CyberNative

Forecast · 1 November 2026 · Frozen · Scored 2 November 2026

We said 532 It was 481 of 1,000 popular Docker Hub images still carried a time-zone copy that our scan found wrong for at least one Canadian zone at 08:00 UTC on 1 November.

Correction: one image we counted as fixed is still wrong, so the corrected count is 482. The correction

Software that works only in UTC is unaffected by these Canadian time-zone changes. The wrong hour can appear when a program uses out-of-date time-zone data for an affected Canadian zone, for example a scheduler or a database set to America/Edmonton.

Counted the 181 official images and the 819 most-pulled community repositories our searches of Docker Hub find (each with at least 57.9 million pulls). Scanned 1 November 2026: 923; not scanned: 77.

Our range 515–543 90% interval

Pushed since 16 Jul, fix routes only 272 range 255–281; 291 when we froze it Counts only images leaving through a published fix route. Images leaving through changes outside the route table (including images at the floor) and images becoming wrong are simulated for the whole frame but not split by maintained status, so the full maintained outcome can fall outside this range.

If nothing changes 557 the count when we froze it

Fix calls right 17 of 29 called before the date, scored after

Fixed since our census 121 121 named below

Scored 2 November 2026

Outside our range but closer than the freeze-day count

We forecast 532 (range 515–543). On 1 November 2026 it was 481, of 923 scanned; 77 not scanned.

Correction, 1 November 2026

We counted library/jruby as fixed, but it is still wrong. Its jruby.jar carries Joda-Time's time-zone data, older than 2026b, and JRuby uses that copy for Ruby's built-in Time (for example Time#localtime); the image does not configure another source. We measured the copy's offsets: it is wrong for Vancouver, Edmonton, Inuvik and Winnipeg. Our scanner classed it as a library copy outside the default, so the frozen rules counted the image as fixed after its Java update.

Counted with this correction, it was 482: our forecast was off by 50, the freeze-day count by 75. Still outside our range, and our forecast was still closer. The score above follows the rules we froze on 24 October 2026. The daily counts from 30 October 2026 to 1 November 2026 were each one too low for the same reason. Corrections to the method.

Both comparisons assume nothing changes after the freeze day: the count stays where it was, and no image gets fixed.
ScoreOur forecast (532)Freeze-day count (557)
Count, off by5176
Fix calls, Brier score (lower is better)0.35every image called “not fixed” 0.31
Fix calls right17 of 29–

What we got wrong

  • The count: it was 481, outside our 515–543 range.
  • library/nginx: we gave it a 0% chance of a fix by 1 November 2026 and called it not fixed; NGINX (F5) fixed it on 29 October 2026.
  • library/memcached: we gave it a 0% chance of a fix by 1 November 2026 and called it not fixed; Memcached Docker Official Image maintainers fixed it on 29 October 2026.
  • library/redis: we gave it a 40% chance of a fix by 1 November 2026 and called it not fixed; Redis Docker Official Image maintainers fixed it on 27 October 2026.
  • jenkins/jenkins: we gave it a 0% chance of a fix by 1 November 2026 and called it not fixed; Jenkins project fixed it on 29 October 2026.
  • library/httpd: we gave it a 0% chance of a fix by 1 November 2026 and called it not fixed; httpd Docker Official Image maintainers fixed it on 29 October 2026.
  • timberio/vector: we gave it a 0% chance of a fix by 1 November 2026 and called it not fixed; Vector (Datadog) fixed it on 30 October 2026.
  • library/golang: we gave it a 0% chance of a fix by 1 November 2026 and called it not fixed; Go Docker Official Image maintainers fixed it on 29 October 2026.
  • library/sonarqube: we gave it a 40% chance of a fix by 1 November 2026 and called it not fixed; SonarSource fixed it on 30 October 2026.
  • cloudcustodian/c7n: we gave it a 90% chance of a fix by 1 November 2026 and called it fixed; it was not fixed by then.
  • cloudcustodian/c7n-org: we gave it a 90% chance of a fix by 1 November 2026 and called it fixed; it was not fixed by then.
  • altinity/metrics-exporter: we gave it a 82% chance of a fix by 1 November 2026 and called it fixed; it was not fixed by then.
  • altinity/clickhouse-operator: we gave it a 82% chance of a fix by 1 November 2026 and called it fixed; it was not fixed by then.

Read the post-mortem

The count, day by day

Images our scan judges wrong for Canadian zones on 1 November, by day 481 were wrong on 1 November 2026, of 923 scanned. The forecast for 1 November 2026 was 532, range 515 to 543; with no change it would have been 557. On 1 November 2026 it was 481. It turns on 2 cases: Debian accepts the 2026e update but no Debian base image rebuild happens before 1 November; the official Eclipse Temurin images do not publish the October Java update before 1 November, 57%, 537; Debian accepts the 2026e update but no Debian base image rebuild happens before 1 November; the official Eclipse Temurin images publish the October Java update before 1 November, 43%, 523. 374 had no published fix when we froze the forecast. The table below has every day. 374 had no published fix when we froze the forecast30047565019 Oct21 Oct23 Oct25 Oct27 Oct29 Oct1 NovFreeze-day count: 55719 October 2026: 602 wrong of 923 scanned, 77 not scanned20 October 2026: 597 wrong of 923 scanned, 77 not scanned21 October 2026: 595 wrong of 923 scanned, 77 not scanned22 October 2026: 580 wrong of 923 scanned, 77 not scanned23 October 2026: 566 wrong of 923 scanned, 77 not scanned24 October 2026: 557 wrong of 923 scanned, 77 not scanned25 October 2026: 553 wrong of 923 scanned, 77 not scanned26 October 2026: 553 wrong of 923 scanned, 77 not scanned27 October 2026: 547 wrong of 923 scanned, 77 not scanned28 October 2026: 537 wrong of 923 scanned, 77 not scanned29 October 2026: 509 wrong of 923 scanned, 77 not scanned30 October 2026: 486 wrong of 923 scanned, 77 not scanned31 October 2026: 482 wrong of 923 scanned, 77 not scanned1 November 2026: 481 wrong of 923 scanned, 77 not scannedForecast for 1 November 2026: 532 (range 515–543)57%: 537Forecast 53243%: 523range 515–543Observed on 1 November 2026: 481 Images our scan judges wrong for Canadian zones on 1 November, by day 481 were wrong on 1 November 2026, of 923 scanned. The forecast for 1 November 2026 was 532, range 515 to 543; with no change it would have been 557. On 1 November 2026 it was 481. It turns on 2 cases: Debian accepts the 2026e update but no Debian base image rebuild happens before 1 November; the official Eclipse Temurin images do not publish the October Java update before 1 November, 57%, 537; Debian accepts the 2026e update but no Debian base image rebuild happens before 1 November; the official Eclipse Temurin images publish the October Java update before 1 November, 43%, 523. 374 had no published fix when we froze the forecast. The table below has every day. 374 had no published fix when we frozethe forecast30047565019 Oct23 Oct27 Oct1 NovFreeze-daycount: 55719 October 2026: 602 wrong of 923 scanned, 77 not scanned20 October 2026: 597 wrong of 923 scanned, 77 not scanned21 October 2026: 595 wrong of 923 scanned, 77 not scanned22 October 2026: 580 wrong of 923 scanned, 77 not scanned23 October 2026: 566 wrong of 923 scanned, 77 not scanned24 October 2026: 557 wrong of 923 scanned, 77 not scanned25 October 2026: 553 wrong of 923 scanned, 77 not scanned26 October 2026: 553 wrong of 923 scanned, 77 not scanned27 October 2026: 547 wrong of 923 scanned, 77 not scanned28 October 2026: 537 wrong of 923 scanned, 77 not scanned29 October 2026: 509 wrong of 923 scanned, 77 not scanned30 October 2026: 486 wrong of 923 scanned, 77 not scanned31 October 2026: 482 wrong of 923 scanned, 77 not scanned1 November 2026: 481 wrong of 923 scanned, 77 not scannedForecast for 1 November 2026: 532 (range 515–543)57%: 537Forecast 53243%: 523range 515–543Observed on 1 November 2026: 481
Each point is one daily read of the 1,000 repositories at the tag current that day; an image is scanned again only when its tag points to a new image. The 77 we could not scan are not counted: 55 have no linux/amd64 tag, and for 22 the pull or scan failed. The shaded band is the range we gave a 90% chance, frozen on 24 October. The marks on it are our cases, each with the chance we gave it; they are explained under “What the number turns on”. The dashed line is the freeze-day count: the forecast is only worth something if it ended closer to the real count than that line. Pull counts are lifetime totals, so the 1,000 include old, unmaintained repositories. Beside the range is a separate forecast for images whose tag was pushed since 16 July; the note under it says what it leaves out.

