DefectDojo Pro Changelog

October 29, 2026: v3.4.303

Thu, 29 Oct 2026 00:00:00 +0000

New features:

(Compliance) A Finding’s FedRAMP Potential Agency Impact (PAIN) rating can be set, changed or cleared by hand: on Edit Finding, in Bulk Edit, and through pain_rating on the Findings API, which also accepts it when a Finding is created. The Findings list gains a PAIN column and a filter that offers Unrated. Rating needs the new Rate Potential Agency Impact (PAIN) permission, which every role that can edit Findings receives on upgrade. See Potential Agency Impact (PAIN) Ratings.
(Findings) My Work is one Up Next queue of everything waiting on you, grouped by deadline into Overdue, Due in 7 Days, Later, No Due Date and Waiting on Others: assigned Findings, reviews to claim or clear, Risk Acceptances about to expire, and remediation actions assigned to you. Each item has a next-step button that opens the matching form, and the queue shows as a list, a grid or a board. See My Work.
(Sensei) Ask Sensei answers “what should I fix first?” with fixes rather than Findings: the Root Causes that clear the most, exploited ones first, each with a Fix With Sensei button that shows the plan before Sensei opens pull requests. The panel can expand to full width or open as its own page, and a new conversation opens on a home view of what changed since your last visit and the top fixes. Ranked fixes need Root Cause Correlation. See Ask Sensei.

Enhancements:

(Deduplication) Matching Configuration shows each tool’s default algorithm and hash fields, and Reset to Default loads them into the form, to be saved through Review Impact like any other matching change. See Deduplication Tuning.
(Reporting) On Organization, Asset, Engagement, Test and Finding blocks, the Fields and Order By pickers list their fields under the same headings as that list’s Add Filter. See Report Builder.
(Navigation) Each control in the sidebar footer has its own shape: What’s New is one button naming the release and its unseen count, the Production/Sandbox switch is a full-width button, and the account row shows your username and email beside the alerts bell. Ask Sensei moved into the search field as an Ask button. See The Sidebar Menu.
(Settings) When the running release has been revoked, users who can see the Version Manager get a banner with the reason and the release to upgrade to, and the Version Manager never offers a revoked release as the latest version. See Revoked releases.
(API) The Findings API takes a has_sla filter: true keeps Findings that have an SLA date, false keeps those without one.

Bug fixes:

(Findings) SLA status agrees on every page. Today is the viewer’s date, an open Finding due today is within SLA and reads Due Today, and a mitigated Finding is judged by the date it was mitigated, so the Findings list, Finding Groups, the Insights counts and charts, and the Mitigated Within SLA column put a Finding on the same side of its due date. An open Finding Group’s SLA comes from its open Findings only. An owner assignment completes when its Finding closes, so closed Findings no longer count as open work, and a closed Finding cannot be assigned. See How SLA days are counted and Peer Review & Claiming.
(Deduplication) Mark as Duplicate in the Similar Findings menu refuses to mark an open Finding as a duplicate of a mitigated one, and shows one message with the reason. Consolidating historical churn no longer merges distinct Findings: it orders Findings by import instead of by timestamp, so backdated scan dates cannot chain Findings that were open at the same time, and it leaves out false positive, risk accepted and out of scope Findings. See Similar Findings and Location Drift Matching.
(Tables) Sort offers custom fields on the Assets, Organizations, Engagements and Tests lists, as the Findings list already did, so the grid view can sort by them; multi-select custom fields are not offered on any list. A column filter that has not been applied yet is left alone when settings sync in the background. Toolbar icon buttons match the height of the fields beside them, toolbar labels give way to icons instead of overlapping on narrow windows, and a Tags cell shows the whole tags that fit and folds the rest into +N. See Customizing Tables.
(Dashboards) A dashboard tile’s header stays on one row with a readable title, while viewing and while editing, including beside a stale or failed freshness stamp. See Customizable Dashboards.
(Locations) Sorting the Locations list by Status, including in a Finding’s affected-locations view, works instead of failing to load. See Locations Overview.
(Importers) Reimport Scan on a Test keeps Submit disabled until the Test’s details load, so a quick submit no longer fails validation on fields that cannot be edited. See Tests.
(Settings) The Version Manager answers normally on a new instance’s first page load instead of returning a server error. See Upgrading DefectDojo Pro (On-Premise).

October 28, 2026: v3.4.302

Wed, 28 Oct 2026 00:00:00 +0000

New features:

(AI) AI Guardrails checks every Claude Code prompt and tool call against a policy you control. A policy can block a prompt that holds personal data, redact secrets from file contents and command output before the model sees them, stop or ask about a risky command, or log a match. Developers get the policy through Claude Code’s managed settings, and each checked call is listed under Prompt Activity. Create Starter Policy on Settings > AI Guardrails adds a baseline policy in monitor mode. Requires the AI Inventory and Governance feature flag, off by default, and only superusers can see or change guardrails. See AI Guardrails for Claude Code.
(Connectors) Ingestion Health flags a Connector whose Syncs keep succeeding with zero Findings while it usually imports some. The Connector’s tile reads Returned 0 Findings Against a Baseline of n, where the baseline is the median Findings per Sync over the last 30 days, and a user who can edit the Connector can acknowledge it with a reason that stays on record. The next Sync that imports Findings clears it. Requires the Ingestion Health feature flag, off by default. See Ingestion Health.

Enhancements:

(Assets) Every count card at the top of the Asset page shows what makes up its total, plus one figure for what needs attention, which turns amber or red above zero: open, closed and overdue Engagements; last scanned, imports in the last 30 days and new Findings for Tests; direct, indirect and past-SLA Findings; and vulnerable, not vulnerable and critical Endpoints or Locations. See Assets.
(Tables) Sort in the filter bar takes any number of sort levels. Drag a level by its grip, or press Up or Down, to reorder it, and Reset to Default clears the sort. On the Findings, Assets, Organizations, Engagements and Tests lists, the Columns picker and Sort list their fields under the same headings as Add Filter. See Customizing Tables.
(UI) Icons in the sidebar, top bar, breadcrumbs, table headers and buttons are drawn in a quieter tone than the labels beside them.
(Performance) Opening a Finding no longer runs a query for each finding group in its Test, and API requests with ?prefetch=test load a Test’s finding groups and their Jira issues once.

Bug fixes:

(Triage Engine) Switching a rule’s schedule from Single Run to Repeated Run starts it at the top of the hour, and the minute can no longer be cleared, so the rule saves instead of failing with an invalid cron expression. This applies to every schedule dialog. See Scheduling Rules.
(Reporting) A report left Processing past its time limit, for example because its worker stopped, is marked failed with the timed-out reason. In the template editor, a role with Report Template Add but not Edit can preview a new block and see its chart keys. A template block entry with no block is refused with a 400 instead of a server error. See Report Builder.
(Deduplication) Following a completed Locations migration, Findings in different files are no longer marked duplicates of each other. The upgrade recomputes the stored hashes; Findings already marked duplicate are not changed. Marking an open Finding as a duplicate of a mitigated one is refused, as automatic deduplication already does, Set as original works on a duplicate that has lost its original, and deleting a single Finding no longer deadlocks with the duplicate cleanup. See About Deduplication.
(Importers) Reimport no longer adds a newly reported host to a Finding marked false positive, out of scope or risk accepted for a different host. An import that loses its database connection names the database error and its SQLSTATE in the error response. See Reimport Deduplication.
(Findings) Add Finding From Template fills the description, mitigation, impact, CVSS v3 vector and vulnerability IDs from the template, not only its title, severity, CWE and tags.
(Assets) An Asset’s Technologies tab lists only that Asset’s technologies. See Assets.
(Settings) A new SLA configuration starts with the default day counts filled in, so it can be saved with only a name. See Assign Priority, Risk and SLAs.
(Sensei) Agent targets can be onboarded from the hub’s Add Accounts menu, under Add Agent Targets. The item is disabled with the reason when the license has no agent-target quota or the quota is used up. The menu’s connect-first items read Connect a Source-Control Provider First and Connect a Cloud Provider First in every language. See AI Agent Red Teaming.
(Licensing) A replacement license can be saved on the License Manager page while the instance is over its license limit.
(Tables) A filter being edited is no longer cleared when the table’s settings refresh in the background.
(API) The API token page shows the current key after the token is regenerated in another tab or reset by an administrator, and hides token controls when the instance has API tokens turned off. Concurrent requests for the OpenAPI schema no longer fail with a server error, and a request larger than the upload limits answers 413 instead of 500. See DefectDojo API v2.
(UI) On a multi-step create form, Next is the main button until every step has been reached, and the held Submit explains why it is disabled. A user, environment, or Asset platform, lifecycle or origin that cannot be deleted says how many records still refer to it and which kinds, instead of listing each one. A webhook receiver’s URL and secret buttons wrap at phone width.

Upgrade notes:

(Deployment) On instances with a completed Locations migration, the upgrade recomputes deduplication hashes, which can lengthen the migration. DD_REHASH_MIGRATION_WORKERS sets how many processes run it, up to four by default. See Upgrading DefectDojo Pro (On-Premise).

October 27, 2026: v3.4.301

Tue, 27 Oct 2026 00:00:00 +0000

Enhancements:

(UI) Each tab in a page layout’s tab group can be set to hide when it has nothing to show, so a record no longer opens on an empty tab. The option is on each tab row in the Tabs widget’s Configure Widget dialog. Tiles on detail pages and dashboards now share the header band, title and spacing of the section cards around them. See Customizing Page Layouts.
(Performance) The dashboard priority histogram, Top-N records and Command Center tallies read less data. See Command Center.

Bug fixes:

(SSO) Signing in through an OAuth or OIDC provider works again. In v3.4.300 these sign-ins returned a server error once a provider was chosen. SAML sign-in was not affected. See Single Sign-On.
(Importers) A background import that fails leaves its Test’s status at Failed until the next import, instead of reporting Processed, and the status reads Post Processing - Deduplication while deduplication runs. See DefectDojo API v2.
(Reporting) A report that reaches the time limit while drawing a chart, a widget or an image fails with the time-out reason, instead of staying Processing or completing with a placeholder. A refused template save names the Template Blocks and Theme fields the way the form does. See Report Builder.
(Dashboards) The Command Center finishes loading on large datasets, because a scheduled refresh waits for the previous load to finish. On the Insights pages, the filter bar keeps its own height and its “Some data may be hidden” warning stays in view. See Command Center and Pro Metrics Overview.
(API) A 400 response raised by a model or importer check reads as plain sentences. A delete blocked by other records answers 409 with how many records still refer to it and which kinds they are, instead of listing each one. See DefectDojo API v2.

October 26, 2026: v3.4.300

Mon, 26 Oct 2026 00:00:00 +0000

NOTE: v3.4.300 was revoked: Signing in through an OAuth or OIDC provider returns a server error. SAML sign-in is not affected. Upgrade to v3.4.301.

New features:

(Findings) A Finding’s Title, Tags, Severity, Assignees, Planned Remediation Date and Description can be changed on the Finding page itself, without opening the Edit Finding form. Changes are held until you save, several fields can be changed and saved together, and a change someone else made since the page loaded is never overwritten. The same in-place editing is on the Engagement and Asset pages. Requires the Inline Editing feature flag, on by default. See Editing Findings.
(Notifications) The bell in the sidebar footer opens a notification inbox: unread alerts grouped by the record they are about, with All, Mentions, Assigned, Watching and System tabs, the option to mute a record, and read state carried to the Alerts Page. The counts refresh on their own, and Load Older pages through the rest. The inbox is now generally available. See About Notifications.
(API) Service users are API-only accounts with no email or password that never sign in, each holding one token shown once at creation, and authorized through memberships, groups and a global role on their own page. Requires the Service Users feature flag, off by default. See Service Users.
(Deduplication) Each scan type can set how its Findings are grouped: as the parser produces them (the default), one Finding per location, or one Finding per vulnerability, where every location of a vulnerability becomes one Finding that stays open until each location is fixed. The location-based options need the Locations feature. See Deduplication Tuning.
(Triage Engine) Rules can be exported, imported and restored: move a set of rules between instances with a compatibility check, restore an earlier version of a rule, and manage rules through the API. See Sharing and Versions.
(Connectors) Unmanaged device discovery lists the devices your EDR sees on the network with no agent of their own, as CrowdStrike Falcon Discover and Microsoft Defender for Endpoint report them. Each device is a candidate and becomes neither an Asset nor a Finding on its own. Requires the Unmanaged Devices feature flag, off by default, turned on per connection with Report Unmanaged Devices. See Unmanaged Devices.

Enhancements:

(Connectors) A connector’s label can be renamed without re-homing its Engagements. See Add or Edit Upstream Connectors.
(Connectors) Tenable groups records by asset and adds WAS scan-configuration grouping and a WAS tag filter, Checkmarx One tags Findings with their triage state and exploitable path and carries their comments, Qualys sets each Finding’s date from when it was first found, and Wiz reports a runtime reachability verdict. Connector-owned tags and the triage comment stay current on reimport, and a connector whose filters match nothing shows a warning.
(Jira) Findings can be unlinked from Jira in a bulk edit. See Bulk Editing Findings.
(Triage Engine) Rules can be scoped to hosts, IP addresses and CIDR networks.
(Dashboards) The Count and Graph widgets can measure unique CWEs or unique vulnerability IDs instead of rows, such as unique CWEs by severity for one Asset, and roll the measure up across child Assets. See Customizable Dashboards.
(API) A new API exports an Asset and everything under it as a manifest plus an NDJSON stream. See Product export.
(Locations) Each location reference records the Test that reported it. See Locations Overview.
(Navigation) The sidebar footer has an account row and a single row of icon buttons (alerts, What’s New, Ask Sensei and the Production/Sandbox switch), and the account menu holds the language and light/dark choices. The What’s New panel remembers the release you have seen, per account, and Hide Walkthroughs is on the lightbulb’s list. See The Sidebar Menu.
(Settings) The All Settings page is compacted into group cards. See The Sidebar Menu.
(Threat Intelligence) A Finding’s Threat Intelligence tile shows pending enrichment and KEV status. See EPSS / KEV.
(Performance) The Findings and Engagements lists no longer run a query per row, tag filters match with EXISTS instead of a DISTINCT join, bulk deletes and an import’s finding groups run as one set-based operation, import and reimport requests cost a fixed few queries, and dashboard tile counts, the import list and a user’s History tab read less. Connector configuration saves and deletes cost a fixed few queries.

Bug fixes:

(Findings) A Finding keeps its Locations when the Pro UI edit form is saved.
(Risk Acceptance) A Finding stays in a single risk acceptance when one is reinstated or approved, including under concurrent writes. Reinstating leaves out Findings accepted elsewhere since the expiry, and Jira is told after the change commits. See Risk Acceptances.
(Reporting) Report failure reasons are translated, and a report that reaches the time limit says so. A template’s block ordering is checked when it is saved, with a missing sort field named under Order By, the template editor is tidied, and Add Existing Block follows the permission that saves the template. See Report Builder.
(Importers) The import form’s help is corrected for Scan Date (the mitigated date), asynchronous import and a disabled Close Old Findings, and the Do Not Reactivate option on reimport is explained. See Add Findings form.
(Parsers) The generic importer rejects a field value wider than its Finding column with a 400, instead of failing the import without a clear reason. See Generic Findings Import.
(Connectors) The GitHub connector resolves repositories by URL and owner/name instead of display name, Cycode accepts numeric project IDs, and Qualys WAS leaves an empty filter block out of searches that have no criteria. See GitHub.
(Sensei) A pasted repository access token no longer outranks the repository’s connection and can be replaced or removed, reachability scans fetch private Go modules from the same organization, and a fix is applied to every active code location of a Finding in one change. See Fixing Findings with Sensei.
(Compliance) The CRA scope widget counts every Finding in scope, and the CRA evidence pack’s support-period obligation reads each Asset’s Support Period End. See CRA Article 14 Reporting.
(Permissions) Group writes and the group edit page are offered only where the group role allows them, an empty group counts as 0 members, the Add File action shows for users who can add files, and a page re-checks its per-record permissions when only the route’s parameters change.
(Notifications) Relabeled Organization and Asset links in notifications open their Pro UI pages.
(API) The message beside a 400 response’s field map reads as sentences.
(UI) A failed save, delete or import shows one toast with the server’s reason, the user page’s Metadata and Contact cards stack on a phone, a keyboard-focused table row has a quieter outline, the Markdown source toggle lines up with the first line of text, the UI switches back to an offered language when the one on screen is not offered, and popovers show their line breaks as text.

Upgrade notes:

(Deployment) A self-hosted instance can sign in to PostgreSQL with a cloud identity token instead of a password. See Passwordless Database Authentication.
(Deployment) On shutdown, a running import is allowed to finish before the worker stops, and the import pool’s memory recycling is sized for the pool. See DefectDojo Pro Installation Guide (Kubernetes / Helm).
(Deployment) Operators can default Asset Identity on for new instances with DD_ASSET_IDENTITY_DEFAULT_ON. See Assets.
(Deployment) Databases from before 3.0 upgrade without failing or losing the default group. See Upgrading DefectDojo Pro (On-Premise).
(Helm) The initializer runs with the media volume’s group. See DefectDojo Pro Installation Guide (Kubernetes / Helm).

October 22, 2026: v3.4.202

Thu, 22 Oct 2026 00:00:00 +0000

New features:

(Navigation) Every Pro UI page that has documentation shows a Documentation button beside the breadcrumbs, which opens the matching docs page in a new tab. A page that belongs to a feature behind a flag links to that flag’s documentation. See The Documentation link.
(Assets) The VEX export offers OpenVEX next to CycloneDX, on the Asset page Export dialog and in the API, so an SPDX SBOM can be paired with a matching VEX document. See Exporting SBOMs and VEX.

Enhancements:

(Findings) With Locations on, the Findings export dialog offers a Locations field in place of Endpoints, and the Report Builder has a Locations column, both listing each Finding’s Locations. Exports of lists whose filters are too long for a URL, such as a long pasted list, complete instead of failing.
(Triage Engine) Run Now is no longer offered for scan triggers, and asks for confirmation on a disabled rule. A rule’s schedule is shown to everyone who can view the rule, saving a rule sends only the fields you changed, and rule templates are written in your language when you adopt them.
(UI) The sidebar wordmark no longer runs under the collapse button, a sidebar row with a LEGACY badge is the same height as the rest, a locked filter chip has even padding, the Command Center stat cards keep their deltas and severity chips inside the card, and a walkthrough card stays clear of an open picker.

Bug fixes:

(Importers) With Locations on and location tracking off, a reimport keeps packages that share a CVE as separate Findings instead of merging them into one.
(Dashboards) Insights leaves Findings mitigated on or before their discovery date out of average time to remediation, matching the dashboard. Noise Reduction by Category counts each Finding once, so a reimported Finding is no longer counted as both Reimport Automation and Actionable Finding, in Insights and in Report Builder charts.
(Findings) Quick Export from a Test’s Findings list works.
(Assets) The Asset user and reviewer pickers load instead of returning a server error.
(Sensei) When a new fix replaces an earlier one on the same pull request, the earlier fix is marked Superseded instead of PR Open, and impact counts include only the current fix.
(API) The users API accepts configuration permissions on writes and returns each user’s stored configuration permissions. Sending an empty list removes only configuration permissions.
(Licensing) An instance over its license limit can still export, search lists, and load dashboards and report previews. Changes are refused as before.

Behavior changes:

(Findings) In Keyboard Triage, no key changes a Finding by itself. The keys that set severity and toggled Verified, Under Review, False Positive, and Out of Scope are removed, and n opens the Add Note form. See Keyboard Triage.
(Settings) System Settings no longer shows the Enable Remediation Advice checkbox, which had no effect.

October 21, 2026: v3.4.201

Wed, 21 Oct 2026 00:00:00 +0000

New features:

(Findings) Keyboard Triage walks a Findings list one Finding at a time. Open it with the Triage button or the t key on any Findings list, then set each Finding’s status from the keyboard. Requires the Keyboard Triage feature flag, on by default. See Keyboard Triage.
(Navigation) The Pro UI has keyboard shortcuts. Press ? for the full list, and use j and k to move between rows on every list. See Keyboard Shortcuts.
(Navigation) A What’s New button at the bottom of the sidebar opens the highlights of the release you are running. See What’s New.
(Locations) Qualys VMDR imports and the Qualys connector record each host’s name as a host Location, and host Locations are listed with the others.
(PSIRT) The Linux Kernel CVEs advisory feed reads the kernel CVE team’s own repository. See Linux Kernel CVEs.

