3.2.0 🌈

Please consult the Upgrade notes in the documentation for specific instructions for this release, and general upgrade instructions. Below is an automatically generated list of all PRs merged since the previous release.

Changes since 3.1.0

• fix(dedupe): repair four split deduplication registrations @devGregA (#15479)
• fix(govulncheck): sort symbol/location sets so hash_code is stable @devGregA (#15483)
• docs(agents): milestone every new PR at creation, from milestones that already exist @Maffooch (#15485)
• docs(navigation): document the reorganized Pro Settings menu and the All Settings page @devGregA (#15478)
• fix(awssecurityhub): sort resource IDs so hash_code is stable @devGregA (#15481)
• docs(rules-engine): document Rules Engine 2.0 @blakeaowens (#15484)
• docs(notes): document markdown, editing and history in notes @blakeaowens (#15477)
• docs(pro): several optional features are now always on, and one is support-enabled @devGregA (#15480)
• docs(triage): document reachability scoring @devGregA (#15476)
• feat(parsers): add composer audit, pnpm audit, dotnet vulnerable packages and mix_audit parsers @devGregA (#15475)
• docs(compliance): document the CMMC partial-credit column @devGregA (#15474)
• docs(onprem): add hardware sizing guidance for self-hosted Pro @rossops (#15459)
• Harden authorization on the make-finding-a-template action @svader0 (#15463)
• Harden authorization on finding-template apply/read views @svader0 (#15471)
• Harden source-code link construction in create_bleached_link @svader0 (#15470)
• feat(parsers): add 30 command-line security tool parsers (SAST, IaC, host hardening, web/network discovery, malware) @devGregA (#15465)
• docs(onprem): publish the Helm install and upgrade guides @devGregA (#15466)
• docs(onprem): add the Docker Compose installation guide @devGregA (#15469)
• docs(onprem): document what to back up in a self-hosted deployment @devGregA (#15461)
• docs(onprem): make the self-hosting page a real landing page @devGregA (#15464)
• docs: correct the Threat Intelligence floor to describe Priority, not just the Risk band @devGregA (#15462)
• docs(onprem): add guidance for expanding upload storage on Compose @devGregA (#15458)
• docs(onprem): document the upload size limits for large scan files @devGregA (#15456)
• docs(onprem): add air-gapped install guide for self-hosted Pro @devGregA (#15455)
• docs(onprem): add OpenShift deployment guide for self-hosted Pro @devGregA (#15457)
• docs: peer review claiming, per-person assignment and the My Work queue @devGregA (#15395)
• docs(pro): FIPS 140-3 mode — enabling, verifying, and behaviour differences @devGregA (#15370)
• docs(compliance): Federal Compliance section (FedRAMP POA&M, ConMon, CMMC, control coverage) @devGregA (#15453)
• Harden user account management authorization @svader0 (#15454)
• Scope the report endpoint prefetch to the requesting user's findings @svader0 (#15435)
• feat(parsers): SPDX, CSAF 2.0 and OpenVEX interchange-format parsers @devGregA (#15414)
• docs(pro): document Diagnostics, Authorization Connectors, and menu badges @Maffooch (#15433)
• fix(generic parser): ignore non-numeric values in numeric JSON fields @Maffooch (#15442)
• Scope endpoint and host view findings to the requesting user @svader0 (#15441)
• Scope API scan configuration tool selection to authorized tool configurations @svader0 (#15445)
• fix(importers): keep the reimport target test when a report declares no tests @Maffooch (#15446)
• fix(search): render result panes, open the right tab, survive bad input @Maffooch (#15448)
• Align id-keyed questionnaire routes with engagement permissions @svader0 (#15449)
• docs: Threat Intelligence page (DefectDojo Pro) @devGregA (#15450)
• Scope the product endpoint report to the requested product @svader0 (#15451)
• docs(onprem): document migrating from open source to self-hosted Pro @devGregA (#15452)
• fix(dedupe): stable original across scan orders via content-ordered finding creation @Maffooch (#15222)
