From c4a0a53fcf7ae0886184b1dfe36015fbdb34e363 Mon Sep 17 00:00:00 2001
From: "Frank Pigeon Jr." <frank.pigeon@gsa.gov>
Date: Mon, 9 Nov 2026 14:41:23 -0600
Subject: [PATCH] fix(deps): bump locked moment to 2.31.0 (CVE-2026-17495)

Lock-only update; the published peer range (>=2.19.3) is unchanged so consumers are not forced to upgrade. Fixes ZAP 10003 in the DAST bundle blocking #767/#769/#771.
---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index f3488fda9..dc1eff7d0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -7833,9 +7833,9 @@
       }
     },
     "node_modules/moment": {
-      "version": "2.30.1",
-      "resolved": "https://registry.npmjs.org/moment/-/moment-2.30.1.tgz",
-      "integrity": "sha512-uEmtNhbDOrWPFS+hdjFCBfy9f2YoyzRpwcl+DqpC6taX21FzsTLQVbMV/W7PzNSX6x/bhC1zA3c2UQ5NzH6how==",
+      "version": "2.31.0",
+      "resolved": "https://registry.npmjs.org/moment/-/moment-2.31.0.tgz",
+      "integrity": "sha512-0acOTfMiWOheYS4eoWb80yYMb/JLvVv9SHbs2PehaDzfUG0Bw855SKyk0IKTnPGa5+U2bmi3W68l1+sGLX/pvw==",
       "license": "MIT",
       "peer": true,
       "engines": {