Enhancements:

(Assets) Change Plans and the Needs Attention inbox are out of beta and on for every instance, and their feature flags no longer appear on the Feature Flags page. A change plan lists warnings next to its errors, shows the SLA configuration a criticality change maps to, and can be discarded, or rebuilt without the operations on Assets that are still recalculating.
(Importers) An import that names an Asset or Organization by a former name, or by the Organization an Asset was moved out of, lands in the current Asset instead of failing or creating a duplicate. Turn this off with the Imports Follow Renames and Moves feature flag, on by default.
(Connectors) A connector whose syncs keep importing nothing shows a Zero Results chip on its tile and sends a Connector Health Warning, and the Triage Engine rules table shows when each scheduled rule runs next, with an Overdue chip. ServiceNow PC hardware records become host Assets, and the Coverity connector accepts http Coverity Connect URLs.
(Tables) List filters too long to fit in a URL, such as a long pasted list, are sent in the request body and apply instead of failing.
(Performance) Organization moves are batched and recalculate only what they changed, priority recalculation runs as one set-based update, and web workers share one warmed-up application, so containers start faster and use less memory.
(UI) The Location map panels follow right-to-left languages and wrap long words, the Command Center flow ring blocks stay apart in Tamil, Telugu, and Japanese, and its first ring is labeled Processed instead of Ingested. An alert row expands to show its full title and description.

Bug fixes:

(Risk Acceptance) A Finding belongs to one risk acceptance at a time, and every new risk acceptance gets a default expiration date, including those created through the API.
(Compliance) CRA Article 14 reporting works with PSIRT turned off: statutory deadlines warn and breach, deadline notifications reach the users who can view the Asset, and a report can be started from the UI. New Severe Incident Report is renamed New CRA Report.
(Sensei) Repository scans import into the Asset linked on the repository, and a scan run is marked partial when a scanner is skipped or not installed. Code scans no longer drop results when the scanner runs without a vendor login. Sensei rejects a fix that never touches the flagged code, keeps CRLF line endings, replaces an earlier fix when a Finding is remediated again, and builds pull request links from the public DefectDojo URL. Sensei spend prices current Claude models at list rates, links a fix’s usage to its run, and counts a resent usage report once. Threat modeling fits large designs into architecture extraction.
(SSO) A changed OIDC endpoint in Settings > Tuner applies at the next sign-in, without a restart.
(Triage Engine) A rule’s trace follows an Asset run, a saved rule opens as saved, a new rule asks for its name before the first save, and the remaining “Rules Engine 2.0” text reads Triage Engine.
(Tables) Edit form pickers show the saved value, the filter bar chip names In List and Exclude filters, an empty exclude URL parameter leaves the column unfiltered, and the SLA and prioritization engine pickers lock while Findings recalculate.
(Connectors) Checkmarx One reads the CVE name when vulnerability details are present, and a protocol-relative endpoint keeps its host when Locations is off.
(UI) Documentation links point at docs.defectdojo.com.

Security fixes:

(Hardening) The container images ship refreshed CA trust stores that no longer trust the emSign root CAs, and the Orchestrator, connectors, MCP server, and Sensei scan engine are built on a Go release with security fixes.

Behavior changes:

(Assets) Asset Identity is switched by the Asset Identity feature flag, off by default, instead of the DD_V3_ASSET_ALIASES deployment setting. Instances that set DD_V3_ASSET_ALIASES to true keep it on. While the flag is off, connectors keep each record’s vendor identifier current, so turning it on later does not move records back. See Asset Identity.

Upgrade notes:

(Compose) A new install generates its own internal CA and service certificates instead of using the copies shipped in the bundle, and upgrades keep them. Existing installs still on the shipped copies get a warning from certs status, doctor, and the start preflight, and the new certs rotate-internal command replaces them, backing up the old files first. See Checking a Deployment.
(Compose) Sandbox mode pages load on self-hosted Compose installs, and containers no longer receive empty proxy variables when no forward proxy is set, so Sensei scans run every scanner.
(Helm) The uwsgi startup probe is on by default (django.uwsgi.startupProbe.enabled), as a TCP check on the uwsgi port that allows 5 minutes to start, and the import pool gets the same probe. Setting django.uwsgi.startupProbe.path keeps the earlier HTTP check.

October 19, 2026: v3.4.200

Mon, 19 Oct 2026 00:00:00 +0000

New features:

(UI) The Pro UI has in-app walkthroughs. A lightbulb in the lower right of every page lists the walkthroughs for that page: the App Tour, plus task walkthroughs for importing, triage, access, reports, admin setup, the Jira connector, and the Triage Engine. First-time users are offered the App Tour on Home. Requires the In-App Walkthroughs feature flag, on by default. See In-App Walkthroughs.
(Tables) The Findings list has a grid view, a filter bar, and a Match Any mode. The Assets, Organizations, Engagements, and Tests lists get the same grid view and filter bar.
(Triage Engine) A new On Dedupe Match trigger decides what deduplication does with a match in another Asset: mark it a duplicate as before, or keep both Findings active with their own SLAs and link them. Two new actions, Copy Status from Matched Finding and Apply Status to Linked Findings, carry false positive, out of scope, and risk accepted decisions between linked Findings.
(Connectors) StackHawk and Qualys TotalAppSec connectors are available.
(Connectors) Connectors set an Asset’s type from the vendor’s data when a record is mapped and on every sync, and Triage Engine rules can set it too. A type chosen by a person or a rule is never overwritten.

Enhancements:

(Tables) Text column filters gain In List and Not in List modes, every multi-select column filter has an Include / Exclude switch, and the Asset and Organization pick-list filters accept a pasted list. Pressing Enter applies a column filter or the filter bar editor.
(Findings) A Finding’s risk is shown as a meter that marks its band, instead of a written level. The Findings list has an Owner (Team) column and filter, and the API can filter Findings by owner and assignee.
(Triage Engine) Rules can use Asset metadata, custom fields, and contacts in notifications, and select fields support partial matching.
(Connectors) Wiz reports network exposure as asset exposure evidence, FOSSA syncs can be limited by issue category and by project label or title, and Qualys imports host tags and can group Assets by tag. Push to Connector is offered only when a connector covers the Finding, and says what each push sent.
(Assets) The reachability probe checks the addresses held in Locations, and superusers configure it under Settings > Reachability Probe. See Asset Exposure.
(Deduplication) A rehash keeps going when a worker stops, and shows its progress.
(Settings) Every flag on the Feature Flags page links to its documentation.
(Performance) The Pro UI loads its application state once and fetches only what changed as you navigate. The daily SLA run batches its notifications and loads its data up front, the asset page, Findings list, and Command Center no longer recount large Finding sets, list filters stay fast at scale, approved Sensei fix candidates are delivered in the background, and saving a Finding no longer runs one query per vulnerability id.
(UI) Form checks show their messages in the app language, and errors the server returns appear under the field they name. Tags have readable contrast in light and dark themes, with corrected Medium and High colors, table column headers use the monospace label font, the asset hierarchy and Location map editors stack on phones, and a failed table preference save shows one toast.

Bug fixes:

(Findings) Merging Findings deletes each merged Finding on its own, so duplicates and Jira stay in sync, and the merge counts bulk-selected Findings. Users mentioned in a review request are notified, and review notes are cleared.
(Jira) Findings closed because a threat model superseded them are closed in Jira too.
(Importers) Imports and reimports no longer fail when Findings are deleted while they run, and vulnerability ids that are not strings are accepted.
(Deduplication) Excess duplicate deletion runs one at a time, so overlapping runs no longer deadlock, and it only waits for imports in the same database.
(Parsers) SARIF tags and OSV aliases supply CVE and GHSA ids.
(Threat Intelligence) A matched Finding gets KEV and EPSS data when a reimport adds its CVE.
(Notifications) The daily SLA run continues when one Finding fails.
(Sensei) Sensei no longer offers fixes for Findings with no file, and a GitHub 404 from a deleted App or a missing installation is explained. Fixes and the Bedrock connection test use the API Base URL set in AI Model Settings for Claude, OpenAI, and Bedrock. Reachability analysis on Go repositories completes.
(Connectors) An un-ignored mapped record returns to Good and syncs again, and a mapping save with duplicate values no longer fails. Snyk follows every results page, Cyberwatch reads live server data, and Cycode accepts one language or a list. The Jira sign-in flow for Downstream connectors says why it failed.
(MCP) Toolset selection works, and MCP server upgrades no longer interrupt /mcp.
(Compliance) Hand-entered POA&M items stay open across syncs and can carry a scheduled completion date, the POA&M artifacts API honors its snapshot and kind filters, and DAST connector scan types count as web application assessments.
(Assets) Every user who can view an Asset sees its Organization and contact names.
(Locations) Old Endpoint list links keep their filters, New Location and Add Existing show only for users who can edit the Asset (and work for member Writers), the Location Map is translated, and the endpoint status API identifies endpoints by the id the endpoints API lists.
(Tables) A page’s pinned filter stays locked outside an OR group, child pages pin only the parent, and multi-select options apply on click without a search.
(Permissions) Group Owners and Maintainers can list and open the groups they belong to, and member errors are complete, translated sentences.
(Settings) The Pro UI loads on databases migrated from open source whose settings record is not the first row, and the Pro settings record is created only once.
(API) API v3 file uploads accept a title that another file already uses, and a title over 100 characters returns 400. The custom field values API filters by Asset. The admin error email for an unexpected API error includes the traceback.
(UI) In the classic UI, multi-select filter fields render as searchable dropdowns.

Security fixes:

(Authorization) Changing or removing an Owner on an Asset, Organization, or group requires permission to grant the Owner role. Downstream connector errors and ticket links show only Findings the user can view, deleting a mapping or connector requires edit access to the Assets it targets, and the Jira sign-in flow re-checks the user’s permission. Legacy Endpoint detail views check access through the Asset or Finding.

Behavior changes:

(Navigation) The classic sidebar and the Menu 2.0 toggle are removed, and every user gets the current sidebar.
(Findings) The Findings list opens with nine columns: Severity, Risk, Finding, Asset, Status, Age, SLA, Found By, and Tags. The rest are in the Columns picker. Saved table preferences keep their columns, and columns added after a preference was saved start hidden.

Upgrade notes:

(Deployment) The initializer refuses to migrate without a valid license in DD_LICENSE, the mounted license file, or the database. An expired license still passes. Please see the upgrade guide before upgrading.
(Deployment) A fresh install loads a schema built for its release instead of running every migration, so the first start is much faster. Upgrades are unchanged. DD_SCHEMA_DUMP_PATH overrides the schema file’s path, and an empty value turns this off.
(Helm) The Orchestrator TLS private key is kept only in its Secret and no longer copied into the ConfigMap. mcp-server rolls out with no downtime, with a preStop wait set by lifecycle.preStop.waitSeconds.mcpServer, nginx forwards the query string on /mcp, and Django and Celery receive the Sensei Vertex project and region.

