Feature · End of life
Scanners look at your packages. LibWatch also looks at your language.
An up-to-date library on PHP 8.1 or Ruby 3.2 is still exposed: these versions no longer receive fixes. LibWatch reads the language version each project declares and shows its end-of-life date.
- Nov 10, 2026 .NET 8 and .NET 9 In 3 weeks
- Dec 31, 2026 PHP 8.2 In 10 weeks
- March 2027 Ruby 3.3 In 5 months
- Apr 30, 2027 Node.js 22 In 6 months
- October 2027 Python 3.11 In 1 year
Why it's a blind spot
No CVE says “end of life.”
A discontinued language version doesn't trigger a classic alert: it simply stops receiving fixes.
The next vulnerability won't be fixed.
PHP2Shell proved it: PHP 8.1, already discontinued, received no official fixed release.
The date arrives without any change to the code.
A project nobody touches reaches end of life on a December 31. The nightly watch sees it.
Languages tracked
What LibWatch reads, language by language
| Language | Read from | What is flagged |
|---|---|---|
| PHP | composer.json (config.platform.php, require.php), WordPress sites | End of life, engine vulnerabilities |
| Node.js | .nvmrc, .node-version, .tool-versions | End of life |
| Python | .python-version, pyproject.toml | End of life |
| Ruby | .ruby-version, .tool-versions | End of life |
| Go and Rust | go.mod, rust-version in Cargo.toml | Versions no longer patched |
| Java, Kotlin, Android | Gradle and Maven files | Versions, Google Play target SDK |
| .NET | TargetFramework, SDK | End of life |
| Dart, Flutter, Swift | pubspec.yaml, Package.swift, Xcode project | Versions and minimum targets |
In your dependencies
Spotted before the date, not after
In the dependency list, each language version shows its end-of-life date: flagged 90 days ahead, then in red on the day it is reached.
- orders-api PHP 8.2 declared Dec 31, 2026
- company-site · WordPress PHP 8.2 detected on the site Dec 31, 2026
- internal-tool PHP 8.1 declared Already ended
Flagged in each project's dependency list
Frequently asked questions
About end of life
Where do the dates come from?
From the official schedules of each language or framework, as compiled by endoflife.date. A product missing from the catalog is never guessed.
Does LibWatch see the version installed in production?
For a repository, no: LibWatch reads the version declared in its files (composer.json, .ruby-version, .nvmrc…), without access to your servers. For a WordPress site, it records the PHP version when the site discloses it.
Are frameworks like Rails or Symfony tracked?
Yes. Rails, Django, Laravel, Symfony, Spring Boot, Angular, React Native, Next.js, Vue, Nuxt and Express have their end-of-life dates, just like languages.