v3 Beta UI - interactive controls located in panel/section headers are unresponsive

[ChrisAAAllard]

Bug description

In the new v3 UI beta (enabled via "Use new UI (beta)" in the user profile), the interactive controls located in panel/section headers are unresponsive. Clicking them produces no result no dropdown opens, no filter panel appears, and collapsible sections do not toggle. Affected controls include the filter button, the export/download dropdown, the "Column visibility" dropdown, and the section collapse/expand carets. This was observed on a Test view (across the Import History, Groups, and Findings panels) and on the All Findings page.

Steps to reproduce
Steps to reproduce the behavior:

• Go to your User Profile and enable the Use new UI (beta) option, then Submit.
• Navigate to a Test view (e.g. Engagements -> an engagement -> a test) or to Findings -> All Findings.
• In any section header, click the filter button, the export/download dropdown, the Column visibility dropdown, or a section collapse/expand caret.
  See error: nothing happens - the control does not respond. (Open DevTools and enable Disable cache, then reload - the same controls now work with the exception of the column selector.)

Expected behavior
Clicking a section-header control should perform its action: filter buttons should open the filter panel, the export/download and Column visibility buttons should open their dropdowns, and collapse carets should expand/collapse the section - without needing to disable the browser cache.
Deployment method (select with an X)

• [X ] Docker Compose
• Kubernetes
• GoDojo

Environment information
Operating System: Ubuntu 24.04
Docker Compose
DefectDojo version: 2.59.0

Browsers tested (issue reproduces in all):
Brave 1.90.128 (Official Build) (64-bit), Chromium 148.0.7778.217 — with Shields on and off
Latest Firefox
Also reproduces in incognito / private windows

Screenshots
Screen recording and a screenshot of the All Findings page are attached. The screenshot shows the filter panel working with the DevTools Network tab open and Disable cache checked.

Additional context (optional)
I was using dark reader in the screenshot however I did test with it disabled and no change.

[ChrisAAAllard]

similar deal but with these buttons at the top issue with the "engagements" interactions seems to resolve when disabling cache

[ChrisAAAllard]

on another note I ran a trivy scan against your public GitHub for defectdojo and there are some findings that came up. Im no developer so maybe these are on a practical level not an attack surface but I can share if you like privately. Though I am sure you guys can just as easily find it if you run it against it as well. I didn't do anything special just a 'repo' scan.

[mtesauro]

Repo scan's can be problematic as we don't ship a bunch of the repo in our containers like unit tests. Also, lots of scanners find things in the sample files we uses for testing that appear like issues but actually false positives since they aren't part of the actual application.

If there's issues you think are worth reporting, see https://github.com/DefectDojo/django-DefectDojo/blob/master/readme-docs/SECURITY.md

[ChrisAAAllard]

Within the findings groups when I go to merge findings the select all button does not correctly update the count for findings selected and I need to uncheck and recheck at least two from the list to get the popup to not occur. After which it does successfully merge all bulk selected findings. This behavior appears consistent across all sections of the UI where a merge is possible

[valentijnscholten]

I am not able to reproduce any of the reported UI v3 beta findings in Chrome on Windows 11. I also don't see any video.

[ChrisAAAllard]

There was an error uploading the video to the ticket however within the community slack when I originally reached out there was a video attached which should still be there.

As for reproducing I not only observed this on the ubuntu 24.04.04 EC2 instance I have deployed in a sandbox with nothing else running on the system, signing in from my windows 11 work laptop. But I also was able to reproduce it in my homelab on the same version of ubuntu migrating up from 2.58 -> 2.59 (docker compose) using my home desktop on windows 11 insider build.

The behavior was consistent across all machines and the issue was 100% reproducible for both deployments across the same variables I mentioned before around browsers and cache behavior. Additionally I signed into the demo version of defect dojo you guys have posted to sign into on both my desktop and my iphone 13 pro and it exhibited the same behavior.

If there is anything I can provide to help reproduce this issue please let me know, many thanks for looking into this