Bump boto3 from 1.35.96 to 1.35.98

[dependabot]

Bumps boto3 from 1.35.96 to 1.35.98.

Commits

• 3902cc2 Merge branch 'release-1.35.98'
• 66657ad Bumping version to 1.35.98
• 177fa3b Add changelog entries from botocore
• 4673c59 Merge branch 'release-1.35.97'
• 4088aef Merge branch 'release-1.35.97' into develop
• 7b9ebbb Bumping version to 1.35.97
• e28898c Add changelog entries from botocore
• 28fc5bb Merge branch 'release-1.35.96' into develop
• See full diff in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
boto3	[< 1.25, > 1.24.55]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dryrunsecurity]

DryRun Security Summary

The code change updates the requirements.txt file with minor version updates to various Python libraries, including boto3, which is primarily a routine dependency update aimed at maintaining the application's security and functionality.

Expand for full summary

Summary:

The provided code change is an update to the requirements.txt file, which lists the Python dependencies required for the DefectDojo application. The key changes include an update to the boto3 library, which is required for the Celery Broker AWS (SQS) support, and updates to various other Python libraries used by the application.

From an application security perspective, the update to the boto3 library is not particularly interesting, as it is a minor version update that likely contains bug fixes and minor improvements. However, it is always important to keep dependencies up-to-date to ensure that any known security vulnerabilities are addressed. The other changes in the requirements.txt file are also likely to contain bug fixes and minor improvements, but do not appear to have any significant security implications.

Overall, this code change appears to be a routine update to the application's dependencies, which is a common practice to keep the application secure and up-to-date. However, it is always important to review any changes to dependencies, as they can potentially introduce security vulnerabilities if not properly vetted.

Files Changed:

• requirements.txt: This file has been updated to include a new version of the boto3 library (from 1.35.96 to 1.35.98) and various other Python library updates, such as django-ratelimit, argon2-cffi, blackduck, and fontawesomefree. These updates are likely to contain bug fixes and minor improvements, but do not appear to have any significant security implications.

Code Analysis

We ran 9 analyzers against 1 file and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	1 finding

View PR in the DryRun Dashboard.

[mtesauro]

Approved

[dependabot]

Superseded by #11571.