fix(isISO8601): restrict UTC offset range

[deepakganesh78]

Fixes #1883

Reproduction

On current master, isISO8601 accepts UTC offsets outside the valid ISO 8601 UTC-offset range:

const isISO8601 = require('./src/lib/isISO8601').default;
isISO8601('2021-12-13T00:00:00+15:00'); // true, expected false
isISO8601('2021-12-13T00:00:00-13:00'); // true, expected false

Root cause

The ISO 8601 regex allowed any signed timezone hour from 00 through 23, regardless of sign. That accepts offsets beyond the UTC range of -12:00 through +14:00.

Fix

The timezone-offset branch now validates positive and negative offsets separately, preserving valid boundaries (+14:00, +1400, +14, -12:00, -1200, -12) while rejecting values beyond them (+14:01, +15:00, -12:01, -13:00, etc.). The same change is applied to both regular and strictSeparator ISO 8601 patterns.

Compatibility notes

This only rejects timezone offsets outside the accepted UTC range; existing valid ISO 8601 date/time forms and in-range offsets continue to pass. README table update is not applicable because no validator/options were added or renamed.

Validation

• Reproduced before the fix with node --require '@babel/register' -e ...: +15:00 and -13:00 returned true.
• Verified regression tests fail with the source fix reverted: npx mocha --require @babel/register --reporter dot test\\validators.test.js --grep "ISO 8601" => 2 passing, 3 failing.
• Verified targeted tests with the fix: same command => 5 passing.
• Full suite: npm test (build + lint + tests) => 321 passing; coverage: Statements 100% (2743/2743), Branches 96.59% (1697/1757), Functions 100% (427/427), Lines 100% (2428/2428).

Checklist

• PR contains only changes related; no stray files, etc.
• README updated (not applicable)
• Tests written
• References provided in PR (issue references ISO 8601 UTC offset range)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (3576b41) to head (295250e).

Additional details and impacted files

@@            Coverage Diff            @@
##            master     #2834   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          114       114           
  Lines         2598      2598           
  Branches       658       658           
=========================================
  Hits          2598      2598           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR updates the isISO8601 validator to reject ISO 8601 timezone offsets outside the valid UTC-offset range (−12:00 through +14:00), addressing #1883.

Changes:

• Tightens the ISO 8601 regex timezone-offset branch to enforce the +14:00 and -12:00 boundaries (including compact forms like +1400, -12).
• Applies the same timezone-offset constraint to both the regular and strictSeparator ISO 8601 patterns.
• Adds targeted test cases covering newly-accepted boundary offsets and newly-rejected out-of-range offsets.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/lib/isISO8601.js	Updates the ISO 8601 regexes to restrict timezone offsets to the valid UTC range.
test/validators.test.js	Adds regression tests for boundary offsets and out-of-range offsets in both separator modes.

Suppressed comments (1)

src/lib/isISO8601.js:7

• Same issue as the non-strict-separator regex: the timezone offset pattern nests the negative-offset branch under a leading +, which breaks valid -HH[:MM] offsets and can permit +-... strings. Adjust the alternation so + and - are siblings and enforce +14:00 / -12:00 boundaries.

const iso8601StrictSeparator = /^([\+-]?\d{4}(?!\d{2}\b))((-?)((0[1-9]|1[0-2])(\3([12]\d|0[1-9]|3[01]))?|W(0[1-9]|[1-4]\d|5[0-3])(-?[1-7])?|(00[1-9]|0[1-9]\d|[12]\d{2}|3([0-5]\d|6[0-6])))([T]((([01]\d|2[0-3])((:?)[0-5]\d)?|24:?00)([\.,]\d+(?!:))?)?(\17[0-5]\d([\.,]\d+)?)?([zZ]|(?:\+(?:(?:0\d|1[0-3]):?[0-5]\d|14:?00|(?:0\d|1[0-4]))|-(?:(?:0\d|1[01]):?[0-5]\d|12:?00|(?:0\d|1[0-2]))))?)?)?$/;

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.