Skip to content

feat(toolchains): update Python toolchains to latest patch releases - #4369

Draft
rickeylev wants to merge 2 commits into
bazel-contrib:mainfrom
rickeylev:bump_patch_version_releases
Draft

rickeylev wants to merge 2 commits into
bazel-contrib:mainfrom
rickeylev:bump_patch_version_releases

Conversation

@rickeylev

Copy link
Copy Markdown
Collaborator

Recent Python patch releases address compromised eMudhra intermediate
CA keys in the bundled CA bundle and provide the Python 3.15 GA and
patch releases. Without these updates, default toolchains use older
patch releases and pre-release 3.15 builds.

Add the 20261009 and 20261026 python-build-standalone runtime
releases, remove pre-release 3.15.0 entries, and update default
minor version mappings to 3.10.22, 3.11.18, 3.12.16, 3.13.18,
3.14.10, and 3.15.2.

Fixes #4358

Recent Python patch releases address compromised eMudhra intermediate
CA keys in the bundled CA bundle and provide the Python 3.15 GA and
patch releases. Without these updates, default toolchains use older
patch releases and pre-release 3.15 builds.

Add the `20261009` and `20261026` `python-build-standalone` runtime
releases, remove pre-release `3.15.0` entries, and update default
minor version mappings to `3.10.22`, `3.11.18`, `3.12.16`, `3.13.18`,
`3.14.10`, and `3.15.2`.

Fixes bazel-contrib#4358
@rickeylev
rickeylev requested a review from aignas as a code owner October 27, 2026 18:45
@rickeylev

Copy link
Copy Markdown
Collaborator Author

AI Disclosure: This PR was created by an AI coding agent (semi-autonomous / human-reviewed). The human author (@rickeylev) monitors and reviews PR comments and approves any agent-assisted responses or changes before they are posted.

This is an automatically generated agent comment.

@rickeylev
rickeylev marked this pull request as draft October 27, 2026 20:27
Do not pass runtime_root through _get_windows_path_with_unc_prefix in
_fixup_stdlib_paths, since _get_windows_path_with_unc_prefix now
unconditionally adds the \\?\ prefix on Windows and leaks extended
paths into sys.path when CPython resolves sys.base_prefix out of
runfiles.

Also pin python_version = "3.11.15" in runtime_manifests integration
test so adding newer 3.11.x patch releases to runtimes_manifest.bzl does
not change the toolchain selected for basic_test.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Increase the patch version of all Python releases

1 participant