Skip to content

Release: Merge release into master from: release/2.31.0#9483

Merged
Maffooch merged 145 commits into
masterfrom
release/3.31.0
Feb 5, 2024
Merged

Release: Merge release into master from: release/2.31.0#9483
Maffooch merged 145 commits into
masterfrom
release/3.31.0

Conversation

@github-actions
Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot commented Feb 5, 2024

Release triggered by Maffooch

dependabot Bot and others added 30 commits January 2, 2024 11:55
@dependabot
Bump boto3 from 1.34.9 to 1.34.11 (#9254)
3dba304 
Bumps [boto3](https://github.com/boto/boto3) from 1.34.9 to 1.34.11.
- [Release notes](https://github.com/boto/boto3/releases)
- [Changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst)
- [Commits](boto/boto3@1.34.9...1.34.11)

---
updated-dependencies:
- dependency-name: boto3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Update versions in application files
b4739ce
@Maffooch
Merge pull request #9261 from DefectDojo/master-into-dev/2.30.0-2.31.…
f4cb7bd 
…0-dev

Release: Merge back 2.30.0 into dev from: master-into-dev/2.30.0-2.31.0-dev
@dependabot
Bump lxml from 4.9.4 to 5.0.0 (#9251)
af66030 
Bumps [lxml](https://github.com/lxml/lxml) from 4.9.4 to 5.0.0.
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](lxml/lxml@lxml-4.9.4...lxml-5.0.0)

---
updated-dependencies:
- dependency-name: lxml
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@renovate
Update rabbitmq:3.12.11-alpine Docker digest from 3.12.11 to 3.12.11-…
5cd53bc 
…alpine (docker-compose.yml) (#9240)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@dependabot
Bump sqlalchemy from 2.0.23 to 2.0.24 (#9244)
960859f 
Bumps [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) from 2.0.23 to 2.0.24.
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

---
updated-dependencies:
- dependency-name: sqlalchemy
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump drf-spectacular-sidecar from 2023.12.1 to 2024.1.1 (#9252)
b329ee6 
Bumps [drf-spectacular-sidecar](https://github.com/tfranzel/drf-spectacular-sidecar) from 2023.12.1 to 2024.1.1.
- [Commits](tfranzel/drf-spectacular-sidecar@2023.12.1...2024.1.1)

---
updated-dependencies:
- dependency-name: drf-spectacular-sidecar
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@renovate
Update manusa/actions-setup-minikube action from v2.9.0 to v2.10.0 (.…
0076894 
…github/workflows/k8s-tests.yml) (#9257)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@dependabot
Bump sqlalchemy from 2.0.24 to 2.0.25 (#9266)
9a98df7 
Bumps [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) from 2.0.24 to 2.0.25.
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

---
updated-dependencies:
- dependency-name: sqlalchemy
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump pillow from 10.1.0 to 10.2.0 (#9265)
b5c6b2b 
Bumps [pillow](https://github.com/python-pillow/Pillow) from 10.1.0 to 10.2.0.
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@10.1.0...10.2.0)

---
updated-dependencies:
- dependency-name: pillow
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@manuel-sommer
🐛 fix zap, issue #9242 (#9243)
59fab10 
* 🐛 fix zap, issue #9242

* adapt identiation
@kiblik
API: Add Announcements (#9112)
38f4d22 
* Add Announcement to API

* Add test_rest_framework

* Add test_swagger_schema

* Flake8

* Fix count

* Skip test

* Inc db_mig

* Use DojoModelViewSet

* inc db_mig
@manuel-sommer
🐛 None Type in cvss score in Trivy #9263e (#9268)
c0948bb
@MarianG @kiblik
Feature: Add Auditlog Retention and Cleanup (#9208)
4a3f333 
* feat: add auditlog retention

