Release: Merge release into master from: release/3.3.200 - #16023
Merged
Merged
Conversation
…15917) * docs(connectors): document the Aqua per-branch deduplication toggle * docs(connectors): note that the connector owns the branch engagement dedupe setting The connector re-applies its configured value on every branch resolve, so a value an admin sets by hand on a branch engagement is reset on the next sync. Before this feature the connector never touched the flag after creating the engagement, so the hand-set value stuck. The docs now say which side owns the setting.
…100-3.4.0-dev (#15950) * Update versions in application files * Update versions in application files --------- Co-authored-by: DefectDojo release bot <dojo-release-bot@users.noreply.github.com> Co-authored-by: Ross E Esposito <rossespo@gmail.com>
The Qualys connector gains an opt-in "Create endpoints from hosts" option that attaches each finding's host (DNS name, else NetBIOS, else IP, plus the detection's port) as an endpoint. Documents the toggle, the naming preference order, port handling, endpoint reuse, and the off-by-default behavior. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Add the AI Agent Red Teaming capability page (onboarding an agent target, the OpenAI-compatible and generic-JSON adapters, running a scan and what a finding looks like, the /api/v2/agentsec/runtime/ check API, quotas, troubleshooting) and a one-line mention in the Sensei overview. Text-only.
Adds improper output handling, retrieval (RAG) injection and unbounded consumption to the technique list and their CWE mappings. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Final prose pass on the outward-facing docs: replace rhetorical em-dashes with plain punctuation (colons for term glosses, periods/commas/parentheses inline). No facts, endpoints, or code changed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Fill out the 3.3.100 changelog entry, which previously covered only the Dedupe Pools / Matching Configuration feature. Summarize the remaining user-facing work from the release: new connectors and connector controls, shared dashboards, markdown inline images, the Vertex AI provider, keyless/delegated cloud auth for Sensei, and a batch of connector, UI, API, and reporting bug fixes. Dormant Go single-writer work, CI/test plumbing, Vue table refactors, and docs-only PRs are omitted. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…15953) The English message catalog set `msgstr "Поиск"` on the "Search", "Simple Search", and "simple_search" entries, so the compiled `.mo` served the Russian word in the English locale (visible in the navbar search box). English is the source language, so those msgstr values must be empty and fall back to the msgid. Blank the three translations, drop the stale `#, fuzzy` markers, and add a regression test asserting the English catalog stays free of translated strings and fuzzy entries. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* docs(sensei): document Dynamic Scanning (DAST) * docs(sensei): document the DAST scanners, API schema, and scan-on-deploy Extends the Dynamic Scanning page for the scanner choice (Nuclei / ZAP / Schemathesis with a "Choosing a scanner" section), the Schemathesis API Schema field, and the new "Scan on deploy" automation (a successful GitHub deployment auto-launches a scan of the matching, opted-in, still-verified target). * docs(sensei): document scheduled DAST scans Adds a "Scheduling scans" section: a verified target can run on a recurring cron schedule (at most once per day), independent of the deploy trigger, via DefectDojo's scheduling service; ownership is re-checked at each scheduled run. * docs(sensei): document the DAST <-> Rules Engine integration Adds a "Rules Engine" section: a rule can launch a dynamic scan (the Launch DAST Scan action) and can react to a completed scan over its findings (the On DAST Scan Completed trigger). Both surface only when dynamic scanning is enabled. * docs(sensei): document AI triage of DAST findings --------- Co-authored-by: Cody Maffucci <agent-cody@defectdojo.com>
…se sections (#15959) Reorganize the self-hosted DefectDojo Pro on-prem docs so each deployment method has its own section and method-specific guidance. - Add Kubernetes (Helm) and Docker Compose subsections and move the method-specific pages into them, with backward-compat aliases. - Split genuinely divergent pages per method (upload size limits) and use Kubernetes/Compose tabs on mostly-shared pages (hardware sizing, migrating, backing up, FIPS enablement) to avoid duplicating prose. - Extract Amazon ECS/Fargate FIPS onto its own page. - Add a dedicated Docker Compose upgrade guide and rescope the on-prem "Upgrading" page into a method-neutral hub. - Add a Kubernetes migration runbook with an error-keyed troubleshooting index and a verification checklist. - Hardware sizing: add a Docker Compose sizing tab (extrapolated from the Kubernetes tiers) and correct the uWSGI/Celery tuning guidance (keep threads low, scale with processes, watch DB connections). - Surface both upgrade guides in the changelog (Pro Upgrades) left nav. English pages only; translations regenerate via the i18n pipeline. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Add a "Schedule recurring scans" subsection to the AI Agent Red Teaming page: the Schedule scans row action, the once-per-day cap and why it is stricter than the other capabilities, and that the action only appears when the scheduling service is enabled. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
