End of life (EOL)

End of life is the date after which a maintainer stops releasing fixes, including security patches, for a version of a product.

When a version reaches end of life, or EOL, its maintainer stops working on it. No bug fixes, no security patches and no compatibility updates are published. The software keeps running after that date. It stays frozen while everything around it keeps changing.

The consequences build up over time:

• Newly found vulnerabilities stay open.
• Browsers, build tools and runtimes evolve and are no longer tested against it.
• Libraries that depend on it stop being maintained too.
• Security audits and customer questionnaires flag it.
• Fewer developers want to work with it.

Example

AngularJS reached end of life when its long-term support ended on December 31, 2021. Applications built with it still run in today's browsers. A company that sells to banks, however, now has to explain in every security review why its product depends on an unsupported framework and which compensating controls exist.

Common misunderstanding

There are two opposite errors. One is to treat EOL as an emergency in which the application will break tomorrow. That leads to rushed rewrites. The other is to conclude that nothing happens because the application still works. That ignores a risk that grows quietly each year.

EOL is a deadline for a decision. The realistic options are to migrate incrementally, to rewrite, to buy extended support from a third-party vendor as a bridge, or to retire the product. Extended support covers known vulnerabilities and modernizes nothing, so it works best alongside a migration plan. The guide AngularJS end of life: your options compares these paths.

Related terms

• Long-term support (LTS)
• Legacy code
• Technical debt