Releases · DefectDojo/django-DefectDojo

02 Apr 18:47

2.33.0

ca4250f

2.33.0 🌈

Please consult the Upgrade notes in the documentation for specific instructions for this release, and general upgrade instructions. Below is an automatically generated list of all PRs merged since the previous release.

Changes since 2.32.0

release notes for v2.33.0 @manuel-sommer (#9836)
Update documentation to reflect multiple SLA Configurations @paulOsinski (#9844)
Jira link class based views @dogboat (#9846)
Flake8: Fix leftover of W504 and E402 @kiblik (#9823)
fix doc breaking due to colon in front matter @hblankenship (#9845)
Move PYTHONWARNINGS to EnvVar @kiblik (#9503)
add cve values to openvas csv parser @manuel-sommer (#9791)
sysdig_reports: migrate cve to unsaved_vulnerability_ids @manuel-sommer (#9825)
bundleraudit: remove cves @manuel-sommer (#9827)
redhatsatellite: migrate cve to unsaved_vulnerability_ids @manuel-sommer (#9828)
Refactor awssecurityhub and add endpoint @manuel-sommer (#9814)
🐛 fix multiple netsparker issues @manuel-sommer (#9817)
fix qualys parser: Finding object inconsistencies - use a copy of the issue_row object @MarianG (#9792)
✨ Advance Trivy Operator to parse Benchmark report @manuel-sommer (#9799)
Tenable Parser: Support the new "workbench" format @FelixHernandez (#9804)
Ruff: add some TRY @kiblik (#9756)
Flake8: Remove useless ignores @kiblik (#9760)
remove xlrd @manuel-sommer (#9810)
[k8s] Remove pgha from actions @dsever (#9784)
Flake8: Fix E201, E202 and E231 @kiblik (#9761)
Ruff: add FLY @kiblik (#9757)
Flake8: Solve E704 @kiblik (#9765)
Fix: wrong parameters for k8s redis test @dsever (#9767)
Flake8: Change F841 @kiblik (#9764)
remove supervisor @manuel-sommer (#9811)
🔨 Refactor fortify to separate xml and fpr @manuel-sommer (#9667)
🔨 Refactor cyclonedx @manuel-sommer (#9668)
🔨 Refactor nikto to separate json and xml @manuel-sommer (#9680)
🐛 fix snyk, multiple cwes @manuel-sommer (#9682)
🐛 fix wazuh date @manuel-sommer (#9728)
Ruff: Move F403 @kiblik (#9753)
Fix items not found in scout suite findings @jbschooley (#9796)
Fix finding filter in API `not_test__tags' @FelixHernandez (#9805)
Fix typo of github username in DryRun Security config @mtesauro (#9815)
Ruff: Solve F601 @kiblik (#9752)
set Dynamic finding to false by default in add finding manually to test @FelixHernandez (#9794)
List more Endpoints in a Finding's Excel / CSV report @FelixHernandez (#9738)
Ruff: Solve E713 @kiblik (#9750)
Ruff: better log output for GitHub Actions @kiblik (#9747)
Updated DryRun Security config @mtesauro (#9769)
Fix version mismatch @Maffooch (#9721)
Helm: Remove PSQLHA Test @Maffooch (#9716)
remove flotaxis, #9700 @manuel-sommer (#9709)
Updating pip-audit parser to handle new JSON file format @grendel513 (#9696)
Deprecate merge_sets_safe in dojo/utils.py @manuel-sommer (#9568)
Bugfix: checkmarx parser - datetime is no longer put into the Finding.date field @reichertan (#9570)

