Page Comparison

Jenn Colt is next, followed by Florian Gleixner

Reminder:  Please copy/paste the Zoom chat into the notes.  If you miss it, this is saved along with the meeting recording, but having it here has benefits.

Maccabee Levine

Tod Olson

Jakub Skoczen

Craig McNally

Jenn Colt 

• CC: Maccabee Levine
  • ...No CC this morning
• PC: Tod Olson
  • Call for Ramsons BugFest testers, need to recruit more people to help with upcoming BugFest.
  • Claiming app: Presentation on new app to support workflows to claim missing serials, will entail a new UI module using existing backend. New functionality brought to PC while still in design phase! More detail in the presentation linked in the 2024-10-31 Product Council Meeting Notes
    
    • Presentation: New app proposal - Claiming
• RMS Group:
  • ...Nothing relevant
• Security Team: 
  • We should discuss ownership of mod-graphql see agenda item below.
• Tri-council Application Formalization:  
  • ...Group has paused while POs and App Interaction work on spreadsheet from Taras

• 06 Nov 2024 - Dedicated discussion:  Topic TBDGo continued
• 11 Nov 2024 - Regular TC meeting
• 13 Nov 2024 - Dedicated discussion:  Topic TBD
• 18 Nov 2024 - Regular TC meeting

All

• Craig McNally followed up with VBar on the FQM RFC... 
  • VBar will update with current state and discussions from Wolfcon

Nothing new here.

Check Recurring Calendar...

• Craig McNally made progress on a couple things here...
  • Spoke to Christopher Spalding and got access to Election Runner - Setup was very easy, and free for < 20 voters.
  • Reached out to Boaz Nadav Manes wrt the google form used in the last election for nominations - Still need to see how much of this can be reused.
• It's also come to light that Taras Spashchenko will be leaving the project soon, so we have 2 seats to fill.
• Timing
  • Two weeks for nominations + One week to vote
  • Assuming we can get the word out (and nomination form) by 11 Nov 2024 (Next Monday), we should have results by the end of the month. 
  • Does this timing work?
• Communication/Announcement
  • Since it wasn't clearly captured in previous notes - the plan is to post to #tech-council, right?  Also maybe to the other council channels?  
    • Maccabee Levine should post to wider channels, probably developers or implementers
  • Do we need to be concerned that we may not get enough nominees, or that not posting this to a wider audience may be viewed negatively?
    • Craig McNally we did not have too much candidates recently

From Julian Ladisch in #tech-council... Do we need to discuss?

There's a request to get a fix being back-ported to Morning Glory (R2 2022): https://github.com/folio-org/mod-authtoken/pull/164
Does FOLIO support this, or should we suggest that people (upgrade to a supported flower release or) fork the repository, do the changes in their fork, and use their own docker hub space to publish the fixed container?

Notes:

• Was this raised with the RMS group?  Any updates?
• Julian Ladisch: yes, raised with RMS group

This is mostly an FYI, but also raising this here in hopes of finding a volunteer to help with this...

• mod-graphql is unmaintained.  Charlotte Whitt indicates that the Thor team does not have bandwidth for this.  
• There are several security-related issues here, dating back to 2021.  Most of this is regarding outdated, unsupported versions of 3rd party dependencies, but there are also at least one known vulnerability too.
• It seems the project needs to find a new owner for this module.
  • Sought advice from the folio chairs.  It was suggested that we engage Khalilah Gambrell (Lead PO). 
  • Khalilah indicated that there aren't any teams with capacity to take this on, especially while hardening for a release.  She also notes that EBSCO + EPAM teams have already taken on a significant number of modules previously maintained by the now defunct Prokopovych team.
• Noteworthy considerations:
  • This module is written in node.js
  • the z39.50 module depends on mod-graphql, so removing it from future releases may be problematic
• Jakub Skoczen probably dependency on z3950 could be removed, so we could get rid of mod-graphql at all
• Marc Johnson ask z3950 responsibles if they think removal is possible
• Maccabee Levine announce a note in slack too the planned removal of mod-graphql in case someone else uses it

Follow-on Q & A/ discussion on approval of the Go language for module development.

• DevOps topics were discussed last wednesday
• Discussion:
  • Craig McNally Can other teams take over go-based modules? We learned mit mod-graphql this can be a problem
  • Maccabee Levine Should be a MOU from the Organization
  • Jakub Skoczen Does not depend only on programming language. Most time the teams lack resources and not knowledge.
  • Marc Johnson Not only the programming language, but also central tooling has to be considered. Not central policy for new languages. Need guidelines for new languages
  • Jenn Colt When should a module be considered to be abandoned?
  • Craig McNally mod-graphql most security vulnerabilities raise from outdated dependencies. Unclear if this is exploitable. Upgrading dependencies is not easy.
  • Julian Ladisch At least one security issue known, but does not directly affect Folio.
  • Marc Johnson No policies for new languages regarding tooling exist
  • Jakub Skoczen As we proposed go, we figured out tooling, devops and so on. Discussion seems to be endless, we had 2 topics: CI/CD and developing of a demonstration module. Either formulate clear questions about topics in question or take a vote now or soon.
  • Craig McNally Most of questions have been raised in the RFC. Concerns about managing multiple languages have all been discussed
  • Jakub Skoczen Can invite developers from the team if there are more questions.
  • Marc Johnson Static code analysis group will look at it
  • Craig McNally Remaining questions should be answered at Wednesday and we plan to take a vote them