Skip to content

remove: Stub Findings (2.57 deprecation, 2.59 EOL)#14837

Merged
Maffooch merged 3 commits into
devfrom
remove-stub-findings
May 8, 2026
Merged

remove: Stub Findings (2.57 deprecation, 2.59 EOL)#14837
Maffooch merged 3 commits into
devfrom
remove-stub-findings

Conversation

@Maffooch
Copy link
Copy Markdown
Contributor

@Maffooch Maffooch commented May 7, 2026

Per the 2.59 upgrade notes, this PR retires the Stub Findings feature (announced for removal in 2.57.0). Full removal: UI, API, model, and DB table. `Stub_Finding` has no inbound foreign keys, so the deletion is self-contained.

Endpoint removed (now `404`)

  • `/api/v2/stub_findings/`

UI removed

  • `/finding//promote`, `/stub_finding//add`, `/stub_finding//delete` routes
  • "Potential Findings" table and quick-add form on the test detail page
  • `promote_to_finding.html` template

What changed

Area What was removed
API `StubFindingsViewSet`, `StubFindingSerializer`, `StubFindingCreateSerializer` and the `v2_api.register("stub_findings", ...)` call
Views `add_stub_finding`, `delete_stub_finding`, `promote_to_finding` in `dojo/finding/views.py`; `get_stub_findings` method + call site in `dojo/test/views.py`
Forms `StubFindingForm`, `DeleteStubFindingForm`
Queries `get_authorized_stub_findings` in `dojo/finding/queries.py`
URLs The three `stub_finding/...` patterns in `dojo/finding/urls.py`
Templates `promote_to_finding.html` deleted; "Potential Findings" table removed from `view_test.html`; quick-add-form AJAX handler simplified to no-op success in `view_test.html` / `view_objects.html` / `view_objects_eng.html`
Authorization The `Finding | Stub_Finding` union in `dojo/authorization/authorization.py` is now just `Finding`
JIRA `isinstance(obj, Stub_Finding)` early-return in `get_jira_issue_url_validation` and the `Finding | Stub_Finding` union in `get_jira_project` removed
Models `class Stub_Finding` and its `admin.site.register(Stub_Finding)` removed
Tests `StubFindingsTest` (`unittests/test_rest_framework.py`), `TestGetAuthorizedStubFindings` + fixture setup (`unittests/test_authorization_queries.py`), the two `test_user_has_permission_stub_finding_*` tests (`unittests/authorization/test_authorization.py`), and the three Selenium tests in `tests/test_test.py`

Schema changes

`dojo/db_migrations/0265_remove_stub_finding.py`:

  • `DeleteModel('Stub_Finding')`
  • `dependencies = [('dojo', '0264_alter_url_identity_hash_alter_urlevent_identity_hash')]`

Coordinating with #14836

This PR's migration uses number `0265`. PR #14836 (Credential Manager removal) also adds a `0265_` migration. **Whichever of the two PRs merges second must rebase its migration filename to `0266_` and update its `dependencies` tuple to point at the previously-merged `0265_*` migration.**

The `view_cred_*` templates contain leftover `#stub_findings` JS as well; those edits are intentionally left to PR #14836 since that PR deletes the entire files.

Verification

  • `python manage.py check`
  • `python manage.py makemigrations --check` → must report "No changes detected"
  • `python manage.py migrate dojo` → applies 0265
  • `python -c "from dojo.models import Stub_Finding"` → ImportError
  • `python -m pytest unittests/ -x --timeout=120`
  • API: `curl -i /api/v2/stub_findings/` → `404`
  • UI: `/test/` should render with no "Potential Findings" table
  • No leftover refs (excluding `view_cred_` templates owned by remove: Credential Manager (2.57 deprecation, 2.59 EOL) #14836): `grep -rn "Stub_Finding\|stub_finding\|stub_findings" dojo/ unittests/ tests/ --include=".py" | grep -v db_migrations` → empty
  • Schema regenerates cleanly: `python manage.py spectacular --file /tmp/schema.yml && grep -c "stub_findings" /tmp/schema.yml` → `0`

The 2.59 upgrade doc already documents this removal; no doc update required.

Diff: `20 files changed, 29 insertions(+), 955 deletions(-)`.

🤖 Generated with Claude Code

@Maffooch @claude
remove: Stub Findings (announced 2.57, EOL in 2.59)
dfbd7c0 
Per the 2.59 release notes, retires the Stub Findings feature in its
entirety: UI, API, model, and DB table. Stub_Finding has no inbound
foreign keys, so the deletion is self-contained.

Endpoint removed (now `404`):
- /api/v2/stub_findings/

UI removed:
- /finding/<id>/promote, /stub_finding/<id>/add, /stub_finding/<id>/delete
- "Potential Findings" table on the test detail page (view_test.html)
- The quick-add-form JS handler that powered it
- The promote_to_finding.html template

Code deleted:
- `StubFindingsViewSet`, `StubFindingSerializer`, `StubFindingCreateSerializer`
- `add_stub_finding`, `delete_stub_finding`, `promote_to_finding` views
- `StubFindingForm`, `DeleteStubFindingForm`
- `get_authorized_stub_findings` query helper
- `get_stub_findings` method and call site in `dojo/test/views.py`
- `Stub_Finding` admin registration and model class
- The `Stub_Finding` branch in `dojo/authorization/authorization.py`
  (now just `Finding` instead of `Finding | Stub_Finding`)
- The `Stub_Finding` early-return and union check in `dojo/jira/helper.py`
- Unit tests: `StubFindingsTest` (REST), `TestGetAuthorizedStubFindings`,
  the two `test_user_has_permission_stub_finding_*` tests, and the three
  Selenium tests in `tests/test_test.py`
- Dead `#stub_findings` JS in `view_objects.html` / `view_objects_eng.html`

Schema dropped via 0265_remove_stub_finding:
- `DeleteModel('Stub_Finding')`

The 2.59 upgrade doc already documents the removal; no doc update.

