jQuery End of Life & Support Options —
What's Actually EOL (and What Isn't)
Let's clear up the most-searched question first: jQuery is not end-of-life. jQuery core is still actively maintained — the 4.x line, released January 17, 2026, is the current version, and the 3.x line receives critical security patches and bug fixes. By the EOL Risk Score™, the current line sits at 30 (live value), because the project is alive and there is no scheduled end-of-life date.
But that headline hides the real problem. The parts of the jQuery ecosystem most sites actually depend on are end-of-life: jQuery 1.x and 2.x have received no releases since 2016, jQuery UI is in what its own team calls a maintenance state (its 1.13 line reached end of life on August 5, 2024, the day 1.14 shipped), and jQuery Mobile was archived years ago. And here is the catch that the Low EOL score doesn't capture — old jQuery versions carry known, patchable XSS vulnerabilities. This page untangles what's maintained, what's dead, and what to actually do about it.
Key Dates at a Glance
- jQuery 4.0.0: released 2026-01-17
- jQuery 3.x: currently maintained (latest 3.7.1)
- jQuery 2.x and 1.x: end of life
jQuery Core Versions — What's Maintained
Every jQuery core line scores Low on the EOL Risk Score™ — the project maintains backward compatibility and has no formal EOL schedule. But "no EOL date" is not the same as "still getting updates." Here is the maintenance reality behind the score:
| Version | Released | Maintenance reality | Status | EOL Risk Score™ |
|---|---|---|---|---|
| jQuery 1.x | Aug 31, 2006 | No releases since 1.12.4 (May 2016) | EOL | 65 |
| jQuery 2.x | Apr 18, 2013 | No releases since 2.2.4 (May 2016) | EOL | 65 |
| jQuery 3.x | Jun 9, 2016 | Critical security patches and bug fixes only (jquery.com support policy) | Supported | 45 |
| jQuery 4.x | Jan 17, 2026 | Current line · drops legacy IE support | Supported | 30 |
Every jQuery and jQuery UI version, one line each
The same picture as plain statements, one per release line, for anyone who needs a single date rather than a table. Every date is bound to the same data as the jQuery and jQuery UI product pages, checked against jquery.com/support and the jQuery UI 1.14.0 release post, and re-verified at each build.
- jQuery 4.x — released January 17, 2026; the current version branch.
- jQuery 3.x — released June 9, 2016; security-only: critical security patches and bug fixes, no end-of-life date announced.
- jQuery 2.x — released April 18, 2013; end of life, with no releases since May 2016 (the project lists the 1.x and 2.x branches as no longer supported).
- jQuery 1.x — released August 31, 2006; end of life, with no releases since May 2016 (the project lists the 1.x and 2.x branches as no longer supported).
- jQuery UI 1.14 — released August 5, 2024; the maintained release of a project in a maintenance state.
- jQuery UI 1.13 — released October 7, 2021; end of life August 5, 2024, when the next release shipped.
- jQuery UI 1.12 — released April 21, 2016; end of life October 7, 2021, when the next release shipped.
- jQuery UI 1.11 — released June 26, 2014; end of life April 21, 2016, when the next release shipped.
- jQuery UI 1.10 — released January 17, 2013; end of life June 26, 2014, when the next release shipped.
- jQuery UI 1.9 — released October 5, 2012; end of life January 17, 2013, when the next release shipped.
- jQuery UI 1.8 — released March 18, 2010; end of life October 8, 2012, when the next release shipped.
- jQuery UI 1.7 — released March 3, 2009; end of life March 23, 2010, when the next release shipped.
The Real Risk: Old Versions, Known CVEs
Here is the part that the Low EOL score does not — and is not designed to — capture. The EOL Risk Score™ measures lifecycle status. It does not track version-specific vulnerabilities. And jQuery has several well-known ones that were fixed in specific releases:
CVE-2020-11022 and CVE-2020-11023 — cross-site scripting (XSS) flaws in jQuery's HTML manipulation, fixed in jQuery 3.5.0 (April 2020). Any jQuery older than 3.5.0 — which includes all of 1.x and 2.x and the early 3.x releases — is vulnerable. CVE-2019-11358 — prototype pollution via jQuery.extend, fixed in jQuery 3.4.0.
This divergence — a maintained project with low EOL risk, but dangerous old versions in the wild — is the same blind spot we cover in the CVE blind spot: lifecycle status and CVE exposure are two different axes, and you have to check both.
jQuery UI & jQuery Mobile — Maintenance State and Archived
jQuery UI is not developed any further, but it is not abandoned either. Its team's own words with the 1.14.0 release (August 5, 2024): jQuery UI is in a maintenance state — kept compatible with new jQuery releases and patched for security issues, with no significant feature work planned. The 1.13 line reached end of life on August 5, 2024, the day 1.14 shipped; 1.14 is the release to be on, and it carries an EOL Risk Score™ of 10 (live value). If your app leans on jQuery UI widgets (datepickers, dialogs, autocomplete, sortable), plan the move off them: a maintenance-state dependency is the piece most likely to become a stranded one.
jQuery Mobile went further still: the project was archived and deprecated years ago and should not be used in anything new or maintained. There is no supported version.
