defectdojo

No entries match these filters. Clear filters

1. 3.5.0 Nov 2, 2026 · issue 129

   DefectDojo adds LocationData builders for domain, IP, and certificate data, a default-queryset plugin hook, and environment-variable reading for secret key fallbacks⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.5.0 https://github.com/DefectDojo/django-DefectDojo.git
   # already have the repo? check out this version:
   $ git checkout 3.5.0

   └──▷ TRY IT
   Supply secret key fallbacks through the environment so they are never committed to config files.
   copy

   $ DD_SECRET_KEY_FALLBACKS='oldsecret1,oldsecret2' docker compose up

   • Read Django secret key fallbacks via the DD_SECRET_KEY_FALLBACKS environment variable instead of hardcoding them in settings.dist.py or local_settings.py.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Add a default-queryset hook for plugins via the new database migration, enabling plugins to scope querysets at the model level.
   • Adds LocationData builders for domain, IP, and certificate data to populate location records programmatically.
   • DefectDojo Cloud instances can now supply their own AI model for the Sensei feature.
   • Read Django secret key fallbacks via the DD_SECRET_KEY_FALLBACKS environment variable instead of hardcoding them in settings.dist.py or local_settings.py.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Add a default-queryset hook for plugins via the new database migration, enabling plugins to scope querysets at the model level.
   • Adds LocationData builders for domain, IP, and certificate data to populate location records programmatically.

   1 more in Everything

2. api-docs-7be342814ede Oct 30, 2026 · issue 125

   DefectDojo Pro adds live API key change detection and dynamic token-controls visibility based on administrator token policy⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
   • DefectDojo Pro now re-reads the active API key whenever its browser tab regains focus, showing an API Key Changed notice if the key was replaced in another tab or by an administrator — instead of silently using a stale key.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • DefectDojo Pro now hides token-management controls site-wide when API tokens are disabled by policy: the account menu, Force Token Reset in user menus, Reset API Tokens in the Users list bulk actions, and the API Access walkthrough are all removed, and the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Service page notes that an AI provider cannot connect because the MCP server authenticates with an API token.
   • DefectDojo Pro now re-reads the active API key whenever its browser tab regains focus, showing an API Key Changed notice if the key was replaced in another tab or by an administrator — instead of silently using a stale key.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

3. 3.4.304 Oct 30, 2026 · issue 125

   DefectDojo adds Package URLPackage URLA standardized string format for uniquely identifying software packages across ecosystems (npm, PyPI, Maven, etc.), letting cyber tools reference and correlate dependency data without ecosystem-specific logic. support for dependency findings in the generic parser⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.4.304 https://github.com/DefectDojo/django-DefectDojo.git
   # already have the repo? check out this version:
   $ git checkout 3.4.304

4. 3.4.300 Oct 26, 2026 · issue 122

   DefectDojo 3.4.300 adds a product export API (manifest + NDJSONNDJSONA text format where each line is a self-contained JSON object, making it easy to stream, append, and parse large datasets record-by-record without loading the whole file into memory. stream), bulk Jira unlink, location test attribution, and Siemens SSB VulnIDs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.4.300 https://github.com/DefectDojo/django-DefectDojo.git
   # already have the repo? check out this version:
   $ git checkout 3.4.300

   • Adds a product export API returning a manifest and an NDJSON stream for bulk product data export.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds feat(jira): unlink findings from Jira in bulk edit via the UI and API.
   • Adds feat(locations): attributes each location reference to the test that reported it, with a supporting database migration.
   • Adds Siemens SSB VulnID support via settings.dist.py / local_settings.py.
   • Adds a product export API returning a manifest and an NDJSON stream for bulk product data export.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Siemens SSB VulnID support via settings.dist.py / local_settings.py.

   2 more in Everything

5. api-docs-cf3a04800f5d Oct 23, 2026 · issue 117

   DefectDojo Pro adds service user tokens (ddsu_ prefix) exchangeable for OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. bearer tokensbearer tokensA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. via POST /api/v2/oauth/token/.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   DefectDojo Pro adds service user tokens (`ddsu_` prefix) exchangeable for OAuth 2.0 bearer tokens via `POST /api/v2/oauth/token/`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + POST /api/v2/oauth/token/
   ⤢ ⤢ ⤢
   └──▷ TRY IT
   Exchange a service user token for a short-lived OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 bearer tokenbearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. to authenticate automated pipelines without long-lived credentials.
   copy

   $ curl -X POST https://your-instance/api/v2/oauth/token/ \
     -H 'Authorization: Token ddsu_<token>' \
     -H 'Content-Type: application/x-www-form-urlencoded' \
     -d 'grant_type=client_credentials'

   • Adds POST /api/v2/oauth/token/ endpoint to exchange a service user token (prefixed ddsu_) for a one-hour OAuth 2.0 bearer access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. using the client credentials grant, sent as Authorization: Bearer <access_token>.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces service user tokens in DefectDojo Pro, prefixed ddsu_, usable directly via Authorization: Token ddsu_<token> for API authentication.
   • New endpoint documented: POST /api/v2/oauth/token/

   3 details in Everything

6. docs update Oct 22, 2026 · issue 116

   DefectDojo v3.4.202 adds OpenVEXOpenVEXAn open specification and Go library, maintained by the OpenVEX community, for expressing VEX (Vulnerability Exploitability eXchange) statements in a standard JSON format so cyber tools can automate vulnerability triage. export, Locations in Findings export, and expanded users API configuration-permission writes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   • Adds OpenVEX as a VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. export format alongside CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. on the Asset page Export dialog and in the API, enabling pairing of an SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. with a matching VEX document.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a Locations field to the Findings export dialog and a Locations column in the Report Builder (when the Locations feature flag is on), replacing Endpoints with each Finding's Locations.
   • Extends the users API to accept and return configuration permissions on writes, and to remove configuration permissions when an empty list is sent.
   • Adds a Documentation button beside breadcrumbs on every Pro UI page that has docs, linking to the matching documentation page (or to the feature-flag docs when the page is behind a flag).
   • With Locations on and location tracking off, reimport now keeps packages sharing a CVE as separate Findings instead of merging them.
   • Adds OpenVEX as a VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. export format alongside CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. on the Asset page Export dialog and in the API, enabling pairing of an SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. with a matching VEX document.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a Documentation button beside breadcrumbs on every Pro UI page that has docs, linking to the matching documentation page (or to the feature-flag docs when the page is behind a flag).

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !In Keyboard Triage, the keys that previously set severity and toggled Verified, Under Review, False Positive, and Out of Scope are removed; n now opens the Add Note form instead.
   • !The Enable Remediation Advice checkbox is removed from System Settings (it had no effect).
   • !Run Now is no longer offered for scan triggers.
7. docs update Oct 21, 2026 · issue 115

   DefectDojo v3.4.201 adds Keyboard Triage, Linux Kernel CVE feed, CRA Article 14CRA Article 14A mandatory incident-reporting obligation in the EU Cyber Resilience Act requiring manufacturers of products with digital elements to notify authorities of actively exploited vulnerabilities within 24 hours of discovery. reporting, and a new internal CA management command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ TRY IT
   Rotate internal CA and service certificates on an existing self-hosted install that is still using the shipped bundle copies.
   copy

   $ certs rotate-internal

   Disable import rename/move resolution if you want imports that reference old Asset names to fail rather than silently land in the renamed Asset.
   📍In the DefectDojo UI, go to Settings › Feature Flags and turn off Imports Follow Renames and Moves.
   Override the uwsgi startup probe from the default TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. check back to an HTTP check in a Helm-based deployment.
   values.yaml copy

   django:
     uwsgi:
       startupProbe:
         enabled: true
         path: /healthz

   • Adds Imports Follow Renames and Moves feature flag (on by default) so imports that name an Asset or Organization by a former or moved-out-of name resolve to the current Asset instead of failing or creating a duplicate; disable the flag to revert.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Asset Identity feature flag (off by default) to control Asset Identity in place of the former deployment setting; instances that previously set the deployment setting to true keep it on.
   • Adds django.uwsgi.startupProbe.enabled (on by default) as a TCP check on the uwsgi port allowing 5 minutes to start, with django.uwsgi.startupProbe.path available to revert to the earlier HTTP check.
   • Adds a certs rotate-internal doctor command to replace shipped internal CA and service certificates (backing up old files first), and new installs now generate their own internal CA and service certificates, with certs status doctor and the start preflight warning existing installs still using shipped copies.
   • Adds a Keyboard Triage mode — open with the Triage button or the t key on any Findings list — to walk findings one at a time and set status from the keyboard.

   +5 more show less

   • Adds a What's New button at the bottom of the sidebar showing release highlights for the currently running version.
   • Adds CRA Article 14 reporting without requiring PSIRTPSIRTA Product Security Incident Response Team: an internal group responsible for receiving, investigating, and disclosing vulnerability reports affecting a vendor's products, giving cyber tools a formal channel for coordinated disclosure.: statutory deadlines warn and breach, deadline notifications reach users who can view the Asset, and reports can be started from the UI.
   • Qualys VMDR imports and the Qualys connector now record each host's name as a host Location, and the Coverity connector now accepts http Coverity Connect URLs.
   • Change Plans and the Needs Attention inbox are now out of beta and enabled on every instance (their feature flags no longer appear on the Feature Flags page), and Change Plans gain warnings alongside errors, show the SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. configuration a criticality change maps to, and support discard or rebuild without operations on Assets still recalculating.
   • Adds a Zero Results chip on connector tiles and a Connector Health Warning when a connector's syncs keep importing nothing.
   • Adds Imports Follow Renames and Moves feature flag (on by default) so imports that name an Asset or Organization by a former or moved-out-of name resolve to the current Asset instead of failing or creating a duplicate; disable the flag to revert.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds django.uwsgi.startupProbe.enabled (on by default) as a TCP check on the uwsgi port allowing 5 minutes to start, with django.uwsgi.startupProbe.path available to revert to the earlier HTTP check.
   • Adds a certs rotate-internal doctor command to replace shipped internal CA and service certificates (backing up old files first), and new installs now generate their own internal CA and service certificates, with certs status doctor and the start preflight warning existing installs still using shipped copies.
   • Adds a Keyboard Triage mode — open with the Triage button or the t key on any Findings list — to walk findings one at a time and set status from the keyboard.
   • Adds a What's New button at the bottom of the sidebar showing release highlights for the currently running version.

   +2 more show less

   • Adds CRA Article 14 reporting without requiring PSIRTPSIRTA Product Security Incident Response Team: an internal group responsible for receiving, investigating, and disclosing vulnerability reports affecting a vendor's products, giving cyber tools a formal channel for coordinated disclosure.: statutory deadlines warn and breach, deadline notifications reach users who can view the Asset, and reports can be started from the UI.
   • Adds a Zero Results chip on connector tiles and a Connector Health Warning when a connector's syncs keep importing nothing.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The New Severe Incident Report action is renamed to New CRA Report.
   • !The Asset Identity feature is now controlled by the Asset Identity feature flag instead of the former deployment setting; instances that set the deployment setting to true retain it, but the old setting name is no longer the control surface.
   • !Container images no longer trust the emSign root CAs (CA trust stores refreshed).
   • !New installs generate their own internal CA and service certificates instead of using the copies shipped in the bundle; existing installs still on the shipped copies receive a warning and must run certs rotate-internal to replace them.
8. 3.4.201 Oct 21, 2026 · issue 115

   DefectDojo 3.4.201 reports the Qualys VMDR asset name as a host location for imported findings.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.4.201 https://github.com/DefectDojo/django-DefectDojo.git
   # already have the repo? check out this version:
   $ git checkout 3.4.201

   • Updated integration Qualys VMDR host location reporting
9. docs update Oct 20, 2026 · issue 114

   DefectDojo Pro adds four built-in Asset relationship types including deploys_to, which propagates exposure from host clusters to deployed services.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   • Adds deploys_to built-in Asset relationship type that exposes Asset Exposure propagation: a service deployed onto an internet-facing cluster inherits the cluster's effective exposure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Ships four Asset relationship types by default, with deploys_to intentionally excluded from Finding roll-up so a cluster's Findings are not attributed to every service it hosts.

   2 details in Everything

10. docs update Oct 20, 2026 · issue 114

    DefectDojo Pro v3.4.200 adds StackHawk and Qualys TotalAppSec connectors, a Findings grid view, On Dedupe Match trigger, and in-app walkthroughs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ USE IT
    Prevent a fresh-install from running every migration by pointing to a pre-built schema dump, or disable the feature entirely.
    .env copy

    DD_SCHEMA_DUMP_PATH=/opt/defectdojo/schema.sql

    Control zero-downtime mcp-server rollout drain time so in-flight MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. requests complete before the pod terminates.
    yaml copy

    lifecycle:
      preStop:
        waitSeconds:
          mcpServer: 30

    Configure the reachability probe as a superuser to check network addresses recorded in Locations.
    📍1. Log in as a superuser. 2. Navigate to Settings › Reachability Probe. 3. Enter the addresses to probe and save.
    • Adds DD_LICENSE requirement to the initializer, which refuses to migrate without a valid license in DD_LICENSE, the mounted license file, or the database.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds DD_SCHEMA_DUMP_PATH config key to override the schema file path for fresh installs (empty value disables schema pre-load).
    • Adds lifecycle.preStop.waitSeconds.mcpServer config key to set the preStop wait during zero-downtime mcp-server rollouts.
    • Adds an On Dedupe Match trigger for marking a matched Finding a duplicate or keeping both active with independent SLAs and a link, plus Copy Status from Matched Finding and Apply Status to Linked Findings actions to propagate false positive, out of scope, and risk accepted decisions across linked Findings.
    • Adds in-app walkthroughs to the Pro UI (App Tour plus task walkthroughs for importing, triage, access, reports, admin setup, Jira connector, and Triage Engine), controlled by the In-App Walkthroughs feature flag (on by default).

    +5 more show less

    • Adds a grid view and filter bar to the Findings list (also applied to the Assets, Organizations, Engagements, and Tests lists), with a Match Any mode, an Owner (Team) column and filter plus API support for filtering Findings by owner and assignee, In List and Not in List modes for text column filters, an Include / Exclude switch on every multi-select column filter, and paste-a-list support for Asset and Organization pick-list filters.
    • Adds a risk meter to Findings that marks the Finding's band visually instead of displaying a written level.
    • Adds reachability probe configuration under Settings > Reachability Probe for superusers, with the probe checking addresses held in Locations.
    • Enables Triage Engine rules to set an Asset's type (with connectors also setting Asset type from vendor data on every sync, never overwriting a type set by a person or rule) and to use Asset metadata, custom fields, and contacts in notifications, with select fields now supporting partial matching.
    • Enables Wiz to report network exposure as asset exposure evidence, FOSSA syncs to be limited by issue category and by project label or title, and Qualys to import host tags and group Assets by tag.
    • Adds DD_LICENSE requirement to the initializer, which refuses to migrate without a valid license in DD_LICENSE, the mounted license file, or the database.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds DD_SCHEMA_DUMP_PATH config key to override the schema file path for fresh installs (empty value disables schema pre-load).
    • Adds lifecycle.preStop.waitSeconds.mcpServer config key to set the preStop wait during zero-downtime mcp-server rollouts.
    • Adds an On Dedupe Match trigger for marking a matched Finding a duplicate or keeping both active with independent SLAs and a link, plus Copy Status from Matched Finding and Apply Status to Linked Findings actions to propagate false positive, out of scope, and risk accepted decisions across linked Findings.
    • Adds in-app walkthroughs to the Pro UI (App Tour plus task walkthroughs for importing, triage, access, reports, admin setup, Jira connector, and Triage Engine), controlled by the In-App Walkthroughs feature flag (on by default).

    5 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The initializer refuses to migrate without a valid license in DD_LICENSE, the mounted license file, or the database — see the upgrade guide before upgrading.
    • !The classic sidebar and Menu 2.0 toggle are removed; all users are migrated to the current sidebar.
11. 3.4.200 Oct 19, 2026 · issue 114

    DefectDojo 3.4.200 adds per-release schema snapshots for empty databases and a caller-configurable batch dedupe match action.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.4.200 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.4.200

    • Loads a per-release schema snapshot into empty databases on first start, speeding up fresh deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Lets a caller decide what a batch dedupe match does, giving API consumers control over deduplication behaviour.
    • Loads a per-release schema snapshot into empty databases on first start, speeding up fresh deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

12. docs update Oct 15, 2026 · issue 109

    DefectDojo v3.4.101 adds CRA Annex I Part ICRA Annex I Part IThe section of the EU Cyber Resilience Act listing product categories whose manufacturers must meet stricter conformity-assessment requirements before placing them on the EU market. to EU regulatory assessment, new import formats (.ckl.cklA checklist file format used by DISA's STIG Viewer to store vulnerability assessment results against Security Technical Implementation Guide controls, giving cyber tools a structured XML record of compliance findings., .cklb, .jsonl.jsonlA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory.), and FOSSA connector sync.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Adds .ckl, .cklb, and .jsonl file formats to the import file pickers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Extends the EU regulatory assessment to include CRA Annex I Part I requirements.
    • Enables Ask Sensei from any page, with answers built from live views of your data.
    • Adds the AI inventory catalogue, presets, and FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. VDRVDRA Virtual Data Room is a secure, hosted document repository used for controlled sharing of sensitive files during due diligence, audits, or investigations, giving cyber tools a governed environment to exchange evidence or reports. data to the package.
    • Improves mobile layout: Dashboards 2.0 widgets and Home stat cards stack in one column, and the app shell fits phone screens.

    +5 more show less

    • FOSSA connector syncs now complete successfully on large organizations.
    • Enforces MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. and password reset rules across every sign-in path, and requires sign-in for exports.
    • Restricts LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. settings, update check, reminder snoozes, Finding Groups, and Finding actions to authorized users based on permissions.
    • Verifies the Orchestrator against its own CA when REQUESTS_CA_BUNDLE is set, and includes the Orchestrator root CA in the Helm chart's combined CA bundle.
    • Warns when the Sensei engine secret is a shipped default, and the licensing portal now refuses the placeholder portal secret.
    • Adds .ckl, .cklb, and .jsonl file formats to the import file pickers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds the AI inventory catalogue, presets, and FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. VDRVDRA Virtual Data Room is a secure, hosted document repository used for controlled sharing of sensitive files during due diligence, audits, or investigations, giving cyber tools a governed environment to exchange evidence or reports. data to the package.

    8 more in Everything

13. 3.4.100 Oct 12, 2026 · issue 106

    Adds system checks for unmodified default settings, limits account-recovery emails, applies API v3 token auth settings, and scopes endpoint choices on import forms.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.4.100 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.4.100

    • Adds system checks for settings left at their shipped values in settings.dist.py / local_settings.py.
    • Adds locations as a prefetch option on the findings and products API endpoints.
    • Limits account-recovery emails per address (new settings.dist.py / local_settings.py setting).
    • Applies the token endpoint's account rules to HTTP Basic auth on the API (new settings.dist.py / local_settings.py setting).
    • Requires a login for the report cover page (new settings.dist.py / local_settings.py setting).

    +7 more show less

    • Applies API token settings to API v3 token auth.
    • Offers the engagement's findings on the risk acceptance forms.
    • Resolves notification recipients from the listed users.
    • Shares cell handling between the CSV and Excel exports.
    • Uses scoped endpoint choices on the import and re-import forms.
    • Declares each API deprecation once, with a release calendar.
    • Aligns JIRA configuration editing with tool configuration editing.

    12 details in Everything

    • Updated integration SonarQube REST API import — unique_id_from_tool
14. docs update Oct 10, 2026 · issue 101

    DefectDojo adds POST /api/v2/assets/bulk_update/ for moving and re-parenting up to 500 Assets at once, with dry-run support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ TRY IT
    Move a batch of Assets to a new Organization and place them under a common parent in one atomic call — useful when consolidating services after a team reorg.
    copy

    $ curl -X POST "https://defectdojo.example.com/api/v2/assets/bulk_update/" \
      -H "Authorization: Token <your API token>" \
      -H "Content-Type: application/json" \
      -d '{"products": [12, 13, 14], "prod_type": 4, "parent": 9, "business_criticality": "high"}'

    Preview a large reorganization before committing it — review every moved descendant and refused Asset without writing any changes.
    copy

    $ curl -X POST "https://defectdojo.example.com/api/v2/assets/bulk_update/" \
      -H "Authorization: Token <your API token>" \
      -H "Content-Type: application/json" \
      -d '{"products": [12, 13, 14], "prod_type": 4, "parent": 9, "dry_run": true}'

    Move a single Asset to another Organization while leaving its children behind as top-level Assets — useful when splitting a subtree across org boundaries.
    copy

    $ curl -X POST "https://defectdojo.example.com/api/v2/assets/bulk_update/" \
      -H "Authorization: Token <your API token>" \
      -H "Content-Type: application/json" \
      -d '{"products": [12], "prod_type": 7, "move_children": false}'

    • Adds POST /api/v2/assets/bulk_update/ endpoint to apply org moves, parent assignments, type changes, criticality, contacts, SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments., and tags to up to 500 Assets in one atomic request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds "dry_run": true field on POST /api/v2/assets/bulk_update/ to preview all field changes, subtree moves, removed parent links, and refused Assets before writing anything.
    • Adds "move_children": false field on POST /api/v2/assets/bulk_update/ to move an Asset to another Organization without carrying its subtree — children become top-level Assets in the original Organization.
    • Adds "parent": null support on POST /api/v2/assets/bulk_update/ to remove parent links from a batch of Assets in one request.
    • Supports prod_type, move_children, asset_type, business_criticality, technical_contact, team_manager, product_manager, sla_configuration, prioritization_engine, and tags fields on the bulk update endpoint, leaving any omitted field unchanged.

    +3 more show less

    • Recalculates Finding priority in the background for both the source and destination Organization after any Asset move, accounting for revenue and user-record share changes.
    • Exposes Asset hierarchy management at Act > Explore > Assets > Hierarchy in the sidebar, supporting visualization and reorganization of parent/child Asset relationships.
    • Enforces cross-organization parent-link rules in the Rules Engine Set Parent action and Set Organization action, moving subtrees consistently and logging every removed parent link to the audit log.
    • Adds POST /api/v2/assets/bulk_update/ endpoint to apply org moves, parent assignments, type changes, criticality, contacts, SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments., and tags to up to 500 Assets in one atomic request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds "dry_run": true field on POST /api/v2/assets/bulk_update/ to preview all field changes, subtree moves, removed parent links, and refused Assets before writing anything.
    • Adds "move_children": false field on POST /api/v2/assets/bulk_update/ to move an Asset to another Organization without carrying its subtree — children become top-level Assets in the original Organization.
    • Adds "parent": null support on POST /api/v2/assets/bulk_update/ to remove parent links from a batch of Assets in one request.
    • Supports prod_type, move_children, asset_type, business_criticality, technical_contact, team_manager, product_manager, sla_configuration, prioritization_engine, and tags fields on the bulk update endpoint, leaving any omitted field unchanged.

    +1 more show less

    • Exposes Asset hierarchy management at Act > Explore > Assets > Hierarchy in the sidebar, supporting visualization and reorganization of parent/child Asset relationships.

    2 more in Everything

15. docs update Oct 10, 2026 · issue 101

    DefectDojo Pro v3.4 adds two-way Jira sync, AI workflow nodes, Remediation Center, AI Inventory, new cloud connectors, and ten new languages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ USE IT
    Enable Sandbox Mode on a self-hosted instance so your team can experiment with DefectDojo Pro workflows without touching production data.
    .env copy

    DD_SANDBOX_ENABLED=true

    Turn on the beta Remediation Center so findings are grouped by the remediation action that closes them, with owners and due dates, rather than tracked individually.
    yaml copy

    remediation_center: true

    Query the new PSIRTPSIRTA Product Security Incident Response Team: an internal group responsible for receiving, investigating, and disclosing vulnerability reports affecting a vendor's products, giving cyber tools a formal channel for coordinated disclosure. API to retrieve all PSIRT records with token authentication.
    copy

    $ curl -H 'Authorization: Token <your-api-token>' https://<your-defectdojo-host>/api/v2/psirt/

    • Enables DD_SANDBOX_ENABLED on self-hosted instances to activate Sandbox Mode: a practice copy of DefectDojo Pro under /sandbox/ on its own database, preloaded with sample data, with Reset and Wipe for superusers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a beta Remediation Center module (feature flag remediation_center, off by default) that groups open findings by the change that resolves them, each action carrying a due date, risk, owner, workflow status, and the findings it will close.
    • Adds a beta AI Inventory module (feature flag ai_inventory, off by default, requires Locations) that inventories coding assistants, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, models, AI packages, AI service endpoints, agent skills, and provider keys per repository, with governance policies marking each as authorized, unauthorized, or needs review, and exports a CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. AIBOMAIBOMAn inventory of every AI model, dataset, and dependency used in a system, analogous to a software bill of materials, giving cyber tools a structured way to audit AI supply-chain risk. per asset.
    • Exposes the PSIRT API at /api/v2/psirt/* with token authentication, and adds a PSIRT toolset to the MCP server.
    • Adds new Helm chart values: connectors.debug, connectors.vendorEgress (private-network blocking with allowed/denied CIDRs), dojo.obligationAttachmentMaxBytes (default 10 MB), and a sandbox values block for Sandbox Mode.

    +5 more show less

    • Adds webhook receivers so Jira and other tools can send changes back to DefectDojo, and gives the Jira Downstream Connector two-way sync and Push Notes as Comments.
    • Adds three AI workflow nodes (Check for False Positive, Assess Exploitability, and Group by Fix) to the pipeline palette, routing each finding out of a named exit for human review.
    • Adds new Microsoft Azure and Google Cloud asset connectors, and a new Kenna Security (Cisco Vulnerability Management) connector.
    • Adds hierarchy change plans: bulk or AI-made reorganizations become a server-side plan with a dry-run diff that can be reviewed, applied as one change, and undone; plans can be built from JSON or a CSV upload.
    • Adds a Needs Attention inbox under Assets listing assets still in a connector's default organization or missing fields that priority and SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. depend on.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Self-hosted Docker Compose and Helm deployments with webhookGateway.enabled now run a new webhook gateway service in front of webhook receivers with its own schema and database role inside DefectDojo's database — review deployment docs before upgrading.
    • !The Support section in Settings replaces the Contact Support menu entries and pages; old bookmarks redirect.
16. api-docs-9db73511e919 Oct 10, 2026 · issue 100

    DefectDojo API token revocation endpoint returns 204 and notifies token owners, with UI lockout guidance added.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    • Token revocation endpoint returns 204 on success, deletes the token, clears any per-user expiry override, and notifies the token owner to generate a new token from the API v2 Token page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • When API tokens are disabled, the API v2 Token page in DefectDojo Pro displays the reason 'API tokens are disabled.' instead of a key, making the disabled state explicit to users.
    • Adds guidance that the UI remains accessible via session authentication if the API is locked out, and a new token can be issued from the API v2 Token page without losing UI access.
    • Token revocation endpoint returns 204 on success, deletes the token, clears any per-user expiry override, and notifies the token owner to generate a new token from the API v2 Token page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    2 more in Everything

17. docs update Oct 10, 2026 · issue 100

    DefectDojo adds granular Integration permissions and splits Connectors into Upstream/Downstream pages for Pro instances.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Introduces Integration: View and Integration: Edit Global Role permissions to control who can see and manage Connectors, replacing broad superuser-only access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Splits the Connect sidebar into separate Connect > Upstream and Connect > Downstream pages, each visible only when the user holds the relevant Integration permission.
    • Adds Manage Mappings and Assignments action per connector tile for connectors that open tickets, surfacing mapping controls directly from the connector list.
    • Groups connector tiles by category (e.g. Ticketing, Incident Management) in both the configured and available connector sections.
    • Introduces Integration: View and Integration: Edit Global Role permissions to control who can see and manage Connectors, replacing broad superuser-only access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Splits the Connect sidebar into separate Connect > Upstream and Connect > Downstream pages, each visible only when the user holds the relevant Integration permission.

    2 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Connect > Downstream page replaces the old Downstream Connectors surface; access now requires a custom Global Role with Integration: View or Integration: Edit — no built-in role grants either permission, so existing non-superuser access to Downstream Connectors will break on upgrade.
18. docs update Oct 6, 2026 · issue 096

    DefectDojo adds POST /api/v2/assets/bulk_update/ for bulk Asset moves, re-parenting, and dry-run previews across Organizations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ TRY IT
    Move a set of Assets to a new Organization and place them under a new parent in one atomic request.
    copy

    $ curl -X POST "https://defectdojo.example.com/api/v2/assets/bulk_update/" \
      -H "Authorization: Token <your API token>" \
      -H "Content-Type: application/json" \
      -d '{"products": [12, 13, 14], "prod_type": 4, "parent": 9, "business_criticality": "high"}'

    Preview a bulk reorganization before committing — review every descendant move and refused Asset without writing any changes.
    copy

    $ curl -X POST "https://defectdojo.example.com/api/v2/assets/bulk_update/" \
      -H "Authorization: Token <your API token>" \
      -H "Content-Type: application/json" \
      -d '{"products": [12, 13, 14], "prod_type": 4, "parent": 9, "dry_run": true}'

    Move a single Asset to another Organization without dragging its children along, leaving them as top-level Assets.
    copy

    $ curl -X POST "https://defectdojo.example.com/api/v2/assets/bulk_update/" \
      -H "Authorization: Token <your API token>" \
      -H "Content-Type: application/json" \
      -d '{"products": [12], "prod_type": 7, "move_children": false}'

    • Adds POST /api/v2/assets/bulk_update/ to apply the same change to up to 500 Assets in one atomic request, supporting fields products, prod_type, move_children, parent, asset_type, business_criticality, technical_contact, team_manager, product_manager, sla_configuration, prioritization_engine, and tags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds "dry_run": true field to POST /api/v2/assets/bulk_update/ to preview every field change, descendant move, parent-link removal, and refused Asset without writing anything.
    • Adds "move_children": false field to POST /api/v2/assets/bulk_update/ to move an Asset without carrying its subtree, leaving children as top-level Assets in their original Organization.
    • Supports Asset parent/child hierarchy management via Act > Explore > Assets > Hierarchy in the sidebar for visualizing and reorganizing Asset relationships.
    • Automatically recalculates Finding priority in the background for both the source and destination Organization after any Asset move, reflecting updated revenue and user-record shares.

    +2 more show less

    • Notifies Technical Contact, Team Manager, Asset Manager, and Owner-role members when a parent link is removed during an inter-Organization move, and records each removed link in the audit log.
    • The Rules Engine Set Parent action treats a parent in another Organization as a failed item, and Set Organization moves subtrees exactly as the bulk API does.
    • Adds POST /api/v2/assets/bulk_update/ to apply the same change to up to 500 Assets in one atomic request, supporting fields products, prod_type, move_children, parent, asset_type, business_criticality, technical_contact, team_manager, product_manager, sla_configuration, prioritization_engine, and tags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds "dry_run": true field to POST /api/v2/assets/bulk_update/ to preview every field change, descendant move, parent-link removal, and refused Asset without writing anything.
    • Adds "move_children": false field to POST /api/v2/assets/bulk_update/ to move an Asset without carrying its subtree, leaving children as top-level Assets in their original Organization.
    • Supports Asset parent/child hierarchy management via Act > Explore > Assets > Hierarchy in the sidebar for visualizing and reorganizing Asset relationships.
    • Notifies Technical Contact, Team Manager, Asset Manager, and Owner-role members when a parent link is removed during an inter-Organization move, and records each removed link in the audit log.

    2 more in Everything

19. docs update Oct 6, 2026 · issue 096

    DefectDojo v3.4.0 adds webhook receivers for two-way Jira sync and a new webhook gateway service for self-hosted deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ USE IT
    Enable the webhook gateway service in a Helm deployment so Jira can send change events back to DefectDojo.
    values.yaml copy

    webhookGateway:
      enabled: true

    • Enables webhookGateway.enabled in Helm deployments to run a new webhook gateway service in front of webhook receivers, with its own schema and database role.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds webhook receivers so Jira and other tools can send changes back to DefectDojo.
    • Adds two-way sync and Push Notes as Comments to the Jira Downstream Connector.
    • Enables webhookGateway.enabled in Helm deployments to run a new webhook gateway service in front of webhook receivers, with its own schema and database role.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds webhook receivers so Jira and other tools can send changes back to DefectDojo.

    1 more in Everything

20. 3.4.0 Oct 5, 2026 · issue 096

    DefectDojo 3.4.0 refreshes the UI theme, returns nested user shapes from API v3 expand, and eliminates N+1 queries on product and asset list endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.4.0 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.4.0

    • Returns the v2 nested user shape from API v3 expand, giving callers richer user objects without a separate lookup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Eliminates N+1 queries on the product and asset list endpoints, enabling performant large-scale asset enumeration.
    • Refreshes the DefectDojo UI theme to the updated DefectDojo brand.
    • Returns the v2 nested user shape from API v3 expand, giving callers richer user objects without a separate lookup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    2 more in Everything

21. announced Oct 1, 2026 · issue 093

    DefectDojo launches Triage Engine with Rules Engine 2.0: branching workflows, egress actions, simulation mode, and full run traceability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Enable Rules Engine 2.0 Beta so you can build branching, egress-capable triage workflows.
    📍In DefectDojo, go to Settings › Feature Flags in the sidebar and toggle the Rules Engine 2.0 pill to on.
    Validate a new Rule against real Findings without firing Slack, Jira, or webhook actions until you are confident the logic is correct.
    📍In the Rule editor, run the Rule in Simulation mode: Finding changes will be applied and recorded in Runs, but all Egress actions (Slack messages, Jira tickets, webhooks) are logged in Deliveries as skipped rather than sent.
    • Adds Rules Engine 2.0 (Beta), enabled via the Feature Flags toggle in Settings sidebar, expanding automation nodes from 14 to 38 across five categories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds branching logic so a single Rule can evaluate a condition and route Findings down different action paths (e.g. Critical to a ticketing system, lower-severity to a weekly-review tag) within one workflow.
    • Adds Egress capability so Rules can trigger actions outside DefectDojo: create Jira or other downstream tickets, send Slack or Microsoft Teams messages, deliver email, call a webhook, publish to an SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. topic, raise an in-app notification, or generate a report.
    • Adds Simulation mode, which executes Finding changes while recording egress actions without actually sending them, letting teams validate a Rule before enabling external actions.
    • Adds Runs traceability, recording every Rule execution with a node-by-node trace, trigger source, status, timing, and errors.

    +5 more show less

    • Adds Deliveries log, cataloguing every outbound action a Run sends, including payload, destination, status, retry count, destination response, and skips.
    • Adds ProvenanceProvenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., surfacing which Rule, Run, or node caused a change directly on the Finding record.
    • Adds a graph view in Rules Engine 2.0 providing a bird's-eye view of every possible outcome for a Rule in a single place.
    • Adds Asset Rules that respond to Asset creation, update, or tagging events (or run on a schedule) and can update Asset fields, apply or remove tags, move Assets between Organizations, and reorganize the Asset hierarchy.
    • Rules Engine and Rules Engine 2.0 can run side by side, with a converter available to migrate existing Rules Engine workflows to Rules Engine 2.0.
    • Adds Rules Engine 2.0 (Beta), enabled via the Feature Flags toggle in Settings sidebar, expanding automation nodes from 14 to 38 across five categories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds branching logic so a single Rule can evaluate a condition and route Findings down different action paths (e.g. Critical to a ticketing system, lower-severity to a weekly-review tag) within one workflow.
    • Adds Egress capability so Rules can trigger actions outside DefectDojo: create Jira or other downstream tickets, send Slack or Microsoft Teams messages, deliver email, call a webhook, publish to an SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. topic, raise an in-app notification, or generate a report.
    • Adds Simulation mode, which executes Finding changes while recording egress actions without actually sending them, letting teams validate a Rule before enabling external actions.
    • Adds Runs traceability, recording every Rule execution with a node-by-node trace, trigger source, status, timing, and errors.

    +4 more show less

    • Adds Deliveries log, cataloguing every outbound action a Run sends, including payload, destination, status, retry count, destination response, and skips.
    • Adds ProvenanceProvenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., surfacing which Rule, Run, or node caused a change directly on the Finding record.
    • Adds a graph view in Rules Engine 2.0 providing a bird's-eye view of every possible outcome for a Rule in a single place.
    • Adds Asset Rules that respond to Asset creation, update, or tagging events (or run on a schedule) and can update Asset fields, apply or remove tags, move Assets between Organizations, and reorganize the Asset hierarchy.

