Ability to create a policy condition based on "Age of latest version" #5290
Description
Current Behavior
We are trying to implement an "out-of-date" policy for open source components with these rules:
- The component in use must not be older than 2 years.
- The latest available (upstream) version of the component must not be older than 1 year.
With this we hope to accomplish a mix of allowing old and stable versions (with no known vulnerabilities) but be alerted if the project is not longer being actively developed (meaning no future fixes if a vulnerability is found).
Proposed Behavior
A possibility to make policy conditions based on when the latest version of a component was released.
Checklist
- I have read and understand the contributing guidelines
- I have checked the existing issues for whether this enhancement was already requested