Bump moment from 2.30.1 to 2.31.0 in /webapp

[dependabot]

Bumps moment from 2.30.1 to 2.31.0.

Release notes

Sourced from moment's releases.

2.31.0

Released Sep 14, 2026

Security fixes

• Fix CVE-2026-17495 (GHSA-4p3w-j4w9-5jqw)

Bug fixes

• #6376 Prevent object prototype properties from being used as format tokens
• #6386 Normalize lazy-loaded locale names
• #6404 Fix parsing issue with eHHmm format
• #6433 Ignore non-Moment arguments in min and max
• #6434 Fix inherited lowercase long date formats
• #6436 Reset locale parsing caches after updates
• #6437 Fix weekday mismatch when the format only has part of a date
• #6442 Fix locale('__proto__') corrupting the global locale
• #6443 Avoid Object.assign in duration.humanize
• #6446 Validate range when parsing a time zone offset
• #6447 Include metadata in all-locales bundle
• #6448 Apply postformat to locale relative time methods
• #6450 Add stack traces to conditional deprecation warnings

New features

• #6451 Add internal date-default hook for Moment Timezone

New locales

• #6000: Pashto ('ps')
• #6278, #6379: Amharic (Ethiopia) ('am-et')

Updates to existing locales

• #5404 Portuguese (Brazil) ('pt-br'): Fix wrong plural usage for time
• #6197 Indonesian ('id'): Correct the abbreviation for August
• #6217 Georgian ('ka') and Dutch (Belgium) ('nl-be'): Correct L date formats
• #6289 Swedish ('sv'): Correct the abbreviation for Thursday
• #6306 Catalan ('ca'): Use typographic apostrophes in relative time
• #6347 Swahili ('sw'): Correct the spelling of hour in calendar output
• #6360 Ukrainian ('uk'): Use ISO week numbering
• #6370 Ukrainian ('uk'): Use U+02BC apostrophes in Friday names
• #6371 Hungarian ('hu'): Preserve numeric values in relative seconds
• #6391 Swahili ('sw'): Fix weekday and relative-time grammar
• #6396 German ('de', 'de-at', 'de-ch'): Parse short months without trailing dots
• #6409 Uzbek ('uz', 'uz-latn'): Fix past relative-time formatting
• #6410 Polish ('pl'): Use genitive month names in dotted day formats

Changelog

Sourced from moment's changelog.

2.31.0

Released Sep 14, 2026

Security fixes

• Fix CVE-2026-17495 (GHSA-4p3w-j4w9-5jqw)

Bug fixes

• #6376 Prevent object prototype properties from being used as format tokens
• #6386 Normalize lazy-loaded locale names
• #6404 Fix parsing issue with eHHmm format
• #6433 Ignore non-Moment arguments in min and max
• #6434 Fix inherited lowercase long date formats
• #6436 Reset locale parsing caches after updates
• #6437 Fix weekday mismatch when the format only has part of a date
• #6442 Fix locale('__proto__') corrupting the global locale
• #6443 Avoid Object.assign in duration.humanize
• #6446 Validate range when parsing a time zone offset
• #6447 Include metadata in all-locales bundle
• #6448 Apply postformat to locale relative time methods
• #6450 Add stack traces to conditional deprecation warnings

New features

• #6451 Add internal date-default hook for Moment Timezone

New locales

• #6000: Pashto ('ps')
• #6278, #6379: Amharic (Ethiopia) ('am-et')

Updates to existing locales

• #5404 Portuguese (Brazil) ('pt-br'): Fix wrong plural usage for time
• #6197 Indonesian ('id'): Correct the abbreviation for August
• #6217 Georgian ('ka') and Dutch (Belgium) ('nl-be'): Correct L date formats
• #6289 Swedish ('sv'): Correct the abbreviation for Thursday
• #6306 Catalan ('ca'): Use typographic apostrophes in relative time
• #6347 Swahili ('sw'): Correct the spelling of hour in calendar output
• #6360 Ukrainian ('uk'): Use ISO week numbering
• #6370 Ukrainian ('uk'): Use U+02BC apostrophes in Friday names
• #6371 Hungarian ('hu'): Preserve numeric values in relative seconds
• #6391 Swahili ('sw'): Fix weekday and relative-time grammar
• #6396 German ('de', 'de-at', 'de-ch'): Parse short months without trailing dots
• #6409 Uzbek ('uz', 'uz-latn'): Fix past relative-time formatting
• #6410 Polish ('pl'): Use genitive month names in dotted day formats

Commits

• 15b45d4 [pkg] Build 2.31.0 (#6452)
• 631cd81 [pkg] Update changelog for upcoming release (#6394)
• 6caff9e Merge commit from fork
• 710703b [feature] Add internal date-default hook for Moment Timezone (#6451)
• 863ed94 [bugfix] Add stack traces to conditional deprecation warnings (#6450)
• 2c7abe1 [bugfix] Apply postformat to locale relative time methods (#6448)
• 9c45ac3 [bugfix] Include metadata in all-locales bundle (#6447)
• f6eefc5 [bugfix] Validate timezone offset range (#6446)
• 136b441 [bugfix] Avoid Object.assign in duration.humanize (#6443)
• 0d10504 [bugfix] Fix locale('proto') corrupting the global locale (#6442)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for moment since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[mattermost-build]

Hello @dependabot[bot],

Thanks for your pull request! A Core Committer will review your pull request soon. For code contributions, you can learn more about the review process here.

[nang2049]

@CodeRabbit review

[coderabbitai]

⚠️ Action not completed

Review skipped.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Important

Review skipped

This PR was authored by a bot without an assigned CodeRabbit review seat. Ask an organization administrator to assign a seat to the bot. See the seat-assignment guide. After the seat is assigned, request a review again.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: c64f5f66-c3df-4e2a-be4e-aca84f477354

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}