token expiry and revoke-by-key endpoint @svader0 (#14932)
• refactor(ui): remove the classic Bootstrap UI @Maffooch (#15565)

🚀 General features and enhancements

• Allow a false-positive-history candidate hook to supply candidates, not only narrow them @devGregA (#15502)

🚀 API features and enhancements

• chore(deps): switch django-tagulous from fork to upstream 2.2.2 @valentijnscholten (#15828)
• feat(i18n): full platform internationalization with per-user language selection @devGregA (#15622)

🐛 Bug Fixes

• fix(importers): accept scan severities case-insensitively @Maffooch (#15864)
• fix(locations): tolerate concurrent creation in bulk_get_or_create @Maffooch (#15845)
• fix(engagement): allow saving engagements with an empty status @Maffooch (#15472)

📝 Documentation updates

• docs(connectors): Rapid7 InsightVM - Cloud Instance connector reference @Maffooch (#15867)

🖌 Updates in UI

• feat(risk-acceptance): add option to restore Verified when a Risk Acceptance expires @Maffooch (#15878)
• chore(ui): improve readability of the version in the footer @nisnopa (#15863)
• feat(product): editable platform/lifecycle/origin lookup tables @Maffooch (#15869)
• feat: API v3 (alpha) — parallel /api/v3-alpha/ with slim refs, expand, and a tested query-count contract @valentijnscholten (#15304)
• feat(i18n): full platform internationalization with per-user language selection @devGregA (#15622)
• feat(api-tokens): API token expiry and revoke-by-key endpoint @svader0 (#14932)
• refactor(ui): remove the classic Bootstrap UI @Maffooch (#15565)

🗣 Updates in localization

• feat(i18n): full platform internationalization with per-user language selection @devGregA (#15622)

🔧 Improved code quality with linters

• ci(migrations): bring the migration graph check to dev @devGregA (#15504)

🧰 Maintenance