Home / The jQuery Immortality Report (2026)

Data

The jQuery Immortality Report (2026)

Data report by the SearchWebCode team · August 2026 index build · Updated September 4, 2026

jQuery was first released in 2006 and has been called obsolete almost every year since. This report measures how much of the web still ships it, broken down by how it is loaded and by how much of it is running code that will never get another security fix. It is a source-code census: each count is the number of indexed domains whose stored homepage source contains the listed substring, verified against the source itself, over roughly 129 million unique-domain homepages in the SearchWebCode August 2026 index. Every figure is a live query you can re-run.

27% of the web still loads jQuery

The canonical minified filename jquery.min.js appears in the homepage source of 35,172,641 domains — 27.20% of the index, more than one homepage in four. A library two decades old outranks every framework that was supposed to replace it. Read that number as a floor: it counts only the unversioned minified filename and misses versioned CDN filenames, unminified builds, and jQuery bundled under another name.

These filename patterns do not cleanly overlap — a page loading jquery-3.6.0.min.js from a CDN matches none of the rows above — so they are not additive, but together they show the headline understates the real footprint. Re-run the headline count →

Most of the version-identifiable jQuery web is end-of-life

When jQuery is loaded from a versioned filename, the major version is readable in the source. jQuery 1.x and 2.x are both end-of-life — no more releases, ever, including security releases. 3.x is the only maintained line. The split is lopsided toward the dead versions:

The money stat: of version-identifiable minified jQuery (24,332,038 domains), about 70% — 16,968,309 homepages — run an end-of-life 1.x or 2.x release. The single dead 1.x line alone (12.47M) outnumbers the entire maintained 3.x line (7.36M) by more than 1.6 to 1. The final 1.x release, 1.12.4, shipped in May 2016 and is still on 3,203,565 homepages today. Re-run the 1.x count →   See 1.12.4 →

What "end-of-life" means for security

End-of-life is not only an upgrade-hygiene concern. jQuery CVE-2020-11022 and CVE-2020-11023 — cross-site-scripting flaws in jQuery.htmlPrefilter — affect every release from 1.2 up to but not including 3.5.0, and were patched only in 3.5. The 1.x and 2.x lines never received that fix and never will. So the ~17M version-identifiable EOL homepages measured above (plus an unknown number of unversioned ones) are serving jQuery with a known, unpatched XSS class in their dependency chain. Whether any given site is exploitable depends on how it uses the library — this is an attack-surface floor, not a vulnerability count — but it is a large, measurable one.

jQuery Migrate: 19 million homepages carrying legacy debt

jQuery Migrate is a compatibility shim that restores APIs removed in jQuery 3, so its presence is a direct marker that a page still depends on deprecated jQuery behavior. It loads on 19,314,241 domains (14.94%) — more than run a clean current-line 3.x build. Nearly one homepage in seven is actively papering over jQuery code old enough to have been removed from the library years ago. Re-run the Migrate count →

Who still serves jQuery

Most jQuery is self-hosted, but the public CDNs still move an enormous amount of it. Google's Hosted Libraries alone serves jQuery to 4,747,445 homepages — a decade after Google stopped adding new library versions to the service.

The public-CDN references above total roughly 14.8 million; since the canonical filename count is 35.2M and most CDN loads use versioned filenames, the majority of jQuery on the web is self-hosted. Re-run a CDN count →

Methodology

SearchWebCode built this dataset in August 2026 from a trigram index over approximately 129,313,463 homepages, one homepage per unique domain. Literal-filename counts (for example jquery.min.js) are verified substring matches. Version-line counts use the regex jquery-N.[0-9.]+.min.js; each was spot-checked against its live sample and returned real, correctly-versioned results (1.x and 3.x at 30 of 30 sampled, 2.x at 21 of 30), so they are reported as reliable, while broad unconstrained patterns that return only a shared-trigram candidate bound are deliberately excluded. The index is refreshed monthly, so numbers drift slightly between builds.

Known limitations, stated plainly: this is a homepage census, not a whole-site crawl — jQuery used only on inner pages is not counted. Filename and path fingerprints miss jQuery that is bundled under a custom name, inlined, or injected at runtime, so every count here is a lower bound. Version detection needs a version string in the filename or CDN path; a self-hosted jquery.min.js with no version in its name is counted in the headline but not attributed to a version line. Presence in source does not prove the code executes.

How to cite and reuse this report

Every figure keeps its footprint attached so it stays reproducible. Cite it as: "The August 2026 SearchWebCode homepage index found 35,172,641 domains (27.2% of ~129 million) loading jquery.min.js, and about 70% of version-identifiable installs on an end-of-life 1.x or 2.x release." The full dataset is available as a dated CSV, jquery-immortality-2026-08.csv. Reuse is welcome with attribution — cite "SearchWebCode, August 2026 index" and link this page so readers can verify any number against the live search.

The always-current version of the headline number lives on the auto-updating jQuery technology page; this report is the dated, citable snapshot. See the live jQuery footprint →

Data quality & editorial policy

Every count we publish is a verified substring match against stored page source, never an extrapolated estimate, and the exact footprint appears next to each number so any claim can be re-run as a search and checked result by result. Reports are tied to a dated index build; when a new build changes the numbers, we update the page and move the modified date above. Corrections are made in place.

Frequently asked questions