Release: Merge release into master from: release/2.37.0

[github-actions]

Release triggered by Maffooch

[dryrunsecurity]

DryRun Security Summary

The pull request includes a wide range of updates to the DefectDojo application, focusing on improving the security, setup, and deployment processes, as well as updating dependencies and enhancing the overall security posture of the application.

Expand for full summary

Summary:

The code changes in this pull request cover a wide range of updates to the DefectDojo application, including improvements to the GitHub Actions workflows, Docker Compose configuration, and various scripts. The changes are primarily focused on simplifying the setup and deployment process, updating dependencies, and enhancing the overall security posture of the application.

Key security-related changes include:

1. Improvements to the integration test workflow, such as the use of Docker Compose V2, simplified database and message broker configurations, and better handling of environment variables.
2. Updates to the release management workflow, including version number updates, branch management, and the creation of upgrade notes.
3. Enhancements to the Docker image build process, including the use of secure base images, dependency updates, and improved environment variable management.
4. Simplification of the development and testing environment configurations, with a focus on separating test and production environments and properly securing sensitive information.
5. Improvements to the error handling and logging in various scripts, which can help with the early detection and investigation of potential security issues.

Overall, the changes in this pull request appear to be well-considered and aimed at improving the security and maintainability of the DefectDojo application. As an application security engineer, I would recommend thoroughly reviewing the changes and their impact on the application's security posture, and then approving the pull request.

Files Changed:

1. .github/workflows/integration-tests.yml: Updates the integration test workflow to use Docker Compose V2 and simplify the setup process.
2. .github/workflows/k8s-tests.yml: Modifies the Kubernetes deployment test workflow, including the use of a single database and message broker configuration.
3. .github/renovate.json: Updates the Renovate bot configuration, including changes to dependency management and commit message formatting.
4. .github/workflows/fetch-oas.yml: Enhances the workflow for fetching OpenAPI specifications, including improved artifact management and validation.
5. .github/workflows/release-1-create-pr.yml: Improves the release management workflow, including version number updates and branch handling.
6. .github/workflows/release-3-master-into-dev.yml: Adds a workflow to merge the master branch into the dev and bugfix branches after a release.
7. .github/workflows/rest-framework-tests.yml: Updates the unit test workflow for the Django REST Framework project.
8. Dockerfile.django-alpine: Optimizes the Docker image build process for the Django-based application running on Alpine Linux.
9. Dockerfile.nginx-debian: Updates the Docker image build process for the Nginx web server component.
10. Dockerfile.django-debian: Enhances the Docker image build process for the Django-based application running on Debian.
11. Dockerfile.integration-tests-debian: Improves the Docker image build process for running integration tests on a Debian-based environment.
12. Dockerfile.nginx-alpine: Updates the Docker image build process for the Nginx web server component running on Alpine Linux.
13. components/package.json and components/yarn.lock: Updates a dependency (justgage) to a newer version.
14. Various script files (e.g., dc-build.sh, dc-down.sh, dc-stop.sh, dc-integration-tests.sh, dc-unittest.sh, dc-up.sh, dc-up-d.sh) related to the Docker Compose setup and management.
15. docker-compose.override.debug.yml, docker-compose.override.integration_tests.yml, docker-compose.override.dev.yml, docker-compose.override.unit_tests.yml, docker-compose.override.unit_tests_cicd.yml, and docker-compose.yml: Updates to the Docker Compose configuration files for different environments and use cases.
16. NOTICE: Updates the licensing information for the DefectDojo application and its dependencies.
17. docker/entrypoint-unit-tests-devDocker.sh and docker/entrypoint-unit-tests.sh: Improvements to the unit test execution scripts.

Code Analysis

We ran 9 analyzers against 30 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	1 finding

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.