# Risk map — moment/luxon

> Canonical page: https://codevetter.com/unpack/luxon/risk-map

# Risk map — moment/luxon

Scanned commit f427515a38f6a671f8de663e6bcc040ed81f114e (2026-08-09). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. The main runtime sensitivities are host Intl behavior, shared caches/defaults, DST ambiguity, and inputs that drive interval iteration. Security-relevant execution boundaries appear in the demonstration site and CI/deployment tooling. Compatibility claims and operational scripts require separate verification before relying on them.
- CI executes a remotely fetched Codecov shell script via bash process substitution; the inspected workflow supplies no content hash for that fetched script. — [.github/workflows/test.yml#L33-L38](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/.github/workflows/test.yml#L33-L38)
- deploy-site sources .env or a supplied configuration file as shell code, accepts configurable deployment directories/remotes, rewrites Git branch/index state, and commits/pushes; it is an operational execution boundary, not a read-only helper. — [scripts/deploy-site#L28-L38](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/scripts/deploy-site#L28-L38) [scripts/deploy-site#L67-L79](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/scripts/deploy-site#L67-L79) [scripts/deploy-site#L135-L167](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/scripts/deploy-site#L135-L167)
- The demo evaluates code and interpolates results into innerHTML, but the inspected callers supply hard-coded example strings; user-controlled execution or injection is not established by this source. — [site/demo/demo.js#L6-L36](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/site/demo/demo.js#L6-L36) [site/demo/demo.js#L40-L85](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/site/demo/demo.js#L40-L85) [site/demo/demo.js#L87-L94](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/site/demo/demo.js#L87-L94)
- Runtime behavior depends on host Intl support and data: IANA offsets contain formatToParts/legacy-format branches, while interval localization directly calls Intl.DateTimeFormat.formatRange without a fallback in that method. — [src/zones/IANAZone.js#L201-L232](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/src/zones/IANAZone.js#L201-L232) [src/impl/formatter.js#L120-L122](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/src/impl/formatter.js#L120-L122) [docs/why.md#L41-L45](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/docs/why.md#L41-L45)
- Locale's list-formatter cache is populated separately, but Locale.resetCache clears its other listed caches without clearing intlLFCache; resetCaches therefore does not reset every formatter cache shown here. — [src/impl/locale.js#L9-L17](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/src/impl/locale.js#L9-L17) [src/impl/locale.js#L364-L371](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/src/impl/locale.js#L364-L371) [src/settings.js#L174-L178](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/src/settings.js#L174-L178)
- Hypothesis: splitBy with a negative duration may fail to advance toward the interval end because its guard checks invalidity and zero length, while the loop keeps moving from the original start using increasing multiples; inspected split tests do not establish negative-input handling. (inferred) — [src/interval.js#L376-L394](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/src/interval.js#L376-L394) [test/interval/many.test.js#L325-L375](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/test/interval/many.test.js#L325-L375)
- Ambiguous local-time resolution is coupled to constructor choice and shared offset-cache history; the DST suite explicitly expects fromObject to use the current offset and local to retain a cached choice until reset. — [src/datetime.js#L103-L127](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/src/datetime.js#L103-L127) [src/datetime.js#L418-L434](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/src/datetime.js#L418-L434) [test/datetime/dst.test.js#L21-L68](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/test/datetime/dst.test.js#L21-L68)
- Compatibility guidance has drift: package.json declares Node >=12, the install guide still says Node 6+, CONTRIBUTING says tests require Node 18, Docker uses Node 15, and CI starts at Node 20. — [package.json#L67-L69](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/package.json#L67-L69) [docs/install.md#L24-L39](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/docs/install.md#L24-L39) [CONTRIBUTING.md#L16-L18](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/CONTRIBUTING.md#L16-L18) [docker/Dockerfile#L1-L8](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/docker/Dockerfile#L1-L8) [.github/workflows/test.yml#L20-L24](https://github.com/moment/luxon/blob/f427515a38f6a671f8de663e6bcc040ed81f114e/.github/workflows/test.yml#L20-L24)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)