* linting: satisfy flake8

* fix: forgot imports in tasks.py

* fix: add necessary test-data

* Update unittests/test_flush_auditlog.py

Co-authored-by: kiblik <kiblik@gjh.sk>

* Update unittests/test_flush_auditlog.py

Co-authored-by: kiblik <kiblik@gjh.sk>

* Update unittests/test_flush_auditlog.py

Co-authored-by: kiblik <kiblik@gjh.sk>

* Update dojo/tasks.py

Co-authored-by: kiblik <kiblik@gjh.sk>

* Update unittests/test_flush_auditlog.py

Co-authored-by: kiblik <kiblik@gjh.sk>

* Update test_flush_auditlog.py

removed spaces

* fix: change default value for the retetion period to disable log recycling and mimic the default behavior. Then no change will happen until a user actively sets/ changes this parameter

---------

Co-authored-by: MarianG <marian.gawron@deutschebahn.com>
Co-authored-by: kiblik <kiblik@gjh.sk>
@MarianG @cneill
QualysParser: add cvss value to finding (#9256)
8e03ac2 
* feat: add cvss value to finding and only overwrite values if not already set

This is because of XML Report Layout of Qualys. It has CVSS Values on concrete Finding and in the Knowledgebase.   The values in the concrete Finding are more accurate and are parsed at first. It would be much better to stick with those values and only use the ones from the Knowledgebase if CVSS values from concrete finding are missing

* linting: flake8

* feat: add unit-test for cvss_score field

* remove unnecessary loop

Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com>

* Update test_qualys_parser.py for linting

---------

Co-authored-by: MarianG <marian.gawron@deutschebahn.com>
Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com>
@dependabot
Bump boto3 from 1.34.11 to 1.34.12 (#9276)
94302e6 
Bumps [boto3](https://github.com/boto/boto3) from 1.34.11 to 1.34.12.
- [Release notes](https://github.com/boto/boto3/releases)
- [Changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst)
- [Commits](boto/boto3@1.34.11...1.34.12)

---
updated-dependencies:
- dependency-name: boto3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@renovate
Update dependency postcss from 8.4.32 to v8.4.33 (docs/package.json) (#…
dcd1eb4 
…9281)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@dependabot
Bump packageurl-python from 0.13.1 to 0.13.2 (#9284)
154b343 
Bumps [packageurl-python](https://github.com/package-url/packageurl-python) from 0.13.1 to 0.13.2.
- [Release notes](https://github.com/package-url/packageurl-python/releases)
- [Changelog](https://github.com/package-url/packageurl-python/blob/main/CHANGELOG.rst)
- [Commits](package-url/packageurl-python@v0.13.1...v0.13.2)

---
updated-dependencies:
- dependency-name: packageurl-python
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump boto3 from 1.34.12 to 1.34.13 (#9285)
13abca1 
Bumps [boto3](https://github.com/boto/boto3) from 1.34.12 to 1.34.13.
- [Release notes](https://github.com/boto/boto3/releases)
- [Changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst)
- [Commits](boto/boto3@1.34.12...1.34.13)

---
updated-dependencies:
- dependency-name: boto3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@renovate
Update postgres:16.1-alpine Docker digest from 16.1 to 16.1-alpine (d…
39414ae 
…ocker-compose.yml) (#9283)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@FelixHernandez @felixhernandez15
Add a "tag findings" parameter to the import-scan and reimport-scan A…
30b2d49 
…PI endpoints (#8707)

* Set Development default environment (new import)

* fix flake8 issue

* Trivy parser includes causeMetadata in findings description

* Fix System Settings Required Fields Jira

* remove print

* flake code

* merge

* merge

* Add apply tags to findings to importer and reimporter functions

* fix changes

* Addedd to import scan and reimport scan functions the apply tags parameter

* fix validations

* remove default true in importscan serializer

* fix error in testing tags

* added apply tag to findings parameter to UI

* removed unnecessary lines

---------

Co-authored-by: Felix Hernandez <felixfhdez15@gmail.com>
Update versions in application files
ee02a67
@Maffooch
Merge branch 'dev' into master-into-dev/2.30.1-2.31.0-dev
26aa901
@Maffooch
Merge pull request #9298 from DefectDojo/master-into-dev/2.30.1-2.31.…
0e9ac64 
…0-dev