Check your own images

361 of 557 have a wrong copy outside the operating system's package

  • 174 have no wrong copy where the OS package keeps its time-zone files, so a check of that package finds nothing wrong
  • 187 have one wrong copy where the OS package keeps its files and another elsewhere, so updating the package leaves the other behind
  • 196 have every wrong copy where the OS package keeps its time-zone files

The usual check, dpkg -s tzdata (or apk or rpm), reads only the operating system's package. In at least 361 of the 557 images that were wrong on 24 October, a wrong copy sits outside that package, in a JDK, Node.js, PHP, ICU or a copied zoneinfo folder, so updating the package the check reports does not fix them. tzscan finds every copy it recognises in an image without running it, private images included. If it finds a wrong copy, the tested fixes are in our runtimes and databases guides.

What the number turns on

When we froze the forecast, one question was open: would the official eclipse-temurin images publish the October Java update before 1 November? Eclipse Temurin released those builds on 22 October, but the official images had not picked them up. These are our cases, frozen with the forecast. On 28 October, before 1 November, Docker Hub's debian:12 and debian:13 images were rebuilt with tzdata 2026e. Both cases assumed that would not happen. The forecast was scored as published. On 29 October the official eclipse-temurin images for Java 21 and 25 moved to the October release.

  1. 57%Debian accepts the 2026e update but no Debian base image rebuild happens before 1 November; the official Eclipse Temurin images do not publish the October Java update before 1 NovemberCount: 537
  2. 43%Debian accepts the 2026e update but no Debian base image rebuild happens before 1 November; the official Eclipse Temurin images publish the October Java update before 1 NovemberCount: 523

Who fixed it

Images fixed since our census of 18 October, meaning our scan now judges no default time-zone copy it recognises in them wrong. Each row links the fixed image on Docker Hub or, where Docker Hub no longer shows the image we scanned, says so; our record of every scan is in the forecast's data file. A deliberate fix means the publisher's own public commits around that time changed time-zone data. A rebuild means a scheduled or base-image rebuild picked up fixed data without such a commit. On 28 October, after we froze the forecast, tz 2026f kept Cuba on UTC−4 this winter. We judged every copy against 2026e as published, so fixed here means fixed for the four Canadian zones: a copy older than 2026f puts Havana an hour behind from 1 November.

A rebuild is not always a fix. Some images copy their time-zone files from a base image that is itself rebuilt on a schedule; if that base still carries 2026c or older, the image is rebuilt, its date changes, and it still gives the wrong time.

Deliberate fix 1

  1. library/sapmachineSAP (SapMachine)

    SapMachine took in the OpenJDK change “(tz) Update Timezone Data to 2026e” (JDK-8393337, committed 3 October) for its Java 27 build; the 27 October image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /usr/lib/jvm/sapmachine-27/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label)

    Evidence for library/sapmachine

Rebuild 120

  1. networkstatic/iperf3The networkstatic/iperf3 image publisher
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for networkstatic/iperf3
  2. dagster/dagster-cloud-agentDagster Labs
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for dagster/dagster-cloud-agent
  3. flyway/flywayRedgate (Flyway)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for flyway/flyway
  4. metabase/metabaseMetabase
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label)

    Evidence for metabase/metabase
  5. ubnt/speedtestUbiquiti
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/local/bin/node 2023c to 2026e or later (judged from its tz release label)

    Evidence for ubnt/speedtest
  6. cloudflare/cloudflaredCloudflare
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Distroless): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for cloudflare/cloudflared
  7. codercom/code-serverCoder
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/lib/code-server/lib/node 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for codercom/code-server
  8. cypress/baseCypress.io
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/local/bin/node 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for cypress/base
112 earlier rebuilds
  1. guacamole/guacamoleApache Guacamole (Apache Software Foundation)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 26.04.1 LTS): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label)

    Evidence for guacamole/guacamole
  2. jenkins/ssh-agentJenkins project
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for jenkins/ssh-agent
  3. library/bonitaBonita Docker Official Image maintainers
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.23): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026d to 2026e or later (offsets measured)

    Evidence for library/bonita
  4. library/clojureClojure Docker Official Image maintainers
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 12 (bookworm)): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/clojure
  5. library/convertigoConvertigo
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label)

    Evidence for library/convertigo
  6. library/eclipse-temurinEclipse Adoptium
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 26.04.1 LTS): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label)

    Evidence for library/eclipse-temurin
  7. library/gradleGradle
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 26.04.1 LTS): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label)

    Evidence for library/gradle
  8. library/groovyApache Groovy Docker Official Image maintainers
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label)

    Evidence for library/groovy
  9. library/jettyEclipse Jetty
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 26.04.1 LTS): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label)

