[Rick Brighenti (rbrighenti)]

Summary

Refreshes stale time-zone data packages pinned in uv.lock for Canada-2026 time-zone readiness (IcM 894123555).

Package	Before	After
tzdata	2025.3	2026.5
pytz	2026.1.post1	2026.5

Generated with uv lock --upgrade-package tzdata --upgrade-package pytz. No pyproject.toml, constraint, or build-system changes. The diff touches only the tzdata and pytz lock entries (versions, URLs, hashes).

The package feed now returns size/upload-time metadata, so uv would otherwise rewrite every entry in the lock. Those fields were left out of the two updated entries to keep the diff limited to these packages. uv lock --check and uv sync --locked --all-extras --dev both pass.

Dependency paths (both transitive)

• tzdata: microsoft-agents-a365-tooling-extensions-googleadk -> google-adk -> tzlocal -> tzdata (Windows only)
• pytz: microsoft-agents-a365-tooling-extensions-agentframework -> agent-framework -> agent-framework-core[all] -> agent-framework-mem0 -> mem0ai -> pytz

Impact

This only affects dev and CI environments built from uv.lock. SDK code does not use either package, and published wheel metadata does not reference them. Published packages are unaffected and no release is needed.

Validation

• uv lock --check: passes
• uv sync --locked --all-extras --dev: passes; installed tzdata 2026.5 and pytz 2026.5
• pytest tests/ -m "not integration": 859 passed, 3 skipped

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
pip/pytz	2026.5	Unknown	Unknown
pip/tzdata	2026.5	🟢 7	Details Check Score Reason Code-Review 🟢 7 Found 13/17 approved changesets -- score normalized to 7 Maintained 🟢 7 6 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 7 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 4 dependency not pinned by hash detected -- score normalized to 4 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 9 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• uv.lock