[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ moment (2.30.1 → 2.31.0) · Repo · Changelog

Security Advisories 🚨

🚨 moment vulnerable to Path Traversal via crafted non-string locale name

Impact

moment before 2.31.0 is vulnerable to path traversal in moment.locale(). When an application passes a non-string, attacker-influenced value to moment.locale(), a specially crafted object can bypass the locale name validation and cause moment to load a file from an attacker-controlled path. This is a further bypass of the validation added in 2.29.2 for CVE-2022-24785.

This affects server-side (npm) users only. Plain string input is not affected: the existing validation correctly rejects strings that contain path separators.

Patches

This issue is patched in moment 2.31.0.

Workarounds

Validate that any user-supplied input is a string before passing it to moment.locale().

Release Notes

2.31.0

Released Sep 14, 2026

Security fixes

• Fix CVE-2026-17495 (GHSA-4p3w-j4w9-5jqw)

Bug fixes

• #6376 Prevent object prototype properties from being used as format tokens
• #6386 Normalize lazy-loaded locale names
• #6404 Fix parsing issue with eHHmm format
• #6433 Ignore non-Moment arguments in min and max
• #6434 Fix inherited lowercase long date formats
• #6436 Reset locale parsing caches after updates
• #6437 Fix weekday mismatch when the format only has part of a date
• #6442 Fix locale('__proto__') corrupting the global locale
• #6443 Avoid Object.assign in duration.humanize
• #6446 Validate range when parsing a time zone offset
• #6447 Include metadata in all-locales bundle
• #6448 Apply postformat to locale relative time methods
• #6450 Add stack traces to conditional deprecation warnings

New features

• #6451 Add internal date-default hook for Moment Timezone

New locales

• #6000: Pashto ('ps')
• #6278, #6379: Amharic (Ethiopia) ('am-et')

Updates to existing locales

• #5404 Portuguese (Brazil) ('pt-br'): Fix wrong plural usage for time
• #6197 Indonesian ('id'): Correct the abbreviation for August
• #6217 Georgian ('ka') and Dutch (Belgium) ('nl-be'): Correct L date formats
• #6289 Swedish ('sv'): Correct the abbreviation for Thursday
• #6306 Catalan ('ca'): Use typographic apostrophes in relative time
• #6347 Swahili ('sw'): Correct the spelling of hour in calendar output
• #6360 Ukrainian ('uk'): Use ISO week numbering
• #6370 Ukrainian ('uk'): Use U+02BC apostrophes in Friday names
• #6371 Hungarian ('hu'): Preserve numeric values in relative seconds
• #6391 Swahili ('sw'): Fix weekday and relative-time grammar
• #6396 German ('de', 'de-at', 'de-ch'): Parse short months without trailing dots
• #6409 Uzbek ('uz', 'uz-latn'): Fix past relative-time formatting
• #6410 Polish ('pl'): Use genitive month names in dotted day formats

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 67 commits:

• [pkg] Build 2.31.0 (#6452)
• [pkg] Update changelog for upcoming release (#6394)
• Merge commit from fork
• [feature] Add internal date-default hook for Moment Timezone (#6451)
• [bugfix] Add stack traces to conditional deprecation warnings (#6450)
• [bugfix] Apply postformat to locale relative time methods (#6448)
• [bugfix] Include metadata in all-locales bundle (#6447)
• [bugfix] Validate timezone offset range (#6446)
• [bugfix] Avoid Object.assign in duration.humanize (#6443)
• [bugfix] Fix locale('__proto__') corrupting the global locale (#6442)
• [bugfix] weekday mismatch when the format only has part of a date (#6437)
• [misc] Add security threat model (#6445)
• [tests] Fix format test date input (#6438)
• [new locale] ps: Pashto (#6000)
• gitignore non-pnpm lockfiles
• [bugfix] Reset locale parsing caches after updates (#6436)
• [bugfix] Fix inherited lowercase long date formats (#6434)
• [bugfix] Ignore non-Moment arguments in min and max (#6433)
• [locale] Fix Polish month case for dotted day formats (#6410)
• [locale] Fix Uzbek past relative time (#6409)
• [misc] add CI meta check for validation (#6408)
• [misc] Create locale reviewer agent skill (#6407)
• [misc] colorize githook messages (#6406)
• [tests] fix DST unit test failures (#6405)
• [bugfix] Parse compact locale weekday before time (#6404)
• [tests] fix benchmarks (#6403)
• [locale] change abbreviation of august for Indonesian locale (#6197)
• [misc] fix openjsf logo in light mode (#6401)
• [misc] update readme with openjs details (#6400)
• [misc] format code
• [locale] de, de-at, de-ch: parse short months without trailing dot (#6396)
• [misc] update links (#6399)
• [misc] fix fossa scan (#6398)
• [misc] Modernize development, CI, and release tooling (#6397)
• [misc] rename test to match repo conventions (#6395)
• [locale] Fix Swahili weekday and relative-time grammar (#6391)
• [misc] Remove last traces of Nuget (#6392)
• [bugfix] Normalize lazy-loaded locale names (#6386)
• [locale] Fix Swahili spelling of hour from saat to saa (#6347)
• [locale] locale(uk): use U+02BC apostrophe in Friday weekday names (#6370)
• [tests] Fix strict flag assertion message (#6350)
• [misc] fix typo in transpile task description
• Fix uk locale week calculation according to ДСТУ ISO 8601:2010 (National Standard of Ukraine) (#6360)
• [locale] pt-br: Fix wrong plural usage for time
• [misc] update fossa workflow (#6390)
• [misc] update fossa workflow (#6389)
• [misc] update fossa badges (#6388)
• [misc] run fossa scan manually (#6387)
• [misc] add code owners file (#6385)
• [misc] fix npm packaging (#6383)
• [misc] fix coveralls, remove travis (#6382)
• Add fossa license scan report and status (#6381)
• [misc] Update dev dependencies and update tests (#6380)
• [bugfix] Fix develop CI failures from recent locale changes (#6379)
• [locale] Fixed ('L') format for Georgian and Flemish (Belgium Dutch). (#6217)
• [locale] Add Amharic (Ethiopia) locale [am-et] (#6278)
• fix: thursday shortcode for sv locale (#6289)
• [locale] ca.js: replace straight quotes with curly quotes (#6306)
• [bugfix] Fix hu locale relative time ss ternary precedence (#6371)
• [bugfix] prevent object prototypes in format strings (#6376)
• [misc] repository maintenance (#6375)
• [misc] Update readme, remove broken badges and images (#6293)
• docs: use https momentjs.com link (#6348)
• fix: update moment package-lock version to 2.30.1 (#6372)
• ci: Update Node testing matrix
• docs: add security policy (#6327)
• Create npm-grunt.yml (#6209)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

Go to the Depfu Dashboard to see the state of your dependencies and to customize how Depfu works.