`/v1/token/{uuid}` deprecated since 4.11.0

[elmuerte]

The BOM upload polling uses /v1/token/{uuid} to test if the BOM processing has been completed.
As of Dependency Track 4.11.0 this has been deprecated in favor of the /v1/event/token/{uuid} endpoint, which was introduced in that release.
The new endpoint does not require any permissions. It has the same request and response as the old endpoint.

[elmuerte]

As this is used for polling after an upload we could first try to use the new API. If that responds with a 404 we could switch over to the old API. Since way we would assume DepTrack 4.11 or later, but still support older versions.

[pmckeown]

Does /v1/token/{uuid} still work in 4.11 - just deprecated right? When is it removed? Assuming 5.X?

Given this is effectively a breaking change, should we introduce a new DT Version config parameter for the plugin to config how it works? This would be a major bump on our side, to 2.X. 2 would still work with DT 4.X but would require an explicit parameter to tell the plugin what version of the server it is targeting. This would allow us to target specific APIs for this change, and as and when they change in the future, without the need for API error logic to determine which endpoints to use.

What are your thoughts on this?

[elmuerte]

The old endpoint is still present in the current 5.0 release. I have no idea when they are planning to actually remove it. There is an old issue with the same question, but no response yet.
Both endpoints have basically the same logic, the new one just doesn't need a special privilege and has a more generic name (suitable to monitor other background tasks).

[pmckeown]

Right, I guess in that case, your suggestion is the more pragmatic approach for now then. When the old endpoint is removed, the feature will continue to work, and a clean up task can happen at some point in the future after that.