feat(toolchains): backport 20260325/20260414 Python toolchains for 2.0.2 (#3708)#3775
Open
kevinpark1217 wants to merge 2 commits into
Open
Conversation
This was referenced May 14, 2026
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request updates the Python toolchains by adding several new versions (3.10.20, 3.11.15, 3.12.13, 3.13.12, 3.13.13, 3.14.3, 3.14.4, and 3.15.0a8) from the 20260325 and 20260414 releases. It also updates the MINOR_MAPPING to these latest versions and adjusts the get_release_info logic in python/versions.bzl to handle build string formatting for freethreaded platforms based on the release ID. I have no feedback to provide.
kevinpark1217
force-pushed
the
backport-toolchains-3708-release-2.0
branch
from
e682635 to
ebb09da
Compare
kevinpark1217
added a commit
to kevinpark1217/rules_python
that referenced
this pull request
May 14, 2026
The toolchain bumps from bazel-contrib#3708 are being backported to release/2.0 and release/1.9 as 2.0.2 and 1.9.1 respectively (bazel-contrib#3775, bazel-contrib#3776), so move the bullets out of Unreleased and into dated patch sections to match what will ship from those branches. Refs bazel-contrib#3773.
…,4}, 3.15.0a8 (bazel-contrib#3708) This updates the Python version mappings to include the latest released versions. (cherry picked from commit 6dac0f6)
kevinpark1217
force-pushed
the
backport-toolchains-3708-release-2.0
branch
from
ebb09da to
503bf8b
Compare
…-contrib#3778) RBE has dropped support for older platform Fixing https://buildkite.com/bazel/rules-python-python/builds/15434#019e2c2c-c708-4c20-bc05-a9a5b1215d2f (cherry picked from commit 32527de)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backports the Python toolchain bumps from #3708 to
release/2.0so the2.0.xseries can pick up the high-severity CVE fixes (CVE-2025-13836, CVE-2026-24049, CVE-2026-23949) described in #3773 without requiring a major-version migration. AddsMINOR_MAPPINGentries for3.10.20,3.11.15,3.12.13,3.13.{12,13},3.14.{3,4},3.15.0a8and a new2.0.2CHANGELOG.mdsection.Before:
release/2.0ships3.10.19 / 3.11.14 / 3.12.12 / 3.13.11 / 3.14.2, which bundle the vulnerable interpreter +setuptools/pkg_resources.After:
release/2.0ships the patched 20260325 / 20260414python-build-standalonearchives. CHANGELOG gains a2.0.2section.Commits:
feat(toolchains): Add 3.10.20, 3.11.15, ...— cherry-pick of feat(toolchains): Add 3.10.20, 3.11.15, 3.12.13, 3.13.{12,13} 3.14.{3,4}, 3.15.0a8 #3708 (6dac0f6d).CHANGELOG.mdbullets placed under a new2.0.2section instead ofUnreleased. Theexamples/wheel/hunk is kept verbatim because the new interpreters dropsetuptools/pkg_resources, breaking the previously-pinnedpypiserver==2.0.1.ci: update RBE toolchain version from ubuntu2204 to ubuntu2404 (#3778)— cherry-pick of32527de8. Needed to unbreak RBE jobs (RBE provider dropped theubuntu2204toolchain).MODULE.bazelconflict resolved by taking only therules_cc 0.1.5 → 0.2.17bump; the unrelatedpackage_metadatabazel_dep frommainis skipped.Fixes #3773.