--- title: OpenSSF Newsletter – September 2026 – Open Source... description: OpenSSF's September 2026 newsletter covers the Governing Board's commitment to sustainable funding for public package registries, guidance for navigating the... canonical: https://daily.dev/posts/openssf-newsletter-september-2026-open-source-security-foundation-po4487ovb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: OpenSSF Newsletter – September 2026 – Open Source Security Foundation | daily.dev og:description: OpenSSF's September 2026 newsletter covers the Governing Board's commitment to sustainable funding for public package registries, guidance for navigating the... og:url: https://daily.dev/posts/openssf-newsletter-september-2026-open-source-security-foundation-po4487ovb og:image: https://api.daily.dev/og/posts/PO4487OvB.png og:image:alt: OpenSSF Newsletter – September 2026 – Open Source Security Foundation og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # OpenSSF Newsletter – September 2026 – Open Source Security Foundation **[OpenSSF](https://daily.dev/sources/openssf)** · 8 min read · 0 upvotes · 0 comments ## Summary OpenSSF's September 2026 newsletter covers the Governing Board's commitment to sustainable funding for public package registries, guidance for navigating the EU Cyber Resilience Act (with a September 11 manufacturer reporting deadline and December 2027 deadline for stewards), and a fall Security Slam with CNCF TAG Security. Three podcast episodes cover CRA compliance, AI's impact on software engineering, and dependency debt. Project releases include OpenBao v2.7.0 beta and v2.6.2, gittuf v0.16.0, Zarf v0.85.0, protobom v0.6.0/v0.6.1, Gemara's go-gemara v0.10.0, and Sigstore's Rekor v1.5.4. Policy updates include ENISA's new FAQ, glossary, threat landscape report, and a public consultation on AI-assisted development guidance. Upcoming events include OpenSSF Community Day Europe in Prague on October 6. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### When does the EU Cyber Resilience Act reporting deadline apply to manufacturers versus open source stewards? The September 11, 2026 CRA reporting deadline applies exclusively to manufacturers, while open source software stewards face a separate compliance obligation starting December 11, 2027. The European Commission clarified this distinction in an update to subchapter 5.5 of its official FAQ, and OpenSSF published separate steward and manufacturer compliance checklists to help each group prepare. _Track evolving CRA compliance guidance on daily.dev as deadlines for manufacturers and stewards diverge._ ### What happened to OpenSSF's community-hosted Allstar service? Community-hosted Allstar ended in August, and users need to migrate to self-hosting the tool themselves. OpenSSF published self-hosting instructions in the Allstar GitHub repository to guide the transition. This came alongside OpenSSF Scorecard migrating its own public infrastructure, in partnership with AboutCode, onto AWS. _Developers managing GitHub security tooling migrations can follow supply chain security shifts like this on daily.dev._ ### What new features does OpenBao add in its v2.7.0 beta release? OpenBao's v2.7.0 beta introduces external KMS-backed keys, post-quantum cryptography support, and improved PostgreSQL read scalability. Separately, the v2.6.2 stable release focuses on security fixes rather than new features. OpenBao is an open source secrets management tool developed under OpenSSF's project umbrella. _Teams evaluating secrets management upgrades can follow OpenBao release notes on daily.dev._ ## Similar posts on daily.dev - [OpenSSF Newsletter – July 2026 – Open Source Security Foundation](https://daily.dev/posts/openssf-newsletter-july-2026-open-source-security-foundation-pfg1vkjsr) · OpenSSF · 0 upvotes · 0 comments - [OpenSSF Newsletter – August 2026 – Open Source Security Foundation](https://daily.dev/posts/openssf-newsletter-august-2026-open-source-security-foundation-uftvr36ju) · OpenSSF · 0 upvotes · 0 comments - [OpenSSF Newsletter – May 2026 – Open Source Security Foundation](https://daily.dev/posts/openssf-newsletter-may-2026-open-source-security-foundation-envxbelwn) · OpenSSF · 0 upvotes · 0 comments - [OpenSSF Newsletter – June 2026 – Open Source Security Foundation](https://daily.dev/posts/openssf-newsletter-june-2026-open-source-security-foundation-jgziplo2l) · OpenSSF · 0 upvotes · 0 comments - [This Week in Open Source for September 24, 2026](https://daily.dev/posts/this-week-in-open-source-for-september-24-2026-f0evuxtni) · Google Open Source Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source), [#supply-chain](https://daily.dev/tags/supply-chain) [View this post on daily.dev](https://daily.dev/posts/openssf-newsletter-september-2026-open-source-security-foundation-po4487ovb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"OpenSSF Newsletter – September 2026 – Open Source Security Foundation","url":"https://daily.dev/posts/openssf-newsletter-september-2026-open-source-security-foundation-po4487ovb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/openssf-newsletter-september-2026-open-source-security-foundation-po4487ovb"},"datePublished":"2026-09-30T11:29:27.692Z","dateModified":"2026-09-30T11:29:52.702Z","description":"OpenSSF's September 2026 newsletter covers the Governing Board's commitment to sustainable funding for public package registries, guidance for navigating the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/47dd676d4ac67c52b883f9e3efb960c6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/47dd676d4ac67c52b883f9e3efb960c6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"OpenSSF","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"OpenSSF","logo":"https://media.daily.dev/image/upload/s--l6RJ5uPj--/f_auto,q_auto/v1774959959/logos/openssf?_a=BAMAMiWQ0","url":"https://daily.dev/sources/openssf"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/openssf-newsletter-september-2026-open-source-security-foundation-po4487ovb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,open-source,supply-chain","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"OpenSSF","item":"https://daily.dev/sources/openssf"},{"@type":"ListItem","position":3,"name":"OpenSSF Newsletter – September 2026 – Open Source Security Foundation"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/openssf-newsletter-september-2026-open-source-security-foundation-po4487ovb#faq","mainEntity":[{"@type":"Question","name":"When does the EU Cyber Resilience Act reporting deadline apply to manufacturers versus open source stewards?","acceptedAnswer":{"@type":"Answer","text":"The September 11, 2026 CRA reporting deadline applies exclusively to manufacturers, while open source software stewards face a separate compliance obligation starting December 11, 2027. The European Commission clarified this distinction in an update to subchapter 5.5 of its official FAQ, and OpenSSF published separate steward and manufacturer compliance checklists to help each group prepare. Track evolving CRA compliance guidance on daily.dev as deadlines for manufacturers and stewards diverge."}},{"@type":"Question","name":"What happened to OpenSSF's community-hosted Allstar service?","acceptedAnswer":{"@type":"Answer","text":"Community-hosted Allstar ended in August, and users need to migrate to self-hosting the tool themselves. OpenSSF published self-hosting instructions in the Allstar GitHub repository to guide the transition. This came alongside OpenSSF Scorecard migrating its own public infrastructure, in partnership with AboutCode, onto AWS. Developers managing GitHub security tooling migrations can follow supply chain security shifts like this on daily.dev."}},{"@type":"Question","name":"What new features does OpenBao add in its v2.7.0 beta release?","acceptedAnswer":{"@type":"Answer","text":"OpenBao's v2.7.0 beta introduces external KMS-backed keys, post-quantum cryptography support, and improved PostgreSQL read scalability. Separately, the v2.6.2 stable release focuses on security fixes rather than new features. OpenBao is an open source secrets management tool developed under OpenSSF's project umbrella. Teams evaluating secrets management upgrades can follow OpenBao release notes on daily.dev."}}]} ```