moment
Parse, validate, manipulate, and display dates
About
Parse, validate, manipulate, and display dates
What detecting moment tells you about a site
moment is the classic date library, and finding it today — especially the full build — usually signals an older codebase, since Moment is in maintenance mode and the project itself recommends modern alternatives. Its large, mutable footprint is often the single biggest avoidable chunk in a legacy bundle.
Why the exact moment version matters
Moment is effectively frozen at 2.x, so the exact version matters less for features than as a signal: shipping Moment at all is a date-handling decision the ecosystem has moved on from, and a candidate for migration.
moment in a real-world stack
When you find moment in a bundle, it rarely travels alone. moment-timezone for zone support, and often older charting or scheduling libraries that depended on it.
Quick facts
npm install momentHow Sourcemap Explorer detects moment
moment ships as v2.30.1, published 2023-12-27 and carries 0 direct dependencies, 76 versions on the registry. Those exact numbers are the footprint Sourcemap Explorer matches when moment rides inside a deployed bundle — here is how the detection works.
We catch moment from two complementary signals: bundled source paths and the embedded package.json. Modern bundlers (webpack, Vite, esbuild, Rollup, Turbopack) preserve the original node_modules/moment/ paths inside the JavaScript sourcemap's sources[] array — that's the canonical signal. When the matching package.json is also captured in sourcesContent[], we read the exact version field — patch number included. No regex guessing, no version inference.
- 1
Confirm the site exposes sourcemaps
In DevTools Network, check the response headers of any application script for `SourceMap` or `X-SourceMap`. Failing that, fetch the script's last 4 KB and look for a `//# sourceMappingURL=` comment — that map is where the `moment` paths live.
- 2
Find the package in the bundle
Open DevTools → Network → reload. Click any application script and look at its sourcemap. Inside, search `sources[]` for entries matching `node_modules/moment/` — every match confirms the package is bundled. The matching `sourcesContent[i]` for `node_modules/moment/package.json` gives you the exact installed version.
- 3
Read the version directly from package.json
Run `jq -r '. as $m | $m.sources | to_entries[] | select(.value | endswith("node_modules/moment/package.json")) | $m.sourcesContent[.key] | fromjson | .version' bundle.js.map`. Sourcemap Explorer automates the same query in the popup.
Major releases of moment
When each major version first landed. Major bumps are where breaking changes live, so this timeline is the fastest way to date the moment version a site actually ships against the ecosystem.
Recent security advisories for moment
The 4 most recent advisories affecting some versions of moment, aggregated from OSV.dev (GitHub Advisory + CVE data). A listing here doesn't mean the version a given site ships is affected — each advisory applies to a specific version range. Sourcemap Explorer reads the exact bundled version so you can check it against these ranges.
Moment.js vulnerable to Inefficient Regular Expression Complexity
Path Traversal: 'dir/../../filename' in moment.locale
Regular Expression Denial of Service in moment
Regular Expression Denial of Service in moment
Recent versions
moment README
Live mirror of the GitHub README, for reference. Updated whenever the repo's default branch changes.
Moment.js
A JavaScript date library for parsing, validating, manipulating, and formatting dates.
Project Status
Moment.js is a legacy project, now in maintenance mode. In most cases, you should choose a different library.
For more details and recommendations, please see Project Status in the docs.
Thank you.
Resources
License
Moment.js is freely distributable under the terms of the MIT license.
FAQ
What is moment used for?
Parse, validate, manipulate, and display dates
How can I tell if a website is using moment?
Open the page in Chrome with the Sourcemap Explorer extension installed and read the Stack tab. We catch `moment` from two complementary signals: `node_modules/moment/` paths inside the JavaScript sourcemap, and the embedded `package.json` we read for exact-version detection. Without the extension you can do the same lookup manually in DevTools — the steps are listed in the "How Sourcemap Explorer detects" section above.
How do I find out which version of moment a website is running?
Read it straight from the site's JavaScript sourcemap. When a build ships source maps, the bundled `moment/package.json` carries the exact `version` string — Sourcemap Explorer extracts it in one click on the Stack tab, and you can do it by hand in DevTools by opening the `.map` file and searching for `node_modules/moment/package.json`. That is far more reliable than inferring the version from an asset-hash or a `?ver=` query string, which is all surface-level detectors have to go on. The current npm release is 2.30.1, but real deployments frequently run an older pinned version — which is exactly why reading the bundled number matters.
What is the latest version of moment?
2.30.1, as published on the npm registry. The "Recent versions" table on this page lists the most recent 8 releases with their release dates. Sourcemap Explorer reports the version actually bundled into a site, which can lag the latest release by months on real-world deployments.
Is moment actively maintained?
Quiet at the moment — no new release in over two years. Worth checking the repository for an active fork before adopting on a new project. The last published release was 2023-12-27. Source code: https://github.com/moment/moment.
Does moment have known security vulnerabilities?
4 recent advisories affecting some versions of moment are listed in the "Recent security advisories" section above, aggregated from OSV.dev (GitHub Advisory + CVE data). Whether a particular site is exposed depends entirely on the exact version it ships — each advisory applies to a specific version range, not to the package as a whole. That is why the precise bundled version matters: Sourcemap Explorer reads the version a site actually runs, so you can check it against the affected ranges instead of assuming the latest release is what's deployed.
Where can I read more?
Project homepage: https://momentjs.com. Source code: https://github.com/moment/moment. Published on npm: https://www.npmjs.com/package/moment. Licensed as MIT.
Keep reading on Sourcemap Explorer
Practical guides
Detection deep dives
Detected by Sourcemap Explorer
When a bundle ships sourcemaps, we read the embedded package.json for moment and report the precise version (the registry's latest is v2.30.1, published 2023-12-27; the bundled copy is often older). Without sourcemaps, an import / require in the page's scripts is enough to flag it.