Release: Merge release into master from: release/3.1.300

.github/workflows/release-3-master-into-dev.yml

@@ -70,8 +70,8 @@ jobs:
           description: No special instructions.
           ---
           There are no special instructions for upgrading to $minorv.x. Check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/$patchv) for the contents of the release.
-          " > docs/content/en/open_source/upgrading/$minorv.md
-          git add docs/content/en/open_source/upgrading/$minorv.md
+          " > docs/content/releases/os_upgrading/$minorv.md
+          git add docs/content/releases/os_upgrading/$minorv.md
         if: endsWith(inputs.release_number_new, '.0') && endsWith(inputs.release_number_dev, '.0-dev')
 
       - name: Update values in HELM chart

Dockerfile.django-alpine

@@ -5,7 +5,7 @@
 # Dockerfile.nginx to use the caching mechanism of Docker.
 
 # Ref: https://devguide.python.org/#branchstatus
-FROM python:3.14.5-alpine3.22@sha256:6b91e66ab2a880ce9ca5a1b91c70f45963ff71ff68268df056336e1a657d5efd AS base
+FROM python:3.14.6-alpine3.23@sha256:b165067c5afc37fa5608a3c05609cc3d51aafd808a30fbfd822ee594fef55ad4 AS base
 FROM base AS build
 WORKDIR /app
 RUN \
@@ -15,7 +15,7 @@ RUN \
     gcc \
     build-base \
     bind-tools \
-    postgresql16-client \
+    postgresql18-client \
     xmlsec \
     git \
     util-linux \
@@ -49,7 +49,7 @@ RUN \
     xmlsec \
     git \
     util-linux \
-    postgresql16-client \
+    postgresql18-client \
     curl-dev \
     openssl \
     # needed for integration-tests

Dockerfile.django-debian

@@ -43,6 +43,15 @@ RUN \
   apt-get -y upgrade && \
   # ugly fix to install postgresql-client without errors
   mkdir -p /usr/share/man/man1 /usr/share/man/man7 && \
+  # ca-certificates + curl are needed to fetch the PostgreSQL APT (PGDG) signing key
+  apt-get -y install --no-install-recommends ca-certificates curl && \
+  # Debian trixie only ships postgresql-client-17, but the bundled PostgreSQL
+  # server is 18. pg_dump refuses to dump a server newer than itself, which
+  # breaks `manage.py dbbackup`, so pull the matching v18 client from PGDG.
+  install -d /usr/share/postgresql-common/pgdg && \
+  curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc && \
+  echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt trixie-pgdg main" > /etc/apt/sources.list.d/pgdg.list && \
+  apt-get -y update && \
   apt-get -y install --no-install-recommends \
     # libopenjp2-7 libjpeg62 are required by the pillow package
     libopenjp2-7 \
@@ -52,8 +61,9 @@ RUN \
     git \
     uuid-runtime \
     libpq-dev \
-    # only required for the dbshell (used by the initializer job)
-    postgresql-client \
+    # only required for the dbshell (used by the initializer job) and dbbackup;
+    # must match the server major version (18) for pg_dump to work
+    postgresql-client-18 \
     # libcurl4-openssl-dev is required for installing pycurl python package
     libcurl4-openssl-dev \
     && \

Dockerfile.nginx-alpine

@@ -5,7 +5,7 @@
 # Dockerfile.django-alpine to use the caching mechanism of Docker.
 
 # Ref: https://devguide.python.org/#branchstatus
-FROM python:3.14.5-alpine3.22@sha256:6b91e66ab2a880ce9ca5a1b91c70f45963ff71ff68268df056336e1a657d5efd AS base
+FROM python:3.14.6-alpine3.23@sha256:b165067c5afc37fa5608a3c05609cc3d51aafd808a30fbfd822ee594fef55ad4 AS base
 FROM base AS build
 WORKDIR /app
 RUN \
@@ -15,7 +15,7 @@ RUN \
     gcc \
     build-base \
     bind-tools \
-    postgresql16-client \
+    postgresql18-client \
     xmlsec \
     git \
     util-linux \

components/package.json

@@ -1,6 +1,6 @@
 {
   "name": "defectdojo",
-  "version": "3.1.200",
+  "version": "3.1.300",
   "license": "BSD-3-Clause",
   "private": true,
   "dependencies": {

docs/assets/js/custom.js

@@ -22,24 +22,34 @@ window.ddOffcanvas = Offcanvas;
 (() => {
     "use strict";
 
