Release: Merge back 2.54.2 into dev from: master-into-dev/2.54.2-2.55.0-dev #14133

github-actions · 2026-01-20T16:39:04Z

Release triggered by rossops

….55.0-dev Release: Merge back 2.54.1 into bugfix from: master-into-bugfix/2.54.1-2.55.0-dev

- Remove asteval from requirements.txt as it's not used in the codebase - Remove asteval license notice from NOTICE file - No Python code imports or uses asteval

…tests (#14080) * Update AssetSerializer fields to allow null values and set defaults * Refactor authorization functions to use type hints for better clarity and maintainability * Enhance permission checks to support multiple primary key attributes in post requests * Refactor check_post_permission to use list type for post_pk parameter * Refactor Organization serializers to handle default values for critical and key assets, and update OrganizationViewSet to use OrganizationFilterSet for filtering. * Refactor API tests to include asset and organization endpoints, enhancing coverage for asset-related functionalities. * Refactor permission classes to use asset and organization-specific permissions, enhancing clarity and maintainability. * Add blank line before UserHasOrganizationGroupPermission class for improved readability

…#14068) - Add explicit 'Report Builder' submenu item under Reports menu for better UX - Improve form validation error messages to show which specific fields are missing - Fix trailing whitespace in Finding Groups menu item

…code duplication (#14081)

…erializer selection (#14090) * Enforce readonly name field for existing Test_Type instances in form * Add TestTypeCreateSerializer and enforce readonly name field in TestTypeSerializer * Add dynamic serializer selection in TestTypesViewSet for create action * Update test payload to set 'active' field instead of 'name' * Update TestTypeTest payload to use 'name' and modify update_fields to 'active' * Add test to verify 'name' field is read-only in TestType

* 💄 Refactor ssl_labs json file * more

…use in report disclaimers (#14098)

…t-grouped Import/Reimport: Push to jira when findings is not grouped

* Add additional fields to AssetSerializer for business criticality, platform, lifecycle, and origin * Correct some filters too

…#14124) Fixes #14118 This commit fixes multiple bugs related to MIME type handling in file downloads: 1. Fixed tuple-as-string bug where mimetypes.guess_type() was used directly in f-strings, resulting in invalid Content-Type headers like "('image/png', None)" instead of "image/png" 2. Added fallback to "application/octet-stream" when MIME type cannot be determined (when guess_type returns None) 3. Fixed incorrect content type for JSON exports (was "json" instead of "application/json") 4. Fixed potential AttributeError crash in inline_image template tag when guess_type returns None and code attempted to call .startswith() on None Files changed: - dojo/api_v2/views.py: Risk acceptance file download (API endpoint) - dojo/utils.py: Generic file response helper function - dojo/finding/views.py: Finding image downloads and JSON template export - dojo/engagement/views.py: Risk acceptance proof downloads - dojo/templatetags/display_tags.py: Inline image template tag All file downloads now properly set Content-Type headers with appropriate fallbacks for unknown file types.

* commit hash footer: disable in production mode * memory leak: fix bleach usage * simplify git commit hash check * improve git commit detection * cleanup

* prettify sample scan files * prettify sample scan files

* tags from parser: fix parsers, add tests and fallback * fix tag merge * comments

Release: Merge release into master from: release/2.54.2

github-actions · 2026-01-20T16:44:05Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

github-actions · 2026-01-20T16:52:17Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

github-actions · 2026-01-20T16:52:27Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

dryrunsecurity · 2026-01-20T16:55:34Z

🔴 Risk threshold exceeded.

This pull request modifies many sensitive templates, auth, importer, API, and utility files (e.g., dojo/templates/, templatetags, api_v2/, authorization, importers/*, utils.py, views, forms) and flags a logic flaw in both default_importer.py and default_reimporter.py where a per-finding push_to_jira flag is overwritten across a batch, causing incorrect/omitted Jira synchronization for findings. Reviewers should verify the sensitive-path changes and fix the batching logic so push_to_jira is handled per-finding (or properly aggregated) before invoking batched post-processing.

🔴 Configured Codepaths Edit in dojo/templates/dojo/engagement_pdf_report.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templates/dojo/finding_pdf_report.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templates/dojo/product_endpoint_pdf_report.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templates/dojo/product_pdf_report.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templates/dojo/product_type_pdf_report.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templates/dojo/report_builder.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templates/dojo/test_pdf_report.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templatetags/announcement_banner_tags.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templatetags/display_tags.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templatetags/get_banner.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/utils.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/importers/base_importer.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/importers/default_importer.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/importers/default_reimporter.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/api_v2/permissions.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/api_v2/serializers.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/api_v2/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/authorization/authorization.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/engagement/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/finding/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/forms.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/importers/base_importer.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/importers/default_importer.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/importers/default_reimporter.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/notes/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templates/base.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templates/dojo/custom_html_report.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templates/dojo/endpoint_pdf_report.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

Logic Flaw in Batched Jira Synchronization in dojo/importers/default_importer.py

Vulnerability	Logic Flaw in Batched Jira Synchronization
Description	The `push_to_jira` flag is recalculated and overwritten for each finding within the import loop. However, this flag is only used when a batch of findings is dispatched for post-processing. Because the variable is overwritten in each iteration, the value passed to the batch processing function is solely determined by the grouping status of the last finding in that batch. If the last finding is added to a group (which sets `push_to_jira` to `False` for that finding to avoid individual sync), all findings in the entire batch—including those that were not grouped and should have been synced individually—will not be pushed to Jira. This leads to findings being missing from Jira, undermining the core vulnerability management workflow.

