3.0.0 🌈

Please consult the Upgrade notes in the documentation for specific instructions for this release, and general upgrade instructions. Below is an automatically generated list of all PRs merged since the previous release.

Breaking Changes: Please consult the release notes for full details

Changes since 2.58.0

• Release: Merge release into master from: release/3.0.0 @github-actions (#15017)
• Locations updates @dogboat (#15015)
• Add release notes for upgrading to DefectDojo Version 3.0.x @Maffooch (#15010)
• test(perf) on bugfix: re-enable import performance tests with recalibrated query counts @valentijnscholten (#14968)
• test(perf) on dev: re-enable import performance tests with recalibrated query counts @valentijnscholten (#14967)
• fix(dependency_check): fold related dependency paths into description instead of emitting separate findings @valentijnscholten (#14941)
• Prevent reimport from reactivating duplicate findings as active/verified @valentijnscholten (#14935)
• Preserve verified flag when promoting duplicate to new original @valentijnscholten (#14934)
• feat: allow users to request peer review from themselves @valentijnscholten (#14946)
• Check statusCategory instead of the resolution field for Jira issue status @derda17 (#14611)
• feat(parser): set fix_available on GitHub Vulnerability parser @jsayerascb (#14943)
• Release: Merge back 2.59.0 into bugfix from: master-into-bugfix/2.59.0-2.60.0-dev @github-actions (#14939)
• Release: Merge back 2.59.0 into dev from: master-into-dev/2.59.0-2.60.0-dev @github-actions (#14938)
• Release 2.59.0: Merge Bugfix into Dev @rossops (#14936)
• Fix SARIF parser crash on empty extensions @kleomartiny (#14898)
• Rename title to 'Open-Source Permissions' @paulOsinski (#14908)
• docs: add 2.58.3 and 2.58.4 release notes to Pro changelog @Maffooch (#14926)
• Release: Merge back 2.58.4 into dev from: master-into-dev/2.58.4-2.59.0-dev @github-actions (#14914)
• Release: Merge back 2.58.4 into bugfix from: master-into-bugfix/2.58.4-2.59.0-dev @github-actions (#14915)
• Release: Merge release into master from: release/2.58.4 @github-actions (#14913)
• 🐛 fix cyclonedx missing vector field #14874 @manuel-sommer (#14884)
• [docs] Improve Snyk parser documentation with export instructions and enterprise workflow @balaakasam (#14675)
• Release: Merge back 2.58.3 into bugfix from: master-into-bugfix/2.58.3-2.59.0-dev @github-actions (#14886)
• Add docs for Products and Assets @dangoelz (#14876)
• May docs maintenance @paulOsinski (#14880)
• rename CLAUDE.md to AGENTS.md @valentijnscholten (#14873)
• Expose created/updated date filters for Risk Acceptance API (created_before/after, updated_before/after) @PDFour4 (#14786)
• Scope report views to the requesting user's authorized products @Maffooch (#14870)
• Anchor location finding reference authorization to the finding's own product @Maffooch (#14871)
• Remove gitpython @dogboat (#14808)
• Update changelog for v2.58.2 release notes @Maffooch (#14854)
• Fix URLs and expand Lychee coverage @Maffooch (#14855)
• ⚡ speed up migrate_endpoints_to_locations (~14× fewer queries) @Maffooch (#14841)
• docs: Add Components page and glossary entry @Jino-T (#14840)
• Release: Merge back 2.58.2 into bugfix from: master-into-bugfix/2.58.2-2.59.0-dev @github-actions (#14851)
• [docs] locations (pro feature), maintenance @paulOsinski (#14834)
• feat(importers): apply import-time tags per batch before post-processing, do not tag old findings @valentijnscholten (#14839)
• perf(tags): centralize tag inheritance + replace signal disconnect with batch context manager (Phase B) @valentijnscholten (#14827)
• perf(tags): bulk-propagate inherited tags + gate child post_save on create @valentijnscholten (#14812)
• Add mitigation finding filters and complete mitigation filter tests @bendnema (#14790)
• cascade delete: prepare preview_only parameter @valentijnscholten (#14810)
• test: add background param to import all unit tests command @valentijnscholten (#14805)
• perf(dupe-delete): use bulk_delete_findings + correlated subquery in async_dupe_delete @valentijnscholten (#14797)
• test: pin query-count baselines for tag inheritance hot paths @valentijnscholten (#14811)
• Update changelog for May 2026 release (v2.58.0) @Maffooch (#14807)
• Release: Merge back 2.58.1 into dev from: master-into-dev/2.58.1-2.59.0-dev @github-actions (#14830)
• Release: Merge back 2.58.1 into bugfix from: master-into-bugfix/2.58.1-2.59.0-dev @github-actions (#14829)
• Release: Merge release into master from: release/2.58.1 @github-actions (#14828)
• endpoint: optimize eq via product_id @valentijnscholten (#14806)
• Fix broken links @paulOsinski (#14802)
• Release: Merge back 2.58.0 into dev from: master-into-dev/2.58.0-2.59.0-dev @github-actions (#14803)

