Skip to content

build(deps-dev): bump moment from 2.29.4 to 2.31.0 - #7229

Merged
jdstrand merged 1 commit into
masterfrom
dependabot/npm_and_yarn/moment-2.31.0
Nov 5, 2026
Merged

build(deps-dev): bump moment from 2.29.4 to 2.31.0#7229
jdstrand merged 1 commit into
masterfrom
dependabot/npm_and_yarn/moment-2.31.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps moment from 2.29.4 to 2.31.0.

Release notes

Sourced from moment's releases.

2.31.0

Released Sep 14, 2026

Security fixes

Bug fixes

  • #6376 Prevent object prototype properties from being used as format tokens
  • #6386 Normalize lazy-loaded locale names
  • #6404 Fix parsing issue with eHHmm format
  • #6433 Ignore non-Moment arguments in min and max
  • #6434 Fix inherited lowercase long date formats
  • #6436 Reset locale parsing caches after updates
  • #6437 Fix weekday mismatch when the format only has part of a date
  • #6442 Fix locale('__proto__') corrupting the global locale
  • #6443 Avoid Object.assign in duration.humanize
  • #6446 Validate range when parsing a time zone offset
  • #6447 Include metadata in all-locales bundle
  • #6448 Apply postformat to locale relative time methods
  • #6450 Add stack traces to conditional deprecation warnings

New features

  • #6451 Add internal date-default hook for Moment Timezone
New locales

Updates to existing locales

  • #5404 Portuguese (Brazil) ('pt-br'): Fix wrong plural usage for time
  • #6197 Indonesian ('id'): Correct the abbreviation for August
  • #6217 Georgian ('ka') and Dutch (Belgium) ('nl-be'): Correct L date formats
  • #6289 Swedish ('sv'): Correct the abbreviation for Thursday
  • #6306 Catalan ('ca'): Use typographic apostrophes in relative time
  • #6347 Swahili ('sw'): Correct the spelling of hour in calendar output
  • #6360 Ukrainian ('uk'): Use ISO week numbering
  • #6370 Ukrainian ('uk'): Use U+02BC apostrophes in Friday names
  • #6371 Hungarian ('hu'): Preserve numeric values in relative seconds
  • #6391 Swahili ('sw'): Fix weekday and relative-time grammar
  • #6396 German ('de', 'de-at', 'de-ch'): Parse short months without trailing dots
  • #6409 Uzbek ('uz', 'uz-latn'): Fix past relative-time formatting
  • #6410 Polish ('pl'): Use genitive month names in dotted day formats

2.30.1

Note - this was not a new release, but rather just updating GitHub's latest release to indicate the existing version 2.30.1 from Dec 27, 2023.

... (truncated)

Changelog

Sourced from moment's changelog.

2.31.0

Released Sep 14, 2026

Security fixes

Bug fixes

  • #6376 Prevent object prototype properties from being used as format tokens
  • #6386 Normalize lazy-loaded locale names
  • #6404 Fix parsing issue with eHHmm format
  • #6433 Ignore non-Moment arguments in min and max
  • #6434 Fix inherited lowercase long date formats
  • #6436 Reset locale parsing caches after updates
  • #6437 Fix weekday mismatch when the format only has part of a date
  • #6442 Fix locale('__proto__') corrupting the global locale
  • #6443 Avoid Object.assign in duration.humanize
  • #6446 Validate range when parsing a time zone offset
  • #6447 Include metadata in all-locales bundle
  • #6448 Apply postformat to locale relative time methods
  • #6450 Add stack traces to conditional deprecation warnings

