Release: Merge back 3.3.200 into dev from: master-into-dev/3.3.200-3.4.0-dev - #16025
Merged
Merged
Conversation
…15917) * docs(connectors): document the Aqua per-branch deduplication toggle * docs(connectors): note that the connector owns the branch engagement dedupe setting The connector re-applies its configured value on every branch resolve, so a value an admin sets by hand on a branch engagement is reset on the next sync. Before this feature the connector never touched the flag after creating the engagement, so the hand-set value stuck. The docs now say which side owns the setting.
…100-3.4.0-dev (#15950) * Update versions in application files * Update versions in application files --------- Co-authored-by: DefectDojo release bot <dojo-release-bot@users.noreply.github.com> Co-authored-by: Ross E Esposito <rossespo@gmail.com>
The Qualys connector gains an opt-in "Create endpoints from hosts" option that attaches each finding's host (DNS name, else NetBIOS, else IP, plus the detection's port) as an endpoint. Documents the toggle, the naming preference order, port handling, endpoint reuse, and the off-by-default behavior. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Add the AI Agent Red Teaming capability page (onboarding an agent target, the OpenAI-compatible and generic-JSON adapters, running a scan and what a finding looks like, the /api/v2/agentsec/runtime/ check API, quotas, troubleshooting) and a one-line mention in the Sensei overview. Text-only.
Adds improper output handling, retrieval (RAG) injection and unbounded consumption to the technique list and their CWE mappings. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Final prose pass on the outward-facing docs: replace rhetorical em-dashes with plain punctuation (colons for term glosses, periods/commas/parentheses inline). No facts, endpoints, or code changed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Fill out the 3.3.100 changelog entry, which previously covered only the Dedupe Pools / Matching Configuration feature. Summarize the remaining user-facing work from the release: new connectors and connector controls, shared dashboards, markdown inline images, the Vertex AI provider, keyless/delegated cloud auth for Sensei, and a batch of connector, UI, API, and reporting bug fixes. Dormant Go single-writer work, CI/test plumbing, Vue table refactors, and docs-only PRs are omitted. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…15953) The English message catalog set `msgstr "Поиск"` on the "Search", "Simple Search", and "simple_search" entries, so the compiled `.mo` served the Russian word in the English locale (visible in the navbar search box). English is the source language, so those msgstr values must be empty and fall back to the msgid. Blank the three translations, drop the stale `#, fuzzy` markers, and add a regression test asserting the English catalog stays free of translated strings and fuzzy entries. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* docs(sensei): document Dynamic Scanning (DAST) * docs(sensei): document the DAST scanners, API schema, and scan-on-deploy Extends the Dynamic Scanning page for the scanner choice (Nuclei / ZAP / Schemathesis with a "Choosing a scanner" section), the Schemathesis API Schema field, and the new "Scan on deploy" automation (a successful GitHub deployment auto-launches a scan of the matching, opted-in, still-verified target). * docs(sensei): document scheduled DAST scans Adds a "Scheduling scans" section: a verified target can run on a recurring cron schedule (at most once per day), independent of the deploy trigger, via DefectDojo's scheduling service; ownership is re-checked at each scheduled run. * docs(sensei): document the DAST <-> Rules Engine integration Adds a "Rules Engine" section: a rule can launch a dynamic scan (the Launch DAST Scan action) and can react to a completed scan over its findings (the On DAST Scan Completed trigger). Both surface only when dynamic scanning is enabled. * docs(sensei): document AI triage of DAST findings --------- Co-authored-by: Cody Maffucci <agent-cody@defectdojo.com>
