Deprecation
The deprecation report warns when a page uses a web platform feature the browser plans to remove.
Last update:
A deprecation report tells you that the page used an API the browser has marked
for removal. It is an early-warning signal: you find out which code path relies on
a feature that will stop working, with a source location, before it breaks in a
future release.
Non-standard
Deprecation reporting is not defined in a current specification and is implemented mainly in Chromium. Use it as a heads-up, not as a guaranteed cross-browser signal.
When the browser sends it
When the page uses a deprecated API. The report goes to the default reporting endpoint
in Reporting-Endpoints (it has no per-policy directive), and it is also observable
in the page through ReportingObserver,
which is useful for surfacing deprecations to developers during a build.
Payload example
{
"type": "deprecation",
"age": 32,
"url": "https://api-next.centralcsp.com/",
"user_agent": "Mozilla/5.0 ...",
"body": {
"id": "XMLHttpRequestSynchronousInNonWorkerOutsideBeforeUnload",
"message": "Synchronous XMLHttpRequest on the main thread is deprecated ...",
"anticipatedRemoval": null,
"sourceFile": "https://api-next.centralcsp.com/app.js",
"lineNumber": 54,
"columnNumber": 11
}
}Every deprecation report body carries these fields inside the shared report envelope.
Field reference
| Field | Meaning |
|---|---|
id | A machine-readable feature identifier, the stable key to group by. |
message | A human-readable description of the deprecation. |
anticipatedRemoval | The planned removal date, or null if not announced. |
sourceFile | The file that used the deprecated API. |
lineNumber / columnNumber | The location in that file. |
How to receive it
Declare a default endpoint in Reporting-Endpoints; deprecation reports have no
other target. CentralCSP collects them at
one endpoint alongside every other type.
What it tells you about security
Deprecated APIs are often the ones with the weakest defaults (synchronous
XMLHttpRequest, legacy crypto, insecure patterns the platform is retiring).
Clearing them removes both a future breakage and, frequently, a security weakness,
so the report is worth acting on rather than filing.
Gotchas
anticipatedRemoval is frequently null, so do not rely on it for scheduling. The
id is the stable key to group and track by; the message wording can change
between browser versions.
Browser support
Chromium-based browsers only; not Baseline. Other engines do not emit deprecation reports, so treat it as a Chromium-first signal.
See also
- ReportingObserver
- intervention report
- Deprecation and intervention reports
- Deprecation monitoring in CentralCSP
- Reporting-Endpoints header
- The report delivery format