We Measured the Lifespan of 7,144 Software Versions. The Median Is 18 Months.

A developer at endoflife.ai analyzed 7,144 software versions across 463 products and found the median supported lifespan is 18 months. The dataset, drawn from the endoflife.ai database, reveals that enterprise products like Internet Explorer (17 years) and Raspberry Pi (11.7 years) have the longest support, while rolling-release projects like Chrome and Firefox average five weeks per version. The findings suggest that organizations relying on multi-year upgrade cycles may run unpatched software for significant periods.

Originally published at endoflife.ai. We run a database that tracks end-of-life dates for 485 software products — every version, every release date, every day the security patches stop. Which means we're sitting on something nobody else has bothered to assemble: enough lifecycle data to answer a simple question with actual numbers. How long does a software version actually live? We measured every version in the dataset with both a firm release date and a firm end-of-life date — 7,144 versions across 463 products — and computed the span between them. The median supported lifespan of a software version is 1.5 years . The mean is 2.3 years a long tail of enterprise products drags it up . Sit with that. The thing you deployed, integrated, and built muscle memory around has — statistically — about eighteen months of security patches from the day it shipped. If your upgrade cadence is "every two or three years," the math says you spend a meaningful slice of every cycle running unpatched software. Not because you're negligent — because the clock is shorter than most people's mental model of it. | Category | Versions measured | Median lifespan | |---|---|---| | Hardware | 100 | 2.9 yrs | | Operating systems | 370 | 1.6 yrs | | Databases | 228 | 1.6 yrs | | Security tools | 61 | 1.3 yrs | | Frameworks | 195 | 1.1 yrs | | Runtimes | 221 | 1.0 yr | | Cloud services | 142 | 0.9 yrs | Two things jump out: Longest-lived median across versions : Internet Explorer at 17.0 years — say what you want about IE, Microsoft supported it longer than some of its users' entire careers. Then Atlassian Data Center 12.2 , Raspberry Pi 11.7 , Apache HTTP Server 11.6 , and NVIDIA GPUs 11.5 . Shortest-lived: a cluster of rolling-release projects — Chrome, Firefox, Rust, Prometheus, Neo4j among them — where each version gets roughly five weeks before the next one replaces it. That model works because upgrades are continuous and boring. The danger zone isn't rapid release; it's rapid release consumed at an enterprise pace. All data comes from the endoflife.ai https://endoflife.ai dataset built on the open-source endoflife.date project plus vendor lifecycle pages . We only measured versions with firm dates on both ends — no TBDs, no estimates — and used medians because enterprise long-tails skew means. Full methodology and tables are in the original article https://endoflife.ai/article-software-lifespan-study . If the median version lives 18 months, then "check lifecycle dates once, at adoption time" is a broken process — the answer changes underneath you. The fix is making the check continuous: curl https://api.endoflife.ai/v1/status/python/3.10 "is eol": false — until October 31, 2026. Eighteen months. Plan accordingly.