DefectDojo weekly changelog — v3.4.300 (October 26, 2026)

DefectDojo Weekly Changelog 🚀 — v3.4.300 (October 26, 2026) Hey everyone! A new update of DefectDojo Pro and Community Edition is out. Here's what's in this week's release: 🎯 (Findings) A Finding's Title, Tags, Severity, Assignees, Planned Remediation Date and Description can be changed on the Finding page itself, without opening the Edit Finding form. Changes are held until you save, several fields can be changed and saved together, and a change someone else made since the page loaded is never overwritten. The same in-place editing is on the Engagement and Asset pages. Requires the Inline Editing feature flag, on by default. See Editing Findings. 🔔 (Notifications) The bell in the sidebar footer opens a notification inbox: unread alerts grouped by the record they are about, with All, Mentions, Assigned, Watching and System tabs, the option to mute a record, and read state carried to the Alerts Page. The counts refresh on their own, and Load Older pages through the rest. The inbox is now generally available. See About Notifications. ⚙️ (API) Service users are API-only accounts with no email or password that never sign in, each holding one token shown once at creation, and authorized through memberships, groups and a global role on their own page. Requires the Service Users feature flag, off by default. See Service Users. ♻️ (Deduplication) Each scan type can set how its Findings are grouped: as the parser produces them (the default), one Finding per location, or one Finding per vulnerability, where every location of a vulnerability becomes one Finding that stays open until each location is fixed. The location-based options need the Locations feature. See Deduplication Tuning. 📏 (Triage Engine) Rules can be exported, imported and restored: move a set of rules between instances with a compatibility check, restore an earlier version of a rule, and manage rules through the API. See Sharing and Versions. 🔌 (Connectors) Unmanaged device discovery lists the devices your EDR sees on the network with no agent of their own, as CrowdStrike Falcon Discover and Microsoft Defender for Endpoint report them. Each device is a candidate and becomes neither an Asset nor a Finding on its own. Requires the Unmanaged Devices feature flag, off by default, turned on per connection with Report Unmanaged Devices. See Unmanaged Devices. 🔌 (Connectors) A connector's label can be renamed without re-homing its Engagements. See Add or Edit Upstream Connectors. 🔌 (Connectors) Tenable groups records by asset and adds WAS scan-configuration grouping and a WAS tag filter, Checkmarx One tags Findings with their triage state and exploitable path and carries their comments, Qualys sets each Finding's date from when it was first found, and Wiz reports a runtime reachability verdict. Connector-owned tags and the triage comment stay current on reimport, and a connector whose filters match nothing shows a warning. 🔌 (Jira) Findings can be unlinked from Jira in a bulk edit. See Bulk Editing Findings. 📏 (Triage Engine) Rules can be scoped to hosts, IP addresses and CIDR networks. 📈 (Dashboards) The Count and Graph widgets can measure unique CWEs or unique vulnerability IDs instead of rows, such as unique CWEs by severity for one Asset, and roll the measure up across child Assets. See Customizable Dashboards. ⚙️ (API) A new API exports an Asset and everything under it as a manifest plus an NDJSON stream. See Product export. 📍 (Locations) Each location reference records the Test that reported it. See Locations Overview. 🧭 (Navigation) The sidebar footer has an account row and a single row of icon buttons (alerts, What's New, Ask Sensei and the Production/Sandbox switch), and the account menu holds the language and light/dark choices. The What's New panel remembers the release you have seen, per account, and Hide Walkthroughs is on the lightbulb's list. See The Sidebar Menu. 🎛️ (Settings) The All Settings page is compacted into group cards. See The Sidebar Menu. 🕵️ (Threat Intelligence) A Finding's Threat Intelligence tile shows pending enrichment and KEV status. See EPSS / KEV. ⚡ (Performance) The Findings and Engagements lists no longer run a query per row, tag filters match with EXISTS instead of a DISTINCT join, bulk deletes and an import's finding groups run as one set-based operation, import and reimport requests cost a fixed few queries, and dashboard tile counts, the import list and a user's History tab read less. Connector configuration saves and deletes cost a fixed few queries. 🎯 (Findings) A Finding keeps its Locations when the Pro UI edit form is saved. ⚖️ (Risk Acceptance) A Finding stays in a single risk acceptance when one is reinstated or approved, including under concurrent writes. Reinstating leaves out Findings accepted elsewhere since the expiry, and Jira is told after the change commits. See Risk Acceptances. 📊 (Reporting) Report failure reasons are translated, and a report that reaches the time limit says so. A template's block ordering is checked when it is saved, with a missing sort field named under Order By, the template editor is tidied, and Add Existing Block follows the permission that saves the template. See Report Builder. 📥 (Importers) The import form's help is corrected for Scan Date (the mitigated date), asynchronous import and a disabled Close Old Findings, and the Do Not Reactivate option on reimport is explained. See Add Findings form. 🛠️ (Parsers) The generic importer rejects a field value wider than its Finding column with a 400, instead of failing the import without a clear reason. See Generic Findings Import. 🔌 (Connectors) The GitHub connector resolves repositories by URL and owner/name instead of display name, Cycode accepts numeric project IDs, and Qualys WAS leaves an empty filter block out of searches that have no criteria. See GitHub. 🤖 (Sensei) A fix is applied to every active code location of a Finding in one change. See Fixing Findings with Sensei. 📜 (Compliance) The CRA scope widget counts every Finding in scope, and the CRA evidence pack's support-period obligation reads each Asset's Support Period End. See CRA Article 14 Reporting. 🔐 (Permissions) Group writes and the group edit page are offered only where the group role allows them, an empty group counts as 0 members, the Add File action shows for users who can add files, and a page re-checks its per-record permissions when only the route's parameters change. 🔔 (Notifications) Relabeled Organization and Asset links in notifications open their Pro UI pages. ⚙️ (API) The message beside a 400 response's field map reads as sentences. ✨ (UI) A failed save, delete or import shows one toast with the server's reason, the user page's Metadata and Contact cards stack on a phone, a keyboard-focused table row has a quieter outline, the Markdown source toggle lines up with the first line of text, the UI switches back to an offered language when the one on screen is not offered, and popovers show their line breaks as text. 🚢 (Deployment) A self-hosted instance can sign in to PostgreSQL with a cloud identity token instead of a password. See Passwordless Database Authentication. 🚢 (Deployment) On shutdown, a running import is allowed to finish before the worker stops, and the import pool's memory recycling is sized for the pool. See DefectDojo Pro Installation Guide (Kubernetes / Helm). 🚢 (Deployment) Operators can default Asset Identity on for new instances with DD_ASSET_IDENTITY_DEFAULT_ON. See Assets. 🚢 (Deployment) Databases from before 3.0 upgrade without failing or losing the default group. See Upgrading DefectDojo Pro (On-Premise). 🚢 (Helm) The initializer runs with the media volume's group. See DefectDojo Pro Installation Guide (Kubernetes / Helm). Check out the full changelog here: docs.defectdojo.com/releases/pro/changelog#…