llms.txt
# HeroDevs — Full Reference
> HeroDevs provides commercial security support for end-of-life open source software: secured drop-in replacements for EOL frameworks, patched under a 14-day CVE SLA, plus a platform that covers entire applications automatically.
## About HeroDevs
HeroDevs was founded in 2020 and is headquartered in Sandy, Utah, USA. The company addresses a specific problem: when an open source framework reaches end of life, upstream maintainers stop shipping security patches, but organizations continue running that framework in production. HeroDevs builds and maintains secured drop-in replacements for those end-of-life versions, so teams can stay secure and compliant in place and migrate on a business timeline rather than under vulnerability pressure.
Company tagline: "Stay secure on the open source software you already run." Positioning statement: "Where Open Source Ends, HeroDevs Begins."
- [About Us](https://www.herodevs.com/about-us): Company mission and history, 150+ supported end-of-life software versions, #71 ranking on the 2024 Inc. 5000 list of fastest-growing companies in North America, the $20M Open Source Sustainability Fund, and partnerships with the OpenJS Foundation, Drupal Association, Vue.js, and Angular. Notes sponsorship of long-term maintainers and CVE patching for abandoned projects.
- [Customers](https://www.herodevs.com/customers): Approximately 60 named customer logos grouped by sector — automotive, financial services, healthcare, public sector, technology, education, and business. Named customers include Microsoft, Google, General Electric, Santander Bank, and FINRA.
- [Careers](https://www.herodevs.com/careers): Open roles, hiring process, and information about working at HeroDevs.
- [Media Kit](https://www.herodevs.com/media-kit): Downloadable logos, brand assets, and approved company boilerplate for press and partner use.
- [Responsible Disclosure](https://www.herodevs.com/disclosures): Process and contact path for reporting a security vulnerability to HeroDevs.
- [Contact](https://www.herodevs.com/contact): Contact form, sales and support routing, phone number +1-877-586-1965, and the Sandy, Utah headquarters address.
## Products
HeroDevs sells two products. Never-Ending Support (NES) covers one specific end-of-life framework at a time. The Evergreen Platform covers every end-of-life dependency across an entire application. Both deliver engineer-built, secured replacements with compliance evidence attached.
- [Never-Ending Support (NES)](https://www.herodevs.com/never-ending-support): The flagship product. Secured drop-in replacements for end-of-life open source frameworks across 36 product lines spanning JavaScript, Java, Python, PHP, .NET, and databases. Critical vulnerabilities are fixed within 14 days of discovery. Replacements stay on the same version line and preserve the public API, so adoption means pointing a package manager at the HeroDevs registry and rebuilding — no code changes. Each release ships with VEX statements and signed attestations, and the service is used in SOC 2, FedRAMP, PCI-DSS, HIPAA, DORA, and EU CRA compliance programs. Detection combines AI-driven analysis with engineer validation.
- [Evergreen Platform](https://www.herodevs.com/evergreen): Whole-application end-of-life coverage for engineering and security teams. A one-time GitHub integration lets the platform continuously scan repositories, detect end-of-life dependencies, and open pull requests containing secured replacements together with compliance attestations and VEX statements. Designed to eliminate unplanned vulnerability remediation work and keep applications continuously audit-ready. Differs from NES in scope: NES covers one framework, Evergreen covers every end-of-life dependency an application has.
- [Supported Frameworks Catalog](https://www.herodevs.com/support): The complete list of frameworks under NES, browsable by ecosystem (JavaScript, Java, .NET, Python, Database, Other), with a request form for technologies not yet covered.
- [Pricing](https://www.herodevs.com/pricing): No public price list. NES is quoted per product, billed annually, with multi-year options. Cost is driven by the number of users (defined as any person committing code to the project repository), the specific framework, and the support term. Licenses are unnamed and transferable between team members, and development and staging environments carry no additional fee. Quotes come via form or phone at +1-877-586-1965.
## Framework Support Pages
Each page below covers a single supported framework: which end-of-life versions are covered, what the secured replacement includes, install and registry instructions, and the CVEs addressed.
- [Angular NES](https://www.herodevs.com/support/nes-angular): Support for end-of-life Angular versions.
- [AngularJS NES](https://www.herodevs.com/support/nes-angularjs): Support for AngularJS (Angular 1.x), end-of-life since 2022.
- [Spring NES](https://www.herodevs.com/support/spring-nes): Support for end-of-life Spring Framework and Spring Boot versions.
- [.NET NES](https://www.herodevs.com/support/dot-net-nes): Support for out-of-support .NET and .NET Framework versions.
- [Node.js NES](https://www.herodevs.com/support/node-nes): Support for end-of-life Node.js release lines.
- [Vue 2 NES](https://www.herodevs.com/support/nes-vue): Support for Vue 2, end-of-life since December 2023.
