Merge pull request #15293 from DefectDojo/master-into-dev/3.1.200-3.2.0-dev

Release: Merge back 3.1.200 into dev from: master-into-dev/3.1.200-3.2.0-dev

Author: Maffooch

.github/release-drafter.yml

@@ -6,50 +6,65 @@ branches:
 
 categories:
   - title: '💣 Breaking changes'
-    labels:
-      - 'Breaking Changes'
+    when:
+      labels:
+        - 'Breaking Changes'
   - title: '🚩 Changes to `settings.dist.py` / `local_settings.py`'
-    labels:
-      - 'settings_changes'
+    when:
+      labels:
+        - 'settings_changes'
   - title: '🚩 Database migration'
-    labels:
-      - 'New Migration'
+    when:
+      labels:
+        - 'New Migration'
   - title: '🚩 Requires hash code recomputation'
-    labels:
-      - 'hashcode-update-needed'
+    when:
+      labels:
+        - 'hashcode-update-needed'
   - title: '🚩 Security'
-    labels:
-      - 'security'
+    when:
+      labels:
+        - 'security'
   - title: '🚀 New importers'
-    labels:
-      - 'Import Scans'
+    when:
+      labels:
+        - 'Import Scans'
   - title: '🚀 General features and enhancements'
-    labels:
-      - 'feature'
-      - 'enhancement'
-      - 'performance'
+    when:
+      labels:
+        - 'feature'
+        - 'enhancement'
+        - 'performance'
   - title: '🚀 API features and enhancements'
-    label: 'apiv2'
+    when:
+      label: 'apiv2'
   - title: '🐛 Bug Fixes'
-    labels:
-      - 'fix'
-      - 'bugfix'
-      - 'bug'
+    when:
+      labels:
+        - 'fix'
+        - 'bugfix'
+        - 'bug'
   - title: 📝 Documentation updates
-    label: 'documentation'
+    when:
+      label: 'documentation'
   - title: '🖌 Updates in UI'
-    label: 'ui'
+    when:
+      label: 'ui'
   - title: '🗣 Updates in localization'
-    label: 'localization'
+    when:
+      label: 'localization'
   - title: '🔧 Improved code quality with linters'
-    label: 'lint'
+    when:
+      label: 'lint'
   - title: '⚙️ Improvemets of GitHub Actions'
-    label: 'gha'
+    when:
+      label: 'gha'
   - title: '🧰 Maintenance'
     collapse-after: 3
-    labels:
-      - 'dependencies'
-      - 'maintenance'
+    when:
+      labels:
+        - 'dependencies'
+        - 'maintenance'
 exclude-labels:
   - 'skip-changelog'
 

.github/workflows/fetch-oas.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          ref: release/${{ env.release_version }}
+          ref: ${{ env.release_version }}
 
