Dependabot unsupported timezone: "Europe/Kyiv"

[yukal]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

npm

Package manager version

6.14.16, 8.11.0, 8.19.2

Language version

12, 14, 16, 18

Manifest location and content before the Dependabot update

There is only one package.json file exists at the root of my project
https://github.com/yukal/experimentals/blob/dev/package.json

dependabot.yml content

https://github.com/yukal/experimentals/blob/b395ce48f2cc3a8dc83c2bbeb40da403a051a5c8/.github/dependabot.yml#L11

Updated dependency

No response

What you expected to see, versus what you actually saw

I carefully read the documentation about the timezone following the List of tz database time zones, I found the timezone I needed.
I expected that the timezone Europe/Kyiv should work well, but I got an error: "is not a valid timezone".

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

Here the dump of the logs
https://github.com/yukal/experimentals/runs/9449227640

Smallest manifest that reproduces the issue

No response

[jeffwidman]

I just checked and the internal Dependabot API that handles the config file is using the timezone dataset provided by the Ruby gem: "tzinfo-data", "1.2022.6" https://github.com/tzinfo/tzinfo-data/releases/tag/v1.2022.6

It looks like the Kyiv spelling landed fairly only in August in 2022b: https://stackoverflow.com/a/73709276/770425 but

Surprisingly however, the Ruby gem claims to pull in the 2022f release of the IANA database, which is definitely more recent than 2022b where Kyiv was added... so it should work. Confirmed via irb:

$ gem install tzinfo
... 
$ gem install tzinfo-data
...
Successfully installed tzinfo-data-1.2022.6
Parsing documentation for tzinfo-data-1.2022.6
Installing ri documentation for tzinfo-data-1.2022.6
Done installing documentation for tzinfo-data after 0 seconds
1 gem installed
$ irb
3.1.2 :001 > require "tzinfo"
 => true 
3.1.2 :002 > TZInfo::Timezone.get("Europe/Kyiv") # if invalid, this should throw `TZInfo::InvalidTimezoneIdentifier`
 => #<TZInfo::DataTimezone: Europe/Kyiv> 

I'm wondering if that Dependabot CI check uses a different set of code for validation than what the API service uses? I'll have to check internally on that one...

[jeffwidman]

So I found an internal place where we're hardcoding the list of timezones, and that's likely why this isn't getting picked up. I filed an internal ticket for myself to remove the hardcoding... it'll probably take a week or two before I get time to tackle it though.

[jeffwidman]

👋 So the hardcoded list is actually the config file schema JSON. While we don't expose that today, we may in the future (#1927) in which case we'll need that file to stay static.

So I updated the list of timezones specified in the schema to the ones listed in the IANA 2022g release from 2022-11-29: https://data.iana.org/time-zones/tzdb/NEWS

That includes the "Europe/Kyiv" timezone.

I just deployed that, so it should work now. Thanks again for the heads up that we were behind.

[yukal]

Oh, it works now! Thank you, @jeffwidman for the promptness :)