Description
Dependencies marked as deprecated by their registry, archived by their maintainers, or without any release for a long time are identified, as well as language runtimes past their end of life. Each one has a replacement plan or a recorded acceptance.
Rationale
An unmaintained component will not get a fix when the next vulnerability is found, and abandoned package names are a target for takeover.
Impact
Replacing a core dependency can be a large piece of work.
Audit
- List deprecated, archived and long-inactive dependencies and end-of-life runtimes.
- Check each has a plan or an acceptance.
Automated: every check must pass. Scanners report each check by its id.
postmortem
archived / inactive source repositories
command: postmortem harden --json
control: CB-DEP-VULN-004
coverage: online
flags:
- --online
Remediation
- Add deprecation and end-of-life checks to the scheduled scan.
- Plan replacements, starting with runtime dependencies.
References
- Concise Guide for Evaluating Open Source Software OpenSSF, guide, accessed 2026-10-16
- OWASP Software Component Verification Standard OWASP, standard, accessed 2026-10-16
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | SA-22 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID | Note |
|---|---|---|
| Common Weakness Enumeration | CWE-1104 |
Related controls
- related
CB-DEP-VULN-001Scan dependencies for known vulnerabilities continuously
People and lifecycle
| Authors | Alice |
| Introduced in | v1.0.0 |
| Created, updated | 2026-10-16, 2026-10-16 |