Bazel

v9.1.1 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 10h Build & Package

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

bazel build build-system correct fast multi-language

+2 more

scalable test

Affected surfaces

breaking_upgrade

ReleasePort's take

Moderate signal

editorial:auto 8h

CcInfo has been removed from the Starlark API; upgrade rules_go or rules_nodejs to avoid build errors.

Why it matters: Affects any project using CcInfo in Starlark. Upgrade rules_go or rules_nodejs immediately to prevent build failures.

Summary

AI summary

Updates Remote Execution, External Deps, and 2026-06-03 across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Breaking	High	CcInfo symbol removed; upgrade rules_go or rules_nodejs to resolve errors. CcInfo symbol removed; upgrade rules_go or rules_nodejs to resolve errors. Source: llm_adapter@2026-06-03 Confidence: high	—
Performance	Medium	Supports bounded parallel chunk transfers for remote execution. Supports bounded parallel chunk transfers for remote execution. Source: llm_adapter@2026-06-03 Confidence: high	—
Bugfix
Bugfix	Medium	`--downloader_config` flag is no longer repeatable, restoring previous behavior. `--downloader_config` flag is no longer repeatable, restoring previous behavior. Source: llm_adapter@2026-06-03 Confidence: high	—
Bugfix	Medium	Crash with `file://` URIs fixed. Crash with `file://` URIs fixed. Source: llm_adapter@2026-06-03 Confidence: high	—
Bugfix	Medium	Crash with opaque URIs fixed. Crash with opaque URIs fixed. Source: llm_adapter@2026-06-03 Confidence: high	—
Bugfix	Medium	Bazel no longer fails on lost inputs when build or action rewinding is enabled. Bazel no longer fails on lost inputs when build or action rewinding is enabled. Source: llm_adapter@2026-06-03 Confidence: high	—
Bugfix	Medium	Crash on `--remote_default_exec_properties` with duplicate keys resolved. Crash on `--remote_default_exec_properties` with duplicate keys resolved. Source: llm_adapter@2026-06-03 Confidence: high	—
Bugfix	Medium	Verifies entire blob integrity when downloading chunks in remote execution. Verifies entire blob integrity when downloading chunks in remote execution. Source: llm_adapter@2026-06-03 Confidence: high	—
Bugfix	Medium	Resolves JVM crash in GrpcCacheClient.onNext() during remote execution. Resolves JVM crash in GrpcCacheClient.onNext() during remote execution. Source: llm_adapter@2026-06-03 Confidence: high	—
Bugfix	Medium	Invalidates unresolved symlink info after deletion in RAFS remote execution cache. Invalidates unresolved symlink info after deletion in RAFS remote execution cache. Source: llm_adapter@2026-06-03 Confidence: high	—

Full changelog

[!NOTE]
If you are looking for rolling releases, please visit this page.

Release 9.1.1 (2026-06-03)

Bazel 9.1.1 is a patch LTS release. With the exception of CcInfo (see below), it is backward compatible with Bazel 9.0.

IMPORTANT

Compatibility Note: CcInfo removal and rules_go

If you encounter the error "The CcInfo symbol has been removed", this is due to an intentional change in Bazel 9 regarding C++ Starlarkification. While this change was present in 9.0.0, a bug fixed in 9.0.1 (#28360) now correctly surfaces this error instead of failing silently or with a confusing message. To fix this, please upgrade rules_go, rules_nodejs or any broken rulesets. For example,

# Add repo_name = None if you don't directly depend on them.
bazel_dep(name = "rules_go", version = "0.59.0") 
bazel_dep(name = "rules_nodejs", version = "6.7.3")

External Deps

--downloader_config was accidentally made a repeatable flag in 9.1.0, which was a backwards-incompatible change. This has been reverted in 9.1.1. (#29616)
Fixed a crash with file:// URIs. (#29579)
Fixed a crash with opaque URIs. (#29658)

Remote Execution

Fixed an issue that caused Bazel to fail on a lost input even with build or action rewinding enabled. (#29677)
Fix crash on --remote_default_exec_properties with the same key. (#29596)
Verify the whole blob when downloading chunks (#29593)
Support bounded parallel chunk transfers (#29614)
Fix JVM crash from VerifyException in GrpcCacheClient.onNext() (#29583)
Invalidate unresolved symlink info after deletion in the RAFS (#29671)

Acknowledgments

This release contains contributions from many people at Google, as well as Armando Montanez, ashutosh0x, Boleyn Su, Fabian Meumertzheim, H5-O5, Joseph Gette, Keith Smiley, Paul Tarjan, Ted Kaplan, Tyler French, and Will Stranton.

Notice: Bazel installers contain binaries licensed under the GPLv2 with Classpath exception. Those installers should always be redistributed along with the source code.

Some versions of Bazel contain a bundled version of OpenJDK. The license of the bundled OpenJDK and other open-source components can be displayed by running the command bazel license. The vendor and version information of the bundled OpenJDK can be displayed by running the command bazel info java-runtime. The binaries and source-code of the bundled OpenJDK can be downloaded from our mirror server.

Security: All our binaries are signed with our public key 3D5919B448457EE0.

Breaking Changes

Removed `CcInfo` Starlark provider; requires upgrading rules_go or rules_nodejs to resolve build failures.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Bazel

Get notified when new releases ship.

About Bazel

a fast, scalable, multi-language and extensible build system

All releases →