Skip to content

fix(deps): update dependency luxon to v2.5.2 [security] #325

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(deps): update dependency luxon to v2.5.2 [security] #325

wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Mar 16, 2023 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
luxon 2.1.1 -> 2.5.2 age confidence

GitHub Vulnerability Alerts

CVE-2023-22467

Impact

Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks.

This is the same bug as Moment's GHSA-wc69-rhjr-hc9g

Workarounds

Limit the length of the input.

References

There is an excellent writeup of the same issue in Moment: https://github.com/moment/moment/pull/6015#issuecomment-1152961973

Details

DateTime.fromRFC2822("(".repeat(500000)) takes a couple minutes to complete.

Release Notes

moment/luxon (luxon)

v2.5.2

Compare Source

v2.5.1

Compare Source

v2.5.0

Compare Source

  • Support for ESM-style node imports
  • Fix Wednesday parsing for RFC 850 strings
  • Increase number of digits allowed in ISO durations

2.4.0 (2022-05-08)

  • Add support for parsing the ISO zone extension, like 2022-05-08T20:42:00.000-04:00[America/New_York]
  • Add an extendedZone option to toISO() and toISOTime
  • Improvements to DateTime.isInDST()
  • Fix for parsing in Vietnames (and probably other languages)

2.3.2 (2022-04-17)

  • Fix timezone calculations for negative years
  • add week formatting token "w" for durations
  • fix weekday computation for years 0-100

2.3.1 (2022-02-23)

  • Added an includeOffsetSpace option to toSQL and toSQLTime
  • Added toUnixInteger
  • Don't use -0 when negating durations with zeros in them

2.3.0 (2022-01-02)

  • Major perf improvements to toISO(), toISODate(), toISOTime(), and toSQLDate()
  • Fixed date padding for negative years in toISO()
  • Added Duration#toHuman()

2.2.0 (2021-12-10)

  • Allow offsets to pick among ambiguous times when both an offset and zone are provided to fromFormat
  • Fix a floating point bug in Duration.shiftTo()

2.1.1 (2021-11-08)

  • Fix issue in quirky environments that lack hourCycle support and sometimes computed offsets 12 hours off

2.1.0 (2021-11-07)

  • Stop special casing of Etc/GMT* zones
  • export fromDurationLike
  • memoize zone validation
  • Support for fractional elements in duration ISO parsing
  • Added uu and uuu tokens for fractional millisecond parsing

2.0.2 (2021-08-08)

Fix locale defaulting

2.0.0 (2021-07-3)

See Upgrading section

1.28.0 (2021-07-03)

  • Fix ISO parsing for offset specifiers in Year-Ordinal formats

1.27.0 (2021-05-08)

  • Fix GMT zone parsing for older versions of Node
  • Support multiple units in toRelative
  • Various documentation updates

1.26.0 (2021-02-13)

  • Add fromISOTime, toISOTime and toMillis to Duration (#​803)
  • Fix padding of negative years in IsoDate (#​871)
  • Fix hasSame unit comparison (#​798)
  • Export VERSION information (#​794)
  • Durations are considered equal with extra zero units. Fixes #​809 (#​811)

1.25.0 (2020-08-23)

  • fix fromFormat with Intl formats containing non-breaking spaces
  • Support higher precision in ISO milliseconds
  • Some fixes for 00:30 timezones
  • Fix some throwOnInvalid for invalid Intervals
  • Various doc fixes
  • Fix Interval#isSame for empty intervals
  • Mark package as side effect-free
  • Add support for intervals with a large number of seconds

1.24.1 (2020-05-04)

  • Remove erroneous console.log call

1.24.0 (2020-05-03)

  • Update polyfills for pollyfilled build

1.23.0 (2020-04-02)

  • Allow minus sign prefix when creating Duration from ISO

1.22.2 (2020-03-25)

  • Added more details to error messages for type errors

1.22.1 (2020-03-19)

  • Added support for ISO basic format to DateTime#toISO

1.22.0 (2020-01-26)