October 14, 2026: v3.4.101

Wed, 14 Oct 2026 00:00:00 +0000

New features:

(Sensei) Ask Sensei from any page. Answers are built from live views of your data.
(Compliance) The EU regulatory assessment includes the CRA Annex I Part I requirements.
(Tables) Each table row fits on one line, with a density toggle, and list cells show the first value plus a +N count.

Enhancements:

(Tables) The column picker uses the same checkboxes as the column filter.
(UI) Every multi-step form uses the same stepper, with Submit available on every step.
(Connectors) Vendor logos on the Connections page are drawn at one size in the brand duotone.
(UI) The app works better on phones: Dashboards 2.0 widgets and Home’s stat cards stack in one column, Home’s brief stays whole, and the app shell fits the screen (gutter, breadcrumb trail, rail height).

Bug fixes:

(Connectors) FOSSA syncs complete on large organizations.
(Sensei) A scan target is verified again after its host changes, and the DAST targets list uses the same verification rule as launch.
(Importers) The import file pickers accept .ckl, .cklb, and .jsonl files.
(Settings) A Tuner settings save applies in every worker on its next request, and Tool Configurations keep stored credentials on edit.
(UI) Numbers are formatted in the language picked in the app, the Jira project popover keeps its width, content after a table stays inside its card, removing a Dedupe Pool member moves into a row menu, and the compliance evidence mode no longer overlaps the Evidence button on narrow screens.

Security fixes:

(Authentication) MFA and password reset rules apply to every sign-in path, exports require sign-in, and the generated admin password and Jira webhook secret no longer appear in logs.
(Authorization) LDAP settings, the update check, reminder snoozes, Finding Groups, and Finding actions are checked against the user’s permissions. Only authorized users can grant group configuration permissions and owner-level roles. Edits and deletes of shared Locations are limited to the user’s Assets, and API requests can only reference records the user can access.
(Hardening) Connectors reuse a stored credential only when the host is unchanged, exports are hardened, and Markdown rendering is stricter. The licensing portal refuses the placeholder portal secret, and DefectDojo warns when the Sensei engine secret is a shipped default.

Upgrade notes:

(Deployment) The Orchestrator is verified against its own CA when REQUESTS_CA_BUNDLE is set, and the Helm chart includes the Orchestrator root CA in the combined CA bundle.
(Deployment) The AI inventory catalogue, presets, and FedRAMP VDR data are included in the package.
(Connectors) The pro.W001 system check hint now gives the manual secret step that works today.

October 12, 2026: v3.4.100

Mon, 12 Oct 2026 00:00:00 +0000

New features:

(Search) Global Search (Cmd/Ctrl+K) is rebuilt as a palette with two modes: Search finds records by type (Findings, Assets, Organizations, Engagements, Tests, Locations), and Navigate jumps to any page in the sidebar.
(Sensei) 1,000 free Sensei fixes for every Pro instance from October 14 through November 13. Free fixes are used before your license quota and do not count toward pay-as-you-go spend.
(Sensei) Reachability analysis runs after default-branch scans and can be started from the asset menu. An import can now carry several reachability verdicts, each source goes stale on its own, and a reimport retracts verdicts that no longer apply.
(Sensei) When the Model setting is blank, Sensei uses Claude Sonnet 5.5 and falls back to Sonnet 4.6, then 4.5.
(AI) Amazon Bedrock is available as a provider for the in-app AI features.
(Compliance) Posture scans count as configuration evidence, with PCI DSS Requirement 2. Security Hub and Wiz findings are tagged with the compliance requirements they map to, and Prowler compliance mappings are kept on cloud scan results.
(Compliance) For findings that cite no security control, DefectDojo suggests control mappings for a person to confirm.
(Threat Intelligence) Findings and the Vulnerability Explorer show source ratings from the signed threat-intel bundle, and the finding’s evidence chip shows the date a CVE was added to CISA KEV.
(Locations) Cloud resources are listed under Attack Surface.
(Licensing) View and delete the legacy endpoints that still count toward your license after the move to Locations.
(Air-Gapped) The Airgapped instance flag, or the new DD_AIRGAPPED setting, now stops every default outbound call: the version check, external tools, announcements, threat intel, and diagnostics.
(Deprecations) Each deprecation is declared once, with its release calendar, and shown on every surface where it applies.
(Tables) Tables show when their columns or filters have unsaved changes.
(Navigation) Pinned sidebar entries are prefixed with their parent group.
(UI) DefectDojo asks before copying, duplicating, or moving a record.
(Connectors) Security Hub ECR repository tags become asset tags for resource grouping.
(MCP) The MCP server can render DefectDojo results as MCP Apps views.
(API) locations is advertised as a prefetch option on findings and products.

Enhancements:

(UI) Pages work better on narrow screens and phones: detail page headers wrap, dialogs stay inside the viewport, the Permissions dialog fits, and Home and the connection tiles no longer scroll sideways.
(UI) Labels and copy are reworded and title-cased consistently in all 27 languages, and forms, tables, and dialogs across the UI (including the Command Center, Report Builder, and Sensei pages) share one style.
(SSO) When an identity provider’s certificate cannot be verified, sign-in shows an actionable message, and Validate Config names the CA bundle it checked against.
(Performance) Removed per-row queries from the tests, endpoints, locations, assets, engagements, and findings lists and from findings exports. Reimport closes old findings in bulk and looks up only the endpoints a report can match, the endpoint meta import is batched, notification cost stays flat as recipients grow, and prioritization rescores a product in a worker after import.

Bug fixes:

(Login) A failed SSO sign-in no longer loops on the auto-redirect, and the login page reports a login service that returns an unexpected response.
(Connectors) Finding tags sent by connectors are saved, nb_occurrences maps onto the finding, a corrupt gzip chunk returns 400 instead of 500, and moved assets’ records are no longer marked stale when their original organization is deleted. Discover and Sync say why a run was refused and refresh the records when it ends, and Push to Connector says whether anything was sent. Downstream connector controls follow Integration permissions instead of requiring a superuser.
(Connectors) Cyberwatch authenticates with HTTP basic auth, Cycode streams violation pages, and Snyk treats a missing links object as the end of pagination.
(Deduplication) Security Hub connector findings match on their finding ARN, and the same CVE in two container images stays two findings.
(VEX) The asset VEX export never applies one host’s not_affected to another host.
(Sensei) Fixes that cannot succeed are refused up front, patch-mismatch evidence is kept, only fixable candidates are staged, and spend is recorded on failed fixes. Sensei targets refresh after a status sync, and Scan History is back.
(Importers) Import no longer overwrites a report’s scan date, and misleading import and reimport fields are corrected. A scan with a missing request or response in a request/response pair imports, and an orphaned location reference returns 400 instead of 500.
(Parsers) SonarQube REST API imports store the issue key as unique_id_from_tool, and Qualys WAS honors the QUALYS_WAS_WEAKNESS_IS_VULN and QUALYS_WAS_UNIQUE_ID settings.
(Risk Acceptance) The default expiration date applies to every new risk acceptance, the forms offer the engagement’s findings, and accepting risk stays fast on tables without statistics.
(Findings) The SLA of a finding due today is shown, and creating a finding group no longer returns 500 for non-superusers.
(Reporting) Organization users can open Generated Reports, report toasts link to the report, and a failed report shows why.
(Triage Engine) New rules start disabled and Run Now runs them, and a rule with a disabled schedule says so instead of showing a next run.
(Locations) Old Endpoint links redirect instead of returning 404.
(Notifications) Notification and Quick Action links point at pages that exist.
(Permissions) A refused member add shows the server’s reason, and the Owner role is offered only to users who can grant it.
(Settings) The default group can be cleared, and Tool Configurations keep stored credentials when they are left blank on edit.
(API) The SonarQube issue and transition endpoints are served from the right viewsets, and the API v2 Token page shows a refusal once and has a corrected Python sample.
(Threat Intelligence) EPSS and receipt links refresh on records whose score did not change.
(Licensing) A license date without a timezone is read as UTC instead of failing.
(UI) Actions the server would refuse are hidden, a failure shows one toast, PSIRT toasts no longer show error codes, the Regulatory Scope severity counts show in every language, and the Command Center respects reduced motion.

Security fixes:

(Authentication) API token settings apply to API v3 token auth, HTTP Basic auth on the API follows the token endpoint’s account rules, the login rate limiter and account lockout are adjusted, account-recovery emails are limited per address, the report cover page requires a login, and changing a JIRA instance URL requires its password.
(Authorization) Object permissions are enforced on the questionnaire answer view, the API v3 import permission check, delete_preview on configuration viewsets, notification recipients, Issue Tracker Assignments, and report selectors and endpoint counts for shared locations.
(Hardening) The upload file type check covers parser-supplied attachments, three parser regular expressions are bounded, new system checks flag settings left at their shipped values, and the FIPS images apply Debian security updates.

Upgrade notes:

(Compose) The separate-db and containerized-db bundles now require per-install values for DD_ORCH_SECRET and DD_SENSEI_SHARED_SECRET. A current dojo-compose-cli generates both. The bundles also ship upgrade notes that dojo-compose-cli checks before an upgrade, and the first admin’s email is read from DD_ADMIN_MAIL.
(Deployment) uWSGI now uses harakiri to recycle wedged workers, configurable with DD_UWSGI_HARAKIRI (Compose) or per uWSGI pool (Helm).
(Deployment) A forward proxy and a private CA are honored by every container, NO_PROXY has built-in defaults, and /api/v2/health_check/light/ answers 503 instead of 400 when it fails. Self-hosted defaults for diagnostics, the portal secret, and initializer exit codes are corrected.
(Helm) New values: an opt-in dojo.migrationCheck gate that holds pods until migrations finish, license.existingSecretKey, ddorch.tls.existingSecret for GitOps and cert-manager, and GKE django.service.loadBalancerSourceRanges, SSL policy, and Cloud Armor settings. The values templates ship inside the chart, and the OCI chart is the documented install source.
(Helm) The ddorch TLS private key is stored in a Secret instead of a ConfigMap, the webhook gateway has its own trust anchor, the mirror, proxy, and CA settings reach every workload, django pods roll without load-balancer errors, and helm upgrade --reuse-values from 3.3.x renders.