🚩 Changes to `settings.dist.py` / `local_settings.py`

Add legacy parsing method for qualys @Maffooch (#9861)
Filter EPSS-related values on Findings listing @dogboat (#9847)
🎉 added parser for Bearer CLI @quirinziessler (#9672)
✨ merge acunetix and acunetix360 @manuel-sommer (#9522)
Implement Nancy Parser @grendel513 (#9801)
Ruff: Solve E402 @kiblik (#9748)
✨ implement wiz parser @manuel-sommer (#9671)
remove Clair Klar Scan deduplication @manuel-sommer (#9686)
🐛 Fix Tenable deduplication setting @manuel-sommer (#9619)
Added Checkmarx One Parser @FelixHernandez (#9715)
Npm audit v7+ Parser @grendel513 (#9692)
Added crunch42 parser @FelixHernandez (#9714)

🚩 Database migration

✨ merge acunetix and acunetix360 @manuel-sommer (#9522)
🐛 fix sonarqube api importer key length, issue 9611 @manuel-sommer (#9683)
API responses more detailed (optional) @FelixHernandez (#9788)
correcting cvss scoring behavior when updating/adding findings via ui and api [sc-4849] @grendel513 (#9744)
Jira Epic Mapping: Add flexibility to epic issue type @Maffooch (#9666)

🚀 API features and enhancements

Merge Bugfix -> Dev - Release/2.33.0 @Maffooch (#9866)
CVSS Override: Revert #9744 @Maffooch (#9858)
API Import/Reimport: Convert string tags to lists @Maffooch (#9830)
Make tags optional for import and reimport API endpoints @FelixHernandez (#9819)
Ruff: add preview + fix F841 and F823 @kiblik (#9759)
API responses more detailed (optional) @FelixHernandez (#9788)
Import/Reimport: Add toggle for applying tags to endpoints @Maffooch (#9740)
correcting cvss scoring behavior when updating/adding findings via ui and api [sc-4849] @grendel513 (#9744)

🐛 Bug Fixes

CVSS Override: Revert #9744 @Maffooch (#9858)
API Import/Reimport: Convert string tags to lists @Maffooch (#9830)
Endpoints: Redefine vulnerable definition @Maffooch (#9772)
Ruff Linter: Resolve deprecation notice @Maffooch (#9729)
Product Metrics: Correct week to week charts @Maffooch (#9695)
Jira: Improve alerting on a per step basis @Maffooch (#9691)

🖌 Updates in UI

Filter EPSS-related values on Findings listing @dogboat (#9847)
Findings endpoint name truncated change @dogboat (#9789)
Ruff: add preview + fix F841 and F823 @kiblik (#9759)
improve risk acceptance UI (accept aditional findings) @FelixHernandez (#9737)
Flake8: Fix W504 @kiblik (#9763)
Ruff: Solve E731 @kiblik (#9749)
Endpoints: Remove "verified" query on listing pages @Maffooch (#9717)
Func views to class based views in finding exports @FelixHernandez (#9679)

🗣 Updates in localization

fix
tag on django.po @paulOsinski (#9718)

