2026-04-27 Meeting Notes

Apr 20, 2026

Attendees

@Christie Thomas
@Kevin Day
@Wayne Schneider
@Jenn Colt
@Zak Burke
@Jeff Gerhard
@Ingolf Kuss
@Tod Olson
@Maccabee Levine
@Shelley Doljack
@Olamide Kolawole
@Julian Ladisch
@Matt Weaver
@Craig McNally
@Charlotte Whitt
@VBar
@Rahman Corr
@John Coburn

Time	Item	Who	Notes

Time	Item	Who	Notes
1 min	Scribe		@Christie Thomas (and @Shelley Doljack last 15 min) followed by @Florian Gleixner Reminder: Please take attendance. Please paste the Zoom chat into the notes. If you miss it, this is saved along with the meeting recording, but having it here has benefits.
5-15 min	Liaison Updates	@Maccabee Levine @Christie Thomas @Craig McNally	CC: @Maccabee Levine Today’s meeting was cancelled; both co-chairs out sick. PC: @Christie Thomas Privacy SIG presented on personally identifiable information across FOLIO. (PII) Working on personal data disclosures (PDD) for all existing modules. Status of this work is tracked here: 2026-04-16 PDD Status Asking for PC endorsement to create JIRAS requiring modules to complete the PDD form for each module. GitHub repository with PDD forms and scripts: https://github.com/folio-org/personal-data-disclosure Discussion of progress on umbrellaleaf review. Question about how subject matter experts can surface features or other work that will result in behavior changes when the Jiras are focused on the technical work. RMS Group: @Jenn Colt sunflower csp 7 may 1 module release, GA May 11 going relatively well sunflower bugfest having some infrastructure experiments https://folio-org.atlassian.net/jira/dashboards/12853 discussion about how to talk about the fact that functionality is coming in CSPs, however this csp is all technical. csp 6 had many new stories however Trillium on release integration sprint Trillium (R1 2026) K-Int and Thor working on releases Teams learning to do application releases Will finish and then do environment prep PC endorsement of new functionality Not a change in process Tried to make it more in line with TC and also moved into JIRA Second stage would enforce more proactively, PC liaisons looking at what is happening in SIGs and functionality Teams don't have to go to PC Discussion: @Jenn Colt and @Olamide Kolawole will bring this up at chairs to get everyone on the same page. Security Team: @Julian Ladisch Presentation after updates Eureka Early Adopters: @Craig McNally: Status of Eureka Adoption AWS Costs Review Group: @Wayne Schneider No meeting, no update
5 min	Upcoming Meetings	All	Apr 27, 2026 Regular TC Meeting + Security Presentation from @Craig McNally https://folio-org.atlassian.net/wiki/x/VQDsbg https://folio-org.atlassian.net/wiki/x/oADlbg Apr 29, 2026 Calming Week - No meeting May 4, 2026 Regular TC Meeting + Config Management Presentation from @Oleksii Petrenko May 6, 2026TBD Dedicated Discussion Topics: Developer wolfcon survey https://folio-org.atlassian.net/wiki/x/VQBTR FOLIO API Standardization & Documentation Surface current issues with API documentation and discoverability. API versioning ability and access by release/module? Validation standards API usage for bulk operations Breaking changes notifications Dedicated channel for breaking changes announcements (forwarded from #folio-development) Tag breaking changes in Jira; auto-populate wiki page for external monitoring Define FOLIO Core: Establish clear definition of what constitutes “core” FOLIO vs others. what should integrate vs what needs to be in FOLIO Simplification opportunities Cost Reduction & Resource Optimizations Sidecar proliferation Kafka usage visibility and optimization AWS cost analysis wOLFcon Technical Track Planning: Proposal for technical conference track alongside general wolfcon. Ensure non-developer access Format options: virtual conference, two-day technical overlay, hybrid Employer outreach for developer/operations engineer participation FOLIO contribution vehicle Technology Visibility & Scanning: Automated scanning and reporting on FOLIO technology stack leverage existing work by David Crossley Language and framework scanning Topics from Wolfcon sessions that could get into dedicated discussion Folio “Core” definition Estimating support costs Getting People to contribute to Folio Working costs of supporting modules Costs of development environment (AWS) Security team DR for support periods- Sep 17, 2025
