Merge branch 'master' into no-more-master

Author: StanFromIreland

.github/dependabot.yml

@@ -7,4 +7,9 @@ updates:
     groups:
       actions:
         patterns:
-          - "*"
+          - "*"
+    cooldown:
+      # https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns
+      # Cooldowns protect against supply chain attacks by avoiding the
+      # highest-risk window immediately after new releases.
+      default-days: 14

.github/workflows/auto-tag.yml

@@ -14,27 +14,33 @@ jobs:
       contents: write
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: true  # Needed to push the tag
 
       - name: Get current version
         id: version
         run: |
           VERSION=$(cat VERSION)
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Check if tag already exists
         id: checktag
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
         run: |
-          if git rev-parse "v${{ steps.version.outputs.version }}" >/dev/null 2>&1; then
-            echo "skip=true" >> $GITHUB_OUTPUT
+          if git rev-parse "${VERSION}" >/dev/null 2>&1; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
           else
-            echo "skip=false" >> $GITHUB_OUTPUT
+            echo "skip=false" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Push tag
         if: steps.checktag.outputs.skip == 'false'
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git tag "${{ steps.version.outputs.version }}"
-          git push origin "${{ steps.version.outputs.version }}"
+          git tag "${VERSION}"
+          git push origin "${VERSION}"

.github/workflows/check-for-updates.yml

@@ -5,9 +5,13 @@ on:
     - cron: '0 9 * * *'  # Runs daily at 9AM UTC
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   check-pr-exists:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
     outputs:
       pr_exists: ${{ steps.check_pr_exists.outputs.pr_exists }}
     steps:
@@ -16,15 +20,15 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          PR_EXISTS=$(gh pr --repo $GITHUB_REPOSITORY \
+          PR_EXISTS=$(gh pr --repo "$GITHUB_REPOSITORY" \
                       list --search "Update tzdata to version" \
                       --json number --jq '.[] | .number')
           if [ -n "$PR_EXISTS" ]; then
             echo "A PR updating the tzdata version already exists: https://github.com/python/tzdata/pulls/${PR_EXISTS}"
-            echo "pr_exists=true" >> $GITHUB_OUTPUT
+            echo "pr_exists=true" >> "$GITHUB_OUTPUT"
             exit 0
           else
-            echo "pr_exists=false" >> $GITHUB_OUTPUT
+            echo "pr_exists=false" >> "$GITHUB_OUTPUT"
           fi
 
   check-for-updates:
@@ -36,12 +40,13 @@ jobs:
     if: needs.check-pr-exists.outputs.pr_exists == 'false'  # Run only if no PR exists
     steps:
       - name: Check out repository (shallow)
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1  # Shallow clone to save time
+          persist-credentials: true  # Needed to push the update
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12'
 
@@ -62,7 +67,7 @@ jobs:
           # Check for changes
           if git diff --quiet; then
             echo "No changes detected."
-            echo "CHANGES_DETECTED=false" >> $GITHUB_ENV
+            echo "CHANGES_DETECTED=false" >> "$GITHUB_ENV"
             exit 0
           fi
 
@@ -75,19 +80,19 @@ jobs:
             exit 1
           fi
 
-          if [ $(echo "$news_files" | wc -l) -ne 1 ]; then
+          if [ "$(echo "$news_files" | wc -l)" -ne 1 ]; then
             echo "More than one new file added in news.d, failing the job."
             exit 1
           fi
-          echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
+          echo "CHANGES_DETECTED=true" >> "$GITHUB_ENV"
 
           # Extract TZDATA_VERSION from filename
           TZDATA_VERSION=$(basename "$news_files" .md)
 
           # Extract TZDATA_NEWS from file content
           TZDATA_NEWS=$(cat "$news_files")
 
-          echo "TZDATA_VERSION=$TZDATA_VERSION" >> $GITHUB_ENV
+          echo "TZDATA_VERSION=$TZDATA_VERSION" >> "$GITHUB_ENV"
           {
             echo "TZDATA_NEWS<<EOF"
             echo "$TZDATA_NEWS"
@@ -111,5 +116,5 @@ jobs:
           gh pr create --title "Update tzdata to version $TZDATA_VERSION" \
             --body "$TZDATA_NEWS" \
             --base main \
-            --head $(git rev-parse --abbrev-ref HEAD) \
+            --head "$(git rev-parse --abbrev-ref HEAD)" \
             --label "automatic-updates"

.github/workflows/publish.yml

@@ -9,47 +9,92 @@
 name: Upload package
 
 on:
-  release:
-    types: [created]
   push:
-    tags:
-      - '*'
+  pull_request:
+  release:
+    types:
+      - published
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  FORCE_COLOR: 1
 
 jobs:
-  deploy:
+  build-package:
+    name: Build & verify package
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: hynek/build-and-inspect-python-package@fe0a0fb1925ca263d076ca4f2c13e93a6e92a33e # v2.17.0
+
+  test-package:
+    name: Test package
+    if: |
+      github.event.repository.fork == false
+      && (
+        (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
+        || github.event.action == 'published'
+      )
+    needs: build-package
+    uses: ./.github/workflows/tests.yml
+
+  # Publish to TestPyPI for every tag.
+  release-test-pypi:
+    name: Publish to TestPyPI
+    if: |
+      github.event.repository.fork == false
+      && github.event_name == 'push'
+      && startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    needs: test-package
+
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Download packages built by build-and-inspect-python-package
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: Packages
+          path: dist
+
+      - name: Publish to Test PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        with:
+          repository-url: https://test.pypi.org/legacy/
+
+  release-pypi:
+    name: Publish to PyPI
+    # Only run for published releases.
+    if: |
+      github.event.repository.fork == false
+      && github.event.action == 'published'
     runs-on: ubuntu-latest
+    needs: test-package
+
     environment:
       name: release
-      url: https://pypi.org/p/tzdata
+      url: >-
+        https://pypi.org/project/tzdata/${{
+          github.event.release.tag_name
+        }}
+
     permissions:
       id-token: write
+
     steps:
-    - uses: actions/checkout@v6
-    - name: Set up Python
-      uses: actions/setup-python@v6
-      with:
-        python-version: '3.x'
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install -U tox
-    - name: Create tox environments
-      run: |
-        tox -p -e py,build --notest
-    - name: Run tests
-      run: |
-        tox -e py
-    - name: Build package
-      run: |
-        tox -e build
-    - name: Publish package (TestPyPI)
-      if: github.event_name == 'push'
-      uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        repository-url: https://test.pypi.org/legacy/
-        verbose: true
-    - name: Publish package
-      if: github.event_name == 'release'
-      uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        verbose: true
+      - name: Download packages built by build-and-inspect-python-package
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: Packages
+          path: dist
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0

.github/workflows/tests.yml

@@ -5,8 +5,11 @@ on:
     branches:
       - main
   pull_request:
+  workflow_call:
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   tests:
 
@@ -25,12 +28,14 @@ jobs:
     env:
       TOXENV: py
     container:
-      image: ${{ matrix.use-container && format('python:{0}', matrix.python-version) || '' }}
+      image: ${{ matrix.use-container && format('python:{0}', matrix.python-version) || '' }}  # zizmor: ignore[unpinned-images]
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        persist-credentials: false
     - if: ${{ !matrix.use-container }}
       name: Set up Python ${{ matrix.python-version }} on ${{ matrix.os }} (non-containers)
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: ${{ matrix.python-version }}
         allow-prereleases: true
@@ -46,14 +51,16 @@ jobs:
     runs-on: "ubuntu-latest"
     strategy:
       matrix:
-        toxenv: ["build", "precommit", "typing", "docs"]
+        toxenv: ["precommit", "typing", "docs"]
     env:
       TOXENV: ${{ matrix.toxenv }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: ${{ matrix.toxenv }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.x"
       - name: Install tox

.pre-commit-config.yaml

@@ -1,12 +1,12 @@
 repos:
   - repo: https://github.com/psf/black
-    rev: 25.9.0
+    rev: 26.3.1
     hooks:
       - id: black
         language_version: "python3.12"
 
   - repo: https://github.com/pycqa/isort
-    rev: 7.0.0
+    rev: 8.0.1
     hooks:
       - id: isort
         additional_dependencies: [ toml ]
@@ -18,7 +18,28 @@ repos:
       - id: trailing-whitespace
       - id: debug-statements
 
+  - repo: https://github.com/python-jsonschema/check-jsonschema
+    rev: 0.37.1
+    hooks:
+      - id: check-dependabot
+      - id: check-github-workflows
+
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.12
+    hooks:
+      - id: actionlint
+
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.24.1
+    hooks:
+      - id: zizmor
+
   - repo: https://github.com/asottile/setup-cfg-fmt
-    rev: v3.1.0
+    rev: v3.2.0
     hooks:
     -   id: setup-cfg-fmt
+
+  - repo: meta
+    hooks:
+      - id: check-hooks-apply
+      - id: check-useless-excludes

NEWS.md

@@ -1,3 +1,22 @@
+# Version 2026.2
+Upstream version 2026b released 2026-04-23T06:06:43+00:00
+
+## Briefly:
+
+British Columbia moved to permanent -07 on 2026-03-09. Some more overflow bugs
+have been fixed in zic.
+
+## Changes to future timestamps
+
+British Columbia’s 2026-03-08 spring forward was its last foreseeable clock
+change, as it moved to permanent -07 thereafter. (Thanks to Arthur David Olson.)
+Although the change to permanent -07 legally took place on 2026-03-09,
+temporarily model the change to occur on 2026-11-01 at 02:00 instead.  This
+works around a limitation in CLDR v48.2 (2026-03-17).  This temporary hack is
+planned to be removed after CLDR is fixed.
+
+---
+
 # Version 2026.1
 Upstream version 2026a released 2026-03-02T06:59:49+00:00
 

README.rst

@@ -4,7 +4,7 @@ tzdata: Python package providing IANA time zone data
 This is a Python package containing ``zic``-compiled binaries for the IANA time
 zone database. It is intended to be a fallback for systems that do not have
 system time zone data installed (or don't have it installed in a standard
-location), as a part of `PEP 615 <https://www.python.org/dev/peps/pep-0615/>`_
+location), as a part of `PEP 615 <https://www.python.org/dev/peps/pep-0615/>`_.
 
 This repository generates a ``pip``-installable package, published on PyPI as
 `tzdata <https://pypi.org/project/tzdata>`_.