Bootstrap End of Life & Support Options —
What To Do When Bootstrap Patches Stop, and the jQuery Problem
Bootstrap is one of the most widely deployed front-end frameworks on the web — and most of that deployment is on versions that are end of life. Bootstrap 5 is the only maintained line (EOL Risk Score™ 10, live value). Bootstrap 4 reached end of life on January 1, 2023, Bootstrap 3 on July 24, 2019, and Bootstrap 2 on August 19, 2013. None of them receives fixes of any kind.
And Bootstrap carries a risk most CSS frameworks don't: Bootstrap 3 and 4 depend on jQuery, so running them also means running a second end-of-life dependency. This page lays out every Bootstrap version's EOL date and EOL Risk Score™, the real (and sometimes overstated) security exposure, and the path to Bootstrap 5.
Key Dates at a Glance
- Bootstrap 3: end of life 2019-07-24
- Bootstrap 4: end of life 2023-01-01
- Bootstrap 5: released 2021-05-05; currently maintained
Bootstrap Version EOL Schedule
Only Bootstrap 5 is actively maintained. Every earlier major is end of life and receives no fixes — including security fixes. Scores below are live EOL Risk Scores™ — click any for the full breakdown.
| Version | Released | Active support ends | End of Life | Status | EOL Risk Score™ |
|---|---|---|---|---|---|
| Bootstrap 2 | Jan 31, 2012 | Aug 19, 2013 | Aug 19, 2013 | EOL | 50 |
| Bootstrap 3 | Aug 19, 2013 | Sep 5, 2016 | Jul 24, 2019 | EOL | 50 |
| Bootstrap 4 | Jan 18, 2018 | Nov 1, 2021 | Jan 1, 2023 | EOL | 50 |
| Bootstrap 5 (current) | May 5, 2021 | Ongoing | Maintained | Supported | 10 |
Every Bootstrap version, one line each
The same schedule as plain statements, one per major version, for anyone who needs a single date rather than a table. Every date is bound to the same data as the Bootstrap product page, checked against the Bootstrap team's own announcements (the 4.6.2 post set Bootstrap 4's end of life), and re-verified at each build.
- Bootstrap 5 — released May 5, 2021; the maintained line, with no end-of-life date announced.
- Bootstrap 4 — released January 18, 2018; active development ended November 1, 2021; end of life January 1, 2023.
- Bootstrap 3 — released August 19, 2013; active development ended September 5, 2016; end of life July 24, 2019.
- Bootstrap 2 — released January 31, 2012; active development ended August 19, 2013; end of life August 19, 2013.
The Real Risk of EOL Bootstrap
Bootstrap is mostly CSS, so it's fair to ask how dangerous an EOL version really is. The honest answer: less acutely dangerous than an EOL database or runtime, but not zero — and the risk is concentrated in three specific places.
The JavaScript components. Bootstrap's interactive pieces — tooltips, popovers, modals, the data-attribute API — process input and write to the DOM. Older Bootstrap had real XSS vulnerabilities in exactly these components (the data-* sanitizer in particular), patched in later 3.x and 4.x point releases. If you're pinned to an old minor, you may be missing those fixes, and no further ones are coming.
The frozen ecosystem. An EOL Bootstrap locks you to a generation of themes, plugins, and build tooling that are themselves no longer maintained — and, for 3 and 4, to a specific old jQuery (see below). The dependency rot compounds.
Browser drift. Bootstrap 3/4 target browser behaviours and prefixes from their era. As browsers evolve, layout and behaviour bugs accumulate that will never be fixed upstream.
The jQuery Problem in Bootstrap 3 & 4
This is the hidden cost of staying on Bootstrap 4. Upgrading to Bootstrap 5 isn't only a CSS modernisation — it removes the jQuery dependency altogether (Bootstrap 5's JavaScript is vanilla), eliminating an entire class of EOL exposure in one move. See our jQuery EOL guide for exactly which jQuery versions are dangerous and why.
