moment package upgraded to the latest version.

[MEGApixel23]

No description provided.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: MEGApixel23 / name: Igor Omelchenko (8ac17fe, a8ad808)

[milakucher]

hi there!
any ideas when this can be merged? :)

[sergei-lobanov]

any updates on this?

[senthur-kumaran]

Any update about this PR merge? Because this version upgrade fixes the vulnerability issue.

[gilmoreorless]

Just to be clear, moment-timezone itself doesn't have a vulnerability. Automated tools are only complaining because its dependency on moment is accurately stating that it will work with any version from 2.9.0 onwards (as mentioned at #997 (comment)).

New installs of moment-timezone using npm or yarn should include the latest version of moment anyway. Existing vulnerable versions can easily be upgraded using npm audit fix or similar tools (e.g. npx yarn-deduplicate). Therefore it isn't critical to update the dependency definition in package.json — it's mostly just wanted to silence automated security tools.

@ichernev has stated a few times that he doesn't want to bump this dependency version (#991 (comment), #997 (comment), #979 (comment)). He's been part of the Moment team for a long time, so I generally defer to his judgement.

Personally though, I know just how irritating those automated security warnings can be, and they'll only continue to nag. As far as I know, the dependencies field in package.json really only affects people using package managers like npm, yarn, etc. It doesn't stop people from using a different version of moment if they want.

The documentation still says it can work with core Moment >= 2.9.0. I'm thinking we should probably just merge this, then revisit plans to move moment to peerDependencies instead.

@ichernev your thoughts?

[gilmoreorless]

After some discussions outside GitHub, I've decided to go ahead with this dependency bump, and accelerate plans to use peerDependencies instead. There have been several dev dependency updates since this PR was created, causing conflicts. I've manually merged this change in 8080504, leaving @MEGApixel23 as co-author.

I'll try to get a new release of moment-timezone out soon because I want to decouple this version bump from any data updates. February is generally quiet for tzdb data updates, but March usually has at least one data update, so I'm expecting to need a separate data-based release sometime in the next month.