Day.js v1.11.10 depends on Moment.js which has a known security vulnerability (CVE-2022-31129)
Open
- Dominant language
- JavaScript
- Stars
- 48.7k
- Forks
- 2.5k
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
Day.js v1.11.10 specifies Moment.js 2.29.2 in devDependencies, which has a know security vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2022-31129
**Expected behavior**
Day.js should bump the Moment.js version to 2.29.4 which is not vulnerable.
**Information**
- Day.js Version v1.11.10
- OS: All
- Browser: All
Contributor guide
Research direction
Start by locating the package manifest's devDependencies entry for Moment.js and confirm the current version is 2.29.2. Update it to 2.29.4, then verify the dependency metadata and run the project's existing checks to confirm the vulnerable version is no longer specified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100