Replacements: for jQuery UI widgets, modern component libraries (or native HTML elements like <dialog> and <input type="date">) cover most use cases. For jQuery Mobile, a current responsive framework is the path forward.
How to Fix It — jQuery Migrate & Upgrade
The good news: getting current with jQuery is one of the easier framework migrations, because backward compatibility is a core jQuery value and the team ships a dedicated tool to ease it.
-
01Find out which jQuery version you actually ship Check your bundle, not your intentions — old versions hide in vendored files, CMS themes, and third-party widgets. In the console,
jQuery.fn.jqueryprints the loaded version. Anything below 3.5.0 is a priority. -
02Add jQuery Migrate The official jQuery Migrate plugin restores removed/deprecated APIs and logs every deprecation your code hits — turning a scary upgrade into a checklist generated from your real usage. Use it as a temporary bridge, not a permanent dependency.
-
03Upgrade to current jQuery 3.x (3.7.1) For most sites, moving from 1.x/2.x to the latest 3.x is the right step — it closes the known XSS CVEs and is the most compatible target. Work through the Migrate warnings, replace deprecated calls, and test.
-
04Replace jQuery UI and jQuery Mobile These won't be fixed by a core upgrade — they're separately end-of-life. Swap jQuery UI widgets for maintained components or native HTML controls, and migrate off jQuery Mobile entirely. Tackle these as their own work items.
-
05Consider whether you still need jQuery at all Much of what jQuery was indispensable for — selectors, fetch, DOM manipulation — is now native (
querySelectorAll,fetch,classList). For new code, you may not need it; for existing code, staying on a current, patched jQuery is perfectly fine. The goal is "patched," not necessarily "removed."
Extended Support for Stranded Apps
Some legacy applications are pinned to jQuery 1.x or 2.x by old plugins, ancient browser requirements, or a sprawling codebase that makes even the gentle jQuery upgrade a real project. While that work is scheduled, those apps are serving known XSS to every visitor.
Extended support and security-patched builds exist for exactly this situation — keeping a stranded jQuery (or jQuery UI) deployment patched against newly disclosed issues while you plan the move to a current version. It's a bridge to buy safe time, not a substitute for getting to jQuery 3.7.1 or 4.x. Compare the options on our extended-support partners page.
Find out which jQuery version your site actually serves
jQuery is one dependency among many. Scan your whole front-end for EOL and vulnerable versions — free, no signup required.
Scan your stack Check a version The CVE blind spotFrequently Asked Questions
Is jQuery 3 end of life?
Not according to the project. jquery.com's support policy states that jQuery 3.x will only receive critical security patches and bug fixes, and encourages everyone to upgrade to 4.x; no end-of-life date has been announced for 3.x. Some third-party trackers record 3.x as ending on January 17, 2026, the day 4.0.0 shipped, because the project supports only its latest version in full — this page follows the project's own wording.
Is jQuery UI end of life?
The jQuery UI project describes itself as in a maintenance state: compatible with new jQuery releases and patched for security issues, with no new feature work. Its 1.13 line reached end of life on August 5, 2024 when 1.14.0 shipped; 1.14 is the maintained release. Treat it as a dependency to plan off rather than one that will disappear overnight.
Is jQuery end of life?
jQuery core is not — jQuery 4.0.0 shipped January 17, 2026 and is the current line, and 3.x still receives critical security patches and bug fixes. What is end of life is everything older: jQuery 1.x and 2.x receive no fixes, and they carry known cross-site scripting CVEs (in .html(), .load() and selector handling) that were fixed only in 3.5+.
Which jQuery versions have known vulnerabilities?
Versions before 3.5.0 are affected by the 2020 XSS advisories (CVE-2020-11022, CVE-2020-11023), and versions before 3.4.0 by prototype-pollution and earlier XSS issues. Anything 1.x or 2.x is both end of life and vulnerable; upgrade to 3.7.1 or 4.0 and use jQuery Migrate to surface removed APIs.
Should I move to jQuery 4?
For most sites, upgrading to jQuery 3.7.1 first is the low-risk step, then 4.0 when your plugins support it — 4.0 drops IE 10 and older and removes several deprecated APIs. jQuery Migrate 3.x reports what will break.
Is there extended support for old jQuery?
Yes — third-party vendors sell security patches for jQuery 1.x/2.x and for the Bootstrap 3/4 and AngularJS applications that pin them, for teams that cannot upgrade yet. See our extended support options page.