Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[architect] Four validators gate an 'ISO 8601' timestamp with plain Date.parse, accepting loose strings the format claims to reject

Closed
  • Is something wrong?
#1,505 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

A pull request for this has already been merged.

  • #1506 by @hivecommons-hive — merged

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
20/100
Issue type
Refactor
Clarity
Clearly specified
Activity status
Stale
Tech stack
javascript
Domain
devtools

Research direction

Start with the strict ISO regex and its comment in scripts/validate-community-people.mjs, then the shared helpers in scripts/lib/validate-utils.mjs and their tests in tests/validate-utils.test.mjs. Work is already under way in linked PR #1506, so check with its author before starting. Done means a shared checkIsoTimestamp helper with unit tests, and all five call sites (including validate-community-people.mjs) using it.

Written by the indexing model from the issue text.

Description

agent/architect architecture hive/covered-by-pr hive/hosted-available-lke648397-260827-5n31 tech-debt

Architecture Finding

Type: interface-violation/tech-debt (duplicated check with drift)
Affected area: scripts/validate-community-groups.mjs, scripts/validate-enduser-members.mjs, scripts/validate-launch-metrics.mjs (3 fields), scripts/lib/validate-utils.mjs

scripts/validate-community-people.mjs already carries a strict ISO 8601 regex
(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/) with this exact comment:

Strict ISO 8601 only: plain Date.parse also accepts loose strings like
"March 1, 2026", which would silently defeat the staleness check below.

That fix never made it into the other four validators gating a field whose
error message literally claims "must be ISO 8601" / "must be an ISO
timestamp": validate-community-groups.mjs (checkedAt, which layers the
same 60-second future-skew grace-window check community-people.mjs does —
the exact failure mode the comment above warns about), validate-enduser- members.mjs (collectedAt), and validate-launch-metrics.mjs
(generatedAt, capturedAt, and per-signal collectedAt). Each still
uses Number.isNaN(Date.parse(value)), so a loose, locale-dependent string
passes a check whose own message says it enforces ISO 8601.

This is the same drift-after-copy pattern already fixed twice in this file
(checkUrl, checkNonEmptyArray in scripts/lib/validate-utils.mjs) — the
precedent for centralizing is already established and documented there.

Impact

A malformed or ambiguous timestamp (e.g. "March 1, 2026" or a
non-UTC-offset form) silently passes the gate that is supposed to catch it.
For community-groups.mjs's checkedAt, this also means the stacked
future-skew check beneath it can never fire for such a value, since
new Date(...) happily parses the loose string into some timestamp.
Every future new validator that copies one of these four as a template
copies the gap forward again.

Recommendation

Centralize a checkIsoTimestamp(errors, path, field, value, options) helper
in scripts/lib/validate-utils.mjs (strict regex, optional
futureToleranceMs/futureMessage for the staleness/future-skew check),
and have all five call sites (including validate-community-people.mjs's own
copy) call it instead of carrying independent regex/Date.parse logic.

  • Add checkIsoTimestamp to scripts/lib/validate-utils.mjs with full unit coverage in tests/validate-utils.test.mjs
  • Migrate validate-community-people.mjs's local regex to the shared helper
  • Migrate validate-community-groups.mjs's checkedAt check (format + future-skew) to the shared helper
  • Migrate validate-enduser-members.mjs's collectedAt check to the shared helper
  • Migrate validate-launch-metrics.mjs's generatedAt/capturedAt/per-signal collectedAt checks to the shared helper

Note: scripts/validate-metrics.mjs has the identical loose-Date.parse
"must be ISO 8601" pattern on its own generatedAt field, but that file and
its test are occupied by open hold-gated PR cncf/endusers#1504 at the time of
filing, so it is deliberately left out of this issue's scope; a follow-up
should migrate it once that PR lands.

Filed by architect agent (ACMM L5 — hold-gated mode)

🐝 Hive Agent: architect | Instance: hosted-available-lke648397-260827-5n31 | SHA: unknown

— hive: agent=architect backend=copilot model=claude-opus-4-6 copilot=1.0.88

Dominant language
JavaScript
Stars
0
Forks
2
Avg merge
16h 38m
Merged PRs (30d)
608

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from cncf/endusers

All issues in cncf/endusers

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.