Repository navigation
fix: Bump moment from 2.30.1 to 2.31.0 - #952
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code. |
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update Moment lockfile records package-lock.json |
The dependency entry and installed package entry now reference Moment 2.31.0, with updated tarball URLs and integrity hashes. The installed package entry records the MIT license. |
Priority:
Estimated code review effort: 1 (Trivial) | ~4 minutes
Possibly related PRs
- parse-community/parse-server-example#946: Updates
parse-serverand its dependency tree, including lockfile resolutions on a dependency path that includes Moment.
Merge Risk: 
5e773
-
The dependency update is consistent and presents no actionable merge-blocking risk.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title begins with the allowed prefix fix:and uses a capitalized first word. It accurately describes themomentdependency update from 2.30.1 to 2.31.0.Linked Issues check The active linked issue is #943. The lockfile changes bothmomentrecords from 2.30.1 to 2.31.0 and update the resolved tarball and integrity value. This installs the release that contains CVE-2026-…Out of Scope Changes check The diff changes only package-lock.json. It updates the requestedmomentpackage records and adds the corresponding npm-generatedlicensemetadata. No unrelated source, dependency, or configurat…Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Security Check The pull request changes only package-lock.json. It replaces the transitive production dependency moment 2.30.1 with 2.31.0 in both lockfile sections, using the matching npm tarball URL and integrity … Engage In Review Feedback PASS. The current review produced zero actionable findings, and no CodeRabbit review threads were returned. Therefore, no review feedback required engagement, implementation, or reviewer retraction. Full details: Linked Issues check
-
Explanation
The active linked issue is
#943. The lockfile changes bothmomentrecords from 2.30.1 to 2.31.0 and update the resolved tarball and integrity value. This installs the release that contains CVE-2026-17495 and the listed release fixes, locales, and date-default hook. No project code change is required for this dependency upgrade. Closed issue#6376supplies historical context only.
Full details: Out of Scope Changes check
-
Explanation
The diff changes only
package-lock.json. It updates the requestedmomentpackage records and adds the corresponding npm-generatedlicensemetadata. No unrelated source, dependency, or configuration change is present.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Full details: Security Check
-
Explanation
The pull request changes only package-lock.json. It replaces the transitive production dependency moment 2.30.1 with 2.31.0 in both lockfile sections, using the matching npm tarball URL and integrity hash. No source code, scripts, dependency ranges, or new packages are introduced. The change removes the vulnerable moment version rather than adding a security-sensitive code pattern.
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
# [3.1.0](3.0.0...3.1.0) (2026-10-25) ### Bug Fixes * Bump ip-address from 10.1.0 to 10.7.4 and parse-server from 9.10.0 to 9.10.7 ([#946](#946)) ([62c53da](62c53da)) * Bump moment from 2.30.1 to 2.31.0 ([#952](#952)) ([6e042b4](6e042b4)) * Bump parse-server from 9.2.0 to 9.6.1 ([#819](#819)) ([85afc1f](85afc1f)) * Bump websocket-driver from 0.7.4 to 0.7.5 ([#912](#912)) ([70f7a44](70f7a44)) * Security upgrade brace-expansion from 5.0.5 to 5.0.7 ([#923](#923)) ([888e594](888e594)) * Security upgrade jws ([#749](#749)) ([198e1c9](198e1c9)) ### Features * Add TypeScript support ([#595](#595)) ([c9b119a](c9b119a)) * Upgrade to parse-server 9.2.0 ([#788](#788)) ([eef10d5](eef10d5))
|
🎉 This change has been released in version 3.1.0 |
Closes #943
Bumps the transitive production dependency
momentfrom 2.30.1 to 2.31.0. This fixes a medium-severity advisory. Onlypackage-lock.jsonchanges.Security
moment.locale()via a crafted non-string locale name>= 2.29.2, < 2.31.0This is the only
momentalert in the repository, in any state.momentis a production dependency.npm ls moment --omit=devshows the only path:parse-server9.10.7 →winston-daily-rotate-file5.0.0 →file-stream-rotator0.6.1 →moment.Version
2.31.0 is Dependabot's target and the current
latest. It satisfies the^2.29.1range offile-stream-rotator0.6.1, so no parent package changes.2.31.0 is the first
momentrelease since 2.30.1 (December 2023). Its origin checks out:moment/momentworkflow.github/workflows/release.ymlat tag2.31.0, commit moment/moment@15b45d4. The attested digest equals theintegrityvalue in this lock.2.31.0points to that commit ("[pkg] Build 2.31.0", [pkg] Build 2.31.0 moment/moment#6452), and GitHub shows its signature as verified.moment.js(themainentry),min/moment-with-locales.js,min/locales.js,locale/uk.js,src/lib/locale/locales.jsandsrc/lib/units/offset.js.package.jsondiffers only by publish normalization:packageManageris removed andrepositoryis written as an object. The package has nopreinstall,install,postinstallorpreparescript.Lock file changes
