Enhancement: more frequent releases

[PenelopeFudd]

Current Behavior:

The last release of DependencyTrack (3.8.0) is from March 2020 (168 days ago).

Proposed Behavior:

Releasing a new version of DependencyTrack every month on the same day, much like Microsoft "Patch Tuesday" or GNU Parallel's regular releases.

I'm not suggesting frantically trying to close all open issues before every release; it's just that the pipeline between the developers and end users appears clogged. :-)

[stevespringett]

Clogged would be an understatement. The issues being added to v4.0 are here:
https://github.com/DependencyTrack/dependency-track/milestone/14. Pull requests are highly encouraged.

• CycloneDX v1.2 had to be worked on, released, and implementations updated. Keep in mind that DT essentially created an industry that didn't exist prior to it (and I'm not referring to SCA). There's a fundamental chicken/egg issue here. Updates to the CycloneDX spec and the implementations need to be made in order for future versions of DT to have specific features in the future.
• The migration from a global component model to per-project component model has taken considerable effort. Migrate Global Component Model to Per Project Model #593
• The upgrade from 3.8 to 4.0 hasn't even been worked on yet. That's likely another month away.
• When looking at the master branch commit history, it's obvious to see why this release is taking so long.

If this project had an army of committers, I would love to release every two weeks. That is not the reality. As mentioned in the DT beta channel on Slack, I am also not happy with the release cadence between 3.8 and 4.0, but it needs to be done. It could have been faster had the project had more volunteers. But it doesn't. Once 4.0 is released, I plan on having releases every 30-60 days.

[PenelopeFudd]

Yeek! You're right, the master branch commit history really does tell the story!

Apologies for the distraction: my Github-navigating skills are still entry-level. :-/

I'd love to contribute, but I'm rather rusty on Java: my PRs might slow things down rather than speed them up.