Add meeting notes 2025-03-19 (#2481)

* Add community/minutes/2025-03-19.md

* Update community/minutes/2025-03-19.md

* Update community/minutes/2025-03-19.md

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: github-actions[bot]

community/minutes/2025-03-19.md

@@ -0,0 +1,79 @@
+---
+tags: [meeting-notes]
+title: '2025-03-19'
+---
+# conda-forge core meeting 2025-03-19
+
+Add new agenda items under the `Your __new__() agenda items` heading
+
+- [Zoom link](https://zoom.us/j/9138593505?pwd=SWh3dE1IK05LV01Qa0FJZ1ZpMzJLZz09)
+- [What time is the meeting in my time zone](https://dateful.com/convert/utc?t=5pm)
+- [Previous meetings](https://conda-forge.org/community/minutes/)
+
+## Attendees
+
+| Name                    | Initials | GitHub ID        | Affiliation                 |
+| ----------------------- | -------- | ---------------  | --------------------------- |
+| Daniel Ching            | DJC      | @carterbox       | cf / NVIDIA                 |
+| Jaime Rodríguez-Guerra  | JRG      | @jaimergp        | Quansight                   |
+| Marius van Niekerk      | MvN      | @mariusvniekerk  | cf / Voltron Data           |
+| Uwe Korn                | UK       | @xhochy          | cf / QuantCo                |
+| Wolf Vollprecht         | WV       | @wolfv           |                             |
+| Isuru Fernando          | IF       | @isuruf          |                             |
+|                         |          |                  |                             |
+|                         |          |                  |                             |
+|                         |          |                  |                             |
+
+X people total
+
+### Standing items
+
+- [ ]
+
+### From previous meeting(s)
+
+- [ ]
+
+### Active votes
+
+- [X] IF: Vote for adding Daniel Nachun to staged-recipes ends in ~6 days
+    - Only 13 votes yet. Need one more vote (quorum needs 27 * 0.5)
+    - Go to Helios voting platform and log in with Github to see vote
+
+### Your __new__() agenda items
+
+- [X] WV: CVE mapping
+    - Use PURLs?
+    - JRG interested in adding PURLs to. See https://github.com/conda/ceps/pull/114
+    - MvN suggests identifying canonical sources
+    - UK has been using automated scan tools to identify CVEs in Go packages
+        - MvN: approach tricky for C/C++, probably better for Rust because they contain enough metadata
+    - MvN Integrated command could be interested to launch the analysis upon env creation
+        - UK: these analysis are costly though, in the order of minutes
+        - UK: Run them on cronjobs on top of small number of known lockfiles
+        - UK: These analysis lead to discovery of weird dependencies in the tree (terraform > openai > weights and biases)
+    - UK expressed concerns about Dependabot and Github analysis creating noise with false positives
+- [x] DJC: CI restart behavior has changed?
+    - DJC Close and reopen PRs do not retrigger the CI.
+    - IF no changes, just flaky Azure.
+- [X] WV: Latest tinyxml release was ABI incompatible and broke a few packages. More tests?
+    - DJC: ABI laboratory dead, but tools appear to have moved to the "Linux Hardware Project". Packaged in conda-forge now.
+        - DJC: https://github.com/lvc/abi-dumper
+    - WV: Could a tool run the ABILaboratory logic to detect ABI breakage across releases?
+        - MvN: Create two envs with release and release-1 and diff the results?
+        - DJC: Library has two methods available: compile with debug symbols, or binary+headers.
+        - UK: Probably because they also show symbol renames, not just ABI incompatibilities. Might just work for us to run the ABI checks only.
+    - IF: We should just pull tinyxml2 10.1 version, 11.0 is available
+        - WV: Agreed for this particular problem
+ - [X] WV: conda-forge 10th anniversary soon right?
+    - JRG: Apr 11th. Let's do something fun about it! At the very least a blog post.
+
+
+
+### Pushed to next meeting
+
+- [ ]
+
+### CFEPs
+
+- [ ]