    1 more in Everything

22. docs update Sep 29, 2026 · issue 089

    DefectDojo v3.3.300 adds multilingual UI, Code to Cloud Locations, CSV/Excel/JSON report export, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Dashboards 2.0, and a /api/v2/report_schedules/ endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Navigate to Appearance settings to switch the Pro UI language to one of the 27 supported languages.
    📍1. Log in to DefectDojo Pro. 2. Go to Settings › Appearance. 3. Under Interface Language, select your preferred language (e.g., German, Japanese, Arabic). 4. Save changes.
    Use the GitLab connector's Exclude Archived Projects toggle to skip stale projects during discovery.
    📍1. Go to Connectors › GitLab connector configuration. 2. Enable the Exclude Archived Projects toggle. 3. Save and trigger a sync to limit discovery to active projects only.
    • Report Builder gains export to CSV, Excel, and JSON formats, plus template variables and per-finding / per-asset Triage Engine reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces Code to Cloud Locations: container-image and connector-populated cloud-resource inventories, image-to-repository links, suggested deploys_to edges, typed location items, and Harbor and Trivy Operator connector support for emitting inventories.
    • The MCP server adds a Dashboards 2.0 toolset with dashboard support, and the reporting toolset is now customer-visible.
    • Pro UI is now multilingual with 27 languages available (including German, Japanese, French, Spanish, Arabic, Hebrew, and more), with a new setting to choose the interface language.
    • Two-stage regulatory deadlines for vulnerability response are now supported.

    +12 more show less

    • Sensei and AI Agent Red Teaming reach general availability — the BETA badge and the agent_redteam feature flag are removed — and the Advisor's cross-tool estimate now simulates dedupe within Dedupe Pool scope.
    • Dashboards 2.0 layouts add audit history, ETag / If-Match concurrency control, and a widget-config JSON Schema.
    • Vulnerability Explorer gains multi-value filters, null-last multi-column sorting, and a filter for every column.
    • Exploit Maturity and Reachability are now manually editable, and Priority, Risk, and Risk Score are added to every findings export.
    • GitLab connector gains an Exclude Archived Projects toggle for project discovery.
    • Superusers can now reset another user's MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone..
    • Filter the risk-acceptance list by host, and see the hosts an acceptance covers.
    • The column picker gains select all / deselect all, and lazy list filters gain select all matching.
    • Each connector sync is now metered with a single usage record.
    • The default logging handler is now gcp_json, and nginx logs carry a severity.
    • DefectDojo ships a new logo, brand colors, and an Appearance page with theme presets and a color customizer.
    • Generated reports expose a plain-text sidecar and content endpoint.
    • Report Builder gains export to CSV, Excel, and JSON formats, plus template variables and per-finding / per-asset Triage Engine reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces Code to Cloud Locations: container-image and connector-populated cloud-resource inventories, image-to-repository links, suggested deploys_to edges, typed location items, and Harbor and Trivy Operator connector support for emitting inventories.
    • Pro UI is now multilingual with 27 languages available (including German, Japanese, French, Spanish, Arabic, Hebrew, and more), with a new setting to choose the interface language.
    • Two-stage regulatory deadlines for vulnerability response are now supported.
    • Superusers can now reset another user's MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone..

    +3 more show less

    • Each connector sync is now metered with a single usage record.
    • DefectDojo ships a new logo, brand colors, and an Appearance page with theme presets and a color customizer.
    • Generated reports expose a plain-text sidecar and content endpoint.

    9 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Tenable Scan hash_code fields no longer include the description, changing how those findings deduplicate — existing Tenable findings may re-deduplicate differently after upgrade.
23. docs update Sep 24, 2026 · issue 084
    ⤢ ⤢ ⤢ ⤢
    └──▷ USE IT
    Enable per-source asset versions in a Helm-based deployment so each scanner's assets are versioned independently.
    .env copy

    DD_V3_ASSET_VERSIONS=true

    └──▷ BREAKING ON UPGRADE

    • !The retired PSIRTPSIRTA Product Security Incident Response Team: an internal group responsible for receiving, investigating, and disclosing vulnerability reports affecting a vendor's products, giving cyber tools a formal channel for coordinated disclosure. 1.0 Advisory Engine sidecar is removed from the deployment and release verification; any remaining sidecar data must be migrated using psirt_import_legacy (PSIRT 1.0 was removed in 3.3.0).
    • !Rules Engine 2.0 is renamed Triage Engine across the UI.
24. docs update Sep 22, 2026 · issue 082

    DefectDojo Pro syncs Feature Flag toggles to start-time surfaces on restart; add DD_FEATURE_FLAGS_BOOT_SYNC=False to opt out.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Pin a test harness or unusual deployment to its environment variables, preventing stored Feature Flag toggles from overriding DD_V3_FEATURE_LOCATIONS or DD_ENABLE_V3_ORGANIZATION_ASSET_RELABEL at start-up.
    .env copy

    DD_FEATURE_FLAGS_BOOT_SYNC=False

    • Adds DD_FEATURE_FLAGS_BOOT_SYNC=False environment variable to keep a process pinned to its environment variables instead of syncing stored Feature Flag toggles at start-up (default is on).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • DefectDojo Pro now reads stored Feature Flag toggles (Locations, Organization / Asset Relabeling) at start-up and applies them to the deployment settings, so Settings > Feature Flags changes take effect after a restart without manually updating DD_V3_FEATURE_LOCATIONS or DD_ENABLE_V3_ORGANIZATION_ASSET_RELABEL.
    • With the Locations Feature Flag enabled and a restart, /api/v2/location/, /api/v2/url/, and /api/v3/ API routes are mounted and appear in the API documentation, and /api/v2/endpoints/ is served read-compatibly from Locations.
    • Adds DD_FEATURE_FLAGS_BOOT_SYNC=False environment variable to keep a process pinned to its environment variables instead of syncing stored Feature Flag toggles at start-up (default is on).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    2 more in Everything

25. docs update Sep 22, 2026 · issue 082

    DefectDojo now surfaces suggested deploy-to edges from container image evidence on the asset hierarchy page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Review and accept container-derived deploy relationships on the asset hierarchy page to propagate exposure from host assets to deployed assets automatically.
    📍In the Asset Hierarchy page, look for the banner counting open suggestions, click Review to open the list, then click Accept on a pair to draw the deploys-to edge, or Dismiss to suppress it.
    • Adds suggested edges on the asset hierarchy page when Container Image Locations are enabled: DefectDojo detects undrawn deploys to relationships by matching image repositories across assets and presents each pair as a reviewable suggestion with container-image evidence.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Accepting a suggested edge draws a deploys to relationship from the image-building asset to the running asset, causing the deployed asset to inherit its host's exposure; accepted edges carry an origin of container evidence distinguishing them from manually drawn or connector-declared edges.
    • Dismissing a suggestion suppresses that asset pair; further images for the same pair are counted but do not reopen it, and dismissed suggestions can be reopened from the same dialog.
    • Reviewing suggestions requires the Asset Hierarchy view permission; accepting or dismissing requires the edit permission plus edit access to both assets.

    4 details in Everything

26. docs update Sep 22, 2026 · issue 082

    DefectDojo v3.3.200 adds regulatory compliance packs, DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces., AI red-teaming, CSAF 2.0CSAF 2.0An OASIS open standard for machine-readable vulnerability advisories, defining a JSON schema that lets vendors publish and consumers automate ingestion of patch and disclosure data at scale./VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. export, and a Command Center dashboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ USE IT
    Enable per-source asset versioning when deploying DefectDojo via Helm, so each scanner source tracks its own asset history independently.
    .env copy

    DD_V3_ASSET_VERSIONS=true

    Migrate legacy PSIRTPSIRTA Product Security Incident Response Team: an internal group responsible for receiving, investigating, and disclosing vulnerability reports affecting a vendor's products, giving cyber tools a formal channel for coordinated disclosure. 1.0 sidecar data before upgrading to v3.3.200, which removes the sidecar entirely.
    copy

    $ python manage.py psirt_import_legacy

    • Adds DD_V3_ASSET_VERSIONS chart value and compose environment variable to enable per-source asset versions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds CSAFCSAFAn OASIS open standard for distributing machine-readable vulnerability advisories, letting cyber tools automate ingestion and correlation of vendor-issued security disclosures at scale. 2.0 / VEX advisory export, backported to the 3.3.x line.
    • Adds a vulnerability response evidence API and export, backed by versioned vulnerability response policies with response-clock evaluation and incident escalation.
    • Adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. and CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. threat-intelligence fields as editable inputs on the Add/Edit Finding form.
    • Adds import-completion triggers — one per scan and one per group of scans.

    +19 more show less

    • Adds psirt_import_legacy migration command for importing legacy PSIRT 1.0 sidecar data.
    • Adds EU regulatory scope foundation with an EU-seeded profile, EU regulatory control catalogs, EU regulatory assessments, and exportable EU evidence packs.
    • Adds a PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. compliance pack covering scope and scope inventory, patch-clock SLAs (6.3.3), targeted risk analyses (12.3.1), quarterly scan and ASV evidence, a vulnerability-management control catalog, and a PCI DSS evidence workbook.
    • Adds FDA cyber device packs with component support metadata, lifecycle metrics, SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export, and a Section 524B cyber device evidence pack.
    • Adds a CRA Article 14CRA Article 14A mandatory incident-reporting obligation in the EU Cyber Resilience Act requiring manufacturers of products with digital elements to notify authorities of actively exploited vulnerabilities within 24 hours of discovery. reporting interface.
    • Adds certification control catalogs for ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria., and NIS2NIS2EU directive that expands mandatory cybersecurity requirements to more sectors and member states than its predecessor, giving cyber tools a compliance framework to map controls and reporting obligations against. with a cross-framework evidence view.
    • Adds framework presets for UK Cyber EssentialsCyber EssentialsA UK government-backed certification scheme that defines a baseline set of technical controls organizations must implement to defend against common cyber threats, giving cyber tools a compliance benchmark to assess or report against. and the Australian Essential Eight.
    • Adds Dynamic Scanning (DAST): configure targets, verify ownership, launch Nuclei scans, and meter usage for billing.
    • Adds AI Agent Red Teaming as a new Sensei engine mode for red-teaming AI agents.
    • Adds scheduled hosted repository scans with attributed credentials and exportable cadence attestations for scan-frequency tracking.
    • Adds Tier Advisor to project annual processing volume and recommend a service tier.
    • Adds the Command Center dashboard scene as the new home page for every user.
    • Adds new endpoint-status and location-finding audit pages, plus a location-metering health metric.
    • Adds Microsoft Defender device-group import allowlist.
    • Adds Azure DevOps custom field mappings applied to work items.
    • Aqua Supply Chain imports non-default branches via per-branch scan IDs and enriches Supply Chain findings with reachability verdicts and friendly category tags.
    • Report chart blocks gain a Date Range window, and the Widget-block picker is populated.
    • The finding SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. row now shows the SLA expiration date.
    • Matching Configuration now lists every test type.
    • Adds DD_V3_ASSET_VERSIONS chart value and compose environment variable to enable per-source asset versions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds CSAFCSAFAn OASIS open standard for distributing machine-readable vulnerability advisories, letting cyber tools automate ingestion and correlation of vendor-issued security disclosures at scale. 2.0 / VEX advisory export, backported to the 3.3.x line.
    • Adds a vulnerability response evidence API and export, backed by versioned vulnerability response policies with response-clock evaluation and incident escalation.
    • Adds import-completion triggers — one per scan and one per group of scans.
    • Adds psirt_import_legacy migration command for importing legacy PSIRT 1.0 sidecar data.

    +12 more show less

    • Adds EU regulatory scope foundation with an EU-seeded profile, EU regulatory control catalogs, EU regulatory assessments, and exportable EU evidence packs.
    • Adds a PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. compliance pack covering scope and scope inventory, patch-clock SLAs (6.3.3), targeted risk analyses (12.3.1), quarterly scan and ASV evidence, a vulnerability-management control catalog, and a PCI DSS evidence workbook.
    • Adds FDA cyber device packs with component support metadata, lifecycle metrics, SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export, and a Section 524B cyber device evidence pack.
    • Adds a CRA Article 14CRA Article 14A mandatory incident-reporting obligation in the EU Cyber Resilience Act requiring manufacturers of products with digital elements to notify authorities of actively exploited vulnerabilities within 24 hours of discovery. reporting interface.
    • Adds certification control catalogs for ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria., and NIS2NIS2EU directive that expands mandatory cybersecurity requirements to more sectors and member states than its predecessor, giving cyber tools a compliance framework to map controls and reporting obligations against. with a cross-framework evidence view.
    • Adds framework presets for UK Cyber EssentialsCyber EssentialsA UK government-backed certification scheme that defines a baseline set of technical controls organizations must implement to defend against common cyber threats, giving cyber tools a compliance benchmark to assess or report against. and the Australian Essential Eight.
    • Adds Dynamic Scanning (DAST): configure targets, verify ownership, launch Nuclei scans, and meter usage for billing.
    • Adds AI Agent Red Teaming as a new Sensei engine mode for red-teaming AI agents.
    • Adds scheduled hosted repository scans with attributed credentials and exportable cadence attestations for scan-frequency tracking.
    • Adds Tier Advisor to project annual processing volume and recommend a service tier.
    • Adds the Command Center dashboard scene as the new home page for every user.
    • Adds new endpoint-status and location-finding audit pages, plus a location-metering health metric.

    7 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The PSIRT 1.0 Advisory Engine sidecar is removed from deployment and release verification; any remaining sidecar data must be migrated using psirt_import_legacy before upgrading.
    • !Rules Engine 2.0 is renamed to Triage Engine across the UI — any documentation, runbooks, or references to Rules Engine 2.0 by name will need updating.
27. 3.3.200 Sep 21, 2026 · issue 082

    DefectDojo 3.3.200 adds container image location emission from container scanners and debounced product grade recalculation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.3.200 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.3.200

    • Container scanners now emit the scanned image as an Image location, linking container images to their repository in the Locations model.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Debounces product grade recalculation per product to improve performance on large imports.
    • Container scanners now emit the scanned image as an Image location, linking container images to their repository in the Locations model.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

28. docs update Sep 16, 2026 · issue 076

    defectdojo: Adds DD_V3_ASSET_ALIASES chart value and compose environment variable to enable per-source asset aliases.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ TRY IT
    After upgrading, recompute cross-tool identity hashes so the nightly drift notification does not repeat for tools that had cross-tool hash fields but no explicit algorithm.
    copy

    $ manage.py identity_drift --kind cross_tool --rehash

    Enable per-source asset aliases in an on-prem compose deployment by setting the new environment variable.
    copy

    $ DD_V3_ASSET_ALIASES=true docker compose up -d

    • Exposes FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. VDRVDRA Virtual Data Room is a secure, hosted document repository used for controlled sharing of sensitive files during due diligence, audits, or investigations, giving cyber tools a governed environment to exchange evidence or reports., PAIN, and KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.-cap SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. fields in the Pro UI and REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..
    • Adds Dedupe Pools: group Assets that should deduplicate against each other, choose where originals collect, preview membership-change impact, and re-run deduplication over in-scope Findings with Apply Now.
    • Adds new Palo Alto Cortex connector family covering XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss., XSIAM, XSOAR, and Cloud.
    • Adds Google Vertex AI as an on-prem LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. provider.
    • Adds keyless and delegated cloud authentication for Prowler scans and Sensei CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. using cloud federation or Connect DefectDojo Cloud.

    +13 more show less

    • Makes connector sync and discovery frequency configurable (6, 12, or 24 hours), with schedule times shown in the browser's local time.
    • Adds collaborative shared dashboard layouts so teams can create, share, and reuse dashboard configurations across users and roles.
    • Adds Dashboards 2.0 widgets as reusable Report Builder blocks.
    • Adds an asset Assign to Dedupe Pool rule action that pools an Asset or removes rule-created rows.
    • Adds an Asset page Dedupe Pool panel showing which pool the Asset matches within, per kind, with pool change, subtree pooling, and untoggle available in place.
    • Adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. finding tools tag filtering.
    • Adds date condition fields with relative-date operators.
    • Adds opt-in endpoint creation from host identity.
    • The markdown editor now stores images pasted or dropped into any markdown field.
    • Import and reimport now bulk-create new findings, reducing per-finding overhead on large scans.
    • Connectors now stream findings per page (JFrog, Tenable.io WAS, Tenable VM) instead of holding a whole sync in memory.
    • Connectors report data-visibility warnings at config-test time.
    • Notifications fan out to every organization an Asset belongs to.
    • Exposes FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. VDRVDRA Virtual Data Room is a secure, hosted document repository used for controlled sharing of sensitive files during due diligence, audits, or investigations, giving cyber tools a governed environment to exchange evidence or reports., PAIN, and KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.-cap SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. fields in the Pro UI and REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..
    • Adds Dedupe Pools: group Assets that should deduplicate against each other, choose where originals collect, preview membership-change impact, and re-run deduplication over in-scope Findings with Apply Now.
    • Adds new Palo Alto Cortex connector family covering XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss., XSIAM, XSOAR, and Cloud.
    • Adds Google Vertex AI as an on-prem LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. provider.
    • Adds keyless and delegated cloud authentication for Prowler scans and Sensei CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. using cloud federation or Connect DefectDojo Cloud.

    +4 more show less

    • Adds collaborative shared dashboard layouts so teams can create, share, and reuse dashboard configurations across users and roles.
    • Adds an asset Assign to Dedupe Pool rule action that pools an Asset or removes rule-created rows.
    • Adds an Asset page Dedupe Pool panel showing which pool the Asset matches within, per kind, with pool change, subtree pooling, and untoggle available in place.
    • Adds opt-in endpoint creation from host identity.

    9 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !False-positive history now follows deduplication scope: an Engagement that deduplicates within itself only replicates false positives inside that Engagement, so instances relying on cross-Engagement false-positive replication will see narrower replication after upgrade.
    • !For an Asset in a Dedupe Pool, Global Component, Global Vulnerability ID, and Global Locations matching is bounded to the pool rather than the whole instance.
    • !The three deduplication tuning pages move off the Tuner permissions onto four new Dedupe Pool permissions (view, add, edit, delete); existing roles with Tuner edit are carried over to all four, and Tuner view to view only.
29. docs update Sep 15, 2026 · issue 075

    DefectDojo findings notes now support inline image attachments via paste, drag-and-drop, or toolbar button.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢
    └──▷ HOW TO FIND IT
    Attach a screenshot of exploit evidence directly to a finding note so it appears inline in reports without needing an external host.
    📍In a Finding, open the Notes section, then paste a screenshot from your clipboard or drag an image file onto the Markdown editor. The image is stored by DefectDojo and rendered inline in the notes feed and any generated reports.
30. docs update Sep 15, 2026 · issue 075

    DefectDojo Pro v3.3 adds Dedupe Pools, PSIRT 2.0PSIRT 2.0An updated framework for how organizations run a Product Security Incident Response Team, standardizing vulnerability disclosure, coordination, and remediation processes to help cyber tools handle CVEs consistently., cross-domain finding correlation, API v3 alpha, FIPS 140-3FIPS 140-3A US federal standard, maintained by NIST, that defines requirements for cryptographic modules used in government systems. Cyber tools target it to satisfy procurement mandates requiring validated crypto. support, and major connector/SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. expansions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ TRY IT
    After upgrading to v3.3, run this to recompute cross-tool identity hashes and silence the one-time system notification about changed identities.
    copy

    $ manage.py identity_drift --kind cross_tool --rehash

    • Adds GET /api/v3-alpha/ API v3 (alpha) with slim references, expansion, RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. sub-resources, and the Pro importer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Exposes Custom Fields on the token-authenticated /api/v2 API.
    • Adds a CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence./SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. SBOM and CycloneDX VEXCycloneDX VEXA CycloneDX-format document that records which known vulnerabilities in a software bill of materials actually affect a given product, letting cyber tools automate triage by filtering out irrelevant CVEs. export API, and the Pro UI now accepts .spdx files on import.
    • Adds manage.py identity_drift --kind cross_tool --rehash management command to recompute cross-tool identity hashes and record a new baseline.
    • Adds Dedupe Pools to group Assets that deduplicate against each other, with Assign to Dedupe Pool as a new asset rule action and four new permissions (view, add, edit, delete) replacing the Tuner permissions for those pages.

    +23 more show less

    • Adds DISA STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. checklist import supporting .ckl.cklA checklist file format used by DISA's STIG Viewer to store vulnerability assessment results against Security Technical Implementation Guide controls, giving cyber tools a structured XML record of compliance findings. and .cklb files with a CCI to NIST 800-53NIST 800-53A catalog of security and privacy controls for U.S. federal information systems, published by NIST. Cyber tools cite it to map their findings or features to a recognized compliance framework. crosswalk.
    • Adds FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 140-3 image support (FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. SC-13), PAIN-keyed FedRAMP VDRVDRA Virtual Data Room is a secure, hosted document repository used for controlled sharing of sensitive files during due diligence, audits, or investigations, giving cyber tools a governed environment to exchange evidence or reports. remediation deadlines, and a FedRAMP prioritization preset.
    • Adds cross-domain finding correlation grouping related findings into shared root causes, with a new Top Root Causes dashboard widget, Product breakdown, and a public read-only Root Cause API.
    • Folds PSIRT 2.0 natively into DefectDojo Pro: native advisory feeds and catalog, feed rules and rule templates, advisory-to-case conversion, and a dedicated PSIRT permission.
    • Adds new Rapid7 InsightVM - Cloud Instance and Aqua Supply Chain connectors, plus a Wiz option to import Issues only.
    • Adds customer-defined field mappings for connectors (versioned and identity-safe, per scan type), per-record sync checkpoints so an interrupted sync resumes, and health notifications when a connector stops working.
    • Adds a dedicated editing screen for Universal Parser field mappings, with an impact warning attached.
    • Adds Risk Acceptances 2.0 with a pending-review queue, durable ledger, and an option to restore a finding to Verified when its risk acceptance expires.
    • Adds Sensei Advisor with one-click deduplication-hygiene fixes, per-run license quotas for threat modeling and Advisor, and ships the Sensei engine in on-prem compose bundles.
    • Adds Dashboards 2.0 / DefectDojo Command Center with a published security-posture score.
    • Adds asset versions with BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. snapshots and per-version SBOM/VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. export, per-source identity and aliases, typed asset kinds, typed relationship edges, and asset exposure and deployment context including live reachability probing and business-criticality sync from the CMDBCMDBA Configuration Management Database: a repository that stores records of IT assets and the relationships between them, giving cyber tools a single authoritative source for infrastructure context..
    • Adds non-exclusive Organizations so an asset can belong to multiple organizations with union-of-grants RBAC, membership-aware filters, and roles grantable across an entire organization type.
    • Consolidates the three deduplication tuning pages into a single Matching Configuration page with same-tool, cross-tool, and reimport matching shown side by side and previewed before saving.
    • Adds a Location Map drawing an asset's locations as derived trees per location type, and connectors can now emit standalone location inventory.
    • Rules can now trigger on scan absence, draw from a rule-template gallery, assign an SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. configuration or Risk Priority to assets, and condition on exploit evidence, reachability, and asset exposure.
    • Adds a Location Count field on every entity and reorderable block fields in the Report Builder.
    • Adds checkbox bulk edit on the asset list covering organization, SLA, engine, and tags, plus customer-editable platform, lifecycle, and origin dropdowns.
    • Extends the Freshservice integration to push findings as ITIL Incidents or Problems per mapping, and adds tag filtering to MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. finding tools.
    • Records System Settings changes in the audit log.
    • Adds finding identity signature ledger, versioned and bridged across formula changes, with a scheduled drift check; reimport can now match on identity signatures.
    • Menu 2.0 adds a Sensei + AI section, a full-height sidebar rail with pinned pages, and server-backed shell preferences.
    • Report charts now export as PNG so labels survive PDF rendering.
    • Tracks dedupe pools, their memberships, and per-tool matching rows in the audit log.
    • Adds GET /api/v3-alpha/ API v3 (alpha) with slim references, expansion, RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. sub-resources, and the Pro importer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence./SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. SBOM and CycloneDX VEXCycloneDX VEXA CycloneDX-format document that records which known vulnerabilities in a software bill of materials actually affect a given product, letting cyber tools automate triage by filtering out irrelevant CVEs. export API, and the Pro UI now accepts .spdx files on import.
    • Adds manage.py identity_drift --kind cross_tool --rehash management command to recompute cross-tool identity hashes and record a new baseline.
    • Adds Dedupe Pools to group Assets that deduplicate against each other, with Assign to Dedupe Pool as a new asset rule action and four new permissions (view, add, edit, delete) replacing the Tuner permissions for those pages.
    • Adds DISA STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. checklist import supporting .ckl.cklA checklist file format used by DISA's STIG Viewer to store vulnerability assessment results against Security Technical Implementation Guide controls, giving cyber tools a structured XML record of compliance findings. and .cklb files with a CCI to NIST 800-53NIST 800-53A catalog of security and privacy controls for U.S. federal information systems, published by NIST. Cyber tools cite it to map their findings or features to a recognized compliance framework. crosswalk.

    +8 more show less

    • Adds FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 140-3 image support (FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. SC-13), PAIN-keyed FedRAMP VDRVDRA Virtual Data Room is a secure, hosted document repository used for controlled sharing of sensitive files during due diligence, audits, or investigations, giving cyber tools a governed environment to exchange evidence or reports. remediation deadlines, and a FedRAMP prioritization preset.
    • Adds cross-domain finding correlation grouping related findings into shared root causes, with a new Top Root Causes dashboard widget, Product breakdown, and a public read-only Root Cause API.
    • Folds PSIRT 2.0 natively into DefectDojo Pro: native advisory feeds and catalog, feed rules and rule templates, advisory-to-case conversion, and a dedicated PSIRT permission.
    • Adds new Rapid7 InsightVM - Cloud Instance and Aqua Supply Chain connectors, plus a Wiz option to import Issues only.
    • Adds Sensei Advisor with one-click deduplication-hygiene fixes, per-run license quotas for threat modeling and Advisor, and ships the Sensei engine in on-prem compose bundles.
    • Adds asset versions with BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. snapshots and per-version SBOM/VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. export, per-source identity and aliases, typed asset kinds, typed relationship edges, and asset exposure and deployment context including live reachability probing and business-criticality sync from the CMDBCMDBA Configuration Management Database: a repository that stores records of IT assets and the relationships between them, giving cyber tools a single authoritative source for infrastructure context..
    • Adds finding identity signature ledger, versioned and bridged across formula changes, with a scheduled drift check; reimport can now match on identity signatures.
    • Tracks dedupe pools, their memberships, and per-tool matching rows in the audit log.

    15 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !False-positive history now follows deduplication scope: an Engagement that deduplicates within itself only replicates false positives inside that Engagement, narrowing replication for instances that previously relied on cross-Engagement false-positive history.
    • !For an Asset in a Dedupe Pool, Global Component, Global Vulnerability ID, and Global Locations matching is bounded to the pool rather than the whole instance.
    • !The three deduplication tuning pages move off the Tuner permissions onto four new Dedupe Pool permissions (view, add, edit, delete); roles should be reviewed to confirm Dedupe Pool access is correctly assigned.
    • !The classic Bootstrap UI and the classic report engine have been retired; Menu 2.0 and the Pro Vue UI are now standard.
    • !The maintenance window feature has been removed.
    • !Product Type is relabeled Organization and Product is relabeled Asset in UI labels and URL routing by default (API endpoints and field names are unchanged).
31. 3.3.100 Sep 14, 2026 · issue 075

    DefectDojo 3.3.100 adds injectable dedupe candidate scope and winner ordering, plus pooling controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.3.100 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.3.100

    • Adds injectable candidate scope and winner order configuration to the deduplication engine, along with dedupe pools support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

32. api-docs-1f90ea491d7a Sep 14, 2026 · issue 074

    defectdojo: New endpoint documented: PATCH /api/v2/user_contact_infos/{id}/

    API change

    defectdojo: New endpoint documented: PATCH /api/v2/user_contact_infos/{id}/

    • + POST /api/v2/api-tokens/revoke/
    • + POST /api/v2/users/{id}/reset_api_token/
    • + PATCH /api/v2/user_contact_infos/{id}/
    • + POST /api/v2/api-token-auth/
    ⤢ ⤢ ⤢
    └──▷ TRY IT
    Revoke a compromised API token by key value without needing to identify the owning user account.
    copy

    $ curl -s -X POST https://defectdojo.example.com/api/v2/api-tokens/revoke/ \
      -H 'Authorization: Token <api_key>' \
      -H 'Content-Type: application/json' \
      -d '{"key": "<token_to_revoke>"}'

    Pin a specific user's token to expire on a known date, enforcing a short-lived credential for a contractor or service account.
    copy

    $ curl -s -X PATCH https://defectdojo.example.com/api/v2/user_contact_infos/42/ \
      -H 'Authorization: Token <api_key>' \
      -H 'Content-Type: application/json' \
      -d '{"token_expiry": "2026-12-31T23:59:59Z"}'

    Enforce a 90-day maximum token lifetime across all users and service accounts on the instance.
    .env copy

    DD_API_TOKEN_DEFAULT_EXPIRY_DAYS=90

    └──▷ BREAKING ON UPGRADE

    • !Setting DD_API_TOKEN_DEFAULT_EXPIRY_DAYS to a value greater than 0 is retroactive: every token older than that many days is immediately invalidated on the next use, including tokens in CI/CD pipelines and your own admin API token.
33. api-docs-1f90ea491d7a Sep 13, 2026 · issue 073

    defectdojo: Adds token_expiry field to PATCH /api/v2/user_contact_infos/{id}/ (superuser only) to set or clear a per-user token expiry datetime; after the datetime passes, the user's token receives 403 Forbidden with {"detail": "API token has expired."} until a new token is generated; set to null to clear the override.

    API change

    defectdojo: Adds `token_expiry` field to `PATCH /api/v2/user_contact_infos/{id}/` (superuser only) to set or clear a per-user token expiry datetime; after the datetime passes, the user's token receives `403 Forbidden` with `{"detail": "API token has expired."}` until a new token is generated; set to `null` to clear the override.

    • + POST /api/v2/api-tokens/revoke/
    • + POST /api/v2/users/{id}/reset_api_token/
    • + PATCH /api/v2/user_contact_infos/{id}/
    • + POST /api/v2/api-token-auth/
    ⤢ ⤢ ⤢
    └──▷ TRY IT
    Revoke a compromised API token by key value without knowing which user owns it — useful during an incident response.
    copy

    $ curl -s -X POST https://defectdojo.example.com/api/v2/api-tokens/revoke/ \
      -H 'Authorization: Token <superuser_api_key>' \
      -H 'Content-Type: application/json' \
      -d '{"key": "<token_to_revoke>"}'

    Pin an expiry date on a specific user's token so it automatically expires at a known deadline, enforcing rotation without manual intervention.
    copy

    $ curl -s -X PATCH https://defectdojo.example.com/api/v2/user_contact_infos/42/ \
      -H 'Authorization: Token <superuser_api_key>' \
      -H 'Content-Type: application/json' \
      -d '{"token_expiry": "2026-12-31T23:59:59Z"}'

    Enforce a 90-day maximum token lifetime across the entire instance so all tokens — including existing ones — rotate on a predictable schedule.
    .env copy

    DD_API_TOKEN_DEFAULT_EXPIRY_DAYS=90

    • Adds DD_API_TOKEN_DEFAULT_EXPIRY_DAYS environment variable to enforce an instance-wide maximum token lifetime (in days, measured from each token's creation time); applies retroactively to all existing tokens including those issued via POST /api/v2/api-token-auth/; defaults to no expiry when unset.
    • New endpoint documented: POST /api/v2/api-tokens/revoke/

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Setting DD_API_TOKEN_DEFAULT_EXPIRY_DAYS is retroactive: every token older than the configured window is immediately invalidated on upgrade, including tokens driving CI/CD pipelines and the token of the user making the change.
34. api-docs-1f90ea491d7a Sep 12, 2026 · issue 072

    DefectDojo gains programmatic API token revocation, per-user expiry, and an instance-wide default token lifetime setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    DefectDojo gains programmatic API token revocation, per-user expiry, and an instance-wide default token lifetime setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • + POST /api/v2/api-tokens/revoke/
    • + POST /api/v2/users/{id}/reset_api_token/
    • + PATCH /api/v2/user_contact_infos/{id}/
    • + POST /api/v2/api-token-auth/
    ⤢ ⤢ ⤢
    └──▷ TRY IT
    Immediately revoke a compromised token by its key value without knowing which user owns it — useful for incident response.
    copy

    $ curl -s -X POST https://defectdojo.example.com/api/v2/api-tokens/revoke/ \
      -H 'Authorization: Token <api_key>' \
      -H 'Content-Type: application/json' \
      -d '{"key": "<token_to_revoke>"}'

    Pin a short expiry on a specific service-account token — for example to enforce 90-day rotation for one user regardless of the instance default.
    copy

    $ curl -s -X PATCH https://defectdojo.example.com/api/v2/user_contact_infos/42/ \
      -H 'Authorization: Token <api_key>' \
      -H 'Content-Type: application/json' \
      -d '{"token_expiry": "2026-12-31T23:59:59Z"}'

    Enforce a 90-day token lifetime across the entire instance so that no long-lived tokens accumulate.
    .env copy

    DD_API_TOKEN_DEFAULT_EXPIRY_DAYS=90

    • Adds POST /api/v2/api-tokens/revoke/ endpoint allowing a superuser or Global Owner to revoke a token by its key value, without knowing the owning user; returns 204 on success, 404 if the key is not found, 400 if the key field is missing, or 403 for non-superusers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds token_expiry field on PATCH /api/v2/user_contact_infos/{id}/ (superuser only) to set a per-user token expiry datetime; expired tokens receive 403 Forbidden with {"detail": "API token has expired."} and setting the field to null clears the override and falls back to the instance default.
    • Adds DD_API_TOKEN_DEFAULT_EXPIRY_DAYS environment variable to enforce a maximum token lifetime across all users; tokens expire that many days after creation and the setting is evaluated at request time, making it retroactive to existing tokens.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Setting DD_API_TOKEN_DEFAULT_EXPIRY_DAYS to a value greater than 0 is retroactive: every token already older than the configured window is immediately invalidated on its next use, including tokens driving CI/CD pipelines and your own API token.
35. api-docs-1f90ea491d7a Sep 11, 2026 · issue 071

    defectdojo: Adds POST /api/v2/api-tokens/revoke/ endpoint allowing a superuser or Global Owner to revoke a compromised token by its key value, returning 204 on success and notifying the token owner.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    defectdojo: Adds `POST /api/v2/api-tokens/revoke/` endpoint allowing a superuser or Global Owner to revoke a compromised token by its key value, returning 204 on success and notifying the token owner.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • + POST /api/v2/api-tokens/revoke/
    • + POST /api/v2/users/{id}/reset_api_token/
    • + PATCH /api/v2/user_contact_infos/{id}/
    • + POST /api/v2/api-token-auth/
    ⤢ ⤢ ⤢
    └──▷ TRY IT
    Revoke a compromised API token by its key value without knowing which user owns it.
    copy

    $ curl -X POST https://<defectdojo>/api/v2/api-tokens/revoke/ \
      -H 'Authorization: Token <api_key>' \
      -H 'Content-Type: application/json' \
      -d '{"key": "<token_to_revoke>"}'

    Pin an expiry date on a specific user's token so it automatically stops working after a deadline.
    copy

    $ curl -X PATCH https://<defectdojo>/api/v2/user_contact_infos/42/ \
      -H 'Authorization: Token <api_key>' \
      -H 'Content-Type: application/json' \
      -d '{"token_expiry": "2026-12-31T23:59:59Z"}'

    Enforce a 90-day maximum token lifetime for all users instance-wide before enabling the setting in production.
    .env copy

    DD_API_TOKEN_DEFAULT_EXPIRY_DAYS=90

    • Adds DD_API_TOKEN_DEFAULT_EXPIRY_DAYS environment variable to enforce a maximum token lifetime (in days) across all users instance-wide, evaluated at token-use time and applied retroactively to existing tokens.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Setting DD_API_TOKEN_DEFAULT_EXPIRY_DAYS to a value greater than 0 is evaluated retroactively: every existing token older than the configured window is immediately invalidated, including tokens driving CI/CD pipelines and your own API token.
36. api-docs-1f90ea491d7a Sep 10, 2026 · issue 070

    defectdojo: Adds POST /api/v2/api-tokens/revoke/ endpoint, allowing a superuser or Global Owner to revoke a token by its key value (returns 204 on success, 404 if key not found, 403 for non-superusers).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    defectdojo: Adds `POST /api/v2/api-tokens/revoke/` endpoint, allowing a superuser or Global Owner to revoke a token by its key value (returns 204 on success, 404 if key not found, 403 for non-superusers).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • + POST /api/v2/api-tokens/revoke/
    • + POST /api/v2/users/{id}/reset_api_token/
    • + PATCH /api/v2/user_contact_infos/{id}/
    • + POST /api/v2/api-token-auth/
    ⤢ ⤢ ⤢
    └──▷ TRY IT
    Immediately revoke a compromised API token by key without knowing which user owns it.
    copy

    $ curl -s -X POST https://defectdojo.example.com/api/v2/api-tokens/revoke/ \
      -H 'Authorization: Token <admin_api_key>' \
      -H 'Content-Type: application/json' \
      -d '{"key": "<token_to_revoke>"}'

    Pin an expiry date on a specific user's token so it stops working after a project ends.
    copy

    $ curl -s -X PATCH https://defectdojo.example.com/api/v2/user_contact_infos/42/ \
      -H 'Authorization: Token <admin_api_key>' \
      -H 'Content-Type: application/json' \
      -d '{"token_expiry": "2026-12-31T23:59:59Z"}'

    Enforce a 90-day maximum token lifetime across the entire instance before enabling the setting, rotate existing long-lived tokens first to avoid locking out CI/CD pipelines.
    .env copy

    DD_API_TOKEN_DEFAULT_EXPIRY_DAYS=90

    • Adds token_expiry field to PATCH /api/v2/user_contact_infos/{id}/ so superusers can set or clear a per-user token expiry datetime; expired tokens receive 403 Forbidden with {"detail": "API token has expired."} rather than being deleted.
    • Adds DD_API_TOKEN_DEFAULT_EXPIRY_DAYS environment variable to enforce an instance-wide maximum token lifetime (in days) measured from each token's creation time; defaults to no expiry.
    • New endpoint documented: POST /api/v2/api-tokens/revoke/
    • New endpoint documented: POST /api/v2/users/{id}/reset_api_token/
    • New endpoint documented: PATCH /api/v2/user_contact_infos/{id}/

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Setting DD_API_TOKEN_DEFAULT_EXPIRY_DAYS is retroactive: any existing token older than the configured window is immediately invalidated when the setting is enabled, including tokens used by CI/CD pipelines and your own admin token.
37. docs update Sep 10, 2026 · issue 070

    DefectDojo Pro v3.3 adds cross-domain finding correlation, PSIRT 2.0PSIRT 2.0An updated framework for how organizations run a Product Security Incident Response Team, standardizing vulnerability disclosure, coordination, and remediation processes to help cyber tools handle CVEs consistently., API v3 alpha, FIPS 140-3FIPS 140-3A US federal standard, maintained by NIST, that defines requirements for cryptographic modules used in government systems. Cyber tools target it to satisfy procurement mandates requiring validated crypto. support, and major asset/connector overhauls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Adds GET /api/v3-alpha/ (API v3 alpha) with slim references, expansion, RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. sub-resources, and the Pro importer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Exposes Custom Fields on the token-authenticated /api/v2 API.
    • Adds a CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence./SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. and CycloneDX VEXCycloneDX VEXA CycloneDX-format document that records which known vulnerabilities in a software bill of materials actually affect a given product, letting cyber tools automate triage by filtering out irrelevant CVEs. export API, and the Pro UI now accepts .spdx files on import.
    • Adds DISA STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. checklist import for .ckl.cklA checklist file format used by DISA's STIG Viewer to store vulnerability assessment results against Security Technical Implementation Guide controls, giving cyber tools a structured XML record of compliance findings. and .cklb files with a CCI-to-NIST 800-53NIST 800-53A catalog of security and privacy controls for U.S. federal information systems, published by NIST. Cyber tools cite it to map their findings or features to a recognized compliance framework. crosswalk.
    • Adds FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 140-3 image support (FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. SC-13), PAIN-keyed FedRAMP VDRVDRA Virtual Data Room is a secure, hosted document repository used for controlled sharing of sensitive files during due diligence, audits, or investigations, giving cyber tools a governed environment to exchange evidence or reports. remediation deadlines, and a FedRAMP prioritization preset.

