DefectDojo Weekly Changelog: v3.2.0 Update Highlights and New Features (August 4, 2026)

🙋 (Review Claiming) Let a requested reviewer claim a Finding review so the other eligible reviewers can see it is being handled. Once claimed, only the claimer or the requester can clear the review.

📋 (Work Assignment) Assign Findings and Risk Acceptances to individual people, alongside the existing group Owners, and give each person a My Work queue of what they are responsible for.

⚖️ (Priority) Added a threat-intel risk floor, which is based on whether a Finding has EPSS, KEV or other exploitability. Only takes effect if Threat Intelligence Enrichment is enabled.

⚙️ (Rules Engine 2.0) Build automation rules as visual node graphs that react to Finding events, with per-run traces and a delivery outbox.

🕵️ (Threat Intelligence Enrichment) Threat Intelligence reached general availability, with signed threat-intel bundles, downgrade hysteresis, and new list and dashboard surfaces.

🧭 (Menu 2.0) Reorganized the Settings menu behind Menu 2.0, with a new All Settings hub.

📜 (Compliance) The federal compliance pack: FedRAMP POA&M ledger and ConMon deliverables, CMMC Level 2 assessments, and control coverage.

🔗 (API) DefectDojo REST API can now produce reports as HTML, CSV, and Excel, not just JSON. Use the /generate_report/ endpoint path, e.g. api/v2/findings/generate_report/.

⚡ (Performance) Improved the performance of Celery/Async tasks.

♻️ (Deduplication) Added set-based deduplication that matches Findings on their full set of vulnerability IDs and CWEs, including partial/subset matches, alongside a new global vulnerability-ID deduplication algorithm and global_locations cross-product deduplication on shared locations. False-positive history now honors the same vulnerability-ID/CWE set-match tokens, false-positive-history candidate filtering is now pluggable, and deduplication now produces a stable "original" finding regardless of scan-import order.

🎯 (Findings) Findings can now carry multiple CWEs across the API, the Vue UI, and the universal parser. Vulnerability IDs are normalized into a first-class Vulnerability entity with ordered references, per-vulnerability KEV/EPSS enrichment columns, and vulnerability aliases. Added a copy-finding action with an auto-detected vulnerability-ID type.

📍 (Locations) Location drift matching keeps a finding tracked as its locations change across reimports.

🕵️ (Enrichment) Added a two-stage KEV/EPSS pipeline that projects the worst score per vulnerability onto Findings, plus bulk cloud-enrichment reads and import-time enrichment.

🔌 (Connectors) Added one-button migration from classic Jira to Downstream Connectors. Connector syncs now keep branch tags current on the Findings they report, and the public /assign_product endpoint can map Findings-type records again.

🔌 (Connectors) JFrog now scopes artifact-mode Findings to each artifact's latest build.

📝 (Notes) Notes now support Markdown.

🛠️ (Tools) Added SPDX, CSAF 2.0, and OpenVEX interchange-format parsers and a Promptfoo (LLM eval and red-teaming) parser.