Keep jQuery UI 1.10.4 patched without rebuilding your widgets

In a limited way. The OpenJS Foundation lists jQuery UI among its archived projects, while the jQuery team still ships releases on the current line, most recently 1.14.2 on 28 January 2026. Those release notes describe a maintenance state covering jQuery compatibility, security fixes and important regressions from 1.12.1 or newer. 1.10.4 sits outside that window.

Swap the package, not the widgets. TuxCare ELS delivers maintained jQuery UI packages through its npm registry. You add the registry to .npmrc, point package.json at the ELS package manually or with the TuxCare Patcher, then run npm install. The package is designed to preserve your widget markup, themes and initialization code, with normal application testing still recommended.

TuxCare documentation lists jQuery UI 1.10.4 as the supported version. Coverage is version specific, so the package you install matches the build your pages already load. If your application ships a different release, contact TuxCare to discuss coverage options.

Five advisories can be reported against a 1.10.4 package on published version ranges. CVE-2016-7103 is XSS through the dialog closeText option, fixed upstream in 1.12.0. CVE-2021-41182, CVE-2021-41183 and CVE-2021-41184 cover the datepicker altField option, the datepicker text options and the position utility, all fixed in 1.13.0. CVE-2022-31160 covers checkboxradio and was fixed in 1.13.2.

The published version range says yes. The code says no. The checkboxradio widget was introduced in jQuery UI 1.12, so a genuine 1.10.4 build contains no checkboxradio code to reach. Scanners flag it because the advisory range extends below 1.12. TuxCare publishes a VEX feed for exactly this reason, so exploitability can be recorded rather than argued.

Yes. jQuery UI often arrives through an admin theme, a vendor template or a bundled plugin rather than a direct install. ELS packages resolve from the TuxCare npm registry, and overrides in package.json redirect covered instances to the maintained package. The TuxCare Patcher can write those entries for you.

Yes. TuxCare documents the jQuery UI packages as Docker compatible, and they resolve through npm from the TuxCare registry, so they fit CI/CD pipelines and deployment workflows that already install jQuery UI through npm. The registry token is read from your project's .npmrc.

ELS is designed to support vulnerability-remediation requirements under frameworks including SOC 2, PCI DSS, HIPAA, NIS2, DORA and the CRA. It does not make an application compliant on its own. What it provides is a named vendor, a contractual SLA and a documented remediation path that auditors can review.

It depends on how much of the widget set you actually use. A build that needs only a simple dialog or datepicker may be able to move to native HTML controls, though formatting and localization rarely map across cleanly. An interface wired through sortable, resizable and themed widgets is a longer project. ELS keeps 1.10.4 patched while that work happens.