Prepare release v2.3.0

CHANGELOG.md

@@ -29,6 +29,82 @@ Unreleased changes are tracked as individual files in the [news/](./news)
 directory, or view the [latest generated
 changelog](https://rules-python.readthedocs.io/en/latest/changelog.html).
 
+{#v2-3-0}
+## [2.3.0] - 2026-08-07
+
+[2.3.0]: https://github.com/bazel-contrib/rules_python/releases/tag/2.3.0
+
+{#v2-3-0-changed}
+### Changed
+* (gazelle) **BREAKING** rules_python 1.5.0 or higher is now required. The Python
+  extension selects its standard library list on `is_python_3.14`, which earlier
+  versions do not define.
+
+{#v2-3-0-fixed}
+### Fixed
+* Fixed `py_binary_rule_builder()` / `py_test_rule_builder()` (from `python/api/executables.bzl`)
+  failing at analysis time with a visibility error when used to construct a custom rule from an
+  external module.
+* (compile_pip_requirements) Add the explicit `data` attribute and forward it
+  directly to the generated `py_binary`, so files passed via `data` can be
+  referenced from `extra_args` using `$(location ...)`.
+* (coverage) The warning about a missing bundled `coverage.py` wheel is no longer
+  emitted as we are now falling back to a pure python wheel
+  ([#3950](https://github.com/bazel-contrib/rules_python/issues/3950)).
+* (gazelle) The Python extension now uses the correct standard library module list for
+  `python_version` 3.13 and 3.14; previously both fell back to the 3.11 list, so modules
+  added or removed since then (e.g. `compression.zstd`, `telnetlib`) were misclassified. The
+  fallback list for unrecognized versions is now the newest available one rather than 3.11
+  ([#3978](https://github.com/bazel-contrib/rules_python/pull/3978)).
+* (pypi) Allow `uv_lock` to be specified in `pip.parse` without requiring
+  `requirements_lock` (or other os-specific requirement file attributes) to be
+  set.
+* (pypi) Requirement `--hash=<algo>:<digest>` pins and Simple API
+  `#<algo>=<digest>` URL fragments are now parsed for all hash algorithms
+  instead of silently dropping everything except `sha256`. Non-sha256 pins are
+  matched against the digests advertised by the index and downloads are verified
+  using the corresponding Subresource Integrity value, and the pins are kept in
+  the requirement line when falling back to `pip`
+  ([#3972](https://github.com/bazel-contrib/rules_python/issues/3972)).
+  As part of this, `whl_library` repos created by `pip.parse` now always pass
+  the digest via the `integrity` attribute (SRI format) instead of `sha256`,
+  and the lock file facts store digests as `<algo>:<digest>` values (the facts
+  version was bumped, so cached index information is refreshed once).
+* (pypi) `pip.parse(uv_lock = ...)` no longer exposes uv workspace/root members
+  that resolve to no wheel or sdist (e.g. `source = { virtual = "." }` or editable
+  installs). Previously these source-less packages were added to the hub's
+  `all_requirements` / `all_whl_requirements` with an alias to a subpackage that
+  does not exist, breaking analysis for anything enumerating the full set such as
+  `modules_mapping(wheels = all_whl_requirements)`
+  ([#3934](https://github.com/bazel-contrib/rules_python/issues/3934)).
+* (pypi) correctly parse the `index_url` for each wheel so that the source registry is forwarded to
+  the {obj}`whl_library`. This is so that the `purl` for `package_metadata` can be correctly
+  constructed.
+* (pypi) fixed the URL normalization function to correctly handle local paths
+  enabling wheel sources files to point to an absolute path. Currently it supports
+  the `file://<absolute_path>` for linux and windows like paths. We also support
+  envsubst for the said paths from now on.
+
+{#v2-3-0-added}
+### Added
+* (bzlmod) Added MODULE.bazel flag aliases for Starlark-defined flags:
+  `build_python_zip`, `incompatible_default_to_explicit_init_py`,
+  `python_path`, and `experimental_python_import_all_repositories`.
+* (cc) Added experimental {obj}`py_extension` macro for creating C/C++ Python
+  extension modules
+  ([#3283](https://github.com/bazel-contrib/rules_python/issues/3283)).
+  (cc) Added `libc`, `platform_machine`, `platform_tag`, `soabi`, and
+  `sys_platform` attributes and info fields to {obj}`py_cc_toolchain` /
+  {obj}`PyCcToolchainInfo`.
+* (pip,python) Added `pyproject_toml` attribute to {obj}`pip.default`, {obj}`pip.parse` and {obj}`python.defaults` to read the default Python version from the `requires-python` field of `pyproject.toml`.
+* (py_test) Added an opt-in safeguard against `py_test` targets that silently
+  pass without running any tests. Set
+  {obj}`--@rules_python//python/config_settings:validate_test_main=enabled` to
+  fail the build when a test's main module only contains inert top-level
+  statements (definitions, imports, assignments) and never invokes a test
+  runner ([#3824](https://github.com/bazel-contrib/rules_python/issues/3824)).
+
+
 {#v2-2-0}
 ## [2.2.0] - 2026-06-30
 

docs/api/rules_python/python/config_settings/index.md

@@ -276,7 +276,7 @@ Enabling this requires the exec tools toolchain (with an exec interpreter) to
 be registered, which is the case for the default hermetic toolchains.
 :::
 
-:::{versionadded} VERSION_NEXT_FEATURE
+:::{versionadded} 2.3.0
 :::
 ::::
 

python/cc/py_extension.bzl

@@ -11,7 +11,7 @@ for information on writing C extension modules.
 :::{include} /_includes/experimental_api.md
 :::
 
-:::{versionadded} VERSION_NEXT_FEATURE
+:::{versionadded} 2.3.0
 :::
 """
 

python/private/cc/py_extension_macro.bzl

@@ -50,7 +50,7 @@ def py_extension(
     - `module_name`: Pass `module_name = "custom_name"` to override the base
       module filename.
 
-    :::{versionadded} VERSION_NEXT_FEATURE
+    :::{versionadded} 2.3.0
     :::
 
     Args:

python/private/py_cc_toolchain_info.bzl

@@ -22,7 +22,7 @@ PyCcToolchainInfo = provider(
 
 The runtime's ABI flags, i.e. `sys.abiflags` (e.g. 't' for free-threaded builds).
 
-:::{versionadded} VERSION_NEXT_FEATURE
+:::{versionadded} 2.3.0
 :::
 """,
         "headers": """\
@@ -106,7 +106,7 @@ If available, information about C libraries, struct with fields:
 The {pep}`PEP 508` `platform_machine` marker
 value for the target architecture, e.g. 'x86_64', 'aarch64'.
 
-:::{versionadded} VERSION_NEXT_FEATURE
+:::{versionadded} 2.3.0
 :::
 """,
         "platform_tag": """\
@@ -115,7 +115,7 @@ value for the target architecture, e.g. 'x86_64', 'aarch64'.
 The PEP 3149 / PEP 425 platform tag for extension modules, e.g.
 'x86_64-linux-gnu', 'darwin', or 'win_amd64'.
 
-:::{versionadded} VERSION_NEXT_FEATURE
+:::{versionadded} 2.3.0
 :::
 """,
         "python_version": """
@@ -130,7 +130,7 @@ The SOABI tag for extension modules (see
 [PEP 3149](https://peps.python.org/pep-3149/)), e.g.
 'cpython-311-x86_64-linux-gnu' or 'cp311'.
 
