This PR contains the following updates:

Release Notes

v2.3.2

Compare Source

{#v2-3-2-fixed}

Fixed

• (pypi) Fixed analysis failures in {obj}pip.parse for source-less wheels with
  dependencies. (#​4053)
• (pypi) Fixed the handling of optional args for the {obj}pip_archive and {obj}whl_archive
  repository rules within the {obj}whl_library. From now on we are dropping unsupported args.
• (pypi) Fixed {obj}pip.parse repository names for Git sources in uv.lock
  files by excluding URL query and fragment components
  (#​4084).

{#v2-3-1}

v2.3.1

Compare Source

{#v2-3-1-fixed}

Fixed

• Previous refactor that shipped with 2.3 introduced regression for the
  experimental repository cache users. This restores the previous behavior
  (#​3791).

{#v2-3-0}

v2.3.0

Compare Source

{#v2-3-0-changed}

Changed

• (gazelle) BREAKING rules_python 1.5.0 or higher is now required. The Python
  extension selects its standard library list on is_python_3.14, which earlier
  versions do not define.

{#v2-3-0-fixed}

Fixed

• Fixed py_binary_rule_builder() / py_test_rule_builder() (from python/api/executables.bzl)
  failing at analysis time with a visibility error when used to construct a custom rule from an
  external module.
• (compile_pip_requirements) Add the explicit data attribute and forward it
  directly to the generated py_binary, so files passed via data can be
  referenced from extra_args using $(location ...).
• (coverage) The warning about a missing bundled coverage.py wheel is no longer
  emitted as we are now falling back to a pure python wheel
  (#​3950).
• (gazelle) The Python extension now uses the correct standard library module list for
  python_version 3.13 and 3.14; previously both fell back to the 3.11 list, so modules
  added or removed since then (e.g. compression.zstd, telnetlib) were misclassified. The
  fallback list for unrecognized versions is now the newest available one rather than 3.11
  (#​3978).
• (pypi) Allow uv_lock to be specified in pip.parse without requiring
  requirements_lock (or other os-specific requirement file attributes) to be
  set.
• (pypi) Fixed the fixed-point loop that resolves self-referencing extras
  (pkg[extra] entries in a package's own Requires-Dist). The loop compared
  the number of extras discovered in the current round against the number known
  before it, rather than against the size of the merged set. As a result it
  could stop before every extra was resolved, silently dropping dependencies
  only reachable through two or more pkg[extra] hops, and for the common case
  of a package with no self-referencing extras it never converged at all,
  running all 10000 rounds while evaluating each wheel's generated BUILD file
  (#​4039).
• (pypi) Requirement --hash=<algo>:<digest> pins and Simple API
  #<algo>=<digest> URL fragments are now parsed for all hash algorithms
  instead of silently dropping everything except sha256. Non-sha256 pins are
  matched against the digests advertised by the index and downloads are verified
  using the corresponding Subresource Integrity value, and the pins are kept in
  the requirement line when falling back to pip
  (#​3972).
  As part of this, whl_library repos created by pip.parse now always pass
  the digest via the integrity attribute (SRI format) instead of sha256,
  and the lock file facts store digests as <algo>:<digest> values (the facts
  version was bumped, so cached index information is refreshed once).
• (pypi) pip.parse(uv_lock = ...) no longer exposes uv workspace/root members
  that resolve to no wheel or sdist (e.g. source = { virtual = "." } or editable
  installs). Previously these source-less packages were added to the hub's
  all_requirements / all_whl_requirements with an alias to a subpackage that
  does not exist, breaking analysis for anything enumerating the full set such as
  modules_mapping(wheels = all_whl_requirements)
  (#​3934).
• (pypi) correctly parse the index_url for each wheel so that the source registry is forwarded to
  the {obj}whl_library. This is so that the purl for package_metadata can be correctly
  constructed.
• (pypi) fixed the URL normalization function to correctly handle local paths
  enabling wheel sources files to point to an absolute path. Currently it supports
  the file://<absolute_path> for linux and windows like paths. We also support
  envsubst for the said paths from now on.

{#v2-3-0-added}

Added

• (bzlmod) Added MODULE.bazel flag aliases for Starlark-defined flags:
  build_python_zip, incompatible_default_to_explicit_init_py,
  python_path, and experimental_python_import_all_repositories.
• (bzlmod) Added the {obj}explicit_init_py tag class to the `{obj}`config module extension for configuring implicit __init__.py file
  generation module-wide.
  (#​3997,
  #​2945)
• (cc) Added experimental {obj}py_extension macro for creating C/C++ Python
  extension modules
  (#​3283).
  (cc) Added libc, platform_machine, platform_tag, soabi, and
  sys_platform attributes and info fields to {obj}py_cc_toolchain /
  {obj}PyCcToolchainInfo.
• (pip,python) Added pyproject_toml attribute to {obj}pip.default, {obj}pip.parse and {obj}python.defaults to read the default Python version from the requires-python field of pyproject.toml.
• (py_test) Added an opt-in safeguard against py_test targets that silently
  pass without running any tests. Set
  {obj}--@rules_python//python/config_settings:validate_test_main=enabled to
  fail the build when a test's main module only contains inert top-level
  statements (definitions, imports, assignments) and never invokes a test
  runner (#​3824).

{#v2-2-0}

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.