Flags software stack entries nobody has reviewed for months
Read the stack. An empty stack is a WARNING (300): nothing can be audited, and the other stack-based auditors cannot run either.
Read each entry's date. The date changes when an entry is added, when it is edited, and when an admin clicks Still accurate on the project page. If an entry arrives without a date, the result is ERROR (500) and the age rules do not run.
Measure the age. The age is the number of whole days between the entry's date and the moment the audit runs.
Apply the thresholds.
An entry failDays days old or older (default 180) is a FAIL (400).
An entry warningDays days old or older (default 90), but younger than failDays, is a WARNING (301).
Each entry gets its own check. The oldest entry is listed first.
Aggregate. ERROR wins, then FAIL, then WARNING. If every entry is younger than warningDays, the result is SUCCESS (200).
Both preferences are optional and set per URL. A value that is unset, unreadable or not positive uses the default. If warningDays is not smaller than failDays, there is no warning window, so only the FAIL rule applies.
| Key | Type | Default | Meaning |
|---|---|---|---|
warningDays | integer | 90 | WARNING (301) when an entry is this many days old or older |
failDays | integer | 180 | FAIL (400) when an entry is this many days old or older |
Every row maps to one checkRule* method and one CheckCode. The audited page is not fetched, so there is no 590 (site blocked) code.
| CheckCode | Status | When it fires | Recommendation | Why it matters |
|---|---|---|---|---|
37A-StackFreshnessAuditor-300 | WARNING | The project declares no software stack. | Add the platform, its version and the main components {url} runs on to the project's software stack, so that CVE, End of Life and Stack Freshness can audit them. | Without a declared stack, the audits that look for known vulnerabilities and end-of-life software cannot run, so those risks go unreported. |
37A-StackFreshnessAuditor-500 | ERROR | A stack entry arrived without its update date. | Run the audit again; if {software} still has no update date, contact 37 Audits support. | — |
37A-StackFreshnessAuditor-400 | FAIL | A stack entry was last reviewed at least failDays days ago. | Confirm the site still runs {software}: update the version in the project's software stack if it changed, or click Still accurate if it did not. | Stack information this old most likely describes software the site no longer runs, so vulnerability and end-of-life audits report on the wrong versions. |
37A-StackFreshnessAuditor-301 | WARNING | A stack entry was last reviewed at least warningDays days ago, but fewer than failDays days ago. | Confirm the site still runs {software}: update the version in the project's software stack if it changed, or click Still accurate if it did not. | Sites are upgraded and patched over time; stack information nobody has reviewed may no longer match the site, so vulnerability and end-of-life alerts can be wrong or missing. |
37A-StackFreshnessAuditor-200 | SUCCESS | All rules passed. The message is All {n} stack entries were reviewed within {warningDays} days (oldest: {software}, {days} days). | — | — |
Example messages, using the default thresholds:
400: Liferay DXP 7.4 U92 was last reviewed 731 days ago (2024-10-13); the limit is 180 days.
301: nginx 1.25 was last reviewed 120 days ago (2026-06-16); review it every 90 days.
200: All 3 stack entries were reviewed within 90 days (oldest: Liferay DXP 2026.Q1.13 LTS, 42 days).
Each finding carries the same values in data: vendor, product, version, updatedAt, ageDays, thresholdDays, entries, warningDays and failDays.
| Status | Description | Test logic |
|---|---|---|
| SUCCESS | Every stack entry was reviewed within warningDays days | No rule fired (200). |
| WARNING | The stack is empty, or an entry is due for review | No entries (300). An entry is at least warningDays days old and younger than failDays (301). |
| FAIL | An entry has not been reviewed for failDays days or more | An entry is at least failDays days old (400). Any 301 warnings are listed as well. |
| ERROR | The age of an entry could not be measured | An entry arrived without an update date (500). |
37 Audits trusts the stack the project declares. The CVE and End of Life auditors match vulnerabilities and support dates against those versions. If the stack is out of date, those audits can raise false alarms or miss real problems.
This auditor does not compare the declared version with what the site actually runs. It only says when someone last looked.
Adding an entry, editing it, and clicking Still accurate all reset its date. Nothing else does: running other audits, or changing a different entry, leaves the date as it is.
Pick thresholds that match how often the site is deployed. A site that ships every week may want a warningDays of 30.
This documentation is built and hosted on Mintlify, a developer documentation platform.
Add this auditor to your monitoring setup and start identifying issues on your websites today.