Auditing and replacing third-party jQuery plugins

site-plugins.json

{
  "about": "The jQuery plugins of this lesson's fixture shop: the release its pages load, how many of its page templates use each one, and its repository. snapshot.mjs adds what npm, OSV and GitHub say about each.",
  "plugins": [
    {
      "name": "bootstrap",
      "installed": "4.6.2",
      "pages": 12,
      "repo": "twbs/bootstrap"
    },
    {
      "name": "bootstrap-datepicker",
      "installed": "1.10.1",
      "pages": 3,
      "repo": "uxsolutions/bootstrap-datepicker"
    },
    {
      "name": "@fancyapps/fancybox",
      "installed": "3.5.7",
      "pages": 3,
      "repo": "fancyapps/fancybox"
    },
    {
      "name": "jquery.cookie",
      "installed": "1.4.1",
      "pages": 20,
      "repo": "carhartl/jquery-cookie"
    },
    {
      "name": "jquery-mask-plugin",
      "installed": "1.14.16",
      "pages": 0,
      "repo": "igorescobar/jQuery-Mask-Plugin"
    },
    {
      "name": "jquery-validation",
      "installed": "1.19.5",
      "pages": 6,
      "repo": "jquery-validation/jquery-validation"
    },
    {
      "name": "lightbox2",
      "installed": "2.12.0",
      "pages": 4,
      "repo": "lokesh/lightbox2"
    },
    {
      "name": "magnific-popup",
      "installed": "1.2.0",
      "pages": 5,
      "repo": "dimsemenov/Magnific-Popup"
    },
    {
      "name": "owl.carousel",
      "installed": "2.3.4",
      "pages": 2,
      "repo": "OwlCarousel2/OwlCarousel2"
    },
    {
      "name": "select2",
      "installed": "4.0.13",
      "pages": 7,
      "repo": "select2/select2"
    },
    {
      "name": "slick-carousel",
      "installed": "1.8.1",
      "pages": 1,
      "repo": "kenwheeler/slick"
    },
    {
      "name": "toastr",
      "installed": "2.1.4",
      "pages": 9,
      "repo": "CodeSeven/toastr"
    }
  ]
}

