Bump some of the dependencies

[harryzcy]

• Bazel dependencies gazelle, rules_rust, rules_python, rules_cc are updated
• rules_oci requires a major version bump, and is not included in this PR

Related to #1851

[gemini-code-assist]

Summary of Changes

Hello @harryzcy, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request focuses on routine maintenance by updating several key Bazel dependencies to their latest versions. This ensures the project benefits from the most recent bug fixes, performance improvements, and new features provided by these tools, contributing to a more stable and efficient build environment.

Highlights

• Dependency Updates: Updated the gazelle dependency from version "0.38.0" to "0.45.0".
• Dependency Updates: Updated the rules_rust dependency from version "0.63.0" to "0.64.0".
• Dependency Updates: Updated the rules_python dependency from version "1.5.3" to "1.6.1".
• Dependency Updates: Updated the rules_cc dependency from version "0.2.0" to "0.2.8".

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request updates four Bazel dependencies. While keeping dependencies current is important, this change introduces risks that should be addressed. The version bump for gazelle is particularly large and could introduce breaking changes. Furthermore, updating multiple dependencies in one go complicates testing and potential rollbacks. I've added two comments highlighting these concerns and suggesting best practices for dependency management.

[gemini-code-assist]

This update for Gazelle from 0.38.0 to 0.45.0 is a large version jump across seven minor versions for a pre-1.0 dependency. This significantly increases the risk of introducing breaking changes that could affect the go_deps extension. Given the empty pull request description, it's unclear if this has been validated. It is highly recommended to review the release notes for breaking changes. For such significant upgrades, consider smaller, incremental updates to reduce risk and simplify debugging.

[gemini-code-assist]

Updating four different dependencies in a single pull request makes it difficult to trace the source of any potential issues and complicates rollbacks. It's a best practice to update each dependency in a separate pull request. This allows for isolated testing and a clearer commit history, which is especially important when dealing with multiple pre-1.0 dependencies as is the case here.