[dependabot]

Bumps timex from 3.7.13 to 4.0.0.

Release notes

Sourced from timex's releases.

v4.0.0

See CHANGELOG.md and the migration guidance in README.md for more details on this release

Changelog

Sourced from timex's changelog.

4.0.0 — Unreleased

Added/Changed

• Require Elixir 1.16 and Erlang/OTP 26 or later.

• Require tzdata 1.2.2 or later and use its verified built-in HTTP client by default, removing Timex's mandatory Hackney dependency chain. Deployments need an OS CA certificate bundle; remove explicit Hackney client configuration to use the default. Applications depending on Hackney separately must update and audit that dependency themselves.

• Support both Gettext 0.26 and Gettext 1.x.

• Remove deprecated protocol default arguments for Elixir 1.20 compatibility. Timex.compare/2, Timex.diff/2 and Timex.to_datetime/1 retain their defaults; direct calls to the protocols must supply the granularity or timezone explicitly.

• Improve duration parsing performance.

• Add the cycled option to Timex.between?/4 for time ranges crossing midnight.

• Add Croatian translations.

• Use current Elixir charlist and stepped-range syntax.

• Verify GitHub Actions dependencies with a generated action lockfile and add actionlint, ShellCheck and zizmor checks, with pinned tools and least-privilege workflow permissions.

• Define ISO date arithmetic/conversion support as years 0 through 9999, with explicit unsupported-calendar/year errors and consistent boundary checks on supported runtimes. Convert other calendars explicitly before calling Timex (#765, #449).

• Relative Date targets now compare calendar days against the reference's UTC date; datetime targets retain elapsed-time semantics (#775).

• Validate setters after applying all replacements, clamping the day against the final year/month. Preserve raw validate: false updates and tuple shapes. Zoned setters refresh metadata against the final wall time and expose gaps and overlaps explicitly (#411).

• Accept TZif version 4 containers and preserve their raw leap records, including truncation and expiration data.

• Explicit POSIX timezone conversions now use the same gap-boundary and overlap results as IANA zones. PosixTimezone.is_dst?/2 returns true only for a unique daylight interpretation; ambiguous or nonexistent wall times return false.

• Parsed POSIX transition bounds now store signed seconds from midnight rather than Time values, supporting hour 24 and signed transition hours through 167. Existing custom PosixTimezone structs with Time bounds remain supported.

• Allow equal interval endpoints when both bounds are closed, representing a singleton that enumerates exactly once (#787).

• Naive datetime conversion through Timex.to_datetime/2 and Timex.Timezone.convert/2 now returns AmbiguousDateTime with type: :gap and the adjacent valid boundaries for nonexistent IANA wall times, consistently for zone names and TimezoneInfo inputs (#789, #691). Callers matching {:error, {:could_not_resolve_timezone, ...}} for gaps must handle this result

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)