[4.x] Fix YAML date coercion - #441
Merged
Merged
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This was referenced Aug 23, 2026
This was referenced Aug 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This supersedes #439 and keeps its commit from @mklenbw as it was, rebased onto 4.x, followed by one commit with the changes that came out of review.
Unquoted date-shaped scalars like an IAM policy Version were parsed into Date objects and serialized into compiled templates as ISO 8601 strings, a date behind a file variable failed the whole configuration resolution, and date-shaped mapping keys became timezone-dependent strings. Quoted and !!str values were never affected. The schema change now also re-registers the timestamp type as explicit, so a deliberate !!timestamp tag keeps constructing a Date for consumers that read files through the utils and parser APIs instead of hard-failing with an unknown tag.
The same schema is applied on the two parse paths the original commit did not reach: serverless.utils.readFileSync previously used the date-coercing default schema for any file without CloudFormation shorthand tags, and yamlParser.parse loaded external $ref documents with no schema at all, which also made shorthand tags silently fail to resolve there. One deliberate tightening: an unquoted date-only s3 lifecycle ExpirationDate or TransitionDate previously slipped through validation via the coercion and now fails it explicitly; the fix is to write the full timestamp. A companion pull request applies the same change to 3.x.