This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+2 more
ReleasePort's take
Light signalBazel 9.2.0 adds SOCKS proxy support for HTTPS_PROXY/HTTP_PROXY and introduces `strip_components` for archive extraction rules, while fixing several remote repository caching bugs.
Why it matters: Enables secure proxy routing for network‑bound builds; improves deterministic archive handling with strip_components; resolves cache‑related errors that could cause build failures or slowdowns.
Summary
AI summaryConfigurability, External Deps, Remote Execution, Performance, and Windows modules receive new attributes, fixes, and enhancements.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Adds SOCKS proxy support for HTTPS_PROXY/HTTP_PROXY URLs. Adds SOCKS proxy support for HTTPS_PROXY/HTTP_PROXY URLs. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Feature | Medium |
Adds `strip_components` attribute to `extract`, `download_and_extract`, and `http_archive` rules. Adds `strip_components` attribute to `extract`, `download_and_extract`, and `http_archive` rules. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Feature | Medium |
Adds `module_ctx.tag_sort_key(tag)` method for deterministic tag ordering in MODULE.bazel. Adds `module_ctx.tag_sort_key(tag)` method for deterministic tag ordering in MODULE.bazel. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Feature | Medium |
`module_extension(...)` now accepts a `facts_version` integer parameter to invalidate persisted facts on bump. `module_extension(...)` now accepts a `facts_version` integer parameter to invalidate persisted facts on bump. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Feature | Low |
Introduces `refines_constraint_value` attribute on `constraint_setting` to enforce refined values on platforms. Introduces `refines_constraint_value` attribute on `constraint_setting` to enforce refined values on platforms. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Feature | Low |
`exec_properties` now respects `resources:cpu` and `resources:memory` for local resource estimation. `exec_properties` now respects `resources:cpu` and `resources:memory` for local resource estimation. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Feature | Low |
Adds `and_then` method on transitions to compose Starlark and native transitions. Adds `and_then` method on transitions to compose Starlark and native transitions. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Feature | Low |
Enables TCP keepalive by default for gRPC connections with reasonable defaults. Enables TCP keepalive by default for gRPC connections with reasonable defaults. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Feature | Low |
Allows parallel CDC chunk uploads and downloads within a large blob for remote execution. Allows parallel CDC chunk uploads and downloads within a large blob for remote execution. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Feature | Low |
Introduces `--incompatible_remove_ctx_android_fragment` flag for Starlark Flags migration. Introduces `--incompatible_remove_ctx_android_fragment` flag for Starlark Flags migration. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Feature | Low |
Embeds `asInvoker` UAC manifest in Windows launcher stubs to prevent elevation prompts for installer‑detection heuristic matches. Embeds `asInvoker` UAC manifest in Windows launcher stubs to prevent elevation prompts for installer‑detection heuristic matches. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Bugfix | Medium |
Fixes spurious "No such file" errors with remote repo contents cache involving symlinks to .bzl files. Fixes spurious "No such file" errors with remote repo contents cache involving symlinks to .bzl files. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Bugfix | Medium |
Prevents external repos from being refetched when contributing inputs to hermetic Linux sandbox actions. Prevents external repos from being refetched when contributing inputs to hermetic Linux sandbox actions. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Bugfix | Medium |
Corrects remote repo contents cache to materialize symlink chains as action inputs and drops support for symlinks into the main repository. Corrects remote repo contents cache to materialize symlink chains as action inputs and drops support for symlinks into the main repository. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Bugfix | Medium |
Ensures remote repo contents cache no longer caches or restores repos with cross‑repo symlinks to avoid bug surface. Ensures remote repo contents cache no longer caches or restores repos with cross‑repo symlinks to avoid bug surface. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Bugfix | Medium |
Prevents spurious reloading of packages in external repositories when environment variables are modified. Prevents spurious reloading of packages in external repositories when environment variables are modified. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Bugfix | Medium |
Fixes performance regression causing `RepoMappingManifest` actions to consume excessive CPU time. Fixes performance regression causing `RepoMappingManifest` actions to consume excessive CPU time. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Bugfix | Medium |
Bazel no longer crashes when a `label_list_dict` attribute is used in a split transition. Bazel no longer crashes when a `label_list_dict` attribute is used in a split transition. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Bugfix | Medium |
Temporarily allows source directories in external repositories to cross package boundaries, gated by `--incompatible_check_external_repo_source_dir_package_boundary`. Temporarily allows source directories in external repositories to cross package boundaries, gated by `--incompatible_check_external_repo_source_dir_package_boundary`. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Bugfix | Medium |
Fixes repo content caching for non-gRPC cache backends in remote execution. Fixes repo content caching for non-gRPC cache backends in remote execution. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Bugfix | Medium |
Removes size limit on gRPC messages received from remote executor or cache. Removes size limit on gRPC messages received from remote executor or cache. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Bugfix | Medium |
Fixes crash with `--experimental_remote_repo_contents_cache` when running without a remote or disk cache. Fixes crash with `--experimental_remote_repo_contents_cache` when running without a remote or disk cache. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Bugfix | Medium |
Resolves spurious remote-execution failure with `--experimental_output_paths=strip` involving lost tree artifact inputs. Resolves spurious remote-execution failure with `--experimental_output_paths=strip` involving lost tree artifact inputs. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Bugfix | Medium |
Fixes Bazel inability to run Windows executables with paths exceeding `MAX_PATH` when 8dot3 short names are disabled. Fixes Bazel inability to run Windows executables with paths exceeding `MAX_PATH` when 8dot3 short names are disabled. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
Full changelog
[!NOTE]
If you are looking for rolling releases, please visit this page.
