Skip to content

Release: Merge release into master from: release/2.46.0 #12386

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 116 commits into from
May 5, 2025
Merged

Release: Merge release into master from: release/2.46.0 #12386

merged 116 commits into from
May 5, 2025
+29,620 −20,652

Conversation

github-actions[bot]
Copy link
Contributor

@github-actions github-actions bot commented May 5, 2025

Release triggered by rossops

DefectDojo release bot and others added 30 commits April 7, 2025 15:24
Update versions in application files
3bc363d
@Maffooch
Merge pull request #12189 from DefectDojo/master-into-dev/2.45.0-2.46…
131e567 
….0-dev

Release: Merge back 2.45.0 into dev from: master-into-dev/2.45.0-2.46.0-dev
@dependabot
Bump boto3 from 1.37.27 to 1.37.28 (#12183)
e2fbf54 
Bumps [boto3](https://github.com/boto/boto3) from 1.37.27 to 1.37.28.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.37.27...1.37.28)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.37.28
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump lxml from 5.3.1 to 5.3.2 (#12182)
95434ae 
Bumps [lxml](https://github.com/lxml/lxml) from 5.3.1 to 5.3.2.
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](lxml/lxml@lxml-5.3.1...lxml-5.3.2)

---
updated-dependencies:
- dependency-name: lxml
  dependency-version: 5.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump ruff from 0.11.3 to 0.11.4 (#12184)
59f08d4 
Bumps [ruff](https://github.com/astral-sh/ruff) from 0.11.3 to 0.11.4.
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.11.3...0.11.4)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.11.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump boto3 from 1.37.28 to 1.37.29 (#12195)
e5a0ffc 
Bumps [boto3](https://github.com/boto/boto3) from 1.37.28 to 1.37.29.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.37.28...1.37.29)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.37.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump django-extensions from 3.2.3 to 4.0 (#12197)
6db74ef 
Bumps [django-extensions](https://github.com/django-extensions/django-extensions) from 3.2.3 to 4.0.
- [Release notes](https://github.com/django-extensions/django-extensions/releases)
- [Changelog](https://github.com/django-extensions/django-extensions/blob/main/CHANGELOG.md)
- [Commits](django-extensions/django-extensions@3.2.3...4.0)

---
updated-dependencies:
- dependency-name: django-extensions
  dependency-version: '4.0'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump celery from 5.4.0 to 5.5.1 (#12196)
f95315d 
Bumps [celery](https://github.com/celery/celery) from 5.4.0 to 5.5.1.
- [Release notes](https://github.com/celery/celery/releases)
- [Changelog](https://github.com/celery/celery/blob/main/Changelog.rst)
- [Commits](celery/celery@v5.4.0...v5.5.1)

---
updated-dependencies:
- dependency-name: celery
  dependency-version: 5.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump boto3 from 1.37.29 to 1.37.30 (#12202)
b018feb 
Bumps [boto3](https://github.com/boto/boto3) from 1.37.29 to 1.37.30.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.37.29...1.37.30)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.37.30
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@kiblik
Ruff: Final fix of PTH123 (#12177)
9fcf423
@kiblik
feat(perf): Speed-up loading by using smaller resources (js,css) (#12178
d11e7cd 
)
@dependabot
Bump boto3 from 1.37.30 to 1.37.31 (#12208)
4e171b7 
Bumps [boto3](https://github.com/boto/boto3) from 1.37.30 to 1.37.31.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.37.30...1.37.31)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.37.31
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump django-celery-results from 2.5.1 to 2.6.0 (#12209)
fb41501 
Bumps [django-celery-results](https://github.com/celery/django-celery-results) from 2.5.1 to 2.6.0.
- [Release notes](https://github.com/celery/django-celery-results/releases)
- [Changelog](https://github.com/celery/django-celery-results/blob/main/Changelog)
- [Commits](celery/django-celery-results@v2.5.1...v2.6.0)

---
updated-dependencies:
- dependency-name: django-celery-results
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@renovate
Update dependency vite from 6.2.5 to v6.2.6 (docs/package.json) (#12207)
9daf2f5 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@manuel-sommer @Maffooch
Ruff: Add S324 rule (#12169)
ceee38a 
* fix

* fix

* Update ruff.toml

---------

Co-authored-by: Cody Maffucci <[email protected]>
@valentijnscholten
sla_config: use mass update for recalculation (#12133)
5e97c09 
* sla_config_updater: add logging

* sla_config: use mass update on changes

* sla_config: use mass update on changes

* sla_config: use mass update on changes

* sla_config: use mass update on changes

* sla_config: use mass update on changes

* sla_config: use mass update on changes

* sla_config: use mass update on changes

* sla_config: use mass update on changes

* cleanup
@Maffooch
Import/Reimport Stats: Change name of left untouched (#12193)
f751349 
* Import/Reimport Stats: Change name of left untouched

