Flags a platform version that is near or past vendor end of life
Select the platform — the first stack entry whose vendor is Liferay (any case) is audited. No stack, or no supported vendor in it, is INFORMATION (101): nothing is audited and the run is not charged.
Read the declared version — an entry without a version is ERROR (502); the release list is not read.
Find the installed release — https://releases-cdn.liferay.com/releases.json is fetched with a 10 second timeout (a network error, a status other than 200 or an unreadable body is ERROR 500) and the declared version is matched against the releases of the declared product (DXP or Portal) by any of its names, ignoring case and repeated spaces, exactly like the Latest Version Auditor: 2025.Q1.15 LTS, DXP 2025.Q1.15 LTS, 2025.q1.15, dxp-2025.q1.15-lts, 7.4.3.132 GA132, 7.4.13-u92. A version that names no release of that product is ERROR (503). The release line is the group Liferay publishes the release in (2025.Q1, 7.4).
Liferay Portal — Liferay publishes no service life for Portal (the community edition): only its latest GA release receives fixes. A Portal release is a WARNING (302) with no dates.
Service-life dates of the line — for DXP, the line is looked up in the table of the Liferay Service Life Policy bundled with the auditor (the policy page serves the table as an image behind a bot challenge, so it cannot be read at audit time). The bundled edition is the 2026 table, read on 2026-10-05, covering DXP 7.0 to 2026.Q4; the 100 check names the edition in every result.
| Line | General availability | End of Premium Support | End of Limited Support |
|---|---|---|---|
| 2026.Q4 | 2026-11-11 | 2027-11-10 | — |
| 2026.Q3 | 2026-08-19 | 2027-08-18 | — |
| 2026.Q2 | 2026-05-13 | 2027-05-12 | — |
| 2026.Q1 (LTS) | 2026-03-18 | 2029-03-17 | 2031-03-17 |
| 2025.Q4 | 2025-11-26 | 2026-11-25 | — |
| 2025.Q3 | 2025-09-03 | 2026-09-02 | — |
| 2025.Q2 | 2025-05-28 | 2026-05-27 | — |
| 2025.Q1 (LTS) | 2025-02-19 | 2028-02-18 | 2030-02-18 |
| 2024.Q4 | 2024-12-11 | 2025-12-10 | — |
| 2024.Q3 | 2024-09-12 | 2025-09-11 | — |
| 2024.Q2 | 2024-06-12 | 2025-06-11 | — |
| 2024.Q1 (LTS) | 2024-03-13 | 2027-03-13 | 2029-03-12 |
| 2023.Q4 | 2023-12-13 | 2024-12-12 | — |
| 2023.Q3 | 2023-10-20 | 2024-10-19 | — |
| 7.4 | 2023-09-01 (final release) | 2027-09-01 | 2030-09-01 |
| 7.3 | 2020-10-13 | 2024-10-12 | 2027-10-12 |
| 7.2 | 2019-06-04 | 2023-06-03 | 2026-06-03 |
| 7.1 | 2018-07-10 | 2022-11-13 | 2025-11-13 |
| 7.0 | 2016-06-15 | 2020-06-14 | 2023-06-14 |
A quarterly line that is newer than the table gets its dates from the policy rules: the first release of the line (2026.q2.0) publishes its general availability date in release.properties (since 2026.Q1); a non-LTS quarterly line has one year of Premium Support and no Limited Support, and the Q1 line of each year is LTS with three years of Premium Support followed by two years of Limited Support, each phase ending the day before the anniversary. A DXP line that is in neither place is ERROR (504).
End of life — the last day of Limited Support when the line has that phase (7.x and LTS lines), otherwise the last day of Premium Support. The day count is from the day the audit runs (UTC).
Thresholds — end of life in the past is FAIL (400); end of life in at most failDays days (default 180) is FAIL (401); in at most warningDays days (default 365) is WARNING (300). A line past its Premium Support but still in Limited Support is WARNING (301), listed next to the end-of-life finding when both apply.
Aggregate — ERROR wins, then FAIL, then WARNING. A line in Premium Support with more than warningDays days left is SUCCESS (200).
Both are optional per-URL preferences; an unset, unreadable or non-positive value takes the default.
| Key | Type | Default | Meaning |
|---|---|---|---|
failDays | integer | 180 | FAIL (401) when end of life is this many days away or fewer |
warningDays | integer | 365 | WARNING (300) when end of life is this many days away or fewer (and more than failDays) |
Every row maps to one checkRule* method and one CheckCode. CheckCode suffixes use status ranges: 100 information, 200 success, 300–399 warning, 400–499 fail, 500–599 error. The audited page is not fetched, so there is no 590 (site blocked) code.