20 min	Security update	@Craig McNally	Security Presentation from @Craig McNally https://folio-org.atlassian.net/wiki/x/VQDsbg https://folio-org.atlassian.net/wiki/x/oADlbg Presentation: Have seen 2 attacks recently. Becoming more prevalent and want to get in front of this before it becomes a larger problem. Will undertake each environment individually. Begain with NPM/Javascript. Want to create a roadmap so can get work to the teams. Security team has reviewed NPM/Javascript document and given its approval. NPM/Javascript overview/themes Preventing post-install scripts from running trades convenience for security in an area that is easy to exploit. Commit lock files in all UI repositories, causing dependency management to be more deliberate.** Might need to wait for a bug fix but we are not automatically pulling down vulnerabilities by pullling down each new update as soon as it is available without intention. Good general practice to point to release versions rather than snapshot versions. It is not about curating the lock file, but about committing the lock file in place. Discussion: Is there anything that is expensive? As you go to short to mid-term to long, there are more unknowns, especially in terms of resources. Does not anticipate that there is anything that is heavy or expensive. Are the guidance for tooling in the mid-term guidance regarding the release versions for first party and third party tools? Any third-party dependencies that get pulled into the FOLIO tooling should be an official release rather than consumed from source. After-the-discussion historical context: committing lock files feels obvious; why didn’t we always do it? From @Zak Burke : First, it’s important to think of dependencies in a UI build the same way yarn does, which is hierarchically: platform-complete ui-this third-party-foo third-part-bar ui-that third-party-baz When installing dependencies for an application, the only relevant lock file is the “application”-level one at the very top of the hierarchy (e.g. the file belonging to platform-complete). Lock files in dependencies, i.e. in “shared libraries” like ui-this or third-party-foo, are ignored. The arguments against committing lock files in shared libraries are well-summarized in this “old” thread from 2019. In short: once you commit something you commit to maintaining it; that comes with a cost (still true) maintenance can be a pain (somewhat better now that tools like renovate and dependabot are more mature) there are longstanding arguments that generated-files do not belong in source control (this is a judgement call) the sense of security is false because a shared-library’s lock file is ignored when that library is installed by an application (this conclusion is dangerously short-sighted, but it resonated for us once upon a time, STRIPES-644) Lock files look down through the dependency hierarchy, not up it. Therefore, the claim that a shared-library’s lock file could provide a false sense of security about an application that contains it does not hold water; lock files never made such a claim. More importantly, platform-level builds are not the only builds: when a dev clones ui-this on their workstation and then installs its deps to run tests, ui-this is at the top of the dependency hierarchy and therefore its lock file is consulted; ditto when CI clones ui-this and installs dependencies to validate a PR. We need lock files in every repo because they help provide security for developers’ workstations and our CI environments.
15 min	Dev ops. update	@Wayne Schneider	updates from the FOLIO community DevOps team regarding the maintenance of the platform-complete repository and the Okapi-based folio-snapshot reference environments. We are also looking for direction regarding the implicit quality gate that the hourly "build-platform-complete" Jenkins job provides. retiring old Jenkins server and folio-snapshot Most of the load on the Jenkins server has been migrated off of it maven-based CI workflows now on GitHub Actions there’s a plan to mostly retire the Jenkins server by Jun 1, 2026 Jenkins retirement confluence page (@Wayne Schneider to provide link) phase out okapi-based reference env builds (folio-snapshot) End of June, restrict public access to FOLIO Jenkins After Umbrellaleaf, can officially decommission the server What are the plans for continuing maintaining the branch for platform-complete? There is a twice-daily snapshot reference env for Eureka. platform-complete used for the frontend build for Eureka? a replacement for this is in the module federation build work that Zak reported about. short-term: platform-lsp is the place to build the frontend. Trillium and going forward, you won’t use platform-complete to build the fronted. the snapshot branch of platform-complete uses Okapi Okapi-based reference build retirement platform-complete snapshot branch has not been correct since November (from a backend perspective) b/c of technical issues with folio-spring support of system user modules. backend modules that use this are pinned at older modules okapi support removed in Trillium plan is to discontinue the build May 1, 2026 @Wayne Schneider to put link to presentation here Presentation Jenkins retirement details Okapi-based reference environment retirement details
10 min	TCR Board Review	All	Module Federation https://folio-org.atlassian.net/browse/TCR-65 Not yet started, sorry. Will prioritize this week. mod-rtac-cache https://folio-org.atlassian.net/browse/TCR-66 @Jeff Gerhard delegated to @Rahman Corr @Jeff Gerhard unable to attend, will send update later
0 min	Existing Module Evaluation	All	Olamide to refine feedback from the documents showcased on Apr 15, 2027dedicated discussion @Olamide Kolawole Demonstrated Jira management of TCR project using parent tickets and subtasks Call for vote? No quorum, vote deferred No opposition among attendees
0 min	Technical Council Sub-Groups Updates	All	Zero active subgroups
0 min	GitHub RFCs Wiki RFCs	All
0 min	Decision Log	All
0 min	Officially Supported Technologies (OST)	Alls	We won’t know Umbrellaleaf dates until Trillium comes out (GA approx June 8) Umbrellaleaf @Julian Ladisch recommends doing some prework @Maccabee Levine recommends adding Recurring Calendar as a standing agenda item
	https://folio-org.atlassian.net/wiki/x/HwCJDQ
	Zoom Chat		2026-04-27 09:12:32 From Charlotte Whitt to Everyone: Here the link to the PC log 2026-04-27 09:12:37 From Charlotte Whitt to Everyone: Decision log 2026-04-27 09:19:40 From Tod Olson to Everyone: Maybe a light going through? 2026-04-27 09:21:19 From Charlotte Whitt to Everyone: Wayne - here link to the PC Endorsement projects on FOLIO Jira - https://folio-org.atlassian.net/issues?jql=textfields ~ "pce*" AND project %3D PCE 2026-04-27 09:28:04 From Shelley Doljack to Everyone: I’ve always wondered why yarn.lock files were never committed. 2026-04-27 09:28:47 From Zak Burke (EBSCO) to Everyone: As Craig said, so much about development is about managing tradeoffs, and convenience vs security is a very common tradeoff. Short-term actions #1 and #2 both focus on moving our security posture from convenience toward security. 2026-04-27 09:44:58 From Christie Thomas (she/her) to Everyone: I need to leave soon for a meeting with an internal job candidate. Can someone take over with notes? 2026-04-27 09:46:37 From Shelley Doljack to Everyone: Replying to "I need to leave soon for a meeting with an interna...": I’ll take over for you. 2026-04-27 09:46:42 From Christie Thomas (she/her) to Everyone: Replying to "I need to leave soon for a meeting with an interna...": Thank you! 2026-04-27 09:56:32 From Charlotte Whitt to Everyone: https://applications.ci.folio.org/ 2026-04-27 09:57:00 From Ingolf Kuss to Everyone: Kubernetes Example Deployment this still uses platform-complete and should be updated, then.

Topic Backlog
Decision Log Review	All	Review decisions that are in progress. Can any of them be accepted? rejected?
Translation Subgroup	All	Since we're having trouble finding volunteers for a subgroup, maybe we can make progress during a dedicated discussion session?
Communicating Breaking Changes	All	Currently there is a PoC, developed by @Maccabee Levine, of a utility to catalog Github PRs that have been labeled with the "breaking change" label. We would like to get developer feedback on the feasibility of this label being used more often, and the usefulness of this utility.