  • Fix setZone's handling of pre-1970 dates with millisecond components
  • Fix keepLocalTime for large jumps near the target zone's DST
  • Fix cache perf for toRelative()

1.21.3 (2019-11-28)

  • Fix parsing of meridiems in macro tokens in newer versions of v8

1.21.2 (2019-11-18)

  • Fix bug in Chrome Canary that threw off time zone calculations

1.21.1 (2019-11-03)

  • Fix for quarter parsing
  • Some documentation updates

1.21.0 (2019-10-30)

  • Added quarter support to the parser
  • Fix some rounding issues in ISO formatting

1.20.0 (2019-10-29)

  • Added Duration#mapUnits
  • added Interval#toISODate and Interval#toISOTime
  • Some documentation fixes

1.19.3

  • Cache offset values
  • Fix handling of negative sub 1-hour offsets

1.19.2

  • Speculative fix for Node 6

1.19.1

  • Fix Intl.DateTimeFormat usage for polyfills

1.19.0

  • Interval#splitAt now ignores input dates outside the interval
  • Don't allow decimals in DateTime creation

1.18.2

  • Fix handling of decimals in DateTime#plus and #minus

1.18.1

  • Fix validity when adding or subtracting time that exceeds Date max/min boundaries

1.18.0

  • Add support for macro tokens in the parser

1.17.2

  • Fix issue with toRelative using style: short with plural days

1.17.1

  • Reject out-of-range numbers in DateTime.fromMillis
  • Reject 0s in ISO date inputs

1.17.0

  • DateTime.min and DateTime.max throw if they get the wrong kind of arguments
  • Fixed throwOnInvalid logic for Interval
  • Added DATETIME_MED_WITH_WEEKDAY preset

1.16.1

  • Catch errors trying to use Intl in weird versions of IE 11

1.16.0

  • Fixed locale default logic for `DateTime#toFormat("ZZZZ")

1.15.0

  • Added formatOffset to Zones

1.14.0

  • Allow the zone argument to Interval.fromISO with duration components
  • Ignore the zone argument to Duration factory methods

1.13.3

  • Fix keepLocalTime calculations that span offset changes

1.13.2

  • Fixed ISO formatting for dates > 999

1.13.1

  • Performance improvements for regex parsing

1.13.0

  • Support numberSystem in fromFormat
  • Fix validity for bad initial zone specifiers

1.12.1

  • Fix cross-month diffs in some scenarios
  • Fix time zone parsing when the time zone isn't at the end
  • Memoize IANA zone creation

1.12.0

  • Add some explicit CDN support to the NPM package
  • Add week token to duration ISO support
  • Lots of cleanup and test coverage changes

1.11.4

  • setZone("local") now returns the defaultZone if it is set
  • Fixes for the polyfilled build

1.11.3

  • Allow 24:00 in ISO (and other) strings
  • Fix some bugs with the typecheck functions like DateTime.isDateTime()

1.11.2

  • Fixed handling of some characters in fromFormat literal sections
  • Handle string values in object arguments to DateTime methods
  • Fixed toRelativeCalendar's handling of zones in the base date

1.11.1

  • Fix DateTime#plus() when spanning across AD 100

1.11.0

  • Fix low-year handling for IANA zones
  • DateTime#toLocal() now uses the default locale
  • Fix zero duration formatting
  • Many documentation fixes

1.10.0

  • Fix endOf("day") during DSTs (#​399)
  • Add `Interval#mapEndpoints (#​400)
  • Add DateTime#zone and Info.normalizeZone (#​404)

1.9.0

  • Add DateTime#toRelative and DateTime#toRelativeCalendar

1.8.3

  • Allow "UTC" in the zone position of fromSQL
  • Force isDateTime and isDuration to return booleans in all cases

1.8.2

  • Trim leading \u200e characters from offset names in Edge 16 and 17

1.8.1

  • Add DateTime.fromSeconds and DateTime#toSeconds

1.7.1

  • Floor the seconds instead of rounding them when outputting the 'X' format
  • Change the options to toLocale to override the configuration (the previous options were essentially ignored)

