Release: Merge back 2.41.0 into bugfix from: master-into-bugfix/2.41.0-2.42.0-dev

[github-actions]

Release triggered by rossops

[dryrunsecurity]

DryRun Security Summary

The provided code changes cover a range of updates and improvements to the DefectDojo project, including updates to the .gitignore file, Dockerfiles, GitHub Actions workflow, package dependencies, and the docker-compose.yml file, with a focus on improving the security and maintainability of the project.

Expand for full summary

Summary:

The provided code changes cover a range of updates and improvements to the DefectDojo project, including updates to the .gitignore file, Dockerfiles, GitHub Actions workflow, package dependencies, and the docker-compose.yml file. From an application security perspective, these changes generally appear to be positive and focused on improving the security and maintainability of the project.

Key security-related updates include:

1. Updating the Nginx base image to a newer version with a specific SHA256 digest, ensuring the use of a secure and vetted base image.
2. Upgrading the Hugo and Node.js versions used in the GitHub Pages deployment workflow, which helps keep the project's dependencies up-to-date and secure.
3. Updating the PostgreSQL version used in the docker-compose.yml file, which is a good practice to incorporate the latest security patches and bug fixes.
4. Reviewing the management of sensitive environment variables, such as database credentials and encryption keys, to ensure they are properly secured.
5. Monitoring the versions of dependencies, such as the OpenAPI Generator CLI, Chrome, and ChromeDriver, to ensure they are kept up-to-date and secure.

Overall, the changes in this pull request appear to be focused on improving the security, maintainability, and reliability of the DefectDojo project. As an application security engineer, I would recommend closely reviewing the changes and thoroughly testing the application to ensure that no unintended security vulnerabilities are introduced.

Files Changed:

1. .gitignore: Updates to the .gitignore file to exclude various documentation and development environment-related files and directories, which is a common and recommended practice.
2. Dockerfile.nginx-debian and Dockerfile.nginx-alpine: Updates to the Nginx-based deployment Dockerfiles, including the use of a specific Nginx base image version and SHA256 digest, as well as the configuration of the Nginx server.
3. .github/workflows/gh-pages.yml: Updates to the GitHub Actions workflow for deploying the project's documentation to GitHub Pages, including version upgrades for Hugo and Node.js, and improvements to the build and deployment process.
4. components/package.json: Update to the version of the "pdfmake" dependency, which is a routine dependency update.
5. Dockerfile.integration-tests-debian: Updates to the Dockerfile used for running integration tests, including version updates for the OpenAPI Generator CLI, Chrome, and ChromeDriver.
6. components/yarn.lock: Updates to the versions of the @foliojs-fork/fontkit, @foliojs-fork/linebreak, and @foliojs-fork/pdfkit dependencies.
7. docker-compose.yml: Update to the PostgreSQL image version, as well as a review of the environment variables, volumes, and other configuration settings in the docker-compose.yml file.

Code Analysis

We ran 9 analyzers against 30 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	1 finding

View PR in the DryRun Dashboard.