Bump moment from 2.29.4 to 2.31.0

Open

Number: #1365
Type: Pull Request
State: Open

Author:

dependabot[bot]
Association: Unknown
Comments: 1

Created: October 03, 2026 at 08:25 AM UTC
(11 days ago)

Updated: October 03, 2026 at 08:33 AM UTC
(11 days ago)

Labels:
dependencies javascript

Description:

Bumps moment from 2.29.4 to 2.31.0.

Release notes

Sourced from moment's releases.

2.31.0

Released Sep 14, 2026

Security fixes

Fix CVE-2026-17495 (GHSA-4p3w-j4w9-5jqw)

Bug fixes

#6376 Prevent object prototype properties from being used as format tokens

#6386 Normalize lazy-loaded locale names

#6404 Fix parsing issue with eHHmm format

#6433 Ignore non-Moment arguments in min and max

#6434 Fix inherited lowercase long date formats

#6436 Reset locale parsing caches after updates

#6437 Fix weekday mismatch when the format only has part of a date

#6442 Fix locale('__proto__') corrupting the global locale

#6443 Avoid Object.assign in duration.humanize

#6446 Validate range when parsing a time zone offset

#6447 Include metadata in all-locales bundle

#6448 Apply postformat to locale relative time methods

#6450 Add stack traces to conditional deprecation warnings

New features

#6451 Add internal date-default hook for Moment Timezone

New locales

#6000: Pashto ('ps')

#6278, #6379: Amharic (Ethiopia) ('am-et')

Updates to existing locales

#5404 Portuguese (Brazil) ('pt-br'): Fix wrong plural usage for time

#6197 Indonesian ('id'): Correct the abbreviation for August

#6217 Georgian ('ka') and Dutch (Belgium) ('nl-be'): Correct L date formats

#6289 Swedish ('sv'): Correct the abbreviation for Thursday

#6306 Catalan ('ca'): Use typographic apostrophes in relative time

#6347 Swahili ('sw'): Correct the spelling of hour in calendar output

#6360 Ukrainian ('uk'): Use ISO week numbering

#6370 Ukrainian ('uk'): Use U+02BC apostrophes in Friday names

#6371 Hungarian ('hu'): Preserve numeric values in relative seconds

#6391 Swahili ('sw'): Fix weekday and relative-time grammar

#6396 German ('de', 'de-at', 'de-ch'): Parse short months without trailing dots

#6409 Uzbek ('uz', 'uz-latn'): Fix past relative-time formatting

#6410 Polish ('pl'): Use genitive month names in dotted day formats

2.30.1

Note - this was not a new release, but rather just updating GitHub's latest release to indicate the existing version 2.30.1 from Dec 27, 2023.

... (truncated)

Changelog

Sourced from moment's changelog.

2.31.0

Released Sep 14, 2026

Security fixes

Fix CVE-2026-17495 (GHSA-4p3w-j4w9-5jqw)

Bug fixes

#6376 Prevent object prototype properties from being used as format tokens

#6386 Normalize lazy-loaded locale names

#6404 Fix parsing issue with eHHmm format

#6433 Ignore non-Moment arguments in min and max

#6434 Fix inherited lowercase long date formats

#6436 Reset locale parsing caches after updates

#6437 Fix weekday mismatch when the format only has part of a date

#6442 Fix locale('__proto__') corrupting the global locale

#6443 Avoid Object.assign in duration.humanize

#6446 Validate range when parsing a time zone offset

#6447 Include metadata in all-locales bundle

#6448 Apply postformat to locale relative time methods

#6450 Add stack traces to conditional deprecation warnings

New features

#6451 Add internal date-default hook for Moment Timezone

New locales

#6000: Pashto ('ps')

#6278, #6379: Amharic (Ethiopia) ('am-et')

Updates to existing locales

#5404 Portuguese (Brazil) ('pt-br'): Fix wrong plural usage for time

#6197 Indonesian ('id'): Correct the abbreviation for August

#6217 Georgian ('ka') and Dutch (Belgium) ('nl-be'): Correct L date formats

#6289 Swedish ('sv'): Correct the abbreviation for Thursday

#6306 Catalan ('ca'): Use typographic apostrophes in relative time

#6347 Swahili ('sw'): Correct the spelling of hour in calendar output

#6360 Ukrainian ('uk'): Use ISO week numbering

#6370 Ukrainian ('uk'): Use U+02BC apostrophes in Friday names

#6371 Hungarian ('hu'): Preserve numeric values in relative seconds

#6391 Swahili ('sw'): Fix weekday and relative-time grammar

#6396 German ('de', 'de-at', 'de-ch'): Parse short months without trailing dots

#6409 Uzbek ('uz', 'uz-latn'): Fix past relative-time formatting

#6410 Polish ('pl'): Use genitive month names in dotted day formats

2.30.1

... (truncated)

Commits

15b45d4 [pkg] Build 2.31.0 (#6452)
631cd81 [pkg] Update changelog for upcoming release (#6394)
6caff9e Merge commit from fork
710703b [feature] Add internal date-default hook for Moment Timezone (#6451)
863ed94 [bugfix] Add stack traces to conditional deprecation warnings (#6450)
2c7abe1 [bugfix] Apply postformat to locale relative time methods (#6448)
9c45ac3 [bugfix] Include metadata in all-locales bundle (#6447)
f6eefc5 [bugfix] Validate timezone offset range (#6446)
136b441 [bugfix] Avoid Object.assign in duration.humanize (#6443)
0d10504 [bugfix] Fix locale('proto') corrupting the global locale (#6442)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for moment since your current version.

Package Dependencies

Package:
moment

Ecosystem:
npm

Version Change:
2.29.4 → 2.31.0

Update Type:
Minor

Security Advisories

moment vulnerable to Path Traversal via crafted non-string locale name

GHSA-4p3w-j4w9-5jqw CVE-2026-17495 MODERATE

### Impact moment before 2.31.0 is vulnerable to path traversal in `moment.locale()`. When an application passes a non-string, attacker-influenced value to `moment.locale()`, a specially crafted o...

ID:	`16659258`
UUID:	`5687920265`
Node ID:	`PR_kwDOD326cc8AAAABGaRVHQ`
Host:	GitHub
Repository:	AdoptOpenJDK/blog

ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Dependabot

Bump moment from 2.29.4 to 2.31.0

2.31.0

Security fixes

Bug fixes

New features

New locales

Updates to existing locales

2.30.1