A calendar for owners of software companies, and of any business that runs on its own website, store, portal or internal system. When the languages, frameworks, databases and platforms underneath stop getting fixes, when the next major versions arrive, and when new rules start to apply. Every date is checked against its official source and read for what it means in money, risk and the next deal.
Sorted by date. Filter by area. Dates that have just passed stay for a while, marked, because many products still run on those versions.
Long-term support for Angular 20 ends. Angular keeps only the current major and the two before it under support.
For ownersProducts built on Angular 20 or older get no further fixes from the Angular team. Angular moves every six months, so a product left for two years is three or four versions behind.
Bug fixes for Symfony 6.4 stop. Security fixes continue until November 2027.
For ownersNothing breaks on the day, and security is covered for another year. It is the right moment to plan the move to Symfony 7.4 LTS, supported until November 2029. Drupal 10 sites stand on these components too.
Upgrade guide (PERETZ) What it means in a deal Source: Symfony releases
Basic SMTP authentication in Exchange Online is turned off by default for existing tenants at the end of December. Admins can turn it back on for now; final removal is to be announced in the second half of 2027.
For ownersWebsites, CRMs, printers and old systems that send email through Microsoft 365 with a username and password can silently stop sending: contact forms, invoices, password resets. Check what sends mail through your tenant before the holidays.
How to move each sender (PERETZ) What it means in a deal Source: Microsoft Exchange blog
WordPress 7.2 is scheduled for release. WordPress officially supports only the latest version; older ones get security fixes as a courtesy, not a promise.
For ownersA site that is more than one or two major versions behind, or held back by an old theme or plugins, is drifting out of the versions that get fixes first.
Drupal 10 reaches end of life: no further releases, security releases included. Drupal 12 is released the same week.
For ownersEvery Drupal 10 site needs a move to Drupal 11, supported until December 2028. Its size depends almost entirely on the custom modules. Drupal moves one major version at a time, so 12 comes through 11.
Upgrade guide (PERETZ) What it means in a deal Source: Drupal release schedule
PHP 8.2 stops getting security fixes. PHP 8.1 lost them a year earlier.
For ownersAny PHP site or product on 8.2 or older, whatever the framework, runs on a language version with no fixes. PHP 8.4, supported to the end of 2028, is the sensible target.
Upgrade guide (PERETZ) What it means in a deal Source: PHP supported versions
Free open source support for Spring Boot 4.0 ends; paid support runs until the end of 2027. The free line moves to 4.1 and 4.2.
For ownersJava products on Spring move fast now: the whole 3.x line left free support in June 2026. Ask whether you are on a free line or paying for support without knowing it.
Microsoft ends support for .NET Framework 4.6.2. Versions 4.7 and later have no end date announced.
For ownersOlder Windows business software often still targets 4.6.2. Moving to 4.8 is usually small; moving to modern .NET is a rewrite and should be priced as one.
Extended support for Windows Server 2016 ends. Paid Extended Security Updates are sold by the year, up to January 2030.
For ownersInternal systems, file servers and old applications on Server 2016 either move or start costing a yearly fee for security updates. The fee is a known number; the move is the real project.
Let's Encrypt moves all subscribers to 64-day certificates by default, with 45 days to follow in 2028. Domain validation is reused for 10 days instead of 30.
For ownersSites with automatic renewal notice nothing. A site where someone renews the certificate by hand, or an old server where automation broke years ago, will show a security warning to every visitor.
Laravel 12 stops getting security fixes. Laravel has no long-term support versions; each major gets two years of security fixes.
For ownersLaravel 11 and older are already without fixes. A product on Laravel 12 should plan the move to Laravel 13, supported until March 2028, in the first quarter.
Standard support for PostgreSQL 14 on Amazon RDS ends; from 1 March 2027 AWS charges for Extended Support. PostgreSQL 14 itself reached end of life on 12 November 2026.
For ownersIf nobody upgrades the database, the cloud bill grows by itself from March. An upgrade of the database version is usually cheaper than a year of extended support.
The maximum validity of a public TLS certificate drops from 200 to 100 days, under the CA/Browser Forum rules. 47 days follows in March 2029.
For ownersPaid certificates bought once a year and installed by hand stop being possible. Every site and API needs automatic renewal; where it is missing, it is a small job now and an outage later.
Ruby 3.3 is expected to reach end of life. AWS Lambda deprecates its Ruby 3.3 runtime the same day.
For ownersRails products on Ruby 3.3 need a language upgrade alongside their next Rails upgrade.
Extended support for Django 6.0 ends, and Django 6.2 LTS is released the same month. Django 5.2 LTS remains supported.
For ownersPython web products should sit on an LTS line, 5.2 now or 6.2 from April, rather than on short-lived versions.
Node.js 22 reaches end of life. Node.js 24 and 26 are the supported long-term lines. AWS Lambda deprecates its Node.js 22 runtime on 30 May.