1.6.2

  • Fixing merge error that resulted in bad error messages

1.6.0

  • midly breaking Rework negative durations
  • Fix handling

v2.4.0

Compare Source

  • Add support for parsing the ISO zone extension, like 2022-05-08T20:42:00.000-04:00[America/New_York]
  • Add an extendedZone option to toISO() and toISOTime
  • Improvements to DateTime.isInDST()
  • Fix for parsing in Vietnames (and probably other languages)

v2.3.2

Compare Source

  • Fix timezone calculations for negative years
  • add week formatting token "w" for durations
  • fix weekday computation for years 0-100

v2.3.1

Compare Source

  • Added an includeOffsetSpace option to toSQL and toSQLTime
  • Added toUnixInteger
  • Don't use -0 when negating durations with zeros in them

v2.3.0

Compare Source

  • Major perf improvements to toISO(), toISODate(), toISOTime(), and toSQLDate()
  • Fixed date padding for negative years in toISO()
  • Added Duration#toHuman()

v2.2.0

Compare Source

  • Allow offsets to pick among ambiguous times when both an offset and zone are provided to fromFormat
  • Fix a floating point bug in Duration.shiftTo()

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/npm-luxon-vulnerability branch from 5799c43 to 7917b1d Compare August 11, 2025 03:53
@renovate
Copy link
Contributor Author

renovate bot commented Aug 11, 2025

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml
 WARN  GET https://registry.npmjs.org/@babel/core/-/core-7.15.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@commitlint/cli/-/cli-13.1.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@commitlint/config-conventional/-/config-conventional-13.1.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@types/gtag.js/-/gtag.js-0.0.8.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@types/luxon/-/luxon-2.0.7.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@types/node/-/node-14.17.34.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@types/react/-/react-17.0.18.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-4.33.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@typescript-eslint/parser/-/parser-4.33.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/babel-loader/-/babel-loader-8.2.2.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/babel-preset-react-app/-/babel-preset-react-app-10.0.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/cross-env/-/cross-env-7.0.3.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/eslint/-/eslint-7.32.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/eslint-config-next/-/eslint-config-next-11.1.2.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-7.2.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/luxon error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@babel/core/-/core-7.15.0.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/@commitlint/cli/-/cli-13.1.0.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/@commitlint/config-conventional/-/config-conventional-13.1.0.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/@types/gtag.js/-/gtag.js-0.0.8.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/@types/luxon/-/luxon-2.0.7.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/@types/node/-/node-14.17.34.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/@types/react/-/react-17.0.18.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-4.33.0.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/@typescript-eslint/parser/-/parser-4.33.0.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/babel-loader/-/babel-loader-8.2.2.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/babel-preset-react-app/-/babel-preset-react-app-10.0.0.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/cross-env/-/cross-env-7.0.3.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/eslint/-/eslint-7.32.0.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/eslint-config-next/-/eslint-config-next-11.1.2.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-7.2.0.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/luxon error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/eslint-plugin-prettier/-/eslint-plugin-prettier-4.0.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 ERR_INVALID_THIS  Value of "this" must be of type URLSearchParams
 WARN  GET https://registry.npmjs.org/husky/-/husky-4.3.8.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/lint-staged/-/lint-staged-11.1.2.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/npm-run-all/-/npm-run-all-4.1.5.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/prettier/-/prettier-2.3.2.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/prettier-plugin-tailwindcss/-/prettier-plugin-tailwindcss-0.1.8.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/rehype/-/rehype-12.0.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/tsconfig-paths-webpack-plugin/-/tsconfig-paths-webpack-plugin-3.5.2.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/typescript/-/typescript-4.5.2.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/whatwg-fetch/-/whatwg-fetch-3.6.2.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@mdx-js/react/-/react-1.6.22.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@octokit/graphql/-/graphql-4.8.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@plaiceholder/base64/-/base64-1.0.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@tailwindcss/typography/-/typography-0.5.2.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.3.1.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/docx/-/docx-7.3.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants