Add pro release notes for 2.41.4

[paulOsinski]

Release notes for DefectDojo Pro 2.41.4:

• (API) Changed functionality of 'Force To Active / Verified' flag: True now forces to Active, while False will keep the tool's status (rather than forcing to Inactive).
• (Beta UI) Added ability to regenerate / copy your API token
• (Beta UI) Fixed bug preventing date / planned remediation dates from being added via Bulk Edit
• (Import) Added fields for EPSS score and percentile to Generic Findings Import parser

[dryrunsecurity]

DryRun Security Summary

The pull request updates the DefectDojo Pro changelog with API modifications, Beta UI improvements, and Generic Findings Import parser enhancements, while also highlighting potential security considerations related to the 'Force To Active / Verified' flag and the new /request_response_pairs endpoint.

Expand for full summary

Summary:

The code changes in this pull request primarily focus on updating the changelog for the DefectDojo Pro (Cloud Version) application. The key changes include API updates, Beta UI improvements, and changes to the Generic Findings Import parser.

From an application security perspective, the changes to the 'Force To Active / Verified' flag in the API endpoints are worth noting. This flag is used to control the initial status of findings imported into the system, and the change to make this flag optional could potentially lead to security issues if users are not careful about the default status they choose for imported findings. The application security team should ensure that all findings are properly triaged and marked as active or inactive based on their risk level.

Additionally, the new /request_response_pairs endpoint could be used to retrieve sensitive information if not properly secured and access-controlled. The application security team should review the implementation of this endpoint to ensure that it does not expose any sensitive data.

Files Changed:

• docs/content/en/changelog/changelog.md: This file has been updated to reflect the following changes:
  1. API Changes:
     • The 'Force To Active / Verified' flag is no longer required when calling the /import-scan and /reimport-scan endpoints.
     • A new /request_response_pairs endpoint has been added.
  2. Beta UI Changes:
     • Added the ability to regenerate/copy the API token.
     • Fixed a bug preventing date/planned remediation dates from being added via Bulk Edit.
  3. Import Changes:
     • Added fields for EPSS score and percentile to the Generic Findings Import parser.

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

[mtesauro]

Approved