-:::{versionadded} VERSION_NEXT_FEATURE
+:::{versionadded} 2.3.0
 :::
 """,
         "sys_platform": """

python/private/py_cc_toolchain_rule.bzl

@@ -143,7 +143,7 @@ If not set, or set to `<AUTO>`, the ABI flags are automatically derived
 from `--//python/config_settings:py_freethreaded` (e.g., `'t'` when
 free-threaded is enabled, or `''` otherwise).
 
-:::{versionadded} VERSION_NEXT_FEATURE
+:::{versionadded} 2.3.0
 :::
 """,
         ),
@@ -171,7 +171,7 @@ attribute is available or not.
             doc = """\
 Target C library variant, e.g. 'glibc', 'musl'.
 
-:::{versionadded} VERSION_NEXT_FEATURE
+:::{versionadded} 2.3.0
 :::
 """,
             default = "",
@@ -185,7 +185,7 @@ Target C library variant, e.g. 'glibc', 'musl'.
             doc = """
 Target architecture as a PEP 508 `platform_machine` marker, e.g. 'x86_64', 'aarch64', 'x86_32'.
 
-:::{versionadded} VERSION_NEXT_FEATURE
+:::{versionadded} 2.3.0
 :::
 """,
             default = "",
@@ -199,7 +199,7 @@ Target architecture as a PEP 508 `platform_machine` marker, e.g. 'x86_64', 'aarc
 The SOABI tag for extension modules (see PEP 3149), e.g.
 'cpython-311-x86_64-linux-gnu' or 'cp311'.
 
-:::{versionadded} VERSION_NEXT_FEATURE
+:::{versionadded} 2.3.0
 :::
 """,
             default = "",

python/private/pypi/extension.bzl

@@ -751,7 +751,7 @@ The version must be specified as `==X.Y.Z` (exact version with full semver).
 This is designed to work with dependency management tools like Renovate.
 :::
 
-:::{versionadded} VERSION_NEXT_FEATURE
+:::{versionadded} 2.3.0
 :::
 """,
     ),
@@ -934,7 +934,7 @@ for this `pip.parse()` call, unless `python_version` is set explicitly.
 The version must be specified as `==X.Y.Z` (exact version with full semver).
 :::
 
-:::{versionadded} VERSION_NEXT_FEATURE
+:::{versionadded} 2.3.0
 :::
 """,
         ),
@@ -952,7 +952,7 @@ a corresponding `python.toolchain()` configured.
 The {obj}`pyproject_toml` attribute for getting the version from a project file.
 :::
 
-:::{versionchanged} VERSION_NEXT_FEATURE
+:::{versionchanged} 2.3.0
 No longer mandatory if the {obj}`pyproject_toml` attribute or
 {obj}`pip.default.pyproject_toml` is specified.
 :::

python/private/pypi/whl_library.bzl

@@ -587,7 +587,7 @@ The expected checksum of the downloaded whl in Subresource Integrity format
 (e.g. `sha256-...` or `sha512-...`). Only used when `urls` is passed. If
 `sha256` is also set, it takes precedence over this attribute.
 
-:::{versionadded} VERSION_NEXT_FEATURE
+:::{versionadded} 2.3.0
 :::
 """,
     ),
@@ -673,7 +673,7 @@ The `whl_library` is marked as reproducible if using starlark to extract and par
 wheel contents without building an `sdist` first.
 :::
 
-:::{versionchanged} VERSION_NEXT_FEATURE
+:::{versionchanged} 2.3.0
 The whl-only pure Starlark operations have been refactored into {obj}`whl_archive` and the
 previously named {obj}`whl_library` repository became renamed to `pip_archive`.
 :::

python/private/python.bzl

@@ -1117,7 +1117,7 @@ Label pointing to pyproject.toml file to read the default Python version from.
 When specified, reads the `requires-python` field from pyproject.toml.
 The version must be specified as `==X.Y.Z` (exact version with full semver).
 
-:::{versionadded} VERSION_NEXT_FEATURE
+:::{versionadded} 2.3.0
 :::
 """,
         ),