# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-UPD-003
title: Do not fall more than a set number of major versions behind
finding:
  title: Dependencies are several major versions behind their current release
status: draft
profiles: [baseline]
risk:
  severity: low
assessment: partial
tags: [updates, maintenance]
description: |
  No direct dependency is more than {{ max_major_versions_behind }} major version(s) behind its latest stable release, unless a recorded plan exists.
rationale: |
  Old major versions stop receiving fixes, and the longer the gap, the harder the upgrade when a fix becomes urgent.
impact: |
  Major upgrades need to be planned regularly.
parameters:
  - name: max_major_versions_behind
    type: integer
    description: Maximum number of major versions behind the latest stable release.
    unit: versions
    default: 2
    profile_defaults:
      hardened: 1
    minimum: 0
    maximum: 5
audit:
  manual: |
    1. List direct dependencies with their major version gap.
    2. Check none exceeds {{ max_major_versions_behind }} without a plan.
remediation:
  manual: |
    1. Plan the overdue major upgrades.
references:
  - title: NIST SP 800-218 - Secure Software Development Framework (SSDF) 1.1
    url: https://csrc.nist.gov/pubs/sp/800/218/final
    publisher: NIST
    kind: standard
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SI-2
    relation: related
threats:
  - framework: cwe
    id: CWE-1104
related_controls:
  - id: CB-DEP-VULN-004
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16