Release: Merge back 2.36.2 into dev from: master-into-dev/2.36.2-2.37.0-dev

[github-actions]

Release triggered by Maffooch

[dryrunsecurity]

DryRun Security Summary

The provided code changes include updates to the Helm chart for the DefectDojo application, a minor version update to the postgresql Helm chart dependency, and a refactoring of the filter_queryset method to get_queryset in several of the ViewSet classes, which improves the security and performance of the API.

Expand for full summary

Summary:

The provided code changes include updates to the Helm chart for the DefectDojo application, a minor version update to the postgresql Helm chart dependency, and a refactoring of the filter_queryset method to get_queryset in several of the ViewSet classes in the dojo/api_v2/views.py file.

From an application security perspective, these changes do not appear to introduce any significant security risks. The Helm chart update is a routine version bump, and the minor version update to the postgresql Helm chart dependency is unlikely to contain critical security vulnerabilities. The refactoring of the filter_queryset method to get_queryset is a positive change, as it improves the security and performance of the API by moving the filtering logic to the database level, reducing the risk of SQL injection vulnerabilities.

However, it is always important to review the release notes or commit history for the DefectDojo project to ensure there are no security fixes or improvements included in these updates. Additionally, regularly updating the Helm chart and the underlying DefectDojo application to the latest stable version is recommended to ensure you have the most up-to-date security patches and features.

Files Changed:

1. helm/defectdojo/Chart.yaml: This file has been updated to change the version field from 1.6.139-dev to 1.6.140-dev, indicating a new version of the Helm chart. The rest of the contents remain the same.

2. helm/defectdojo/Chart.lock: The version of the postgresql Helm chart dependency has been updated from 15.5.14 to 15.5.15, which is a minor version update.

3. dojo/api_v2/views.py: The filter_queryset method has been replaced with get_queryset in several of the ViewSet classes, and the permission classes have been updated in some of the ViewSets to use the appropriate permissions for the actions being performed.

Code Analysis

We ran 7 analyzers against 3 files and 1 analyzer had findings. 6 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	19 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud