jQuery End of Life: What's Actually EOL (and What Isn't)

#javascript #webdev #jquery #security

Originally published on endoflife.ai.

Let's clear up the most-searched question first: jQuery is not end-of-life. jQuery core is still actively maintained — the 3.x line gets security releases and 4.x is the modern successor. On the EOL Risk Score, jQuery sits at just 20 (Low).

But that headline hides the real problem. The parts of the jQuery ecosystem most sites depend on are end-of-life: jQuery 1.x and 2.x got no releases since 2016, jQuery UI reached EOL on August 5, 2024, and jQuery Mobile was archived years ago. And the catch the Low score doesn't capture — old jQuery versions carry known, patchable XSS vulnerabilities.

jQuery core versions — what's maintained

Version	Maintenance reality	Status	Risk Score
jQuery 1.x	No releases since 1.12.4 (May 2016)	Unmaintained	20
jQuery 2.x	No releases since 2.2.4 (May 2016)	Unmaintained	20
jQuery 3.x	Maintained · latest 3.7.1	Maintained	20
jQuery 4.x	Newest line · drops legacy IE	Current	20

"No EOL date" ≠ "no updates." jQuery 1.x/2.x have a Low score because jQuery never formally declared them EOL — but the project stopped shipping releases for both in May 2016. In practice they're unmaintained; the only supported path is 3.x or 4.x.

The real risk: old versions, known CVEs

The EOL Risk Score measures lifecycle status. It doesn't track version-specific vulnerabilities — and jQuery has well-known ones fixed in specific releases:

CVE-2020-11022 and CVE-2020-11023 — XSS flaws fixed in jQuery 3.5.0 (April 2020). Any jQuery older than 3.5.0 — all of 1.x/2.x and early 3.x — is vulnerable.
CVE-2019-11358 — prototype pollution via jQuery.extend, fixed in jQuery 3.4.0.

If you're running jQuery below 3.5.0, you're shipping known XSS to your users. The fix is free: upgrade to current 3.x (3.7.1) or 4.x.

This is the same blind spot covered in the CVE blind spot — lifecycle status and CVE exposure are two different axes, and you have to check both.

jQuery UI & jQuery Mobile — the EOL pieces

Unlike jQuery core, jQuery UI is genuinely end-of-life — dated to August 5, 2024, with a Risk Score of 55 (Elevated). The widget library (datepickers, dialogs, autocomplete) is no longer developed. jQuery Mobile went further — archived and deprecated years ago.

Replacements: modern component libraries or native HTML (<dialog>, <input type="date">) cover most jQuery UI use cases.

How to fix it

Find which jQuery version you actually ship. jQuery.fn.jquery prints the loaded version in the console. Anything below 3.5.0 is a priority.
Add jQuery Migrate. It restores deprecated APIs and logs every deprecation your code hits — a checklist from your real usage. Use it as a temporary bridge.
Upgrade to current jQuery 3.x (3.7.1). Closes the known XSS CVEs; most compatible target.
Replace jQuery UI and jQuery Mobile. Separately EOL — swap for maintained components or native controls.
Consider whether you still need jQuery. Much of what it was indispensable for is now native (querySelectorAll, fetch, classList). The goal is "patched," not necessarily "removed."