Release: Merge release into master from: release/2.56.0#14427
Merged
Release: Merge release into master from: release/2.56.0#14427
Conversation
….0-dev Release: Merge back 2.55.0 into dev from: master-into-dev/2.55.0-2.56.0-dev
Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.10.1 to 2.11.0. - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.10.1...2.11.0) --- updated-dependencies: - dependency-name: pyjwt dependency-version: 2.11.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…ocker-compose.yml) (#14223) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…43 (.github/workflows/renovate.yaml) (#14222) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: kiblik <5609770+kiblik@users.noreply.github.com>
…14214) Bumps [datatables.net](https://github.com/DataTables/Dist-DataTables) from 2.3.6 to 2.3.7. - [Release notes](https://github.com/DataTables/Dist-DataTables/releases) - [Commits](DataTables/Dist-DataTables@2.3.6...2.3.7) --- updated-dependencies: - dependency-name: datatables.net dependency-version: 2.3.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…3.11 to v (dockerfile.integration-tests-debian) (#14233) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
….0-dev Release: Merge back 2.55.1 into dev from: master-into-dev/2.55.1-2.56.0-dev
…rfile.nginx-alpine) (#14245) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…2.11 to v (docker-compose.yml) (#14252) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…-template Fix email template rendering for product_type_added notification
….0-dev Release: Merge back 2.55.2 into dev from: master-into-dev/2.55.2-2.56.0-dev
Bumps [ruff](https://github.com/astral-sh/ruff) from 0.14.14 to 0.15.0. - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.14.14...0.15.0) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.15.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
….12 to v (dockerfile.nginx-alpine) (#14263) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…3.12 to v (dockerfile.integration-tests-debian) (#14264) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Bumps [setuptools](https://github.com/pypa/setuptools) from 80.10.2 to 82.0.0. - [Release notes](https://github.com/pypa/setuptools/releases) - [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst) - [Commits](pypa/setuptools@v80.10.2...v82.0.0) --- updated-dependencies: - dependency-name: setuptools dependency-version: 82.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…b/workflows/renovate.yaml) (#14268) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Bumps [django-polymorphic](https://github.com/jazzband/django-polymorphic) from 4.10.5 to 4.11.0. - [Release notes](https://github.com/jazzband/django-polymorphic/releases) - [Commits](jazzband/django-polymorphic@v4.10.5...v4.11.0) --- updated-dependencies: - dependency-name: django-polymorphic dependency-version: 4.11.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [markdown](https://github.com/Python-Markdown/markdown) from 3.10.1 to 3.10.2. - [Release notes](https://github.com/Python-Markdown/markdown/releases) - [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md) - [Commits](Python-Markdown/markdown@3.10.1...3.10.2) --- updated-dependencies: - dependency-name: markdown dependency-version: 3.10.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [redis](https://github.com/redis/redis-py) from 7.1.0 to 7.1.1. - [Release notes](https://github.com/redis/redis-py/releases) - [Changelog](https://github.com/redis/redis-py/blob/master/CHANGES) - [Commits](redis/redis-py@v7.1.0...v7.1.1) --- updated-dependencies: - dependency-name: redis dependency-version: 7.1.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [social-auth-core](https://github.com/python-social-auth/social-core) from 4.8.3 to 4.8.5. - [Release notes](https://github.com/python-social-auth/social-core/releases) - [Changelog](https://github.com/python-social-auth/social-core/blob/master/CHANGELOG.md) - [Commits](python-social-auth/social-core@4.8.3...4.8.5) --- updated-dependencies: - dependency-name: social-auth-core dependency-version: 4.8.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…lidate_docs_build.yml) (#14294) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…ub/workflows/release-x-manual-docker-containers.yml) (#14299) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…14396) * fix: don't close old findings when reimport auto-creates a new test When auto_create_context=True and the test doesn't exist yet, the reimport falls back to DefaultImporter. With close_old_findings=True, this would incorrectly close findings from other tests in the same engagement/product scope because the newly created test has no prior findings to compare against. Suppress close_old_findings for this initial-import path. Fixes #14363. * test: regression test for #14363 via API serializer path Add test_reimport_auto_create_does_not_close_findings_in_existing_test to ImportReimportTestAPI. It calls the reimport endpoint with auto_create_context=True and close_old_findings=True targeting a non-existing test title, verifying that the existing test's findings are not closed when the endpoint auto-creates a new test. This test would fail if the close_old_findings=False override in the serializer were reverted.
The Question and Answer models intentionally use models.Manager() as their default objects manager instead of PolymorphicManager(). This is a deliberate trade-off introduced in #9574 to fix cascade deletion failures (ForeignKeyViolation on dojo_choiceanswer and ValueError during Product/ProductType deletion) caused by Django's inability to correctly order polymorphic child row deletions before parent row deletions when using PolymorphicManager as the default. Using models.Manager() as the default ensures Django's collector can walk the full object graph and delete child rows (TextAnswer, ChoiceAnswer) before their parent Answer rows, satisfying FK constraints. A named polymorphic manager is retained on both models for all queryset operations that require polymorphic behavior (used throughout dojo/survey/views.py and dojo/forms.py). The resulting polymorphic.W001 and polymorphic.W002 warnings are therefore expected and benign — they describe the intentional configuration, not a bug. Silencing them here prevents noise in CI and local development output without masking any real misconfiguration. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
…hedDate mappings (#14360) Add missing field mappings to the Trivy Operator parser: - checks_handler: extract remediation and messages → Finding.mitigation, category → Finding tag. These fields are defined on the Check struct (config_audit_types.go) and were already mapped in compliance_handler but missing from checks_handler. Messages and remediation are combined in the mitigation field since both provide actionable guidance. Category is stored as a tag for filterability rather than in description, to avoid affecting the deduplication hash. - vulnerability_handler: extract publishedDate → Finding.publish_date. Trivy provides CVE publication dates in VulnerabilityReport; map them to the existing nullable DateField with graceful handling of empty strings and malformed dates. Signed-off-by: Sergiy Kulanov <sergiy_kulanov@epam.com>
* wip * cyclonedx test * dependency check update test * wip * wip * wip * wip * wip * wip * replace parser instantiation of URL with locationdata * url model util method updates * wip * wip * wip * locationdata.dependency * wip * move locationdata module * wip * wip * wip * wip * update to use test.unsaved_metadata * test at adding hashes * locationdata entry name update * wip relationship data * assoc rel info in dataclass * updates to include licensing for components * tools updates * comments * remove unused attribute * comments * comments * typing * fixup * deptrack parser update * pass correct reference * update parsers to include file_name for deps if possible * finding hash code computation fix * generic json parser update * updates * fix classmethod/app.task interaction * some tool cleanup * undo mend * tools fixes * wip tools * fixup * trigger GitHub actions * nuclei fix * nuclei fix --------- Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com>
Optimize language import process with bulk creation and improved validation
fix the way bulk update endpoints in finding view works in v3
* Adjust decorators for new permissions model Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Decorator and permissions updates Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Align get_object_or_404 filtering strategy with dev branch Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Fix test assertions and serializer type hint Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Enhance permission tests with detailed docstrings for clarity and maintainability --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com>
Refactor zip handling with safe_open_zip and safe_read_all_zip
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Release 2.56.0: Merge Bugfix into Dev
github-actions
bot
added
docker
New Migration
🔴 Risk threshold exceeded.This pull request modifies sensitive files (dojo/api_v2/serializers.py and dojo/api_v2/views.py), triggering configured codepath alerts for edits to sensitive file paths; reviewers should verify these changes are intended and that the authors are allowed per
🔴 Configured Codepaths Edit in
|
| Vulnerability | Configured Codepaths Edit |
|---|---|
| Description | Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml. |
🔴 Configured Codepaths Edit in dojo/api_v2/views.py (drs_1202aec9)
| Vulnerability | Configured Codepaths Edit |
|---|---|
| Description | Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml. |
We've notified @mtesauro.
All finding details can be found in the DryRun Security Dashboard.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
16 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release triggered by
rossops