    Evidence for library/jetty
  10. library/jrubyJRuby

    Still wrong. Correction, 1 November: its jruby.jar carries Joda-Time zone data older than 2026b, which JRuby uses for Ruby's built-in Time; wrong for Vancouver, Edmonton, Inuvik and Winnipeg. Why library/jruby is still wrong

    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label)

    Evidence for library/jruby
  11. library/lightstreamerLightstreamer
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 26.04.1 LTS): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label)

    Evidence for library/lightstreamer
  12. library/liquibaseLiquibase
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 22.04.5 LTS): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label)

    Evidence for library/liquibase
  13. library/neo4jNeo4j
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/neo4j
  14. library/solrApache Solr (Apache Software Foundation)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label)

    Evidence for library/solr
  15. library/sonarqubeSonarSource
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label)

    Evidence for library/sonarqube
  16. library/sparkApache Spark (Apache Software Foundation)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 22.04.5 LTS): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label); release not determined, so not judged: /usr/lib/x86_64-linux-gnu/libicudata.so.70.1

    Evidence for library/spark
  17. library/stormApache Storm (Apache Software Foundation)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 26.04.1 LTS): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label)

    Evidence for library/storm
  18. library/tomcatTomcat Docker Official Image maintainers
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 26.04.1 LTS): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label)

    Evidence for library/tomcat
  19. library/tomeeTomitribe (Apache TomEE)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label)

    Evidence for library/tomee
  20. timberio/vectorVector (Datadog)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Distroless): /usr/share/zoneinfo 2026b to 2026e or later (offsets measured)

    Evidence for timberio/vector
  21. certbot/certbotElectronic Frontier Foundation (Certbot)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.23): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for certbot/certbot
  22. jenkins/jenkinsJenkins project
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /opt/java/openjdk/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for jenkins/jenkins
  23. library/chronografInfluxData
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 12 (bookworm)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/chronograf
  24. library/dartDart team
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/dart
  25. library/drupalDrupal Docker Official Image maintainers
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/lib/apache2/modules/libphp.so 2026c to 2026e or later (offsets measured); /usr/local/bin/php 2026c to 2026e or later (offsets measured); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/drupal
  26. library/emqxEMQ Technologies (EMQX)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/emqx
  27. library/espocrmEspoCRM
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/lib/apache2/modules/libphp.so 2026c to 2026e or later (offsets measured); /usr/local/bin/php 2026c to 2026e or later (offsets measured); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/espocrm
  28. library/fluentdFluentd project
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/fluentd
  29. library/ghostGhost Foundation
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 12 (bookworm)): /usr/local/bin/node 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/ghost
  30. library/golangGo Docker Official Image maintainers
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/golang
  31. library/haskellHaskell Docker Official Image maintainers
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 12 (bookworm)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/haskell
  32. library/haxeHaxe Foundation
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/haxe
  33. library/httpdhttpd Docker Official Image maintainers
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/httpd
  34. library/influxdbInfluxData
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 12 (bookworm)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/influxdb
  35. library/irssiirssi Docker Official Image maintainers
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/irssi
  36. library/juliaJulia Docker Official Image maintainers
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/julia
  37. library/matomoMatomo
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/lib/apache2/modules/libphp.so 2026c to 2026e or later (offsets measured); /usr/local/bin/php 2026c to 2026e or later (offsets measured); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/matomo
  38. library/memcachedMemcached Docker Official Image maintainers
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/memcached
  39. library/nginxNGINX (F5)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/nginx
  40. library/nimNim Docker Official Image maintainers
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 12 (bookworm)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/nim
  41. library/phpPHP Docker Official Image maintainers
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/local/bin/php 2026c to 2026e or later (offsets measured); /usr/local/bin/php-cgi 2026c to 2026e or later (offsets measured); /usr/local/bin/phpdbg 2026c to 2026e or later (offsets measured); /usr/local/lib/libphp.so 2026c to 2026e or later (offsets measured); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/php
  42. library/rakudo-starRakudo
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/rakudo-star
  43. library/rocket.chatRocket.Chat
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/local/bin/node 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/rocket.chat
  44. library/telegrafInfluxData
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 12 (bookworm)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/telegraf
  45. library/varnishVarnish Software
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/varnish
  46. library/yourlsYOURLS
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/lib/apache2/modules/libphp.so 2026c to 2026e or later (offsets measured); /usr/local/bin/php 2026c to 2026e or later (offsets measured); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/yourls
  47. openresty/openrestyOpenResty
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 12 (bookworm)): /usr/share/zoneinfo 2026b to 2026e or later (offsets measured)

