The type reference for file in Puppet 0.25.5 said:
I believe that there are many Puppet manifests out there that still writes file mode as 3-digit numbers and expect them to be interpreted as octal.
Starting with Puppet 3.5.0 (using future parser), this would set the mode to 1204 instead of the intended 0644. The mode 755 becomes 1363 – which means that the file is world writable.
I know that for a long time the documentation says that the mode should be specified as a four-digit octal value. But it doesn't say that it has to be a string. Specifying 4711 used to make a file setuid; starting in Puppet 3.5.0 is produces the nonsensical error message "The file mode specification is invalid: 4711".
There has never been any deprecation warnings, so code written by the ancient documentation now suddenly behaves differently. Files that were supposed to be read-only can now become writable by everybody on the system.
At the very least, this should have been mentioned in the release notes.