Moment.js saw a minor version update from 2.11.2 to 2.12.0, offering developers continued stability and reliability in date and time manipulation. Both versions, sharing the same core description of parsing, validating, manipulating, and displaying dates, retain the MIT license, ensuring freedom and flexibility in usage. The development dependencies remain consistent, showcasing a commitment to a stable development environment, and utilizes tools like Grunt, Karma, and QUnit for building, testing and quality assurance. For developers, the subtle version bump signifies incremental improvements and bug fixes rather than significant API changes, meaning integration efforts should be minimal.
The release dates indicate a roughly one-month gap between versions, signifying a commitment to consistent updates and maintenence. While the core offering remains constant, developers can expect refinements and optimizations within the 2.12.0 version. The dist.tarball links point developers to the specific release packages on the npm registry. Developers should look to the offical release notes on the github repository, to note any internal fixes, as well as minor performance enhancements. Ultimately, developers using moment.js will find value in staying up to date, ensuring access to the most recent enhancements and issue resolutions contributing to the overall stability of their projects.
All the vulnerabilities related to the version 2.12.0 of the package
Regular Expression Denial of Service in moment
Affected versions of moment are vulnerable to a low severity regular expression denial of service when parsing dates as strings.
Update to version 2.19.3 or later.
Path Traversal: 'dir/../../filename' in moment.locale
This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg fr is directly used to switch moment locale.
This problem is patched in 2.29.2, and the patch can be applied to all affected versions (from 1.0.1 up until 2.29.1, inclusive).
Sanitize user-provided locale name before passing it to moment.js.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
