GA Roadmap

[nscuro]

This issue acts as a roadmap towards making Hyades generally available.

Features

Features that must be implemented before Hyades can be considered GA.

• Use liquibase to deploy schema changes in api server #774
• Use PgBouncer for centralized database connection pooling #702
• Provide a way to configure more Kafka Streams and Kafka Producer properties in API server #656
• Re-implement fuzzy analysis for internal scanner #645
• Cel policy evaluator for version distance policy evaluator #866
• Support SPDX expression matching in CEL policies #872
• Distribute system identifier to all services #925
• Migrate EPSS mirroring to mirror-service #926
• Revisit configuration management to support modification via UI #929
• Remove / reduce usage of Kafka Streams
  • Investigate usage of Confluent's parallel consumer #346
  • Automatically pause Kafka consumers when database is down #901
  • Implement wrapper around KafkaConsumer to support batch consumption with head of line blocking #907
• [] Externalize BOM ingestion pipeline #633

Bugfixes

Bugs that must be fixed before Hyades can be considered GA.

• Broken OSV Integration  #1023
• Performance regression: Preparing IntegrityMetaComponents after BOM processing takes too long #1306
• Defect Dojo sync frequency from webui is ignored #1484
• Defect Dojo integration require a server restart #1485

Miscellaneous

Other things that need doing before Hyades can be considered GA.

• Port DT Release 4.9.0 changes to Hyades #858
• Port changes from 4.9.1 #887
• Default to Apache Kafka instead of Redpanda #854
• Clean up package structure to avoid split package usage #883
• Rename org.hyades packages to org.dependencytrack #884
• Port changes from upstream DT release 4.10.x #983
• Create hyades-frontend repository #986
• Port changes from upstream DT release 4.11.x #1190
• Move Helm chart to DependencyTrack/helm-charts #1226
• Unify versions #1300
• Port changes from upstream DT release 4.12.x #1358
• Remove REST endpoints, fields that were deprecated in v4.x #1428
• (Add more)

Documentation

Aspects of Hyades that require documentation coverage before it can be considered GA.

• Document differences between Dependency-Track 4.x and Hyades / DT 5.x #927
• Add documentation for production deployment #928
• Add documentation for vulnerability policies #997
• Create developer documentation #1174
• (Add more)

Migration

Organizations using vanilla Dependency-Track today must be able to migrate to Hyades. How do we enable that?

• Provide a solution to migrate from MySQL or MSSQL to PostgreSQL #881
• (Add more)