luxon

About

Immutable date wrapper

What detecting luxon tells you about a site

Luxon in a bundle signals a team that takes dates and time zones seriously. Built by a Moment.js maintainer as its modern successor, Luxon handles zones, durations and locale-aware formatting through a clean immutable API on top of the Intl platform features. Finding it suggests the app does real temporal work: scheduling, calendars, cross-timezone displays, or anything where getting offsets and DST right actually matters. It is a heavier, more capable choice than the tiny date-fns or day.js, so its presence implies the team valued correctness and a full-featured zone-aware API over minimal footprint.

Why the exact luxon version matters

Luxon leans on the platform's Intl and time-zone data, so behaviour can shift with the runtime as much as with the library, but its own majors have refined the DateTime and Duration APIs and tightened immutability guarantees. The exact version matters most for which formatting tokens and zone-handling behaviours are available, and for known fixes around parsing edge cases.

luxon in a real-world stack

When you find luxon in a bundle, it rarely travels alone. Often the only date library in a project, occasionally alongside a calendar UI component.

Quick facts

How Sourcemap Explorer detects luxon

luxon ships as v3.7.2, published 2025-09-05 and carries 0 direct dependencies, 151 versions on the registry. Those exact numbers are the footprint Sourcemap Explorer matches when luxon rides inside a deployed bundle — here is how the detection works.

We catch luxon from two complementary signals: bundled source paths and the embedded package.json. Modern bundlers (webpack, Vite, esbuild, Rollup, Turbopack) preserve the original node_modules/luxon/ paths inside the JavaScript sourcemap's sources[] array — that's the canonical signal. When the matching package.json is also captured in sourcesContent[], we read the exact version field — patch number included. No regex guessing, no version inference.

1. 1

   Confirm the site exposes sourcemaps

   In DevTools Network, check the response headers of any application script for `SourceMap` or `X-SourceMap`. Failing that, fetch the script's last 4 KB and look for a `//# sourceMappingURL=` comment — that map is where the `luxon` paths live.

2. 2

   Find the package in the bundle

   Open DevTools → Network → reload. Click any application script and look at its sourcemap. Inside, search `sources[]` for entries matching `node_modules/luxon/` — every match confirms the package is bundled. The matching `sourcesContent[i]` for `node_modules/luxon/package.json` gives you the exact installed version.

3. 3

   Read the version directly from package.json

   Run `jq -r '. as $m | $m.sources | to_entries[] | select(.value | endswith("node_modules/luxon/package.json")) | $m.sourcesContent[.key] | fromjson | .version' bundle.js.map`. Sourcemap Explorer automates the same query in the popup.

Major releases of luxon

When each major version first landed. Major bumps are where breaking changes live, so this timeline is the fastest way to date the luxon version a site actually ships against the ecosystem.

Recent security advisories for luxon

The 1 most recent advisories affecting some versions of luxon, aggregated from OSV.dev (GitHub Advisory + CVE data). A listing here doesn't mean the version a given site ships is affected — each advisory applies to a specific version range. Sourcemap Explorer reads the exact bundled version so you can check it against these ranges.

1. HIGHCVE-2023-22467· 2023-01-09

   Luxon Inefficient Regular Expression Complexity vulnerability

Recent versions

luxon README

Live mirror of the GitHub README, for reference. Updated whenever the repo's default branch changes.

DateTime.now().setZone("America/New_York").minus({ weeks: 1 }).endOf("day").toISO();

FAQ