Moment.js updated from version 2.14.1 to 2.15.0, offering developers improvements and bug fixes in this popular date manipulation library. Both versions maintain the same core functionality for parsing, validating, manipulating, and displaying dates. The core license and repository remain consistent, ensuring continuity for existing users. Key changes are reflected in the devDependencies, where version 2.15.0 introduces "typescript":"^1.8.10" which signals potential enhancements or refactoring involving TypeScript, a language that helps with writing cleaner and safer JavaScript code. Existing users can expect further improvements in type safety and maintainability as the project embraces TypeScript. Aside from the addition of typescript, version bumps might occur in other packages, bringing the related performance improvements, security patches, and new features in those packages. Before upgrading, it's advised that developers review the changelog on the Moment.js GitHub repository for a comprehensive list of specific changes, bug fixes, and potential breaking changes introduced in version 2.15.0 which directly affect their applications. Checking the release dates, one can notice that version 2.15.0 was released approximately two months after 2.14.1.
All the vulnerabilities related to the version 2.15.0 of the package
Regular Expression Denial of Service in moment
Affected versions of moment are vulnerable to a low severity regular expression denial of service when parsing dates as strings.
Update to version 2.19.3 or later.
Path Traversal: 'dir/../../filename' in moment.locale
This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg fr is directly used to switch moment locale.
This problem is patched in 2.29.2, and the patch can be applied to all affected versions (from 1.0.1 up until 2.29.1, inclusive).
Sanitize user-provided locale name before passing it to moment.js.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