* Update migrations

* Failed spell check

* Update migration again

* Migrate from `left_untouched` to `untouched`
@dependabot
Bump boto3 from 1.37.31 to 1.37.32 (#12219)
3cd059d 
Bumps [boto3](https://github.com/boto/boto3) from 1.37.31 to 1.37.32.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.37.31...1.37.32)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.37.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump django-extensions from 4.0 to 4.1 (#12220)
ca34ac3 
Bumps [django-extensions](https://github.com/django-extensions/django-extensions) from 4.0 to 4.1.
- [Release notes](https://github.com/django-extensions/django-extensions/releases)
- [Changelog](https://github.com/django-extensions/django-extensions/blob/main/CHANGELOG.md)
- [Commits](django-extensions/django-extensions@4.0...4.1)

---
updated-dependencies:
- dependency-name: django-extensions
  dependency-version: '4.1'
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Update versions in application files
31baf30
@manuel-sommer
🐛 fix ruff bump to 0.11.5 #12217 (#12224)
a045f44 
* 🐛 fix ruff bump to 0.11.5

* bump
@rossops
Merge branch 'dev' into master-into-dev/2.45.1-2.46.0-dev
3ec6b4c
@dependabot
Bump uwsgi from 2.0.28 to 2.0.29 (#12231)
7c6c90f 
Bumps [uwsgi](https://uwsgi-docs.readthedocs.io/en/latest/) from 2.0.28 to 2.0.29.

---
updated-dependencies:
- dependency-name: uwsgi
  dependency-version: 2.0.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump boto3 from 1.37.32 to 1.37.33 (#12232)
7f5b9ed 
Bumps [boto3](https://github.com/boto/boto3) from 1.37.32 to 1.37.33.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.37.32...1.37.33)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.37.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump markdown from 3.7 to 3.8 (#12233)
79f057f 
Bumps [markdown](https://github.com/Python-Markdown/markdown) from 3.7 to 3.8.
- [Release notes](https://github.com/Python-Markdown/markdown/releases)
- [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md)
- [Commits](Python-Markdown/markdown@3.7...3.8)

---
updated-dependencies:
- dependency-name: markdown
  dependency-version: '3.8'
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@renovate
chore(deps): update actions/setup-node action from v4.3.0 to v4.4.0 (…
348c996 
….github/workflows/validate_docs_build.yml) (#12229)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@dependabot
Bump django-crispy-forms from 2.3 to 2.4 (#12235)
c7c5132 
Bumps [django-crispy-forms](https://github.com/django-crispy-forms/django-crispy-forms) from 2.3 to 2.4.
- [Release notes](https://github.com/django-crispy-forms/django-crispy-forms/releases)
- [Changelog](https://github.com/django-crispy-forms/django-crispy-forms/blob/main/CHANGELOG.md)
- [Commits](django-crispy-forms/django-crispy-forms@2.3...2.4)

---
updated-dependencies:
- dependency-name: django-crispy-forms
  dependency-version: '2.4'
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump pillow from 11.1.0 to 11.2.1 (#12234)
8356f81 
Bumps [pillow](https://github.com/python-pillow/Pillow) from 11.1.0 to 11.2.1.
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@11.1.0...11.2.1)

---
updated-dependencies:
- dependency-name: pillow
  dependency-version: 11.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@Maffooch
Fixing ruff
f2ee11e
@rossops
Merge pull request #12239 from DefectDojo/master-into-dev/2.45.1-2.46…
ed2b172 
….0-dev

Release: Merge back 2.45.1 into dev from: master-into-dev/2.45.1-2.46.0-dev
valentijnscholten and others added 13 commits May 1, 2025 12:03
@valentijnscholten
view_endpoint: fix error (#12343)
5635f69 
* view_endpoint fix error

* ui tests: add view_endpoint test

* ui tests: add view_endpoint test

* ui tests: add view_endpoint test

* ui tests: add view_endpoint test

* ui tests: add view_endpoint test
@rossops @valentijnscholten
Add input validation (branch to release num) for the release gha (#12302
5fcc9e4 
)

* Add input validation (branch to release num) for the release gha

* Update .github/workflows/release-1-create-pr.yml

Co-authored-by: valentijnscholten <[email protected]>

* Update .github/workflows/release-1-create-pr.yml

Co-authored-by: valentijnscholten <[email protected]>

* Update .github/workflows/release-1-create-pr.yml

Co-authored-by: valentijnscholten <[email protected]>

* Update .github/workflows/release-1-create-pr.yml

Co-authored-by: valentijnscholten <[email protected]>

* Update .github/workflows/release-1-create-pr.yml

Co-authored-by: valentijnscholten <[email protected]>

* Resolving merge conflict

---------

Co-authored-by: valentijnscholten <[email protected]>
@oussama-taoufiq
Focus Indicator Disappears While Tabbing - DefectDojo Accessibility i…
19ed7f7 
…ssue (Serious) (#12051)

* Update dojo.css

* Update package-lock.json
@kiblik
fix(GHA): Avoid some actions in forks (#12354)
dfa5304
@dependabot
Bump ruff from 0.11.7 to 0.11.8 (#12367)
2bf8cd6 
Bumps [ruff](https://github.com/astral-sh/ruff) from 0.11.7 to 0.11.8.
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.11.7...0.11.8)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.11.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@paulOsinski
update changelog 2.45.3 (#12364)
6601929 
Co-authored-by: Paul Osinski <[email protected]>
@dependabot
Bump boto3 from 1.38.6 to 1.38.7 (#12366)
32b1bdd 
Bumps [boto3](https://github.com/boto/boto3) from 1.38.6 to 1.38.7.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.38.6...1.38.7)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.38.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@paulOsinski
[docs] sso maintenance (#12356)
5610328 
* Update configure_sso.md

* Update configure_sso.md
@rossops
Merge branch 'dev' into bugfix
cede5fa
@rossops
Fixing linter issues PTH123
941b258
@rossops
Fixing urllib version
8ff6f7d
@rossops
Merge pull request #12385 from DefectDojo/bugfix
e21bfbb 
Release 2.46.0: Merge Bugfix into Dev
Update versions in application files
fba830a
@github-actions github-actions bot requested review from Maffooch and mtesauro as code owners May 5, 2025 16:39
@rossops rossops closed this May 5, 2025
@rossops rossops reopened this May 5, 2025
@github-actions github-actions bot added docker New Migration Adding a new migration file. Take care when merging. settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR apiv2 docs unittests integration_tests ui parser helm lint labels May 5, 2025
@dryrunsecurity DryRunSecurity
Copy link

dryrunsecurity bot commented May 5, 2025 •
edited
Loading

DryRun Security

🔴 Risk threshold exceeded.

This pull request contains sensitive edits to multiple core files including models, templates, and importers, and introduces potential security risks related to workflow input validation, dependency updates, secret exposure, and workflow execution controls that may require careful review and mitigation.

⚠️ Configured Codepaths Edit in dojo/db_migrations/0226_import_history_left_untouched_rename.py
Vulnerability Configured Codepaths Edit
Description Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.
⚠️ Configured Codepaths Edit in dojo/models.py
Vulnerability Configured Codepaths Edit
Description Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.
⚠️ Configured Codepaths Edit in dojo/product/helpers.py
Vulnerability Configured Codepaths Edit
Description Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.
⚠️ Configured Codepaths Edit in dojo/templates/base.html
Vulnerability Configured Codepaths Edit
Description Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.
⚠️ Configured Codepaths Edit in dojo/importers/base_importer.py
Vulnerability Configured Codepaths Edit
Description Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.
💭 Unconfirmed Findings (5)
Vulnerability Dependency Version Update Risks
Description Multiple workflows and Dockerfiles updated dependencies with potential unknown security implications. Risks include introducing unexpected behaviors or subtle security changes, affecting files like .github/workflows/, Dockerfile.*, docker-compose.yml, and components/package.json.
Vulnerability Workflow Input Validation Vulnerabilities
Description Some workflows modified input handling, potentially exposing risks in input validation. Specific risks identified in release-x-manual-merge-container-digests.yml and release-2-tag-docker-push.yml, with potential for input manipulation or bypass of intended workflow controls.
Vulnerability Secret and Credential Exposure Risks
Description Workflows using secrets: inherit could expose more secrets than necessary. Hardcoded Git user credentials in release workflows and DockerHub credential usage present potential exposure risks.
Vulnerability Potential Information Disclosure
Description Email addresses and repository-specific conditions could leak internal information. External links in documentation files might introduce tracking or redirection risks.
Vulnerability Workflow Execution and Tagging Risks
Description Identified risks include unrestricted cron schedules, force pushing Git tags, and reduced image tagging controls that could potentially compromise workflow security and integrity.

We've notified @mtesauro.

All finding details can be found in the DryRun Security Dashboard.

@rossops rossops merged commit 05a92af into master May 5, 2025
75 of 76 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Maffooch Maffooch Awaiting requested review from Maffooch Maffooch is a code owner

@mtesauro mtesauro Awaiting requested review from mtesauro mtesauro is a code owner

Assignees
No one assigned
Labels
apiv2 docker docs helm integration_tests lint New Migration Adding a new migration file. Take care when merging. parser settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR ui unittests
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.