Release: Merge back 2.50.0 into bugfix from: master-into-bugfix/2.50.0-2.51.0-dev

[github-actions]

Release triggered by rossops

[dryrunsecurity]

🔴 Risk threshold exceeded.

This pull request contains sensitive edits to multiple files in the dojo directory and templates, and includes a supply chain risk from an unmaintained GitHub Action fork and an insecure GitHub Action versioning issue in the workflow files.

🔴 Configured Codepaths Edit in dojo/filters.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/finding_group/urls.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/finding_group/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/templates/base.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/templates/dojo/finding_groups_list.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/templates/dojo/finding_groups_list_snippet.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/filters.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/finding_group/urls.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/finding_group/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/templates/base.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/templates/dojo/finding_groups_list.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/templates/dojo/finding_groups_list_snippet.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/templatetags/display_tags.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

Supply Chain Risk from Unmaintained Fork in .github/workflows/release_drafter_valentijn.yml

Vulnerability	Supply Chain Risk from Unmaintained Fork
Description	The workflow uses a personal fork valentijnscholten/release-drafter of a GitHub Action. The code explicitly states that this fork is 'not maintained anymore', indicating a significant supply chain risk. Unmaintained actions do not receive security updates, leaving the workflow vulnerable to known or future exploits in the action's code or its dependencies.

django-DefectDojo/.github/workflows/release_drafter_valentijn.yml

Lines 20 to 26 in 17f7d6b

	update_release_draft:
	runs-on: ubuntu-latest
	steps:
	- uses: valentijnscholten/release-drafter@f587de96a420b4b7f767d7eb12817926f18cad69 # master # TODO: not maintained anymore - missing part is maybe already solved in the upstream
	with:
	version: ${{github.event.inputs.version}}
	previous-version: ${{github.event.inputs.previous-version}}

Insecure GitHub Action Versioning in .github/workflows/build-docker-images-for-testing.yml

Vulnerability

Insecure GitHub Action Versioning

Description

The actions/checkout action is pinned to a specific commit SHA (08c6903cd8c0fde910a37f88322edcfb5dd907a8). As per the problem description, this SHA corresponds to version v4.1.6. However, the accompanying comment incorrectly identifies it as v5.0.0 and also references v4.2.2. This discrepancy is misleading and indicates that an older version of the action is being used than what the comments suggest, potentially missing security fixes present in newer versions of actions/checkout (e.g., v4.2.2 or v5.0.0).

django-DefectDojo/.github/workflows/build-docker-images-for-testing.yml

Lines 40 to 46 in 17f7d6b

	echo $GITHUB_ENV
	- name: Checkout
	uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false

We've notified @mtesauro.

---

All finding details can be found in the DryRun Security Dashboard.