Outdated Software Finder - EOL PHP, WordPress, Any Stack

Give it a list of components ("php 7.4", "WordPress 5.8", "nodejs 16") or the output of the tech-stack-detector Actor, and it tells you which ones are end-of-life, how many days are left, what to upgrade to and how many known vulnerabilities the library versions have. For web agencies hunting upgrade leads, MSPs and IT asset teams.

Data comes from endoflife.date (about 480 products) and the OSV vulnerability database. No API keys.

Input examples

{ "components": ["php 7.4", "wordpress 5.8", "nodejs 16", "ubuntu 18.04"] }

{ "components": ["npm:lodash 4.17.20", "jquery 1.12.4", "django 2.2"], "checkVulnerabilities": true }

{ "techStackDatasetId": "<dataset id of a tech-stack-detector run>", "eolSoonDays": 365 }

Input guide

Field	What it does
components	One per line, name plus version: php 7.4, WordPress 5.8.1, nodejs@16. npm:name version forces a vulnerability lookup.
techStackDatasetId	Pick a tech-stack-detector dataset; each site's versioned technologies are checked and a per-site summary is added.
includeUnknownVersions	For datasets: also list known products whose version was not detected.
checkVulnerabilities	Count OSV advisories for library components (default on).
eolSoonDays	Support ending within this many days is flagged eol-soon (default 180).
maxSites	Cap on dataset rows processed.

Output

Field	Meaning
type	component, site-summary or error
site, source	Domain (dataset input) or null (typed list)
component, version, product, cycle	What was checked and the matched release line
status	eol, eol-soon, supported, version-unknown, unknown-product
eolDate, daysLeft	End of support date and days remaining (negative = days since EOL)
upgradeTo, newestSupported	Newest maintained release line and its latest version
vulnCount, highestSeverity, vulnIds	OSV advisories for that exact version, highest severity seen
site summary	eolCount, eolSoonCount, vulnerableCount, outdated, eolComponents

Sample row:

{"type":"component","component":"php","version":"7.4","product":"php","cycle":"7.4","status":"eol","eolDate":"2022-11-28","daysLeft":-1407,"upgradeTo":"8.5","vulnCount":null}

Use it with

• tech-stack-detector -> this Actor: detect the stack of a list of sites, then keep the sites whose summary says outdated: true as upgrade leads.
• Google Maps scraper -> tech-stack-detector -> this Actor for local-business prospecting.

FAQ

Why is vulnCount empty for PHP or nginx? OSV tracks packages in library ecosystems (npm, PyPI, Packagist, Maven, RubyGems), not servers and runtimes. Those components get an end-of-life check only. Use the npm:-style prefix to force a package lookup.

Why are many detected technologies skipped? Most sites hide versions. Technologies without a detected version cannot be placed on a release line, so they are skipped unless you turn on includeUnknownVersions.

Limits (honest)

• Version matching is by release line (7.4.33 matches the 7.4 line). A version that does not match any line is version-unknown.
• Vulnerability severity is read from the first 12 advisories only when there are more.
• Security patches that vendors backport (Debian, RHEL) are not visible; EOL dates are the upstream project's.
• Reading a tech-stack-detector dataset needs the Actor's full-permissions mode (it reads a storage you pick).

Price

Pay per event: site-checked $0.003 per site with at least one checked component; a typed component list counts one event per 10 components. Example: 200 sites from tech-stack-detector cost $0.60 (sites with nothing checkable are free).