@PeterSommerlad @jyasskin 1. That’s not really practical though. If that was the standard EU folks would wake up the next day finding they couldn’t use media for instance because the FFmpeg maintainers super do not care. Very few important components like that even try to do the SBOM stuff CRA requires. Requiring everything like that to be reimplemented would likely be a net security decrease because no matter how competent, people still write bugs.
2. Even if (1) is solved, a LOT of real world issues like this are operational. e.g. “we issued the patch for MS08-067 8 years ago but you won’t reboot that server to take the patch so you still get exploited” and that likely devolves into a bunch of finger pointing