End of support date for Microsoft code analysis

[Aishbeck]

I am looking for end of support date for the following components to feed in SBOM document

Microsoft.CodeAnalysis - 2.10.0
Microsoft.CodeAnalysis.Csharp - 2.10.0

[jaredpar]

The components themselves do not have support policies as they're not a product. Instead the support policy derives from the version of Visual Studio that these shipped in. For 2.10 that is Visual Studio 15.9 which is still in extended support. But the bar for changes to that release is incredibly high and I do not think this would meet that bar.

[Aishbeck]

we use .net framework 4.8 which has support date till 2029 , can we use that for these two ?

[jaredpar]

There are newer versions of the packages that correspond with more actively supported Visual Studio instances. For example you could use 4.11. That is still very much supported on .NET Framework.