Description
No direct dependency is more than {{ max_major_versions_behind }} major version(s) behind its latest stable release, unless a recorded plan exists.
Rationale
Old major versions stop receiving fixes, and the longer the gap, the harder the upgrade when a fix becomes urgent.
Impact
Major upgrades need to be planned regularly.
Parameters
| Parameter | Baseline | Hardened | Bounds | Description |
|---|---|---|---|---|
max_major_versions_behindinteger | 2 versions | 1 versions | 0 to 5 | Maximum number of major versions behind the latest stable release. |
The value used is your override, else the profile's, else the default. Bounds limit what an override may set.
Audit
- List direct dependencies with their major version gap.
- Check none exceeds {{ max_major_versions_behind }} without a plan.
Remediation
- Plan the overdue major upgrades.
References
- NIST SP 800-218 - Secure Software Development Framework (SSDF) 1.1 NIST, standard, accessed 2026-10-16
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | SI-2 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID | Note |
|---|---|---|
| Common Weakness Enumeration | CWE-1104 |
Related controls
- related
CB-DEP-VULN-004Track unmaintained, deprecated and end-of-life components
People and lifecycle
| Authors | Alice |
| Introduced in | v1.0.0 |
| Created, updated | 2026-10-16, 2026-10-16 |