Release: Merge back 2.52.1 into dev from: master-into-dev/2.52.1-2.53.0-dev

[github-actions]

Release triggered by rossops

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[dryrunsecurity]

This pull request changes the Renovate bot configuration to delay its own updates to a weekly schedule, which increases the window (up to a week) during which the repository could be exposed to newly discovered vulnerabilities in a high-privilege supply-chain tool. Because Renovate has historically had severe issues (e.g., token leakage and command injection), this delayed patching raises security risk even if the change is marked non-blocking.

Delayed Security Patching for Supply Chain Tool in .github/renovate.json

Vulnerability

Delayed Security Patching for Supply Chain Tool

Description

The configuration for the Renovate bot is changed to delay its own updates to a weekly schedule. Renovate is a critical supply chain tool with privileged access to repository data. Delaying its updates creates a window of up to a week where the repository is exposed to any newly discovered and patched vulnerabilities in Renovate itself. Past vulnerabilities in Renovate have included serious issues like token leakage and arbitrary command injection, highlighting the risk of delayed patching.

django-DefectDojo/.github/renovate.json

Lines 29 to 32 in f6cac49

	"schedule": ["* * * * 0"]
	}],
	"customDatasources": {
	"endoflife-oldest-maintained": {

---

All finding details can be found in the DryRun Security Dashboard.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.