feat(renovate): Update renovate only weekly

[kiblik]

They are releasing new versions too often, so it is a bit noisy, and keeping renovating a bit older does not create vulnerabilities in DD

[dryrunsecurity]

This pull request delays Renovate dependency management updates to a weekly schedule, which increases the window of exposure to past critical Renovate vulnerabilities (e.g., token leakage and command injection) and could enable supply-chain or repository compromise given the tool's likely elevated privileges. Consider shortening the update cadence or adding compensating controls to reduce the risk.

Delayed Security Updates for Dependency Management Tool in .github/renovate.json

Vulnerability

Delayed Security Updates for Dependency Management Tool

Description

The change delays updates for the Renovate dependency management tool to a weekly schedule. Historical data shows that Renovate has had critical vulnerabilities, including token leakage and arbitrary command injection. Delaying updates creates a window of exposure where known and patched vulnerabilities could be exploited, potentially leading to a supply chain attack or repository compromise, especially given the likely elevated privileges of such a tool.

django-DefectDojo/.github/renovate.json

Lines 29 to 32 in 5a1d7ba

	"schedule": ["* * * * 0"]
	}],
	"customManagers": [
	{

---

All finding details can be found in the DryRun Security Dashboard.