Merge remote-tracking branch 'origin/dev' into stackable

Author: dervoeti

.github/workflows/build_push_dev.yml

@@ -44,7 +44,7 @@ jobs:
       -
         name: Build and push backend
         id: build-and-push-backend
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: .
           file: ./docker/backend/prod/django/Dockerfile
@@ -93,7 +93,7 @@ jobs:
       -
         name: Build and push frontend
         id: build-and-push-frontend
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: .
           file: ./docker/frontend/prod/Dockerfile

.github/workflows/build_push_release.yml

@@ -43,7 +43,7 @@ jobs:
         run: echo "CREATED=$(date +'%Y-%m-%dT%H:%M:%S')" >> $GITHUB_ENV
       -
         name: Build and push backend
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: .
           file: ./docker/backend/prod/django/Dockerfile
@@ -89,7 +89,7 @@ jobs:
         run: echo "CREATED=$(date +'%Y-%m-%dT%H:%M:%S')" >> $GITHUB_ENV
       -
         name: Build and push frontend
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: .
           file: ./docker/frontend/prod/Dockerfile

.github/workflows/check_backend.yml

@@ -75,7 +75,7 @@ jobs:
             --env-file docker/backend/unittests/envs/sqlite \
             secobserve_backend_unittests:latest
       - name: "Upload coverage report"
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: coverage-report
           path: backend/coverage.xml

.github/workflows/scorecard.yml

@@ -56,7 +56,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: SARIF file
           path: results.sarif

backend/application/__init__.py

@@ -1,5 +1,7 @@
-__version__ = "1.51.0"
+__version__ = "1.51.1"
 
 import pymysql
 
+pymysql.version_info = (2, 2, 1, "final", 0)
+pymysql.__version__ = "2.2.1"
 pymysql.install_as_MySQLdb()

backend/application/access_control/api/serializers.py

@@ -53,6 +53,7 @@ class Meta:
             "setting_list_size",
             "setting_package_info_preference",
             "setting_metrics_timespan",
+            "setting_rows_per_page",
             "permissions",
             "oidc_groups_hash",
             "is_oidc_user",
@@ -75,6 +76,7 @@ def to_representation(self, instance: User) -> dict[str, Any]:
             data.pop("setting_list_size")
             data.pop("setting_package_info_preference")
             data.pop("setting_metrics_timespan")
+            data.pop("setting_rows_per_page")
             data.pop("permissions")
             data.pop("oidc_groups_hash")
             data.pop("is_oidc_user")
@@ -133,6 +135,7 @@ class Meta:
             "setting_list_size",
             "setting_package_info_preference",
             "setting_metrics_timespan",
+            "setting_rows_per_page",
             "permissions",
             "oidc_groups_hash",
             "is_oidc_user",
@@ -277,6 +280,7 @@ class Meta:
             "setting_list_size",
             "setting_package_info_preference",
             "setting_metrics_timespan",
+            "setting_rows_per_page",
         ]
 
 

backend/application/access_control/api/views.py

@@ -134,6 +134,8 @@ def my_settings(self, request: Request) -> Response:
         setting_list_size = request_serializer.validated_data.get("setting_list_size")
         setting_package_info_preference = request_serializer.validated_data.get("setting_package_info_preference")
         setting_metrics_timespan = request_serializer.validated_data.get("setting_metrics_timespan")
+        setting_rows_per_page = request_serializer.validated_data.get("setting_rows_per_page")
+
         user = request.user
         if isinstance(user, AnonymousUser):
             raise PermissionDenied("You must be authenticated to change settings")
@@ -146,6 +148,9 @@ def my_settings(self, request: Request) -> Response:
             user.setting_package_info_preference = setting_package_info_preference
         if setting_metrics_timespan:
             user.setting_metrics_timespan = setting_metrics_timespan
+        if setting_rows_per_page:
+            user.setting_rows_per_page = setting_rows_per_page
+
         user.save()
 
         response_serializer = UserSerializer(request.user)

backend/application/access_control/migrations/0018_user_setting_rows_per_page.py

@@ -0,0 +1,20 @@
+# Generated by Django 6.0.3 on 2026-04-11 06:14
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("access_control", "0017_add_system_theme_option"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="user",
+            name="setting_rows_per_page",
+            field=models.IntegerField(
+                choices=[(10, "Ten"), (25, "Twentyfive"), (50, "Fifty"), (100, "Hundred")], default=25
+            ),
+        ),
+    ]

backend/application/access_control/models.py

@@ -10,6 +10,8 @@
     DateField,
     ForeignKey,
     Index,
+    IntegerChoices,
+    IntegerField,
     ManyToManyField,
     Model,
 )
@@ -23,9 +25,17 @@
 )
 
 
+class RowsPerPageChoices(IntegerChoices):
+    TEN = 10
+    TWENTYFIVE = 25
+    FIFTY = 50
+    HUNDRED = 100
+
+
 class User(AbstractUser):
     full_name = CharField(max_length=301, blank=True)
     is_external = BooleanField(default=False)
+
     setting_theme = CharField(max_length=6, choices=Theme.THEME_CHOICES, default=Theme.THEME_LIGHT)
     setting_list_size = CharField(max_length=6, choices=ListSize.LIST_SIZE_CHOICES, default=ListSize.LIST_SIZE_MEDIUM)
     setting_package_info_preference = CharField(
@@ -36,6 +46,8 @@ class User(AbstractUser):
     setting_metrics_timespan = CharField(
         max_length=8, choices=MetricsTimespan.METRICS_TIMESPAN_CHOICES, default=MetricsTimespan.METRICS_TIMESPAN_7_DAYS
     )
+    setting_rows_per_page = IntegerField(choices=RowsPerPageChoices, default=25)
+
     oidc_groups_hash = CharField(max_length=64, blank=True)
     is_oidc_user = BooleanField(default=False)
 

backend/application/access_control/queries/api_token.py

@@ -19,7 +19,7 @@ def get_api_tokens() -> QuerySet[API_Token_Multiple]:
     if user is None:
         return API_Token_Multiple.objects.none()
 
-    api_tokens = API_Token_Multiple.objects.all()
+    api_tokens = API_Token_Multiple.objects.all().order_by("id")
 
     if user.is_superuser:
         return api_tokens
@@ -33,7 +33,7 @@ def get_api_tokens_for_user(given_user: User) -> QuerySet[API_Token_Multiple]:
     if current_user is None:
         return API_Token_Multiple.objects.none()
 
-    api_tokens = API_Token_Multiple.objects.filter(user=given_user)
+    api_tokens = API_Token_Multiple.objects.filter(user=given_user).order_by("id")
 
     if current_user.is_superuser:
         return api_tokens