chris (.

🧩 (Correlation) Cross-domain finding correlation groups related findings into shared root causes. A finding's page now lists its root causes, root-cause blast radius feeds finding prioritization, and a new Top Root Causes dashboard widget plus a Product breakdown show where risk concentrates. Root causes cover CVE, component, resource, and endpoint types, hide CVE causes a component already covers, and are readable through a public read-only Root Cause API.

🚨 (PSIRT) PSIRT 2.0 is folded natively into DefectDojo Pro: native advisory feeds and a catalog, feed rules and rule templates, advisory-to-case conversion, and a dedicated PSIRT permission so an analyst does not need global maintainer.

⚖️ (Risk Acceptance) Risk Acceptances 2.0 adds a reviewable lifecycle with a pending-review queue and a durable ledger. You can also choose to restore a finding to Verified when its risk acceptance expires.

📦 (Assets) A rebuilt asset model adds asset versions with BOM snapshots and per-version SBOM/VEX export, per-source identity and aliases so connectors resolve assets by the vendor's id, typed asset kinds, typed relationship edges that distinguish direct from indirect vulnerabilities, and asset exposure and deployment context (including live reachability probing and business-criticality sync from the CMDB).

🏢 (Organizations) Organizations can now be non-exclusive: an asset can belong to multiple organizations with union-of-grants RBAC, membership-aware organization filters on the asset and finding lists, and roles that can be granted across an entire organization type.

📈 (Dashboards) Dashboards 2.0 expands into the DefectDojo Command Center, with a published security-posture score.

📍 (Locations) Endpoints continue their move to Locations: asset connectors can emit standalone location inventory, and a new Location Map draws an asset's locations as derived trees per location type.

🧭 (Navigation) Menu 2.0 now covers the whole sidebar, including a Sensei + AI section, a full-height sidebar rail with pinned pages, and server-backed shell preferences.

🤖 (Sensei) Added Sensei Advisor, which recommends settings changes and offers one-click fixes for mechanical deduplication-hygiene issues, with per-run license quotas for threat modeling and Advisor. The Sensei engine now ships in the on-prem compose bundles.

🔌 (Connectors) New Rapid7 InsightVM - Cloud Instance and Aqua Supply Chain connectors, plus a Wiz option to import Issues only. Connectors gain customer-defined field mappings (versioned and identity-safe, per scan type), a connector registry the UI reads from, per-record sync checkpoints so an interrupted sync resumes, and health notifications when a connector stops working or authenticates but sees no data.

🛠️ (Universal Parser) Universal Parser field mappings can now be edited from a dedicated screen, with an impact warning attached.

📜 (Compliance) Added DISA STIG checklist import (.ckl/.cklb) with a CCI to NIST 800-53 crosswalk.

📤 (Exporters) Added a CycloneDX/SPDX SBOM and CycloneDX VEX export API, and the Pro UI now accepts .spdx files on import.

⚙️ (API) Added API v3 (alpha) at `/api/v3-alpha/` with slim references, expansion, RBAC sub-resources, and the Pro importer. Custom Fields are now available on the token-authenticated `/api/v2` API.

🏛️ (Federal) Added FIPS 140-3 image support (FedRAMP SC-13), PAIN-keyed FedRAMP VDR remediation deadlines, and a FedRAMP prioritization preset.

📏 (Rules Engine 2.0) Rules can now trigger on scan absence, draw from a rule-template gallery, assign an SLA configuration or Risk Priority to assets, and condition on exploit evidence, reachability, and asset exposure.

📊 (Reporting) Added a Location Count field on every entity and reorderable block fields in the Report Builder.

📦 (Assets) Added checkbox bulk edit on the asset list (organization, SLA, engine, tags) and customer-editable platform, lifecycle, and origin dropdowns.

🔌 (Integrations) The Freshservice integration can push findings as ITIL Incidents or Problems per mapping, and MCP finding tools gained tag filtering.

🧾 (Audit Log) System Settings changes are now recorded in the audit log.

🔌 (Connectors) The JFrog, Tenable.io WAS, and Tenable VM connectors now stream findings per page instead of holding a whole sync in memory, and connectors report data-visibility warnings at config-test time. The Location URL is pre-filled for single-host tools.

✨ (UI) A first pass of accessibility and readability foundations: a visible focus ring, AA-contrast muted text, a System theme option, comfortable reading line-height, and shared type tokens. Toggleable panels now expand from a click anywhere on the header, and locked dropdowns gained a copy button.

♻️ (Deduplication) Finding identity is now recorded in a signature ledger, versioned and bridged across formula changes, with a scheduled drift check that reports what moved; reimport can match on identity signatures.

🔔 (Notifications) Notifications now fan out to every organization an asset belongs to.

📊 (Reporting) Report charts export as PNG so labels survive PDF rendering.

📥 (Importers) Import and reimport bulk-create new findings, reducing per-finding overhead on large scans.

🔌 (Connectors) Wiz now imports findings from tenants that use no Projects, the Microsoft Defender connector no longer fails a good sync during spool cleanup, and connector product descriptions are capped at the column limit.

🎫 (Licensing) A usage block now answers with 402 rather than a throttle status, and license enforcement no longer blocks authentication.

📥 (Importers) Scan severities are accepted case-insensitively, `.spdx` files are accepted for import, concurrent imports no longer race on scan-directory creation, and edited tests keep their scan type so reimport matching survives.

🛠️ (Parsers) Fortify now marks only suppressed FPR findings as false positive, Anchore Grype parses the CISA KEV date, and Xeol and Checkmarx One finding identity is deterministic.

✨ (UI) The Components list no longer renders an empty body while its paginator counts every row, ECharts resolves theme tokens to concrete colors, and the New Issue Tracker Assignment dialog no longer closes when going full-screen.

✨ (UI) The classic Bootstrap UI and the classic report engine have been retired; Menu 2.0 and the Pro Vue UI are now standard.

🧰 (Operations) The maintenance window feature has been removed.

🤖 (Sensei) Added a generic fix flow: you can now associate a repository with a finding inline, and a gap-closing wizard walks you through anything else Sensei needs before it can generate a fix. Finding file paths are also resolved against the repository tree before the fix is generated, so fixes land in the right file.

🤖 (Sensei) Scan-and-fix now includes a scanner for AI agent skills (Skillspector).

📋 (Engagements) Added engagement checklists to the Pro UI.

⚙️ (Rules Engine 2.0) Rules can now be conditioned on KEV (Known Exploited Vulnerabilities) listing and exploit evidence.

🧭 (Navigation) Added a searchable menu palette over the sidebar, opened with Cmd/Ctrl+K.

🔗 (Correlation) The Root Cause view now has a Root Cause Organization column, asset and organization filters, and per-organization drill-in.

📤 (Exporters) The UI SBOM export now offers SPDX alongside CycloneDX.

🧩 (Custom Fields) Custom fields now render on the entity create and edit forms, and are configured like any other form field.

🔌 (Connectors) The Wiz, Microsoft Defender for Cloud, and CrowdStrike connectors now stream findings page by page rather than holding a whole sync in memory, so large syncs are faster and lighter.

🧩 (Page Layouts) The Risk Acceptance view page now uses a customizable widget grid, like the other View pages.

🤖 (Sensei) Added Amazon Bedrock as an on-prem LLM connection.

📍 (Locations) The data-migration suite on the Feature Flags page can now be cancelled while a backfill is running. Cancelling stops the run at the next batch boundary and keeps everything migrated so far, so re-running the item resumes and converges on the same result. A run whose worker is lost is now detected and marked failed on its own, so a stuck suite becomes runnable again instead of blocking every item.

🌐 (Endpoints) Endpoints are now deprecated in favour of Locations.

🧭 (Menu) Classic-menu users are now warned that Menu 2.0 becomes the standard in 3.3.0.

☁️ (CSPM) Cloud Security Posture Management is now gated on the Sensei license rather than a separate feature flag.

🤖 (Sensei) Scan-and-fix scanner parallelism is now configurable, via `--max-parallel` / `MAX_PARALLEL` (and `sensei.maxParallel` in Helm).

