defectdojo — The Cyber Toolchain

defectdojo 3.5.0

Mon, 02 Nov 2026 21:24:12 GMT

DefectDojo adds LocationData builders for domain, IP, and certificate data, a default-queryset plugin hook, and environment-variable reading for secret key fallbacks⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Read Django secret key fallbacks via the `DD_SECRET_KEY_FALLBACKS` environment variable instead of hardcoding them in `settings.dist.py` or `local_settings.py`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Add a default-queryset hook for plugins via the new database migration, enabling plugins to scope querysets at the model level. • Adds `LocationData` builders for domain, IP, and certificate data to populate location records programmatically. • DefectDojo Cloud instances can now supply their own AI model for the Sensei feature. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo api-docs-7be342814ede

Fri, 30 Oct 2026 07:57:40 GMT

DefectDojo Pro adds live API key change detection and dynamic token-controls visibility based on administrator token policy⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • DefectDojo Pro now re-reads the active API key whenever its browser tab regains focus, showing an 'API Key Changed' notice if the key was replaced in another tab or by an administrator — instead of silently using a stale key.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • DefectDojo Pro now hides token-management controls site-wide when API tokens are disabled by policy: the account menu, 'Force Token Reset' in user menus, 'Reset API Tokens' in the Users list bulk actions, and the API Access walkthrough are all removed, and the MCP Service page notes that an AI provider cannot connect because the MCP server authenticates with an API token. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.4.304

Fri, 30 Oct 2026 02:26:51 GMT

DefectDojo adds Package URL support for dependency findings in the generic parser⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • The generic parser now accepts a Package URL (purl) for a finding's dependency, letting you link findings directly to a specific package.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.4.300

Mon, 26 Oct 2026 15:53:04 GMT

DefectDojo 3.4.300 adds a product export API (manifest + NDJSON stream), bulk Jira unlink, location test attribution, and Siemens SSB VulnIDs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a product export API returning a manifest and an NDJSON stream for bulk product data export.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds feat(jira): unlink findings from Jira in bulk edit via the UI and API. • Adds feat(locations): attributes each location reference to the test that reported it, with a supporting database migration. • Adds Siemens SSB VulnID support via `settings.dist.py` / `local_settings.py`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo api-docs-cf3a04800f5d

Fri, 23 Oct 2026 08:12:21 GMT

DefectDojo Pro adds service user tokens (`ddsu_` prefix) exchangeable for OAuth 2.0 bearer tokens via `POST /api/v2/oauth/token/`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `POST /api/v2/oauth/token/` endpoint to exchange a service user token (prefixed `ddsu_`) for a one-hour OAuth 2.0 bearer access token using the client credentials grant, sent as `Authorization: Bearer `.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces service user tokens in DefectDojo Pro, prefixed `ddsu_`, usable directly via `Authorization: Token ddsu_` for API authentication. • New endpoint documented: POST /api/v2/oauth/token/ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.4.201

Wed, 21 Oct 2026 04:26:39 GMT

DefectDojo 3.4.201 reports Qualys VMDR asset names as host locations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Reports the Qualys VMDR asset name as a host location for findings imported from Qualys VMDR.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.4.200

Mon, 19 Oct 2026 18:14:55 GMT

DefectDojo 3.4.200 adds per-release schema snapshots for empty databases and a caller-configurable batch dedupe match action.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Loads a per-release schema snapshot into empty databases on first start, speeding up fresh deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Lets a caller decide what a batch dedupe match does, giving API consumers control over deduplication behaviour. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.4.100

Mon, 12 Oct 2026 21:18:51 GMT

DefectDojo 3.4.100 adds locations as a findings/products prefetch option and system checks for default settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds system checks for settings left at their shipped values in `settings.dist.py` / `local_settings.py`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Stores the SonarQube issue key as `unique_id_from_tool` for REST API imports. • Applies API token settings to API v3 token auth and applies the token endpoint's account rules to HTTP Basic auth on the API (new `settings.dist.py` / `local_settings.py` setting). • Offers the engagement's findings on the risk acceptance forms. • Shares cell handling between the CSV and Excel exports. • Uses scoped endpoint choices on the import and re-import forms. • Limits account-recovery emails per address (new `settings.dist.py` / `local_settings.py` setting). • Requires a login for the report cover page (new `settings.dist.py` / `local_settings.py` setting). • Declares each API deprecation once, with a release calendar. • Aligns JIRA configuration editing with tool configuration editing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo api-docs-9db73511e919

Sat, 10 Oct 2026 08:16:27 GMT

DefectDojo API token revocation endpoint returns 204 and notifies token owners, with UI lockout guidance added.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Token revocation endpoint returns `204` on success, deletes the token, clears any per-user expiry override, and notifies the token owner to generate a new token from the `API v2 Token` page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • When API tokens are disabled, the `API v2 Token` page in DefectDojo Pro displays the reason `'API tokens are disabled.'` instead of a key, making the disabled state explicit to users. • Adds guidance that the UI remains accessible via session authentication if the API is locked out, and a new token can be issued from the `API v2 Token` page without losing UI access. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.4.0

Mon, 05 Oct 2026 17:08:29 GMT

DefectDojo 3.4.0 refreshes the UI theme, returns nested user shapes from API v3 expand, and eliminates N+1 queries on product and asset list endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Returns the v2 nested user shape from API v3 `expand`, giving callers richer user objects without a separate lookup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Eliminates N+1 queries on the product and asset list endpoints, enabling performant large-scale asset enumeration. • Refreshes the DefectDojo UI theme to the updated DefectDojo brand. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.3.200

Mon, 21 Sep 2026 16:56:25 GMT

DefectDojo 3.3.200 adds container image location emission from container scanners and debounced product grade recalculation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Container scanners now emit the scanned image as an `Image` location, linking container images to their repository in the Locations model.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Debounces product grade recalculation per product to improve performance on large imports. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.3.100

Mon, 14 Sep 2026 18:18:51 GMT

DefectDojo 3.3.100 adds injectable dedupe candidate scope and winner ordering, plus pooling controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds injectable candidate scope and winner order configuration to the deduplication engine, along with dedupe pools support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo api-docs-1f90ea491d7a

Mon, 14 Sep 2026 14:43:42 GMT

defectdojo: New endpoint documented: PATCH /api/v2/user_contact_infos/{id}/ Breaking changes: • Setting `DD_API_TOKEN_DEFAULT_EXPIRY_DAYS` to a value greater than 0 is retroactive: every token older than that many days is immediately invalidated on the next use, including tokens in CI/CD pipelines and your own admin API token. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo api-docs-1f90ea491d7a

Sun, 13 Sep 2026 14:52:32 GMT

defectdojo: Adds `token_expiry` field to `PATCH /api/v2/user_contact_infos/{id}/` (superuser only) to set or clear a per-user token expiry datetime; after the datetime passes, the user's token receives `403 Forbidden` with `{"detail": "API token has expired."}` until a new token is generated; set to `null` to clear the override. • Adds `DD_API_TOKEN_DEFAULT_EXPIRY_DAYS` environment variable to enforce an instance-wide maximum token lifetime (in days, measured from each token's creation time); applies retroactively to all existing tokens including those issued via `POST /api/v2/api-token-auth/`; defaults to no expiry when unset. • New endpoint documented: POST /api/v2/api-tokens/revoke/ Breaking changes: • Setting `DD_API_TOKEN_DEFAULT_EXPIRY_DAYS` is retroactive: every token older than the configured window is immediately invalidated on upgrade, including tokens driving CI/CD pipelines and the token of the user making the change. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo api-docs-1f90ea491d7a

Sat, 12 Sep 2026 13:33:17 GMT

DefectDojo gains programmatic API token revocation, per-user expiry, and an instance-wide default token lifetime setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `POST /api/v2/api-tokens/revoke/` endpoint allowing a superuser or Global Owner to revoke a token by its key value, without knowing the owning user; returns 204 on success, 404 if the key is not found, 400 if the key field is missing, or 403 for non-superusers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `token_expiry` field on `PATCH /api/v2/user_contact_infos/{id}/` (superuser only) to set a per-user token expiry datetime; expired tokens receive `403 Forbidden` with `{"detail": "API token has expired."}` and setting the field to `null` clears the override and falls back to the instance default. • Adds `DD_API_TOKEN_DEFAULT_EXPIRY_DAYS` environment variable to enforce a maximum token lifetime across all users; tokens expire that many days after creation and the setting is evaluated at request time, making it retroactive to existing tokens. Breaking changes: • Setting `DD_API_TOKEN_DEFAULT_EXPIRY_DAYS` to a value greater than 0 is retroactive: every token already older than the configured window is immediately invalidated on its next use, including tokens driving CI/CD pipelines and your own API token. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo api-docs-1f90ea491d7a

Fri, 11 Sep 2026 14:51:08 GMT

defectdojo: Adds `POST /api/v2/api-tokens/revoke/` endpoint allowing a superuser or Global Owner to revoke a compromised token by its key value, returning 204 on success and notifying the token owner.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `DD_API_TOKEN_DEFAULT_EXPIRY_DAYS` environment variable to enforce a maximum token lifetime (in days) across all users instance-wide, evaluated at token-use time and applied retroactively to existing tokens. Breaking changes: • Setting `DD_API_TOKEN_DEFAULT_EXPIRY_DAYS` to a value greater than 0 is evaluated retroactively: every existing token older than the configured window is immediately invalidated, including tokens driving CI/CD pipelines and your own API token. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo api-docs-1f90ea491d7a