…se sections (#15959) Reorganize the self-hosted DefectDojo Pro on-prem docs so each deployment method has its own section and method-specific guidance. - Add Kubernetes (Helm) and Docker Compose subsections and move the method-specific pages into them, with backward-compat aliases. - Split genuinely divergent pages per method (upload size limits) and use Kubernetes/Compose tabs on mostly-shared pages (hardware sizing, migrating, backing up, FIPS enablement) to avoid duplicating prose. - Extract Amazon ECS/Fargate FIPS onto its own page. - Add a dedicated Docker Compose upgrade guide and rescope the on-prem "Upgrading" page into a method-neutral hub. - Add a Kubernetes migration runbook with an error-keyed troubleshooting index and a verification checklist. - Hardware sizing: add a Docker Compose sizing tab (extrapolated from the Kubernetes tiers) and correct the uWSGI/Celery tuning guidance (keep threads low, scale with processes, watch DB connections). - Surface both upgrade guides in the changelog (Pro Upgrades) left nav. English pages only; translations regenerate via the i18n pipeline. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Add a "Schedule recurring scans" subsection to the AI Agent Red Teaming page: the Schedule scans row action, the once-per-day cap and why it is stricter than the other capabilities, and that the action only appears when the scheduling service is enabled. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
docs(sensei): AI Agent Red Teaming capability page
…15991) Clarify that a Defender "device" is one individual machine (one finding per device / software version / CVE), document the new Device Groups allowlist for importing in phases (plus the record-mapping alternative), and explain setting a minimum severity per device group via a per-record severity override. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…#15992) Add the full regional CSPM Auth Host table (US/EU/Singapore/Sydney), state that the Auth Host is separate from the Location edge host, and add a troubleshooting note that a 405 during validation means the Auth Host is not the CSPM API host. Docs for the matching Pro UI clarification; reported via a customer support ticket.
…ng toggles to the Classic UI and /api/v2 (#15990) DefectDojo Pro reads the stored Locations and Organization / Asset Relabeling toggles at start-up and applies them to the deployment settings the Classic UI, /api/v2 and /api/v3 route wiring read. Operators no longer need to set DD_V3_FEATURE_LOCATIONS or DD_ENABLE_V3_ORGANIZATION_ASSET_RELABEL to make a restart move those surfaces; the env vars remain the upgrade seed and the DB-down fallback. Adds the 3.3.200 upgrade note that corrects the 3.2.200 guidance. Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Rename the automation docs section from "Rules Engine 2.0" to "Triage Engine" to match the product name change, across English and all seven translations. - Move content/automation/rules_engine_2/ -> triage_engine/ (URL changes to /automation/triage_engine/); add aliases for the old /automation/rules_engine_2/ paths and keep the older rules_engine_v2 aliases, so existing links keep resolving. - Swap the display name in titles and prose (all 8 languages), and update cross-references from the classic Rules Engine page, messaging connectors, PAIN ratings, audit log, permission chart, page layouts and risk acceptance docs. The changelog and the sidebar redesign mapping table keep the historical name on purpose. - Node reference: document three nodes that were missing (Assign to a Dedupe Pool, Publish to an SNS Topic, Set Potential Agency Impact) and correct the node count to 41. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
#15986) * docs(onprem): document app-tier and database tuning knobs for hardware sizing Add a "what each knob does" table for the uWSGI/Celery application-tier settings, and a new "Tuning the database" section covering the PostgreSQL settings that matter most for DefectDojo's aggregation-heavy reads (shared_buffers, effective_cache_size, work_mem, maintenance_work_mem, max_connections), plus a connection-budget subsection tying the application tier and database together. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(docs): land deep links in the page's own edition (Pro/OSS) Pages carry an audience (pro/opensource); general pages have none. Stamp data-dd-version from the page's own audience before first paint and persist it, so a deep link to a Pro page puts the reader in the Pro section (with the matching sidebar) instead of leaving them in their stored edition's nav around Pro content. General pages keep the stored preference. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…it Finding form (#15984) The Pro UI Add/Edit Finding form now exposes EPSS Score, EPSS Percentile, Known Exploited, Used in Ransomware and KEV Date Added in a Threat Intelligence panel under Optional Fields. Document the panel, how the EPSS/KEV sync treats hand-entered values (replaced on CVE-backed findings, kept on findings without a CVE), that hand-set values feed priority and risk, and that a rule reacting to a hand-set flag should use the KEV: Known Exploited condition because the FedRAMP review template keys on Exploit Maturity from the threat-intelligence feed. Also fix the "ESS" typo on the Pro Findings reference page. Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* docs(pro): PCI DSS scope, patch clock, and scope inventory Document the Pro PCI DSS v4.0.1 scope features: per-Asset scope and component classification, the public-facing determination, scope confirmation, the assessment anchor, the Requirement 6.3.3 patch-clock SLA, the instance entity type, and the scope inventory export. Behind the pci_dss feature flag. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(pro): add SLA start policy to the PCI DSS scope page Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(pro): add targeted risk analyses to the PCI DSS scope page Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(pci): reflect the reviewed PCI scope, SLA start and risk analysis behavior The API is behind the flag with the UI, hand-set SLA starts are authoritative and the default policy changes nothing, the fix-available date has no import date fallback, a never-assessed Asset counts as not assessed, and targeted risk analyses have one scope, a one-way lifecycle, and owner-directed review alerts. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Protocol-less URLs (e.g. 'amazon.com') caused urlparse(matched).hostname to return None, making different hosts share the same dupe_key and hash_code — merging findings that should have remained distinct. Prepend '//' before urlparse() so the hostname is correctly extracted. This mirrors the existing pattern used for LocationData construction on line 91 of the same file.
…g on disk (#15960) * fix(files): return 404 instead of 500 when an uploaded file is missing on disk Downloading an uploaded file whose FileUpload row exists in the database but whose bytes are absent on disk raised a low-level FileNotFoundError that surfaced as an unhandled HTTP 500. This happened when reading file_object.file.size in generate_file_response (e.g. GET /access_file/<id>/<oid>/Finding) and when opening a raw path in generate_file_response_from_file_path (e.g. the engagement threat model download). Guard both helpers: when the file is not present on disk, raise Http404 so the caller receives a clean "not found" response instead of a server error. This covers every file-download path that routes through these helpers (the access_file view, and the finding/test/engagement UI and API download endpoints). Add a regression test that parameterizes the present-file (control) and missing-file cases for both helpers. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015MoDChxuDr2CVnTTYjxZmR * fix(files): derive missing file_name from path.stem in generate_file_response_from_file_path The file_name-not-supplied branch called .rsplit() on a Path object (file_path_without_extension was `path.parent / path.stem`, a PosixPath), raising AttributeError: 'PosixPath' object has no attribute 'rsplit' and a 500. Any caller that omits file_name hit this — notably the engagement threat-model download (generate_file_response_from_file_path(eng.tmodel_path)). Use path.stem, which is exactly the value the original code intended (the final path component without its extension). Surfaced by the new regression test's present-file control case for this helper. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015MoDChxuDr2CVnTTYjxZmR * test(files): close file handle directly to avoid closing the test DB connection The present-file cases called response.close() on the FileResponse, which emits Django's request_finished signal; its close_old_connections handler closed this TestCase's DB connection, so every subsequent test in the class failed at FileUpload.objects.create() with "the connection is closed". Close the underlying file handle via response.file_to_stream.close() instead, which releases the handle without firing the signal. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015MoDChxuDr2CVnTTYjxZmR --------- Co-authored-by: Claude <noreply@anthropic.com>
The v3 notes sub-resource read the parent relation directly. Its comment said it mirrored v2, but v2 has routed note reads through visible_notes() since 3.2.100, so the two paths disagreed on what private means. The existing privacy test asserted the older behaviour and is inverted here, and the rule is now checked on all three parents plus the envelope count.
…ssion check (#15988) The auto branch of POST /import dispatches on the numeric engagement field, while the permission check only resolved the name fields. The check now builds the same context the service resolves from, so both agree on the target. Adds regression coverage for the denial, including the reimport leg.