New features

  • #6451 Add internal date-default hook for Moment Timezone
New locales

Updates to existing locales

  • #5404 Portuguese (Brazil) ('pt-br'): Fix wrong plural usage for time
  • #6197 Indonesian ('id'): Correct the abbreviation for August
  • #6217 Georgian ('ka') and Dutch (Belgium) ('nl-be'): Correct L date formats
  • #6289 Swedish ('sv'): Correct the abbreviation for Thursday
  • #6306 Catalan ('ca'): Use typographic apostrophes in relative time
  • #6347 Swahili ('sw'): Correct the spelling of hour in calendar output
  • #6360 Ukrainian ('uk'): Use ISO week numbering
  • #6370 Ukrainian ('uk'): Use U+02BC apostrophes in Friday names
  • #6371 Hungarian ('hu'): Preserve numeric values in relative seconds
  • #6391 Swahili ('sw'): Fix weekday and relative-time grammar
  • #6396 German ('de', 'de-at', 'de-ch'): Parse short months without trailing dots
  • #6409 Uzbek ('uz', 'uz-latn'): Fix past relative-time formatting
  • #6410 Polish ('pl'): Use genitive month names in dotted day formats

2.30.1

... (truncated)

Commits
  • 15b45d4 [pkg] Build 2.31.0 (#6452)
  • 631cd81 [pkg] Update changelog for upcoming release (#6394)
  • 6caff9e Merge commit from fork
  • 710703b [feature] Add internal date-default hook for Moment Timezone (#6451)
  • 863ed94 [bugfix] Add stack traces to conditional deprecation warnings (#6450)
  • 2c7abe1 [bugfix] Apply postformat to locale relative time methods (#6448)
  • 9c45ac3 [bugfix] Include metadata in all-locales bundle (#6447)
  • f6eefc5 [bugfix] Validate timezone offset range (#6446)
  • 136b441 [bugfix] Avoid Object.assign in duration.humanize (#6443)
  • 0d10504 [bugfix] Fix locale('proto') corrupting the global locale (#6442)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for moment since your current version.


Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 30, 2026
@dependabot
dependabot Bot requested a review from jdstrand as a code owner September 30, 2026 20:51
@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Sep 30, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner September 30, 2026 20:51
@jdstrand
jdstrand added this pull request to the merge queue Oct 1, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Oct 1, 2026
@jdstrand
jdstrand added this pull request to the merge queue Nov 4, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Nov 4, 2026
@jdstrand
jdstrand added this pull request to the merge queue Nov 4, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Nov 4, 2026
@jdstrand

jdstrand commented Nov 5, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
build(deps-dev): bump moment from 2.29.4 to 2.31.0
7c7bac1 
Bumps [moment](https://github.com/moment/moment) from 2.29.4 to 2.31.0.
- [Release notes](https://github.com/moment/moment/releases)
- [Changelog](https://github.com/moment/moment/blob/develop/CHANGELOG.md)
- [Commits](moment/moment@2.29.4...2.31.0)

---
updated-dependencies:
- dependency-name: moment
  dependency-version: 2.31.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/moment-2.31.0 branch from 6d384db to 7c7bac1 Compare November 5, 2026 18:46
@jdstrand
jdstrand added this pull request to the merge queue Nov 5, 2026
Merged via the queue into master with commit 4ab2a5f Nov 5, 2026
7 checks passed
@jdstrand
jdstrand deleted the dependabot/npm_and_yarn/moment-2.31.0 branch November 5, 2026 20:31
jdstrand added a commit that referenced this pull request Nov 9, 2026
@jdstrand @blegesse-w
@claude @dependabot
chore: cherry-pick or apply various dependency updates from master (#…
97cfc4f 
…7247)

* fix(docker): install yarn explicitly in the prod image build (#7244)

The production Dockerfile relied on the node:lts-alpine base image
bundling Yarn v1. On 2026-10-28 that tag moved to Node 26, and the
official node images no longer ship Yarn v1 as of Node 26.0.0. Every
monitor-ci build-image, build-oss-image and build-prod-image job has
since failed with `/bin/sh: yarn: not found`, which blocks every PR in
the merge queue.

