Release 9.3.2 (2026-11-05)

Bazel 9.3.2 is a patch LTS release. It is fully backward compatible with Bazel 9 releases starting from 9.0.1; see Bazel 9.0.1 release notes for a note on backward compatibility.

• Fixed an issue where Bazel occasionally hangs during external repo fetch. (#32159)

• Reverted the change "Invalidate cached action execution results when remote cache/executor endpoints or --remote_instance_name change between invocations" introduced in 9.3.0; it was causing overeager invalidations, especially as action rewinding is now enabled by default. (#32254)

Acknowledgments

This release contains contributions from Fabian Meumertzheim and James Judd.

Notice: Bazel installers contain binaries licensed under the GPLv2 with Classpath exception. Those installers should always be redistributed along with the source code.

Some versions of Bazel contain a bundled version of OpenJDK. The license of the bundled OpenJDK and other open-source components can be displayed by running the command bazel license. The vendor and version information of the bundled OpenJDK can be displayed by running the command bazel info java-runtime. The binaries and source-code of the bundled OpenJDK can be downloaded from our mirror server.

Security: All our binaries are signed with our public key 3D5919B448457EE0.

Release 9.3.2rc3 (2026-11-02)

Bazel 9.3.2 is a patch LTS release. It is fully backward compatible with Bazel 9 releases starting from 9.0.1; see Bazel 9.0.1 release notes for a note on backward compatibility.

• Fixed an issue where Bazel occasionally hangs during external repo fetch. (#32159)

• Reverted the change "Invalidate cached action execution results when remote cache/executor endpoints or --remote_instance_name change between invocations" introduced in 9.3.0; it was causing overeager invalidations, especially as action rewinding is now enabled by default. (#32254)

Acknowledgments

This release contains contributions from Fabian Meumertzheim and James Judd.

Notice: Bazel installers contain binaries licensed under the GPLv2 with Classpath exception. Those installers should always be redistributed along with the source code.

Some versions of Bazel contain a bundled version of OpenJDK. The license of the bundled OpenJDK and other open-source components can be displayed by running the command bazel license. The vendor and version information of the bundled OpenJDK can be displayed by running the command bazel info java-runtime. The binaries and source-code of the bundled OpenJDK can be downloaded from our mirror server.

Security: All our binaries are signed with our public key 3D5919B448457EE0.

Release 9.3.2rc2 (2026-10-29)

Bazel 9.3.2 is a patch LTS release. It is fully backward compatible with Bazel 9 releases starting from 9.0.1; see Bazel 9.0.1 release notes for a note on backward compatibility.

• Fixed an issue where Bazel occasionally hangs during external repo fetch. (#32159)

• Reverted the change "Invalidate cached action execution results when remote cache/executor endpoints or --remote_instance_name change between invocations" introduced in 9.3.0; it was causing overeager invalidations, especially as action rewinding is now enabled by default. (#32254)

Acknowledgments

This release contains contributions from Fabian Meumertzheim.

Notice: Bazel installers contain binaries licensed under the GPLv2 with Classpath exception. Those installers should always be redistributed along with the source code.

Some versions of Bazel contain a bundled version of OpenJDK. The license of the bundled OpenJDK and other open-source components can be displayed by running the command bazel license. The vendor and version information of the bundled OpenJDK can be displayed by running the command bazel info java-runtime. The binaries and source-code of the bundled OpenJDK can be downloaded from our mirror server.

Security: All our binaries are signed with our public key 3D5919B448457EE0.

Release 9.3.2rc1 (2026-10-28)

Bazel 9.3.2 is a patch LTS release. It is fully backward compatible with Bazel 9 releases starting from 9.0.1; see Bazel 9.0.1 release notes for a note on backward compatibility.

• Fixed an issue where Bazel occasionally hangs during external repo fetch. (#32159)

Acknowledgments

This release contains contributions from Fabian Meumertzheim.

Notice: Bazel installers contain binaries licensed under the GPLv2 with Classpath exception. Those installers should always be redistributed along with the source code.

