Several common runtimes and frameworks reach the end of their stated support between now and 31 December 2026, including .NET 8 and 9, Rails 8.0, Angular 20 and PHP 8.2 security support. Check your inventory against this list now, while there is still time to schedule upgrades.
The watchlist
Dates below come from the official pages we fetched on 19 October 2026, except where marked as from a lifecycle tracker.
| Date | What ends | Source type |
|---|---|---|
| 7 November 2026 | Rails 8.0 security support | Official, Rails maintenance page |
| 10 November 2026 | .NET 8 (LTS) and .NET 9 (STS) end of support | Official, Microsoft policy page |
| 28 November 2026 | Angular 20 long-term support ends | Official, angular.dev |
| 1 December 2026 | Redis 8.0 end of life | Tracker |
| 31 December 2026 | PHP 8.2 security support | Official, php.net |
| 31 December 2026 | Spring Boot 4.0 open source support | Tracker |
The Rails page lists 8.0.x as supported for security issues until 7 November 2026, with 8.1.x supported until 10 October 2027. The Angular page lists version 20 with LTS ending 28 November 2026, and says versions 2 to 19 are no longer supported. Dates marked as tracker data should be confirmed on the project's own page before you use them in a contract or audit.
Note what is not on the list: Node.js 20 and Python 3.10 already passed. See Node.js 20 and Python 3.10.
How to use it in three steps
- Match. For each row, search your inventory for that product and major version. If your inventory cannot answer, that is the first finding.
- Size. For each match, estimate upgrade effort in weeks, not days. Include testing and rollout.
- Decide. Compare effort with days remaining. If effort exceeds the days left, start now or open a dated exception.
Days remaining from today: about 19 days to the Rails date, 22 to the .NET date, 40 to the Angular date, and 73 to the PHP date. These are shorter than most upgrade projects.
What "support ends" means in each case
The word hides differences. Rails ends security support, which is the last phase. The .NET date ends all support for those releases. Angular LTS is the second phase of its schedule, after active support. PHP 8.2 is already in security-only mode, so the date ends the final phase. Record the phase as well as the date. Five lifecycle statuses for your inventory gives labels you can reuse.
Make the watchlist repeatable
A one-off list rots. Keep a standing list of the products you use, the source page for each, and the date you last checked. Review it monthly and add 90 day alerts. How to track support windows without spreadsheet rot covers the routine.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how monitoring surfaces change over time, the idea behind a date alert.
Where Safeguard fits
Safeguard's SBOM and dependency scanning gives you the list of what you run, which is the input this watchlist needs. A free scan is at gold.safeguard.sh/scan.
Quick check
Is a tracker date as good as an official date?
Use it as a pointer. Confirm on the project's own page before relying on it.
What if I find a match with too little time?
Write a dated exception with an owner, compensating steps and a revisit date, and start the upgrade anyway.
Sources
- Rails maintenance policy
- .NET support policy
- Angular releases
- PHP supported versions
- endoflife.date Redis data
- endoflife.date Spring Boot data
Last reviewed: 19 October 2026.
