ReARM 26.07.158: Notifications, Dependency-Track 5, and Simpler CE Deployment

We're announcing a major release of ReARM v26.07.158. Detailed information is available on its release view on the ReARM Demo instance. ReARM Pro installations have already been upgraded; ReARM CE users are encouraged to upgrade to benefit from the changes described below.

Notifications

The headline of this release is a reworked notifications platform. ReARM now models notification channels, subscriptions that decide which events reach which channels, and channel groups for fanning a single subscription out to several destinations. Every delivery is recorded, so there is a delivery history showing what was sent, where it went, and whether it succeeded — with an expandable payload and deep links back to the release or event that triggered it. Alongside this, each user gets a personalized inbox: a bell in the top navigation with unread counts, severity, filtering, and read state that follows the user rather than the browser.

Supported destinations include Slack, Microsoft Teams, generic HTTPS webhooks with optional bearer-token or HMAC-SHA256 signing, email digests, and Microsoft Sentinel via the Azure Log Analytics ingestion API. Subscriptions can be scoped by event type and severity, and on ReARM Pro they can carry expression-based policies for finer-grained routing. The personalized inbox is available on both editions, and channel configuration is part of ReARM Pro in this release — Slack and Microsoft Teams channels will become available on ReARM CE in future releases.

Dependency-Track 5

ReARM now supports Dependency-Track 5. The Dependency-Track integration has been substantially rewritten as part of this work, and the integration card in Organization Settings now displays the Dependency-Track version ReARM has detected, so it is immediately clear which backend an organization is talking to.

Organization administrators also get a force re-upload control. This is not a per-BOM action: it re-submits every project for the organization and triggers a full re-analysis, so an organization's entire Dependency-Track state can be rebuilt from ReARM. It is heavier than a routine sync and is intended for recovery — for example after a Dependency-Track migration, or when rebuilding an instance from scratch. Dependency-Track 5 support is available on both ReARM CE and ReARM Pro.

A Helm Chart for Dependency-Track 5

We are also open-sourcing the Helm chart we use to run Dependency-Track 5 for ReARM, published with its first release, 0.1.3. It lives in the ReARM repository under deploy, which is MIT licensed, and wraps the official Dependency-Track chart rather than replacing it.

ReARM works with any Dependency-Track instance, so this chart is purely a convenience for teams that do not already run one. It proxies the API through the frontend rather than routing it at the ingress, which is also where it configures gzip compression and security headers, and means both URIs you enter into ReARM are the same value. Alongside that it brings an optional bundled PostgreSQL with simple backups, optional Traefik IngressRoute support with a straightforward Let's Encrypt certResolver configuration, and database and key-encryption credentials generated on first install and preserved across upgrades. See the documentation for details.

Simpler ReARM CE Deployment

Installing ReARM CE no longer requires bringing your own OCI registry. Both the Docker Compose stack and the Helm chart can now run a bundled zot registry for BOM and artifact storage — enabled by default in Compose and opt-in for Helm — so a first installation needs no external registry and no credentials of your own. An external registry remains fully supported for anyone who prefers one. The Compose stack has also been consolidated onto a single optional .env file, and a localhost deployment now needs no configuration at all. The installation documentation has been rewritten around this.

Known Exploited Vulnerabilities

This release introduces KEV support in ReARM. Known Exploited Vulnerability data is configured per organization and can be sourced from both the CISA catalog and VulnCheck, with each source recorded as its own assertion rather than collapsed into a single flag — so it is clear which catalog flagged a vulnerability. KEV status is surfaced across the analysis view, the changelog, the home dashboard and trend widgets, with a details modal showing the underlying assertions, including ransomware-campaign context where a source provides it. KEV support is available on both editions.

VEX, VDR and Findings Over Time

The VEX and VDR import path is substantially deeper this release, including support for source-code-entry all-component artifacts, free-form key artifact upload, and reporting of attestation-deferred statements. Imports now report the result in detail — how many statements were applied and how many found no matching finding — so a partial import is visible at a glance instead of needing to be inferred from the data afterwards. A new Finding changes over time changelog tab tracks how a component's findings move between scans, with newly-KEV and severity-increase attribution, branch context, and drill-down into the individual findings behind each change.

Distribution and Component Ownership

ReARM Pro gains a preview of a new Distribution module, covering clients, sites and shipments with device classification. Component ownership metadata lands alongside it, with approval routing and the Needs my approval queue available on ReARM Pro.

Platform Upgrade

The backend moves to Spring Boot 4.1.0 and Java 25, with Keycloak 26.7.0 and a base image refresh across all components. Keycloak login is hardened with PKCE and refresh-failure recovery, and the UI is now served with security headers and a Content-Security-Policy.

Dependency Updates

This release contains a number of dependency updates, including those fixing underlying CVEs in dependencies. ReARM users are encouraged to upgrade to this release to benefit from these fixes.

Release Identification

We are continuing to publish TEIs for all ReARM releases. TEI for this release: urn:tei:purl:demo.rearmhq.com:pkg:github/relizaio/rearm@26.07.158.