Thu, 10 Sep 2026 14:51:26 GMT

defectdojo: Adds `POST /api/v2/api-tokens/revoke/` endpoint, allowing a superuser or Global Owner to revoke a token by its key value (returns 204 on success, 404 if key not found, 403 for non-superusers).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `token_expiry` field to `PATCH /api/v2/user_contact_infos/{id}/` so superusers can set or clear a per-user token expiry datetime; expired tokens receive `403 Forbidden` with `{"detail": "API token has expired."}` rather than being deleted. • Adds `DD_API_TOKEN_DEFAULT_EXPIRY_DAYS` environment variable to enforce an instance-wide maximum token lifetime (in days) measured from each token's creation time; defaults to no expiry. • New endpoint documented: POST /api/v2/api-tokens/revoke/ • New endpoint documented: POST /api/v2/users/{id}/reset_api_token/ • New endpoint documented: PATCH /api/v2/user_contact_infos/{id}/ Breaking changes: • Setting `DD_API_TOKEN_DEFAULT_EXPIRY_DAYS` is retroactive: any existing token older than the configured window is immediately invalidated when the setting is enabled, including tokens used by CI/CD pipelines and your own admin token. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.3.0

Tue, 08 Sep 2026 21:57:34 GMT

DefectDojo 3.3.0 adds a locations backfill cancel hook, Regulations support, and multiple API and Rules Engine 2.0 expansions. • Adds a cancel hook to the endpoints-to-locations backfill via feat(locations). • Sets finding mitigation automatically from Dependency Track affected version ranges. • Adds an RSS feed to the changelog. • Adds KEV and exploit-evidence condition fields to Rules Engine 2.0. • Adds exploit-evidence, reachability, and asset-exposure condition fields to Rules Engine 2.0. • Adds the missing-scan trigger to Rules Engine 2.0. • Adds SLA configuration and Risk Priority asset actions to Rules Engine 2.0. • Adds custom fields support to Rules Engine 2.0. • Adds asset support to Rules Engine 2.0. • Adds typed Custom Fields feature with support on create and edit forms. • Adds Chart blocks to the reporting feature (no longer 'coming soon'). • Adds GitHub issue import support to the GHAS connector. • Adds GMP over SSH support for the OpenVAS / Greenbone connector. • Adds Wiz imports without Projects via a tenant-level Record. • Adds a Qualys Host Tags filter to the Qualys connector. • Adds multi-Asset finding fan-out to Smart Upload. • Adds PAIN-keyed FedRAMP VDR remediation deadlines to the federal feature. • Adds Feed Rules, the no-SBOM matching path, and advisory-to-case to PSIRT. • Adds AI Model Settings with LLM provider configuration to the Sensei feature. • Adds the Claude Code plugin page and corrects the MCP tool count. • Adds CSPM cloud-posture page, hub views, and fix-quota states to Sensei. • Adds inline repo association and locate-the-file fix flow to Sensei. • Adds AI agent skill scanning to Sensei. • Adds MFA disabling now requiring a verification code. • Adds a `GET /api/v2/` Custom Fields API endpoint. • Adds `Quick Export` dialog that produces a named report on the findings view. • Adds Bulk Edit action on the All Assets list. • Adds SBOM export from the Asset page. • Adds Asset inventory export. • Adds Asset Versions and per-version claims in the UI. • Adds asset-hierarchy relationship types and direct vs indirect vulnerability views. • Adds type-scoped grants UI for organizations. • Adds roles scoped to an organization type. • Adds the Connector Health Warning notification type. • Adds notifications following every organization membership. • Adds asset exposure and deployment context documentation surface. • Adds location inventory tracking from asset connectors. • Adds Form Configuration as a documented navigation surface. • Adds customizable page layouts on view pages. • Adds RFC 9116 `security.txt` to docs.defectdojo.com. • Adds Brazilian Portuguese, Simplified Chinese, Italian, and German translations of the core guides. • Lets a downstream distribution supply the assets router's write schemas via the API v3. • Validates the request body on a finding metadata `PUT`. • Validates the Jira epic action body and rejects reserved dispatch kwargs. Breaking changes: • The classic sidebar is retired in 3.3.0 — installations relying on the classic sidebar navigation will need to migrate to the new sidebar. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.2.300

Mon, 24 Aug 2026 15:09:09 GMT

DefectDojo 3.2.300 adds Regulations support, typed Custom Fields, MFA disable verification, and expanded documentation. • Scopes endpoint delete and rename operations to the requesting product, restricting cross-product mutations. • Disabling MFA now requires a verification code, adding a confirmation step to protect account security. • Documents typed Custom Fields feature, including how custom fields integrate with Rules Engine 2.0. • Documents multi-Asset finding fan-out in Smart Upload workflows. • Documents AI Model Settings and supported LLM providers in Sensei. • Documents GMP over SSH support for OpenVAS / Greenbone connectors. • Documents customizable page layouts on view pages and Form Configuration in navigation. • Documents Quick Export dialog that produces a named report. • Documents the rebuilt Asset hierarchy page. • Documents four-permission rule permission tier in Rules Engine 2.0. • Adds RFC 9116 `security.txt` to docs.defectdojo.com. • Adds Brazilian Portuguese, Simplified Chinese, and Italian translations of the core documentation guides. • Splits connector documentation into one page per connector for easier navigation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.2.300

