Merge branch 'main' into exp/pypi-simplify

Author: aignas

.bazelci/presubmit.yml

@@ -91,20 +91,20 @@ tasks:
     <<: *common_workspace_flags_min_bazel
     <<: *minimum_supported_version
     name: "Gazelle: workspace, minimum supported Bazel version"
-    platform: ubuntu2004
+    platform: ubuntu2204
     build_targets: ["//..."]
     test_targets: ["//..."]
     working_directory: gazelle
   gazelle_extension_workspace:
     <<: *common_workspace_flags
     name: "Gazelle: workspace"
-    platform: ubuntu2004
+    platform: ubuntu2204
     build_targets: ["//..."]
     test_targets: ["//..."]
     working_directory: gazelle
   gazelle_extension:
     name: "Gazelle: default settings"
-    platform: ubuntu2004
+    platform: ubuntu2204
     build_targets: ["//..."]
     test_targets: ["//..."]
     working_directory: gazelle
@@ -114,28 +114,28 @@ tasks:
     <<: *reusable_config
     <<: *common_workspace_flags_min_bazel
     name: "Default: Ubuntu, workspace, minimum Bazel"
-    platform: ubuntu2004
+    platform: ubuntu2204
 
   ubuntu_min_bzlmod:
     <<: *minimum_supported_version
     <<: *reusable_config
     name: "Default: Ubuntu, bzlmod, minimum Bazel"
-    platform: ubuntu2004
+    platform: ubuntu2204
     bazel: 7.x
   ubuntu:
     <<: *reusable_config
     name: "Default: Ubuntu"
-    platform: ubuntu2004
+    platform: ubuntu2204
   ubuntu_upcoming:
     <<: *reusable_config
     name: "Default: Ubuntu, upcoming Bazel"
-    platform: ubuntu2004
+    platform: ubuntu2204
     bazel: last_rc
   ubuntu_workspace:
     <<: *reusable_config
     <<: *common_workspace_flags
     name: "Default: Ubuntu, workspace"
-    platform: ubuntu2004
+    platform: ubuntu2204
   mac_workspace:
     <<: *reusable_config
     <<: *common_workspace_flags
@@ -185,7 +185,7 @@ tasks:
     <<: *minimum_supported_version
     <<: *reusable_config
     name: "RBE: Ubuntu, minimum Bazel"
-    platform: rbe_ubuntu2004
+    platform: rbe_ubuntu2204
     build_flags:
       # BazelCI sets --action_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1,
       # which prevents cc toolchain autodetection from working correctly
@@ -203,7 +203,7 @@ tasks:
   rbe:
     <<: *reusable_config
     name: "RBE: Ubuntu"
-    platform: rbe_ubuntu2004
+    platform: rbe_ubuntu2204
     # TODO @aignas 2024-12-11: get the RBE working in CI for bazel 8.0
     # See https://github.com/bazelbuild/rules_python/issues/2499
     bazel: 7.x
@@ -217,13 +217,13 @@ tasks:
     <<: *common_workspace_flags_min_bazel
     name: "examples/build_file_generation: Ubuntu, workspace, minimum Bazel"
     working_directory: examples/build_file_generation
-    platform: ubuntu2004
+    platform: ubuntu2204
   integration_test_build_file_generation_ubuntu_workspace:
     <<: *reusable_build_test_all
     <<: *common_workspace_flags
     name: "examples/build_file_generation: Ubuntu, workspace"
     working_directory: examples/build_file_generation
-    platform: ubuntu2004
+    platform: ubuntu2204
   integration_test_build_file_generation_debian_workspace:
     <<: *reusable_build_test_all
     <<: *common_workspace_flags
@@ -249,21 +249,21 @@ tasks:
     coverage_targets: ["//:test"]
     name: "examples/bzlmod: Ubuntu, minimum Bazel"
     working_directory: examples/bzlmod
-    platform: ubuntu2004
+    platform: ubuntu2204
     bazel: 7.x
   integration_test_bzlmod_ubuntu:
     <<: *reusable_build_test_all
     <<: *coverage_targets_example_bzlmod
     name: "examples/bzlmod: Ubuntu"
     working_directory: examples/bzlmod
-    platform: ubuntu2004
+    platform: ubuntu2204
     bazel: 7.x
   integration_test_bzlmod_ubuntu_upcoming:
     <<: *reusable_build_test_all
     <<: *coverage_targets_example_bzlmod
     name: "examples/bzlmod: Ubuntu, upcoming Bazel"
     working_directory: examples/bzlmod
-    platform: ubuntu2004
+    platform: ubuntu2204
     bazel: last_rc
   integration_test_bzlmod_debian:
     <<: *reusable_build_test_all
@@ -276,7 +276,7 @@ tasks:
     <<: *reusable_build_test_all
     name: "examples/bzlmod: bazel vendor"
     working_directory: examples/bzlmod
-    platform: ubuntu2004
+    platform: ubuntu2204
     shell_commands:
     - "bazel vendor --vendor_dir=./vendor //..."
     - "bazel build --vendor_dir=./vendor //..."
@@ -316,19 +316,19 @@ tasks:
     <<: *coverage_targets_example_bzlmod_build_file_generation
     name: "examples/bzlmod_build_file_generation: Ubuntu, minimum Bazel"
     working_directory: examples/bzlmod_build_file_generation
-    platform: ubuntu2004
+    platform: ubuntu2204
     bazel: 7.x
   integration_test_bzlmod_generation_build_files_ubuntu:
     <<: *reusable_build_test_all
     <<: *coverage_targets_example_bzlmod_build_file_generation
     name: "examples/bzlmod_build_file_generation: Ubuntu"
     working_directory: examples/bzlmod_build_file_generation
-    platform: ubuntu2004
+    platform: ubuntu2204
   integration_test_bzlmod_generation_build_files_ubuntu_run:
     <<: *reusable_build_test_all