…#15993) The import, reimport, and metadata-import permission checks parse request.data to resolve the target product/engagement/test before the serializer runs. When a scan import submits more form fields than DATA_UPLOAD_MAX_NUMBER_FIELDS (or a body larger than DATA_UPLOAD_MAX_MEMORY_SIZE), Django's multipart parser raises a SuspiciousOperation (TooManyFieldsSent / RequestDataTooBig) while request.data is evaluated. That exception escaped the permission check as an opaque error and generated error-reporting noise. Catch those exceptions in the three import/reimport permission classes and raise a DRF ValidationError with an actionable message instead. Also make DATA_UPLOAD_MAX_NUMBER_FIELDS configurable via DD_DATA_UPLOAD_MAX_NUMBER_FIELDS (default 10240), mirroring DD_DATA_UPLOAD_MAX_MEMORY_SIZE, so operators can raise the limit for instances that legitimately submit very large imports. Adds unit tests covering all three permission classes and the setting default. Claude-Session: https://claude.ai/code/session_01EWbcF7wUybs9Z2bFCpEi49 Co-authored-by: Claude <noreply@anthropic.com>
KICS: TypeError when expected_value is null in dupe_key concatenation. Added query_id to dupe_key for proper differentiation. AppSpider: AttributeError on unsaved_request typo (should be unsaved_req_resp) — every duplicate finding crashes. KubeHunter: TypeError when vid is absent (vuln_id_from_tool is None) in dupe_key string concatenation. Terrascan: TypeError from 'and' vs 'or' logic bug when results key is missing, plus None concat in dupe_key fields. TFSec: TypeError when rule_provider is null (custom/trivy rules) in dupe_key concatenation. ZAP: TypeError when requestbody/responsebody XML tags are absent (findtext returns None) in request/response assembly. Each fix uses f-strings with 'or empty' guards. All existing tests pass. New regression tests added for each parser.
* Show authorized finding groups to product members Use the Finding Group authorization queryset for list views so groups are visible according to their owning test and product, including groups without member findings. Keep unauthorized products out of the list and cover the UI permission matrix. Signed-off-by: ADİL ALPEREN ÇİFTCİ <134228585+adilalperenciftci@users.noreply.github.com> * Cover finding group open and closed lists Exercise the authorization matrix through the open and closed Finding Group list views so their queryset filtering remains covered. Signed-off-by: ADİL ALPEREN ÇİFTCİ <134228585+adilalperenciftci@users.noreply.github.com> * Preserve empty finding groups in ownership filters Filter products and engagements through each Finding Group's owning test so authorized groups remain visible without member findings. Cover product and engagement filtering across authorized and unauthorized products. Signed-off-by: ADİL ALPEREN ÇİFTCİ <134228585+adilalperenciftci@users.noreply.github.com> --------- Signed-off-by: ADİL ALPEREN ÇİFTCİ <134228585+adilalperenciftci@users.noreply.github.com>
#15981) The Location tag scoping added in #15784 covered the REST API and the location pages. The classic search view and the Product Endpoint Report options page were missed, so both still joined the raw tag relation on a globally deduplicated row. Search also matched on it, which made a substring operator an oracle over a value the page withholds. Both now use dojo.location.queries.readable_tag_match, the same predicate the API filters and the location templates use. Endpoint gains a readable_tags mirror because simple_search.html serves either model. Refs H1 #4005137.
…he location FK (#16020) * fix(location): resolve location_type/location_value filters through the location FK The /api/v2/location_findings/ and /api/v2/location_products/ endpoints are backed by LocationFindingReferenceFilter and LocationProductReferenceFilter. Both declared location_type and location_value as direct fields on the reference (through) model, but those columns live on the related Location model. Any request that used one of these filters (e.g. ?location_type_contains=...) or ordered by them raised: django.core.exceptions.FieldError: Cannot resolve keyword 'location_type' into field. Choices are: audit_time, auditor, ..., location, location_id, ... which surfaced to the client as a 500. Point both char filters and the ordering entries at the location__location_type / location__location_value ORM path via the existing model_field_name / (orm, alias) helper support, so they resolve through the location FK while the public query parameter names (location_type_*, location_value_*, ordering=location_type| location_value) stay unchanged for existing API clients and the UI. This mirrors how created/updated are already aliased on these same filtersets. Added unittests/test_location_reference_filters.py covering contains-match, a zero-match case, and ordering for both filtersets; each reproduces the FieldError before the fix. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L4KLUavvAVfs11WZKrexEm * test(location): make reference-filter test self-contained (drop dojo_testdata) The regression test loaded the dojo_testdata fixture, which carries deprecated Endpoint rows and fails to install in the V3_FEATURE_LOCATIONS test lane (EndpointDeprecatedError), erroring setUpClass. Build the minimal Product → Engagement → Test → Finding graph and a reporter user directly instead, so the test runs in both the locations-on and locations-off lanes without depending on the fixture. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L4KLUavvAVfs11WZKrexEm --------- Co-authored-by: Claude <noreply@anthropic.com>
…ack (#16017) * docs(fda): component support metadata and the cyber device evidence pack Three changes, covering the cyber device work end to end. The Locations SBOM page gains the supplier and support fields a component now carries, and a section on where those facts come from: what each import format supplies, that unknown is a valid recorded answer rather than a guess, and the order a per-snapshot override, a recorded value and unknown resolve in. An edit made by hand survives a later import, and the support source field is what tells a reviewer which case applies. The SBOM export page gains the supplier and support properties each format emits, and says plainly that a component with an unknown support level emits no property at all, because a consumer reading a support level should be reading a claim somebody made rather than a placeholder. A new page covers the cyber device profile, the three lifecycle metrics, the assessment and the evidence pack. It describes each of the seven elements in our own words with the statute cited, says which nine controls are evidenced from data and which four are the manufacturer's paperwork, and states plainly that DefectDojo records and reports what the manufacturer supplies, does not assess whether a bill of materials is complete or accurate, and does not determine whether a submission satisfies the FDA. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(fda): point the cross section link at the right depth The page sits one level down, so reaching another top-level section takes two levels up rather than one. The sibling link inside this section is unchanged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Greg Anderson <greg@Gregs-MBP.lan> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com>
…is not the fix) (#16022) PR #16005 said a non-default branch must be pinned in Aqua before it imports. Re-verifying against a live tenant with the connector's own credentials showed that is wrong: Aqua's scan-results feed (which the connector reads) returns a repository's default branch only for some sources such as Azure DevOps, regardless of pinning or token scope, so pinning does not make the branch appear in the feed. Rewrite the Branch handling section to describe the actual behavior: the connector imports whatever branches Aqua returns in its scan-results feed, some sources expose only the default branch, and an operator who expects a missing branch should contact support. Removes the pinning instruction. Reported via a customer support ticket. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Release: Merge release into master from: release/3.3.200
github-actions
Bot
requested review from
Maffooch and
blakeaowens
as code owners
September 21, 2026 16:57
|
This pull request contains multiple low-severity findings where sensitive codepaths were modified by authors not on the allowed list. These changes involve various Python and HTML files across the dojo module but are non-blocking.
