This check detects recognizable JavaScript library versions associated with known security issues. Bundling, patch backports, or incomplete version detection can affect the result, so confirm the actual installed package and advisory.
Why this matters
A vulnerable library can expose users to cross-site scripting, prototype pollution, or other attacks even when only one feature uses it. Unsupported packages also stop receiving fixes.
How to fix it
- Confirm the package name and resolved version in the lockfile and production bundle.
- Read the applicable advisory and determine whether the vulnerable code path is reachable.
- Upgrade to a maintained patched release, replace the package, or remove it if unused.
- Use dependency scanning in continuous integration and review transitive dependencies as well as direct ones.
When the finding appears across many URLs, fix the shared component or layout that produces it instead of patching generated HTML page by page. Recheck representative templates and responsive states after deployment so the correction does not create a regression elsewhere.
How to verify the fix
Rebuild from a clean lockfile state, rerun the dependency audit, and exercise the affected workflow. Do not treat hiding the version string or suppressing the finding as remediation.
Keep before-and-after evidence for the affected URL, original output, correction, and verification method. If markup changes after load, test consent states, localization, responsive variants, and client-side navigation because the initial HTML and rendered DOM can differ.