Note: PR 2 also adds a 0265_* migration. Whichever PR merges second
must rebase the migration filename and `dependencies` tuple accordingly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@Maffooch Maffooch requested a review from mtesauro as a code owner May 7, 2026 22:33
@github-actions github-actions Bot added New Migration Adding a new migration file. Take care when merging. apiv2 unittests integration_tests ui labels May 7, 2026
Maffooch and others added 2 commits May 7, 2026 16:45
@Maffooch @claude
fix: ruff F401 + drop stub_finding refs from fixtures
9985255 
- dojo/finding/views.py: drop now-unused `json` and `formats` imports
  (the only callers were in the deleted stub-finding views).
- tests/test_test.py: drop the now-unused `on_exception_html_source_logger`
  import.
- Remove dojo.stub_finding rows and watson.searchentry rows pointing at
  that content type from all four data fixtures so loaddata stops
  faulting.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@Maffooch @claude
fix: adjust deleted_objects count + drop dependent merge UI test
13d9acd 
- unittests/test_rest_framework.py: EngagementTest.deleted_objects went
  from 23 -> 21 because the cascading delete no longer pulls 2
  Stub_Finding rows.
- tests/test_test.py: drop test_merge_findings (the integration test
  needed two findings; the second one used to come from the stub
  finding promote flow which is now gone). The merge functionality is
  still covered by the unit tests.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@Maffooch Maffooch force-pushed the remove-stub-findings branch from 57c5eb5 to 13d9acd Compare May 7, 2026 23:15
@Maffooch Maffooch added this to the 2.59.0 milestone May 8, 2026
mtesauro
mtesauro approved these changes May 8, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

@Maffooch Maffooch merged commit f50bb18 into dev May 8, 2026
295 of 297 checks passed
@Maffooch Maffooch deleted the remove-stub-findings branch May 8, 2026 20:13
Maffooch added a commit to devGregA/django-DefectDojo that referenced this pull request May 8, 2026
@Maffooch @claude
devGregA Merge branch 'dev' into tailwind
03124a3 
Resolve conflicts from dev's removal of Credential Manager (DefectDojo#14836),
Stub Findings (DefectDojo#14837), deprecated questionnaire API (DefectDojo#14835), plus
Xygeni parser (DefectDojo#14769) and import-time tag batching (DefectDojo#14839).

Accepted dev's deletions: cred module, stub findings, deprecated
viewsets, and their UI sections in view_eng/view_finding/view_test.
Kept tailwind's refactored auth (api_permissions shim, action-string
roles, _user_authorized_for) over dev's legacy Permissions-enum code.
Trimmed cred/Stub_Finding refs from authorization/{api_permissions,
query_registrations,url_permissions}.py and the legacy auth tests.

Note: dojo/templates_classic/ still references removed URL names
(new_cred_*, promote_to_finding, delete_stub_finding) — follow-up.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Maffooch pushed a commit to devGregA/django-DefectDojo that referenced this pull request May 8, 2026
@devGregA @claude
Merge branch 'dev' into tailwind
ae1210d 
Resolve conflicts from dev's removal of Credential Manager (DefectDojo#14836),
Stub Findings (DefectDojo#14837), deprecated questionnaire API (DefectDojo#14835), plus
Xygeni parser (DefectDojo#14769) and import-time tag batching (DefectDojo#14839).

Accepted dev's deletions: cred module, stub findings, deprecated
viewsets, and their UI sections in view_eng/view_finding/view_test.
Kept tailwind's refactored auth (api_permissions shim, action-string
roles, _user_authorized_for) over dev's legacy Permissions-enum code.
Trimmed cred/Stub_Finding refs from authorization/{api_permissions,
query_registrations,url_permissions}.py and the legacy auth tests.

Note: dojo/templates_classic/ still references removed URL names
(new_cred_*, promote_to_finding, delete_stub_finding) — follow-up.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Maffooch pushed a commit to devGregA/django-DefectDojo that referenced this pull request May 8, 2026
@devGregA @claude
Merge branch 'dev' into tailwind
9917ad8 
Resolve conflicts from dev's removal of Credential Manager (DefectDojo#14836),
Stub Findings (DefectDojo#14837), deprecated questionnaire API (DefectDojo#14835), plus
Xygeni parser (DefectDojo#14769) and import-time tag batching (DefectDojo#14839).

Accepted dev's deletions: cred module, stub findings, deprecated
viewsets, and their UI sections in view_eng/view_finding/view_test.
Kept tailwind's refactored auth (api_permissions shim, action-string
roles, _user_authorized_for) over dev's legacy Permissions-enum code.
Trimmed cred/Stub_Finding refs from authorization/{api_permissions,
query_registrations,url_permissions}.py and the legacy auth tests.

Note: dojo/templates_classic/ still references removed URL names
(new_cred_*, promote_to_finding, delete_stub_finding) — follow-up.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mtesauro mtesauro mtesauro approved these changes

@valentijnscholten valentijnscholten valentijnscholten approved these changes

@paulOsinski paulOsinski paulOsinski approved these changes

@Jino-T Jino-T Jino-T approved these changes

@blakeaowens blakeaowens Awaiting requested review from blakeaowens

Assignees

No one assigned

Labels

apiv2 integration_tests New Migration Adding a new migration file. Take care when merging. ui unittests

Projects

None yet

Milestone

2.59.0

Development

Successfully merging this pull request may close these issues.

5 participants

@Maffooch @mtesauro @valentijnscholten @paulOsinski @Jino-T