Release: Merge back 2.30.1 into dev from: master-into-dev/2.30.1-2.31.0-dev
@renovate
Update rabbitmq Docker tag from 3.12.11 to v3.12.12 (docker-compose.y…
8bcf090 
…ml) (#9288)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@dependabot
Bump packageurl-python from 0.13.2 to 0.13.3 (#9295)
47a6fe4 
Bumps [packageurl-python](https://github.com/package-url/packageurl-python) from 0.13.2 to 0.13.3.
- [Release notes](https://github.com/package-url/packageurl-python/releases)
- [Changelog](https://github.com/package-url/packageurl-python/blob/main/CHANGELOG.rst)
- [Commits](package-url/packageurl-python@v0.13.2...v0.13.3)

---
updated-dependencies:
- dependency-name: packageurl-python
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump jira from 3.5.2 to 3.6.0 (#9296)
481c83b 
Bumps [jira](https://github.com/pycontribs/jira) from 3.5.2 to 3.6.0.
- [Release notes](https://github.com/pycontribs/jira/releases)
- [Changelog](https://github.com/pycontribs/jira/blob/main/RELEASE.md)
- [Commits](pycontribs/jira@3.5.2...3.6.0)

---
updated-dependencies:
- dependency-name: jira
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump boto3 from 1.34.13 to 1.34.14 (#9294)
6882984 
Bumps [boto3](https://github.com/boto/boto3) from 1.34.13 to 1.34.14.
- [Release notes](https://github.com/boto/boto3/releases)
- [Changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst)
- [Commits](boto/boto3@1.34.13...1.34.14)

---
updated-dependencies:
- dependency-name: boto3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@renovate
Update postgres:16.1-alpine Docker digest from 16.1 to 16.1-alpine (d…
1f9b34a 
…ocker-compose.yml) (#9291)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@dependabot
Bump lxml from 5.0.0 to 5.1.0 (#9293)
a530542 
Bumps [lxml](https://github.com/lxml/lxml) from 5.0.0 to 5.1.0.
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](lxml/lxml@lxml-5.0.0...lxml-5.1.0)

---
updated-dependencies:
- dependency-name: lxml
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
renovate Bot and others added 15 commits January 31, 2024 14:17
@renovate
Update rabbitmq:3.12.12-alpine Docker digest from 3.12.12 to 3.12.12-…
0b66b40 
…alpine (docker-compose.yml) (#9447)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate
Update postgres:16.1-alpine Docker digest from 16.1 to 16.1-alpine (d…
41c683d 
…ocker-compose.yml) (#9446)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@biennd279
Add parser for Sonarqube JSON result. (#9366)
25df450 
* init parser

* fix filename

* add testcase

* Update docs

* strip severity beforce compare

* rebase from upstream/dev

* remove not need newline

* fix flake8

* Update docs

* update recommend version

* add recommend version in parser description

---------

Co-authored-by: biennd4 <biennd4@vcs.com>
@grendel513 @Maffooch
Changing name of WhiteSource to Mend (#9359)
1b579b0 
* Changing name of Whitestone to Mend

* adding migrations

* renamed migration to next number

* adding upgrade info and breaking change warning

* addressing comments

* copy paste typo fixed

* Update documentation number

* Update migration

---------

Co-authored-by: Jay Paz <jpaz@optaros.com>
Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com>
@paulOsinski @cneill
Update and rename whitesource.md to mend.md (#9348)
c263392 
* Update and rename whitesource.md to mend.md

* Update docs/content/en/integrations/parsers/file/mend.md

Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com>

---------

Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com>
@renovate
Update dependency postcss-cli from 10.1.0 to v11 (docs/package.json) (#…
a986c7b 
…9116)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@Maffooch
Replace whitesource with mend
67ad937
@dependabot
Bump boto3 from 1.34.31 to 1.34.32 (#9455)
202fcb6 
Bumps [boto3](https://github.com/boto/boto3) from 1.34.31 to 1.34.32.
- [Release notes](https://github.com/boto/boto3/releases)
- [Changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst)
- [Commits](boto/boto3@1.34.31...1.34.32)

---
updated-dependencies:
- dependency-name: boto3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump drf-spectacular-sidecar from 2024.1.1 to 2024.2.1 (#9456)
4760375 
Bumps [drf-spectacular-sidecar](https://github.com/tfranzel/drf-spectacular-sidecar) from 2024.1.1 to 2024.2.1.
- [Commits](tfranzel/drf-spectacular-sidecar@2024.1.1...2024.2.1)

---
updated-dependencies:
- dependency-name: drf-spectacular-sidecar
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@kiblik
API: Remote v2 OpenAPI2 Docs from menu (#9469)
39b68dc
@manuel-sommer
🐛 fix migration (#9467)
3e81d6d
@blakeaowens @cneill
finding sla expiration date field (part one) (#9473)
19ecb49 
* addition of sla expiration date field on the finding model

* add migration and fix indentation issue

* fix mitigated finding remaining sla days calculation

* fix sla violation filter to return only active, sla violating findings

* migration system settings fix

* fix mitigation date vs datetime discrepancy

* fix breaking unit test

* move product save check to signal

* fix unit test failure

* make signal operations async, fix sla config delete 500 error

* add unit tests to test sla expiration date functionality

* restarting without signals

* add async updating flags, redo migration

* move signal logic to overriden save

* fix errors for non-existing objects at creation

* clean up comments and a few logical expressions

* fix flake8 error

* addition of new unit tests

* fix unit test error

* add message to form fields when async updating flag is true

* fix save location, reword form messages, reword redirect messages

* remove commented lines from unit tests

* add a bit more description to API validation errors

* migration fix

* migration performance improvements

* fix datetime - str comparison issue

* clean up for part one of sla expiration date field

* fix flake8

* Update dojo/db_migrations/0200_finding_sla_expiration_date_product_async_updating_and_more.py

Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com>

* Update dojo/models.py

Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com>

---------

Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com>
@Maffooch
Merge branch 'dev' into bugfix
752297a
@Maffooch
Merge pull request #9482 from DefectDojo/bugfix
5b0e5e1 
Merge Bugfix Into Dev: 2.31.0
Update versions in application files
b48587e
@Maffooch Maffooch closed this Feb 5, 2024
@Maffooch Maffooch reopened this Feb 5, 2024
@github-actions github-actions Bot added docker New Migration Adding a new migration file. Take care when merging. settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR apiv2 docs unittests ui parser helm labels Feb 5, 2024
@Maffooch Maffooch merged commit 597cced into master Feb 5, 2024
manuel-sommer
manuel-sommer reviewed Feb 5, 2024
View reviewed changes
Comment thread components/package.json
{
"name": "defectdojo",
"version": "2.30.4",
"version": "3.31.0",
Copy link
Copy Markdown
Contributor

@manuel-sommer manuel-sommer Feb 5, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

2.31.0 ?

Copy link
Copy Markdown
Contributor

@Maffooch Maffooch Feb 5, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ohhh boy :(

Copy link
Copy Markdown
Contributor

@Maffooch Maffooch Feb 6, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe this to be corrected:

  • versions have been updated on master in all the places
  • docker images have been republished with 3.x versions removed
  • helm chart has been republished
  • bugfix and dev left alone as they have 2.32.0-dev versions

@Maffooch Maffooch changed the title Release: Merge release into master from: release/3.31.0 Release: Merge release into master from: release/2.31.0 Feb 6, 2024
@Maffooch Maffooch deleted the release/3.31.0 branch February 6, 2024 00:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Maffooch Maffooch Maffooch left review comments

+1 more reviewer

@manuel-sommer manuel-sommer manuel-sommer left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

apiv2 docker docs helm New Migration Adding a new migration file. Take care when merging. parser settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR ui unittests

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.