Update on DefectDojo 3.0 progress and changes

[mtesauro]

Background:

Please see the previous Github discussion here.

Update Details:

Beyond just keeping DefectDojo updated, merging PRs and the normal day to day on this project, we've been experimenting with various ways to achieve the DefectDojo v3 goals. The results of our experimentation so far follow:

We've started doing some large PRs to update and modernize some of the older parts of DefectDojo (see #8728 & #8929 for examples).

Things we learned is from the above^ is:

• We've got several more large PRs like those in our future
• Several previous attempts became very difficult to merge due to upstream changes
• While we announced the feature freeze, we've let more PRs through then we probably should have (because we love community contributions and just can't help ourselves).

What we're doing to make this better:

• We're adding a Github Action that will fail any PR that touches parts of the code base that are actively being refactored. This is really just more strict enforcement of the feature freeze mentioned in the original discussion.
  • We'll be adjusting the list of files on a rolling basis so the files/paths today (2023-11-10) won't be forever.
  • These aren't a definitive "No" to PRs that have red tests for this new check - we're doing this to send a signal to contributors who may not have followed the v3 discussions that they may be breaking the 'feature freeze'.
  • We're trying our 2nd tool to do this. This is a new experiment and there's likely to be some sharp edges that we've not found yet. Thanks for your patience as we sort things out.
  • We're currently using Dryrun Security to flag 'protected' files/paths
• We are doing the ground work to get DefectDojo from Django 4.1 to 4.2
• We're moving to class-based views (a more modern Django-ism)
• We're deprecating asciidoc report output - it's a very old, rarely used feature. There’s likely other things that will be deprecated during the modernization / cleanup.
• As previously announced we are deprecating the DefectDojo API OpenAPI v2 docs since the OpenAPI v3 docs provide the same information in a more modern format. This will happen in the Jan 2024 release (2.30.0).

Like we said before, we love contributions so these are still greatly appreciated:

• New or updated parsers
• Bug / Security Fixes
• Adding or improving unit tests

Thanks for all your patience as we head towards 3.0 and for all the community’s work at making DefectDojo the awesome thing it is today!

-- Matt Tesauro

[schdief]

@mtesauro the last update on this was in November, could you give the community feedback on the current state and plans, is it reasonable to believe it will be released this year?

[cris-renee]

I just want to say THANK YOU for all the work you all put into this. I know I appreciate it enormously. It is hard to find (free as I can't afford to pay for anything extra right now) well documented instructions for all software and projects withing a program. I believe these are the best I have came across yet. I am fairly new to security, graduate summer 2025 and I need all the practice I can get. Once again THANK YOU & HAPPY HOLIDAYS : )

[mtesauro]

@mtesauro Hi, do you have any updates? As I am currently trying to make a case for using this in my company, I would really like to show them whats possible with the new UI :)

You can see all my updates since this one at https://github.com/DefectDojo/django-DefectDojo/discussions?discussions_q=is%3Aopen+author%3Amtesauro

[mtesauro]

I just want to say THANK YOU for all the work you all put into this. I know I appreciate it enormously. It is hard to find (free as I can't afford to pay for anything extra right now) well documented instructions for all software and projects withing a program. I believe these are the best I have came across yet. I am fairly new to security, graduate summer 2025 and I need all the practice I can get. Once again THANK YOU & HAPPY HOLIDAYS : )

@cris-renee Super glad you've found DefectDojo useful. When we release this as an open source so many years ago, we wanted to make sure that lack of a budget didn't prevent people from being able to do security work. Thanks for the early holiday 🎁 !

[ThommyH]

do you have any news? :)

[valentijnscholten]

Please expect an update later this Q4.