plugins-snapshot.json

{
  "about": "What npm, OSV and GitHub published about each plugin of site-plugins.json, as snapshot.mjs read it.",
  "plugins": [
    {
      "name": "bootstrap",
      "installed": {
        "version": "4.6.2",
        "published": "2022-07-19",
        "jquery": {
          "field": "peerDependencies",
          "range": "1.9.1 - 3"
        },
        "deprecated": "This version of Bootstrap is no longer supported. Please upgrade to the latest version.",
        "licence": "MIT"
      },
      "latest": {
        "version": "5.3.8",
        "published": "2025-08-26",
        "jquery": null,
        "deprecated": null
      },
      "advisories": [],
      "repository": {
        "name": "twbs/bootstrap",
        "archived": false,
        "description": "The most popular HTML, CSS, and JavaScript framework for developing responsive, mobile first projects on the web."
      }
    },
    {
      "name": "bootstrap-datepicker",
      "installed": {
        "version": "1.10.1",
        "published": "2025-09-16",
        "jquery": {
          "field": "dependencies",
          "range": ">=3.4.0 <4.0.0"
        },
        "deprecated": null,
        "licence": "Apache-2.0"
      },
      "latest": {
        "version": "1.10.1",
        "published": "2025-09-16",
        "jquery": {
          "field": "dependencies",
          "range": ">=3.4.0 <4.0.0"
        },
        "deprecated": null
      },
      "advisories": [],
      "repository": {
        "name": "uxsolutions/bootstrap-datepicker",
        "archived": false,
        "description": "A datepicker for twitter bootstrap (@twbs)"
      }
    },
    {
      "name": "@fancyapps/fancybox",
      "installed": {
        "version": "3.5.7",
        "published": "2019-03-11",
        "jquery": {
          "field": "peerDependencies",
          "range": ">=1.9.0"
        },
        "deprecated": null,
        "licence": "GPL-3.0"
      },
      "latest": {
        "version": "3.5.7",
        "published": "2019-03-11",
        "jquery": {
          "field": "peerDependencies",
          "range": ">=1.9.0"
        },
        "deprecated": null
      },
      "advisories": [],
      "repository": {
        "name": "fancyapps/fancybox",
        "archived": true,
        "description": "jQuery lightbox script for displaying images, videos and more. Touch enabled, responsive and fully customizable. "
      }
    },
    {
      "name": "jquery.cookie",
      "installed": {
        "version": "1.4.1",
        "published": "2014-04-27",
        "jquery": null,
        "deprecated": null,
        "licence": "MIT"
      },
      "latest": {
        "version": "1.4.1",
        "published": "2014-04-27",
        "jquery": null,
        "deprecated": null
      },
      "advisories": [],
      "repository": {
        "name": "carhartl/jquery-cookie",
        "archived": true,
        "description": "No longer maintained, superseded by JS Cookie:"
      }
    },
    {
      "name": "jquery-mask-plugin",
      "installed": {
        "version": "1.14.16",
        "published": "2019-07-31",
        "jquery": null,
        "deprecated": null,
        "licence": "MIT"
      },
      "latest": {
        "version": "1.14.16",
        "published": "2019-07-31",
        "jquery": null,
        "deprecated": null
      },
      "advisories": [],
      "repository": {
        "name": "igorescobar/jQuery-Mask-Plugin",
        "archived": false,
        "description": "A jQuery Plugin to make masks on form fields and HTML elements."
      }
    },
    {
      "name": "jquery-validation",
      "installed": {
        "version": "1.19.5",
        "published": "2022-07-01",
        "jquery": {
          "field": "peerDependencies",
          "range": "^1.7 || ^2.0 || ^3.1"
        },
        "deprecated": null,
        "licence": "MIT"
      },
      "latest": {
        "version": "1.22.1",
        "published": "2026-02-18",
        "jquery": {
          "field": "peerDependencies",
          "range": "^1.7 || ^2.0 || ^3.1 || ^4.0"
        },
        "deprecated": null
      },
      "advisories": [
        {
          "id": "CVE-2025-3573",
          "fixed": "1.20.0"
        }
      ],
      "repository": {
        "name": "jquery-validation/jquery-validation",
        "archived": false,
        "description": "jQuery Validation Plugin library sources"
      }
    },
    {
      "name": "lightbox2",
      "installed": {
        "version": "2.12.0",
        "published": "2026-02-28",
        "jquery": {
          "field": "dependencies",
          "range": "^3.7.1"
        },
        "deprecated": "Lightbox2 is in maintenance mode. Lightbox3 is available: https://lokeshdhakar.com/projects/lightbox3/",
        "licence": null
      },
      "latest": {
        "version": "2.12.0",
        "published": "2026-02-28",
        "jquery": {
          "field": "dependencies",
          "range": "^3.7.1"
        },
        "deprecated": "Lightbox2 is in maintenance mode. Lightbox3 is available: https://lokeshdhakar.com/projects/lightbox3/"
      },
      "advisories": [],
      "repository": {
        "name": "lokesh/lightbox2",
        "archived": false,
        "description": "THE original Lightbox script (v2)."
      }
    },
    {
      "name": "magnific-popup",
      "installed": {
        "version": "1.2.0",
        "published": "2024-06-08",
        "jquery": null,
        "deprecated": null,
        "licence": "MIT"
      },
      "latest": {
        "version": "1.2.0",
        "published": "2024-06-08",
        "jquery": null,
        "deprecated": null
      },
      "advisories": [],
      "repository": {
        "name": "dimsemenov/Magnific-Popup",
        "archived": false,
        "description": "Light and responsive lightbox script with focus on performance."
      }
    },
    {
      "name": "owl.carousel",
      "installed": {
        "version": "2.3.4",
        "published": "2018-04-20",
        "jquery": {
          "field": "dependencies",
          "range": ">=1.8.3"
        },
        "deprecated": null,
        "licence": "SEE LICENSE IN https://github.com/OwlCarousel2/OwlCarousel2/blob/HEAD/LICENSE"
      },
      "latest": {
        "version": "2.3.4",
        "published": "2018-04-20",
        "jquery": {
          "field": "dependencies",
          "range": ">=1.8.3"
        },
        "deprecated": null
      },
      "advisories": [],
      "repository": {
        "name": "OwlCarousel2/OwlCarousel2",
        "archived": false,
        "description": "DEPRECATED jQuery Responsive Carousel."
      }
    },
    {
      "name": "select2",
      "installed": {
        "version": "4.0.13",
        "published": "2020-01-28",
        "jquery": null,
        "deprecated": null,
        "licence": "MIT"
      },
      "latest": {
        "version": "4.1.0",
        "published": "2026-05-26",
        "jquery": null,
        "deprecated": null
      },
      "advisories": [],
      "repository": {
        "name": "select2/select2",
        "archived": false,
        "description": "Select2 is a jQuery based replacement for select boxes. It supports searching, remote data sets, and infinite scrolling of results."
      }
    },
    {
      "name": "slick-carousel",
      "installed": {
        "version": "1.8.1",
        "published": "2017-10-03",
        "jquery": {
          "field": "peerDependencies",
          "range": ">=1.8.0"
        },
        "deprecated": null,
        "licence": "MIT"
      },
      "latest": {
        "version": "2.0.0",
        "published": "2026-09-13",
        "jquery": {
          "field": "peerDependencies",
          "range": ">=1.8.0"
        },
        "deprecated": null
      },
      "advisories": [],
      "repository": {
        "name": "kenwheeler/slick",
        "archived": false,
        "description": "the last carousel you'll ever need"
      }
    },
    {
      "name": "toastr",
      "installed": {
        "version": "2.1.4",
        "published": "2017-12-08",
        "jquery": {
          "field": "dependencies",
          "range": ">=1.12.0"
        },
        "deprecated": null,
        "licence": null
      },
      "latest": {
        "version": "2.1.4",
        "published": "2017-12-08",
        "jquery": {
          "field": "dependencies",
          "range": ">=1.12.0"
        },
        "deprecated": null
      },
      "advisories": [],
      "repository": {
        "name": "CodeSeven/toastr",
        "archived": false,
        "description": "Simple javascript toast notifications"
      }
    }
  ]
}

rules.mjs

// The scorecard's rules, used by facts.mjs, ranges.mjs and decide.mjs. Each takes the facts of one plugin: its entry in
// plugins-snapshot.json (npm, OSV, GitHub) and its runs in recorded.mjs.

// jQuery 4.0.0 came out on 17 January 2026 (the jQuery blog's release post); a plugin whose newest release is older
// was published before it, so its authors cannot have tested that release against it.
export const JQUERY_4 = '2026-01-17';

// Does an npm range accept 4.0.0? Enough of npm's range syntax for the ranges plugins declare: alternatives with ||,
// hyphen ranges (1.9.1 - 3), comparators (>=3.4.0 <4.0.0) and carets (^3.7.1, ^4.0).
const parse = (v) => v.replace(/^[v=]/, '').split('.').map(Number);
function cmp(a, b) {
  for (let i = 0; i < 3; i++) if ((a[i] ?? 0) !== (b[i] ?? 0)) return (a[i] ?? 0) - (b[i] ?? 0);
  return 0;
}
function accepts(part, v) {
  const hyphen = /^(\S+)\s+-\s+(\S+)$/.exec(part);
  if (hyphen) {
    const top = parse(hyphen[2]);
    const below = top.length === 3 ? null : top.length === 2 ? [top[0], top[1] + 1, 0] : [top[0] + 1, 0, 0];
    return cmp(v, parse(hyphen[1])) >= 0 && (below ? cmp(v, below) < 0 : cmp(v, top) <= 0);
  }
  return part.split(/\s+/).every((c) => {
    const caret = /^\^(.+)$/.exec(c);
    if (caret) {
      const low = parse(caret[1]);
      return cmp(v, low) >= 0 && cmp(v, [low[0] + 1, 0, 0]) < 0;
    }
    const [, op, ver] = /^(>=|<=|>|<|=)?(.+)$/.exec(c);
    const d = cmp(v, parse(ver));
    return { '>=': d >= 0, '<=': d <= 0, '>': d > 0, '<': d < 0 }[op] ?? d === 0;
  });
}
export const acceptsFour = (range) => range.split('||').some((part) => accepts(part.trim(), [4, 0, 0]));

