[devin-ai-integration]

Summary

Fixes Code Scan finding sfind-e5ddd93b (high, Snyk SNYK-JS-MOMENT-2944238 / CVE-2022-31129, CWE-1333): upgrades moment 2.15.1 -> 2.29.4 in package.json + package-lock.json (the only moment entries; no other deps changed). routes/index.js /import passes the CSV when field from the request straight to moment(when). In moment 2.18.0-2.29.3 a long string like '(' x N makes preprocessRFC2822 run in quadratic time and blocks the event loop. 2.29.4 caps that parsing.

No app code changes. moment.locale() / moment(when).format(format) behave the same for normal input (checked below). This also moves past the other moment advisories on 2.15.1 (locale path traversal SNYK-JS-MOMENT-2440688, ReDoS SNYK-JS-MOMENT-10164).

Note: the RFC2822 parser was added in moment 2.18.0, so 2.15.1 on main doesn't run this exact code path (timings below show this). Snyk still flags 2.15.1, and 2.29.4 is the fixed version it recommends.

Duplicate notice: these open PRs also bump moment to 2.29.4: #1037 (same CVE), #1040, #1048, #1059, #1069, #1087, #1118, #1107 (also bumps humanize-ms/ms). Only one should land. This PR exists because this finding is a new ticket.

How it was tested

Ran the real app.js (NODE_OPTIONS=--openssl-legacy-provider, Mongo replaced by an in-memory stub) and used curl to send a CSV to POST /import. Compared main (2.15.1), main with moment 2.29.3 (the last vulnerable version), and this branch (2.29.4):

POST /import	main (2.15.1)	2.29.3	this PR (2.29.4)
dentist,2016-10-01,en,LL + rfc,01 Oct 2016 10:00:00 +0000,en,LL	0.009 s, both [October 1, 2016]	0.009 s, same	0.014 s, same
when = '(' x 20000	0.003 s	0.21 s	0.005 s
when = '(' x 40000	0.003 s	0.84 s	0.003 s
when = '(' x 80000	0.003 s	3.32 s (event loop blocked; a concurrent GET /about_new took 6.0 s instead of the usual ~2.7 s)	0.012 s

Direct library probe, moment('('.repeat(n)) for n = 10k/20k/40k: 2.29.3 took 54 / 318 / 1074 ms; 2.29.4 took 0.9 / 0.2 / 0.3 ms.

Not run: npm test (snyk test), because there's no Snyk token and api.snyk.io isn't reachable from the test box. The repo has no other runnable test suite.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/040d25a12a1240ce9204a9b2dcf2d869
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/040d25a12a1240ce9204a9b2dcf2d869?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

Enable auto-review to review your pull requests automatically.

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	moment@​2.15.1 ⏵ 2.29.4		+21

View full report

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.