CodeVetter
← All unpacks
CodeVetter · Repo Unpack evidence

iamkun/dayjs

Scanned commit 436bde0bcd dated 2026-09-15 — last upstream commit. Generated by codevetter 1.15.0 on 2026-10-02.

github.com/iamkun/dayjs ↗ · 375 files · 780 KB

English | 简体中文 | 日本語 | Português Brasileiro | 한국어 | Español (España) | Русский | Türkçe | සිංහල | עברית Fast 2kB alternative to Moment.js with the same modern API Day.js is a minimalist JavaScript library that parses, validates, manipulates, and displays dates

Deep analysis by cli:codex via the codex CLI on 2026-10-02 (349s) — every claim below links to its cited source files. Source inspection; upstream code and tests were not executed.

Overview

Day.js is a JavaScript date and time library for developers who want a chainable, largely Moment-compatible API with immutable operations by default. Its core wraps native Date objects, while separately loaded plugins add format parsing, durations, timezone conversion, calendar queries, and other capabilities. Locale modules supply translated names and formatting rules; the build produces a minified UMD library, separate plugin and locale bundles, ESM files, and TypeScript declarations.

System map

The runtime is a callable factory backed by one Dayjs class and shared locale state. Core date operations use native Date, constants, and a small utility module; plugins extend the same class and factory. Packaging separates the core from optional plugins and locales and supplies declarations for JavaScript consumers using TypeScript. GitHub Actions defines development checks and a separate master release pipeline.

Feature catalog

The public surface centers on parsing, immutable manipulation, comparison, formatting, and serialization. Optional modules broaden input types, calendar calculations, translated output, timezone handling, and duration arithmetic. Compatibility plugins add aliases or deliberately change mutation behavior. The following eight groups cover the inspected core and plugin APIs; these are library capabilities rather than application screens or routes.

Data flow

Inputs pass through the factory and an overridable parsing boundary into native Date state. Cached fields drive most calendar operations and display, while valueOf provides the epoch boundary for comparisons and elapsed-time calculations. Clones retain locale and extension metadata, and optional plugins reinterpret parsing, offsets, or output. Serialization returns values to the caller; the inspected runtime does not implement durable persistence.

Behavior traces

Eight traces follow concrete public operations through their implementation branches. They cover initial construction, calendar manipulation, locale registration, strict parsing, timezone parsing/conversion, durations, and serialization. Each trace describes source execution order rather than an observed runtime result. Persistence here is the caller-facing serialization boundary.

Testing signals

Tests and CI were inspected, not executed; no passing result or measured coverage is asserted. Jest covers core and plugin behavior, frequently comparing against Moment and using MockDate to control time. The npm test script runs explicit host-timezone matrices before requesting full line coverage. Browser and declaration checks have narrower scopes, and this inventory is bounded rather than exhaustive coverage.

Risk map

These are source observations and explicitly identified hypotheses, not confirmed vulnerabilities. The inspected runtime paths principally expose parsing and shared extension state; filesystem mutation and release credentials appear in tooling boundaries. Calendar correctness depends on native Date, Intl data, offset bookkeeping, and plugin composition. Existing regression tests constrain some of these behaviors but were not run.

Extension points

The main extension contract is a plugin function that can modify the class, factory, and shared utilities. Locale objects supply data and callbacks independently of the core bundle. TypeScript declarations extend public interfaces separately from implementation. Build discovery automatically packages conventionally placed modules, making file naming and registration conventions part of the extension surface.

Contributor handoff

Begin with the factory, utilities, constants, and the implementation/declaration/test trio for the target API. Preserve immutable defaults, calendar-versus-elapsed arithmetic, and plugin delegation order. Tests and CI were inspected, not executed, and any later validation must distinguish configured checks from observed results. This brief is a bounded source investigation; it neither establishes exhaustive coverage nor authorizes build, installation, or release actions.

Languages

LanguageFilesShare of source
JavaScript28388%
TypeScript4012%
Markdown39docs/config
YAML4docs/config
JSON2docs/config

Start reading here

Probable source entrypoint: src/ — inferred from the directory tree and manifest, not the upstream docs.

Source roots

src/ (184 files)

Source layout — src/

PathFiles
src/locale/143
src/plugin/19

Repository structure

Top-level pathFiles
src/184
test/95
types/40
docs/37
.github/5
patches/1

Docs found: CONTRIBUTING.mdREADME.mddocs/en/API-reference.mddocs/en/I18n.mddocs/en/Installation.mddocs/en/Plugin.mddocs/es-es/API-reference.mddocs/es-es/I18n.mddocs/es-es/Installation.mddocs/es-es/Plugin.md

Package

package.json — dayjs v0.0.0-development, 30 declared dependencies.

@babel/cli@babel/core@babel/node@babel/preset-env@semantic-release/githubbabel-corebabel-jestbabel-plugin-external-helperscross-enveslinteslint-config-airbnb-baseeslint-plugin-import

CI & config entrypoints

Structural health signals

Average score 8.6/10 across 96 analyzed source files; 0 hotspots surfaced.

These are deterministic review leads — size, churn, and structural signals — not proof of a bug in this project.

Recent history