DefectDojo weekly changelog: v3.5.0 (November 2, 2026)

DefectDojo Weekly Changelog 🚀 — v3.5.0 (November 2, 2026) Hey everyone! A new update of DefectDojo Pro and Community Edition is out. Here's what's in this week's release: 📦 (Assets) Organizations, Assets, Engagements, Tests and Findings can be archived instead of deleted. Archiving hides the record and everything under it from lists, search, dashboards, metrics, reports, the API, deduplication, reimport and Triage Engine rules, and it stops counting toward the license. Archived data is kept for 2 months by default and can be restored at any point in that period, after which it is deleted. The Archived page lists each archive, and opening one shows its records read-only in the usual lists and pages. Triage Engine rules can archive Findings on a schedule, and excess duplicates are archived instead of deleted. Self-hosted installs can change the retention period with DD_ARCHIVE_RETENTION_MONTHS. Requires the Archive feature flag, off by default. See Archive. 📏 (Triage Engine) The Notifications template pack has a template that sends an in-app alert when new Findings match a set of filters: pick the filters in the trigger's scope, and the rule sends one alert for each batch of matching Findings, however they were added. See Building Rules. 🧭 (Navigation) Each user can choose the page they land on after signing in, from Default Landing Page under Signing In on the User Profile page. The choice follows the account to every browser, and applies to single sign-on started from the identity provider. Controlled by the Default Landing Page feature flag, on by default. See Default Landing Page. 🔐 (Authentication) Idle Timeout on the Login Settings page signs a user out after a set time without a request, from 15 minutes to 8 hours. It is off by default and applies to password and SSO logins alike. See Login Settings. 🔌 (Connectors) Security Hub can import Findings on ECR container images only for images Amazon Inspector reports in use. CrowdStrike Falcon imports Identity Protection detections. Checkmarx One can select scans by Initiator, combined with the Branch filter. 🔌 (Integrations) ServiceDesk Plus sends custom fields and a ticket template with each ticket, and a refused ticket shows the error ServiceDesk Plus returned. 🔐 (SSO) Use Mapped Username on the SAML settings page takes the username from the attribute mapped to Username instead of the NameID. It is off by default. The SAML Login Attempts panel lists the attributes received on each login, which mapping rows were found, and where the username came from. See SAML Configuration. 🔐 (Permissions) The All Users and All Groups tables have a Permissions column that opens a read-only grid of the permissions a user or group holds, and which Global Role grants each one. See Custom RBAC Roles. 📦 (Assets) The Finding Distribution panel on the Asset page is a status ring beside a tile for each source. The record cards on the Asset page sit below the metadata row. See Assets and Customizing Page Layouts. ✨ (UI) Each main list with nothing in it offers its main action, such as adding the first Asset. ⚡ (Performance) The Executive Insights summary, the Vulnerability Explorer list, the Assets list counts, the Command Center, the Test page's import history, the Tests list sorted by Finding count, exports, Triage Engine rule previews, bulk edits on the Findings list and tag filters on the Findings list are faster. The tag picker no longer slows down for users scoped to a few Assets, downstream connectors are updated once per import, and large Qualys XML reports parse in linear time. 🔌 (Connectors) A Coverity Discover no longer stops on a project with no name: the project is skipped with a warning, and records with a blank product name are named after their ID. 📊 (Reporting) Reports show pasted screenshots. In PDF reports, long code wraps and a Finding too large for one page breaks across pages. Numeric filters work in chart blocks, previews, Triage Engine rule scopes and dashboard tiles, and a ~ in report text no longer shows a backslash before it. See Report Builder. 📈 (Dashboards) An Embedded Table keeps a viewer's saved filters after a reload, and a widget's saved filters can be removed or cleared in the editor. The Command Center's Add Widget dialog titles a new widget as new, and a graph taller than its tile scrolls to its top. See Customizable Dashboards. ⚖️ (Risk Acceptance) An older Risk Acceptance that has expired reads as expired, and one that is extended expires again on its new date. See Risk Acceptances. 📏 (Triage Engine) A scheduled run of a disabled rule is recorded as skipped instead of successful. A Send an Email node can only address Email connections. See Scheduling Rules and Send an Email. 🎯 (Findings) The Remediation Center groups host Findings by the fix they need. A component name that only repeats the host's name is ignored, and vendor advisories with no component become one upgrade per product per host. See Remediation Center. 🏢 (Organizations) The change plan preview for moving an Organization lists only the rules, dashboard layouts and report schedules that refer to it. See Change Plans. 🔔 (Notifications) Users whose notification settings were created outside the app, such as from a fixture, receive Pro event notifications, and a user with two global notification rows gets a consistent result. See About Notifications. 🔌 (Integrations) A ticket template action that holds only a string literal can be saved, an action that holds only trim markers is refused when saved instead of failing later, and the template check's messages are translated. A refused issue tracker mapping save keeps the dialog open and shows the server's messages under their fields. ⚙️ (API) /api/v2/findings/ honors the engagement, product and prod_type filters. The full health check no longer fails on instances missing a Location table. See DefectDojo API v2. 🛠️ (Parsers) The Qualys XML parser skips a Finding whose QID has no glossary entry instead of failing the import. 🤖 (MCP) When saving the MCP server switch is refused, the switch stays on the server's state and one message is shown. See MCP Server. 🎛️ (Settings) Removing one rule on the Firewall Settings page no longer removes other rules for the same IP address. A deployment setting changed across a restart, such as turning API tokens off, reaches browsers that already had the app open. 📋 (Tables) A dragged column keeps its width when the table redraws during the drag. See Customizing Tables. ✨ (UI) Enter starts a new line in form text areas and editors. A saved setting no longer reverts to an older value from a refresh sent before the save. The gear menus on Organization and Test pages appear once the record has loaded. Numbers and dashboard text follow the app language. Message contrast, page landmarks, link names, scrolling table regions and form spacing in right-to-left languages are improved for accessibility. See Language and Localization. 🔐 (Authorization) Report schedules are visible only to their creator and to users who can see the reports they produce. Adding a note to a Finding, Test or Engagement requires permission to add notes on it, and downloading a Risk Acceptance's proof requires permission to view that Risk Acceptance. A revoked permission stops applying as soon as it is removed. A Triage Engine rule can name only a connection that its author and its owner may use. See Action permission charts and Node Reference. 🔐 (Hardening) SSO, LDAP and SMTP secrets saved on the Settings pages are stored encrypted in the database. See Single Sign-On. 🔐 (Permissions) Configuration Permissions, which open settings pages such as Users, Tool Types and SLA Configurations, come from roles. A role carries them in its Configuration Permissions table, and they apply when the role is held as a Global Role, directly or through a Group. A user or Group can hold several Global Roles, and they add up. The upgrade creates a role for each set of Configuration Permissions in use and adds it beside each holder's existing Global Role, so no one loses access. See Custom RBAC Roles. 🔐 (Authentication) Session Age is counted from login, so a session ends when it passes, however active the user has been. After the upgrade, a signed-in session's clock starts at its first request. See Login Settings. 🚢 (Deployment) PostgreSQL stops any single statement of a web request that runs past 30 seconds under the service's harakiri, and the request answers with a 503. Background tasks, migrations and management commands are not limited. DD_DATABASE_WEB_STATEMENT_TIMEOUT, DD_DATABASE_WEB_LONG_STATEMENT_TIMEOUT and, on Docker Compose, DD_DATABASE_IMPORT_STATEMENT_TIMEOUT change the limits. See Hardware Sizing for Self-Hosted DefectDojo Pro. 🚢 (Deployment) SSO, LDAP and SMTP secrets saved in Settings are encrypted with DD_SECRET_KEY. To change the key, set the new one in DD_SECRET_KEY and keep the old one in DD_SECRET_KEY_FALLBACKS, a comma-separated list. See Restoring a Self-Hosted Deployment. Check out the full changelog here: https://docs.defectdojo.com/releases/pro/changelog/#november-2-2026-v350