[EXP] Bazel 8 support

.bazelrc

@@ -14,9 +14,7 @@ build --test_timeout=1,15,60,240
 common --noenable_bzlmod
 
 # bazel7 enables Build without the Bytes (BwoB) by default. This significantly speeds up builds
-# using the remote cache since less data needs to be fetched. Set remote_cache_eviction_retries
-# which is required to fully support a "dumb" cache. Bazel 8 already sets this value by default.
-build --experimental_remote_cache_eviction_retries=5
+# using the remote cache since less data needs to be fetched.
 # Note that we use remote_download_minimal for test builds, which avoids fetching build outputs
 # where possible. While several previous BwoB bugs have been fixed, this is slower than it could be
 # due to https://github.com/bazelbuild/bazel/issues/20576.
@@ -33,12 +31,6 @@ import %workspace%/build/lint.bazelrc
 # Enable webgpu
 build --//src/workerd/io:enable_experimental_webgpu=True
 
-# Avoid generating duplicate runfile trees. This will become the default in a future bazel version.
-build --nolegacy_external_runfiles
-
-# Flip this early to avoid breaking compatibility once it becomes the default.
-build --incompatible_disallow_empty_glob
-
 # Prevents bazel cache invalidation when switching terminals
 build --incompatible_strict_action_env
 
@@ -156,13 +148,10 @@ build --cxxopt="-fbracket-depth=512" --host_cxxopt="-fbracket-depth=512"
 build --@capnp-cpp//src/capnp:gen_rust=True
 
 # Additional Rust flags (see https://doc.rust-lang.org/rustc/codegen-options/index.html)
-# Need to disable debug-assertions for fastbuild, should be off automatically for opt. As long as
-# rust-level LTO is not enabled, LLVM bitcode is not needed so -C embed-bitcode=n provides a free
-# improvement to build speed and Rust code size.
+# Need to disable debug-assertions for fastbuild, should be off automatically for opt.
 # Using extra_rustc_flag for non-exec flags so they can be overwritten selectively.
-build --@rules_rust//:extra_rustc_flag=-Cembed-bitcode=n
 build --@rules_rust//:extra_rustc_flag=-Cdebug-assertions=n
-build --@rules_rust//:extra_exec_rustc_flags=-C,debug-assertions=n,-C,embed-bitcode=n
+build --@rules_rust//:extra_exec_rustc_flags=-Cdebug-assertions=n
 
 # We default to not enabling debug assertions and unwinding for Rust. For debug builds this is not
 # the right setting, but unfortunately we can't set that directly.
@@ -383,3 +372,12 @@ build:windows --cxxopt='/Zc:__cplusplus' --host_cxxopt='/Zc:__cplusplus'
 # enable clang coverage: https://clang.llvm.org/docs/SourceBasedCodeCoverage.html
 build:clang-coverage --copt="-fprofile-instr-generate" --linkopt="-fprofile-instr-generate"
 build:clang-coverage --copt="-fcoverage-mapping" --linkopt="-fcoverage-mapping"
+
+build --enable_workspace
+# As part of starlarkification, Bazel 8 removes a number of rules which now need to be imported from
+# other repositories. In the long term, load() statements will be needed to import these rules. For
+# now, we can still autoload the affected repositories when needed. Do this only for a few
+# handpicked rules_python rules_shell, and protobuf components instead of the larger default
+# autoload set – some dependencies aren't importing the required shell rules yet, but we don't want
+# to accidentally rely on autoloading more dependencies.
+build --incompatible_autoload_externally="+py_binary,+py_library,+py_test,+ProtoInfo,+sh_binary,+proto_library,+cc_proto_library"

.bazelversion

@@ -1 +1 @@
-7.4.1rc2
+8.0.1rc1

.gitignore

@@ -16,6 +16,8 @@ package-lock.json
 /external
 # Bazel output symlinks: Same reasoning as /external. You need the * because people can change the name of the directory your repository is cloned into, changing the bazel-<workspace_name> symlink.
 /bazel-*
+# Bazel 8's MODULE lock, since we're not actually locking anything yet.
+MODULE.bazel.lock
 # Compiled output -> don't check in
 /compile_commands.json
 /rust-project.json

MODULE.bazel

@@ -0,0 +1 @@
+# We don't use bzlmod at this time, but bazel 8 still expects us to have a MODULE.bazel file.

