Turns out only moment-jdateformatparser was fixed (org.webjars.npm:momentjs was fixed too, but the id is actually org.webjars.npm:moment...), created XWIKI-24322.
This message was sent by Atlassian Jira (v9.3.0#930000-sha1:287aeb6)
If image attachments aren't displayed, see this article.
