Repository navigation
Release: Merge release into master from: release/merge-dev-into-master-3.4.304 - #16635
Merged
defectdojo-release-tracker[bot] merged 20 commits intoOct 30, 2026
Merged
defectdojo-release-tracker[bot] merged 20 commits into
defectdojo-release-tracker[bot] merged 20 commits into
Conversation
…ev-3.4.303 Release: Merge back 3.4.303 into dev from: release/merge-master-into-dev-3.4.303
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…#16611) The Customizable Dashboards page named separate gear, duplicate, trash and export icons on each widget. The Pro UI now offers those actions from one Widget Actions menu in the widget title bar: Edit Widget, Title Style, Duplicate Widget and Remove Widget while editing, and Add to Report while viewing. The paragraphs on duplicating a tile, a Section Break's blank title and putting a widget into a report say so. Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* docs(permissions): configuration permissions come from roles Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(permissions): a member who leaves an Owner group, and custom authentication backends Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(permissions): a user or group holds several global roles The Edit User and Edit Group forms carry a Global Roles field, the roles add up, and the upgrade adds a configuration-only role beside the role a holder already has instead of cloning it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(permissions): configuration permissions have no View gate in the role editor Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
…ly kinds and thresholds (#16606) The page lists every connector and scheduled Triage Engine rule with its health; adds the volume drop, stale and auth failed anomalies, per-source thresholds and snooze, the Ingestion Health Warning notification, and a note on stale scheduled rules in the Triage Engine runs page. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Document the next scheduled Discover and Sync lines on an Upstream Connector's tile and on its Manage Records and Operations page: shown in the browser's time zone, worded as scheduled rather than started, and hidden while a run is stalled. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…roups tables (#16620) * docs(permissions): describe the Permissions column on the users and groups tables Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(permissions): roles are lettered in the effective permissions grid Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…ge (#16613) Look up the note through the risk acceptance's own notes, the same way the remove-finding action already scopes its lookup.
* docs: rename Unmanaged Devices to Asset Discovery Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: keep the Feature Flags table alphabetical after the rename Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…s account (#16623) The SAML page told admins to map a Username attribute and said DefectDojo matches a login to an account by username or email. Pro always looks the account up by the NameID; a mapped attribute only fills fields. Adds a "Which account a login lands on" section and corrects the attribute mapping bullets, the Identity Center example and the troubleshooting remedies. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…n URL (#16624) * docs(sandbox): say the Helm chart's bundled database needs a provision URL The Requirements section said only that a new Docker Compose install's bundled database user has CREATEROLE and CREATEDB. The Helm chart's bundled PostgreSQL gives DefectDojo's user CREATEDB only, so with it the sandbox can be provisioned only through sandbox.provisionUrl naming the bundled superuser. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(sandbox): word the Helm note so it holds whether or not the chart sets the provision URL Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…s dashboard widget (#16627) * docs(ingestion-health): document API import streams and the dashboard widget Ingestion Health now tracks every Asset and scan type that receives scans through the API. The page describes how a stream is formed, its observed cadence and the anomalies it raises, who sees and acts on it, and the Ingestion Health Status dashboard widget. The notifications page lists the import cases the warning covers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(ingestion-health): failing imports go stale, and who hears about an import stream An API import stream now goes stale when it has no successful import for longer than usual, so a stream whose imports keep failing is reported too. Import warnings reach the Asset's readers who can open the Ingestion Health page (Connector View), and the page gains a Scan Type column. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…der's language (#16630) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…#16608) * feat(generic parser): accept a Package URL for a finding's dependency A Generic Findings Import JSON finding could only describe its component with component_name and component_version, so with Locations enabled the dependency location always got the package type `generic`. A Package URL sent in component_name was read as a plain name and nested inside another Package URL. A finding now accepts `purl`, or `purl_type` and `namespace` next to the component fields, and the dependency location carries them. A purl fills in component_name and component_version when they are not set. An invalid purl, a purl combined with purl_type or namespace, or a non-string package field is rejected with a ValueError, which the importer reports as a 400. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(generic parser): never fail an import on a package field The purl, purl_type and namespace fields only refine a finding's dependency location, so a value that cannot be used is now dropped with a warning instead of raising: a null, blank or non-string value counts as absent, a purl that does not parse falls back to purl_type and namespace, a purl_type outside the Package URL type grammar falls back to generic, and a valid purl wins over parts sent beside it. A purl name or version wider than the component columns is not copied into them, so it cannot trip the length check either. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(generic parser): address review of the Package URL fields - A NUL character, sent plainly or percent-encoded in any purl part, makes the value unusable: PostgreSQL cannot store it, so it failed the import. - The purl's version is only copied for the package the purl names, never next to a different component_name, and a blank component field counts as unset so the purl fills it. - Every dropped value is logged as a warning, including purl_type and namespace on a finding with no component. - Tests cover the round-trip check and the catch-all (a purl that parses but whose normalized string does not), NUL in each purl part and in namespace, and the version and blank-field fill rules. - Docs: dependency locations are a DefectDojo Pro feature, a purl is normalized before use, namespace applies without purl_type, and a location with a part too long to store is left off the finding. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com>
…6619) * docs(dedupe): describe reverting the grouping after consolidation Explain that moving a tool back to the parser's grouping after consolidate_folded_findings splits the folded findings on the next reimport, with their locations moving back, and when a duplicate is left alone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(dedupe): scope the revert paragraph to findings consolidation folded away Say that every location type moves back, that the reopened finding gets a note naming the finding it was folded into, and that a finding marked as a duplicate by hand stays a duplicate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(dedupe): say a hand-marked duplicate on the same line or URL stays one Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(dedupe): describe consolidation records and the unfold command Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(dedupe): say what the unfold command counts and which rows it replaces Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…e Feature Flags page (#16629) * docs(feature-flags): describe the area cards, index and filters on the Feature Flags page The Feature Flags page now groups features into one card per area, with an enabled count in its header, an Areas index that jumps to a card, and Show filters. A description opens to its full text in place on hover or keyboard focus. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(feature-flags): say With Warnings covers every warning tag and that touch screens show descriptions whole Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* docs: domain, IP address and certificate locations Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: attack surface locations review fixes and the flag's row Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: name the Domains, IP Addresses and Certificates pages Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: title the flag External Asset Discovery Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
#16622) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
github-actions
Bot
requested review from
Maffooch and
blakeaowens
as code owners
October 30, 2026 02:14
defectdojo-release-tracker
Bot
deleted the
release/merge-dev-into-master-3.4.304
branch
October 30, 2026 02:14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release triggered by
defectdojo-release-tracker[bot]