Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 13, 2025

Bumps bazel-runfiles from 1.5.1 to 1.6.3.

Release notes

Sourced from bazel-runfiles's releases.

1.6.3

For more detailed setup instructions, see https://rules-python.readthedocs.io/en/latest/getting-started.html

For the user-facing changelog see here

Using Bzlmod

Add to your MODULE.bazel file:

bazel_dep(name = "rules_python", version = "1.6.3")
python = use_extension("@​rules_python//python/extensions:python.bzl", "python")
python.toolchain(
python_version = "3.13",
)
pip = use_extension("@​rules_python//python/extensions:pip.bzl", "pip")
pip.parse(
hub_name = "pypi",
python_version = "3.13",
requirements_lock = "//:requirements_lock.txt",
)
use_repo(pip, "pypi")

Using WORKSPACE

Paste this snippet into your WORKSPACE file:

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
http_archive(
name = "rules_python",
sha256 = "2f5c284fbb4e86045c2632d3573fc006facbca5d1fa02976e89dc0cd5488b590",
strip_prefix = "rules_python-1.6.3",
url = "https://github.com/bazel-contrib/rules_python/releases/download/1.6.3/rules_python-1.6.3.tar.gz",
)
load("@​rules_python//python:repositories.bzl", "py_repositories")
py_repositories()

Gazelle plugin

Paste this snippet into your WORKSPACE file:

... (truncated)

Changelog

Sourced from bazel-runfiles's changelog.

1.6.3 - 2025-09-21

{#v1-6-3-fixed}

Fixed

  • (pypi) We now use the Minimal Version Selection (MVS) algorithm to select the right wheel when there are multiple wheels for the target platform (e.g. musllinux_1_1_x86_64 and musllinux_1_2_x86_64). If the user wants to set the minimum version for the selection algorithm, use the {attr}pip.defaults.whl_platform_tags attribute to configure that. If musllinux_*_x86_64 is specified, we will choose the lowest available wheel version. Fixes #3250.

{#v1-6-0}

1.6.0 - 2025-08-23

{#v1-6-0-changed}

Changed

  • (gazelle) update minimum gazelle version to 0.36.0 - may cause BUILD file changes
  • (gazelle) update minimum rules_go version to 0.55.1
  • (gazelle) remove custom go-tree-sitter module BUILD file
  • (gazelle) For package mode, resolve dependencies when imports are relative to the package path. This is enabled via the # gazelle:python_experimental_allow_relative_imports true directive ({gh-issue}2203).
  • (gazelle) Types for exposed members of python.ParserOutput are now all public.
  • (gazelle) Removed the requirement for __init__.py, __main__.py, or __test__.py files to be present in a directory to generate a BUILD.bazel file.
  • (toolchain) Updated the following toolchains to build [20250808] to patch CVE-2025-47273:
    • 3.9.23
    • 3.10.18
    • 3.11.13
    • 3.12.11
    • 3.14.0rc1
  • (toolchain) Python 3.13 now references 3.13.6
  • (gazelle) Switched back to smacker/go-tree-sitter, fixing #2630
  • (pypi) From now on the list of default platforms only includes linux_x86_64, linux_aarch64, osx_x86_64, osx_aarch64 and windows_x86_64. If you are on other platforms, you need to use the pip.default to configure it yourself. If you are interested in graduating the platform, consider helping set us up CI for them and update the documentation.
  • (ci) We are now testing on Ubuntu 22.04 for RBE and non-RBE configurations.
  • (core) #!/usr/bin/env bash is now used as a shebang in the stage1 bootstrap template.
  • (gazelle:docs) The Gazelle docs have been migrated from {gh-path}gazelle/README.md to {gh-path}gazelle/docs and are now available on the primary documentation site at https://rules-python.readthedocs.io/en/latest/gazelle/docs/index.html

... (truncated)

Commits
  • 38f2679 bump to 1.6.3
  • b12a960 update the version
  • 23da9a1 fix(pypi): select the lowest available libc version by default (#3255)
  • eed1690 fix(gazelle): Do not build proto targets with default Gazelle (#3216)
  • 2918ef9 chore: allow release workflow to be manually run and skip pypi upload (#3232)
  • 24146a4 docs: update for 1.6 release (#3205)
  • fe45faa fix(toolchains): Add Xcode repo env vars to local_runtime_repo for better cac...
  • 563c585 docs: correctly spell release in devguide (#3201)
  • 56c9a34 feat: freethreaded support for the builder API (#3063)
  • bb2aad2 fix(py_wheel): add directories in deterministic order (#3194)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [bazel-runfiles](https://github.com/bazel-contrib/rules_python) from 1.5.1 to 1.6.3.
- [Release notes](https://github.com/bazel-contrib/rules_python/releases)
- [Changelog](https://github.com/bazel-contrib/rules_python/blob/main/CHANGELOG.md)
- [Commits](bazel-contrib/rules_python@1.5.1...1.6.3)

