Deprecate and remove DAST_CRAWL_EXTRACT_ELEMENT_TIMEOUT and DAST_CRAWL_SEARCH_ELEMENT_TIMEOUT variables
Deprecation Summary
The DAST variables DAST_CRAWL_EXTRACT_ELEMENT_TIMEOUT
and DAST_CRAWL_SEARCH_ELEMENT_TIMEOUT
are being deprecated. These variables, which were intended to control browser interaction timeouts in Browser-Based DAST scanning, have not been functional since Browser-Based DAST was introduced due to an underlying implementation issue. The variables were meant to provide granular timeout controls for specific browser interactions, but these interactions are currently governed by a common timeout value, and the variables are not needed. Removing them will simplify the available configuration options for DAST, which improves the onboarding experience for customers.
Documentation
- Deprecation notice: merge request
- Migration guidelines: add link
- etc.
Product Usage
These variables have not been functional since Browser-Based DAST was introduced. There have been no recorded customer requests or complaints about these variables not working, suggesting minimal impact on user workflows. The variables were originally intended to constrain particular browser interactions, but these interactions are now effectively managed by a common timeout value.
Breaking Change?
Does this deprecation contain a breaking change? No
This deprecation is not considered a breaking change since the variables have never been functional in the Browser-Based DAST implementation. Their removal will not impact any working configurations or pipelines as they currently have no effect on system behavior.
Affected Customers
Who is affected by this deprecation:
- GitLab.com
- Self-managed
- Dedicated
Pricing tiers impacted:
- GitLab Free
- GitLab Premium
- GitLab Ultimate
[ ] Internal note outlining details of customer impact has been created
Deprecation Milestone
This deprecation will be announced in milestone: 17.9
Planned Removal Milestone
The feature / functionality will be removed in milestone: 18.0
Links
https://gitlab.com/gitlab-org/gitlab/-/issues/515733+s
Checklists
Timeline
Rollout Plan
- DRI Engineers:
@DavidNelsonGL
,@hbakergitlab
- DRI Engineering Manager:
@Kopel
-
Describe rollout plans on GitLab.com
-
_Link to _a feature flag rollout issue that covers:
- Expected release date on GitLab.com and GitLab version
- Rollout timelines, such as a percentage rollout on GitLab.com
- Creation of any clean-up issues, such as code removal
-
_Link to _a feature flag rollout issue that covers:
- Determine how to migrate users still using the existing functionality
- Document ways to migrate with the tooling available
- Automate any users who have not yet migrated, but ensure it's a two-way door decision
Communication Plan
- DRI Product Manager:
@johncrowley
An internal slack post and a release post are not sufficient notification for our customers or internal stakeholders. Plan to communicate proactively and directly with affected customers and the internal stakeholders supporting them.
Internal Communication Plan
-
Create an internal note in the comment thread of this issue with a comprehensive narrative of customer impacts, with the intended audience of internal stakeholders who directly interact with customers.
- Consider: what will the CSM / AE / SA teams need to tell their customers? What will they want to know about customer sentiment and impact?
- If customers must take an action, include in this internal note the following information: what action is needed, the steps they can take to complete it, the due date for that action, and the consequences of not completing the action in time.
- Internal announcement plan (timeline for notifications, audience, channels, etc)
-
Support and enablement plan
- Support readiness: Document how the support team should handle tickets related to this deprecation / breaking change.
- Customer Success readiness: Ensure the CS team knows how to bring questions or concerns from clients to the right internal team members.
External Communication Plan
- Customer announcement plan (timeline for notifications, audience, channels, etc)
- Ensure you have approvals from legal and corp comms for any communication being sent directly to customers.
-
As soon as possible, but no later than the third milestone preceding the major release, ensure that the following are complete (for example, given the following release schedule:
17.8, 17.9, 17.10, 17.11, 18.0
–17.9
is the third milestone preceding the major release).- A deprecation announcement entry has been created so the deprecation will appear in release posts and on the general deprecation page. Add link to the relevant merge request.
- Documentation has been updated to mark the feature as deprecated. Add link to the relevant merge request.
-
On the major milestone:
- The deprecated item has been removed. Add link to the relevant merge request.
- If the removal of the deprecated item is a breaking change, the merge request is labeled breaking change.
-
Document the migration plan for users, clearly outlining the actions they need to take to mitigate the impact of the breaking change.
- Add link
Development
- DRI Engineers:
@DavidNelsonGL
,@hbakergitlab
- DRI Engineering Manager:
@Kopel
-
Measure usage of the impacted product feature
- Evaluate metrics across GitLab.com, Self-Managed, Dedicated
- add issue link
- list any metrics and/or dashboards
-
Create tooling for customers to manually migrate their data or workflows
- add issue link
-
Build mechanism for users to manually enable the breaking change ahead of time
- add issue link
-
Automate the migration for those who do not take any manual steps (ensure the automation can be reverted)
- add issue link
-
Develop rollout plan of breaking change on GitLab.com
- add feature flag rollout issue
-
Dogfood the changes on GitLab.com or a Self-Managed test instance
- add issue link
-
(Optional) Create UI controls for instance admins to disable the breaking change, providing flexibility to Self-Managed / Dedicated customers. Optional as this depends on the breaking change.
- add issue link
Approvals
-
Product Manager
@johncrowley
-
Engineering Manager
@Kopel
-
Senior Engineering Manager
@twoodham
-
Group / Director of Product Management
@sarahwaldner
-
Product / Eng Leaders in the
CPO
orCTO
organizations, as applicable (optional - depends on scope of change)
Keep in mind that approval check boxes and deprecations notices alone are not sufficient communication about breaking changes. Despite having approvals documented here, the PM/EM will still need to take active steps to partner with internal stakeholders and customers to ensure a positive user experience.
Stakeholder Mentions
-
Product Designer
@ProductDesigner
-
Tech Writer
@phillipwells
-
Software Engineering in Test
@SET
-
Any other stable counterparts based on the product categories:
-
Add Sales/CS counterpart or mention
@timtams
-
Add Support counterpart
@kategrechishkina
-
Add Marketing counterpart or mention
@martin_klaus
-
Add Corp comms if direct customer comms are needed
@jmalleo
- Add Product Security counterpart, if relevant to your deprecation
- Mention (in internal note) Customer Success Managers / Acount Managers / Solutions Architects for impacted customers
-
Add Sales/CS counterpart or mention
Labels
-
This issue is labeled deprecation, and with the relevant
~devops::
,~group::
, and~Category:
labels. - This issue is labeled breaking change if the removal of the deprecated item will be a breaking change.