Update on DefectDojo 3.0 progress and changes

[mtesauro]

Background:

Please see the previous Github discussion here.

Update Details:

Beyond just keeping DefectDojo updated, merging PRs and the normal day to day on this project, we've been experimenting with various ways to achieve the DefectDojo v3 goals. The results of our experimentation so far follow:

We've started doing some large PRs to update and modernize some of the older parts of DefectDojo (see #8728 & #8929 for examples).

Things we learned is from the above^ is:

• We've got several more large PRs like those in our future
• Several previous attempts became very difficult to merge due to upstream changes
• While we announced the feature freeze, we've let more PRs through then we probably should have (because we love community contributions and just can't help ourselves).

What we're doing to make this better:

• We're adding a Github Action that will fail any PR that touches parts of the code base that are actively being refactored. This is really just more strict enforcement of the feature freeze mentioned in the original discussion.
  • We'll be adjusting the list of files on a rolling basis so the files/paths today (2023-11-10) won't be forever.
  • These aren't a definitive "No" to PRs that have red tests for this new check - we're doing this to send a signal to contributors who may not have followed the v3 discussions that they may be breaking the 'feature freeze'.
  • We're trying our 2nd tool to do this. This is a new experiment and there's likely to be some sharp edges that we've not found yet. Thanks for your patience as we sort things out.
  • We're currently using Dryrun Security to flag 'protected' files/paths
• We are doing the ground work to get DefectDojo from Django 4.1 to 4.2
• We're moving to class-based views (a more modern Django-ism)
• We're deprecating asciidoc report output - it's a very old, rarely used feature. There’s likely other things that will be deprecated during the modernization / cleanup.
• As previously announced we are deprecating the DefectDojo API OpenAPI v2 docs since the OpenAPI v3 docs provide the same information in a more modern format. This will happen in the Jan 2024 release (2.30.0).

Like we said before, we love contributions so these are still greatly appreciated:

• New or updated parsers
• Bug / Security Fixes
• Adding or improving unit tests

Thanks for all your patience as we head towards 3.0 and for all the community’s work at making DefectDojo the awesome thing it is today!

-- Matt Tesauro

[schdief]

@mtesauro the last update on this was in November, could you give the community feedback on the current state and plans, is it reasonable to believe it will be released this year?

[mtesauro]

@schdief
I have been doing regular updates in GH Discussions - see https://github.com/DefectDojo/django-DefectDojo/discussions?discussions_q=author%3Amtesauro+

To be fair, I'm late on my 2024-Q2 Update some unplanned time off and other personal matters have pushed that back a bit.

Short answer is that we're doing the necessary foundational work to make 3.0 possible but there was more work then we initially expected. Details are in my other updates linked above.

[sNiXx]

@mtesauro, could you perhaps provide an update regarding v3? There has been no Q2/Q3 update, so it would be really interesting to get some insights regarding progress and timeline. Thank you 😁

[mtesauro]

@sNiXx Valid call out.

I've had some planned and unplanned travel and personal stuff in my life of late so haven't been as present here as I usually am.

TBH, I likely won't have bandwidth to do an update till early November but I'll add a reminder to my calendar to get make sure I do an update the first week of November if I can't get one out before then.

Thanks for keeping me honest 🙏