docs: 3.3.x upgrade notes for the three deduplication identity changes (bugfix) - #15763
Merged
Merged
Conversation
#15761) * docs: 3.3.x upgrade notes for the three deduplication identity changes The 3.3 upgrade page said "no special instructions", which this release makes wrong three times over: Xeol Parser, Checkmarx One Scan and Checkmarx Scan detailed all gain HASHCODE_FIELDS_PER_SCANNER registrations, so findings imported before the upgrade carry hashes that no longer match what an import computes after it. Follows the shape the 3.2 notes set: what changed and why per scan type, then two paths. Instances running the identity signature ledger (default from Pro 3.2.300) need no action because drift detection, the scoped rehash and signature matching bridge the change; the one caveat spelled out is that a large never-backfilled instance should run the backfill before upgrading, since a rehash replaces the identities the backfill exists to record. Everyone else gets the three manage.py dedupe commands in the same form the 2.4x and 3.2 notes use. * docs: the drift watch reports, it does not repair The Pro section overpromised twice. It claimed both ledger flags default on in 3.2.300, and matching is deliberately opt-in. It also claimed the definition change is repaired automatically, but identity_drift_watch notifies and stops there; the repair is the operator accepting the change or running the same dedupe commands everyone else uses. Rewritten so the Pro path is honest: recording is on by default, the drift watch will tell you, and the fix is the same three commands or a Tuner acceptance. The backfill-before-upgrade guidance stays, scoped to instances where matching is enabled, because that is where the preserved identities are actually consulted.
blakeaowens
approved these changes
Aug 22, 2026
Maffooch
approved these changes
Aug 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #15761 (dev,
51fa0654d) to the patch line, so users still on 3.2.x read accurate 3.3 upgrade guidance from the docs their installs build.One difference from the dev commit worth naming: the bugfix line never had a
3.3.mdstub, so this backport adds the page rather than editing it (the cherry-pick surfaced that as a delete/update conflict, resolved by taking the full file).Content is identical to dev: the three identity changes per scan type, the Pro path (recording defaults on from 3.2.300; the drift watch reports and does not repair; backfill before upgrading where matching is enabled), and the three
manage.py dedupe --parser '...' --hash_code_onlycommands for everyone else.