rewindio
diff --git a/‎.github/pull_request_template.md‎
Lines changed: 11 additions & 8 deletions b/‎.github/pull_request_template.md‎
Lines changed: 11 additions & 8 deletions
diff --git a/‎.github/workflows/.trivyignore‎
Lines changed: 15 additions & 0 deletions b/‎.github/workflows/.trivyignore‎
Lines changed: 15 additions & 0 deletions
diff --git a/‎.github/workflows/.zap-rules-web.tsv‎
Lines changed: 9 additions & 14 deletions b/‎.github/workflows/.zap-rules-web.tsv‎
Lines changed: 9 additions & 14 deletions
diff --git a/‎.github/workflows/browserstack.yaml‎
Lines changed: 8 additions & 6 deletions b/‎.github/workflows/browserstack.yaml‎
Lines changed: 8 additions & 6 deletions
diff --git a/‎.github/workflows/housekeeping.yaml‎
Lines changed: 24 additions & 23 deletions b/‎.github/workflows/housekeeping.yaml‎
Lines changed: 24 additions & 23 deletions
@@ -3,17 +3,20 @@
 What existing issue does the pull request solve?
 Please provide enough information so that others can review your pull request
 -->
+If this closes an existing issue then add "closes #xxxx", where xxxx is the issue number
 
 **Description for the changelog**:
-<!--
-A short (one line) summary that describes the changes in this pull request for inclusion in the change log
--->
+<!-- A short (one line) summary that describes the changes in this pull request for inclusion in the change log -->
+
+**Declaration**:
+
+- [ ] appropriate unit tests have been created / modified
+- [ ] functional tests created / modified for changes in functionality
+- [ ] any use of AI has been declared in this pull request
 
 **Other info**:
-<!--
-Add here any other information that may be of help to the reviewer
-If this closes an existing issue then add "closes #xxxx", where xxxx is the issue number
--->
+<!-- Add here any other information that may be of help to the reviewer -->
 
 Thanks for submitting a pull request!
-Please make sure you follow our code_of_conduct.md and our contributing guidelines contributing.md
+Please make sure you follow our [Code of Conduct](../code_of_conduct.md)
+and our [contributing guidelines](../contributing.md)
@@ -0,0 +1,15 @@
+# ignoring these vulnerabilities in zlib,
+# there are no updates to zlib and so these are unlikely to be fixed
+CVE-2018-25032
+CVE-2022-37434
+
+# https://avd.aquasec.com/nvd/cve-2023-28155
+# request version prior to 2.88.2
+# this vulnerability is for the build system, not run time, so ignore
+CVE-2023-28155
+
+# https://avd.aquasec.com/nvd/cve-2024-9143 
+# alpine 3.20.3 is pulling in a Low priority vuln for libcrypto3 version 3.3.2-r2,
+# ignore for now until alpine is updated
+CVE-2024-9143
+
@@ -1,19 +1,14 @@
-10110	OUTOFSCOPE	.*vendor.*\.js
-10110	OUTOFSCOPE	.*graph-test.*\.js
+10062	OUTOFSCOPE	.*_bom\..*
+10094	OUTOFSCOPE	.*_bom\..*
 10099	OUTOFSCOPE	.*vendor.*\.js
 10099	OUTOFSCOPE	.*diagram-edit.*\.js
 10099	OUTOFSCOPE	.*app.*\.js
+10110	OUTOFSCOPE	.*vendor.*\.js
+10110	OUTOFSCOPE	.*graph-test.*\.js
 10110	OUTOFSCOPE	.*diagram-edit.*\.js
-10062	OUTOFSCOPE	.*_bom\..*
-10094	OUTOFSCOPE	.*_bom\..*
 10110	OUTOFSCOPE	.*jquery\.min\.js
-10003	IGNORE	(docs/assets/js/jquery.dataTables.min.js)
-10094	IGNORE	Base64 Disclosure
-10027	IGNORE	Information Disclosure - Suspicious Comments
-10096	IGNORE	Timestamp Disclosure - Unix
-10099	IGNORE	Source Code Disclosure - SQL
-10109	IGNORE	Modern Web Application
-10049	IGNORE	Non-Storable Content
-10055	IGNORE	(CSP: style-src unsafe-inline)
-10063	IGNORE	(Feature Policy Header Not Set)
-90005	IGNORE	(Sec-Fetch-Dest Header is Missing)
+10003	IGNORE	Javascript libraries handled by dependabot
+10055	IGNORE	CSP: script-src unsafe-eval
+10063	IGNORE	Permissions Policy Header Not Set
+40039	IGNORE	Web Cache Deception
+90004	IGNORE	Set the Cross-Origin-Opener-Policy header
@@ -10,27 +10,29 @@ on:
 jobs:
   browserstack_e2e:
     name: Browserstack e2e
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     defaults:
       run:
         working-directory: td.vue
     if: github.repository == 'OWASP/threat-dragon'
+
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.1
+        uses: actions/checkout@v4.2.0
 
-      - name: Use Node.js 18.x
-        uses: actions/setup-node@v4.0.0
+      - name: Use node LTS 20.14.0
+        uses: actions/setup-node@v4.3.0
         with:
-          node-version: '18'
+          node-version: '20.14.0'
 
       - name: Cache NPM dir
-        uses: actions/cache@v4.0.0
+        uses: actions/cache@v4.2.0
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-node-
+            ${{ runner.os }}-
 
       - name: Install packages
         run: |
 
@@ -6,13 +6,13 @@ on:
   workflow_dispatch:
 
 env:
-  IMAGE_NAME: threatdragon/owasp-threat-dragon
+  IMAGE_NAME: threatdragon/owasp-threat-dragon:latest
 
 # for security reasons the github actions are pinned to specific release versions
 jobs:
   chores:
     name: Tidy workflows
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     permissions:
       actions: write
 
@@ -26,13 +26,13 @@ jobs:
           keep_minimum_runs: 10
 
       - name: Delete unused workflows
-        uses: otto-de/purge-deprecated-workflow-runs@v2.0.3
+        uses: otto-de/purge-deprecated-workflow-runs@v3.0.1
         with:
           token: ${{ github.token }}
 
   stale:
     name: Tidy pull requests
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     permissions:
       pull-requests: write
       issues: write
@@ -41,45 +41,46 @@ jobs:
       - name: Tidy stale PRs and issues
         uses: actions/stale@v9
         with:
-          days-before-issue-stale: 182
+          days-before-issue-stale: 190
           days-before-issue-close: -1
-          stale-issue-message: 'This issue is stale because it has been open for 6 months with no activity.'
+          stale-issue-message: 'This issue is stale because it has been open for more than 6 months with no activity'
           stale-issue-label: stale
           remove-issue-stale-when-updated: true
           days-before-pr-stale: 21
           days-before-pr-close: 7
-          stale-pr-message: 'This PR is stale because it has been open 21 days with no activity. Remove stale label, or add a comment, otherwise it will be closed in 7 days.'
-          close-pr-message: 'This PR was closed because it has been stalled for 28 days with no activity.'
+          stale-pr-message: 'This PR is stale because it has been open 21 days with no activity. Remove stale label, or add a comment, otherwise it will be closed in 7 days'
+          close-pr-message: 'This PR was closed because it has been stalled for 28 days with no activity'
 
   trivy:
-    name: Scan with trivy
-    runs-on: ubuntu-22.04
+    name: Scan with Trivy
+    runs-on: ubuntu-24.04
     permissions:
       contents: write
       security-events: write
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4.1.1
+        uses: actions/checkout@v4.2.0
         with:
           ref: main
 
-      - name: Run vulnerability scanner
-        uses: aquasecurity/trivy-action@0.19.0
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@0.30.0
         with:
-          image-ref: '${{ env.IMAGE_NAME }}:latest'
+          image-ref: '${{ env.IMAGE_NAME }}'
           format: 'template'
           template: '@/contrib/sarif.tpl'
+          trivyignores: '.github/workflows/.trivyignore'
           output: 'trivy-results.sarif'
 
       - name: Upload scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3.25.1
+        uses: github/codeql-action/upload-sarif@v3.28.1
         with:
           sarif_file: 'trivy-results.sarif'
 
   codeql:
     name: Analyze with codeql
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     permissions:
       security-events: write
 
@@ -88,12 +89,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4.1.1
+        uses: actions/checkout@v4.2.0
         with:
           ref: main
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3.25.1
+        uses: github/codeql-action/init@v3.28.1
         with:
           languages: 'javascript'
           config-file: ./.github/codeql/codeql-config.yml
@@ -102,21 +103,21 @@ jobs:
           # Prefix the list here with "+" to use these queries and those in the config file.
 
       - name: CodeQL autobuild
-        uses: github/codeql-action/autobuild@v3.25.1
+        uses: github/codeql-action/autobuild@v3.28.1
 
       - name: Perform vulnerability analysis
-        uses: github/codeql-action/analyze@v3.25.1
+        uses: github/codeql-action/analyze@v3.28.1
 
   link_checker:
     name: Link checker
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Checkout markdown
-        uses: actions/checkout@v4.1.1
+        uses: actions/checkout@v4.2.0
 
       - name: Link Checker
-        uses: lycheeverse/lychee-action@v1.10.0
+        uses: lycheeverse/lychee-action@v2.4.0
         with:
           fail: true
         env: