Serverless runtimes

The serverless detector reports managed serverless runtime identifiers that vendors list as end-of-life, as declared in AWS SAM / CloudFormation templates, Serverless Framework serverless.yml, and Terraform (including Azure Functions application_stack version pins). It is stable: its level is recorded as stable in benchmarks/thresholds.json, and the precision floor is enforced on the public corpus. The maturity rules are in Decision 0013.

What it reads

File	Declaration
template.yaml / template.yml	Literal Globals.Function.Runtime, and each Properties.Runtime on an AWS::Serverless::Function or AWS::Lambda::Function
serverless.yml	Literal provider.runtime and each function's own runtime
*.tf	Literal runtime on aws_lambda_function, google_cloudfunctions_function, and google_cloudfunctions2_function.build_config; and version fields on azurerm_*_function_app site_config.application_stack (node_version, python_version, java_version, powershell_core_version, dotnet_version)

Plain or quoted string scalars only. CloudFormation tags (!Ref, !Sub), Serverless ${…} interpolations, Terraform var / local / interpolations, floating aliases such as latest, nested lookalike keys, heredocs, and image functions without a managed-runtime identifier are ignored. serverless.yaml is not read.

It walks the repository up to eight directories deep (at most 500 matching files) and does not follow symbolic links. It skips .git, node_modules, vendor, dist, build, target, .venv, venv, fixtures, __fixtures__, and testdata. SAM, the Serverless Framework, Terraform, and cloud CLIs are never run.

What it reports

• A literal AWS Lambda runtime identifier that a pkg:generic/aws-lambda-runtime/<id> rule covers, citing the AWS Lambda runtimes table.
• A literal Google Cloud Functions runtime identifier that a pkg:generic/google-cloud-functions-runtime/<id> rule covers, citing the Cloud Run functions runtime support schedule.
• An Azure Functions / App Service application_stack version pin (node_version, python_version, java_version, dotnet_version, powershell_core_version) on azurerm_linux_function_app / azurerm_windows_function_app when a pkg:generic/azure-app-service/<stack> rule covers that version, citing the App Service language runtime support policy.

Each finding names the file and line, and carries its rule's source, replacement, deadline, migration guidance, and verification commands. There is no source-usage pass.

What it intentionally does not judge

• Runtime identifiers with no rule in registry/serverless.json. A missing finding is not evidence that a runtime is current.
• CloudFormation intrinsic functions and tags, Serverless Framework variables, Terraform variables and interpolations, and floating aliases such as latest.
• CDK, Pulumi, SAM CLI samconfig, Serverless Framework serverless.ts / serverless.js, and Azure Function function.json / host.json app settings (Terraform application_stack pins are judged; app settings are not).
• Azure stack fields that are Terraform interpolations (var / local / dynamic blocks), and node_version only under app_settings or module variable type objects without a literal pin on the resource.
• Image-based Lambda or Cloud Functions deployments that omit a managed-runtime identifier.
• Vulnerability advisories and license policy.

Known limits and false-positive boundaries

• A declared runtime is reported whatever the project actually deploys. A stale example under the repository root still produces a finding when it is within the walk limits.
• The identifier is matched as written. nodejs14.x is an AWS Lambda id; nodejs14 is a Google Cloud Functions id. They do not substitute for each other.
• Malformed input produces no declarations from that file, never a partial result, and no error is raised. A file over 1 MiB yields nothing, and a single line over 4,096 characters is skipped. An unterminated string or comment in Terraform yields nothing from the whole file.
• The eight-level and 500-file limits are silent. Files beyond them, and any under vendor or a skipped directory, are not scanned.

Data

The rules are in registry/serverless.json and ship in the data bundle. The importers serverless-1 (AWS Lambda runtimes) and serverless-2 (Google Cloud Functions runtime support) draft new rules for review; see Lifecycle importers.

Validation

Forty-one public repositories at pinned commits cover the detector: seven targeted and thirty-four chosen blind by the rules in Validation (the 2026-10-21 beta walk plus the 2026-11-08 stable expansion). The set includes SAM template.yaml, Serverless Framework serverless.yml, Terraform AWS Lambda runtimes, and Azure application_stack pins. Each expected finding was reviewed by hand against the file at that commit. Corpus-wide evidence meets every stable count in decision 0013. Offline validate on the Serverless bucket reported precision 1 and recall 1 for serverless.