🎯 (Findings) The Remediation Center groups the Findings on a host whose remediation text names the same vendor patch into one Patch action named for that patch. See Remediation Center. 🤖 (Sensei) Suggested changes in fix pull requests show as one diff. The Generate Threat Model button is visible on the New Threat Model page. See Threat Modeling. ⚖️ (Risk Acceptance) Deleting a Risk Acceptance pushes each Finding's removal note to its issue tracker ticket, only for Findings that have one, and the note no longer links to the deleted Risk Acceptance. Block Self-Approval of Risk Acceptances and Require Review to Extend an Expired Risk Acceptance can be changed on the System Settings page. See Risk Acceptances. 🔐 (Permissions) Users authorized only through Organization or Asset roles can open the Vulnerability Explorer, which lists the Findings they can see. A user whose role is on an Asset's secondary Organization can open that Asset from the lists where it appears. See EPSS / KEV. 🔔 (Notifications) A user with more than one global notification row receives a Pro event on every channel any of those rows turns on. See About Notifications. 🔌 (Integrations) The ticket template check refuses a stray - and a comment that the integration cannot read, when the template is saved instead of when a ticket is pushed. A custom field mapping that does not fit the pushed record, such as a Finding mapping on a Finding Group tracker, is reported as a configuration error that names the field and the sources it can use. 🎛️ (Settings) The Audit Logs list loads on instances with a very large audit history: past 10,000 entries the total reads as a lower bound, such as "10,001+". Pages never repeat or skip an entry, and an unknown sort key answers 400 instead of a server error. A feature flag change applies on every server at once, instead of up to five minutes later. See Audit Logs. 📊 (Reporting) Scheduled executive posture packs are generated instead of failing. See Command Center. 🔐 (Authentication) After a forced password reset or an MFA step, a user who opened a classic page lands on that page instead of the home page. ⚙️ (API) Updating a Finding that another request deletes at the same time returns 404 instead of a server error, and the OpenAPI schema download no longer fails on an unusual version value. See DefectDojo API v2. ✨ (UI) A URL in a detail table stays on one line, with the whole URL in a tooltip. An empty list tab offers its add action only when the new record would show in that tab. A refused Appearance save restores the saved colors. 🔐 (Authentication) API token authentication follows the forced password reset rule. A SAML message addressed to another service provider is refused with a 400 response. After sign-in, an MFA step, a password change or accepting the End User License Agreement, the user is only sent to a page on the same site. See Single Sign-On. 🔐 (Authorization) Every Risk Acceptance read, including its notes and proof file, follows the Risk Acceptance view permission. Images in reports require view access to the Engagement, Test or Finding that holds them. API v3 includes a parent Organization's details only for users who can view that Organization. See Risk Acceptances. 🔐 (Hardening) The application, nginx and integration images apply security updates to their bundled components, and the application image leaves out packages it does not need at runtime. 🔐 (Authentication) Every user accepts the End User License Agreement once, after their first sign-in on this release and again when a new version is published. Nothing else loads until they select I Agree. A user who must reset their password accepts it on the password change page. See End User License Agreement. 📏 (Triage Engine) The Restrict Triage Engine Emails to DefectDojo Users feature flag is on by default. While it is on, Send an Email and the email announcement of Generate a Report reach active DefectDojo users only, and each user only gets an email whose listed items they can all see. Other addresses are refused when a rule is saved, and left out with a warning when a rule is imported. Turn the flag off to let rules email any address. Rule names no longer have to be unique: exported rules carry an ID, and an import matches existing rules on it. See Send an Email and Sharing and Versions. 🎛️ (Settings) The hidden and required fields in Form Configuration apply to /api/v2/ writes for Findings, Engagements, Tests, Assets, Organizations and Risk Acceptances: writing a hidden field or leaving a required one empty answers 400. The instance's API schema shows the configuration. See Configuring Forms. 📦 (Engagements) The Calendar shows Interactive Engagements by default. CI/CD Engagements are shown when they are selected in the Engagement Type filter, and a link that names an Engagement Type keeps it. See Calendar. 🚢 (Helm) The initializer Job's default memory limit is 2Gi, up from 1Gi, in values.yaml and every profile. New opt-in values support a service mesh and a read-only root filesystem: securityContext.nginx.readOnlyRootFilesystem, securityContext.tmpVolume.enabled (with sizeLimit), securityContext.initContainers.runAsGroup, jobs.tests.podAnnotations and jobs.certificateGeneration.podAnnotations. See Service Mesh (Istio), Read-Only Root Filesystem and DefectDojo Pro Upgrade Guide (Kubernetes / Helm). Check out the full changelog here: docs.defectdojo.com/releases/pro/changelog#…

DefectDojo Weekly Changelog 🚀 — v3.5.100 (November 9, 2026) Hey everyone! A new update of DefectDojo Pro and Community Edition is out. Here's what's in this week's release: NOTE: Tool Types, Tool Configurations and API Scan Configurations are deprecated and will be removed in 3.6.0 on December 7, 2026. 🔐 (Permissions) Permission Audit on the All Users list adds columns for each user's flags, Global Roles, Configuration Permissions, Organizations, Assets and Groups, with filters, sorting and CSV export. A user's page has an Access tab that lists everything the user reaches and the role or Group that grants it, and Organizations and Assets cards where roles can be added, changed or removed. A Group's page shows the Group's own access in the same way. Bulk Add To and Remove From on the Users list add or remove many users at once. These are part of Access Administration, a beta feature that is on by default. View As User shows the app read-only as another user sees it, for up to an hour, with an Exit bar at the top of the page. A user administrator starts it from the user's page, and a Group lead from a member's row on the Group's Members tab. It requires the View As User feature flag, off by default. See Permission Audit and Effective Access and View As User. 🧭 (Navigation) Sidebar Presets are named sets of hidden sidebar entries, managed under Settings > UI Defaults > Sidebar Presets. A preset only hides entries: direct links, bookmarks and the API keep working. Each user picks a preset on the User Profile page, and an administrator can share a preset and make it the instance default. The feature is on by default. See Sidebar Presets. 🎛️ (Settings) Default Profiles give every member of a Group the same starting setup. Superusers build named profiles under Settings > UI Defaults > Default Profiles and rank them, and each Group picks one on its new Defaults tab. A member's dashboards, page layouts, table views, sidebar preset, form configuration and landing page come from their Groups' profiles in rank order, unless they chose their own. Restrict to Selected Layouts limits members to the layouts a profile lists, and Lock Landing Page fixes where they land. See Default Profiles. 📏 (Triage Engine) A Group can own Triage Engine rules and Report Builder templates, blocks, themes and schedules, share them read-only with other Groups, or publish them to everyone. A Group's rules and report schedules run as the Group's own automation identity, with the Group's access. The role editor has a Group Content table, and Settings > Unowned Content lists what a deleted Group or a departed owner left behind. Requires the Group Ownership feature flag, off by default. See Sharing and Versions and Report Builder. 🤖 (MCP) A Personal Data Filter card on the MCP page lets a superuser filter personal data out of MCP tool results: user fields are removed or replaced with pseudonyms, audit trails are removed, and personal data is scrubbed from free text. It is off by default. See MCP Server. 