WORKSPACE

@@ -13,6 +13,11 @@ deps_gen()
 
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive", "http_file")
+load("@rules_shell//shell:repositories.bzl", "rules_shell_dependencies", "rules_shell_toolchains")
+
+rules_shell_dependencies()
+
+rules_shell_toolchains()
 
 NODE_VERSION = "22.11.0"
 
@@ -161,10 +166,10 @@ bind(
 # OK, now we can bring in tcmalloc itself.
 http_archive(
     name = "com_google_tcmalloc",
-    sha256 = "81f285cb337f445276f37c308cb90120f8ba4311d1be9daf3b93dccf4bfdba7d",
-    strip_prefix = "google-tcmalloc-69c409c",
+    integrity = "sha256-8joG3SxfLYqR2liUznBAcMkHKYMmUtsO1qGr505VBMY=",
+    strip_prefix = "google-tcmalloc-91765c1",
     type = "tgz",
-    url = "https://github.com/google/tcmalloc/tarball/69c409c344bdf894fc7aab83e2d9e280b009b2f3",
+    url = "https://github.com/google/tcmalloc/tarball/91765c11461a01579fcbdddf430a556b818818c4",
 )
 
 # ========================================================================================
@@ -191,7 +196,7 @@ rust_register_toolchains(
         # Add support for macOS rosetta
         "aarch64-unknown-linux-gnu",
     ],
-    versions = ["1.82.0"],  # LLVM 19
+    versions = ["1.83.0"],  # LLVM 19
 )
 
 load("@rules_rust//crate_universe:repositories.bzl", "crate_universe_dependencies")
@@ -277,6 +282,8 @@ esbuild_register_toolchains(
 #
 # There is an official mirror for V8 itself on GitHub, but not for dependencies like zlib (Chromium
 # fork), icu (Chromium fork), and trace_event, so we still have to use git for them.
+# TODO: Upstream 0021-bazel-Add-missing-imports-needed-with-Bazel-8.patch (currently unused here) to
+# avoid needing to autoload py_test.
 
 http_archive(
     name = "v8",

build/deps/build_deps.jsonc

@@ -116,11 +116,7 @@
       "type": "github_release",
       "owner": "aspect-build",
       "repo": "rules_js",
-      "file_regex": "^rules_js-",
-      // TODO(cleanup): On latest version, Windows build fails with `tar.exe: Error opening archive:
-      // Can't initialize filter; unable to run program "gzip -d"`, likely due to
-      // https://github.com/aspect-build/rules_js/pull/1905/files. Develop a workaround.
-      "freeze_version": "v2.0.1"
+      "file_regex": "^rules_js-"
     },
     {
       "name": "aspect_rules_ts",
@@ -129,6 +125,20 @@
       "repo": "rules_ts",
       "file_regex": "^rules_ts-"
     },
+    {
+      "name": "rules_shell",
+      "type": "github_release",
+      "owner": "bazelbuild",
+      "repo": "rules_shell",
+      "file_regex": "^rules_shell-"
+    },
+    {
+      "name": "rules_cc",
+      "type": "github_release",
+      "owner": "bazelbuild",
+      "repo": "rules_cc",
+      "file_regex": "^rules_cc-"
+    },
     //buildifier
     {
       "name": "buildifier-linux-amd64",

