Patch out-of-support libraries for secure, audit-ready systems while
avoiding costly rewrites, rushed upgrades, and unnecessary risk.
Don’t see yours? We’ll add it, just ask.
View All Supported Technologies →
Angular 4 - 19
AngularJS 1.5.x | 1.6.x | 1.7.x | 1.8.x
Apache Commons Lang 3.2.2
Apache CXF 3.5.9 | 3.5.11
Apache Kafka 3.2.3
Apache Lucene 5.5.5
Apache Spark 2.4.8
Apache Struts 1.3.5 | 2.5.33
Apache Velocity 1.7
AutoMapper Various
Boost Various
Bootstrap 3.4.1 | 4.6.2
Celery 5.1.2
CometD 5 | 6 | 7
Django 3.2.25 | 4.0 | 4.2.22 | 5.0 | 5.0.1 | 5.0.2 | 5.1 | 5.1.10 | 5.1.4 | 5.1.9 
Express 3.21.2
Fast API 0.63.0 | 0.104.1
Fastify 3.29.5
Flask 1.1.2 | 2.2.1
fmt Various
Hibernate 5.4.33 | 5.6.15 | 6.0.2 | 6.5.3
Jackson 1.9.13
jQuery 1.8.2 | 1.12.4 | 2.2.4 | 3.4.1
Knockout 3.4.2 | 2.3.0
Laravel 5.4.36 | 5.5.50 | 5.6.40 | 5.7.29 | 5.8.38 | 6.20.45 | 7.30.7 | 8.12.0 | 8.12.1 | 8.12.2 | 8.12.3 | 8.83.29 | 9.52.21 | 10 | 11 | 12.58.0
Lodash 4.5.0 | 4.17.x
Microsoft.Owin 3.1.0
Newtonsoft.Json 4.5.11 | 6.0.8 | 8.0.3 | 9.0.1 | 10.0.3 | 11.0.2 | 12.0.3
Next.js 12.3.7 | 13.5.11 | 16.0.6
nlohmann-json Various
NumPy 1.15.4 | 1.16.0
Nuxt 0.10.x | 2.18.x | 3
Passport 0.2.2
Protocol Buffers 2.5.0
React 15.6.2 | 19.2.0
Spring® Various
Starlette 0.27.0
Vue 2.7.16
Werkzeug 1.0.1 | 2.2.3If It’s Open Source and Not on Our List,
With ELS, every release is secure, compatible, and built to industry standards you can trust.
Rapid SLA-backed security patches
for as long as you need
Security fixes for both direct and transitive EOL dependencies
Extensively tested updates that work flawlessly with your existing code
Plug-and-play integration with your workflows and CI/CD pipelines
Signed, tamper-proof updates from TuxCare-hosted repositories you can trust
Every release includes an SBOM, VEX, and SLSA Level 3 attestation**SLSA L3 attestation for ELS packages is coming soon
We onboard new projects and enable 24/7 automated CVE tracking – monitoring the NVD, vendor, and GitHub security advisories, and other sources.
Once CVEs are detected, we backport upstream fixes using algorithmic and AI-assisted automation, with expert validation to ensure accuracy.
Patches are compiled in a binary format, extensively tested (for integrity, functionality, and regression), signed, and deployed to ELS repositories.
Your package managers, build tools, or orchestrators check for updates, then automatically pull and install them.
The EOL library you know about is rarely the whole problem. Its dependency set shifts with the functionality you use, and every vulnerable node means rebuilding everything above it.
ELS covers the whole ecosystem, the library you came for, every dependency it pulls in, and the EOL libraries you adopt next, patched and rebuilt automatically.
Reduce technical overhead by avoiding unstable upgrades, shifting dependency requirements, and code rewrites
Maintain application security and compliance by eliminating exposure to vulnerabilities in end-of-life open source components
Keep your roadmap on track and accelerate feature delivery by eliminating the drag of non-strategic upgrades
Start protection while your packages are still maintained, and make end of life a non-event.
Key Takeaways Once a Node.js version reaches end of life, upstream stops checking whether new vulnerabilities affect it. Starting with Node.js 27, the project ships one major release a year, and every release line becomes LTS. AI tools are finding real Node.js bugs, but duplicate reports now bury the volunteers doing triage. Teams that can’t […]
Learn more →Key Takeaways Rev5 providers keep the legacy POA&M until they adopt FedRAMP’s 2026 vulnerability rules, which are required starting December 7, 2026. A scanner finding fixed before it’s past due needs no entry on the legacy POA&M, and a listed one closes once evidence of the fix is ready. Routine library patching skips agency approval […]
Learn more →Key Takeaways Article 13(5) of the Cyber Resilience Act (CRA) requires due diligence on third-party components, open source included. Breaching Article 13 risks fines up to EUR 15 million or 2.5% of global annual turnover, whichever is higher. Non-binding Recital 34 ties due diligence to component risk and names four possible actions, but the method […]
Learn more →Tell us your challenges, and our experts will help you find the best approach to address them with the TuxCare product line.
Tech Support
Documentation
Login
Contact Us
