DefectDojo/django-DefectDojo 3.5.100

3.5.100 🌈

on GitHub

Please consult the Upgrade notes in the documentation for specific instructions for this release, and general upgrade instructions. Below is an automatically generated list of all PRs merged since the previous release.

Changes since 3.5.0

• docs(pro): groups own and run their Triage Engine rules and Report Builder content @blakeaowens (#16702)
• docs(groups): document Default Profiles and the Instance Landing Page @blakeaowens (#16706)
• docs(threat-intel): document the Exploit Evidence filter; on by default since 3.2.200 @svader0 (#16699)
• docs(risk-acceptance): explain how to give a team read-only access to risk acceptances @Jino-T (#16679)
• docs: findings export offers Test and Engagement version/build metadata fields @paulOsinski (#16703)
• docs(dedupe): the pool previews count Keep Both Active findings apart @blakeaowens (#16723)
• docs(rules-engine): explain how Run Now brings existing dedupe matches under a Keep Both Active rule @blakeaowens (#16721)
• docs(assets): describe the redesigned Exposure panel and its edit form @blakeaowens (#16731)
• docs(rules-engine): the import previews count Keep Both Active findings as created and linked @blakeaowens (#16724)
• docs(rules-engine): closing a risk-accepted finding from a rule removes the acceptance @blakeaowens (#16718)
• docs(rules-engine): document the Linked Findings tab and removing a Keep Both Active link @blakeaowens (#16722)
• docs(custom-fields): document the Other choice on select fields @blakeaowens (#16713)
• docs(assets): describe the redesigned Priority and SLA Drivers card @blakeaowens (#16725)
• docs(mcp): document the Personal Data Filter @Maffooch (#16714)
• docs(pro): Remediation Center groups Findings by a vendor patch named in remediation text @Maffooch (#16716)
• docs(connectors): describe the Tenable credentialed scan tags @Maffooch (#16710)
• docs(pro): Form Configuration governs /api/v2/ writes and the API schema @Maffooch (#16708)
• docs(pro): describe what the Asset PCI DSS Scope widget shows @blakeaowens (#16707)
• docs(calendar): document the Interactive default for the Pro calendar @paulOsinski (#16694)
• docs(dashboards): document read-only collaborative dashboard layouts @Maffooch (#16705)
• docs(pro): every user accepts the End User License Agreement once @blakeaowens (#16671)
• docs(onprem): service mesh (Istio) and read-only root filesystem on Kubernetes @Maffooch (#16701)
• docs(users): describe permission audit, access from the user and group pages, and View As User @blakeaowens (#16641)
• docs(pro): describe what the Asset Compliance tab shows @blakeaowens (#16691)
• refactor(urls): add a site_url() helper for building absolute URLs @Maffooch (#16695)
• docs(walkthroughs): describe continuing a task walkthrough without saving @blakeaowens (#16697)
• docs(triage-engine): name the email recipients flag as the product does @blakeaowens (#16698)
• docs(navigation): document sidebar presets @blakeaowens (#16649)
• docs(pro): carry container findings across image tags on reimport @blakeaowens (#16692)
• docs(form-configuration): describe named form configurations and the default @blakeaowens (#16677)
• docs(triage-engine): a rule emails DefectDojo users only @blakeaowens (#16676)
• docs(findings): list the Mitigated By filter and column on the Findings filter index @paulOsinski (#16666)
• docs(sensei): a Partial scan names scanners that did not complete, for any reason @stevewallone (#16667)
• docs(pro): document supply chain security and package analysis @devGregA (#16672)
• docs(triage-engine): say what a batch-level alert or email template can name @blakeaowens (#16660)
• docs(audit-log): say the audit log total is a lower bound past 10,000 entries @blakeaowens (#16670)
• Apply the forced password reset rule to API token auth @svader0 (#16571)
• Apply organization read permission to API v3 expand @svader0 (#16499)
• fix(findings): check object access when serving report images @svader0 (#16662)
• docs(changelog): add DefectDojo Pro 3.5.0 release notes @Maffooch (#16669)
• chore(deprecations): move the Tool Type, Tool Configuration and API Scan Configuration removals to 3.6.0 @devGregA (#16668)

🚩 Changes to settings.dist.py / local_settings.py

• feat(system_settings): add a read-only mode @svader0 (#16386)

🚩 Database migration

• fix(migrations): apply 0304's state operations without re-rendering models @Maffooch (#16700)
• fix(migrations): make 0305 archive_batch indexes safe to re-run after a partial failure @Maffooch (#16673)
• feat(system_settings): add a read-only mode @svader0 (#16386)

🚀 General features and enhancements

• fix(migrations): apply 0304's state operations without re-rendering models @Maffooch (#16700)
• feat(system_settings): add a read-only mode @svader0 (#16386)

🚀 API features and enhancements

• fix(api): sanitize the OpenAPI schema download filename so a crafted ?version= cannot 500 @Maffooch (#16656)

🐛 Bug Fixes

• fix(migrations): apply 0304's state operations without re-rendering models @Maffooch (#16700)
• fix(migrations): make 0305 archive_batch indexes safe to re-run after a partial failure @Maffooch (#16673)

🧰 Maintenance