October 5, 2026: v3.4.0

Mon, 05 Oct 2026 00:00:00 +0000

New features:

(Triage Engine) Webhook receivers let Jira and other tools send changes back to DefectDojo, and the Jira Downstream Connector gains two-way sync and Push Notes as Comments.
(Triage Engine) AI steps: three new nodes in an AI section of the palette (Check for False Positive, Assess Exploitability, and Group by Fix) ask Sensei one fixed question about the findings that reach them and route each finding out of a named exit, so the AI proposes and a person decides.
(Triage Engine) Asset actions gain computed destinations (set the organization, parent, or SLA configuration from a tag, attribute, or connector field with a mapping), connector record attributes are available in the asset envelope, and a new Add Membership node replaces the admin-only membership rules.
(Sandbox) Sandbox Mode: a practice copy of DefectDojo Pro under /sandbox/, on its own database and preloaded with sample data, with Reset and Wipe for superusers. Nothing done in the sandbox reaches production. Self-hosted instances turn it on with DD_SANDBOX_ENABLED.
(Support) The new Support section in Settings searches the docs first, then lets you file feature, connector, bug, and feedback requests and vote on a public community board. It replaces the Contact Support menu entries and pages; old bookmarks redirect.
(Remediation Center) A new beta module (feature flag remediation_center, off by default) that makes the remediation action the unit of work: open findings are grouped by the change that resolves them, one action per change per place, each with a due date, risk, owner, workflow status, and the findings it will close.
(AI Inventory) A beta AI inventory (feature flag ai_inventory, off by default, requires Locations): every scanned repository gets an inventory of its coding assistants, MCP servers, models, AI packages, AI service endpoints, agent skills, and provider keys. Governance policies mark each as authorized, unauthorized, or needs review, unauthorized components become findings, and each Asset exports a CycloneDX 1.6 AIBOM. The DefectDojo scanner detects the AI in a repository and uploads it as a CycloneDX inventory.
(Assets) A Needs Attention inbox under Assets lists assets still sitting in a connector’s default organization or missing the fields that priority and SLA run on, a What Drives Priority and SLA card appears on the asset page, and onboarding is complete when the inbox reads zero.
(Assets) Hierarchy change plans: bulk or AI-made reorganizations become a server-side plan with a dry-run diff that you review, apply as one change, and undo if needed. Plans can be built from JSON or a CSV upload.
(Connectors) New Microsoft Azure and Google Cloud asset connectors, and a new Kenna Security (Cisco Vulnerability Management) connector.
(Connectors) AWS Security Hub gains configurable asset grouping (by resource type or resource) with hierarchy parents, account parent records, OU and account-tag placement, AWS tags, and re-placing of existing assets. The same grouping and placement ladder comes to Microsoft Defender for Cloud, Prowler, Google Cloud SCC, and Lacework.
(Connectors) Re-mapping an already-mapped record to a different asset now moves its findings to the new asset by default, or closes them, instead of leaving them open and importing a duplicate set.
(Findings) Move or copy findings to another test, singly or in bulk.
(Findings) The finding tables gain an Exception Requested column and filter for findings sitting in a risk acceptance nobody has decided yet.
(Correlation) Fix with Sensei on Root Causes: the Root Cause dialog’s member table carries the Sensei column, so you can launch a fix for each finding in the cluster.
(Locations) The Location page returns, with the asset-scoped Metadata box, a Custom Fields card, and a Referenced By table of the assets that use the location. Cloud resource identifiers (AWS ARNs, GCP self-links, Azure resource ids) are decomposed into provider, account, region, service, and resource fields.
(Compliance) Supporting files can be attached to regulatory obligations as evidence.
(Reporting) Report Builder gains Location per Asset blocks and Asset and Organization name columns.
(PSIRT) PSIRT is out of beta, the PSIRT API is available on /api/v2/psirt/* with token authentication, and the MCP server gains a PSIRT toolset.
(i18n) Ten more languages: Polish, Ukrainian, Turkish, Indonesian, Filipino, Vietnamese, Thai, Korean, and Chinese (Simplified and Traditional).
(API) Findings can be ordered by priority.

Upgrade notes:

(Deployment) Self-hosted Docker Compose deployments, and Helm deployments with webhookGateway.enabled, run a new webhook gateway service in front of webhook receivers, with its own schema and database role inside DefectDojo’s database. Please see additional instructions for more details.
(Helm) New chart values: connectors.debug (default off), connectors.vendorEgress (private-network blocking and allowed or denied CIDRs, default off), dojo.obligationAttachmentMaxBytes (default 10 MB), and a sandbox values block for Sandbox Mode. The Go service’s internal routes are kept off nginx and its rate-limit toggles are split. The dd-orch workers and integrators mount only the dd-orch root CA, and the django readiness probe now has to reach a uwsgi worker.
(Deployment) The pro.0001 migration streams and bulk-creates its enhanced finding rows, so the first upgrade on a large instance completes in bounded memory.

September 28, 2026: v3.3.300

Mon, 28 Sep 2026 00:00:00 +0000

New features:

(i18n) The Pro UI is now multilingual, with 27 languages available including German, Japanese, French, Italian, Spanish, Dutch, Portuguese (Brazil), Russian, Hindi, Bengali, Marathi, Tamil, Telugu, Hebrew, Arabic, Persian, and Urdu. A new setting lets you choose the interface language.
(Appearance) DefectDojo’s 2026 rebrand ships with a new logo and brand colors, plus an Appearance page with theme presets and a color customizer.
(Reporting) The Report Builder can export to CSV, Excel, and JSON. Reports gain template variables and per-finding / per-asset Triage Engine reports, and a new /api/v2/report_schedules/ endpoint schedules report generation. Generated reports also expose a plain-text sidecar and content endpoint.
(Locations) Code to Cloud Locations arrive: container-image and connector-populated cloud-resource inventories, an image-to-repository link, suggested deploys_to edges, and typed location items. Harbor and Trivy Operator connectors emit inventories, and the scanned image or resource is recorded on every finding.
(Findings) Exploit Maturity and Reachability are now manually editable, and Priority, Risk, and Risk Score are added to every findings export.
(Tables) The column picker gains select all / deselect all, and lazy list filters gain “select all matching.”
(MFA) Superusers can reset another user’s MFA.
(MCP) The MCP server adds a Dashboards 2.0 toolset and dashboard support, and the reporting toolset is now customer-visible.
(SLA) Two-stage regulatory deadlines for vulnerability response.
(Risk Acceptance) Filter the risk-acceptance list by host, and see the hosts an acceptance covers.
(Connectors) The GitLab connector gains an Exclude Archived Projects toggle for project discovery.

Enhancements:

(Dashboards) The Command Center scene is refined with a dot grid, softer beams, a risk-colored actionable ring, and an automation bar. Dashboards 2.0 layouts add audit history, ETag / If-Match concurrency, and a widget-config JSON Schema.
(Vulnerability Explorer) Multi-value filters, null-last multi-column sorting, and a filter for every column.
(Tables) Numeric, score, and date columns sort descending first, with blanks last.
(Sensei) Sensei and AI Agent Red Teaming reach general availability (the BETA badge and the agent_redteam feature flag are removed), and the Advisor’s cross-tool estimate now simulates dedupe within Dedupe Pool scope.
(Connectors) Each connector sync is metered with a single usage record, and NowSecure includes the app group in the product name.
(Performance) Audit-log Changes filters search the stored row JSON and count in the page query; report block filter tables load only when filters are added; and the nightly enrichment fan-out no longer depends on a shared connection.

Bug fixes:

(Connectors) Fixes across Aqua (token-exchange redirect handling and server-side branch discovery), Snyk (org enumeration and access validation via the REST API, and no longer fetching SCA issues from both the v1 and REST APIs), Cycode (pagination parameters), NowSecure (assessment-status decoding), and YesWeHack (endpoints built from the report scope). A sync that started under the license is allowed to finish before it blocks.
(Findings) Bulk Edit keeps its popover open while picking a dropdown option and no longer clips the Risk Acceptance list, and filters no longer leak between the findings status pages.
(Reporting) The Report Builder block modal recovers when field options fail to load, a duplicated report block preserves its chart date range and truncates the copy name, and report templates no longer try to load scripts nginx does not serve.
(Parsers) Crash fixes in the Aqua and Snyk parsers for None-field concatenation, and Generic Findings Import correctly reads CSV KEV/fix booleans, CVSSV3_score, and empty cells.
(Deduplication) Matching Configuration loads every row when the server caps page size, and the duplicate-finding self-FK is row-locked so import dedup and duplicate deletion no longer fail at commit.
(Importers) Reimport with group_by no longer 500s on duplicate same-name finding groups, and scheme-less connector endpoints store their host.
(Assets) The hierarchy link and gear no longer act on an unloaded asset, and the Asset/Location relationship is shown and editable on the dependency map.
(SLA) SLA configurations governed by a deleted response policy are re-swept.
(Permissions) The permission cache is busted correctly on Pro membership, role, and group-member writes and on reassign-deletes, and user and group deletes no longer fail in the permission-cache receivers.
(JIRA) Select-list custom-field values are wrapped correctly, the authorized project queryset is ordered by id, and empty credentials no longer garble debug dumps.
(SSO/SCIM) SAML keeps an uploaded metadata file across later saves, and SCIM routes mount under the configured URL prefix.
(UI) The OS banner message decodes as UTF-8 and restores its list and paragraph styles, and filter-menu controls render in flow so Clear/Apply stays reachable.

Security fixes:

(Authorization) Hardened authorization on the audit history page, the merge-finding action aligned with the object-level permission check, Location relation filters scoped to the caller’s products, and cross-organization asset-hierarchy edges refused on every write path.
(Secrets) Stored settings credentials are masked in the audit log, saved SSO, OIDC, and email secrets are no longer sent to the settings pages, and the stored LDAP bind password is reused only for the saved server and Bind DN.
(MFA) TOTP codes are single-use, recovery codes use a CSPRNG, and MFA is enforced on the Vue API for session logins.
(Sensei) The engine and CI endpoints are scoped to the caller’s objects, the LLM key is kept on its own endpoint with Vertex host validation and untrusted-prompt fencing, and only repository writers can trigger /fix from a comment.

Behavior changes:

(Deduplication) The Tenable Scan hash_code fields no longer include the description, changing how those findings deduplicate.

Upgrade notes:

(Logging) The default logging handler is now gcp_json, and nginx logs carry a severity.
(Deployment) Back up both databases before upgrading; a restore runbook is now linked from the on-prem docs.

September 22, 2026: v3.3.200

Tue, 22 Sep 2026 00:00:00 +0000

New features:

(Compliance) New regulatory scope foundation with an EU-seeded profile, plus EU regulatory control catalogs, EU regulatory assessments, and exportable EU evidence packs.
(Compliance) PCI DSS compliance pack: scope and scope inventory, patch-clock SLAs (6.3.3), targeted risk analyses (12.3.1), quarterly scan and ASV evidence, a vulnerability-management control catalog, and a PCI DSS evidence workbook.
(Compliance) FDA cyber device packs: component support metadata, lifecycle metrics, SBOM export, and the Section 524B cyber device evidence pack.
(Compliance) CRA Article 14 reporting interface.
(Compliance) Certification control catalogs for ISO 27001, SOC 2, and NIS2, with a cross-framework evidence view.
(Compliance) Framework presets for UK Cyber Essentials and the Australian Essential Eight.
(SLA) Versioned vulnerability response policies, with a response-clock evaluation and incident escalation, plus a vulnerability response evidence API and export.
(Sensei) Dynamic Scanning (DAST): configure targets, verify ownership, launch scans, and meter usage for billing.
(Sensei) AI Agent Red Teaming, a new Sensei capability and engine mode for red-teaming AI agents.
(Sensei) Schedule hosted repository scans with attributed credentials, and track scan frequency with exportable cadence attestations.
(Sensei) Tier Advisor projects your annual processing volume and recommends a tier.
(Dashboards) The Command Center dashboard scene, now the home page for every user.
(PSIRT) CSAF 2.0 / VEX advisory export, backported to the 3.3.x line.
(Findings) EPSS and CISA KEV threat-intelligence fields are editable on the Add/Edit Finding form.
(Triage Engine) Import-completion triggers, one per scan and one per group of scans.
(Locations) Container scanners now emit the scanned image as an Image location.
(Licensing) New endpoint-status and location-finding audit pages, plus a location-metering health metric.
(Connectors) Aqua Supply Chain imports non-default branches via per-branch scan ids, and enriches Supply Chain findings with reachability verdicts and friendly category tags.
(Connectors) Microsoft Defender adds a device-group import allowlist.
(Connectors) Azure DevOps applies your custom field mappings to work items.

Enhancements:

(Findings) The finding SLA row now shows the SLA expiration date.
(Connectors) Aqua warns when a configured branch imports nothing beyond the defaults, and a branched sync tags the default-branch engagement.
(Reporting) Report chart blocks gain a Date Range window, and the Widget-block picker is populated.
(Celery) A finished task reports its peak memory when it nears the guard limit.
(Performance) EPSS enrichment gates changes at display precision and streams the nightly projection; the Location Map authorizes once per request and counts root groups correctly; product-grade recalculation is debounced per product.

Bug fixes:

(Connectors) Fixes for slow validates (a WriteTimeout raised above the Django wait to stop TLS desync), Cycode auth split across its two hosts, a slow GitLab config save, NowSecure assessment-list 400s with surfaced HTTP errors, finding correlation on chunked syncs, single-label hosts in a Location URL, and Qualys finding title and vuln id aligned with the OSS parser.
(Deduplication) Matching Configuration lists every test type.
(Triage Engine) Rule-graph nodes saved without positions are laid out, and v1 float conditions carry EPSS-precision decimals.
(Reporting) A report keeps rendering when a saved column was renamed.
(Compliance) The POA&M sync no longer walks whole products on instances without a compliance profile.
(Locations) Bulk-update popovers stay open while picking a status, and the created_at/updated_at and location_type/location_value API filters resolve correctly.
(Importers) Scan retention is bounded so a large backlog cannot exceed the hard time limit, a scan import over the upload limit returns a clear 400, and a missing uploaded file returns 404 instead of 500.
(Security) Engineer metrics, and classic search and endpoint report reads of shared location tags, are scoped to the requester’s authorized findings; the API token follows the forced-password-reset state; the classic confirm dialogs harden text rendering.
(API) The v3 notes list and the auto-create import permission check route through the shared helpers, and go-api auth errors carry the DRF error code.
(Parsers) Nuclei deduplicates protocol-less URLs, govulncheck tolerates OSV entries without aliases, and crash bugs are fixed in the KICS, AppSpider, KubeHunter, Terrascan, TFSec, and ZAP parsers.
(Findings) Finding-group list visibility is fixed for product members, and finding-group members stay inside the group’s test.
(i18n) Dropped stray Russian text from the English “Search” strings.

Behavior changes:

(Triage Engine) Rules Engine 2.0 is renamed Triage Engine across the UI.

Upgrade notes:

(PSIRT) The retired PSIRT 1.0 Advisory Engine sidecar is removed from the deployment and release verification. PSIRT 1.0 was removed in 3.3.0; migrate any remaining sidecar data with psirt_import_legacy.
(Deployment) A new DD_V3_ASSET_VERSIONS chart value and compose environment variable enables per-source asset versions.

September 14, 2026: v3.3.100

Mon, 14 Sep 2026 00:00:00 +0000

New features:

(Deduplication) Added Dedupe Pools: group the Assets that should deduplicate against each other, choose where their originals collect, preview what a membership change would link, and re-run deduplication over the Findings already in scope with Apply Now.
(Deduplication) The three deduplication tuning pages are now one Matching Configuration page: every tool listed once, with its same-tool, cross-tool and reimport matching side by side, and every change previewed before it is saved.
(Connectors) New Palo Alto Cortex connector family, covering XDR, XSIAM, XSOAR, and Cloud.
(Connectors) Connector sync and discovery frequency is now configurable (6, 12, or 24 hours), with schedule times shown in your browser’s local time.
(Dashboards) Collaborative shared dashboard layouts.
(Editor) The markdown editor now stores images you paste or drop into any markdown field.
(Sensei) Google Vertex AI is available as an on-prem LLM provider.
(Sensei) Keyless and delegated cloud authentication for Prowler scans and Sensei CSPM, using cloud federation or Connect DefectDojo Cloud.
(Reporting) Dashboards 2.0 widgets can now be reused as Report Builder blocks.
(Rules Engine 2.0) Date condition fields support relative-date operators.
(Federal) FedRAMP VDR, PAIN, and KEV-cap SLA fields are exposed in the Pro UI and REST API.
(Qualys) Opt-in endpoint creation from host identity.

Enhancements:

(Dashboards) Duplicate a dashboard tile from its edit-mode chrome.
(Connectors) The Aqua Supply Chain Branch field accepts a comma-separated list and gains a per-branch deduplication toggle, and its placeholders now show the real default.
(SSO) Auth settings show callback and ACS URLs inline, with richer help text and corrected field labels.
(Sensei) The Threat Modeling and Advisor pages show the licensed per-run quotas.

Bug fixes:

(Connectors) JFrog scopes each nested child image to its own latest build; Dependency-Track paginates project findings so large projects aren’t truncated; YesWeHack maps every workflow state and falls back to the CVSS score for severity; GitHub Advanced Security 403 and 404 responses are treated as feature-disabled rather than token errors; a tool-reported finding status now survives a sync; and KEV/EPSS enrichment staging is isolated per connection to avoid concurrent-run collisions.
(Findings) You can now request a review from yourself.
(Rules Engine) “Clear Filters” now clears a rule’s saved filters.
(SSO) Unconfigured social-login backends return you to the login form instead of a 500.
(Assets) Each personnel picker gets its own users list.
(API) A stored inactive contact stays readable, a new contact can no longer be assigned to an inactive user, and the finding API’s SonarQube issue relation is read-only.
(Dashboards) The Top Root Causes widget is registered and receives its configuration.
(Sensei) GitHub App creation opens in a new tab, and the Targets “Last Scan” value aligns with the scan-run ledger while the Scan-now dialog stays responsive.
(UI) Table columns size to fit their headers so filter and sort controls stay reachable, and the Upstream menu item is a plain link while Field Mappings is unreleased.
(Questionnaires) Corrected the share note on the general questionnaire list.
(JIRA) Corrected the exception class the webhook lookups catch.
(Reporting) Removed a duplicate vulnerability reference prefetch in the finding report.
(Parsers) bundler-audit resets advisory fields so warnings can’t inherit stale values.
(Deduplication) The endpoint rehash runs once per tool instead of once per finding.

Behavior changes:

(Deduplication) False-positive history now follows deduplication scope. A Finding is compared against the Assets it deduplicates with, so an Engagement that deduplicates within itself only replicates false positives inside that Engagement. An Asset in a Dedupe Pool replicates its false positives across the pool for same-tool matching. Instances using false-positive history across such Engagements see narrower replication than before. A pool may span Organizations, and both effects follow the pool: a duplicate mark or a replicated false positive originating in one Organization can change a Finding in another Organization that shares the pool.
(Deduplication) For an Asset in a Dedupe Pool, Global Component, Global Vulnerability ID and Global Locations matching is bounded to the pool rather than the whole instance.
(Deduplication) The three deduplication pages move off the Tuner permissions onto four Dedupe Pool permissions (view, add, edit, delete). Roles that held the Tuner permissions are carried over for those pages: Tuner edit maps to all four, Tuner view to view only. The Tuner permissions themselves are unchanged and still gate the other 14 Tuner sections (SSO, LDAP, SCIM, email, MFA and the rest).
(Rules) A new asset rule action, Assign to Dedupe Pool, pools an Asset or removes the rows a rule created; it never moves an Asset another pool holds, and the rule owner needs the Dedupe Pool edit permission.
(Assets) The Asset page gains a Dedupe Pool panel showing which pool the Asset matches within, per kind, with the pool change, subtree pooling and untoggle available in place.
(Audit Log) Dedupe pools, their memberships and the per-tool matching rows are tracked in the audit log.

Upgrade notes:

(Deduplication) Pods may roll in either order relative to the migration. The upgrade copies the deduplication tuning into per-tool matching rows and retires the old tuning fields from the application, but leaves their columns in the database for this release. A pod still on the previous image keeps reading and writing those columns and behaves exactly as before until it is rolled; a pod on the new image reaches a database that has not migrated yet and matches without pools, reading the old tuning where it needs to, until the migration lands. The columns are removed by a later release, once no pod on the previous image can exist. Hold imports across the roll if you want no import to straddle the changeover; nothing fails if you do not.
(Deduplication) The migration is reversible. Rolling back to the previous node drops the new pool tables and restores the previous release’s view of the settings; the tuning columns never left. Take a database backup before upgrading anyway, as ordinary upgrade hygiene.
(Deduplication) The matching rows the upgrade seeds carry no audit log entry: the migration writes them before it installs their audit triggers. Audit history for Matching Configuration starts with the first change made after the upgrade; the seeded state itself is what the Tuner held, and is not recorded as an event.
(Deduplication) The first nightly identity check after the upgrade may send a system notification saying the cross-tool identity changed for some tools. Those tools had cross-tool hash fields configured but no algorithm; the previous release treated that as Hash code, and the upgrade records Hash code explicitly, so the identity definition moved while the stored hashes did not. The rehash the notification suggests (manage.py identity_drift --kind cross_tool --rehash) is safe, recomputes the same values, and records the new baseline so the notice does not repeat.
(Deployment) A new DD_V3_ASSET_ALIASES chart value and compose environment variable enable per-source asset aliases; Sensei CSPM adds keyless and delegated cloud-auth boot gates.

September 9, 2026: v3.3.0

Wed, 09 Sep 2026 00:00:00 +0000

New features:

(Correlation) Cross-domain finding correlation groups related findings into shared root causes. A finding’s page now lists its root causes, root-cause blast radius feeds finding prioritization, and a new Top Root Causes dashboard widget plus a Product breakdown show where risk concentrates. Root causes cover CVE, component, resource, and endpoint types, hide CVE causes a component already covers, and are readable through a public read-only Root Cause API.
(PSIRT) PSIRT 2.0 is folded natively into DefectDojo Pro: native advisory feeds and a catalog, feed rules and rule templates, advisory-to-case conversion, and a dedicated PSIRT permission so an analyst does not need global maintainer.
(Risk Acceptance) Risk Acceptances 2.0 adds a reviewable lifecycle with a pending-review queue and a durable ledger. You can also choose to restore a finding to Verified when its risk acceptance expires.
(Assets) A rebuilt asset model adds asset versions with BOM snapshots and per-version SBOM/VEX export, per-source identity and aliases so connectors resolve assets by the vendor’s id, typed asset kinds, typed relationship edges that distinguish direct from indirect vulnerabilities, and asset exposure and deployment context (including live reachability probing and business-criticality sync from the CMDB).
(Organizations) Organizations can now be non-exclusive: an asset can belong to multiple organizations with union-of-grants RBAC, membership-aware organization filters on the asset and finding lists, and roles that can be granted across an entire organization type.
(Dashboards) Dashboards 2.0 expands into the DefectDojo Command Center, with a published security-posture score.
(Locations) Endpoints continue their move to Locations: asset connectors can emit standalone location inventory, and a new Location Map draws an asset’s locations as derived trees per location type.
(Navigation) Menu 2.0 now covers the whole sidebar, including a Sensei + AI section, a full-height sidebar rail with pinned pages, and server-backed shell preferences.
(Sensei) Added Sensei Advisor, which recommends settings changes and offers one-click fixes for mechanical deduplication-hygiene issues, with per-run license quotas for threat modeling and Advisor. The Sensei engine now ships in the on-prem compose bundles.
(Connectors) New Rapid7 InsightVM - Cloud Instance and Aqua Supply Chain connectors, plus a Wiz option to import Issues only. Connectors gain customer-defined field mappings (versioned and identity-safe, per scan type), a connector registry the UI reads from, per-record sync checkpoints so an interrupted sync resumes, and health notifications when a connector stops working or authenticates but sees no data.
(Universal Parser) Universal Parser field mappings can now be edited from a dedicated screen, with an impact warning attached.
(Compliance) Added DISA STIG checklist import (.ckl/.cklb) with a CCI to NIST 800-53 crosswalk.
(Exporters) Added a CycloneDX/SPDX SBOM and CycloneDX VEX export API, and the Pro UI now accepts .spdx files on import.
(API) Added API v3 (alpha) at /api/v3-alpha/ with slim references, expansion, RBAC sub-resources, and the Pro importer. Custom Fields are now available on the token-authenticated /api/v2 API.
(Federal) Added FIPS 140-3 image support (FedRAMP SC-13), PAIN-keyed FedRAMP VDR remediation deadlines, and a FedRAMP prioritization preset.
(Rules Engine 2.0) Rules can now trigger on scan absence, draw from a rule-template gallery, assign an SLA configuration or Risk Priority to assets, and condition on exploit evidence, reachability, and asset exposure.
(Reporting) Added a Location Count field on every entity and reorderable block fields in the Report Builder.
(Assets) Added checkbox bulk edit on the asset list (organization, SLA, engine, tags) and customer-editable platform, lifecycle, and origin dropdowns.
(Integrations) The Freshservice integration can push findings as ITIL Incidents or Problems per mapping, and MCP finding tools gained tag filtering.
(Audit Log) System Settings changes are now recorded in the audit log.

Enhancements:

(Connectors) The JFrog, Tenable.io WAS, and Tenable VM connectors now stream findings per page instead of holding a whole sync in memory, and connectors report data-visibility warnings at config-test time. The Location URL is pre-filled for single-host tools.
(UI) A first pass of accessibility and readability foundations: a visible focus ring, AA-contrast muted text, a System theme option, comfortable reading line-height, and shared type tokens. Toggleable panels now expand from a click anywhere on the header, and locked dropdowns gained a copy button.
(Deduplication) Finding identity is now recorded in a signature ledger, versioned and bridged across formula changes, with a scheduled drift check that reports what moved; reimport can match on identity signatures.
(Notifications) Notifications now fan out to every organization an asset belongs to.
(Reporting) Report charts export as PNG so labels survive PDF rendering.
(Importers) Import and reimport bulk-create new findings, reducing per-finding overhead on large scans.

Bug fixes:

(Connectors) Wiz now imports findings from tenants that use no Projects, the Microsoft Defender connector no longer fails a good sync during spool cleanup, and connector product descriptions are capped at the column limit.
(Licensing) A usage block now answers with 402 rather than a throttle status, and license enforcement no longer blocks authentication.
(Importers) Scan severities are accepted case-insensitively, .spdx files are accepted for import, concurrent imports no longer race on scan-directory creation, and edited tests keep their scan type so reimport matching survives.
(Parsers) Fortify now marks only suppressed FPR findings as false positive, Anchore Grype parses the CISA KEV date, and Xeol and Checkmarx One finding identity is deterministic.
(UI) The Components list no longer renders an empty body while its paginator counts every row, ECharts resolves theme tokens to concrete colors, and the New Issue Tracker Assignment dialog no longer closes when going full-screen.

Notable changes:

(UI) The classic Bootstrap UI and the classic report engine have been retired; Menu 2.0 and the Pro Vue UI are now standard.
(Operations) The maintenance window feature has been removed.

August 31, 2026: v3.2.400

Mon, 31 Aug 2026 00:00:00 +0000

New features:

(Sensei) Added a generic fix flow: you can now associate a repository with a finding inline, and a gap-closing wizard walks you through anything else Sensei needs before it can generate a fix. Finding file paths are also resolved against the repository tree before the fix is generated, so fixes land in the right file.
(Sensei) Scan-and-fix now includes a scanner for AI agent skills (Skillspector).
(Engagements) Added engagement checklists to the Pro UI.
(Rules Engine 2.0) Rules can now be conditioned on KEV (Known Exploited Vulnerabilities) listing and exploit evidence.
(Navigation) Added a searchable menu palette over the sidebar, opened with Cmd/Ctrl+K.
(Correlation) The Root Cause view now has a Root Cause Organization column, asset and organization filters, and per-organization drill-in.
(Exporters) The UI SBOM export now offers SPDX alongside CycloneDX.

Enhancements:

(Custom Fields) Custom fields now render on the entity create and edit forms, and are configured like any other form field.
(Connectors) The Wiz, Microsoft Defender for Cloud, and CrowdStrike connectors now stream findings page by page rather than holding a whole sync in memory, so large syncs are faster and lighter.

August 24, 2026: v3.2.300

Mon, 24 Aug 2026 00:00:00 +0000

New features:

(Custom Fields) Added typed Custom Fields: define your own fields across seven datatypes and attach them to six entity types. Custom field values are tracked in the audit log, and Rules Engine 2.0 rules can read and write them.
(Rules Engine 2.0) Rules can now work with Assets end to end, and a new asset provenance widget on the asset page layout shows which rule produced an asset.
(Asset Hierarchy) Rebuilt the Asset Hierarchy page on the Rules Engine 2.0 editor shell.
(Connectors) The GitHub Advanced Security connector can now import repository issues as a fourth finding family, under the new GitHub: Issues scan type. Pre-existing mappings are backfilled with the new subtype automatically.
(Connectors) The OpenVAS / Greenbone connector now supports GMP over SSH as a transport.

Enhancements:

(Deduplication) The deduplication identity ledger is now enabled by default.
(Connectors) The Action1 connector now consolidates findings per organization, with machines recorded as endpoints, and each connector tile now counts only actively syncing records as mapped and surfaces unmapped records directly on the tile.
(Locations) The component and code backfills now run in batches, and stale-run reaping was moved off the poll, making the data-migration suite faster and lighter.
(Operations) DefectDojo now reports when a Celery task is routed to a queue that no worker consumes.
(Sensei) The scan-and-fix release image is smaller, with scanner installs split into per-ecosystem layers.
(MCP) The Pro MCP server now reports its version (with commit hash) via a CLI option.
(Compliance) The POA&M scheduled completion date is now derived from the finding’s SLA.
(Reporting) The Risk Acceptance name is now offered as a finding report column.
(Jira) The custom fields JSON limit was raised from 200 to 1000.

August 18, 2026: v3.2.201

Tue, 18 Aug 2026 00:00:00 +0000

New features:

(Page Layouts) The Risk Acceptance view page now uses a customizable widget grid, like the other View pages.
(Sensei) Added Amazon Bedrock as an on-prem LLM connection.
(Locations) The data-migration suite on the Feature Flags page can now be cancelled while a backfill is running. Cancelling stops the run at the next batch boundary and keeps everything migrated so far, so re-running the item resumes and converges on the same result. A run whose worker is lost is now detected and marked failed on its own, so a stuck suite becomes runnable again instead of blocking every item.
(Endpoints) Endpoints are now deprecated in favour of Locations.
(Menu) Classic-menu users are now warned that Menu 2.0 becomes the standard in 3.3.0.

Enhancements:

(CSPM) Cloud Security Posture Management is now gated on the Sensei license rather than a separate feature flag.
(Sensei) Scan-and-fix scanner parallelism is now configurable, via --max-parallel / MAX_PARALLEL (and sensei.maxParallel in Helm).

Bug fixes:

(Authorization) Import and reimport preview targets are now scoped to the caller’s permissions, POA&M item findings are validated against the record’s own product, and questionnaire expiration and question-set editing are checked against the response route and the questionnaire change permission.
(Risk Acceptance) A companion-less risk acceptance is now counted correctly, as active and as non-global, when filtering.
(Reporting) Report graph blocks that no browser captured are now drawn instead of failing silently, and the BETA badge that Menu 2.0 re-added after GA is gone.
(Licensing) License enforcement no longer blocks authentication.
(Connectors) The Action1 connector derives severity from the CVSS score when no severity bucket is usable, and a chunked sync now records one Import History row per sync.
(Locations) The endpoints-to-locations backfill now reports distinct locations and per-endpoint failures.
(Dedupe) Finding post-processing now retries on a transient DB deadlock.
(UI) The Advisor now renders with PrimeVue, and PSIRT and Field Mappings are nested correctly in the legacy sidebar.
(Threat Model) The schema-repair loop no longer deletes the prompt it is repairing.

August 17, 2026: v3.2.200

Mon, 17 Aug 2026 00:00:00 +0000

New features:

(CSPM) Added Cloud Security Posture Management: connect AWS, Azure, and GCP cloud accounts, run posture scans against them, and apply reversible direct remediation to the misconfigurations that are found.
(Asset Exposure) Added asset exposure reporting from Wiz, Shodan, and Censys, and from CrowdStrike Spotlight (which reports only the exposure it can prove).
(Connectors) Registered the Aikido Security, Jit, and Cycode connectors.
(Finding Templates) You can now apply a finding template to a Finding, and turn a Finding into a template, directly from the Vue UI.
(Form Configuration) Added admin-controlled Form Configuration for the Vue create and edit forms, so an administrator can decide which fields appear.
(Locations) Added a DB-backed Locations toggle, with a data-migration suite to move existing data over.
(Assets) You can now export the asset and organization inventory as CSV.
(Reporting) Quick Export now names its output from the current context, and you can apply a report template to an export.
(Findings) Added a filterable Review Claimant column to the findings list.
(Rules Engine) Rules Engine permissions now split into View / Add / Edit / Delete for finer RBAC.
(Feature Flags) Promoted nine feature flags off the menu, turned five more on by default, and moved Feature Flags out of System into its own settings location.
(Layouts) Layout customization can now be restricted to admin-designated defaults.

Enhancements:

(Qualys) The Qualys connector now accepts a Host Tags filter that scopes discovery to hosts carrying the Qualys asset tags you name. The filter is sent to Qualys, so out-of-scope hosts are never downloaded. It applies to the detection download as well as the host listing, so a narrowed scope also shortens each Sync. Tag names are matched exactly, because Qualys supports no wildcards on tag names. Leave the field blank to keep discovering every host.
(JFrog) The JFrog connector now surfaces a pending status.
(Jira) The Jira connector now accepts service accounts.
(Findings) The count of Findings a tool submitted is now recorded before deduplication runs.
(API) The finding serializer now exposes a flat test_type_name field.
(MCP) Finding and asset Location retrieval is now consolidated into single REST calls.

Bug fixes:

(Authorization) Location data, DojoMeta visibility, and the /api/v2/location/ endpoint are now scoped to the requesting user’s products and RBAC rather than superusers only; every routed connector endpoint is named in the permission allow-list; the user edit form authorization was hardened; Tool Configuration credentials are kept out of the edit form; and the private-note visibility rule is now applied in the note UI views.
(Export) Spreadsheet formulas can no longer execute out of an exported file (CSV/formula injection).
(SSO) SAML2 routes now answer 404 when SAML is disabled.
(Findings) The Priority filter and override inputs now accept decimal values.
(Assets) A PATCH without a parent field no longer orphans the asset, and auto-creating the same asset name concurrently no longer returns a 500.
(Importers) Bulk finding deletes, tag-count updates, and async cascade deletes now retry on transient DB conflicts and are ordered so concurrent imports and deletes cannot deadlock.
(Connectors) The Action1 connector tolerates non-numeric sentinels in quoted numeric fields, and the Microsoft Defender connector retries a transient 5xx/429 on a single export page instead of failing the whole export.
(Parsers) Fixed a Trivy Scan crash from an uninitialized resource_name, and reset Scout Suite parser state so a report parses to the same findings twice.
(Notes) A partial note PATCH now keeps the note body and no longer writes a null NoteHistory entry.
(Reporting) Reports no longer fetch unrenderable columns, report cells are now bounded, and a block’s Order By is applied through the filterset.
(Tables & UI) Clipped table cell text now wraps, the empty band below short pages is gone, the viewport row cap no longer oscillates and stalls a table, and the severity bar chart is positioned correctly in the open findings chart.
(Page Grid) A widget’s Title and Icon now follow its Records choice.
(Jira) Fixed the Jira migration.

August 10, 2026: v3.2.100

Mon, 10 Aug 2026 00:00:00 +0000

NOTE: The classic report engine (Report Builder, Report Templates and Generated Reports) will be removed in 3.3.0 on September 8, 2026.

New features:

(VEX) Added CycloneDX SBOM / VEX / VDR export and import, as a round trip: a document exported from DefectDojo can be imported back into DefectDojo. The raw CycloneDX VEX analysis is now preserved on parsed Findings.
(SCIM) Added SCIM 2.0 provisioning. Your identity provider can now create, update and deactivate DefectDojo users and manage groups directly, rather than DefectDojo only learning about a user when that user first signs in. Deactivating a user over SCIM also deletes that user’s API tokens. SCIM is configured under Connect > Authorization, alongside your login providers, and is tagged Provisioning to distinguish it from the providers that put a button on the login page.
(Downstream Connectors) Added Messaging Connectors (beta), which send alerts to Slack, Microsoft Teams, email, or an Amazon SNS topic. Alerts are routed by Rules Engine 2.0: a rule decides when to send, which Findings qualify, and which connection and destination the message goes to. Requires the Messaging Connectors and Rules Engine 2.0 feature flags.
(Reporting) Reporting is now generally available, and no longer carries the BETA label.
(Reports) Both the classic Report Builder and the new Report Builder now offer a one-click migration of your existing report templates. The migration works with the Reporting feature flag off, so you can move on your own schedule. Reports you have already generated are finished files and stay downloadable until removal.
(Page Layouts) The five View pages now use customizable widget grids, so you can arrange each page’s widgets.
(Tables) Table columns can now be resized, and the widths you set are saved to your table preferences. List tables also render a per-column loading skeleton while data is loading.
(Connectors) Registered the Tenable Web App Scanning and Rapid7 InsightVM connectors, along with six connectors that had shipped without a registration.
(Sensei) A provider can now hold several connections rather than one, and setup is scoped to the connection you are working in. Add Repositories now opens on the repository step. Semgrep scans run under a memory cap and recover across a hard kill (OOM).
(Risk Acceptance) Added Expire and Reinstate to the risk acceptance menu, and as API actions.
(Rules Engine 2.0) A Rules Engine 2.0 rule can now be given its own schedule. Enabling the feature flag now warns that a worker restart is required before it takes effect.
(Locations) Added migrate_locations_to_endpoints, the reverse of the endpoint-to-location conversion.

Enhancements:

(Connectors) A connector request now requires a usable credential and a base URL, so a request cannot be submitted with details that will not connect.
(Snyk) Snyk reachability is now rendered as the raw values Snyk reports, rather than a derived yes/no.
(Performance) Notes are now serialized a page at a time without re-filtering the page, and deduplication no longer lowercases the hash input on every Finding purely to log it.
(Dashboards) The two Group By selects now focus their filter automatically when opened.

August 4, 2026: v3.2.0

Tue, 04 Aug 2026 00:00:00 +0000

NOTE: We have deprecated API-based pull parsers, Tool Type/Tool Configuration, and dbbackup, with end-of-life scheduled for 3.5.0.

This release added many entries to the Feature Flags list: features that can be opted into.

(Review Claiming) Let a requested reviewer claim a Finding review so the other eligible reviewers can see it is being handled. Once claimed, only the claimer or the requester can clear the review.
(Work Assignment) Assign Findings and Risk Acceptances to individual people, alongside the existing group Owners, and give each person a My Work queue of what they are responsible for.
(Priority) Added a threat-intel risk floor, which is based on whether a Finding has EPSS, KEV or other exploitability. Only takes effect if Threat Intelligence Enrichment is enabled.
(Rules Engine 2.0) Build automation rules as visual node graphs that react to Finding events, with per-run traces and a delivery outbox.
(Threat Intelligence Enrichment) Threat Intelligence reached general availability, with signed threat-intel bundles, downgrade hysteresis, and new list and dashboard surfaces.
(Menu 2.0) Reorganized the Settings menu behind Menu 2.0, with a new All Settings hub.
(Compliance) The federal compliance pack: FedRAMP POA&M ledger and ConMon deliverables, CMMC Level 2 assessments, and control coverage.

Additional features:

(API) DefectDojo REST API can now produce reports as HTML, CSV, and Excel, not just JSON. Use the /generate_report/ endpoint path, e.g. api/v2/findings/generate_report/
(Performance) Improved the performance of Celery/Async tasks.
(Deduplication) Added set-based deduplication that matches Findings on their full set of vulnerability IDs and CWEs, including partial/subset matches, alongside a new global vulnerability-ID deduplication algorithm and global_locations cross-product deduplication on shared locations. False-positive history now honors the same vulnerability-ID/CWE set-match tokens, false-positive-history candidate filtering is now pluggable, and deduplication now produces a stable “original” finding regardless of scan-import order.
(Findings) Findings can now carry multiple CWEs across the API, the Vue UI, and the universal parser. Vulnerability IDs are normalized into a first-class Vulnerability entity with ordered references, per-vulnerability KEV/EPSS enrichment columns, and vulnerability aliases. Added a copy-finding action with an auto-detected vulnerability-ID type.
(Locations) Location drift matching keeps a finding tracked as its locations change across reimports.
(Enrichment) Added a two-stage KEV/EPSS pipeline that projects the worst score per vulnerability onto Findings, plus bulk cloud-enrichment reads and import-time enrichment.
(Connectors) Added one-button migration from classic Jira to Downstream Connectors. Connector syncs now keep branch tags current on the Findings they report, and the public /assign_product endpoint can map Findings-type records again.
(Connectors) JFrog now scopes artifact-mode Findings to each artifact’s latest build.
(Notes) Notes now support Markdown.
(Tools) Added SPDX, CSAF 2.0, and OpenVEX interchange-format parsers and a Promptfoo (LLM eval and red-teaming) parser.