docs(sensei): AI Agent Red Teaming capability page
…15991) Clarify that a Defender "device" is one individual machine (one finding per device / software version / CVE), document the new Device Groups allowlist for importing in phases (plus the record-mapping alternative), and explain setting a minimum severity per device group via a per-record severity override. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…#15992) Add the full regional CSPM Auth Host table (US/EU/Singapore/Sydney), state that the Auth Host is separate from the Location edge host, and add a troubleshooting note that a 405 during validation means the Auth Host is not the CSPM API host. Docs for the matching Pro UI clarification; reported via a customer support ticket.
…ng toggles to the Classic UI and /api/v2 (#15990) DefectDojo Pro reads the stored Locations and Organization / Asset Relabeling toggles at start-up and applies them to the deployment settings the Classic UI, /api/v2 and /api/v3 route wiring read. Operators no longer need to set DD_V3_FEATURE_LOCATIONS or DD_ENABLE_V3_ORGANIZATION_ASSET_RELABEL to make a restart move those surfaces; the env vars remain the upgrade seed and the DB-down fallback. Adds the 3.3.200 upgrade note that corrects the 3.2.200 guidance. Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Rename the automation docs section from "Rules Engine 2.0" to "Triage Engine" to match the product name change, across English and all seven translations. - Move content/automation/rules_engine_2/ -> triage_engine/ (URL changes to /automation/triage_engine/); add aliases for the old /automation/rules_engine_2/ paths and keep the older rules_engine_v2 aliases, so existing links keep resolving. - Swap the display name in titles and prose (all 8 languages), and update cross-references from the classic Rules Engine page, messaging connectors, PAIN ratings, audit log, permission chart, page layouts and risk acceptance docs. The changelog and the sidebar redesign mapping table keep the historical name on purpose. - Node reference: document three nodes that were missing (Assign to a Dedupe Pool, Publish to an SNS Topic, Set Potential Agency Impact) and correct the node count to 41. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
#15986) * docs(onprem): document app-tier and database tuning knobs for hardware sizing Add a "what each knob does" table for the uWSGI/Celery application-tier settings, and a new "Tuning the database" section covering the PostgreSQL settings that matter most for DefectDojo's aggregation-heavy reads (shared_buffers, effective_cache_size, work_mem, maintenance_work_mem, max_connections), plus a connection-budget subsection tying the application tier and database together. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(docs): land deep links in the page's own edition (Pro/OSS) Pages carry an audience (pro/opensource); general pages have none. Stamp data-dd-version from the page's own audience before first paint and persist it, so a deep link to a Pro page puts the reader in the Pro section (with the matching sidebar) instead of leaving them in their stored edition's nav around Pro content. General pages keep the stored preference. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…it Finding form (#15984) The Pro UI Add/Edit Finding form now exposes EPSS Score, EPSS Percentile, Known Exploited, Used in Ransomware and KEV Date Added in a Threat Intelligence panel under Optional Fields. Document the panel, how the EPSS/KEV sync treats hand-entered values (replaced on CVE-backed findings, kept on findings without a CVE), that hand-set values feed priority and risk, and that a rule reacting to a hand-set flag should use the KEV: Known Exploited condition because the FedRAMP review template keys on Exploit Maturity from the threat-intelligence feed. Also fix the "ESS" typo on the Pro Findings reference page. Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* docs(pro): PCI DSS scope, patch clock, and scope inventory Document the Pro PCI DSS v4.0.1 scope features: per-Asset scope and component classification, the public-facing determination, scope confirmation, the assessment anchor, the Requirement 6.3.3 patch-clock SLA, the instance entity type, and the scope inventory export. Behind the pci_dss feature flag. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(pro): add SLA start policy to the PCI DSS scope page Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(pro): add targeted risk analyses to the PCI DSS scope page Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(pci): reflect the reviewed PCI scope, SLA start and risk analysis behavior The API is behind the flag with the UI, hand-set SLA starts are authoritative and the default policy changes nothing, the fix-available date has no import date fallback, a never-assessed Asset counts as not assessed, and targeted risk analyses have one scope, a one-way lifecycle, and owner-directed review alerts. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Protocol-less URLs (e.g. 'amazon.com') caused urlparse(matched).hostname to return None, making different hosts share the same dupe_key and hash_code — merging findings that should have remained distinct. Prepend '//' before urlparse() so the hostname is correctly extracted. This mirrors the existing pattern used for LocationData construction on line 91 of the same file.
…g on disk (#15960) * fix(files): return 404 instead of 500 when an uploaded file is missing on disk Downloading an uploaded file whose FileUpload row exists in the database but whose bytes are absent on disk raised a low-level FileNotFoundError that surfaced as an unhandled HTTP 500. This happened when reading file_object.file.size in generate_file_response (e.g. GET /access_file/<id>/<oid>/Finding) and when opening a raw path in generate_file_response_from_file_path (e.g. the engagement threat model download). Guard both helpers: when the file is not present on disk, raise Http404 so the caller receives a clean "not found" response instead of a server error. This covers every file-download path that routes through these helpers (the access_file view, and the finding/test/engagement UI and API download endpoints). Add a regression test that parameterizes the present-file (control) and missing-file cases for both helpers. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015MoDChxuDr2CVnTTYjxZmR * fix(files): derive missing file_name from path.stem in generate_file_response_from_file_path The file_name-not-supplied branch called .rsplit() on a Path object (file_path_without_extension was `path.parent / path.stem`, a PosixPath), raising AttributeError: 'PosixPath' object has no attribute 'rsplit' and a 500. Any caller that omits file_name hit this — notably the engagement threat-model download (generate_file_response_from_file_path(eng.tmodel_path)). Use path.stem, which is exactly the value the original code intended (the final path component without its extension). Surfaced by the new regression test's present-file control case for this helper. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015MoDChxuDr2CVnTTYjxZmR * test(files): close file handle directly to avoid closing the test DB connection The present-file cases called response.close() on the FileResponse, which emits Django's request_finished signal; its close_old_connections handler closed this TestCase's DB connection, so every subsequent test in the class failed at FileUpload.objects.create() with "the connection is closed". Close the underlying file handle via response.file_to_stream.close() instead, which releases the handle without firing the signal. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015MoDChxuDr2CVnTTYjxZmR --------- Co-authored-by: Claude <noreply@anthropic.com>
The v3 notes sub-resource read the parent relation directly. Its comment said it mirrored v2, but v2 has routed note reads through visible_notes() since 3.2.100, so the two paths disagreed on what private means. The existing privacy test asserted the older behaviour and is inverted here, and the rule is now checked on all three parents plus the envelope count.
…ssion check (#15988) The auto branch of POST /import dispatches on the numeric engagement field, while the permission check only resolved the name fields. The check now builds the same context the service resolves from, so both agree on the target. Adds regression coverage for the denial, including the reimport leg.
