Q2 2026 SCSC Roadmap
The Q2 2026 State of Supply Chain report is one quarter of work against measurement infrastructure that itself wears out. Six commitments shape the next two quarters; we publish them here both to anchor accountability and to let readers know what to compare against in Q3.
01npm at full-rigor parity
The deps.dev BigQuery pipeline replaces the ecosyste.ms dependent_repos_count-sort path for npm specifically. Brings the npm corpus from the top-100 light-rigor pass of Q2 §3.2.1 to the top-10K rigor of the other seven ecosystems.
02Manual top-100 verification per ecosystem
The verification model that produced the Guava false-positive correction in Q2 §3.2 (and the surface caveats noted in Appendix A) scales to top-100 across every ecosystem. Refines the boundary classifications, particularly the Slowing/Dormant edge and the intentional-sunset vs. maintainer-collapse distinction.
03Quarter-over-quarter delta analysis
Q2 is the snapshot; Q3 is the first delta. Reports newly-entered intersection list, newly-superseded packages with named successors, and ecosystems that shifted in the risk-weighted table.
04Monthly OSSF Criticality Score refresh
VCRI commits to picking up the criticality_score pipeline cadence dropped after 2025-07-25 (see Q2 §4). Published as monthly CSVs under VCRI auspices with full attribution back to OSSF as the originating methodology.
05Long-tail malicious-package companion analysis
Q2 §3.4 noted that the malicious-package signal lives mostly in the long tail outside the top-10K corpus. A companion issue focused on long-tail dynamics is on the roadmap; methodology requires a different sampling approach and is in design.
06Methodology tightening
Per Q2 §6 acknowledgments, the classification is heuristic; refinements land each issue's §2, documented explicitly. Readers should consult the methodology section of every issue rather than assuming continuity.
github.com/value-chain-risk-institute/state-of-supply-chain
and acknowledged in the next quarterly issue's §2 and §6.
This roadmap is a snapshot from the Q2 2026 issue. Q3 issue (~early August 2026) will publish an updated roadmap. The latest roadmap always lives at /state-of-supply-chain/{issue}/roadmap/.