|
2 | 2 | title: 'Upgrading to DefectDojo Version 3.1.x' |
3 | 3 | toc_hide: true |
4 | 4 | weight: -20260615 |
5 | | -description: New optional setting DD_OS_MESSAGE_ENABLED to control the open-source promo banner. |
| 5 | +description: New optional setting DD_OS_MESSAGE_ENABLED to control the open-source promo banner, and a new deduplication execution mode for import/reimport. |
6 | 6 | --- |
7 | 7 | There are no breaking changes when upgrading to 3.1.x. Check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/3.1.0) for the contents of the release. |
8 | 8 |
|
9 | 9 | ### New setting: `DD_OS_MESSAGE_ENABLED` |
10 | 10 |
|
11 | 11 | This release adds the `DD_OS_MESSAGE_ENABLED` setting (default `True`), which controls the open-source promotional ("Upgrade to Pro") banner. The default preserves the existing behavior. Set `DD_OS_MESSAGE_ENABLED=False` to hide the banner; when disabled, DefectDojo skips the outbound request that fetches the message. |
| 12 | + |
| 13 | +## Deduplication execution mode for import/reimport |
| 14 | + |
| 15 | +This release adds a new `deduplication_execution_mode` setting that controls how |
| 16 | +import/reimport deduplication post-processing is dispatched and whether the API |
| 17 | +response waits for it. It can be set per user (profile) and overridden per request |
| 18 | +on the import and reimport endpoints. |
| 19 | + |
| 20 | +Modes: |
| 21 | + |
| 22 | +- `async` (default): deduplication and the rest of post-processing are dispatched |
| 23 | + to the background and the response returns immediately. This is the historical |
| 24 | + behavior; nothing changes for existing users. |
| 25 | +- `async_wait`: post-processing is still dispatched to the background, but the |
| 26 | + request waits for deduplication to finish before responding. As a result the |
| 27 | + `scan_added` notification and the statistics in the import/reimport response |
| 28 | + reflect the deduplicated state (findings that turned out to be duplicates are |
| 29 | + no longer counted/listed as new). JIRA push, product grading and other |
| 30 | + non-deduplication tasks remain asynchronous and are not awaited. |
| 31 | +- `sync`: import deduplication runs inline in the web request. |
| 32 | + |
| 33 | +The wait in `async_wait` is bounded by the new `DD_DEDUPLICATION_ASYNC_WAIT_TIMEOUT` |
| 34 | +environment variable (default `60` seconds). If no worker picks up the work within |
| 35 | +the timeout, the request responds anyway (degrading to the `async` outcome) rather |
| 36 | +than hanging. |
| 37 | + |
| 38 | +The import/reimport response now also includes a `deduplication_complete` boolean |
| 39 | +indicating whether deduplication had finished by the time the response was produced. |
| 40 | + |
| 41 | +### Relationship to `block_execution` |
| 42 | + |
| 43 | +The existing `block_execution` profile flag is unchanged. It remains the global |
| 44 | +switch that forces **all** of a user's asynchronous tasks (notifications, JIRA |
| 45 | +push, product grading, deduplication, ...) to run in the foreground. |
| 46 | +`deduplication_execution_mode` is independent and narrower — it only affects |
| 47 | +import/reimport deduplication post-processing. A user who has `block_execution` |
| 48 | +enabled continues to get fully synchronous imports; the upgrade migration seeds |
| 49 | +their `deduplication_execution_mode` to `sync` so behavior is unchanged. |
| 50 | + |
| 51 | +No action is required to upgrade. |
0 commit comments