🧰 Maintenance

chore(deps): update dependency ruff from 0.3.4 to v0.3.5 (requirements-lint.txt) @renovate (#9857)
Update softprops/action-gh-release action from v1 to v2 (.github/workflows/release-x-manual-helm-chart.yml) @renovate (#9703)
Update dependency ruff from 0.3.1 to v0.3.4 (requirements-lint.txt) @renovate (#9705)
Update Helm release postgresql from 11.9.13 to v15 (helm/defectdojo/Chart.yaml) @renovate (#9781)
Update dependency autoprefixer from 10.4.18 to v10.4.19 (docs/package.json) @renovate (#9806)
Bump nginx from 02d8d94 to 31bad00 @dependabot (#9818)
Update rabbitmq:3.13.0-alpine Docker digest from 3.13.0 to 3.13.0-alpine (docker-compose.yml) @renovate (#9797)
Update redis:7.2.4-alpine Docker digest from 7.2.4 to 7.2.4-alpine (docker-compose.yml) @renovate (#9798)
Update postgres:16.2-alpine Docker digest from 16.2 to 16.2-alpine (docker-compose.yml) @renovate (#9800)
Update dependency postcss from 8.4.36 to v8.4.38 (docs/package.json) @renovate (#9790)
Update Helm release redis from 16.13.2 to v19 (helm/defectdojo/Chart.yaml) @renovate (#9786)
Refresh minikube & k8s versions @dsever (#9684)
Update redis:7.2.4-alpine Docker digest from 7.2.4 to 7.2.4-alpine (docker-compose.yml) @renovate (#9773)
Update dependency postcss from 8.4.35 to v8.4.36 (docs/package.json) @renovate (#9774)
Bump nginx from 6a2f8b2 to 02d8d94 @dependabot (#9771)
Update postgres:16.2-alpine Docker digest from 16.2 to 16.2-alpine (docker-compose.yml) @renovate (#9768)
Update gcr.io/cloudsql-docker/gce-proxy Docker tag from 1.34.0 to v1.34.1 (helm/defectdojo/values.yaml) @renovate (#9745)
Update rabbitmq:3.13.0-alpine Docker digest from 3.13.0 to 3.13.0-alpine (docker-compose.yml) @renovate (#9746)
Bump openapitools/openapi-generator-cli from v7.3.0 to v7.4.0 @dependabot (#9711)
Update dependency ruff from 0.3.0 to v0.3.1 (requirements-lint.txt) @renovate (#9694)
[HELM CT] Update component versions @dsever (#9665)

Contributors

grendel513, MarianG, and 14 other contributors

Assets 5

25 Mar 19:01

github-actions

2.32.3

aaf251b

2.32.3 🌈

Changes since 2.32.2

🐛 fix wazuh date @manuel-sommer (#9728)
Ruff: Move F403 @kiblik (#9753)
Fix items not found in scout suite findings @jbschooley (#9796)
Fix finding filter in API `not_test__tags' @FelixHernandez (#9805)
Fix typo of github username in DryRun Security config @mtesauro (#9815)
Ruff: Solve F601 @kiblik (#9752)
set Dynamic finding to false by default in add finding manually to test @FelixHernandez (#9794)
List more Endpoints in a Finding's Excel / CSV report @FelixHernandez (#9738)
Ruff: Solve E713 @kiblik (#9750)
Ruff: better log output for GitHub Actions @kiblik (#9747)

🚩 Changes to `settings.dist.py` / `local_settings.py`

Ruff: Solve E402 @kiblik (#9748)

🚀 API features and enhancements

Make tags optional for import and reimport API endpoints @FelixHernandez (#9819)

🖌 Updates in UI

Flake8: Fix W504 @kiblik (#9763)

Contributors

mtesauro, jbschooley, and 3 other contributors

Assets 5

18 Mar 19:12

github-actions

2.32.2

c182e9c

2.32.2 🌈

Changes since 2.32.1

Updated DryRun Security config @mtesauro (#9769)

🚩 Database migration

correcting cvss scoring behavior when updating/adding findings via ui and api [sc-4849] @grendel513 (#9744)

🚀 API features and enhancements

Import/Reimport: Add toggle for applying tags to endpoints @Maffooch (#9740)
correcting cvss scoring behavior when updating/adding findings via ui and api [sc-4849] @grendel513 (#9744)

🐛 Bug Fixes

Endpoints: Redefine vulnerable definition @Maffooch (#9772)
Ruff Linter: Resolve deprecation notice @Maffooch (#9729)

🖌 Updates in UI

Ruff: Solve E731 @kiblik (#9749)

Contributors

grendel513, mtesauro, and 2 other contributors

Assets 5

11 Mar 22:06

github-actions

2.32.1

1f450c2

2.32.1 🌈

Changes since 2.32.0

Helm: Remove PSQLHA Test @Maffooch (#9716)
remove flotaxis, #9700 @manuel-sommer (#9709)
Bugfix: checkmarx parser - datetime is no longer put into the Finding.date field @reichertan (#9570)

🚩 Changes to `settings.dist.py` / `local_settings.py`

Added Checkmarx One Parser @FelixHernandez (#9715)
Added crunch42 parser @FelixHernandez (#9714)

