TOML has a datetime type (both with or without tz), as well as plain date and plain time:

  start_at = 2026-05-27T07:32:00Z  # RFC 3339
  start_at = 2026-05-27 07:32:00Z  # readable

  timeout = PT15S  # RFC 3339

  timeout = 15s   # can omit "P" and "T" if not ambiguous, can use lowercase specifiers

great, now attackers can also target all the libraries to enable all that complexity in npm too.