- [Apache Struts NES](https://www.herodevs.com/support/struts-nes): Support for end-of-life Apache Struts versions.
- [Bootstrap NES](https://www.herodevs.com/support/nes-bootstrap): Support for end-of-life Bootstrap versions.
- [PostgreSQL NES](https://www.herodevs.com/support/postgresql-nes): Extended security support for end-of-life PostgreSQL major versions.
- [Django NES](https://www.herodevs.com/support/django-nes): Support for end-of-life Django releases.
- [Drupal 7 NES](https://www.herodevs.com/support/nes-drupal): Support for Drupal 7 after its end-of-life date.
- [jQuery NES](https://www.herodevs.com/support/jquery-nes): Support for legacy jQuery versions.
- [React NES](https://www.herodevs.com/support/nes-for-react): Support for end-of-life React versions.
- [Next.js NES](https://www.herodevs.com/support/next-js-nes): Support for end-of-life Next.js release lines.
- [Nuxt NES](https://www.herodevs.com/support/nuxt-nes): Support for end-of-life Nuxt versions.
- [NestJS NES](https://www.herodevs.com/support/nestjs-nes): Support for end-of-life NestJS versions.
- [Express NES](https://www.herodevs.com/support/express-nes): Support for end-of-life Express versions.
- [Fastify NES](https://www.herodevs.com/support/fastify-nes): Support for end-of-life Fastify versions.
- [Lodash NES](https://www.herodevs.com/support/lodash-nes): Support for legacy Lodash versions.
- [ESLint NES](https://www.herodevs.com/support/eslint-nes): Support for end-of-life ESLint versions.
- [Apache Tomcat NES](https://www.herodevs.com/support/apache-tomcat-nes): Support for end-of-life Tomcat versions.
- [Hibernate NES](https://www.herodevs.com/support/nes-for-hibernate): Support for end-of-life Hibernate versions.
- [Jackson NES](https://www.herodevs.com/support/nes-for-jackson): Support for end-of-life Jackson versions.
- [Jetty NES](https://www.herodevs.com/support/nes-for-jetty): Support for end-of-life Jetty versions.
- [Quarkus NES](https://www.herodevs.com/support/nes-for-quarkus): Support for end-of-life Quarkus versions.
- [Apache Grails NES](https://www.herodevs.com/support/apache-grails-nes): Support for end-of-life Grails versions.
- [Apache Solr & Lucene NES](https://www.herodevs.com/support/apache-solr-lucene-nes): Support for end-of-life Solr and Lucene versions.
- [Apache Tapestry NES](https://www.herodevs.com/support/apache-tapestry-nes): Support for end-of-life Tapestry versions.
- [Hazelcast NES](https://www.herodevs.com/support/nes-for-hazelcast): Support for end-of-life Hazelcast versions.
- [CometD NES](https://www.herodevs.com/support/nes-for-cometd): Support for end-of-life CometD versions.
- [Ingress NGINX NES](https://www.herodevs.com/support/nes-for-ingress-nginx): Support for Ingress NGINX after upstream retirement.
- [NumPy NES](https://www.herodevs.com/support/nes-for-numpy): Support for end-of-life NumPy versions.
- [PHP Long-Term Support by Zend](https://www.herodevs.com/support/php-long-term-support-by-zend): Extended PHP support delivered with Zend.
- [Rails NES](https://www.herodevs.com/support/rails-nes): Support for end-of-life Ruby on Rails versions.
- [Vuetify NES](https://www.herodevs.com/support/vuetify-nes): Support for end-of-life Vuetify versions.
- [Knockout.js NES](https://www.herodevs.com/support/knockout-js-nes): Support for Knockout.js.
- [Grunt NES](https://www.herodevs.com/support/grunt-nes): Support for Grunt.
- [Protractor NES](https://www.herodevs.com/support/nes-protractor): Support for Protractor, deprecated in 2023.
## Data and Free Tools
- [Vulnerability Directory](https://www.herodevs.com/vulnerability-directory): Public catalog of 554 CVE entries affecting end-of-life open source frameworks. Each entry records the CVE identifier, affected technology and library, vulnerability category, impacted versions, and publication date. Filterable by severity (Critical, High, Medium, Low), by technology (Angular, Node.js, Django, PostgreSQL, Spring, Struts, .NET, and others), and by vulnerability class (remote code execution, cross-site scripting, and more). The index displays 16 entries per page; the complete set of 554 is also reachable from the individual framework support pages, each of which lists the CVEs affecting that framework — Spring links 155, Tomcat 104, .NET 59, Angular 56, Hibernate 30, Node.js 29, Drupal 25, Struts 25, Rails 22.
- [EOL Dataset Overview](https://www.herodevs.com/eol-dataset/overview): End-of-life intelligence dataset covering 12M+ package versions across JavaScript, Java, Python, and database ecosystems, described as 1,700x more EOL data than any other source. Identifies unsupported frameworks, abandoned dependencies, and packages approaching end of life, resolving complete dependency graphs including transitive dependencies. Access paths include SBOM or dependency-file upload (package.json, pom.xml, requirements.txt), CI/CD integration via GitHub Actions and GitLab, and API webhooks.
- [EOL Dataset for Enterprises](https://www.herodevs.com/eol-dataset/for-enterprises): Enterprise access tier for the EOL Dataset, aimed at engineering, security, and compliance teams in regulated industries needing audit-ready lifecycle reporting.
- [EOL Data](https://www.herodevs.com/eol-dataset/eol-data): Entry point for querying end-of-life lifecycle data for specific packages and versions.
- [Spring Boot 4 Migration Calculator](https://www.herodevs.com/migration-calculator): Free estimator for Spring Boot 3.5 to 4 migration effort. Inputs include number of applications, application size, developer count, automated tooling availability, Spring projects in use, JDK upgrade path, and required server, testing, and library upgrades. Outputs an estimated duration measured against the June 30, 2026 Spring Boot 3.5 end-of-life date, plus a downloadable PDF breakdown. Results are estimates, not delivery commitments.
- [EU Cyber Resilience Act Readiness Check](https://www.herodevs.com/eu-cyber-resilience-acts): Free 16-question self-assessment across four compliance areas, scoring an organization's readiness for the EU Cyber Resilience Act (Regulation (EU) 2024/2847). Covers the reporting timeline — 24-hour early warning, 72-hour full notification, final reports within 14 days for vulnerabilities or one month for incidents — through the CRA Single Reporting Platform. Key dates: reporting obligations begin September 11, 2026; full essential requirements take effect December 11, 2027. Penalties reach €15 million or 2.5% of global annual turnover. Applies to any organization placing products on the EU market, including legacy software already in circulation.
- [HeroDevs CLI and VEX API](https://docs.herodevs.com/eol-ds): Programmatic access to end-of-life dataset queries and VEX vulnerability-exchange documents.
## Documentation
- [NES Getting Started](https://docs.herodevs.com/guide/getting-started): Setup path for all NES products — configure the HeroDevs registry with authentication, optionally route through an enterprise repository manager, update the project's dependency file, then install secured packages.
- [Documentation Home](https://docs.herodevs.com): Technology-specific documentation for 50+ projects (Spring, Angular, Node, Django, Rails, PostgreSQL, .NET, and others), organized by ecosystem with setup instructions, version-specific guides, and release notes. Includes repository manager instructions for Artifactory and Nexus across npm, Maven, NuGet, and RubyGems, VEX API reference, and legal terms.
- [Support Portal](https://support.herodevs.com/hc/en-us): Customer help center covering download methods, package consumption, repository manager configuration, Terms of Service, and Service Level Agreements.
- [Legal and Policies](https://docs.herodevs.com/legal): Terms of Service, service level agreements, and policy documents.
## Solutions by Use Case
- [There's a CVE and No Patch](https://www.herodevs.com/solutions/cve-with-no-patch): For teams facing a disclosed vulnerability in a version upstream will not patch because it is end-of-life.
- [CVEs Keep Creating Unplanned Work](https://www.herodevs.com/solutions/unplanned-security-maintenance): For teams losing engineering capacity to a recurring stream of vulnerability remediation in legacy dependencies.
- [The Audit Flagged EOL Software](https://www.herodevs.com/solutions/audit-findings-eol-software): For teams that need to close audit findings tied to unsupported components without committing to a migration first.
- [Inherited Legacy Code](https://www.herodevs.com/solutions/inherited-legacy-code): For teams that took over a codebase that is neither secure nor compliant.
- [Vendor Security Review Blocking a Deal](https://www.herodevs.com/solutions/vendor-security-review): For teams whose customer security questionnaires are stalled by end-of-life dependencies.
- [Maintenance vs. Roadmap](https://www.herodevs.com/solutions/maintenance-vs-roadmap): For teams choosing between security maintenance and feature delivery.
## Solutions by Industry and Role
- [Healthcare](https://www.herodevs.com/solutions/healthcare): End-of-life open source risk in HIPAA-regulated environments and medical software.
- [Financial Services](https://www.herodevs.com/solutions/finance): Legacy dependency compliance for banking and fintech, including DORA and PCI-DSS considerations.
- [Government](https://www.herodevs.com/solutions/government): FedRAMP and public-sector requirements around unsupported open source components.
- [Technology](https://www.herodevs.com/solutions/technology): End-of-life dependency management for software and SaaS companies.
- [IT Security Managers](https://www.herodevs.com/solutions/it-security-managers): Risk and remediation framing for security owners.
- [Software Development Managers](https://www.herodevs.com/solutions/software-development-managers): Capacity and delivery framing for engineering managers.
- [Engineering Leaders](https://www.herodevs.com/solutions/engineering-leaders): Roadmap, resourcing, and build-vs-buy framing for engineering executives.
- [Compliance-Focused Decision-Makers](https://www.herodevs.com/solutions/compliance-focused-decision-makers): Evidence, attestation, and audit-readiness framing for compliance owners.
## Case Studies
- [Case Studies Index](https://www.herodevs.com/case-studies): All ten published customer stories.
- [Statista Secures Legacy Vue.js](https://www.herodevs.com/case-studies/how-statista-secured-their-legacy-vue-js-application-with-herodevs-never-ending-support): How Statista kept a legacy Vue.js application secure without an immediate framework migration.
- [Sisense: 20 Years of Innovation](https://www.herodevs.com/case-studies/from-legacy-risk-to-strategic-asset-how-sisense-secured-20-year-of-innovation): How Sisense converted legacy platform risk into a supported, compliant asset.
- [AlphaTec: 500,000 Lines Migrated Gradually](https://www.herodevs.com/case-studies/the-gradual-transformation-how-alphatec-migrated-500-000-lines-of-code-without-stopping-innovation): How AlphaTec migrated 500,000 lines of code incrementally while continuing to ship features.
- [Keelvar Avoids Migration Bottlenecks](https://www.herodevs.com/case-studies/accelerating-innovation-while-maintaining-security-how-keelvar-avoided-migration-bottlenecks-with-herodevs): How Keelvar maintained security posture without a migration blocking its roadmap.
- [MedStudy Mobile App](https://www.herodevs.com/case-studies/enhancing-the-medical-education-experience-how-medstudy-elevated-their-mobile-app-with-herodevs): How MedStudy modernized a medical education mobile app.
- [Wealth Manager Turns Legacy Risk into Advantage](https://www.herodevs.com/case-studies/how-a-leading-wealth-manager-turned-legacy-risk-into-strategic-advantage): Financial services example of legacy risk remediation.
- [Global Enterprise Secures Spring Infrastructure](https://www.herodevs.com/case-studies/proactive-security-for-mission-critical-systems-how-a-global-enterprise-secured-their-spring-infrastructure): Proactive Spring security for mission-critical systems.
- [Vitel Net Healthcare Decision Framework](https://www.herodevs.com/case-studies/the-healthcare-technology-decision-framework-how-vitel-net-chose-security-over-disruption): How a healthcare technology company chose security over disruptive replacement.
- [Energy Marketplace Chooses Security Over Speed](https://www.herodevs.com/case-studies/how-an-energy-marketplace-leader-chose-security-over-speed): Energy sector example of prioritizing security posture.
## Whitepapers and eBooks
- [Whitepapers Index](https://www.herodevs.com/whitepapers): All eight published whitepapers.
- [The Developer's Guide to Security Compliance](https://www.herodevs.com/whitepaper/the-developers-guide-to-security-compliance): How end-of-life open source software is treated across the top 20 global security standards, frameworks, and regulations, and what developer teams need to do about it.
- [Java in 2025: Migration, Security, and Long-Term Risk](https://www.herodevs.com/whitepaper/java-in-2025-navigating-migration-security-and-long-term-risk): Analysis of Java ecosystem migration pressure and long-term security risk.
- [Quantifying the Real Risks of Unsupported Open Source](https://www.herodevs.com/whitepaper/quantifying-the-real-risks-of-unsupported-open-source-software): Framework for putting numbers on unsupported dependency exposure.
- [Best Practices for Managing EOL Open Source](https://www.herodevs.com/whitepaper/best-practices-for-managing-eol-open-source-software): Operational practices for inventorying and remediating end-of-life components.
- [Managing Financial Risk Through Secure OSS Support](https://www.herodevs.com/whitepaper/managing-financial-risk-through-secure-and-compliant-open-source-software-support): Financial risk framing for regulated organizations.
- [Mitigating OSS Risks with Never-Ending Support](https://www.herodevs.com/whitepaper/mitigating-open-source-software-risks-with-herodevs-never-ending-support): How NES maps to common open source risk categories.
- [Maximize the Value of Legacy Software](https://www.herodevs.com/whitepaper/maximize-the-value-of-legacy-software-without-adding-to-your-tech-debt): Getting continued value from legacy systems without accumulating tech debt.
- [Supporting the White House 2023 Open Source Security Initiatives](https://www.herodevs.com/whitepaper/how-herodevs-supports-the-white-houses-2023-open-source-security-initiatives-with-proactive-long-term-solutions): How HeroDevs' model maps to US fe