    +20 more show less

    • Introduces cross-domain finding correlation that groups related findings into shared root causes, with a public read-only Root Cause API, a Top Root Causes dashboard widget, and a Product breakdown view; root causes cover CVE, component, resource, and endpoint types.
    • Folds PSIRTPSIRTA Product Security Incident Response Team: an internal group responsible for receiving, investigating, and disclosing vulnerability reports affecting a vendor's products, giving cyber tools a formal channel for coordinated disclosure. 2.0 natively into DefectDojo Pro with native advisory feeds and catalog, feed rules and rule templates, advisory-to-case conversion, and a dedicated PSIRT permission that does not require global maintainer.
    • Adds Risk Acceptances 2.0 with a reviewable lifecycle, a pending-review queue, a durable ledger, and an option to restore a finding to Verified when its risk acceptance expires.
    • Adds new Rapid7 InsightVM - Cloud Instance and Aqua Supply Chain connectors, plus a Wiz option to import Issues only.
    • Adds customer-defined field mappings to connectors (versioned and identity-safe, per scan type), a connector registry readable from the UI, per-record sync checkpoints for resuming interrupted syncs, and health notifications when a connector stops working or authenticates but sees no data.
    • Rebuilds the asset model with asset versions carrying BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. snapshots, per-version SBOM/VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. export, per-source identity and aliases, typed asset kinds, typed relationship edges distinguishing direct from indirect vulnerabilities, and asset exposure and deployment context including live reachability probing and business-criticality sync from the CMDBCMDBA Configuration Management Database: a repository that stores records of IT assets and the relationships between them, giving cyber tools a single authoritative source for infrastructure context..
    • Allows Organizations to be non-exclusive so an asset can belong to multiple organizations with union-of-grants RBAC, membership-aware organization filters on asset and finding lists, and roles grantable across an entire organization type.
    • Launches Dashboards 2.0 as the DefectDojo Command Center with a published security-posture score.
    • Adds Sensei Advisor, which recommends settings changes and offers one-click fixes for mechanical deduplication-hygiene issues, with per-run license quotas for threat modeling and Advisor; the Sensei engine now ships in on-prem compose bundles.
    • Allows Universal Parser field mappings to be edited from a dedicated screen with an impact warning attached.
    • Expands Rules to trigger on scan absence, draw from a rule-template gallery, assign an SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. configuration or Risk Priority to assets, and condition on exploit evidence, reachability, and asset exposure.
    • Adds a Location Count field on every entity and reorderable block fields in the Report Builder.
    • Adds checkbox bulk edit on the asset list for organization, SLA, engine, and tags, plus customer-editable platform, lifecycle, and origin dropdowns.
    • Extends the Freshservice integration to push findings as ITIL Incidents or Problems per mapping, and adds tag filtering to MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. finding tools.
    • Records System Settings changes in the audit log.
    • Records finding identity in a signature ledger that is versioned and bridged across formula changes, with a scheduled drift check; reimport can now match on identity signatures.
    • Fans out notifications to every organization an asset belongs to.
    • Exports report charts as PNG so labels survive PDF rendering.
    • Adds an asset Location Map that draws an asset's locations as derived trees per location type; asset connectors can emit standalone location inventory.
    • Delivers Menu 2.0 covering the whole sidebar with a Sensei + AI section, a full-height sidebar rail with pinned pages, and server-backed shell preferences.
    • Adds GET /api/v3-alpha/ (API v3 alpha) with slim references, expansion, RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. sub-resources, and the Pro importer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence./SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. and CycloneDX VEXCycloneDX VEXA CycloneDX-format document that records which known vulnerabilities in a software bill of materials actually affect a given product, letting cyber tools automate triage by filtering out irrelevant CVEs. export API, and the Pro UI now accepts .spdx files on import.
    • Adds DISA STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. checklist import for .ckl.cklA checklist file format used by DISA's STIG Viewer to store vulnerability assessment results against Security Technical Implementation Guide controls, giving cyber tools a structured XML record of compliance findings. and .cklb files with a CCI-to-NIST 800-53NIST 800-53A catalog of security and privacy controls for U.S. federal information systems, published by NIST. Cyber tools cite it to map their findings or features to a recognized compliance framework. crosswalk.
    • Adds FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 140-3 image support (FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. SC-13), PAIN-keyed FedRAMP VDRVDRA Virtual Data Room is a secure, hosted document repository used for controlled sharing of sensitive files during due diligence, audits, or investigations, giving cyber tools a governed environment to exchange evidence or reports. remediation deadlines, and a FedRAMP prioritization preset.
    • Introduces cross-domain finding correlation that groups related findings into shared root causes, with a public read-only Root Cause API, a Top Root Causes dashboard widget, and a Product breakdown view; root causes cover CVE, component, resource, and endpoint types.

    +6 more show less

    • Folds PSIRTPSIRTA Product Security Incident Response Team: an internal group responsible for receiving, investigating, and disclosing vulnerability reports affecting a vendor's products, giving cyber tools a formal channel for coordinated disclosure. 2.0 natively into DefectDojo Pro with native advisory feeds and catalog, feed rules and rule templates, advisory-to-case conversion, and a dedicated PSIRT permission that does not require global maintainer.
    • Adds new Rapid7 InsightVM - Cloud Instance and Aqua Supply Chain connectors, plus a Wiz option to import Issues only.
    • Rebuilds the asset model with asset versions carrying BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. snapshots, per-version SBOM/VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. export, per-source identity and aliases, typed asset kinds, typed relationship edges distinguishing direct from indirect vulnerabilities, and asset exposure and deployment context including live reachability probing and business-criticality sync from the CMDBCMDBA Configuration Management Database: a repository that stores records of IT assets and the relationships between them, giving cyber tools a single authoritative source for infrastructure context..
    • Adds Sensei Advisor, which recommends settings changes and offers one-click fixes for mechanical deduplication-hygiene issues, with per-run license quotas for threat modeling and Advisor; the Sensei engine now ships in on-prem compose bundles.
    • Records finding identity in a signature ledger that is versioned and bridged across formula changes, with a scheduled drift check; reimport can now match on identity signatures.
    • Adds an asset Location Map that draws an asset's locations as derived trees per location type; asset connectors can emit standalone location inventory.

    14 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The classic Bootstrap UI and the classic report engine have been retired; Menu 2.0 and the Pro Vue UI are now standard — any customizations or integrations relying on the classic UI or classic report engine will break.
    • !The maintenance window feature has been removed — any automation or scheduling that depended on it will no longer function.
38. docs update Sep 9, 2026 · issue 069

    DefectDojo adds programmatic API token revocation, per-user token expiry, and an instance-wide default token lifetime setting.

    ⤢ ⤢ ⤢
    └──▷ TRY IT
    Revoke a compromised API token by its key value without needing to identify the owning user — useful during an incident response.
    copy

    $ curl -X POST https://defectdojo.example.com/api/v2/api-tokens/revoke/ \
      -H 'Authorization: Token <api_key>' \
      -H 'Content-Type: application/json' \
      -d '{"key": "<token_to_revoke>"}'

    Set an expiry date on a specific user's API token to enforce short-lived credentials for a contractor or service account.
    copy

    $ curl -X PATCH https://defectdojo.example.com/api/v2/user_contact_infos/42/ \
      -H 'Authorization: Token <api_key>' \
      -H 'Content-Type: application/json' \
      -d '{"token_expiry": "2026-12-31T23:59:59Z"}'

    Enforce a 90-day maximum token lifetime across all users and tokens on the instance.
    .env copy

    DD_API_TOKEN_DEFAULT_EXPIRY_DAYS=90

    • New POST /api/v2/api-tokens/revoke/ endpoint lets a superuser or Global Owner revoke a compromised token by its key value, without knowing which user it belongs to; returns 204 on success, 404 if no token matches, 400 if the key field is missing, and 403 for non-superusers.
    • New token_expiry field on PATCH /api/v2/user_contact_infos/{id}/ lets superusers set or clear a per-user token expiry datetime; after expiry, requests return 403 Forbidden with {"detail": "API token has expired."} and the user must generate a new token.
    • New DD_API_TOKEN_DEFAULT_EXPIRY_DAYS environment variable enforces an instance-wide maximum token lifetime in days for all tokens, including existing ones; setting it is retroactive and takes effect the next time each token is used.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Setting DD_API_TOKEN_DEFAULT_EXPIRY_DAYS to a value greater than 0 immediately invalidates every token on the instance older than that window, including tokens used by CI/CD pipelines and your own API token.
39. 3.3.0 Sep 8, 2026 · issue 069

    DefectDojo 3.3.0 adds a locations backfill cancel hook, Regulations support, and multiple API and Rules Engine 2.0 expansions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.3.0 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.3.0

    └──▷ TRY IT
    Query the new Custom Fields API to retrieve all custom field definitions for your instance.
    copy

    $ curl -s -H 'Authorization: Token <your_api_token>' https://<defectdojo_host>/api/v2/custom_fields/

    • Adds a cancel hook to the endpoints-to-locations backfill via feat(locations).
    • Sets finding mitigation automatically from Dependency Track affected version ranges.
    • Adds an RSS feed to the changelog.
    • Adds KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. and exploit-evidence condition fields to Rules Engine 2.0.
    • Adds exploit-evidence, reachability, and asset-exposure condition fields to Rules Engine 2.0.

    +39 more show less

    • Adds the missing-scan trigger to Rules Engine 2.0.
    • Adds SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. configuration and Risk Priority asset actions to Rules Engine 2.0.
    • Adds custom fields support to Rules Engine 2.0.
    • Adds asset support to Rules Engine 2.0.
    • Adds typed Custom Fields feature with support on create and edit forms.
    • Adds Chart blocks to the reporting feature (no longer coming soon).
    • Adds GitHub issue import support to the GHAS connector.
    • Adds GMPGMPGNU Multiple Precision Arithmetic Library, a free library for arbitrary-precision integers, rationals, and floats; cyber tools use it when cryptographic operations require big-number math beyond native integer limits. over SSH support for the OpenVAS / Greenbone connector.
    • Adds Wiz imports without Projects via a tenant-level Record.
    • Adds a Qualys Host Tags filter to the Qualys connector.
    • Adds multi-Asset finding fan-out to Smart Upload.
    • Adds PAIN-keyed FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. VDRVDRA Virtual Data Room is a secure, hosted document repository used for controlled sharing of sensitive files during due diligence, audits, or investigations, giving cyber tools a governed environment to exchange evidence or reports. remediation deadlines to the federal feature.
    • Adds Feed Rules, the no-SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. matching path, and advisory-to-case to PSIRTPSIRTA Product Security Incident Response Team: an internal group responsible for receiving, investigating, and disclosing vulnerability reports affecting a vendor's products, giving cyber tools a formal channel for coordinated disclosure..
    • Adds AI Model Settings with LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. provider configuration to the Sensei feature.
    • Adds the Claude Code plugin page and corrects the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool count.
    • Adds CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. cloud-posture page, hub views, and fix-quota states to Sensei.
    • Adds inline repo association and locate-the-file fix flow to Sensei.
    • Adds AI agent skill scanning to Sensei.
    • Adds MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. disabling now requiring a verification code.
    • Adds a GET /api/v2/ Custom Fields API endpoint.
    • Adds Quick Export dialog that produces a named report on the findings view.
    • Adds Bulk Edit action on the All Assets list.
    • Adds SBOM export from the Asset page.
    • Adds Asset inventory export.
    • Adds Asset Versions and per-version claims in the UI.
    • Adds asset-hierarchy relationship types and direct vs indirect vulnerability views.
    • Adds type-scoped grants UI for organizations.
    • Adds roles scoped to an organization type.
    • Adds the Connector Health Warning notification type.
    • Adds notifications following every organization membership.
    • Adds asset exposure and deployment context documentation surface.
    • Adds location inventory tracking from asset connectors.
    • Adds Form Configuration as a documented navigation surface.
    • Adds customizable page layouts on view pages.
    • Adds RFC 9116 security.txt to docs.defectdojo.com.
    • Adds Brazilian Portuguese, Simplified Chinese, Italian, and German translations of the core guides.
    • Lets a downstream distribution supply the assets router's write schemas via the API v3.
    • Validates the request body on a finding metadata PUT.
    • Validates the Jira epic action body and rejects reserved dispatch kwargs.
    • Sets finding mitigation automatically from Dependency Track affected version ranges.
    • Adds an RSS feed to the changelog.
    • Adds typed Custom Fields feature with support on create and edit forms.
    • Adds Chart blocks to the reporting feature (no longer coming soon).
    • Adds GMPGMPGNU Multiple Precision Arithmetic Library, a free library for arbitrary-precision integers, rationals, and floats; cyber tools use it when cryptographic operations require big-number math beyond native integer limits. over SSH support for the OpenVAS / Greenbone connector.

    +17 more show less

    • Adds PAIN-keyed FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. VDRVDRA Virtual Data Room is a secure, hosted document repository used for controlled sharing of sensitive files during due diligence, audits, or investigations, giving cyber tools a governed environment to exchange evidence or reports. remediation deadlines to the federal feature.
    • Adds AI Model Settings with LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. provider configuration to the Sensei feature.
    • Adds a GET /api/v2/ Custom Fields API endpoint.
    • Adds Quick Export dialog that produces a named report on the findings view.
    • Adds SBOM export from the Asset page.
    • Adds Asset inventory export.
    • Adds Asset Versions and per-version claims in the UI.
    • Adds asset-hierarchy relationship types and direct vs indirect vulnerability views.
    • Adds type-scoped grants UI for organizations.
    • Adds roles scoped to an organization type.
    • Adds the Connector Health Warning notification type.
    • Adds asset exposure and deployment context documentation surface.
    • Adds location inventory tracking from asset connectors.
    • Adds Form Configuration as a documented navigation surface.
    • Adds customizable page layouts on view pages.
    • Adds RFC 9116 security.txt to docs.defectdojo.com.
    • Adds Brazilian Portuguese, Simplified Chinese, Italian, and German translations of the core guides.

    22 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The classic sidebar is retired in 3.3.0 — installations relying on the classic sidebar navigation will need to migrate to the new sidebar.
40. docs update Sep 8, 2026 · issue 068

    DefectDojo v3.2.400 adds KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.-based rules, SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export, Skillspector scanner, engagement checklists, and a Cmd/Ctrl+K palette.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Export an SBOM in SPDX format directly from the UI when your downstream tooling requires SPDX instead of CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence..
    📍In the Pro UI, open the finding or product SBOM export dialog, then select SPDX from the format dropdown (alongside the existing CycloneDX option) and click Export.
    Prioritize remediation rules to fire only when a vulnerability is actively exploited — combine KEV listing with exploit evidence as rule conditions.
    📍In the Pro UI, navigate to Rules, create or edit a rule, and add conditions for KEV listing and exploit evidence to restrict the rule to actively exploited vulnerabilities.
    • Adds SPDX as an export format alongside CycloneDX in the UI SBOM export.
    • Rules can now be conditioned on KEV (Known Exploited VulnerabilitiesKnown Exploited VulnerabilitiesCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.) listing and exploit evidence.
    • Adds a searchable menu palette over the sidebar, opened with Cmd/Ctrl+K.
    • Adds engagement checklists to the Pro UI.
    • Adds a generic fix flow: associate a repository with a finding inline, with a gap-closing wizard and repository-tree path resolution before fix generation.

    +3 more show less

    • The Root Cause view gains a Root Cause Organization column, asset and organization filters, and per-organization drill-in.
    • Custom fields now render on entity create and edit forms, configured like any other form field.
    • The Wiz, Microsoft Defender for Cloud, and CrowdStrike connectors now stream findings page by page rather than loading an entire sync into memory, making large syncs faster and lighter.
    • Adds a searchable menu palette over the sidebar, opened with Cmd/Ctrl+K.
    • Adds engagement checklists to the Pro UI.

    6 more in Everything

41. announced Sep 1, 2026 · issue 064

    DefectDojo Pro adds SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. and VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. export via Asset page UI and REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., supporting CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. and SPDX 2.3SPDX 2.3An open standard from the Linux Foundation for describing software bills of materials, letting cyber tools exchange dependency, license, and vulnerability data in a common machine-readable format..

    └──▷ TRY IT
    Export a versioned SBOM in SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. 2.3 JSON for a specific product release to satisfy a compliance or procurement request.
    copy

    $ curl -H 'Authorization: Token <your_token>' 'https://<your_instance>/api/v2/sbom/<asset_id>/?spec=spdx&version=5.2.0'

    Retrieve a VEX document scoped to a specific release, reflecting per-version exploitability based on your team's triage and fixed_in records.
    copy

    $ curl -H 'Authorization: Token <your_token>' 'https://<your_instance>/api/v2/sbom/<asset_id>/vex/?version=5.2.0'

    • Adds GET /api/v2/sbom/{asset_id}/ endpoint to export a CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.6 or SPDX 2.3 JSON SBOM for an Asset.
    • Adds GET /api/v2/sbom/{asset_id}/?spec=spdx parameter to select SPDX 2.3 JSON output instead of the default CycloneDX 1.6.
    • Adds GET /api/v2/sbom/{asset_id}/vex/ endpoint to export a CycloneDX VEXCycloneDX VEXA CycloneDX-format document that records which known vulnerabilities in a software bill of materials actually affect a given product, letting cyber tools automate triage by filtering out irrelevant CVEs. document derived from the Asset's triage findings.
    • Supports ?version=<release> query parameter on both GET /api/v2/sbom/{asset_id}/ and GET /api/v2/sbom/{asset_id}/vex/ to scope the export to a specific Asset Version (e.g. ?version=5.2.0); returns 404 if the version does not exist.
    • Adds a third export format — SBOM with vulnerabilities (VDRVDRA Virtual Data Room is a secure, hosted document repository used for controlled sharing of sensitive files during due diligence, audits, or investigations, giving cyber tools a governed environment to exchange evidence or reports.) — that embeds a VEX analysis block inside the CycloneDX SBOM inventory.

    +1 more show less

    • Adds an Export panel to every Asset page in the DefectDojo Pro UI with the three export options (SBOM, VEX, SBOM with vulnerabilities/VDR); requires V3 Locations to be enabled.

    6 details in Everything

42. docs update Aug 31, 2026 · issue 060

    DefectDojo v3.2.300 adds typed Custom Fields, GMPGMPGNU Multiple Precision Arithmetic Library, a free library for arbitrary-precision integers, rationals, and floats; cyber tools use it when cryptographic operations require big-number math beyond native integer limits.-over-SSH for OpenVAS, GitHub Issues import, and default deduplication identity ledger.

    ⤢ ⤢ ⤢ ⤢
    • Adds typed Custom Fields across seven datatypes attachable to six entity types, with values tracked in the audit log and readable/writable by Rules Engine 2.0 rules.
    • Adds a new GitHub: Issues scan type so the GitHub Advanced Security connector can import repository issues as a fourth finding family; pre-existing mappings are backfilled automatically.
    • The OpenVAS / Greenbone connector now supports GMP over SSH as a transport.
    • The deduplication identity ledger is now enabled by default.
    • Rules Engine 2.0 can now work with Assets end to end, and a new asset provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. widget on the asset page layout shows which rule produced an asset.

    +7 more show less

    • Rebuilt the Asset Hierarchy page on the Rules Engine 2.0 editor shell.
    • The Action1 connector now consolidates findings per organization, with machines recorded as endpoints, and each connector tile now counts only actively syncing records as mapped and surfaces unmapped records directly on the tile.
    • DefectDojo now reports when a Celery task is routed to a queue that no worker consumes.
    • The Pro MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server now reports its version (with commit hash) via a CLI option.
    • The POA&MPOA&MA Plan of Action and Milestones: a US federal government document that tracks known security weaknesses in a system, the remediation steps planned, and the deadlines for completing them, required under FISMA compliance. scheduled completion date is now derived from the finding's SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments..
    • The Risk Acceptance name is now offered as a finding report column.
    • Raises the custom fields JSON limit from 200 to 1000.

    12 details in Everything

43. announced Aug 27, 2026 · issue 058

    DefectDojo Pro adds Sensei CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps.: onboard AWS, Azure, and GCP accounts for cloud misconfiguration scanning and automated remediation with an undo button.

    └──▷ HOW TO FIND IT
    Onboard all AWS accounts visible to an Organizations management credential and run an initial posture scan from the Sensei hub.
    📍In DefectDojo Pro, go to Sensei › Cloud Connections › Add Connection, select AWS, enter a read-only Organizations credential, and choose Discover and onboard all member accounts. Then navigate to Sensei › Hub and select Run Scan against the newly onboarded accounts.
    Apply and later revert a Fix in Cloud action (e.g., blocking public S3 access) with human approval and a full audit trail.
    📍In DefectDojo Pro, open a cloud posture finding for an S3 bucket, click Fix in Cloud, review the approval dialog (action: block public access, resource: the specific bucket, required permissions listed), approve, then navigate to Sensei › Cloud Remediations to see the ledger entry and use the per-row Revert button if needed.
    • Adds Cloud Connection onboarding in DefectDojo Pro to connect AWS Organizations, Azure subscriptions, and GCP projects in bulk using a shared read-only credential that auto-discovers and onboards all visible accounts at once.
    • Adds on-demand cloud posture scanning from the Sensei hub, with results landing in DefectDojo as deduplicated, prioritized findings tied to the specific cloud resource (S3 bucket, security group, etc.) and updated in place on re-scan.
    • Adds Fix in Cloud direct remediation that applies changes through the provider API using a separate write credential, independent of the read-only scan credential, with a mandatory human-approval dialog showing the exact action, target resource, and required cloud permissions before execution.
    • Retains the existing IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. pull request remediation path for infrastructure managed as code, so Sensei opens a PR rather than touching the live resource when source code exists.

    4 details in Everything

44. announced Aug 27, 2026 · issue 009

    DefectDojo Pro adds Sensei CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps.: onboard AWS, Azure, and GCP accounts for cloud misconfiguration scanning and automated remediation with an undo button.

    └──▷ HOW TO FIND IT
    Onboard all AWS accounts visible to an Organizations management credential and run an initial posture scan from the Sensei hub.
    📍In DefectDojo Pro, go to Sensei › Cloud Connections › Add Connection, select AWS, enter a read-only Organizations credential, and choose Discover and onboard all member accounts. Then navigate to Sensei › Hub and select Run Scan against the newly onboarded accounts.
    Apply and later revert a Fix in Cloud action (e.g., blocking public S3 access) with human approval and a full audit trail.
    📍In DefectDojo Pro, open a cloud posture finding for an S3 bucket, click Fix in Cloud, review the approval dialog (action: block public access, resource: the specific bucket, required permissions listed), approve, then navigate to Sensei › Cloud Remediations to see the ledger entry and use the per-row Revert button if needed.
    • Adds Cloud Connection onboarding in DefectDojo Pro to connect AWS Organizations, Azure subscriptions, and GCP projects in bulk using a shared read-only credential that auto-discovers and onboards all visible accounts at once.
    • Adds on-demand cloud posture scanning from the Sensei hub, with results landing in DefectDojo as deduplicated, prioritized findings tied to the specific cloud resource (S3 bucket, security group, etc.) and updated in place on re-scan.
    • Adds Fix in Cloud direct remediation that applies changes through the provider API using a separate write credential, independent of the read-only scan credential, with a mandatory human-approval dialog showing the exact action, target resource, and required cloud permissions before execution.
    • Retains the existing IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. pull request remediation path for infrastructure managed as code, so Sensei opens a PR rather than touching the live resource when source code exists.

    4 details in Everything

45. announced Aug 25, 2026 · issue 058

    DefectDojo Pro adds Vulnerability Explorer with EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching./KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. enrichment and Root Cause Correlation for one-row-per-CVE prioritization

    └──▷ HOW TO FIND IT
    Quickly surface the highest-exploitation-probability CVEs across your entire portfolio for same-day triage.
    📍In DefectDojo Pro, open the Vulnerability Explorer, click the EPSS Score column header to sort descending, then click Total Findings on the top row to jump directly to the filtered findings list for that CVE.
    Force an immediate refresh of KEV and EPSS data after CISA publishes a new catalog update, without waiting for the nightly sync.
    📍In DefectDojo Pro, open the Vulnerability Explorer and click the Sync KEV/EPSS data button at the top of the page.
    Enable Root Cause Correlation (Beta) so that clusters of findings sharing the same vulnerable component are grouped and prioritized together.
    📍In DefectDojo Pro, navigate to Settings › Feature Flags and enable Root Cause Correlation (requires superuser account).
    • Adds the Vulnerability Explorer in DefectDojo Pro: a deduplicated, one-row-per-vulnerability-ID view that surfaces EPSS Score, EPSS Percentile, Known Exploited, Ransomware Used, and KEV Date columns alongside a Total Findings count that links directly to the filtered findings list.
    • Adds a Sync KEV/EPSS data button at the top of the Vulnerability Explorer to pull the latest CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. and FIRST EPSS data on demand, in addition to automatic daily sync.
    • Supports Cap by KEV due date in SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. configuration, which tightens a KEV-listed finding's remediation deadline to CISA's official due date for that CVE.
    • Adds Root Cause Correlation (Beta) to DefectDojo Pro, grouping findings that share the same component-at-version, CVE, infrastructure resource, or weakness class at the same URL into ranked clusters showing active findings, affected assets, and aggregate risk — enabled by a superuser under Settings > Feature Flags.
    • Distinguishes between unenriched vulnerabilities (blank column) and confirmed non-exploited vulnerabilities (red ✗ under Known Exploited), making triage status unambiguous.

    5 details in Everything

46. announced Aug 25, 2026 · issue 009

    DefectDojo Pro adds Vulnerability Explorer with EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching./KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. enrichment and Root Cause Correlation for one-row-per-CVE prioritization

    └──▷ HOW TO FIND IT
    Quickly surface the highest-exploitation-probability CVEs across your entire portfolio for same-day triage.
    📍In DefectDojo Pro, open the Vulnerability Explorer, click the EPSS Score column header to sort descending, then click Total Findings on the top row to jump directly to the filtered findings list for that CVE.
    Force an immediate refresh of KEV and EPSS data after CISA publishes a new catalog update, without waiting for the nightly sync.
    📍In DefectDojo Pro, open the Vulnerability Explorer and click the Sync KEV/EPSS data button at the top of the page.
    Enable Root Cause Correlation (Beta) so that clusters of findings sharing the same vulnerable component are grouped and prioritized together.
    📍In DefectDojo Pro, navigate to Settings › Feature Flags and enable Root Cause Correlation (requires superuser account).
    • Adds the Vulnerability Explorer in DefectDojo Pro: a deduplicated, one-row-per-vulnerability-ID view that surfaces EPSS Score, EPSS Percentile, Known Exploited, Ransomware Used, and KEV Date columns alongside a Total Findings count that links directly to the filtered findings list.
    • Adds a Sync KEV/EPSS data button at the top of the Vulnerability Explorer to pull the latest CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. and FIRST EPSS data on demand, in addition to automatic daily sync.
    • Supports Cap by KEV due date in SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. configuration, which tightens a KEV-listed finding's remediation deadline to CISA's official due date for that CVE.
    • Adds Root Cause Correlation (Beta) to DefectDojo Pro, grouping findings that share the same component-at-version, CVE, infrastructure resource, or weakness class at the same URL into ranked clusters showing active findings, affected assets, and aggregate risk — enabled by a superuser under Settings > Feature Flags.
    • Distinguishes between unenriched vulnerabilities (blank column) and confirmed non-exploited vulnerabilities (red ✗ under Known Exploited), making triage status unambiguous.

    5 details in Everything

47. docs update Aug 25, 2026 · issue 056

    DefectDojo Pro gains a documented air-gapped install mode driven by --air-gapped true in dojo-compose-cli.

    └──▷ TRY IT
    Enable air-gapped mode on the target host so the CLI reads the license from disk and refuses registry calls rather than hanging or failing silently.
    copy

    $ sudo ./dojo-compose-cli config set --air-gapped true
    dojo-compose-cli config print

    On the staging host, set the target release and pre-pull all images before packaging them for transfer into the air-gapped network.
    copy

    $ export DOJO_CLI_KEY="your-key"
    dojo-compose-cli config set --deploy-version 2.1.0
    dojo-compose-cli config set --version 2.1.0
    dojo-compose-cli deploy download
    dojo-compose-cli app pull-images
    docker image ls

    Inject required secrets and database connection into the air-gapped host's configuration after restoring the deployment directory.
    copy

    $ dojo-compose-cli environment add --key "DD_CREDENTIAL_AES_256_KEY" --value "<64-character-key-from-step-4>"
    dojo-compose-cli environment add --key "DD_SECRET_KEY" --value "<64-character-key-from-step-4>"
    dojo-compose-cli environment add --key "DD_DATABASE_URL" --value "postgres://<db_user>:<db_password>@<db_host>:5432/<db_name>"
    dojo-compose-cli environment add --key "DD_SITE_URL" --value "https://defectdojo.internal.example.com"
    dojo-compose-cli environment add --key "DD_ALLOWED_HOSTS" --value "*"
    dojo-compose-cli app start

    • Enables air-gapped deployment via dojo-compose-cli config set --air-gapped true, which validates the license from /etc/defectdojo/dojopro.lic and blocks registry-dependent commands with an explicit error message instead of silent failures.
    • Adds dojo-compose-cli config set --deploy-version and --version flags to pin the exact release version across deployment artifacts and container images.
    • Adds dojo-compose-cli deploy download to pull the full deployment directory (compose file, nginx config, issue tracker templates, customizations) into /opt/dojo.
    • Adds dojo-compose-cli app pull-images to fetch all container images for a given release on the staging host prior to air-gapped transfer.
    • Adds dojo-compose-cli environment print to capture generated secrets (DD_CREDENTIAL_AES_256_KEY, DD_SECRET_KEY) before transferring to an air-gapped host.

    +4 more show less

    • Adds dojo-compose-cli environment add --key ... --value ... to manually set environment values (DD_CREDENTIAL_AES_256_KEY, DD_SECRET_KEY, DD_SITE_URL, DD_ALLOWED_HOSTS, DD_DATABASE_URL) on the air-gapped target.
    • Adds dojo-compose-cli app start, app stop, and app restart commands that operate fully offline, reading the local compose file without contacting the registry.
    • Requires CLI version 2.1.0 or later for air-gapped mode; earlier versions have no air-gapped mode and fail with name resolution errors instead of actionable messages.
    • Introduces DOJO_CLI_KEY environment variable to supply the CLI's stored-configuration encryption key non-interactively across all commands.

    9 details in Everything

48. docs update Aug 25, 2026 · issue 056

    DefectDojo Pro adds official OpenShift 4.x deployment support with bootstrap script, SCC guidance, and Route-based TLS.

    └──▷ USE IT
    Fix login failures behind an edge-terminated OpenShift Route by disabling secure cookies in your Helm values.
    yaml copy

    dojo:
      secureCookies: false

    Retrieve the correct fsGroup start value from the namespace annotation when using NFS or EFS storage.
    copy

    $ oc get namespace <namespace> -o jsonpath='{.metadata.annotations.openshift\.io/sa\.scc\.supplemental-groups}'

    Skip the initializer wait on subsequent upgrades once the database has already been initialized.
    yaml copy

    dojo:
      skipInitContainer: true

    • Adds dojo.secureCookies config key: must be set to false when deploying behind an edge-terminated OpenShift Route (where TLS ends at the router and the pod receives plain HTTP), or login will fail.
    • Adds dojo.skipInitContainer config key: set to true after first install to skip the initializer wait on subsequent upgrades.
    • Adds config.logLevel and celery.logLevel config keys, both accepting DEBUG for deeper diagnostic output.
    • Supports three resource profiles — minimal, standard, and performance — selected at install time; performance enables autoscaling.
    • Provides an idempotent OpenShift bootstrap script (included with license materials) that handles storage, fsGroup, Route creation, and install; supports a dry-run mode that prints planned actions without making changes.

    +4 more show less

    • DefectDojo Pro now runs under the default restricted-v2 SCC on OpenShift 4.x, including OpenShift Container Platform, ROSA, and OKD — no anyuid or privileged SCC grant required.
    • Exposes the service via an OpenShift Route with edge TLS termination and HTTP-to-HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. redirect; on ROSA, hostnames are auto-generated as <release-name>-<namespace>.apps.<cluster-domain>.
    • Exploitability enrichment optionally pulls EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scores from api.first.org and CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. data from www.cisa.gov over outbound HTTPS port 443.
    • Requires ReadWriteMany persistent storage for multi-node deployments; supports NFS-backed storage with fsGroup derived from the namespace's openshift.io/sa.scc.supplemental-groups annotation.

    9 details in Everything

49. docs update Aug 25, 2026 · issue 056

    DefectDojo Pro adds FIPS 140-3FIPS 140-3A US federal standard, maintained by NIST, that defines requirements for cryptographic modules used in government systems. Cyber tools target it to satisfy procurement mandates requiring validated crypto. validated container images for FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. SC-13 and similar compliance deployments.

    └──▷ USE IT
    Enable FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 140-3 mode in a Docker Compose deployment by pointing to FIPS image variants and setting DD_FIPS_MODE in each shared environment anchor.
    docker-compose.yaml copy

    # In .env
    DD_IMAGE_TAG=<version>-fips
    
    # In docker-compose.yaml shared anchors
    x-dojo-vars: &dojoenv
      DD_FIPS_MODE: "1"
    
    x-nginx-vars: &nginxenv
      DD_FIPS_MODE: "1"
    
    x-psirt-vars: &psirtenv
      DD_FIPS_MODE: "1"
    
    # Then recreate the stack
    docker compose up -d --force-recreate

    Deliberately include Sensei in a FIPS environment while documenting the bundled scanner toolchain as non-validated in the system security plan.
    your-values.yaml copy

    fips:
      enabled: true
      validate: false
    sensei:
      enabled: true

    • Adds -fips image tag suffix to identify FIPS 140-3 validated container variants of DefectDojo Pro, leaving standard images unchanged.
    • Adds DD_FIPS_MODE environment variable (set to "1") to activate FIPS enforcement inside containers across Docker Compose, Kubernetes, and ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. deployments.
    • Adds fips.enabled Helm value that automatically selects -fips image variants and injects DD_FIPS_MODE for every pod in the chart.
    • Adds fips.validate Helm value (set to false) to explicitly accept partial FIPS coverage when components like Sensei or embedded datastores are also enabled.
    • Adds chart-level guard rails that refuse to render when fips.enabled is true alongside components with no FIPS image variant (embedded PostgreSQL, Redis, or unaccepted Sensei), naming the offenders in the error output.

    +3 more show less

    • Supports all cryptographic operations through OpenSSL FIPS Provider 3.1.2 (CMVP #4985) for Python/Django services and Go Cryptographic Module v1.0.0 (CMVP #5247) for Go services (Connectors, Integrators, ddorch, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server).
    • Enables FIPS mode without requiring a FIPS-enabled host kernel, making it usable on managed runtimes such as Amazon ECS with the Fargate launch type.
    • Provides complete ECS/Fargate task definition examples using DD_FIPS_MODE, DD_DATABASE_URL, DD_SECRET_KEY, DD_CREDENTIAL_AES_256_KEY, and DD_LICENSE sourced from Secrets Manager.

    8 details in Everything

50. docs update Aug 25, 2026 · issue 056

    DefectDojo Pro adds an interactive Asset Hierarchy diagram with relationship management, node filtering, and incremental hierarchy loading.

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Reorganize a large product tree without losing context — move an Asset to a new parent while keeping the diagram visible.
    📍In the Asset Hierarchy diagram, click the Asset node you want to move. In the right panel, click Change Parent and select the new parent Asset from the form that opens in the right panel.
    Explore a deep hierarchy incrementally to avoid an overwhelming diagram — load ancestors of an unparented node on demand.
    📍In the Asset Hierarchy diagram, locate an Asset whose parent has not been loaded and click the Load Parents button that appears above it to add the parent and its siblings.
    • New interactive Asset Hierarchy diagram visualizes parent-child relationships between Assets as labelled arrows, color-coded by selection origin, with a Legend panel identifying node types.
    • Adds Hide Asset List button to collapse the Asset selector and give the diagram full-page real estate.
    • Node display in the left panel supports toggling Asset ID, Organization ID, Organization Name, and Child Count on or off per node.
    • Clicking an Asset node exposes contextual actions in the right panel: Open Asset, Edit Asset, Add Child, Change Parent, and Remove From Hierarchy — all without leaving the diagram view.
    • Add Child allows nesting an existing Asset or creating a new one under the selected node, constrained to the same Organization.

    +3 more show less

    • Change Parent moves the selected Asset to a different parent within the hierarchy.
    • Remove From Hierarchy detaches an Asset from its parent with a prompt to either orphan or re-parent the Asset's children.
    • Incremental hierarchy loading via Load Parents (above a node) and Load (below a node, with configurable batch size) keeps large hierarchies readable.

    8 details in Everything

51. 3.2.300 Aug 24, 2026 · issue 056

    DefectDojo 3.2.300 adds Regulations support, typed Custom Fields, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. disable verification, and expanded documentation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.300 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.2.300

    • Scopes endpoint delete and rename operations to the requesting product, restricting cross-product mutations.
    • Disabling MFA now requires a verification code, adding a confirmation step to protect account security.
    • Documents typed Custom Fields feature, including how custom fields integrate with Rules Engine 2.0.
    • Documents multi-Asset finding fan-out in Smart Upload workflows.
    • Documents AI Model Settings and supported LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. providers in Sensei.

    +8 more show less

    • Documents GMPGMPGNU Multiple Precision Arithmetic Library, a free library for arbitrary-precision integers, rationals, and floats; cyber tools use it when cryptographic operations require big-number math beyond native integer limits. over SSH support for OpenVAS / Greenbone connectors.
    • Documents customizable page layouts on view pages and Form Configuration in navigation.
    • Documents Quick Export dialog that produces a named report.
    • Documents the rebuilt Asset hierarchy page.
    • Documents four-permission rule permission tier in Rules Engine 2.0.
    • Adds RFC 9116 security.txt to docs.defectdojo.com.
    • Adds Brazilian Portuguese, Simplified Chinese, and Italian translations of the core documentation guides.
    • Splits connector documentation into one page per connector for easier navigation.

    13 details in Everything

52. 3.2.300 Aug 24, 2026 · issue 009

    DefectDojo 3.2.300 adds Regulations support, typed Custom Fields, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. disable verification, and expanded documentation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.300 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.2.300

    • Scopes endpoint delete and rename operations to the requesting product, restricting cross-product mutations.
    • Disabling MFA now requires a verification code, adding a confirmation step to protect account security.
    • Documents typed Custom Fields feature, including how custom fields integrate with Rules Engine 2.0.
    • Documents multi-Asset finding fan-out in Smart Upload workflows.
    • Documents AI Model Settings and supported LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. providers in Sensei.

    +8 more show less

    • Documents GMPGMPGNU Multiple Precision Arithmetic Library, a free library for arbitrary-precision integers, rationals, and floats; cyber tools use it when cryptographic operations require big-number math beyond native integer limits. over SSH support for OpenVAS / Greenbone connectors.
    • Documents customizable page layouts on view pages and Form Configuration in navigation.
    • Documents Quick Export dialog that produces a named report.
    • Documents the rebuilt Asset hierarchy page.
    • Documents four-permission rule permission tier in Rules Engine 2.0.
    • Adds RFC 9116 security.txt to docs.defectdojo.com.
    • Adds Brazilian Portuguese, Simplified Chinese, and Italian translations of the core documentation guides.
    • Splits connector documentation into one page per connector for easier navigation.

    13 details in Everything

53. docs update Aug 19, 2026 · issue 050

    DefectDojo v3.2.201 adds Amazon Bedrock LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code., CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. via Sensei license, configurable scanner parallelism, asset export, and new connectors.

    ⤢ ⤢ ⤢ ⤢
    └──▷ USE IT
    Set scanner parallelism in a Helm-based deployment to cap concurrent scan-and-fix workers.
    values.yaml copy

    sensei:
      maxParallel: 4

    • Adds --max-parallel CLI flag, MAX_PARALLEL environment variable, and sensei.maxParallel Helm key to configure scan-and-fix scanner parallelism.
    • Exposes a flat test_type_name field on the finding serializer REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..
    • Adds Amazon Bedrock as an on-prem LLM connection option.
    • Cloud Security Posture Management (CSPM) is now gated on the Sensei license rather than a separate feature flag; supports AWS, Azure, and GCP posture scans with reversible direct remediation.
    • Adds asset exposure reporting from Wiz, Shodan, Censys, and CrowdStrike Spotlight.

    +17 more show less

    • Adds Aikido Security, Jit, and Cycode connectors.
    • Enables CSV export of the asset and organization inventory.
    • Adds a DB-backed Locations toggle with a data-migration suite to move existing Endpoint data over (Endpoints are deprecated in favour of Locations).
    • Adds admin-controlled Form Configuration for Vue create and edit forms to control which fields appear.
    • Adds a filterable Review Claimant column to the findings list.
    • Splits Rules Engine permissions into View / Add / Edit / Delete for finer RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists..
    • Allows applying a finding template to a Finding, and turning a Finding into a template, directly from the Vue UI.
    • The Jira connector now accepts service accounts.
    • The JFrog connector now surfaces a pending status.
    • Layout customization can now be restricted to admin-designated defaults.
    • The Risk Acceptance view page now uses a customizable widget grid.
    • Records the count of Findings a tool submitted before deduplication runs.
    • Consolidates Finding and asset Location retrieval into single REST calls.
    • Quick Export now names its output from the current context, and report templates can be applied to an export.
    • Moves Feature Flags out of System into its own settings location.
    • Classic-menu users now receive a warning that Menu 2.0 becomes the standard in v3.3.0.
    • The Priority filter and override inputs now accept decimal values.

    22 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Endpoints are deprecated in favour of Locations; a data-migration suite is provided to move existing data over.
54. docs update Aug 18, 2026 · issue 049

    DefectDojo 3.2.100 enforces true private notes — visible only to the author and superusers across API, UI, and reports.

    └──▷ BREAKING ON UPGRADE

    • !Private notes written by other users no longer appear in the notes tab, note popovers, or note counts for findings, tests, and engagements. Teams that used the private flag as a label while relying on all users still reading the text must move that content into public notes before upgrading.
55. docs update Aug 18, 2026 · issue 049

    DefectDojo Pro 3.2.200 moves Locations to a self-service toggle with on-demand data-migration backfills.

    └──▷ TRY IT
    Run the endpoint-to-locations backfill as a management command in an air-gapped or scripted environment after enabling the Locations toggle.
    copy

    $ python manage.py migrate_endpoints_to_locations

    Enable Locations for the first time via the Pro UI, then run all three backfills and the identity rehash in sequence.
    📍1. Go to Settings › Feature Flags and enable the Locations toggle. 2. Under the Locations row, run migrate_endpoints_to_locations, then migrate_components_to_dependencies, then migrate_findings_to_code_locations. 3. Once all three complete, run the identity rehash. 4. If using the Classic UI or /api/v2, set DD_V3_FEATURE_LOCATIONS=True in your deployment config and restart.
    • Adds a self-service Locations toggle on the Settings > Feature Flags page in DefectDojo Pro, replacing the previous environment-variable-only deployment change; once enabled the toggle locks (Cannot Be Disabled) because reversing the location data migration is not yet supported.
    • The DD_V3_FEATURE_LOCATIONS environment variable continues to govern the Classic UI and /api/v2 route wiring at boot time; a restart is recommended when enabling the toggle if either surface is in use, so all surfaces stay aligned.
    • Introduces a data-migration suite under the Locations row on the Feature Flags page with four on-demand, idempotent items: migrate_endpoints_to_locations (converts existing Endpoint rows to URL Locations), migrate_components_to_dependencies (converts component_name/component_version to Dependency Locations), migrate_findings_to_code_locations (converts file_path/line to Source Code Locations), and an identity rehash that recomputes deduplication digests — each also available as a management command for scripted or air-gapped runs.
    • The identity rehash step is locked until all three backfills complete, preventing incomplete deduplication identities from being baked into a half-migrated database.

    4 details in Everything

56. docs update Aug 18, 2026 · issue 049

    DefectDojo Pro adds SCIM 2.0SCIM 2.0A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning, CycloneDX VEXCycloneDX VEXA CycloneDX-format document that records which known vulnerabilities in a software bill of materials actually affect a given product, letting cyber tools automate triage by filtering out irrelevant CVEs. round-trip, Messaging Connectors, and customizable page layouts

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Narrow a Qualys connector sync to only hosts tagged in Qualys, reducing download and sync time to in-scope assets only.
    📍In the DefectDojo UI, go to your Qualys connector connection settings, enter the exact tag name(s) in the Host Tags filter field, and save. Leave the field blank to discover all hosts.
    • Adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. 2.0 provisioning under Connect > Authorization (tagged Provisioning): identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. can now create, update, and deactivate DefectDojo users and manage groups directly; deactivating a user over SCIM also deletes that user's API tokens.
    • Adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. / VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. / VDRVDRA Virtual Data Room is a secure, hosted document repository used for controlled sharing of sensitive files during due diligence, audits, or investigations, giving cyber tools a governed environment to exchange evidence or reports. export and import as a full round trip: a document exported from DefectDojo can be imported back in, and the raw CycloneDX VEX analysis is now preserved on parsed Findings.
    • Adds Messaging Connectors (beta) that send alerts to Slack, Microsoft Teams, email, or an Amazon SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. topic, routed by Rules Engine 2.0 rules; requires the Messaging Connectors and Rules Engine 2.0 feature flags.
    • A Rules Engine 2.0 rule can now be given its own schedule; enabling the feature flag now warns that a worker restart is required before it takes effect.
    • Adds Expire and Reinstate to the risk acceptance menu and as API actions.

    +6 more show less

    • The Qualys connector now accepts a Host Tags filter to scope discovery to hosts carrying named Qualys asset tags; the filter applies to both detection downloads and host listing, reducing sync scope without downloading out-of-scope hosts.
    • Registers the Tenable Web App Scanning and Rapid7 InsightVM connectors, along with six previously unregistered connectors.
    • A provider can now hold several connections rather than one, with setup scoped to the active connection; Add Repositories now opens directly on the repository step.
    • Reporting is now generally available (GA), removing the BETA label; both the classic and new Report Builder offer one-click migration of existing report templates, and migration works with the Reporting feature flag off.
    • The five View pages now use customizable widget grids, allowing per-page widget arrangement.
    • Table columns can now be resized with widths saved to table preferences; list tables now render per-column loading skeletons while data loads.

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The classic report engine (Report Builder, Report Templates, and Generated Reports) will be removed in v3.3.0 on September 8, 2026.
57. 3.2.200 Aug 17, 2026 · issue 049

    DefectDojo 3.2.200 adds a flat test_type_name field on the finding serializer and scopes Location API access by RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists..

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.200 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.2.200

    • Adds a flat test_type_name field on the finding serializer, surfacing the test type name directly on finding API responses without a nested lookup.
    • Scopes GET /api/v2/location/ by RBAC instead of requiring superuser access, enabling non-superuser roles to query location data within their permissions.

    2 details in Everything

58. docs update Aug 11, 2026 · issue 042

    DefectDojo API gains multi-format report generation endpoints and clearer background-import response documentation.

    ⤢ ⤢ ⤢
    └──▷ TRY IT
    Export all findings you can view as a CSV file — useful for offline triage or stakeholder reporting.
    copy

    $ curl -X POST \
      -H "Authorization: Token <your-api-token>" \
      -H "Content-Type: application/json" \
      -d '{"report_type": "CSV"}' \
      https://<your-instance>/api/v2/findings/generate_report/ \
      -o findings.csv

    Generate an HTML report with executive summary and notes for a single engagement, scoped to only what you are authorized to see.
    copy

    $ curl -X POST \
      -H "Authorization: Token <your-api-token>" \
      -H "Content-Type: application/json" \
      -d '{"report_type": "HTML", "include_executive_summary": true, "include_finding_notes": true}' \
      https://<your-instance>/api/v2/engagements/7/generate_report/ \
      -o engagement_7_report.html

    • Adds POST /api/v2/findings/generate_report/ to generate a findings report across all viewable findings in JSON, HTML, CSV, or Excel format.
    • Adds POST /api/v2/products/{id}/generate_report/, POST /api/v2/engagements/{id}/generate_report/, POST /api/v2/tests/{id}/generate_report/, POST /api/v2/product_types/{id}/generate_report/, and POST /api/v2/endpoints/{id}/generate_report/ for scoped, per-object report generation.
    • Adds Pro-alias report endpoints POST /api/v2/assets/{id}/generate_report/, POST /api/v2/organizations/{id}/generate_report/, and POST /api/v2/location/{id}/generate_report/.
    • Report requests accept optional report_type (default JSON; also HTML, CSV, Excel), include_finding_notes, include_finding_images, include_executive_summary, and include_table_of_contents fields; posting an empty body {} returns a JSON report.
    • CSV and Excel responses are returned as file attachments via Content-DispositionContent-DispositionAn HTTP response header that tells a browser whether to display a file inline or treat it as a download attachment, and under what filename — letting cyber tools control how retrieved files are handled or trigger forced downloads. header, with filenames derived from the scoped object (e.g. product_1_findings.csv, test_42_findings.xlsx); the global findings endpoint produces findings.csv / findings.xlsx.

    +2 more show less

    • Documents the background-import response shape for POST /api/v2/import-scan/ when background_import=true or api_async_import system setting is enabled: response includes background_import, status, findings_parsed, test_id, engagement_id, product_id, product_type_id, and message fields, but omits statistics and deduplication_complete.
    • Documents a polling pattern using GET /api/v2/tests/{test_id}/ to track background import progress via status (Processing, Post Processing - Deduplication, Post Processing - False Positive History, Processed, Failed) and processing fields.

    7 details in Everything

59. docs update Aug 11, 2026 · issue 042

    DefectDojo Pro unifies scanner imports and issue-tracker pushes under a single Connectors hub in the UI.

    • Introduces the Connectors group in the DefectDojo Pro UI sidebar (under the Import header), merging the formerly separate API Connectors and Integrations pages into a single home for all tool connections.
    • Adds Connectors > Upstream Connectors (replacing the old API Connectors entry under Import) for pulling findings and asset inventory in from scanners and cyber tools.
    • Adds Connectors > Downstream Connectors (replacing the old Integrations entry under Settings) for pushing findings out to issue trackers and ticketing systems; currently in Beta for Cloud-hosted DefectDojo Pro instances.
    • Legacy API Connectors and Integrations URLs now automatically redirect to the new Upstream Connectors and Downstream Connectors pages, preserving existing bookmarks and deep links.
    • Each connector is displayed as a tile with logo, description, and action button; a real-time search box filters tiles by tool name within each section.

    +2 more show less

    • Upstream Connectors page adds a header filter with All, Asset/Product, and Finding values to narrow configured and available connectors by type.
    • Configured connectors on the Upstream Connectors page now surface an operational health summary — health status, last operation, and total/mapped record counts — alongside a Manage Configuration menu with Manage Records & Operations, Edit Configuration, and Delete Configuration actions.

    7 details in Everything

60. docs update Aug 11, 2026 · issue 042

    DefectDojo v3.2 adds visual rules engine, threat-intel GA, multi-CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. findings, new report formats, and 60+ new connectors

    ⤢ ⤢ ⤢ ⤢
    • Adds api/v2/findings/generate_report/ endpoint to produce reports as HTML, CSV, and Excel in addition to JSON.
    • Adds set-based deduplication matching Findings on their full set of vulnerability IDs and CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes., including partial/subset matches, plus a new global_locations cross-product deduplication algorithm for shared locations.
    • Adds SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format., CSAF 2.0CSAF 2.0An OASIS open standard for machine-readable vulnerability advisories, defining a JSON schema that lets vendors publish and consumers automate ingestion of patch and disclosure data at scale., and OpenVEXOpenVEXAn open specification and Go library, maintained by the OpenVEX community, for expressing VEX (Vulnerability Exploitability eXchange) statements in a standard JSON format so cyber tools can automate vulnerability triage. interchange-format parsers, plus a Promptfoo (LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. eval and red-teaming) parser.
    • Rules Engine 2.0 (feature flag): build automation rules as visual node graphs reacting to Finding events, with per-run traces and a delivery outbox.
    • Threat Intelligence Enrichment reaches general availability with signed threat-intel bundles, downgrade hysteresis, and new list and dashboard surfaces.

    +12 more show less

    • Adds a threat-intel risk floor based on EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching., KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use., or other exploitability signals (requires Threat Intelligence Enrichment to be enabled).
    • Adds a two-stage KEV/EPSS pipeline projecting the worst score per vulnerability onto Findings, plus bulk cloud-enrichment reads and import-time enrichment.
    • Findings can now carry multiple CWEs across the API, Vue UI, and universal parser; vulnerability IDs are normalized into a first-class Vulnerability entity with ordered references, per-vulnerability KEV/EPSS enrichment columns, and vulnerability aliases.
    • Location drift matching keeps a Finding tracked as its locations change across reimports.
    • Adds one-button migration from classic Jira to Downstream Connectors; the public /assign_product endpoint can map Findings-type records again.
    • JFrog connector now scopes artifact-mode Findings to each artifact's latest build.
    • Notes now support Markdown.
    • Review Claiming (feature flag): lets a requested reviewer claim a Finding review so other eligible reviewers can see it is being handled.
    • Work Assignment (feature flag): assigns Findings and Risk Acceptances to individual people alongside existing group Owners, with a personal My Work queue.
    • Federal Compliance pack (feature flag): FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. POA&MPOA&MA Plan of Action and Milestones: a US federal government document that tracks known security weaknesses in a system, the remediation steps planned, and the deadlines for completing them, required under FISMA compliance. ledger and ConMon deliverables, CMMC Level 2 assessments, and control coverage.
    • Menu 2.0 (feature flag): reorganized Settings menu with a new All Settings hub.
    • Deprecates API-based pull parsers, Tool Type/Tool Configuration, and dbbackup, with end-of-life scheduled for v3.5.0.

    17 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !API-based pull parsers, Tool Type/Tool Configuration, and dbbackup are deprecated with end-of-life scheduled for v3.5.0 — integrations relying on these surfaces will break at that release.
61. 3.2.100 Aug 10, 2026 · issue 042

    DefectDojo 3.2.100 adds location migration tooling, raw CycloneDX VEXCycloneDX VEXA CycloneDX-format document that records which known vulnerabilities in a software bill of materials actually affect a given product, letting cyber tools automate triage by filtering out irrelevant CVEs. preservation, and scoped CI/CD infrastructure permissions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.100 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.2.100

    • Adds migrate_locations_to_endpoints operation — the reverse of the endpoint-to-location conversion — letting teams move location data back to endpoints.
    • Scopes CI/CD Infrastructure detail fields to the matching configuration permission, restricting access to infrastructure metadata by permission level.
    • Preserves raw CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. analysis data on parsed findings, retaining the original vendor-supplied VEX analysis fields rather than discarding them.
    • Scopes Location metadata and tags to the owning product via a database migration, enforcing product-level isolation on location data.
    • Names the POST permission on the risk acceptance API, making the permission model explicit for that endpoint.

    +1 more show less

    • Renders Snyk's raw reachability values instead of a derived boolean, exposing the original Snyk reachability string on findings.

    6 details in Everything

62. docs update Aug 4, 2026 · issue 035

    DefectDojo 3.2 adds per-vulnerability-ID type classification, multiple CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes. per finding, and deprecates six API-pull parsers and Tool Configuration infrastructure.

    └──▷ TRY IT
    Recompute hash codes for Burp Suite DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Scan findings before your next reimport to avoid false closures and duplicates.
    copy

    $ ./manage.py dedupe --parser "Burp Suite DAST Scan" --hash_code_only
    ./manage.py dedupe --parser "Burp Suite DAST Scan" --dedupe_only

    After upgrading a parser that changes how CWEs are derived, re-sync Finding_CWE rows without re-importing scan data.
    copy

    $ ./manage.py migrate_cwe

    • Adds vulnerability_id_type column to Vulnerability_Id — auto-detected from the identifier's prefix (CVE, GHSA, RUSTSEC, etc.), indexed, and backfilled by migration 0282_backfill_vulnerability_id_type; NULL when no non-numeric prefix exists.
    • Adds unique constraint on (finding, vulnerability_id) via migration 0283_unique_finding_vulnerability_id, consolidating any pre-existing duplicate rows.
    • Adds Finding_CWE relationship table (migration 0284_finding_cwe) so a finding can carry multiple CWEs; primary CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. remains on Finding.cwe and additional CWEs are accessible via finding.cwes.
    • Adds optional manage.py migrate_cwe management command to idempotently reconcile Finding_CWE rows from current Finding.cwe values after a parser upgrade.
    • Adds DEDUPLICATION_ALGORITHM_PER_PARSER entries for Snyk Code Scan, Cycognito Scan, and n0s1 Scanner so deduplication now uses their configured HASHCODE_FIELDS_PER_SCANNER fields instead of the legacy algorithm.

    +5 more show less

    • AWS Security Hub parser now sorts resource ARNs before joining them into the finding description, making hash_code stable across re-imports for findings with multiple resources.
    • Yarn Audit parser (Yarn 2) now sorts dependents and tree versions before joining them into component_version and the finding description, eliminating UI reshuffling between imports.
    • Deprecates six API-based pull parsers (BlackDuck API, Bugcrowd API Import, Cobalt.io API Import, Edgescan Scan, SonarQube API Import, Vulners) with removal scheduled for DefectDojo 3.5.0 (November 2026).
    • Deprecates Tool Type and Tool Configuration features along with API endpoints /api/v2/tool_types/, /api/v2/tool_configurations/, and /api/v2/product_api_scan_configurations/; affected endpoints now return an X-Deprecated response header.
    • Deprecates manage.py dbbackup / dbrestore (django-dbbackup integration) with removal in DefectDojo 3.5.0; recommends native pg_dump/pg_restore instead.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Existing Burp Suite DAST Scan findings will not match new imports until hash codes are recomputed; reimporting before running manage.py dedupe --parser "Burp Suite DAST Scan" --hash_code_only will close existing findings as absent and create duplicates.
    • !AWS Security Hub Scan findings that carry two or more resources have a new stable hash_code; the previous value was random per import, so false-positive history, risk acceptance copies, and similar-findings features linked to old hashes are affected.
63. 3.2.0 Aug 3, 2026 · issue 035

    DefectDojo 3.2.0 adds 34+ new parsers (composer, pnpm, dotnet, SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format., CSAF 2.0CSAF 2.0An OASIS open standard for machine-readable vulnerability advisories, defining a JSON schema that lets vendors publish and consumers automate ingestion of patch and disclosure data at scale., OpenVEXOpenVEXAn open specification and Go library, maintained by the OpenVEX community, for expressing VEX (Vulnerability Exploitability eXchange) statements in a standard JSON format so cyber tools can automate vulnerability triage., and 30 CLI tools) plus per-vulnerability KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use./EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. enrichment columns.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.0 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.2.0

    • Adds parsers for composer audit, pnpm audit, dotnet vulnerable packages, and mix_audit output formats.
    • Adds SPDX, CSAFCSAFAn OASIS open standard for distributing machine-readable vulnerability advisories, letting cyber tools automate ingestion and correlation of vendor-issued security disclosures at scale. 2.0, and OpenVEX interchange-format parsers for software bill-of-materialsbill-of-materialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. and VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. ingestion.
    • Adds 30 new command-line cyber tool parsers spanning SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup., host hardening, web/network discovery, and malware categories.
    • Introduces per-vulnerability KEV/EPSS enrichment columns on the Vulnerability entity, surfacing exploit and prioritization data directly on findings.
    • Normalizes Vulnerability_Id into a dedicated Vulnerability entity with ordered references, enabling cross-finding vulnerability correlation.

    +1 more show less

    • Deprecates API-based pull parsers, Tool Type/Configuration, and dbbackup (EOL 3.5.0), signaling the removal timeline from 3.2.0 onward.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !API-based pull parsers, Tool Type/Configuration, and dbbackup are deprecated as of 3.2.0 with end-of-life set at 3.5.0; integrations relying on these surfaces should begin migration now.
64. 3.1.305 Jul 31, 2026 · release notes

    DefectDojo 3.1.305 scopes API and UI endpoints to user/product permissions and adds Federal Compliance documentation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.305 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.1.305

    • Harden user account management authorization
    • Scope the report endpoint prefetch to the requesting user's findings
    • Scope endpoint and host view findings to the requesting user
    • Scope API scan configuration tool selection to authorized tool configurations
    • Align id-keyed questionnaire routes with engagement permissions

    +1 more show less

    • Scope the product endpoint report to the requested product

    6 details in Everything

65. 3.1.303 Jul 30, 2026 · release notes

    Adds Bell Security Advisory integration as a new import format to DefectDojo.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.303 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.1.303

    • Add support for importing findings from Bell Security Advisories via the bell security advisory setting in settings.dist.py / local_settings.py

    1 detail in Everything

66. docs update Jul 30, 2026 · issue 030

    DefectDojo Pro adds 33 new findings connectors, FIPS 140-3FIPS 140-3A US federal standard, maintained by NIST, that defines requirements for cryptographic modules used in government systems. Cyber tools target it to satisfy procurement mandates requiring validated crypto. image variants, Opsgenie/ServiceNow outbound integrators, and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider./LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory./OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. attribute-mapping editors.

    └──▷ USE IT
    Enable FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 140-3 compliant image variants for the connectors service and related components during Helm deployment.
    yaml copy

    fips:
      enabled: true

    • Adds 33 new findings connectors in v3.1.302: AppCheck, CyCognito, Picus, Red Hat Satellite, ImmuniWeb, Trustwave Fusion, Scantist, Black Duck Continuous Dynamic, Finite State, SOOS, Ostorlab, Automox, Qwiet AI, HiddenLayer, Nozomi Networks, NetRise, Uptycs, Klocwork, Parasoft DTP, CI Fuzz, Akto, BigID, Action1, ManageEngine Vulnerability Manager Plus, Zimperium, Dragos, CyberArk Certificate Manager, Calico Cloud, Rapid7 InsightCloudSec, Holm Security, Wazuh SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., Fleet, and Elastic Security.
    • Adds nine parser-backed findings connectors in v3.1.301: Google Artifact Analysis, Zora, PingCastle, Promptfoo, Alert Logic, Cyberwatch, WebInspect Enterprise, TruffleHog, and Chef Automate — each sharing its existing parser mapping and deduplication config with file imports.
    • Connector syncs can now stream findings in chunks, preventing memory exhaustion on very large syncs.
    • Checkmarx One branch tracking now accepts wildcard branch patterns for flexible multi-branch coverage.
    • JFrog Xray gains a repository_filter to scope discovery before per-repository work begins.

    +5 more show less

    • All-records view can now be filtered by record state.
    • Adds optional FIPS 140-3 image variants (CMVP #5247) for the connectors service, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, integrators, and PSIRTPSIRTA Product Security Incident Response Team: an internal group responsible for receiving, investigating, and disclosing vulnerability reports affecting a vendor's products, giving cyber tools a formal channel for coordinated disclosure. advisory engine, deployable via fips.enabled in the Helm chart.
    • Adds Opsgenie and ServiceNow SecOpsSecOpsThe practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. / Vulnerability Response outbound integrators.
    • Adds structured attribute-mapping editors for SAML, LDAP, and OIDC in the Tuner, including OIDC group mapping.
    • Login rate limiter now also applies to the API token authentication endpoint.

    10 details in Everything

67. 3.1.302 Jul 29, 2026 · issue 030

    DefectDojo 3.1.302 adds login rate limiting to API token auth and expands scanner protocol support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.302 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.1.302

    • Applies login rate limiter to the API token authentication endpoint, reducing brute-force exposure on token-based logins.
    • Adds additional scanner protocols to the whitelist, broadening supported import sources.
    • Updates Fortify parsers to extract and populate CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. data from scan results.
    • API now returns HTTP 409 instead of 500 on unique-constraint violations, enabling cleaner client-side error handling.

    4 details in Everything

68. docs update Jul 29, 2026 · issue 029

    DefectDojo adds nine new issue-tracker integrations: Azure DevOps Boards, Bitbucket, Freshservice, GitLab, Linear, PagerDuty, ServiceDesk Plus, Shortcut, and Zendesk.

69. docs update Jul 29, 2026 · issue 029

    DefectDojo Pro adds custom RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. roles, 25+ new findings connectors, native Pro UI auth, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory., and SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. diagnostics.

    └──▷ HOW TO FIND IT
    Enable per-branch sync in a Checkmarx One connector so each tracked branch gets its own engagement in DefectDojo.
    📍In the cloud UI, open the Checkmarx One connector settings and set track_branches to enabled, then save.
    Troubleshoot a misconfigured SSO provider without raising a support ticket.
    📍In the Pro UI, navigate to Settings › Authentication › SSO Diagnostics to view provider logs and error details.
    Configure LDAP authentication for your organization directly from the Tuner.
    📍In the Pro UI, navigate to Tuner › Authentication and add a generic LDAP integration, supplying your server URL, bind credentials, and user search base.
    • Adds user-defined Custom Roles with granular per-object-type permissions, replacing reliance on built-in roles only.
    • Adds 25+ new findings connectors including Fortify (SSC and FoD), HCL AppScan (ASoC and AppScan 360°), Datadog Cloud Security, MobSF, Deepfence ThreatMapper, NeuVector, Lacework/FortiCNAPP, Socket.dev, Bright Security, Aqua Security, Escape, Detectify, Fairwinds Insights, Wallarm, Vanta, NowSecure, FOSSA, Codacy, DeepSource, Beagle Security, Orca, AccuKnox, Halo Security, and Nightfall AI.
    • Unifies connector nomenclature as Upstream and Downstream Connectors, with the ability to request either type from the cloud UI.
    • JFrog Xray connector gains artifact-level record mode with connector-declared parents materialized as asset hierarchy edges (on by default for new installations).
    • Checkmarx One connector adds opt-in per-branch sync via a track_branches toggle, creating a separate engagement per tracked branch.

    +7 more show less

    • Adds Bitbucket, Azure DevOps, and GitHub Enterprise source code connections, plus a Revert action and GitLab remediation support.
    • Login, logout, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., SSO, and password reset now run natively in the Pro UI instead of falling back to the classic UI.
    • Adds a generic LDAP authentication integration configurable from the Tuner.
    • Adds self-serve SSO diagnostics and logs for troubleshooting misconfigured providers without opening a support ticket.
    • ServiceNow integrator gains support for transition-time custom fields and client_credentials authentication, and surfaces integration errors in the UI.
    • Feature flags (including Organization/Asset relabeling) are now readable through the v2 API and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface..
    • Adds Fortify parser V2 that uses the true line number reported by the scanner.

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The legacy feature flag table was retired; feature flags are now database-driven and exposed via the v2 API and MCP.
    • !Configuration permission assignment is now restricted to superusers.
    • !Connector engagement names now include the asset name, which may change existing engagement naming conventions.
70. docs update Jul 27, 2026 · issue 027

    DefectDojo Pro gains Sensei: AI-powered scan-and-fix that opens remediation PRs on GitHub repositories.

    └──▷ HOW TO FIND IT
    Trigger an AI-generated remediation PR directly from a pull request review without leaving GitHub.
    📍Post a /fix comment on an open pull request in your connected GitHub repository to queue a Sensei remediation candidate for approval.
    • New Sensei AI feature scans GitHub repositories and imports results as findings into DefectDojo Pro.
    • Enables LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-generated pull requests that remediate findings, using a preview-first approval workflow so nothing runs until manually approved.
    • Supports triggering fixes from the findings table, from staged auto-fix candidates, or via a /fix comment on a pull request.

    3 details in Everything

71. docs update Jul 27, 2026 · docs issue 004

    DefectDojo Pro gains Sensei: AI-powered scan-and-fix that opens remediation PRs on GitHub repositories.

    └──▷ HOW TO FIND IT
    Trigger an AI-generated remediation PR directly from a pull request review without leaving GitHub.
    📍Post a /fix comment on an open pull request in your connected GitHub repository to queue a Sensei remediation candidate for approval.
    • New Sensei AI feature scans GitHub repositories and imports results as findings into DefectDojo Pro.
    • Enables LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-generated pull requests that remediate findings, using a preview-first approval workflow so nothing runs until manually approved.
    • Supports triggering fixes from the findings table, from staged auto-fix candidates, or via a /fix comment on a pull request.

    3 details in Everything

72. docs update Jul 27, 2026 · issue 027

    DefectDojo Pro adds 20+ new findings connectors, a Linear integrator, per-assignment push filters, and a redesigned feature flags system.

    └──▷ HOW TO FIND IT
    Limit an integrator assignment to push only high-severity active findings, reducing noise in downstream tools like Linear.
    📍In the Pro UI, open an Integrator Assignment, enable per-assignment push filters, set minimum severity to High, and check Active Only, then save.
    Prevent users from editing mitigation dates and status on closed findings to preserve audit integrity.
    ini copy

    DD_EDITABLE_MITIGATED_DATA=False

    • Adds findings connectors for Rapid7 InsightAppSec, Cobalt.io PtaaS, Sonatype IQ (Nexus Lifecycle), Acunetix 360, Mend (WhiteSource), Bugcrowd, Black Duck, Edgescan, Sysdig Secure, Coverity Connect, Harbor, OpenVAS/Greenbone, Nuclei/ProjectDiscovery Cloud, Endor Labs, Prowler, Kubescape/ARMO, Quay+Clair, Intruder.io, and YesWeHack.
    • Adds a ServiceNow CMDBCMDBA Configuration Management Database: a repository that stores records of IT assets and the relationships between them, giving cyber tools a single authoritative source for infrastructure context. asset connector for syncing asset inventory.
    • Registers the Intigriti bug bounty connector and the runZero asset connector in the Pro UI.
    • Adds a Linear integrator for pushing findings directly to Linear.
    • Enables requesting a new connector directly from the cloud UI.

    +10 more show less

    • Adds per-assignment push filters on integrator assignments, allowing minimum severity and active-only constraints on what gets pushed.
    • Introduces a cloud dispatch guard, retroactive re-staging of auto-fixes, and a per-row actions menu in the findings list.
    • Redesigns feature flags into a two-tier, metadata-driven system with a dedicated Feature Flags admin page.
    • Adds a configurable OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. username claim with hardened SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. user creation.
    • Introduces DD_EDITABLE_MITIGATED_DATA setting to control whether mitigation data is editable.
    • CrowdStrike Spotlight connector now derives its severity floor from structured sync filters.
    • Export options now prefillprefillThe first phase of inference, where the model reads the whole prompt in parallel before producing its first token. It drives time-to-first-token; decode is the token-by-token phase after it. from the active table preference; AI menu flattened into top-level Sensei, Model Settings, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. links.
    • Scan-import cleanup now streams files and fails loudly on error.
    • CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. and EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. columns now expose numeric filter operators in the findings table.
    • Metric colors in the Vue UI are now configurable per instance.

    15 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Request Review is now gated on Finding_View instead of Finding_Edit.
73. docs update Jul 27, 2026 · docs issue 004

    DefectDojo Pro adds 20+ new findings connectors, a Linear integrator, per-assignment push filters, and a redesigned feature flags system.

    └──▷ HOW TO FIND IT
    Limit an integrator assignment to push only high-severity active findings, reducing noise in downstream tools like Linear.
    📍In the Pro UI, open an Integrator Assignment, enable per-assignment push filters, set minimum severity to High, and check Active Only, then save.
    Prevent users from editing mitigation dates and status on closed findings to preserve audit integrity.
    ini copy

    DD_EDITABLE_MITIGATED_DATA=False

    • Adds findings connectors for Rapid7 InsightAppSec, Cobalt.io PtaaS, Sonatype IQ (Nexus Lifecycle), Acunetix 360, Mend (WhiteSource), Bugcrowd, Black Duck, Edgescan, Sysdig Secure, Coverity Connect, Harbor, OpenVAS/Greenbone, Nuclei/ProjectDiscovery Cloud, Endor Labs, Prowler, Kubescape/ARMO, Quay+Clair, Intruder.io, and YesWeHack.
    • Adds a ServiceNow CMDBCMDBA Configuration Management Database: a repository that stores records of IT assets and the relationships between them, giving cyber tools a single authoritative source for infrastructure context. asset connector for syncing asset inventory.
    • Registers the Intigriti bug bounty connector and the runZero asset connector in the Pro UI.
    • Adds a Linear integrator for pushing findings directly to Linear.
    • Enables requesting a new connector directly from the cloud UI.

    +10 more show less

    • Adds per-assignment push filters on integrator assignments, allowing minimum severity and active-only constraints on what gets pushed.
    • Introduces a cloud dispatch guard, retroactive re-staging of auto-fixes, and a per-row actions menu in the findings list.
    • Redesigns feature flags into a two-tier, metadata-driven system with a dedicated Feature Flags admin page.
    • Adds a configurable OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. username claim with hardened SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. user creation.
    • Introduces DD_EDITABLE_MITIGATED_DATA setting to control whether mitigation data is editable.
    • CrowdStrike Spotlight connector now derives its severity floor from structured sync filters.
    • Export options now prefillprefillThe first phase of inference, where the model reads the whole prompt in parallel before producing its first token. It drives time-to-first-token; decode is the token-by-token phase after it. from the active table preference; AI menu flattened into top-level Sensei, Model Settings, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. links.
    • Scan-import cleanup now streams files and fails loudly on error.
    • CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. and EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. columns now expose numeric filter operators in the findings table.
    • Metric colors in the Vue UI are now configurable per instance.

    15 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Request Review is now gated on Finding_View instead of Finding_Edit.
74. 3.1.300 Jul 27, 2026 · issue 027

    DefectDojo 3.1.300 adds a Fortify parser v2, tighter API permission controls, and a case-insensitive index on Vulnerability ID.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.300 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.1.300

    • New Fortify parser v2 prefers true source line numbers for more accurate finding location reporting.
    • Adds case-insensitive expression index on Vulnerability_Id.vulnerability_id for faster, case-insensitive vulnerability lookups.
    • Restricts configuration permission assignment to superusers only in the user API, tightening privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. controls.
    • Scopes location and endpoint reference writes to authorized products, enforcing product-level authorization on those API writes.
    • Extends user serializer validation to identity and permission fields for stricter input validation.

    +1 more show less

    • Makes notes read-only on the test create serializer, preventing unintended note mutations at creation time.

    6 details in Everything

75. docs update Jul 21, 2026 · issue 021

    DefectDojo 3.1 adds granular deduplication execution modes for import/reimport and a configurable OS promo banner setting.

    └──▷ TRY IT
    Use async_wait mode on a single reimport API call so the response statistics accurately reflect deduplicated findings — useful in CI pipelines that parse the returned finding counts.
    copy

    $ curl -X POST 'https://<defectdojo>/api/v2/reimport-scan/' \
      -H 'Authorization: Token <token>' \
      -F 'scan_type=Trivy Scan' \
      -F 'test=<test_id>' \
      -F 'deduplication_execution_mode=async_wait' \
      -F 'file=@trivy-results.json'

    Suppress the promotional banner and its outbound request in a self-hosted air-gapped environment.
    yaml copy

    DD_OS_MESSAGE_ENABLED=False

    Extend the async_wait deadline to 120 seconds for large scans with slow Celery workers, preventing premature async fallback.
    yaml copy

    DD_DEDUPLICATION_ASYNC_WAIT_TIMEOUT=120

    • New deduplication_execution_mode setting (per-user profile and per-request override) controls whether import/reimport deduplication runs async, async-with-wait, or fully inline sync.
    • New async_wait mode makes the import/reimport API response wait for deduplication to complete, so response statistics and scan_added notifications reflect the deduplicated finding count.
    • New deduplication_complete boolean field in import/reimport API responses indicates whether deduplication had finished before the response was produced.
    • New DD_DEDUPLICATION_ASYNC_WAIT_TIMEOUT environment variable sets the maximum seconds the request waits in async_wait mode before degrading to standard async (default 60 seconds).
    • New DD_OS_MESSAGE_ENABLED environment variable (default True) controls whether the open-source Upgrade to Pro promotional banner is shown and its associated outbound fetch request is made.

    5 details in Everything

76. docs update Jul 21, 2026 · issue 021

    DefectDojo Pro adds nested Asset Hierarchy (Beta): parent/child relationships between Products with scoped RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. and visual diagram.

    └──▷ HOW TO FIND IT
    Enable the Asset Hierarchy feature on a self-hosted Pro instance so teams can create parent/child Asset relationships.
    📍In the DefectDojo Pro console, go to Settings › Feature Flags and enable Asset Hierarchy.
    • Enables parent/child relationships between Assets (formerly Products), allowing unlimited nesting to model branches, mono-repo components, or isolated pen-test groups.
    • Adds an Asset Hierarchy diagram view — filterable table of Assets that renders an interactive hierarchy diagram with zoom, drag, and node-level actions.
    • Supports per-node actions in the diagram: navigate to Asset view, edit Asset, add a Child Asset, change Parent Asset, or remove a parent relationship.
    • Introduces optional UI relabeling: Product Type → Organization and Product → Asset throughout the UI, controlled separately from the hierarchy feature flag.
    • On-Premise deployments can enable label changes via the DD_ENABLE_V3_ORGANIZATION_ASSET_RELABEL environment variable without affecting API endpoints or field names.

    +1 more show less

    • Asset Hierarchy feature flag is togglable by superusers from Settings > Feature Flags on both Cloud and On-Premise instances.

    6 details in Everything

77. 3.1.101 Jul 15, 2026 · issue 017

    Adds DD_WATSON_SEARCH_ENABLED toggle to control Watson search indexing in DefectDojo.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.101 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.1.101

    └──▷ USE IT
    Disable Watson search indexing to reduce database load in environments where full-text search is not needed.
    ini copy

    DD_WATSON_SEARCH_ENABLED=False

    • New DD_WATSON_SEARCH_ENABLED setting in settings.dist.py / local_settings.py to gate Watson search indexing on or off.

    1 detail in Everything

78. 3.1.100 Jul 13, 2026 · issue 015

    DefectDojo 3.1.100 adds FTS+trigram global search indexes, Jira close/reopen transition fields, and exposes dedupe policy on the Test API.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.100 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.1.100

    • Adds full-text search (FTS) and trigram GIN indexes for global search, requiring a settings and database migration update.
    • Supports custom fields on Jira close/reopen transitions via a new database migration.
    • Exposes the effective dedupe matching policy on the Test API endpoint.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The FTS + trigram GIN indexes for global search require changes to settings.dist.py / local_settings.py and a database migration — existing deployments must apply both before upgrading.
79. 3.1.0 Jul 6, 2026 · issue 008

    DefectDojo 3.1.0 adds new parsers, JIRA multi-component support, AES-256-GCMAES-256-GCMAES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. credential encryption, and import/deduplication sync control.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.0 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.1.0

    • Adds Garak (NVIDIA LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. vulnerability scanner) parser for AI/LLM security findings.
    • Adds Govulncheck Scanner V2 parser for Go vulnerability results.
    • Adds PICUS Breach and Attack Simulation CSV parser.
    • Supports multiple JIRA components in project settings.
    • Supports CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. vector parsing and severity derivation in the cargo-audit parser.

    +14 more show less

    • Includes analysis.detail from Dependency Track FPF in finding descriptions.
    • Modernizes Tool Config credential encryption to AES-256-GCM.
    • New setting allows import/reimport to wait for deduplication to complete before returning.
    • New setting allows disabling and dismissing the open source message banner.
    • Adds global required fields notice for WCAG H90 accessibility compliance.
    • Shows vulnerability IDs in PDF Reports.
    • New UI: animates collapse panels in the new UI.
    • New UI: smooth filter category accordion in the new UI.
    • New UI: folds Finding Groups under Findings in the sidebar.
    • Performance: batch Vulnerability_Id inserts during import for faster ingestion.
    • Performance: batch BurpRawRequestResponse inserts during import.
    • Performance: adds SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. expiration date index for global finding list queries.
    • Performance: adds partial indexes for authorized finding-list queries.
    • Performance: drops blanket DISTINCT from FindingViewSet list for faster API responses.

    19 details in Everything

80. 3.0.200 Jun 29, 2026 · release notes

    DefectDojo 3.0.200 adds partial indexes and a DISTINCT-drop for faster finding-list queries at scale.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.200 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.0.200

    • Adds partial indexes for authorized finding-list queries to speed up permission-scoped lookups.
    • Adds performance indexes (Ree/perf indexes) via database migration to improve query efficiency.
    • Drops blanket DISTINCT from FindingViewSet list API to reduce query overhead on large finding datasets.

    3 details in Everything

81. 3.0.100 Jun 22, 2026 · release notes

    DefectDojo 3.0.100 adds Govulncheck V2 and PICUS BAS parsers, CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. vector parsing for Cargo Audit, and Endpoint_Status API updates.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.100 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.0.100

    • Adds Govulncheck Scanner V2 parser for Go vulnerability scanning results.
    • Adds PICUS Breach and Attack Simulation CSV parser for BAS tool ingestion.
    • Parses CVSS vectors and derives severity from Cargo Audit findings.
    • Updates Endpoint_Status API with new enhancements.

    4 details in Everything

82. 3.0.100 Jun 22, 2026 · issue 001

    DefectDojo 3.0.100 adds Govulncheck V2 and PICUS BAS parsers plus CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. parsing for cargo-audit findings.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.100 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.0.100

    • Adds Govulncheck Scanner V2 parser for Go vulnerability scan results.
    • Adds PICUS Breach and Attack Simulation CSV parser for BAS findings ingestion.
    • Adds CVSS vector parsing and severity derivation for cargo-audit findings.

    3 details in Everything

83. 3.0.0 Jun 15, 2026 · release notes

    DefectDojo 3.0 ships a Tailwind UI rebuild, two new parsers, localization additions, and expanded API filters.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.0 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.0.0

    └──▷ TRY IT
    Filter risk acceptances created within a date range via the API to audit recent approvals.
    copy

    $ curl -H 'Authorization: Token <token>' 'https://<defectdojo>/api/v2/risk_acceptances/?created_after=2025-01-01&created_before=2025-06-30'

    Import Xygeni JSON results (SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., or Secrets) into an engagement.
    copy

    $ curl -X POST 'https://<defectdojo>/api/v2/import-scan/' \
      -H 'Authorization: Token <token>' \
      -F 'scan_type=Xygeni Scan' \
      -F 'file=@xygeni_results.json' \
      -F 'engagement=<engagement_id>'

    Import Alert Logic CSV findings into an existing engagement.
    copy

    $ curl -X POST 'https://<defectdojo>/api/v2/import-scan/' \
      -H 'Authorization: Token <token>' \
      -F 'scan_type=Alert Logic CSV' \
      -F 'file=@alertlogic_export.csv' \
      -F 'engagement=<engagement_id>'

    • Adds a full Tailwind CSS UI rebuild (Dojo V3) with updated legacy authorization and open-source surface changes.
    • New Alert Logic CSV parser for importing Alert Logic findings.
    • New Xygeni JSON parser supporting SAST, SCA, and Secrets finding types.
    • GitHub Vulnerability parser now sets the fix_available field on findings.
    • Exposes created_before, created_after, updated_before, and updated_after date filters on the Risk Acceptance API.

    +9 more show less

    • Adds mitigation finding filters to the findings API and UI.
    • Import-time tags are now applied per batch before post-processing; old findings are not re-tagged.
    • Supports requesting peer review from yourself.
    • Adds Brazilian Portuguese (pt-BR) and Russian locale translations.
    • Jira integration now checks statusCategory instead of the resolution field to determine issue status.
    • Scopes report views to only the requesting user's authorized products.
    • Applies object-level permission checks to finding duplicate API actions.
    • KSA Security Advisory source added to the advisory database.
    • Cascade delete gains a preview_only parameter for dry-run previews.

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Credential Manager is removed (deprecated in 2.57, EOL in 2.59); any configuration or API usage relying on Credential Manager will break.
    • !Stub Findings are removed (deprecated in 2.57, EOL in 2.59); workflows using Stub Findings will break.
    • !Questionnaire API endpoints are removed (deprecated in 2.56, EOL in 2.59); integrations calling those endpoints will break.
    • !The sync= dispatch kwarg is renamed to force_sync=; callers passing sync= will break.
    • !V3 functionality and organization/asset relabeling are now enabled by default via settings.dist.py; existing deployments relying on the old defaults will see changed behavior.
    • !A database migration is required; the migration refactors and removes deprecated features while preserving database state — upgrading without running migrations will break the application.
84. 3.0.0 Jun 15, 2026 · issue 001

    DefectDojo 3.0 ships a full Tailwind UI rebuild, new parsers, localization, and removes EOL features.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.0 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 3.0.0

    • New Tailwind-based UI rebuild with legacy authorization removal and open-source surface changes (Dojo V3).
    • Adds Alert Logic CSV parser for importing Alert Logic findings.
    • Adds Xygeni JSON parser supporting SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., and Secrets finding types.
    • Adds Korean Security Advisory (KSA) parser support.
    • Sets fix_available field on findings from the GitHub Vulnerability parser.

    +13 more show less

    • Exposes created_before, created_after, updated_before, and updated_after date filters on the Risk Acceptance API.
    • Adds mitigation finding filters and complete mitigation filter support.
    • Adds Brazilian Portuguese (pt-BR) and Russian locale translations.
    • Allows users to request peer review from themselves.
    • Uses statusCategory instead of the resolution field for Jira issue status checks.
    • Applies import-time tags per batch before post-processing; no longer tags pre-existing findings.
    • Removes Credential Manager (deprecated in 2.57, EOL in 2.59).
    • Removes Stub Findings (deprecated in 2.57, EOL in 2.59).
    • Removes questionnaire API endpoints (deprecated in 2.56, EOL in 2.59).
    • Scopes report views to only the requesting user's authorized products.
    • Applies object-level permission checks to finding duplicate API actions.
    • Uses a dedicated permission class for the BurpRawRequestResponseViewSet API.
    • Enables V3 functionality and organization/asset relabeling by default in settings.

    18 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Credential Manager feature has been removed (deprecated in 2.57, EOL in 2.59); any setups relying on it will break after upgrading to 3.0.0.
    • !Stub Findings have been removed (deprecated in 2.57, EOL in 2.59); any setups relying on them will break after upgrading to 3.0.0.
    • !Questionnaire API endpoints have been removed (deprecated in 2.56, EOL in 2.59); any integrations using those endpoints will break after upgrading to 3.0.0.
    • !The sync= dispatch kwarg has been renamed to force_sync=; any code or configuration passing sync= will break.
    • !Legacy authorization and certain OS surface areas have been removed as part of the Dojo V3 UI rebuild; setups depending on those surfaces will break.
85. 2.58.3 May 18, 2026 · release notes

    DefectDojo 2.58.3 scopes report views and duplicate API actions to authorized products only.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.58.3 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 2.58.3

    • Scopes report views to only the requesting user's authorized products, preventing exposure of unauthorized product data in reports.
    • Anchors location finding reference authorization to the finding's own product for consistent access control.
    • Applies object-level permission checks to finding duplicate API actions, ensuring users can only act on duplicates within their authorized scope.
    • Speeds up the migrate_endpoints_to_locations operation with ~14× fewer database queries, enabling practical use on larger datasets.

    4 details in Everything

86. 2.58.2 May 11, 2026 · release notes

    DefectDojo 2.58.2 adds KSA Security Advisory support and tightens Burp permissions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.58.2 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 2.58.2

    • Adds KSA Security Advisory integration via new settings in settings.dist.py / local_settings.py.
    • Introduces a dedicated permission class for BurpRawRequestResponseViewSet, enabling finer-grained API access control over Burp raw request/response data.

    2 details in Everything

87. 2.58.0 May 4, 2026 · release notes

    DefectDojo 2.58.0 adds Qualys VMDR CSV parser, WatchGuard and CNNVD vuln ID support, RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. on risk acceptance, and a centralized banner system.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.58.0 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 2.58.0

    • New Qualys VMDR CSV parser for importing vulnerability scan results.
    • New WatchGuard Security Advisory parser for vulnerability ID enrichment.
    • Adds Mozilla Foundation Security Advisory as a supported vulnerability ID source.
    • Adds CNNVD (China National Vulnerability Database) as a supported vulnerability ID source.
    • Govulncheck parser now surfaces fix_available and fix_version fields in findings.

    +13 more show less

    • RBAC enforcement added to accept_risks API endpoints, restricting risk acceptance by user role.
    • New centralized banner system with open-source messaging support in the UI.
    • Import/reimport API now validates consistency between ID-based and name-based identifiers.
    • API now enforces permission checks when moving engagements between products.
    • Create-path notifications dispatched asynchronously, reducing slow POST latency.
    • SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. breach notification format and display improved in the UI.
    • Bulk delete findings now supports an extension hook for customization.
    • More parameters stored in import settings for persistent configuration.
    • Invicti parser updated to use FirstSeenDate for more accurate first-seen tracking.
    • Risk acceptance reactivation behavior changed for previously risk-accepted findings.
    • Pickle removed from forms and Celery serializer (settings change required).
    • MAX_ZIP_* limits moved to settings.dist.py / local_settings.py for operator control.
    • Database: locations performance improvements via migration.

    18 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Pickle is removed from forms and the Celery serializer; existing setups relying on pickle-based serialization in Celery will break and require reconfiguration.
    • !MAX_ZIP_* settings are moved to settings.dist.py / local_settings.py; any hardcoded or previously defaulted values must now be explicitly set there.
88. 2.57.3 Apr 27, 2026 · release notes

    DefectDojo 2.57.3 adds WatchGuard Security Advisory parser, async path notifications, and improved SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. breach display.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.57.3 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 2.57.3

    • Adds WatchGuard Security Advisory parser for importing WatchGuard vulnerability advisories.
    • Dispatches create-path notifications asynchronously, reducing POST request latency.
    • Improves SLA breach notification format and display in the UI.

    3 details in Everything

89. 2.57.2 Apr 20, 2026 · release notes

    DefectDojo 2.57.2 adds govulncheck fix metadata, Mozilla security advisories, RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for risk acceptance, and a centralized banner system.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.57.2 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 2.57.2

    • Adds fix_available and fix_version fields to govulncheck parser output, surfacing remediation metadata directly in findings.
    • Adds Mozilla Foundation security advice lookup to vulnerability ID enrichment.
    • Adds a centralized banner system with OS messaging support, configurable via settings.dist.py / local_settings.py and visible in the UI.
    • Enforces RBAC on accept_risks API endpoints, restricting risk acceptance to authorized roles.
    • Validates consistency between ID-based and name-based identifiers during import/reimport via the API.

    +1 more show less

    • Adds permission checks when moving engagements between products.

    6 details in Everything

90. 2.57.1 Apr 13, 2026 · release notes

    DefectDojo 2.57.1 adds CNNVD vulnerability ID support and persists more import settings in the UI.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.57.1 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 2.57.1

    • Adds CNNVD as a supported vulnerability ID source via the new CNNVD vulnid setting.
    • Stores more parameters in import settings so UI-configured import options are retained across sessions.

    2 details in Everything

91. 2.57.0 Apr 6, 2026 · release notes

    DefectDojo 2.57.0 adds a System Status page, two new parsers, JFrog Xray API config, endpoint sorting, and several API/UI enhancements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.57.0 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 2.57.0

    └──▷ TRY IT
    Filter findings by an exact title match to quickly isolate a specific vulnerability across all products.
    copy

    $ curl -s -H 'Authorization: Token <api_token>' 'https://<defectdojo_host>/api/v2/findings/?exact_title=SQL+Injection+in+login+form'

    Sort the endpoints list by active findings count to prioritize the most exposed hosts.
    copy

    $ curl -s -H 'Authorization: Token <api_token>' 'https://<defectdojo_host>/api/v2/endpoints/?ordering=-active_findings_count'

    • New System Status page showing Celery queue monitoring with the ability to purge queues (UI + API).
    • New IriusRisk threat model CSV parser for importing threat model data.
    • New Orca Security CSV and JSON parser for importing Orca findings.
    • New JFrog Xray API Summary Artifact Scan configuration support.
    • Adds exact_title filter to the findings API for precise title matching.

    +17 more show less

    • Allows sorting endpoints by active findings count via API and UI.
    • Adds a notes endpoint to the RiskAcceptanceViewSet API.
    • Loads JIRA custom fields as JSON via the API.
    • New Quick verify menu item and keyboard shortcuts to verify/close findings in the UI.
    • New Remove from Finding bulk action on the View Finding page.
    • Adds additional_banners support to the base UI template for custom alerting.
    • Dependency Track parser now supports CVSS4, CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. vectors, references, and publish date.
    • Gosec parser now parses cwe_id and swaps references where possible.
    • Twistlock parser now records packagePath to identify where a CVE is found.
    • AWS Security Hub parser now extracts CVSS v3/v4 scores from Inspector findings.
    • Anchore Grype parser adds file-path-based detail mode.
    • Adds scan_date to import settings when overridden.
    • Enhances engagement close/reopen actions with permission checks.
    • Adds authorization check to the link_engagement API action.
    • Adds deprecation notices for Credential Manager and Stub Findings in the API.
    • Adds PluggableContextTask for settings-based Celery task context managers.
    • Batch endpoint creation and status updates during import/reimport for improved performance.

    22 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The credentials field is dropped from System_Settings (database migration required).
    • !PostgreSQL 18 users with existing volumes must follow upgrade guidance due to a PGDATA path change.
92. 2.56.4 Mar 30, 2026 · release notes

    DefectDojo 2.56.4 adds JFrog Xray API Summary Artifact Scan support and a pluggable Celery task context manager.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.56.4 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 2.56.4

    • Adds JFrog Xray API Summary Artifact Scan configuration for scanner integration.
    • Adds PluggableContextTask for settings-based Celery task context managers, enabling customizable task execution contexts.
    • Adds scan_date to import settings when overridden, surfacing the effective scan date through the import pipeline.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !A database migration is required due to the removal of django-linear-migrations.
93. 2.56.3 Mar 23, 2026 · release notes

    DefectDojo 2.56.3 adds Twistlock package path parsing to pinpoint CVE locations in findings.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.56.3 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 2.56.3

    • Parses packagePath from Twistlock scan results to record the exact file path where a CVE is found.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The credentials field is dropped from System_Settings; any configuration or integrations reading that field will break on upgrade.
94. 2.56.2 Mar 16, 2026 · release notes

    DefectDojo 2.56.2 adds endpoint sorting, JIRA JSON custom fields, a notes API for risk acceptances, and new bulk-action UI controls.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.56.2 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 2.56.2

    └──▷ TRY IT
    Add a note to a risk acceptance programmatically without navigating the UI.
    copy

    $ curl -s -X POST -H 'Authorization: Token <your_api_token>' -H 'Content-Type: application/json' -d '{"entry": "Reviewed and accepted per policy."}' 'https://<defectdojo_host>/api/v2/risk_acceptances/<id>/notes/'

    • Supports sorting endpoints by active findings count in both the UI and API.
    • Loads JIRA custom fields as JSON via the API, enabling richer JIRA integration data.
    • Adds a notes endpoint to the RiskAcceptanceViewSet for programmatic note management.
    • Adds authorization/permission checks to engagement close, reopen, and link actions.
    • Adds a Remove from Finding bulk action on the View Finding page.

    +1 more show less

    • Adds additional_banners support to the base UI template for custom banner injection.

    6 details in Everything

95. 2.56.0 Mar 2, 2026 · release notes

    DefectDojo 2.56.0 adds a Scheduled engagement status, Trivy enrichment fields, fix_version support in Generic Import, and Dependency Track UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. tracking.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.56.0 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 2.56.0

    • Adds Scheduled status to engagement models, enabling pre-planned engagement tracking.
    • Adds remediation, messages, category, and publishedDate field mappings to the Trivy Operator parser.
    • Adds fix_version support to the Generic Findings Import parser.
    • Stores Dependency Track UUID into unique_id_from_tool (previously used vuln_id_from_tool) for more accurate finding identity.
    • Adds LocationData support for parsers via database migration.

    +1 more show less

    • Optimizes language import process with bulk creation and improved validation.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Dependency Track parser now stores the DT UUID into unique_id_from_tool instead of vuln_id_from_tool, which may affect deduplication and finding matching for existing Dependency Track findings.
96. 2.55.2 Feb 9, 2026 · release notes

    DefectDojo 2.55.2 adds finding group JIRA sync, a new has_any_jira_issue filter, and expanded JIRA keep-in-sync for import/reimport flows.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.55.2 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 2.55.2

    └──▷ TRY IT
    Filter findings that have at least one linked JIRA issue via the API — useful for auditing JIRA coverage across a product.
    copy

    $ curl -X GET 'https://<defectdojo>/api/v2/findings/?has_any_jira_issue=true' -H 'Authorization: Token <token>'

    • Adds finding group support to the jira_status_reconciliation management command, enabling bulk JIRA status reconciliation across finding groups.
    • Exposes has_any_jira_issue filter on the Findings API, allowing queries to scope findings by JIRA issue linkage.
    • Expands JIRA keep findings in sync feature to cover import/reimport workflows and API interactions.

    3 details in Everything

97. 2.55.1 Feb 5, 2026 · release notes

    DefectDojo 2.55.1 automatically sets last-reviewed date and reviewer when a note is added.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.55.1 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 2.55.1

98. 2.55.0 Feb 3, 2026 · release notes

    DefectDojo 2.55.0 adds Cloudflare Insights and enhanced Trivy/Google Cloud parsers, task queue visibility, and a Report Builder submenu.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.55.0 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 2.55.0

    └──▷ HOW TO FIND IT
    Monitor how many async background tasks are queued without leaving DefectDojo — check the queue depth indicator now visible in the UI.
    📍In the DefectDojo UI, navigate to the top navigation bar where the async task queue count badge is now displayed next to the background task indicator.
    • Adds new Cloudflare Insights parser (both JSON and initial implementation) for ingesting Cloudflare security findings.
    • Adds Trivy misconfiguration fields to the Trivy parser for richer finding detail.
    • Advances Google Cloud Artifact Scan parser to extract and store vulnerability IDs (vulnid).
    • Includes TruffleHog verified secret information in generated reports.
    • Shows the number of tasks waiting in the async queue in the UI for operational visibility.

    +8 more show less

    • Adds a Report Builder submenu in the UI with improved form validation error messages.
    • Adds Permissions-PolicyPermissions-PolicyAn HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. header settings for improved browser security posture control.
    • Adds pghistory tracking for tag fields, enabling audit history on tag changes.
    • Adds additional fields to the AssetSerializer and patches Asset/Organizations API endpoints with improved permission checking.
    • Enforces readonly name field for Test_Type instances via dynamic serializer selection in the API.
    • Updates file upload field to accept dynamic file types with validation for supported extensions.
    • Enables push-to-Jira during Import/Reimport when findings are not grouped.
    • Enhances risk acceptance authorization checks for tighter access control.

    13 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Product Grade configuration has been removed (database migration included).
99. 2.54.3 Jan 26, 2026 · release notes

    DefectDojo 2.54.3 adds Trivy misconfiguration fields, dynamic file upload validation, and Permissions-PolicyPermissions-PolicyAn HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. header settings.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.54.3 https://github.com/DefectDojo/django-DefectDojo.git
    # already have the repo? check out this version:
    $ git checkout 2.54.3

    • Adds Trivy misconfiguration fields to enrich findings imported from Trivy scans.
    • Updates file upload field to accept dynamic file types with validation for supported extensions.
    • Adds Permissions-Policy header settings to settings.dist.py / local_settings.py.

    3 details in Everything

100. 2.54.2 Jan 20, 2026 · release notes

     DefectDojo 2.54.2 adds Cloudflare Insights JSON parsing, expanded Asset API fields, and a Report Builder submenu.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.54.2 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.54.2

     • Adds JSON support to the Cloudflare Insights parser for ingesting Cloudflare scan results.
     • Adds additional fields to the AssetSerializer, expanding what asset data is exposed via API.
     • Adds Asset/Organizations API endpoints with PATCH support and permission checking.
     • Enforces a readonly name field for Test_Type instances and adds dynamic serializer selection in the API.
     • Adds a Report Builder submenu and improves form validation error messages in the UI.

     +1 more show less

     • Pushes findings to Jira on Import/Reimport when findings are not grouped.

     6 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The name field on Test_Type instances is now enforced as readonly via the API; any integration writing to this field will break.
101. 2.54.1 Jan 12, 2026 · release notes

     DefectDojo 2.54.1 adds vuln ID parsing for Google Cloud Artifact scans and a new Cloudflare Insights parser.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.54.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.54.1

     • Adds vuln ID (vulnid) parsing to the Google Cloud Artifact Scan parser.
     • New Cloudflare Insights parser for ingesting Cloudflare security findings.

     2 details in Everything

102. 2.54.0 Jan 5, 2026 · release notes

     DefectDojo 2.54.0 adds PingCastle and Prowler parsers, admin API token reset, batch reimport, AND-logic tag filtering, and pghistory audit logging.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.54.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.54.0

     └──▷ HOW TO FIND IT
     Export findings with the new status and notes columns for offline triage or reporting.
     📍In the DefectDojo UI, navigate to a Product or Engagement's findings list, then use Findings › Export › CSV (or Excel) — the exported file now includes status and notes columns automatically.
     Filter findings to only those matching ALL specified tags simultaneously using the new AND logic in the UI.
     📍In the DefectDojo UI, go to Findings, open the Tag filter, select multiple tags — results now return only findings that have ALL selected tags (AND logic).
     • New PingCastle vulnerability parser for ingesting PingCastle scan results.
     • New Prowler scan parser for cloud security posture findings.
     • Adds status and notes columns to CSV/Excel finding exports.
     • Enables admins to reset any user's API tokens via the API and UI.
     • Reimport now matches findings in configurable batches for better scalability.

     +14 more show less

     • Switches audit logging to pghistory, adding per-process and per-Celery-task context.
     • UI tag filtering now supports AND logic across multiple tags.
     • Adds ICSA vulnerability ID support.
     • Adds test_type mismatch validation during reimport to catch scan type errors.
     • Adds fix_available field to Legitify parser output.
     • Metrics now use mitigated_date for closed findings in reports and the UI.
     • BurpRawRequestResponseViewSet gains permission classes and a refined queryset.
     • Adds management command to reimport sample scans for testing and validation.
     • Allows configuring tag truncate length via settings.dist.py / local_settings.py.
     • Twistlock parser now uses discoveredDate for the finding date.
     • SonarQube parser now uses creationDate for the finding date.
     • Helm HPA configuration is now more Argo-friendly.
     • Adds startup checker for the broker service.
     • Finding template refactored with API, UI, and database migration changes.

     19 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Finding template refactor (#13946) includes a database migration — existing finding template data structures are changed; review the upgrade notes before migrating.
     • !Audit log backend switched to pghistory (#13587) with a database migration — the previous audit log backend is replaced; existing audit records may not be accessible via the new backend without migration.
     • !The djnago.mediaPersistentVolume.fsGroup Helm value is dropped (#13813) — Helm deployments using this key will fail on upgrade.
103. 2.53.5 Dec 29, 2025 · release notes

     DefectDojo 2.53.5 introduces reimport validation and fixes import parsers for BlackDuck, Tenable, and CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence..

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.53.5 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.53.5

     • Adds test_type mismatch validation during reimport to prevent data inconsistency
     • Updates Docker image management strategy from dependabot to renovate

     2 details in Everything

104. 2.53.4 Dec 22, 2025 · release notes

     DefectDojo 2.53.4 adds configurable tag truncation, Argo-friendly HPA, and metrics now use mitigated_date for closed findings.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.53.4 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.53.4

     • Adds configurable tag truncate length via settings.dist.py / local_settings.py.
     • Metrics now use mitigated_date for closed findings in both the API and UI, giving more accurate closure timestamps.
     • Makes Helm HPA configuration more Argo-friendly for GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. deployments.
     • Adds a start-up checker for the broker to verify connectivity on launch.
     • Twistlock parser now uses discoveredDate for the finding date.

     +1 more show less

     • SonarQube parser now uses creationDate for the finding date.

     6 details in Everything

105. 2.53.2 Dec 15, 2025 · release notes

     DefectDojo 2.53.2 adds ICSA vulnerability ID support and a management command to reimport sample scans.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.53.2 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.53.2

     • Adds ICSA vulnerability ID support via new settings.dist.py / local_settings.py configuration.
     • New management command to reimport sample scans for testing and validation workflows.
     • Beautified Rubocop JSON output format for improved readability.

     3 details in Everything

106. 2.53.1 Dec 8, 2025 · release notes

     DefectDojo 2.53.1 adds AND logic for tag filtering and a new fix_available field for Legitify findings.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.53.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.53.1

     └──▷ HOW TO FIND IT
     Use AND tag filtering to narrow findings to those matching all selected tags at once — useful for triaging findings that belong to multiple categories or teams.
     📍In the Findings list, apply multiple tag filters; the UI now evaluates them with AND logic so only findings matching all selected tags are returned.
     • Adds AND logic for tag filtering in the UI, enabling more precise finding searches across multiple tags simultaneously.
     • Adds fix_available field to Legitify scan report imports, surfacing remediation availability directly in findings.

     2 details in Everything

107. 2.53.0 Dec 1, 2025 · release notes

     DefectDojo 2.53.0 adds new parsers, fix_available fields across scanners, JIRA retry/rate limiting, OpenReports import, and API enhancements.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.53.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.53.0

     • New Zora vulnerability parser with fix_available field support.
     • New ThreatMapper file format parser for the updated ThreatMapper output.
     • New n0s1 scanner parser.
     • New OpenReports import support.
     • Adds fix_available field to Kubeaudit, Dawnscanner, IBM App, PWN SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., and Zora parsers; reimport now updates fix_available in existing findings.

     +10 more show less

     • Implements CERTFR vuln ID and VA vuln ID parsing.
     • Qualys XML parser now maps CVEs to Vulnerability IDs.
     • JIRA integration gains retry and rate-limit support.
     • Adds API choice fields for business criticality, platform, lifecycle, and origin on products.
     • API now sends a notification when a finding is created via the API.
     • Social auth exceptions are now configurable via settings.
     • Adds SOCIAL_AUTH_REDIRECT_IS_HTTPS setting to force HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. redirects after social-auth login.
     • Deduplication of findings now runs in batches for improved scalability.
     • Helm chart gains Horizontal Pod Autoscaler (HPA) and Pod Disruption Budget (PDBPDBA debug symbol file format used by Microsoft's toolchain that maps compiled binaries back to source code, function names, and variable types, letting cyber tools resolve symbols during reverse engineering or memory analysis.) support.
     • System settings caching optimization reduces database load.

     15 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Helm chart now uses Valkey instead of Redis (feat(helm): Use Valkey); existing Redis-based Helm deployments will break on upgrade.
108. 2.52.3 Nov 24, 2025 · release notes

     DefectDojo 2.52.3 adds CERTFR vuln ID support and new API choice fields for product metadata.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.52.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.52.3

     • Implements CERTFR vulnerability ID parsing/support for findings.
     • Adds choice fields for business criticality, platform, lifecycle, and origin to the API.

     2 details in Everything

109. 2.52.2 Nov 17, 2025 · release notes

     DefectDojo 2.52.2 adds new ThreatMapper format support, expands fix_available fields across parsers, and improves Qualys CVE mapping.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.52.2 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.52.2

     • Implements new ThreatMapper file format parser.
     • Adds fix_available field support to the pwn SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. parser.
     • Adds fix_available field support to the Kubeaudit parser.
     • Adds fix_available field support to the Dawnscanner parser.
     • Advances IBM App parser with fix_available field.

     +3 more show less

     • Qualys XML parser now maps CVEs to Vulnerability IDs.
     • Adds VA vulnerability ID support via settings (VA vulnid).
     • Reimport now supports the Pro compute hash code method.

     8 details in Everything

110. 2.52.1 Nov 10, 2025 · release notes

     DefectDojo 2.52.1 makes social auth exceptions configurable and improves tag handling in importers.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.52.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.52.1

     • Adds configurable social auth exceptions via settings.dist.py / local_settings.py, allowing operators to control how authentication errors are surfaced.
     • Improves tag handling in importers for more reliable tag imports.

     2 details in Everything

111. 2.52.0 Nov 3, 2025 · release notes

     DefectDojo 2.52.0 adds single-user session enforcement, MobSF/MSRC/MAL parsers, merged MobSF scanner, and Valkey message broker support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.52.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.52.0

     └──▷ HOW TO FIND IT
     Enforce that each user can only have one active session at a time, kicking out prior sessions on new login.
     📍In the console, go to Settings › System Settings and enable the Single User Session option.
     Update the found_by scanner attribution on an existing finding without re-importing.
     copy

     $ curl -X PATCH https://<defectdojo>/api/v2/findings/<id>/ \
       -H 'Authorization: Token <token>' \
       -H 'Content-Type: application/json' \
       -d '{"found_by": [<scanner_id>]}'

     • Adds single-user session enforcement via the new feat(session): Single user session setting, preventing concurrent logins for the same account.
     • Switches the Docker Compose message broker from Redis to Valkey.
     • Merges the MobSF scanner into the core platform for mobile application security testing.
     • Adds a new MSRC (Microsoft Security Response Center) vulnerability ID parser.
     • Adds a new MAL vulnerability ID parser.

     +10 more show less

     • Splits the GitHub Vulnerability Scan parser into separate SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. parsers for finer-grained findings categorization.
     • Adds the SOCIAL_AUTH_LOGIN_REDIRECT_URL variable to control post-login redirect destination for social auth providers.
     • Enables editing the found_by value on findings via the API.
     • Shows unique tool ID alongside hash_code in finding title elements in the UI.
     • Allows unlinking of a JIRA epic from an engagement in the UI.
     • Upgrades Docker images to use Python 3.13.
     • Adds automountServiceAccountToken support to the Helm chart.
     • Adds digest pinning support for image tags in the Helm chart.
     • Splits Helm image locations and tags for finer control in the Helm chart.
     • Adds cloudsql-proxy DRY configuration support to the Helm chart.

     15 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !UNIQUE_ID_OR_HASH_CODE deduplication no longer stops after one candidate — instances relying on previous single-candidate behavior may see changed deduplication results on upgrade.
112. 2.51.3 Oct 27, 2025 · release notes

     DefectDojo 2.51.3 adds MSRC vulnerability ID support and refreshed favicon/theme UI.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.51.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.51.3

     • Adds MSRC vulnerability ID (msrc_vulnid) support via a new settings configuration.
     • Reimplements favicons and updates the application theme.
     • Implements authorization controls for the Risk Acceptance class.
     • Adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server documentation.

     4 details in Everything

113. 2.51.2 Oct 20, 2025 · release notes

     DefectDojo 2.51.2 surfaces tool unique IDs alongside hash codes in finding titles and hardens report builder sections.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.51.2 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.51.2

     • Shows the unique ID from the source tool together with the hash_code in finding title elements for easier cross-tool traceability.
     • Report builder now ensures at least one section is always present, preventing empty report generation.

     2 details in Everything

114. 2.51.1 Oct 14, 2025 · release notes

     DefectDojo 2.51.1 adds Helm automountServiceAccountToken support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.51.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.51.1

115. 2.51.0 Oct 6, 2025 · release notes

     DefectDojo 2.51 adds new parsers, fix-availability tracking, MS Teams Adaptive CardsAdaptive CardsAn open-source card schema from Microsoft that lets apps render structured UI snippets — buttons, text, images — natively inside any host surface, so a tool can push rich, interactive notifications without owning the renderer., OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. button customization, and major import performance gains.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.51.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.51.0

     └──▷ USE IT
     Customize the OIDC login button text shown on the login page for your identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
     python copy

     SOCIAL_AUTH_OIDC_LOGIN_BUTTON_TEXT = "Login with Okta"

     Allow users to log in with their full email as their username when using social auth.
     python copy

     SOCIAL_AUTH_USERNAME_IS_FULL_EMAIL = True

     • New GitHub Secrets Detection Report parser ingests GitHub secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. results.
     • New Semgrep Pro parser supports Semgrep Pro findings import.
     • Snyk Issue API (SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself.) scan import implementation added.
     • Adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. details extraction to the AWS Inspector2 parser.
     • Adds AWS security bulletins as a recognized vulnerability ID source.

     +26 more show less

     • Adds OXAS-ADV-, VAR, and NN vulnerability ID namespaces for enriched vuln tracking.
     • Adds fix_available information to the BlackDuck binary analysis, BlackDuck component risk, JFrog On-Demand, JFrog Xray Unified, JFrog, WPScan, Mend, Aqua, and KrakenD Audit parsers.
     • MS Teams notifications now support Power Automate Workflows via Adaptive CardAdaptive CardA JSON-defined UI snippet, maintained by Microsoft, that renders natively in host apps like Teams or Outlook, letting tools surface structured data without building platform-specific UI code. format.
     • UI: findings list supports ordering by additional fields.
     • UI: planned_remediation_version field added to the finding list.
     • UI: Similar Findings panel restricted to the current product scope.
     • Introduces text labels for API v3 responses.
     • Password Reset disabled for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. users.
     • UI import now allows providing a custom test title.
     • OpenVAS parser improvements for broader result compatibility.
     • Qualys Hacker Guardian parser updated to handle larger CSV files.
     • SonarQube Scan and SonarQube Scan Detailed parsers now capture the Line field.
     • Engagement's branch_tag included in Jira Epic description.
     • SOCIAL_AUTH_USERNAME_IS_FULL_EMAIL is now a configurable setting.
     • New SOCIAL_AUTH_OIDC_LOGIN_BUTTON_TEXT setting to customize the OIDC login button label.
     • Django Debug Toolbar can now be enabled via environment variable.
     • Optional django-pghistory audit log backend added alongside django-auditlog.
     • Default audit log type updated to django-auditlog.
     • Bulk edit now supports updating the under_review flag.
     • Watson search index updates now performed asynchronously.
     • Performance: import pipeline reduces number of finding.save() calls and adds tags in bulk.
     • Performance: product grading calls reduced and optimized using a Celery Chord.
     • uWSGI defaults changed to 4 processes × 4 threads for better out-of-box throughput.
     • Generic parser updated with extended support.
     • Wazuh v4.8 parser implemented.
     • Requested-review notifications now include additional data in the notification title.

     31 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The default audit log type is changed to django-auditlog (was previously different); existing setups using the old default may need to verify audit log configuration after upgrade.
     • !django-tagging dependency is dropped; a database migration is required.
     • !django-pghistory is added as an optional audit log backend; a database migration is required.
116. 2.50.4 Sep 29, 2025 · release notes

     DefectDojo 2.50.4 adds line field for SonarQube scans and branch/tag info in Jira Epic descriptions.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.50.4 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.50.4

     • Adds Line Field support for SonarQube Scan and SonarQube Scan Detailed scan types, improving finding precision.
     • Includes an Engagement's branch_tag in Jira Epic descriptions, giving engineers richer context directly in Jira.
     • Adds fix_available information to the BlackDuck Binary Analysis parser, surfacing remediation status in findings.
     • Enables SonarQube hotspots sync, allowing hotspot findings to be kept in sync with SonarQube.

     4 details in Everything

117. 2.50.3 Sep 22, 2025 · release notes

     DefectDojo 2.50.3 adds bulk under_review editing, fix_available data from BlackDuck, and updated Wazuh v4.8 support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.50.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.50.3

     • Enables bulk editing of the under_review flag across multiple findings at once.
     • Surfaces fix_available information from BlackDuck component risk data in findings.
     • Updates Wazuh parser to support Wazuh v4.8 format.

     3 details in Everything

118. 2.50.2 Sep 15, 2025 · release notes

     DefectDojo 2.50.2 adds fix-availability data for JFrog, WPScan, and Mend parsers, a customizable OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. login button, and OXAS-ADV vulnerability ID support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.50.2 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.50.2

     └──▷ USE IT
     Customize the OIDC SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login button text shown to users on the DefectDojo login page.
     yaml copy

     SOCIAL_AUTH_OIDC_LOGIN_BUTTON_TEXT: "Login with Corporate SSO"

     Enable the Django Debug Toolbar for troubleshooting without modifying settings files directly.
     yaml copy

     DD_DEBUG_TOOLBAR=True

     • Adds fix_available field population to the JFrog On-Demand parser so practitioners can see remediation availability directly in findings.
     • Adds fix_available field population to the WPScan parser for WordPress vulnerability findings.
     • Adds fix_available field population to the Mend (WhiteSource) parser for SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. findings.
     • Adds SOCIAL_AUTH_OIDC_LOGIN_BUTTON_TEXT setting to customize the OIDC SSO login button label in the UI.
     • Adds support for OXAS-ADV- vulnerability ID prefix in vulnerability tracking.

     +2 more show less

     • Enables Django Debug Toolbar via an environment variable for operator-level diagnostics.
     • Updates the Generic parser with new capabilities.

     7 details in Everything

119. 2.50.1 Sep 8, 2025 · release notes

     DefectDojo 2.50.1 adds fix_available tracking across JFrog Xray, Aqua, and KrakenD parsers plus a new Semgrep Pro parser and Wazuh v4.8 support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.50.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.50.1

     • Adds fix_available field population to the JFrog Xray unified parser so remediation status surfaces automatically on import.
     • Adds fix_available field population to the Aqua parser for richer vulnerability triage data.
     • Adds fix_available field population to the KrakenD Audit parser.
     • New Semgrep Pro parser supports ingesting Semgrep Pro scan results.
     • Adds Wazuh v4.8 support in the Wazuh parser.

     +4 more show less

     • Updates the Qualys Hacker Guardian parser to handle larger CSV files.
     • New VAR vulnid variable added to settings.dist.py / local_settings.py.
     • Disables password reset for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. users via the API, preventing credential confusion.
     • uWSGI now defaults to 4 processes × 4 threads, improving out-of-the-box throughput.

     9 details in Everything

120. 2.50.0 Sep 2, 2025 · release notes

     DefectDojo 2.50.0 adds fix_available signals across major scanners, a global Finding Groups page, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. nginx support, and broader file import options.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.50.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.50.0

     • Adds fix_available field support to Harbor, AnchoreCTL, AnchoreEngine, Trivy, TrivyOperator, and RedHatSatellite parsers, surfacing patch availability data from these scanners in findings.
     • Adds fix_available information to engagement views in the UI.
     • New global Finding Groups page for cross-product finding group management.
     • Adds Product Life Cycle filter to finding filters.
     • New Snyk Issue API parser for code (file-based) issues.

     +5 more show less

     • Enables IPv6 support in nginx.
     • Allows more file extensions for importers, including .fpr extension for Fortify scans.
     • BlackDuck importer now supports import in plaintext or bytes format.
     • Webhook notifications now support the owner field.
     • Adds wid-sec-w vulnerability ID support.

     10 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Helm chart drops support for networking.k8s.io/v1beta1 Ingress API version; clusters must use networking.k8s.io/v1.
     • !Helm chart drops support for the kubernetes.io/ingress.class annotation in GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure.; use ingressClassName instead.
     • !feat(settings): Drop time_zone — the time_zone setting is removed from settings.dist.py; existing configurations referencing this key will need to be updated.
121. 2.49.2 Aug 18, 2025 · release notes

     DefectDojo 2.49.2 adds support for importing .fpr scan files.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.49.2 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.49.2

     • Supports .fpr file extension when importing scans (Fortify Pro Results format).

     1 detail in Everything

122. 2.49.1 Aug 11, 2025 · release notes

     DefectDojo 2.49.1 adds a Snyk Code issues parser, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. nginx support, and webhook owner field.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.49.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.49.1

     • New snyk_issue_api parser for Snyk Code file-based issues.
     • Enables IPv6 support in nginx when available.
     • Webhook notifications now include the owner field.

     3 details in Everything

123. 2.49.0 Aug 4, 2025 · release notes

     DefectDojo 2.49.0 adds Xeol and Mayhem SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. parsers, CVSS4 support, a new fix_available field, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. nginx support, and more.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.49.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.49.0

     └──▷ TRY IT
     Reimport a scan and restart SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. timers for any findings reactivated in this run.
     copy

     $ curl -X POST 'https://<defectdojo>/api/v2/reimport-scan/' \
       -H 'Authorization: Token <token>' \
       -F 'scan_type=Trivy Scan' \
       -F 'file=@trivy-results.json' \
       -F 'engagement=<engagement_id>' \
       -F 'close_old_findings=true' \
       -F 'restart_sla_on_reactivation=true'

     Import a Mayhem SARIF report to track Mayhem fuzzing findings alongside other tool results.
     copy

     $ curl -X POST 'https://<defectdojo>/api/v2/import-scan/' \
       -H 'Authorization: Token <token>' \
       -F 'scan_type=Mayhem Scan' \
       -F 'file=@mayhem-results.sarif' \
       -F 'engagement=<engagement_id>'

     • Adds Xeol parser for end-of-life component detection findings.
     • Adds Mayhem SARIF parser (new parser) for Mayhem security findings.
     • Adds CVSS4 support across findings, API, and UI.
     • Adds a fix_available field to findings to surface patch availability.
     • Adds Sophos, NCSC, and GSD vulnerability ID sources to settings.

     +15 more show less

     • Supports whitelisted file extensions via the API.
     • Supports optional SLA restart on finding reactivation during reimport (restart_sla_on_reactivation).
     • Extends Mend Platform parser to include Ransomware, Exploitable, and KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. data.
     • Extends Twistlock/Prisma parser to parse compliance findings.
     • Adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v3 support to the Dependency Check parser.
     • Supports Sysdig 2025 report formats.
     • Makes KEV (Known Exploited VulnerabilitiesKnown Exploited VulnerabilitiesCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.) data visible on the findings listing in the UI.
     • Adds IPv6 support to the nginx configuration.
     • Allows users with edit/add user permission to force password resets.
     • Adds validation to minimum and maximum password length settings.
     • Includes vuln_id_from_tool in group-by options for findings.
     • Adds more finding fields to the risk acceptance findings dropdown for better context.
     • Optimizes view_engineer dashboard using DB-side aggregation to reduce load time.
     • Ensures consistent Close old findings behavior between UI and API.
     • Adds JIRA endpoint status to finding description when pushing to JIRA.

     20 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Reimport API: the default for close_old_findings is restored to True — any integrations relying on the previous changed default will now close old findings on reimport.
124. 2.48.5 Jul 28, 2025 · release notes

     Adds NCSC vulnerability ID support in DefectDojo settings

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.48.5 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.48.5

     • Add NCSC vulnid to settings.dist.py / local_settings.py

     1 detail in Everything

125. 2.48.3 Jul 21, 2025 · release notes

     DefectDojo 2.48.3 adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. vendor score support in Trivy, CVSS v3 in Dependency Check, and a faster findings API.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.48.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.48.3

     • Trivy parser now uses CVSS scores from other vendors where applicable.
     • Dependency Check parser supports CVSS v3 scoring.
     • Product API optimizes the list of finding IDs for faster retrieval.

     3 details in Everything

126. 2.48.2 Jul 21, 2025 · release notes

     DefectDojo 2.48.2 adds Sysdig 2025 format support, KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. data on findings listing, and GSD vulnerability ID support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.48.2 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.48.2

     • Supports Sysdig 2025 report formats in the Sysdig parser.
     • Makes KEV (Known Exploited VulnerabilitiesKnown Exploited VulnerabilitiesCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.) data visible on the findings listing page.
     • Adds GSD vulnerability ID support via new settings in settings.dist.py / local_settings.py.

     3 details in Everything

127. 2.48.1 Jul 14, 2025 · release notes

     DefectDojo 2.48.1 adds Twistlock compliance parsing, force password reset delegation, and vuln ID group-by support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.48.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.48.1

     • Adds compliance parsing for Twistlock scanner results.
     • Allows users with edit user permission to force password resets on other accounts.
     • Enables grouping findings by vuln_id_from_tool in the group-by feature.
     • Displays more fields in the findings dropdown when adding a risk acceptance.

     4 details in Everything

128. 2.48.0 Jul 7, 2025 · release notes

     DefectDojo 2.48.0 adds new parsers, vulnerability ID sources, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. from Grype, ASVS 5.0 benchmarks, and expanded API filtering.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.48.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.48.0

     └──▷ TRY IT
     Filter the user list to find accounts that have never logged in since a specific date, useful for access reviews.
     copy

     $ curl -X GET 'https://<defectdojo>/api/v2/users/?last_login__lte=2024-01-01T00:00:00Z' \
       -H 'Authorization: Token <token>'

     Import an Anchore Grype scan to automatically capture EPSS scores alongside vulnerability findings.
     copy

     $ curl -X POST https://<defectdojo>/api/v2/import-scan/ \
       -H 'Authorization: Token <token>' \
       -F 'scan_type=Anchore Grype' \
       -F 'file=@grype-results.json' \
       -F 'engagement=<engagement_id>' \
       -F 'active=true'

     • New ReversingLabs SpectraAssure rl-json parser for importing SpectraAssure scan results.
     • New Cycognito parser for importing Cycognito scan findings.
     • Adds EPSS (Exploit Prediction Scoring SystemExploit Prediction Scoring SystemExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching.) data import from Anchore Grype scans.
     • Adds support for JVNDB vulnerability IDs on findings.
     • Adds support for Lenovo vulnerability IDs on findings.

     +16 more show less

     • Adds support for Tailscale vulnerability IDs on findings.
     • Adds support for EUVDEUVDThe European Vulnerability Database, operated by ENISA, is the EU's official registry of disclosed software vulnerabilities, giving cyber tools a regional authoritative source for CVE-equivalent advisories. (European Union Vulnerability Database) vulnerability IDs on findings.
     • Adds support for Go vulnerability IDs on findings.
     • Adds KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.-related data fields to the finding model.
     • New ASVS 5.0 benchmark support in the UI.
     • API: Enables filtering users by last_login and date_joined fields.
     • Finding Groups now respect minimum severity and active/verified rules when pushing to JIRA.
     • JIRA integration respects simple/full risk acceptance on webhook processing.
     • JIRA descriptions are now truncated automatically if the maximum length is exceeded.
     • SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. login now respects the next redirect parameter for post-login navigation.
     • Improved CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v3 validation enforced at the API level.
     • Trivy parser now maps the status field from scan results.
     • Checkov report parsing enhanced with additional field support.
     • Optimized queryset annotations and prefetches to cut database time for test, finding, and product views.
     • Finding groups now filter by product when applicable.
     • Metrics filters improve handling when nothing matches the applied filters.

     21 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The actual_time and estimated_time fields have been removed from the database model (migration required).
     • !Burp Enterprise has been renamed to Burp DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. — any configurations or references to the old name will need to be updated.
129. 2.49.3 Jul 1, 2025 · release notes

     DefectDojo Pro 2.49.3 adds Azure DevOps/GitHub/GitLab integrations and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. enforcement for API auth

     • Adds Integrations subsystem to DefectDojo Pro with Jira-style connectors for Azure DevOps, GitHub, and GitLab boards
     • Enforces MFA requirement for the /api-token-auth endpoint when MFA is enabled in the system
     • Adds Unique ID from Tool column to the Findings list and Finding view in the Pro UI
     • Adds Test Status field to the Test View in the Pro UI

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Basic Auth Login has been removed from the swagger form; only cookieAuth and tokenAuth are accepted
130. 2.47.4 Jun 30, 2025 · release notes

     DefectDojo 2.47.4 adds Lenovo and Tailscale vulnerability ID sources and new KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.-related fields on the finding model.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.47.4 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.47.4

     • Adds Lenovo as a supported vulnerability ID source (VulnID).
     • Adds Tailscale as a supported vulnerability ID source (VulnID).
     • Adds KEV (Known Exploited VulnerabilitiesKnown Exploited VulnerabilitiesCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.)-related data fields to the finding model via database migration.

     3 details in Everything

131. 2.47.3 Jun 23, 2025 · release notes

     DefectDojo 2.47.3 adds user filtering by last_login/date_joined via API and renames Burp Enterprise to Burp DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces..

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.47.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.47.3

     • Enables filtering users by last_login and date_joined fields via the API.
     • Renames the Burp Enterprise integration to Burp DAST in settings.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Burp Enterprise is renamed to Burp DAST — any local_settings.py or settings.dist.py references to the old name may need to be updated.
132. 2.47.2 Jun 16, 2025 · release notes

     DefectDojo 2.47.2 adds EUVDEUVDThe European Vulnerability Database, operated by ENISA, is the EU's official registry of disclosed software vulnerabilities, giving cyber tools a regional authoritative source for CVE-equivalent advisories. and Go vulnerability ID support to settings.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.47.2 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.47.2

     • Adds EUVD (European Vulnerability Database) vulnerability ID type, configurable via settings.dist.py / local_settings.py.
     • Adds Go vulnerability ID type, configurable via settings.dist.py / local_settings.py.

     2 details in Everything

133. 2.47.1 Jun 9, 2025 · release notes

     v2.47.1 adds Vulnerable Endpoints table to Findings and CI/CD metadata to Engagements in DefectDojo Pro.

     └──▷ HOW TO FIND IT
     Review affected endpoints directly on a finding without navigating away.
     📍In the Pro UI, open a Finding and scroll to the new Vulnerable Endpoints table.
     Trace duplicate findings back to their source.
     📍In the Pro UI, open a Finding Metadata table for a duplicate and click Original Finding.
     Check CI/CD context for an engagement.
     📍In the Pro UI, navigate to the Engagement view to see the new CI/CD Metadata section.
     • Adds the Vulnerable Endpoints table to Finding pages in the Pro UI
     • Adds an Original Finding link in the Duplicate Findings Metadata table
     • Adds CI/CD Metadata section to the Engagement view

     3 details in Everything

134. 2.47.0 Jun 2, 2025 · release notes

     DefectDojo 2.47.0 adds ELA/ALEA vuln IDs, Alibaba Cloud Linux 3 advisories, Anchorectl evaluations format, session timeout notifications, and tag comma-separation in import APIs.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.47.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.47.0

     └──▷ TRY IT
     Import findings with multiple tags using comma separation in a multipart form — useful for CI pipelines that build tag lists as a single string.
     copy

     $ curl -X POST 'https://<defectdojo>/api/v2/import-scan/' \
       -H 'Authorization: Token <token>' \
       -F 'scan_type=Trivy Scan' \
       -F 'file=@trivy-results.json' \
       -F 'product_name=MyApp' \
       -F 'engagement_name=CI' \
       -F 'tags=tag1,tag2,tag3'

     Configure Celery log verbosity independently from the application log level to reduce noise in task workers.
     ini copy

     CELERY_LOG_LEVEL=WARNING

     • Adds ELA (Enterprise Linux Advisory) vulnerability ID support to findings.
     • Adds ALEA vulnerability ID support to findings.
     • Adds Alibaba Cloud Linux 3 Security Advisory as a supported scanner/parser.
     • Adds support for the new evaluations format in the Anchorectl parser.
     • Adds CVSSv4 support to the auditjs parser.

     +10 more show less

     • Includes CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. score in findings when using the OpenVAS CSV parser.
     • Adds session timeout notification to alert users before their session expires.
     • Adds tag comma-separation support for multipart form submissions in import/reimport API endpoints.
     • Adds case-insensitive filters to the Dojo Meta API via migration to filterset_class.
     • Adds Product Announcements feature to surface messages on relevant features in the UI and API.
     • Enables browser native spell checker in the EasyMDE markdown editor.
     • Stores Bearer scanner fingerprint in unique_id_from_tool for more precise deduplication.
     • Helm chart now supports using an external ServiceAccount via serviceAccount configuration.
     • Celery logging now respects the CELERY_LOG_LEVEL setting.
     • Improved Excel export handling for finding groups with better logging.

     15 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Helm chart support for postgresql-ha is dropped; deployments using postgresql-ha will break on upgrade.
     • !Asynchronous import feature is removed; any workflows or configurations relying on async import will no longer function.
135. 2.46.4 May 27, 2025 · release notes

     DefectDojo 2.46.4 adds Anchorectl evaluations format, Alibaba Cloud Linux 3 advisories, and ALEA vuln ID support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.46.4 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.46.4

     • Adds evaluations format support to the Anchorectl parser for richer container image assessment ingestion.
     • Adds Alibaba Cloud Linux 3 Security Advisory as a supported parser/source.
     • Implements ALEA vulnerability ID support.
     • Adds CVSSv4 scoring support to the auditjs parser.
     • Celery logging now respects the CELERY_LOG_LEVEL setting.

     5 details in Everything

136. 2.46.3 May 19, 2025 · release notes

     DefectDojo 2.46.3 adds comma-separated tag support for multipart import forms and streamlined UI pagination options.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.46.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.46.3

     └──▷ TRY IT
     Pass multiple tags in a single comma-separated field when importing findings via multipart form — no need for repeated tag parameters.
     copy

     $ curl -X POST https://<defectdojo>/api/v2/import-scan/ \
       -H 'Authorization: Token <token>' \
       -F 'scan_type=ZAP Scan' \
       -F 'file=@zap_report.xml' \
       -F 'engagement=1' \
       -F 'tags=web,critical,sprint-42'

     • Supports comma-separated tag values in multipart form submissions for import and reimport API endpoints.
     • Updates UI pagination to a reduced set of more reasonable page-size options.

     2 details in Everything

137. 2.46.2 May 12, 2025 · release notes

     v2.46.2 adds tag filtering to Pro Insights Dashboards and CSV export for the Users table

     • Pro Insights Dashboards can now be filtered by Tag
     • Users table can now be exported as a .csv file

     2 details in Everything

138. 2.46.0 May 6, 2025 · release notes

     DefectDojo 2.46.0 adds new parsers, vulnerability ID sources, OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. mitigation data, and API risk-acceptance controls.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.46.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.46.0

     └──▷ TRY IT
     Set a recommendation and decision on a risk acceptance via the API — newly writable fields in this release.
     copy

     $ curl -X PATCH https://<defectdojo>/api/v2/risk_acceptance/<id>/ \
       -H 'Authorization: Token <token>' \
       -H 'Content-Type: application/json' \
       -d '{"recommendation": "accept", "decision": "accept"}'

     • Adds Cyberwatch Galeax parser for importing Cyberwatch scan results.
     • Adds Immuniweb JSON parser for importing Immuniweb scan results.
     • Adds Fortify WebInspect new report format parser.
     • Expands Nessus parser to capture additional fields.
     • Adds Generic Parser support for Test Type Meta.

     +16 more show less

     • Handles Fortify suppressed findings as false positives during import.
     • Enhances Wiz scan parser to handle more fields and unique_id_from_tool.
     • Adds HackerOne vulnerability disclosure parser improvements.
     • Adds Alibaba Linux vulnerability IDs to the vulnerability ID tracking system.
     • Adds Amazon Linux Security Center advisories as vulnerability IDs.
     • Adds Cisco Security Advisory as a vulnerability ID source.
     • Adds HCL Commerce KB vulnerability IDs.
     • Enables setting recommendation and decision fields on risk_acceptance via API.
     • Updates tag allowed characters to a unified format (API and database change).
     • Reimport now respects special finding statuses (e.g., false positive, out-of-scope) carried from reports.
     • Tenable importer now validates mandatory columns before importing.
     • Shows date and author on the most recent note in the finding UI.
     • Speeds up UI page loading by serving smaller (minified) JS and CSS resources.
     • Improves accessibility by restoring focus indicators when tabbing through the UI.
     • Publishes nightly builds of the dev branch as Docker images.
     • Removes non-working DD_SLA_BUSINESS_DAYS setting to eliminate misconfiguration.

     21 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The DD_SLA_BUSINESS_DAYS setting is removed; any configuration referencing it will no longer have effect and should be cleaned up to avoid confusion.
     • !Tag allowed characters are changed to a unified format — existing tags containing previously-allowed characters that fall outside the new format may be affected (database migration required).
139. 2.45.3 Apr 28, 2025 · release notes

     DefectDojo 2.45.3 adds Alibaba Linux vuln IDs, Fortify false-positive handling, and smarter reimport status respect.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.45.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.45.3

     • Adds Alibaba Linux vulnerability ID support in settings and UI.
     • Fortify parser now handles suppressed findings as false positives.
     • Reimport now respects special finding statuses (e.g., false positive, out of scope) carried in reports.
     • Tenable importer validates mandatory columns before attempting import.
     • SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. engine parses finding.date implicitly, reducing manual date-field configuration.

     5 details in Everything

140. 2.45.2 Apr 22, 2025 · release notes

     DefectDojo 2.45.2 adds Fortify WebInspect new report format support and Amazon Linux Security Center advisory vuln ID mapping.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.45.2 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.45.2

     • Supports the new Fortify WebInspect report format for import and parsing.
     • Adds Amazon Linux Security Center advisory identifiers to vulnerability ID mappings in settings.

     2 details in Everything

141. 2.45.0 Apr 7, 2025 · release notes

     DefectDojo 2.45.0 adds generic OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. login, new parser support, arm64 images, session timeout alerts, and expanded vuln ID coverage.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.45.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.45.0

     • Adds generic OIDC login option for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. authentication
     • Adds experimental arm64 Docker image builds for releases
     • Adds session timeout notification in the UI
     • Adds Aqua vulnerabilities format parser
     • Adds CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. field to PTART parser

     +14 more show less

     • Adds references support to testssl parser
     • Adds Anchore Engine parser support for new report format
     • Enhances Fortify FPR parser with 2025 improvements
     • Improves OpenVAS endpoint and severity parsing
     • Adds Slackware Security Advisory to vuln ID sources
     • Adds Arch Linux Security Advisory to vuln ID sources
     • Adds openSUSE vulnerabilities to vuln ID sources
     • Adds Proofpoint vuln IDs to vuln ID sources
     • Adds FortiGuard vuln IDs to vuln ID sources
     • Adds Splunk vuln IDs to vuln ID sources
     • Adds new compliance regulations to the database
     • Optimizes import memory handling by not retaining parsed findings long-term
     • Enables Generic JSON parser to explicitly process tags like other tools
     • Marks async finding import feature as deprecated

     19 details in Everything

142. 2.44.4 Mar 31, 2025 · release notes

     DefectDojo 2.44.4 adds Slackware, Arch Linux, and openSUSE advisory vuln-ID sources plus new regulations and testssl references.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.44.4 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.44.4

     • Adds Slackware Security Advisory as a vulnerability ID source (vulnid), visible in the UI.
     • Adds Arch Linux Security Advisory as a vulnerability ID source (vulnid).
     • Adds openSUSE vulnerability advisories as a vulnerability ID source (vulnid).
     • Adds references support to the testssl parser.
     • Adds new regulations via database migration.

     5 details in Everything

143. 2.44.3 Mar 24, 2025 · release notes

     DefectDojo 2.44.3 adds Aqua vulnerabilities format support and Proofpoint vuln ID parsing.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.44.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.44.3

     • Adds support for the Aqua vulnerabilities report format as a new parser integration.
     • Adds Proofpoint vuln ID support in the Proofpoint parser.
     • Anchore Engine parser now handles the new report format.

     3 details in Everything

144. 2.44.2 Mar 17, 2025 · release notes

     DefectDojo 2.44.2 adds FortiGuard VulnID support and improves OpenVAS endpoint and severity handling.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.44.2 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.44.2

     • Adds FortiGuard VulnID field to settings, enabling tracking of FortiGuard vulnerability identifiers.
     • Improves OpenVAS parser with endpoint and severity enhancements.

     2 details in Everything

145. 2.44.1 Mar 10, 2025 · release notes

     DefectDojo 2.44.1 adds generic OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. login and Splunk vulnerability ID support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.44.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.44.1

     • Adds generic OIDC login option, configurable via settings.dist.py/local_settings.py and surfaced in the UI.
     • Adds Splunk vulnerability ID (vulnIDs) support for Splunk findings.

     2 details in Everything

146. 2.44.0 Mar 3, 2025 · release notes

     DefectDojo 2.44.0 adds AND-filter support for API tags, new vuln ID sources, Burp hashcode dedupe, and improved importer close-old-findings logic.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.44.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.44.0

     • Adds AND expression filtering for API Tags, enabling more precise finding queries across tag combinations.
     • Supports vulnerability IDs from SUSE, Atlassian, Palo Alto Networks Security Advisories, MGAA, MGASA, PMASA (phpMyAdmin), and Typo3 in vuln ID logic.
     • Switches Burp Scan parser to use Hashcode Dedupe for more reliable deduplication.
     • Improves Close Old Findings importer behavior to accommodate different dedupe algorithms.
     • Ensures Vulnerability IDs are included in hash code calculations when added outside of the import flow.

     +5 more show less

     • Updates 12 parsers with better metadata for richer finding context.
     • Adds secret annotations support for Helm deployments.
     • Supports arm64 architecture builds for broader deployment flexibility.
     • Adds keyboard tab access to Show Password on the Login Page for improved accessibility.
     • Improves ZAP parser to return feedback when an incorrect file format is submitted.

     10 details in Everything

147. 2.43.4 Feb 24, 2025 · release notes

     DefectDojo 2.43.4 adds AND-expression filtering to API tag queries.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.43.4 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.43.4

     • Supports AND expression filtering on API tag queries, enabling narrower, multi-tag intersection searches.

     1 detail in Everything

148. 2.43.3 Feb 19, 2025 · release notes

     DefectDojo v2.43.3 adds /audit_log API endpoint and editable Vulnerability IDs for findings

     └──▷ TRY IT
     Retrieve all user activity logs via the new API endpoint.
     copy

     $ curl https://<defectdojo-host>/api/v2/audit_log/

     Retrieve user activity filtered by a specific object ID.
     copy

     $ curl https://<defectdojo-host>/api/v2/audit_log/?object_id=<123>

     Navigate to the Finding edit page in the UI to change its Vulnerability ID.
     📍Go to Findings › [Select Finding] › Edit. Change the Vulnerability ID field value and save.
     • Adds /audit_log API endpoint to DefectDojo Pro for retrieving user activity JSON reports
     • Allows editing the Vulnerability ID field on an existing Finding via the UI to manually link duplicates

     2 details in Everything

149. 2.43.2 Feb 12, 2025 · release notes

     DefectDojo v2.43.2 adds async CLI import, connector min severity config, and dedup logic updates.

     └──▷ USE IT
     Run a non-blocking import so the CLI returns immediately while processing continues in the background.
     shell copy

     defectdojo-cli import --background-import

     Configure a connector to only ingest findings at High severity or above.
     config copy

     minimum_severity: High

     • (CLI Tools) Added a background-import flag to allow for asynchronous imports or reimports.
     • (Connectors) Users of Burp, SonarQube and Dependency-Track Connectors can now set a minimum Severity level for Findings to limit the amount of data imported via Connector.
     • (Pro UI) Tests and Risk Acceptances can now be added directly from the All Tests / All Risk Acceptances lists.

     3 details in Everything

150. 2.43.1 Feb 10, 2025 · release notes

     DefectDojo 2.43.1 adds MGASA vulnerability ID support and clarifies nullable SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. days in the API spec.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.43.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.43.1

     • Adds MGASA vulnerability ID support as a recognized vuln ID source.
     • API spec now correctly documents that SLA days remaining can be null.

     2 details in Everything

151. 2.43.0 Feb 3, 2025 · release notes

     DefectDojo 2.43.0 adds two new SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. parsers, NoseyParker v0.22 support, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. range filters, split disclaimers, and granular verified-status toggling.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.43.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.43.0

     • New HCL AppScan on Cloud SAST parser for importing cloud SAST results.
     • New Checkmarx CxFlow SAST parser for importing CxFlow pipeline findings.
     • Advances NoseyParker parser to support version 0.22.0.
     • Adds ALBA as a supported vulnerability ID type in vulnid handling.
     • Adds range filters for EPSS scores on findings.

     +10 more show less

     • Adds imageTags support to AWS SecurityHub and Inspector2 parsers.
     • Wiz parser now imports findings regardless of status.
     • Split disclaimers feature: disclaimers can now be configured separately per context.
     • Verified Status Toggle gains granularity controls.
     • API prefetching of multiple endpoints now returns all prefetch models.
     • Notes on Findings are now supported for Simple Risk Acceptance.
     • Mitigated On/Before/After filters now use DateTimeFilter for precise date-time filtering.
     • Helm chart supports adding a custom local_settings.py via a new option.
     • Django service type is now configurable in Kubernetes deployments.
     • Kubernetes resources support additional annotations.

     15 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !All dc- convenience scripts have been dropped; any automation referencing them will break.
     • !Django AuditLog upgraded to 3.x, which may require settings or migration changes — consult upgrade notes.
152. 2.42.3 Jan 27, 2025 · release notes

     DefectDojo 2.42.3 improves API prefetching and makes vulnerability IDs more robust.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.42.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.42.3

     • API now returns all prefetch models when prefetching multiple endpoints simultaneously.
     • Vulnerability IDs handling made more robust in settings configuration.

