Release: Merge release into master from: release/2.52.1

[github-actions]

Release triggered by rossops

[dryrunsecurity]

This pull request changes Renovate's update cadence to weekly, which increases the window of exposure to any vulnerabilities in the dependency-management tool itself and could raise the risk of a supply-chain compromise until the next scheduled update. While not flagged as blocking, the change may warrant reconsideration or compensating controls to reduce the longer exposure period.

Delayed Security Updates for Renovate Bot in .github/renovate.json

Vulnerability

Delayed Security Updates for Renovate Bot

Description

The proposed change delays updates for the Renovate bot to a weekly schedule. Renovate is a critical dependency management tool within the software supply chain. Delaying updates for such a tool increases the window of exposure to potential vulnerabilities in Renovate itself. If a vulnerability is discovered in Renovate, the project would remain exposed until the next scheduled update, which could be up to a week, increasing the risk of a supply chain attack where malicious dependencies could be introduced or existing ones compromised.

django-DefectDojo/.github/renovate.json

Lines 29 to 32 in f4d4c41

	"schedule": ["* * * * 0"]
	}],
	"customManagers": [
	{

---

All finding details can be found in the DryRun Security Dashboard.