High security vulnerabilities in versions 1.0.1 to 2.29.3

[richbirch]

The latest version of scala-js-momentjs uses momentjs 2.22.2, which suffers from the following two vulnerabilities:

• https://nvd.nist.gov/vuln/detail/CVE-2022-24785
• https://nvd.nist.gov/vuln/detail/CVE-2022-31129

These are scored as high. As such an upgrade to a version of at least 2.29.4 is required urgently

[richbirch]

I have a fix for this issue. I don't have permission to create a branch to submit a PR from though..

build.sbt:

val MomentVersion = ">=2.29.4"
val MomentTimezoneVersion = "0.5.35"
val ScalaTestVersion = "3.2.13"

lazy val npmDeps = Seq(
  "moment" -> MomentVersion,
  "moment-timezone" -> MomentTimezoneVersion,
)

[vpavkin]

@richbirch thank you. you can always fork and send a PR from your fork. This is the default workflow scala OSS projects usually have

[richbirch]

Thank you for educating me :) Pull request submitted