📦 (Assets) Four widgets on the Asset page lead with what needs attention and fit their tile at every size. Compliance shows overdue POA&M items, a missing ConMon snapshot and unmet CMMC requirements. PCI DSS Scope shows what is due on the Asset. Priority and SLA Drivers names the priority fields that are not set and shows the deadline for each severity under the SLA that applies. Exposure explains its verdict from the source that decides it, and its override and production branch are set in one Edit Exposure form. See Federal Compliance, PCI DSS Scope and Patch Clocks, Finish onboarding and Asset Exposure. 🎯 (Findings) The Findings list has a Mitigated By column, with a user filter and sorting, and an Exploit Evidence filter that keeps Findings with a Metasploit Module, Nuclei Template or Exploit-DB Entry in Threat Intelligence, or excludes them. The Findings export offers the Version, Build ID, Commit Hash and Branch/Tag of each Finding's Test and Engagement. See Filter Index, Threat Intelligence and Findings. 📏 (Triage Engine) Run Now of an On Dedupe Match rule in Keep Both Active mode brings in the matches deduplication made before the rule existed, such as Findings already marked duplicates while both Assets shared a Dedupe Pool. A Finding's page has a Linked Findings tab that lists the Findings a rule linked it to, where a wrong link can be removed and restored. Automation can do the same through /api/v2/finding_links/. See On Dedupe Match. 🎛️ (Settings) Form Configuration holds several named configurations, one of them the instance default that everyone's forms follow. Configurations can be duplicated, and an upgrade keeps the existing configuration as the default. Single Select and Multi Select custom fields can offer an Other choice, turned on per field, that saves the text the user types. See Configuring Forms and Custom Fields. 📈 (Dashboards) A Maintainer can make a collaborative dashboard layout read-only. Everyone keeps it in their layout picker, and only its owner and users who can share dashboards can change it. See Customizable Dashboards. 🔌 (Connectors) Tenable.io tags each Finding credentialed-scan or uncredentialed-scan from the scan of the host it was found on. The tags follow the scan, so a host scanned with credentials later gets the new tag on the next sync. 🧭 (Navigation) Task walkthroughs outside the Sandbox can continue past a save step without saving: Next closes the form, and later steps use a record that already exists. See In-App Walkthroughs. ✨ (UI) Danger buttons and badges, error and validation text, the required-field asterisk and form field borders meet WCAG AA contrast in light and dark themes, and an invalid field keeps its red border while it is hovered or focused. ⚡ (Performance) Creating or updating a Risk Acceptance takes the same time for one Finding as for many, and removing Findings from it sends one notification instead of one per Finding. List exports with many columns, and saving a long IP allowlist on the Firewall Settings page, are faster. The Pro database migrations run about a third faster. 🔌 (Connectors) GitHub Advanced Security closes the last open Finding of an alert type once GitHub reports no open alerts of that type. StackHawk An expired session no longer fails the run, and paging stops at the last page. When connection settings are saved twice in quick succession, the later save is the one applied. 📏 (Triage Engine) A rule that sets a risk-accepted Finding to false positive, out of scope or mitigated takes it out of its Risk Acceptance first, as closing it by hand does. Batched alert and email text fills in the values it names, such as the Jira issue in a Jira receiver's alert. A condition holding a comma-separated list of values can be saved, and the condition editor shows such a list and a true or false value stored as text. Saving a rule with no name says the rule needs a name. See Node Reference and Building Rules. ♻️ (Deduplication) The Dedupe Pool previews count the Findings a Keep Both Active rule keeps active apart from those that become duplicates. The import and reimport previews match across the Asset's Dedupe Pool as the import does, and count a Finding a Keep Both Active rule links as created. See Dedupe Pools. 📥 (Importers) When a reimport reports a container image under a newer tag, the previous image on each matched Finding is mitigated and the new one stays active. Location History on the Finding page includes container images. See Location Drift Matching.

