Release: Merge back 2.40.2 into bugfix from: master-into-bugfix/2.40.2-2.41.0-dev

[github-actions]

Release triggered by rossops

[dryrunsecurity]

DryRun Security Summary

The pull request includes routine version updates, Helm chart metadata changes, and GitHub Actions workflow modifications, which do not introduce any obvious security concerns, but thorough review and testing are still recommended to ensure there are no indirect security implications or unintended consequences.

Expand for full summary

Summary:

The code changes in this pull request cover updates to three different files: dojo/__init__.py, helm/defectdojo/Chart.yaml, and .github/workflows/release-drafter.yml. These changes appear to be routine version updates, Helm chart metadata changes, and GitHub Actions workflow modifications, respectively.

From an application security perspective, the changes do not introduce any obvious security concerns. The version updates are generally a good security practice, as they often include bug fixes and security patches. The Helm chart update is a minor version bump, and the GitHub Actions workflow changes are focused on improving the release management process.

However, it is crucial to thoroughly review the full context of the changes, including any dependencies or related components, to ensure there are no indirect security implications. Additionally, the updated versions should be tested in a non-production environment to verify there are no regressions or unintended consequences.

Ongoing monitoring and review of the entire codebase and its dependencies are recommended to maintain a secure application. As an application security engineer, I would approve these changes, but continue to monitor the project for any potential security-related issues.

Files Changed:

1. dojo/__init__.py:

   • The version number has been updated from "2.40.1" to "2.40.2".
   • There are no other functional changes to the code.

2. helm/defectdojo/Chart.yaml:

   • The version of the Helm chart has been updated from 1.6.160-dev to 1.6.161-dev, indicating a minor version update.
   • There are no other code changes visible in the provided patch.

3. .github/workflows/release-drafter.yml:

   • A new step has been added to the "add-oas-to-release" job, which downloads the OAS (OpenAPI Specification) files from the artifacts.
   • The new step uses the actions/download-artifact@v4 action with the pattern: oas-* parameter to download the OAS files.

Code Analysis

We ran 9 analyzers against 3 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.