     2 details in Everything

153. 2.42.2 Jan 21, 2025 · release notes

     DefectDojo 2.42.2 adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. range filters, image tag parsing for AWS findings, ALBA vuln ID support, and verified status granularity.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.42.2 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.42.2

     • Adds range filters for EPSS scores, enabling filtering findings by EPSS probability ranges.
     • Adds imageTags extraction to AWS SecurityHub and Inspector2 parsers for richer finding context.
     • Adds ALBA as a supported vulnerability ID type in settings.
     • Adds granularity to the Verified Status Toggle via a new database-backed capability.
     • Adds Kubernetes resource annotations support across different resources.

     5 details in Everything

154. 2.42.1 Jan 13, 2025 · release notes

     DefectDojo v2.42.1 adds API field selection, CSV/Excel tag exports, risk acceptance logging, and AWS tool parser updates.

     └──▷ TRY IT
     Fetch only specific fields to reduce payload size or match a downstream schema.
     copy

     $ curl -X 'GET' https://localhost/api/v2/findings/?response_fields=title,severity,description -H 'accept: application/json'

     • Adds response_fields query parameter to API endpoints to control returned fields
     • Excel and CSV exports now include tags

     2 details in Everything

155. 2.42.0 Jan 6, 2025 · release notes

     DefectDojo 2.42.0 adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scoring to generic CSV parser, new Request/Response API CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. endpoints, and expanded JIRA/finding filters.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.42.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.42.0

     └──▷ TRY IT
     Retrieve HTTP request/response evidence attached to a finding for triage or reporting.
     copy

     $ curl -X GET 'https://<defectdojo>/api/v2/request_response/?finding=<finding_id>' \
       -H 'Authorization: Token <token>'

     • Adds EPSS score and percentile fields (epss_* parameters) to the generic CSV parser for vulnerability prioritization data.
     • New Request/Response API CRUD endpoints for managing HTTP request/response data on findings.
     • Adds ordering support to the Test_Import API endpoint.
     • Allows None as an option for Active/Verified status on Import/Reimport API calls, mirroring UI behavior.
     • New filter for findings by Has Any JIRA (covering both grouped and single JIRA issues).

     +10 more show less

     • Adds filters to the Products list under View Product Type.
     • Updates the Dashboard Reported Finding Severity by Month chart to aggregate by month instead of by day.
     • Adds CGA vulnerability ID support to the dedupe/vuln-ID settings.
     • Adds DTSA vulnerability ID support.
     • Adds GLSA (Gentoo) vulnerability ID support.
     • Updates JIRA for Finding Groups when a Risk Acceptance expires.
     • Adds Horusec Scan to hashcode deduplication settings.
     • Sets deduplication configuration for Qualys Hacker Guardian parser.
     • Disallows multiple single-use notes on a single object (enforced via API).
     • Disallows linking an already-linked JIRA issue.

     15 details in Everything

156. 2.41.4 Dec 30, 2024 · release notes

     DefectDojo 2.41.4 adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scoring to CSV imports, CGA vuln IDs, and None option for Active/Verified on import.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.41.4 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.41.4

     └──▷ TRY IT
     Pass Active/Verified as None on reimport to leave those flags unchanged, matching UI behavior when no explicit state is desired.
     copy

     $ curl -X POST 'https://<defectdojo>/api/v2/reimport-scan/' \
       -H 'Authorization: Token <token>' \
       -F 'scan_type=Generic Findings Import' \
       -F 'active=None' \
       -F 'verified=None' \
       -F 'file=@findings.csv'

     • Adds EPSS score and percentile fields to the generic CSV parser, enabling risk-prioritization data to flow in during bulk imports.
     • Adds CGA vulnerability ID support as a new vuln ID type in settings.
     • Allows None as a valid option for Active/Verified fields on Import/Reimport API calls, mirroring the existing UI behavior.

     3 details in Everything

157. 2.41.3 Dec 23, 2024 · release notes

     Adds Horusec Scan and Qualys Hacker Guardian dedupe configuration via settings keys.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.41.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.41.3

     • Adds horusec_scan configuration key in settings.dist.py to enable Horusec Scan integration
     • Adds dedupe_config setting for Qualys Hacker Guardian to control finding deduplication

     2 details in Everything

158. 2.41.1 Dec 9, 2024 · release notes

     DefectDojo 2.41.1 adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. parameters to the generic parser, DTSA vuln ID support, and new JIRA/findings filters.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.41.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.41.1

     • Adds epss_score, epss_percentile, and related epss_* parameters to the generic findings parser.
     • Adds DTSA as a supported vulnerability ID type in the vuln ID field.
     • New filter on the Findings list to show findings that have any JIRA issue (grouped or single).
     • Request review notifications now display usernames instead of generic identifiers.
     • API now disallows linking an already-linked JIRA issue to a second object.

     +3 more show less

     • API now disallows multiple single-use notes on a single object.
     • Dashboard Reported Finding Severity by Month chart now aggregates by month instead of by day.
     • Removes the Settings SHA mechanism from settings.dist.py / local_settings.py.

     8 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Settings SHA is removed from settings.dist.py / local_settings.py; any tooling or validation that relied on that hash will no longer work after upgrade.
159. 2.41.0 Dec 2, 2024 · release notes

     DefectDojo 2.41.0 adds Trivy Operator cluster compliance reports, batch DojoMeta API, new vuln ID types, and Burp Enterprise format support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.41.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.41.0

     • Adds Trivy Operator clustercompliance report parsing support.
     • Consolidates all Trivy Operator findings into a single JSON import.
     • Makes Trivy Operator Kubernetes vulnerability IDs consistent.
     • Adds new Mend Platform API 3.0 file types to the existing Mend parser.
     • Adds DSA, RLBA, RLSA, and TEMP vulnerability ID types.

     +13 more show less

     • Supports newer Burp Enterprise report format.
     • Adds batch create-or-update capability for multiple DojoMeta objects via API.
     • New API endpoint to link an EngagementQuestionnaire's unanswered Answered_Survey to an Engagement.
     • New API support for updating the Jira epic on an Engagement.
     • Adds validator for DD_DEDUPLICATION_ALGORITHM_PER_PARSER and DD_HASHCODE_FIELDS_PER_SCANNER configuration values.
     • Displays reviewers on finding pages in the UI.
     • Adds audit log updates reflecting actual requested reviewers.
     • Allows sorting endpoints by ID in the UI.
     • Adds engagement-closed notification templates for MS Teams, Email, Alert, and Slack.
     • Reworks the Kubescape parser.
     • Refactors MobSF parser to support v4 reports.
     • Updates Prowler parser to support v4.5.0's renamed time_dt key (was event_time).
     • AnchoreCTL Policies parser gains additional severity checks from the description field.

     18 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Helm chart drops support for TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port 3000 (cleanup(helm): Drop support for TCP/3000).
160. 2.40.3 Nov 25, 2024 · release notes

     DefectDojo 2.40.3 adds Trivy Operator cluster compliance reports and expands vulnerability ID coverage with RLBA support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.40.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.40.3

     • Adds Trivy Operator cluster compliance report ingestion for cluster-wide compliance findings.
     • Adds RLBA vulnerability ID support in settings for broader vuln tracking coverage.
     • Updates audit log to display actual requested reviewers for improved change accountability.

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port 3000 support is dropped from the Helm chart; any configuration or firewall rules relying on port 3000 will break on upgrade.
161. 2.40.4 Nov 25, 2024 · release notes

     DefectDojo v2.40.4 adds Trivy Operator cluster compliance support and CheckMarx One null-description handling

     • (Tools) Trivy Operator now parses the cluster compliance report from scans.
     • (Tools) CheckMarx One parser can now handle cases where a result has no description.

     2 details in Everything

162. 2.40.2 Nov 18, 2024 · release notes

     DefectDojo 2.40.2 adds Trivy Operator all-findings JSON, DSA vuln IDs, RLSA vuln ID support, and Helm initializer retention.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.40.2 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.40.2

     • Consolidates all Trivy Operator findings into a single JSON import, simplifying bulk ingestion.
     • Adds DSA vulnerability ID support for Debian Security Announcements in finding enrichment.
     • Adds RLSA (Red Hat Linux Security Advisory) as a recognized vulnerability ID type.
     • Makes Trivy Operator Kubernetes vulnerability IDs consistent across findings and UI.
     • Adds Helm chart option to retain the initializer job after completion (keepInitializer).

     +2 more show less

     • Adds validation checker for DD_DEDUPLICATION_ALGORITHM_PER_PARSER and DD_HASHCODE_FIELDS_PER_SCANNER settings to catch misconfiguration at startup.
     • Reworks the Kubescape parser with updated field mappings reflected in both the parser and UI.

     7 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Prowler v4 parser now expects the time_dt key instead of event_time — existing Prowler v4 import pipelines using the old key will fail to parse event timestamps.
163. 2.40.1 Nov 12, 2024 · release notes

     DefectDojo 2.40.1 adds Burp Enterprise newer format support, Helm staticName for initializer, and a FileUpload Base64 extension fix.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.40.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.40.1

     └──▷ USE IT
     Use a static name for the Helm initializer to avoid resource name changes across deployments.
     yaml copy

     initializer:
       staticName: true

     • Supports newer Burp Enterprise report format in both the UI and settings.
     • Adds staticName support for the Helm chart initializer, enabling stable resource naming.
     • Adds TEMP to vulnerability ID handling in settings.

     3 details in Everything

164. 2.40.0 Nov 4, 2024 · release notes

     DefectDojo 2.40.0 adds AWS Inspector2 parser, FPR upload support, ELBA vulnerability URLs, and a verified-status enforcement toggle.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.40.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.40.0

     └──▷ HOW TO FIND IT
     Enable verified-status enforcement after upgrading — requires running the accompanying database migration first.
     📍In the console, go to System Settings and enable the toggle to dictate enforcement of verified status.
     • New parser for AWS Inspector2 findings enables automatic ingestion of AWS-native vulnerability scan results.
     • File uploads now accept FPR (Fortify Project Results) format, expanding supported scanner imports.
     • Adds ELBA vulnerability URL support, linking findings to the ELBA advisory database.
     • New toggle to enforce verified status on findings, giving teams control over verification workflow.
     • Webhook payloads now always populate description and include title, improving downstream automation.

     +1 more show less

     • Burp Enterprise integration gains hash code fields for improved deduplication.

     6 details in Everything

165. 2.39.3 Oct 28, 2024 · release notes

     DefectDojo 2.39.3 adds RXSA VULNERABILITY_URL setting to settings.dist.py and local_settings.py.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.39.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.39.3

     • Adds VULNERABILITY_URL setting for RXSA integrations
     • Supports OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. Parser with robustified parsing logic

     2 details in Everything

166. 2.39.2 Oct 21, 2024 · release notes

     DefectDojo 2.39.2 adds file_path to SonarQube findings, a no-enforcement SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. config option, and ELSA errata support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.39.2 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.39.2

     └──▷ HOW TO FIND IT
     Configure an SLA policy that tracks findings without enforcing SLA deadlines — useful for informational or low-priority finding types.
     📍In the console, go to Configuration › SLA Configuration and create a new SLA Config with enforcement disabled.
     • Adds file_path field to SonarQube findings for more precise vulnerability location tracking.
     • New SLA Config option that does not enforce SLA, allowing teams to track findings without triggering SLA violations.
     • Adds ELSA errata support in settings and UI.

     3 details in Everything

167. 2.39.1 Oct 15, 2024 · release notes

     DefectDojo 2.39.1 adds a Jira project disable toggle, DLA/USN vulnerability advisory sources, and sets Jira Express as the default form.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.39.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.39.1

     • Adds a toggle in Jira project settings to disable an existing Jira project integration (UI, API, and database-backed).
     • Adds DLA (Debian Long-term support Advisories) as a security advisory source for vulnerability IDs.
     • Adds USN (Ubuntu Security Notices) as a vulnerability ID source.
     • Sets the Jira Express form as the default when creating a new Jira configuration.

     4 details in Everything

168. 2.39.0 Oct 7, 2024 · release notes

     DefectDojo 2.39.0 adds webhook notifications, 5 new parsers, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching./Impact enhancements, and risk exception audit notes.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.39.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.39.0

     └──▷ HOW TO FIND IT
     Enable outbound webhook notifications so your SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. or chat tool receives DefectDojo events in real time.
     📍In the console, go to Settings › Notifications and add a new Webhook entry with your endpoint URL and the events to subscribe to.
     • Adds webhook support for notifications, enabling outbound HTTP callbacks on DefectDojo events.
     • New parser: Qualys Hacker Guardian for importing Qualys HackerGuardian scan results.
     • New parser: Threat Composer for ingesting AWS Threat Composer threat model outputs.
     • New parser: Legitify for analyzing GitHub/GitLab security posture findings.
     • New parser: KrakenD audit results via the krakend audit parser.

     +15 more show less

     • Adds HackerOne Bug Bounty Program report support to the existing HackerOne parser.
     • Adds Invicti scanner support through the Netsparker parser.
     • Extends the Wiz parser with SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scanning and Fortify legacy format support.
     • Adds EPSS score data to the Aqua parser output.
     • Adds Impact field parsing to the AWS SecurityHub ASFF parser.
     • Adds vulnerability ID enrichment to the ssh-audit parser.
     • Adds AlmaLinux advisory links to vulnerability records.
     • Risk Exceptions: automatically adds/removes audit notes on findings when they enter or leave a risk exception.
     • User management: adds an admin toggle to require password on new user creation.
     • Dynamic parsing: adds a flag to indicate when a parser introduces new test types.
     • Lists global-role members within Product and Product Type member views.
     • Makes Product Type clickable from the Product detail page.
     • Adds GitLab-specific permission support.
     • Semgrep parser gains support for new severity levels.
     • Prefetch API: adds Swagger documentation for models that support prefetching.

     20 details in Everything

169. 2.38.4 Sep 26, 2024 · release notes

     DefectDojo 2.38.4 adds a configurable toggle to require passwords on user creation.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.38.4 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.38.4

     • Adds a settings toggle (settings.dist.py / local_settings.py) to require a password when creating new users.
     • Exposes the user-password-required toggle via the API, enabling programmatic control of user creation policy.

     2 details in Everything

170. 2.38.3 Sep 23, 2024 · release notes

     DefectDojo 2.38.3 adds Qualys Hacker Guardian and KrakenD audit parsers, HackerOne Bug Bounty support, and risk exception audit notes.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.38.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.38.3

     • New Qualys Hacker Guardian parser for ingesting Hacker Guardian scan results.
     • New KrakenD audit parser for ingesting KrakenD audit findings.
     • Adds support for HackerOne Bug Bounty Program reports in the HackerOne parser.
     • Risk Exceptions: automatically adds/removes audit notes on a finding when it is added to or removed from a risk exception.
     • User accounts now require email at all times and a password for new users.

     +2 more show less

     • Lists global role members in Product and Product Type member views.
     • Adds Swagger documentation for API models that support prefetching.

     7 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !User email is now required at all times and password is required for new users — API calls or integrations that create users without these fields will fail.
171. 2.38.2 Sep 16, 2024 · release notes

     DefectDojo 2.38.2 adds a Wiz SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. parser, Invicti/Netsparker parser support, and less verbose JSON parsing errors.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.38.2 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.38.2

     • Adds Wiz SCA (Software Composition Analysis) parser, plus support for the legacy Fortify format in the Wiz parser.
     • Adds support for the Invicti scanner via the existing Netsparker parser.
     • Makes JSON parsing errors less verbose in the API, reducing noise in error responses.

     3 details in Everything

172. 2.38.1 Sep 9, 2024 · release notes

     DefectDojo 2.38.1 adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scores for Aqua parser, two new parsers (Threat Composer & Legitify), and a dynamic parsing flag for new test types.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.38.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.38.1

     • Adds EPSS score support to the Aqua parser.
     • New parser: Threat Composer.
     • New parser: Legitify.
     • Adds a flag on test types to indicate dynamically parsed test types, exposed via the API and database.
     • Makes Product Type clickable in the Product detail UI.

     5 details in Everything

173. 2.38.0 Sep 3, 2024 · release notes

     DefectDojo 2.38.0 adds API token controls, inline report images, anonymous questionnaires, a new Appcheck parser, and Django 5.0 upgrade.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.38.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.38.0

     • Adds ability to use API tokens without disabling the api-token-auth endpoint, giving admins finer-grained token authentication control.
     • New Appcheck web application scanner parser ingests Appcheck scan results.
     • Inline finding images now rendered directly in generated reports.
     • Supports adding anonymous questionnaires to engagements.
     • Adds AWS ARN of the offending resource into the description field of ASFF parser findings.

     +3 more show less

     • Prowler v4 importer now skips muted findings during import.
     • Upgrades to Django 5.0.
     • Improved naming of the discovered findings filter; same filter now also available for mitigated findings.

     8 details in Everything

174. 2.37.3 Aug 26, 2024 · release notes

     DefectDojo 2.37.3 adds flexible API token controls, letting you issue tokens without disabling the auth endpoint.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.37.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.37.3

     • Adds ability to use API tokens while keeping the api-token-auth endpoint enabled, giving admins finer-grained control over token-based authentication.

     1 detail in Everything

175. 2.37.2 Aug 19, 2024 · release notes

     DefectDojo 2.37.2 adds inline finding images on reports and restores relative date filtering for findings.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.37.2 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.37.2

176. 2.37.1 Aug 12, 2024 · release notes

     DefectDojo 2.37.1 adds anonymous questionnaire support to engagements and a new Appcheck web application scanner parser.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.37.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.37.1

     • Adds anonymous questionnaire option to engagements in the UI.
     • New Appcheck web application scanner parser with settings configuration support.

     2 details in Everything

177. 2.37.0 Aug 5, 2024 · release notes

     DefectDojo 2.37.0 adds Wizcli, Rapplex, and Kiuwan SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. parsers, drops MySQL/RabbitMQ, and gains new listing-table controls and import severity filtering.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.37.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.37.0

     └──▷ HOW TO FIND IT
     Enable or disable listing tables site-wide from the system settings toggle, useful for decluttering the UI for large deployments.
     📍In the console, go to System Settings and toggle the listing table switch on or off.
     • New Wizcli parser for ingesting Wizcli scan results.
     • New Kiuwan SCA parser for software composition analysissoftware composition analysisSoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. results.
     • Extends AWS Prowler v3 parser with additional finding support.
     • Adds minimum severity flag support on import to filter out low-noise findings at ingest time.
     • Adds a toggle switch in system settings to show/hide listing tables.

     +8 more show less

     • Bulk Edit: adds a note when pushing a finding to Jira.
     • Supports setting --max-fd argument to uWSGI to prevent OOMKill in Kubernetes deployments.
     • Migrates Okta authentication from python-jose to python_social_auth.
     • Switches database driver from psycopg2 to psycopg3 (PostgreSQL only).
     • Restores support for disabling test types via the active flag.
     • Product metrics now clickable in UI, redirecting to findings filtered by severity.
     • Centralizes uploaded file serving with improved error handling.
     • API: Finding properties related_fields, jira_creation, and jira_change are now marked as nullable.

     13 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !MySQL is no longer supported — deployments using MySQL as the database backend will break on upgrade.
     • !RabbitMQ is no longer supported as a message broker — deployments using RabbitMQ will break on upgrade.
178. 2.36.6 Jul 29, 2024 · release notes

     DefectDojo 2.36.6 adds a listing-tables toggle in system settings and centralizes uploaded file serving via the API.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.36.6 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.36.6

     └──▷ HOW TO FIND IT
     Enable or inspect the new listing-tables toggle via the System Settings UI.
     📍In the console, go to System Settings and locate the new toggle switch for Listing Tables to enable or disable the feature.
     • Adds a toggle switch in System Settings to control listing tables display.
     • Centralizes file serving for uploaded files and strengthens error handling in the file management API.

     2 details in Everything

179. 2.36.3 Jul 15, 2024 · release notes

     DefectDojo 2.36.3 adds test-type disabling, minimum severity import filtering, and Jira bulk-edit notes.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.36.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.36.3

     • Re-enables disabling Test Types via the active flag through the API.
     • Applies the minimum severity flag during import to filter findings at ingestion time.
     • Adds a note when bulk-pushing findings to Jira via Bulk Edit.
     • Expands Delete Preview to surface previously missed related objects.
     • Updates reporting UI with additional enhancements.

     5 details in Everything

180. 2.36.0 Jul 1, 2024 · release notes

     DefectDojo 2.36.0 adds Deepfence Threatmapper integration and string-based finding report filtering.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.36.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.36.0

     • Adds deepfence threatmapper parser support via settings.dist.py / local_settings.py
     • Enables Finding Reports: Support string based filtering
     • Expands API user contact endpoint to include all user data

     3 details in Everything

181. 2.35.4 Jun 24, 2024 · release notes

     DefectDojo 2.35.4 adds string-based filtering support to Finding Reports across API and UI.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.35.4 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.35.4

     • Adds FindingReports: Support string based filtering to allow searching report entries by text strings
     • Extends the existing Finding Reports feature with new string filtering capability via API endpoints
     • Enhances the UI's Finding Reports with a new string-based search filter input

     3 details in Everything

182. 2.35.1 Jun 6, 2024 · release notes

     UserProfile API properties user_contact_info and global_role are now optional

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.35.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.35.1

183. 2.35.0 Jun 3, 2024 · release notes

     DefectDojo 2.35.0 adds Coverity parser, risk acceptance API, SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. enforcement, object file uploads, user creation date, and integrity checker

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.35.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.35.0

     • Introduce coverity scan parser in settings.dist.py / local_settings.py
     • Make API set/unset risk acceptance status via new endpoints
     • Optionally Enforce SLA Remediation Days (database migration and settings)
     • Object File Uploads: Add validations and download functionality
     • Show date of user creation in API responses and UI

     +1 more show less

     • Introduce integrity checker in settings.dist.py

     6 details in Everything

184. 2.34.3 May 13, 2024 · release notes

     DefectDojo 2.34.3 adds object file upload with validation and download capabilities.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.34.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.34.3

185. 2.34.0 May 6, 2024 · release notes

     DefectDojo 2.34.0 adds Progpilot and Yarn2 parsers, similar findings toggle, configurable API request/response pairs, RHSA links, and string-based filtering.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.34.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.34.0

     • Adds progpilot SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. parser support for importing findings
     • Adds yarn2 parser support for dependency scanning results
     • Adds RedHatSatellite finding link to RHSA advisory
     • Enables string based filtering for engagements and findings

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Removed aws_scout2 parser; remove any imports referencing this parser.
186. 2.33.7 Apr 29, 2024 · release notes

     Adds similar findings toggle and string-based filtering to the UI.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.33.7 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.33.7

     └──▷ HOW TO FIND IT
     Disable automatic merging of similar findings in the UI.
     📍In the Findings view, locate and toggle off Similar Findings: Create Toggle.
     Filter findings using text strings instead of complex query parameters.
     📍Use the new string based filtering field in the Findings UI to search by description or title.
     • Adds string based filtering in the UI for finding queries.

     1 detail in Everything

187. 2.33.6 Apr 29, 2024 · release notes

     Opt-in setting in DefectDojo v2.33.6 improves filtering performance via string-based filtering.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.33.6 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.33.6

     • Adds filtering_strategy setting to enable string-based filtering for improved performance.

     1 detail in Everything

188. 2.33.0 Apr 2, 2024 · release notes

     DefectDojo 2.33.0 adds Wiz, Nancy, Bearer CLI, Checkmarx One and other parsers plus EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. filtering

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.33.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.33.0

     └──▷ HOW TO FIND IT
     Use the UI to filter findings by EPSS scores on the Findings listing page.
     📍Go to Findings › Filters and select EPSS-related fields (e.g. EPSS Score, EPSS Percentile) to narrow down high-risk vulnerabilities.
     • Adds Bearer CLI parser for importing scan results
     • Adds Nancy parser for import vulnerabilities
     • Adds new parser for Wiz findings
     • Adds Checkmarx One parser to replace legacy Checkmarx integration
     • Adds support for npm audit v7+ JSON file format in the Npm audit parser

     +9 more show less

     • Adds crunch42 parser for importing security findings
     • Adds optional EPSS-related filtering on the Findings listing view
     • Adds toggle to apply tags to endpoints during Import/Reimport API calls via the new apply_tags_to_endpoints parameter
     • Makes tags optional for the API import and reimport endpoints
     • Updates OpenVAS CSV parser to include CVE values in output
     • Merges Acunetix and Acunetix360 parsers into a single unified parser
     • Adds Advanced Trivy Operator support for parsing Benchmark reports
     • Updates Tenable parser to support the new workbench format
     • Updates pip-audit parser to handle the new JSON file format

     14 details in Everything

189. 2.32.3 Mar 25, 2024 · release notes

     Tags become optional on import/reimport API endpoints

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.32.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.32.3

     └──▷ TRY IT
     Import a finding without providing a tags array when you do not have or want to set tags.
     copy

     $ curl -X POST https://<dojo-host>/api/v2/import-scan/ \
       -H 'Authorization: Token <token>' \
       -H 'Content-Type: multipart/form-data' \
       -F 'scan_type=Scan Type' \
       -F 'file=@finding.jdx' \
       -F 'verified=true'
       # Note: the 'tags' parameter is omitted entirely

190. 2.32.2 Mar 18, 2024 · release notes

     Adds toggle to apply tags during import/reimport of findings for endpoints in DefectDojo

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.32.2 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.32.2

     └──▷ HOW TO FIND IT
     Control whether endpoint tags are updated during an import or reimport operation via the UI.
     📍In the Import/Reimport screen, look for the toggle labeled Apply tags to endpoints and enable it before running the import.
191. 2.32.1 Mar 11, 2024 · release notes

     Adds Checkmarx One and crunch42 parsers in settings.dist.py

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.32.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.32.1

     • Added CheckmarxOneParser to settings.dist.py to ingest Checkmarx One findings.
     • Added Crunch42Parser to settings.dist.py to ingest Crunch42 findings.

     2 details in Everything

192. 2.32.0 Mar 4, 2024 · release notes

     DefectDojo 2.32.0 adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scoring, OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories.-Scanner and multiple new parser integrations with API and UI enhancements

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.32.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.32.0

     └──▷ TRY IT
     Retrieve findings using the new date filter parameters in the APIv2 endpoint.
     copy

     $ curl -s 'https://<defectdojo>/api/v2/findings/?date_from=2023-01-01&date_to=2023-01-31' -H 'Authorization: Token <token>'

     • Add EPSS score import from AWS Inspector via AWS Security Hub, DependencyTrack output, and general EPSS support
     • Implement osv-scanner integration for vulnerability scanning
     • Add Snyk Code Parser for code analysis results
     • Add Nosey Parker parser for secret detection results
     • Add Burp DASTardly parser for DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. results

     +5 more show less

     • Support Fortify .fpr format in Fortify parser
     • Add GuardDuty findings support in AWS Security Hub parser
     • Extend APIv2 Findings endpoint and UI filters to accept new date filters
     • Add DD_APPEND_SLASH configuration setting
     • Remove drf_yasg (OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. 2.0 Swagger) from API schema generation, relying on DRF Spectacular

     10 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !DRF Spectacular sidecar is now enabled by default, requiring the sidecar service to be running
193. 2.31.2 Feb 20, 2024 · release notes

     Adds sync-labels subcommand to Labeler for Jira label synchronization

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.31.2 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.31.2

     └──▷ TRY IT
     Sync Jira labels to DefectDojo findings using the new Labeler command
     copy

     $ python manage.py labeler sync-labels

194. 2.31.0 Feb 5, 2024 · release notes

     DefectDojo 2.31.0 adds Kubescape/InSpecInSpecAn open-source compliance-as-code framework maintained by Chef that lets you write human-readable tests describing the expected state of systems, so cyber tools can audit infrastructure against policy automatically./SonarQube parsers, SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. expiry fields, tag findings API param, and announcement notifications

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.31.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.31.0

     • Add parser for Sonarqube JSON result
     • add kubescape support
     • add kubeaudit support
     • add redhatsatellite parser
     • implement google cloud artifact scan parser

     +8 more show less

     • Implement Chef InSpec Parser
     • Merge OpenVAS XML and CSV parsers
     • Add bitbucket support to finding view SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. urls
     • finding sla expiration date field (part one)
     • new notifications type: SLA breach combined (per product)
     • API: Add Announcements
     • Add a tag findings parameter to the import-scan and reimport-scan API endpoints
     • Support _FILE environmental variables

     13 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !WhiteSource is renamed to Mend in settings.dist.py / local_settings.py
195. 2.30.3 Jan 22, 2024 · release notes

     Adds First Seen parser flag to DefectDojo settings.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.30.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.30.3

     • Adds the FIRST_SEEN setting to settings.dist.py or local_settings.py to control how first seen timestamps are handled during parsing.

     1 detail in Everything

196. 2.30.0 Jan 2, 2024 · release notes

     DefectDojo 2.30 adds MS Defender parser, ProwlerV3 component_name support, and product/engagement filtering on unset properties

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.30.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.30.0

     • Improve Trivy package path parsing behavior
     • Add Kubernetes cluster resource object support in Trivy
     • Allow filtering Products and Engagements on unset properties
     • Store CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. score and vector during Whitesource imports
     • Import all vulnerabilities when no asset IDs given to api_client

     +1 more show less

     • Improve Request Review Notifications

     6 details in Everything

197. 2.29.0 Dec 4, 2023 · release notes

     DefectDojo 2.29.0 adds JFrog Xray binary scan parsing, SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. & lifecycle filters in Report Builder, and notifications without scan changes

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.29.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.29.0

     • Adds a new parser for jfrog xray binary scans (engineer) to ingest findings via the tool integrations

     1 detail in Everything

198. 2.28.3 Nov 27, 2023 · release notes

     DefectDojo 2.28.3 adds Vuln ID display in UI and improves DD_DEDUPLICATION_ALGORITHM_PER_PARSER configuration.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.28.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.28.3

     • Adds DD_DEDUPLICATION_ALGORITHM_PER_PARSER and DD_HASHCODE_FIELDS_PER_SCANNER settings to control deduplication behavior per parser/scanner.
     • Adds Vuln ID display in the UI for findings sourced from external tools.

     2 details in Everything

199. 2.28.0 Nov 6, 2023 · release notes

     DefectDojo 2.28.0 adds parsers for AppScan HCL, Sysdig CSV, SSHAudit, OpenVAS XML, and Threagile; new Test scan_type API filter.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.28.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.28.0

     • Adds support for importing AppScan HCL scan results via a new parser
     • Adds a CSV parser for Sysdig Vulnerability reports
     • Adds SSH audit report parsing support via sshsaudit parser
     • Adds OpenVAS XML import capability with the openvasxml parser
     • Adds Threagile threat modeling report parsing via the Threagile parser

     +1 more show less

     • Enables audit logging for Product Types

     6 details in Everything

200. 2.27.4 Oct 30, 2023 · release notes

     DefectDojo 2.27.4 adds Whispers 2.2 report importing, Auditlog for Product Types, and Kubehunter/Kube-bench deduplication config.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.27.4 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.27.4

     • Adds whispers2 report import support to ingest Whispers 2.2 vulnerability reports
     • Enables Auditlog for Product Types, recording create/update/delete events
     • Adds configurable deduplication algorithm setting for Kubehunter Scan and kube-bench Scan types

     3 details in Everything

201. 2.27.3 Oct 23, 2023 · release notes

     DefectDojo 2.27.3 adds scan_type filter for Tests in the API and improves Qualys parsing.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.27.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.27.3

     └──▷ TRY IT
     Filter tests by a specific scan type via the API.
     copy

     $ curl -s --header 'Authorization: Token <token>' http://<host>/api/v2/tests/?scan_type=Nessus

     • Adds scan_type parameter to Test API endpoints
     • Updates Qualys parser to aggregate multiple endpoints per Finding

     2 details in Everything

202. 2.27.0 Oct 2, 2023 · release notes

     DefectDojo 2.27 adds product lifecycle filtering, Kube-hunter parser, and HASHCODE_ALLOWED_FIELDS config to control Harbor integration.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.27.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.27.0

     • Add filtering on product lifecycles
     • Add mitigation to HASHCODE_ALLOWED_FIELDS in settings to fix Harbor integration

     2 details in Everything

203. 2.26.4 Sep 25, 2023 · release notes

     DefectDojo 2.26.4 adds CVSSv3.1 support to Qualys CSV parser and enables PUT for risk acceptance updates

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.26.4 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.26.4

     └──▷ TRY IT
     Update an existing risk acceptance state via the API.
     copy

     $ curl -X PUT https://<defectdojo-host>/api/v2/risk_acceptance/<id>/

     • Qualys CSV parser now includes CVSSv3.1 data headers
     • Allows PUT method in risk acceptance update API endpoint

     2 details in Everything

204. 2.26.2 Sep 13, 2023 · release notes

     DefectDojo 2.26.2 adds additional Veracode severity mappings for informational findings.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.26.2 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.26.2

205. 2.26.0 Sep 5, 2023 · release notes

     DefectDojo 2.26.0 adds has_tags and SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. product/finding filters, an open findings burndown chart, and drf-spectacular API hooks.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.26.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.26.0

     └──▷ TRY IT
     Filter findings list to only those tagged with critical using the new has_tags parameter.
     copy

     $ GET /api/v2/findings/?has_tags=critical

     View the trend of open findings over time for a specific product directly in the web interface.
     📍In the DefectDojo UI, navigate to Products › [Product Name] › Metrics and locate the open findings burndown chart.
     • Adds has_tags query parameter to filter products and findings by the presence of specific tags.
     • Adds new filtering options for product and finding SLA (Service Level Agreement) metrics.
     • Adds an open findings burndown visualization to the product metrics dashboard in the UI.
     • Adds drf-spectacular preprocessing hooks to maintain a rigid definition of rendered API endpoints.

     4 details in Everything

206. 2.25.3 Aug 28, 2023 · release notes

     DefectDojo 2.25.3 adds Helm chart config for external Redis port.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.25.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.25.3

207. 2.25.1 Aug 18, 2023 · release notes

     Adds Django service annotations config in Helm and drf-spectacular preprocessing hooks to API schema generation

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.25.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.25.1

     • Adds django_service_annotations option to the Helm values file for configuring Kubernetes service annotations
     • Adds drf-spectacular preprocessing hooks to enforce a rigid definition of rendered API endpoints
     • Generates Semgrep parser unique ID from the tool instead of internal defaults

     3 details in Everything

208. 2.25.0 Aug 7, 2023 · release notes

     DefectDojo 2.25.0 adds Reporter field to Finding API and new Veracode JSON parser

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.25.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.25.0

     └──▷ TRY IT
     Update a finding's reporter field via the API.
     copy

     $ curl -X PUT https://<defectdojo-host>/api/v2/findings/<id>/ \
       -H "Authorization: Bearer <token>" \
       -d '{"reporter": {"username": "jdoe"}}'

     • Adds Reporter field to the Finding PATCH/PUT API endpoints to allow setting the finding reporter via API.

     1 detail in Everything

     └──▷ BREAKING ON UPGRADE

     • !The naming convention for product tags in related objects has been updated; existing integrations relying on the old format may break.
209. 2.24.1 Jul 10, 2023 · release notes

     DefectDojo 2.24.1 adds verified default and finding tag API filter fixes

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.24.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.24.1

     • found_by column on Finding is now updated via a signal.
     • Dependency Track connector now includes CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. Score in findings.

     2 details in Everything

210. 2.24.0 Jul 3, 2023 · release notes

     DefectDojo 2.24.0 adds Jira finding group tags, configurable SameSite cookies, Popeye parser, bulk date editing UI, and false positive history revamp

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.24.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.24.0

     └──▷ HOW TO FIND IT
     Bulk update expiration dates for findings in a specific test to manage SLAs.
     📍Navigate to the Test view, select multiple findings, and use the Bulk Change Dates action.
     • Adds Popeye Scanner Parser to ingest Popeye SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. results.
     • Makes the SameSite attribute for Session / CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. Cookies configurable in settings.dist.py / local_settings.py via the SESSION_COOKIE_SAMESITE and CSRF_COOKIE_SAMESITE settings (standard Django configuration keys for this purpose).
     • Adds the ability to tag Jira tickets created for finding groups.
     • Adds bulk change of finding dates in the Test view via the new UI interface.
     • Revamps the false positive history feature with a new database schema and logic.

     5 details in Everything

211. 2.23.1 Jun 12, 2023 · release notes

     Adds bulk finding date changes in Test view and fixes engagement context creation

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.23.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.23.1

     └──▷ HOW TO FIND IT
     When/why you'd use this — the value or use case.
     📍1. Navigate to a specific Test in the DefectDojo UI. 2. Locate the bulk action controls for the findings list. 3. Select the findings and apply new date values via the bulk edit interface.
     • Enables bulk modification of finding dates directly within a test in the UI.

     1 detail in Everything

212. 2.23.0 Jun 5, 2023 · release notes

     DefectDojo 2.23.0 adds tag inheritance, planned remediation fields, govulncheck/Nessus parsers, and Jira auto-sync

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.23.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.23.0

     • Adds planned_remediation_version and effort_for_fixing fields to findings and API responses.
     • Implements tag inheritance so child objects inherit tags from their parent findings or engagements.
     • Adds the govulncheck parser for importing Go vulnerability reports.
     • Adds auto-sync support for Jira when opening or closing findings, configurable via settings.dist.py / local_settings.py.