---
updated-dependencies:
- dependency-name: bazel-runfiles
  dependency-version: 1.6.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Oct 13, 2025
@dependabot dependabot bot requested a review from a team as a code owner October 13, 2025 15:27
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Oct 13, 2025
@kotlaja kotlaja merged commit 2e9643b into main Oct 20, 2025
9 checks passed
@dependabot dependabot bot deleted the dependabot/pip/tools/bazel-runfiles-1.6.3 branch October 20, 2025 14:14
FilipposSot pushed a commit to FilipposSot/bazel-central-registry that referenced this pull request Oct 20, 2025
Bumps [bazel-runfiles](https://github.com/bazel-contrib/rules_python)
from 1.5.1 to 1.6.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/bazel-contrib/rules_python/releases">bazel-runfiles's
releases</a>.</em></p>
<blockquote>
<h2>1.6.3</h2>
<p>For more detailed setup instructions, see <a
href="https://rules-python.readthedocs.io/en/latest/getting-started.html">https://rules-python.readthedocs.io/en/latest/getting-started.html</a></p>
<p>For the user-facing changelog see <a
href="https://rules-python.readthedocs.io/en/latest/changelog.html#v1-6-3">here</a></p>
<h2>Using Bzlmod</h2>
<p>Add to your <code>MODULE.bazel</code> file:</p>
<pre lang="starlark"><code>bazel_dep(name = &quot;rules_python&quot;,
version = &quot;1.6.3&quot;)
<p>python = use_extension(&quot;<a
href="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/rules"><code>@​rules</code></a>_python//python/extensions:python.bzl&quot;,
&quot;python&quot;)
python.toolchain(
python_version = &quot;3.13&quot;,
)</p>
<p>pip = use_extension(&quot;<a
href="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/rules"><code>@​rules</code></a>_python//python/extensions:pip.bzl&quot;,
&quot;pip&quot;)
pip.parse(
hub_name = &quot;pypi&quot;,
python_version = &quot;3.13&quot;,
requirements_lock = &quot;//:requirements_lock.txt&quot;,
)</p>
<p>use_repo(pip, &quot;pypi&quot;)
</code></pre></p>
<h2>Using WORKSPACE</h2>
<p>Paste this snippet into your <code>WORKSPACE</code> file:</p>
<pre
lang="starlark"><code>load(&quot;@bazel_tools//tools/build_defs/repo:http.bzl&quot;,
&quot;http_archive&quot;)
<p>http_archive(
name = &quot;rules_python&quot;,
sha256 =
&quot;2f5c284fbb4e86045c2632d3573fc006facbca5d1fa02976e89dc0cd5488b590&quot;,
strip_prefix = &quot;rules_python-1.6.3&quot;,
url = &quot;<a
href="https://github.com/bazel-contrib/rules_python/releases/download/1.6.3/rules_python-1.6.3.tar.gz">https://github.com/bazel-contrib/rules_python/releases/download/1.6.3/rules_python-1.6.3.tar.gz</a>&quot;,
)</p>
<p>load(&quot;<a
href="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/rules"><code>@​rules</code></a>_python//python:repositories.bzl&quot;,
&quot;py_repositories&quot;)</p>
<p>py_repositories()
</code></pre></p>
<h3>Gazelle plugin</h3>
<p>Paste this snippet into your <code>WORKSPACE</code> file:</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/bazel-contrib/rules_python/blob/main/CHANGELOG.md">bazel-runfiles's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/bazel-contrib/rules_python/releases/tag/1.6.3">1.6.3</a>
- 2025-09-21</h2>
<p>{#v1-6-3-fixed}</p>
<h3>Fixed</h3>
<ul>
<li>(pypi) We now use the Minimal Version Selection (MVS) algorithm to
select
the right wheel when there are multiple wheels for the target platform
(e.g. <code>musllinux_1_1_x86_64</code> and
<code>musllinux_1_2_x86_64</code>). If the user
wants to set the minimum version for the selection algorithm, use the
{attr}<code>pip.defaults.whl_platform_tags</code> attribute to configure
that. If
<code>musllinux_*_x86_64</code> is specified, we will choose the lowest
available
wheel version. Fixes <a
href="https://redirect.github.com/bazel-contrib/rules_python/issues/3250">#3250</a>.</li>
</ul>
<p>{#v1-6-0}</p>
<h2><a
href="https://github.com/bazel-contrib/rules_python/releases/tag/1.6.0">1.6.0</a>
- 2025-08-23</h2>
<p>{#v1-6-0-changed}</p>
<h3>Changed</h3>
<ul>
<li>(gazelle) update minimum gazelle version to 0.36.0 - may cause BUILD
file changes</li>
<li>(gazelle) update minimum rules_go version to 0.55.1</li>
<li>(gazelle) remove custom go-tree-sitter module BUILD file</li>
<li>(gazelle) For package mode, resolve dependencies when imports are
relative
to the package path. This is enabled via the
<code># gazelle:python_experimental_allow_relative_imports</code> true
directive ({gh-issue}<code>2203</code>).</li>
