Track Status / Support Life Cycle of packages (supported/unsupported/abondoned/...)

[valentijnscholten]

Current Behavior

Status / Support Life Cycle of packages is not tracked by Dependency Track

Proposed Behavior

Some package repositories provide information about packages that are abondoned (Composer). Other repositories might also provide information about whether packages are supported or unsupported.

It would be good if these could be tracked by Dependency Track, for example to add risk scores or flags to packages that are abandoned.

Some example from Compose / Packagist:

https://packagist.org/p2/laminas/laminas-text.json
"abandoned": true

https://packagist.org/p2/laminas/laminas-mail.json

"abandoned": "symfony/mailer"

symfony-mailer is suggested as replacement for the abandoned laminas-mail.

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this enhancement was already requested

[mieliespoor]

Yes, nuget has the ability to deprecate packages. It would be good if that could be flagged as an operational risk.