    Evidence for openresty/openresty
  48. sumologic/collectorSumo Logic
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /opt/SumoCollector/jre/lib/tzdb.dat 2026d to 2026e or later (judged from its tz release label)

    Evidence for sumologic/collector
  49. cimg/postgresCircleCI
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 22.04.5 LTS): /usr/share/zoneinfo-icu/44/be/zoneinfo64.res 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo-icu/44/le/zoneinfo64.res 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured); release not determined, so not judged: /usr/lib/x86_64-linux-gnu/libicudata.so.70.1

    Evidence for cimg/postgres
  50. library/almalinuxThe AlmaLinux OS Foundation
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (AlmaLinux 10.2 (Lavender Lion)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/almalinux
  51. library/debianDebian Docker Official Image maintainers (debuerreotype)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/debian
  52. library/haproxyHAProxy Docker Official Image maintainers
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/haproxy
  53. library/hitchVarnish Software (Hitch)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 12 (bookworm)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/hitch
  54. library/neurodebianNeuroDebian
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/neurodebian
  55. library/rethinkdbRethinkDB
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 12 (bookworm)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/rethinkdb
  56. library/satosaIdentityPython (SATOSA)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/satosa
  57. library/spipedspiped Docker Official Image maintainers
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/spiped
  58. matrixdotorg/synapseElement (Matrix Synapse)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for matrixdotorg/synapse
  59. falcosecurity/falcoctlThe Falco Project (falcoctl)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Wolfi): /usr/share/zoneinfo 2026d to 2026e or later (offsets measured)

    Evidence for falcosecurity/falcoctl
  60. library/hylangHy Docker Official Image maintainers
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/hylang
  61. library/redisRedis Docker Official Image maintainers
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/redis
  62. linuxserver/delugeLinuxServer.io
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.23): /usr/share/zoneinfo 2026d to 2026e or later (offsets measured)

    Evidence for linuxserver/deluge
  63. linuxserver/resilio-syncLinuxServer.io
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for linuxserver/resilio-sync
  64. valkey/valkeyValkey (valkey-io)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for valkey/valkey
  65. crazymax/diunCrazyMax (Diun)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.23): /usr/share/zoneinfo 2026b to 2026e or later (offsets measured)

    Evidence for crazymax/diun
  66. getwud/wudWUD (What's up Docker?)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/local/bin/node 2026c to 2026e or later (judged from its tz release label)

    Evidence for getwud/wud
  67. nginx/nginx-ingressNGINX (F5)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for nginx/nginx-ingress
  68. openspeedtest/latestOpenSpeedTest
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/share/zoneinfo older than 2026b to 2026e or later (offsets measured)

    Evidence for openspeedtest/latest
  69. caprover/caproverCapRover
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/local/bin/node 2026a to 2026e or later (judged from its tz release label)

    Evidence for caprover/caprover
  70. grafana/grafana-image-rendererGrafana Labs
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/lib/chromium/icudtl.dat 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for grafana/grafana-image-renderer
  71. homeassistant/home-assistantHome Assistant
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/share/zoneinfo 2026b to 2026e or later (offsets measured)

    Evidence for homeassistant/home-assistant
  72. library/amazoncorrettoAmazon Corretto (Amazon Web Services)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Amazon Linux 2023.12.20261021): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/amazoncorretto
  73. library/eclipse-mosquittoEclipse Mosquitto
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.23): /usr/share/zoneinfo 2026d to 2026e or later (offsets measured)

    Evidence for library/eclipse-mosquitto
  74. linuxserver/code-serverLinuxServer.io
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /app/code-server/lib/node 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for linuxserver/code-server
  75. requarks/wikiWiki.js (Requarks)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/local/bin/node 2026c to 2026e or later (judged from its tz release label)

    Evidence for requarks/wiki
  76. sonarsoftware/customerportalSonar Software
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 22.04.1 LTS): /usr/share/zoneinfo-icu/44/be/zoneinfo64.res 2026a to 2026e or later (judged from its tz release label); /usr/share/zoneinfo-icu/44/le/zoneinfo64.res 2026a to 2026e or later (judged from its tz release label); /usr/share/zoneinfo older than 2026b to 2026e or later (offsets measured); release not determined, so not judged: /usr/lib/x86_64-linux-gnu/libicudata.so.70.1

    Evidence for sonarsoftware/customerportal
  77. zammad/zammad-docker-composeZammad
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for zammad/zammad-docker-compose
  78. bitnami/minidebBitnami (Broadcom)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for bitnami/minideb
  79. cimg/pythonCircleCI
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 26.04.1 LTS): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for cimg/python
  80. cimg/redisCircleCI
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 22.04.5 LTS): /usr/share/zoneinfo-icu/44/be/zoneinfo64.res 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo-icu/44/le/zoneinfo64.res 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured); release not determined, so not judged: /usr/lib/x86_64-linux-gnu/libicudata.so.70.1

    Evidence for cimg/redis
  81. concourse/s3-resourceConcourse
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Wolfi): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for concourse/s3-resource
  82. concourse/semver-resourceConcourse
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Wolfi): /usr/share/zoneinfo 2026d to 2026e or later (offsets measured)

    Evidence for concourse/semver-resource
  83. gitlab/gitlab-runnerGitLab
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for gitlab/gitlab-runner
  84. hashicorp/consulHashiCorp
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for hashicorp/consul
  85. hashicorp/consul-enterpriseHashiCorp
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for hashicorp/consul-enterprise
  86. library/amazonlinuxAmazon Linux (Amazon Web Services)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Amazon Linux 2023.12.20261021): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/amazonlinux
  87. library/redmineRedmine Docker Official Image maintainers
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/redmine
  88. linuxserver/lazylibrarianLinuxServer.io
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 26.04.1 LTS): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for linuxserver/lazylibrarian
  89. n8nio/n8nn8n
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Docker Hardened Images/Alpine Linux v3.24): /usr/bin/node 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for n8nio/n8n
  90. netdata/netdataNetdata
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for netdata/netdata
  91. verdaccio/verdaccioVerdaccio
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/local/bin/node 2026a to 2026e or later (judged from its tz release label)

    Evidence for verdaccio/verdaccio
  92. bitnami/wordpressBitnami (Broadcom)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (VMware Photon OS/Linux): /opt/bitnami/apache/modules/libphp.so 2026c to 2026e or later (offsets measured); /opt/bitnami/php/bin/php 2026c to 2026e or later (offsets measured); /opt/bitnami/php/bin/php-cgi 2026c to 2026e or later (offsets measured); /opt/bitnami/php/bin/phpdbg 2026c to 2026e or later (offsets measured); /opt/bitnami/php/sbin/php-fpm 2026c to 2026e or later (offsets measured); /usr/lib/libicudata.so.76.1 2024b, removed

    Evidence for bitnami/wordpress
  93. cimg/rubyCircleCI
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 22.04.5 LTS): /usr/share/zoneinfo-icu/44/be/zoneinfo64.res 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo-icu/44/le/zoneinfo64.res 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured); release not determined, so not judged: /usr/lib/x86_64-linux-gnu/libicudata.so.70.1

    Evidence for cimg/ruby
  94. cockroachdb/cockroachCockroach Labs
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Red Hat Enterprise Linux 10.2 (Coughlan)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for cockroachdb/cockroach
  95. concourse/registry-image-resourceConcourse
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Wolfi): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for concourse/registry-image-resource
  96. gremlin/gremlinGremlin
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Wolfi): /usr/share/zoneinfo 2026d to 2026e or later (offsets measured)

    Evidence for gremlin/gremlin
  97. hashicorp/tfc-agentHashiCorp
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for hashicorp/tfc-agent
  98. library/adminerAdminer Docker Official Image maintainers
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/local/bin/php 2026c to 2026e or later (offsets measured); /usr/local/bin/php-cgi 2026c to 2026e or later (offsets measured); /usr/local/bin/phpdbg 2026c to 2026e or later (offsets measured)

    Evidence for library/adminer
  99. library/composerComposer
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/local/bin/php 2026c to 2026e or later (offsets measured); /usr/local/bin/php-cgi 2026c to 2026e or later (offsets measured); /usr/local/bin/phpdbg 2026c to 2026e or later (offsets measured)

    Evidence for library/composer
  100. library/eggdropEggheads (Eggdrop)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.23): /usr/share/zoneinfo 2026d to 2026e or later (offsets measured)

    Evidence for library/eggdrop
  101. linuxserver/nzbhydra2LinuxServer.io
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for linuxserver/nzbhydra2
  102. nodered/node-redNode-RED
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/local/bin/node 2026c to 2026e or later (judged from its tz release label)

    Evidence for nodered/node-red
  103. organizr/organizrOrganizr
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/bin/php81 older than 2026b, removed; /usr/sbin/php-fpm81 older than 2026b, removed; /usr/share/zoneinfo older than 2026b to 2026e or later (offsets measured)

