Informative list of tasks and dependencies related to mapping and requirement (re)numbering

Just for your information, what kind of tasks do we.. (I?) have and what are the dependencies between them

Updated 2025-03-20 - as removing CWE is part of those tasks, I applied those steps here

• Activities that makes work after reordering easier
  • All content of requirements are in - (soft requirement) later it is annoying to track changes
    • For tracking
  • Requirements texts as style finetuned (soft requirement) (listed in #2555)
  • Levels are defined (especially L1)
  • Levels are changed - required for reordering, that L1 requirements come first (#2690)
• Prep to keep v4.0.3 to v5.0.BE mapping and store the CWE mapping just in case
  • step 1.1 - Update current mapping tags to include version (v4.0.3 or v5.0.BE [bleeding edge] requirement)
    • We skip this and extract mapping directly to a separate (yaml) file
  • step 1.2 - Export current CWE mapping to v5.0.BE into a separate file
    • PR #2765
  • step 1.3 - Remove CWE column (#2589
    • PR #2765
  • step 1.4 - v4.0.3 to v5.0.BE mapping tags are exported to a separate file - precondition for placeholder cleanup.
    • PR #2777
  • step 1.5 - Current requirement number ("v5.0.BE / bleeding edge req number") is copied/duplicated to last/additional column to keep info on where the requirement was located before reordering / renumbering.
    • PR #2778
  • step 1.6 - Remove modification tag from requirement text
    • If those values require changes it must be done in the mapping files
    • PR #2829
• "Rebuild" the document
  • step 2.1 - Remove empty placeholders for deleted and moved requirements. Close section gaps.
    • PR #2779
  • step 2.2 - Reorder requirements into correct order, based on level.
    • PR #2784
  • step 2.3 - Reorder chapters and sections (#2553)
    • PR #2803
  • step 2.4 - Renumber everything
    • PR #2804
      • Renumbering titles: https://github.com/OWASP/ASVS/pull/2804/commits/ceeede9a451b1320fa553a3299d687b8becfe7b5
      • Renumbering requirements: https://github.com/OWASP/ASVS/pull/2804/commits/9ae401bb433ec6724470ecd7646a6608d683d32f
  • step 2.5 - Update all numeric references from texts (a'la points to precise requirement or section by number)
  • step 2.6 - Update github chapter labels to contain both numbers
• Update mapping to now also include v4.0.3 to v5.0.0 mapping
  • step 3.1 - Export mapping from v5.0.be > v5.0.0
    • PR #2807
  • step 3.2 - Generate mapping for v5.0.0 to v4.0.3 and v4.0.3 to v5.0.0 into separate files
    • PR #2807
  • step 3.3 - Provide web-output of mapping to https://asvs.dev
    • Not integrated to the nice UI, but for validation it is available:
      • https://asvs.dev/mapping_v5.0.0_to_v4.0.3.html
      • https://asvs.dev/mapping_v4.0.3_to_v5.0.0.html
  • step 3.4 - Validate the mapping
  • Steps 3.1 .. 3.4 must be repeated after any new requirements, modification, re-ordering
• Cleanup - those steps will be done right before v5.0.0 release
  • step 4.1 - Remove additional column with old requirement number
    • PR #3150
• Those steps can be done after v5.0.0 release
  • step 5.1 - Update CWE mapping to v5.0.BE in a separate file to v5.0 ids (#2334?)
  • step 5.2 - Sort *.yml files
  • step 5.3 - Remove temporary mappings (v4.0.3-v5.0.be, v5.0.be-v4.0.3)

The rest of the document finetuning, related issue for wider scope (than just mapping and renumbering) #2555