[Maffooch]

Adds the DefectDojo Pro 3.5.103 release notes to the Pro changelog.

New features: computed custom fields with formulas (also on the Triage Engine's Set a Custom Field node), a Merge Findings node for the Triage Engine, Group ownership for webhook receivers, notification webhooks, Downstream Connectors, ticket templates, dashboards, page layouts and table views, plus a Group API token. Also Stop Sync and health alerts for connector syncs, and per-Asset notifications from the Asset's gear menu.

Enhancements: a Work Item Type on Azure DevOps mappings, connector saves that cancel only the edited connector's runs, an SLA Status filter, a threat intelligence page for each vulnerability ID, Insights filters by Test Type and category, a warning before a session expires, whole-scope standing risk acceptances, three more AI Guardrails agents, redesigned Engagement, Test, Finding, Organization and dashboard widgets, grouped field pickers, new /api/v2/ routes for Downstream Connector configuration, and faster imports, exports, search and audit history.

Bug fixes: imports into one Test run one at a time; SBOM components are recorded through Import Scan; the import preview counts match the import; plus fixes in the Triage Engine, Risk Acceptances (with two upgrade-time data repairs), Findings filters, Locations, Dedupe Pools, Jira, Compliance, notifications, tables and the UI.

Security fixes: scan imports check permissions on the target they import into, the calendar pages are hardened, and the Go services pick up the latest Go security fixes.

Upgrade notes: the two import serialization environment variables, the connectors pod under Istio STRICT mTLS, and an opt-in import pool readiness probe in Helm.

Each bullet links to its docs page under docs/content where one exists. Every link was checked against the files and headings on dev.

Left out on purpose

• Dependency, Go toolchain and base image bumps, except one Hardening line for the Go security release
• CI, test, e2e and coverage changes
• Refactors, lint and style cleanups
• Go migration and Go parity work
• Docs-only PRs (used for the links instead)
• Release plumbing, developer tooling and internal data cleanups with no visible effect

Moved: nothing.

🤖 Generated with Claude Code