From 4467b86e6e62831e83a266c46132f78a10e19182 Mon Sep 17 00:00:00 2001 From: Cody Maffucci <46459665+Maffooch@users.noreply.github.com> Date: Mon, 17 Aug 2026 18:20:13 -0600 Subject: [PATCH] docs(changelog): add Pro changelog entry for 3.2.200 Summarize the user-facing features, enhancements, and bug fixes for release 3.2.200, grouped by type. Skips dependency bumps, CI, tests, and internal chores. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01Fk3iZNFqwoik35Ywq78u4E --- docs/content/releases/pro/changelog.md | 34 ++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/docs/content/releases/pro/changelog.md b/docs/content/releases/pro/changelog.md index 1d432986b7..fb928d1a2f 100644 --- a/docs/content/releases/pro/changelog.md +++ b/docs/content/releases/pro/changelog.md @@ -14,8 +14,42 @@ For Open Source release notes, please see the [Releases page on GitHub](https:// ### August 17, 2026: v3.2.200 +New features: +* **(CSPM)** Added Cloud Security Posture Management: connect AWS, Azure, and GCP cloud accounts, run posture scans against them, and apply reversible direct remediation to the misconfigurations that are found. +* **(Asset Exposure)** Added asset exposure reporting from Wiz, Shodan, and Censys, and from CrowdStrike Spotlight (which reports only the exposure it can prove). +* **(Connectors)** Registered the Aikido Security, Jit, and Cycode connectors. +* **(Finding Templates)** You can now apply a finding template to a Finding, and turn a Finding into a template, directly from the Vue UI. +* **(Form Configuration)** Added admin-controlled Form Configuration for the Vue create and edit forms, so an administrator can decide which fields appear. +* **(Locations)** Added a DB-backed Locations toggle, with a data-migration suite to move existing data over. +* **(Assets)** You can now export the asset and organization inventory as CSV. +* **(Reporting)** Quick Export now names its output from the current context, and you can apply a report template to an export. +* **(Findings)** Added a filterable Review Claimant column to the findings list. +* **(Rules Engine)** Rules Engine permissions now split into View / Add / Edit / Delete for finer RBAC. +* **(Feature Flags)** Promoted nine feature flags off the menu, turned five more on by default, and moved Feature Flags out of System into its own settings location. +* **(Layouts)** Layout customization can now be restricted to admin-designated defaults. + Enhancements: * **(Qualys)** The Qualys connector now accepts a **Host Tags** filter that scopes discovery to hosts carrying the Qualys asset tags you name. The filter is sent to Qualys, so out-of-scope hosts are never downloaded. It applies to the detection download as well as the host listing, so a narrowed scope also shortens each Sync. Tag names are matched exactly, because Qualys supports no wildcards on tag names. Leave the field blank to keep discovering every host. +* **(JFrog)** The JFrog connector now surfaces a pending status. +* **(Jira)** The Jira connector now accepts service accounts. +* **(Findings)** The count of Findings a tool submitted is now recorded before deduplication runs. +* **(API)** The finding serializer now exposes a flat `test_type_name` field. +* **(MCP)** Finding and asset Location retrieval is now consolidated into single REST calls. + +Bug fixes: +* **(Authorization)** Location data, DojoMeta visibility, and the `/api/v2/location/` endpoint are now scoped to the requesting user's products and RBAC rather than superusers only; every routed connector endpoint is named in the permission allow-list; the user edit form authorization was hardened; Tool Configuration credentials are kept out of the edit form; and the private-note visibility rule is now applied in the note UI views. +* **(Export)** Spreadsheet formulas can no longer execute out of an exported file (CSV/formula injection). +* **(SSO)** SAML2 routes now answer 404 when SAML is disabled. +* **(Findings)** The Priority filter and override inputs now accept decimal values. +* **(Assets)** A PATCH without a `parent` field no longer orphans the asset, and auto-creating the same asset name concurrently no longer returns a 500. +* **(Importers)** Bulk finding deletes, tag-count updates, and async cascade deletes now retry on transient DB conflicts and are ordered so concurrent imports and deletes cannot deadlock. +* **(Connectors)** The Action1 connector tolerates non-numeric sentinels in quoted numeric fields, and the Microsoft Defender connector retries a transient 5xx/429 on a single export page instead of failing the whole export. +* **(Parsers)** Fixed a Trivy Scan crash from an uninitialized `resource_name`, and reset Scout Suite parser state so a report parses to the same findings twice. +* **(Notes)** A partial note PATCH now keeps the note body and no longer writes a null NoteHistory entry. +* **(Reporting)** Reports no longer fetch unrenderable columns, report cells are now bounded, and a block's Order By is applied through the filterset. +* **(Tables & UI)** Clipped table cell text now wraps, the empty band below short pages is gone, the viewport row cap no longer oscillates and stalls a table, and the severity bar chart is positioned correctly in the open findings chart. +* **(Page Grid)** A widget's Title and Icon now follow its Records choice. +* **(Jira)** Fixed the Jira migration. ### August 10, 2026: v3.2.100