⏰ Last week for 1,000 free Sensei fixes The offer ends Friday, November 13. That's 1,000 fixes your team doesn't have to write by hand. Connect a GitHub or GitLab repository, turn on automatic remediation, and review the pull requests Sensei opens. Already a customer? Talk to sales and we'll turn the fixes on. 👉 Sign up: bit.ly/4hCTbm3

DefectDojo Weekly Changelog 🚀 — v3.5.0 (November 2, 2026) Hey everyone! A new update of DefectDojo Pro and Community Edition is out. Here's what's in this week's release: 📦 (Assets) Organizations, Assets, Engagements, Tests and Findings can be archived instead of deleted. Archiving hides the record and everything under it from lists, search, dashboards, metrics, reports, the API, deduplication, reimport and Triage Engine rules, and it stops counting toward the license. Archived data is kept for 2 months by default and can be restored at any point in that period, after which it is deleted. The Archived page lists each archive, and opening one shows its records read-only in the usual lists and pages. Triage Engine rules can archive Findings on a schedule, and excess duplicates are archived instead of deleted. Self-hosted installs can change the retention period with DD_ARCHIVE_RETENTION_MONTHS. Requires the Archive feature flag, off by default. See Archive. 📏 (Triage Engine) The Notifications template pack has a template that sends an in-app alert when new Findings match a set of filters: pick the filters in the trigger's scope, and the rule sends one alert for each batch of matching Findings, however they were added. See Building Rules. 🧭 (Navigation) Each user can choose the page they land on after signing in, from Default Landing Page under Signing In on the User Profile page. The choice follows the account to every browser, and applies to single sign-on started from the identity provider. Controlled by the Default Landing Page feature flag, on by default. See Default Landing Page. 🔐 (Authentication) Idle Timeout on the Login Settings page signs a user out after a set time without a request, from 15 minutes to 8 hours. It is off by default and applies to password and SSO logins alike. See Login Settings. 🔌 (Connectors) Security Hub can import Findings on ECR container images only for images Amazon Inspector reports in use. CrowdStrike Falcon imports Identity Protection detections. Checkmarx One can select scans by Initiator, combined with the Branch filter. 🔌 (Integrations) ServiceDesk Plus sends custom fields and a ticket template with each ticket, and a refused ticket shows the error ServiceDesk Plus returned. 🔐 (SSO) Use Mapped Username on the SAML settings page takes the username from the attribute mapped to Username instead of the NameID. It is off by default. The SAML Login Attempts panel lists the attributes received on each login, which mapping rows were found, and where the username came from. See SAML Configuration. 🔐 (Permissions) The All Users and All Groups tables have a Permissions column that opens a read-only grid of the permissions a user or group holds, and which Global Role grants each one. See Custom RBAC Roles. 📦 (Assets) The Finding Distribution panel on the Asset page is a status ring beside a tile for each source. The record cards on the Asset page sit below the metadata row. See Assets and Customizing Page Layouts. ✨ (UI) Each main list with nothing in it offers its main action, such as adding the first Asset. ⚡ (Performance) The Executive Insights summary, the Vulnerability Explorer list, the Assets list counts, the Command Center, the Test page's import history, the Tests list sorted by Finding count, exports, Triage Engine rule previews, bulk edits on the Findings list and tag filters on the Findings list are faster. The tag picker no longer slows down for users scoped to a few Assets, downstream connectors are updated once per import, and large Qualys XML reports parse in linear time. 🔌 (Connectors) A Coverity Discover no longer stops on a project with no name: the project is skipped with a warning, and records with a blank product name are named after their ID. 📊 (Reporting) Reports show pasted screenshots. In PDF reports, long code wraps and a Finding too large for one page breaks across pages. Numeric filters work in chart blocks, previews, Triage Engine rule scopes and dashboard tiles, and a ~ in report text no longer shows a backslash before it. See Report Builder. 📈 (Dashboards) An Embedded Table keeps a viewer's saved filters after a reload, and a widget's saved filters can be removed or cleared in the editor. The Command Center's Add Widget dialog titles a new widget as new, and a graph taller than its tile scrolls to its top. See Customizable Dashboards. ⚖️ (Risk Acceptance) An older Risk Acceptance that has expired reads as expired, and one that is extended expires again on its new date. See Risk Acceptances. 