Moment.js version 2.13.0 arrived on April 18, 2016, succeeding version 2.12.0, released on March 7, 2016. Both versions maintain the core function of parsing, validating, manipulating, and displaying dates in JavaScript. Examining the devDependencies reveals subtle changes, likely reflecting updates in the tooling used for development and testing. Both versions share an extensive suite of development dependencies, including testing frameworks like Karma and QUnit, build tools like Grunt, and utilities for code quality and coverage such as JSHint, JSC, and Coveralls. The presence of tools like esperanto suggests ongoing efforts to modernize the codebase and support ES6 modules and the toolchain to test on different browsers such as Chrome and Firefox and also different platforms with Sauce Labs.
For developers considering an upgrade, the shift from 2.12.0 to 2.13.0 mostly entails potential improvements and fixes under the hood. While no specific feature additions are evident from the provided metadata, upgrading is often recommended to benefit from bug fixes, performance enhancements, and compatibility updates with the latest JavaScript environments. Developers should always consult the official Moment.js changelog for detailed information on specific changes and potential breaking changes between versions, ensuring a smooth transition and optimal use of the library. The license remains MIT in both versions, allowing for flexible use in diverse projects.
All the vulnerabilities related to the version 2.13.0 of the package
Regular Expression Denial of Service in moment
Affected versions of moment
are vulnerable to a low severity regular expression denial of service when parsing dates as strings.
Update to version 2.19.3 or later.
Path Traversal: 'dir/../../filename' in moment.locale
This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg fr
is directly used to switch moment locale.
This problem is patched in 2.29.2, and the patch can be applied to all affected versions (from 1.0.1 up until 2.29.1, inclusive).
Sanitize user-provided locale name before passing it to moment.js.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory: