> ## Documentation Index
> Fetch the complete documentation index at: https://docs.37audits.com/llms.txt
> Use this file to discover all available pages before exploring further.
# End of Life Auditor
> Checks the platform version declared in the software stack against the service life its vendor publishes
**Security Auditor** — places the platform version declared in the project's software stack in its vendor's service life: it fails when the release line is past, or within six months of, its end of life, and warns when end of life is within a year or the line is already in Limited Support.
A release line past its end of life receives no security patches. Every vulnerability published after that date stays open on the site.
A platform upgrade takes months. Knowing the date a year ahead keeps the site supported without an emergency migration.
This auditor does **not fetch the monitored URL**. It reads the **software stack** of the project, finds the platform a visitor supports, and looks the installed release line up in the service-life policy the vendor publishes. The first supported platform is **Liferay** (DXP and Portal), against the [Liferay Service Life Policy](https://www.liferay.com/liferay-service-life-policy); other platforms can be added as new visitors that reuse the same rules and codes.
## How it works
1. **Select the platform** — the first stack entry whose vendor is `Liferay` (any case) is audited. No stack, or no supported vendor in it, is `INFORMATION` (`101`): nothing is audited and the run is not charged.
2. **Read the declared version** — an entry without a version is `ERROR` (`502`); the release list is not read.
3. **Find the installed release** — `https://releases-cdn.liferay.com/releases.json` is fetched with a 10 second timeout (a network error, a status other than `200` or an unreadable body is `ERROR` `500`) and the declared version is matched against the releases of the declared product (`DXP` or `Portal`) by any of its names, ignoring case and repeated spaces, exactly like the Latest Version Auditor: `2025.Q1.15 LTS`, `DXP 2025.Q1.15 LTS`, `2025.q1.15`, `dxp-2025.q1.15-lts`, `7.4.3.132 GA132`, `7.4.13-u92`. A version that names no release of that product is `ERROR` (`503`). The release line is the group Liferay publishes the release in (`2025.Q1`, `7.4`).
4. **Liferay Portal** — Liferay publishes no service life for Portal (the community edition): only its latest GA release receives fixes. A Portal release is a `WARNING` (`302`) with no dates.
5. **Service-life dates of the line** — for DXP, the line is looked up in the table of the Liferay Service Life Policy bundled with the auditor (the policy page serves the table as an image behind a bot challenge, so it cannot be read at audit time). The bundled edition is the 2026 table, read on 2026-10-05, covering DXP 7.0 to 2026.Q4; the `100` check names the edition in every result.
| Line | General availability | End of Premium Support | End of Limited Support |
| - | - | - | - |
| 2026.Q4 | 2026-11-11 | 2027-11-10 | — |
| 2026.Q3 | 2026-08-19 | 2027-08-18 | — |
| 2026.Q2 | 2026-05-13 | 2027-05-12 | — |
| 2026.Q1 (LTS) | 2026-03-18 | 2029-03-17 | 2031-03-17 |
| 2025.Q4 | 2025-11-26 | 2026-11-25 | — |
| 2025.Q3 | 2025-09-03 | 2026-09-02 | — |
| 2025.Q2 | 2025-05-28 | 2026-05-27 | — |
| 2025.Q1 (LTS) | 2025-02-19 | 2028-02-18 | 2030-02-18 |
| 2024.Q4 | 2024-12-11 | 2025-12-10 | — |
| 2024.Q3 | 2024-09-12 | 2025-09-11 | — |
| 2024.Q2 | 2024-06-12 | 2025-06-11 | — |
| 2024.Q1 (LTS) | 2024-03-13 | 2027-03-13 | 2029-03-12 |
| 2023.Q4 | 2023-12-13 | 2024-12-12 | — |
| 2023.Q3 | 2023-10-20 | 2024-10-19 | — |
| 7.4 | 2023-09-01 (final release) | 2027-09-01 | 2030-09-01 |
| 7.3 | 2020-10-13 | 2024-10-12 | 2027-10-12 |
| 7.2 | 2019-06-04 | 2023-06-03 | 2026-06-03 |
| 7.1 | 2018-07-10 | 2022-11-13 | 2025-11-13 |
| 7.0 | 2016-06-15 | 2020-06-14 | 2023-06-14 |
A quarterly line that is newer than the table gets its dates from the policy rules: the first release of the line (`2026.q2.0`) publishes its general availability date in `release.properties` (since 2026.Q1); a non-LTS quarterly line has one year of Premium Support and no Limited Support, and the Q1 line of each year is LTS with three years of Premium Support followed by two years of Limited Support, each phase ending the day before the anniversary. A DXP line that is in neither place is `ERROR` (`504`).
