CRA Update, Glasswing
Mikaël Barbero, Head of Security, shared the latest updates on the Cyber Resilience Act (CRA) and the Eclipse Foundation’s participation in Anthropic’s Project Glasswing.
Wayne Beaton, Head of Open Source Projects, spoke briefly about journey of an Eclipse Foundation project, from incubation to graduation.
Notes
CRA reporting timeline update CRA compliance and active reporting obligations apply to commercial manufacturers according to the initial enforcement timeline. This impacts your commercial products that are built on Eclipse open source technology. This takes effect on September 11, 2026.
The European Commission’s FAQ update of September 4, 2026 clarified that the reporting obligations for open source software stewards, including the Eclipse Foundation, have a different timeline. These obligations apply starting on December 11, 2027.
Project Glasswing If your project team is prepared to collaborate on validation and remediation of vulnerabilities identified by Project Glasswing, your repositories are actively maintained, and your project security team includes active Committers who can act on reports, we encourage you to enrol.
Enrollment is not first come, first served and does not guarantee a particular review date. Scheduling depends on program priorities and available capacity. Please note that the enrollment repository and its merge requests are public: do not use them to report vulnerabilities or include sensitive information.
Security-related questions Committers with security-related questions can contact the Eclipse Foundation Security Team through:
Graduating from Incubation Incubation Phase projects will eventually graduate, signifying that the project code base has stabilised and that the project team is familiar with the Eclipse Foundation Development Process.
Incubation mailing list New committers are encouraged to join the incubation mailing list; this list is a good place to ask questions about process, services available, and other aspects of working as a committer.
Eclipse and ecosystem events The Eclipse Foundation events timeline provides information about upcoming Eclipse Foundation and ecosystem events: