Greg A.

Thank you mbelarde, I appreciate that. Below are answers to your questions, and I'm sorry, but this will have to be my final reply here so I can get back to building. Dojo is going through rapid growth (we just crossed 50M downloads) and there's a lot to do. Staying on v2: nothing changes for existing deployments. v2 stays available and keeps working as it does today. It won't get new development from us though; active work, security fixes included, happens in v3. On OSS improvements: the OSS edition is not frozen and not going away. It continues in v3, and it's getting real investment. Since the last v2 release, OSS v3 has added 42 new tool integrations, taking it from 215 to 257 supported tools, and every one of the 215 from v2 is still there. That's on top of the new UI and other new areas of the platform. And to clear up one thing in your message, the Jira integration was not removed. Choosing RBAC and SSO is what let us keep it. On whether more features move later: the point of doing this once, and doing it the way we did, was to make the economics stable enough that we don't have to keep revisiting what's in the OSS edition. There is no list of features waiting to move. On why SSO and RBAC rather than others: that's the tradeoff analysis in my earlier message and the letter, so I'll point you there rather than re-run it. For anything beyond this, office hours is the place, and you're welcome any time.

Hi mbelarde. I'd appreciate you not pulling Cody or Valentijn into this. They work incredibly hard for this community, and I'm the one who made the decision. The full details are in DefectDojo v3 - A New Chapter for the OWASP Edition.pdf. We held office hours discussing different avenues before settling on this route, I've done my best to be clear and transparent about the why, and the move has drastically helped the economics. I empathize with your frustration, but no one offered up a reasonable alternative, and I believe that's because one doesn't exist: if the conversion metrics aren't sustainable, there aren't other viable options. We did weigh the other paths. If we stopped supporting the Jira integration instead, that would hit small teams hardest. If we stopped supporting deduplication or auto-triage via reimport, both would impact far more of the community. Everything else we looked at had the same problem. Choosing not to support RBAC and SSO in v3 was the option that affected the fewest users while also making the platform easier to maintain: supporting integrations with identity systems we don't control or have access to is resource intensive. We offer a free tier of Pro to non-enterprise teams that qualify. It gives the community cross-tool deduplication, root cause analysis with correlation, threat intel, reachability, auto-remediation, a new UI, astronomical performance gains, the list goes on. I made these changes so that Dojo is still here years from now. A sustainable company is what funds the platform, the OSS edition included. You're welcome to stay on v2. It's still available and accessible, and everything you're running today keeps working as it always has. The reasons SSO didn't carry into v3 are laid out in the letter.

Fix completed and scheduled for 3.2.100

looking into this, thank you for the report.

https://github.com/DefectDojo/django-DefectDojo/pull/15089

Thanks for flagging this. I was surprised there wasn't already an env var for it. I will submit a PR and link below when completed.

Thanks for digging into this and writing it up so clearly. This kind of report really helps us. 3.0 was meant to be fully downgrade-compatible, but the planned deprecation of the credentials manager pulled out the table and column behind it, which broke compatibility on the way back down. We'll get it corrected with 3.0. I'm not sure what else we can do right now to help others. Your workaround of recreating the table is very helpful for anyone stuck right now. We're hoping that pulling 2.59 in the meantime will help reduce the impact while we work on a fix. Yes please, a GitHub bug report would be a big help. It lets us track it properly. Thank you again.

Thank you callard! Please open a GitHub issue with the details: https://github.com/DefectDojo/django-DefectDojo/issues