Moment.js saw a version bump from 2.15.2 to 2.16.0 in late 2016, introducing some subtle but potentially impactful changes for developers relying on this widely used date manipulation library. Both versions share the same core functionality: parsing, validating, manipulating, and displaying dates in JavaScript. The development dependencies highlight tools used for testing, linting, and building the library itself, with tools like grunt, karma, qunit, and several grunt-contrib-* plugins for tasks such as concatenation, minification, and JSHint.
A notable difference lies in the introduction of rollup in version 2.16.0, which replaces esperanto present in version 2.15.2. This suggests a shift in the module bundler used for building the library, potentially affecting the final bundle size and overall performance. While developers consuming Moment.js directly might not immediately notice this change, it could influence the library's long-term maintainability and optimization. The consistent use of various karma and grunt plugins across both versions emphasizes the project's focus on code quality and automated testing. The development dependencies also show the consistent use of typescript allowing type checking during development. Choosing between the 2 versions is not really significant but consider using the latest version recommended by the project.
All the vulnerabilities related to the version 2.16.0 of the package
Regular Expression Denial of Service in moment
Affected versions of moment
are vulnerable to a low severity regular expression denial of service when parsing dates as strings.
Update to version 2.19.3 or later.
Path Traversal: 'dir/../../filename' in moment.locale
This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg fr
is directly used to switch moment locale.
This problem is patched in 2.29.2, and the patch can be applied to all affected versions (from 1.0.1 up until 2.29.1, inclusive).
Sanitize user-provided locale name before passing it to moment.js.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory: