bazel: bazel_6 -> bazel_7; bazel_6: drop by emilazy · Pull Request #435096 · NixOS/nixpkgs

emilazy · 2025-08-19T20:53:18Z

Bazel 6 will be out of security support by the release of 25.11.

cc @NixOS/bazel – I see there’s an open PR for Bazel 8 but that it doesn’t work with buildBazelPackage yet, so hopefully this should be an okay incremental step to deal with the EOL version.

cc @lukegb for envoy (#435062)

cc @GaetanLepage for tensorflow-probability

Things done

Add a 👍 reaction to pull requests you find important.

hzeller · 2025-08-21T16:29:35Z

While updating the existing packages that use bazel 7 instead of bazel 6 is a good idea, I'd prefer if the actual bazel 6, the build tool, will stay through 25.11 and maybe removed 26.05.

bazel 6 is still supported up to December 2025 (https://bazel.build/release), so should be good for 25.11. After that, it is deprecated, but that doesn't mean that it isn't still useful. There will be plenty of projects that might want to use bazel 6 as bazel 7 can be a breaking change for them and they might only start switching after the deadline.

In my personal projects (such as bant) I am using bazel and often explicitly choose bazel 6 to be able to test compatibility and not accidentally pick up too new bazel features, so I'd be bummed if I can't do that on my regularly updated NixOS.

emilazy · 2025-08-21T17:56:28Z

bazel 6 is still supported up to December 2025 (https://bazel.build/release), so should be good for 25.11. After that, it is deprecated, but that doesn't mean that it isn't still useful. There will be plenty of projects that might want to use bazel 6 as bazel 7 can be a breaking change for them and they might only start switching after the deadline.

We support Nixpkgs releases for 7 months; removing software versions that will go EOL during the release window and not receive security support for its lifetime is standard procedure. Bazel 6 will be going EOL basically as soon as 25.11 releases. Bazel 5 has been out of security support for more than 25.05’s entire lifespan, which is really quite bad (and why it is being dropped in #434827).

Note that Bazel 6’s current maintenance state already only receives critical security fixes.

In my personal projects (such as bant) I am using bazel and often explicitly choose bazel 6 to be able to test compatibility and not accidentally pick up too new bazel features, so I'd be bummed if I can't do that on my regularly updated NixOS.

It’ll still be possible to use Bazel 6 from an older Nixpkgs release, with all the attendant security implications. The alternative would be to mark it as knownVulnerabilities (which would mean it is no longer built on Hydra), but that’s generally not how we handle EOL versions of packages with supported versions when nearing a new stable release. (Old versions of packages also cause maintenance burden by requiring maintenance of old versions of their dependencies – in this case Bazel 5 and Bazel 6 also pull in EOL versions of compilers that are being removed for 25.11, although the fix I am applying to Bazel 7 in #435110 would work for Bazel 6.)

hzeller · 2025-08-21T18:16:51Z

Fair enough, I just wanted to bring in my perspective as developer (The last tagged bazel 6 release is https://github.com/bazelbuild/bazel/releases/tag/6.5.0 from January 2024, so it is not that there is a lot of churn.)

emilazy · 2025-08-22T17:21:43Z

Yeah, it is unfortunate. But the alternative would be that if there is a Bazel security issue that gets a fix that isn’t backported back to Bazel 6, we’d have to mark it with knownVulnerabilities on 25.05 and take it away from people retroactively. Ultimately, it’s not really sustainable for Nixpkgs to promise longer support windows than upstream maintainers do. Hopefully getting your EOL Bazel from an EOL Nixpkgs won’t be too bad a solution – you won’t get security updates to the libraries used by Bazel, but since it’s out of support anyway that should be more or less priced in to the risk calculation.

I’m not hugely opposed to keeping it for 25.11, but the fact that there’s only one package that can’t easily be bumped to Bazel 7 in Nixpkgs (edit: other than the source jaxlib build, which is behind upstream – which supported Bazel 7 even for the release we package – and not used by default) makes me think it’s likely not worth the effort (which I suppose Google agrees with).

Ironically the one straggler is python3Packages.tensorflow-probability, a Google‐maintained library. I talked with its maintainer @GaetanLepage and he said that marking it broken for now seems reasonable, so this is ready to review from my POV.

pineapplehunter · 2025-08-24T02:26:50Z

pkgs/by-name/mo/mozc/package.nix

I found that mozc was not building on x86_64-linux. Bazel 7 introduced a platform-dependent file in the FOD.
Applying this patch should fix the issue.

fetchAttrs = { - sha256 = "sha256-+N7AhSemcfhq6j0IUeWZ0DyVvr1l5FbAkB+kahTy3pM="; + hash = "sha256-c+v2vWvTmwJ7MFh3VJlUh+iSINjsX66W9K0UBX5K/1s="; - # remove references of buildInputs and zip code files preInstall = '' - rm -rv $bazelOut/external/{ibus,qt_linux,zip_code_*} + # Remove zip code data. It will be replaced with jp-zip-codes from nixpkgs + rm -rv "$bazelOut"/external/zip_code_{jigyosyo,ken_all} + # Remove references to buildInputs + rm -rv "$bazelOut"/external/{ibus,qt_linux} + # Remove reference to the host platform + rm -rv "$bazelOut"/external/host_platform ''; };

Thank you! These Bazel FODs are quite unfortunate…

I have applied both of these patches and credited you as a co‐author on the relevant commits; I hope you don’t mind. I’m verifying the build on aarch64-linux and will also check the other builds on x86_64-linux to ensure nothing else like this slipped in.

pineapplehunter · 2025-08-24T03:30:51Z

pkgs/by-name/fc/fcitx5-mozc/package.nix

Similar to the patch on mozc.

fetchAttrs = { preInstall = '' + # Remove reference to buildInput rm -rf $bazelOut/external/fcitx5 + # Remove reference to the host platform + rm -rv "$bazelOut"/external/host_platform ''; - sha256 = "sha256-rrRp/v1pty7Py80/6I8rVVQvkeY72W+nlixUeYkjp+o="; + hash = "sha256-nFPGhZWvzzBOSeIa35XQbK6dHgJJSYum/5X8eAA0uCY="; };

Co-authored-by: Shogo Takata <[email protected]>

emilazy · 2025-08-24T19:25:22Z

`nixpkgs-review` result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 435096
Commit: 95cfbc3383cc7b7680fc4c5c74ea8e0ffdaf5d42

`x86_64-linux`

✅ 11 packages built:

anytype
anytype-heart
bant
fcitx5-mozc
fcitx5-mozc-ut
mozc (ibus-engines.mozc)
mozc-ut (ibus-engines.mozc-ut)
perf_data_converter
protoc-gen-js
verible
veridian

GaetanLepage

Thanks @emilazy !

hzeller

LGTM for

bant
perf_data_converter
verible

Thanks for working on this!

vbgl · 2025-08-26T07:39:27Z

pkgs/development/python-modules/jaxlib/default.nix

    # See https://github.com/google/jax/blob/main/.bazelversion for the latest.
-    bazel = bazel_6;
+    #bazel = bazel_6;
+    bazel = bazel;


This causes infinite recursion (and breaks nixpkgs evaluation), right?

yep, eval broken

The package is marked as broken and CI eval was happy; did this actually break the branch? Apologies for missing it, though.

nixpkgs-ci bot added 10.rebuild-linux: 11-100 This PR causes between 11 and 100 packages to rebuild on Linux. 10.rebuild-darwin: 1-10 This PR causes between 1 and 10 packages to rebuild on Darwin. 6.topic: python Python is a high-level, general-purpose programming language. labels Aug 19, 2025

emilazy mentioned this pull request Aug 21, 2025

envoy: 1.34.2 -> 1.35.1 #435427

Merged

13 tasks

emilazy force-pushed the push-rxzpqpqmkvmr branch from d89d778 to 202cc7f Compare August 21, 2025 12:04

emilazy marked this pull request as ready for review August 22, 2025 17:18

nix-owners bot requested review from GovanifY, Profpatsch, berberman, hzeller, lromor, newAM and pineapplehunter August 22, 2025 17:20

emilazy force-pushed the push-rxzpqpqmkvmr branch from 202cc7f to b88d784 Compare August 22, 2025 21:55

pineapplehunter suggested changes Aug 24, 2025

View reviewed changes

pineapplehunter reviewed Aug 24, 2025

View reviewed changes

emilazy force-pushed the push-rxzpqpqmkvmr branch from b88d784 to 46e2c37 Compare August 24, 2025 16:52

emilazy and others added 8 commits August 24, 2025 18:22

perf_data_converter: bump to Bazel 7

3a5b2aa

mozc: bump to Bazel 7

6da7629

Co-authored-by: Shogo Takata <[email protected]>

fcitx5-mozc: bump to Bazel 7

adaf301

Co-authored-by: Shogo Takata <[email protected]>

bant: bump to Bazel 7

1163733

verible: bump to Bazel 7

68c1755

protoc-gen-js: 3.21.2 -> 3.21.4

4afbcac

bazel: bazel_6 -> bazel_7

c2374fd

bazel_6: drop

95cfbc3

emilazy force-pushed the push-rxzpqpqmkvmr branch from 46e2c37 to 95cfbc3 Compare August 24, 2025 18:42

pineapplehunter approved these changes Aug 25, 2025

View reviewed changes

nixpkgs-ci bot added 12.approvals: 1 This PR was reviewed and approved by one person. 12.approved-by: package-maintainer This PR was reviewed and approved by a maintainer listed in any of the changed packages. labels Aug 25, 2025

GaetanLepage approved these changes Aug 25, 2025

View reviewed changes

nixpkgs-ci bot added 12.approvals: 2 This PR was reviewed and approved by two persons. and removed 12.approvals: 1 This PR was reviewed and approved by one person. labels Aug 25, 2025

hzeller approved these changes Aug 25, 2025

View reviewed changes

nixpkgs-ci bot added 12.approvals: 3+ This PR was reviewed and approved by three or more persons. and removed 12.approvals: 2 This PR was reviewed and approved by two persons. labels Aug 25, 2025

lromor approved these changes Aug 25, 2025

View reviewed changes

emilazy merged commit 18e2105 into NixOS:master Aug 26, 2025
33 of 35 checks passed

emilazy deleted the push-rxzpqpqmkvmr branch August 26, 2025 00:20

vbgl reviewed Aug 26, 2025

View reviewed changes

kirillrdy mentioned this pull request Aug 26, 2025

python3Packages.jaxlib: fix eval, infinate recursion #437069

Merged

13 tasks

phanirithvij mentioned this pull request Aug 29, 2025

bazel_6.updater: add more comments #245856

Closed

12 tasks

emilazy mentioned this pull request Sep 4, 2025

llvmPackages_{12,13,14,15,16,17}: drop #440273

Merged

13 tasks

Uh oh!

Conversation

emilazy commented Aug 19, 2025

Things done

Uh oh!

hzeller commented Aug 21, 2025

Uh oh!

emilazy commented Aug 21, 2025

Uh oh!

hzeller commented Aug 21, 2025

Uh oh!

emilazy commented Aug 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pineapplehunter Aug 24, 2025

Choose a reason for hiding this comment

Uh oh!

emilazy Aug 24, 2025

Choose a reason for hiding this comment

Uh oh!

pineapplehunter Aug 24, 2025

Choose a reason for hiding this comment

Uh oh!

emilazy commented Aug 24, 2025

nixpkgs-review result

x86_64-linux

Uh oh!

GaetanLepage left a comment

Choose a reason for hiding this comment

Uh oh!

hzeller left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

vbgl Aug 26, 2025

Choose a reason for hiding this comment

Uh oh!

kirillrdy Aug 26, 2025

Choose a reason for hiding this comment

Uh oh!

kirillrdy Aug 26, 2025

Choose a reason for hiding this comment

Uh oh!

emilazy Aug 26, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

emilazy commented Aug 22, 2025 •

edited

Loading

`nixpkgs-review` result

`x86_64-linux`