📏 (Triage Engine) A scheduled run of a disabled rule is recorded as skipped instead of successful. A Send an Email node can only address Email connections. See Scheduling Rules and Send an Email. 🎯 (Findings) The Remediation Center groups host Findings by the fix they need. A component name that only repeats the host's name is ignored, and vendor advisories with no component become one upgrade per product per host. See Remediation Center. 🏢 (Organizations) The change plan preview for moving an Organization lists only the rules, dashboard layouts and report schedules that refer to it. See Change Plans. 🔔 (Notifications) Users whose notification settings were created outside the app, such as from a fixture, receive Pro event notifications, and a user with two global notification rows gets a consistent result. See About Notifications. 🔌 (Integrations) A ticket template action that holds only a string literal can be saved, an action that holds only trim markers is refused when saved instead of failing later, and the template check's messages are translated. A refused issue tracker mapping save keeps the dialog open and shows the server's messages under their fields. ⚙️ (API) /api/v2/findings/ honors the engagement, product and prod_type filters. The full health check no longer fails on instances missing a Location table. See DefectDojo API v2. 🛠️ (Parsers) The Qualys XML parser skips a Finding whose QID has no glossary entry instead of failing the import. 🤖 (MCP) When saving the MCP server switch is refused, the switch stays on the server's state and one message is shown. See MCP Server. 🎛️ (Settings) Removing one rule on the Firewall Settings page no longer removes other rules for the same IP address. A deployment setting changed across a restart, such as turning API tokens off, reaches browsers that already had the app open. 📋 (Tables) A dragged column keeps its width when the table redraws during the drag. See Customizing Tables. ✨ (UI) Enter starts a new line in form text areas and editors. A saved setting no longer reverts to an older value from a refresh sent before the save. The gear menus on Organization and Test pages appear once the record has loaded. Numbers and dashboard text follow the app language. Message contrast, page landmarks, link names, scrolling table regions and form spacing in right-to-left languages are improved for accessibility. See Language and Localization. 🔐 (Authorization) Report schedules are visible only to their creator and to users who can see the reports they produce. Adding a note to a Finding, Test or Engagement requires permission to add notes on it, and downloading a Risk Acceptance's proof requires permission to view that Risk Acceptance. A revoked permission stops applying as soon as it is removed. A Triage Engine rule can name only a connection that its author and its owner may use. See Action permission charts and Node Reference. 🔐 (Hardening) SSO, LDAP and SMTP secrets saved on the Settings pages are stored encrypted in the database. See Single Sign-On. 🔐 (Permissions) Configuration Permissions, which open settings pages such as Users, Tool Types and SLA Configurations, come from roles. A role carries them in its Configuration Permissions table, and they apply when the role is held as a Global Role, directly or through a Group. A user or Group can hold several Global Roles, and they add up. The upgrade creates a role for each set of Configuration Permissions in use and adds it beside each holder's existing Global Role, so no one loses access. See Custom RBAC Roles. 🔐 (Authentication) Session Age is counted from login, so a session ends when it passes, however active the user has been. After the upgrade, a signed-in session's clock starts at its first request. See Login Settings. 🚢 (Deployment) PostgreSQL stops any single statement of a web request that runs past 30 seconds under the service's harakiri, and the request answers with a 503. Background tasks, migrations and management commands are not limited. DD_DATABASE_WEB_STATEMENT_TIMEOUT, DD_DATABASE_WEB_LONG_STATEMENT_TIMEOUT and, on Docker Compose, DD_DATABASE_IMPORT_STATEMENT_TIMEOUT change the limits. See Hardware Sizing for Self-Hosted DefectDojo Pro. 🚢 (Deployment) SSO, LDAP and SMTP secrets saved in Settings are encrypted with DD_SECRET_KEY. To change the key, set the new one in DD_SECRET_KEY and keep the old one in DD_SECRET_KEY_FALLBACKS, a comma-separated list. See Restoring a Self-Hosted Deployment. Check out the full changelog here: https://docs.defectdojo.com/releases/pro/changelog/#november-2-2026-v350

