Release: Merge back 2.48.4 into dev from: master-into-dev/2.48.4-2.49.0-dev

[github-actions]

Release triggered by Maffooch

[dryrunsecurity]

This pull request identifies a potential security risk in the API serializer where changing the default value for 'close_old_findings' could lead to unintentional closure of valid security findings, potentially creating a false sense of security.

Unintended Closure of Findings via API Default Change in dojo/api_v2/serializers.py

Vulnerability

Unintended Closure of Findings via API Default Change

Description

The default value for 'close_old_findings' in the ReImportScanSerializer has been changed from False to True. This means that when a user re-imports a scan via the API without explicitly setting the close_old_findings parameter, any findings from the previous scan that are not present in the new report will be automatically closed as mitigated. This behavior differs from the standard ImportScanSerializer, which defaults to False, and could lead to the unintentional closure of valid security findings, creating a false sense of security and potentially masking real vulnerabilities.

django-DefectDojo/dojo/api_v2/serializers.py

Lines 2383 to 2389 in 3e46a54

	# also for ReImport.
	close_old_findings = serializers.BooleanField(
	required=False,
	default=True,
	help_text="Old findings no longer present in the new report get closed as mitigated when importing. "
	"If service has been set, only the findings for this service will be closed. "
	"This only affects findings within the same test.",

---

All finding details can be found in the DryRun Security Dashboard.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.