Release: Merge release into master from: release/2.42.2

[github-actions]

Release triggered by rossops

[dryrunsecurity]

DryRun Security Summary

The pull request introduces comprehensive updates to the DefectDojo application, focusing on improving security, reliability, and functionality through enhanced system settings, reporting metrics, JIRA integration, and documentation improvements.

Expand for full summary

Summary:

The code changes in this pull request cover a wide range of updates to the DefectDojo application, including documentation improvements, version updates, enhancements to the reporting and metrics functionality, and improvements to the JIRA integration and verified status enforcement.

The changes focus on improving the overall security and reliability of the application by introducing more granular control over the enforcement of verified findings, enhancing the accuracy and integrity of the reports and metrics, and strengthening the JIRA integration process. Additionally, the updates to the Helm chart and various configuration files demonstrate a commitment to maintaining a secure and well-documented deployment of the DefectDojo application.

From an application security perspective, the changes appear to be positive and address several important security considerations, such as ensuring that only verified findings are used for critical business functions, improving the visibility and traceability of the application's configuration, and enhancing the overall security posture of the DefectDojo platform.

Files Changed:

• docs/content/en/open_source/upgrading/2.42.md: Documentation update for the DefectDojo 2.42.x upgrade instructions.
• docs/content/en/share_your_findings/pro_reports/working_with_generated_reports.md: Documentation update for the "Working with Generated Reports" section.
• dojo/__init__.py: Version number update from 2.42.1 to 2.42.2.
• components/package.json: Version and dependency updates.
• dojo/db_migrations/0219_system_settings_enforce_verified_status_jira_and_more.py: Adds new system settings to enforce verified status for various features.
• dojo/filters.py: Adds new DateTimeFilter and PercentageRangeFilter for more granular filtering of findings.
• dojo/api_v2/serializers.py: Defensive programming change to handle missing "file" key in input data.
• dojo/forms.py: Ensures that findings must be active and verified to be pushed to JIRA.
• dojo/jira_link/helper.py: Updates the can_be_pushed_to_jira() function to check the enforce_verified_status_jira system setting.
• dojo/management/commands/jira_async_updates.py: Adds check for enforce_verified_status_jira system setting when updating JIRA issues.
• dojo/management/commands/push_to_jira_update.py: Adds check for enforce_verified_status_jira system setting when pushing findings to JIRA.
• dojo/metrics/views.py: Adds enforce_verified_status_metrics system setting to filter findings for metrics calculations.
• dojo/metrics/utils.py: Updates the finding_queries function to filter by verified findings based on the enforce_verified_status_metrics system setting.
• dojo/reports/views.py: Filters endpoints to only include those with active, verified findings based on the enforce_verified_status and enforce_verified_status_metrics system settings.
• dojo/reports/widgets.py: Filters the endpoints queryset to only include those with verified findings based on the enforce_verified_status and enforce_verified_status_metrics system settings.
• dojo/settings/settings.dist.py: Adds new URL templates for linking to the OSV vulnerability database.
• dojo/templates/dojo/notifications.html: Updates the URL used in the $('#notification-scope').change() function to use a dynamic Django URL template.
• dojo/models.py: Adds new system settings and fields related to enforcing verified status, false positive history, and asynchronous updating.
• dojo/tools/aws_inspector2/parser.py: Adds the "Image tags" information to the impact list for AWS Inspector2 findings.
• dojo/tools/awssecurityhub/compliance.py: Adds the "Image tags" information to the impact list for AWS Security Hub findings.
• dojo/tools/awssecurityhub/guardduty.py: Adds the "Image tags" information to the impact list for AWS GuardDuty findings.
• dojo/tools/openvas/xml_parser.py: Adds a new test attribute to the

Code Analysis

We ran 9 analyzers against 30 files and 3 analyzers had findings. 6 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	3 findings
IDOR Analyzer	1 finding
Sensitive Files Analyzer	1 finding

Overall Riskiness

🟡 Please give this pull request extra attention during review.

View PR in the DryRun Dashboard.