Csomag your CRA support window

Under the CRA you must handle vulnerabilities for your product's expected lifetime — and for at least five years unless it's genuinely in use for less. Set the lifetime and see the obligation.