Apache Velocity End of Life - Dates and Lifecycle

Apache Velocity is a Java-based template engine that generates dynamic web pages, source code, configuration files, and other text output by combining templates with data. It's maintained by the Apache Software Foundation and has been a stable, if slow-moving, part of the Java ecosystem since the early 2000s, often paired with tools like Spring or used standalone for code and document generation.

Apache Velocity Lifecycle Explained

Apache Velocity has no formal end of life policy, and unlike most software covered on this site, that isn't an inference, it's something a project maintainer stated directly. In response to a user asking about EOL versions on the Velocity mailing list, developer Nathan Bubna replied plainly: "there are no technically EOL versions of Velocity... we're just not that big or fast moving of a project. Things change only very slowly around here, as the project is stable and the team is small and busy... support is volunteer-based, so if someone wants to support you and answer your question, they do."

That description matches the release history closely. Velocity Engine 2.0 shipped seven years after 1.7. A sandbox bypass vulnerability (CVE-2020-13936, allowing arbitrary Java code execution through untrusted templates) affected every version up through 2.2, but the fix in 2.3 didn't ship until over a year later. There's no scheduled patching cadence, and no guarantee that any given issue, security or otherwise, will be addressed quickly, or at all, since the project runs entirely on volunteer time.

Velocity also ships a closely related but separately versioned Tools package, which provides supporting utilities for web and standalone applications built on the Velocity Engine. Tools 3.1, for example, was released alongside Engine 2.3 and specifically patches its own XSS vulnerability (CVE-2020-13959), so it's worth tracking Tools versions alongside the core Engine version rather than assuming Engine security fixes cover it too.