For ownersMost JavaScript back ends and many build pipelines run on Node.js. Moving one major version is usually days of work, if it is done before the old one is out of support.
Standard security maintenance for Ubuntu 22.04 ends. Paid Expanded Security Maintenance through Ubuntu Pro runs until 2032.
For ownersServers on 22.04 either move to 24.04 or need a paid subscription to keep getting security fixes. Many hosting images and cloud servers built in 2022 to 2024 are on it.
Standard support for 2.4.7 ends. Adobe Commerce customers get extended support until May 2028; Magento Open Source has no extended period. From 1 June, Adobe stops maintaining Commerce Cloud environments on unsupported versions.
For ownersMagento upgrades are rarely small: extensions and customizations decide the cost. For many stores this date is also the moment to ask whether to upgrade at all or to move.
CentOS Stream 9 reaches end of life. Red Hat Enterprise Linux 9 moves from full support to maintenance the same day.
For ownersServers on CentOS Stream 9 need a new operating system. RHEL 9 itself keeps security maintenance until 2032.
Long-term support for Angular 21 ends.
For ownersSee Angular 20: the same six-month rhythm. Products on Angular should plan one upgrade a year.
AWS blocks creating new functions on deprecated runtimes: Node.js 20 and 22, Python 3.9 to 3.11, Ruby 3.2 and 3.3, .NET 8, Java on Amazon Linux 2 and others. From 31 August 2027 existing functions can no longer be updated.
For ownersServerless code that nobody touches keeps running, until the day it needs a fix and cannot be deployed. Ask for a list of your functions and their runtimes.
MongoDB 7.0 reaches end of life. MongoDB 6.0 ended in July 2025.
For ownersSelf-hosted MongoDB on 7.0 or older needs an upgrade; managed Atlas clusters are upgraded by the provider on its own schedule.
Python 3.11 reaches end of life. Python 3.10 ended in October 2026.
For ownersData, AI and back-end products in Python should be on 3.12 or newer. AWS Lambda deprecates Python 3.11 on 30 June 2027.
Security fixes for Rails 8.1 end. Rails 8.0 and 7.2 are already out of security support.
For ownersRails supports each version for a short time. A Rails product needs an upgrade at least once a year to stay covered.
Extended support for SQL Server 2017 ends. SQL Server 2016 ended in July 2026.
For ownersAccounting, ERP and older line-of-business systems often sit on SQL Server. The upgrade itself is routine; the applications that talk to it need testing.
The consumer Extended Security Updates program for Windows 10, extended by Microsoft, ends. Support for Windows 10 itself ended in October 2025.
For ownersOffice computers still on Windows 10 lose their last security updates. Business ESU is sold by the year; either way, plan the hardware and the move to Windows 11.
Security fixes for Symfony 6.4 end. Symfony 8.4 LTS is planned for the same month.
For ownersThe last date for products on 6.4. Anything still on it after November 2027 runs without fixes.
Upgrade guide (PERETZ) What it means in a deal Source: Symfony releases
PostgreSQL 15 receives its final release. Managed cloud versions follow with paid extended support.
For ownersSee PostgreSQL 14: an unplanned database upgrade turns into a cloud bill.
Obligations for high-risk AI systems in the areas of Annex III, such as hiring, education, credit and biometrics, apply from this date, moved from 2026 by the AI Omnibus agreement. Rules for AI inside regulated products follow in August 2028.
For ownersA product that uses AI to decide about people and sells in the EU must meet documentation, oversight and risk rules. A buyer will ask whether yours is high-risk and what it would cost to comply.
The main obligations of the Cyber Resilience Act apply to products with digital elements sold in the EU: secure design, vulnerability handling and security updates for a stated period.
For ownersSoftware and connected products sold in the EU need a security process they can show, including how long they will be supported. Reporting of exploited vulnerabilities already applies since September 2026.
PHP 8.3 stops getting security fixes. It is also the minimum version for Drupal 11.
For ownersA product upgraded only to 8.3 in 2026 faces the same question again in a year. PHP 8.4 buys one more year.
Laravel 13 stops getting security fixes, two years after its release in March 2026.
For ownersThe current target for Laravel products. Laravel releases a major every year, so an upgrade a year keeps a product covered.
Drupal 11 reaches end of life in early December 2028.
For ownersThe target for Drupal 10 sites today: two calm years after the upgrade.
PHP 8.4 stops getting security fixes at the end of 2028.
For ownersThe version to move to now if your framework supports it.
PostgreSQL 14 received its final release.
For ownersSelf-hosted databases on 14 are now without fixes; on Amazon RDS, paid extended support starts in March 2027.
Support for .NET 8 (LTS) and .NET 9 ended on the same day. .NET 10 LTS is supported until November 2028; .NET 11 was released the same day.
For ownersBusiness software and APIs on .NET 8 should move to .NET 10. It is usually a small upgrade if done soon.