// How a release ran, set up as the shop does: clean on jQuery 4.0.0 alone, only with Migrate 4.0.2, or not even then.
function outcome(run) {
  return !run.lines.some(([kind, text]) => kind === 'error' || /^setup threw /.test(text));
}
export function onFour(runs) {
  if (!runs) return null;
  if (outcome(runs.four)) return 'clean';
  return outcome(runs['four-migrate']) ? 'needs Migrate' : 'breaks';
}

const PERMISSIVE = /^(MIT|ISC|Apache-2\.0|BSD-2-Clause|BSD-3-Clause)$/;
const COPYLEFT = /^(A?GPL|LGPL)-/;
export function licenceClass(licence) {
  if (!licence) return 'not declared';
  if (/^SEE LICENSE IN/.test(licence)) return 'in a file of its own';
  return PERMISSIVE.test(licence) ? 'permissive' : COPYLEFT.test(licence) ? 'copyleft' : 'other';
}

// Has the project said it has ended, or named what comes next? npm's deprecation message, an archived repository, or a
// repository description that says it is deprecated.
const said = (text) => `"${text.trim().replace(/[:.]$/, '')}"`;
export function endSignal(facts) {
  const npm = facts.installed.deprecated || facts.latest.deprecated;
  if (npm) return `npm: ${said(npm.split(/(?<=\.) /)[0])}`;
  if (facts.repository.archived) return `repository archived (${said(facts.repository.description.split('. ')[0])})`;
  if (/^deprecated\b/i.test(facts.repository.description ?? '')) return `repository: ${said(facts.repository.description)}`;
  return null;
}

// The decision, rule by rule, with the rule that decided it.
export function decide({ pages, facts, installedRun, latestRun }) {
  const newer = facts.latest.version !== facts.installed.version;
  const fixable = facts.advisories.filter((a) => a.fixed);
  if (pages === 0) return ['remove', 'no page template uses it'];
  if (fixable.length && newer) return ['upgrade', `${fixable.map((a) => a.id).join(', ')} is fixed in ${fixable.map((a) => a.fixed).join(', ')}`];
  if (newer && latestRun === 'clean') return ['upgrade', `${facts.latest.version} runs on 4.0.0 alone`];
  const signal = endSignal(facts);
  if (installedRun === 'clean' && !facts.advisories.length) return ['keep', signal ? `it runs on 4.0.0 alone; plan the move (${signal})` : 'it runs on 4.0.0 alone'];
  if (signal) return ['replace', signal];
  if (installedRun === 'breaks') return ['replace', 'it breaks on 4.0.0 even with Migrate'];
  if (licenceClass(facts.installed.licence) !== 'permissive') return ['replace', `its licence (${facts.installed.licence ?? 'none stated'}) needs reading before any patch`];
  return ['patch', 'it runs with Migrate, and its licence allows a recorded patch'];
}

site/plugins.html

<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>Shop: every plugin on one page</title>
</head>
<body>
  <!-- One page that holds what each of the shop's plugins works on, so record.mjs can set each up as the shop does. -->
  <button id="cart" data-toggle="dropdown" class="dropdown-toggle">Cart</button>
  <div class="dropdown-menu"><a class="dropdown-item" href="/cart">View cart</a></div>
  <input id="dob" value="">
  <input id="phone" value="9876543210">
  <form id="signup"><input id="email" name="email" class="required email" value=""></form>
  <a href="/img/kettle.jpg" data-lightbox="kettle">Kettle</a>
  <a href="/img/teapot.jpg" id="zoom">Teapot</a>
  <div id="slides" class="owl-carousel"><div>Diwali offers</div><div>New arrivals</div><div>Free delivery over 499</div></div>
  <select id="city"><option>Pune</option><option>Patna</option></select>
  <div id="offers"><div>1</div><div>2</div><div>3</div></div>
</body>
</html>

pages.mjs

// What record.mjs runs. PROBES: for each plugin of site-plugins.json, its file in the npm package (and the files it
// needs first), a few lines that set it up on site/plugins.html the way the shop does and return what it made, and,
// where a newer release exists, the file of that release. COOKIES: the cookie runs of site/cookies.html.
export const PROBES = {
  bootstrap: { file: 'bootstrap-4.6.2/package/dist/js/bootstrap.js', needs: ['popper.js-1.16.1/package/dist/umd/popper.js'], init: "$('#cart').dropdown(); return typeof $.fn.dropdown;" },
  'bootstrap-datepicker': { file: 'bootstrap-datepicker-1.10.1/package/dist/js/bootstrap-datepicker.js', init: "$('#dob').datepicker({ format: 'dd/mm/yyyy' }); $('#dob').datepicker('setDate', new Date(2026, 0, 26)); return $('#dob').val();" },
  '@fancyapps/fancybox': { file: 'fancyapps-fancybox-3.5.7/package/dist/jquery.fancybox.js', init: "$.fancybox.open({ src: '/img/kettle.jpg', type: 'image' }); return $('.fancybox-container').length + ' open';" },
  'jquery.cookie': { file: 'jquery.cookie-1.4.1/package/jquery.cookie.js', init: "$.cookie('city', 'Pune', { path: '/' }); return $.cookie('city');" },
  'jquery-mask-plugin': { file: 'jquery-mask-plugin-1.14.16/package/dist/jquery.mask.js', init: "$('#phone').mask('00000 00000'); return $('#phone').val();" },
  'jquery-validation': { file: 'jquery-validation-1.19.5/package/dist/jquery.validate.js', latest: 'jquery-validation-1.22.1/package/dist/jquery.validate.js', init: "$('#signup').validate(); return 'valid() ' + $('#signup').valid();" },
  lightbox2: { file: 'lightbox2-2.12.0/package/dist/js/lightbox.js', init: "$('[data-lightbox]').first().trigger('click'); return $('#lightbox').length + ' lightbox';" },
  'magnific-popup': { file: 'magnific-popup-1.2.0/package/dist/jquery.magnific-popup.js', init: "$('#zoom').magnificPopup({ type: 'image' }); $('#zoom').trigger('click'); return $('.mfp-wrap').length + ' open';" },
  'owl.carousel': { file: 'owl.carousel-2.3.4/package/dist/owl.carousel.js', init: "$('#slides').owlCarousel({ items: 1 }); return $('#slides .owl-item').length + ' slides';" },
  select2: { file: 'select2-4.0.13/package/dist/js/select2.full.js', latest: 'select2-4.1.0/package/dist/js/select2.full.js', init: "$('#city').select2(); return $('.select2-container').length + ' box';" },
  'slick-carousel': { file: 'slick-carousel-1.8.1/package/slick/slick.js', latest: 'slick-carousel-2.0.0/package/slick/slick.js', init: "$('#offers').slick(); return $('#offers .slick-slide').length + ' slides';" },
  toastr: { file: 'toastr-2.1.4/package/build/toastr.min.js', init: "toastr.success('Saved'); return $('.toast').length + ' toast';" },
};

export const COOKIES = [
  { id: 'plugin-three', label: 'jquery.cookie 1.4.1 on jQuery 3.7.1', files: ['vendor:jquery-3.7.1.min.js', 'packs:jquery.cookie-1.4.1/package/jquery.cookie.js'] },
  { id: 'plugin-four', label: 'jquery.cookie 1.4.1 on jQuery 4.0.0', files: ['vendor:jquery-4.0.0.min.js', 'packs:jquery.cookie-1.4.1/package/jquery.cookie.js'] },
  { id: 'first-four', label: 'js-cookie 3.0.8, first adapter, on 4.0.0', flag: true, files: ['vendor:jquery-4.0.0.min.js', 'packs:js-cookie-3.0.8/package/dist/js.cookie.js', 'site/cookie-adapter-first.js'] },
  { id: 'fixed-four', label: 'js-cookie 3.0.8, fixed adapter, on 4.0.0', flag: true, files: ['vendor:jquery-4.0.0.min.js', 'packs:js-cookie-3.0.8/package/dist/js.cookie.js', 'site/cookie-adapter.js'] },
  { id: 'fixed-three', label: 'js-cookie 3.0.8, fixed adapter, on 3.7.1', flag: true, files: ['vendor:jquery-3.7.1.min.js', 'packs:js-cookie-3.0.8/package/dist/js.cookie.js', 'site/cookie-adapter.js'] },
  { id: 'flag-off', label: 'Flag off: the fixed adapter does nothing', flag: false, files: ['vendor:jquery-3.7.1.min.js', 'packs:jquery.cookie-1.4.1/package/jquery.cookie.js', 'packs:js-cookie-3.0.8/package/dist/js.cookie.js', 'site/cookie-adapter.js'] },
];