     name: "examples/bzlmod_build_file_generation: Ubuntu, Gazelle and pip"
     working_directory: examples/bzlmod_build_file_generation
-    platform: ubuntu2004
+    platform: ubuntu2204
     shell_commands:
     - "bazel run //:gazelle_python_manifest.update"
     - "bazel run //:gazelle -- update"
@@ -357,7 +357,7 @@ tasks:
     <<: *coverage_targets_example_multi_python
     name: "examples/multi_python_versions: Ubuntu, workspace"
     working_directory: examples/multi_python_versions
-    platform: ubuntu2004
+    platform: ubuntu2204
   integration_test_multi_python_versions_debian_workspace:
     <<: *reusable_build_test_all
     <<: *common_workspace_flags
@@ -386,19 +386,19 @@ tasks:
     <<: *reusable_build_test_all
     name: "examples/pip_parse: Ubuntu, workspace, minimum supported Bazel version"
     working_directory: examples/pip_parse
-    platform: ubuntu2004
+    platform: ubuntu2204
   integration_test_pip_parse_ubuntu_min_bzlmod:
     <<: *minimum_supported_version
     <<: *reusable_build_test_all
     name: "examples/pip_parse: Ubuntu, bzlmod, minimum supported Bazel version"
     working_directory: examples/pip_parse
-    platform: ubuntu2004
+    platform: ubuntu2204
     bazel: 7.x
   integration_test_pip_parse_ubuntu:
     <<: *reusable_build_test_all
     name: "examples/pip_parse: Ubuntu"
     working_directory: examples/pip_parse
-    platform: ubuntu2004
+    platform: ubuntu2204
   integration_test_pip_parse_debian:
     <<: *reusable_build_test_all
     name: "examples/pip_parse: Debian"
@@ -421,13 +421,13 @@ tasks:
     <<: *reusable_build_test_all
     name: "examples/pip_parse_vendored: Ubuntu, workspace, minimum Bazel"
     working_directory: examples/pip_parse_vendored
-    platform: ubuntu2004
+    platform: ubuntu2204
   integration_test_pip_parse_vendored_ubuntu:
     <<: *reusable_build_test_all
     <<: *common_workspace_flags
     name: "examples/pip_parse_vendored: Ubuntu"
     working_directory: examples/pip_parse_vendored
-    platform: ubuntu2004
+    platform: ubuntu2204
   integration_test_pip_parse_vendored_debian:
     <<: *reusable_build_test_all
     <<: *common_workspace_flags
@@ -450,7 +450,7 @@ tasks:
     <<: *common_workspace_flags
     name: "examples/py_proto_library: Ubuntu, workspace"
     working_directory: examples/py_proto_library
-    platform: ubuntu2004
+    platform: ubuntu2204
   integration_test_py_proto_library_debian_workspace:
     <<: *reusable_build_test_all
     <<: *common_workspace_flags
@@ -475,7 +475,7 @@ tasks:
     <<: *common_workspace_flags
     name: "examples/pip_repository_annotations: Ubuntu, workspace"
     working_directory: examples/pip_repository_annotations
-    platform: ubuntu2004
+    platform: ubuntu2204
   integration_test_pip_repository_annotations_debian_workspace:
     <<: *reusable_build_test_all
     <<: *common_workspace_flags
@@ -498,7 +498,7 @@ tasks:
   integration_test_bazelinbazel_ubuntu:
     <<: *common_bazelinbazel_config
     name: "tests/integration bazel-in-bazel: Ubuntu"
-    platform: ubuntu2004
+    platform: ubuntu2204
   integration_test_bazelinbazel_debian:
     <<: *common_bazelinbazel_config
     name: "tests/integration bazel-in-bazel: Debian"
@@ -508,7 +508,7 @@ tasks:
     <<: *reusable_build_test_all
     name: "compile_pip_requirements: Ubuntu"
     working_directory: tests/integration/compile_pip_requirements
-    platform: ubuntu2004
+    platform: ubuntu2204
     shell_commands:
     # Make a change to the locked requirements and then assert that //:requirements.update does the
     # right thing.
@@ -596,23 +596,23 @@ tasks:
     <<: *common_workspace_flags_min_bazel
     name: "compile_pip_requirements_test_from_external_repo: Ubuntu, workspace, minimum Bazel"
     working_directory: tests/integration/compile_pip_requirements_test_from_external_repo
-    platform: ubuntu2004
+    platform: ubuntu2204
     shell_commands:
     # Assert that @compile_pip_requirements//:requirements_test does the right thing.
     - "bazel test @compile_pip_requirements//..."
   integration_compile_pip_requirements_test_from_external_repo_ubuntu_min_bzlmod:
     <<: *minimum_supported_version
     name: "compile_pip_requirements_test_from_external_repo: Ubuntu, bzlmod, minimum Bazel"
     working_directory: tests/integration/compile_pip_requirements_test_from_external_repo
-    platform: ubuntu2004
+    platform: ubuntu2204
     bazel: 7.x
     shell_commands:
     # Assert that @compile_pip_requirements//:requirements_test does the right thing.
     - "bazel test @compile_pip_requirements//..."
   integration_compile_pip_requirements_test_from_external_repo_ubuntu:
     name: "compile_pip_requirements_test_from_external_repo: Ubuntu"
     working_directory: tests/integration/compile_pip_requirements_test_from_external_repo
-    platform: ubuntu2004
+    platform: ubuntu2204
     shell_commands:
     # Assert that @compile_pip_requirements//:requirements_test does the right thing.
     - "bazel test @compile_pip_requirements//..."

CHANGELOG.md

@@ -60,19 +60,21 @@ END_UNRELEASED_TEMPLATE
 * (gazelle) Types for exposed members of `python.ParserOutput` are now all public.
 * (gazelle) Removed the requirement for `__init__.py`, `__main__.py`, or `__test__.py` files to be
   present in a directory to generate a `BUILD.bazel` file.
-* (toolchain) Updated the following toolchains to build 20250702 to patch CVE-2025-47273:
+* (toolchain) Updated the following toolchains to build 20250708 to patch CVE-2025-47273:
     * 3.9.23
     * 3.10.18
     * 3.11.13
     * 3.12.11
-    * 3.14.0b3
+    * 3.14.0b4
 * (toolchain) Python 3.13 now references 3.13.5
 * (gazelle) Switched back to smacker/go-tree-sitter, fixing
   [#2630](https://github.com/bazel-contrib/rules_python/issues/2630)
 * (pypi) From now on the list of default platforms only includes `linux_x86_64`, `linux_aarch64`,
   `osx_x86_64`, `osx_aarch64` and `windows_x86_64`. If you are on other platforms, you need to
   use the `pip.default` to configure it yourself. If you are interested in graduating the
   platform, consider helping set us up CI for them and update the documentation.
+* (ci) We are now testing on Ubuntu 22.04 for RBE and non-RBE configurations.
+* (core) #!/usr/bin/env bash is now used as a shebang in the stage1 bootstrap template.
 
 {#v0-0-0-fixed}
 ### Fixed
@@ -94,6 +96,7 @@ END_UNRELEASED_TEMPLATE
   in ambiguous select matches ({gh-issue}`2759`) and should be much more efficient
   when running `bazel query` due to fewer repositories being included 
   ({gh-issue}`2849`).
+* Multi-line python imports (e.g. with escaped newlines) are now correctly processed by Gazelle.
 