Mon, 24 Aug 2026 15:09:09 GMT

defectdojo 3.2.200

Mon, 17 Aug 2026 18:39:23 GMT

DefectDojo 3.2.200 adds a flat `test_type_name` field on the finding serializer and scopes Location API access by RBAC. • Adds a flat `test_type_name` field on the finding serializer, surfacing the test type name directly on finding API responses without a nested lookup. • Scopes `GET /api/v2/location/` by RBAC instead of requiring superuser access, enabling non-superuser roles to query location data within their permissions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.2.100

Mon, 10 Aug 2026 17:10:40 GMT

DefectDojo 3.2.100 adds location migration tooling, raw CycloneDX VEX preservation, and scoped CI/CD infrastructure permissions. • Adds `migrate_locations_to_endpoints` operation — the reverse of the endpoint-to-location conversion — letting teams move location data back to endpoints. • Scopes CI/CD Infrastructure detail fields to the matching configuration permission, restricting access to infrastructure metadata by permission level. • Preserves raw CycloneDX VEX analysis data on parsed findings, retaining the original vendor-supplied VEX analysis fields rather than discarding them. • Scopes Location metadata and tags to the owning product via a database migration, enforcing product-level isolation on location data. • Names the POST permission on the risk acceptance API, making the permission model explicit for that endpoint. • Renders Snyk's raw reachability values instead of a derived boolean, exposing the original Snyk reachability string on findings. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.2.0

Mon, 03 Aug 2026 16:08:09 GMT

DefectDojo 3.2.0 adds 34+ new parsers (composer, pnpm, dotnet, SPDX, CSAF 2.0, OpenVEX, and 30 CLI tools) plus per-vulnerability KEV/EPSS enrichment columns. • Adds parsers for `composer audit`, `pnpm audit`, `dotnet vulnerable packages`, and `mix_audit` output formats. • Adds SPDX, CSAF 2.0, and OpenVEX interchange-format parsers for software bill-of-materials and VEX ingestion. • Adds 30 new command-line cyber tool parsers spanning SAST, IaC, host hardening, web/network discovery, and malware categories. • Introduces per-vulnerability KEV/EPSS enrichment columns on the Vulnerability entity, surfacing exploit and prioritization data directly on findings. • Normalizes `Vulnerability_Id` into a dedicated Vulnerability entity with ordered references, enabling cross-finding vulnerability correlation. • Deprecates API-based pull parsers, Tool Type/Configuration, and `dbbackup` (EOL 3.5.0), signaling the removal timeline from 3.2.0 onward. Breaking changes: • API-based pull parsers, Tool Type/Configuration, and `dbbackup` are deprecated as of 3.2.0 with end-of-life set at 3.5.0; integrations relying on these surfaces should begin migration now. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.1.302

Wed, 29 Jul 2026 21:32:08 GMT

DefectDojo 3.1.302 adds login rate limiting to API token auth and expands scanner protocol support. • Applies login rate limiter to the API token authentication endpoint, reducing brute-force exposure on token-based logins. • Adds additional scanner protocols to the whitelist, broadening supported import sources. • Updates Fortify parsers to extract and populate CWE data from scan results. • API now returns HTTP 409 instead of 500 on unique-constraint violations, enabling cleaner client-side error handling. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.1.300

Mon, 27 Jul 2026 16:04:16 GMT

DefectDojo 3.1.300 adds a Fortify parser v2, tighter API permission controls, and a case-insensitive index on Vulnerability ID. • New Fortify parser v2 prefers true source line numbers for more accurate finding location reporting. • Adds case-insensitive expression index on `Vulnerability_Id.vulnerability_id` for faster, case-insensitive vulnerability lookups. • Restricts configuration permission assignment to superusers only in the user API, tightening privilege escalation controls. • Scopes location and endpoint reference writes to authorized products, enforcing product-level authorization on those API writes. • Extends user serializer validation to identity and permission fields for stricter input validation. • Makes notes read-only on the test create serializer, preventing unintended note mutations at creation time. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.1.101

Wed, 15 Jul 2026 21:45:29 GMT

Adds DD_WATSON_SEARCH_ENABLED toggle to control Watson search indexing in DefectDojo. • New `DD_WATSON_SEARCH_ENABLED` setting in `settings.dist.py` / `local_settings.py` to gate Watson search indexing on or off. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.1.100

Mon, 13 Jul 2026 18:33:35 GMT

DefectDojo 3.1.100 adds FTS+trigram global search indexes, Jira close/reopen transition fields, and exposes dedupe policy on the Test API. • Adds full-text search (FTS) and trigram GIN indexes for global search, requiring a settings and database migration update. • Supports custom fields on Jira close/reopen transitions via a new database migration. • Exposes the effective dedupe matching policy on the Test API endpoint. Breaking changes: • The FTS + trigram GIN indexes for global search require changes to `settings.dist.py` / `local_settings.py` and a database migration — existing deployments must apply both before upgrading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.1.0

