Bump python-gitlab from 5.4.0 to 5.6.0

[dependabot]

Bumps python-gitlab from 5.4.0 to 5.6.0.

Release notes

Sourced from python-gitlab's releases.

v5.6.0 (2025-01-28)

Features

• group: Add support for group level MR approval rules (304bdd0)

---

Detailed Changes: v5.5.0...v5.6.0

v5.5.0 (2025-01-28)

Chores

• Add deprecation warning for mirror_pull functions (7f6fd5c)

• Relax typing constraints for response action (f430078)

• tests: Catch deprecation warnings (0c1af08)

Documentation

• Add usage of pull mirror (9b374b2)

• Remove old pull mirror implementation (9e18672)

Features

• projects: Add pull mirror class (2411bff)

---

Detailed Changes: v5.4.0...v5.5.0

Changelog

Sourced from python-gitlab's changelog.

v5.6.0 (2025-01-28)

Features

• group: Add support for group level MR approval rules (304bdd0)

v5.5.0 (2025-01-28)

Chores

• Add deprecation warning for mirror_pull functions (7f6fd5c)

• Relax typing constraints for response action (f430078)

• tests: Catch deprecation warnings (0c1af08)

Documentation

• Add usage of pull mirror (9b374b2)

• Remove old pull mirror implementation (9e18672)

Features

• functional: Add pull mirror test (3b31ade)

• projects: Add pull mirror class (2411bff)

• unit: Add pull mirror tests (5c11203)

Commits

• 515a8a2 chore: release v5.6.0
• 304bdd0 feat(group): add support for group level MR approval rules
• cfa6358 chore: release v5.5.0
• 0c1af08 chore(tests): catch deprecation warnings
• f430078 chore: relax typing constraints for response action
• 7f6fd5c chore: add deprecation warning for mirror_pull functions
• 9e18672 docs: remove old pull mirror implementation
• 9b374b2 docs: add usage of pull mirror
• 3b31ade feat(functional): add pull mirror test
• 2411bff feat(projects): add pull mirror class
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dryrunsecurity]

DryRun Security Summary

The code change updates the python-gitlab library from version 5.4.0 to 5.6.0 in DefectDojo's requirements.txt file, while maintaining various security-related dependencies and noting concerns about outdated libraries.

Expand for full summary

Summary:

The provided code change is an update to the requirements.txt file for the DefectDojo application, which is a web application for managing software vulnerabilities. The key change is the update of the python-gitlab library from version 5.4.0 to 5.6.0. This update may contain bug fixes, security improvements, or new features related to interacting with GitLab.

From an application security perspective, it's important to keep all dependencies up-to-date to ensure the use of the latest versions with the most recent security patches. The requirements.txt file also includes several security-related libraries, such as cryptography, pyjwt, and argon2-cffi, which should be closely monitored for any security vulnerabilities. Additionally, the file includes a comment about the django-tagging library being very outdated and only used for migration purposes, suggesting that unused dependencies should be removed to reduce the application's attack surface.

Files Changed:

• requirements.txt: This file has been updated to include the latest version of the python-gitlab library, which is now at version 5.6.0. The file also includes several security-related libraries, such as cryptography, pyjwt, and argon2-cffi, which should be closely monitored for any security vulnerabilities. Additionally, the file includes a comment about the django-tagging library being very outdated and only used for migration purposes, suggesting that unused dependencies should be removed to reduce the application's attack surface.

Code Analysis

We ran 9 analyzers against 1 file and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	1 finding

View PR in the DryRun Dashboard.

[mtesauro]

Approved