HeroDevs @herodevs

The EOL experts. We let your developers focus on mission-critical work, while we keep your open-source stack running in the background. #LifeAfterEOL herodevs.com Worldwide Joined January 2018

Tweets

1K
Followers

3K
Following

748
Likes

3K

HeroDevs @herodevs

6 hours ago

⏳ 20 days until Spring Boot 3.5 hits end-of-life. Three weeks. That's the runway left before community patches stop on June 30. If your migration plan is still a Jira ticket and a vague timeline, this is the week to make it real. #SpringBoot #Java #EOL

0 0 0 35 0

View Details

HeroDevs @herodevs

a day ago

21 days. That's all that's left of community support for Spring Boot 3.5. 🗓️ Code compiles. Tests pass. Production breaks. Spot the silent one: True or false: Jackson 3.0 changes the default date serialisation from numeric timestamps to ISO-8601 strings. #SpringBoot #Java #SoftwareEngineering

1 0 2 80 0

View Details

HeroDevs @herodevs

a day ago

Learn More 🔗 herodevs.com/blog-posts/ai-…

0 0 0 154 0

View Details

HeroDevs @herodevs

a day ago

Who's that vulnerability? A scanner just flagged it — and there's no patch coming. The June 2026 AI Cybersecurity Executive Order builds a national apparatus for AI-assisted vulnerability discovery. It accelerates the half of the lifecycle that hurts end-of-life software most: finding flaws. It funds none of the fixes. For maintained software, that loop closes — a CVE lands, upstream ships a patch, you update. For EOL frameworks, the loop is broken. No maintainer, no patch, no answer to the auditor. With CRA Article 14 reporting starting September 11 and DORA already in force, "we know about the CVE but no fix exists" gets weaker by the day — not stronger. Know your EOL exposure. Line up a patch source before the next AI-surfaced CVE lands against a framework no one maintains anymore. #OpenSourceSecurity #EndOfLife #Cybersecurity #VulnerabilityManagement #SoftwareSupplyChain #DevSecOps #Compliance

1 0 0 192 0

View Details

HeroDevs @herodevs

a day ago

CVEs only track the vulnerabilities someone actually reported. So what happens when a package goes end-of-life and no one's looking anymore? That's the "ghost in the dependency tree" — and it's exactly what Isaac Wuest, Product Line Leader at HeroDevs, unpacked on @openssf 's What's in the SOSS podcast. Listen to the full podcast 🎧 openssf.org/podcast/2026/0… #OpenSource #SoftwareSupplyChain #EndOfLife #CyberSecurity #AppSec

0 1 0 78 0

View Details

HeroDevs @herodevs

2 days ago

That's a wrap on Microsoft Build 2026. 🎬 Our takeaway: the faster the frontier moves, the more critical the foundation becomes. Every new AI workload still runs on top of something — and a lot of that something is .NET, Java, Node, and other open source stacks quietly aging out of support. The leap forward only works if the layer underneath is still secure. Grateful to everyone we got to connect with this week. Until next year. 👋 #MicrosoftBuild #Build2026 #AI #OpenSource #DevSecOps #HeroDevs

0 0 1 91 0

View Details

HeroDevs @herodevs

2 weeks ago

The reactive SCA-scan-and-patch model is breaking under the weight of AI-discovered CVEs. What replaces it? Curated, SLA-backed open source. techstrong.tv/videos/intervi…

1 1 4 140 0

View Details

HeroDevs @herodevs

2 weeks ago

33 days to go. ⏱️ Infra surprises are the worst kind of surprises: True or false: Undertow has been completely removed as an embedded server option in Spring Boot 4.0. #SpringBoot #Tomcat #Java

0 0 0 84 0

View Details

HeroDevs @herodevs

2 weeks ago

🔴 Happening now. Join us live. Live Q&A is open. Jump in → herodevs.com/from-node-20-e… #NodeJS #OpenSource #EndOfLife #DevSecOps #JavaScript #HeroDevs

0 0 0 78 0

View Details

HeroDevs @herodevs

2 weeks ago

Tomorrow. One hour. Two members of the Node.js Technical Steering Committee. Matteo Collina (TSC Chair) and Marco Ippolito (TSC & HeroDevs Engineer) join HeroDevs' Javier Perez to talk Node 20 EOL, the path to Node 27 LTS, and how the project is handling a flood of AI-generated CVE reports — plus what to do if you can't migrate off Node 20 yet. Live Q&A included. 📅 May 27, 2026 | 11:00 AM EST | Free registration Register → herodevs.com/from-node-20-e… #NodeJS #OpenSource #EndOfLife #DevSecOps #JavaScript #HeroDevs

