[fpigeonjr]

Description

Lock-only update of moment from 2.30.1 → 2.31.0 to fix CVE-2026-17495 (GHSA-4p3w-j4w9-5jqw; affects >=2.29.2 <2.31.0).

package-lock.json  node_modules/moment  2.30.1 -> 2.31.0   (package.json unchanged)

• The test-app production build (the one the DAST job scans) resolves the root node_modules/moment, not test-app's own 2.31.0 copy, so the ZAP gate flagged 2.30.1 in main-*.js.
• The published peer range (moment: >=2.19.3) is intentionally left alone. Narrowing it would force every consumer to upgrade and break installs for anyone pinned below 2.31.0.

Motivation and Context

DAST (medium/high gate) fails on #767, #769 and #771 with [10003] Vulnerable JS Library: Medium, which is this moment version. None of those PRs touch moment. Found by the fleet Dependabot sweep. There's no .zap/rules.tsv exception for 10003, so this is a real fix, not a suppression.

Closes N/A (no issue; unblocks #767, #769, #771)

Type of Change (Select One and Apply Label)

• Bug fix (non-breaking change which fixes an issue) → Apply bugfix label
• New feature (non-breaking change which adds functionality) → Apply enhancement label
• Breaking change (fix or feature that would cause existing functionality to change) → Apply breaking label
• Documentation / configuration update → Apply maintenance label

How to Test

1. npm ci && npm ci --prefix test-app
2. npm ls moment shows only moment@2.31.0
3. npm --prefix test-app run build -- --configuration production, then grep -l 2.30.1 test-app/dist/browser/*.js (no match) and grep -l 2.31.0 test-app/dist/browser/*.js (main bundle)

Expected result: only 2.31.0 is installed and bundled, and the CI DAST (medium/high gate) check passes.

Evidence

• Before: the root lock had 2.30.1. The production build's stats list ../node_modules/moment/moment.js, and main-LIALRILK.js contained 2.30.1, matching ZAP runs 42064029364, 40911271582 and 39813832109.
• After: the production build succeeded and main-V5VVGEPW.js contains 2.31.0, with no 2.30.1 in any emitted JS. Before the final lock-only amendment, the same lock change passed npm --prefix test-app test (176 files / 1936 tests), npm run coverage:check, npm run lint:baseline and npm run validate:publish.
• Not yet verified: the live ZAP result, which this PR's CI will show.

Merge Danger

• Door: two-way (lockfile revert).
• Blast radius: this repo's dev/test-app builds only; the published package manifest is unchanged. Consumers on older moment versions remain responsible for their own upgrade (a peer-range bump could be a separate, coordinated change).

Screenshots (if appropriate)

N/A

Checklist

• Branch name follows convention (e.g. gh-<number>-<slug>). There's no issue; the branch is fix-moment-cve-2026-17495.
• PR title starts with a verb in the imperative mood
• I have self-reviewed my own code
• format:check passes (npm run format:check)
• lint passes (npm run lint)
• build passes (cd test-app && npm run build)
• Tests pass and coverage is reported (cd test-app && npm test)
• If this change requires a documentation update, I have updated it accordingly
• If there are dependent changes, they have been merged and published in downstream modules