What Enterprises Need to Know About the Software They Depend On
Red Hat, Friday, October 2nd, 2026
Red Hat says enterprises must understand the open source dependencies behind their software as AI coding and the EU CRA raise the stakes.
Red Hat argues that knowing an application contains open source is not the same as understanding the software and communities behind it.
Commercial codebases now average more than 84,000 files, about four times the number five years ago, AI coding assistants can pull in nested dependencies, licenses and vulnerabilities without anyone choosing them, and the EU Cyber Resilience Act makes this a legal issue, with vulnerability reporting beginning September 11, 2026 and main requirements taking effect December 11, 2027.
The post says the real blind spot is a lack of context about what dependencies mean, who maintains them and how they are sustained.