release version 2.3.0-RC1

README.md

@@ -152,7 +152,7 @@ There are some [developer notes][notes] to help get started with this project.
 We are trying to keep the test coverage relatively high so include tests in your pull requests.
 
 The easiest way to get in contact with the Threat Dragon community is via the OWASP Slack
-[#project-threat-dragon](https://owasp.slack.com/messages/CURE8PQ68) project channel
+[#project-threat-dragon][td-slack] project channel
 (you may need to [subscribe](https://owasp.org/slack/invite) first).
 
 ### Vulnerability disclosure
@@ -180,3 +180,4 @@ Threat Dragon: _making threat modeling less threatening_
 [owasp]: https://www.owasp.org
 [project]: https://owasp.org/www-project-threat-dragon
 [releases]: https://github.com/OWASP/threat-dragon/releases
+[td-slack]: https://owasp.slack.com/messages/CURE8PQ68

package.json

@@ -1,6 +1,6 @@
 {
   "name": "threat-dragon",
-  "version": "2.2.0",
+  "version": "v2.3.0-RC1",
   "private": true,
   "scripts": {
     "audit": "npm-run-all -c audit:server audit:site",

release-process.md

@@ -1,42 +1,71 @@
 The steps used during the release process
 
+## Release candidate
+
+Before a release it is required that a release candidate version is created.
+This allows the Threat Dragon community to review and feedback on the proposed release.
+Changes that are agreed for the release should then be made available with a further release candidate.
+
+1. `git clone [email protected]:OWASP/threat-dragon.git`
+2. `cd threat-dragon`
+3. update version, for example `"version": "2.3.0-RC1",`, in `package.json`, `td.site/package.json` and `td.server/package.json`
+4. ensure `buildState` in `td.vue/package.json` is `-latest`
+5. update package lock files: `npm install`
+6. `npm run build`
+7. `npm test`
+8. `npm run test:vue`
+9. `git add --all; git status`
+10. `git commit -m"release version 2.3.0-RC1"`
+11. `git push`
+12. tag the release `git tag v2.3.0-RC1`
+13. `git push origin v2.3.0-RC1`
+
+repeat as necessary for further release candidates.
+
+The github release workflow will then create the release candidate along with the install images
+
+Ensure the release candidate is announced on the [OWASP Threat Dragon][td-slack] slack channel
+and any other relevant channels
+
 ## Tag the release
 
+After the releases candidate has been agreed by the Threat Dragon community, a release version can be prepared:
+
 1. `git clone [email protected]:OWASP/threat-dragon.git`
 2. `cd threat-dragon`
-3. update version eg `"version": "2.2.0",`, in `package.json`, `td.site/package.json` and `td.server/package.json`
-4. update `buildState` in `td.vue/package.json` away from `-demo`, usually ''
+3. update version eg `"version": "2.3.0",`, in `package.json`, `td.site/package.json` and `td.server/package.json`
+4. update `buildState` in `td.vue/package.json` away from `-latest` to ''
 5. update package lock files: `npm install`
 6. `npm run build`
 7. `npm test`
 8. `npm run test:vue`
 9. `git add --all; git status`
-10. `git commit -m"release version 2.2.0"`
+10. `git commit -m"release version 2.3.0"`
 11. `git push`
-12. tag the release `git tag v2.2.0`
-13. `git push origin v2.2.0`
+12. tag the release `git tag v2.3.0`
+13. `git push origin v2.3.0`
 
 The github release workflow then creates the draft release and the install images
 
 ### Publish docker image
 
 1. once tagged, the github workflow pushes the docker image to docker hub
-2. check using `docker pull threatdragon/owasp-threat-dragon:v2.2.0`
+2. check using `docker pull threatdragon/owasp-threat-dragon:v2.3.0`
 3. Test using the command to run a detached container:
-    `docker run -d -p 8080:3000 -v $(pwd)/.env:/app/.env threatdragon/owasp-threat-dragon:v2.2.0`
+    `docker run -d -p 8080:3000 -v $(pwd)/.env:/app/.env threatdragon/owasp-threat-dragon:v2.3.0`
 4. Ideally test this release on Windows, linux and MacOS using `http://localhost:8080/#/`
 
 If the image tests correctly, promote the docker image
-from dockerhub `threatdragon/` to dockerhub `OWASP/threat-dragon/v2.2.0`.
+from dockerhub `threatdragon/` to dockerhub `OWASP/threat-dragon/v2.3.0`.
 
