What’s new in the latest DefectDojo Pro release

🎯 (Findings) The Remediation Center groups the Findings on a host whose remediation text names the same vendor patch into one Patch action named for that patch. See Remediation Center. 🤖 (Sensei) Suggested changes in fix pull requests show as one diff. The Generate Threat Model button is visible on the New Threat Model page. See Threat Modeling. ⚖️ (Risk Acceptance) Deleting a Risk Acceptance pushes each Finding's removal note to its issue tracker ticket, only for Findings that have one, and the note no longer links to the deleted Risk Acceptance. Block Self-Approval of Risk Acceptances and Require Review to Extend an Expired Risk Acceptance can be changed on the System Settings page. See Risk Acceptances. 🔐 (Permissions) Users authorized only through Organization or Asset roles can open the Vulnerability Explorer, which lists the Findings they can see. A user whose role is on an Asset's secondary Organization can open that Asset from the lists where it appears. See EPSS / KEV. 🔔 (Notifications) A user with more than one global notification row receives a Pro event on every channel any of those rows turns on. See About Notifications. 🔌 (Integrations) The ticket template check refuses a stray - and a comment that the integration cannot read, when the template is saved instead of when a ticket is pushed. A custom field mapping that does not fit the pushed record, such as a Finding mapping on a Finding Group tracker, is reported as a configuration error that names the field and the sources it can use. 🎛️ (Settings) The Audit Logs list loads on instances with a very large audit history: past 10,000 entries the total reads as a lower bound, such as "10,001+". Pages never repeat or skip an entry, and an unknown sort key answers 400 instead of a server error. A feature flag change applies on every server at once, instead of up to five minutes later. See Audit Logs. 📊 (Reporting) Scheduled executive posture packs are generated instead of failing. See Command Center. 🔐 (Authentication) After a forced password reset or an MFA step, a user who opened a classic page lands on that page instead of the home page. ⚙️ (API) Updating a Finding that another request deletes at the same time returns 404 instead of a server error, and the OpenAPI schema download no longer fails on an unusual version value. See DefectDojo API v2. ✨ (UI) A URL in a detail table stays on one line, with the whole URL in a tooltip. An empty list tab offers its add action only when the new record would show in that tab. A refused Appearance save restores the saved colors. 🔐 (Authentication) API token authentication follows the forced password reset rule. A SAML message addressed to another service provider is refused with a 400 response. After sign-in, an MFA step, a password change or accepting the End User License Agreement, the user is only sent to a page on the same site. See Single Sign-On. 🔐 (Authorization) Every Risk Acceptance read, including its notes and proof file, follows the Risk Acceptance view permission. Images in reports require view access to the Engagement, Test or Finding that holds them. API v3 includes a parent Organization's details only for users who can view that Organization. See Risk Acceptances. 🔐 (Hardening) The application, nginx and integration images apply security updates to their bundled components, and the application image leaves out packages it does not need at runtime. 🔐 (Authentication) Every user accepts the End User License Agreement once, after their first sign-in on this release and again when a new version is published. Nothing else loads until they select I Agree. A user who must reset their password accepts it on the password change page. See End User License Agreement. 📏 (Triage Engine) The Restrict Triage Engine Emails to DefectDojo Users feature flag is on by default. While it is on, Send an Email and the email announcement of Generate a Report reach active DefectDojo users only, and each user only gets an email whose listed items they can all see. Other addresses are refused when a rule is saved, and left out with a warning when a rule is imported. Turn the flag off to let rules email any address. Rule names no longer have to be unique: exported rules carry an ID, and an import matches existing rules on it. See Send an Email and Sharing and Versions. 🎛️ (Settings) The hidden and required fields in Form Configuration apply to /api/v2/ writes for Findings, Engagements, Tests, Assets, Organizations and Risk Acceptances: writing a hidden field or leaving a required one empty answers 400. The instance's API schema shows the configuration. See Configuring Forms. 📦 (Engagements) The Calendar shows Interactive Engagements by default. CI/CD Engagements are shown when they are selected in the Engagement Type filter, and a link that names an Engagement Type keeps it. See Calendar. 🚢 (Helm) The initializer Job's default memory limit is 2Gi, up from 1Gi, in values.yaml and every profile. New opt-in values support a service mesh and a read-only root filesystem: securityContext.nginx.readOnlyRootFilesystem, securityContext.tmpVolume.enabled (with sizeLimit), securityContext.initContainers.runAsGroup, jobs.tests.podAnnotations and jobs.certificateGeneration.podAnnotations. See Service Mesh (Istio), Read-Only Root Filesystem and DefectDojo Pro Upgrade Guide (Kubernetes / Helm). Check out the full changelog here: docs.defectdojo.com/releases/pro/changelog#…