docs: publish the four docs changes stranded on dev - #15649
Merged
Conversation
Documents the new Pro export endpoints: an Asset's dependency inventory as CycloneDX 1.6 / SPDX 2.3, and finding statuses as a CycloneDX VEX document, including the status-to-analysis mapping and current-inventory boundaries. Cross-linked from the Working with SBOMs page. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> (cherry picked from commit e97be18)
* docs: organization types + non-exclusive membership Documents the Pro organization additions that ship with the non-exclusive membership work: - Organization Types: the org_type facet (team / business application / compliance scope / portfolio / custom), orthogonal-axes framing, and same-type nesting via parent_organization (reporting/navigation only -- nesting does not grant access). - Non-Exclusive Membership: the DD_V3_ORGANIZATION_NONEXCLUSIVE deployment flag (off by default), the primary membership as the access/billing anchor, additional memberships with provenance (user pin / connector / rule), access following every membership (why pinning requires edit on both sides), the new Member Assets table and asset-side Organizations tab, and the /api/v2/organization_memberships/ + org_type / parent_organization API surfaces. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: the organization asset list and org filters cover every member asset * docs: asset membership surface is a panel, not a tab --------- Co-authored-by: devGregA <greg-agent-2@defectdojo.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> (cherry picked from commit 8c41868)
…15629) Documents the Pro asset-version additions: - Asset Versions and BOM Snapshots: the DD_V3_ASSET_VERSIONS deployment flag (off by default), why a version is metadata about an Asset rather than another Asset, binding an upload via `version` (falling back to the document's own subject version), the absence of version ordering, and snapshots superseding per (version, format) while history stays queryable -- a separate axis from replace_dependencies. - found_in / fixed_in claims stamped from scan imports that carry a version, additive and never automatically withdrawn. - Per-version SBOM export via `?version=`: components from that version's snapshot, `dependencies` reproducing the declared graph rather than a flat fan, the version on metadata.component / SPDX versionInfo, and the 404-on-unknown-version behavior. - Per-version VEX: fixed_in reports resolved at that version while the same Finding stays exploitable where it was found; no cross-version inference, and a global mitigation is not a per-version fix claim. - The /api/v2/asset_versions/ and /api/v2/finding_version_affects/ surfaces, including why neither offers an update action. Also corrects the SBOM upload field name on the same page: the API field is `replace_dependencies`, not `replace`, so a request sending `replace` was silently importing cumulatively. Co-authored-by: devGregA <greg-agent-2@defectdojo.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> (cherry picked from commit 71807de)
…15633) Documents the two user-visible halves of the identity work: * Asset Kinds -- an optional, descriptive kind per Asset (repository, service, host, ...), drawn from an editable registry rather than a fixed list. * Asset Identity -- per-source aliases (namespace / type / value), what makes an identifier resolve to exactly one Asset, why user-asserted aliases survive automation, and why there is no update action. Also documents how connector Auto-Mapping now chooses a Product: the tool's own identifier first, the name second, a new Product last -- and that turning the feature on changes nothing about mappings that already exist. Co-authored-by: devGregA <greg-agent-3@defectdojo.com> (cherry picked from commit a32ac15)
blakeaowens
approved these changes
Aug 12, 2026
Maffooch
approved these changes
Aug 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Four documentation changes were merged into
devand are therefore not on the live docs site.gh-pages.ymlbuilds docs.defectdojo.com only on pushes tomasterandbugfix, so anything merged todevstays unpublished until the next minor. This brings them tobugfixso they publish on the next patch.Cherry-picked in their original
devorder,-xso each commit records its source:e97be18ab08c418687ab71807ded61a32ac15629All four applied without conflict, and the five resulting files are byte-identical to their current state on
dev. No content was rewritten in the move.The order matters: #15629 edits the SBOM pages that #15584 created, and #15633 edits the asset pages ahead of further work. Cherry-picking any one of them alone conflicts, which is why they travel together.
Docs only. No code changes.