The most dangerous sentence in enterprise software may be: “It still works.” The application opens. The transactions clear. The nurses, bankers or civil servants using it see no reason for alarm. Underneath, however, sits a framework whose maintainers have stopped shipping fixes. One vulnerability report later, a dependable old system becomes an audit finding with no obvious patch.
HeroDevs built a company around that awkward interval. The Sandy, Utah, software firm maintains private, commercially supported versions of open-source frameworks and libraries after official support ends. Customers replace a dependency with a compatible HeroDevs build, keep the application behavior they know, and receive backported security fixes under contract. The product is called Never-Ending Support, or NES. The less branded description is even better: paid maintenance for code that the rest of the industry has left behind.
First came the consultancy. Then AngularJS fell off a cliff.
Aaron Frost founded HeroDevs in 2018, drawing on relationships he had built around ng-conf, the Angular conference he co-founded. The original business was conventional: assemble a distributed team of skilled developers and build applications for clients. It grew, but it was still a services company selling talent project by project.
Then Google announced the end of support for AngularJS. That decision did not switch off the enormous number of applications already built with it. It switched off the expected stream of security fixes. Frost knew the migrations facing his clients could absorb tens of thousands of engineering hours and millions of dollars. A functioning application had acquired a deadline unrelated to what its users needed.
That was the first thing to fail: not the software, but the assumption that a healthy open-source project would always remain maintained. HeroDevs changed shape around the contradiction. Instead of only helping one company rebuild one application, it could maintain a compatible version of AngularJS and sell the same security work to every company stuck on that release line.
“Open source software runs the world.”Aaron Frost, announcing the 2025 growth investment
What customers buy is control of the calendar
A typical customer has three choices. It can accept the risk, maintain a private fork itself, or start a migration immediately. The first choice makes security teams sweat. The second diverts specialists into permanent maintenance. The third can be the right answer and still arrive at the wrong time - in the middle of a roadmap, a regulatory review or a staffing shortage.
HeroDevs inserts a fourth choice. Its engineers monitor old release lines, investigate vulnerabilities, backport fixes and distribute patched artifacts through private registries. The packages preserve the APIs and behavior applications expect. For JavaScript, adoption can mean changing a package reference and registry token. For Java, it can mean swapping Maven or Gradle coordinates. Customers also get release history, compliance evidence, technical support and remediation commitments.
The catalog now reaches far beyond AngularJS. It spans JavaScript projects such as Vue 2, Node.js, jQuery, Next.js, Express, Bootstrap and React 16 and 17; Java projects including Spring, Struts, Tomcat and Hibernate; plus PostgreSQL, .NET, PHP, Rails, Django and NumPy. In July 2026, HeroDevs launched React support and estimated that moving one enterprise React codebase can cost $50,000 to $250,000, with one to three months of regression testing. That is HeroDevs’ estimate, not a universal price tag, but it explains the budget conversation.
HeroDevs does not publish NES list prices. Its subscriptions are custom-quoted, billed annually and available on multi-year terms. So the honest answer to “what did it cost?” is that customer contract values are private. The visible comparison is between a predictable support subscription and the labor, testing, downtime risk and opportunity cost of a forced migration.
Potentially months of engineering and regression testing, with roadmap work displaced.
A custom annual subscription, a compatible package and continuing security coverage.
The evidence is a clean scan, not a prettier dashboard
HeroDevs is aimed at organizations where an unsupported component is more than technical debt. Banks face fiduciary and regulatory scrutiny. Hospitals cannot casually disturb clinical workflows. Government suppliers have formal security controls. Enterprise software vendors must answer customer questionnaires before a deal can close. For these buyers, the product sits between software composition analysis tools that identify a problem and migration consultancies that replace the application.
The case studies make the job legible. Sanlam Private Wealth discovered an end-of-life AngularJS application during a routine assessment. A rewrite was expected to take 12 to 18 months. It moved from AngularJS 1.5 to 1.8 in testing, adopted NES without production downtime, and reported complete remediation of known framework vulnerabilities. ViTel Net evaluated migration, internal maintenance and subscription support for a virtual-care platform. It chose the subscription, deployed in under a week and reported a clean Burp Suite scan without interrupting clinical work.
Elsewhere, Objective Corp used NES while moving a codebase of millions of lines from AngularJS toward React. Alphatec paired ongoing support with a gradual migration of more than 500,000 lines. Sisense said offloading legacy AngularJS maintenance reduced front-end maintenance overhead by 10 percent. These are vendor-published examples, so they should be read as selected outcomes, but together they reveal the product’s real unit of value: engineering attention returned to the roadmap.
A security vendor that has to befriend the people it follows
Selling patches for abandoned versions could look extractive: take free code, close the maintenance layer, charge enterprises. HeroDevs has spent heavily to argue the opposite. It became a CVE Numbering Authority in 2024, which lets its researchers assign and publish vulnerability records. It joined OpenSSF, sponsored the .NET Foundation, and developed commercial-support relationships across open-source ecosystems.
The largest gesture came with the 2025 funding announcement. PSG led a $125 million strategic growth investment, with existing investor Album participating. HeroDevs earmarked $20 million for an Open Source Sustainability Fund, offering grants from $2,500 to $250,000. At the time, it said it had already directed $4 million to creators and projects, including $2 million in 2024. The loop is strategically neat: revenue from keeping old versions safe helps fund the communities building current versions.
Distribution is also moving closer to the tools developers already use. An IBM collaboration makes support for old Spring and Struts applications available to customers running IBM and Red Hat Java runtimes. A Sonatype integration surfaces matching secure alternatives during Maven Central discovery. In March 2026, HeroDevs began publishing OpenVEX data so scanners can understand when a vulnerability has been fixed in an NES package instead of continuing to raise a stale alert.
Evergreen pushes the idea one level higher. Rather than subscribe only after a team notices one expired framework, customers connect GitHub repositories. HeroDevs monitors the dependency tree and, when an unsupported package needs remediation, proposes a secured replacement as a pull request with a VEX statement and legal attestation. If NES sells time one framework at a time, Evergreen tries to make that protection continuous across an application.
The bridge is useful because it has an exit
There are limits. A maintained fork is still a fork. Procurement must accept a private vendor, engineers must test the replacement in their own environment, and HeroDevs must actually cover the package and version in question. If an upgrade is small, safe and already funded, moving to the supported upstream release is usually cleaner. Some policies may require that outcome regardless of commercial maintenance.
The model also depends on compatibility. A drop-in package can preserve an old API, but it cannot make every surrounding dependency immortal. Architecture continues to age. Browser behavior changes. Staff knowledge thins out. NES works best when the application is stable, the immediate problem is security or compliance, and the organization needs a defined runway for a real modernization. It works poorly as an excuse never to make a plan.
That distinction is what changed HeroDevs’ mind about its own business. Consulting taught the team how expensive migrations were. AngularJS end-of-life showed that the recurring problem was not writing new software; it was keeping useful old software defensible long enough to replace it well. The company now has about 90 remote employees across 12 countries, more than 800 reported customers, and a new CEO. Aaron Mitchell took over in January 2026 while Frost moved to the board and an advisory role.
Legacy software is easy to mock until it runs payroll, patient care or a public service. HeroDevs does not make that software young again. It makes the waiting period less reckless. In enterprise technology, where the correct migration date is rarely today and never conveniently tomorrow, that can be a product all by itself.