-    // Asset-modelling landing pages per edition. The top nav is otherwise
-    // static, so a single URL can't be correct for both editions: we keep the
-    // "Model Your Assets" nav link in sync with the selected version, and —
-    // when the user is already viewing one of these pages — navigate to the
-    // matching edition's page so the main content follows the toggle.
-    const assetNavUrls = {
-        opensource: "/asset_modelling/engagements_tests/os__assets/",
-        pro: "/asset_modelling/pro_hierarchy/assets_organizations/",
+    // Edition-specific landing pages per top-nav tab. The top nav is otherwise
+    // static, so a single URL can't be correct for both editions: we keep these
+    // nav links in sync with the selected version, and — when the user is
+    // already viewing one of these pages — navigate to the matching edition's
+    // page so the main content follows the toggle. Keyed by nav-link label.
+    const editionNavUrls = {
+        "Model Your Assets": {
+            opensource: "/asset_modelling/engagements_tests/os__assets/",
+            pro: "/asset_modelling/pro_hierarchy/asset_hierarchy/",
+        },
+        // Sensei is Pro-only: Open Source shows a short "Pro feature" page,
+        // Pro shows the full guide.
+        "Sensei": {
+            opensource: "/sensei/os__sensei/",
+            pro: "/sensei/about_sensei/",
+        },
     };
 
-    const switchAssetPageForVersion = (version) => {
-        const target = assetNavUrls[version];
-        const other = assetNavUrls[version === "pro" ? "opensource" : "pro"];
-        // Only redirect when currently on the *other* edition's asset page,
-        // so this never fires on unrelated pages or loops on the target page.
-        if (target && location.pathname === other) {
-            location.assign(target);
-        }
+    const switchPageForVersion = (version) => {
+        Object.values(editionNavUrls).forEach((urls) => {
+            const target = urls[version];
+            const other = urls[version === "pro" ? "opensource" : "pro"];
+            // Only redirect when currently on the *other* edition's page, so
+            // this never fires on unrelated pages or loops on the target page.
+            if (target && location.pathname === other) {
+                location.assign(target);
+            }
+        });
     };
 
     const setVersion = (version) => {
@@ -58,11 +68,12 @@ window.ddOffcanvas = Offcanvas;
             btn.setAttribute("aria-checked", btn.dataset.versionValue === version ? "true" : "false");
         });
 
-        // Edition-aware top nav: route "Model Your Assets" to the page that
-        // matches the selected version (see assetNavUrls above).
+        // Edition-aware top nav: route these tabs to the page that matches the
+        // selected version (see editionNavUrls above).
         document.querySelectorAll("a.nav-link").forEach(link => {
-            if (link.textContent.trim() === "Model Your Assets") {
-                link.setAttribute("href", assetNavUrls[version] || assetNavUrls.opensource);
+            const urls = editionNavUrls[link.textContent.trim()];
+            if (urls) {
+                link.setAttribute("href", urls[version] || urls.opensource);
             }
         });
     };
@@ -80,8 +91,8 @@ window.ddOffcanvas = Offcanvas;
         if (btn) {
             setVersion(btn.dataset.versionValue);
             // Only on an explicit user toggle (not on load) follow the page to
-            // the matching edition when viewing an asset-modelling page.
-            switchAssetPageForVersion(btn.dataset.versionValue);
+            // the matching edition when viewing one of the edition-specific pages.
+            switchPageForVersion(btn.dataset.versionValue);
         }
     });
 

docs/config/_default/menus/menus.en.toml

@@ -23,6 +23,42 @@
   url = "/metrics_reports/dashboards/introduction_dashboard/"
   weight = 14
 
+[[main]]
+  name = "Sensei"
+  # Sensei is Pro-only. Default to the Open Source "Pro feature" page; custom.js
+  # swaps this tab to the full guide (/sensei/about_sensei/) when Pro is selected.
+  url = "/sensei/os__sensei/"
+  weight = 14
+
+# Left-hand section sidebar for the Sensei chapter (the chapter is flat, so the
+# Doks subsection-based sidebar has nothing to render without this menu).
+# Entries are audience-filtered by the version toggle: the opensource page shows
+# in the OS view, the pro pages show in the Pro view.
+[[sidebar_sensei]]
+  name = "Sensei"
+  pageRef = "/sensei/OS__sensei"
+  weight = 0
+
+[[sidebar_sensei]]
+  name = "About Sensei"
+  pageRef = "/sensei/about_sensei"
+  weight = 1
+
+[[sidebar_sensei]]
+  name = "Set Up Sensei"
+  pageRef = "/sensei/setup_sensei"
+  weight = 2
+
+[[sidebar_sensei]]
+  name = "Fixing Findings with Sensei"
+  pageRef = "/sensei/fixing_findings"
+  weight = 3
+
+[[sidebar_sensei]]
+  name = "Sensei Reference"
+  pageRef = "/sensei/sensei_reference"
+  weight = 4
+
 [[main]]
   name = "Admin"
   url = "/admin/admin_intro/intro/"

docs/config/_default/params.toml

@@ -56,7 +56,8 @@ mainSections = ["docs"]
     "admin",
     "automation",
     "asset_modelling",
-    "issue_tracking"] # ["docs"] (default) or list of sections (e.g. ["docs", "guides"])
+    "issue_tracking",
+    "sensei"] # ["docs"] (default) or list of sections (e.g. ["docs", "guides"])
 
   toTopButton = true # scroll-to-top button
   breadcrumbTrail = true # breadcrumb navigation on doc pages

docs/content/admin/feature_flags/PRO__feature_flags.md

@@ -26,11 +26,22 @@ Use the search box to filter the list by feature name or description.
 
 1. Find the feature in the list.
 2. Click its toggle.
-3. The change takes effect immediately. You do not need to restart anything, and other users pick the change up on their next page load.
+3. The change takes effect immediately. Other users pick the change up on their next page load.
 
 Some features show a confirmation dialog before the change is applied. This happens when enabling a feature that carries a warning (for example one that requires a restart or may affect existing data), or one that cannot be turned back off.
 
-Turning a feature off is normally just the reverse of turning it on. The exceptions are called out in the next section.
+Turning a feature off is normally just the reverse of turning it on. The exceptions are called out in [When a toggle is locked](#when-a-toggle-is-locked).
+
+### Organization / Asset Relabeling
+
+**Organization / Asset Relabeling** renames "Product Type" to "Organization" and "Product" to "Asset". It is on by default and toggles from this page like any other feature, but it is worth knowing which parts of DefectDojo it governs:
+
+* The **Pro UI** follows this toggle. The new labels appear on your next page load.
+* The **Classic UI** pages, their URLs, and generated reports take their naming from the `DD_ENABLE_V3_ORGANIZATION_ASSET_RELABEL` deployment setting (also on by default), which is read when DefectDojo starts. This toggle does not change them, and restarting does not make it change them.
+
+The stored toggle was seeded from that deployment setting, so the two agree until you change one of them. If you turn relabeling off here and you also use the Classic UI, set `DD_ENABLE_V3_ORGANIZATION_ASSET_RELABEL=False` on your deployment and restart so both surfaces match. On [DefectDojo Pro (Cloud)](/get_started/pro/cloud/), contact [DefectDojo Support](mailto:support@defectdojo.com) to have the deployment setting changed.
+
+The feature carries a **Restart Recommended** tag on the Feature Flags page for this reason: the naming used outside the Pro UI is fixed when the process starts. Relabeling is cosmetic either way. Database models, field names, and API endpoints are unchanged, so existing automation keeps working. See [Asset Hierarchy](/asset_modelling/pro_hierarchy/asset_hierarchy/).
 
 ## When a toggle is locked
 
@@ -58,7 +69,7 @@ Cloud instances also have access to features that are not offered on-premise. Se
 
 On [DefectDojo Pro (On-Premise)](/get_started/pro/onprem/), most features work exactly as they do on Cloud: open **Settings > Feature Flags** and toggle them.
 
-A small number of features are read from your deployment configuration instead — they change how the application starts, so they cannot be flipped at runtime. These appear on the page as read-only, labeled **Managed by deployment**, and name the environment variable that controls them, for example `DD_ENABLE_V3_ORGANIZATION_ASSET_RELABEL`.
+A small number of features are read from your deployment configuration instead. They change how the application starts, so they cannot be flipped at runtime. These appear on the page as read-only, labeled **Managed by deployment**, and name the environment variable that controls them, for example `DD_V3_FEATURE_LOCATIONS` for [Locations](/asset_modelling/locations/pro__locations_overview/).
 
 Because these features require a restart, and some of them cannot be reversed once enabled, check the feature's own documentation before changing one. Several are best enabled with help from [DefectDojo Support](mailto:support@defectdojo.com).
 
@@ -81,7 +92,6 @@ Most features are available on both installation types. The exceptions are:
 | Downstream Connections | [DefectDojo Pro (Cloud)](/get_started/pro/cloud/) only | Feature Flags page. Shown as **Unavailable on This Deployment** on-premise, which does not run the required infrastructure. See [Pro Integrations](/issue_tracking/pro_integration/integrations/). |
 | Request a New Connector | [DefectDojo Pro (Cloud)](/get_started/pro/cloud/) only | Feature Flags page. Shown as **Unavailable on This Deployment** on-premise. |
 | Locations | Both | Deployment configuration. Locations is in Beta and cannot be turned back off once enabled, so contact [DefectDojo Support](mailto:support@defectdojo.com) to have it enabled. See [Locations Overview](/asset_modelling/locations/pro__locations_overview/). |
-| Organization / Asset Relabeling | Both | Deployment configuration: `DD_ENABLE_V3_ORGANIZATION_ASSET_RELABEL`. |
 
 Every other optional feature is toggled directly on the Feature Flags page on both Cloud and On-Premise instances.