--- title: OpenSSF Newsletter – July 2026 – Open Source Security... description: The July 2026 OpenSSF Newsletter covers the upcoming Community Day Europe in Prague (October 6), a new eBook on EU Cyber Resilience Act (CRA) compliance, and... canonical: https://daily.dev/posts/openssf-newsletter-july-2026-open-source-security-foundation-pfg1vkjsr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: OpenSSF Newsletter – July 2026 – Open Source Security Foundation | daily.dev og:description: The July 2026 OpenSSF Newsletter covers the upcoming Community Day Europe in Prague (October 6), a new eBook on EU Cyber Resilience Act (CRA) compliance, and... og:url: https://daily.dev/posts/openssf-newsletter-july-2026-open-source-security-foundation-pfg1vkjsr og:image: https://api.daily.dev/og/posts/PfG1vkJsR.png og:image:alt: OpenSSF Newsletter – July 2026 – Open Source Security Foundation og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # OpenSSF Newsletter – July 2026 – Open Source Security Foundation **[OpenSSF](https://daily.dev/sources/openssf)** · 9 min read · 0 upvotes · 0 comments ## Summary The July 2026 OpenSSF Newsletter covers the upcoming Community Day Europe in Prague (October 6), a new eBook on EU Cyber Resilience Act (CRA) compliance, and an explainer on dependency firewalls for blocking malicious packages before installation. It also highlights OpenSSF's outreach at AfricaCyberFest (7+ new contributors), podcast episodes on AI/ML artifact signing and the Alpha-Omega $20M milestone, and multiple project releases including OpenBao v2.6.0/v2.6.1, OSV Schema v1.8.0, and Minder v0.2.2. Regulatory updates include new European Commission CRA guidance, ENISA's SME CRA Survey Report, and the Secure by Design and Default Playbook. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is a dependency firewall and how is it different from vulnerability scanning? A dependency firewall evaluates packages before they are installed, blocking malicious code from reaching a workstation, CI/CD pipeline, or AI coding agent's workspace, rather than scanning after installation when damage like credential or token theft may already have occurred. It checks for typosquatting, dependency confusion, and slopsquatting, where AI coding agents recommend packages that do not actually exist. _daily.dev surfaces practical security explainers like this for teams evaluating supply chain defenses._ ### How aware is the open source community of the EU Cyber Resilience Act ahead of the compliance deadline? Awareness remains low even as the first compliance deadline approaches: 66% of the open source community reported little to no familiarity with the CRA, up slightly from 62% a year earlier, and the figure rises to 72% in the US and Canada. This gap persists despite ongoing outreach and new compliance resources being published. _Developers tracking CRA compliance timelines can follow ongoing coverage on daily.dev._ ### How much has Alpha-Omega given in open source security grants? Alpha-Omega has surpassed $20 million in security grants distributed to open source projects, alongside introducing a four-quarter seasonal grant framework, expanding Security Engineers in Residence support, completing security audits for Rust and PyTorch ExecuTorch infrastructure, and rolling out an AI-powered vulnerability scanner called Scrutineer. _Maintainers weighing funding and tooling options for project security can follow such milestones on daily.dev._ ## Similar posts on daily.dev - [OpenSSF Newsletter – September 2026 – Open Source Security Foundation](https://daily.dev/posts/openssf-newsletter-september-2026-open-source-security-foundation-po4487ovb) · OpenSSF · 0 upvotes · 0 comments - [OpenSSF Newsletter – May 2026 – Open Source Security Foundation](https://daily.dev/posts/openssf-newsletter-may-2026-open-source-security-foundation-envxbelwn) · OpenSSF · 0 upvotes · 0 comments - [OpenSSF Newsletter – August 2026 – Open Source Security Foundation](https://daily.dev/posts/openssf-newsletter-august-2026-open-source-security-foundation-uftvr36ju) · OpenSSF · 0 upvotes · 0 comments - [OpenSSF Newsletter – June 2026 – Open Source Security Foundation](https://daily.dev/posts/openssf-newsletter-june-2026-open-source-security-foundation-jgziplo2l) · OpenSSF · 0 upvotes · 0 comments - [OpenSSF Newsletter – April 2026 – Open Source Security Foundation](https://daily.dev/posts/openssf-newsletter-april-2026-open-source-security-foundation-fxb6ebk7q) · OpenSSF · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source) [View this post on daily.dev](https://daily.dev/posts/openssf-newsletter-july-2026-open-source-security-foundation-pfg1vkjsr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"OpenSSF Newsletter – July 2026 – Open Source Security Foundation","url":"https://daily.dev/posts/openssf-newsletter-july-2026-open-source-security-foundation-pfg1vkjsr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/openssf-newsletter-july-2026-open-source-security-foundation-pfg1vkjsr"},"datePublished":"2026-07-30T19:59:54.012Z","dateModified":"2026-09-14T08:47:30.042Z","description":"The July 2026 OpenSSF Newsletter covers the upcoming Community Day Europe in Prague (October 6), a new eBook on EU Cyber Resilience Act (CRA) compliance, and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4e2c3ace89b7f889c811dba5168e299a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4e2c3ace89b7f889c811dba5168e299a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"OpenSSF","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"OpenSSF","logo":"https://media.daily.dev/image/upload/s--l6RJ5uPj--/f_auto,q_auto/v1774959959/logos/openssf?_a=BAMAMiWQ0","url":"https://daily.dev/sources/openssf"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/openssf-newsletter-july-2026-open-source-security-foundation-pfg1vkjsr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,open-source","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"OpenSSF","item":"https://daily.dev/sources/openssf"},{"@type":"ListItem","position":3,"name":"OpenSSF Newsletter – July 2026 – Open Source Security Foundation"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/openssf-newsletter-july-2026-open-source-security-foundation-pfg1vkjsr#faq","mainEntity":[{"@type":"Question","name":"What is a dependency firewall and how is it different from vulnerability scanning?","acceptedAnswer":{"@type":"Answer","text":"A dependency firewall evaluates packages before they are installed, blocking malicious code from reaching a workstation, CI/CD pipeline, or AI coding agent's workspace, rather than scanning after installation when damage like credential or token theft may already have occurred. It checks for typosquatting, dependency confusion, and slopsquatting, where AI coding agents recommend packages that do not actually exist. daily.dev surfaces practical security explainers like this for teams evaluating supply chain defenses."}},{"@type":"Question","name":"How aware is the open source community of the EU Cyber Resilience Act ahead of the compliance deadline?","acceptedAnswer":{"@type":"Answer","text":"Awareness remains low even as the first compliance deadline approaches: 66% of the open source community reported little to no familiarity with the CRA, up slightly from 62% a year earlier, and the figure rises to 72% in the US and Canada. This gap persists despite ongoing outreach and new compliance resources being published. Developers tracking CRA compliance timelines can follow ongoing coverage on daily.dev."}},{"@type":"Question","name":"How much has Alpha-Omega given in open source security grants?","acceptedAnswer":{"@type":"Answer","text":"Alpha-Omega has surpassed $20 million in security grants distributed to open source projects, alongside introducing a four-quarter seasonal grant framework, expanding Security Engineers in Residence support, completing security audits for Rust and PyTorch ExecuTorch infrastructure, and rolling out an AI-powered vulnerability scanner called Scrutineer. Maintainers weighing funding and tooling options for project security can follow such milestones on daily.dev."}}]} ```