Moment library update, adapt to the changes in Moment's parsing of dates

[dariapimenovaleanix]

Description

handsontable is currently using moment library of the version 2.24.0.
Affected versions of this package are vulnerable to Directory Traversal when a user provides a locale string which is directly used to switch moment locale.
Link to the known vulnerability in Snyk: https://security.snyk.io/vuln/SNYK-JS-MOMENT-2440688

How to fix

Upgrade moment to version 2.29.2 or higher.

Your environment

• Handsontable version: 11.1.0

[AMBudnik]

Hi @dariapimenovaleanix, thank you for the notification. We also got the PR from SNYK #9376

I will notify you as soon as we update this topic.

[dariapimenovaleanix]

@AMBudnik thank you!

[warpech]

We will deal with upgrading the dependency shortly. Let me assure you that this vulnerability does not affect Handsontable when it is used, as intended, in a web browser. Anyway we should upgrade the dependency to silence the vulnerability alerts.

[warpech]

We are tracking a solution in the PR #9382, but we need to take into account some changes in moment that resulted in changed behaviour when the data does not match dateFormat property.

[AMBudnik]

Hi @dariapimenovaleanix we just released Handsontable v12 where we bumped the version of moment.js
Thank you again for sharing your feedback. I'm closing this issue as done.