<li>(gazelle) Types for exposed members of
<code>python.ParserOutput</code> are now all public.</li>
<li>(gazelle) Removed the requirement for <code>__init__.py</code>,
<code>__main__.py</code>, or <code>__test__.py</code> files to be
present in a directory to generate a <code>BUILD.bazel</code> file.</li>
<li>(toolchain) Updated the following toolchains to build [20250808] to
patch CVE-2025-47273:
<ul>
<li>3.9.23</li>
<li>3.10.18</li>
<li>3.11.13</li>
<li>3.12.11</li>
<li>3.14.0rc1</li>
</ul>
</li>
<li>(toolchain) Python 3.13 now references 3.13.6</li>
<li>(gazelle) Switched back to smacker/go-tree-sitter, fixing
<a
href="https://redirect.github.com/bazel-contrib/rules_python/issues/2630">#2630</a></li>
<li>(pypi) From now on the list of default platforms only includes
<code>linux_x86_64</code>, <code>linux_aarch64</code>,
<code>osx_x86_64</code>, <code>osx_aarch64</code> and
<code>windows_x86_64</code>. If you are on other platforms, you need to
use the <code>pip.default</code> to configure it yourself. If you are
interested in graduating the
platform, consider helping set us up CI for them and update the
documentation.</li>
<li>(ci) We are now testing on Ubuntu 22.04 for RBE and non-RBE
configurations.</li>
<li>(core) <code>#!/usr/bin/env bash</code> is now used as a shebang in
the stage1 bootstrap template.</li>
<li>(gazelle:docs) The Gazelle docs have been migrated from
{gh-path}<code>gazelle/README.md</code> to
{gh-path}<code>gazelle/docs</code> and are now available on the primary
documentation site
at <a
href="https://rules-python.readthedocs.io/en/latest/gazelle/docs/index.html">https://rules-python.readthedocs.io/en/latest/gazelle/docs/index.html</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/bazel-contrib/rules_python/commit/38f2679fcc6c23a72e4c6309b7fdecb4eafcccf0"><code>38f2679</code></a>
bump to 1.6.3</li>
<li><a
href="https://github.com/bazel-contrib/rules_python/commit/b12a960daf9d505c13262b7ee37bdf8ea0163dbf"><code>b12a960</code></a>
update the version</li>
<li><a
href="https://github.com/bazel-contrib/rules_python/commit/23da9a12fe58a1f4f4bf8a4a64aabf12c23ca592"><code>23da9a1</code></a>
fix(pypi): select the lowest available libc version by default (<a
href="https://redirect.github.com/bazel-contrib/rules_python/issues/3255">#3255</a>)</li>
<li><a
href="https://github.com/bazel-contrib/rules_python/commit/eed169034e989dc39b02a4e6a6767b3f59541ae0"><code>eed1690</code></a>
fix(gazelle): Do not build proto targets with default Gazelle (<a
href="https://redirect.github.com/bazel-contrib/rules_python/issues/3216">#3216</a>)</li>
<li><a
href="https://github.com/bazel-contrib/rules_python/commit/2918ef9be6016580a527eb25892e083c374d667b"><code>2918ef9</code></a>
chore: allow release workflow to be manually run and skip pypi upload
(<a
href="https://redirect.github.com/bazel-contrib/rules_python/issues/3232">#3232</a>)</li>
<li><a
href="https://github.com/bazel-contrib/rules_python/commit/24146a49cc34269d1dd7f7cd334fa80e0c8a2935"><code>24146a4</code></a>
docs: update for 1.6 release (<a
href="https://redirect.github.com/bazel-contrib/rules_python/issues/3205">#3205</a>)</li>
<li><a
href="https://github.com/bazel-contrib/rules_python/commit/fe45faabeb3dceab8766fb1a67131ec0cc1135dc"><code>fe45faa</code></a>
fix(toolchains): Add Xcode repo env vars to local_runtime_repo for
better cac...</li>
<li><a
href="https://github.com/bazel-contrib/rules_python/commit/563c58510c785726c3c154c2332b52bf58ba2e3b"><code>563c585</code></a>
docs: correctly spell release in devguide (<a
href="https://redirect.github.com/bazel-contrib/rules_python/issues/3201">#3201</a>)</li>
<li><a
href="https://github.com/bazel-contrib/rules_python/commit/56c9a3499a312031a02d6fd65726098403fd87f5"><code>56c9a34</code></a>
feat: freethreaded support for the builder API (<a
href="https://redirect.github.com/bazel-contrib/rules_python/issues/3063">#3063</a>)</li>
<li><a
href="https://github.com/bazel-contrib/rules_python/commit/bb2aad2d1e3f883c9cdc2264e0b4a2815233db57"><code>bb2aad2</code></a>
fix(py_wheel): add directories in deterministic order (<a
href="https://redirect.github.com/bazel-contrib/rules_python/issues/3194">#3194</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/bazel-contrib/rules_python/compare/1.5.1...1.6.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=bazel-runfiles&package-manager=pip&previous-version=1.5.1&new-version=1.6.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant