Release: Merge release into master from: release/2.34.4

[github-actions]

Release triggered by Maffooch

[dryrunsecurity]

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security	Status	Findings
Configured Codepaths Analyzer	✅	0 findings
Sensitive Files Analyzer	❕	1 finding
AppSec Analyzer	✅	0 findings
Authn/Authz Analyzer	✅	0 findings
Secrets Analyzer	✅	0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The provided code changes cover a range of updates and improvements across multiple files in the DefectDojo application. The changes include:

1. Dependency Updates: The package.json file has been updated to include the latest versions of various dependencies, which is a good security practice to address known vulnerabilities.
2. Reimport Process Improvement: The default_reimporter.py file has been updated to improve the accuracy of the reimport process, ensuring that new, reactivated, and untouched findings are properly categorized.
3. Version Updates: The __init__.py and Helm chart Chart.yaml files have been updated to reflect the new version of the DefectDojo application (2.34.4).
4. HTML Report Template Update: The custom_html_report_endpoint_list.html template has been updated to improve the presentation and formatting of the custom HTML report.
5. SARIF Parser Improvements: The test_sarif_parser.py and parser.py files have been updated to improve the handling of SARIF reports, including the parsing of severity information and edge cases.
6. Progpilot Parser Update: The parser.py file in the dojo/tools/progpilot module has been updated to improve the handling of the description variable when processing Progpilot security scan results.

From an application security perspective, these changes generally address various maintenance and improvement tasks, with a focus on enhancing the reliability, accuracy, and security of the DefectDojo application. The updates to dependencies, the reimport process, and the SARIF and Progpilot parsers are particularly noteworthy, as they directly impact the application's ability to accurately identify and manage security vulnerabilities.

Files Changed:

1. components/package.json: Updated the application version and dependency versions.
2. dojo/importers/default_reimporter.py: Improved the accuracy of the reimport process.
3. dojo/__init__.py: Updated the application version.
4. dojo/templates/dojo/custom_html_report_endpoint_list.html: Updated the HTML report template.
5. helm/defectdojo/Chart.yaml: Updated the Helm chart version and the underlying application version.
6. unittests/tools/test_sarif_parser.py: Added a new test case to improve the SARIF parser.
7. dojo/tools/progpilot/parser.py: Updated the handling of the description variable in the Progpilot parser.
8. dojo/tools/sarif/parser.py: Improved the handling of the security-severity property in the SARIF parser.

Powered by DryRun Security