[euvoor]

Description

Fixes #16728.

The findings list prefetched endpoint statuses, but rendering each status still fetched its endpoint separately. Join each endpoint into the status prefetch in the legacy endpoint path.

For a warmed page containing 12 findings with three endpoints each, this removes all 36 individual endpoint lookups and reduces total queries from 97 to 61. The existing endpoint prefetch stays in place for the template's existence check. Endpoint ordering, status counts and the Locations path are unchanged.

Test results

Added regression coverage for both All Findings and Open Findings, one versus twelve findings, endpoint URLs and status markers, and findings without endpoints. The query regressions fail on the base revision and pass with this fix.

• Selected findings and endpoint suites: 24 passed, 7 mode-specific skips.
• Importer performance suite: 11 passed, with existing query/task expectations unchanged.
• Locations-mode findings tests: 4 passed, 7 legacy-mode skips.
• Ruff on both changed files, migration drift check and OpenAPI schema validation passed.

Validation used Python 3.14.8 and PostgreSQL 17.11. The full test suite was not run.

Documentation

No user-facing behavior, configuration or schema changes.

Checklist

• Based on current dev.
• Target branch: dev.
• Ruff compliant.
• Regression tests included.
• No model changes or migration needed.

[dryrunsecurity]

This pull request modifies a sensitive codepath in 'dojo/finding/queries.py' by an author not on the allowed list. However, the finding is classified as low severity and is not blocking.

Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/finding/queries.py (drs_058e64bd)

Vulnerability	Configured Sensitive Codepath Modified by Non-Allowed Author
Description	File 'dojo/finding/queries.py' matches configured sensitive codepath pattern 'dojo/finding/*.py' and was modified by 'euvoor' (commit a05d0cb) who is not in the allowed authors list.

---

Comment to provide feedback on these findings.

Report false positive: @dryrunsecurity fp [FINDING ID] [FEEDBACK]
Report low-impact: @dryrunsecurity nit [FINDING ID] [FEEDBACK]

Example: @dryrunsecurity fp drs_90eda195 This code is not user-facing

All finding details can be found in the DryRun Security Dashboard.