DefectDojo Weekly Changelog — v3.5.100 (November 9, 2026)

DefectDojo Weekly Changelog 🚀 — v3.5.100 (November 9, 2026) Hey everyone! A new update of DefectDojo Pro and Community Edition is out. Here's what's in this week's release: NOTE: Tool Types, Tool Configurations and API Scan Configurations are deprecated and will be removed in 3.6.0 on December 7, 2026. 🔐 (Permissions) Permission Audit on the All Users list adds columns for each user's flags, Global Roles, Configuration Permissions, Organizations, Assets and Groups, with filters, sorting and CSV export. A user's page has an Access tab that lists everything the user reaches and the role or Group that grants it, and Organizations and Assets cards where roles can be added, changed or removed. A Group's page shows the Group's own access in the same way. Bulk Add To and Remove From on the Users list add or remove many users at once. These are part of Access Administration, a beta feature that is on by default. View As User shows the app read-only as another user sees it, for up to an hour, with an Exit bar at the top of the page. A user administrator starts it from the user's page, and a Group lead from a member's row on the Group's Members tab. It requires the View As User feature flag, off by default. See Permission Audit and Effective Access and View As User. 🧭 (Navigation) Sidebar Presets are named sets of hidden sidebar entries, managed under Settings > UI Defaults > Sidebar Presets. A preset only hides entries: direct links, bookmarks and the API keep working. Each user picks a preset on the User Profile page, and an administrator can share a preset and make it the instance default. The feature is on by default. See Sidebar Presets. 🎛️ (Settings) Default Profiles give every member of a Group the same starting setup. Superusers build named profiles under Settings > UI Defaults > Default Profiles and rank them, and each Group picks one on its new Defaults tab. A member's dashboards, page layouts, table views, sidebar preset, form configuration and landing page come from their Groups' profiles in rank order, unless they chose their own. Restrict to Selected Layouts limits members to the layouts a profile lists, and Lock Landing Page fixes where they land. See Default Profiles. 📏 (Triage Engine) A Group can own Triage Engine rules and Report Builder templates, blocks, themes and schedules, share them read-only with other Groups, or publish them to everyone. A Group's rules and report schedules run as the Group's own automation identity, with the Group's access. The role editor has a Group Content table, and Settings > Unowned Content lists what a deleted Group or a departed owner left behind. Requires the Group Ownership feature flag, off by default. See Sharing and Versions and Report Builder. 🤖 (MCP) A Personal Data Filter card on the MCP page lets a superuser filter personal data out of MCP tool results: user fields are removed or replaced with pseudonyms, audit trails are removed, and personal data is scrubbed from free text. It is off by default. See MCP Server. 📦 (Assets) Four widgets on the Asset page lead with what needs attention and fit their tile at every size. Compliance shows overdue POA&M items, a missing ConMon snapshot and unmet CMMC requirements. PCI DSS Scope shows what is due on the Asset. Priority and SLA Drivers names the priority fields that are not set and shows the deadline for each severity under the SLA that applies. Exposure explains its verdict from the source that decides it, and its override and production branch are set in one Edit Exposure form. See Federal Compliance, PCI DSS Scope and Patch Clocks, Finish onboarding and Asset Exposure. 🎯 (Findings) The Findings list has a Mitigated By column, with a user filter and sorting, and an Exploit Evidence filter that keeps Findings with a Metasploit Module, Nuclei Template or Exploit-DB Entry in Threat Intelligence, or excludes them. The Findings export offers the Version, Build ID, Commit Hash and Branch/Tag of each Finding's Test and Engagement. See Filter Index, Threat Intelligence and Findings. 📏 (Triage Engine) Run Now of an On Dedupe Match rule in Keep Both Active mode brings in the matches deduplication made before the rule existed, such as Findings already marked duplicates while both Assets shared a Dedupe Pool. A Finding's page has a Linked Findings tab that lists the Findings a rule linked it to, where a wrong link can be removed and restored. Automation can do the same through /api/v2/finding_links/. See On Dedupe Match. 🎛️ (Settings) Form Configuration holds several named configurations, one of them the instance default that everyone's forms follow. Configurations can be duplicated, and an upgrade keeps the existing configuration as the default. Single Select and Multi Select custom fields can offer an Other choice, turned on per field, that saves the text the user types. See Configuring Forms and Custom Fields. 📈 (Dashboards) A Maintainer can make a collaborative dashboard layout read-only. Everyone keeps it in their layout picker, and only its owner and users who can share dashboards can change it. See Customizable Dashboards. 🔌 (Connectors) Tenable.io tags each Finding credentialed-scan or uncredentialed-scan from the scan of the host it was found on. The tags follow the scan, so a host scanned with credentials later gets the new tag on the next sync. 🧭 (Navigation) Task walkthroughs outside the Sandbox can continue past a save step without saving: Next closes the form, and later steps use a record that already exists. See In-App Walkthroughs. ✨ (UI) Danger buttons and badges, error and validation text, the required-field asterisk and form field borders meet WCAG AA contrast in light and dark themes, and an invalid field keeps its red border while it is hovered or focused. ⚡ (Performance) Creating or updating a Risk Acceptance takes the same time for one Finding as for many, and removing Findings from it sends one notification instead of one per Finding. List exports with many columns, and saving a long IP allowlist on the Firewall Settings page, are faster. The Pro database migrations run about a third faster. 🔌 (Connectors) GitHub Advanced Security closes the last open Finding of an alert type once GitHub reports no open alerts of that type. StackHawk An expired session no longer fails the run, and paging stops at the last page. When connection settings are saved twice in quick succession, the later save is the one applied. 📏 (Triage Engine) A rule that sets a risk-accepted Finding to false positive, out of scope or mitigated takes it out of its Risk Acceptance first, as closing it by hand does. Batched alert and email text fills in the values it names, such as the Jira issue in a Jira receiver's alert. A condition holding a comma-separated list of values can be saved, and the condition editor shows such a list and a true or false value stored as text. Saving a rule with no name says the rule needs a name. See Node Reference and Building Rules. ♻️ (Deduplication) The Dedupe Pool previews count the Findings a Keep Both Active rule keeps active apart from those that become duplicates. The import and reimport previews match across the Asset's Dedupe Pool as the import does, and count a Finding a Keep Both Active rule links as created. See Dedupe Pools. 📥 (Importers) When a reimport reports a container image under a newer tag, the previous image on each matched Finding is mitigated and the new one stays active. Location History on the Finding page includes container images. See Location Drift Matching.