CodeVetter · Repo Unpack · Risk map
moment/luxon
These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. The main runtime sensitivities are host Intl behavior, shared caches/defaults, DST ambiguity, and inputs that drive interval iteration. Security-relevant execution boundaries appear in the demonstration site and CI/deployment tooling. Compatibility claims and operational scripts require separate verification before relying on them.
- CI executes a remotely fetched Codecov shell script via bash process substitution; the inspected workflow supplies no content hash for that fetched script.
- deploy-site sources .env or a supplied configuration file as shell code, accepts configurable deployment directories/remotes, rewrites Git branch/index state, and commits/pushes; it is an operational execution boundary, not a read-only helper.
- The demo evaluates code and interpolates results into innerHTML, but the inspected callers supply hard-coded example strings; user-controlled execution or injection is not established by this source.
- Runtime behavior depends on host Intl support and data: IANA offsets contain formatToParts/legacy-format branches, while interval localization directly calls Intl.DateTimeFormat.formatRange without a fallback in that method.
- Locale's list-formatter cache is populated separately, but Locale.resetCache clears its other listed caches without clearing intlLFCache; resetCaches therefore does not reset every formatter cache shown here.
- Hypothesis: splitBy with a negative duration may fail to advance toward the interval end because its guard checks invalidity and zero length, while the loop keeps moving from the original start using increasing multiples; inspected split tests do not establish negative-input handling. (inferred)
- Ambiguous local-time resolution is coupled to constructor choice and shared offset-cache history; the DST suite explicitly expects fromObject to use the current offset and local to retain a cached choice until reset.
- Compatibility guidance has drift: package.json declares Node >=12, the install guide still says Node 6+, CONTRIBUTING says tests require Node 18, Docker uses Node 15, and CI starts at Node 20.