How it works
Once a day, we look at the scripts on your homepage (up to 20) and detect the JavaScript libraries they contain and their versions, such as jQuery, Bootstrap, Angular or Lodash. We match them by URL, file name and content against the retire.js vulnerability database, and report every version with known vulnerabilities, with their severity and advisories.
Statuses
| Status | Meaning |
|---|---|
| OK | No libraries with known vulnerabilities were found. |
| Warning | A library has low or medium severity vulnerabilities, or we could not connect. |
| Failed | A library has high or critical severity vulnerabilities. |
By default you are notified of warnings and failures.
Fixing common problems
- Update the library to the version named in the advisory, or a later one. If your package manager bundles it, run
npm update <library>and rebuild. - Libraries from a CDN: change the version in the URL.
- Libraries bundled with a theme or plugin: update the theme or plugin. If it is abandoned, replace it.