Mon, 06 Jul 2026 22:11:18 GMT

DefectDojo 3.1.0 adds new parsers, JIRA multi-component support, AES-256-GCM credential encryption, and import/deduplication sync control. • Adds Garak (NVIDIA LLM vulnerability scanner) parser for AI/LLM security findings. • Adds Govulncheck Scanner V2 parser for Go vulnerability results. • Adds PICUS Breach and Attack Simulation CSV parser. • Supports multiple JIRA components in project settings. • Supports CVSS vector parsing and severity derivation in the cargo-audit parser. • Includes analysis.detail from Dependency Track FPF in finding descriptions. • Modernizes Tool Config credential encryption to AES-256-GCM. • New setting allows import/reimport to wait for deduplication to complete before returning. • New setting allows disabling and dismissing the open source message banner. • Adds global required fields notice for WCAG H90 accessibility compliance. • Shows vulnerability IDs in PDF Reports. • New UI: animates collapse panels in the new UI. • New UI: smooth filter category accordion in the new UI. • New UI: folds Finding Groups under Findings in the sidebar. • Performance: batch Vulnerability_Id inserts during import for faster ingestion. • Performance: batch BurpRawRequestResponse inserts during import. • Performance: adds SLA expiration date index for global finding list queries. • Performance: adds partial indexes for authorized finding-list queries. • Performance: drops blanket DISTINCT from FindingViewSet list for faster API responses. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.0.100

Mon, 22 Jun 2026 16:54:22 GMT

DefectDojo 3.0.100 adds Govulncheck V2 and PICUS BAS parsers, CVSS vector parsing for Cargo Audit, and Endpoint_Status API updates. • Adds Govulncheck Scanner V2 parser for Go vulnerability scanning results. • Adds PICUS Breach and Attack Simulation CSV parser for BAS tool ingestion. • Parses CVSS vectors and derives severity from Cargo Audit findings. • Updates Endpoint_Status API with new enhancements. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.0.100

Mon, 22 Jun 2026 16:54:22 GMT

DefectDojo 3.0.100 adds Govulncheck V2 and PICUS BAS parsers plus CVSS parsing for cargo-audit findings. • Adds Govulncheck Scanner V2 parser for Go vulnerability scan results. • Adds PICUS Breach and Attack Simulation CSV parser for BAS findings ingestion. • Adds CVSS vector parsing and severity derivation for cargo-audit findings. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.0.0

Mon, 15 Jun 2026 22:36:37 GMT

DefectDojo 3.0 ships a Tailwind UI rebuild, two new parsers, localization additions, and expanded API filters. • Adds a full Tailwind CSS UI rebuild (Dojo V3) with updated legacy authorization and open-source surface changes. • New Alert Logic CSV parser for importing Alert Logic findings. • New Xygeni JSON parser supporting SAST, SCA, and Secrets finding types. • GitHub Vulnerability parser now sets the `fix_available` field on findings. • Exposes `created_before`, `created_after`, `updated_before`, and `updated_after` date filters on the Risk Acceptance API. • Adds mitigation finding filters to the findings API and UI. • Import-time tags are now applied per batch before post-processing; old findings are not re-tagged. • Supports requesting peer review from yourself. • Adds Brazilian Portuguese (pt-BR) and Russian locale translations. • Jira integration now checks `statusCategory` instead of the resolution field to determine issue status. • Scopes report views to only the requesting user's authorized products. • Applies object-level permission checks to finding duplicate API actions. • KSA Security Advisory source added to the advisory database. • Cascade delete gains a `preview_only` parameter for dry-run previews. Breaking changes: • Credential Manager is removed (deprecated in 2.57, EOL in 2.59); any configuration or API usage relying on Credential Manager will break. • Stub Findings are removed (deprecated in 2.57, EOL in 2.59); workflows using Stub Findings will break. • Questionnaire API endpoints are removed (deprecated in 2.56, EOL in 2.59); integrations calling those endpoints will break. • The `sync=` dispatch kwarg is renamed to `force_sync=`; callers passing `sync=` will break. • V3 functionality and organization/asset relabeling are now enabled by default via `settings.dist.py`; existing deployments relying on the old defaults will see changed behavior. • A database migration is required; the migration refactors and removes deprecated features while preserving database state — upgrading without running migrations will break the application. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 3.0.0

Mon, 15 Jun 2026 22:36:37 GMT

DefectDojo 3.0 ships a full Tailwind UI rebuild, new parsers, localization, and removes EOL features. • New Tailwind-based UI rebuild with legacy authorization removal and open-source surface changes (Dojo V3). • Adds Alert Logic CSV parser for importing Alert Logic findings. • Adds Xygeni JSON parser supporting SAST, SCA, and Secrets finding types. • Adds Korean Security Advisory (KSA) parser support. • Sets `fix_available` field on findings from the GitHub Vulnerability parser. • Exposes `created_before`, `created_after`, `updated_before`, and `updated_after` date filters on the Risk Acceptance API. • Adds mitigation finding filters and complete mitigation filter support. • Adds Brazilian Portuguese (pt-BR) and Russian locale translations. • Allows users to request peer review from themselves. • Uses `statusCategory` instead of the `resolution` field for Jira issue status checks. • Applies import-time tags per batch before post-processing; no longer tags pre-existing findings. • Removes Credential Manager (deprecated in 2.57, EOL in 2.59). • Removes Stub Findings (deprecated in 2.57, EOL in 2.59). • Removes questionnaire API endpoints (deprecated in 2.56, EOL in 2.59). • Scopes report views to only the requesting user's authorized products. • Applies object-level permission checks to finding duplicate API actions. • Uses a dedicated permission class for the BurpRawRequestResponseViewSet API. • Enables V3 functionality and organization/asset relabeling by default in settings. Breaking changes: • The Credential Manager feature has been removed (deprecated in 2.57, EOL in 2.59); any setups relying on it will break after upgrading to 3.0.0. • Stub Findings have been removed (deprecated in 2.57, EOL in 2.59); any setups relying on them will break after upgrading to 3.0.0. • Questionnaire API endpoints have been removed (deprecated in 2.56, EOL in 2.59); any integrations using those endpoints will break after upgrading to 3.0.0. • The `sync=` dispatch kwarg has been renamed to `force_sync=`; any code or configuration passing `sync=` will break. • Legacy authorization and certain OS surface areas have been removed as part of the Dojo V3 UI rebuild; setups depending on those surfaces will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 2.58.3

Mon, 18 May 2026 15:06:06 GMT

DefectDojo 2.58.3 scopes report views and duplicate API actions to authorized products only. • Scopes report views to only the requesting user's authorized products, preventing exposure of unauthorized product data in reports. • Anchors location finding reference authorization to the finding's own product for consistent access control. • Applies object-level permission checks to finding duplicate API actions, ensuring users can only act on duplicates within their authorized scope. • Speeds up the `migrate_endpoints_to_locations` operation with ~14× fewer database queries, enabling practical use on larger datasets. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 2.58.2

Mon, 11 May 2026 16:12:37 GMT

DefectDojo 2.58.2 adds KSA Security Advisory support and tightens Burp permissions. • Adds KSA Security Advisory integration via new settings in `settings.dist.py` / `local_settings.py`. • Introduces a dedicated permission class for `BurpRawRequestResponseViewSet`, enabling finer-grained API access control over Burp raw request/response data. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 2.58.0

Mon, 04 May 2026 17:24:18 GMT

DefectDojo 2.58.0 adds Qualys VMDR CSV parser, WatchGuard and CNNVD vuln ID support, RBAC on risk acceptance, and a centralized banner system. • New Qualys VMDR CSV parser for importing vulnerability scan results. • New WatchGuard Security Advisory parser for vulnerability ID enrichment. • Adds Mozilla Foundation Security Advisory as a supported vulnerability ID source. • Adds CNNVD (China National Vulnerability Database) as a supported vulnerability ID source. • Govulncheck parser now surfaces `fix_available` and `fix_version` fields in findings. • RBAC enforcement added to `accept_risks` API endpoints, restricting risk acceptance by user role. • New centralized banner system with open-source messaging support in the UI. • Import/reimport API now validates consistency between ID-based and name-based identifiers. • API now enforces permission checks when moving engagements between products. • Create-path notifications dispatched asynchronously, reducing slow POST latency. • SLA breach notification format and display improved in the UI. • Bulk delete findings now supports an extension hook for customization. • More parameters stored in import settings for persistent configuration. • Invicti parser updated to use `FirstSeenDate` for more accurate first-seen tracking. • Risk acceptance reactivation behavior changed for previously risk-accepted findings. • Pickle removed from forms and Celery serializer (settings change required). • `MAX_ZIP_*` limits moved to `settings.dist.py` / `local_settings.py` for operator control. • Database: locations performance improvements via migration. Breaking changes: • Pickle is removed from forms and the Celery serializer; existing setups relying on pickle-based serialization in Celery will break and require reconfiguration. • `MAX_ZIP_*` settings are moved to `settings.dist.py` / `local_settings.py`; any hardcoded or previously defaulted values must now be explicitly set there. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 2.57.3

Mon, 27 Apr 2026 16:11:39 GMT

DefectDojo 2.57.3 adds WatchGuard Security Advisory parser, async path notifications, and improved SLA breach display. • Adds WatchGuard Security Advisory parser for importing WatchGuard vulnerability advisories. • Dispatches create-path notifications asynchronously, reducing POST request latency. • Improves SLA breach notification format and display in the UI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 2.57.2

Mon, 20 Apr 2026 15:27:31 GMT

DefectDojo 2.57.2 adds govulncheck fix metadata, Mozilla security advisories, RBAC for risk acceptance, and a centralized banner system. • Adds `fix_available` and `fix_version` fields to govulncheck parser output, surfacing remediation metadata directly in findings. • Adds Mozilla Foundation security advice lookup to vulnerability ID enrichment. • Adds a centralized banner system with OS messaging support, configurable via `settings.dist.py` / `local_settings.py` and visible in the UI. • Enforces RBAC on `accept_risks` API endpoints, restricting risk acceptance to authorized roles. • Validates consistency between ID-based and name-based identifiers during import/reimport via the API. • Adds permission checks when moving engagements between products. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 2.57.1