 There is _no going back_ on this last step, so it is deliberately left as a manual task:
 
 ```text
-docker pull --platform linux/x86_64 threatdragon/owasp-threat-dragon:v2.2.0
-docker tag threatdragon/owasp-threat-dragon:v2.2.0 owasp/threat-dragon:v2.2.0
-docker push owasp/threat-dragon:v2.2.0
-docker pull owasp/threat-dragon:v2.2.0
-docker tag owasp/threat-dragon:v2.2.0 owasp/threat-dragon:stable
+docker pull --platform linux/x86_64 threatdragon/owasp-threat-dragon:v2.3.0
+docker tag threatdragon/owasp-threat-dragon:v2.3.0 owasp/threat-dragon:v2.3.0
+docker push owasp/threat-dragon:v2.3.0
+docker pull owasp/threat-dragon:v2.3.0
+docker tag owasp/threat-dragon:v2.3.0 owasp/threat-dragon:stable
 docker push owasp/threat-dragon:stable
 ```
 
@@ -67,9 +96,9 @@ grep sha512 latest.yml | head -n 2 | tail -n 1 | cut -d ":" -f 2 | base64 -d |
 - Confirm SHA512 with:
 
 ```text
-echo "$(cat checksum-linux.yml) Threat-Dragon-ng-2.2.0.AppImage" | sha512sum --check
-echo "$(cat checksum-mac.yml) Threat-Dragon-ng-2.2.0.dmg" | sha512sum --check
-echo "$(cat checksum.yml) Threat-Dragon-ng-Setup-2.2.0.exe" | sha512sum --check
+echo "$(cat checksum-linux.yml) Threat-Dragon-ng-2.3.0.AppImage" | sha512sum --check
+echo "$(cat checksum-mac.yml) Threat-Dragon-ng-2.3.0.dmg" | sha512sum --check
+echo "$(cat checksum.yml) Threat-Dragon-ng-Setup-2.3.0.exe" | sha512sum --check
 ```
 
 - upload `checksum*.yml` files
@@ -82,19 +111,21 @@ Edit the 'What's Changed' to filter out any chores.
 
 Then update the release notes for the draft in the [Threat Dragon release area][area]
 using the release notes using markdown provided by `.release-note-template.md` as a template,
-making sure to revise `2.x.x` to the correct version number such as `2.2.0`
+making sure to revise `2.x.x` to the correct version number such as `2.3.0`
 
 Promote the release from draft to public once everything is in place
 
 ### Announce
 
 Update the [releases tab][releases] and the [info pane][td-info] on the OWASP Threat Dragon project pages.
 
-Finally ensure Threat Dragon announces the new release, for example on the OWASP slack channels
+Finally ensure Threat Dragon announces the new release on the [OWASP Threat Dragon][td-slack] slack channel
+and any other relevant channels
 
 [area]: https://github.com/OWASP/threat-dragon/releases
 [heroku]: https://id.heroku.com/login
 [herokucli]: https://devcenter.heroku.com/articles/heroku-cli#install-the-heroku-cli
 [herokudash]: https://dashboard.heroku.com/apps
 [releases]: https://github.com/OWASP/www-project-threat-dragon/blob/main/tab_releases.md
 [td-info]: https://github.com/OWASP/www-project-threat-dragon/blob/main/info.md
+[td-slack]: https://owasp.slack.com/messages/CURE8PQ68

td.server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "threat-dragon-server",
-  "version": "2.2.0",
+  "version": "v2.3.0-RC1",
   "private": true,
   "scripts": {
     "audit": "npm audit",

td.vue/package.json

@@ -1,7 +1,7 @@
 {
   "name": "threat-dragon",
   "productName": "Threat Dragon",
-  "version": "2.2.0",
+  "version": "v2.3.0-RC1",
   "private": true,
   "scripts": {
     "audit": "npm audit",