DependencyTrack / DependencyTrack/dependency-track
Add End-of-life (EOL) / End-of-support (EOS) information for components
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Currently, Dtrack identifies Out-of-date components by checking for newer versions of components. But it does NOT identify whether a component is Out-of-Support or not.
### Proposed Behavior
We should be able to get EOL/EOS information of components.
Use case:
Take Spring boot for example. Couple of versions(2.7, 3.0) of Spring boot are nearing End of support date(for OSS).
Support timelines of recent Spring boot versions from https://spring.io/projects/spring-boot#support:
Branch | Initial Release | End of Support | End Commercial Support *
-- | -- | -- | --
3.2.x | 2023-11-23 | 2024-11-23 | 2026-02-23
3.1.x | 2023-05-18 | 2024-05-18 | 2025-08-18
3.0.x | 2022-11-24 | 2023-11-24 | 2025-02-24
2.7.x | 2022-05-19 | 2023-11-24 | 2025-08-24
2.6.x | 2021-11-17 | 2022-11-24 | 2024-02-24
Which means there will not be a patch available if a critical security vulnerability is identified. Given how widely Spring boot is used globally, there would a security crisis if another Log4j scenario occurs.
EOL/EOS feature would be a proactive step towards mitigating another Log4j.
This information is tracked by https://endoflife.date/
We could add an analyzer for https://endoflife.date/ to fetch this information for components that are tracked currently.
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.