Eclipse Steady offers a code-based approach to detect the presence of open-source code subject to known vulnerabilities, to assess the severity of findings and to propose mitigations. Its code-centricity allows Steady to improve on several dimensions, esp. detection accuracy. However, public vulnerability databases like the NVD do not contain the required information, hence, a dedicated vulnerability database had to be established, needing continuous contributions. This presentation will provide an overview about on-going research activities related to the creation and maintenance of an open-source vulnerability database for Eclipse Steady. Moreover, we will shortly discuss the possibility to use the code-analysis features of Eclipse Steady to identify unused dependencies, whose removal would reduce applications' attack surface and maintenance effort.

Sat4j is a library of tools in Java to solve combinatorial problems with Boolean variables. One of such problem is the canonical SATisfiability problem, one of the simplest hard problems in theoretical computer science. Interestingly, in practice, software able to solve instances of such problem (so called *SAT solvers*) improved drastically in early 2000's. Those solvers are used nowadays to solve a wide range of problems, from hardware or software verification to bioinformatics. Sat4j provides such technology to Java users. From the beginning, Sat4j has been hosted by OW2, and developed using Eclipse. Since 2008, Sat4j is used in Eclipse p2 to manage Eclipse plugin dependencies. This talk will review the conditions, benefits and limitations of growing open source research software in a non academic open source world.