6. **End of life** — the last day of Limited Support when the line has that phase (7.x and LTS lines), otherwise the last day of Premium Support. The day count is from the day the audit runs (UTC).
7. **Thresholds** — end of life in the past is `FAIL` (`400`); end of life in at most `failDays` days (default 180) is `FAIL` (`401`); in at most `warningDays` days (default 365) is `WARNING` (`300`). A line past its Premium Support but still in Limited Support is `WARNING` (`301`), listed next to the end-of-life finding when both apply.
8. **Aggregate** — `ERROR` wins, then `FAIL`, then `WARNING`. A line in Premium Support with more than `warningDays` days left is `SUCCESS` (`200`).
## Preferences
Both are optional per-URL preferences; an unset, unreadable or non-positive value takes the default.
| Key | Type | Default | Meaning |
| - | - | - | - |
| `failDays` | integer | `180` | `FAIL` (`401`) when end of life is this many days away or fewer |
| `warningDays` | integer | `365` | `WARNING` (`300`) when end of life is this many days away or fewer (and more than `failDays`) |
## What it audits
Every row maps to one `checkRule*` method and one `CheckCode`. CheckCode suffixes use status ranges: `100` information, `200` success, `300–399` warning, `400–499` fail, `500–599` error. The audited page is not fetched, so there is no `590` (site blocked) code.
| CheckCode | Status | When it fires | Recommendation | Why it matters |
| - | - | - | - | - |
| `37A-EndOfLifeAuditor-100` | `INFORMATION` | Always. Records the vendor policy and the edition of its table the dates come from (`Service-life dates come from the Liferay Service Life Policy (2026 table, read 2026-10-05).`). | — (recommendation is `null`; nothing for the site to change) | — |
| `37A-EndOfLifeAuditor-101` | `INFORMATION` | The project has no software stack, or the stack names no supported platform; nothing is audited and the run is not charged (the check carries `notApplicable: true`). | Empty stack: add `{supported}` and its version to the project's software stack to audit its service life. Other platforms: if the site runs `{supported}`, add it and its version to the project's software stack to audit its service life. | — |
| `37A-EndOfLifeAuditor-500` | `ERROR` | The release list or a release's `release.properties` could not be fetched or parsed. | Run the audit again; `{dataSource}` answered `"{error}"`. | — |
| `37A-EndOfLifeAuditor-502` | `ERROR` | The stack entry of the platform has no version. | Set the installed version of `{platform} {product}` in the project's software stack. | — |
| `37A-EndOfLifeAuditor-503` | `ERROR` | The declared version names no release of the declared product. | Pick the installed `{platform} {product}` release in the project's software stack; `"{declaredVersion}"` names no `{platform} {product}` release. | — |
| `37A-EndOfLifeAuditor-504` | `ERROR` | The release is known but its DXP line is neither in the bundled service-life table nor publishes a general availability date. | Run the audit again once the auditor's service-life table lists the `{releaseLine}` line; the stack declares `{installed}`. | — |
| `37A-EndOfLifeAuditor-400` | `FAIL` | The installed release line is past its end of life. | Upgrade `{platform} {product}` from `{installed}` to a line in Premium Support, such as the current LTS release; support for the `{releaseLine}` line ended on `{endOfLife}`. | An end-of-life platform gets no security patches, so every new vulnerability stays open on the site and compliance audits flag it. |
| `37A-EndOfLifeAuditor-401` | `FAIL` | End of life is at most `failDays` days away (not yet past). | Start the upgrade of `{platform} {product} {installed}` now; the `{releaseLine}` line loses all support on `{endOfLife}`. | A platform upgrade takes months; with so little support left the site will run unsupported before the work finishes. |
| `37A-EndOfLifeAuditor-300` | `WARNING` | End of life is more than `failDays` and at most `warningDays` days away. | Plan the upgrade of `{platform} {product} {installed}` off the `{releaseLine}` line before `{endOfLife}`. | Scheduling the upgrade a year ahead keeps the site supported without an emergency migration once the vendor stops publishing fixes. |
| `37A-EndOfLifeAuditor-301` | `WARNING` | Premium Support of the line ended and its Limited Support has not. | Move `{platform} {product} {installed}` to a line in Premium Support, such as the current LTS release, to receive new hotfixes again. | In Limited Support the vendor fixes only critical vulnerabilities, so ordinary bugs and lower-severity security issues stay in the site until it moves to a supported line. |
