I'm not sure if the SDK is the correct place for this.  For instance, most packages in the framework would need to add this new policy to their SDK table but correctly mark its support as "None" or something similar.  Perhaps the "Notes" for SDK M2 could be updated for such projects to state that the README was updated to inform users of the lack of support and that steps were taken to express clearly the last known supported versions.

Instead, sunsetting seems like something that should happen at the level of the framework rather than the level of an individual project.  I would guess that the framework should have a procedure for sunsetting a project so that the decision related to how to deal with this involves more parties and considerations are made about how to propagate this through, for example, the website and the bandframework repo.  The (evolving) procedure could, for example, define the steps proposed here and ensure as well as ensure that M2 Notes are updated (if so desired).

The idea to put an upper limit of external dependence versions is interesting.  Should we take that further? Should the development team make a final release that bakes those same limitations into those publicly-distributed packages?  Should we go further still and have the package print a warning that users are using the last supported version?

NOTE: It looks like some of the steps that should go into a procedure are already being determined in PR
#203

Collecting what I shared in today's meeting:

I agree that the SDK is probably not the best place for this.
Instead, I propose that the following should be done (as part of this PR):

• Develop a new doc, such as https://github.com/bandframework/bandframework/blob/main/resources/dev_guide/component-sunsetting-proc.rst , that states what the expectation is.
• Add a very brief note in https://github.com/bandframework/bandframework/blob/main/CONTRIBUTING.rst that links to the above doc
• To https://github.com/bandframework/bandframework/blob/main/resources/dev_guide/release-proc.rst in "Before Release" a check is added to inventory all BAND components to list the ones that are not being actively maintained; this should point to the above doc and also ensure that any newly inactive components are noted in the release's changelog