Skip to main content

End-of-life calendar

When things stop getting security fixes — and what actually breaks when they do. The dates are published years ahead and are easy to find. The sentence after each one is the part nobody writes.

Dates checked · Notes last edited · Subscribe (.ics) · JSON

The next release to lose support is GitLab 19.2 on 15 October 2026. Reaching end of life does not stop software running — it stops the vendor shipping security fixes for it, which is when the surrounding ecosystem starts dropping it too.

Losing support next

Within 30 days8 releases

  1. 5 days

    GitLab 19.2

    Self-hosted instances stop receiving security backports at this point; GitLab only patches a short window of recent minors.

  2. 10 days

    Electron 42

    Electron supports only its most recent majors, so an app pinned here ships an increasingly out-of-date Chromium with known browser CVEs inside it.

  3. 11 days

    Next.js 15LTS

    Security patches stop, and the ecosystem moves faster than the framework: plugins and starters begin requiring 16 well before most teams have migrated.

  4. 12 days

    OpenSSL 3.4

    A short-lived branch, not an LTS one -- if you pinned to it deliberately you are on a two-year clock that ends here.

  5. 17 days

    Kubernetes 1.34

    Upstream patch releases stop, and the managed providers are the real deadline -- EKS, GKE and AKS force-upgrade clusters past their supported window, several of them charging extended-support rates first.

  6. 22 days

    Alpine Linux 3.21

    The branch stops receiving security updates, which means FROM alpine:3.21 becomes a permanently unpatched base layer in every image built from it.

  7. 22 days

    OpenSSL 3.6

    Another non-LTS branch reaching its end; check whether you pinned a minor or are tracking the LTS line.

  8. 28 days

    Ruby on Rails 8.0

    Security backports stop for this series, so an app left here has no supported path to a patch short of upgrading.

One to three months10 releases

  1. 31 days

    Microsoft .NET 9

    Microsoft ends support the same day as .NET 8 -- a Standard Term release expiring alongside the LTS one, which surprises teams who chose 9 for its newer features.

  2. 31 days

    Microsoft .NET 8LTS

    The LTS release most enterprises standardised on ends here, on the same day as .NET 9, leaving .NET 10 as the only supported target.

  3. 33 days

    PostgreSQL 14

    The final minor release lands and no further security fixes follow. Managed providers force-upgrade after this, and extension authors drop the version from their build matrices.

  4. 40 days

    GitLab 19.3

    The last of three GitLab minors expiring inside a quarter -- if you self-host, the upgrade cadence is the product, not an optional extra.

  5. 49 days

    Angular 20

    Long-term support ends, so no further security patches -- and Angular's upgrade path punishes skipped majors, so the longer you sit the worse the jump.

  6. 52 days

    Redis 8.0

    Security fixes stop for this series; check whether your managed provider tracks Redis versions or has quietly moved you to a fork.

  7. 55 days

    Docker Engine 25.0

    No further patches to the engine itself, which on a host running untrusted workloads is a different risk class from an out-of-date library.

  8. 82 days

    PHP 8.2

    Security support ends, and shared hosts tend to be the enforcement mechanism -- they start refusing the runtime, and Composer constraints rise underneath you.

  9. 82 days

    Spring Boot 4.0

    Open-source support ends here; continued patches move behind a commercial extended-support agreement.

  10. 87 days

    Electron 43

    An Electron app is only as patched as the Chromium it bundles, and this release stops receiving those updates.

Recently ended

Still running in plenty of places. These are the ones where the clock has already run out.

  1. Python 3.10

    python.org stops shipping security fixes. The knock-on is faster than the date suggests: CI base images disappear, and libraries raise their Requires-Python floor, so installs start failing on resolution rather than on syntax.

    What breaks, and what to do →

  2. Eclipse Temurin 26

    Temurin stops publishing builds for this release, so CI images and Dockerfiles pinned to JDK 26 quietly stop receiving patches while continuing to build fine.

  3. GitLab 19.1

    GitLab backports security fixes only to a short window of recent minors, so a self-hosted instance left here stops receiving them entirely.

  4. OpenSSL 3.0LTS

    The long-term-support branch most distros pinned to; after this the OpenSSL project ships it no further fixes, so anything vendoring or statically linking 3.0 inherits every later CVE.

    What breaks, and what to do →
Also ending34 more

Tracked and dated; no consequence written yet. Each date links to its endoflife.date row so you can check it at the source.