| CheckCode | Status | When it fires | Recommendation | Why it matters |
|---|---|---|---|---|
37A-EndOfLifeAuditor-100 | INFORMATION | Always. Records the vendor policy and the edition of its table the dates come from (Service-life dates come from the Liferay Service Life Policy (2026 table, read 2026-10-05).). | — (recommendation is null; nothing for the site to change) | — |
37A-EndOfLifeAuditor-101 | INFORMATION | The project has no software stack, or the stack names no supported platform; nothing is audited and the run is not charged (the check carries notApplicable: true). | Empty stack: add {supported} and its version to the project's software stack to audit its service life. Other platforms: if the site runs {supported}, add it and its version to the project's software stack to audit its service life. | — |
37A-EndOfLifeAuditor-500 | ERROR | The release list or a release's release.properties could not be fetched or parsed. | Run the audit again; {dataSource} answered "{error}". | — |
37A-EndOfLifeAuditor-502 | ERROR | The stack entry of the platform has no version. | Set the installed version of {platform} {product} in the project's software stack. | — |
37A-EndOfLifeAuditor-503 | ERROR | The declared version names no release of the declared product. | Pick the installed {platform} {product} release in the project's software stack; "{declaredVersion}" names no {platform} {product} release. | — |
37A-EndOfLifeAuditor-504 | ERROR | The release is known but its DXP line is neither in the bundled service-life table nor publishes a general availability date. | Run the audit again once the auditor's service-life table lists the {releaseLine} line; the stack declares {installed}. | — |
37A-EndOfLifeAuditor-400 | FAIL | The installed release line is past its end of life. | Upgrade {platform} {product} from {installed} to a line in Premium Support, such as the current LTS release; support for the {releaseLine} line ended on {endOfLife}. | An end-of-life platform gets no security patches, so every new vulnerability stays open on the site and compliance audits flag it. |
37A-EndOfLifeAuditor-401 | FAIL | End of life is at most failDays days away (not yet past). | Start the upgrade of {platform} {product} {installed} now; the {releaseLine} line loses all support on {endOfLife}. | A platform upgrade takes months; with so little support left the site will run unsupported before the work finishes. |
37A-EndOfLifeAuditor-300 | WARNING | End of life is more than failDays and at most warningDays days away. | Plan the upgrade of {platform} {product} {installed} off the {releaseLine} line before {endOfLife}. | Scheduling the upgrade a year ahead keeps the site supported without an emergency migration once the vendor stops publishing fixes. |
37A-EndOfLifeAuditor-301 | WARNING | Premium Support of the line ended and its Limited Support has not. | Move {platform} {product} {installed} to a line in Premium Support, such as the current LTS release, to receive new hotfixes again. | In Limited Support the vendor fixes only critical vulnerabilities, so ordinary bugs and lower-severity security issues stay in the site until it moves to a supported line. |
37A-EndOfLifeAuditor-302 | WARNING | The installed product has no vendor service life (Liferay Portal). | Keep {platform} {product} on the latest GA release, or move to a commercial edition with a published support window; the stack declares {installed}. | Without a support window there is no patch stream for the installed release, so security fixes arrive only by upgrading to the newest release. |
37A-EndOfLifeAuditor-200 | SUCCESS | All rules passed. Message is {platform} {product} {installed} is in Premium Support until {endOfPremiumSupport}; the {releaseLine} line reaches end of life on {endOfLife} ({days} days left). | — | — |
Example messages for an audit run on 2026-10-05 with the default thresholds:
400 — Liferay DXP 2025.Q3.5 reached end of life on 2026-09-02 (33 days ago): the 2025.Q3 line receives no fixes or security patches.
401 — Liferay DXP 2025.Q4.3 reaches end of life on 2026-11-25, in 51 days (fail threshold: 180 days).
301 — Liferay DXP 7.3 U36 left Premium Support on 2024-10-12; the 7.3 line is in Limited Support until 2027-10-12 (critical security fixes only).
302 — Liferay Portal 7.4.3.132 GA132 (Community Edition) has no vendor service life: Liferay fixes only the latest GA release of Portal.
200 — Liferay DXP 2026.Q1.13 LTS is in Premium Support until 2029-03-17; the 2026.Q1 line reaches end of life on 2031-03-17 (1624 days left).
Findings carry the same values in data: platform, product, declaredVersion, installedVersion, releaseLine, lts, communityEdition, generalAvailability, endOfPremiumSupport, endOfLimitedSupport, endOfLife, daysToEndOfLife, datesSource (table or release.properties rule), failDays and warningDays.
| Status | Description | Test logic |
|---|---|---|
| INFORMATION | The auditor does not apply to the stack | No stack, or no supported platform in it (101); the run is not charged. |
| SUCCESS | The installed release line is in Premium Support and its end of life is more than warningDays days away | No rule fired (200). |
| WARNING | End of life is within warningDays days, the line is in Limited Support, or the product has no vendor service life | End of life in more than failDays and at most warningDays days (300); Premium Support ended and Limited Support has not (301); Liferay Portal (302). |
| FAIL | The installed release line is past its end of life, or within failDays days of it | End of life in the past (400) or in at most failDays days (401). The 301 warning is listed too when the line is in Limited Support. |
| ERROR | The auditor could not place the version in a service life | Release data unreadable (500); stack entry without a version (502); version that names no release (503); line without known dates (504). |
After its end of life a release line gets no patches of any kind. Every vulnerability Liferay publishes from then on is open on the site for good, which is why an end-of-life line is a FAIL and not a warning.
Limited Support only brings fixes for critical vulnerabilities. A site on 7.3 today still gets those until 2027-10-12, but no hotfix for anything else; the 301 warning marks that phase.
The dates of the 7.x and quarterly lines come from the 2026 edition of Liferay's Service Life Policy table, read on 2026-10-05. Liferay can revise its policy; the 100 check names the edition the audit used.
A quarterly line newer than the table is dated from its general availability date with the policy rules, which may differ by one day from the date Liferay later publishes.
Liferay Portal (community edition) has no published service life, so no date is reported for it.
The verdict is only as good as the version in the project's software stack. Update the stack when the site is upgraded, or the audit keeps reporting the old line.
Only the first Liferay entry of the stack is audited.
It does not fetch the monitored URL and does not detect the running version from the site.
It does not say whether a later fix release exists; the Latest Version Auditor does.
It does not look up vulnerabilities for the installed version; the CVE Auditor does.
This documentation is built and hosted on Mintlify, a developer documentation platform.
Add this auditor to your monitoring setup and start identifying issues on your websites today.