🚩 Changes to settings.dist.py / local_settings.py

• Release 3.0.0: Merge bugfix -> dev @Maffooch (#15014)
• Enable v3 functionality and organization/asset relabeling by default @Maffooch (#15011)
• Fix for GHSA-w2j3-x3j3-mm43 @dogboat (#14952)
• feat(parsers): add Alert Logic CSV parser @skywalke34 (#14930)
• Release: Merge release into master from: release/2.59.0 @github-actions (#14937)
• perf(watson): prefetch relations + force async indexing @valentijnscholten (#14881)
• perf(tag inheritance): batch_mode + per-batch bulk during import + reorganize @valentijnscholten (#14877)
• Dojo V3 - Tailwind UI rebuild, legacy authorization, OS surface removals @devGregA (#14865)
• Release: Merge back 2.58.2 into dev from: master-into-dev/2.58.2-2.59.0-dev @github-actions (#14852)
• Release: Merge release into master from: release/2.58.2 @github-actions (#14850)
• feat(parsers): add Xygeni JSON parser (SAST, SCA, Secrets) @lmrb-1968 (#14769)
• 🎉 add ksa security advisory @manuel-sommer (#14809)
• Release: Merge back 2.58.0 into bugfix from: master-into-bugfix/2.58.0-2.59.0-dev @github-actions (#14804)

🚩 Database migration

• Refactor removal of deprecated features while preserving database state @Maffooch (#15009)
• Release: Merge release into master from: release/2.59.0 @github-actions (#14937)
• Dojo V3 - Tailwind UI rebuild, legacy authorization, OS surface removals @devGregA (#14865)
• remove: Credential Manager (2.57 deprecation, 2.59 EOL) @Maffooch (#14836)
• remove: Stub Findings (2.57 deprecation, 2.59 EOL) @Maffooch (#14837)
• Release: Merge back 2.58.0 into bugfix from: master-into-bugfix/2.58.0-2.59.0-dev @github-actions (#14804)

🚀 API features and enhancements

• Release 3.0.0: Merge bugfix -> dev @Maffooch (#15014)
• Fix for GHSA-w2j3-x3j3-mm43 @dogboat (#14952)
• Release: Merge release into master from: release/2.59.0 @github-actions (#14937)
• refactor: rename dispatch kwarg sync= to force_sync= @valentijnscholten (#14882)
• Release: Merge back 2.58.3 into dev from: master-into-dev/2.58.3-2.59.0-dev @github-actions (#14887)
• Release: Merge release into master from: release/2.58.3 @github-actions (#14885)
• Apply object-level permission check to finding duplicate API actions @Maffooch (#14866)
• Dojo V3 - Tailwind UI rebuild, legacy authorization, OS surface removals @devGregA (#14865)
• Release: Merge back 2.58.2 into dev from: master-into-dev/2.58.2-2.59.0-dev @github-actions (#14852)
• Release: Merge release into master from: release/2.58.2 @github-actions (#14850)
• remove: Credential Manager (2.57 deprecation, 2.59 EOL) @Maffooch (#14836)
• Use a dedicated permission class for BurpRawRequestResponseViewSet @Maffooch (#14838)
• remove: Stub Findings (2.57 deprecation, 2.59 EOL) @Maffooch (#14837)
• remove: questionnaire API endpoints (2.56 deprecation, 2.59 EOL) @Maffooch (#14835)
• Release: Merge back 2.58.0 into bugfix from: master-into-bugfix/2.58.0-2.59.0-dev @github-actions (#14804)