🐛 Bug Fixes

Product Metrics: Correct week to week charts @Maffooch (#9695)
Jira: Improve alerting on a per step basis @Maffooch (#9691)

🖌 Updates in UI

Endpoints: Remove "verified" query on listing pages @Maffooch (#9717)

🗣 Updates in localization

fix <br/> tag on django.po @paulOsinski (#9718)

Contributors

FelixHernandez, paulOsinski, and 3 other contributors

Assets 5

04 Mar 20:59

github-actions

2.32.0

8218125

2.32.0 🌈

Changes since 2.31.0

Upgrade drf-spectacular-sidecar to 2024.3.4 @kiblik (#9670)
resolve doing, remove dead code @manuel-sommer (#9577)
🔨 restructure clair parser @manuel-sommer (#9660)
🔨 restructure openvas parser @manuel-sommer (#9658)
Fix github parser issue 9582 @manuel-sommer (#9583)
Bundler Audit Parser - Support for GHSA-Only Findings @rh0dy (#9649)
StringAgg: use default Value('') @kiblik (#9661)
Upgrade Notes: Move breaking helm change notice from 2.13.x -> 2.12.x @manuel-sommer (#9637)
Anchore Grype: Default to Info severity if missing in report @manuel-sommer (#9620)
resolve npm audit unittest doing @manuel-sommer (#9572)
Extend APIv2 Findings endpoint and UI filters to accept new date filters @FelixHernandez (#9642)
advance mobsf to also parse exisiting unittestfile @manuel-sommer (#9563)
Qualys: Correct CVE assignment @Maffooch (#9653)
ASFF Parser: Respect active status based on RecordState field @manuel-sommer (#9567)
Add integration tests script @Maffooch (#9136)
✨ Fortify: Support .fpr format @manuel-sommer (#9590)
Format cyclonedx_cwe.json unit test for legibility @paulOsinski (#9595)
🎉 Snyk epss update @quirinziessler (#9601)
Revert psqlha version from v13 to v9 @Maffooch (#9630)
Extend npm_audit.md with unsupported v7 notice @paulOsinski (#9593)
✨ AWS Security Hub: Add GuardDuty @manuel-sommer (#9524)
Labeler: Add sync-labels @kiblik (#9565)
✨ Documentation for managing files @manuel-sommer (#9557)
🐛 fix nessus severity @manuel-sommer (#9549)
Fix engagement/view if import fail @kiblik (#9544)
🎉 Importing EPSS score from AWS Inspector via AWS SecHub @quirinziessler (#9529)
fix clair docs according to PR #9355 @manuel-sommer (#9523)
🎉 importing epss score from DependencyTrack output @quirinziessler (#9521)
Remove handling of broken unittests @kiblik (#9504)
✨ add burp dastardly @manuel-sommer (#9514)
Remove useless noqa, be more specific for usefull noqa @kiblik (#9510)
🐛 WFuzz: Generalize severity mapping @manuel-sommer (#9505)
Update google-sheets-sync.md with deprecation notice @paulOsinski (#9495)
Use full url for helm-repos and add alias in renovate.json @rndmh3ro (#9525)
Modifying Bugcrowd API Parser to align to vendor documentation on wha… @grendel513 (#9517)
Fix SARIF parser with CodeQL rules @ansereb (#9440)
Parse GitHub vulnerability version @coheigea (#9462)
🐛 Yarn Audit: Add CI importer support @manuel-sommer (#9478)
🐛 Trufflehog3: Remove null characters @manuel-sommer (#9470)
🐛 WFuzz: Add additional severity mappings @manuel-sommer (#9486)
fix typo in docs @manuel-sommer (#9487)
Optimize list of Maintenance in relase notes @kiblik (#9492)
Fix unittests with assertRaises + replace assertTrue/False with better checks @kiblik (#9435)
API: Check missing endpoints @kiblik (#7618)
Trivy Operator Parser additionalVulnerabilityReportFields @raouf-haddada (#9452)
Add ruff for *tests @kiblik (#9406)
Dependencytrack default severity @manuel-sommer (#9370)