momentmomententries change, in both thepackagesand the legacydependenciessection. npm 10 also adds"license": "MIT"to the entry. No entry is added or removed, andlockfileVersionstays 2.momenthas no dependencies of its own. Itsengines.nodeis still*. The newdevEnginesfield (^22.22.2 || ^24.15.0 || >=26.0.0) only applies when developingmomentitself, not when it is installed as a dependency.masterwith npm 10.9.3. Dependabot's lock on refactor: Bump moment from 2.30.1 to 2.31.0 #943 drops the optional entriessocks,smart-bufferandgcp-metadata(with nestedgaxiosandnode-fetch). This lock keeps them, as fix: Bump ip-address from 10.1.0 to 10.7.4 and parse-server from 9.10.0 to 9.10.7 #946, refactor: Bump undici from 6.27.0 to 6.29.1 and 7.28.0 to 7.30.1 #947, refactor: Bump js-yaml from 3.14.2 to 3.15.2 and 4.1.1 to 4.3.2 #950 and refactor: Bump browserslist from 4.23.2 to 4.29.4 #951 did.Impact on this project
WinstonLoggerwritesparse-server.infoandparse-server.errthroughwinston-daily-rotate-filewheneverlogsFolderis set. The default is./logs/(./test_logs/whenTESTING=1). This example sets no logger options, so these transports are active.datePattern, and its logger options cannot set one.file-stream-rotatortherefore always uses the defaultYYYY-MM-DD.file-stream-rotator0.6.1 loadsmomentthrough its main entry (require('moment')). It calls only these APIs:moment(),moment.utc()and.local().minutes()and.hour(), as getters and setters.format(date_format).add(1, 'day'),.subtract(n, 'days').valueOf()and.endOf('day')moment.locale(),defineLocale()orupdateLocale(), and never parses strings. It uses only the built-inenlocale, whose definition is byte-identical in both versions.format()is reached. Its token regex and cache key changed, but the output forYYYY-MM-DDis unchanged.momentitself. This repository's code (cloud/,config.ts,index.ts,spec/) never importsmomentor callslocale().moment/locale/*ormoment/min/*. Those paths still exist in 2.31.0, which adds noexportsmap.Changes
moment 2.31.0
Security fixes:
./locale/<name>only when the normalized name is a string matching^[a-z0-9]+(?:-[a-z0-9]+)*$.match('^[^/\\]*$')result was truthy. A non-string object with its ownmatchmethod could therefore pass an arbitrary path torequire('./locale/' + name).Bug fixes:
'$' + formatand read withhasOwnProperty. A format string that is anObject.prototypeproperty name, such asconstructor, no longer resolves to that property.loadLocalelooks up the exact name first, then the normalized name (lowercased, first_replaced by-), and requires./locale/<normalized name>. A failed require is cached asnullunder the normalized name. For example,en_GBnow loadslocale/en-gbdirectly instead of first tryinglocale/en_GB.updateLocale()now resolves the name throughloadLocalefirst and stores the update under the locale's canonical name.eHHmmformat.eHHmmtoken for formatting and parsing: the locale weekday digit followed byHHmm, 5 or 6 digits.econsumed up to two digits, so unseparated input such aseHHmmwas misparsed.e+HH+mm, and\estill renders a literale.moment.min()andmoment.max()now skip arguments that are not Moment objects, and return an invalid moment if none remain.TypeError.l,ll,lllandllllare derived fromLtoLLLL. They are now cached per locale and recomputed when the uppercase format changes._longDateFormaton first use, so it went stale whenLtoLLLLchanged later, for example in a child locale or afterupdateLocale().Locale#set()runs whenever a locale is created or updated. It now clears the cached month and weekday parse regexes unless the new config supplies them. Before, an updated locale could keep parsing with the old regexes.weekdayMismatchflag is no longer set and the moment stays valid. Before, the weekday was compared against the defaulted date, which made the moment invalid.locale('__proto__')corrupting the global locale. Locale lookups inloadLocalenow usehasOwnProperty, so names such as__proto__,constructorandprototypeno longer resolve toObject.prototypemembers.Object.assigninduration.humanize. Custom thresholds are merged with moment's ownextendhelper, which also works whereObject.assignis missing. The merged result is the same.Z/ZZoffsets now make the parsed moment invalid, through a newinvalidOffsetparsing flag: offsets with minutes above 59, offsets above+14:00and offsets below-12:00.utcOffset()ignores such a string offset.+25:00became +1500 minutes.min/moment-with-locales.jsnow starts with the standard//! moment.jsheader comment.localeData().relativeTime()andlocaleData().pastFuture()now apply the locale'spostformat, such as the digit conversion inarorhi.humanize(),from()andfromNow()still apply it once.deprecateSimple, such asdefineLocaleOverride, now include a stack trace. The other deprecation warnings already had one.New features:
moment._getDefaultDateParts(), which Moment Timezone can override.New locales:
ps)am-et)Updates to existing locales:
pt-br): Fix wrong plural usage for timeid): Correct the abbreviation for Augustka) and Dutch (Belgium) (nl-be): CorrectLdate formatssv): Correct the abbreviation for Thursdayca): Use typographic apostrophes in relative timesw): Correct the spelling of hour in calendar outputuk): Use ISO week numberinguk): Use U+02BC apostrophes in Friday nameshu): Preserve numeric values in relative secondssw): Fix weekday and relative-time grammarde,de-at,de-ch): Parse short months without trailing dotsuz,uz-latn): Fix past relative-time formattingpl): Use genitive month names in dotted day formatsNot in the release notes (found in the commits):
filesallowlist.package.js, the Dojo build profile. It was renamed todojo.profile.js, anddojoBuildpoints to it.main(./moment.js),jsnext:main,typings,typesVersionsandengines.node(*). There is still noexportsmap.moment.js, but the public API is unchanged.bmadds a comment, andmkremoves a blank line.Breaking Changes
None
Code Changes Required
None — the upgrade is a drop-in replacement.
Summary by CodeRabbit