Dependency-Track Should Perform Update Check

[msymons]

Current Behavior

Unlike many CI/CD servers (eg Jenkins, SonarQube, Nexus Reposiitory Manager), Dependency-Track does not inform the administrator when a new version of DT is available.

Proposed Behavior

Dependency-Track should perform a regular check for latest version and clearly inform the administrator when an update is available.

If implemented in 4.12 and running 4.12, the MVP would be to inform that 4.12.1 or 4.13 is available. Ideally, the notification might separately also state that 5.0.0 is available... eg, inform of "minor/patch version update available" AND "major version update available"

The notification should also include a link (links) to release notes.

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this enhancement was already requested

[nscuro]

Assigning this to myself, since this requires some organizational stuff to be sorted out. Mainly, we need a publicly accessible endpoint, hosted on the OWASP foundation's cloud infra.

[rkg-mm]

Can't you just query https://docs.github.com/de/rest/releases/releases?apiVersion=2022-11-28 ?

[nscuro]

Can't you just query docs.github.com/de/rest/releases/releases?apiVersion=2022-11-28 ?

Technically yes. And in fact that is most likely what we'll end up querying behind the scenes. However, update checks are also be a good way for us to get an overview over what versions people are currently using.

We are blind in this regard today, but this information will become increasingly critical to us as we approach general availability of v5. Adoption rates of new versions will help us understand better how soon users are upgrading, or if they don't upgrade at all.

[msymons]

Moving to 4.14 milestone.

v4.13.0 will now be released with an MVP for Telemetry functionality via #4694. An update check would build upon this new functionality... but cannot make it into 4.13.0 itself unless the release is delayed.