Release: Merge release into master from: release/2.51.2#13474
Merged
Release: Merge release into master from: release/2.51.2#13474
Conversation
Co-authored-by: Ross E Esposito <ross@defectdojo.com>
….52.0-dev Release: Merge back 2.51.1 into bugfix from: master-into-bugfix/2.51.1-2.52.0-dev
fix(helm): re-add annotation hint
feat(renovate): Add support for versioning less standard value locations
Downgrade django-tagulous to version 2.1.0 to avoid issues.
* tag based filtering: avoid duplicate rows in results * tag based filtering: avoid duplicate rows in results * improvements
* report builder: ensure at least one section is present * report builder: ensure at least one section is present
* fix(serializers): Update DojoGroupSerializer to handle empty permissions list * Accommodate the UserSerializer as well
* findings-report-api: fix 404 errors * findings-report-api: fix 404 errors
* Update wiz.md * update changelog * update wiz parser * correct changelog entry --------- Co-authored-by: Paul Osinski <paul.m.osinski@gmail.com> Co-authored-by: Matt Tesauro <mtesauro@gmail.com>
* Update wiz.md * add Anchore Connector documentation --------- Co-authored-by: Paul Osinski <paul.m.osinski@gmail.com>
Fix incorrect (inflated) numbers in top 10 metrics
* deduplication: add more importer unit tests * deduplication: add more importer unit tests * uncomment tests * add more assessments
…13460) * view_finding: show unique_id_from_tool with hash_code * view_finding: show unique_id_from_tool with hash_code
* deduplication logic: add missing tests * deduplication logic: add docs * deduplication logic: add docs
🔴 Risk threshold exceeded.This pull request modifies sensitive codepaths (dojo/metrics/utils.py and dojo/metrics/views.py) and also includes workflow/config changes: an insecure pattern in shellcheck.yml that relies on a hardcoded checksum for a downloaded binary, and a Renovate config (.github/renovate.json) that disables automated updates for key dependency files (requirements, package.json, Dockerfiles).
🔴 Configured Codepaths Edit in
|
| Vulnerability | Configured Codepaths Edit |
|---|---|
| Description | Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml. |
🔴 Configured Codepaths Edit in dojo/metrics/views.py
| Vulnerability | Configured Codepaths Edit |
|---|---|
| Description | Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml. |
Insecure Dependency Check in docs/content/en/about_defectdojo/pro_features.md
| Vulnerability | Insecure Dependency Check |
|---|---|
| Description | The shellcheck.yml workflow downloads a binary without verifying its integrity against a known good source. While it does check the SHA1 checksum, the checksum itself is hardcoded in the workflow file. If an attacker were to compromise the repository and modify the shellcheck binary and update the SHELLCHECK_SHA variable to match the malicious binary's checksum, the workflow would pass the integrity check and execute the compromised binary. |
django-DefectDojo/docs/content/en/about_defectdojo/pro_features.md
Lines 54 to 60 in 969cb64
Automated Dependency Updates Disabled in .github/renovate.json
| Vulnerability | Automated Dependency Updates Disabled |
|---|---|
| Description | The Renovate configuration explicitly ignores critical dependency files such as Python requirements (requirements.txt, requirements-lint.txt), Node.js packages (components/package.json), and Dockerfiles (Dockerfile**). This prevents automated scanning and updating of these dependencies, leading to a high risk of using outdated components with known vulnerabilities. No alternative automated process for managing these dependencies was identified. |
django-DefectDojo/.github/renovate.json
Lines 10 to 18 in 969cb64
We've notified @mtesauro.
All finding details can be found in the DryRun Security Dashboard.
Maffooch
pushed a commit
to valentijnscholten/django-DefectDojo
that referenced
this pull request
Feb 16, 2026
Release: Merge release into master from: release/2.51.2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release triggered by
rossops