Moment v2.31.0 is for existing code, not a fresh dependency
Moment v2.31.0 still does the work that made it a default choice for JavaScript dates: parsing strings, checking validity, changing values, formatting output, calculating durations, and applying locales. Its chainable API is familiar across old browser applications and Node.js services. That familiarity now has a precise use. It helps when you inherit Moment code; it is a poor reason to add Moment to a new project.
The August 2026 status update calls Moment a legacy project in maintenance mode. Maintainers are not accepting new user-facing features or redesigning the mutable API. They may work on internals, packaging, type declarations, runtime support, and releases when they can preserve compatibility. Moment 3.0 is no longer ruled out, but there is no schedule, and the team says any such release would still be maintenance rather than renewed feature development.
A 47-second install shows the repository remains workable
Our checkout installed 314 pnpm packages in 47 seconds and occupied 378 MB. That is the contributor environment, including QUnit, Rollup, ESLint, several TypeScript generations, formatting tools, and coverage tooling. An application that runs npm install moment does not inherit that whole development tree. The repository cost matters to maintainers and contributors, not as a claim about a production bundle.
The package has scripts for linting, tests, builds, TypeScript checks, release preparation, and coverage. Seven GitHub Actions workflow files cover CI, coverage, releases, runtime compatibility, FOSSA, pull requests, and time zones. The measured checkout contained 679 files and about 168,409 source lines. That size reflects the core, locale catalog, generated bundles, type declarations, tooling, and a long compatibility history.
What happened when we ran it
Our sandbox installed 314 packages in 47 seconds and used 378 MB on disk. The build succeeded in 8 seconds, followed by a successful 20-second test command. The run used commit 863ed94 in a fresh Debian container with 3 CPUs, 8 GB of RAM, Node.js 22, no secrets, and no elevated privileges.
The checkout held 679 files and about 168,409 lines of source at 6.9 MB. Our scan found 7 CI workflow files, no Dockerfile, and no top-level tests directory. The install, build, and test steps all completed successfully. The supplied measurement did not report a test-case count, so there is no honest total to attach to the passing test command.
v2.31.0 fixed a CVE after our measured commit
Version 2.31.0 was published on September 15, 2026, after the commit our sandbox ran. Its release notes say it fixes CVE-2026-17495, along with parser, locale, duration, and time-zone-offset bugs. Our passing result therefore applies to commit 863ed94, whose package file still said 2.30.1, and does not verify the later release tag. Existing applications should assess and take the security update rather than treating our earlier test as coverage for it.
The same release is evidence that maintenance mode does not mean abandoned. It added Pashto and Amharic locale data and repaired behavior across Brazilian Portuguese, Indonesian, Ukrainian, German, Swedish, Swahili, and other locales. A release-workflow issue opened the same day says npm publication succeeded but the branch update failed and was completed manually. The package shipped, while the workflow still needs repair before the next release.
Every Moment object is mutable unless you clone it
Moment's 2.x API changes the object when you call methods such as add, subtract, or setters. The official guide warns about this directly and tells developers to clone before date math when the original value must survive. That behavior is stable by policy. Rewriting Moment around immutable values would break existing applications, so a new codebase that assumes immutable date objects should choose another library.
Parsing has a similar compatibility edge. Moment accepts loose input by default, while its guide recommends strict mode and says many reported parser problems disappear when the input must match the declared format. Pass the strict flag for controlled formats and test invalid strings explicitly. Flexible parsing can keep old integrations working, but it also makes incorrect input easier to accept without an obvious failure.
Core Moment handles offsets, not named time zones
Moment v2.31.0 can work in local time, UTC, or a fixed offset. Its core package cannot apply the historical and daylight-saving rules for a named zone such as America/New_York; the official guide assigns that job to Moment Timezone. An offset only describes one displacement from UTC and cannot identify a region whose rules may change across dates.
Locale files create a separate browser concern. The project status says Moment works poorly with tree shaking and can enlarge bundles when internationalization data is included. The webpack guide notes that default bundling may pull every locale unless you restrict them. date-fns offers function-level imports, Day.js loads features through plugins, and Luxon uses platform Intl data. Each gives a new project a cleaner starting point for code splitting or zones.
September 2026 activity supports maintenance, not expansion
The repository was pushed on September 15, 2026, the day v2.31.0 appeared. GitHub listed 47,913 stars and 56 combined issues and pull requests, of which 41 were issues in our API check. Several old date-math and locale reports received updates in September, while issue 6453 documents the current release-workflow fault. That is active maintenance around a large installed base, bounded by an explicit compatibility policy.
Moment remains a sensible dependency to understand and a questionable one to introduce. The 20-second passing test step, current security release, and detailed docs support teams keeping an existing application safe. The mutable API, separate time-zone package, bundle behavior, and refusal of new user-facing features decide the new-project question. Pick the replacement around your actual constraint, then migrate with date, locale, and daylight-saving fixtures before removing Moment.