🚩 Changes to `settings.dist.py` / `local_settings.py`

DRF Spectacular: Enable sidecar by default @Maffooch (#9645)
✨ implement osv-scanner, #7321 @manuel-sommer (#9578)
Force to use DjangoDivFormRenderer @kiblik (#9659)
Added Snyk Code Parser @FelixHernandez (#9647)
Remove filterwarnings for RemovedInDjango50Warning @kiblik (#9500)
Nosey Parker Parser @tpat13 (#9067)
Remote filterwarnings for "cgi is deprecated and slated" @kiblik (#9561)
🐛 fix kics, #7966 @manuel-sommer (#9542)
improved Sonatype parser @reichertan (#9519)
🎉 introducing EPSS score @quirinziessler (#9516)
Remove filterwarnings for "DateTimeField - timezone" @kiblik (#9497)
🐛 fix mobsf deduplication and severity mapping @manuel-sommer (#9471)
Remove filterwarnings for "invalid escape sequence" @kiblik (#9496)
Remove filterwarnings for "unclosed file" @kiblik (#9498)
API: removal of drf_yasg (OpenAPI 2.0 Swagger) @kiblik (#9108)
Remove DD_USE_L10N @kiblik (#9491)
🎉 Improvements for wazuh importer @quirinziessler (#9248)
Add support for DD_APPEND_SLASH @kiblik (#9385)
Be strict about Warnings during testing @kiblik (#9490)
Revert adding severity to Dependency Track hash_code calculation @kepten (#9371)

🚩 Database migration

Fix broken migration 0197 @kiblik (#9606)
🎉 introducing EPSS score @quirinziessler (#9516)
Dojo_Group: Support for "RemoteUser" in model @kiblik (#9405)
finding sla expiration date field (part two) @blakeaowens (#9494)
Be strict about Warnings during testing @kiblik (#9490)

🚀 General features and enhancements

Jira Webhook: Catch comments from other issue updates @Maffooch (#9513)

🚀 API features and enhancements

FindingGroupSerializer: not break schemas when JIRAIssue not available @kiblik (#9651)
Engagement validation for risk_acceptance API in POST PATCH and PUT @FelixHernandez (#9599)
🎉 introducing EPSS score @quirinziessler (#9516)
API: removal of drf_yasg (OpenAPI 2.0 Swagger) @kiblik (#9108)
Disallow duplicate tool types @Maffooch (#9530)
Improve API endpoints for Risk Acceptances @FelixHernandez (#9415)
Be strict about Warnings during testing @kiblik (#9490)

🐛 Bug Fixes

DRF Spectacular: Enable sidecar by default @Maffooch (#9645)
Metrics: Status unification @Maffooch (#9654)
Correct search queries containing colons @Maffooch (#9624)
Update SLA Violation Filter query @Maffooch (#9614)
CSV/Excel Report: Correct date/datetime comparison error @Maffooch (#9609)
Deduplication: Do not reopen original finding @Maffooch (#9558)
Correct Endpoint "Hosts" views when the host field is None @Maffooch (#9560)
Jira: Append labels and respect priority on update @Maffooch (#9571)
Questionnaires: Correct nested object deletions @Maffooch (#9574)
Disallow duplicate tool types @Maffooch (#9530)
Jira Server/DataCenter: Update meta methods @Maffooch (#9512)
dojo/importers/importer/importer.py - Change "None" string to "Info" from cvss module when a CVSS vector string should evaluate to "Info" @ninp0 (#9453)

