ReARM 26.07.158

For more details, see release on ReARM Public Demo.

PURL: pkg:github/relizaio/rearm@26.07.158
TEI: urn:tei:purl:demo.rearmhq.com:pkg:github/relizaio/rearm@26.07.158

This is a major release. It lands a full notifications platform on ReARM (with policies and additional integrations on ReARM Pro), multi-source CISA KEV with per-org configuration, a substantially deeper VEX/VDR import path, a new Distribution module in Rebom, simplified ReARM CE self-installation which also includes an optional bundled zot OCI registry, and component ownership + approval routing — alongside a broad round of UI reliability work and a platform bump to Spring Boot 4.1.0 / Java 25.

Also ReARM's Helm Chart for Dependency-Track 5 is now open-sourced with its first release 0.1.3 published.

Features

• Notifications: channels, subscriptions, inbox & delivery history — the new notification system now includes per-channel subscriptions with policies (Pro only) and personalized inboxes. ReARM Pro includes additional options for Email notifications, Microsoft Sentinel, custom Webhooks. ReARM CE continues to support Slack and MS Teams integrations with new inbox and additional configurations. (#128, #221, #174, #135, #167, #168, #171, #139, #138, #159, #173, #176).
• CISA KEV, VulnCheck KEV — multi-source — a per-org KEV backend (#147) plus multi-source activation across mirror, scheduler and UI ungate (#144), per-org CISA + VulnCheck catalog cards (#146), KEV badges on the analysis, changelog, home and trend surfaces (#137), and a KEV details modal (#136) moved onto a per-source assertion contract (#142).
• VEX & VDR — KEV backend with VEX import details (#201), updated VEX fields and support for SCE all-component artifacts (#207), free-form key artifact upload with VEX parser improvements (#203), reporting of attestation-deferred VEX statements with conditional claims documented in the skill (#205), and an honest import-outcome report replacing the misleading "processing" toast (#200).
• Distribution module (ReARM Pro only, preview) — clients / sites / shipments with device classification.
• Simplified ReARM CE Deployment, Bundled zot OCI registry — a zot registry bundled into the OCI Artifact Service, on by default and configured via .env (#209), with matching opt-in support in the Helm chart (#220).
• Component ownership & approvals (Part of this is only in ReARM Pro) — a durable-owner picker with ownership status on Component Settings (RFC Phase 4) (#228), component team metadata plus a Needs my approval bell-drawer tab (#132), and actionable approval events (Phase 4b) (#133).
• Finding changes over time — a new Finding changes over time changelog tab (board #37) (#163), the ALL_POSTURE scope toggle wired into the over-time timeline drawer (F5) (#191), branch shown on timeline drawer rows (F7b) (#193), capped inline attribution with a "+N more" drill-down drawer (#180), and Newly-KEV / Severity-up tooltips clarified as open-findings-only (F9) (#192).
• GitHub App integration (ReARM Pro only) — a Test credentials button for an unsaved key + App ID (#157), a Test connection button with inbound/outbound clarity (#153), an editable key/App ID in the edit modal, BEAR-style (#151), and an optional integration link with honest copy (#155).
• Dependency-Track 5 Support — ReARM now supports Dependency-Track 5, includes a Dependency-Track version badge on the integration card (#196) and an admin force re-upload icon (#129).
• DevOps module improvements (ReARM Pro Only) — deployment failures surfaced on the instance view, backend and UI (#215).
• BOM capture (Rebom) — CPE/licenses capture, required-qualifier preservation and CPE-canonical components (#120), with distro and epoch qualifiers preserved in canonical purls (#181).
• Keycloak configuration hardening — PKCE login with refresh-failure recovery and a break-glass IdP hint, across the UI and Keycloak (#141).

Bug Fixes

• Notifications — the non-admin inbox bell uses the server channelName and drops the admin channel fetch, with a severity-column fix (#160); a drift-tolerant catalog + delivery history (#170) and schema-drift fallbacks for subscriptions, groups and approvals lists (#175) keep the inbox from blanking on GraphQL schema drift (#169); output-only presetConfig no longer leaks into NotificationFilterInput (BUG 1) (#219); Slack/Teams catalog cards render their notification channels (#161); disabled/misconfigured channels render distinctly (#177); Delivery History gains an expandable payload and event-scoped deep link (BUG 3, BUG 4) (#223) alongside affected-release deep links and labeled stale channels (BUG 5, BUG 2) (#222); the inbox uses CSS ellipsis instead of JS slicing for title/description (#131); form honesty on the subscription form with the dead VEX event type hidden (#32) (#172); plus the notifications hint RouterLink and copy rework, an n-dialog-provider wrap so useDialog works downstream, an unfiltered tab badge refreshed by loadInbox, and inbox-tab loading on direct URL mount.
• Approvals (ReARM Pro only) — an explanation of why "Needs my approval" is empty for an admin with no role (#166); in-flight approval-request loads invalidated on release switch (#134); the hidden 3-state disapprove checkbox split into separate controls (#165); a segmented approve/reject control with the admin override check unshadowed (#218).
• Releases & SCE — commit-scoped SCE artifacts now show on every release sharing the commit (#206); the child-release query no longer asks for a nonexistent DigestRecord field (#224); side-by-side views no longer read release/artifact fields that return nothing (#225); the component changelog prefers the window posture-diff over release-pairwise findings (#211); rejected releases show Release rejected instead of an eternal "Scan pending" (#182).
• Findings over time — SEVERITY_DECREASED and KEV_REMOVED render in the over-time view (#190).
• BOM enrichment (Rebom) — VDR component enrichment binds the merged SBOM with the CycloneDX parser (#239); non-SPDX license ids are sanitized to freeform names at capture (#126).
• Dependency-Track — dtrackFetchSkipUntil is stored as clean ISO-8601 and tolerates timezoned data.
• UI reliability — route swaps suspend at their own boundary to stop intermittent stacked layout (#194); the VEX toast handles zero statements and surfaces backend messages (#204); saving an empty GitHub App key is blocked (B6 customer P1) (#149).
• Helm — the CE chart no longer names a pull secret that does not exist (#241); hardening settings and graceful updates; a bare CP-1252 em-dash replaced with UTF-8 in chart comments (#145).

Performance Improvements

• Significant rewrite of Dependency-Track integration, including Dependency-Track 5 support.
• The most-vulnerable widget and findings over time chart performance improvements (#184).
• CVE release search is bounded, with a truncation note rendered for capped results (#183).
• The Dependency-Track badge and status-poll artifact sweeps are component-scoped (#212).

Chores

• Permissions — help tooltips on every permission function (#199).
• Platform — Spring Boot 4.1.0, Keycloak 26.7.0, npm re-resolve, Go bumps and base image refresh across all components (#185); netty 4.2.14.Final → 4.2.15.Final (#187); nginx base image and dependency bumps (#242).
• Security — security headers + CSP (Report-Only) on the SPA nginx (#124).