Update from moment 2.19.2

Moment is affected by CVE2017-18214 (DoS via crafted date string). Not only is it a dev dependency, sunder does not use this functionality and therefore shouldn't be affected. To avoid receiving and ignoring security notifications, version bump of concurrently is non-trivial and requires code changes. Overriding and bumping version of moment in `package.json` appears to be an easy fix.
freedomofpress · Mar 6, 2018 · 2795f29 · 2795f29
1 parent 6a330b4
commit 2795f29
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 5 deletions.
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -84,6 +84,7 @@
     "minimist": "^1.2.0",
     "mocha": "^3.3.0",
     "mockery": "^1.6.2",
+    "moment": "^2.19.3",
     "node-sass": "^3.4.2",
     "nyc": "^10.3.0",
     "react-addons-test-utils": "^15.0.0",