1 14 12 11K 2

View Details

HeroDevs @herodevs

2 weeks ago

ACTIVE: 'TrapDoor' supply chain campaign hits npm, PyPI & Crates.io with 34+ malicious packages stealing SSH keys, AWS creds & crypto wallets. Novel technique poisons AI assistant config files to trigger exfiltration. #SupplyChain #DevSecOps thehackernews.com/2026/05/trapdo…

1 0 1 117 0

View Details

HeroDevs @herodevs

2 weeks ago

Heads up: Kubernetes 1.33 reaches End of Life on June 28, 2026. No more security patches after that date. K8s 1.34 EOLs Oct 27. With active supply chain attacks targeting Kubernetes service account tokens, staying on a supported release is more urgent than ever. #OpenSource #DevSecOps kubernetes.io/releases/patch…

0 0 0 95 0

View Details

HeroDevs @herodevs

2 weeks ago

⏳ 35 days until Spring Boot 3.5 hits end-of-life. Before you bump that version number, drop your guess below 👇 True or false: Spring Boot 4.0 uses Jakarta EE 10, the same as Spring Boot 3.x. #SpringBoot #Java #JakartaEE

0 0 0 149 0

View Details

HeroDevs @herodevs

3 weeks ago

Apache's Tomcat 8.5 security page is the tip of the iceberg. 🧊 May 10, 2026: Apache shipped patches for seven new CVEs in 9.x, 10.1.x, and 11.x. Tomcat 8.5 isn't listed in any of them — but NVD confirms 8.5 is affected by every one. The standout: CVE-2026-43512. Any user not in the configured realm authenticates successfully if the request presents the literal password "null." Tomcat 8.5 reached EOL March 31, 2024. The CVE disclosures haven't stopped. The documentation just has. "No entry on Apache's page" ≠ "Not affected." It means the project stopped tracking your version. #ApacheTomcat #Tomcat #Java #EndOfLife #EOL #CVE #DevSecOps #VulnerabilityManagement #HeroDevs #NeverEndingSupport

0 0 0 151 0

View Details

HeroDevs @herodevs

3 weeks ago

⏱️ Counting down: 40 days until Spring Boot 3.5 EOL. Make sure you know what you're upgrading into — vote below ⬇️ True or false: Spring Boot 4.0 requires Java 21 as its minimum version — Java 17 is no longer supported. #SpringBoot #Java #JakartaEE

0 0 0 83 0

View Details

HeroDevs @herodevs

3 weeks ago

"Reporting a CVE takes a fraction of the time it takes a maintainer to verify it." — Our CEO Aaron Mitchell on the AI-driven CVE surge breaking open source maintainer bandwidth. techstrong.tv/videos/intervi…

0 0 0 89 0

View Details

HeroDevs @herodevs

3 weeks ago

HeroDevs NES for Drupal 7 🔗 herodevs.com/support/nes-dr…

0 0 0 97 0

View Details

HeroDevs @herodevs

3 weeks ago

Drupal drops a 'highly critical' unauthenticated core security update today (May 20). Exploits could emerge within hours. EOL Drupal 8 and 9 get manual-only patch files with no correctness guarantee. If you're on EOL Drupal, now is the time to plan your upgrade path. #CyberSecurity #OSS thehackernews.com/2026/05/drupal…

1 0 0 231 0

View Details

HeroDevs @herodevs

3 weeks ago

TeamPCP's Mini Shai-Hulud campaign hit Microsoft's official durabletask PyPI SDK on May 19. 3 malicious versions steal cloud credentials from AWS/Azure/GCP/Kubernetes and spread laterally. PyPI has quarantined them — pin to v1.4.0 and rotate secrets now. #SupplyChain #DevSecOps cybersecuritynews.com/microsoft-pyth…

0 0 0 137 0

View Details

HeroDevs @herodevs

3 weeks ago

If you run Node.js in production, this is the conversation to be in. ⏰ Matteo Collina (Chair of the Node.js TSC) and Marco Ippolito (Node.js TSC & HeroDevs Engineer) sit down with HeroDevs' Javier Perez to cover: → The path to Node 27 LTS and the new release cadence → Vulnerability handling in the age of AI-generated CVE reports → Staying secure on Node 20 when you can't migrate yet 📅 May 27, 2026 | 11:00 AM EST | Free registration Register 🔗 herodevs.com/from-node-20-e… #NodeJS #OpenSource #EndOfLife #DevSecOps #JavaScript #HeroDevs