build/deps/gen/build_deps.bzl

@@ -23,10 +23,12 @@ load("@//build/deps:gen/dep_cxxbridge_cmd.bzl", "dep_cxxbridge_cmd")
 load("@//build/deps:gen/dep_ruff_darwin_arm64.bzl", "dep_ruff_darwin_arm64")
 load("@//build/deps:gen/dep_ruff_linux_amd64.bzl", "dep_ruff_linux_amd64")
 load("@//build/deps:gen/dep_ruff_linux_arm64.bzl", "dep_ruff_linux_arm64")
+load("@//build/deps:gen/dep_rules_cc.bzl", "dep_rules_cc")
 load("@//build/deps:gen/dep_rules_nodejs.bzl", "dep_rules_nodejs")
 load("@//build/deps:gen/dep_rules_pkg.bzl", "dep_rules_pkg")
 load("@//build/deps:gen/dep_rules_python.bzl", "dep_rules_python")
 load("@//build/deps:gen/dep_rules_rust.bzl", "dep_rules_rust")
+load("@//build/deps:gen/dep_rules_shell.bzl", "dep_rules_shell")
 load("@//build/deps:gen/dep_wpt.bzl", "dep_wpt")
 
 def deps_gen():
@@ -46,6 +48,8 @@ def deps_gen():
     dep_aspect_bazel_lib()
     dep_aspect_rules_js()
     dep_aspect_rules_ts()
+    dep_rules_shell()
+    dep_rules_cc()
     dep_buildifier_linux_amd64()
     dep_buildifier_linux_arm64()
     dep_buildifier_darwin_amd64()

build/deps/gen/dep_aspect_bazel_lib.bzl

@@ -2,10 +2,10 @@
 
 load("@//:build/http.bzl", "http_archive")
 
-TAG_NAME = "v2.9.4"
-URL = "https://github.com/bazel-contrib/bazel-lib/releases/download/v2.9.4/bazel-lib-v2.9.4.tar.gz"
-STRIP_PREFIX = "bazel-lib-2.9.4"
-SHA256 = "349aabd3c2b96caeda6181eb0ae1f14f2a1d9f3cd3c8b05d57f709ceb12e9fb3"
+TAG_NAME = "v2.11.0"
+URL = "https://github.com/bazel-contrib/bazel-lib/releases/download/v2.11.0/bazel-lib-v2.11.0.tar.gz"
+STRIP_PREFIX = "bazel-lib-2.11.0"
+SHA256 = "c96db69dd2714a37f3298338a1a42b27e3a2696c3b36dd4441b9bf7a1a12bee0"
 TYPE = "tgz"
 
 def dep_aspect_bazel_lib():

build/deps/gen/dep_aspect_rules_js.bzl

@@ -2,10 +2,10 @@
 
 load("@//:build/http.bzl", "http_archive")
 
-TAG_NAME = "v2.0.1"
-URL = "https://github.com/aspect-build/rules_js/releases/download/v2.0.1/rules_js-v2.0.1.tar.gz"
-STRIP_PREFIX = "rules_js-2.0.1"
-SHA256 = "4cab6898f0ff8048e32640cce06a47aa4b92b2fb330d055940f95f24c8ebb868"
+TAG_NAME = "v2.1.2"
+URL = "https://github.com/aspect-build/rules_js/releases/download/v2.1.2/rules_js-v2.1.2.tar.gz"
+STRIP_PREFIX = "rules_js-2.1.2"
+SHA256 = "fbc34d815a0cc52183a1a26732fc0329e26774a51abbe0f26fc9fd2dab6133b4"
 TYPE = "tgz"
 
 def dep_aspect_rules_js():

build/deps/gen/dep_aspect_rules_ts.bzl

@@ -2,10 +2,10 @@
 
 load("@//:build/http.bzl", "http_archive")
 