…#15993) The import, reimport, and metadata-import permission checks parse request.data to resolve the target product/engagement/test before the serializer runs. When a scan import submits more form fields than DATA_UPLOAD_MAX_NUMBER_FIELDS (or a body larger than DATA_UPLOAD_MAX_MEMORY_SIZE), Django's multipart parser raises a SuspiciousOperation (TooManyFieldsSent / RequestDataTooBig) while request.data is evaluated. That exception escaped the permission check as an opaque error and generated error-reporting noise. Catch those exceptions in the three import/reimport permission classes and raise a DRF ValidationError with an actionable message instead. Also make DATA_UPLOAD_MAX_NUMBER_FIELDS configurable via DD_DATA_UPLOAD_MAX_NUMBER_FIELDS (default 10240), mirroring DD_DATA_UPLOAD_MAX_MEMORY_SIZE, so operators can raise the limit for instances that legitimately submit very large imports. Adds unit tests covering all three permission classes and the setting default. Claude-Session: https://claude.ai/code/session_01EWbcF7wUybs9Z2bFCpEi49 Co-authored-by: Claude <noreply@anthropic.com>
KICS: TypeError when expected_value is null in dupe_key concatenation. Added query_id to dupe_key for proper differentiation. AppSpider: AttributeError on unsaved_request typo (should be unsaved_req_resp) — every duplicate finding crashes. KubeHunter: TypeError when vid is absent (vuln_id_from_tool is None) in dupe_key string concatenation. Terrascan: TypeError from 'and' vs 'or' logic bug when results key is missing, plus None concat in dupe_key fields. TFSec: TypeError when rule_provider is null (custom/trivy rules) in dupe_key concatenation. ZAP: TypeError when requestbody/responsebody XML tags are absent (findtext returns None) in request/response assembly. Each fix uses f-strings with 'or empty' guards. All existing tests pass. New regression tests added for each parser.
* Show authorized finding groups to product members Use the Finding Group authorization queryset for list views so groups are visible according to their owning test and product, including groups without member findings. Keep unauthorized products out of the list and cover the UI permission matrix. Signed-off-by: ADİL ALPEREN ÇİFTCİ <134228585+adilalperenciftci@users.noreply.github.com> * Cover finding group open and closed lists Exercise the authorization matrix through the open and closed Finding Group list views so their queryset filtering remains covered. Signed-off-by: ADİL ALPEREN ÇİFTCİ <134228585+adilalperenciftci@users.noreply.github.com> * Preserve empty finding groups in ownership filters Filter products and engagements through each Finding Group's owning test so authorized groups remain visible without member findings. Cover product and engagement filtering across authorized and unauthorized products. Signed-off-by: ADİL ALPEREN ÇİFTCİ <134228585+adilalperenciftci@users.noreply.github.com> --------- Signed-off-by: ADİL ALPEREN ÇİFTCİ <134228585+adilalperenciftci@users.noreply.github.com>
#15981) The Location tag scoping added in #15784 covered the REST API and the location pages. The classic search view and the Product Endpoint Report options page were missed, so both still joined the raw tag relation on a globally deduplicated row. Search also matched on it, which made a substring operator an oracle over a value the page withholds. Both now use dojo.location.queries.readable_tag_match, the same predicate the API filters and the location templates use. Endpoint gains a readable_tags mirror because simple_search.html serves either model. Refs H1 #4005137.
