fix(deps): update dependency moment to v2.31.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
moment	2.29.4 → 2.31.0

---

moment vulnerable to Path Traversal via crafted non-string locale name

CVE-2026-17495 / GHSA-4p3w-j4w9-5jqw

More information

Details

Impact

moment before 2.31.0 is vulnerable to path traversal in moment.locale(). When an application passes a non-string, attacker-influenced value to moment.locale(), a specially crafted object can bypass the locale name validation and cause moment to load a file from an attacker-controlled path. This is a further bypass of the validation added in 2.29.2 for CVE-2022-24785.

This affects server-side (npm) users only. Plain string input is not affected: the existing validation correctly rejects strings that contain path separators.

Patches

This issue is patched in moment 2.31.0.

Workarounds

Validate that any user-supplied input is a string before passing it to moment.locale().

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw
• https://nvd.nist.gov/vuln/detail/CVE-2026-17495
• https://github.com/moment/moment/pull/6386
• https://github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07
• https://cna.openjsf.org/security-advisories.html
• https://github.com/moment/moment/releases/tag/2.31.0
• https://github.com/advisories/GHSA-4p3w-j4w9-5jqw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 43007786-eecb-4211-88c0-439c00357a86

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

The auto preview on your projects!.

Name	Status	Preview	Updated
contributor-graph	Deploying		Mon Oct 5 17:27:51 UTC 2026