The last paid Extended Security Update period for on-premises Exchange 2016 and 2019 ended. Microsoft says there will be no further extensions.
For ownersOn-premises email servers are a favourite target. Any company still running one has an urgent item, not a plan.
Python 3.10 reached end of life.
For ownersPython products should be on 3.12 or newer.
New apps and updates on Google Play must target Android 16 (API level 36); the extension ran until 1 November 2026.
For ownersAn Android app that is not updated stops reaching new users. Expect the same rule each August.
Standard support for 2.4.6 ended. Adobe Commerce customers have extended support until August 2027.
For ownersMagento Open Source stores on 2.4.6 or older are without fixes.
The EU AI Act became generally applicable, including the transparency rules for AI that talks to people or generates content.
For ownersChatbots and AI-generated content in products sold in the EU must be labelled as such.
Nuxt 3 reached end of life, after one extension.
For ownersVue sites and shops built on Nuxt 3 need the move to Nuxt 4.
Standard support for MySQL 8.0 on Amazon RDS ended; paid Extended Support runs until July 2029. MySQL 8.0 itself reached end of life in April 2026.
For ownersIf your bill grew in August, this may be why. MySQL 8.4 LTS is the target.
Extended support for SQL Server 2016 ended; paid updates are sold by the year.
For ownersSee SQL Server 2017, one year later.
Community support for MariaDB 10.6 ended; enterprise support continues until 2028.
For ownersMany hosting providers ship MariaDB by default. Ask which version your database runs.
Free support for Spring Boot 3.5, the last 3.x line, and Spring Framework 6.2 ended. Paid support continues.
For ownersJava products on Spring Boot 3 are on paid support or none.
Amazon Linux 2 reached end of support.
For ownersAWS servers and containers built on it need a new base image.
Node.js 20 reached end of life.
For ownersBack ends and build tools on Node.js 20 are without fixes.
Extended support for Django 4.2 LTS ended.
For ownersDjango products should be on 5.2 LTS.
MySQL 8.0 reached end of life; 8.0.46 was the final release.
For ownersOne of the most common databases in business software. MySQL 8.4 LTS is the target.
The maximum validity of public TLS certificates dropped from 398 to 200 days.
For ownersThe first of three steps; see March 2027.
Laravel 11 stopped getting security fixes. Laravel 10 lost them in February 2025.
For ownersLaravel products on 11 or older are without fixes; the move is to 13.
PHP 8.1 stopped getting security fixes.
For ownersStill common on shared hosting and older servers.
Support for Windows 10 ended; paid Extended Security Updates continue for a limited time.
For ownersSee October 2027, when the consumer program ends.
The European Accessibility Act applies to many digital products and services sold in the EU, including online shops, banking and e-books.
For ownersWebsites and apps that sell to EU consumers must be accessible. Buyers increasingly check it.
Drupal 7 security support ended after fourteen years.
For ownersMany Drupal 7 sites still run. A move from 7 is a rebuild, not an upgrade.
Vue 2 reached end of life.
For ownersFront ends still on Vue 2 have had no fixes for years; the move to Vue 3 is a project.
Nothing in this area yet.
When a date changes how a software company is bought or sold, we write what it means for both sides.
Engineers have their own trackers. This one is for the people who sign the budget, the contract or the deal.
That is exactly why these dates get missed. The site opens, orders arrive, the product works the day after the deadline as it did the day before. What changes is quieter. Any weakness found later stays without an official fix. Hosting providers start removing old versions. New libraries, payment modules and AI tools stop supporting them, so every new feature costs a little more. Enterprise clients, insurers and banks start asking about it in their security questionnaires.
In a deal the same date reads differently. A buyer's technical review lists every unsupported part with a cost to fix, and that cost is priced in, held back from the payment or written in as a condition before closing. A date the owner knew about a year ahead, with a plan and a budget, is a line in the plan. Found by the buyer, it is a line in the price.
We keep what an owner should act on, and leave out what only engineers need.
Framework, CMS, language, database and the main packages, for every system the business relies on, as they are in production. Your team or hosting can answer in an afternoon.
Compare the list with the calendar. Anything that ends before your next budget year, or before a planned sale, goes into the plan now.
An estimate from the team that will do the work, with a date. If a sale is ahead, it goes into the data room as a plan rather than a surprise.
The Structure, an independent technical due diligence firm. Support status is one of the first things we read in every target, so we keep these dates for our own reviews and publish them for owners.
Whenever a vendor publishes or moves a date, and at least once a month. The date of the last update is at the top of the page.
We start with what software companies and business systems run on most often. If yours is missing, write to us. If many owners depend on it, we add it.
No. A date is a deadline for a plan, not for a rewrite. Most upgrades are planned work of weeks, and the cheapest time to do them is while the old version is still supported.
Yes. A short look at the code and the servers answers it. For a company preparing a sale it is part of exit readiness; for a buyer, part of a red-flag memo or full technical due diligence.
We reply within one business day. NDA before any documents change hands.