    Evidence for organizr/organizr
  104. syncthing/syncthingSyncthing
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/share/zoneinfo 2026d to 2026e or later (offsets measured)

    Evidence for syncthing/syncthing
  105. sysdig/agentSysdig
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Red Hat Enterprise Linux 9.8 (Plow)): /usr/share/javazi-1.8/tzdb.dat 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for sysdig/agent
  106. linuxserver/ddclientLinuxServer.io
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.22): /usr/share/zoneinfo 2026d to 2026e or later (offsets measured)

    Evidence for linuxserver/ddclient
  107. linuxserver/smokepingLinuxServer.io
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.22): /usr/share/zoneinfo 2026d to 2026e or later (offsets measured)

    Evidence for linuxserver/smokeping
  108. amazon/aws-for-fluent-bitAmazon Web Services (AWS for Fluent Bit)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Amazon Linux 2): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for amazon/aws-for-fluent-bit
  109. datadog/agentDatadog
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for datadog/agent
  110. datadog/cluster-agentDatadog
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for datadog/cluster-agent
  111. grafana/alloyGrafana Labs
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for grafana/alloy
  112. splunk/universalforwarderSplunk
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Red Hat Enterprise Linux 8.10 (Ootpa)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for splunk/universalforwarder

Our fix calls

The chance we gave each image that our scan would find none of its default copies wrong on 1 November, set when we froze the forecast and not changed since. A chance of 50% or more counts as a call of fixed. We scored every call we could read, named any we could not, and compared the whole forecast with the freeze-day count.

ImageOur chance it is fixed in timeOur callOn 1 Nov
cloudcustodian/c7n90%Fixed WrongNot fixed
cloudcustodian/c7n-org90%Fixed WrongNot fixed
altinity/metrics-exporter82%Fixed WrongNot fixed
altinity/clickhouse-operator82%Fixed WrongNot fixed
getwud/wud74%Fixed RightFixed 25 Oct
stakater/reloader44%Not fixed RightNot fixed
fluent/fluent-bit41%Not fixed RightNot fixed
library/redis40%Not fixed WrongFixed 27 Oct
library/sonarqube40%Not fixed WrongFixed 30 Oct
grafana/loki26%Not fixed RightNot fixed
bitnami/sealed-secrets-controller17%Not fixed RightNot fixed
kong/kong-gateway17%Not fixed RightNot fixed
amazon/aws-xray-daemon17%Not fixed RightNot fixed
kiwigrid/k8s-sidecar12%Not fixed RightNot fixed
library/mongo6%Not fixed RightNot fixed
jenkins/jenkins0%Not fixed WrongFixed 29 Oct
library/docker0%Not fixed RightNot fixed
library/golang0%Not fixed WrongFixed 29 Oct
library/httpd0%Not fixed WrongFixed 29 Oct
library/memcached0%Not fixed WrongFixed 29 Oct
library/nginx0%Not fixed WrongFixed 29 Oct
library/node0%Not fixed RightNot fixed
library/postgres0%Not fixed RightNot fixed
library/python0%Not fixed RightNot fixed
linuxserver/radarr0%Not fixed RightNot fixed
linuxserver/sonarr0%Not fixed RightNot fixed
newrelic/infrastructure-bundle0%Not fixed RightNot fixed
openpolicyagent/gatekeeper0%Not fixed RightNot fixed
timberio/vector0%Not fixed WrongFixed 30 Oct

Every day

DayScanned of 1,000WrongWrong, main­tainedFixed since census
923481221121
923482222120
923486225116
92350924893
92353727565
92354728455
92355329049
92355329049
92355729145
92356629936
92358031322
9235953277
9235973295
9236023340

Canada, 1 November 2026 · where the rules live

Updating tzdata is not one step. Your code reads one copy of the rules. Update that copy first.

A container image can carry several copies of the time-zone database. Most programs read the operating system's copy. Java and the official PHP images read their own, and so does Node.js through its built-in ICU; updating the OS tzdata package does not reach those. Go reads its own copy in a scratch image and Debian's on distroless static-debian12. Each plate below is one copy, with how many images in our census had that copy stale on 14 October.

What runs in your container?

Pick what runs, and the plate it reads lights up.

Most programs read the operating system's copy. Java, the official PHP images, Node.js and some Go programs read a copy of their own, which updating the OS tzdata package does not reach: of the 153 images, a newer OS package alone fixes only 57.

Reads the operating system's copy, /usr/share/zoneinfo

Census stale in 134 of the 153 images, 119 of them at release 2026c (wrong for Inuvik and Winnipeg).

