chore(deps): update dependency tzdata to v2026.4 - #275
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM, straightforward dependency version bump.
What was reviewed: confirmed the diff only changes the tzdata pin from 2026.3 to 2026.4 in both requirements.txt and requirements-dev.txt, with identical comment/via annotations preserved. No source, test, or config logic is touched.
Extended reasoning...
Overview
This PR is an automated Renovate dependency update touching only two lock files, requirements.txt and requirements-dev.txt. The sole change in each file is bumping the pinned version of the tzdata package from 2026.3 to 2026.4. I ran the diff command directly and confirmed this is the entirety of the change — no other lines, packages, or files are affected.
Security risks
tzdata is a well-known, widely-used pure-data package (IANA timezone database published via PyPI by the CPython core team) with no executable logic beyond data tables. The release notes describe timezone rule updates (Canada's Northwest Territories DST changes, POSIX conformance fixes, minor zic/localtime bug fixes) — nothing security-relevant to this application. There is no plausible injection, auth, or data-exposure risk from this change.
Level of scrutiny
This warrants minimal scrutiny: it is a single-package patch-version bump in machine-generated lock files, produced by a trusted automation (Renovate bot), with no code, test, or documentation changes. This is exactly the class of "simple, mechanical" change the approval guidelines describe as appropriate to approve without requiring human review.
Other factors
The bug hunting system reported no findings, and my own review of the diff found nothing beyond the described version bump. There is no CODEOWNERS restriction noted, and no outstanding review threads or objections in the PR timeline.
This PR contains the following updates:
==2026.3→==2026.4Release Notes
python/tzdata (tzdata)
v2026.4: : Release of upstream tzdata 2026dCompare Source
Version 2026.4
Upstream version 2026d released 2026-09-11T22:21:07+00:00
Briefly:
Canada’s Northwest Territories moved to permanent -06 on 2026-08-21. Obsolescent
settings like TZ="EST5EDT" now conform better to POSIX. Fix security,
performance and porting bugs in zic and localtime.
Changes to future timestamps
Canada’s Northwest Territories will not fall back on 2026-11-01 and will stay on
-06 year-round, matching Alberta’s recent change. Model this with its
traditional abbreviation CST. Although the change to permanent -06 legally took
place on 2026-08-21, temporarily model the change to occur on 2026-11-01 at
02:00 for the same reason as other recent temporary hacks. (Caution: see “NOTE
FOR 2026b TEMPORARY HACK FOR CLDR AND CANADA” below.) This affects only
America/Inuvik as the rest of the territory is covered by America/Edmonton, for
which the equivalent change was released in 2026c.
Changes to past timestamps
Colombia’s 1992-05-02 spring forward was at 00:00, not 24:00.
Iran’s 1979-05-26 spring forward was at 00:00, not 24:00. (Thanks to N.F. Hase.)
The backward-compatibility names EST5EDT, CST6CDT, MST7MDT, and PST8PDT now
conform better to POSIX. For example, EST5EDT now always uses the abbreviation
"EST" for standard time (now always 5 hours behind UT) and "EDT" for daylight
saving time, whereas it formerly had different UT offsets before standard time
was introduced and sometimes used abbreviations like "LMT", "EWT" and "EPT", all
contrary to POSIX. Also, though not required by POSIX these names now use US
federal rules rather than rules of places like New York, reverting to 2024a
behavior. This change affects only timestamps before 1966-10-30 at 01:00
standard time.
Other data changes
The temporary hacks used for North American timekeeping changes now work around
a libstdc++ std::chrono bug in GCC 14.1-14.4, 15.1-15.2, and 16.1; see GCC bug
124851. This data change does not affect TZif files or timestamps. The change
does not work around the related but less serious GCC bugs 116110 and 124513.
These GCC bugs are all fixed in GCC 16.2.
Changes to documentation
URLs for release tarballs in tz-link.html have been updated to reflect their new
canonical URLs on data.iana.org.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.