DefectDojo/django-DefectDojo 3.4.0

3.4.0 🌈

on GitHub

Please consult the Upgrade notes in the documentation for specific instructions for this release, and general upgrade instructions. Below is an automatically generated list of all PRs merged since the previous release.

Changes since 3.3.300

• docs(compliance): document supporting files on regulatory obligations @Jino-T (#16168)
• docs(findings): move or copy findings to another test @Jino-T (#16098)
• Add docs on MCP PSIRT toolset @empty-usr (#16129)
• docs: recapture Pro UI screenshots for the Menu 2.0 sidebar @paulOsinski (#16128)
• docs: update Pro navigation instructions for the Menu 2.0 sidebar @paulOsinski (#16116)
• Docs: change plans, review every hierarchy change before it happens @devGregA (#16191)
• Docs: Security Hub account parents, OU and account tag placement, and re-placing existing assets @devGregA (#16190)
• docs(connectors): describe the Checkmarx One Result States filter @svader0 (#16134)
• docs(pci dss): the regulatory profile opens on Regulatory Profile or PCI DSS @Maffooch (#16174)
• Docs: container image repositories as shared asset identity @devGregA (#16196)
• Docs: plan your hierarchy, and what reorganizing later changes @devGregA (#16195)
• Docs: asset grouping for Defender for Cloud, Prowler, Google Cloud SCC and Lacework connectors @devGregA (#16194)
• Docs: finish onboarding with the assets needing attention list @devGregA (#16193)
• Docs: computed destinations and connector attributes in Rules Engine asset actions @devGregA (#16192)
• docs(locations): describe the Location page's Custom Fields card and Referenced by table @Maffooch (#16183)
• docs(connectors): document the Backstage lifecycle and owner-description sync @Maffooch (#16182)
• Docs: what happens to imported findings when a connector record is re-mapped @devGregA (#16181)
• docs(connectors): document the Defender "Consolidate Findings by Vulnerability" option @paulOsinski (#16169)
• docs(locations): cloud resource drift matching and the endpoint migration boundary @svader0 (#16032)
• docs(risk-acceptance): describe the Exception Requested finding-table column @paulOsinski (#16031)
• Docs: moving assets between organizations and the bulk update API @devGregA (#16180)
• Docs: Security Hub connector asset grouping and organization placement @devGregA (#16179)
• docs(connectors): document the Microsoft Azure asset connector @svader0 (#15841)
• docs(page-layouts): the Asset and Organization record cards are widgets @blakeaowens (#16197)
• docs(risk-acceptance): use the hyphenated Pro UI path in the webhook example @blakeaowens (#16198)
• docs(sandbox): the Pro sandbox, and turning it on self-hosted @blakeaowens (#16185)
• docs(webhook gateway): the database role is named after the database @blakeaowens (#16184)
• docs(dashboards): Command Center rows and the teal secondary color @blakeaowens (#16172)
• Helm: add the chart repo from charts.defectdojo.com, with a privacy notice @devGregA (#16178)
• docs(sso): note that a saved client secret is not shown again @devGregA (#16124)
• docs(sensei): note that a new API base URL needs the key again @devGregA (#16126)
• Add CODE_OF_CONDUCT.md @devGregA (#16165)
• docs(sensei): say who can run a /fix comment @devGregA (#16125)
• docs: correct pre-pay savings on Contact Sales to 48% @devGregA (#16123)
• Docs: describe open-source authentication and access accurately @devGregA (#16166)
• docs: say what registry.defectdojo.com logs next to the Compose install steps @devGregA (#16176)
• Pull the Docker Compose images through registry.defectdojo.com @devGregA (#16121)
• docs(triage-engine): webhook receivers and Jira two-way sync @blakeaowens (#16060)
• Google Cloud Artifact Scan: handle vulnerabilities without relatedUrls @anthonwellsjo (#16167)
• docs(pro): point the support docs at the Support page @svader0 (#16118)
• Update sample data @github-actions[bot] (#16155)
• docs(connectors): document the Google Cloud asset connector @svader0 (#16113)
• docs(compliance): walk through CRA evidence packs end to end @skywalke34 (#16159)
• docs(report builder): Location per Asset blocks and Asset/Organization name columns @Maffooch (#16136)
• docs(dashboards): a duplicated Section Break keeps its title, which can be blank @Maffooch (#16119)
• docs(connectors): document the Checkmarx One Tag Findings With Scan ID option @Jino-T (#16153)
• docs(pro): describe the Support pages, the docs search and the airgapped setting @svader0 (#15925)
• docs(crowdstrike): say which CID the Falcon API client must be created in @Maffooch (#16120)
• CycloneDX: keep component.type on dependency locations; AI Inventory docs @Maffooch (#16135)
• Return the v2 nested user shape from API v3 expand @svader0 (#16112)
• fix(base_models): make the model save hook sequence atomic @svader0 (#15732)
• docs(metrics): Insights dashboards remember the last applied timeframe @blakeaowens (#16157)
• docs(reporting): widget blocks honor template variables @blakeaowens (#16117)
• ci(docs): hold dev docs deploys until bugfix is retired @Maffooch (#16131)
• Retire the bugfix branch: every release is cut from dev @Maffooch (#16086)
• docs(markdown editor): add images to markdown fields through the API @blakeaowens (#16105)
• docs: cross-tool deduplication explainer, llms.txt, sitemap lastmod @devGregA (#16122)
• docs: load DefectDojo's own developer-activity tracker next to Reo @devGregA (#16114)
• fix(sonatype): handle null componentIdentifier instead of failing the import @skywalke34 (#16101)
• docs(changelog): add DefectDojo Pro 3.3.300 release notes @Maffooch (#16111)
• perf(api): eliminate N+1 queries in product and asset list endpoints @Jaimin2687 (#16037)
• docs(site): rebrand docs.defectdojo.com to the 2026 brand (Earth Undertones) @devGregA (#15736)
• docs: retire the PSIRT 1.x sidecar from the Pro on-prem guides and document the migration @devGregA (#15964)

🚀 General features and enhancements

• fix(user api): remove N+1 on the users list endpoint @Maffooch (#16127)

🚀 API features and enhancements

• fix(metadata): authorize the location_product scope on location metadata @Maffooch (#16170)
• fix(metadata): accept location-only payloads and persist the product scope; document the Location page @paulOsinski (#16152)

🐛 Bug Fixes

• fix(metadata): authorize the location_product scope on location metadata @Maffooch (#16170)
• fix(user api): remove N+1 on the users list endpoint @Maffooch (#16127)
• fix(locations): return location_type and location_value on reference endpoints @Maffooch (#16130)
• fix(metadata): accept location-only payloads and persist the product scope; document the Location page @paulOsinski (#16152)

🖌 Updates in UI

• Release 3.4.0: Merge Bugfix into Dev @Maffooch (#16201)
• feat(ui): refresh the theme to the DefectDojo brand @blakeaowens (#16188)

🧰 Maintenance