search

urish / angular-moment

Moment.JS directives for Angular.JS (timeago and more)
MIT License
2.6k stars 397 forks source link

Update moment.js version #300

Closed jc1arke closed 6 years ago

jc1arke commented 6 years ago

This is to help with nsp check failing, specifically for https://nodesecurity.io/advisories/532

coveralls commented 6 years ago

Coverage Status

Coverage remained the same at 93.243% when pulling 3563b8e7ce73d2d6746a6b43b6f0e45ef0325171 on jc1arke:master into e66b224adca5dfee9b2f7469ccc45511af702057 on urish:master.

jc1arke commented 6 years ago

@urish can you please have a look at this, it's causing builds depending on angular-moment to fail with NSP

urish commented 6 years ago

Hi, thank you for the PR! Can you please explain what is the problem with moment 2.8.x?

jc1arke commented 6 years ago

@urish it's based of off the NSP CVE (https://nodesecurity.io/advisories/532). What was happening was that a ReDoS had slipped through, and builds would fail (see screenshot).

It was fixed via pull request https://github.com/moment/moment/pull/4326 with the issue logged on https://github.com/moment/moment/issues/4163

screen shot 2017-11-30 at 11 48 11
urish commented 6 years ago

Got it, thanks

urish commented 6 years ago

Released as 1.2.0