Update first the OS tzdata package, then restart each program: one that was already running can keep the rules it loaded. Ubuntu's update has carried 2026e since 14 October, Debian 13's since 22 October and Debian 12's since 23 October.

Reads Java's own copy, tzdb.dat, not the OS copy

Census stale in 38 of the 153 images, 36 of them at 2026b (April): wrong for Edmonton, Inuvik and Winnipeg.

Update first Java's copy: a Temurin build that carries 2026e or later (17.0.21, 21.0.13, 25.0.5, and on Java 8 and 11, 8u512 and 11.0.33, released on 4 November). The eclipse-temurin images for 8 and 11 moved to them on 10 November, except 8 on 32-bit ARM (armv7): there, replace tzdb.dat. Updating the OS package does not reach it. Then restart the Java processes.

Reads PHP's built-in copy, inside the PHP binary (official images; Debian's and Ubuntu's PHP packages read the OS copy)

Census a stale timelib in 18 of the 153 images; 2 of those are MongoDB images, not PHP.

Update first PHP's copy: upgrade to PHP 8.4.27 or 8.5.12, which carry 2026e; 8.2 and 8.3 will get no fix, so install PECL timezonedb. Updating the OS package does not reach it.

Reads Node's built-in ICU library, its own copy

Census an ICU copy was stale in 49 of the 153 images. That counts every ICU copy, not only Node's.

Update first Node itself: 24.22.1 and 22.23.4 carry 2026e. On an earlier 22 or 24, point ICU_TIMEZONE_FILES_DIR at the ICU project's 2026e files; Node reads that directory before its own copy.

Reads Go's built-in copy, if the binary has one (-tags timetzdata)

Census stale in 3 of the 153 images, all older than 2026b (wrong for all four zones). The current Go 1.27.3 carries 2026c: wrong for Inuvik and Winnipeg.

Update first ship current zoneinfo in the image. No Go release carries 2026e; the next data update is planned for Go 1.28, due February 2027.

Reads Debian's copy in the image, /usr/share/zoneinfo

Census the OS copy was stale in 134 of the 153 images. static-debian12 used Debian's 2026b: wrong for Edmonton, Inuvik and Winnipeg.

Update first move to gcr.io/distroless/static or static-debian13, which carry 2026e, or copy current zoneinfo over the image's own.

  1. A library's or program's own copy joda threetenbp MySQL's tables and more Counting these too, 158 of the 189 images have a stale copy; counting main copies only, 153
  2. Go's built-in copy go-embedded compiled into the binary 3 of the 153 have it stale
  3. PHP's built-in copy timelib inside the PHP binary; MongoDB carries one too 18 of the 153 have a stale timelib, 2 of them MongoDB images
  4. ICU's copy, including Node's built-in ICU icu ICU data files and libraries 49 of the 153 have it stale
  5. Java's own copy jdk-tzdb tzdb.dat in the JDK 38 of the 153 have it stale
  6. The operating system's copy zoneinfo /usr/share/zoneinfo 134 of the 153 have it stale; a newer OS package alone fixes 57

Reading your image's row in the census data

WRONG_DEFAULT
a main copy is stale. The column defaultWrongCopies names it; find that name on a plate.
WRONG_LIBRARY_ONLY
main copies fine or absent; a library's or program's own copy is stale (top plate).
CURRENT
every copy found is current. Nothing to update for these rules.
NO_TZ_DATA
no time-zone data found in the image.
Our container census: 270 popular Docker Hub images pinned and read on 14 October 2026. Of the 189 updated since 16 July, 153 have a main copy that gives the wrong time for some Canadian zones after 1 November; every plate but the top one counts within those 153. An image with several stale copies counts on several plates. Which copy each runtime reads and each fix are from our tested runtimes guide. The notched plates were stale in at least one image; a plate is not stale in yours unless your image's row names it.

How we forecast

Each repository's main tag is scanned for the time-zone copies our scanner recognises (OS zoneinfo, Java, ICU, PHP, Go and others). An image counts as wrong if any copy it uses by default is judged to give a wrong offset for Vancouver, Edmonton, Inuvik or Winnipeg: offsets are measured for zoneinfo-format copies and inferred from the tz release label for Java and ICU copies. Each wrong copy is given its published fix route; an image leaves the count only when its slowest copy is fixed and its tag is rebuilt after that. Shared events (Debian's update, base image rebuilds) are simulated once per run for all their children. The frozen method.

Every date on the Breakage Calendar