DependencyTrack / DependencyTrack/dependency-track

Add End-of-life (EOL) / End-of-support (EOS) information for components

Open
#3,108 29 comments 29 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Currently, Dtrack identifies Out-of-date components by checking for newer versions of components. But it does NOT identify whether a component is Out-of-Support or not.

### Proposed Behavior

We should be able to get EOL/EOS information of components.

Use case:
Take Spring boot for example. Couple of versions(2.7, 3.0) of Spring boot are nearing End of support date(for OSS).
Support timelines of recent Spring boot versions from https://spring.io/projects/spring-boot#support:

Branch | Initial Release | End of Support | End Commercial Support *
-- | -- | -- | --
3.2.x | 2023-11-23 | 2024-11-23 | 2026-02-23
3.1.x | 2023-05-18 | 2024-05-18 | 2025-08-18
3.0.x | 2022-11-24 | 2023-11-24 | 2025-02-24
2.7.x | 2022-05-19 | 2023-11-24 | 2025-08-24
2.6.x | 2021-11-17 | 2022-11-24 | 2024-02-24

Which means there will not be a patch available if a critical security vulnerability is identified. Given how widely Spring boot is used globally, there would a security crisis if another Log4j scenario occurs.

EOL/EOS feature would be a proactive step towards mitigating another Log4j.

This information is tracked by https://endoflife.date/
We could add an analyzer for https://endoflife.date/ to fetch this information for components that are tracked currently.

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.