End of life (EOL) means the maker has stopped providing updates, including security fixes, for a specific version. The software keeps running, but newly found flaws stay open. It differs from deprecated, which is a warning, and from unmaintained, which describes a project nobody updates.
Terms people mix up
These words get used interchangeably. They describe different situations.
| Term | What it means | Security fixes continue? |
|---|---|---|
| End of life (EOL) | The maker has set a date after which a version gets no updates | No, after the date |
| End of support | Usually the same as EOL, sometimes only ends help desk support | Check the vendor wording |
| End of sale | The product can no longer be bought | Often yes, for a while |
| Deprecated | The maker advises against use, and plans removal | Usually yes, until removal |
| Unmaintained or abandoned | Nobody is updating it, often with no announcement | Not reliably |
| Extended support | Paid or limited coverage after standard support | Yes, often only Critical issues |
The Windows 10 case shows the wording. Microsoft's FAQ says that after end of support there are no quality updates, security fixes or technical support, and that the paid ESU program covers only Critical and Important security updates.
Why the difference matters
A deprecation warning, such as an npm message, tells you to plan. It is not an emergency. An EOL date tells you when plan becomes risk. An unmaintained project has no date at all, which makes it the hardest to track. See what to do with an npm deprecated warning and how to tell if a dependency is abandoned.
What actually changes on the date
Nothing breaks. The software runs as before. What changes is the flow of fixes. Any vulnerability disclosed afterwards is not patched, and attackers can read the public details. Compatibility also erodes, since browsers, libraries and hardware drop support for old versions.
Steps to handle an EOL notice
- Identify what you run. You cannot act on what you cannot see.
- Find the vendor's own date, not a third party summary. Use the summary to find it, then confirm.
- Assign an owner and a decision: upgrade, extend, isolate or retire.
- Record exceptions with a review date.
- Recheck on a schedule, since dates move.
Quick check
Is EOL software automatically vulnerable?
Not automatically. It may have no known open flaws today. It has no path to a fix if one appears, so risk grows with time.
Is deprecated the same as end of life?
No. Deprecated is advance notice. EOL is the date the fixes stop.
Where Safeguard fits
Safeguard's SBOM and dependency scanning gives you the inventory that these decisions depend on, and policies and gates can turn your own rules into checks on pull requests. See the free scan.
Sources
Last reviewed: 19 October 2026.