       - name: Load docker images
         run: |-

docs/content/admin/feature_flags/PRO__feature_flags.md

@@ -0,0 +1,97 @@
+---
+title: "Feature Flags"
+description: "Turn optional DefectDojo Pro features on and off from the DefectDojo UI"
+weight: 1
+audience: pro
+---
+
+Feature Flags let you turn optional DefectDojo Pro capabilities on and off for your own instance — features that previously could only be enabled by contacting DefectDojo Support can now be self-served from the UI.
+
+The Feature Flags page is visible to **superusers** only. Other users, including Global Owners, do not see it.
+
+## Opening the Feature Flags page
+
+Go to **Settings > Feature Flags** in the left sidebar.
+
+The page lists every optional feature with:
+
+* **Name** — the feature, with a **BETA** tag when it is still in beta
+* **Description** — what the feature does
+* **Documentation link** — where documentation exists for that feature
+* **Toggle** — whether the feature is currently on
+
+Use the search box to filter the list by feature name or description.
+
+## Turning a feature on or off
+
+1. Find the feature in the list.
+2. Click its toggle.
+3. The change takes effect immediately. You do not need to restart anything, and other users pick the change up on their next page load.
+
+Some features show a confirmation dialog before the change is applied. This happens when enabling a feature that carries a warning (for example one that requires a restart or may affect existing data), or one that cannot be turned back off.
+
+Turning a feature off is normally just the reverse of turning it on. The exceptions are called out in the next section.
+
+## When a toggle is locked
+
+A feature you cannot change is shown with a lock badge explaining why:
+
+| Badge | What it means | What to do |
+| --- | --- | --- |
+| **Managed by DefectDojo** | DefectDojo has set this feature centrally for your instance. Your setting cannot override it. | Contact [DefectDojo Support](mailto:support@defectdojo.com) if you need it changed. |
+| **Unavailable on This Deployment** | The feature is not offered on your installation type. See [Feature availability](#feature-availability) below. | Nothing. The feature is not applicable to your instance. |
+| **Cannot Be Disabled** | The feature is already on and is one way. There is no mechanism to reverse it. | Nothing. This is expected. |
+| **Managed by deployment** | The feature is controlled by your deployment configuration rather than by this page. | See [DefectDojo Pro (On-Premise)](#defectdojo-pro-on-premise) below. |
+
+## DefectDojo Pro (Cloud)
+
+On [DefectDojo Pro (Cloud)](/get_started/pro/cloud/), **Settings > Feature Flags** is the only place you need. Toggle a feature on and it is live.
+
+Two things are handled by DefectDojo rather than by you:
+
+* **Managed by DefectDojo** — the feature is pinned centrally. Contact [DefectDojo Support](mailto:support@defectdojo.com) to have it changed.
+* **Managed by deployment** — the feature is part of how your instance is provisioned. Contact Support for these as well, since Cloud instances do not expose deployment configuration to customers.
+
+Cloud instances also have access to features that are not offered on-premise. See [Feature availability](#feature-availability).
+
+## DefectDojo Pro (On-Premise)
+
+On [DefectDojo Pro (On-Premise)](/get_started/pro/onprem/), most features work exactly as they do on Cloud: open **Settings > Feature Flags** and toggle them.
+
+A small number of features are read from your deployment configuration instead — they change how the application starts, so they cannot be flipped at runtime. These appear on the page as read-only, labeled **Managed by deployment**, and name the environment variable that controls them, for example `DD_ENABLE_V3_ORGANIZATION_ASSET_RELABEL`.
+
+Because these features require a restart, and some of them cannot be reversed once enabled, check the feature's own documentation before changing one. Several are best enabled with help from [DefectDojo Support](mailto:support@defectdojo.com).
+
+To change one of those features:
+
+1. Set the environment variable on your DefectDojo deployment. The page tells you which variable to set.
+2. Restart DefectDojo so the new value is read at startup.
+3. Reload the Feature Flags page to confirm the new state.
+
+Because these values are read at startup, changing them in the UI is not possible, and toggling them in your environment without a restart has no effect.
+
+Features that are offered only on Cloud appear as **Unavailable on This Deployment** on an on-premise instance. This is expected and is not a licensing problem.
+
+## Feature availability
+
+Most features are available on both installation types. The exceptions are:
+
+| Feature | Availability | How it is controlled |
+| --- | --- | --- |
+| Downstream Connections | [DefectDojo Pro (Cloud)](/get_started/pro/cloud/) only | Feature Flags page. Shown as **Unavailable on This Deployment** on-premise, which does not run the required infrastructure. See [Pro Integrations](/issue_tracking/pro_integration/integrations/). |
+| Request a New Connector | [DefectDojo Pro (Cloud)](/get_started/pro/cloud/) only | Feature Flags page. Shown as **Unavailable on This Deployment** on-premise. |
+| Locations | Both | Deployment configuration. Locations is in Beta and cannot be turned back off once enabled, so contact [DefectDojo Support](mailto:support@defectdojo.com) to have it enabled. See [Locations Overview](/asset_modelling/locations/pro__locations_overview/). |
+| Organization / Asset Relabeling | Both | Deployment configuration: `DD_ENABLE_V3_ORGANIZATION_ASSET_RELABEL`. |
+
+Every other optional feature is toggled directly on the Feature Flags page on both Cloud and On-Premise instances.
+
+## Frequently asked questions
+
+**A feature I want is not in the list.**
+The list shows optional features only. Capabilities that are always on do not appear. If you expected a feature that is missing, confirm your license includes it, then contact [DefectDojo Support](mailto:support@defectdojo.com).
+
+**I turned a feature on but I do not see it.**
+Reload the page — menu entries and routes are evaluated when the page loads, so a newly enabled feature appears on the next load rather than instantly in the current view.
+
+**Will upgrading change my settings?**
+No. Upgrading preserves the features you have turned on and the ones you have turned off.

docs/content/admin/feature_flags/_index.md

@@ -0,0 +1,22 @@
+---
+title: "Feature Flags"
+description: "Turn optional DefectDojo Pro features on and off for your instance"
+summary: ""
+date: 2026-07-20T00:00:00+00:00
+lastmod: 2026-07-20T00:00:00+00:00
+draft: false
+weight: 4
+chapter: true
+seo:
+  title: "" # custom title (optional)
+  description: "" # custom description (recommended)
+  canonical: "" # custom canonical URL (optional)
+  robots: "" # custom robot tags (optional)
+exclude_search: true
+---
+
+Many DefectDojo Pro capabilities ship behind a feature flag so that you can adopt them when you are ready rather than on the release that introduces them.
+
+Feature Flags are a DefectDojo Pro feature. Open-source DefectDojo does not have a feature flag surface.
+
+* [Feature Flags](./pro__feature_flags/) — view every optional feature, turn features on and off, and understand why a feature might be unavailable on your instance.

docs/content/asset_modelling/PRO_hierarchy/assets_organizations.md

@@ -14,18 +14,24 @@ Currently, this feature is in Beta.
 
