Moment.js saw a minor version bump from 2.17.0 to 2.17.1, representing a small but potentially important update for developers utilizing this widely-used date and time manipulation library. Both versions share the same core description: parsing, validating, manipulating, and displaying dates. This underscores the library's continued commitment to providing a robust and versatile tool for handling date-related tasks in JavaScript.
Examining the devDependencies, we notice the primary difference lies in the version of typescript used. Version 2.17.0 relies on typescript version ^2.0.8, whereas version 2.17.1 uses typescript version ^1.8.10. This change likely indicates a regression or compatibility issue discovered in the newer TypeScript version that prompted a rollback to an older, more stable release for the newer Moment.js point release.
For developers, this difference is crucial. If your project also uses TypeScript, be mindful of potential compatibility issues. Users working with specific TypeScript configurations might find version 2.17.1 more stable due to its alignment with an earlier TypeScript version. The releaseDate also distinguishes the two, with version 2.17.1 released on December 4, 2016, following version 2.17.0 released on November 22, 2016. This short interval suggests that 2.17.1 primarily addresses any bugs or regressions introduced in 2.17.0. While the core functionality remains consistent, developers should prioritize 2.17.1 primarily for any bug fixes it brings.
All the vulnerabilities related to the version 2.17.1 of the package
Regular Expression Denial of Service in moment
Affected versions of moment are vulnerable to a low severity regular expression denial of service when parsing dates as strings.
Update to version 2.19.3 or later.
Path Traversal: 'dir/../../filename' in moment.locale
This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg fr is directly used to switch moment locale.
This problem is patched in 2.29.2, and the patch can be applied to all affected versions (from 1.0.1 up until 2.29.1, inclusive).
Sanitize user-provided locale name before passing it to moment.js.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
