About

What this site is

A version reaches end of life and nothing happens. No alert, no broken build. It just quietly stops getting security patches while it keeps running in production. This site tracks when that happens, for 462 products and 8,311 release branches. For a subset it also counts how many patches a dead version has already missed.

The part that isn't just dates

Release dates are published by vendors and mirrored in plenty of places. The number nobody publishes is the one that answers "so how bad is it?". That's the count of vulnerabilities disclosed after a branch went end of life and fixed only in newer ones. PHP 7.4 has gone over a thousand days without a patch. That's the number we compute, from NVD, for 13 products where the reasoning actually holds.

It doesn't hold everywhere, and we don't pretend otherwise. Linux distributions backport fixes into supported branches and sell extended maintenance on top, so "the new version got the fix, the old one didn't" is simply false for Ubuntu or Debian. Hardware has no comparable vulnerability stream. Those products get lifecycle dates and nothing more.

Where the dates come from

For 15 products we read the vendor's own release data directly: php.net's release feed, the Node.js release working group's schedule file, Microsoft's .NET release index, and so on. Those pages say so in their footer, with a link to the exact source.

For vendors that publish dates on a support page but not as structured data, an extraction pipeline reads the page and pulls the dates out, keeping only what it can quote verbatim from the page itself. The rest comes from openly licensed public datasets, mirrored into our own repository and compiled by us every day.

The full breakdown is on the data sources page.

How we handle dates we don't know precisely

Vendors often announce a month and not a day: "April 2028". Padding that to the 30th invents a precision nobody published, and dropping it claims the vendor said nothing. We keep month precision as its own thing, display it as "April 2028", and never use it to compute a day count. If you see a countdown, the underlying date was a real day.

Corrections

Dates go stale and vendors move goalposts. If something here is wrong, tell us and it gets fixed. That's more useful to us than to you. Get in touch.

Not affiliated with any vendor. Data is refreshed daily; the last run was 2026-08-12.