Configured Sensitive Codepath Modified by Non-Allowed Author in
|
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/finding_group/views.py' matches configured sensitive codepath pattern 'dojo/finding_group/*.py' and was modified by 'adilalperenciftci' (commit e8164e3) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/endpoint/models.py (drs_104ee9dd)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/endpoint/models.py' matches configured sensitive codepath pattern 'dojo/endpoint/*.py' and was modified by 'svader0' (commit 85e0a39) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/search/views.py (drs_116f5822)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/search/views.py' matches configured sensitive codepath pattern 'dojo/search/*.py' and was modified by 'svader0' (commit 85e0a39) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/request_endpoint_report.html (drs_2e3cab2f)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/request_endpoint_report.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'svader0' (commit 85e0a39) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/simple_search.html (drs_69c0d888)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/simple_search.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'svader0' (commit 85e0a39) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/urls.py (drs_615477da)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/urls.py' matches configured sensitive codepath pattern 'dojo/urls.py' and was modified by 'svader0' (commit cd52200) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/user/models.py (drs_c82955c3)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/user/models.py' matches configured sensitive codepath pattern 'dojo/user/*.py' and was modified by 'svader0' (commit cd52200) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/view_product_details.html (drs_7e30e61e)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/view_product_details.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'svader0' (commit 92598c9) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/view_product_type.html (drs_d7021fa0)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/view_product_type.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'svader0' (commit 92598c9) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/view_user.html (drs_93cc3869)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/view_user.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'svader0' (commit 92598c9) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/metrics/views.py (drs_b0741351)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/metrics/views.py' matches configured sensitive codepath pattern 'dojo/metrics/*.py' and was modified by 'svader0' (commit 1d8082d) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/finding/helper.py (drs_d34d051d)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/finding/helper.py' matches configured sensitive codepath pattern 'dojo/finding/*.py' and was modified by 'svader0' (commit d919c3b) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/authorization/api_permissions.py (drs_08c78f5e)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/authorization/api_permissions.py' matches configured sensitive codepath pattern 'dojo/authorization/*.py' and was modified by 'rossops' (commit 395f040) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/engagement/services.py (drs_5d53cb99)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/engagement/services.py' matches configured sensitive codepath pattern 'dojo/engagement/*.py' and was modified by 'rossops' (commit 395f040) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/tasks.py (drs_88405f8e)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/tasks.py' matches configured sensitive codepath pattern 'dojo/tasks.py' and was modified by 'rossops' (commit 395f040) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templatetags/display_tags.py (drs_eb5c1075)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templatetags/display_tags.py' matches configured sensitive codepath pattern 'dojo/templatetags/*.py' and was modified by 'rossops' (commit 395f040) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/test/services.py (drs_5bc7ed07)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/test/services.py' matches configured sensitive codepath pattern 'dojo/test/*.py' and was modified by 'rossops' (commit 395f040) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/utils.py (drs_98a17c66)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/utils.py' matches configured sensitive codepath pattern 'dojo/utils.py' and was modified by 'rossops' (commit 395f040) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/forms.py (drs_619d6522)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/forms.py' matches configured sensitive codepath pattern 'dojo/forms.py' and was modified by 'rossops' (commit 08cdf8c) who is not in the allowed authors list. |
Comment to provide feedback on these findings.
Report false positive: @dryrunsecurity fp [FINDING ID] [FEEDBACK]
Report low-impact: @dryrunsecurity nit [FINDING ID] [FEEDBACK]
Example: @dryrunsecurity fp drs_90eda195 This code is not user-facing
All finding details can be found in the DryRun Security Dashboard.
Contributor
Author
|
This pull request has conflicts, please resolve those before we can evaluate the pull request. |
Three conflicts. helm Chart.yaml and README.md: kept the 1.9.54-dev chart version from this branch. Dev's valkey 0.25.11 bump stays, so both files agree with Chart.lock. fips_mode.md: kept master's layout from #15959, which moved the ECS / Fargate walkthrough to fips_on_ecs_fargate.md. Dev's #15964 had removed the retired PSIRT sidecar from that same walkthrough while it still lived inline, so those two removals are applied to fips_on_ecs_fargate.md here. Otherwise the merge would have brought the PSIRT references back. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Contributor
Author
|
Conflicts have been resolved. A maintainer will review the pull request shortly. |
github-actions
Bot
added
docker
settings_changes
Collaborator
|
Merged
Both sides touched the chart version line. This branch had
Master's #15959 moved the ECS / Fargate walkthrough out to its own page, One thing worth a look from a reviewer. Dev's #15964 removed the retired PSIRT sidecar from that walkthrough while it was still inline in
That is a small edit outside the conflict markers, which is why I'm calling it out. The other two PSIRT removals from #15964 (the component table row and the compose Nothing was tested locally. CI is the check here. 🤖 Generated with Claude Code |
Contributor
Author
|
Conflicts have been resolved. A maintainer will review the pull request shortly. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
12 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release triggered by
rossops