Skip to content

Bazel

v9.2.0 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 13d Build & Package
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

bazel build build-system correct fast multi-language
+2 more
scalable test

ReleasePort's take

Light signal
editorial:auto 12d

Bazel 9.2.0 adds SOCKS proxy support for HTTPS_PROXY/HTTP_PROXY and introduces `strip_components` for archive extraction rules, while fixing several remote repository caching bugs.

Why it matters: Enables secure proxy routing for network‑bound builds; improves deterministic archive handling with strip_components; resolves cache‑related errors that could cause build failures or slowdowns.

Summary

AI summary

Configurability, External Deps, Remote Execution, Performance, and Windows modules receive new attributes, fixes, and enhancements.

Changes in this release

Feature Medium

Adds SOCKS proxy support for HTTPS_PROXY/HTTP_PROXY URLs.

Adds SOCKS proxy support for HTTPS_PROXY/HTTP_PROXY URLs.

Source: llm_adapter@2026-07-14

Confidence: high

Feature Medium

Adds `strip_components` attribute to `extract`, `download_and_extract`, and `http_archive` rules.

Adds `strip_components` attribute to `extract`, `download_and_extract`, and `http_archive` rules.

Source: llm_adapter@2026-07-14

Confidence: high

Feature Medium

Adds `module_ctx.tag_sort_key(tag)` method for deterministic tag ordering in MODULE.bazel.

Adds `module_ctx.tag_sort_key(tag)` method for deterministic tag ordering in MODULE.bazel.

Source: llm_adapter@2026-07-14

Confidence: high

Feature Medium

`module_extension(...)` now accepts a `facts_version` integer parameter to invalidate persisted facts on bump.

`module_extension(...)` now accepts a `facts_version` integer parameter to invalidate persisted facts on bump.

Source: llm_adapter@2026-07-14

Confidence: high

Feature Low

Introduces `refines_constraint_value` attribute on `constraint_setting` to enforce refined values on platforms.

Introduces `refines_constraint_value` attribute on `constraint_setting` to enforce refined values on platforms.

Source: granite4.1:30b@2026-07-14-audit

Confidence: low

Feature Low

`exec_properties` now respects `resources:cpu` and `resources:memory` for local resource estimation.

`exec_properties` now respects `resources:cpu` and `resources:memory` for local resource estimation.

Source: granite4.1:30b@2026-07-14-audit

Confidence: low

Feature Low

Adds `and_then` method on transitions to compose Starlark and native transitions.

Adds `and_then` method on transitions to compose Starlark and native transitions.

Source: granite4.1:30b@2026-07-14-audit

Confidence: low

Feature Low

Enables TCP keepalive by default for gRPC connections with reasonable defaults.

Enables TCP keepalive by default for gRPC connections with reasonable defaults.

Source: granite4.1:30b@2026-07-14-audit

Confidence: low

Feature Low

Allows parallel CDC chunk uploads and downloads within a large blob for remote execution.

Allows parallel CDC chunk uploads and downloads within a large blob for remote execution.

Source: granite4.1:30b@2026-07-14-audit

Confidence: low

Feature Low

Introduces `--incompatible_remove_ctx_android_fragment` flag for Starlark Flags migration.

Introduces `--incompatible_remove_ctx_android_fragment` flag for Starlark Flags migration.

Source: granite4.1:30b@2026-07-14-audit

Confidence: low

Feature Low

Embeds `asInvoker` UAC manifest in Windows launcher stubs to prevent elevation prompts for installer‑detection heuristic matches.

Embeds `asInvoker` UAC manifest in Windows launcher stubs to prevent elevation prompts for installer‑detection heuristic matches.

Source: granite4.1:30b@2026-07-14-audit

Confidence: low

Bugfix Medium

Fixes spurious "No such file" errors with remote repo contents cache involving symlinks to .bzl files.

Fixes spurious "No such file" errors with remote repo contents cache involving symlinks to .bzl files.

Source: llm_adapter@2026-07-14

Confidence: high

Bugfix Medium

Prevents external repos from being refetched when contributing inputs to hermetic Linux sandbox actions.

Prevents external repos from being refetched when contributing inputs to hermetic Linux sandbox actions.

