Iskren Ivov Chernev

@devansvd @GregKass @iamraffe can you figure out what exactly is going on and suggest a fix? I'm not a fan of TS, but this might be related to dependency management....

@F0b0s well, I've been thinking of making moment-timezone a proper plugin that gets passed a moment instance, that would probably work with tiny moment (of course if moment-timezone uses locale...

To be fair importing moment shouldn't import any locales, maybe if you're using some fancy package manager that is dumb and puts locales in anyway, you can just instruct it...

Thank you @gilmoreorless, very professionally written and concise :)

Close in favor of https://github.com/moment/moment-timezone/issues/301

@ghost if you leave only the `package.json` change it can be easily merged.

I'm thinking of switching to peerDependency, that should (hopefully) take care of that. Now moment is pulled as a dependency, so it looks like `moment-timezone` is responsible for the security...

Thank you @effrenus

2022c also

Thank you @gilmoreorless for excellent explanation.