Version 3.0.44 updates

[sei-vsarvepalli]

This pull request introduces several significant updates focused on authentication flexibility, test automation, and dependency management. Most notably, it adds a GitHub Actions workflow for automated PR tests, introduces a local authentication mode to support development and testing without Cognito, and updates several dependencies for security and compatibility. Additionally, it includes bug fixes, security improvements, and new features such as CSAF intake support.

Authentication and Authorization Improvements:

• Introduced a new AUTH_BACKEND_MODE setting in settings_.py to allow switching between Cognito and local Django authentication backends, with robust error handling for misconfiguration. Local mode leverages Django's ModelBackend and bypasses Cognito checks throughout the codebase, enabling easier development and CI testing. (bigvince/settings_.py, cogauth/utils.py, cogauth/views.py) [1] [2] [3] [4] [5] [6] [7]
• Added a dedicated URL route for local authentication endpoints (vince/auth) and corresponding test cases. (bigvince/urls.py)
• Improved diagnostics for MFA session failures, aiding in debugging potential login loop issues. (cogauth/views.py)
• Updated API key generation logic in the user profile template to support both Cognito and local auth users. (cogauth/templates/cogauth/profile.html)

Testing and CI/CD Enhancements:

• Added a comprehensive GitHub Actions workflow (.github/workflows/pr-tests.yml) to automate Django test suite execution, including ephemeral secrets generation, database setup, and migrations. This supports both local and Cognito authentication modes for robust pull request validation.

Dependency and Security Updates:

• Updated several dependencies in line with vulnerability scan and dependabot recommendations, including awscli, boto3, botocore, s3transfer, soupsieve, pyasn1, cryptography, djangorestframework, and redis.
• Addressed multiple CVEs related to permissions management in vinny/views.py, ensuring stricter checks for user and group access.

CSAF and Feature Enhancements:

• Introduced CSAF intake capability with auto-detect for form or API JSON submissions, and added a CSAF JSON view using Ace Editor for improved VRF submission experience.

Bug Fixes and Miscellaneous:

• Fixed issues related to login loops, regex compatibility with Python 3.12, and template errors. Improved logging for easier troubleshooting. [1] [2]
• Updated version to 3.0.44 and made minor corrections in the changelog. (bigvince/settings_.py, CHANGELOG.md) [1] [2]

These changes collectively improve the platform’s flexibility for development and testing, enhance security, and streamline CI/CD processes.

See CHANGELOG for more details. A number of bug fixes and security updates completed.

[sei-vsarvepalli]

@copilot

Can you also see that there were three CVE's fixed in this CVE-2026-18744, CVE-2026-18750, CVE-2026-18749 - those were not captured in your generated summary of changes. I think they are in the CHAGELOG.md

[sei-vsarvepalli]

Trying to add a new test to ensure CodeQL updates do not break anything.