[Snyk] Security upgrade moment from 2.15.1 to 2.31.0

[aluca3]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Directory Traversal SNYK-JS-MOMENT-19821607	721

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[aluca3]

This upgrade is for a library that is officially in maintenance mode and no longer recommended for new projects. While there are no direct breaking API changes in this version range, the project's legacy status is a significant factor.

Key Points:

• Project Status: In 2020, the Moment.js team announced the project is in maintenance mode. They will not add new features, fix long-standing behavioral quirks, or improve bundle size. [4, 5]
• No Breaking API Changes: The upgrade from v2.15.1 to v2.31.0 does not contain breaking API changes; existing code should continue to function.
• Mutability: Moment objects are mutable, which is a common source of bugs. This will not be changed. [4]
• Bundle Size: The library does not support modern tree-shaking, which can negatively impact application bundle size. [4, 5]

Recommendation:
While this upgrade is not expected to break your application, it is strongly recommended to create a plan to migrate away from Moment.js to a modern alternative like Day.js, date-fns, or Luxon to avoid future technical debt. [1, 5]

Source: Moment.js Project Status

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.