That's an excellent observation. IEC 62304 speaks to these issues, although not in the context of open source per se. It also depends on the class of your devi

That's an excellent observation. IEC 62304 speaks to these issues, although not in the context of open source per se. It also depends on the class of your device (A, B or C in 62304 parlance) how much rigor you must put into your software process.