From 9404551755a74ea85d9e8c8334370008a081bc58 Mon Sep 17 00:00:00 2001 From: Jem Gillam <6413628+jemgillam@users.noreply.github.com> Date: Thu, 3 Sep 2026 17:36:04 +0100 Subject: [PATCH 1/6] Add CRA guidance --- tsc/cve.md | 1 + tsc/security-disclosure.md | 43 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 44 insertions(+) create mode 100644 tsc/security-disclosure.md diff --git a/tsc/cve.md b/tsc/cve.md index eb76009..508ec74 100644 --- a/tsc/cve.md +++ b/tsc/cve.md @@ -1,5 +1,6 @@ --- title: CVE process background +sidebar_position: 900 --- One of the responsibilities of the TSC is in helping deal with security diff --git a/tsc/security-disclosure.md b/tsc/security-disclosure.md new file mode 100644 index 0000000..9e5f5b3 --- /dev/null +++ b/tsc/security-disclosure.md @@ -0,0 +1,43 @@ +--- +title: Security disclosures and the Cyber Resilience Act (CRA) +sidebar_position: 910 +--- + +One of the TSC’s responsibilities is helping to respond to security incidents +affecting GraphQL. The EU Cyber Resilience Act (CRA) introduces new requirements +for how serious security incidents must be assessed and reported. These +reporting requirements begin to apply in 2026, ahead of the CRA coming fully +into effect on 11 December 2027. + +For GraphQL, TSC members will have an important role in identifying and +classifying potential incidents in all GraphQL Foundation projects, verifying +the relevant details, and reporting qualifying incidents to the Linux Foundation +as GraphQL’s designated open-source software steward. + +## A reportable incident + +A reportable incident is one which is classified as "severe". + +A severe incident is one which can negatively affect availability, authenticity, +integrity or confidentiality of sensitive or important data or functions, or an +incident which can lead to introduction / execution of malicious code. + +## When a vulnerability is found or reported to a GraphQL project + +1. Classify incident's severity using the criteria above +1. If the incident is severe under the CRA definition contact the Linux + Foundation nominated contact with all relevant details + +The TSC should also consider the CVE process already established for open source +projects. + +## What happens next + +The Linux Foundation acts as the GraphQL projects' "open source steward". Under +this role, LFX will report the incident to the nominated European Union Agency +of Cybersecurity (ENISA) and designated Computer Security Incident Response Team +(CSIRT). They will have the following timeline to follow: + +- Within 24 hours of notification: send an early warning +- Within 72 hours of notification: send a full vulnerability notification +- Within 14 days of the incident's resolution: send a final report From 7e24e26faabef3048b6fea8b8910bc12b5fa597e Mon Sep 17 00:00:00 2001 From: Jem <6413628+jemgillam@users.noreply.github.com> Date: Mon, 7 Sep 2026 15:03:32 +0100 Subject: [PATCH 2/6] Update tsc/security-disclosure.md Co-authored-by: Benjie --- tsc/security-disclosure.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tsc/security-disclosure.md b/tsc/security-disclosure.md index 9e5f5b3..2c74808 100644 --- a/tsc/security-disclosure.md +++ b/tsc/security-disclosure.md @@ -34,7 +34,7 @@ projects. ## What happens next The Linux Foundation acts as the GraphQL projects' "open source steward". Under -this role, LFX will report the incident to the nominated European Union Agency +this role, the Linux Foundation will report the incident to the nominated European Union Agency of Cybersecurity (ENISA) and designated Computer Security Incident Response Team (CSIRT). They will have the following timeline to follow: From 919c3a54d3822126f81252ed078dee31b2748196 Mon Sep 17 00:00:00 2001 From: Jem <6413628+jemgillam@users.noreply.github.com> Date: Mon, 7 Sep 2026 15:04:28 +0100 Subject: [PATCH 3/6] Update tsc/security-disclosure.md Co-authored-by: Benjie --- tsc/security-disclosure.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/tsc/security-disclosure.md b/tsc/security-disclosure.md index 2c74808..6f07dc3 100644 --- a/tsc/security-disclosure.md +++ b/tsc/security-disclosure.md @@ -6,8 +6,7 @@ sidebar_position: 910 One of the TSC’s responsibilities is helping to respond to security incidents affecting GraphQL. The EU Cyber Resilience Act (CRA) introduces new requirements for how serious security incidents must be assessed and reported. These -reporting requirements begin to apply in 2026, ahead of the CRA coming fully -into effect on 11 December 2027. +reporting requirements fully come into effect on 11 December 2027. For GraphQL, TSC members will have an important role in identifying and classifying potential incidents in all GraphQL Foundation projects, verifying From 473f1a232fde55bee17b1104e3d2beeb7aa4b5d5 Mon Sep 17 00:00:00 2001 From: Jem Gillam <6413628+jemgillam@users.noreply.github.com> Date: Wed, 9 Sep 2026 13:28:23 +0100 Subject: [PATCH 4/6] Add more detail and glossary --- tsc/security-disclosure.md | 82 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 79 insertions(+), 3 deletions(-) diff --git a/tsc/security-disclosure.md b/tsc/security-disclosure.md index 6f07dc3..3c687d9 100644 --- a/tsc/security-disclosure.md +++ b/tsc/security-disclosure.md @@ -13,6 +13,64 @@ classifying potential incidents in all GraphQL Foundation projects, verifying the relevant details, and reporting qualifying incidents to the Linux Foundation as GraphQL’s designated open-source software steward. +## Glossary + +**Designated CSIRT** - "Designated Computer Security Incident Response Team" - a +body who accepts the vulnerability reports. + +**ENISA** - "The European Union Authority for Cybersecurity" - a second body who +accepts the vulnerability reports. + +**Legal person:** - An organization or entity recognised by law as having its +own rights and obligations. This is distinct from a **natural person**, meaning +an individual human being. + +**Manufacturer** - a legal person who designs, develops or manufactures a PDE +(or has them designed, developed or manufactured), _and_ makes it available to +the EU market. For example, a commercial company. + +**Open source steward** - A legal person who is _not_ a manufacturer that has +the purpose of providing support on a sustained basis, for the development of +specific PDEs. Those PDEs must qualify as free and open source software and can +be intended for commercial activity. For example, a software foundation. + +**PDE** - A "Product with Digital Elements" - A software or hardware product +covered by the CRA. + +## What is covered by the CRA: PDEs + +The law only applies to "products with digital elements" (PDEs). + +PDEs are a software or a hardware product and its remote data processing +solutions, including separate software or hardware components. For the purposes +of this guidance, GraphQL Foundation software projects such as GraphQL.js should +be treated as PDEs. At this time (September 2026), it's understood that non +software GraphQL projects such as the GraphQL Specification itself do not count +as PDEs. + +Although GraphQL software projects are free and open-source and are not sold by +the GraphQL Foundation, they are intended to be used in software products and +services, including commercial ones. They therefore fall within the CRA's +provisions for free and open-source software supported by an open-source +software steward (In GraphQL's case, the steward is the Linux Foundation). + +### PDE classification + +Currently (September 2026), GraphQL Foundation PDEs fall within the CRA's +default product category. Important and Critical product categories are defined +separately by the CRA and may change over time. If a GraphQL Foundation project +were in future to fall within one of those categories, the TSC should flag this +to the Linux Foundation. The product's classification does not, however, change +the TSC's process for assessing and escalating potential reportable +vulnerabilities under the open-source steward regime. + +| Classification | Rough meaning | Examples today | +| ----------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- | +| **[Important Class I](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02024R2847-20241120#anx_III)** | Core functionality is particularly cybersecurity relevant or could have significant wider impact | Browsers, password managers, VPNs, operating systems, network management | +| **[Important Class II](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02024R2847-20241120#anx_III)** | Higher cybersecurity risk / potentially greater negative impact | Hypervisors and container runtimes, firewalls, intrusion detection/prevention | +| **[Critical](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02024R2847-20241120#anx_IV)** | Especially significant cybersecurity products on which critical systems/supply chains may depend | Secure hardware devices, smart-meter security gateways and smartcards/secure elements | +| **Default** | Everything not falling into the categories above | Most ordinary applications/libraries | + ## A reportable incident A reportable incident is one which is classified as "severe". @@ -33,10 +91,28 @@ projects. ## What happens next The Linux Foundation acts as the GraphQL projects' "open source steward". Under -this role, the Linux Foundation will report the incident to the nominated European Union Agency -of Cybersecurity (ENISA) and designated Computer Security Incident Response Team -(CSIRT). They will have the following timeline to follow: +this role, the Linux Foundation will report the incident to the nominated ENISA +and designated CSIRT. They will have the following timeline to follow: - Within 24 hours of notification: send an early warning - Within 72 hours of notification: send a full vulnerability notification - Within 14 days of the incident's resolution: send a final report + +## Resources + +[Understanding the EU Cyber Resilience Act training](https://openssf.org/public-policy/eu-cyber-resilience-act/) - +Free training course provided by Linux Foundation and OpenSSF for decision +makers, software developers of open or closed software, and OSS stewards. + +[The Cyber Resilience Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R2847) - +The official and current text of the CRA. + +[Cyber Resilience Act - Implementation](https://digital-strategy.ec.europa.eu/en/factpages/cyber-resilience-act-implementation) - +An overview page published by the European Commission. Giving up to date +information on the CRA's implementation, guidance for the open source community, +essential information and an overview the progress of the Act so far. + +[Resources and news roundup from OpenSSF](https://openssf.org/public-policy/eu-cyber-resilience-act/) - +OpenSSF are the Open Source Security Foundation, placed under the Linux +Foundation. OpenSSF seek to make it easier to sustainable secure the +development, maintenance, release and consumption of open source software. From 6d4531196321b1e3035276642ffb967606f008ae Mon Sep 17 00:00:00 2001 From: Jem <6413628+jemgillam@users.noreply.github.com> Date: Wed, 9 Sep 2026 15:20:58 +0100 Subject: [PATCH 5/6] Apply batched suggestions from code review Co-authored-by: Benjie --- tsc/security-disclosure.md | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/tsc/security-disclosure.md b/tsc/security-disclosure.md index 3c687d9..2110127 100644 --- a/tsc/security-disclosure.md +++ b/tsc/security-disclosure.md @@ -3,6 +3,14 @@ title: Security disclosures and the Cyber Resilience Act (CRA) sidebar_position: 910 --- +> [!NOTE] +> +> This article, like all articles on this site, is maintained by the community. +> It reflects our understanding of the available information, but does not +> constitute legal advice and has not been written by legal professionals. You +> should seek qualified legal advice when assessing how the EU Cyber Resilience +> Act applies to your particular circumstances. + One of the TSC’s responsibilities is helping to respond to security incidents affecting GraphQL. The EU Cyber Resilience Act (CRA) introduces new requirements for how serious security incidents must be assessed and reported. These @@ -15,11 +23,11 @@ as GraphQL’s designated open-source software steward. ## Glossary -**Designated CSIRT** - "Designated Computer Security Incident Response Team" - a -body who accepts the vulnerability reports. +**Designated CSIRT** - "Designated Computer Security Incident Response Team" - an +official body who accepts the vulnerability reports. -**ENISA** - "The European Union Authority for Cybersecurity" - a second body who -accepts the vulnerability reports. +**ENISA** - "The European Union Authority for Cybersecurity" - a second official +body who accepts the vulnerability reports. **Legal person:** - An organization or entity recognised by law as having its own rights and obligations. This is distinct from a **natural person**, meaning @@ -42,17 +50,15 @@ covered by the CRA. The law only applies to "products with digital elements" (PDEs). PDEs are a software or a hardware product and its remote data processing -solutions, including separate software or hardware components. For the purposes -of this guidance, GraphQL Foundation software projects such as GraphQL.js should -be treated as PDEs. At this time (September 2026), it's understood that non -software GraphQL projects such as the GraphQL Specification itself do not count -as PDEs. +solutions, including separate software or hardware components. At this time +(September 2026), it's understood that non software GraphQL projects such as the +GraphQL Specification itself do not count as PDEs. Although GraphQL software projects are free and open-source and are not sold by -the GraphQL Foundation, they are intended to be used in software products and -services, including commercial ones. They therefore fall within the CRA's +the GraphQL Foundation, some are intended to be used in software products and +services, including commercial ones. They therefore may fall within the CRA's provisions for free and open-source software supported by an open-source -software steward (In GraphQL's case, the steward is the Linux Foundation). +software steward (in GraphQL's case, the steward is the Linux Foundation). ### PDE classification From f7f9d0b4e24d0941106452ae012ebb4169b9e63a Mon Sep 17 00:00:00 2001 From: Benjie Date: Mon, 5 Oct 2026 16:36:44 +0100 Subject: [PATCH 6/6] Ad another couple useful links --- tsc/security-disclosure.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/tsc/security-disclosure.md b/tsc/security-disclosure.md index 2110127..48ba5da 100644 --- a/tsc/security-disclosure.md +++ b/tsc/security-disclosure.md @@ -23,8 +23,8 @@ as GraphQL’s designated open-source software steward. ## Glossary -**Designated CSIRT** - "Designated Computer Security Incident Response Team" - an -official body who accepts the vulnerability reports. +**Designated CSIRT** - "Designated Computer Security Incident Response Team" - +an official body who accepts the vulnerability reports. **ENISA** - "The European Union Authority for Cybersecurity" - a second official body who accepts the vulnerability reports. @@ -122,3 +122,7 @@ essential information and an overview the progress of the Act so far. OpenSSF are the Open Source Security Foundation, placed under the Linux Foundation. OpenSSF seek to make it easier to sustainable secure the development, maintenance, release and consumption of open source software. + +[OSSF: The CRA Stewards One Pager](https://github.com/ossf/wg-globalcyberpolicy/blob/main/docs/CRA/stewards-one-pager.md) + +[OSSF: The Linux Foundation CRA Stewards Playbook](https://policy.openssf.org/CRA/stewards-playbook.html)