CRA support period (proposal) ​
Status: Template — to be reviewed by the controller's DPO / counsel. Draft of 2026-10-13; not reviewed yet. User decision pending: the support period and the release scheme below are a proposal.
Regulation (EU) 2024/2847 (Cyber Resilience Act, CRA). Quavon UG (haftungsbeschränkt) is the manufacturer of the self-hosted CodeLotse distribution (container images, Compose files, Helm chart). The hosted edition is a service; whether parts of it are "remote data processing solutions" of the self-hosted product is a question for counsel.
Legal frame ​
| Provision | Content | Applies from |
|---|---|---|
| Art. 13(8) | The support period reflects the time the product is expected to be in use. It is at least five years, unless the product is expected to be in use for less than five years, in which case it matches that time. The reasons are recorded in the technical documentation (Annex VII) | 11 December 2027 |
| Art. 13(9) | Each security update made available during the support period remains available for at least 10 years after its issue, or for the rest of the support period if longer | 11 December 2027 |
| Art. 13(19), Annex II point 8 | The end date of the support period, at least month and year, is stated clearly at the time of purchase (or download) and, where technically feasible, users are notified when support ends | 11 December 2027 |
| Annex I Part II(2), (8) | Vulnerabilities are remediated without delay, including through security updates, provided free of charge with advisory messages | 11 December 2027 |
| Art. 14 | Reporting of actively exploited vulnerabilities and severe incidents | 11 September 2026 (applies now) |
Application dates per Art. 71(2). Sources: Art. 13, Art. 71, Annex II (unofficial consolidation; counsel to check against the Official Journal text, EUR-Lex).
Proposal ​
- Versioning: semantic versioning,
MAJOR.MINOR.PATCH. A major line is all releases with the sameMAJOR. Minor releases within a line do not break configurations or data; upgrades within a line are automatic database migrations. - Support period: each major line receives security updates for five years from the release of its first version (
MAJOR.0.0). Security fixes ship as a new patch release of the latest minor release of each supported line. Users stay supported by upgrading within the line, which is free and non-breaking. - Expected use: a self-hosted developer tool is typically operated for several years; five years is the legal minimum and is proposed as the default. A shorter period is not proposed.
- Statement: the end of support (month and year) is published for each major line in
SECURITY.md, in the release notes and in the download location, and shown byquavon doctorwhen the installed line is within 6 months of its end or past it. - Availability of updates: released images and source tags of every security update remain downloadable for at least 10 years after release (registry retention policy and Git tags never deleted).
- Before the first stable release (current state): only the latest commit on
mainreceives fixes, as stated in SECURITY.md. No version is placed on the market yet.
Decision ​
| Item | Decision |
|---|---|
| Support period per major line | <5 years from MAJOR.0.0 — to confirm> |
| Release and versioning scheme | <semantic versioning, as above — to confirm> |
| Registry and retention for 10-year availability | <registry to choose> |
| Decided by, date | <…> |
Questions for counsel ​
- Is the hosted edition, or any of its components, in CRA scope?
- Does the open-source distribution under Apache-2.0 with a paid hosted edition count as making available "in the course of a commercial activity"? (Working assumption: yes, Quavon UG (haftungsbeschränkt) is manufacturer.)
- Is "latest minor of each supported major line" an acceptable way to provide security updates during the support period?