Skip to main content
Plans: Every plan. Who: every member sees it and marks release lines handled.
A component can be free of known vulnerabilities and still be a risk: when its project stops shipping security fixes for the release line you use, the next flaw in it won’t be fixed upstream. Pharus checks every component in your active SBOMs against endoflife.date and shows which ones have reached end of life upstream, or will within 6 months.
End of life upstream isn’t a vulnerability, and it never opens an incident. It is also not your own support period, which is your promise to your users. Plan the move to a supported line, or record why it is handled.

​
How Pharus finds a component’s release line

Pharus looks up each component on endoflife.date by its purl, then by the vendor and product in its CPE, and last by its name when it has neither. A match by name is marked “by name”. The component’s version picks the release line: 4.10 is not part of the 4.1 line. endoflife.date doesn’t track every project (BusyBox, glibc, U-Boot, curl and OpenSSH, for example), so the list can’t be complete. Pharus refreshes the dates every six hours. Retired SBOMs aren’t counted.

​
Where it shows

  • An SBOM’s page. The components table has an Upstream support column, with the release line and “LTS” where it applies. Above the table, a notice says how many components have reached end of life upstream, how many more end within 6 months and how many components endoflife.date tracks, with a link to Open the family page.
  • The SBOMs page. A family’s SBOM shows “n end of life” under its component count, for lines nobody has marked handled.
  • The family page. Under Settings → Product families, open the family. The Component end of life card lists every release line in the family’s active SBOMs that has ended or ends within 6 months, with the Component, Release line, the product versions it is In, its Upstream support and whether it is Handled. A line that ends before your own support period for that version is flagged “Ends before your support period”: from that date, fixes are yours to make or find.
  • CI. The answer to an SBOM upload lists ended and ending components in eol, and as warnings that the pipeline examples print on the run.
  • Reports. The weekly digest, the board report and the technical documentation list the release lines past end of life that nobody has marked handled.

​
Mark a release line handled

When a line is under control, record why. For example, your Yocto release backports its fixes, or the next product version replaces it.
1

Open the family

Go to Settings → Product families, open the family and find the Component end of life card.
2

Mark it handled

Select Mark handled on the release line. Under Why it’s handled, write up to 500 characters, for example “Yocto scarthgap backports its fixes until April 2028” or “replaced in 5.0, shipping in March”.
3

Save

Select Mark handled.
The line keeps showing on the family page with a Handled badge, your note, who wrote it and when. It leaves the CI warnings, the digest and the board report. The note holds for that component’s release line in this family, in every product version; saving it again replaces it. To undo it, select Reopen on the line. Marking handled and reopening are recorded in the audit trail.

Support periods

SBOMs

SBOM quality

Weekly digest