merge dev: multi-CWE stack alongside code-location emission

Four both-sides-append unions: parsers keep the new
LocationData.code(...) emission (V3-gated) and gain dev's unsaved_cwes
persistence; xygeni's import follows dev's parse_cwes rename.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Maffooch

.github/CODEOWNERS

@@ -1,19 +1,4 @@
-# Any kind of package updates only need 2 approvals,
-# So let's add three folks here
-requirements.txt @cneill @mtesauro @Maffooch
-# Any dockerfile or compose changes will need to be viewed by
-# these people
-Dockerfile.* @mtesauro @Maffooch 
-docker-compose.* @mtesauro @Maffooch 
-/docker/ @mtesauro @Maffooch 
 # Documentation changes 
-/docs/content/ @paulOsinski @valentijnscholten @Maffooch
-# Kubernetes should be reviewed by reviewed first by those that know it
-/helm/ @cneill @kiblik @Maffooch
-# Anything UI related needs to be checked out by those with the eye for it
-/dojo/static/ @blakeaowens @Maffooch
-/dojo/templates/ @blakeaowens @Maffooch
-# Any model changes should be closely looked at
-/dojo/models.py @Maffooch
+/docs/content/ @paulOsinski @Maffooch
 # All other code changes should be reviewed by someone
-* @Maffooch @mtesauro
+* @Maffooch @blakeaowens

.github/workflows/build-docker-images-for-testing.yml

@@ -49,7 +49,7 @@ jobs:
         run: echo "IMAGE_REPOSITORY=$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Build
         id: docker_build

.github/workflows/release-x-manual-docker-containers.yml

@@ -52,7 +52,7 @@ jobs:
         run: echo "DOCKER_ORG=$(echo ${GITHUB_REPOSITORY%%/*} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
 
       - name: Login to DockerHub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -64,7 +64,7 @@ jobs:
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
         # we cannot set any tags here, those are set on the merged digest in release-x-manual-merge-container-digests.yml
       - name: Build and push images

.github/workflows/release-x-manual-merge-container-digests.yml

@@ -48,13 +48,13 @@ jobs:
         merge-multiple: true
 
     - name: Login to DockerHub
-      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
       with:
         username: ${{ secrets.DOCKERHUB_USERNAME }}
         password: ${{ secrets.DOCKERHUB_TOKEN }}
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       # the alpine and debian images are tagged with the os name
     - name: Create OS specific manifest list and push

.github/workflows/release-x-manual-tag-as-latest.yml

@@ -37,13 +37,13 @@ jobs:
       run: echo "DOCKER_ORG=$(echo ${GITHUB_REPOSITORY%%/*} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
 
     - name: Login to DockerHub
-      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
       with:
         username: ${{ secrets.DOCKERHUB_USERNAME }}
         password: ${{ secrets.DOCKERHUB_TOKEN }}
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
     - name: Tag with latest tags
       run: |

.github/workflows/renovate.yaml

@@ -21,4 +21,4 @@ jobs:
         uses: suzuki-shunsuke/github-action-renovate-config-validator@ee9f69e1f683ed0d08225086482b34fc9abe9300 # v2.1.0
         with:
           strict: "true"
-          validator_version: 43.248.0 # renovate: datasource=github-releases depName=renovatebot/renovate
+          validator_version: 43.263.3 # renovate: datasource=github-releases depName=renovatebot/renovate

.gitignore

@@ -153,3 +153,5 @@ docs/.hugo_build.lock
 # claude etc
 MEMORY.md
 .claude/
+CLAUDE.md
+CLAUDE.local.md

components/package.json

@@ -1,6 +1,6 @@
 {
   "name": "defectdojo",
-  "version": "3.1.0-dev",
+  "version": "3.2.0-dev",
   "license": "BSD-3-Clause",
   "private": true,
   "dependencies": {

components/tailwind.css

@@ -1177,6 +1177,9 @@
   box-shadow: 0 4px 16px rgba(0,0,0,.12), 0 1px 3px rgba(0,0,0,.06);
 }
 .open > .dropdown-menu { display: block; }
+/* Right-align the menu to its toggle (e.g. dropdowns pinned to the right
+   edge of a header) so it opens leftward instead of overflowing the page. */
+.dropdown-menu-right { right: 0; left: auto; }
 .dropdown-menu > li > a,
 .dropdown-menu > a {
   display: block;

docker-compose.override.integration_tests.yml

@@ -46,6 +46,12 @@ services:
     environment:
       DD_DATABASE_URL: ${DD_TEST_DATABASE_URL:-postgresql://defectdojo:defectdojo@postgres:5432/test_defectdojo}
       DD_V3_FEATURE_LOCATIONS: ${DD_V3_FEATURE_LOCATIONS:-False}
+      # Delay deduplication batches so the async_wait integration test can
+      # deterministically distinguish a blocking join (async_wait) from a
+      # non-blocking one (async). Scoped by _FILTER to that test's findings so
+      # other dedupe tests are unaffected. Integration-test stack only; never prod.
+      DD_DEDUPLICATION_BATCH_PROCESS_TEST_DELAY: 10
+      DD_DEDUPLICATION_BATCH_PROCESS_TEST_DELAY_FILTER: "async_wait finding"
   initializer:
     environment:
       PYTHONWARNINGS: error  # We are strict about Warnings during testing