Apache Tapestry End of Life (EOL) Dates & Support Timeline
Complete end-of-life dates, support windows, and security status for all Apache Tapestry versions. Data sourced from endoflife.date and official vendor documentation. Updated at every deploy.
| Version | Latest Release | Release Date | EOL Date | Days | Status |
|---|---|---|---|---|---|
| 5.8 | 5.8.7 | Jan 17, 2022 | Feb 2, 2025 | 521 days past EOL | EOL |
| 5.9 | 5.9.1 | Feb 2, 2025 | TBD | Supported | Active |
Apache Tapestry lifecycle status — the real story
Apache Tapestry is a component-oriented Java web framework whose ecosystem peaked in the late 2000s but which continues to receive maintenance: the 5.8 line (2022) was superseded by 5.9 in February 2025, with 5.9.1 arriving in April 2026. As an Apache project it follows the community norm of maintaining the current release, so 5.8 and earlier should be considered end-of-line.
Tapestry has a documented history of serious deserialization and remote-code-execution advisories in older versions (the 5.4-era CVEs remain actively scanned for by attackers), which makes version currency more security-relevant than the framework's quiet profile suggests.
Remaining Tapestry estates are typically long-lived internal enterprise applications. The framework's strong backward-compatibility tradition makes staying current cheaper than for most frameworks of its generation — the risk is organizational neglect, not upgrade difficulty.
What does Apache Tapestry end of life mean for your organization?
When a version of Apache Tapestry reaches end of life, the maintainers stop issuing security patches. Vulnerabilities discovered after this date are publicly disclosed on the National Vulnerability Database, exploit code appears on GitHub, and your systems remain permanently exposed.
The CVE blind spot: Most vulnerability scanners check for known CVEs but do not flag the accumulation of unpatched vulnerabilities in EOL software. With a zero-day, nobody knows about the vulnerability. With EOL software, the vulnerability is public — listed, rated, and often weaponized — but no patch will ever exist. This is the most dangerous gap in enterprise security posture.
Organizations running EOL Apache Tapestry should treat it as a vulnerability class in their risk register, apply compensating controls (network segmentation, enhanced monitoring, access restriction), and prioritize migration to a supported version.
Extended Support Options
If you cannot migrate immediately, extended support vendors provide continued security patches for EOL Apache Tapestry versions. This is a bridge, not a permanent solution — plan your migration in parallel.
We work with vetted extended support vendors. Tell us what you need and we'll connect you with the right provider.
Contact Us →