Treat component updates as a governed product lifecycle process rather than ad hoc package maintenance. The goal is to keep supported products secure while preserving traceability between component versions, product releases and remediation evidence.
Component Update Management Starts Before Release
Choose dependencies with a realistic maintenance path and known update mechanism. Teams should understand how a component is upgraded, tested and rolled back before the product depends on it in the field.
Monitor Upstream Releases and Advisories
Track both routine releases and security advisories for important components. Security-relevant changes should enter the vulnerability and release process rather than waiting for the next planned product feature cycle.
Assess the Security and Compatibility Impact
A component update can fix one vulnerability while introducing behaviour, API or configuration changes. Review cybersecurity impact, compatibility, performance and dependencies before promoting the change into a supported product release.
Test in the Finished-Product Context
Regression and security testing should exercise the actual product configuration because a component can behave differently once integrated with surrounding services, privileges and data flows.
Update the SBOM and Inventory
When a component version changes, update the release-linked SBOM and component inventory. Preserve historical records so teams can still identify which older supported releases contain the previous component version.
Prioritise Security Updates During the Support Period
The manufacturer must handle vulnerabilities effectively throughout the support period. Security-critical component updates should therefore have an expedited path where delay would leave users exposed to known risk.
Review Whether a Change Alters Conformity Assumptions
Major component changes can affect the cybersecurity risk assessment, architecture evidence or conformity assumptions. Release governance should flag material dependency changes for additional review rather than treating every upgrade as routine maintenance.
Plan the End-of-Support Transition
When either the product or a core component approaches end of support, document the remaining update strategy, replacement plan and user communication so that lifecycle obligations do not end abruptly without a controlled transition.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.