Dates on which something you run changes, loses its fixes or becomes a legal duty, whether or not you upgrade anything. Each with what it affects, a check to run and the source that sets it.
29 dates · every one read from its source on 22 October 2026
Three kinds of date matter. Certificate lifetimes shrink every year until 2029, so renewal has to be automatic and watched. End-of-life dates for Kubernetes, Node.js, Python, PostgreSQL and Linux distributions mean no more security fixes after the day. And the EU Cyber Resilience Act turns vulnerability reporting and software bills of materials into obligations for anyone selling software in the EU.
None of these show up as an error on the day. A certificate fails weeks later, at its first short renewal; an unsupported version keeps running until its next vulnerability. Run the checks below now, while you can still choose when to act.
This page is rebuilt every few hours, so “passed” and “coming” follow today’s date. Managed services keep their own calendars: where a provider’s date differs from the project’s, the provider’s is the one that applies to you.
| Date | What changes |
|---|---|
| 11 November 2026 | Helm 3: security fixes end |
| 12 November 2026 | PostgreSQL 14: final release |
| 19 October 2026 to 19 November 2026 | GitHub Actions: ubuntu-latest becomes Ubuntu 26.04 |
| 26 November 2026 | Amazon EKS 1.31: extended support ends |
| 2 December 2026 | Amazon EKS 1.34: standard support ends |
| 10 February 2027 | Let's Encrypt: 64-day certificates by default |
| 28 February 2027 | Kubernetes 1.35 end of life |
| 15 March 2027 | Public TLS certificates: 100 days at most |
| 30 April 2027 | Node.js 22 end of life |
| May 2027 | Ubuntu 22.04 LTS: standard security maintenance ends |
| 28 June 2027 | Kubernetes 1.36 end of life |
| 28 October 2027 | Kubernetes 1.37 end of life |
| October 2027 | Python 3.11 end of life |
19 October 2026 to 19 November 2026 · CI runners
GitHub moves ubuntu-latest to the Ubuntu 26.04 image between 19 October 2026 and 19 November 2026, bringing Docker 29, Compose 5, Helm 4 and Python 3.14 into jobs that never asked for them.
Affects: Every workflow with runs-on: ubuntu-latest.
Check
grep -rn "runs-on:.*ubuntu-latest" .github/workflows/
What to do: Pin ubuntu-24.04 where a job is not ready, and test on ubuntu-26.04 first.
11 November 2026 · Tools
The last day Helm 3 receives security fixes.
Affects: Anything that still runs Helm 3.
Check
helm version --short
What to do: Switch to Helm 4 after comparing rendered output, or accept running an unpatched client.
12 November 2026 · Runtimes and databases
The last minor release of PostgreSQL 14. After it, no bug or security fixes.
Affects: Databases on PostgreSQL 14, including managed ones (check your provider's own dates).
Check
psql -X -At -c 'SHOW server_version;'
What to do: Plan a major-version upgrade, and rehearse it on a copy with a restored backup first.
26 November 2026 · Kubernetes
At the end of extended support, EKS upgrades the cluster automatically to the oldest version still in extended support. A cluster upgraded this way cannot be rolled back.
Affects: EKS clusters on 1.31.
Check
aws eks describe-cluster --name my-cluster --query cluster.version --output text
What to do: Upgrade on your own schedule before the date, after checking for removed APIs and changed defaults.
2 December 2026 · Kubernetes
1.34 enters 12 months of extended support, which is on by default and charged at an additional cost per cluster hour.
Affects: EKS clusters on 1.34.
Check
aws eks describe-cluster --name my-cluster --query cluster.version --output text
What to do: Upgrade before the date, or budget for extended support deliberately.
10 February 2027 · TLS certificates
The default (classic) profile issues 64-day certificates with a 10-day authorization reuse period. Existing certificates change at their next renewal after the date.
Affects: Every site on Let's Encrypt: renewal has to keep working, more often.
Check
systemctl list-timers '*certbot*' # when renewal last ran, and runs next
What to do: Confirm renewal is automated and monitored; a renewal that silently fails now takes the site down sooner.
28 February 2027 · Kubernetes
Upstream patch releases for 1.35 stop.
Affects: Self-managed clusters on 1.35.
Check
kubectl version # the "Server Version" line
What to do: Upgrade to 1.36 or later.
15 March 2027 · TLS certificates
The maximum validity for certificates from publicly trusted authorities drops to 100 days.
Affects: Anyone renewing certificates by hand, or on a schedule tuned to longer lifetimes.
Check
# When the certificate a site is serving expires echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate
What to do: Renewal must be automatic, and alert someone when it fails.
30 April 2027 · Runtimes and databases
No more releases of Node.js 22, including security fixes.
Affects: Services and images on Node 22.
Check
node --version
What to do: Move to Node.js 24 (supported until April 2028) or later.
May 2027 · Operating systems
Ubuntu 22.04 leaves standard security maintenance. Expanded Security Maintenance through Ubuntu Pro continues to May 2032.
Affects: Servers, runners and images on Ubuntu 22.04 (the ubuntu-22.04 runner label included).
Check
grep PRETTY_NAME /etc/os-release
What to do: Move to 24.04 or 26.04, or decide on Ubuntu Pro deliberately.
28 June 2027 · Kubernetes
Upstream patch releases for 1.36 stop.
Affects: Self-managed clusters on 1.36.
Check
kubectl version # the "Server Version" line
What to do: Upgrade to 1.37 or later.
28 October 2027 · Kubernetes
Upstream patch releases for 1.37 stop.
Affects: Self-managed clusters on 1.37.
Check
kubectl version # the "Server Version" line
What to do: Upgrade to a newer minor version.
October 2027 · Runtimes and databases
No more releases of Python 3.11, including security fixes.
Affects: Services, scripts and images on Python 3.11.
Check
python3 --version
What to do: Move to 3.12 or later.
11 November 2027 · Runtimes and databases
The last minor release of PostgreSQL 15.
Affects: Databases on PostgreSQL 15.
Check
psql -X -At -c 'SHOW server_version;'
What to do: Plan the major-version upgrade a release cycle ahead.
11 December 2027 · Regulation
Including a software bill of materials "in a commonly used and machine-readable format covering at the very least the top-level dependencies" (Annex I, Part II).
Affects: Manufacturers placing products with digital elements on the EU market.
What to do: Generate SBOMs from the built artifact, keep them by digest, and make sure you can query them.
16 February 2028 · TLS certificates
The default profile issues 45-day certificates with a 7-hour authorization reuse period.
Affects: Every site on Let's Encrypt.
Check
systemctl list-timers '*certbot*'
What to do: Prefer an ACME client that supports ACME Renewal Information (certbot 4.1 and later), which lets the authority say when to renew.
30 April 2028 · Runtimes and databases
No more releases of Node.js 24.
Affects: Services and images on Node 24.
Check
node --version
What to do: Plan the move to the next LTS line during 2027.
30 June 2028 · Operating systems
Debian 12 has been in long-term support since 11 June 2026; that ends here.
Affects: Servers and debian:bookworm base images.
Check
grep PRETTY_NAME /etc/os-release
What to do: Move to Debian 13 well before the date.
15 March 2029 · TLS certificates
The final step of the schedule: certificates from publicly trusted authorities may be valid for at most 47 days.
Affects: Every public TLS certificate.
Check
# When the certificate a site is serving expires echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate
What to do: By now renewal has to be fully automatic, everywhere certificates live, load balancers and appliances included.
Still worth a check: a passed date is exactly where a forgotten server, base image or runner label is still running, without fixes.
27 October 2026 · Kubernetes
The upstream project stops patch releases for 1.34, including security fixes. Managed services keep their own calendars (EKS below).
Affects: Self-managed clusters on 1.34.
Check
kubectl version # the "Server Version" line
What to do: Upgrade to 1.35 or later, one minor version at a time.
1 October 2026 · Runtimes and databases
No more releases of Python 3.10, including security fixes.
Affects: Services, scripts and images on Python 3.10.
Check
python3 --version
What to do: Move to a supported version; 3.11 itself ends in October 2027.
23 September 2026 · CI runners
JavaScript actions run on Node 24. The opt-out, ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION, is gone, and self-hosted runners on macOS 13.4 or earlier, or on ARM32, are no longer supported. Applies to github.com and GitHub with Data Residency.
Affects: Workflows using old releases of JavaScript actions, and maintainers of such actions.
Check
# In an action you maintain grep -n "using:" action.yml
What to do: Update actions to releases that run on node24; if you maintain one, set runs.using to node24 and publish a release.
11 September 2026 · Regulation
Manufacturers must report actively exploited vulnerabilities and severe incidents in their products with digital elements, including products already on the EU market.
Affects: Anyone who places software or connected products on the EU market.
What to do: Know who reports, to whom and how fast; the Commission's page links the details.
31 August 2026 · Operating systems
The end of Debian's long-term support for bullseye.
Affects: Servers and images still on Debian 11, including old debian:bullseye base images.
Check
grep PRETTY_NAME /etc/os-release
What to do: Move to Debian 12 or 13.
8 July 2026 · Tools
Helm 3 receives security fixes only from here, until 11 November 2026.
Affects: Pipelines and laptops still on Helm 3.
Check
helm version --short
What to do: Compare your charts' output under Helm 3 and Helm 4 and plan the switch.
30 June 2026 · Operating systems
Amazon Linux 2 reached its end-of-support date.
Affects: EC2 instances, AMIs and container base images built on Amazon Linux 2.
Check
grep PRETTY_NAME /etc/os-release
What to do: Rebuild on Amazon Linux 2023 or another supported distribution.
30 April 2026 · Runtimes and databases
No more releases of Node.js 20, including security fixes.
Affects: Services, build images and tools still on Node 20.
Check
node --version
What to do: Move to Node.js 24, the current LTS line, or 22 (which itself ends in April 2027).
March 2026 · Tools
The community Ingress NGINX controller stopped receiving releases, including security fixes. F5's NGINX Ingress Controller is a different project and is not affected.
Affects: Clusters whose Ingress objects are served by kubernetes/ingress-nginx.
Check (from the Kubernetes blog)
kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx
What to do: Plan the move to Gateway API or another controller, and find the behaviours a literal translation drops before you switch.
15 March 2026 · TLS certificates
Certificates from publicly trusted authorities issued from this date may be valid for at most 200 days, down from 398. The limit falls again in 2027 and 2029.
Affects: Anyone who buys or renews certificates by hand once a year.
Check
# When the certificate a site is serving expires echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate
What to do: Automate renewal now; a yearly manual renewal is no longer possible, and the interval only gets shorter.
Every date read from the source that sets it on 22 October 2026. Checks run where a system was available; otherwise the source of the command is named beside it.
Did this get you to an answer?
No text box on purpose — please do not paste production logs anywhere
Something wrong or out of date? Report it