Companion page to the PCI DSS scope docs, for the Requirement 11 evidence features: how a test gets a PCI role, the facts a scan report cannot carry (authenticated, ASV result, vendor and attestation reference), significant changes and unauthenticated system exceptions, what each cell of the quarterly grid means and the exact rule behind it, how the annual Requirement 11.4 checks are measured, the dashboard tile and the end-of-quarter reminders, and what the evidence workbook contains. States plainly that DefectDojo records the ASV results an entity reports, does not perform ASV scans, and does not validate an attestation, so a passing result is never inferred from an absence of findings. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
…l Eight) (#16007) One Pro docs page for the Framework Presets settings page: what a preset contains, what the two shipped presets encode and which published version, how plan and apply work, why applying never reassigns assets, revert, drift, versions, export and import, and the public API. States plainly that a preset is our reading of a scheme at a point in time and not certification. Co-authored-by: devGregA <greg-agent-2@defectdojo.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
…16008) * docs: describe vulnerability response policies on the priority and SLA page Documents the policy table that replaces the hardcoded remediation ladder: how a policy is attached to an SLA configuration, how a deadline is composed from severity or risk, the KEV due date and the policy cell, and how each of the three grading axes is resolved. Says plainly that a policy only ever tightens a deadline, that a value set by hand is never overwritten, and that an unestablished fact is resolved to whichever value the policy treats more urgently so it can never earn a finding more time. Notes that the shipped FedRAMP table reflects one published version and that readers should confirm the version in force for their own authorization. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs: describe the evaluation clock and escalation on the priority and SLA page (#16012) Continues the response policies section with the two obligations a published standard adds beyond a deadline: evaluating every finding inside a window measured from detection, and treating one combination of facts as an incident until it stops being true. Says plainly that establishing a fact is what counts as evaluating, that the daily notification is one per asset rather than one per finding and why, that closed findings are not queued, that a rule never overwrites a person's answer, and that escalation is a flag and a view rather than a separate record to manage. Stacked on the response policies docs branch rather than amending it, so that pull request is unchanged. Co-authored-by: devGregA <greg-agent-2@defectdojo.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: devGregA <greg-agent-2@defectdojo.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
The assessment side of the PCI DSS work: what the authored catalog covers and that every requirement statement in it is a paraphrase rather than the text of the standard, how to scope an assessment to a cardholder data environment that spans several Assets, which requirements DefectDojo evidences by itself and what each one reads, how the shared obligation vocabulary is translated into Report on Compliance wording in the workbook, and what each of the workbook's eight sheets contains. Says plainly that DefectDojo does not determine compliance: it reports what the recorded evidence shows and the assessor decides what is in place. Two rules an assessor needs before reading a result are called out rather than left implicit. A partially satisfied obligation is reported as not in place, because PCI DSS has no partial credit. In place with compensating control means somebody overrode the result, because DefectDojo cannot tell a compensating control from any other override, and the recorded reason needs checking. Co-authored-by: Greg Anderson <greg@Gregs-MBP.lan> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* docs(sensei): document the Tier Advisor Explains what the projection does, why it asks about cadence and estate coverage rather than annualizing trial usage directly, what the headroom wording means, and when it declines to answer. No prices: the page describes which tier covers a volume without naming what a tier costs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(sensei): ask how long findings should be kept, and say what retention covers The question is about the reader's retention obligation, so it no longer says "closed findings" in the question itself. The scope is stated plainly instead: retention governs closed findings and scan history, and findings that are still open are never aged out. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Greg Anderson <greg-agent-2@defectdojo.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* perf: debounce product grade recalculation per product Every finding save scheduled its own calculate_grade task, so a bulk operation (an import, a rules run, a mass edit) queued one task per finding for a value that only needs computing once per product per burst. On a large instance that was thousands of identical tasks competing with the import itself for the worker pool, with several recalculations of the same product running at once. schedule_product_grade() now coalesces background requests: the first change in a window records a marker in the cache and queues one calculate_grade task with a countdown of PRODUCT_GRADE_DEBOUNCE_SECONDS (default 30, env DD_PRODUCT_GRADE_DEBOUNCE_SECONDS; 0 restores a task per change); later changes in the window do nothing. The task drops the marker as it starts, so a change that lands while it runs queues the follow-up it needs, and the marker expires with the window, so an undelivered task cannot block grading. Foreground recalculation (force_sync, or a user whose profile blocks background execution) is unchanged: it runs at once and is never held back by a marker. Every dispatch site of calculate_grade goes through the helper; the two synchronous calls in the bulk-edit views are unchanged. * test: run the unit-test suites with the grade debounce window off The debounce marker lives in the Django cache for the length of the window. Under the test runner a dispatched grade task may never execute, so a marker can outlive the test that set it and silently skip grading for the next test whose product gets the same id, and a live window makes query-count baselines depend on timing rather than on the code under test. Both unit-test compose environments now set DD_PRODUCT_GRADE_DEBOUNCE_SECONDS=0, which queues a task per change exactly as before; the debounce's own tests turn the window on explicitly.
* docs(dashboards): document the Command Center scene The flag-gated Home for Dashboards 2.0 in Pro: how the scene reads (top sources into the flow rings inside the posture score, out to the Active and Mitigated outcome families), the beam through the ribbons and what its glow means, the score sectors and their captions, the honesty states, the window and history controls, the kiosk, and the breadcrumb every door lands with. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(dashboards): the Command Center's flow rings tell their stories Each flow ring divides into arcs (ingested by source, unique by severity, actionable by risk band), every arc a door onto its slice; the screen carries one continuous motion, the beam, and the rings beat with it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(dashboards): the Command Center's score sectors focus and explain themselves on hover Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(dashboards): the Command Center's flow ring arcs focus and card themselves, the rules receipt follows the flag Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(dashboards): the Command Center has its own page, and the grid is a preset The scene lives at /command-center now, on its own route rather than under the dashboards, so the page says that instead of pointing readers at Dashboards > Command Center. The sidebar section is rewritten for the two entries that exist: Home lands on the scene, Dashboards opens the customizable grids. The third entry it described is gone. The grid preset is no longer the starter either: new users are handed Default Dashboard on first login, and the grid is a preset they can clone like any other. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
The Command Center scene is the home page for every Pro user and needs no feature flag. Customizable Dashboards keep their flag, and the sidebar row under Home reads Dashboards (the customizable grids) while that feature is on and Dashboard (the classic tile dashboard) while it is off. The three dashboards pages say so; the Pro change ships beside this on the same release line. Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Go-only advisories (e.g. GO-2026-5932) come without any CVE/GHSA alias. The Govulncheck Scanner parser read aliases[0] unconditionally in both the legacy and the streaming output branches, so the import failed with KeyError: 'aliases'. Use the first alias when there is one and leave the CVE empty otherwise, like GovulncheckParserV2 already does. Findings of the legacy format that have no alias are grouped by OSV id.
…he location FK (#16020) * fix(location): resolve location_type/location_value filters through the location FK The /api/v2/location_findings/ and /api/v2/location_products/ endpoints are backed by LocationFindingReferenceFilter and LocationProductReferenceFilter. Both declared location_type and location_value as direct fields on the reference (through) model, but those columns live on the related Location model. Any request that used one of these filters (e.g. ?location_type_contains=...) or ordered by them raised: django.core.exceptions.FieldError: Cannot resolve keyword 'location_type' into field. Choices are: audit_time, auditor, ..., location, location_id, ... which surfaced to the client as a 500. Point both char filters and the ordering entries at the location__location_type / location__location_value ORM path via the existing model_field_name / (orm, alias) helper support, so they resolve through the location FK while the public query parameter names (location_type_*, location_value_*, ordering=location_type| location_value) stay unchanged for existing API clients and the UI. This mirrors how created/updated are already aliased on these same filtersets. Added unittests/test_location_reference_filters.py covering contains-match, a zero-match case, and ordering for both filtersets; each reproduces the FieldError before the fix. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L4KLUavvAVfs11WZKrexEm * test(location): make reference-filter test self-contained (drop dojo_testdata) The regression test loaded the dojo_testdata fixture, which carries deprecated Endpoint rows and fails to install in the V3_FEATURE_LOCATIONS test lane (EndpointDeprecatedError), erroring setUpClass. Build the minimal Product → Engagement → Test → Finding graph and a reporter user directly instead, so the test runs in both the locations-on and locations-off lanes without depending on the fixture. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L4KLUavvAVfs11WZKrexEm --------- Co-authored-by: Claude <noreply@anthropic.com>
…ack (#16017) * docs(fda): component support metadata and the cyber device evidence pack Three changes, covering the cyber device work end to end. The Locations SBOM page gains the supplier and support fields a component now carries, and a section on where those facts come from: what each import format supplies, that unknown is a valid recorded answer rather than a guess, and the order a per-snapshot override, a recorded value and unknown resolve in. An edit made by hand survives a later import, and the support source field is what tells a reviewer which case applies. The SBOM export page gains the supplier and support properties each format emits, and says plainly that a component with an unknown support level emits no property at all, because a consumer reading a support level should be reading a claim somebody made rather than a placeholder. A new page covers the cyber device profile, the three lifecycle metrics, the assessment and the evidence pack. It describes each of the seven elements in our own words with the statute cited, says which nine controls are evidenced from data and which four are the manufacturer's paperwork, and states plainly that DefectDojo records and reports what the manufacturer supplies, does not assess whether a bill of materials is complete or accurate, and does not determine whether a submission satisfies the FDA. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(fda): point the cross section link at the right depth The page sits one level down, so reaching another top-level section takes two levels up rather than one. The sibling link inside this section is unchanged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Greg Anderson <greg@Gregs-MBP.lan> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com>
…is not the fix) (#16022) PR #16005 said a non-default branch must be pinned in Aqua before it imports. Re-verifying against a live tenant with the connector's own credentials showed that is wrong: Aqua's scan-results feed (which the connector reads) returns a repository's default branch only for some sources such as Azure DevOps, regardless of pinning or token scope, so pinning does not make the branch appear in the feed. Rewrite the Branch handling section to describe the actual behavior: the connector imports whatever branches Aqua returns in its scan-results feed, some sources expose only the default branch, and an operator who expects a missing branch should contact support. Removes the pinning instruction. Reported via a customer support ticket. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
github-actions
Bot
requested review from
Maffooch and
blakeaowens
as code owners
September 21, 2026 16:20
github-actions
Bot
added
docker
settings_changes
|
This pull request contains multiple low-severity findings where sensitive codepaths were modified by authors not on the allowed list. These changes involve various Python and HTML files within the dojo directory but are non-blocking.
Configured Sensitive Codepath Modified by Non-Allowed Author in
|
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/finding_group/views.py' matches configured sensitive codepath pattern 'dojo/finding_group/*.py' and was modified by 'adilalperenciftci' (commit e8164e3) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/endpoint/models.py (drs_15ab365e)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/endpoint/models.py' matches configured sensitive codepath pattern 'dojo/endpoint/*.py' and was modified by 'svader0' (commit 85e0a39) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/search/views.py (drs_d9e24c18)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/search/views.py' matches configured sensitive codepath pattern 'dojo/search/*.py' and was modified by 'svader0' (commit 85e0a39) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/request_endpoint_report.html (drs_99eb4bfe)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/request_endpoint_report.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'svader0' (commit 85e0a39) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/simple_search.html (drs_3877d78f)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/simple_search.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'svader0' (commit 85e0a39) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/urls.py (drs_f93ad7b7)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/urls.py' matches configured sensitive codepath pattern 'dojo/urls.py' and was modified by 'svader0' (commit cd52200) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/user/models.py (drs_5b514f95)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/user/models.py' matches configured sensitive codepath pattern 'dojo/user/*.py' and was modified by 'svader0' (commit cd52200) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/view_product_details.html (drs_b5095aaa)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/view_product_details.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'svader0' (commit 92598c9) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/view_product_type.html (drs_f7e716e6)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/view_product_type.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'svader0' (commit 92598c9) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/view_user.html (drs_a453a239)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/view_user.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'svader0' (commit 92598c9) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/metrics/views.py (drs_e238dc98)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/metrics/views.py' matches configured sensitive codepath pattern 'dojo/metrics/*.py' and was modified by 'svader0' (commit 1d8082d) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/finding/helper.py (drs_ca4c3959)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/finding/helper.py' matches configured sensitive codepath pattern 'dojo/finding/*.py' and was modified by 'svader0' (commit d919c3b) who is not in the allowed authors list. |
Comment to provide feedback on these findings.
Report false positive: @dryrunsecurity fp [FINDING ID] [FEEDBACK]
Report low-impact: @dryrunsecurity nit [FINDING ID] [FEEDBACK]
Example: @dryrunsecurity fp drs_90eda195 This code is not user-facing
All finding details can be found in the DryRun Security Dashboard.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
12 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release triggered by
rossops