EU Cyber Resilience Act (CRA)

[Collie-IT]

In Europe starts the EU Cyber Resilience Act (CRA) and there are new requirements like SBOM.

Cyber Resilience Act

Will phpSpreedsheed comply with this requrements?

[oleibman]

IANAL. We have procedures for reporting security vulnerabilities, and we respond to those as promptly as possible. Do you think something else is required?

[oleibman]

As for "SBOM" (software bill of materials), composer.json and composer.lock files are maintained for the project, and I think they fill this bill (again reiterating that IANAL). We are automatically informed (by Dependabot) of any security vulnerabilities published for the supporting software, and update the software in question ASAP when so informed.

[Collie-IT]

There is more. From 12/2027 a digital product must have a CE conformity declaration other wise the libery is not allowed to be used.

[oleibman]

I would not be willing to file such a declaration. The summary that I am looking at says, "Under the EU Cyber Resilience Act (CRA), open-source software and hardware with digital elements distributed commercially must comply with mandatory cybersecurity requirements." We are not distributed commercially, and have no intention of changing to such a model. Maybe whoever's running the show here in December 2027 will have a different view.