Draft ECMA-xxx / September 22, 2025

Common Lifecycle Enumeration Specification

About this Specification

The document at https://tc54.org/ecmaXXX/ is the most accurate and up-to-date Common Lifecycle Enumeration specification.

This document is available as a single page and as multiple pages.

Contributing to this Specification

This specification is developed on GitHub with the help of the OWASP community. There are a number of ways to contribute to the development of this specification:

Refer to the colophon for more information on how this document is created.

Introduction

The Common Lifecycle Enumeration (CLE) specification provides a standardized, machine-readable format for communicating lifecycle events of software and hardware components throughout the supply chain. As modern software systems increasingly rely on complex networks of dependencies and third-party components, understanding the lifecycle status of these components becomes critical for maintaining secure, compliant, and reliable systems.

This specification addresses the challenge of tracking component lifecycles across diverse ecosystems by defining a unified format for expressing events such as releases, end-of-support announcements, end-of-life declarations, and component transitions. By providing a consistent structure for this information, CLE enables automated tooling to assess risks, plan migrations, and maintain supply chain transparency.

The CLE specification is designed to complement existing standards in the software supply chain ecosystem, including the Package-URL (PURL) specification for component identification and the Version Range (VERS) specification for version constraints. It integrates with Software Bill of Materials (SBOM) formats and transparency exchange protocols to provide comprehensive lifecycle visibility.

This document specifies version 1.0.0 of the Common Lifecycle Enumeration standard, developed under the auspices of Ecma International Technical Committee 54, Task Group 3 (TC54-TG3).