Changelog

3.0.0 — October 2026

A complete rewrite. The add-on id stays the same, so existing users get it as an update.

The vulnerability database is always current. The Retire.js database is downloaded from GitHub every day, so a new add-on release is no longer needed for new vulnerabilities.
Optional OSV.dev lookups cover every npm package, not only the libraries in the Retire.js database. They are off until you agree, and only the library name and version are sent.
More ways to find libraries: CDN addresses (jsDelivr, unpkg, cdnjs, esm.sh, code.jquery.com…), license banners, inline scripts and global variables (jQuery, Vue, React, Angular, lodash, moment, DOMPurify, axios… 40+ probes).
New panel:

- severity summary, the version to upgrade to, CVE and GHSA links, and how each library was found;

- filter and sort (requested in a review);

- JSON and CSV export;

- dark theme;

- Firefox for Android layout.

The badge shows the number of vulnerable libraries in the colour of the worst severity.
A welcome page explains how the add-on works and asks about OSV.dev.
Manifest V3.

Global-variable detection never worked: the version was always "undefined". It is now done with fixed probes and no eval.
Results were lost because a variable was overwritten (vulnerable).
A console message was written for every script on every page.
The badge counter grew across page loads instead of being reset on navigation.
"Update" reloaded the same bundled file. It now downloads the current database.

The detection core is updated to Retire.js 6.1.0 and the database to v6, which adds 128 vulnerability entries compared with 2.3.2.
Permissions: the tabs permission is gone, alarms is added, and optional data collection is used only for OSV.dev.

See the add-on's version history on addons.mozilla.org.