Update postgres Docker tag from 17.0 to v17.1 (docker-compose.yml)

[renovate]

This PR contains the following updates:

Package	Update	Change
postgres	minor	17.0-alpine -> 17.1-alpine

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[dryrunsecurity]

DryRun Security Summary

The provided text summarizes the changes made to the docker-compose.yml file, which include updating the PostgreSQL Docker image to a newer version for improved security, while also highlighting the need to review other security-relevant configurations in the file, such as environment variables, volume mounts, entrypoint scripts, and metrics enablement.

Expand for full summary

Summary:

The code change in the docker-compose.yml file updates the PostgreSQL Docker image from version 17.0-alpine to 17.1-alpine. This is a positive security practice, as it allows the application to benefit from the latest security fixes and improvements in the PostgreSQL database. However, there are several other security considerations that should be reviewed in the docker-compose.yml file, including the handling of environment variables, volume mounts, entrypoint scripts, and metrics enablement.

It's crucial to ensure that the environment variables used in the file, which include sensitive information like database credentials and secret keys, are properly secured, either by using a secure secrets management solution or by restricting access to the Docker Compose file. The volume mounts for the PostgreSQL data, DefectDojo media files, and Redis data should also be carefully considered from a security perspective to prevent potential data exposure. The entrypoint scripts and metrics enablement features should be reviewed to ensure they do not introduce any security vulnerabilities or unintended behaviors.

Files Changed:

• docker-compose.yml: This file has been updated to use the PostgreSQL 17.1-alpine Docker image, which is a security improvement. However, the file also includes several other security-relevant configurations, such as environment variables, volume mounts, entrypoint scripts, and metrics enablement, which should be thoroughly reviewed to ensure the overall security of the application deployment.

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[mtesauro]

Approved