site/cookie-checks.js

// Six checks that pin what the shop's pages ask of $.cookie and $.removeCookie, written against jquery.cookie 1.4.1 on
// jQuery 3.7.1 before anything changed. Each prints PASS or FAIL with what it found.
jQuery(function ($) {
  function check(name, test) {
    var result;
    try {
      result = test();
    } catch (error) {
      result = error.name + ': ' + error.message;
    }
    console.log((result === true ? 'PASS ' : 'FAIL ') + name + (result === true ? '' : ' (' + result + ')'));
  }
  var shown = function (value) {
    return value === undefined ? 'undefined' : JSON.stringify(value);
  };

  check('writes a space as %20', function () {
    $.cookie('city', 'Navi Mumbai', { path: '/' });
    return document.cookie.indexOf('city=Navi%20Mumbai') !== -1 || 'document.cookie is ' + document.cookie;
  });
  check('reads it back', function () {
    var value = $.cookie('city');
    return value === 'Navi Mumbai' || 'got ' + shown(value);
  });
  check('reads a + the server wrote as a space', function () {
    document.cookie = 'greeting=Namaste+ji; path=/';
    var value = $.cookie('greeting');
    return value === 'Namaste ji' || 'got ' + shown(value);
  });
  check('keeps an encoded plus', function () {
    document.cookie = 'code=A%2BB; path=/';
    var value = $.cookie('code');
    return value === 'A+B' || 'got ' + shown(value);
  });
  check('a missing cookie is undefined', function () {
    var value = $.cookie('nothing-here');
    return value === undefined || 'got ' + shown(value);
  });
  check('removeCookie deletes it and says so', function () {
    var removed = $.removeCookie('city', { path: '/' });
    return (removed === true && $.cookie('city') === undefined) || 'returned ' + shown(removed) + ', then ' + shown($.cookie('city'));
  });

  $.cookie('consent', 'yes', { expires: 7, path: '/' });
});

first adapter · site/cookie-adapter-first.js

// cookie-adapter.js, first try: $.cookie and $.removeCookie on top of js-cookie, so the pages' calls stay as they are.
// It runs only when the shop's flag says so; otherwise jquery.cookie stays.
(function ($, Cookies) {
  if (!window.shopFlags || !window.shopFlags.jsCookie) return;
  $.cookie = function (name, value, options) {
    if (value === undefined) return Cookies.get(name);
    Cookies.set(name, value, options);
    return document.cookie;
  };
  $.removeCookie = function (name, options) {
    if (Cookies.get(name) === undefined) return false;
    Cookies.remove(name, options);
    return Cookies.get(name) === undefined;
  };
})(jQuery, window.Cookies);

site/cookie-adapter.js

// cookie-adapter.js: $.cookie and $.removeCookie on top of js-cookie, so the pages' calls stay as they are, with one
// difference from js-cookie's defaults: like jquery.cookie, it reads a + the server wrote as a space.
// It runs only when the shop's flag says so; otherwise jquery.cookie stays.
(function ($, Cookies) {
  if (!window.shopFlags || !window.shopFlags.jsCookie) return;
  var jar = Cookies.withConverter({
    read: function (value) {
      return Cookies.converter.read(value.replace(/\+/g, ' '));
    },
  });
  $.cookie = function (name, value, options) {
    if (value === undefined) return jar.get(name);
    jar.set(name, value, options);
    return document.cookie;
  };
  $.removeCookie = function (name, options) {
    if (jar.get(name) === undefined) return false;
    jar.remove(name, options);
    return jar.get(name) === undefined;
  };
})(jQuery, window.Cookies);

site/cookies.html

<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>Shop: cookie checks</title>
</head>
<body>
  <p>The page that runs the cookie checks. The server prints shopFlags first, then jQuery and either jquery.cookie or
  js-cookie with the adapter, then the checks. This is the page with the flag on.</p>
  <script>window.shopFlags = { jsCookie: true };</script>
  <script src="https://code.jquery.com/jquery-4.0.0.min.js" integrity="sha256-OaVG6prZf4v69dPg6PhVattBXkcOWQB62pdZ3ORyrao=" crossorigin="anonymous"></script>
  <!-- Flag on: js-cookie and the adapter. Flag off: /js/jquery.cookie.js in their place. -->
  <script src="/js/js.cookie.js"></script>
  <script src="cookie-adapter.js"></script>
  <script src="cookie-checks.js"></script>
</body>
</html>