// Resources
Reference material for running open source past end of life
What extended support actually covers, the evidence an auditor will ask you for, and the architectures and migrations behind the work.
Primer
What is EOL support?
How extended support differs from community maintenance and from a commercial vendor's own subscription, and how to tell the three apart when you are buying.
Evidence
Compliance evidence packages
What an auditor asks for under SOC 2, PCI DSS, HIPAA, ISO 27001, DORA and FedRAMP when a component is past EOL — and the artefacts that answer it.
Design
Reference architectures
Deployment topologies for the messaging and data layer, including the failure modes each one is chosen to survive.
Field notes
Customer work
What the engagements actually involved: the versions in play, what was patched, and what had to be migrated.
Recorded
Sessions and walkthroughs
Backporting fixes onto EOL RabbitMQ without a version jump, and the Tanzu exit migration playbook, walked through end to end.
Also useful
Research and directories
EOL Exposure Study 2026
CVE counts disclosed against a release line after its EOL date, computed from NVD data.
EOL library
Community end-of-life dates, what stops on each, and what breaks in the upgrade.
CVE directory
CPE-matched advisories for the technologies OSSeva covers, with affected ranges.
Blog
Migration guides, advisory reviews, and compliance analysis.
Not sure which of your versions are already past EOL?
Check the tracker, or bring us your inventory and we will scope it.