# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-VULN-004
title: Track unmaintained, deprecated and end-of-life components
finding:
  title: The product depends on components that no longer receive fixes
status: draft
profiles: [baseline]
risk:
  severity: medium
assessment: partial
tags: [end-of-life, maintenance]
description: |
  Dependencies marked as deprecated by their registry, archived by their maintainers, or without any release for a long time are identified, as well as language runtimes past their end of life. Each one has a replacement plan or a recorded acceptance.
rationale: |
  An unmaintained component will not get a fix when the next vulnerability is found, and abandoned package names are a target for takeover.
impact: |
  Replacing a core dependency can be a large piece of work.
audit:
  manual: |
    1. List deprecated, archived and long-inactive dependencies and end-of-life runtimes.
    2. Check each has a plan or an acceptance.
  checks:
    - id: postmortem
      engine: postmortem
      description: "archived / inactive source repositories"
      spec:
        command: postmortem harden --json
        control: CB-DEP-VULN-004
        coverage: online
        flags: [--online]
remediation:
  manual: |
    1. Add deprecation and end-of-life checks to the scheduled scan.
    2. Plan replacements, starting with runtime dependencies.
references:
  - title: Concise Guide for Evaluating Open Source Software
    url: https://best.openssf.org/Concise-Guide-for-Evaluating-Open-Source-Software
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
  - title: OWASP Software Component Verification Standard
    url: https://owasp.org/www-project-software-component-verification-standard/
    publisher: OWASP
    kind: standard
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SA-22
    relation: related
threats:
  - framework: cwe
    id: CWE-1104
related_controls:
  - id: CB-DEP-VULN-001
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16