• fix(importers): skip child rows buffered for a finding deleted mid-batch @Maffooch (#15428)
• fix(finding): clear M2M through rows inside each chunk's delete transaction @Maffooch (#15434)
• fix: support new Popeye report sections format @kocaemre (#15432)
• fix: replace bare except with specific exception types @lxcxjxhx (#15430)
• 🎉 add bell security advisory @manuel-sommer (#15429)
• fix(importers): stop the write-back re-creating a deleted import target @Maffooch (#15427)
• perf(migration): drop O(n^2) inheritance query from endpoint-to-locations migration, make re-runs converge @Maffooch (#15425)
• feat(vuln-id): per-vulnerability KEV/EPSS enrichment columns on the Vulnerability entity @Maffooch (#15426)
• chore(deps): update gcr.io/cloudsql-docker/gce-proxy docker tag from 1.38.1 to v1.38.2 (helm/defectdojo/values.yaml) @renovate (#15393)
• Add pro audit logs documentation @dangoelz (#15419)
• feat(vuln-id): normalize Vulnerability_Id into a Vulnerability entity + ordered references (entity-only cutover) @Maffooch (#15331)
• chore(deps): update dependency renovatebot/renovate from 43.263.3 to v43.288.0 (.github/workflows/renovate.yaml) @renovate (#15279)
• chore(deps): update actions/setup-python action from v6.3.0 to v7 (.github/workflows/test-helm-chart.yml) @renovate (#15335)
• chore(deps): update losisin/helm-values-schema-json-action digest from v3.1.0 to v3 (.github/workflows/test-helm-chart.yml) @renovate (#15389)
• chore(deps): update dependency kubernetes from 1.34.9 to v1.34.10 (.github/workflows/k8s-tests.yml) - autoclosed @renovate (#15390)
• chore(deps): update release-drafter/release-drafter action from v7.6.0 to v7.7.0 (.github/workflows/release-drafter.yml) @renovate (#15417)
• chore(deps): update actions/stale action from v10.4.0 to v11 (.github/workflows/close-stale.yml) @renovate (#15418)
• docs: add Pro changelog entries for 3.1.301 and 3.1.302 @Maffooch (#15423)
• fix(findings): clear review state when a finding is closed or reopened @devGregA (#15394)
• add additional scanner protocols to whitelist @paulOsinski (#15416)
• chore(deps): bump python-gitlab from 8.4.0 to 8.5.0 @dependabot (#15401)
• chore(deps): update valkey docker tag from 0.24.4 to v0.24.6 (helm/defectdojo/chart.yaml) @renovate (#15396)
• update fortify parsers to parse cwe @paulOsinski (#15409)
• ci: make ruff a hard gate for the unit-tests workflow chain @Maffooch (#15410)
• fix(reimport): skip close-old candidates whose finding row was deleted mid-reimport @Maffooch (#15408)
• fix(jfrog): stable reimport identity for JFrog Xray API Summary Artifact Scan @devGregA (#15412)
• fix(jira): stop assuming push_to_jira returns a tuple @Maffooch (#15411)
• fix(api): return 409 instead of 500 on a unique-constraint violation @Maffooch (#15407)
• chore(deps): update dependency kubernetes/kubernetes from v1.35.6 to v1.35.7 (.github/workflows/k8s-tests.yml) @renovate (#15392)
• Apply login rate limiter to the API token auth endpoint @svader0 (#15415)
• chore(deps): update docker/login-action action from v4.4.0 to v4.6.0 (.github/workflows/release-x-manual-tag-as-latest.yml) @renovate (#15397)
• chore(deps): bump ruff from 0.15.22 to 0.16.0 @dependabot (#15399)
• chore(deps): bump vulners from 3.2.0 to 4.0.0 @dependabot (#15400)
• chore(deps): bump gitpython from 3.1.54 to 3.1.57 @dependabot (#15403)
• chore(deps): update mccutchen/go-httpbin docker tag from 2.24.0 to v2.25.0 (docker-compose.override.integration_tests.yml) @renovate (#15406)
• fix: add missing return after exception in GitHub issue handlers @lxcxjxhx (#15391)
• maintenance: add a branch guard for the bugfix/dev/master release lines @Maffooch (#15388)
• Seed the search language facet from the authorized queryset @svader0 (#15387)
• refactor(reimport): extract get_original_findings as an override point; guard debug renders @devGregA (#15398)
• docs(connectors): Intigriti connector reference @devGregA (#15286)
• docs(connectors): HCL AppScan connector reference @devGregA (#15312)