Source: llm_adapter@2026-07-14

Confidence: high

Bugfix Medium

Corrects remote repo contents cache to materialize symlink chains as action inputs and drops support for symlinks into the main repository.

Corrects remote repo contents cache to materialize symlink chains as action inputs and drops support for symlinks into the main repository.

Source: llm_adapter@2026-07-14

Confidence: high

Bugfix Medium

Ensures remote repo contents cache no longer caches or restores repos with cross‑repo symlinks to avoid bug surface.

Ensures remote repo contents cache no longer caches or restores repos with cross‑repo symlinks to avoid bug surface.

Source: llm_adapter@2026-07-14

Confidence: high

Bugfix Medium

Prevents spurious reloading of packages in external repositories when environment variables are modified.

Prevents spurious reloading of packages in external repositories when environment variables are modified.

Source: llm_adapter@2026-07-14

Confidence: high

Bugfix Medium

Fixes performance regression causing `RepoMappingManifest` actions to consume excessive CPU time.

Fixes performance regression causing `RepoMappingManifest` actions to consume excessive CPU time.

Source: llm_adapter@2026-07-14

Confidence: high

Bugfix Medium

Bazel no longer crashes when a `label_list_dict` attribute is used in a split transition.

Bazel no longer crashes when a `label_list_dict` attribute is used in a split transition.

Source: granite4.1:30b@2026-07-14-audit

Confidence: low

Bugfix Medium

Temporarily allows source directories in external repositories to cross package boundaries, gated by `--incompatible_check_external_repo_source_dir_package_boundary`.

Temporarily allows source directories in external repositories to cross package boundaries, gated by `--incompatible_check_external_repo_source_dir_package_boundary`.

Source: granite4.1:30b@2026-07-14-audit

Confidence: low

Bugfix Medium

Fixes repo content caching for non-gRPC cache backends in remote execution.

Fixes repo content caching for non-gRPC cache backends in remote execution.

Source: granite4.1:30b@2026-07-14-audit

Confidence: low

Bugfix Medium

Removes size limit on gRPC messages received from remote executor or cache.

Removes size limit on gRPC messages received from remote executor or cache.

Source: granite4.1:30b@2026-07-14-audit

Confidence: low

Bugfix Medium

Fixes crash with `--experimental_remote_repo_contents_cache` when running without a remote or disk cache.

Fixes crash with `--experimental_remote_repo_contents_cache` when running without a remote or disk cache.

Source: granite4.1:30b@2026-07-14-audit

Confidence: low

Bugfix Medium

Resolves spurious remote-execution failure with `--experimental_output_paths=strip` involving lost tree artifact inputs.

Resolves spurious remote-execution failure with `--experimental_output_paths=strip` involving lost tree artifact inputs.

Source: granite4.1:30b@2026-07-14-audit

Confidence: low

Bugfix Medium

Fixes Bazel inability to run Windows executables with paths exceeding `MAX_PATH` when 8dot3 short names are disabled.

Fixes Bazel inability to run Windows executables with paths exceeding `MAX_PATH` when 8dot3 short names are disabled.

Source: granite4.1:30b@2026-07-14-audit

Confidence: low

Full changelog

[!NOTE]
If you are looking for rolling releases, please visit this page.

Release 9.2.0 (2026-07-13)

Bazel 9.2.0 is a minor LTS release. It is fully backward compatible with Bazel 9 releases starting from 9.0.1; see Bazel 9.0.1 release notes for a note on backward compatibility.

Configurability

  • The new refines_constraint_value attribute on constraint_setting can be used to indicate that any non-default value for that setting specified on a platform requires the refined value to also be specified. (#29727)
  • Bazel no longer crashes when a label_list_dict attribute is used in a split transition (#29830). (#29856)
  • exec_properties now respects resources:cpu and resources:memory for local resource estimation. (#29426)
  • The and_then method on transitions can be used to compose transitions. Both Starlark transitions and native transitions (e.g. config.exec()) are supported. (#29888)

Core

  • Source directories in external repositories are temporarily allowed to cross package boundaries. This will be disallowed in the future, gated by the new --incompatible_check_external_repo_source_dir_package_boundary flag. (#30040)

External Deps

  • Added SOCKS proxy support. Bazel now accepts socks://, socks4://, and socks5:// URLs in HTTPS_PROXY/HTTP_PROXY environment variables and related system properties. (#29364)
  • Adds the strip_components attribute to extract/download_and_extract/http_archive to allow stripping of path components when extracting files. (#29369)
  • Added the module_ctx.tag_sort_key(tag) method, which returns an opaque object for the given tag that can be compared to derive the order in which tags from different classes appear in the MODULE.bazel file. (#29484)
  • module_extension(...) now accepts a facts_version integer parameter. Bumping it invalidates the facts persisted in MODULE.bazel.lock for that extension, allowing extension authors to make breaking changes to the facts schema without risking misinterpretation by older code paths. (#29871)
  • External repos are no longer refetched whenever they contribute inputs to an action using the hermetic Linux sandbox. (#29889)
  • The remote repo contents cache now correctly materializes chains of symlinks as action inputs, but no longer supports symlinks into the main repository. (#29959)
  • Fixed spurious "No such file" errors with the remote repo contents cache when a repo contains a symlink to a .bzl file. (#30037)
  • The remote repo contents cache no longer caches or restores repos with cross-repo symlinks, thus avoiding a large surface area for bugs. The effort to reenable this support is tracked by #30160. (#30190)
  • Modifying environment variables no longer causes spurious reloading of packages in external repositories. (#30194)

Performance

  • Fixed a performance regression in Bazel 9 that causes RepoMappingManifest actions to consume a lot of CPU time. (#29807)

Remote Execution

  • Enable TCP keepalive by default for gRPC connections with reasonable defaults (#29898)
  • Fixed repo content caching for non-gRPC cache backends. (#29869)
  • CDC chunk uploads and downloads can now happen in parallel within a large blob. (#29796)
  • Bazel no longer limits the size of gRPC messages received from the remote executor or cache. (#29885)
  • Fixed a crash with --experimental_remote_repo_contents_cache when running without a remote or disk cache. (#30060)
  • Fixed a spurious remote-execution failure with --experimental_output_paths=strip where a lost input in a tree artifact shared between actions could not be recovered by action rewinding. (#30193)

Starlark / Build Language

  • Created --incompatible_remove_ctx_android_fragment for Starlark Flags migration (#29884)

Windows

  • Fixed Bazel being unable to run a Windows executable whose path is too long to shorten under MAX_PATH, e.g. when 8dot3 short names are disabled (microsoft/Windows-Containers#507). (#29984)
  • Windows launcher stubs now embed an asInvoker UAC manifest, preventing "The requested operation requires elevation. (error: 740)" for targets whose name matches the installer-detection heuristic. (#30182)

Acknowledgments

This release contains contributions from many people at Google, as well as Ashutosh0x, Bryce Lampe, Fabian Meumertzheim, Fredrik Medley, gaurav0107, Grzegorz Lukasik, Jacob Nowjack, John Cater, JonathanPerry651, Keith Smiley, peakschris, Rgis Desgroppes, Richard Lavoie, Sarad, Son Luong Ngoc, Tamir Duberstein, Tyler French, vadim, Will Stranton, and Yonatan Goldschmidt.
Notice: Bazel installers contain binaries licensed under the GPLv2 with Classpath exception. Those installers should always be redistributed along with the source code.

Some versions of Bazel contain a bundled version of OpenJDK. The license of the bundled OpenJDK and other open-source components can be displayed by running the command bazel license. The vendor and version information of the bundled OpenJDK can be displayed by running the command bazel info java-runtime. The binaries and source-code of the bundled OpenJDK can be
downloaded from our mirror server.

Security: All our binaries are signed with our public key 3D5919B448457EE0.

Breaking Changes

  • --incompatible_remove_ctx_android_fragment flag removal for Starlark Flags migration

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Bazel

Get notified when new releases ship.

Sign up free

About Bazel

a fast, scalable, multi-language and extensible build system

All releases →

Related context

Earlier breaking changes

  • v9.1.1 CcInfo symbol removed; upgrade rules_go or rules_nodejs to resolve errors.

Beta — feedback welcome: [email protected]