django-DefectDojo/dojo/importers/default_importer.py

Lines 253 to 256 in 8ba30c5

    
           push_to_jira = self.push_to_jira and ((not self.findings_groups_enabled or not self.group_by) or not finding_will_be_grouped) 
        
           logger.debug("process_findings: computed push_to_jira=%s", push_to_jira) 
        
           batch_finding_ids.append(finding.id)

Logic Flaw in Batched Jira Synchronization (Reimporter) in dojo/importers/default_reimporter.py

Vulnerability	Logic Flaw in Batched Jira Synchronization (Reimporter)
Description	In the `process_findings` method of the reimporter, the `push_to_jira` flag is recalculated for each finding within a loop. However, this flag is used to trigger a batched post-processing task (`post_process_findings_batch`) that applies to all findings accumulated in the current batch (default size 1000). Because the variable `push_to_jira` is overwritten in each iteration, only the value calculated for the last finding in the batch (or the last finding in the report) is used for the entire batch. If findings in a batch have different grouping statuses (some grouped, some not), this lead to inconsistent JIRA synchronization: findings that should be pushed may be skipped, or findings that are already part of a group may be pushed individually, causing duplicates.

django-DefectDojo/dojo/importers/default_reimporter.py

Lines 396 to 399 in 8ba30c5

    
           push_to_jira = self.push_to_jira and ((not self.findings_groups_enabled or not self.group_by) or not finding_will_be_grouped) 
        
           batch_finding_ids.append(finding.id) 
        
           # Post-processing batches (deduplication, rules, etc.) are separate from matching batches.

We've notified @mtesauro.

All finding details can be found in the DryRun Security Dashboard.

DefectDojo release bot and others added 24 commits January 12, 2026 17:13

Update versions in application files

6a0e40d

Merge pull request #14078 from DefectDojo/master-into-bugfix/2.54.1-2…

c0444a2

….55.0-dev Release: Merge back 2.54.1 into bugfix from: master-into-bugfix/2.54.1-2.55.0-dev

Remove unused asteval dependency (#14079)

4e9cda1

- Remove asteval from requirements.txt as it's not used in the codebase - Remove asteval license notice from NOTICE file - No Python code imports or uses asteval

🐛 fix Nonetype in nuclei #14071 (#14072)

09c9821

⬆️ Bump ruff from 0.14.10 to 0.14.11 (#14066)

5057b4b

Refactor note fetching logic to improve permission checks and reduce …

e797c5f

…code duplication (#14081)

Import/Reimport: Push to jira when findings is not grouped

cd98b5e

Add unit tests

045018a

Try more recordings?

8562659

💄 ssl labs json files reformat (#14106)

a8479e1

* 💄 Refactor ssl_labs json file * more

🎉 Implement json part for Cloudflare insights parser (#14096)

deb198d

Consolidation of Template Tags: Make a single use case reusable, and …

770e990

…use in report disclaimers (#14098)

Merge pull request #14107 from DefectDojo/import-push-to-jira-when-no…

c54217c

…t-grouped Import/Reimport: Push to jira when findings is not grouped

Add additional fields to AssetSerializer (#14109)

cc52641

* Add additional fields to AssetSerializer for business criticality, platform, lifecycle, and origin * Correct some filters too

fix bleach memory leak & simplify git commit hash checker (#14117)

84910a2

* commit hash footer: disable in production mode * memory leak: fix bleach usage * simplify git commit hash check * improve git commit detection * cleanup

prettify sample scan files (#14113)

6f48a10

* prettify sample scan files * prettify sample scan files

tags from parser: fix parsers, add tests and fallback (#14111)

9c4f51e

* tags from parser: fix parsers, add tests and fallback * fix tag merge * comments

Update versions in application files

311244a

Merge pull request #14130 from DefectDojo/release/2.54.2

24155ef

Release: Merge release into master from: release/2.54.2

Update versions in application files

91dca67

github-actions bot requested review from Maffooch and mtesauro as code owners January 20, 2026 16:39

github-actions bot added the conflicts-detected label Jan 20, 2026

Merge branch 'dev' into master-into-dev/2.54.2-2.55.0-dev

8ba30c5

github-actions bot removed the conflicts-detected label Jan 20, 2026

github-actions bot added apiv2 conflicts-detected docs unittests ui parser helm and removed conflicts-detected labels Jan 20, 2026

rossops merged commit bc79807 into dev Jan 20, 2026
92 checks passed

rossops deleted the master-into-dev/2.54.2-2.55.0-dev branch January 20, 2026 17:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Release: Merge back 2.54.2 into dev from: master-into-dev/2.54.2-2.55.0-dev #14133

Release: Merge back 2.54.2 into dev from: master-into-dev/2.54.2-2.55.0-dev #14133

github-actions bot commented Jan 20, 2026

Uh oh!

github-actions bot commented Jan 20, 2026

Uh oh!

github-actions bot commented Jan 20, 2026

Uh oh!

github-actions bot commented Jan 20, 2026

Uh oh!

dryrunsecurity bot commented Jan 20, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Release: Merge back 2.54.2 into dev from: master-into-dev/2.54.2-2.55.0-dev #14133

Release: Merge back 2.54.2 into dev from: master-into-dev/2.54.2-2.55.0-dev #14133

Conversation

github-actions bot commented Jan 20, 2026

Uh oh!

github-actions bot commented Jan 20, 2026

Uh oh!

github-actions bot commented Jan 20, 2026

Uh oh!

github-actions bot commented Jan 20, 2026

Uh oh!

dryrunsecurity bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔴 Risk threshold exceeded.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

dryrunsecurity bot commented Jan 20, 2026 •

edited

Loading