How long to support 3rd party dependencies?

Based on the discussion on the support for an old libcurl version with the release currently voted on I would like to start
a discussion how long we should support old 3rd party library versions we depend on. I think we should define a set of rules
and document them somewhere on the website or in the documentation.

Just some rules I quickly thought about as a discussion starter:

1. Do not support versions past 10 years of their release.
2. Eventually shorten 1. if the open source version of the library is unsupported upstream and bugs in the old library prevent
things from working any longer.

Regards

Rüdiger