feat(toolchains): backport 20260325/20260414 Python toolchains for 1.9.1 (#3708)#3776
Open
kevinpark1217 wants to merge 2 commits into
Open
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request updates the Python toolchains by adding several new versions from the 20260325 and 20260414 releases, updating the MINOR_MAPPING, and refining the release info logic for freethreaded builds. Feedback includes correcting a missing comma and pluralization in the CHANGELOG.md, as well as improving the consistency of platform key ordering within the sha256 maps in python/versions.bzl.
Comment on lines
+57
to
+59
| * (toolchains) `3.13.12`, `3.14.3` Python toolchain from [20260325] release. | ||
| * (toolchains) `3.10.20`, `3.11.15`, `3.12.13`, `3.13.13` `3.14.4`, `3.15.0a8` | ||
| Python toolchain from [20260414] release. |
Contributor
There was a problem hiding this comment.
There are a few minor issues in the changelog entry:
- A missing comma between
3.13.13and3.14.4on line 58. - Use of the singular "toolchain" when referring to multiple versions. It should be "toolchains" for consistency.
Suggested change
| * (toolchains) `3.13.12`, `3.14.3` Python toolchain from [20260325] release. | |
| * (toolchains) `3.10.20`, `3.11.15`, `3.12.13`, `3.13.13` `3.14.4`, `3.15.0a8` | |
| Python toolchain from [20260414] release. | |
| * (toolchains) `3.13.12`, `3.14.3` Python toolchains from [20260325] release. | |
| * (toolchains) `3.10.20`, `3.11.15`, `3.12.13`, `3.13.13`, `3.14.4`, `3.15.0a8` | |
| Python toolchains from [20260414] release. |
Contributor
Author
There was a problem hiding this comment.
Cherry-picked verbatim from #3708 (6dac0f6d); same content is on main. Not changing in the backport. Happy to fix upstream in a follow-up.
Comment on lines
+910
to
+928
| "aarch64-apple-darwin": "688da81bcaa6ed91792397c7d5433b13a4f02f021f940637c3972639bc516dca", | ||
| "aarch64-unknown-linux-gnu": "31c6e61eed48ca4e156d0e473025a792338641109e8277a63518ded438390c96", | ||
| "ppc64le-unknown-linux-gnu": "654939bc40d5f76f08eb17335bb19e9efa11eb48a0818eda2293a3f7c3570ae7", | ||
| "riscv64-unknown-linux-gnu": "fc7e1fb553c47b831ed7fa529575145207f000f967513f7b9ea809cce006ed79", | ||
| "s390x-unknown-linux-gnu": "7d7919358e88fcc672b061be8c2316c3a604c7074200515d7104166ed611f7f9", | ||
| "x86_64-apple-darwin": "7411e47939783708381017a90944a69641ac84d43f74fb6e2d52576c599a2717", | ||
| "x86_64-pc-windows-msvc": "5b4093f92d9bffcb0d92aea050f3d77d5a4fc8e918b31cea000ee4b3ca751f1d", | ||
| "aarch64-pc-windows-msvc": "d2c8b00044cd2e4c5fc7e697e63d5e481ed44b87c2def0beb42991d59f65d930", | ||
| "aarch64-pc-windows-msvc-freethreaded": "d2c8b00044cd2e4c5fc7e697e63d5e481ed44b87c2def0beb42991d59f65d930", | ||
| "x86_64-unknown-linux-gnu": "ebb1051ca2822b9803f46a5f10b6d51d153189ef1b1f1e142f733c0cbeaf86eb", | ||
| "x86_64-unknown-linux-musl": "b2e9400731c7f18069ec2804ba87a404385fe440f93b7dcb59004b9f56651202", | ||
| "aarch64-apple-darwin-freethreaded": "688da81bcaa6ed91792397c7d5433b13a4f02f021f940637c3972639bc516dca", | ||
| "aarch64-unknown-linux-gnu-freethreaded": "31c6e61eed48ca4e156d0e473025a792338641109e8277a63518ded438390c96", | ||
| "ppc64le-unknown-linux-gnu-freethreaded": "654939bc40d5f76f08eb17335bb19e9efa11eb48a0818eda2293a3f7c3570ae7", | ||
| "riscv64-unknown-linux-gnu-freethreaded": "fc7e1fb553c47b831ed7fa529575145207f000f967513f7b9ea809cce006ed79", | ||
| "s390x-unknown-linux-gnu-freethreaded": "7d7919358e88fcc672b061be8c2316c3a604c7074200515d7104166ed611f7f9", | ||
| "x86_64-apple-darwin-freethreaded": "7411e47939783708381017a90944a69641ac84d43f74fb6e2d52576c599a2717", | ||
| "x86_64-pc-windows-msvc-freethreaded": "5b4093f92d9bffcb0d92aea050f3d77d5a4fc8e918b31cea000ee4b3ca751f1d", | ||
| "x86_64-unknown-linux-gnu-freethreaded": "ebb1051ca2822b9803f46a5f10b6d51d153189ef1b1f1e142f733c0cbeaf86eb", |
Contributor
There was a problem hiding this comment.
The keys in the sha256 map for version 3.13.12 are inconsistently ordered compared to other versions added in this PR (like 3.14.3). Specifically, aarch64-pc-windows-msvc-freethreaded is placed early (line 918) while other freethreaded variants are grouped at the end. It is better to group all freethreaded variants together or sort them alphabetically to maintain consistency and readability.
Suggested change
| "aarch64-apple-darwin": "688da81bcaa6ed91792397c7d5433b13a4f02f021f940637c3972639bc516dca", | |
| "aarch64-unknown-linux-gnu": "31c6e61eed48ca4e156d0e473025a792338641109e8277a63518ded438390c96", | |
| "ppc64le-unknown-linux-gnu": "654939bc40d5f76f08eb17335bb19e9efa11eb48a0818eda2293a3f7c3570ae7", | |
| "riscv64-unknown-linux-gnu": "fc7e1fb553c47b831ed7fa529575145207f000f967513f7b9ea809cce006ed79", | |
| "s390x-unknown-linux-gnu": "7d7919358e88fcc672b061be8c2316c3a604c7074200515d7104166ed611f7f9", | |
| "x86_64-apple-darwin": "7411e47939783708381017a90944a69641ac84d43f74fb6e2d52576c599a2717", | |
| "x86_64-pc-windows-msvc": "5b4093f92d9bffcb0d92aea050f3d77d5a4fc8e918b31cea000ee4b3ca751f1d", | |
| "aarch64-pc-windows-msvc": "d2c8b00044cd2e4c5fc7e697e63d5e481ed44b87c2def0beb42991d59f65d930", | |
| "aarch64-pc-windows-msvc-freethreaded": "d2c8b00044cd2e4c5fc7e697e63d5e481ed44b87c2def0beb42991d59f65d930", | |
| "x86_64-unknown-linux-gnu": "ebb1051ca2822b9803f46a5f10b6d51d153189ef1b1f1e142f733c0cbeaf86eb", | |
| "x86_64-unknown-linux-musl": "b2e9400731c7f18069ec2804ba87a404385fe440f93b7dcb59004b9f56651202", | |
| "aarch64-apple-darwin-freethreaded": "688da81bcaa6ed91792397c7d5433b13a4f02f021f940637c3972639bc516dca", | |
| "aarch64-unknown-linux-gnu-freethreaded": "31c6e61eed48ca4e156d0e473025a792338641109e8277a63518ded438390c96", | |
| "ppc64le-unknown-linux-gnu-freethreaded": "654939bc40d5f76f08eb17335bb19e9efa11eb48a0818eda2293a3f7c3570ae7", | |
| "riscv64-unknown-linux-gnu-freethreaded": "fc7e1fb553c47b831ed7fa529575145207f000f967513f7b9ea809cce006ed79", | |
| "s390x-unknown-linux-gnu-freethreaded": "7d7919358e88fcc672b061be8c2316c3a604c7074200515d7104166ed611f7f9", | |
| "x86_64-apple-darwin-freethreaded": "7411e47939783708381017a90944a69641ac84d43f74fb6e2d52576c599a2717", | |
| "x86_64-pc-windows-msvc-freethreaded": "5b4093f92d9bffcb0d92aea050f3d77d5a4fc8e918b31cea000ee4b3ca751f1d", | |
| "x86_64-unknown-linux-gnu-freethreaded": "ebb1051ca2822b9803f46a5f10b6d51d153189ef1b1f1e142f733c0cbeaf86eb", | |
| "aarch64-apple-darwin": "688da81bcaa6ed91792397c7d5433b13a4f02f021f940637c3972639bc516dca", | |
| "aarch64-unknown-linux-gnu": "31c6e61eed48ca4e156d0e473025a792338641109e8277a63518ded438390c96", | |
| "ppc64le-unknown-linux-gnu": "654939bc40d5f76f08eb17335bb19e9efa11eb48a0818eda2293a3f7c3570ae7", | |
| "riscv64-unknown-linux-gnu": "fc7e1fb553c47b831ed7fa529575145207f000f967513f7b9ea809cce006ed79", | |
| "s390x-unknown-linux-gnu": "7d7919358e88fcc672b061be8c2316c3a604c7074200515d7104166ed611f7f9", | |
| "x86_64-apple-darwin": "7411e47939783708381017a90944a69641ac84d43f74fb6e2d52576c599a2717", | |
| "x86_64-pc-windows-msvc": "5b4093f92d9bffcb0d92aea050f3d77d5a4fc8e918b31cea000ee4b3ca751f1d", | |
| "aarch64-pc-windows-msvc": "d2c8b00044cd2e4c5fc7e697e63d5e481ed44b87c2def0beb42991d59f65d930", | |
| "x86_64-unknown-linux-gnu": "ebb1051ca2822b9803f46a5f10b6d51d153189ef1b1f1e142f733c0cbeaf86eb", | |
| "x86_64-unknown-linux-musl": "b2e9400731c7f18069ec2804ba87a404385fe440f93b7dcb59004b9f56651202", | |
| "aarch64-apple-darwin-freethreaded": "688da81bcaa6ed91792397c7d5433b13a4f02f021f940637c3972639bc516dca", | |
| "aarch64-unknown-linux-gnu-freethreaded": "31c6e61eed48ca4e156d0e473025a792338641109e8277a63518ded438390c96", | |
| "ppc64le-unknown-linux-gnu-freethreaded": "654939bc40d5f76f08eb17335bb19e9efa11eb48a0818eda2293a3f7c3570ae7", | |
