Endless Lifecycle Support

Key Takeaways npm provenance proves which repository, commit and workflow produced a package, not that the code is safe to run. The attestation gap is the space between what provenance...

ELS Builds for the October Node.js Fixes Are on the Way Fixed builds for affected end-of-life Node.js lines are expected in the ELS for Runtimes repositories over the next 24...

Key Takeaways php2shell is the name for two critical PHP core RCE flaws, CVE-2026-109618 and CVE-2026-109619. PHP fixed them in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, but end-of-life branches get no...

Key Takeaways The Log4j vulnerability fix that holds up in 2026 is a currently maintained log4j-core release, well past 2.17.1. Stopping at 2.15.0 or 2.16.0 in 2021 still leaves you...

Key...

Key Takeaways jQuery UI has been in maintenance-only mode since October 2021, and only the newest minor gets fixes. jQuery UI 1.10.4 contains three known XSS flaws, all of them...

Key Takeaways Endor Labs is an application security platform best known for reachability-based software composition analysis. Its reachability engine traces your code’s call graph to show which vulnerable dependency functions...

Key Takeaways Supply chain vulnerabilities come from the packages, registries, and build systems you depend on. ChainDrop hit at least 444 npm packages in August 2026 without exploiting a vulnerability...

Key Takeaways Moment and Moment Timezone are legacy projects in maintenance mode, and new work should use alternatives. Legacy status does not force a quick removal, and it does not...

Key Takeaways RequireJS is an OpenJS Archived project, so no upstream maintainer is committed to fixing future vulnerabilities. Moving to ES modules touches module definitions, loading behavior, build optimization, testing,...

Key Takeaways LoopBack 3 reached community end of life in December 2020 and gets no upstream fixes. If LoopBack came bundled with IBM API Connect, check that product’s lifecycle first....