CodeVetter
← All unpacks
CodeVetter · Repo Unpack evidence

moment/luxon

Scanned commit f427515a38 dated 2026-08-09 — last upstream commit. Generated by codevetter 1.15.0 on 2026-10-02.

github.com/moment/luxon ↗ · 150 files · 850 KB

Luxon [![MIT License][license-image]][license] [![Build Status][github-action-image]][github-action-url] [![NPM version][npm-version-image]][npm-url] [![Coverage Status][test-coverage-image]][test-coverage-url] [![PRs welcome][contributing-image]][contributing

Deep analysis by cli:codex via the codex CLI on 2026-10-02 (363s) — every claim below links to its cited source files. Source inspection; upstream code and tests were not executed.

Overview

Luxon 3.7.2 is a JavaScript library for developers who need explicit, immutable APIs for dates, durations, and time intervals. It combines standard and token-based parsing, calendar-aware arithmetic, serialization, and localized formatting with time-zone and locale data supplied by the host's Date and Intl implementations. This brief examines commit f427515a38f6a671f8de663e6bcc040ed81f114e through public source reads; tests, builds, and CI were inspected, not executed.

System map

The main product is an embeddable library whose public entrypoint exports temporal types and configuration APIs. Implementation modules separate parsing, calendar conversion, formatting, locale handling, and zone behavior. Runtime state consists of object fields, global defaults, and caches; serialization returns values to the caller. Build tooling produces several JavaScript distributions, while a separate static site supplies documentation and examples.

Feature catalog

Luxon's user-facing surface is primarily its JavaScript API. DateTime handles construction, parsing, transformations, formatting, and interoperability; Duration models quantities, and Interval models bounded spans. Info exposes locale and zone metadata, while Settings controls defaults and invalid-value policy. The companion site provides searchable guides, API documentation, runnable examples, and a persistent theme preference.

Data flow

Inputs enter through explicit factories and are normalized into calendar fields, unit quantities, or endpoints. Parsing carries extracted zones separately from date fields before construction resolves defaults, validates data, and computes a timestamp. Transformations create new temporal objects, with calendar arithmetic distinguished from elapsed-time arithmetic. Output methods emit strings, numbers, objects, or native Dates; durable storage remains the caller's responsibility.

Behavior traces

These traces follow implementation order from public calls to outputs. Construction and parsing resolve zone, locale, validity, and timestamp before later operations run. Arithmetic revisits zone offsets after calendar and elapsed-time changes, while formatting crosses into native Intl. Serialization supplies a caller-owned persistence boundary; the documentation theme is a separate concrete browser-storage flow.

Testing signals

Tests and CI were inspected, not executed; no passing result or measured coverage is asserted. Jest runs in Node with Babel transformation and coverage collection from source files. Inspected suites cover parsing, DST, localization, duration conversion, interval semantics, and selected fallback behavior. This inventory is bounded: browser rendering, published bundle loading, and release behavior are outside the configured source-test scope.

Risk map

These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. The main runtime sensitivities are host Intl behavior, shared caches/defaults, DST ambiguity, and inputs that drive interval iteration. Security-relevant execution boundaries appear in the demonstration site and CI/deployment tooling. Compatibility claims and operational scripts require separate verification before relying on them.

Extension points

Extension primarily happens through configuration, factories, callback transformations, and explicit implementation tables. Zone is the clearest public behavioral interface, while Duration accepts custom conversion matrices and DateTime offers reusable token parsers. Parsing and formatting additions require coordinated changes rather than a dynamic registration API. Build targets and documentation plugins have separate, concrete integration points.

Contributor handoff

Begin with the public exports and actual package/test/build configuration, then follow the relevant factory through implementation helpers and its matching tests. Preserve explicit parsing, immutable transformations, half-open interval semantics, and calendar-versus-elapsed arithmetic. Tests and CI were inspected, not executed; this bounded brief supplies no passing status or exhaustive coverage guarantee. Under this task's authority, continue read-only investigation and reserve implementation or execution for a separately authorized task.

Languages

LanguageFilesShare of source
JavaScript96100%
Markdown24docs/config
HTML3docs/config
JSON3docs/config
CSS2docs/config
YAML2docs/config

Start reading here

Probable source entrypoint: src/ — inferred from the directory tree and manifest, not the upstream docs.

Source roots

src/ (25 files)

Source layout — src/

PathFiles
src/impl/12
src/zones/4
src/datetime.js1
src/duration.js1
src/errors.js1
src/info.js1
src/interval.js1
src/luxon.js1
src/package.json1
src/settings.js1
src/zone.js1

Repository structure

Top-level pathFiles
test/60
src/25
docs/14
site/11
scripts/9
tasks/4
docker/4
benchmarks/4

Docs found: CONTRIBUTING.mdLICENSE.mdREADME.mddocs/calendars.mddocs/formatting.mddocs/home.mddocs/install.mddocs/intl.mddocs/math.mddocs/matrix.md

Package

package.json — luxon v3.7.2, 20 declared dependencies.

@babel/core@babel/node@babel/plugin-external-helpers@babel/preset-env@rollup/plugin-babel@rollup/plugin-commonjs@rollup/plugin-node-resolvebabel-jestbenchmarkcodecovdocumentationfs-extra

CI & config entrypoints

Structural health signals

Average score 8.7/10 across 96 analyzed source files; 4 hotspots surfaced.

These are deterministic review leads — size, churn, and structural signals — not proof of a bug in this project.

Recent history