     4 details in Everything

213. 2.22.0 May 1, 2023 · release notes

     DefectDojo 2.22.0 adds Wazuh parser, Trivy license parsing, Talisman support, SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. notification disabling per product

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.22.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.22.0

     • Adds Wazuh parser to import findings from Wazuh security scans
     • Adds Trivy license parser integration to import license findings from Trivy scans
     • Adds Talisman parser support for importing Talisman security scan results

     3 details in Everything

214. 2.21.0 Apr 3, 2023 · release notes

     DefectDojo 2.21.0 adds Trivy-Operator and ASFF parsers, JIRA URL setting, SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. backoff, engagement checklists, and finding group links

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.21.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.21.0

     • Adds trivy-operator parser for parsing Trivy Operator vulnerability reports
     • Adds AWS Security Finding Format (ASFF) parser to ingest findings from AWS security services
     • Adds exponential backoff strategy for SLA notifications to improve notification reliability under load
     • Adds extra path parameter in the Engagement API endpoint to support checklists

     4 details in Everything

215. 2.20.2 Mar 20, 2023 · release notes

     DefectDojo 2.20.2 adds JIRA URL specification from the finding interface

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.20.2 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.20.2

     └──▷ HOW TO FIND IT
     Push a finding to a specific JIRA instance by providing its URL directly from the finding UI, bypassing default project settings.
     📍In the DefectDojo UI, navigate to a Finding › Actions › Push to JIRA, then enter the desired JIRA_URL in the prompted field.
     • Adds ability to push findings to JIRA and specify the JIRA URL directly from the finding view

     1 detail in Everything

216. 2.20.1 Mar 13, 2023 · release notes

     DefectDojo 2.20.1 adds checklist support to Engagement API endpoints and improves the Risk Acceptance endpoint

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.20.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.20.1

     └──▷ TRY IT
     Retrieve or update engagement checklists via the new API path.
     copy

     $ curl -X GET https://<defectdojo-host>/api/v2/engagements/<id>/checklists/ -H "Authorization: Bearer <token>"

     • GET/POST /api/v2/engagements/<id>/checklists/ - Adds extra path in Engagement endpoint for checklists

     1 detail in Everything

217. 2.20.0 Mar 6, 2023 · release notes

     DefectDojo 2.20.0 adds Credential Mapping, Questionnaire API, Risk Acceptance read endpoint, Codechecker parser, and default announcement banner

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.20.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.20.0

     • Adds Credential Mapping feature with its own API endpoints for managing credential-to-product associations.
     • Adds read-only API endpoints for Questionnaires (GET /api/v2/questionnaires/)
     • Adds read-only Risk Acceptance API endpoint (GET /api/v2/risk_acceptances/) to query accepted risks.
     • Adds Codechecker parser support for processing static analysis results from the Codechecker tool.
     • Adds a configurable default announcement banner visible to all users upon login.

     5 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !GitHub OAuth integration has been removed; configure GitHub integration via the new Product settings instead.
218. 2.19.1 Feb 13, 2023 · release notes

     DefectDojo 2.19.1 adds product name filter to findings and enables GitHub integration for existing products

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.19.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.19.1

     └──▷ HOW TO FIND IT
     Filter the findings list by product name in the browser interface.
     📍In the UI, navigate to Findings and enter a product name in the Product Name filter box before searching.
     • Enables enabling GitHub integration on products that already exist

     1 detail in Everything

219. 2.19.0 Feb 6, 2023 · release notes

     DefectDojo 2.19.0 adds SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself./KICS Checkmarx parser support, SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. suppression evaluation, finding grouping by title, dynamic Jira issue types, CVSSv3.1 calculator, Global Announcement Banner, and forgot username flow.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.19.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.19.0

     • Add default Dockerfile operating system
     • Implement support for SCA and KICS data in Checkmarx parser
     • Add suppression evaluation in SARIF importer
     • Add the ability to group by the finding title
     • Forward parser errors to users

     +8 more show less

     • Add dynamic Test_Type for Generic parser
     • Allow to configure the deduplication algorithm in Kubernetes via an environment variable DD_DEDUPLICATION_ALGORITHM
     • New env var DD_HASHCODE_FIELDS_PER_SCANNER
     • New env var DD_JIRA_EXTRA_ISSUE_TYPES to add Jira issue types
     • Change CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. calculator to use CVSSv3.1
     • Make Finding verified field default to false
     • Handle test tags when reimporting with reimport_scan api
     • Add functionality forgot username

     13 details in Everything

220. 2.18.4 Jan 30, 2023 · release notes

     Findings out of SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. now display as negative values in the UI to highlight overdue items.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.18.4 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.18.4

     • Displays findings that are out of SLA as negative values in the UI for immediate visibility.

     1 detail in Everything

221. 2.18.0 Jan 3, 2023 · release notes

     DefectDojo 2.18.0 adds AUDITLOG_DISABLE_ON_RAW_SAVE setting, Veracode fixed findings handling, and Endpoint product visibility.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.18.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.18.0

     └──▷ TRY IT
     Disable audit logging for bulk raw save operations to improve performance
     copy

     $ AUDITLOG_DISABLE_ON_RAW_SAVE=True

     Configure SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. authentication backends dynamically without modifying core settings
     copy

     $ SAML_AUTHENTICATION_BACKENDS='myapp.backends.SamlBackend,django.contrib.auth.backends.ModelBackend'

     Query for a product with an exact name match in the API
     copy

     $ GET /api/v2/products/?name__exact=My%20Service

     • Adds AUDITLOG_DISABLE_ON_RAW_SAVE setting to settings.dist.py / local_settings.py to control audit logging behavior on raw saves
     • Show vulnerable hosts / endpoints in the Endpoint product tab for visibility into impacted assets
     • Enables remote RabbitMQ configuration for DefectDojo deployments outside standard local message broker setups
     • Adds ability to change SAML AUTHENTICATION_BACKENDS via environment variable without editing core settings files
     • Adds exact product name filter to find products by precise match rather than partial matching

     5 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Importer + Re-Importer now set active/verified fields to false by default, changing the initial state of ingested findings
     • !Django upgrade from 3.x to 4.x requires updating url() calls to re_path(), ugettext_lazy() to gettext_lazy(), and filter_fields to filterset_fields in custom code
222. 2.17.0 Dec 6, 2022 · release notes

     DefectDojo 2.17.0 adds Vulners parser, ggshield support, custom password/SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. settings, and several API fields.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.17.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.17.0

     • do_not_reactivate option to persist triages from triage-less scanners
     • status_of_finding field returned when closing a finding via the API
     • Custom Password Requirements configuration in System Settings
     • SLA notification configuration (enable notify for sla) in System Settings
     • Default JIRA issue assignee setting

     +9 more show less

     • close_old_findings_product_scope parameter on the importer/reimporter API
     • Engagement end-date available via the API
     • create_finding_groups_for_all_findings logic implemented in both the Importer and Reimporter
     • Source code management parameter for the importer/reimporter API
     • GGshield parser support (Feature/add tool ggshield Parser)
     • Vulners.com reports API parser and importer
     • Checkov severity parsing support
     • Veracode SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. hashcode calculation uses severity
     • Trivy image scan now includes file path data

     14 details in Everything

223. 2.16.0 Nov 2, 2022 · release notes

     DefectDojo 2.16 adds NeuVector parser, supports ZAP verbose XML, filters on reproduce steps, and more

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.16.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.16.0

     • Adds NeuVector compliance scan import support via a new tool parser.
     • Adds support for ZAP XML with requests and responses format in the parser.
     • Enables filtering findings by steps_to_reproduce in the UI/API.
     • Adds Helm chart support for creating PVCs via podLabels configuration.
     • Adds ability to specify Epic name and priority during JIRA synchronization.

     +1 more show less

     • Allows deleting engagements directly from the engagement tab in the UI.

     6 details in Everything

224. 2.15.0 Oct 4, 2022 · release notes

     Adds NeuVector REST scan type, Bugcrowd API importer, JIRA labels/fields per product, and RemoteUser auth to DefectDojo 2.15.0

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.15.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.15.0

     • Introduces NeuVector (REST) as a new scan type in settings.dist.py / local_settings.py
     • Adds ability to set JIRA labels per-product or engagement
     • Adds support for specifying custom JIRA fields in the database schema
     • Adds RemoteUser authentication implementation
     • Adds TruffleHog v3 support to the original trufflehog parser

     +1 more show less

     • Adds sonarcloud global org id support to the SonarQube API Importer

     6 details in Everything

225. 2.14.3 Sep 22, 2022 · release notes

     DefectDojo 2.14.3 adds SonarCloud and multi-branch support to the SonarQube API Importer UI.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.14.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.14.3

     └──▷ HOW TO FIND IT
     Import SonarCloud scan results into DefectDojo using the new integration.
     📍In the UI, go to Imports › SonarQube API Importer and configure it with your SonarCloud project key.
     Import findings for all branches of a SonarQube project by enabling multi-branch scanning in the importer config.
     📍In Imports › SonarQube API Importer, set Multi Branch Scanning to enabled.
     • Adds SonarCloud integration to the SonarQube API Importer
     • Enables import of findings from multiple branches in SonarQube via the SonarQube API Importer

     2 details in Everything

226. 2.14.0 Sep 6, 2022 · release notes

     DefectDojo 2.14 adds native AWS SQS support, BlackDuck and Veracode SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. parsers, per-project SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. config, and SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. deduplication.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.14.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.14.0

     • DD_API_TOKENS_ENABLED API setting enables API token authentication
     • Per-Project SLA Config for customizing service level agreements
     • Support for local_settings.py with BlackDuck parser integration
     • Veracode SCA (SourceClear) JSON/CSV file parser added
     • Whispers scanner parser for identifying secrets in code

     +6 more show less

     • SARIF basic de-duplication data support for test results
     • docker-bench-security results parser and associated tests
     • Code Flows included in finding's description for SARIF test results
     • Native AWS SQS support added to Django Docker image
     • CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. vector parsing via the CVSS parser module
     • CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. JSON report timestamp parsing implemented

     11 details in Everything

227. 2.13.0 Aug 2, 2022 · release notes

     DefectDojo 2.13.0 adds PWN SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. parser support and CVE-to-Vulnerability ID migration.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.13.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.13.0

     • management command migrate_cves_to_vulnerability_ids migrates stored CVE references to the new Vulnerability Id system
     • New pwn_sast_parser integration for importing PWN SAST driver source code scan results
     • Adds prod_type field to ApiFindingFilter query parameters
     • Adds file_upload_extension_allowlist and forced file download authorization settings in settings.dist.py / local_settings.py

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Legacy authorization checks for configuration changes have been removed, requiring updated permission models
228. 2.12.0 Jul 5, 2022 · release notes

     DefectDojo 2.12 adds DD_CSRF_TRUSTED_ORIGINS config, APIv2 configuration_permissions, and new parser support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.12.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.12.0

     • Adds the DD_CSRF_TRUSTED_ORIGINS environment variable for configuring trusted CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. origins.
     • APIv2 now supports configuration_permissions to manage access control settings.
     • Enables Trivy Kubernetes scan integration via a new parser.
     • Adds SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment./SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself./DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. tag support to Veracode findings.
     • Adds Checkmarx parser JSON support as a new input format.

     +6 more show less

     • Adds Semgrep parser CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. list support for enhanced field mapping.
     • Populates the CWE finding field from CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. JSON files.
     • Writes out file path and line number for static findings in exports.
     • Saves the reporter name when creating a finding via APIv2.
     • Enables PostgreSQL high availability deployment support.
     • Allows users to enable or disable the calendar feature.

     11 details in Everything

229. 2.11.0 Jun 7, 2022 · release notes

     DefectDojo v2.11.0 introduces Trivy secret/misconfig import, Azure AD group auth, endpoint-aware deduplication, and a DELETE preview API.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.11.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.11.0

     • Adds VulnerabilityIdParser support for scanning more vendors to extract vulnerability identifiers from diverse tool outputs
     • Enables importing misconfigurations and secrets from Trivy reports into findings
     • Adds import_azuread_groups=True setting in settings.dist.py or local_settings.py to sync Azure AD groups as DefectDojo users/groups
     • Makes the core deduplication algorithm consider endpoint metadata when grouping duplicate findings
     • Adds a preview payload to DELETE API calls so you can verify which objects will be removed before committing

     5 details in Everything

230. 2.10.0 May 3, 2022 · release notes

     DefectDojo 2.10 adds configurable logging pattern and async delete for top-level objects via settings.dist.py

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.10.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.10.0

     • Adds LOGGING_FORMAT setting to control the log output pattern (default Apache format) in settings.dist.py / local_settings.py
     • Enables asynchronous deletion for Product Type, Product, Engagement, and Test objects via API calls
     • Adds CVSS3 score parsing support for Nessus XML files

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The vulnerability reference field is renamed to vulnerability_id in the risk acceptance API and Findings
231. 2.9.0 Apr 5, 2022 · release notes

     DefectDojo 2.9.0 adds Hydra parser, GitHub/GHE social auth, notification profiles, finding groups, bulk notes, and HTML image resizing.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.9.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.9.0

     └──▷ HOW TO FIND IT
     Apply notes to multiple findings at once instead of individually.
     📍Select multiple findings in the list view and click Bulk Notes to add annotations in one step.
     • Adds Hydra import via the settings.dist.py / local_settings.py configuration to ingest findings from Hydra scanners
     • Adds GitHub and GitHub Enterprise as Social Auth providers for user login integration
     • Adds Finding group enhancements enabling grouping and bulk operations on multiple findings simultaneously
     • Adds support for resizing HTML <img> tags within the application content

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The endpoint.mitigated field is removed from the database schema and API responses
232. 2.8.0 Mar 1, 2022 · release notes

     Adds PostgreSQL option in Docker Compose, StackHawk webhook parser, and API user search

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.8.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.8.0

     └──▷ TRY IT
     Search for active superusers in your DefectDojo APIv2 endpoint.
     copy

     $ curl -X GET "https://<your-defectdojo>/api/v2/users/?is_active=true&is_superuser=true" -H "Authorization: Token <your_api_key>"

     Configure Docker Compose to use PostgreSQL as the database backend.
     config copy

     environment:
       - DB_ENGINE=django.db.backends.postgresql
       - DB_HOST=db

     • Add StackHawk HawkScan webhook event parser to settings.dist.py / local_settings.py for ingesting StackHawk scan results
     • Add PostgreSQL as an option for Docker Compose via the database engine configuration
     • APIv2 allows searching users by parameters is_active and is_superuser

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Redis keys updated in Helm chart, potentially affecting cache state if not managed correctly
233. 2.7.1 Feb 1, 2022 · release notes

     Adds Rubocop parser, Edgescan integration, CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.4 support, and API import stats

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.7.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.7.1

     • Adds Rubocop parser for new code scanning results ingestion
     • Adds Edgescan integration as a new import source
     • Enables parsing of CycloneDX reports version 1.4
     • API imports now return statistics on the response for (re)imports

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Removal of AUTHORIZATION_STAFF_OVERRIDE configuration key
     • !Removal of is_staff checks for various functionalities
234. 2.7.0 Feb 1, 2022 · release notes

     DefectDojo 2.7.0 adds Rubocop import parser and stats for API imports; removes legacy authorization flags.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.7.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.7.0

     • Adds Rubocop to the list of supported import parsers for static analysis results
     • API imports now return import statistics in their response payload via the stats field
     • Removes deprecated AUTHORIZATION_STAFF_OVERRIDE setting and legacy is_staff permission checks from multiple APIs

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The AUTHORIZATION_STAFF_OVERRIDE environment variable / config key is removed; scripts relying on it must switch to the new configuration authorization permissions.
235. 2.6.0 Jan 4, 2022 · release notes

     New pip-audit parser, Anchore Grype revamp, configurable permissions via settings.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.6.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.6.0

     • settings.dist.py and local_settings.py: add Configuration authorization to make permission checks and editing of permissions for users and groups configurable
     • Database migration: introduce flag to enable/disable Objects_Product
     • API endpoint behavior change: close old findings of same service only during imports

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Objects_Engagement object is removed; use the new enable/disable flag for Objects_Product instead.
236. 2.5.0 Dec 7, 2021 · release notes

     DefectDojo 2.5.0 adds SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. login button customization, Jira tag pushing, and API import by name

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.5.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.5.0

     • Adds SOCIAL_AUTH_SAML_LOGIN_BUTTON_TEXT setting to configure the SAML login button label in settings.dist.py or local_settings.py.
     • Enables pushing vulnerability tags to Jira via the Endpoint Metadata Importer feature, allowing tags/custom fields to be added directly to endpoints during ingestion.
     • Expands the import/reimport API (api/v2/findings/import, etc.) to accept name instead of only id for product and engagement references.

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The FEATURE_AUTHORIZATION_V2 feature flag has been removed; legacy authorization parts are no longer supported in the API or database models.
237. 2.4.0 Nov 2, 2021 · release notes

     DefectDojo 2.4.0 adds Horusec and Solar Appscreener parsers, SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. context regions, Read-Only user profiles, and Engagement CSV/Excel export.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.4.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.4.0

     └──▷ TRY IT
     Create a new user and set their initial password via the APIv2.
     copy

     $ curl -X POST https://<defectdojo>/api/v2/users/ -H 'Authorization: Token <token>' -H 'Content-Type: application/json' -d '{"username": "newuser", "first_password": "securepass123"}'

     • service field on Findings for deduplication logic
     • Horusec parser added via horusec.py importer
     • Solar Appscreener parser added via solar_appscreener.py importer
     • Burp GraphQL parser added via burp_graphql.py importer
     • Dependency Check Suppression parsing in dependency_check_suppression_parser.py

     +3 more show less

     • User Profile read-only mode toggle via read_only field on User profile model
     • Engagement CSV/Excel export capability added to UI and API
     • APIv2 POST /api/v2/users/ accepts first_password for initial user creation

     8 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !safety_parser module removed; import jobs using Safety parser must migrate to a different tool or format.
238. 2.3.0 Oct 5, 2021 · release notes

     DefectDojo 2.3.0 adds Azure Security Center importer, SonarQube security hotspot import, configurable Bandit deduplication, and CSV/Excel export

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.3.0

     • Add Cobalt.io API parser/importer for new tool integration

     1 detail in Everything

     └──▷ BREAKING ON UPGRADE

     • !Switch Finding.publish_date to Date type (DateField)
239. 2.2.0 Aug 31, 2021 · release notes

     DefectDojo 2.2.0 adds Cloudsploit and Mobsfscan parsers, searchable UI selects, and Engagement_Presets/Negotiation API endpoints

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.2.0

     • cloudsploit import parser for Aquasecurity scans
     • mobsfscan import parser
     • Support JSON import format for AWS Prowler scans
     • Searchable dropdowns in UI select fields
     • Engagement_Presets API endpoint

     +2 more show less

     • Network_Locations API endpoint
     • Notifications API and enhanced MetaData API

     7 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !User deletion is restricted when the user is linked to product-related objects
     • !OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. behavior changes with new default group and settings for staff members requiring a database migration and hash code recomputation
240. 2.1.0 Jul 27, 2021 · release notes

     DefectDojo 2.1.0 adds GitLab Secret Detection and Acunetix 360 parsers, env-based SAML2 mapping, and parser enable/disable flags.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.1.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.1.0

     • Adds GitLab_SECRET_DETECTION_REPORT_SOURCES support for parsing GitLab secret detection reports
     • Adds new import parser for Acunetix 360 findings
     • Adds environment variables to specify SAML2 attribute mapping configuration
     • Adds a flag to enable or disable specific import parsers
     • Enables findings groups by default via FINDINGS_GROUPS_ENABLED

     +1 more show less

     • Enables import history by default via IMPORT_HISTORY_ENABLED

     6 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Finding images are removed and migrated to file attachments, changing storage backend requirements.
241. 2.0.0 Jun 29, 2021 · release notes

     DefectDojo 2.0 adds authorization V2 with groups/roles, removes API v1, and adds many new importers

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.0.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 2.0.0

     └──▷ TRY IT
     Filter engagements by product type using the new APIv2 filter.
     copy

     $ GET /api/v2/engagements/?product_type__id=<product_type_id>

     • Adds support for Authorization V2 with Groups of users, Global roles, and frontend UI for managing group membership.
     • Adds management command dojo_migration_auth_v2 to migrate existing users to Authorization V2 and set it as the default.
     • Adds endpoint methods to APIv2 for managing endpoints including protocol size changes and userinfo support.
     • Removes API v1; all clients must now use APIv2.
     • Removes setup.bash install method; users must use alternative installation instructions.

     +24 more show less

     • Removes PDF reports feature from the application.
     • Removes Engagement_Type model and associated engagement type parts.
     • Adds GitLab container scanning report parser import capability.
     • Adds Trustwave Fusion API Parser import capability.
     • Adds importer for Jfrog Xray Unified reports.
     • Adds GitLab DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Parser import capability.
     • Adds Nuclei parser import capability.
     • Adds AuditJS parser import capability.
     • Adds WhiteHat Sentinel DAST parser import capability.
     • Adds Meterian Scanner import capability.
     • Adds TFSec parser import capability.
     • Adds Nessus WAS Scanner import capability.
     • Adds terrascan parser import capability.
     • Adds cargo audit parser import capability.
     • Adds Generic parser JSON format support via new endpoints and parser configuration.
     • Adds Detect-secrets parser import capability.
     • Adds KICS parser import capability.
     • Adds Dockle parser import capability.
     • Adds Intsights Parser import capability.
     • Adds Coverity API parser import capability with verified data and deduplication algorithm.
     • [Endpoints] Change size of protocol fields and add full support for using ports and userinfo in endpoints v2.
     • Adds checkboxes to disable checklists, questionnaires, and credentials for engagements.
     • Allows filtering on findings not having tags via API filters for transitive tags.
     • Adds APIv2 Product Type filter to Engagement endpoints.

     29 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !API v1 is removed; all API clients must switch to APIv2 endpoints.
     • !The setup.bash install method is removed from the installation options.
     • !PDF reports are no longer generated or available in the application.
     • !The Engagement_Type model is removed; engagement types can no longer be stored or queried via that model.
     • !Finding.is_Mitigated field is renamed to is_mitigated in the database/API models.
     • !SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. integration now requires djangosaml2 instead of django-saml2-auth.
242. 1.15.0 Apr 27, 2021 · release notes

     DefectDojo 1.15.0 adds CredScan and CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. parsers, allows finding grouping, and refines deduplication.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 1.15.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 1.15.0

     • Add parser for CycloneDX
     • Allow grouping of Findings (and push to JIRA)
     • Show hash_code in title of ID field on the finding view
     • Enable file_path partial matching instead of exact match for filters

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Allow grouping of Findings (and push to JIRA) is now available but disabled by default
243. 1.14.0 Mar 30, 2021 · release notes

     DefectDojo 1.14.0 adds new importers (Checkmarx OSA, Wfuzz, PMD), Authorization V2 for products/engagements/tests, configurable JIRA templates/disclaimers/sessions, and TruffleHog3 support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 1.14.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 1.14.0

     • Adds Checkmarx OSA parser with cvss3 score support
     • Adds Wfuzz import parser
     • Adds PMD import parser
     • Adds Nikto parser JSON format support
     • TruffleHog3 parser support and refresh version 2

     +9 more show less

     • Make the Django session duration configurable
     • JIRA: allow different templates for jira description rendering
     • Add configurable disclaimer to notifications and reports
     • JIRA status reconciliation management command
     • Hash code deduplication for GitLab SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and Checkov
     • allow jira reconciliation to run through celerybeat
     • Quick report based on current finding filters
     • SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface.: support date of findings
     • Nexpose parser: Process all hosts + add Endpoint(and protocol) + add new reference links

     14 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Removal of automatic nmap scans
     • !Reimport feature now uses configurable deduplication for matching new findings to existing findings
244. 1.13.0 Feb 23, 2021 · release notes

     DefectDojo 1.13 adds Anchore Grype parser, Qualys WAS findings integration, object-based AuthZv2 and import history tracking.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 1.13.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 1.13.0

     • Adds parser for Anchore Grype scan
     • Allow marking Qualys WAS security weaknesses as findings
     • AuthZv2.0: Object-based authorization (1st pull request)
     • feature flag: Track Import history per Test
     • Make mitigated date editable

     5 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Deprecation warning SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. integration
245. 1.12.0 Jan 26, 2021 · release notes

     DefectDojo 1.12.0 adds Burp REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. importer, system settings via APIv2, and disables APIv1

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 1.12.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 1.12.0

     • Import Burp REST API findings into DefectDojo products
     • Update system settings via the APIv2 interface
     • Display Jira issue keys in the findings list instead of icons
     • Automated cleanup of alerts per user is now active

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !APIv1 endpoints are disabled by default; APIv2 must be used instead
     • !The custom_field dependency has been removed; references will fail
246. 1.11.0 Dec 29, 2020 · release notes

     DefectDojo 1.11.0 adds GitLab Dependency Scanning and OASIS SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. imports, plus DD_LOG_LEVEL config and login form hiding.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 1.11.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 1.11.0

     • Add support for GitLab Dependency Scanning reports
     • Importer: Add OASIS SARIF format
     • logging: add DD_LOG_LEVEL setting
     • Allow to specify the Environment when importing data from the APIv2 and the UI
     • [feat/login-form] Allowing login forms to be hidden

     +1 more show less

     • Add duplicate finding support to API v2

     6 details in Everything

247. 1.10.0 Nov 24, 2020 · release notes

     DefectDojo 1.10 adds per-engagement JIRA config, findings metadata API operation, and HTML report builder

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 1.10.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 1.10.0

     └──▷ HOW TO FIND IT
     Generate an HTML report for a product (assuming UI support for the reintroduced builder)
     📍In the console, go to Product › Reports and select HTML as the format
     • Adds jira_project configuration option to allow JIRA settings per engagement
     • Adds GET /api/v2/findings/<id>/metadata/ API endpoint for findings metadata operations
     • Reintroduces the HTML report builder as a new output format option

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Charts now rely on bitnami's repository instead of the previous maintainer
248. 1.9.0 Oct 27, 2020 · release notes

     DefectDojo 1.9.0 adds SSLyze import, configurable SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. logout, DELETE endpoints for products/environments in APIv2, and a Component overview UI.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 1.9.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 1.9.0

     • Import JSON reports from the SSLyze scanner
     • Delete products and environments via API v2 DELETE methods
     • Add Component overview screen to the UI
     • Filter product metrics using a new query parameter
     • Configure SAML2 logout endpoint with a named variable

     +1 more show less

     • Add DD_LOGGING_FORMAT environment variable for Celery logger section

     6 details in Everything

249. 1.8.0 Sep 29, 2020 · release notes

     DefectDojo 1.8.0 adds parsers for kube-bench, Checkov, Risk Recon, AWS Security Hub; new metrics, UI fields, and env vars

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 1.8.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 1.8.0

     └──▷ USE IT
     Ingest Kubernetes benchmark results from a kube-bench scan output file into DefectDojo.
     shell copy

     defectdojo import --file kube-bench-results.json --importer kube_bench

     Ingest Infrastructure-as-Code findings from a Checkov JSON report.
     shell copy

     defectdojo import --file checkov-results.json --importer checkov

     Create a new user in DefectDojo programmatically using the new API endpoint.
     copy

     $ curl -X POST http://localhost:8080/api/v2/users/ -H 'Authorization: Token YOUR_API_KEY' -d '{"username": "newuser", "email": "user@example.com"}'

     View request/response details for a specific finding in the DefectDojo web UI.
     📍Navigate to Findings › [Findings Name] and scroll to the Request/Response section.
     Add metadata to a finding via the API for custom tagging or categorization.
     copy

     $ curl -X PATCH http://localhost:8080/api/v2/findings/123/ -H 'Authorization: Token YOUR_API_KEY' -H 'Content-Type: application/json' -d '{"metadata": {"team": "backend", "priority": "high"}}'

     • Add kube-bench report importer to ingest Kubernetes benchmark findings
     • Add Checkov scanner parser to ingest IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. security results
     • Add Risk Recon API Importer for external threat intelligence integration
     • Implement AWS Security Hub Scan Parser to ingest AWS Security Hub findings
     • Calculate metrics by endpoint status in the UI and API

     +14 more show less

     • Allow setting CELERYD_PREFETCH_MULTIPLIER and UWSGI_THREADS/UWSHI_PROCESSES via environment variables in docker-compose and Helm charts
     • Add support for finding metadata via new metadata field in the findings API
     • Expose request/response pairs in finding APIv2 calls for deeper context on findings
     • Set component name and version fields in php symfony & dependency check parsers output
     • Limit staff access to authorized users via new configuration options
     • Add notes at Engagement level with improved Test level note management
     • Allow custom dates on product type metrics in the UI
     • Display CVSS3.0 Score directly in the DefectDojo interface
     • Make additional environment variables configurable in settings.py for advanced deployments
     • Show request/response pairs directly in the Finding view UI
     • Dedicate a certificate to the Django saml2 plugin for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. configurations
     • Extend Regulation GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. and API endpoints for compliance management
     • Add Sonarqube integration endpoints to APIv2 for pushing data programmatically
     • Add user post endpoint to APIv2 for programmatic user creation

     19 details in Everything

250. 1.7.0 Jul 21, 2020 · release notes

     DefectDojo 1.7.0 adds SAML2 auth, partial remediation, new scanners (Twistlock, HuskyCI, CCVS), and risk acceptance flags.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 1.7.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 1.7.0

     └──▷ TRY IT
     Create a new application metadata record using the API to manage cyber tooling assets programmatically.
     copy

     $ curl -X POST http://localhost:8080/api/v2/applications/ ...

     • Add Technology (App Analysis) management via UI and APIv2 allows creating and managing application metadata through the web interface and REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..
     • Adds SAML2 support for authentication, enabling Identity Provider integration.
     • Partial endpoint remediation enables marking specific code paths as fixed without closing the entire finding.
     • Adds risk acceptance flag and simple bulk risk acceptance capability to findings.

     4 details in Everything

251. 1.6.0 May 23, 2020 · release notes

     DefectDojo 1.6.0 adds parsers for Gitleaks, Harbor and Anchore Enterprise, plus Auth0 OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. and bulk risk acceptance API

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 1.6.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 1.6.0

     • Adds gitleaks parser for new scanner support
     • Adds harbor vulnerability API parser
     • Adds Anchore Enterprise policy check parser
     • Implements Auth0 OAuth2 authentication method
     • Enables query by finding_id on the GET /api/v2/jira_finding_mapping/ endpoint with finding_id parameter

     5 details in Everything

252. 1.2.0 Sep 20, 2017 · release notes

     DefectDojo 1.2.0 adds scanner de-duplication, credential manager, remote DB support, and new integrations.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 1.2.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 1.2.0

     • Scanner de-duplication / consolidation
     • Health dashboards for critical products
     • Added '@' mention alerts to notifications
     • Added remote database support to the setup script
     • Made application settings changeable from the UI

     +5 more show less

     • Created the ability to assign tests so that engagements can be split between multiple people
     • Made the calendar toggleable between engagements and tests
     • Slack integration
     • HipChat integration
     • Added support for Qualys, Retire.JS, and the Node Security Platform

     10 details in Everything

253. 1.1.2 Nov 12, 2016 · release notes

     DefectDojo 1.1.2 adds Arachni, Visual Code Grepper, OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Dependency Check, and CSV importers plus new model and contact fields

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 1.1.2 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 1.1.2

     └──▷ TRY IT
     Run the necessary migrations to update the database schema for new contact fields and importers.
     copy

     $ ./manage.py makemigrations dojo && ./manage.py migrate && ./manage.py collectstatic && ./manage.py migrate_product_contacts

     • Adds Arachni Scanner JSON upload support for processing Arachni scan reports.
     • Adds import functionality for Visual Code Grepper scan results.
     • Adds import functionality for OWASP Dependency Check scan results.
     • Adds CSV file import for findings via new CSV importer.
     • Adds Finding_Template model to the API.

     +2 more show less

     • Adds product_manager, team_manager, and technical_contact fields to the Product model as foreign keys to User objects.
     • Extends the User model with UserContactInfo to store title, phone, cell, twitter, and github information.

     7 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The prod_manager, manager, and tech_contact fields on the Product model are replaced by product_manager, team_manager, and technical_contact; references in the project have been migrated to the new fields.
254. 1.1.0 Oct 5, 2016 · release notes

     DefectDojo 1.1.0 adds tags, metadata, images for findings, AppSpider support, and URL prefix configuration.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 1.1.0 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout 1.1.0

     └──▷ TRY IT
     Add a custom tag to a specific finding via the API for easy filtering later.
     copy

     $ curl -X POST 'http://<host>/api/v1/findings/<finding_id>/' -H 'Authorization: Token <key>' -H 'Content-Type: application/json' -d '{"tags": ["new-feature", "Q3-review"]}'

     Configure the application to run behind a reverse proxy at /secure-app.
     copy

     $ docker run -e URL_PREFIX=/secure-app -p 8080:8080 defectdojo/django-defectdojo

     Import findings from an AppSpider scan into DefectDojo.
     copy

     $ python manage.py import_appspider --file appspider_report.xml

     • Adds Tags field to findings allowing users to categorize and filter results with custom labels
     • Adds Metadata capability to findings enabling structured key-value pairs for additional context
     • Adds the ability to upload Images directly to individual findings via the UI or API
     • Adds new detection engine support for AppSpider scanners in import workflows
     • Adds URL_PREFIX environment variable to configure application URL routing

     5 details in Everything

255. v1.0.5 Dec 23, 2015 · release notes

     v1.0.5 adds iCalendar support for engagements, Finding Templates CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information., PDF report generation, and quick find re-opening.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v1.0.5 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout v1.0.5

     └──▷ TRY IT
     Initialize the new finding template tables after upgrading.
     copy

     $ ./manage.py migrate_finding_templates

     • Adds vobject library integration to enable new iCalendar features in tests and engagements
     • Introduces migrate_finding_templates management command to initialize finding template data
     • Requires Celery and wkhtmltopdf for generating PDF reports via the major report functionality overhaul
     • Enables reopening closed findings through a dedicated touch action without full editing

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Finding field Endpoint has been DEPRECATED - makemigrations is needed.
256. v1.0.4 Sep 8, 2015 · release notes

     DefectDojo v1.0.4 adds a metrics page for Product Type counts and raises environment requirements

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v1.0.4 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout v1.0.4

     └──▷ HOW TO FIND IT
     Verify the new Product Type metrics are exposed in the application UI.
     📍Navigate to the Metrics page in the DefectDojo web interface to view product type counts.
     • Adds a new metrics view reporting simple Product Type counts
     • Requires Django 1.8+ and Python 2.7+
     • Removes unused jquery.tablesorter from the dependency list

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Drops support for Django versions prior to 1.8
     • !Drops support for Python versions prior to 2.7
257. v1.0.3 Jul 27, 2015 · release notes

     Adds user management actions and model history logging via django-auditlog in DefectDojo v1.0.3

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v1.0.3 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout v1.0.3

     └──▷ USE IT
     Enable automatic model change tracking by adding auditlog to installed apps in settings.dist.py
     config copy

     # In settings.dist.py
     INSTALLED_APPS = (
         # ... other apps ...
         'auditlog',
     )

     • Adds auditlog to INSTALLED_APPS for automatic model change tracking
     • Adds {% block sidebar-items %} in side navigation for app menu extension

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Requires database table updates via ./manage.py makemigrations and ./manage.py migrate to upgrade from previous versions
258. v1.0.2 May 29, 2015 · release notes

     Endpoint model support with management script for migration and enhanced permissions for authorized users

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v1.0.2 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout v1.0.2

     └──▷ TRY IT
     Migrate existing text-based endpoint data to the new structured Endpoint model before upgrading to v1.0.3.
     copy

     $ ./manage.py migrate_endpoints

     • Added Endpoint model with add, edit, delete, report, and metrics capabilities
     • Added ./manage.py migrate_endpoints management script to migrate from text-based endpoints to the new Endpoint model
     • Enhanced Product Authorized Users to view Products, Endpoints, Findings, Metrics, generate reports, and manage port scans (setup, results, on-demand scans, settings)
     • Improved Finding reports to use finding ID as reference instead of loop counter

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The legacy endpoint field will be removed in version 1.0.3
259. v1.0.1 Apr 27, 2015 · release notes

     DefectDojo v1.0.1 adds finding reports in Asciidoc/PDF, Veracode/Burp XML uploads with severity filtering, and hardened cookie settings.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v1.0.1 https://github.com/DefectDojo/django-DefectDojo.git
     # already have the repo? check out this version:
     $ git checkout v1.0.1

     • Added reports capability at Product_Type, Product, Engagement and Test levels generating Asciidoc and PDF formats
     • Added ability to upload Veracode XML export files
     • Added ability to upload Burp XML reports from Scanner
     • Added minimum severity level selector for Nessus, Veracode and Burp imports
     • Added CSRF_COOKIE_HTTPONLY, SESSION_COOKIE_SECURE and CSRF_COOKIE_SECURE settings with setup instructions

     5 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The models.py change requires running makemigrations/migrate before using the new report features