We’re pleased to celebrate an important milestone for four projects in the Eclipse Technology Top-Level Project: Eclipse SW360, Eclipse Tycho, Eclipse Apoapsis, and Eclipse Common Security Infrastructure (CSI).
Graduation marks a project’s transition from the incubation phase to the mature phase of the Eclipse Foundation Development Process. It recognises more than the maturity of the technology itself. It reflects the work of project teams to establish open and transparent development practices, engage their communities, manage intellectual property and security responsibilities, and operate as sustainable Eclipse open source projects.
Each of these projects serves a different part of the software development lifecycle, from software composition analysis and component management to Eclipse builds and software supply chain security.
Eclipse SW360: Managing Software Components at Scale
Eclipse SW360 provides a central catalogue for managing information about the software components used across an organisation.
Teams can use SW360 to track components, licences, projects, bills of materials, and vulnerability information, while integrating with external systems such as FOSSology and other software scanning tools. Its goal is to help developers, architects, open source programme offices, and compliance teams make informed decisions about the software they use.
The project continues to evolve technically. Its 20.1.0 release, published in July 2026, introduced a new Next.js-based frontend and strengthened its REST API while maintaining the existing backend functionality.
Eclipse SW360's graduation is a major milestone honoring over ten years of continuous efforts of the community. This achievement reflects the immense dedication of our contributors in building not just exceptional software, but following the open, collaborative processes of the Eclipse Foundation that sustain it. Over the years, their efforts have evolved SW360 into a trusted industry standard for software composition and compliance. Ultimately, achieving mature status signals to our adopters that SW360 is built on a rock-solid foundation, ensuring continued engineering innovation and long-term support for the organizations that depend on us every day.
— Gaurav Mishra Project Lead, Eclipse SW360
Eclipse Tycho: Building Eclipse and OSGi Software with Maven
Eclipse Tycho provides a Maven-centric, manifest-first approach to building Eclipse Platform plug-ins, OSGi bundles, features, p2 repositories, and Eclipse RCP applications.
Instead of duplicating Eclipse Platform plug-in and OSGi metadata in the Maven configuration, Tycho works with the native metadata used by these technologies. It supports dependency resolution, compilation, testing, packaging, and publishing as part of Maven-based build workflows.
Tycho is also associated with the Eclipse IDE and Platform Working Group, reflecting its role in the tooling and build ecosystem around Eclipse IDE technologies.
Tycho has been building the Eclipse IDE and countless Eclipse-based products for over a decade. Graduation makes official what has been already known: Tycho is a mature, dependable foundation for building OSGi and Eclipse software with Maven. The project was ready years ago but forgot to ask for graduation as this never affected daily work for the project.
— Aleksandar Kurtakov, Project Lead, Eclipse Tycho
For many years, Tycho has played an important role in building and releasing Eclipse-based software. It helps teams produce the plug-ins, p2 repositories and applications they need to maintain and evolve products built on Eclipse RCP. Its graduation recognises a mature project whose work remains valuable to the wider Eclipse IDE and Platform ecosystem
— Thomas Froment, Program Manager, Development Tools at Eclipse Foundation
Eclipse Apoapsis: Open Source Software Composition Analysis at Scale
Eclipse Apoapsis addresses large-scale software composition analysis and open source component management.
The project combines reusable process blueprints with a reference implementation, ORT Server, based on the OSS Review Toolkit. ORT Server adds capabilities for running software composition analysis as a scalable service, including a REST API, access management, a web frontend, centralised software inventory management, and Kubernetes integration.
For teams managing open source dependencies across many applications and repositories, Apoapsis provides both technical building blocks and practical patterns for areas such as vulnerability monitoring, compliance analysis, and SBOM generation.
The Eclipse Foundation is also investigating how Eclipse Apoapsis could support parts of its IP Due Diligence Process, exploring how its software composition analysis capabilities might complement existing review workflows
Apoapsis completed its Graduation Review in September 2026.
From going public in spring 2024 to reaching version 0.93.0, Eclipse Apoapsis has evolved into a mature, scalable software compliance platform built on the OSS Review Toolkit (ORT).
By delivering a full web UI and a growing ecosystem, including a CLI, GitHub Action, and Helm chart, we’ve built a robust foundation.
Graduation proves to adopters and contributors alike that the Eclipse Apoapsis ORT Server is stable and enterprise-ready.
— Martin Nonnenmacher, Project Lead, Eclipse Apoapsis
Eclipse Common Security Infrastructure: Building Shared Security Foundations
Eclipse Common Security Infrastructure (CSI), which produces tools like Otterdog, which provides declarative configuration management for GitHub repositories, brings together technologies and practices used to secure the software supply chains of Eclipse Foundation projects.
Unlike the other projects in this group, CSI has a Foundation-wide role. It provides open source infrastructure that supports the Eclipse Foundation’s release engineering and security work and helps projects adopt consistent approaches to repository configuration and software supply chain security.
The project currently declares compliance with SLSA Build Level 3, reflecting the emphasis CSI places on build and supply chain security.
Graduating Eclipse CSI is an important milestone for both the project and the Foundation. Developing our security infrastructure in the open makes that work transparent, collaborative, and reusable across the community and beyond. Graduation reflects CSI’s operational maturity and its readiness to serve as dependable, long-term infrastructure, helping Eclipse Foundation project teams strengthen their security practices and respond more effectively to evolving requirements.
— Mikaël Barbero, Project Lead and Head of Security at Eclipse Foundation
Graduation Is a Community Milestone
At the Eclipse Foundation, incubation is not simply a measure of whether software is production-ready. It is the period in which a project establishes itself as a functioning Eclipse open source project and demonstrates the practices expected by the Eclipse Development Process.
A successful graduation recognises a project team’s ability to operate openly and transparently, work through Eclipse Foundation governance and intellectual property processes, maintain appropriate security practices, release software, and build communities around its technology.
With Eclipse CSI to manage critical elements of your supply chain, Eclipse SW360 to track the software that you use, Eclipse Apoapsis to identify and help mitigate compliance issues, and Eclipse Tycho for your OSGi/Maven builds, these projects are representative of the incredible range of technologies being developed by Eclipse Technology open source projects. The Eclipse Technology PMC is excited that these mature technologies, being developed by some of our most experienced maintainers, have formalised their exemplary nature by moving into the mature phase.
— Wayne Beaton, Eclipse Technology PMC
The four projects also show the breadth of work happening under the Eclipse Technology Top-Level Project: managing software components, building Eclipse-based software, analysing open source dependencies, and strengthening the infrastructure that helps secure open source development itself.
Congratulations to the committers, contributors, project leads, PMC members, adopters, and community members who have helped Eclipse SW360, Eclipse Tycho, Eclipse Apoapsis, and Eclipse Common Security Infrastructure reach this milestone.
Explore the Projects
Explore the code, join the project discussions, report issues, or contribute. Graduation is a milestone, but the work of building open source communities continues.
For teams developing open source software who want a vendor-neutral governance model, transparent practices, and guidance to cultivate a thriving ecosystem, explore how to host your effort at the Eclipse Foundation: https://www.eclipse.org/projects/bring-your-project/.