 {#v0-0-0-added}
 ### Added
@@ -111,7 +114,14 @@ END_UNRELEASED_TEMPLATE
     * 3.11.13
     * 3.12.11
     * 3.13.5
-    * 3.14.0b3
+    * 3.14.0b4
+* (gazelle): New annotation `gazelle:include_pytest_conftest`. When not set (the
+  default) or `true`, gazelle will inject any `conftest.py` file found in the same
+  directory as a {obj}`py_test` target to that {obj}`py_test` target's `deps`.
+  This behavior is unchanged from previous versions. When `false`, the `:conftest`
+  dep is not added to the {obj}`py_test` target.
+* (gazelle) New directive `gazelle:python_generate_proto`; when `true`,
+  Gazelle generates `py_proto_library` rules for `proto_library`. `false` by default.
 
 {#v0-0-0-removed}
 ### Removed

WORKSPACE

@@ -95,7 +95,7 @@ load("@bazelci_rules//:rbe_repo.bzl", "rbe_preconfig")
 # otherwise refer to RBE docs.
 rbe_preconfig(
     name = "buildkite_config",
-    toolchain = "ubuntu1804-bazel-java11",
+    toolchain = "ubuntu2204",
 )
 
 local_repository(

addlicense.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Copyright 2023 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

docs/pypi/lock.md

@@ -5,6 +5,8 @@
 
 :::{note}
 Currently `rules_python` only supports `requirements.txt` format.
+
+#{gh-issue}`2787` tracks `pylock.toml` support.
 :::
 
 ## requirements.txt
@@ -37,11 +39,33 @@ This rule generates two targets:
 Once you generate this fully specified list of requirements, you can install the requirements ([bzlmod](./download)/[WORKSPACE](./download-workspace)).
 
 :::{warning}
-If you're specifying dependencies in `pyproject.toml`, make sure to include the `[build-system]` configuration, with pinned dependencies. `compile_pip_requirements` will use the build system specified to read your project's metadata, and you might see non-hermetic behavior if you don't pin the build system.
+If you're specifying dependencies in `pyproject.toml`, make sure to include the
+`[build-system]` configuration, with pinned dependencies.
+`compile_pip_requirements` will use the build system specified to read your
+project's metadata, and you might see non-hermetic behavior if you don't pin the
+build system.
 
-Not specifying `[build-system]` at all will result in using a default `[build-system]` configuration, which uses unpinned versions ([ref](https://peps.python.org/pep-0518/#build-system-table)).
+Not specifying `[build-system]` at all will result in using a default
+`[build-system]` configuration, which uses unpinned versions
+([ref](https://peps.python.org/pep-0518/#build-system-table)).
 :::
 
+
+#### pip compile Dependency groups
+
+pip-compile doesn't yet support pyproject.toml dependency groups. Follow
+[pip-tools #2062](https://github.com/jazzband/pip-tools/issues/2062)
+to see the status of their support.
+
+In the meantime, support can be emulated by passing multiple files to `srcs`:
+
+```starlark
+compile_pip_requirements(
+    srcs = ["pyproject.toml", "requirements-dev.in"]
+    ...
+)
+```
+
 ### uv pip compile (bzlmod only)
 
 We also have experimental setup for the `uv pip compile` way of generating lock files.

docs/readthedocs_build.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -eou pipefail
 

docs/requirements.txt

@@ -17,9 +17,9 @@ babel==2.17.0 \
     --hash=sha256:0c54cffb19f690cdcc52a3b50bcbf71e07a808d1c80d549f2459b9d2cf0afb9d \
     --hash=sha256:4d0b53093fdfb4b21c92b5213dba5a1b23885afa8383709427046b21c366e5f2
     # via sphinx
-certifi==2025.6.15 \
-    --hash=sha256:2e0c7ce7cb5d8f8634ca55d2ba7e6ec2689a2fd6537d8dec1296a477a4910057 \
-    --hash=sha256:d747aa5a8b9bbbb1bb8c22bb13e22bd1f18e9796defa16bab421f7f7a317323b
+certifi==2025.7.14 \
+    --hash=sha256:6b31f564a415d79ee77df69d757bb49a5bb53bd9f756cbbe24394ffd6fc1f4b2 \
+    --hash=sha256:8ea99dbdfaaf2ba2f9bac77b9249ef62ec5218e7c2b2e903378ed5fccf765995
     # via requests
 charset-normalizer==3.4.2 \
     --hash=sha256:005fa3432484527f9732ebd315da8da8001593e2cf46a3d817669f062c3d9ed4 \