-TAG_NAME = "v3.3.2"
-URL = "https://github.com/aspect-build/rules_ts/releases/download/v3.3.2/rules_ts-v3.3.2.tar.gz"
-STRIP_PREFIX = "rules_ts-3.3.2"
-SHA256 = "cff3137b043ff6bf1a2542fd9691dc762432370cd39eb4bb0756d288de52067d"
+TAG_NAME = "v3.4.0"
+URL = "https://github.com/aspect-build/rules_ts/releases/download/v3.4.0/rules_ts-v3.4.0.tar.gz"
+STRIP_PREFIX = "rules_ts-3.4.0"
+SHA256 = "013a10b2b457add73b081780e604778eb50a141709f9194298f97761acdcc169"
 TYPE = "tgz"
 
 def dep_aspect_rules_ts():

build/deps/gen/dep_buildifier_darwin_amd64.bzl

@@ -2,9 +2,9 @@
 
 load("@//:build/http.bzl", "http_file")
 
-TAG_NAME = "v7.3.1"
-URL = "https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildifier-darwin-amd64"
-SHA256 = "375f823103d01620aaec20a0c29c6cbca99f4fd0725ae30b93655c6704f44d71"
+TAG_NAME = "v8.0.1"
+URL = "https://github.com/bazelbuild/buildtools/releases/download/v8.0.1/buildifier-darwin-amd64"
+SHA256 = "802b013211dbcf91e3c0658ba33ecb3932ef5a6f6764a0b13efcec4e2df04c83"
 
 def dep_buildifier_darwin_amd64():
     http_file(

build/deps/gen/dep_buildifier_darwin_arm64.bzl

@@ -2,9 +2,9 @@
 
 load("@//:build/http.bzl", "http_file")
 
-TAG_NAME = "v7.3.1"
-URL = "https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildifier-darwin-arm64"
-SHA256 = "5a6afc6ac7a09f5455ba0b89bd99d5ae23b4174dc5dc9d6c0ed5ce8caac3f813"
+TAG_NAME = "v8.0.1"
+URL = "https://github.com/bazelbuild/buildtools/releases/download/v8.0.1/buildifier-darwin-arm64"
+SHA256 = "833e2afc331b9ad8f6b038ad3d69ceeaf97651900bf2a3a45f54f42cafe0bfd3"
 
 def dep_buildifier_darwin_arm64():
     http_file(

build/deps/gen/dep_buildifier_linux_amd64.bzl

@@ -2,9 +2,9 @@
 
 load("@//:build/http.bzl", "http_file")
 
-TAG_NAME = "v7.3.1"
-URL = "https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildifier-linux-amd64"
-SHA256 = "5474cc5128a74e806783d54081f581662c4be8ae65022f557e9281ed5dc88009"
+TAG_NAME = "v8.0.1"
+URL = "https://github.com/bazelbuild/buildtools/releases/download/v8.0.1/buildifier-linux-amd64"
+SHA256 = "1976053ed4decd6dd93170885b4387eddc76ec70dc2697b2e91a9af83269418a"
 
 def dep_buildifier_linux_amd64():
     http_file(

build/deps/gen/dep_buildifier_linux_arm64.bzl

@@ -2,9 +2,9 @@
 
 load("@//:build/http.bzl", "http_file")
 
-TAG_NAME = "v7.3.1"
-URL = "https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildifier-linux-arm64"
-SHA256 = "0bf86c4bfffaf4f08eed77bde5b2082e4ae5039a11e2e8b03984c173c34a561c"
+TAG_NAME = "v8.0.1"
+URL = "https://github.com/bazelbuild/buildtools/releases/download/v8.0.1/buildifier-linux-arm64"
+SHA256 = "93078c57763493bdc2914ed340544500b8f3497341a62e90f00e9e184c4d9c2c"
 
 def dep_buildifier_linux_arm64():
     http_file(

build/deps/gen/dep_buildifier_windows_amd64.bzl

@@ -2,9 +2,9 @@
 
 load("@//:build/http.bzl", "http_file")
 
-TAG_NAME = "v7.3.1"
-URL = "https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildifier-windows-amd64.exe"
-SHA256 = "370cd576075ad29930a82f5de132f1a1de4084c784a82514bd4da80c85acf4a8"
+TAG_NAME = "v8.0.1"
+URL = "https://github.com/bazelbuild/buildtools/releases/download/v8.0.1/buildifier-windows-amd64.exe"
+SHA256 = "6edc9247e6d42d27fb67b9509bb795d159a12468faa89e9f290dcadc26571c31"
 
 def dep_buildifier_windows_amd64():
     http_file(

build/deps/gen/dep_capnp_cpp.bzl

@@ -2,11 +2,11 @@
 
 load("@//:build/http.bzl", "http_archive")
 
-URL = "https://github.com/capnproto/capnproto/tarball/1c676b2df7f97220607591a38c28ce7e4a968ad4"
-STRIP_PREFIX = "capnproto-capnproto-1c676b2/c++"
-SHA256 = "9281b860a778c9427c55be647d1247d9f8373ab9023e671505881bf2172eba04"
+URL = "https://github.com/capnproto/capnproto/tarball/f600d249496c55289fa07fd6a21cadeeb340edb9"
+STRIP_PREFIX = "capnproto-capnproto-f600d24/c++"
+SHA256 = "1d96cd31ad93eaf8194ba51d4a009a4f08332ad643740c4b49c081a515a27a60"
 TYPE = "tgz"
-COMMIT = "1c676b2df7f97220607591a38c28ce7e4a968ad4"
+COMMIT = "f600d249496c55289fa07fd6a21cadeeb340edb9"
 
 def dep_capnp_cpp():
     http_archive(

build/deps/gen/dep_cargo_bazel_linux_arm64.bzl

@@ -2,9 +2,9 @@
 
 load("@//:build/http.bzl", "http_file")
 
-TAG_NAME = "0.54.1"
-URL = "https://github.com/bazelbuild/rules_rust/releases/download/0.54.1/cargo-bazel-aarch64-unknown-linux-gnu"
-SHA256 = "3792feb084bd43b9a7a9cd75be86ee9910b46db59360d6b29c9cca2f8889a0aa"
+TAG_NAME = "0.56.0"
+URL = "https://github.com/bazelbuild/rules_rust/releases/download/0.56.0/cargo-bazel-aarch64-unknown-linux-gnu"
+SHA256 = "f3a35b137221d4627ba0ed62f775c4d3cbb45b6db839ae47f2ebfd48abe44a91"
 
 def dep_cargo_bazel_linux_arm64():
     http_file(

build/deps/gen/dep_cargo_bazel_linux_x64.bzl

@@ -2,9 +2,9 @@
 
 load("@//:build/http.bzl", "http_file")
 
-TAG_NAME = "0.54.1"
-URL = "https://github.com/bazelbuild/rules_rust/releases/download/0.54.1/cargo-bazel-x86_64-unknown-linux-gnu"
-SHA256 = "2b9d07f34694f63f0cc704989ad6ec148ff8d126579832f4f4d88edea75875b2"
+TAG_NAME = "0.56.0"
+URL = "https://github.com/bazelbuild/rules_rust/releases/download/0.56.0/cargo-bazel-x86_64-unknown-linux-gnu"
+SHA256 = "53418ae5457040e84009f7c69b070e1f12f10a9a3a3ef4f5d0829c66e5438ba1"
 
 def dep_cargo_bazel_linux_x64():
     http_file(

build/deps/gen/dep_cargo_bazel_macos_arm64.bzl

@@ -2,9 +2,9 @@
 
 load("@//:build/http.bzl", "http_file")
 
-TAG_NAME = "0.54.1"
-URL = "https://github.com/bazelbuild/rules_rust/releases/download/0.54.1/cargo-bazel-aarch64-apple-darwin"
-SHA256 = "8204746334a17823bd6a54ce2c3821b0bdca96576700d568e2ca2bd8224dc0ea"
+TAG_NAME = "0.56.0"
+URL = "https://github.com/bazelbuild/rules_rust/releases/download/0.56.0/cargo-bazel-aarch64-apple-darwin"
+SHA256 = "5143e347ec45e0fcc249f1de44f0dce227062579ad364a0b269b39f0ce49f1d8"
 
 def dep_cargo_bazel_macos_arm64():
     http_file(

build/deps/gen/dep_cargo_bazel_macos_x64.bzl

@@ -2,9 +2,9 @@
 
 load("@//:build/http.bzl", "http_file")
 
-TAG_NAME = "0.54.1"
-URL = "https://github.com/bazelbuild/rules_rust/releases/download/0.54.1/cargo-bazel-x86_64-apple-darwin"
-SHA256 = "2ee14b230d32c05415852b7a388b76e700c87c506459e5b31ced19d6c131b6d0"
+TAG_NAME = "0.56.0"
+URL = "https://github.com/bazelbuild/rules_rust/releases/download/0.56.0/cargo-bazel-x86_64-apple-darwin"
+SHA256 = "9e8a92674771982f68031d0cc516ba08b34dd736c4f818d51349547f2136d012"
 
 def dep_cargo_bazel_macos_x64():
     http_file(

build/deps/gen/dep_cargo_bazel_win_x64.bzl

@@ -2,9 +2,9 @@
 
 load("@//:build/http.bzl", "http_file")
 
-TAG_NAME = "0.54.1"
-URL = "https://github.com/bazelbuild/rules_rust/releases/download/0.54.1/cargo-bazel-x86_64-pc-windows-msvc.exe"
-SHA256 = "609e894dc52576407afd5edf3b293eab2774e4fffc25ae212ab138556ff7306d"
+TAG_NAME = "0.56.0"
+URL = "https://github.com/bazelbuild/rules_rust/releases/download/0.56.0/cargo-bazel-x86_64-pc-windows-msvc.exe"
+SHA256 = "5c62a1c42b71af6c2765dc5f9518eba22ed28276a65f7accf5a2bca0c5cfaf74"
 
 def dep_cargo_bazel_win_x64():
     http_file(

build/deps/gen/dep_com_google_protobuf.bzl

@@ -2,10 +2,10 @@
 
 load("@//:build/http.bzl", "http_archive")
 
-TAG_NAME = "v28.3"
-URL = "https://github.com/protocolbuffers/protobuf/releases/download/v28.3/protobuf-28.3.tar.gz"
-STRIP_PREFIX = "protobuf-28.3"
-SHA256 = "7c3ebd7aaedd86fa5dc479a0fda803f602caaf78d8aff7ce83b89e1b8ae7442a"
+TAG_NAME = "v29.3"
+URL = "https://github.com/protocolbuffers/protobuf/releases/download/v29.3/protobuf-29.3.tar.gz"
+STRIP_PREFIX = "protobuf-29.3"
+SHA256 = "008a11cc56f9b96679b4c285fd05f46d317d685be3ab524b2a310be0fbad987e"
 TYPE = "tgz"
 
 def dep_com_google_protobuf():

build/deps/gen/dep_cxxbridge_cmd.bzl

@@ -2,11 +2,11 @@
 
 load("@//:build/http.bzl", "http_archive")
 
-URL = "https://crates.io/api/v1/crates/cxxbridge-cmd/1.0.131/download"
-STRIP_PREFIX = "cxxbridge-cmd-1.0.131"
-SHA256 = "5b12e3f7b0477bd2e469107b778d333171cae561a555e96157e67bbd9f42e54f"
+URL = "https://crates.io/api/v1/crates/cxxbridge-cmd/1.0.136/download"
+STRIP_PREFIX = "cxxbridge-cmd-1.0.136"
+SHA256 = "6c33fd49f5d956a1b7ee5f7a9768d58580c6752838d92e39d0d56439efdedc35"
 TYPE = "tgz"
-VERSION = "1.0.131"
+VERSION = "1.0.136"
 
 def dep_cxxbridge_cmd():
     http_archive(