Release 9.2.0 (2026-07-13)
Bazel 9.2.0 is a minor LTS release. It is fully backward compatible with Bazel 9 releases starting from 9.0.1; see Bazel 9.0.1 release notes for a note on backward compatibility.
Configurability
- The new
refines_constraint_valueattribute onconstraint_settingcan be used to indicate that any non-default value for that setting specified on aplatformrequires the refined value to also be specified. (#29727) - Bazel no longer crashes when a
label_list_dictattribute is used in a split transition (#29830). (#29856) exec_propertiesnow respectsresources:cpuandresources:memoryfor local resource estimation. (#29426)- The
and_thenmethod ontransitions can be used to compose transitions. Both Starlark transitions and native transitions (e.g.config.exec()) are supported. (#29888)
Core
- Source directories in external repositories are temporarily allowed to cross package boundaries. This will be disallowed in the future, gated by the new
--incompatible_check_external_repo_source_dir_package_boundaryflag. (#30040)
External Deps
- Added SOCKS proxy support. Bazel now accepts
socks://,socks4://, andsocks5://URLs inHTTPS_PROXY/HTTP_PROXYenvironment variables and related system properties. (#29364) - Adds the
strip_componentsattribute toextract/download_and_extract/http_archiveto allow stripping of path components when extracting files. (#29369) - Added the
module_ctx.tag_sort_key(tag)method, which returns an opaque object for the given tag that can be compared to derive the order in which tags from different classes appear in the MODULE.bazel file. (#29484) module_extension(...)now accepts afacts_versioninteger parameter. Bumping it invalidates the facts persisted inMODULE.bazel.lockfor that extension, allowing extension authors to make breaking changes to the facts schema without risking misinterpretation by older code paths. (#29871)- External repos are no longer refetched whenever they contribute inputs to an action using the hermetic Linux sandbox. (#29889)
- The remote repo contents cache now correctly materializes chains of symlinks as action inputs, but no longer supports symlinks into the main repository. (#29959)
- Fixed spurious "No such file" errors with the remote repo contents cache when a repo contains a symlink to a
.bzlfile. (#30037) - The remote repo contents cache no longer caches or restores repos with cross-repo symlinks, thus avoiding a large surface area for bugs. The effort to reenable this support is tracked by #30160. (#30190)
- Modifying environment variables no longer causes spurious reloading of packages in external repositories. (#30194)
Performance
- Fixed a performance regression in Bazel 9 that causes
RepoMappingManifestactions to consume a lot of CPU time. (#29807)
Remote Execution
- Enable TCP keepalive by default for gRPC connections with reasonable defaults (#29898)
- Fixed repo content caching for non-gRPC cache backends. (#29869)
- CDC chunk uploads and downloads can now happen in parallel within a large blob. (#29796)
- Bazel no longer limits the size of gRPC messages received from the remote executor or cache. (#29885)
- Fixed a crash with
--experimental_remote_repo_contents_cachewhen running without a remote or disk cache. (#30060) - Fixed a spurious remote-execution failure with
--experimental_output_paths=stripwhere a lost input in a tree artifact shared between actions could not be recovered by action rewinding. (#30193)
Starlark / Build Language
- Created
--incompatible_remove_ctx_android_fragmentfor Starlark Flags migration (#29884)
Windows
- Fixed Bazel being unable to run a Windows executable whose path is too long to shorten under
MAX_PATH, e.g. when 8dot3 short names are disabled (microsoft/Windows-Containers#507). (#29984) - Windows launcher stubs now embed an
asInvokerUAC manifest, preventing "The requested operation requires elevation. (error: 740)" for targets whose name matches the installer-detection heuristic. (#30182)
Acknowledgments
This release contains contributions from many people at Google, as well as Ashutosh0x, Bryce Lampe, Fabian Meumertzheim, Fredrik Medley, gaurav0107, Grzegorz Lukasik, Jacob Nowjack, John Cater, JonathanPerry651, Keith Smiley, peakschris, Rgis Desgroppes, Richard Lavoie, Sarad, Son Luong Ngoc, Tamir Duberstein, Tyler French, vadim, Will Stranton, and Yonatan Goldschmidt.
Notice: Bazel installers contain binaries licensed under the GPLv2 with Classpath exception. Those installers should always be redistributed along with the source code.
Some versions of Bazel contain a bundled version of OpenJDK. The license of the bundled OpenJDK and other open-source components can be displayed by running the command bazel license. The vendor and version information of the bundled OpenJDK can be displayed by running the command bazel info java-runtime. The binaries and source-code of the bundled OpenJDK can be
downloaded from our mirror server.
Security: All our binaries are signed with our public key 3D5919B448457EE0.
Breaking Changes
- --incompatible_remove_ctx_android_fragment flag removal for Starlark Flags migration
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- v9.1.1 CcInfo symbol removed; upgrade rules_go or rules_nodejs to resolve errors.
Beta — feedback welcome: [email protected]