🖌 Updates in UI

Metrics: Status unification @Maffooch (#9654)
View Engagement to class based view and block in engagement template @FelixHernandez (#9613)
Engagement validation for risk_acceptance API in POST PATCH and PUT @FelixHernandez (#9599)
Making EPSS float formatting consistent in 'view Finding' @cneill (#9591)
EPSS Data Displayed Everywhere @dogboat (#9621)
🎉 introducing EPSS score @quirinziessler (#9516)
API: removal of drf_yasg (OpenAPI 2.0 Swagger) @kiblik (#9108)
Remove flot-axis JS library @FelixHernandez (#9540)
Fix "Overdue" tag still visible with closed issues @FelixHernandez (#9539)
Engagement Surveys: Add missing leading slash @Maffooch (#9531)
add metrics page: "Product Tag Count" (fixes #9151) @tomaszn (#9152)

🗣 Updates in localization

add metrics page: "Product Tag Count" (fixes #9151) @tomaszn (#9152)

🧰 Maintenance

Update dependency autoprefixer from 10.4.17 to v10.4.18 (docs/package.json) @renovate (#9664)
Update dependency ruff from 0.2.2 to v0.3.0 (requirements-lint.txt) @renovate (#9652)
Update azure/setup-helm action from v3 to v4 (.github/workflows/test-helm-chart.yml) @renovate (#9646)
Update rabbitmq:3.13.0-alpine Docker digest from 3.13.0 to 3.13.0-alpine (docker-compose.yml) @renovate (#9644)
Bump es5-ext from 0.10.62 to 0.10.64 in /components @dependabot (#9640)
Update rabbitmq Docker tag from 3.12.13 to v3.13.0 (docker-compose.yml) @renovate (#9622)
Bump cryptography from 42.0.2 to 42.0.4 @dependabot (#9607)
Update gcr.io/cloudsql-docker/gce-proxy Docker tag from 1.33.16 to v1.34.0 (helm/defectdojo/values.yaml) @renovate (#9598)
Update dependency ruff from 0.2.1 to v0.2.2 (requirements-lint.txt) @renovate (#9576)
Bump nginx from 1.25.3-alpine to 1.25.4-alpine @dependabot (#9580)
Update rabbitmq Docker tag from 3.12.12 to v3.12.13 (docker-compose.yml) @renovate (#9573)
⬆️ Bump openapitools/openapi-generator-cli from v7.2.0 to v7.3.0 @dependabot (#9526)
Update Helm release postgresql-ha from 9.4.11 to v13 (helm/defectdojo/Chart.yaml) @renovate (#9553)
Update Helm release postgresql-ha from 9.1.9 to ~9.4.0 (helm/defectdojo/Chart.yaml) @renovate (#9547)
Update Helm release postgresql from 11.6.26 to ~11.9.0 (helm/defectdojo/Chart.yaml) @renovate (#9546)
Update Helm release rabbitmq from 11.2.2 to ~11.16.0 (helm/defectdojo/Chart.yaml) @renovate (#9548)
Update Helm release mysql from 9.1.8 to ~9.19.0 (helm/defectdojo/Chart.yaml) @renovate (#9545)
Update postgres Docker tag from 16.1 to v16.2 (docker-compose.yml) @renovate (#9536)
Update rabbitmq:3.12.12-alpine Docker digest from 3.12.12 to 3.12.12-alpine (docker-compose.yml) @renovate (#9541)
Update Helm release redis from 16.12.3 to ~16.13.0 (helm/defectdojo/Chart.yaml) @renovate (#9550)
Update rabbitmq:3.12.12-alpine Docker digest from 3.12.12 to 3.12.12-alpine (docker-compose.yml) @renovate (#9535)
Update dependency postcss from 8.4.34 to v8.4.35 (docs/package.json) @renovate (#9502)
Update rabbitmq:3.12.12-alpine Docker digest from 3.12.12 to 3.12.12-alpine (docker-compose.yml) @renovate (#9501)
Bump vulners from 2.1.2 to 2.1.5 @dependabot (#9391)
Update dependency ruff from 0.1.15 to v0.2.1 (requirements-lint.txt) @renovate (#9459)
⬆️ Bump boto3 from 1.34.32 to 1.34.35 @dependabot (#9489)
Update rabbitmq:3.12.12-alpine Docker di...