> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pharussecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Component end of life

> See which components in your SBOMs are on a release line their project no longer ships security fixes for, and record how you handle each one.

<Info>
  **Plans:** Every plan. **Who:** every member sees it and marks release lines handled.
</Info>

A component can be free of known vulnerabilities and still be a risk: when its project stops shipping security fixes for
the release line you use, the next flaw in it won't be fixed upstream. Pharus checks every component in your active
SBOMs against [endoflife.date](https://endoflife.date) and shows which ones have reached end of life upstream, or will
within 6 months.

<Note>
  End of life upstream isn't a vulnerability, and it never opens an incident. It is also not your own
  [support period](/monitoring/support-periods), which is your promise to your users. Plan the move to a supported line,
  or record why it is handled.
</Note>

## How Pharus finds a component's release line

Pharus looks up each component on endoflife.date by its purl, then by the vendor and product in its CPE, and last by its
name when it has neither. A match by name is marked "by name". The component's version picks the release line: 4.10 is
not part of the 4.1 line.

| State | Shown as | Meaning |
| - | - | - |
| Ended | "Ended" and the date | The project no longer ships security fixes for this release line |
| Ending | "Ends" and the date | Security fixes for this release line stop within 6 months |
| Supported | "Until" and the date, or "Supported" | The project still ships security fixes for this release line |
| Version not listed | "Version not listed" | endoflife.date tracks the project, but not this version's release line |
| Not tracked | "—" | endoflife.date doesn't track this project |

endoflife.date doesn't track every project (BusyBox, glibc, U-Boot, curl and OpenSSH, for example), so the list can't be
complete. Pharus refreshes the dates every six hours. Retired SBOMs aren't counted.

## Where it shows

* **An SBOM's page.** The components table has an **Upstream support** column, with the release line and "LTS" where it
  applies. Above the table, a notice says how many components have reached end of life upstream, how many more end
  within 6 months and how many components endoflife.date tracks, with a link to **Open the family page**.
* **The SBOMs page.** A family's SBOM shows "n end of life" under its component count, for lines nobody has marked
  handled.
* **The family page.** Under **Settings → Product families**, open the family. The **Component end of life** card lists
  every release line in the family's active SBOMs that has ended or ends within 6 months, with the **Component**,
  **Release line**, the product versions it is **In**, its **Upstream support** and whether it is **Handled**. A line that
  ends before your own support period for that version is flagged "Ends before your support period": from that date,
  fixes are yours to make or find.
* **CI.** The answer to an [SBOM upload](/api-reference/sboms#responses) lists ended and ending components in `eol`, and
  as warnings that the pipeline examples print on the run.
* **Reports.** The [weekly digest](/monitoring/weekly-digest), the [board report](/reports/board-report) and the
  [technical documentation](/reports/technical-file) list the release lines past end of life that nobody has marked
  handled.

## Mark a release line handled

When a line is under control, record why. For example, your Yocto release backports its fixes, or the next product
version replaces it.

<Steps>
  <Step title="Open the family">
    Go to **Settings → Product families**, open the family and find the **Component end of life** card.
  </Step>

  <Step title="Mark it handled">
    Select **Mark handled** on the release line. Under **Why it's handled**, write up to 500 characters, for example
    "Yocto scarthgap backports its fixes until April 2028" or "replaced in 5.0, shipping in March".
  </Step>

  <Step title="Save">
    Select **Mark handled**.
  </Step>
</Steps>

The line keeps showing on the family page with a **Handled** badge, your note, who wrote it and when. It leaves the CI
warnings, the digest and the board report. The note holds for that component's release line in this family, in every
product version; saving it again replaces it.

To undo it, select **Reopen** on the line. Marking handled and reopening are recorded in the
[audit trail](/reports/audit-trail).

## Related

<CardGroup cols={2}>
  <Card title="Support periods" icon="calendar-clock" href="/monitoring/support-periods" />

  <Card title="SBOMs" icon="package" href="/monitoring/sboms" />

  <Card title="SBOM quality" icon="list-checks" href="/monitoring/sbom-quality" />

  <Card title="Weekly digest" icon="mail" href="/monitoring/weekly-digest" />
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.