Bootstrap 5 — The Maintained Line
Bootstrap 5 is the only line still receiving updates, and its Low Risk Score of 10 reflects that. Beyond being maintained, it's a genuinely better foundation: it dropped the jQuery dependency in favour of vanilla JavaScript, added a proper CSS custom-properties layer, expanded the utility API, and added built-in RTL support. Moving to it removes EOL risk and modernises the codebase at the same time.
The takeaway: unlike a database where "latest" simply means "supported," moving Bootstrap 4 → 5 also sheds the jQuery liability. It's the rare upgrade that reduces your dependency count rather than growing it.
Migrating to Bootstrap 5
A Bootstrap 4 → 5 migration is mostly mechanical class renames plus removing jQuery-dependent code. It's very doable incrementally.
-
01Confirm which Bootstrap (and jQuery) you ship Check your bundle, not your
package.jsonintentions — old Bootstrap hides in vendored CSS and CMS themes. Note whether jQuery is present; if you're on 3 or 4, it almost certainly is, and that's part of what you're removing. -
02Update the markup class names Bootstrap 5 renamed many utilities: directional spacing (
ml-*/mr-*→ms-*/me-*),.no-gutters→.g-0,.form-rowchanges,.custom-*form classes folded into.form-*, and thedata-*attributes gained abs-prefix (data-bs-toggle). Work through these systematically — most are find-and-replace. -
03Remove jQuery-dependent JavaScript Bootstrap 5's components are initialised with vanilla JS, not jQuery plugins. Replace
$('...').modal()-style calls with the Bootstrap 5 JavaScript API, and audit your own code for other jQuery usage so you can drop the dependency entirely. -
04Re-test interactive components and responsive layouts Modals, dropdowns, tooltips, the grid, and any custom theme are where breakage shows up. Test across your supported browsers — Bootstrap 5 dropped Internet Explorer support, which is usually a benefit but matters if you still have IE requirements.
-
05Adopt the new layers as you go Once on 5, lean on CSS custom properties and the expanded utility API to retire bespoke overrides. This isn't required for the upgrade, but it's where Bootstrap 5 pays you back in maintainability.
Check your whole front-end stack for EOL exposure
Bootstrap rarely travels alone — jQuery, your runtime, and build tooling all age with it. Scan the whole stack, free, no signup.
Scan your stack The jQuery EOL guide Risk Score methodologyFrequently Asked Questions
When did Bootstrap 4 reach end of life?
On January 1, 2023, the date the Bootstrap team set when it shipped 4.6.2 as the final release. Active development of the 4.x line had already stopped on November 1, 2021; after the end-of-life date there are no fixes of any kind, including security fixes.
Is Bootstrap 5 end of life?
No. Bootstrap 5, released May 5, 2021, is the maintained line and the Bootstrap team has announced no end-of-life date for it. Stay on the current 5.x minor; the older minors within 5.x receive no separate fixes.
Is Bootstrap 4 still supported?
No. Bootstrap 4 reached end of life on January 1, 2023 (final release 4.6.2); Bootstrap 3 ended July 24, 2019 (final release 3.4.1). Neither receives security fixes from the Bootstrap team. Bootstrap 5.x is the only maintained line.
Why is end-of-life Bootstrap a security problem?
Bootstrap 3 and 4 depend on jQuery, and their own components have had cross-site scripting advisories (data-attribute and tooltip/popover injection) that were fixed only in later 4.x or 5.x releases. An unmaintained Bootstrap plus an old jQuery is a client-side attack surface that scanners flag and that no upstream release will fix.
Which Bootstrap version should I be on?
Bootstrap 5 (5.3.x), which dropped the jQuery dependency and is the maintained line. Migration from 4 is mostly class renames, the utility API and the removal of jQuery plugin calls; from 3 it is a rewrite of the grid and components.
Is there extended support for Bootstrap 3 or 4?
Yes — third-party vendors sell security patches for Bootstrap 3 and 4 (and the jQuery versions they depend on) for applications that cannot move to 5 yet. It is a bridge, not a destination; see our extended support options page.