11 September 2026

20 new posts across 4 open source sources — 5 worth your time.

One week of Open Source, 5 stories, as published.

7 questions for assessing Cyber Resilience Act codebase readiness

This post outlines key questions organizations must ask to prepare for the European Union's Cyber Resilience Act (CRA). It highlights the upcoming mandatory reporting requirements for actively exploited vulnerabilities and severe security incidents affecting digital products sold in the EU.

Why it matters — Organizations selling software in the EU must establish concrete processes for tracking and reporting active exploits in their open-source dependencies to comply with the CRA.

Tidelift · 11 September 2026 · Read the original →

Governance

[$] CERN's migration path from CentOS Linux to Debian

This article details how CERN navigated its migration away from CentOS Linux following Red Hat's shift in the CentOS roadmap. It explores the unique requirements of CERN's massive computing environment and why they ultimately chose Debian as their primary migration path.

Why it matters — Migrating a massive, specialized infrastructure off a discontinued enterprise distribution requires careful evaluation of community governance and long-term stability, demonstrating why Debian remains a viable target for enterprise-scale migrations.

LWN · 11 September 2026 · Read the original →

Reading

[$] PostgreSQL 19's "scary patch contest"

PostgreSQL developers are raising concerns about the quality of the upcoming major release due to late-breaking features and complex patches. The community is debating the trade-offs of delaying the release versus shipping potentially unstable code, highlighting tensions in the project's annual release cycle.

Why it matters — Even highly mature open-source projects face governance challenges when balancing strict annual release schedules against the risk of shipping complex, late-stage features.

LWN · 11 September 2026 · Read the original →

Security

Forgejo 16.0.4 and 15.0.8 address critical security vulnerability

The Forgejo git forge project has released security updates to patch a critical remote code execution (RCE) vulnerability. The flaw occurs during repository generation from a template, where improper handling of the template expansion process allows arbitrary code execution.

Why it matters — Vulnerabilities in self-hosted git forges present severe supply-chain risks, as an attacker gaining RCE can compromise the integrity of the entire development pipeline and hosted codebases.

LWN · 11 September 2026 · Read the original →

Licensing

OSI brings the State of the Source to All Things Open 2026

The Open Source Initiative is hosting a dedicated track at All Things Open 2026 to address critical policy, licensing, and compliance issues. The sessions will cover the OSI's priorities for 2027, practical compliance strategies, and open-source sustainability.

Why it matters — Keeping up with evolving licensing standards and compliance frameworks is essential for organizations to mitigate legal risks when consuming open-source software.

Open Source Initiative · 11 September 2026 · Read the original →

Another week of migrating away from things we just finished setting up.

5 stories, every Friday

Published here every week. Follow by RSS to get it as it lands.

Subscribe by RSS All issues

← Previous issue Next issue →