// End-of-life tracker
When your stack stops getting patched
Community end-of-life dates for the enterprise open source layer, each with the source it came from. Other trackers give you the date. These pages give you what stops, what actually breaks in the upgrade, what it costs, and what an auditor will say — including when the honest answer is that you do not need us.
Coming up
Dates still ahead. These are the ones you can still plan around rather than react to.
- .NET 810 November 202659 days.NET 8 reaches end of support on 10 November 2026. The exact date, what stops, why .NET 9 does not buy you time, the upgrade path to .NET 10, and how to stay patched if you cannot move yet.
- PostgreSQL 1412 November 202661 daysPostgreSQL 14 reaches end of life on 12 November 2026, the same week as .NET 8. The date, what stops, why upgrading 13 to 14 is a mistake, and how much runway you actually have.
- Apache Tomcat 9.031 March 2027200 daysTomcat 9.0 reaches end of life on 31 March 2027. The date, what stops, why the javax to jakarta rename makes this the migration that needs the most lead time, and the bridge options.
Already end of life
Most recent first. Every one of these lines still runs somewhere in production.
- PostgreSQL 1313 November 2025PostgreSQL 13 reached end of life on 13 November 2025. What stopped, why data-corruption fixes matter more than CVEs here, what breaks in a major upgrade, and how to stay patched on 13.
- Node.js 1830 April 2025Node.js 18 went end of life on 30 April 2025 at release 18.20.8. Why the bundled OpenSSL makes this riskier than an OS scan suggests, why your image CVE count exploded, and what to do.
- PostgreSQL 1221 November 2024PostgreSQL 12 went end of life on 21 November 2024. What stopped, the collation trap in major upgrades, and how to stay patched on 12 while you move.
- .NET 612 November 2024.NET 6 went out of support on 12 November 2024. What stopped, why your image scans light up, the upgrade path to .NET 10, and how to stay patched on 6 while you migrate.
- Apache Kafka 3.86 November 2024Kafka 3.8 went end of life on 6 November 2024. Why 3.9 is the mandatory bridge off ZooKeeper, why the KRaft migration does not roll back, and how to stay patched on 3.8 meanwhile.
- RabbitMQ 3.1317 September 2024RabbitMQ 3.13 went end of life the day 4.0 shipped. Why the community window is shorter than teams expect, why removing classic mirrored queues blocks the upgrade, and how to stay patched on 3.13.
- Spring Framework 5.331 August 2024 (OSS support)Spring Framework 5.3 ended open-source support on 31 August 2024 at release 5.3.39. Why it is welded to Java 8, what a Spring 6 migration really scopes to, and how to stay patched meanwhile.
- Redis 7.029 July 2024Redis 7.0 went end of life on 29 July 2024 at release 7.0.15. Why the licence change matters more than the version, whether Valkey is the answer for you, and what actually breaks in a Redis upgrade.
- Apache Tomcat 8.531 March 2024Tomcat 8.5 went end of life on 31 March 2024 at release 8.5.100. Why upgrading to Tomcat 9 only buys a year, what the Jakarta migration costs, and how to stay patched on 8.5.
- RabbitMQ 3.1221 February 2024RabbitMQ 3.12 went end of life on 21 February 2024 at release 3.12.14. Why you must pass through 3.13 to reach 4.x, the feature-flag precondition, and how to stay patched on 3.12.
- Spring Boot 2.730 June 2023 (OSS support)Spring Boot 2.7 ended open-source support on 30 June 2023 at release 2.7.18. Why the unmanaged dependency BOM is the real exposure, what a Boot 2 to 3 upgrade costs, and how to stay patched.
- Java 8January 2019 (Oracle public updates for commercial use)Java 8 has no single end-of-life date. Oracle ended public updates in 2019; Temurin, Corretto and Zulu still ship security updates for free. What is actually unsupported, and why the real risk is Spring 5 rather than the JVM.
End-of-life: common questions
What does end of life mean for open source software?
It means the project stops publishing fixes for that version line. The software keeps running exactly as before; what ends is the supply of security patches and, for databases, bug fixes that can prevent data corruption. Nothing breaks on the date. Exposure accumulates from it.
How long do open source projects support a version?
It varies enormously and this is where teams get caught out. PostgreSQL supports each major for five years. Microsoft gives .NET LTS releases three years. Node.js LTS lines get thirty months. RabbitMQ and Apache Kafka support only the current release series, so a version can go end of life the day its successor ships — a window of months, not years.
Is it illegal or non-compliant to run end-of-life software?
Not illegal, but it engages specific controls. PCI DSS 4.0 requirement 6.3.3 expects critical and high vulnerabilities patched within a month. SOC 2 CC7.1 expects a working remediation process. FDA premarket cybersecurity submissions expect a plan for unsupported components. In each case the problem is not the version number, it is the absence of a patch path.
Can you get security patches for end-of-life open source?
Yes. Third-party extended support providers backport fixes from upstream to the end-of-life line. OSSeva does this for the infrastructure layer — RabbitMQ, Kafka, PostgreSQL, Redis, Tomcat, Spring and .NET. HeroDevs and TuxCare cover application frameworks and libraries; OpenLogic covers a broad catalogue.
Where do these end-of-life dates come from?
Each project's own published lifecycle policy, cross-checked against endoflife.date. Every date on this site links to its source. We do not publish a lifecycle date we cannot point at.
Which end-of-life dates are coming up next?
The near-term cluster is November 2026: .NET 8 and .NET 9 both reach end of support on 10 November 2026, and PostgreSQL 14 follows on 12 November 2026. Apache Tomcat 9.0 reaches end of life on 31 March 2027. Estates running both .NET and PostgreSQL should plan those as one programme rather than two.
Tell us what you are still running
Send the versions. We will tell you which need attention first, and which are fine where they are.