🖌 Updates in UI

• Release 3.0.0: Merge bugfix -> dev @Maffooch (#15014)
• fix 500 error on critical product metrics page @valentijnscholten (#14945)
• Release: Merge release into master from: release/2.59.0 @github-actions (#14937)
• Dojo V3 - Tailwind UI rebuild, legacy authorization, OS surface removals @devGregA (#14865)
• remove: Credential Manager (2.57 deprecation, 2.59 EOL) @Maffooch (#14836)
• remove: Stub Findings (2.57 deprecation, 2.59 EOL) @Maffooch (#14837)
• Release: Merge back 2.58.0 into bugfix from: master-into-bugfix/2.58.0-2.59.0-dev @github-actions (#14804)

🗣 Updates in localization

• Add pt-BR locale translation @GraoMelo (#14909)
• add russian locale @polishchukd (#14799)

🔧 Improved code quality with linters

• chore(deps): bump ruff from 0.15.13 to 0.15.14 @manuel-sommer (#14929)

🧰 Maintenance

• chore(deps): update gcr.io/cloudsql-docker/gce-proxy docker tag from 1.37.12 to v1.38.0 (helm/defectdojo/values.yaml) @renovate (#14993)
• chore(deps): bump sqlalchemy from 2.0.49 to 2.0.50 @dependabot (#14918)
• chore(deps): update actions/stale action from v10.2.0 to v10.3.0 (.github/workflows/close-stale.yml) @renovate (#14949)
• chore(deps): bump redis from 7.4.0 to 8.0.0 @dependabot (#14958)
• chore(deps): update dependency node from 24.15.0 to v24.16.0 (.github/workflows/validate_docs_build.yml) @renovate (#14950)
• chore(deps): update docker/build-push-action action from v7.1.0 to v7.2.0 (.github/workflows/release-x-manual-docker-containers.yml) @renovate (#14951)
• chore(deps): bump drf-spectacular-sidecar from 2026.5.1 to 2026.6.1 @dependabot (#14955)
• chore(deps): bump ruff from 0.15.14 to 0.15.15 @dependabot (#14959)
• chore(deps): update actions/checkout action from v6.0.2 to v6.0.3 (.github/workflows/validate_docs_build.yml) @renovate (#14947)
• chore(deps): update release-drafter/release-drafter action from v7.3.0 to v7.3.1 (.github/workflows/release-drafter.yml) @renovate (#14948)
• chore(deps): bump django-polymorphic from 4.11.3 to 4.11.5 @dependabot (#14957)
• Update dependency kubernetes from 1.33.11 to v1.33.12 (.github/workflows/k8s-tests.yml) @renovate (#14891)
• Update manusa/actions-setup-minikube action from v2.16.1 to v2.18.0 (.github/workflows/k8s-tests.yml) @renovate (#14893)
• Update postgres Docker tag from 18.3 to v18.4 (docker-compose.yml) @renovate (#14894)
• Update python:3.14.5-slim-trixie Docker digest from 3.14.5 to 3.14.5-slim-trixie (Dockerfile.integration-tests-debian) @renovate (#14895)
• chore(deps): bump pyjwt from 2.12.1 to 2.13.0 @dependabot (#14919)
• chore(deps): bump django-prometheus from 2.4.1 to 2.5.0 @dependabot (#14921)
• chore(deps): bump django-permissions-policy from 4.29.0 to 4.30.0 @dependabot (#14905)
• chore(deps): bump django-htmx from 1.21.0 to 1.27.0 @dependabot (#14907)
