Upgrading to v5.0.0-rc.2

Legacy alpine.* and unprefixed property names no longer accepted

This release drops the compatibility shim that translated v4-era alpine.* and unprefixed property names (for example alpine.ldap.enabled, database.url, bcrypt.rounds) into their dt.* equivalents. Migrate any configuration still using those names to the current dt.* properties. The API server refuses to start when it encounters a legacy key to prevent silent misconfiguration.

The original alpine.* to dt.* migration is documented in the v0.7.0-alpha.3 upgrade notes. See Configuration Properties for the authoritative list of supported properties and their corresponding environment variable spellings.

Apologies for introducing breaking changes in an RC build.

Warning

This release renames roughly 100 configuration properties for naming consistency ahead of the GA release. No aliases or backward-compatibility shims exist. Update affected configuration before upgrading.

• Configuration properties renamed. The renames consistently use kebab-case segments and align related properties under shared namespaces. The full list of old-to-new names follows, grouped by section.

  CORS

  Old	New
  dt.cors.allow.credentials	dt.cors.allow-credentials
  dt.cors.allow.headers	dt.cors.allowed-headers
  dt.cors.allow.methods	dt.cors.allowed-methods
  dt.cors.allow.origin	dt.cors.allowed-origins
  dt.cors.expose.headers	dt.cors.exposed-headers
  dt.cors.max.age	dt.cors.max-age

  Durable execution engine

  The run retention unit changed from an ISO-8601 duration to milliseconds.

  Old	New
  dt.dex-engine.maintenance.run-retention-duration=P1D	dt.dex-engine.maintenance.run-retention-ms=86400000
  dt.dex-engine.maintenance.worker.initial-delay-ms	dt.dex-engine.maintenance.worker-initial-delay-ms
  dt.dex-engine.maintenance.worker.interval-ms	dt.dex-engine.maintenance.worker-interval-ms
  dt.dex-engine.metrics.collector.*	dt.dex-engine.metrics-collector.*

  File storage

  Old	New
  dt.file-storage.local.compression.level	dt.file-storage.local.compression-level
  dt.file-storage.s3.access.key	dt.file-storage.s3.access-key
  dt.file-storage.s3.compression.level	dt.file-storage.s3.compression-level
  dt.file-storage.s3.secret.key	dt.file-storage.s3.secret-key

  General

  Old	New
  dt.config.log.values	dt.config.log-values
  dt.data.directory	dt.data-directory
  dt.telemetry.submission.enabled.default	dt.telemetry.submission.default-enabled
  dt.tmp.delay.bom.processed.notification	dt.tmp.delay-bom-processed-notification

  HTTP

  The HTTP connect timeout unit changed from seconds to milliseconds. Note that the standard HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables are still supported.

  Old	New
  dt.http.proxy.address	dt.http.proxy.host
  dt.http.proxy.password	dt.http.proxy.auth.password
  dt.http.proxy.username	dt.http.proxy.auth.username
  dt.http.timeout.connection (seconds)	dt.http.connect-timeout-ms (milliseconds, default 30000)
  dt.no.proxy	dt.http.proxy.exclusions

  Init tasks

  Old	New
  dt.init.and.exit	dt.init-tasks.exit-after-completion
  dt.init.task.database.migration.enabled	dt.init-task.database-migration.enabled
  dt.init.task.database.partition.maintenance.enabled	dt.init-task.database-partition-maintenance.enabled
  dt.init.task.database.seeding.enabled	dt.init-task.database-seeding.enabled
  dt.init.task.dex.engine.database.migration.enabled	dt.init-task.dex-engine-database-migration.enabled
  dt.init.tasks.datasource.close-after-use	dt.init-tasks.datasource.close-after-completion
  dt.init.tasks.datasource.name	dt.init-tasks.datasource.name
  dt.init.tasks.enabled	dt.init-tasks.enabled

  LDAP

  Old	New
  dt.ldap.attribute.mail	dt.ldap.mail-attribute
  dt.ldap.attribute.name	dt.ldap.name-attribute
  dt.ldap.auth.username.format	dt.ldap.username-format
  dt.ldap.basedn	dt.ldap.base-dn
  dt.ldap.bind.password	dt.ldap.bind-password
  dt.ldap.bind.username	dt.ldap.bind-username
  dt.ldap.groups.filter	dt.ldap.group-filter
  dt.ldap.groups.search.filter	dt.ldap.group-search-filter
  dt.ldap.security.auth	dt.ldap.security-auth
  dt.ldap.server.url	dt.ldap.server-url
  dt.ldap.team.synchronization	dt.ldap.team-synchronization
  dt.ldap.user.groups.filter	dt.ldap.user-groups-filter
  dt.ldap.user.provisioning	dt.ldap.user-provisioning
  dt.ldap.users.search.filter	dt.ldap.user-search-filter

  OIDC

  Old	New
  dt.oidc.auth.customizer	dt.oidc.auth-customizer
  dt.oidc.client.id	dt.oidc.client-id
  dt.oidc.team.synchronization	dt.oidc.team-synchronization
  dt.oidc.teams.claim	dt.oidc.teams-claim
  dt.oidc.teams.default	dt.oidc.default-teams
  dt.oidc.user.provisioning	dt.oidc.user-provisioning
  dt.oidc.username.claim	dt.oidc.username-claim

  Task Scheduling

  Old	New
  dt.task.defect.dojo.upload.cron	dt.task.defect-dojo-upload.cron
  dt.task.epss.mirror.cron	dt.task.epss-mirror.cron
  dt.task.fortify.ssc.upload.cron	dt.task.fortify-ssc-upload.cron
  dt.task.git.hub.advisory.mirror.cron	dt.task.github-advisory-vuln-data-source-mirror.cron
  dt.task.kenna.security.upload.cron	dt.task.kenna-security-upload.cron
  dt.task.metrics.maintenance.cron	dt.task.metrics-maintenance.cron
  dt.task.nist.mirror.cron	dt.task.nvd-vuln-data-source-mirror.cron
  dt.task.osv.mirror.cron	dt.task.osv-vuln-data-source-mirror.cron
  dt.task.package.metadata.maintenance.cron	dt.task.package-metadata-maintenance.cron
  dt.task.project.maintenance.cron	dt.task.project-maintenance.cron
  dt.task.tag.maintenance.cron	dt.task.tag-maintenance.cron
  dt.task.vulnerability-policy-bundle-sync.cron	dt.task.vuln-policy-bundle-sync.cron
  dt.task.vulnerability.analysis.cron	dt.task.portfolio-analysis.cron
  dt.task.vulnerability.database.maintenance.cron	dt.task.vuln-database-maintenance.cron
  dt.task.vulnerability.metrics.update.cron	dt.task.vuln-metrics-update.cron

  Vulnerability policy bundle

  Old	New
  dt.vulnerability.policy.bundle.auth.bearer.token	dt.vuln-policy-bundle.auth.bearer-token
  dt.vulnerability.policy.bundle.auth.password	dt.vuln-policy-bundle.auth.password
  dt.vulnerability.policy.bundle.auth.username	dt.vuln-policy-bundle.auth.username
  dt.vulnerability.policy.bundle.url	dt.vuln-policy-bundle.url