DefectDojo/django-DefectDojo 3.4.100

3.4.100 🌈

on GitHub

Please consult the Upgrade notes in the documentation for specific instructions for this release, and general upgrade instructions. Below is an automatically generated list of all PRs merged since the previous release.

Changes since 3.4.0

• docs(onprem): safer ddorch certificate handling in the Helm upgrade render @Maffooch (#16303)
• perf(engagement): prefetch tags on the engagements list to stop an N+1 @Maffooch (#16304)
• Check the delete permission for delete_preview on configuration-permission viewsets @devGregA (#16286)
• Add system checks for settings left at their shipped values @devGregA (#16285)
• docs(sidebar): describe the parent prefix on pinned pages @stevewallone (#16177)
• [docs] adjust sidebar heading depth @paulOsinski (#16224)
• docs(connectors): Security Hub ECR repository tags and deduplication @skywalke34 (#16280)
• docs(user_management): describe managing group members in the Pro UI @paulOsinski (#16173)
• docs(connectors): say who can see and change an Issue Tracker Assignment @blakeaowens (#16305)
• docs(compliance): describe suggested control mappings @blakeaowens (#16270)
• docs(threat-intel): describe the Source Ratings panel @blakeaowens (#16268)
• fix(importers): drop orphaned LocationFindingReference rows before insert @Maffooch (#16299)
• docs(onprem): document doctor, certs and offline upgrade bundles for Compose @Maffooch (#16300)
• docs(onprem): fix self-hosted install and upgrade pages from a clean 3.4.0 install @Maffooch (#16301)
• docs(onprem): recover a Compose first install that gives up during initialization @Maffooch (#16298)
• docs(pro): describe the copy and move confirmations @Maffooch (#16287)
• docs(triage-engine): correct Run Now, Simulate and the sidebar pages @blakeaowens (#16296)
• docs(connectors): the upstream records page refreshes itself after Discover and Sync @blakeaowens (#16297)
• docs(connectors): correct who can see and change Downstream Connectors @blakeaowens (#16289)
• docs(risk-acceptance): default expiration date, current button names, Unaccept Risk caveat @blakeaowens (#16295)
• docs(import): correct Close Old Findings scope, Do Not Reactivate and Scan Date @blakeaowens (#16291)
• docs(permissions): the Owner role is listed only for users who can grant it @blakeaowens (#16292)
• docs(connectors): Push to Connector naming and what happens with no assignment @blakeaowens (#16293)
• docs(report builder): who sees Generated Reports, the failure reason, and no re-run @blakeaowens (#16294)
• docs(locations): explain where old Endpoint links land @blakeaowens (#16290)
• docs(api): point to the API v2 Token and API v2 Docs menu items @blakeaowens (#16288)
• docs(search): Global Search palette with Search and Navigate modes @blakeaowens (#16269)
• Store the SonarQube issue key as unique_id_from_tool for REST API imports @vyrnsynx (#16267)
• docs(onprem): document the uWSGI harakiri settings for Compose @Maffooch (#16266)
• fix(risk_acceptance): bound accept_risks UPDATE when tables lack statistics @Maffooch (#16274)
• fix(api v3): resolve the organization before the import permission check @svader0 (#16207)
• Apply the API token settings to API v3 token auth @svader0 (#16072)
• Enforce the engagement object permission on the questionnaire answer view @svader0 (#15666)
• perf(notifications): stop per-recipient queries in the notification fan-out @Maffooch (#16229)
• docs(reachability): how reachability verdicts end @blakeaowens (#16247)
• docs(sensei): AI Model Settings also serves the in-app AI features @blakeaowens (#16258)
• docs: match the UI's re-cased and reworded labels @blakeaowens (#16226)
• docs(deduplication): container images separate findings in deduplication @blakeaowens (#16245)
• docs(vex): how the Asset page builds VEX statements when findings disagree @blakeaowens (#16246)
• perf(importers): close old findings in bulk on reimport @Maffooch (#16227)
• docs(locations): explain how to remove the legacy Endpoint rows left after the migration @Maffooch (#16259)
• perf(endpoint): batch the endpoint meta import @Maffooch (#16220)
• perf(locations): keep the endpoint backfill's memory bounded by batch size @Maffooch (#16221)
• perf(importers): look up only the endpoints a report can match @Maffooch (#16225)
• docs(onprem): list the built-in NO_PROXY names and where each component reads extra CAs @Maffooch (#16238)
• docs(air-gapped): stage the Pro settings and carry CA bundles across upgrades @Maffooch (#16216)
• docs(sensei): explain fixes Sensei refuses up front and patch-mismatch failures @Maffooch (#16215)
• docs(pro): document airgapped mode and DD_AIRGAPPED @Maffooch (#16217)
• docs(sensei): explain the default model ladder for a blank Model @Maffooch (#16219)
• docs(reachability): reachability is on for everyone, and the sources that report it @blakeaowens (#16199)
• docs(compliance): posture scan defaults, PCI DSS Requirement 2 and compliance tags @blakeaowens (#16200)
• docs(onprem): document initializer exit codes and self-hosted diagnostics defaults @Maffooch (#16237)
• Resolve notification recipients from the listed users @devGregA (#16230)
• Bound three parser regular expressions @devGregA (#16234)
• Follow-ups in the finding views @devGregA (#16231)
• Offer the engagement's findings on the risk acceptance forms @devGregA (#16232)
• Apply the upload file type check to parser-supplied attachments @devGregA (#16233)
• docs(changelog): add DefectDojo Pro 3.4.0 release notes @paulOsinski (#16223)
• docs: match the Sample Payload and support page labels @blakeaowens (#16222)
• Share cell handling between the CSV and Excel exports @devGregA (#16214)
• Use the scoped endpoint choices on the import and re-import forms @devGregA (#16213)
• Check edit permission for changes on the risk acceptance and finding group pages @devGregA (#16212)
• Keep accepted findings on a partial risk acceptance update @devGregA (#16211)
• Adjust the login rate limiter key and account lockout handling @devGregA (#16210)
• Align JIRA configuration editing with tool configuration editing @devGregA (#16208)
• docs(support): document the Support feature flag @Maffooch (#16206)
• ci(docs): deploy docs from dev once bugfix is retired @Maffooch (#16133)

🚩 Changes to settings.dist.py / local_settings.py

• Limit account-recovery emails per address @devGregA (#16284)
• Apply the token endpoint's account rules to HTTP Basic auth on the API @devGregA (#16283)
• fix(qualys_webapp): honour QUALYS_WAS_WEAKNESS_IS_VULN and QUALYS_WAS_UNIQUE_ID settings @skywalke34 (#16282)
• Require a login for the report cover page @devGregA (#16235)

🚀 General features and enhancements

• perf(locations): stop per-row queries on the location and endpoint lists and meta import @Maffooch (#16279)
• perf(test api): remove N+1 queries on the tests list endpoint @Maffooch (#16187)

🚀 API features and enhancements

• Declare each deprecation once, with a release calendar @svader0 (#16228)
• feat(api): advertise locations as a prefetch option on findings and products @paulOsinski (#16260)
• Adjust report selectors and metadata scope for shared locations @devGregA (#16236)
• Check the delete permission for delete_preview on model-permission viewsets @devGregA (#16209)

🐛 Bug Fixes

• Stop logging a traceback for product announcements on requests without a session @Maffooch (#16302)
• fix(importers): tolerate a missing request or response in a scan req/resp pair @Maffooch (#16265)
• perf(test api): remove N+1 queries on the tests list endpoint @Maffooch (#16187)

📝 Documentation updates

• docs(pro): describe the unsaved-changes indicator on table preferences @blakeaowens (#16271)
• docs(locations): list Cloud Resources under Attack Surface @Maffooch (#16273)

🖌 Updates in UI

• Scope the report builder's endpoint counts to the requesting user @svader0 (#16175)
• Build the asset option icon markup with format_html @svader0 (#16205)

🧰 Maintenance