What it asks for. This category covers risk from using libraries, frameworks, runtimes and other components that are unsupported, out of date or known to be vulnerable. It applies to client and server side components and their nested dependencies, and includes failing to know which versions are in use or to scan and patch them in a timely way.
In practice. Organisations maintain an inventory of components, ideally as a software bill of materials, and use software composition analysis in the build pipeline. Unused dependencies are removed, components come from trusted sources and updates are applied on a defined schedule, with faster handling for exploited issues. Evidence includes SBOMs, scan results, patching metrics and documented exceptions for components that cannot yet be upgraded.
Common gaps. Transitive dependencies and container base images are often missed. Teams also accumulate end of life frameworks that receive no fixes, with no plan to migrate.