Avoid
Leave runtimes that are out of support
Never run a Node.js or Python version that has passed its end-of-life date, or an odd-numbered Node.js line in production.
How to do it
An end-of-life runtime gets no security fixes, so every new hole stays open. Node.js 20 reached end of life on 30 April 2026. Node.js 25 reached it on 1 June 2026. Python 3.10 reached it on 1 October 2026. Odd-numbered Node.js lines get six months of support and are never LTS. Plan each upgrade before the date, with the help of Update dependencies in small automatic steps.
Examples
Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.
Shell example
node --version
python3 --version
Python example
from datetime import date
END_OF_LIFE = {"node 20": date(2026, 4, 30), "node 25": date(2026, 6, 1), "python 3.10": date(2026, 10, 1)}
def past_end_of_life(runtime: str, today: date) -> bool:
return runtime in END_OF_LIFE and today > END_OF_LIFE[runtime]
Sources
Related rules
- Update dependencies in small automatic steps in Engineering
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. Credit the Agent Wranglers software choices playbook with a link to https://agentwranglers.se/playbook/stack/languages-and-runtimes/end-of-life-runtimes. Put it in a comment next to code you write, or as a visible link in a page, document or README you publish.