HeroDevs

A long time ago in a codebase far, far away... frameworks reached end of life. But not on our watch. May the 4th be with you. ✨ #MayThe4th #MayThe4thBeWithYou #NeverEndingSupport #OpenSource

Django 4.2 reaches End-of-Life today. 🪦 Choose your move: Upgrade, Avoid, Hope… or HeroDevs NES. #Django #Python #DjangoEOL #EndOfLife #HeroDevs #NeverEndingSupport

🚨 Node.js v20 reaches end-of-life today 🚨 Your app doesn't stop running. The runtime doesn't fail. What changes is who's responsible for patching it — and starting today, that's no longer the Node.js project. What changes: → Node.js project closes the v20 vulnerability intake. New CVEs affecting v20 get documented with no patch issued. → All apps using Node.js 20 are running end-of-life (EOL) software, at a risk of failing the frameworks and regulatory compliance. → Cloud services such as AWS, Azure, and Google Cloud Platform deprecate Node 20 runtime for new apps and functions. If upgrading to the latest Node.js version is not possible, NES for Node.js keeps v20 patched while your migration plan catches up. #NodeJS #JavaScript #CloudComputing #CyberSecurity #ApplicationSecurity #EndOfLife #Compliance #RiskManagement

Your scanner tells you what's vulnerable today. It can't tell you what will never be patched. That's the gap end-of-life software creates — and most security tooling isn't built to close it. Read what your scanner isn't telling you → #OpenSource" target="_blank" rel="nofollow noopener">herodevs.com/blog-posts/wha… #AppSec #EOL #DevSecOps #SoftwareSecurity #HeroDevs

🚨 Ingress NGINX is EOL. NES for Ingress NGINX from @herodevs is here: A drop-in replacement that resolves the Go stdlib symlink race + 4 more CVEs. Stay secure. Migrate to Gateway API on your timeline. 👇

Node.js 20 hits End-of-Life on April 30, 2026. That's this week. 🚨 After that, no more security patches upstream. Any CVE disclosed against v20 from that point on is yours to deal with — fix or back port patches yourself, or accept the risk. Upgrading to the latest Node.js version is the right answer for most teams, but "right" and "realistic this quarter" aren't always the same thing. If you've got a dependency tree that fights you, native modules that haven't been rebuilt, or a migration that needs a real runway, HeroDevs ships a drop-in NES build of Node.js 20 and never-ending fixes to future CVEs. No app code changes required, buys you time to migrate properly instead of rushing it. Plan the upgrade. Don't let the date plan it for you. 🔗 herodevs.com/support/node-n… #NodeJS #OpenSource #EndOfLife #HeroDevs

Au revoir, Devoxx France 🇫🇷 Three days. Thousands of developers. Hundreds of sessions centered around where software is actually heading next. And yes, we even found time to take care of the Spring team… one hairstyle at a time 💇‍♂️ Until next year 👋 #Devoxx #Java #Spring #OpenSource #DevCommunity #SoftwareEngineering #HeroDevs

JCON Europe 2026 delivered exactly what the Java community needed: real conversations, real code, real progress. 📈 From deep dives into modern Java, Spring, and cloud-native architectures to hands-on sessions, the signal was clear — the ecosystem is moving fast, but with purpose. #JCON #Java #Spring #OpenSource #DevCommunity #SoftwareEngineering #HeroDevs

HeroDevs is excited to announce Never-Ending Support (NES) for .NET Containers. Containerizing your app doesn’t eliminate risk — it can hide it. When .NET reaches end-of-life, those containers don’t get safer. They keep running code that will never receive another security fix. That’s the reality teams are facing: • Containers keep running… but patching stops • Vulnerabilities continue to be discovered • Compliance requirements don’t go away NES for .NET Containers closes that gap — delivering secure, drop-in container images with ongoing CVE remediation, so teams can stay protected while planning their migration. Because modernization takes time. Security can’t wait for it. Learn more 🔗 herodevs.com/blog-posts/ann… #dotnet #Containers #AppSec #OpenSource #EOL #DevSecOps #HeroDevs

Learn more 🔗 herodevs.com/blog-posts/exp…

Some versions in your stack are still in active play. Others hit GAME OVER years ago. 👾 Express.js powers 1.2M+ production websites — it's not legacy, it's infrastructure. But Express 3 has been EOL since 2015, Express 4's sunset is approaching, and Express 5.2 is the production-recommended release. Our 2026 support reference covers the full version timeline, what EOL means for your audits, and what to do when migration isn't on your Q1 roadmap. #ExpressJS #NodeJS #JavaScript #OpenSource #EndOfLife #DevSecOps #Compliance #SoftwareEngineering #HeroDevs #NeverEndingSupport

Our EOL Dataset is live on Product Hunt 🚀 Instantly find every EOL dependency across your stack — direct, transitive, and across all your projects. Whether you need to resolve a specific CVE today or get ahead of EOL risk across your entire open source stack — HeroDevs has you covered. Check it out and let us know what you think! 🔗 producthunt.com/products/eol-d… #ProductHunt #OpenSource #AppSec #DevSecOps #SoftwareSecurity #HeroDevs

That’s a wrap on Spring I/O 2026. 🐉 From deep dives into Spring Boot 4 and AI-driven development to real conversations about modernization and security, this year’s event brought together a global community pushing the Java ecosystem forward. Highlights for us: → Connecting with developers and architects tackling real-world migration challenges → Talking through EOL risk, long-term support, and keeping production systems secure → And crowning a few lucky raffle winners as official dragon parents 🥚🐉 Until next time, Spring I/O 👋 #SpringIO #SpringBoot #Java #OpenSource #DevCommunity #HeroDev

🚨 New CVE Alert: CVE-2026-35554 (Apache Kafka) A race condition in the Kafka producer client can cause messages to be silently delivered to the wrong topic — no errors, no alerts, just corrupted or misrouted data. Why it matters: ❌ Data confidentiality risk — sensitive data may leak across topics ❌ Data integrity risk — downstream systems process unexpected payloads ❌ Silent failures are harder to detect than loud ones Affected versions: kafka-clients 2.8.0–3.9.1, 4.0.0–4.0.1, and 4.1.0–4.1.1. Fixes are available in 3.9.2, 4.0.2, 4.1.2, and 4.2.0+ — but teams on 3.8.x and older have no in-branch patch and will need to upgrade branches. 🔗 herodevs.com/blog-posts/cve… #Kafka #CVE #DataIntegrity #AppSec #OpenSourceSecurity #DevSecOps #HeroDevs

VulnCon 2026 made one thing clear ↓ Vulnerability management is evolving fast. 🏎️💨 From CVE quality and enrichment to SBOMs, VEX, and real-world remediation workflows, the conversation is shifting from detection to decision-making. At HeroDevs, we were right in the middle of it — talking with security leaders, researchers, and practitioners about a growing gap: ✔️ Not every vulnerability can be patched. ✔️ And not every risk shows up in a scanner. Some of the most important conversations this week weren’t about new tools — they were about what happens when support ends, fixes stop, and risk becomes permanent. Huge thanks to everyone we connected with. The direction is clear: The future of vulnerability management isn’t just more data. It’s better context — and actionable outcomes. Read the full recap 🔗 herodevs.com/blog-posts/her… #VulnCon #CyberSecurity #AppSec #DevSecOps #OpenSourceSecurity #HeroDevs

Learn more 🔗 herodevs.com/blog-posts/bey…

🚨 CVE-2025-55315 changed the conversation for .NET teams. This isn’t just another patch cycle. A critical 9.9 severity vulnerability in ASP.NET Core exposed how something as low-level as HTTP request parsing can turn into a full-blown security issue — enabling request smuggling, privilege escalation, and data exposure. Once a framework reaches end-of-life, the equation changes: → Vulnerabilities keep getting discovered → Exploits keep evolving → But upstream fixes stop That’s where risk compounds — especially for teams still running older .NET versions. Upgrading is the long-term answer. But real-world systems don’t always move on release timelines. HeroDevs Never-Ending Support (NES) for .NET exist — to keep systems secure, compliant, and operational while teams modernize on their own schedule. Security isn’t just about reacting to the latest CVE. It’s about what happens after the patch. #dotnet #AppSec #OpenSourceSecurity #EOL #DevSecOps #HeroDevs

🐉 Dragon eggs on the line. Real conversations about security. This is Spring I/O. We’re live at Spring I/O 2026, connecting with the Java and Spring community on everything from framework EOL to real-world security and migration strategy. Thinking about Spring Boot upgrades, long-term support, or how to keep legacy systems secure without slowing down innovation? Come talk to us. #SpringIO #SpringBoot #Java #OpenSource #AppSec #DevSecOps #HeroDevs

🚨 New CVE Alert: CVE-2026-21717 (Node.js) A medium-severity HashDoS vulnerability has been discovered in Node.js's V8 engine. The issue: integer-like strings are hashed to their numeric value, making hash collisions predictable and exploitable. What this means: → Attackers can craft inputs that degrade hash table operations from O(1) to O(n) → No authentication required — but high attack complexity (crafting collision payloads takes knowledge of the hashing algorithm) → Affects Node.js v20.x, v22.x, v24.x, and v25.x → Worst case: event loop blocking and sustained CPU consumption, leading to denial of service Patching is straightforward if you're on a supported version — fixes landed in v20.20.2, v22.22.2, v24.14.1, and v25.8.2. But if you're running Node.js v12, v14, v16, or v18 — all past end-of-life — no official patch is coming. New CVEs don't stop. Official patches do. It's the kind of issue that seems small at first, until you realize you've been wandering into danger without the right gear. ⚔ That's where HeroDevs Never-Ending Support (NES) for Node.js comes in, continuing to backport CVE fixes for EOL versions so your applications stay protected while you plan your migration. Because performance degradation is a headache. Unpatched, exploitable performance degradation is a liability. #NodeJS #CVE #AppSec #OpenSourceSecurity #DevSecOps #HeroDevs

U is for Upgrades. ⬆️ Nobody loves doing them — but in open source, they’re not optional. Every release brings fixes, features, and security patches… along with the occasional breaking change that keeps things interesting. Ignore upgrades long enough and your stack starts to fossilize: → dependencies drop support → security gaps grow → tools stop working The best teams treat upgrades like hygiene — routine and non-negotiable. Because staying current isn’t about chasing new features. It’s about staying secure and supported. Full Episode 🔗 youtube.com/watch?v=DFUPnB… #OpenSource #OSS #SoftwareDevelopment #DevOps #SoftwareMaintenance #TechDebt #AppSec #Developers