OSS + ELC EU 2026

Most organizations consuming open source have no systematic way to assess whether the projects they depend on are thriving, stagnating, or quietly dying. Scanners tell you about license, origin, and known vulnerabilities. Nothing tells you a maintainer is burning out or release cadence has silently stalled until it’s too late.

This talk introduces project health as a missing layer of supply chain risk management. We’ll cover the core metrics that matter from the work of CHAOSS (Community Health Analytics for Open Source Software) and how they complement security-focused efforts like OpenSSF Scorecard.

We’ll look at what’s ahead: making health data federated, queryable, and built into the tools and metadata infrastructure teams already use, so a health check becomes as automatic as a vulnerability scan. We’ll cover what’s being built now, what’s still unsolved, and how you can get involved.

Leave with a practical framework for evaluating dependency health today, and understand where this ecosystem is headed: toward a future where operationalized open health data at scale makes project health visible, measurable, and actionable for everyone who depends on open source.