• docs(connectors): document the YesWeHack connector @devGregA (#15288)
• docs: Checkmarx One connector — branch handling + Track Scanned Branches @devGregA (#15358)
• docs(connectors): Harbor setup @devGregA (#15272)
• docs(connectors): MobSF connector reference @devGregA (#15330)
• docs(connectors): Lacework / FortiCNAPP connector reference @devGregA (#15339)
• docs(connectors): Socket.dev connector reference @devGregA (#15340)
• docs(connectors): Bright Security connector reference @devGregA (#15341)
• docs(connectors): Fortify connector reference @devGregA (#15329)
• docs(connectors): Escape connector reference @devGregA (#15342)
• docs(connectors): Deepfence ThreatMapper connector reference @devGregA (#15337)
• docs(integrations): Opsgenie integrator reference @devGregA (#15277)
• docs(integrations): add ServiceNow SecOps / Vulnerability Response integrator @devGregA (#15278)
• docs(connectors): Fairwinds Insights connector reference @devGregA (#15343)
• fix(dedupe): re-point chained duplicates before deleting excess ones (backport of #15364) @Maffooch (#15383)
• fix(risk_acceptance): stop the expiration job aborting on an unattached risk acceptance @Maffooch (#15376)
• fix(finding): carry locations across a finding merge @Maffooch (#15379)
• Harden metadata API object authorization @svader0 (#15380)
• docs(jira): document enabling the Jira integration in System Settings @Maffooch (#15381)
• docs(sso): document the attribute-mapping editors and OIDC group mapping @Maffooch (#15373)
• [docs] maintenance @paulOsinski (#15371)
• docs: Global Locations deduplication (Pro) + comparison with Global Component @Maffooch (#15348)
• deprecate: API-based pull parsers, Tool Type/Configuration, and dbbackup (3.2.0 → 3.5.0 EOL) @Maffooch (#15353)
• Apply the member-management check on every serializer exposing the field @svader0 (#15375)
• Harden finding and engagement UI actions to require POST @svader0 (#15372)
• docs: add Pro changelog entry for 3.1.300 @Maffooch (#15369)
• Restrict JIRA finding-mapping project field to authorized projects @svader0 (#15355)
• Docs: clarify that the Jira webhook secret authenticates incoming requests @svader0 (#15368)
• chore(deps): bump postcss from 8.5.15 to 8.5.23 in /docs @dependabot (#15352)
• chore(deps): bump gitpython from 3.1.52 to 3.1.54 @dependabot (#15351)
• Restrict bulk update target finding group to authorized groups @svader0 (#15356)
• fix(api): return a validation error instead of 500 when environment is omitted @devGregA (#15367)
• fix(jira): stop repeating a known-broken project config for every finding @devGregA (#15365)
• fix(dedupe): re-point chained duplicates before deleting excess ones @devGregA (#15364)
• docs(feature-flags): correct Organization / Asset relabeling controls @blakeaowens (#15360)
• docs: JFrog Xray connector — Artifact-Level Records mode + hierarchy behavior @devGregA (#15347)
• docs(rbac): document Custom RBAC Roles @blakeaowens (#15359)
• Extend user serializer validation to identity and permission fields @devGregA (#15191)
• docs(connectors): GitHub asset connector reference @devGregA (#15291)
• docs(connectors): NeuVector connector reference @devGregA (#15338)
• docs(sensei): document Bitbucket, Azure DevOps, and GitHub Enterprise connections @Maffooch (#15349)
• 🐛 fix kics severity mapping #15345 @manuel-sommer (#15350)
• chore(deps): bump gitpython from 3.1.51 to 3.1.54 @dependabot (#15316)
• docs(connectors): Black Duck connector reference @devGregA (#15269)
• chore(deps): update valkey/valkey docker tag from 9.1.0 to v9.1.1 (docker-compose.yml) @renovate (#15314)
• chore(deps): update actions/checkout action from v7.0.0 to v7.0.1 (.github/workflows/validate_docs_build.yml) @renovate (#15310)
• chore(deps): update valkey docker tag from 0.24.1 to v0.24.4 (helm/defectdojo/chart.yaml) @renovate (#15313)
• chore(deps): bump vulners from 3.1.11 to 3.2.0 @dependabot (#15315)
• chore(deps): bump ruff from 0.15.21 to 0.15.22 @dependabot (#15317)
• chore(deps): update mccutchen/go-httpbin docker tag from 2.23.1 to v2.24.0 (docker-compose.override.integration_tests.yml) @renovate (#15318)
• chore(deps): update openapitools/openapi-generator-cli docker tag from v7.23.0 to v7.24.0 (dockerfile.integration-tests-debian) @renovate (#15319)
• chore(deps): bump @fontsource-variable/work-sans from 5.2.8 to 5.3.0 in /components @dependabot (#15322)
• chore(deps-dev): bump @tailwindcss/cli from 4.3.2 to 4.3.3 in /components @dependabot (#15321)
• chore(deps): bump gitpython from 3.1.50 to 3.1.52 @dependabot (#15324)
• chore(deps): bump setuptools from 82.0.1 to 83.0.0 @dependabot (#15325)
• chore(deps): update release-drafter/release-drafter action from v7.5.1 to v7.6.0 (.github/workflows/release-drafter.yml) @renovate (#15326)
• chore(deps): update actions/labeler action from v6.2.0 to v7 (.github/workflows/pr-labeler.yml) @renovate (#15327)
• perf(api): eliminate notes N+1 in finding/engagement/test/risk_acceptance list endpoints @vvpoglazov (#15274)
• Add case-insensitive expression index on Vulnerability_Id.vulnerability_id @devGregA (#15218)
• perf(migration): batch endpoint tags and restore inheritance @AKSHATSPAR (#15311)
• Split CI/CD-related infrastructure into its own model @dogboat (#15002)
• add pro findings documentation @dangoelz (#15333)
• fix(api): don't scope serializer querysets by AnonymousUser during schema generation @Maffooch (#15344)
• docs(connectors): Quay (Clair) connector reference @devGregA (#15284)
• Make notes read-only on the test create serializer @svader0 (#15334)
• create fortify parser V2 - prefer true line @paulOsinski (#15228)
• fix(api): explicit scalar cwe stays primary when cwes list is also supplied @valentijnscholten (#15305)
• product type updates and tests @svader0 (#15307)
• fix(docker): install PostgreSQL 18 client so dbbackup works @valentijnscholten (#15306)
• Scope location and endpoint reference writes to authorized products @svader0 (#15300)
• fix: render report summary charts after the table-of-contents rebuild @stevewallone (#15195)
• docs(connectors): Acunetix 360 connector reference @devGregA (#15267)
• docs(connectors): Sysdig Secure connector reference @devGregA (#15271)
• docs(connectors): document Bugcrowd, ServiceNow CMDB, and Linear @Maffooch (#15336)
• fix(ui): style OS promo banner dismiss button in classic UI @Maffooch (#15332)
• docs(connectors): runZero asset connector reference @devGregA (#15287)
• docs(connectors): add Intruder connector reference @devGregA (#15285)
• docs(connectors): add Kubescape connector reference @devGregA (#15283)
• docs(connectors): Sonatype IQ setup @devGregA (#15268)
• chore(deps): update python:3.14.6-slim-trixie docker digest from 3.14.6 to 3.14.6-slim-trixie (dockerfile.integration-tests-debian) @renovate (#15309)
• Restrict configuration permission assignment to superusers in the user API @svader0 (#15296)
• docs(servicenow): refresh Pro ServiceNow Integrator guide (OAuth, close fields, push filters) @devGregA (#15298)
• docs: add Pro changelog entry for 3.1.200 @Maffooch (#15299)
• docs(sensei): Sensei documentation chapter (GitHub and GitLab) @Maffooch (#15308)
• july 17 docs maintenance @paulOsinski (#15276)
• docs(features): document Feature Flags page and correct feature enablement @blakeaowens (#15289)
• docs(connectors): Endor Labs connector reference @devGregA (#15281)
• docs(connectors): add Cobalt.io and Nuclei tool references @devGregA (#15280)
• docs(connectors): Prowler connector reference @devGregA (#15282)
• docs(connectors): OpenVAS / Greenbone connector reference @devGregA (#15273)
• docs(connectors): Edgescan setup @devGregA (#15270)
• docs(connectors): Rapid7 InsightAppSec connector reference @devGregA (#15265)
• fix(generic parser): prevent nested list when cve and vulnerability_ids are both present @narvadanami (#15212)
• feat(locations): LocationData.code factory + get_locations() hash symmetry + location docs @Maffooch (#15171)
• docs(dedup): document instance-wide mutual-candidate + config-persistence behavior @Maffooch (#15241)
• chore(deps): bump django-filter from 25.2 to 26.1 @dependabot (#15249)
• chore(ci): migrate release-drafter to when and build OAS from the release tag @Maffooch (#15264)
• chore(deps): bump ruff from 0.15.20 to 0.15.21 @dependabot (#15250)
• chore(deps): bump gitpython from 3.1.50 to 3.1.51 @dependabot (#15252)
• chore(deps): update valkey docker tag from 0.23.0 to v0.24.1 (helm/defectdojo/chart.yaml) @renovate (#15255)
• chore(deps): update lycheeverse/lychee-action digest from v2.9.0 to v2 (.github/workflows/validate_docs_build.yml) @renovate (#15243)
• chore(deps): update python:3.14.6-slim-trixie docker digest from 3.14.6 to 3.14.6-slim-trixie (dockerfile.integration-tests-debian) @renovate (#15244)
• chore(deps): update valkey/valkey:9.1.0-alpine docker digest from 9.1.0 to 9.1.0-alpine (docker-compose.yml) @renovate (#15245)
• chore(deps): update softprops/action-gh-release action from v3.0.1 to v3.0.2 (.github/workflows/release-x-manual-helm-chart.yml) - autoclosed @renovate (#15246)
• chore(deps): update actions/labeler action from v6.1.0 to v6.2.0 (.github/workflows/pr-labeler.yml) @renovate (#15247)
• chore(deps): bump django-htmx from 1.27.0 to 1.28.0 @dependabot (#15251)
• chore(deps): bump django-polymorphic from 4.11.5 to 4.11.6 @dependabot (#15253)
• chore(deps): update actions/stale action from v10.3.0 to v10.4.0 (.github/workflows/close-stale.yml) @renovate (#15254)
• chore(deps): update actions/setup-node action from v6.4.0 to v7 (.github/workflows/validate_docs_build.yml) @renovate (#15256)
• docs: document DD_EDITABLE_MITIGATED_DATA and hide ignored close-finding fields @Maffooch (#15259)
• docs: add Pro changelog entry for 3.1.101 @Maffooch (#15263)
• fix(shell): silence the shell model auto-import banner (docker + manual runs) @Maffooch (#15234)
• docs: add PagerDuty to the Pro Integrations tool reference @devGregA (#15210)
• fix(forms): avoid DB access at import time in Import/ReImport forms @Maffooch (#15233)
• docs: use "DefectDojo, Inc." consistently in company name references @devGregA (#15242)
• add OS Findings documentation @dangoelz (#15235)
• feat(finding): pluggable false-positive-history candidate filter @Maffooch (#15238)
• feat(cache): L1 singleton settings cache + Celery-scoped authorization caching @valentijnscholten (#15066)
• docs: redesign documentation site UI @devGregA (#15214)
• feat(search): add DD_WATSON_SEARCH_ENABLED toggle to gate watson indexing @blakeaowens (#15236)
• docs: add Zendesk to the Pro Integrations tool reference @devGregA (#15215)
• docs: add ServiceDesk Plus to the Pro Integrations tool reference @devGregA (#15217)
• chore(deps): update dependency renovatebot/renovate from 43.255.2 to v43.263.3 (.github/workflows/renovate.yaml) @renovate (#15224)
• chore(deps): bump django from 5.2.14 to 5.2.15 @dependabot (#15230)
• docs: add Pro changelog entry for 3.1.100 @Maffooch (#15237)
• docs: Pro set-based deduplication hash code fields for CWE/Vulnerability_Ids @valentijnscholten (#15154)
• feat(finding): multiple CWEs per finding @valentijnscholten (#15143)
• feat(finding): copy finding fix + autodetected vulnerability id type + uniqueness constraint @valentijnscholten (#15145)
• docs: Asset Connectors — concept + Azure DevOps / Bitbucket / GitLab / JSM Assets setup @devGregA (#15153)
• docs(jira): Jira integrator guide — custom fields, ticket templates, test render @Maffooch (#15226)
• docs(connectors): Microsoft Defender for Cloud connector reference @devGregA (#15197)
• docs(connectors): add GitHub Advanced Security, Qualys, Rapid7 InsightVM, Veracode references @devGregA (#15198)
• docs(connectors): Cloudflare, Contrast, GitGuardian, Google Cloud SCC, HackerOne, Shodan setup @devGregA (#15199)
• Update migration dependency for global search FTS trigram indexes @Maffooch (#15227)
• Docs: Docker Scout connector reference @devGregA (#15203)
• Group-IB ASM connector docs @Maffooch (#15208)
• docs: add Shortcut to the Pro Integrations tool reference @devGregA (#15209)
• feat(search): FTS + trigram GIN indexes for global search @blakeaowens (#15220)
• docs: add upgrade guide for DefectDojo Pro on-premise (Helm) deployments @devGregA (#15189)
• docs: add Bitbucket to the Pro Integrations pages @devGregA (#15207)
• docs: add Freshservice Pro integration reference @devGregA (#15221)
• docs: add Backstage Pro connector reference @devGregA (#15223)
• Docs: Wazuh connector reference @devGregA (#15201)
• Docs: Censys connector reference @devGregA (#15202)
• docs(connectors): add CrowdStrike Falcon connector reference @Maffooch (#15206)
• Docs: Have I Been Pwned connector reference @devGregA (#15200)
• docs: Microsoft Defender connector setup guide @devGregA (#15156)
• Jira: support fields on close/reopen transitions @devGregA (#15213)
• docs: add copy-to-clipboard to Report Builder LLM prompt and API blocks @skywalke34 (#15216)
• docs: add Similar Findings pages for Open Source and Pro @Maffooch (#15190)
• fix(notifications): deliver @mention notifications and match full usernames @blakeaowens (#15196)
• fix(auditlog): make pghistory context JSON-safe before Celery dispatch @Maffooch (#15204)
• fix(risk_acceptance): reinstate findings when expiration date updated via API @Jino-T (#15147)
• refactor(locations): consistent object lookups in endpoint views @devGregA (#15173)
• Align questionnaire relink routes with questionnaire permissions @devGregA (#15192)
• Authorize the location foreign key on location reference writes @devGregA (#15193)
• Modify CODEOWNERS for code review assignments @Maffooch (#15205)
• fix(importers): stop doubling the (scan_type) suffix in dynamic Test Type names @Maffooch (#15149)
• fix(watson): only intermediate-flush the global search context singleton @valentijnscholten (#15187)
• fix(importers): dispatch post-processing with per-finding push_to_jira @valentijnscholten (#15186)
• fix(watson): fix + batch full-text index updates on Celery worker tasks @valentijnscholten (#15172)
• perf(importers): fetch only needed columns in close_old_findings @valentijnscholten (#15185)
• chore(deps): bump drf-spectacular from 0.29.0 to 0.30.0 @dependabot (#15184)
• chore(deps): update postgres:18.4-alpine docker digest from 18.4 to 18.4-alpine (docker-compose.yml) @renovate (#15188)
• chore(deps): bump pillow from 12.2.0 to 12.3.0 @dependabot (#15183)
• chore(deps): bump drf-spectacular-sidecar from 2026.6.1 to 2026.7.1 @dependabot (#15181)
• chore(deps): bump setuptools from 82.0.1 to 83.0.0 @dependabot (#15180)
• Add report API formats @samiat4911 (#15148)
• V3/locations Endpoint object init guards @dogboat (#15142)
• Product updates and tests @dogboat (#15170)
• chore(deps): update valkey docker tag from 0.22.1 to v0.23.0 (helm/defectdojo/chart.yaml) @renovate (#15178)
• Fix reader file upload @samiat4911 (#15133)
• docs: update finding-filter screenshot with Asset Tags (AND) label and restored highlight box @stevewallone (#15141)
• fix(jira): close deleted findings @samiat4911 (#15050)
• Add Promptfoo (LLM eval & red-teaming) parser @Dashtid (#15081)
• Expose effective dedupe matching policy on the Test API (2/3) @devGregA (#15151)
• fix(checkmarx_one): handle explicit null scanner sections in filtered reports @stevewallone (#15159)
• chore(deps): update docker/setup-buildx-action action from v4.1.0 to v4.2.0 (.github/workflows/release-x-manual-tag-as-latest.yml) @renovate (#15177)
• chore(deps): update docker/login-action action from v4.2.0 to v4.4.0 (.github/workflows/release-x-manual-tag-as-latest.yml) @renovate (#15176)
• chore(deps): update dependency vcrpy from 8.2.1 to v8.3.0 (requirements-dev.txt) @renovate (#15175)
• chore(deps): update postgres:18.4-alpine docker digest from 18.4 to 18.4-alpine (docker-compose.yml) @renovate (#15174)
• docs: add Pro changelog entries for 3.1.0 @Maffooch (#15166)
• chore(deps): update dependency renovatebot/renovate from 43.248.0 to v43.255.2 (.github/workflows/renovate.yaml) @renovate (#15158)
• docs: SSO user local-login fallback for open source @Maffooch (#15167)