Please consult the Upgrade notes in the documentation for specific instructions for this release, and general upgrade instructions. Below is an automatically generated list of all PRs merged since the previous release.
Changes since 3.4.202
- docs: Asset Identity default and DD_ASSET_IDENTITY_DEFAULT_ON @devGregA (#16540)
- docs: Unmanaged Devices from CrowdStrike Falcon and Microsoft Defender @devGregA (#16541)
- docs(dedupe): say an older pool setting no longer blocks other instance edits @Maffooch (#16537)
- docs(findings): describe changing several fields in place and saving them together @blakeaowens (#16536)
- docs(import): Scan Date as the mitigated date, disabled form fields, SonarQube detailed key matching @blakeaowens (#16523)
- docs(reports): say which permission each Template editor add button needs @blakeaowens (#16530)
- docs(connectors): a connector's label can be renamed after creation @paulOsinski (#16321)
- docs(compliance): SP-1 reads the support period end, and the CRA early-warning wording @Maffooch (#16531)
- docs(sensei): replace or remove a repository's pasted access token @stevewallone (#16481)
- docs(onprem): document the import pool's drain on stop and per-pool memory recycling @Maffooch (#16519)
- docs(connectors): document FOSSA scoping filters and Qualys tag grouping @skywalke34 (#16383)
- docs(reports): a failed report can say it took too long to generate @blakeaowens (#16525)
- docs(connectors): document Checkmarx One state and exploitable path tags @Jino-T (#16460)
- docs(connectors): clarify GitHub connector imports assets only, add mapping and missing-repo guidance @skywalke34 (#16475)
- docs(sso): stop saying SSO, LDAP and SCIM need a licensed subscription @Maffooch (#16521)
- docs(dedupe): drop the claim that an older pool setting never blocks other instance edits @Maffooch (#16524)
- docs(assets): change an asset's fields in place on its page @blakeaowens (#16515)
- docs: explain which grouping settings are refused and how a moved line is tracked @Maffooch (#16520)
- docs(compliance): add a step-by-step EU CRA setup guide @skywalke34 (#16518)
- docs: say that review request and clear review notes notify @mentions @stevewallone (#16349)
- docs(connectors): document Tenable asset grouping and WAS tag-targeted scan configurations @Maffooch (#16508)
- docs(triage-engine): share rules between instances, restore versions, and the rules API @Maffooch (#16510)
- perf(findings): match tag filters with EXISTS instead of a DISTINCT join @Maffooch (#16509)
- docs: fix blank create_findings_manually pages @paulOsinski (#16429)
- docs(pro): document the Locations export field and finding Locations report column @paulOsinski (#16369)
- fix(generic parser): reject field values wider than the Finding column as a 400 @paulOsinski (#16338)
- [docs] add Locations and Deduplication quizzes @paulOsinski (#16503)
- docs(walkthroughs): hide the lightbulb from its own list @blakeaowens (#16504)
- docs(user-management): document Pro service users @blakeaowens (#16493)
- docs: run the sandbox with passwordless database authentication @Maffooch (#16505)
- docs(risk-acceptance): a finding stays in one acceptance on reinstate and on approval @blakeaowens (#16500)
- docs(engagements): change an engagement's fields in place on its page @blakeaowens (#16494)
- docs(reporting): document report failure reasons, block ordering checks and template block removal @blakeaowens (#16495)
- docs: passwordless database authentication for self-hosted Pro @Maffooch (#16487)
- docs(notifications): the inbox refreshes its counts and loads older groups @blakeaowens (#16497)
- docs(notifications): inbox tabs, muting a record and read state on the Alerts Page @blakeaowens (#16492)
- docs(notifications): the Pro notification inbox behind the bell @blakeaowens (#16478)
- docs(pro): the What's New panel remembers the seen release per account @blakeaowens (#16491)
- docs(navigation): the Pro sidebar footer and the account menu's language and theme @blakeaowens (#16490)
- docs(findings): change a finding's fields in place on its page @blakeaowens (#16477)
- docs(changelog): add DefectDojo Pro 3.4.202 release notes @Maffooch (#16486)
🚩 Changes to settings.dist.py / local_settings.py
- 🎉 add siemens ssb vulnids @manuel-sommer (#16461)
🚩 Database migration
- Add a product export API (manifest and NDJSON stream) @svader0 (#16448)
- feat(locations): attribute each location reference to the test that reported it @Maffooch (#16489)
🚀 General features and enhancements
- perf(import): resolve the import target once per request and read statistics in one query @Maffooch (#16513)
- feat(jira): unlink findings from Jira in bulk edit @paulOsinski (#16480)
- Add a product export API (manifest and NDJSON stream) @svader0 (#16448)
- perf(importers): group a whole import's findings in bulk @Maffooch (#16511)
- perf(locations): resolve tag readability per page, skip it for full-access callers @Maffooch (#16507)
- feat(locations): attribute each location reference to the test that reported it @Maffooch (#16489)
🚀 API features and enhancements
- fix(api): the message beside a 400's field map reads as sentences @blakeaowens (#16535)
- fix(reimport): describe what do_not_reactivate does, and translate its help @blakeaowens (#16522)
- perf(findings): stop the findings list from querying once per row @Maffooch (#16512)
- perf(import): resolve the import target once per request and read statistics in one query @Maffooch (#16513)
🐛 Bug Fixes
- fix(api): the message beside a 400's field map reads as sentences @blakeaowens (#16535)
- fix: cascade delete hidden reverse relations to avoid FK IntegrityError @Maffooch (#16506)
- fix(risk-acceptance): lock reinstate's members and tell JIRA after the commit @blakeaowens (#16514)
- fix(risk-acceptance): reinstating leaves out findings accepted elsewhere since the expiry @blakeaowens (#16498)
📝 Documentation updates
🖌 Updates in UI
- perf(findings): stop the findings list from querying once per row @Maffooch (#16512)
- feat(jira): unlink findings from Jira in bulk edit @paulOsinski (#16480)
- Redesign the Support page and split the sidebar into Support and Upgrade to Pro @skywalke34 (#16501)
- fix(ui): show the line breaks of data-html popovers as text @cristianchiriac (#16395)
- 🎉 add siemens ssb vulnids @manuel-sommer (#16461)
- feat(locations): attribute each location reference to the test that reported it @Maffooch (#16489)