chore(deps): update dependency moment to v2.31.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
moment	2.30.1 → 2.31.0

---

moment vulnerable to Path Traversal via crafted non-string locale name

CVE-2026-17495 / GHSA-4p3w-j4w9-5jqw

More information

Details

Impact

moment before 2.31.0 is vulnerable to path traversal in moment.locale(). When an application passes a non-string, attacker-influenced value to moment.locale(), a specially crafted object can bypass the locale name validation and cause moment to load a file from an attacker-controlled path. This is a further bypass of the validation added in 2.29.2 for CVE-2022-24785.

This affects server-side (npm) users only. Plain string input is not affected: the existing validation correctly rejects strings that contain path separators.

Patches

This issue is patched in moment 2.31.0.

Workarounds

Validate that any user-supplied input is a string before passing it to moment.locale().

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw
• https://nvd.nist.gov/vuln/detail/CVE-2026-17495
• https://github.com/moment/moment/pull/6386
• https://github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07
• https://cna.openjsf.org/security-advisories.html
• https://github.com/moment/moment/releases/tag/2.31.0
• https://github.com/advisories/GHSA-4p3w-j4w9-5jqw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: d61963bc-0b8a-4f9c-8ecc-5f9d25e3dcdb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.70%. Comparing base (1f2c702) to head (67bd0db).

Additional details and impacted files

@@           Coverage Diff            @@
##           staging    #1279   +/-   ##
========================================
  Coverage    77.70%   77.70%           
========================================
  Files           54       54           
  Lines         1413     1413           
========================================
  Hits          1098     1098           
  Misses         315      315           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.