Officially Supported Technologies - Upkeep	All	Previous Notes: A workflow for these pages. When do they transition from one state to another. Do we even need statuses at all ? Stripes architecture group has some questions about the Poppy release. Zak: A handshake between developers, dev ops and the TC. Who makes that decision and how do we pass along that knowledge ? E.g. changes in Nodes and in the UI boxes. How to communicate this ? We have a large number of teams, all have to be aware of it. TC should be alerted that changes are happening. We have a couple of dedicated channels for that. Most dev ops have subscribed to these channels. How can dev ops folk raise issues to the next level of community awareness ? There hasn't been a specific piece of TC to move that along. Craig: There is a fourth group, "Capacity Planning" or "Release Planning". Slack is the de facto communication channel. There are no objections to using Slack. An example is the Java 17 RFC. Craig: The TC gets it on the agenda and we will discuss it. The TC gets the final say. Marc Johnson: We shouldn’t use the DevOps Channel. The dev ops folks have made it clear that it should only be used for support requests made to them. Jakub: Our responsibility is to avoid piling up technical debt. Marc: Some set of people have to actually make the call. Who lowers the chequered flag ? Craig: It needs to ultimately come to the TC at least for awareness. There is a missing piece. Capacity Planning needs to provide input here. Marc: Stakeholders / Capacity Planning could make that decision. Who makes the decision ? Is it the government or is it some parts of the body ? Marc: the developers community, the dev ops community and sys ops are involved. For example the Spring Framework discussion or the Java 17 discussion. But it was completely separate to the TC decision. It is a coordination and communication effort. Marc: Maybe the TC needs to let go that they are the decision makers so that they be a moderating group. Jakub: I agree with Marc. But we are not a system operating group. Dependency management should be in the responsibility of Release management. There are structures in the project for that. Jason Root: I agree with Jakub and with Marc also. Policies should drive operational/release/support aspects of Folio. Jason Root: If the idea of “support” is that frameworks are supported, then of course the project should meet that. Marc Johnson Some group needs to inform OleksAii when a relevant policy event occurs. These documents effectively ARE the manifestation of the policy. Craig: This is a topic for the next Monday session. Craig to see if Oleksii Petrenko could join us to discuss the process for updating the officially supported technologies lists.
Dev Documentation Visibility	All	Possible topic/activity for a Wednesday session: Discuss/brainstorm: Ideas for the type of developer-facing documentation we think would be most helpful for new developers How we might bring existing documentation up to date and ensure it's consistent etc.
API linting within our backend modules	All	https://folio-project.slack.com/archives/CAQ7L02PP/p1713343461518409 Hello team, I would like to discuss API linting within our backend modules. Some time ago, we transitioned our linting process from Jenkins to GitHub Actions as outlined in https://folio-org.atlassian.net/browse/FOLIO-3678. I am assuming that this move was done via some technical council decision. Please correct me if I'm wrong. In my observations, I've found two problems: Schema linting does not occur if the schemas are in YAML format. There are issues with resolving some deeper references during API linting. Although I'm unsure about how to improve the existing linting implementations within Folio, I propose to consider an open-source solution that handles OpenAPI linting effectively and allows us to define custom rules. For your reference: https://stoplight.io/open-source/spectral A test of this solution can be found in this PR: https://github.com/folio-org/mod-search/pull/567. The same PR also provides an example of custom rule definition: https://github.com/folio-org/mod-search/pull/567/files#diff-d5da7cb43c444434994b76f3b04aa6e702c09e938de09dbc09d72569d611d9ab.Also, by employing 'Spectral', I discovered AsyncAPI (https://www.asyncapi.com/en), an API design tool similar to OpenAPI but for asynchronous interactions. I suggest that we consider using AsyncAPI in FOLIO to generate documentation for Kafka interactions.
PR Templates	All	https://folio-project.slack.com/archives/CAQ7L02PP/p1713445649504769