diff --git a/data/deprecations/17-9-ast-da-dast-devtools-api-timeout-env-change.yml b/data/deprecations/17-9-ast-da-dast-devtools-api-timeout-env-change.yml new file mode 100644 index 0000000000000000000000000000000000000000..f61836903ad94980cfa1b91a23191b35927c02cf --- /dev/null +++ b/data/deprecations/17-9-ast-da-dast-devtools-api-timeout-env-change.yml @@ -0,0 +1,20 @@ +- title: "DAST `dast_devtools_api_timeout` will have a lower default value" + removal_milestone: "18.0" + announcement_milestone: "17.9" + breaking_change: true + window: 1 + reporter: DavidNelsonGL + stage: application security testing + issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/517254 + impact: low + scope: project + resolution_role: Developer + manual_task: false + body: | # (required) Don't change this line. + The `DAST_DEVTOOLS_API_TIMEOUT` environment variable determines how long a DAST scan waits for a response from the browser. Before GitLab 18.0, the variable has a static value of 45 seconds. After GitLab 18.0, `DAST_DEVTOOLS_API_TIMEOUT` environment variable has a dynamic value, which is calculated based on other timeout configurations. + In most cases, the 45-second value was higher than the timeout value of many scanner functions. The dynamically calculated value makes the `DAST_DEVTOOLS_API_TIMEOUT` variable more useful by increasing the number of cases it applies to. + end_of_support_milestone: + tiers: [Ultimate] + documentation_url: https://docs.gitlab.com/ee/user/application_security/dast/browser/configuration/variables.html + image_url: + video_url: diff --git a/doc/update/breaking_windows.md b/doc/update/breaking_windows.md index 988bf423af92e4fd4deb6ff34002b8af26bf0095..342569785b9ba895b809c242a72da46e14cdefac 100644 --- a/doc/update/breaking_windows.md +++ b/doc/update/breaking_windows.md @@ -48,6 +48,7 @@ This window takes place on April 21 - 23, 2025 from 09:00 UTC to 22:00 UTC. | [Dependency Scanning for JavaScript vendored libraries](https://gitlab.com/gitlab-org/gitlab/-/issues/501308) | Low | Application_security_testing | Project | | [Dependency Scanning upgrades to the GitLab SBOM Vulnerability Scanner](https://gitlab.com/gitlab-org/gitlab/-/issues/501308) | High | Application_security_testing | Project | | [Resolve a vulnerability for Dependency Scanning on Yarn projects](https://gitlab.com/gitlab-org/gitlab/-/issues/501308) | Low | Application_security_testing | Project | +| [DAST `dast_devtools_api_timeout` will have a lower default value](https://gitlab.com/gitlab-org/gitlab/-/issues/517254) | Low | Application security testing | Project | | [API Discovery will use branch pipelines by default](https://gitlab.com/gitlab-org/gitlab/-/issues/515487) | Low | Application_security_testing | Project | | [Container Scanning default severity threshold set to `medium`](https://gitlab.com/gitlab-org/gitlab/-/issues/515358) | Low | Application security testing | Project | | [Subscription related API endpoints in the public API are deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/515371#note_2319368251) | Low | Fulfillment | Instance | diff --git a/doc/update/deprecations.md b/doc/update/deprecations.md index 43fa9b6f75acc2e8b4abfcc096cc3e64ae9847bf..5681ceae15217148dc32d7711b8f80aea601e317 100644 --- a/doc/update/deprecations.md +++ b/doc/update/deprecations.md @@ -597,6 +597,23 @@ To continue showing these findings, you must configure the `CS_SEVERITY_THRESHOL <div class="deprecation breaking-change" data-milestone="18.0"> +### DAST `dast_devtools_api_timeout` will have a lower default value + +<div class="deprecation-notes"> + +- Announced in GitLab <span class="milestone">17.9</span> +- Removal in GitLab <span class="milestone">18.0</span> ([breaking change](https://docs.gitlab.com/ee/update/terminology.html#breaking-change)) +- To discuss this change or learn more, see the [deprecation issue](https://gitlab.com/gitlab-org/gitlab/-/issues/517254). + +</div> + +The `DAST_DEVTOOLS_API_TIMEOUT` environment variable determines how long a DAST scan waits for a response from the browser. Before GitLab 18.0, the variable has a static value of 45 seconds. After GitLab 18.0, `DAST_DEVTOOLS_API_TIMEOUT` environment variable has a dynamic value, which is calculated based on other timeout configurations. +In most cases, the 45-second value was higher than the timeout value of many scanner functions. The dynamically calculated value makes the `DAST_DEVTOOLS_API_TIMEOUT` variable more useful by increasing the number of cases it applies to. + +</div> + +<div class="deprecation breaking-change" data-milestone="18.0"> + ### Dependency Proxy token scope enforcement <div class="deprecation-notes">