DefectDojo/django-DefectDojo 3.4.200

3.4.200 🌈

on GitHub

Please consult the Upgrade notes in the documentation for specific instructions for this release, and general upgrade instructions. Below is an automatically generated list of all PRs merged since the previous release.

Changes since 3.4.101

• ci: build the docs on merge groups too @Maffooch (#16417)
• docs(walkthroughs): list the admin, Jira and Triage Engine walkthroughs @blakeaowens (#16411)
• ci: skip the heavy unit-tests suite for docs-only merge groups @Maffooch (#16413)
• feat(release): load a per-release schema snapshot into empty databases @Maffooch (#16414)
• docs(about): refresh the edition comparison, Pro UI, sidebar and FAQ pages @skywalke34 (#16412)
• docs: put what readers come for at the top of six heavily skimmed pages @devGregA (#16327)
• docs(readme): add a centered header with logo, links and screenshot @devGregA (#16403)
• docs(readme): add a Contributors section @devGregA (#16402)
• docs(filters): document In List, Include / Exclude and names on the Asset and Organization filters @blakeaowens (#16406)
• docs(assets): asset types set by connectors and by the Triage Engine @blakeaowens (#16405)
• fix(locations): name the endpoint by the id /api/v2/endpoints/ lists in /api/v2/endpoint_status/ @blakeaowens (#16409)
• docs(locations): old Endpoint links keep their filters, and who sees New Location and Add Existing @blakeaowens (#16408)
• docs(exposure): name every exposure source and document the CMDB criticality sync @blakeaowens (#16407)
• docs(findings): Owner (Team) column and filter, owner and assignee API filters @stevewallone (#16380)
• docs(connectors): Push to Connector shows only when a connector covers the finding @blakeaowens (#16385)
• docs: hand-entered POA&M items take a scheduled completion date @skywalke34 (#16389)
• docs(tables): applying a column filter with Enter @paulOsinski (#16394)
• docs(walkthroughs): document the task walkthroughs @blakeaowens (#16401)
• docs(tables): the grid view and filter bar on the Assets, Organizations, Engagements and Tests lists @blakeaowens (#16400)
• docs(wiz): describe the asset exposure the Wiz connector reports @blakeaowens (#16375)
• docs(sensei): describe Ask Sensei @devGregA (#16319)
• Drop the file title pre-check from the API v3 upload route @svader0 (#16132)
• ci(k8s): record why the uwsgi container restarted when the deployment test fails @Maffooch (#16398)
• fix(dedupe): only count import locks held in the current database @Maffooch (#16397)
• [docs] add "test your knowledge" quizzes @paulOsinski (#16272)
• docs: document Azure DevOps custom field mappings and the @currentiteration token @paulOsinski (#16353)
• docs(connectors): describe what a Cyberwatch Sync imports @Jino-T (#16391)
• fix(location): authorize endpoint compat detail routes via product/finding @Maffooch (#16377)
• docs(walkthroughs): document the area tours and why findings close and reopen @blakeaowens (#16382)
• docs(tables): a page's pinned context shows as a locked chip ahead of the connective @blakeaowens (#16390)
• docs(on-prem): the initializer needs a valid license @Maffooch (#16388)
• docs(pro): add the Qualys TotalAppSec connector page @skywalke34 (#16371)
• docs(pro): filter bar, match mode and grid view on the findings list @blakeaowens (#16362)
• docs(custom-fields): document the per-object filters on the custom field values API @Maffooch (#16378)
• docs(triage-engine): asset metadata, contacts and custom fields in rules, Card Facts, partial select matching @Maffooch (#16372)
• docs(navigation): the classic Pro sidebar and its toggle are removed @blakeaowens (#16335)
• docs(sensei): Bedrock Test connection uses the API Base URL endpoint @Maffooch (#16367)
• docs: document every Pro feature flag and list them on the Feature Flags page @Maffooch (#16368)
• fix(parsers): read CVE/GHSA ids from SARIF tags and OSV aliases @Maffooch (#16363)
• docs(user-management): changing an Owner needs the Owner permission; group members open their own groups @blakeaowens (#16364)
• docs(exposure): describe the reachability probe and its settings page @blakeaowens (#16350)
• docs(pro): add the StackHawk connector page @Maffooch (#16361)
• docs(pro): document in-app walkthroughs and the App Tour @blakeaowens (#16261)
• Pin the rate limiter clock in the Basic auth account rules tests @Maffooch (#16360)
• docs(pro): describe rehash progress and how a rehash survives a lost worker @Maffooch (#16325)
• docs(pro): describe the column picker's select-all checkbox @Maffooch (#16317)
• docs(changelog): add DefectDojo Pro 3.4.101 release notes @Maffooch (#16348)

🚩 Changes to settings.dist.py / local_settings.py

• fix(dedupe): run async_dupe_delete as a singleton to stop overlapping runs deadlocking @Maffooch (#16337)
• fix(dedupe): stop imports failing when findings are deleted under them @Maffooch (#16379)

🚩 Database migration

• perf(findings): index UPPER(title) for case-insensitive title filters @Maffooch (#16387)
• perf(findings): index findings by test and numerical severity @Maffooch (#16357)

🚀 General features and enhancements

• fix(findings): avoid N+1 when serializing vulnerability_ids after a write @Maffooch (#16373)
• feat(dedupe): let a caller decide what a batch dedupe match does @blakeaowens (#16336)
• perf(notifications): batch the daily SLA run's notifications through one manager @Maffooch (#16324)

🚀 API features and enhancements

• fix(api): include the traceback in the admin error email for unexpected API errors @eastagiletracker (#16333)

🐛 Bug Fixes

• fix(finding): run Finding.delete() for each finding the merge action deletes @svader0 (#16307)
• fix(importers): tolerate non-string vulnerability ids in sanitizer @Maffooch (#16365)
• fix(dedupe): run async_dupe_delete as a singleton to stop overlapping runs deadlocking @Maffooch (#16337)
• fix(findings): avoid N+1 when serializing vulnerability_ids after a write @Maffooch (#16373)
• fix(dedupe): stop imports failing when findings are deleted under them @Maffooch (#16379)
• fix(notifications): keep the daily SLA run going when one finding fails @Maffooch (#16315)

📝 Documentation updates

• docs: add Migrating from Open Source to DefectDojo Cloud @Maffooch (#16347)

🖌 Updates in UI

• Fix multiselect filter fields not being initialized as Select2 @raedbrahem (#16306)
• fix(findings): count bulk-selected findings when merging @k0nnect (#16374)

🧰 Maintenance