moment
The e18e replacements list suggests something lighter. See the alternatives.
- 2.31.0 is the latest, published 15 September 2026.
- 5 security advisories, all fixed.
- 2.x: 65 releases since 8 February 2013, 1 in the last 90 days.
Security advisories
Grouped by the version that fixes them, so one upgrade reads as one step.
Fixed in 2.31.0 · 1 advisory
- MODERATEmoment vulnerable to Path Traversal via crafted non-string locale nameGHSA-4p3w-j4w9-5jqw
Fixed in 2.29.4 · 1 advisory
- HIGHMoment.js vulnerable to Inefficient Regular Expression ComplexityGHSA-wc69-rhjr-hc9g
Fixed in 2.29.2 · 1 advisory
- HIGHPath Traversal: 'dir/../../filename' in moment.localeGHSA-8hfj-j24r-96c4
Fixed in 2.19.3 · 1 advisory
- HIGHRegular Expression Denial of Service in momentGHSA-446m-mv8f-q348
1 older fix
Fixed in 2.11.2 · 1 advisory
- MODERATERegular Expression Denial of Service in momentGHSA-87vv-r9j6-g5qv
Releases in the last 90 days
Feed of releases and advisoriesEvery stable release, newest first. Notes are quoted as the maintainers published them.
2.31.0
15 September 2026
Major versions
- 2.xsince 8 February 2013 · latest 2.31.0 · 65 releases
- 1.xsince 6 December 2011 · latest 1.7.2 · 15 releases
Quality and security signals
What npm and deps.dev say about the latest release. Signals, not a verdict.
Reading npm and deps.dev…
Registry facts last checked 15 October 2026. Releases and advisories last read 15 October 2026.
Know when your own dependencies move
Inlinr tracks your coding time automatically. Switch dependency tracking on for a project and it reads that repository's manifest to show what is behind and what has been deprecated — off by default, one project at a time.