Performance degradation and warning messages after upgrading to rules_python 2.0.0 (was fine in 1.9.0)

[brianantony456]

🐞 bug report

Affected Rule

The issue is caused by the rule:

Likely related to pip_deps/pip extension handling in rules_python.

Is this a regression?

Yes, the previous version in which this bug was not present was: 1.9.0

Description

After upgrading from rules_python 1.9.0 to 2.0.0, every shutdown and build results in multiple warnings about the requirements file being generated without hashes (see below). In addition, there is a recurring performance regression observed. With 1.9.0, the build completes in about 10 seconds, but with 2.0.0 it takes about 5 seconds longer (~15s). These warnings and performance issues occur on every shutdown/build.

Warning log:

rules_python:pypi:hub:pip_deps WARNING: requirement file has been generated without hashes, will use all hashes for the given version  that could find on the index:
    []
INFO: Analyzed 4 targets (101 packages loaded, 4766 targets configured).
INFO: Found 4 targets...
INFO: Elapsed time: 14.471s, Critical Path: 0.34s
INFO: 31 processes: 28 internal, 1 linux-sandbox, 2 local.
INFO: Build completed successfully, 31 total actions

long running task 
# Fetching module extension @@rules_python+//python/extensions:pip.bzl%pip; Fetch package lists from PyPI index 5s

With rules_python 1.9.0 it takes ~5s less and no warnings.

Commands to reproduce:

sudo rm -rf $(dirname $(bazelisk info output_base)); bazelisk clean --expunge; bazelisk shutdown; time bazelisk build :all --disk_cache= --remote_cache=

Tested on

• RHEL 9 (x86_64)
• Fedora Workstation latest (x86_64)

🔬 Minimal Reproduction

Sample minimal project:

# python-test/.bazelversion
+8.3.1
# python-test/BUILD.bazel
+load("@rules_python//python:defs.bzl", "py_binary")
+load("@rules_python//python:pip.bzl", "compile_pip_requirements")
+
+compile_pip_requirements(
+    name = "requirements",
+    requirements_in = "requirements.in",
+    requirements_txt = "requirements_lock.txt",
+)
+
+py_binary(
+    name = "main",
+    srcs = ["main.py"],
+    deps = ["@pypi//certifi"],
+)
# python-test/MODULE.bazel
+module(
+    name = "example",
+    version = "0.0.1",
+)
+
+bazel_dep(name = "rules_python", version = "1.9.0")
+
+python = use_extension("@rules_python//python/extensions:python.bzl", "python")
+python.toolchain(python_version = "3.11.9")
+
+pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
+pip.parse(
+    hub_name = "pypi",
+    python_version = "3.11.9",
+    requirements_lock = "//:requirements_lock.txt",
+)
+use_repo(pip, "pypi")
# python-test/main.py
+print("Hello world!")
# python-test/requirements.in
+certifi
# python-test/requirements_lock.txt
+#
+# This file is autogenerated by pip-compile with Python 3.11
+# by the following command:
+#
+#    bazel run //:requirements.update
+#
+certifi==2026.4.22 \
+    --hash=sha256:3cb2210c8f88ba2318d29b0388d1023c8492ff72ecdde4ebdaddbb13a31b1c4a \
+    --hash=sha256:8d455352a37b71bf76a79caa83a3d6c25afee4a385d632127b6afb3963f1c580
+    # via -r requirements.in

🔥 Exception or Error

See warning output above.

🌍 Your Environment

Operating System:

  
RHEL 9 (x86_64)
Fedora Workstation latest (x86_64)
  

Output of bazel version:

  
Bazelisk 8.3.1
  

Rules_python version:

  
1.9.0 (works fine)
2.0.0 (shows warnings and is slower)
  

Anything else relevant?

Regression appears with rules_python 2.0.0 and is not present in 1.9.0; please investigate the hash-handling regression and performance difference.

---

[rickeylev]

@brianantony456 Just to verify the repro diff that was posted: The diff shows requirements.in as a resolved lock file with hashes. It doesn't show the content of requirements_lock.txt. Is this just a typo in the diff reported in your post?

edit: oh I think I see now. Yeah, that looks like a typo. Just an extra + # on the line that is supposed to be naming the requirements_lock.txt file

[rickeylev]

@aignas tldr: requirements_lock.txt with hashes is being given, but a warning about it not containing hashes is being reported. I don't see anything obviously wrong with the file. Only other thing that caught my eye was Bazel 8.3 being used