Which add on's does Cpanel control?

Server software upgrades/updates only apply to server software installed by cPanel/WHM itself (Exim, Apache etc.). Items not installed by cPanel/WHM itself are not controlled by cPanel/WHM (e.g. Fantastico).

Additionally items that are better left to manual upgrades (as they need to be monitored to ensure nothing goes wrong) are not automatically upgraded. Most notably this includes Perl. Migrations from Apache 1.3.39 to 2.0.x or 2.2.x would also be manual rather than automatic.

 

Not quite. From your list:

phyMyAdmin within WHM/cPanel is automatically upgraded when upcp runs overnight if you have the update options set to automatic. It is upgraded to the latest version that cPanel have tested

SpamAssassin is a perl module and distributed by cpan.org this is updated as and when your local cpan.org mirror receives a new version and cPanel updates it's list of perl modules when upcp runs as per phyMyAdmin.

MySQL is updated by upcp to the latest of the version you are running that cPanel have tested. It won't upgrade between major versions (e.g. v4 to v5). That has to be done manually through WHM.

PHP and Apache are not upgraded at all automatically by cPanel. They must be upgraded manually through WHM (or /scripts/easyapache) and can be upgraded to the latest version that cPanel have tested.

Perl has to be upgraded manually, preferrably by using the distribution at http://layer1.cpanel.net as using that will ensure the perl modules cPanel requires are installed

Fantastico is a third party product from www.netenberg.com that is not cPanel's responsibility. Fantastico does come with an option to install a cron job to automatically upgrade itself. It doesn't, AFAIK, automatically upgrade any user installed applications.