I listened to an episode of Open Source Security Podcast and they talked about making EOL of opensource dependencies a CVE type. I think it bears thought.