| `37A-EndOfLifeAuditor-302` | `WARNING` | The installed product has no vendor service life (Liferay Portal). | Keep `{platform} {product}` on the latest GA release, or move to a commercial edition with a published support window; the stack declares `{installed}`. | Without a support window there is no patch stream for the installed release, so security fixes arrive only by upgrading to the newest release. |
| `37A-EndOfLifeAuditor-200` | `SUCCESS` | All rules passed. Message is `{platform} {product} {installed} is in Premium Support until {endOfPremiumSupport}; the {releaseLine} line reaches end of life on {endOfLife} ({days} days left).` | — | — |
Example messages for an audit run on 2026-10-05 with the default thresholds:
* `400` — `Liferay DXP 2025.Q3.5 reached end of life on 2026-09-02 (33 days ago): the 2025.Q3 line receives no fixes or security patches.`
* `401` — `Liferay DXP 2025.Q4.3 reaches end of life on 2026-11-25, in 51 days (fail threshold: 180 days).`
* `301` — `Liferay DXP 7.3 U36 left Premium Support on 2024-10-12; the 7.3 line is in Limited Support until 2027-10-12 (critical security fixes only).`
* `302` — `Liferay Portal 7.4.3.132 GA132 (Community Edition) has no vendor service life: Liferay fixes only the latest GA release of Portal.`
* `200` — `Liferay DXP 2026.Q1.13 LTS is in Premium Support until 2029-03-17; the 2026.Q1 line reaches end of life on 2031-03-17 (1624 days left).`
Findings carry the same values in `data`: `platform`, `product`, `declaredVersion`, `installedVersion`, `releaseLine`, `lts`, `communityEdition`, `generalAvailability`, `endOfPremiumSupport`, `endOfLimitedSupport`, `endOfLife`, `daysToEndOfLife`, `datesSource` (`table` or `release.properties rule`), `failDays` and `warningDays`.
## Output documentation
| Status | Description | Test logic |
| - | - | - |
| **INFORMATION** | The auditor does not apply to the stack | No stack, or no supported platform in it (`101`); the run is not charged. |
| **SUCCESS** | The installed release line is in Premium Support and its end of life is more than `warningDays` days away | No rule fired (`200`). |
| **WARNING** | End of life is within `warningDays` days, the line is in Limited Support, or the product has no vendor service life | End of life in more than `failDays` and at most `warningDays` days (`300`); Premium Support ended and Limited Support has not (`301`); Liferay Portal (`302`). |
| **FAIL** | The installed release line is past its end of life, or within `failDays` days of it | End of life in the past (`400`) or in at most `failDays` days (`401`). The `301` warning is listed too when the line is in Limited Support. |
| **ERROR** | The auditor could not place the version in a service life | Release data unreadable (`500`); stack entry without a version (`502`); version that names no release (`503`); line without known dates (`504`). |
## Risks and considerations
### End of life is a security date
* After its end of life a release line gets no patches of any kind. Every vulnerability Liferay publishes from then on is open on the site for good, which is why an end-of-life line is a `FAIL` and not a warning.
* Limited Support only brings fixes for critical vulnerabilities. A site on 7.3 today still gets those until 2027-10-12, but no hotfix for anything else; the `301` warning marks that phase.
### The table is a snapshot
* The dates of the 7.x and quarterly lines come from the 2026 edition of Liferay's Service Life Policy table, read on 2026-10-05. Liferay can revise its policy; the `100` check names the edition the audit used.
* A quarterly line newer than the table is dated from its general availability date with the policy rules, which may differ by one day from the date Liferay later publishes.
* Liferay Portal (community edition) has no published service life, so no date is reported for it.
### The software stack is declared, not detected
* The verdict is only as good as the version in the project's software stack. Update the stack when the site is upgraded, or the audit keeps reporting the old line.
* Only the first Liferay entry of the stack is audited.
### What this auditor does not check
* It does not fetch the monitored URL and does not detect the running version from the site.
* It does not say whether a later fix release exists; the Latest Version Auditor does.
* It does not look up vulnerabilities for the installed version; the CVE Auditor does.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.