| "riscv64-unknown-linux-gnu-freethreaded": "fc7e1fb553c47b831ed7fa529575145207f000f967513f7b9ea809cce006ed79", | |
| "s390x-unknown-linux-gnu-freethreaded": "7d7919358e88fcc672b061be8c2316c3a604c7074200515d7104166ed611f7f9", | |
| "x86_64-apple-darwin-freethreaded": "7411e47939783708381017a90944a69641ac84d43f74fb6e2d52576c599a2717", | |
| "x86_64-pc-windows-msvc-freethreaded": "5b4093f92d9bffcb0d92aea050f3d77d5a4fc8e918b31cea000ee4b3ca751f1d", | |
| "aarch64-pc-windows-msvc-freethreaded": "d2c8b00044cd2e4c5fc7e697e63d5e481ed44b87c2def0beb42991d59f65d930", | |
| "x86_64-unknown-linux-gnu-freethreaded": "ebb1051ca2822b9803f46a5f10b6d51d153189ef1b1f1e142f733c0cbeaf86eb" |
Contributor
Author
There was a problem hiding this comment.
Cherry-picked verbatim from #3708 (6dac0f6d); same content is on main. Not changing in the backport. Happy to fix upstream in a follow-up.
kevinpark1217
force-pushed
the
backport-toolchains-3708-release-1.9
branch
from
6f9c540 to
baf6bd6
Compare
kevinpark1217
added a commit
to kevinpark1217/rules_python
that referenced
this pull request
May 14, 2026
The toolchain bumps from bazel-contrib#3708 are being backported to release/2.0 and release/1.9 as 2.0.2 and 1.9.1 respectively (bazel-contrib#3775, bazel-contrib#3776), so move the bullets out of Unreleased and into dated patch sections to match what will ship from those branches. Refs bazel-contrib#3773.
…,4}, 3.15.0a8 (bazel-contrib#3708) This updates the Python version mappings to include the latest released versions. (cherry picked from commit 6dac0f6)
kevinpark1217
force-pushed
the
backport-toolchains-3708-release-1.9
branch
from
baf6bd6 to
e88d0dd
Compare
The pinned `requirements: 1.6.0` and `python_version: 3.9` in `.github/workflows/mypy.yaml` no longer work: the `jpetrucciani/mypy-check@master` action now defaults to `mypy==2.1.0` (`Requires-Python >=3.10`) regardless of the `requirements` parameter, and Python 3.9 can no longer install it. Every PR opened against `release/1.9` currently fails this check. Drop both pins so the action picks its defaults, matching how the same workflow already runs on `main` and `release/2.0`.
kevinpark1217
force-pushed
the
backport-toolchains-3708-release-1.9
branch
from
4324592 to
7adf838
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-picks #3708 (
6dac0f6d) intorelease/1.9to land a1.9.1. Companion to #3775;release/1.9ships the sameMINOR_MAPPINGso it's affected by the same CVE set called out in #3773.Deviations from the cherry-pick:
CHANGELOG.mdconflict resolved by placing the bullets in a new1.9.1section. The patch's2.0.0block was discarded (doesn't belong onrelease/1.9).The
examples/wheel/changes from #3708 (pypiserver bump + test_publish hardening) are included verbatim — they are required for the new toolchains, since20260414+python-build-standalonearchives no longer bundlesetuptools/pkg_resourcesand the previously-pinnedpypiserver==2.0.1importspkg_resourcesat module load.Second commit — workflow maintenance:
fix(ci): unpin mypy version in mypy workflowdrops therequirements: 1.6.0/python_version: 3.9pins from.github/workflows/mypy.yaml. Thejpetrucciani/mypy-check@masteraction now defaults tomypy==2.1.0(requires Python ≥3.10) regardless of therequirementsparameter, so every PR againstrelease/1.9currently fails thecicheck. After this fix the workflow runs with the action's defaults, matching how it's already configured onmainandrelease/2.0. (Functionally equivalent to the workflow hunk of #3678, but framed as a workflow-maintenance fix rather than a partial cherry-pick.)Test plan — Ubuntu 24.04
aarch64Docker, Bazel 9.0.0, this branch vialocal_path_override:py_binaryruns under3.14.4(defaultMINOR_MAPPING) — archive SHA256s matchbazel test //examples/wheel:test_publishpasses with the new toolchains🤖 Generated with Claude Code