Existing Invicti Scan findings are not closed in DefectDojo 3.3.0 after reimport

[Kasyap7]

Hi Team,

After an upgrade from DefectDojo 2.58.0 to 3.3.0, existing Invicti Scan findings that are absent from the new report stay open. Reimport still closes findings for Anchore Grype detailed and Xeol Parser. On 2.58.0, those Invicti findings were closed.

Environment

• DefectDojo: 2.58.0 upgraded to 3.3.0, version by version, following the OS upgrade notes
• Deployment: Docker Compose
• Database: PostgreSQL
• Scan type: Invicti Scan (Netsparker JSON vulnerabilities list)
• Import method: POST /api/v2/reimport-scan/
• DD_V3_FEATURE_LOCATIONS: enabled (3.x default)
• Already ran: python manage.py migrate_endpoints_to_locations

Question
What change between DefectDojo 2.58.0 and 3.3.0, other than migrate_endpoints_to_locations, affects closing of Netsparker/Invicti findings that are absent from the next report, and what follow-up does that change require?

[valentijnscholten]

Do you have sample file to reproduce this with? Can you reproduce it on the demo instance?