 Hierarchy features ship with new versions of DefectDojo Pro by default, but existing customers who wish to migrate these features can do so using the following methods
 
-### Cloud Customers
+The two pieces are enabled separately, and by different means.
 
-The hierarchy feature and label changes must be enabled by DefectDojo Support. Email [support@defectdojo.com](mailto:support@defectdojo.com) with your instance URL and request:
+### Asset Hierarchy
 
-1. **Asset Hierarchy** — enables parent/child relationships between Assets. Once enabled, the hierarchy can be viewed and managed from the **Product** tab in the navigation.
-2. **Label Changes** (optional) — renames "Product Type" to "Organization" and "Product" to "Asset" throughout the UI. This is a separate step from enabling the hierarchy and can be requested at the same time or later.
+**Asset Hierarchy** enables parent/child relationships between Assets. Once enabled, the hierarchy can be viewed and managed from the **Product** tab in the navigation.
 
-Note that label changes are cosmetic only: API endpoints and field names remain unchanged, so existing automation will continue to work.
+A superuser can turn it on from **Settings > Feature Flags**, on both Cloud and On-Premise instances. See [Feature Flags](/admin/feature_flags/pro__feature_flags/).
+
+### Label Changes (optional)
+
+**Label Changes** renames "Product Type" to "Organization" and "Product" to "Asset" throughout the UI. This is a separate step from enabling the hierarchy and can be done at the same time or later.
 
-### On-Premise Customers
+Label changes are read from your deployment configuration when DefectDojo starts, so they are not toggled from the Feature Flags page:
 
- Contact Support for guidance on enabling these features via your instance configuration.
+* **[DefectDojo Pro (Cloud)](/get_started/pro/cloud/)** — email [support@defectdojo.com](mailto:support@defectdojo.com) with your instance URL.
+* **[DefectDojo Pro (On-Premise)](/get_started/pro/onprem/)** — set `DD_ENABLE_V3_ORGANIZATION_ASSET_RELABEL` and restart DefectDojo. Contact Support if you would like guidance before making the change.
+
+Note that label changes are cosmetic only: API endpoints and field names remain unchanged, so existing automation will continue to work.
 
 ## Significant Changes
 

docs/content/automation/rules_engine/about.md

@@ -12,6 +12,10 @@ DefectDojo's Rules Engine allows you to build custom workflows and bulk actions
 
 Rules Engine can only be accessed through the [Pro UI](/get_started/about/ui_pro_vs_os/).
 
+## Enabling Rules Engine
+
+Rules Engine is in Beta and is off by default. A superuser can turn it on from **Settings > Feature Flags**, on both Cloud and On-Premise instances. See [Feature Flags](/admin/feature_flags/pro__feature_flags/).
+
 Currently, Rules can only be created for Findings, however more object types will be supported in the future.
 
 Rules can be triggered manually from the **All Rules** page, or scheduled to run automatically on a recurring schedule.  When a rule is triggered, it will be applied to all existing Findings that match the filter conditions set.

docs/content/automation/rules_engine/scheduling.md

@@ -8,6 +8,8 @@ audience: pro
 
 Rules can be scheduled to run automatically rather than triggered manually each time.  A scheduled rule will execute against all Findings that match its filter conditions at the configured time.
 
+Scheduling is off by default. A superuser can turn on the **Scheduling Service** from **Settings > Feature Flags**, on both Cloud and On-Premise instances (see [Feature Flags](/admin/feature_flags/pro__feature_flags/)); the **Schedule Rule** option appears once it is enabled.
+
 The user setting up the schedule must have the **Change Scheduling Service Schedule** configuration permission.
 
 ## Schedule Types

docs/content/get_started/pro/pro_features.md

@@ -104,6 +104,12 @@ See our [Universal Parser Guide](/import_data/pro/specialized_import/universal_p
 
 ![image](images/universal_parser_3.png)
 
+## Managing optional features
+
+Many of the capabilities above are optional and ship behind a feature flag, so you can adopt them when you are ready. A superuser can turn most of them on and off directly from **Settings > Feature Flags**, without contacting support.
+
+See the [Feature Flags](/admin/feature_flags/pro__feature_flags/) guide for how to enable a feature, and for why a feature might be locked or unavailable on your installation type.
+
 ## Support
 
 DefectDojo Pro subscriptions include world-class support for both on-premise and Cloud installations.  Our team is available to help your organization implement and maximize your use of DefectDojo Pro.  Your subscription includes: