Bump python-gitlab from 4.4.0 to 4.5.0

[dependabot]

Bumps python-gitlab from 4.4.0 to 4.5.0.

Release notes

Sourced from python-gitlab's releases.

v4.5.0 (2024-05-13)

Build

• build: Add "--no-cache-dir" to pip commands in Dockerfile

This would not leave cache files in the built docker image.

Additionally, also only build the wheel in the build phase.

On my machine, before this PR, size is 74845395; after this PR, size is 72617713. (4ef94c8)

Chore

• chore(deps): update all non-major dependencies (4f338ae)

• chore(deps): update gitlab/gitlab-ee docker tag to v16.11.2-ee.0 (9be48f0)

• chore(deps): update dependency myst-parser to v3 (9289189)

• chore(deps): update all non-major dependencies (65d0e65)

• chore(deps): update dependency jinja2 to v3.1.4 [security] (8ea10c3)

• chore(deps): update all non-major dependencies (1f0343c)

• chore(deps): update gitlab/gitlab-ee docker tag to v16.11.1-ee.0 (1ed8d6c)

• chore(deps): update all non-major dependencies (0e9f4da)

• chore(deps): update gitlab/gitlab-ee docker tag to v16 (ea8c4c2)

• chore(deps): update all non-major dependencies (d5b5fb0)

• chore(deps): update dependency pytest-cov to v5 (db32000)

• chore: update mypy to 1.9.0 and resolve one issue

mypy 1.9.0 flagged one issue in the code. Resolve the issue. Current unit tests already check that a None value returns text/plain. So function is still working as expected. (dd00bfc)

• chore(deps): update dependency black to v24.3.0 [security] (f6e8692)

• chore(deps): update all non-major dependencies (14a3ffe)

• chore(deps): update all non-major dependencies (3c4dcca)

• chore(deps): update all non-major dependencies (04c569a)

... (truncated)

Changelog

Sourced from python-gitlab's changelog.

v4.5.0 (2024-05-13)

Build

• build: Add "--no-cache-dir" to pip commands in Dockerfile

This would not leave cache files in the built docker image.

Additionally, also only build the wheel in the build phase.

On my machine, before this PR, size is 74845395; after this PR, size is 72617713. (4ef94c8)

Chore

• chore(deps): update all non-major dependencies (4f338ae)

• chore(deps): update gitlab/gitlab-ee docker tag to v16.11.2-ee.0 (9be48f0)

• chore(deps): update dependency myst-parser to v3 (9289189)

• chore(deps): update all non-major dependencies (65d0e65)

• chore(deps): update dependency jinja2 to v3.1.4 [security] (8ea10c3)

• chore(deps): update all non-major dependencies (1f0343c)

• chore(deps): update gitlab/gitlab-ee docker tag to v16.11.1-ee.0 (1ed8d6c)

• chore(deps): update all non-major dependencies (0e9f4da)

• chore(deps): update gitlab/gitlab-ee docker tag to v16 (ea8c4c2)

• chore(deps): update all non-major dependencies (d5b5fb0)

• chore(deps): update dependency pytest-cov to v5 (db32000)

• chore: update mypy to 1.9.0 and resolve one issue

mypy 1.9.0 flagged one issue in the code. Resolve the issue. Current unit tests already check that a None value returns text/plain. So function is still working as expected. (dd00bfc)

• chore(deps): update dependency black to v24.3.0 [security] (f6e8692)

• chore(deps): update all non-major dependencies (14a3ffe)

• chore(deps): update all non-major dependencies (3c4dcca)

• chore(deps): update all non-major dependencies (04c569a)

... (truncated)

Commits

• 58d50f2 chore: release v4.5.0
• 2d1b749 feat(job_token_scope): support Groups in job token allowlist API (#2816)
• c5d0404 fix: Consider scope an ArrayAttribute in PipelineJobManager
• c23e6bd fix(test): use different ids for merge request, approval rule, project
• b8b3849 fix(api): fix saving merge request approval rules
• 4f338ae chore(deps): update all non-major dependencies
• 9be48f0 chore(deps): update gitlab/gitlab-ee docker tag to v16.11.2-ee.0
• 9289189 chore(deps): update dependency myst-parser to v3
• 65d0e65 chore(deps): update all non-major dependencies
• 8ea10c3 chore(deps): update dependency jinja2 to v3.1.4 [security]
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dryrunsecurity]

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security	Status	Findings
Configured Codepaths Analyzer	✅	0 findings
Sensitive Files Analyzer	❕	1 finding
AppSec Analyzer	✅	0 findings
Authn/Authz Analyzer	✅	0 findings
Secrets Analyzer	✅	0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The provided code change is an update to the requirements.txt file for the DefectDojo application. The key change is the update to the python-gitlab library from version 4.4.0 to 4.5.0. From an application security perspective, this library update is worth reviewing, as library updates can sometimes introduce new security vulnerabilities or fix existing ones. It's important to check the release notes and changelog for any security-related changes to ensure the application's security posture is maintained.

Overall, the changes in this requirements.txt file appear to be routine library updates, which is a common practice in software development to keep the application's dependencies current. However, it's still important to review the changes carefully, especially for any security-sensitive libraries, to ensure the application's security is not compromised.

Files Changed:

• requirements.txt: This file has been updated to include the latest version of the python-gitlab library, which has been upgraded from 4.4.0 to 4.5.0.

Powered by DryRun Security

[mtesauro]

Approved