• chore(deps-dev): bump @tailwindcss/cli from 4.2.4 to 4.3.0 in /components @dependabot (#14904)
• chore(deps): bump lxml from 6.1.0 to 6.1.1 @dependabot (#14903)
• chore(deps): bump vulners from 3.1.9 to 3.1.10 @dependabot (#14901)
• chore(deps): bump alpinejs from 3.15.11 to 3.15.12 in /components @dependabot (#14902)
• chore(deps): bump requests from 2.34.0 to 2.34.2 @dependabot (#14900)
• chore(deps): bump ruff from 0.15.12 to 0.15.13 @dependabot (#14899)
• Update python Docker tag from 3.13.13 to v3.14.5 (Dockerfile.nginx-alpine) @renovate (#14863)
• Update valkey Docker tag from 0.20.1 to v0.20.2 (helm/defectdojo/Chart.yaml) @renovate (#14857)
• chore(deps): update peaceiris/actions-hugo action from v3.0.0 to v3.2.1 (.github/workflows/validate_docs_build.yml) @renovate (#14859)
• chore(deps): update python:3.13.13-slim-trixie docker digest from 3.13.13 to v (dockerfile.integration-tests-debian) @renovate (#14856)
• chore(deps): update release-drafter/release-drafter action from v7.2.1 to v7.3.0 (.github/workflows/release-drafter.yml) @renovate (#14864)
• chore(deps): bump requests from 2.33.1 to 2.34.0 @dependabot (#14861)
• chore(deps): bump pdfmake from 0.3.7 to 0.3.8 in /components @dependabot (#14862)
• Update peaceiris/actions-gh-pages action from v4.0.0 to v4.1.0 (.github/workflows/gh-pages.yml) @renovate (#14858)
• chore(deps): bump urllib3 from 2.6.3 to 2.7.0 @dependabot (#14853)
• chore(deps): bump gitpython from 3.1.49 to 3.1.50 @dependabot (#14845)
• chore(deps): bump django from 5.2.13 to 5.2.14 @dependabot (#14846)
• chore(deps): bump @babel/plugin-transform-modules-systemjs from 7.29.0 to 7.29.4 in /docs @dependabot (#14844)
• chore(deps): bump django from 5.2.13 to 5.2.14 @dependabot (#14843)
• Update valkey/valkey Docker tag from 9.0.3 to v9.0.4 (docker-compose.yml) @renovate (#14831)
• chore(deps): bump social-auth-app-django from 5.8.0 to 5.9.0 @dependabot (#14826)
• chore(deps): bump drf-spectacular-sidecar from 2026.4.14 to 2026.5.1 @dependabot (#14825)
• chore(deps): bump gitpython from 3.1.49 to 3.1.50 @dependabot (#14823)
• chore(deps): bump psycopg from 3.3.3 to 3.3.4 @dependabot (#14822)
• chore(deps): bump django-polymorphic from 4.11.2 to 4.11.3 @dependabot (#14821)
• chore(deps): bump pyopenssl from 26.1.0 to 26.2.0 @dependabot (#14818)
• chore(deps): bump easymde from 2.20.0 to 2.21.0 in /components @dependabot (#14817)
• Update losisin/helm-values-schema-json-action action from v2.5.0 to v3 (.github/workflows/test-helm-chart.yml) @renovate (#14816)
• Update actions/labeler action from v6.0.1 to v6.1.0 (.github/workflows/pr-labeler.yml) @renovate (#14815)
• Update losisin/helm-docs-github-action action from v1.8.0 to v2 (.github/workflows/test-helm-chart.yml) @renovate (#14814)
• Update valkey Docker tag from 0.20.0 to v0.20.1 (helm/defectdojo/Chart.yaml) @renovate (#14813)