Mon, 13 Apr 2026 16:05:19 GMT

DefectDojo 2.57.1 adds CNNVD vulnerability ID support and persists more import settings in the UI. • Adds CNNVD as a supported vulnerability ID source via the new `CNNVD` vulnid setting. • Stores more parameters in import settings so UI-configured import options are retained across sessions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 2.57.0

Mon, 06 Apr 2026 18:18:27 GMT

DefectDojo 2.57.0 adds a System Status page, two new parsers, JFrog Xray API config, endpoint sorting, and several API/UI enhancements. • New System Status page showing Celery queue monitoring with the ability to purge queues (UI + API). • New IriusRisk threat model CSV parser for importing threat model data. • New Orca Security CSV and JSON parser for importing Orca findings. • New JFrog Xray API Summary Artifact Scan configuration support. • Adds `exact_title` filter to the findings API for precise title matching. • Allows sorting endpoints by active findings count via API and UI. • Adds a notes endpoint to the RiskAcceptanceViewSet API. • Loads JIRA custom fields as JSON via the API. • New 'Quick verify' menu item and keyboard shortcuts to verify/close findings in the UI. • New 'Remove from Finding' bulk action on the View Finding page. • Adds `additional_banners` support to the base UI template for custom alerting. • Dependency Track parser now supports CVSS4, CVSS vectors, references, and publish date. • Gosec parser now parses `cwe_id` and swaps references where possible. • Twistlock parser now records `packagePath` to identify where a CVE is found. • AWS Security Hub parser now extracts CVSS v3/v4 scores from Inspector findings. • Anchore Grype parser adds file-path-based detail mode. • Adds `scan_date` to import settings when overridden. • Enhances engagement close/reopen actions with permission checks. • Adds authorization check to the `link_engagement` API action. • Adds deprecation notices for Credential Manager and Stub Findings in the API. • Adds `PluggableContextTask` for settings-based Celery task context managers. • Batch endpoint creation and status updates during import/reimport for improved performance. Breaking changes: • The `credentials` field is dropped from `System_Settings` (database migration required). • PostgreSQL 18 users with existing volumes must follow upgrade guidance due to a PGDATA path change. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 2.56.4

Mon, 30 Mar 2026 15:30:22 GMT

DefectDojo 2.56.4 adds JFrog Xray API Summary Artifact Scan support and a pluggable Celery task context manager. • Adds JFrog Xray API Summary Artifact Scan configuration for scanner integration. • Adds `PluggableContextTask` for settings-based Celery task context managers, enabling customizable task execution contexts. • Adds `scan_date` to import settings when overridden, surfacing the effective scan date through the import pipeline. Breaking changes: • A database migration is required due to the removal of `django-linear-migrations`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 2.56.3

Mon, 23 Mar 2026 16:03:24 GMT

DefectDojo 2.56.3 adds Twistlock package path parsing to pinpoint CVE locations in findings. • Parses `packagePath` from Twistlock scan results to record the exact file path where a CVE is found. Breaking changes: • The `credentials` field is dropped from `System_Settings`; any configuration or integrations reading that field will break on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 2.56.2

Mon, 16 Mar 2026 16:15:12 GMT

DefectDojo 2.56.2 adds endpoint sorting, JIRA JSON custom fields, a notes API for risk acceptances, and new bulk-action UI controls. • Supports sorting endpoints by active findings count in both the UI and API. • Loads JIRA custom fields as JSON via the API, enabling richer JIRA integration data. • Adds a notes endpoint to the RiskAcceptanceViewSet for programmatic note management. • Adds authorization/permission checks to engagement close, reopen, and link actions. • Adds a 'Remove from Finding' bulk action on the View Finding page. • Adds `additional_banners` support to the base UI template for custom banner injection. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 2.56.0

Mon, 02 Mar 2026 19:16:14 GMT

DefectDojo 2.56.0 adds a 'Scheduled' engagement status, Trivy enrichment fields, fix_version support in Generic Import, and Dependency Track UUID tracking. • Adds 'Scheduled' status to engagement models, enabling pre-planned engagement tracking. • Adds remediation, messages, category, and publishedDate field mappings to the Trivy Operator parser. • Adds fix_version support to the Generic Findings Import parser. • Stores Dependency Track UUID into unique_id_from_tool (previously used vuln_id_from_tool) for more accurate finding identity. • Adds LocationData support for parsers via database migration. • Optimizes language import process with bulk creation and improved validation. Breaking changes: • Dependency Track parser now stores the DT UUID into `unique_id_from_tool` instead of `vuln_id_from_tool`, which may affect deduplication and finding matching for existing Dependency Track findings. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 2.55.2

Mon, 09 Feb 2026 19:44:16 GMT

DefectDojo 2.55.2 adds finding group JIRA sync, a new `has_any_jira_issue` filter, and expanded JIRA keep-in-sync for import/reimport flows. • Adds finding group support to the `jira_status_reconciliation` management command, enabling bulk JIRA status reconciliation across finding groups. • Exposes `has_any_jira_issue` filter on the Findings API, allowing queries to scope findings by JIRA issue linkage. • Expands 'JIRA keep findings in sync' feature to cover import/reimport workflows and API interactions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 2.55.1