Hey folks we've gotten a few questions about how to get the weekly product changelog email and we have a new page to make it really easy to add yourself or share with others. Filling out the form on this page adds you to the monthly newsletter and the weekly product newsletter. Feel free to sign up here or share the link with a colleague who should be getting the email

Hey folks for those that are going to be at LASCON this week, the DefectDojo team is hosting a small AppSec Dinner tomorrow. Let us know if you'll be in town and are interested by requesting to join here- luma.com/esqzh1qj

DefectDojo Weekly Changelog 🚀 — v3.4.300 (October 26, 2026) Hey everyone! A new update of DefectDojo Pro and Community Edition is out. Here's what's in this week's release: 🎯 (Findings) A Finding's Title, Tags, Severity, Assignees, Planned Remediation Date and Description can be changed on the Finding page itself, without opening the Edit Finding form. Changes are held until you save, several fields can be changed and saved together, and a change someone else made since the page loaded is never overwritten. The same in-place editing is on the Engagement and Asset pages. Requires the Inline Editing feature flag, on by default. See Editing Findings. 🔔 (Notifications) The bell in the sidebar footer opens a notification inbox: unread alerts grouped by the record they are about, with All, Mentions, Assigned, Watching and System tabs, the option to mute a record, and read state carried to the Alerts Page. The counts refresh on their own, and Load Older pages through the rest. The inbox is now generally available. See About Notifications. ⚙️ (API) Service users are API-only accounts with no email or password that never sign in, each holding one token shown once at creation, and authorized through memberships, groups and a global role on their own page. Requires the Service Users feature flag, off by default. See Service Users. ♻️ (Deduplication) Each scan type can set how its Findings are grouped: as the parser produces them (the default), one Finding per location, or one Finding per vulnerability, where every location of a vulnerability becomes one Finding that stays open until each location is fixed. The location-based options need the Locations feature. See Deduplication Tuning. 📏 (Triage Engine) Rules can be exported, imported and restored: move a set of rules between instances with a compatibility check, restore an earlier version of a rule, and manage rules through the API. See Sharing and Versions. 🔌 (Connectors) Unmanaged device discovery lists the devices your EDR sees on the network with no agent of their own, as CrowdStrike Falcon Discover and Microsoft Defender for Endpoint report them. Each device is a candidate and becomes neither an Asset nor a Finding on its own. Requires the Unmanaged Devices feature flag, off by default, turned on per connection with Report Unmanaged Devices. See Unmanaged Devices. 🔌 (Connectors) A connector's label can be renamed without re-homing its Engagements. See Add or Edit Upstream Connectors. 🔌 (Connectors) Tenable groups records by asset and adds WAS scan-configuration grouping and a WAS tag filter, Checkmarx One tags Findings with their triage state and exploitable path and carries their comments, Qualys sets each Finding's date from when it was first found, and Wiz reports a runtime reachability verdict. Connector-owned tags and the triage comment stay current on reimport, and a connector whose filters match nothing shows a warning. 🔌 (Jira) Findings can be unlinked from Jira in a bulk edit. See Bulk Editing Findings. 📏 (Triage Engine) Rules can be scoped to hosts, IP addresses and CIDR networks. 📈 (Dashboards) The Count and Graph widgets can measure unique CWEs or unique vulnerability IDs instead of rows, such as unique CWEs by severity for one Asset, and roll the measure up across child Assets. See Customizable Dashboards. ⚙️ (API) A new API exports an Asset and everything under it as a manifest plus an NDJSON stream. See Product export. 📍 (Locations) Each location reference records the Test that reported it. See Locations Overview. 🧭 (Navigation) The sidebar footer has an account row and a single row of icon buttons (alerts, What's New, Ask Sensei and the Production/Sandbox switch), and the account menu holds the language and light/dark choices. The What's New panel remembers the release you have seen, per account, and Hide Walkthroughs is on the lightbulb's list. See The Sidebar Menu. 🎛️ (Settings) The All Settings page is compacted into group cards. See The Sidebar Menu. 🕵️ (Threat Intelligence) A Finding's Threat Intelligence tile shows pending enrichment and KEV status. See EPSS / KEV. ⚡ (Performance) The Findings and Engagements lists no longer run a query per row, tag filters match with EXISTS instead of a DISTINCT join, bulk deletes and an import's finding groups run as one set-based operation, import and reimport requests cost a fixed few queries, and dashboard tile counts, the import list and a user's History tab read less. Connector configuration saves and deletes cost a fixed few queries. 🎯 (Findings) A Finding keeps its Locations when the Pro UI edit form is saved. ⚖️ (Risk Acceptance) A Finding stays in a single risk acceptance when one is reinstated or approved, including under concurrent writes. Reinstating leaves out Findings accepted elsewhere since the expiry, and Jira is told after the change commits. See Risk Acceptances. 📊 (Reporting) Report failure reasons are translated, and a report that reaches the time limit says so. A template's block ordering is checked when it is saved, with a missing sort field named under Order By, the template editor is tidied, and Add Existing Block follows the permission that saves the template. See Report Builder. 📥 (Importers) The import form's help is corrected for Scan Date (the mitigated date), asynchronous import and a disabled Close Old Findings, and the Do Not Reactivate option on reimport is explained. See Add Findings form. 🛠️ (Parsers) The generic importer rejects a field value wider than its Finding column with a 400, instead of failing the import without a clear reason. See Generic Findings Import. 🔌 (Connectors) The GitHub connector resolves repositories by URL and owner/name instead of display name, Cycode accepts numeric project IDs, and Qualys WAS leaves an empty filter block out of searches that have no criteria. See GitHub. 🤖 (Sensei) A fix is applied to every active code location of a Finding in one change. See Fixing Findings with Sensei. 📜 (Compliance) The CRA scope widget counts every Finding in scope, and the CRA evidence pack's support-period obligation reads each Asset's Support Period End. See CRA Article 14 Reporting. 🔐 (Permissions) Group writes and the group edit page are offered only where the group role allows them, an empty group counts as 0 members, the Add File action shows for users who can add files, and a page re-checks its per-record permissions when only the route's parameters change. 🔔 (Notifications) Relabeled Organization and Asset links in notifications open their Pro UI pages. ⚙️ (API) The message beside a 400 response's field map reads as sentences. ✨ (UI) A failed save, delete or import shows one toast with the server's reason, the user page's Metadata and Contact cards stack on a phone, a keyboard-focused table row has a quieter outline, the Markdown source toggle lines up with the first line of text, the UI switches back to an offered language when the one on screen is not offered, and popovers show their line breaks as text. 🚢 (Deployment) A self-hosted instance can sign in to PostgreSQL with a cloud identity token instead of a password. See Passwordless Database Authentication. 🚢 (Deployment) On shutdown, a running import is allowed to finish before the worker stops, and the import pool's memory recycling is sized for the pool. See DefectDojo Pro Installation Guide (Kubernetes / Helm). 🚢 (Deployment) Operators can default Asset Identity on for new instances with DD_ASSET_IDENTITY_DEFAULT_ON. See Assets. 🚢 (Deployment) Databases from before 3.0 upgrade without failing or losing the default group. See Upgrading DefectDojo Pro (On-Premise). 🚢 (Helm) The initializer runs with the media volume's group. See DefectDojo Pro Installation Guide (Kubernetes / Helm). Check out the full changelog here: docs.defectdojo.com/releases/pro/changelog#…

@here Yesterday, vulnerabilities in eMudhra and PHP2Shell dropped on the same day, and our team immediately merged a fix. Out of that work, we built Early Light, a free, open source detection tool that works with Community Edition and alongside Sensei (available with DefectDojo Pro) to create fixes. The open source community is going to get the fastest detection tool we can ship, and we’d love your feedback and contributions as we continue to scale the project. Early Light Github- github.com/DefectDojo/earlylight

Hey folks today's webinar is now up on youtube. DefectDojo's new Triage Engine is a substantial improvement compared to the old rules engine so be sure to check out the recording or try it out for yourself in DefectDojo Pro

Hey all we're live right now for today's introduction to Triage Engine. Join us live here! zoom.us/webinar/register/…