# Analytics version or SDK is reasonably current

- **Pattern:** `ab-001715` (`marketing-analytics.data-quality.analytics-version-current`)
- **Severity:** low
- **Lifecycle:** active
- **Last modified:** 2026-04-18
- **Canonical URL:** https://auditbuffet.com/patterns/ab-001715
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-001715)

## Why it matters

Google Universal Analytics (UA- tracking IDs) was permanently shut down on July 1, 2024. Any codebase still referencing `analytics.js` or a `UA-XXXXXXXX-X` tracking ID is collecting zero data — the service is gone. Operators may not notice for months because the UI still renders and no error is thrown. Beyond UA, running analytics SDKs two or more major versions behind current (CWE-1357) means missing security patches and compatibility fixes, and relying on deprecated API surfaces that platforms remove without warning.

## Severity rationale

Low because an outdated SDK version degrades observability and may miss security patches (CWE-1357), but does not directly expose user data or create an availability risk.

## Remediation

Replace any Universal Analytics tracking ID with a GA4 measurement ID in your analytics initialization:

```js
// Before (no longer collecting data — UA was shut down July 1, 2024):
gtag('config', 'UA-XXXXXXXX-1')

// After (GA4):
gtag('config', 'G-XXXXXXXXXX')
```

For other analytics packages, run `npm outdated` to surface packages two or more major versions behind. Check the platform's migration guide before upgrading — analytics SDK major versions frequently include breaking changes to initialization options and event schemas. Update `package.json` and re-test your key tracking events after upgrading.

## Detection

- **ID:** `analytics-version-current`
- **Severity:** `low`
- **What to look for:** Check the installed version of analytics packages in `package.json` against known major version milestones. Specifically look for:
  - `gtag.js` vs. legacy Universal Analytics (`analytics.js`) patterns — UA was sunset in July 2024
  - `mixpanel-browser` v2.x vs. v3.x (v3 was a significant rewrite)
  - PostHog JS SDK version — check for v1 vs. v2+ (v2 has breaking changes)
  - Any analytics library that is 2+ major versions behind the current release
  - `google-analytics` (old npm package) vs. `@google-analytics/data` (GA4)
- **Pass criteria:** Count every analytics-related package in `package.json`. All analytics packages are within 1 major version of current, and 0 sunset/deprecated analytics platforms are in use (no Universal Analytics patterns). Report the count even on pass: "N analytics packages checked, all within 1 major version."
- **Fail criteria:** Universal Analytics (`analytics.js` or `UA-XXXXXXXX-X` tracking IDs) is detected (UA was sunset July 1, 2024), or at least 1 analytics package is 2 or more major versions behind.
- **Skip (N/A) when:** No analytics is present. Skip if no versioned analytics npm packages are used (script-tag-only setup).
- **Detail on fail:** `"Universal Analytics (UA-) tracking ID pattern detected. Google Universal Analytics was permanently shut down on July 1, 2024 — no data is being collected. Migration to GA4 (G- tracking ID) is required."`
- **Remediation:** Migrate from Universal Analytics to GA4. Replace the UA tracking ID in your analytics config:

  ```js
  // Before (UA — deprecated, no longer collecting data):
  // gtag('config', 'UA-XXXXXXXX-1')
  // After (GA4):
  gtag('config', 'G-XXXXXXXXXX')
  ```

  For other outdated packages, run `npm outdated` to identify which `package.json` dependencies have newer major versions. Review the changelog before upgrading — analytics SDK major versions often include breaking changes to event schemas.

## External references

- cwe CWE-1357

Taxons: observability, supply-chain

HTML version: https://auditbuffet.com/patterns/ab-001715