This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung →
Software currency
Why is a library with no maker maintenance a risk for your website?
A library with no maker maintenance no longer receives security fixes — if a hole becomes known later, it stays open permanently. Libraries like this are ready-made code building blocks that many websites embed for menus, image galleries, or input forms. The Software Currency audit area recognises them in your page's source code, and matches the version found against the end-of-maintenance dates the makers have published themselves.
Ready-made building blocks carry your website
Hardly any website gets written completely from scratch. Agencies reach for proven building blocks: jQuery helps with controls, Bootstrap supplies the page grid, AngularJS and Vue drive entire input forms. These building blocks are called libraries. They sit as script files on your page and run in every visitor's browser. A library's maker maintains it for years: fixing bugs and closing security holes. At some point, they end maintenance of a version series and point to its successor. From this end-of-maintenance date, no more fixes appear for the old series — regardless of what still gets found. The library keeps running, but nobody repairs it any more.
Published end-of-maintenance dates are verifiable facts
This audit area relies exclusively on dates the makers themselves have announced. Examples from the check catalogue: jQuery series 1 and 2 have received no maintenance since 2016. AngularJS has officially been unmaintained since early 2022. Bootstrap 3 has been unmaintained since mid-2019, Bootstrap 4 was deprecated in early 2023. Vue 2 reached its end of maintenance in late 2023. If the check finds one of these series on your page, that's the most severe finding in this audit area: it costs 40 of 100 points, putting the partial seal out of reach. This weighting follows the risk — missing maker maintenance weighs heavier than any merely visible version number.
The check assesses maker maintenance, not vulnerability
The distinction is deliberate: the finding states that the maker has abandoned the library — a verifiable fact. It never claims, on the other hand, that your website is vulnerable; that couldn't be responsibly determined from outside anyway. The check also only reads what your page itself delivers: script links with a visible version number. Libraries bundled into a package when the page was built stay invisible from outside. So this applies: an empty finding means "nothing detected", never "everything current". This caution is part of the audit rules — the audit area only claims what it can show with a piece of evidence in the source code.
- Ask your agency what frontend libraries are in use on your website — the list should be short and complete.
- Have them tell you, for every library, whether the maker still maintains it.
- At a library's end of maintenance, plan the switch to the maintained successor series — usually a small rebuild, not a push of a button.
- Agree on a fixed date each year when your agency reviews the website's software currency and records it in writing.
- Keep the audit reports — that way you see, over the years, whether the maintenance state gets better or worse.
FAQ
What does end of maintenance mean for software?
The maker publicly declares that they'll no longer maintain a version series of their software. From that date, no more bug fixes or security fixes appear. The software keeps running, but every hole that becomes known after that stays open. The usual way out is switching to the maintained successor series the maker names at end of maintenance.
Is my website insecure if a library has reached its end of maintenance?
The finding explicitly doesn't say that. It states a fact: the maker no longer maintains the library, so holes that become known in future stay open. Whether your specific website is vulnerable depends on many circumstances and can't be determined from outside. The finding is a task with a clear direction, not a break-in diagnosis.
Can I just keep using a library with no maker maintenance?
Technically, it keeps running, and often nobody notices anything for years. The risk still grows, though: no security fixes appear for unmaintained software, and holes that become known stay open. Switching to a maintained series is the only permanent solution. The longer it's put off, the bigger the rebuild usually gets.
Does the check detect every library on my website?
No, and it doesn't claim to. Only what the page embeds with a visible version number is detectable. Libraries bundled into a shared package when the website was built are invisible from outside. An empty finding therefore means "nothing detected" — it's no proof that every building block is current.