Upgrading to DefectDojo Version 3.3.200

Feature Flags toggles reach the Classic UI and /api/v2 after a restart (DefectDojo Pro)#

Two features on the Settings > Feature Flags page, Locations and Organization / Asset Relabeling, have parts that are decided when DefectDojo starts: the Classic UI pages and labels, the /api/v2 endpoint and location routes, and the /api/v3/ API. Both carry a Restart Recommended tag for that reason.

Before this release the tag over-promised. Those start-time surfaces read the DD_V3_FEATURE_LOCATIONS and DD_ENABLE_V3_ORGANIZATION_ASSET_RELABEL deployment settings, and nothing carried the stored toggle into them, so a restart changed nothing. An operator who enabled Locations on the page and restarted still got a 404 from /api/v2/location/, and the routes were missing from the API documentation, until the environment variable was changed as well. The 3.2.200 notes told you to keep the deployment setting in sync for exactly this reason.

DefectDojo Pro now reads each of these stored toggles at start-up and applies it to the deployment setting for the life of the process. After a restart:

• With Locations on, /api/v2/location/, /api/v2/url/ and the /api/v3/ API are mounted and appear in the API documentation, /api/v2/endpoints/ is served read-compatibly from Locations, and the Classic UI shows the Locations pages.
• Organization / Asset Relabeling follows the toggle on the Classic UI pages, their URLs and generated reports, in either direction.
• The Restart Recommended tag clears, and now means what it says.

What you need to do#

• Nothing, if you already kept the environment variables in sync. The stored toggle and the setting agree, so start-up changes nothing.
• If you enabled a toggle on the page without changing your deployment: restart DefectDojo. You no longer need to set DD_V3_FEATURE_LOCATIONS or DD_ENABLE_V3_ORGANIZATION_ASSET_RELABEL; they remain only as the seed for the stored value on upgrade and as a fallback when the database cannot be reached at start-up.
• To keep a process pinned to its environment instead, set DD_FEATURE_FLAGS_BOOT_SYNC=False. This is meant for test harnesses and unusual deployments; the default is on.

Open source DefectDojo is unaffected: with the pro app absent, the deployment settings continue to govern these features exactly as before.

For more information, check the Release Notes.