🔐 (Authorization) Import and reimport preview targets are now scoped to the caller's permissions, POA&M item findings are validated against the record's own product, and questionnaire expiration and question-set editing are checked against the response route and the questionnaire change permission.

✅ (Risk Acceptance) A companion-less risk acceptance is now counted correctly, as active and as non-global, when filtering.

📊 (Reporting) Report graph blocks that no browser captured are now drawn instead of failing silently, and the BETA badge that Menu 2.0 re-added after GA is gone.

🎫 (Licensing) License enforcement no longer blocks authentication.

🔌 (Connectors) The Action1 connector derives severity from the CVSS score when no severity bucket is usable, and a chunked sync now records one Import History row per sync.

📍 (Locations) The endpoints-to-locations backfill now reports distinct locations and per-endpoint failures.

🔁 (Dedupe) Finding post-processing now retries on a transient DB deadlock.

✨ (UI) The Advisor now renders with PrimeVue, and PSIRT and Field Mappings are nested correctly in the legacy sidebar.

🧠 (Threat Model) The schema-repair loop no longer deletes the prompt it is repairing.

☁️ (CSPM) Added Cloud Security Posture Management: connect AWS, Azure, and GCP cloud accounts, run posture scans against them, and apply reversible direct remediation to the misconfigurations that are found.

🛰️ (Asset Exposure) Added asset exposure reporting from Wiz, Shodan, and Censys, and from CrowdStrike Spotlight (which reports only the exposure it can prove).

🔌 (Connectors) Registered the Aikido Security, Jit, and Cycode connectors.

🎯 (Finding Templates) You can now apply a finding template to a Finding, and turn a Finding into a template, directly from the Vue UI.

✨ (Form Configuration) Added admin-controlled Form Configuration for the Vue create and edit forms, so an administrator can decide which fields appear.

📍 (Locations) Added a DB-backed Locations toggle, with a data-migration suite to move existing data over.

🗂️ (Assets) You can now export the asset and organization inventory as CSV.

📊 (Reporting) Quick Export now names its output from the current context, and you can apply a report template to an export.

🎯 (Findings) Added a filterable Review Claimant column to the findings list.

⚙️ (Rules Engine) Rules Engine permissions now split into View / Add / Edit / Delete for finer RBAC.

🚩 (Feature Flags) Promoted nine feature flags off the menu, turned five more on by default, and moved Feature Flags out of System into its own settings location.

✨ (Layouts) Layout customization can now be restricted to admin-designated defaults.

🔌 (Qualys) The Qualys connector now accepts a Host Tags filter that scopes discovery to hosts carrying the Qualys asset tags you name. The filter is sent to Qualys, so out-of-scope hosts are never downloaded. It applies to the detection download as well as the host listing, so a narrowed scope also shortens each Sync. Tag names are matched exactly, because Qualys supports no wildcards on tag names. Leave the field blank to keep discovering every host.

🔌 (JFrog) The JFrog connector now surfaces a pending status.

🔌 (Jira) The Jira connector now accepts service accounts.

🎯 (Findings) The count of Findings a tool submitted is now recorded before deduplication runs.

🔗 (API) The finding serializer now exposes a flat test_type_name field.

🤖 (MCP) Finding and asset Location retrieval is now consolidated into single REST calls.

📍 (Locations) The data-migration suite on the Feature Flags page can now be cancelled while a backfill is running. Cancelling stops the run at the next batch boundary and keeps everything migrated so far, so re-running the item resumes and converges on the same result. A run whose worker is lost is now detected and marked failed on its own, so a stuck suite becomes runnable again instead of blocking every item.

🔐 (Authorization) Location data, DojoMeta visibility, and the /api/v2/location/ endpoint are now scoped to the requesting user's products and RBAC rather than superusers only; every routed connector endpoint is named in the permission allow-list; the user edit form authorization was hardened; Tool Configuration credentials are kept out of the edit form; and the private-note visibility rule is now applied in the note UI views.

📤 (Export) Spreadsheet formulas can no longer execute out of an exported file (CSV/formula injection).

🔐 (SSO) SAML2 routes now answer 404 when SAML is disabled.

🎯 (Findings) The Priority filter and override inputs now accept decimal values.

🗂️ (Assets) A PATCH without a parent field no longer orphans the asset, and auto-creating the same asset name concurrently no longer returns a 500.

📥 (Importers) Bulk finding deletes, tag-count updates, and async cascade deletes now retry on transient DB conflicts and are ordered so concurrent imports and deletes cannot deadlock.

🔌 (Connectors) The Action1 connector tolerates non-numeric sentinels in quoted numeric fields, and the Microsoft Defender connector retries a transient 5xx/429 on a single export page instead of failing the whole export.

🛠️ (Parsers) Fixed a Trivy Scan crash from an uninitialized resource_name, and reset Scout Suite parser state so a report parses to the same findings twice.

📝 (Notes) A partial note PATCH now keeps the note body and no longer writes a null NoteHistory entry.

📊 (Reporting) Reports no longer fetch unrenderable columns, report cells are now bounded, and a block's Order By is applied through the filterset.

✨ (Tables & UI) Clipped table cell text now wraps, the empty band below short pages is gone, the viewport row cap no longer oscillates and stalls a table, and the severity bar chart is positioned correctly in the open findings chart.

✨ (Page Grid) A widget's Title and Icon now follow its Records choice.

🔌 (Jira) Fixed the Jira migration.

📦 (VEX) Added CycloneDX SBOM / VEX / VDR export and import, as a round trip: a document exported from DefectDojo can be imported back into DefectDojo. The raw CycloneDX VEX analysis is now preserved on parsed Findings.

🪪 (SCIM) Added SCIM 2.0 provisioning. Your identity provider can now create, update and deactivate DefectDojo users and manage groups directly, rather than DefectDojo only learning about a user when that user first signs in. Deactivating a user over SCIM also deletes that user's API tokens. SCIM is configured under Connect > Authorization, alongside your login providers, and is tagged Provisioning to distinguish it from the providers that put a button on the login page.

🔌 (Downstream Connectors) Added Messaging Connectors (beta), which send alerts to Slack, Microsoft Teams, email, or an Amazon SNS topic. Alerts are routed by Rules Engine 2.0: a rule decides when to send, which Findings qualify, and which connection and destination the message goes to. Requires the Messaging Connectors and Rules Engine 2.0 feature flags.

📊 (Reporting) Reporting is now generally available, and no longer carries the BETA label.

📊 (Reports) Both the classic Report Builder and the new Report Builder now offer a one-click migration of your existing report templates. The migration works with the Reporting feature flag off, so you can move on your own schedule. Reports you have already generated are finished files and stay downloadable until removal.

🧩 (Page Layouts) The five View pages now use customizable widget grids, so you can arrange each page's widgets.

📋 (Tables) Table columns can now be resized, and the widths you set are saved to your table preferences. List tables also render a per-column loading skeleton while data is loading.

🔌 (Connectors) Registered the Tenable Web App Scanning and Rapid7 InsightVM connectors, along with six connectors that had shipped without a registration.

🤖 (Sensei) A provider can now hold several connections rather than one, and setup is scoped to the connection you are working in. Add Repositories now opens on the repository step. Semgrep scans run under a memory cap and recover across a hard kill (OOM).

✅ (Risk Acceptance) Added Expire and Reinstate to the risk acceptance menu, and as API actions.

⚙️ (Rules Engine 2.0) A Rules Engine 2.0 rule can now be given its own schedule. Enabling the feature flag now warns that a worker restart is required before it takes effect.

📍 (Locations) Added migrate_locations_to_endpoints, the reverse of the endpoint-to-location conversion.

🔌 (Connectors) A connector request now requires a usable credential and a base URL, so a request cannot be submitted with details that will not connect.

🛠️ (Snyk) Snyk reachability is now rendered as the raw values Snyk reports, rather than a derived yes/no.

⚡ (Performance) Notes are now serialized a page at a time without re-filtering the page, and deduplication no longer lowercases the hash input on every Finding purely to log it.

📊 (Dashboards) The two Group By selects now focus their filter automatically when opened.

New Reachability Support

A brand new Drag and Drop Rules Engine 2.0 for building automations/rules

New Threat Intelligence support for Priority Engine

A new federal compliance bundle for FedRamp, ConMon, and others