ReARM 26.08.95

For more details, see release on ReARM Public Demo.

PURL: pkg:github/relizaio/rearm@26.08.95
TEI: urn:tei:purl:demo.rearmhq.com:pkg:github/relizaio/rearm@26.08.95

This release makes Team a first-class entity — the org's addressable unit for ownership, notification routing and assignment rules. Alongside it: KEV as a chart series with a matching findings filter, per-component support status with EOS/EOL attestation in exported BOMs (ReARM Pro), and a substantial round of correctness work on the OCI Artifact Service and Rebom around digest-validated BOM fetches, additionally ReARM Pro gains instance-event deployment notifications, one route per subscription with every filter in one place,

Features

• Teams — the org's addressable unit — a new Teams tab to create and edit teams (#276), with member roles (#230), org-wide regex assignment rules and a clear-owner action (#244), and team notification channels usable as a route target (#248). Component and notification pickers now point at Team rather than User Group (#278), a team can turn on notifications for the components it owns (#285), and owner assignment joins the staged component-settings save flow (#287). On ReARM Pro the backend gains the Team entity itself, ownership and notification routing through it, org-wide regex assignment rules, and a subscription scope covering one team's components.
• Notifications — instance-event deployment notifications (ReARM Pro only), with the subscription UI to drive them (#293); one route per subscription with every filter gathered in one place (#272); an owner-routing target on subscription routes (#258); a tidier subscription editor with durability hidden (#282); and CE now exposes what the CE backend already allows (#249). ReARM Pro adds CEL filter validation at save time and a notifyComponentOwner route target.
• KEV — KEV series support on the findings-over-time charts with a series filter (#252), and a KEV-only filter in the findings modal that arrives pre-enabled when opened from the KEV chart series (#261).
• Findings & changelog — release-level findings recompute, plus select/deselect-all on the chart filter (#256); changelog re-scan visibility, showing over-time changes in NONE mode with arrival-dated attribution and a baseline label (#251).
• Support status & EOL (ReARM Pro) — per-SBOM-component support status with EOS/EOL storage and attestation, and per-component support facts injected into the exported CycloneDX BOM.
• VEX — linkified component / branch / release on VEX proposals (#266), resolve a human-readable scope on VEX statement proposals.
• Rebom — digest-validated BOM fetches now tolerate the enrichment write race (#268).

Bug Fixes

• OCI Artifact Service — the raw-BOM repository pointer and a digest-aware raw fetch, which together fix a false "Digest validation failed" (#263); repository-name validation and an ORAS client cache (#289).
• Rebom — built-in BEAR enrichment now skips purl types it cannot resolve rather than failing the document (#288).
• UI reliability — query-only navigation no longer remounts the whole view (#286); the container execs the real process so it becomes PID 1 and can be signalled (#269); a single v-slot destructure that had been breaking npm run dev is fixed (#275); ESLint is migrated to flat config so lint runs again (#243).
• Notifications — delivery-status filters now match what the backend writes, in both directions (#271); a subscription test that legitimately delivers nothing no longer claims "still processing" for 60 seconds (#270); the PREVIEW subscription status is no longer offered, since selecting it silently did nothing (#197).
• Findings, VEX & TEA — re-scan finding changes render in the org-wide changelog NONE mode (#260); long lines wrap in the VEX proposal's original-statement JSON (#250); CISA KEV modal labels no longer wrap mid-label (#262); the TEI is no longer double-decoded and TEA errors are no longer swallowed (#265).
• ReARM Backend — a large correctness pass, notably: integration is serialized per feature set so concurrent triggers cannot mint duplicate product releases; approval_events (ReARM Pro) is made unwritable by JPA so no release save can erase a committed vote, and concurrent votes are no longer silently lost; RELEASE_LIFECYCLE_CHANGED covers all eleven lifecycles rather than four; duplicate component registrations from VCS-based resolution are stopped and repaired; and the JVM is exec'd so it becomes PID 1 and receives SIGTERM.

Code Refactoring

• The External Members editor is withdrawn as nothing ever notified them (#274), and the owner suggestion and Component Leads editor are removed (#273) — all superseded by Teams.

Chores

• Dependencies & CVEs — npm dependencies refreshed and container CVEs taken to zero (#295); the OCI Artifact Service moves to Go 1.26.6 and a scratch release image (#296).