Some versions of Bazel contain a bundled version of OpenJDK. The license of the bundled OpenJDK and other open-source components can be displayed by running the command bazel license. The vendor and version information of the bundled OpenJDK can be displayed by running the command bazel info java-runtime. The binaries and source-code of the bundled OpenJDK can be downloaded from our mirror server.

Security: All our binaries are signed with our public key 3D5919B448457EE0.

Release 7.7.2 (2026-10-23)

Bazel 7.7.2 is a patch LTS release. It is fully backward compatible with Bazel 7.0 and contains selected changes by the Bazel community and Google engineers.

• Removed distrusted eMudhra and Sectigo AAA root CA certificates from the bundled JDK, to address the private key leakage (see https://emudhra.we-have-a-problem.com/; #31954)

Notice: Bazel installers contain binaries licensed under the GPLv2 with Classpath exception. Those installers should always be redistributed along with the source code.

Some versions of Bazel contain a bundled version of OpenJDK. The license of the bundled OpenJDK and other open-source components can be displayed by running the command bazel license. The vendor and version information of the bundled OpenJDK can be displayed by running the command bazel info java-runtime. The binaries and source-code of the bundled OpenJDK can be downloaded from our mirror server.

Security: All our binaries are signed with our public key 3D5919B448457EE0.

Release 10.0.0rc2 (2026-10-22)

Baseline: 649a7be

Bazel 10.0 is a major long-term-support (LTS) release. It contains new features and backwards incompatible changes.

Highlights

• TBA

Migration-Ready Incompatible Flags

The following flags are flipped in 10.0:

Users can use bazelisk --migrate with the BAZELISK_INCOMPATIBLE_FLAGS environment variable to test these flag flips with Bazel 9.x.

• --experimental_fetch_all_coverage_outputs
• --experimental_split_coverage_postprocessing
• --incompatible_check_testonly_for_output_files (#28875, #28876)
• --incompatible_exclude_starlark_flags_from_exec_config (#26909)
• --incompatible_no_implicit_file_export (#10225, #27674)
• --rewind_lost_inputs (#30415)

The following flags will be flipped in a future major release:

• --incompatible_check_external_repo_source_dir_package_boundary (#30019)
• --incompatible_config_setting_private_default_visibility (#12933)
• --incompatible_disable_starlark_host_transitions (#17032)
• --incompatible_eagerly_resolve_select_keys (#26281)
• --incompatible_fail_on_unknown_output_groups
• --incompatible_package_group_build_output
• --incompatible_prefer_depending_configuration_runfiles
• --incompatible_remove_ctx_android_fragment (#29884)
• --incompatible_remove_ctx_apple_fragment
• --incompatible_remove_ctx_objc_fragment
• --incompatible_require_matching_aspect_hints_providers
• --incompatible_require_mnemonic_for_run_actions
• --incompatible_require_repo_extension_metadata (#30202)
• --incompatible_symbolic_macro_strict_attrs (#27430)

General

• [Incompatible] Added support for platform-specific startup options in .bazelrc files (startup:linux, startup:macos, startup:windows, etc.) (#26882).
• [Incompatible] --test_tmpdir= now resets a value from a .bazelrc file to the default execroot temp directory instead of creating _tmp in the workspace. Use --test_tmpdir=. to retain workspace-relative behavior (#30318).
• [Incompatible] --incompatible_modify_execution_info_additive is now deprecated and a no-op. When --modify_execution_info is specified multiple times, all values are always applied in order.
• The JDK bundled with Bazel has been updated to JDK 27 (#31491).
• --server_javabase and nojdk builds of Bazel can now use JREs in addition to JDKs (#30643).
• Added --target_query and --target_query_file flags for building or testing the result of a bazel query in a single command (#28996).
• Reporting of cached test results can now be suppressed with --test_summary=short_uncached or --test_summary=detailed_uncached (#28290).
• The new --expand_param_files flag expands param files into their contents in --subcommands and --verbose_failures output (#29130).
• Large numbers with 5+ digits in CLI output are now formatted with comma separators for improved readability (e.g., "12,345 targets configured" instead of "12345 targets configured") (#28922).
• .bazelrc config declarations can now be empty (#29212).
• A .bazelrc file may now only import files recursively with a depth of up to 512 imports. If you encounter a "Maximum import depth exceeded parsing config file" error and cannot shorten your import chain, set the BAZEL_UNLIMITED_IMPORT_DEPTH environment variable to any value to disable this limit.
• Added -Djava.net.preferIPv6Addresses=system to startup JVM args, which may impact certain IPv4-only environments. Override as necessary with --host_jvm_args (#29237).
• The --action_cache_gc_idle_delay, --action_cache_gc_threshold, and --action_cache_gc_max_age flags are no longer experimental.
• The --disk_cache_gc_idle_delay, --disk_cache_gc_max_size, and --disk_cache_gc_max_age flags are no longer experimental.
• The --install_base_gc_max_age flag is no longer experimental.
• Added --output:display_full_kind for query options to display the full kind for Starlark rules with the label_kind, location, and xml output formats (#29147).
• In the output of bazel query --output=build, string attributes containing newline characters are now enclosed in triple double quotes (""") for better readability.
• bazel query --output=proto now supports dict(label, string) (LABEL_KEYED_STRING_DICT) aspect attributes.
• bazel query --output=streamed_proto can opt into parallel serialization with --experimental_parallel_streamed_proto_output (#30959).
• aquery now supports the config(expr, word) function (#10872).
• Added bazel dump --skyframe=keys to report only the keys available in Skyframe (always use with --skykey_filter to limit the number of keys reported) (#30006).
• Added bazel dump --skyframe=changed to list the Skyframe values that the last command created or changed, together with the changed dependencies that caused each change (#31564).
• Fixed --progress_in_terminal_title output under screen and emacs.
• Fixed an issue where bazel test --nobuild failed with TEST_WITH_NOANALYZE instead of succeeding after analysis (#13821).
• Fixed a bug where a Bazel server kept its command lock after its client was killed, stalling later invocations (#30960).
• The self-extracting installer now correctly creates installation directories when custom paths contain spaces (#31226).
• Fixed grep: invalid option -- P errors on macOS when running release and documentation scripts (#30909).
• Removed distrusted eMudhra and Sectigo AAA root CA certificates from the bundled JDK, to address the private key leakage (see https://emudhra.we-have-a-problem.com/). (#31925)

Android

• Added an implicit MODULE.tools dependency on rules_android v0.8.0 (#31425).
• Added proper error ordering for the bazel mobile-install command (#30998).
• Created --incompatible_remove_ctx_android_fragment for migrating Android configuration flags to Starlark (#29884).

Build Event Protocol

• BEP events are now written respecting parent-child ordering constraints.
• BuildFinished events in BEP now consistently contain an "infrastructure-caused" detailed exit code when a single target contains both infrastructure-caused and user-caused exit codes in its failed actions.
• Added a new instance_id field to the BuildMetrics BES event to help diff between the current and previous builds on a running server (#29817).
• Improved BES upload failure messages to include the failed invocation's ID.

C++ / Objective-C

• C static libraries can now elide backward reference warnings (when linking with LLD and such warnings are enabled) if the warn_backrefs_defined feature is defined and enabled for the toolchain.
• The --fdo_optimize flag now accepts repo labels as well as package labels (#29118).
• The C++ include scanner now properly resolves headers that are generated at build time and included as part of the toolchain (#30879).
• CcStarlarkInternal now exposes hash functions used by rules_cc Java rules to Starlark.
• Removed CoptsFilter from Bazel (no longer used since rules_cc 0.2.19).

Configurability / cquery

• [Incompatible] The deprecated remote_execution_properties attribute on platform has been removed in favor of exec_properties.
• [Incompatible] The config_setting targets @bazel_tools//src/conditions:{host_windows,remote} have been removed (#28300). Toolchains are usually a better fit as they don't depend on the configuration of the host machine running Bazel or fixed execution modes....

Release 7.7.2rc1 (2026-10-23)

Bazel 7.7.2 is a patch LTS release. It is fully backward compatible with Bazel 7.0 and contains selected changes by the Bazel community and Google engineers.

• Removed distrusted eMudhra and Sectigo AAA root CA certificates from the bundled JDK, to address the private key leakage (see https://emudhra.we-have-a-problem.com/; #31954)

Notice: Bazel installers contain binaries licensed under the GPLv2 with Classpath exception. Those installers should always be redistributed along with the source code.

Some versions of Bazel contain a bundled version of OpenJDK. The license of the bundled OpenJDK and other open-source components can be displayed by running the command bazel license. The vendor and version information of the bundled OpenJDK can be displayed by running the command bazel info java-runtime. The binaries and source-code of the bundled OpenJDK can be downloaded from our mirror server.

Security: All our binaries are signed with our public key 3D5919B448457EE0.

Release 9.3.1 (2026-10-20)

Bazel 9.3.1 is a patch LTS release. It is fully backward compatible with Bazel 9 releases starting from 9.0.1; see Bazel 9.0.1 release notes for a note on backward compatibility.

General

• Removed distrusted eMudhra and Sectigo AAA root CA certificates from the bundled JDK, to address the private key leakage (see https://emudhra.we-have-a-problem.com/; #31920)

Core

• Preserve packages in top-level alias chains across pre-execution cache discards. (#31912)

External Deps

• Close the channel of a lock file when acquiring a lock fails (#31896)

Performance

• Rewind an action whose output was lost before it could be downloaded (#31902)

Acknowledgments

This release contains contributions from many people at Google, as well as Fabian Meumertzheim.

Notice: Bazel installers contain binaries licensed under the GPLv2 with Classpath exception. Those installers should always be redistributed along with the source code.

Some versions of Bazel contain a bundled version of OpenJDK. The license of the bundled OpenJDK and other open-source components can be displayed by running the command bazel license. The vendor and version information of the bundled OpenJDK can be displayed by running the command bazel info java-runtime. The binaries and source-code of the bundled OpenJDK can be downloaded from our mirror server.

Security: All our binaries are signed with our public key 3D5919B448457EE0.

Release 8.8.2 (2026-10-20)

Bazel 8.8.2 is a patch LTS release. It is fully backward compatible with Bazel 8.0 and contains selected changes by the Bazel community and Google engineers.

• Removed distrusted eMudhra and Sectigo AAA root CA certificates from the bundled JDK, to address the private key leakage (see https://emudhra.we-have-a-problem.com/; #31921)

Notice: Bazel installers contain binaries licensed under the GPLv2 with Classpath exception. Those installers should always be redistributed along with the source code.

Some versions of Bazel contain a bundled version of OpenJDK. The license of the bundled OpenJDK and other open-source components can be displayed by running the command bazel license. The vendor and version information of the bundled OpenJDK can be displayed by running the command bazel info java-runtime. The binaries and source-code of the bundled OpenJDK can be downloaded from our mirror server.

Security: All our binaries are signed with our public key 3D5919B448457EE0.

Release 9.3.1rc1 (2026-10-20)

Bazel 9.3.1 is a patch LTS release. It is fully backward compatible with Bazel 9 releases starting from 9.0.1; see Bazel 9.0.1 release notes for a note on backward compatibility.

General

• Removed distrusted eMudhra and Sectigo AAA root CA certificates from the bundled JDK, to address the private key leakage (see https://emudhra.we-have-a-problem.com/; #31920)

Core

• Preserve packages in top-level alias chains across pre-execution cache discards. (#31912)

External Deps

• Close the channel of a lock file when acquiring a lock fails (#31896)

Performance

• Rewind an action whose output was lost before it could be downloaded (#31902)

Acknowledgments

This release contains contributions from many people at Google, as well as Fabian Meumertzheim.

Notice: Bazel installers contain binaries licensed under the GPLv2 with Classpath exception. Those installers should always be redistributed along with the source code.

Some versions of Bazel contain a bundled version of OpenJDK. The license of the bundled OpenJDK and other open-source components can be displayed by running the command bazel license. The vendor and version information of the bundled OpenJDK can be displayed by running the command bazel info java-runtime. The binaries and source-code of the bundled OpenJDK can be downloaded from our mirror server.

Security: All our binaries are signed with our public key 3D5919B448457EE0.