Install yarn with npm before the install step so the build no longer
depends on what the base image happens to bundle. Verified locally that
the prod image builds end to end on Node 26 with this change.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* build(deps): bump immutable from 4.3.8 to 4.3.9 (#7202)

Bumps [immutable](https://github.com/immutable-js/immutable-js) from 4.3.8 to 4.3.9.
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v4.3.8...v4.3.9)

---
updated-dependencies:
- dependency-name: immutable
  dependency-version: 4.3.9
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump svgo from 2.8.2 to 2.8.3 (#7207)

Bumps [svgo](https://github.com/svg/svgo) from 2.8.2 to 2.8.3.
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v2.8.2...v2.8.3)

---
updated-dependencies:
- dependency-name: svgo
  dependency-version: 2.8.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump websocket-driver from 0.7.4 to 0.7.5 (#7197)

Bumps [websocket-driver](https://github.com/faye/websocket-driver-node) from 0.7.4 to 0.7.5.
- [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md)
- [Commits](faye/websocket-driver-node@0.7.4...0.7.5)

---
updated-dependencies:
- dependency-name: websocket-driver
  dependency-version: 0.7.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump nanoid from 3.2.0/3.3.8 to 3.3.20

* build(deps): bump brace-expansion from 1.1.7 to 1.1.21

* build(deps): bump dompurify from 3.4.12 to 3.4.17

* build(deps): bump browserslist from 4.21.4 to 4.29.5

* build(deps): bump fflate from 0.8.2 to 0.8.3

* build(deps): bump svgo from 2.8.3 to 2.8.4 (#7223)

Bumps [svgo](https://github.com/svg/svgo) from 2.8.3 to 2.8.4.
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v2.8.3...v2.8.4)

---
updated-dependencies:
- dependency-name: svgo
  dependency-version: 2.8.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump proxy-addr from 2.0.7 to 2.0.8 (#7234)

Bumps [proxy-addr](https://github.com/jshttp/proxy-addr) from 2.0.7 to 2.0.8.
- [Release notes](https://github.com/jshttp/proxy-addr/releases)
- [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md)
- [Commits](jshttp/proxy-addr@v2.0.7...v2.0.8)

---
updated-dependencies:
- dependency-name: proxy-addr
  dependency-version: 2.0.8
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump source-map-js from 1.0.2 to 1.2.2 (#7235)

Bumps [source-map-js](https://github.com/7rulnik/source-map-js) from 1.0.2 to 1.2.2.
- [Release notes](https://github.com/7rulnik/source-map-js/releases)
- [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md)
- [Commits](7rulnik/source-map-js@v1.0.2...v1.2.2)

---
updated-dependencies:
- dependency-name: source-map-js
  dependency-version: 1.2.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump compression from 1.8.1 to 1.8.2

* build(deps): bump postcss from 8.4.31 to 8.5.31

* build(deps): bump follow-redirects from 1.15.4 to 1.16.2

* build(deps-dev): bump moment from 2.29.4 to 2.31.0 (#7229)

Bumps [moment](https://github.com/moment/moment) from 2.29.4 to 2.31.0.
- [Release notes](https://github.com/moment/moment/releases)
- [Changelog](https://github.com/moment/moment/blob/develop/CHANGELOG.md)
- [Commits](moment/moment@2.29.4...2.31.0)

---
updated-dependencies:
- dependency-name: moment
  dependency-version: 2.31.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump postcss-selector-parser from 6.0.7 to 6.1.5 (#7242)

Bumps [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) from 6.0.7 to 6.1.5.
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/6.1.5/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@v6.0.7...6.1.5)

---
updated-dependencies:
- dependency-name: postcss-selector-parser
  dependency-version: 6.1.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump uuid from 9.0.0 to 14.0.0

* chore: use "mocha/**/nanoid": "^3.3.8" in package.json

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Bethelhem Legesse <legessebl@gmail.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jdstrand jdstrand jdstrand approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jdstrand