Sprint Responsible: 57

[Skarlso]

Responsibilities:

Release Responsible: Responsible for the ocm library release and for setting up corresponding issues to track the releases (and patches). You can find the release process documentation here. @jakobmoellerdev will support you!

Scrum Master: Responsible for moderating, taking meeting notes and follow up tasks for our regular scrum meetings! 📝

Support Coordinator: Responsible for monitoring our slack support channels #sap-tech-ocm #sap-ext-ocm-project and github issues!

Security Responsible: Responsible for monitoring and triaging security issues as described in the OCM Security Compliance / Triage Guidelines!

Dependabot Updates: Responsible for taking care of the dependabot updates for the main repositories! ⏫

Done Criteria

• Security Triage Efforts
• Release OCM as per Release Decision according to the Plan
  • Release created for last release candidate AND follow up PRs checked (ocm-website, ocm-piper-cli, brew, ...)
  • Bump PR for release branch merged
  • Release Branch Cutoff performed
  • Bump PR for main branch merged
  • Release Candidate created for Cutoff branch
• Release ocm v2 (cli)
  • New release branch created (e.g releases/v0.17)
  • CLI RC created and verified (v0.17-rc.1)
  • Controller RC created and verified (v0.17-rc.1)
    • Workflow not ready yet
  • CLI Final promoted from last RC (v0.16-rc.1 --> v0.16.0)
    • First RC
  • Controller Final promoted from last RC (v0.16-rc.1 --> v0.16.0)
    • Workflow not ready yet
  • Both releases visible on GitHub Releases page (v0.16.0)
• Merged / Handled Dependabot updates for org (checked / triaged)
• Clone this issue for the next Sprint and plan a handover for the next assignee in the rotation (assign the issue to the next person on rotation)

Follow ups

• (if applicable)

Releases

Previous #867

[Skarlso]

Ugh, with the latest update round yesterday, new security issues popped up. I'm taking a look at them now.

[Skarlso]

Minimatch alert is... weird. It looks like it's a transitive from the github action javascript flow

    "node_modules/minimatch": {
      "version": "3.1.2",
      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",

[Skarlso]

Okay, CVE-2026-26996 was backported, so we should be okay if we just update the package json really. 🤞

I tried updating to the latest but that breaks glob and other things.

[Skarlso]

Fixed the above by updating the package lock open-component-model/open-component-model#1825

[frewilhelm]

Published RC 0.36.0 https://github.com/open-component-model/ocm/actions/runs/22340124016