Thu, 05 Feb 2026 00:18:28 GMT

DefectDojo 2.55.1 automatically sets last-reviewed date and reviewer when a note is added. • Automatically sets the last-reviewed date and reviewer on a finding when a note is added. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 2.55.0

Tue, 03 Feb 2026 00:13:11 GMT

DefectDojo 2.55.0 adds Cloudflare Insights and enhanced Trivy/Google Cloud parsers, task queue visibility, and a Report Builder submenu. • Adds new Cloudflare Insights parser (both JSON and initial implementation) for ingesting Cloudflare security findings. • Adds Trivy misconfiguration fields to the Trivy parser for richer finding detail. • Advances Google Cloud Artifact Scan parser to extract and store vulnerability IDs (`vulnid`). • Includes TruffleHog verified secret information in generated reports. • Shows the number of tasks waiting in the async queue in the UI for operational visibility. • Adds a Report Builder submenu in the UI with improved form validation error messages. • Adds `Permissions-Policy` header settings for improved browser security posture control. • Adds pghistory tracking for tag fields, enabling audit history on tag changes. • Adds additional fields to the `AssetSerializer` and patches Asset/Organizations API endpoints with improved permission checking. • Enforces readonly `name` field for `Test_Type` instances via dynamic serializer selection in the API. • Updates file upload field to accept dynamic file types with validation for supported extensions. • Enables push-to-Jira during Import/Reimport when findings are not grouped. • Enhances risk acceptance authorization checks for tighter access control. Breaking changes: • Product Grade configuration has been removed (database migration included). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 2.54.3

Mon, 26 Jan 2026 17:41:02 GMT

DefectDojo 2.54.3 adds Trivy misconfiguration fields, dynamic file upload validation, and Permissions-Policy header settings. • Adds Trivy misconfiguration fields to enrich findings imported from Trivy scans. • Updates file upload field to accept dynamic file types with validation for supported extensions. • Adds Permissions-Policy header settings to `settings.dist.py` / `local_settings.py`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 2.54.2

Tue, 20 Jan 2026 16:38:12 GMT

DefectDojo 2.54.2 adds Cloudflare Insights JSON parsing, expanded Asset API fields, and a Report Builder submenu. • Adds JSON support to the Cloudflare Insights parser for ingesting Cloudflare scan results. • Adds additional fields to the AssetSerializer, expanding what asset data is exposed via API. • Adds Asset/Organizations API endpoints with PATCH support and permission checking. • Enforces a readonly `name` field for Test_Type instances and adds dynamic serializer selection in the API. • Adds a Report Builder submenu and improves form validation error messages in the UI. • Pushes findings to Jira on Import/Reimport when findings are not grouped. Breaking changes: • The `name` field on Test_Type instances is now enforced as readonly via the API; any integration writing to this field will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 2.54.1

Mon, 12 Jan 2026 17:13:50 GMT

DefectDojo 2.54.1 adds vuln ID parsing for Google Cloud Artifact scans and a new Cloudflare Insights parser. • Adds vuln ID (`vulnid`) parsing to the Google Cloud Artifact Scan parser. • New Cloudflare Insights parser for ingesting Cloudflare security findings. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo

defectdojo 2.54.0

Mon, 05 Jan 2026 17:50:13 GMT

DefectDojo 2.54.0 adds PingCastle and Prowler parsers, admin API token reset, batch reimport, AND-logic tag filtering, and pghistory audit logging. • New PingCastle vulnerability parser for ingesting PingCastle scan results. • New Prowler scan parser for cloud security posture findings. • Adds `status` and `notes` columns to CSV/Excel finding exports. • Enables admins to reset any user's API tokens via the API and UI. • Reimport now matches findings in configurable batches for better scalability. • Switches audit logging to pghistory, adding per-process and per-Celery-task context. • UI tag filtering now supports AND logic across multiple tags. • Adds ICSA vulnerability ID support. • Adds `test_type` mismatch validation during reimport to catch scan type errors. • Adds `fix_available` field to Legitify parser output. • Metrics now use `mitigated_date` for closed findings in reports and the UI. • BurpRawRequestResponseViewSet gains permission classes and a refined queryset. • Adds management command to reimport sample scans for testing and validation. • Allows configuring tag truncate length via `settings.dist.py` / `local_settings.py`. • Twistlock parser now uses `discoveredDate` for the finding date. • SonarQube parser now uses `creationDate` for the finding date. • Helm HPA configuration is now more Argo-friendly. • Adds startup checker for the broker service. • Finding template refactored with API, UI, and database migration changes. Breaking changes: • Finding template refactor (#13946) includes a database migration — existing finding template data structures are changed; review the upgrade notes before migrating. • Audit log backend switched to pghistory (#13587) with a database migration — the previous audit log backend is replaced; existing audit records may not be accessible via the new backend without migration. • The `djnago.mediaPersistentVolume.fsGroup` Helm value is dropped (#13813) — Helm deployments using this key will fail on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/defectdojo