Release: Merge release into master from: release/2.38.1

[github-actions]

Release triggered by Maffooch

[dryrunsecurity]

DryRun Security Summary

This GitHub pull request contains a variety of changes across multiple files, primarily focused on improving the security and functionality of the DefectDojo application, including adding documentation for new parsers, updating dependencies, implementing new features, improving the handling and processing of security scan data, and enhancing the application's security posture.

Expand for full summary

Summary:

This GitHub pull request contains a variety of changes across multiple files, primarily focused on improving the security and functionality of the DefectDojo application. The changes include:

1. Adding documentation for new parsers, such as Legitify and Threat Composer, which allow the application to import and process security scan data from various sources.
2. Updating dependencies, including the cryptography library, to address known security vulnerabilities.
3. Implementing new features, such as tracking "dynamically generated" test types, which can provide better visibility into the evolving security landscape of the application.
4. Improving the handling and processing of security scan data from various tools, including Aqua and Threat Composer.
5. Enhancing the application's security posture by implementing secure coding practices, such as input validation and sanitization, and improving the management of sensitive information.

Overall, these changes demonstrate a strong focus on application security and a commitment to continuously improving the DefectDojo platform's ability to manage and mitigate security risks.

Files Changed:

• docs/content/en/integrations/parsers/file/legitify.md: Added documentation for the Legitify parser.
• docs/content/en/integrations/parsers/file/threat_composer.md: Added documentation for the Threat Composer parser.
• dojo/__init__.py: Updated the application version from 2.38.0 to 2.38.1.
• components/package.json: Updated the application version and dependencies.
• dojo/db_migrations/0214_test_type_dynamically_generated.py: Added a new field to track "dynamically generated" test types.
• dojo/forms.py: Made changes to various Django forms, including handling of the "dynamically generated" test type field.
• dojo/api_v2/serializers.py: Excluded the "dynamically generated" field from the TestTypeSerializer.
• dojo/settings/.settings.dist.py.sha256sum: Updated the SHA-256 hash for the .settings.dist.py file.
• dojo/importers/default_reimporter.py: Improved the handling of deduplication and associated objects during the import process.
• dojo/models.py: Added a new "dynamically_generated" field to the Test_Type model.
• dojo/templates/dojo/view_product_details.html: Updated the product details page to include a link to the product type.
• dojo/settings/settings.dist.py: Added new parsers and configured the deduplication algorithm per parser.
• dojo/tools/aqua/parser.py: Added support for parsing EPSS (Exploit Prediction Score Service) data.
• helm/defectdojo/Chart.yaml: Updated the Helm chart version and the application version.
• dojo/tools/legitify/parser.py: Implemented a parser for the Legitify tool's JSON output.
• dojo/tools/threat_composer/parser.py: Implemented a parser for the Threat Composer tool's JSON output.
• requirements.txt: Updated the cryptography package to address a known security vulnerability.

Code Analysis

We ran 9 analyzers against 30 files and 2 analyzers had findings. 7 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	2 findings
Authn/Authz Analyzer	1 finding

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.