Release: Merge release into master from: release/2.40.1

[github-actions]

Release triggered by rossops

[dryrunsecurity]

DryRun Security Summary

The pull request covers a wide range of updates and improvements to the DefectDojo application, including GitHub Actions workflows, Kubernetes deployment, and various parsers for security tools, with a strong focus on enhancing security-related functionality, improving reliability and maintainability, and addressing potential issues.

Expand for full summary

Summary:

The changes in this pull request cover a wide range of updates and improvements to the DefectDojo application and its associated infrastructure, such as GitHub Actions workflows, Kubernetes deployment, and various parsers for security tools. The changes focus on enhancing security-related functionality, improving reliability and maintainability, and addressing potential issues.

Key security-focused changes include:

1. Updating artifact versioning and naming in GitHub Actions workflows to ensure the use of the latest secure versions and improve artifact management.
2. Improving Kubernetes deployment by using Kubernetes secrets, healthchecks, and Ingress configuration to enhance the overall security posture.
3. Addressing potential security vulnerabilities in the Checkmarx, AWS Security Hub, and Burp Enterprise parsers by improving date/time handling and input validation.
4. Enhancing the file upload validation in the DefectDojo application to prevent the upload of potentially malicious files.
5. Updating dependencies and addressing potential security issues in the Helm chart for the DefectDojo deployment.

Overall, the changes in this pull request demonstrate a strong focus on application security and a commitment to maintaining a secure and reliable DefectDojo platform.

Files Changed:

1. .github/workflows/build-docker-images-for-testing.yml: Updates artifact versioning and naming to improve artifact management.
2. .github/workflows/integration-tests.yml: Improves the integration testing workflow by updating artifact handling and Docker image loading.
3. .github/workflows/k8s-tests.yml: Enhances the Kubernetes deployment process by using Kubernetes secrets, healthchecks, and Ingress configuration.
4. .github/workflows/fetch-oas.yml: Addresses potential security risks by reviewing hardcoded endpoints and artifact retention.
5. dojo/__init__.py: Updates the version number, which is a standard practice for software releases.
6. .github/workflows/release-drafter.yml: Improves the release management process by updating artifact handling.
7. components/package.json: Updates dependencies, which is important for maintaining security and functionality.
8. .github/workflows/rest-framework-tests.yml: Enhances the unit testing workflow by improving Docker image handling.
9. dojo/importers/options.py: Improves the handling of user input by normalizing tag values.
10. dojo/api_v2/serializers.py: Enhances the file upload validation to prevent the upload of potentially malicious files.
11. dojo/settings/.settings.dist.py.sha256sum: Updates the SHA-256 hash, which is used for integrity checking.
12. dojo/templatetags/display_tags.py: Improves the handling of vulnerability URLs.
13. dojo/tools/acunetix/parse_acunetix_xml.py: Addresses a date parsing issue in the Acunetix XML parser.
14. dojo/tools/awssecurityhub/compliance.py: Improves the handling of security findings from AWS Security Hub.
15. dojo/models.py: Enhances the file upload validation to prevent the upload of potentially malicious files.
16. dojo/tools/awssecurityhub/guardduty.py: Addresses a date parsing issue in the AWS GuardDuty parser.
17. dojo/tools/checkmarx/parser.py: Fixes a date parsing issue in the Checkmarx parser.
18. dojo/tools/checkmarx_one/parser.py: Addresses a date parsing issue in the Checkmarx One parser.
19. dojo/tools/awssecurityhub/inspector.py: Improves the handling of security findings from AWS Inspector.
20. dojo/tools/burp_enterprise/parser.py: Enhances the parsing of Burp Enterprise scan results.
21. dojo/tools/contrast/parser.py: Addresses a date parsing issue in the Contrast Security parser.
22. dojo/tools/dependency_check/parser.py: Improves the handling of datetime values in the Dependency Check parser.
23. dojo/tools/generic/json_parser.py: Enhances the handling of file uploads and vulnerability IDs in the GenericJSONParser.
24. dojo/tools/ms_defender/parser.py: Improves the handling of host names in the Microsoft Defender parser.
25. `dojo/

Code Analysis

We ran 9 analyzers against 30 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	1 finding

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.