2.5.0-rc0

For more detailed setup instructions, see https://rules-python.readthedocs.io/en/latest/getting-started.html

For the user-facing changelog see here

Using Bzlmod

Add to your MODULE.bazel file:

bazel_dep(name = "rules_python", version = "2.5.0-rc0")

python = use_extension("@rules_python//python/extensions:python.bzl", "python")
python.toolchain(
    python_version = "3.14",
)

pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
pip.parse(
    hub_name = "pypi",
    python_version = "3.14",
    requirements_lock = "//:requirements_lock.txt",
)

use_repo(pip, "pypi")

Using WORKSPACE

Paste this snippet into your WORKSPACE file:

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "rules_python",
    sha256 = "2bf5f5ff0be99bf9f6e02ab4086848a181c9093a09e04719ab80bc27a59d7645",
    strip_prefix = "rules_python-2.5.0-rc0",
    url = "https://github.com/bazel-contrib/rules_python/releases/download/2.5.0-rc0/rules_python-2.5.0-rc0.tar.gz",
)

load("@rules_python//python:repositories.bzl", "py_repositories")

py_repositories()

Gazelle plugin

Paste this snippet into your WORKSPACE file:

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
http_archive(
    name = "rules_python_gazelle_plugin",
    sha256 = "2bf5f5ff0be99bf9f6e02ab4086848a181c9093a09e04719ab80bc27a59d7645",
    strip_prefix = "rules_python-2.5.0-rc0/gazelle",
    url = "https://github.com/bazel-contrib/rules_python/releases/download/2.5.0-rc0/rules_python-2.5.0-rc0.tar.gz",
)

# To compile the rules_python gazelle extension from source,
# we must fetch some third-party go dependencies that it uses.

load("@rules_python_gazelle_plugin//:deps.bzl", _py_gazelle_deps = "gazelle_deps")

_py_gazelle_deps()

What's Changed

• chore(release): add release-prepared label to prepare PRs by @rickeylev in #4015
• refactor(tests): convert legacy py_extension in local_toolchains to official rule by @rickeylev in #3988
• chore(release): support manual dispatch and /prepare-complete for complete prepare workflow by @rickeylev in #4016
• chore(release): invoke create release branch from prepare complete and support /create-release-branch by @rickeylev in #4017
• agents: optimize rules and clarify create-pr subagent requirements by @rickeylev in #4018
• agents: document Windows machine normalization and SOABI support by @rickeylev in #4019
• build(deps): bump cryptography from 49.0.0 to 50.0.0 in /tools/publish by @dependabot[bot] in #3995
• agents: add merge queue CI monitoring and lockfile sync rules by @rickeylev in #4021
• agents(rules): document linking external objects in TypedDict docstrings by @rickeylev in #4022
• agents: rename pre-review-audit to review-code and add news file checks by @rickeylev in #4027
• feat(runfiles): add CreateOrRaise API by @rickeylev in #4028
• build(dev): bump dev requirements python version to 3.10 by @rickeylev in #4024
• agents(rules): document git push -u guardrail and delegating function docstrings by @rickeylev in #4030
• agents: document dev python version bump and merge queue fields by @rickeylev in #4031
• build(deps): bump packaging from 26.2 to 26.3 in /tools/publish by @dependabot[bot] in #4032
• build(deps): bump cffi from 2.1.0 to 2.1.1 in /tools/publish by @dependabot[bot] in #4033
• build(pyrefly): enable Pyrefly static type checking across Python targets by @rickeylev in #4020
• fix: preserve arguments with spaces by @stanbot8 in #4026
• agents(rules): update python rules with typing and runfiles conventions by @rickeylev in #4035
• feat(bzlmod): make init.py generation configurable module-wide by @armandomontanez in #3997
• build(ci): remove legacy mypy type checking workflow and comments by @rickeylev in #4036
• agents(analyze-ci-failure): enhance network reset and macOS sandbox flake detection by @rickeylev in #4037
• fix(pypi): rewrite RECORD file entries for extracted .data contents by @rickeylev in #4025
• fix(pypi): resolve self-referencing extras to a real fixed point by @muravev-vasilii in #4039
• agents(rules): add Starlark dict union and Pyrefly PackagePath conventions by @rickeylev in #4038
• fix(pypi): do not return rctx.metadata for pip_archive by @aignas in #4043
• refactor(release): move on_comment workflow logic into Python script by @rickeylev in #4045
• workflows: auto-create patch release tracking issue on /backport by @rickeylev in #4046
• agents(rules): update github_actions_workflows rule with python script and testing conventions by @rickeylev in #4047
• agents(review-code): export review results artifact and factor report format by @rickeylev in #4048
• workflows(release): support /backport comment on release tracking issue and pr by @rickeylev in #4050
• workflows(release): remove non-patch release tasks from patch release issues by @rickeylev in #4051
• tests: use runfiles.CreateOrRaise in release_test_helper by @rickeylev in #4052
• agents: clarify commit and PR type conventions in pr.md by @rickeylev in #4055
• workflow(release): surface subprocess output and improve error handling in backport operations by @rickeylev in #4056
• agents: add workflow type convention and python exception rules by @rickeylev in #4057
• refactor: split code into multiple files by @aignas in #4044
• chore(release): sync changelog and version markers for 2.3 backports by @rickeylev in #4058
• feat(sphinxdocs): make SphinxDocsLibraryInfo provider public by @JoHoenk in #4041
• agents(starlark): document depset element immutability and provider conventions by @rickeylev in #4060
• build(release): add process-news command with PR and version marker support by @rickeylev in #4062
• agents: refine commit type definitions and interface docstring rules by @rickeylev in #4063
• agents: update review-code skill to initialize and update artifact on responses by @rickeylev in #4066
• test(pytest): support python_versions in pytest_test macro by @rickeylev in #4064
• agents: add native.test_suite API tag invariant rule by @rickeylev in #4068
• build(release): separate sync changelog into standalone workflow and CLI tool by @rickeylev in #4067
• agents: update CI soft-fail handling and GHA event parsing rules by @rickeylev in #4069
• tests(runfiles): migrate runfiles tests to pytest_test by @rickeylev in #4061
• workflows: make on_pr_closed.py executable and add permissions test by @rickeylev in #4076
• build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1 by @dependabot[bot] in #4072
• build(deps): bump actions/setup-python from 5 to 7 by @dependabot[bot] in #4074
• build(deps): bump charset-normalizer from 3.4.9 to 3.5.0 in /tools/publish by @dependabot[bot] in #4073
• build(deps): bump bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml from 1.4.2 to 1.5.0 by @dependabot[bot] in #4075
• agents: document rf.root() path navigation and Runfiles.CreateOrRaise() in python rules by @rickeylev in #4078
• fix(py_test): fix Windows crash in py_test main validation by @rdesgroppes in #4079
• agents: document direct integration test execution in testing rules by @rickeylev in #4080
• workflows: grant pull-requests write to release_process_backports by @rickeylev in #4081
• fix(pypi): drop unsupported args in the whl_library macro by @aignas in #4083
• fix(toolchain): fix crash on Windows when precompiling is enabled by @rdesgroppes in #4082
• fix(pypi): handle revisions in uv.lock Git sources by @henriquejsza in #4086
• fix(windows): use extended paths in Python bootstraps by @belitskiy in #4071
• fix(pypi): support source-less wheels with dependencies by @hartikainen in #4054
• chore: cherry-pick 2.3.2 changelog prep by @aignas in #4090
• agents: document Windows extended path rules and test organization by @rickeylev in #4092
• build(release): remove patch release template and streamline backport workflow by @rickeylev in #4093
• agents: specify docs and build(release) commit types by @rickeylev in #4095
• build: upgrade Python 3.9 usages across dev tools, examples, and tests by @rickeylev in #4094
• chore: remove unused rules in whl_library_targets by @aignas in #4087
• build(deps): bump the pip group across 3 directories with 7 updates by @dependabot[bot] in #4096
• build(deps): bump the pip group across 5 directories with 5 updates by @dependabot[bot] in #4097
• build(deps): bump the uv group across 5 directories with 5 updates by @dependabot[bot] in #4098
• agents: add lockfile and dependency bump rule by @rickeylev in #4103
• refactor(pypi): split whl_library_targets by @aignas in #4101
• chore: migrate requirements.in files to pyproject.toml by @rickeylev in #4099
• fix(runfiles): update Path method signatures for Python 3.14 compatibility and fix match() by @rickeylev in #4100
• build(deps): bump the pip group across 1 directory with 3 updates by @dependabot[bot] in #4102
• agents: add constraint synchronization rule for dependency bumps by @rickeylev in #4107
• agents: document runtime version checks and multi-version pytest_test bzlmod rules by @rickeylev in #4108
• agents: add Windows lockfile migration and Gazelle manifest rules by @rickeylev in #4109
• fix: various fixes for the deps library by @aignas in #4106
• agents: add external PR push guidance, refactor commit type, and fix news frontmatter by @rickeylev in #4112
• feat(pypi): allow defining deps in through pkg_aliases macro by @aignas in #4105
• fix(precompile): skip precompilation for directory and pyc inputs in srcs by @rickeylev in #4113
• agents: add VERSION_NEXT_PATCH docs rule and Strunk & White PR guidelines by @rickeylev in #4116
• fix(pypi): append .bat extension for rewritten shebang scripts in RECORD on Windows by @rickeylev in #4114
• agents: add Windows shebang RECORD rewriting and PR metadata discrepancy rules by @rickeylev in #4118
• feat(gazelle): support generic manifest lockfiles by @anisayakmitra-in in #4117
• feat: Update CPython 3.15.0 from -a8 to -rc1. by @hawkinsp in #4122
• fix(zipapp): guard against null runtime files by @rickeylev in #4119
• fix: generate publish wheels for target platforms by @tomatotomata in #4007
• agents: add sync-git-branch-continuously skill by @rickeylev in #4126
• agents: remove _bzl suffix requirement for bzl_library targets by @rickeylev in #4131
• fix(venv_shebang_rewriter): avoid depending on host coreutils by @nicdumz in #4125
• docs(support): document nix as a tier 2 platform by @rickeylev in #4130
• refactor(config_settings): remove unused private distribution target by @rickeylev in #4129
• fix(gazelle): fix module map for old-style namespaces by @gholms in #4135
• agents: update news and PR conventions by @rickeylev in #4138
• chore: update default Python version to 3.14 by @rickeylev in #4023
• refactor: move tools/private/zipapp to tools/zipapp by @rickeylev in #4127
• build: configure repository cache in .bazelrc by @rickeylev in #4137
• feat(uv): add --directory support for locking by @aignas in #4029
• build(deps): bump pip from 26.1.2 to 26.2 in /examples/wheel in the pip group across 1 directory by @dependabot[bot] in #4136
• build(deps): bump pip from 26.1.2 to 26.2 in /examples/wheel in the uv group across 1 directory by @dependabot[bot] in #4140
• build(tools): remove reviewbot tool and workflow by @rickeylev in #4142
• feat: Add win32 versions by @rsartor-cmd in #4141
• build: move requirements update multirun from //private to //dev by @rickeylev in #4143
• fix(bootstrap): remap stdlib sys.path entries to runfiles during site init by @rickeylev in #4104
• build(dev): remove unused requirements update aliases by @rickeylev in #4144
• build(release): allow process-news to create missing release sections by @rickeylev in #4145
• docs(release): document sync-changelog command in template and guide by @rickeylev in #4148
• chore(release): sync changelog for v2.3.3 backports by @github-actions[bot] in #4147
• agents: add conversation-done skill by @rickeylev in #4150
• build(dev): move internal dev tools from //tools/private to //dev by @rickeylev in #4149
• refactor: introduce helper for defining distribution filegroups by @rickeylev in #4152
• build(dev): move release management tooling from //tools/private to //dev by @rickeylev in #4153
• fix(bzlmod): convert coverage_tool Label to string by @kocolosk in #4157
• refactor(zipapp): implement rust exe_zip_maker program by @rickeylev in #4151
• refactor(toolchains): share Python version config settings by @dzbarsky in #4159
• fix(stamping): skip build data spawn when --stamp=false by @alloveras in #4160
• fix(cc): include toolchain libraries in cc_shared_library by @dzbarsky in #4166
• build(release): fetch PR body in get_pr_info and grant PR read permissions by @rickeylev in #4177
• Prepare release v2.4.0 by @github-actions[bot] in #4176
• docs(changelog): sync v2.3.4 changelog entry for #4156 by @rickeylev in #4174
• build(release): exclude devguide.md from version marker checks by @rickeylev in #4186
• agents: report deleted resources in conversation-done skill by @rickeylev in #4187
• build(release): check VERSION_NEXT_ markers during create-rc by @rickeylev in #4188
• workflow: post comment when comment-triggered workflow fails by @rickeylev in #4189
• fix(zipapp): reduce bundled interpreter size by @gfrankliu in #4165
• fix(pypi): skip a pip.parse version with no interpreter for the host by @zakinko in #4184
• chore(release): sync changelog for v2.4.0 backports by @github-actions[bot] in #4190
• build(deps): bump urllib3 from 2.7.0 to 2.8.0 in /tools/publish by @dependabot[bot] in #4169
• build(deps): bump idna from 3.19 to 3.20 in /tools/publish by @dependabot[bot] in #4170
• fix(uv): Reuse the uv cache in runnable lock targets by @hartikainen in #4180
• agents(starlark): Prefer if/else over multi-line ternaries by @rickeylev in #4193
• fix(uv): Preserve uv wrapper runfiles in lock targets by @hartikainen in #4182
• agents: refine starlark rules and CI merge skills by @rickeylev in #4195
• docs(uv): annotate _RunLockInfo provider field types by @rickeylev in #4191
• feat(toolchains): update CPython 3.15.0 from rc1 to rc2 by @rickeylev in #4199
• chore(release): sync changelog for v2.4.0 backports by @github-actions[bot] in #4200
• feat(pypi): add py.typed files to pyi_srcs by @gholms in #4202
• workflow: allow specific users to trigger backport comment commands by @rickeylev in #4203
• workflow: allow gholms to trigger backport comment commands by @rickeylev in #4206
• chore(release): sync changelog for v2.4.0 backports by @github-actions[bot] in #4212
• fix(zipapp): store _solib shared libraries as files, not absolute symlinks by @gfrankliu in #4211
• fix(pypi): build uv.lock git sources with pip by @thirtyseven in #4209
• build(deps): bump the pip group across 10 directories with 2 updates by @dependabot[bot] in #4204
• build(deps): bump the uv group across 10 directories with 2 updates by @dependabot[bot] in #4205
• feat(toolchains): allow selecting stripped python-build-standalone archives by @gfrankliu in #4192
• agents: refine Starlark, workspace merge, and CI monitor rules by @rickeylev in #4214
• feat(toolchains): update CPython 3.15.0 from rc2 to rc3 by @rickeylev in #4220
• build(release): ignore completed release issues when adding backports by @rickeylev in #4225
• chore(release): sync changelog for v2.4.1 backports by @github-actions[bot] in #4226
• workflows: centralize and optimize setup-bazel configuration by @rickeylev in #4227
• build(deps): bump cryptography from 50.0.1 to 50.0.2 in /tools/publish by @dependabot[bot] in #4221
• build(deps): bump charset-normalizer from 3.5.1 to 3.5.2 in /tools/publish by @dependabot[bot] in #4222
• build(release): ignore completed release issues in more commands by @rickeylev in #4229
• build(release): add jvolkman to BCR maintainers and set github_user_id by @rickeylev in #4230
• feat(pypi): generate requirements.bzl in the unified @pypi hub by @thirtyseven in #4223
• build(deps): bump the pip group across 2 directories with 2 updates by @dependabot[bot] in #4228
• fix(sphinx): recursive dir copy by @oxidase in #4231
• fix: do not include transitive sources from pyi_deps in runtime runfiles by @faximan in #4178
• refactor(zipapp): add dev-only toolchain for the Rust exe_zip_maker by @rickeylev in #4215
• build(release): build prebuilt tools in the release workflow by @rickeylev in #4217
• chore(release): sync changelog for v2.4.2 backports by @github-actions[bot] in #4237
• build(release): search for rules_python in BCR PR query by @rickeylev in #4238
• build(release): make Git.checkout a context manager by @rickeylev in #4239
• chore(agents): require Strunk and White conciseness in rule-creator by @rickeylev in #4240
• agents: enforce concise prose and refine PR skills by @rickeylev in #4241
• refactor: don't depend on @bazel_tools//tools/python files by @fmeum in #4236
• refactor(executables): remove legacy _bootstrap_template attribute by @rickeylev in #4243
• fix(py_console_script_binary): only create _script_gen for the exec cfg by @robinlinden in #4219
• build(release): cross-compile the Linux aarch64 tools on x86_64 by @rickeylev in #4242
• agents(review-code): prompt to post PR comments with agent signature by @rickeylev in #4246
• build: remove redundant dev/requirements.txt from bzlmod dev_pip by @rickeylev in #4245
• agents: clarify create-pr artifact publishing and monitor-ci pgrep by @rickeylev in #4247
• fix(pypi): correctly override default indexes as documented in our docs by @aignas in #4124
• agents: add rules_python usage auditor and open-question label rule by @rickeylev in #4249
• build(release): build tools for more python-build-standalone platforms by @rickeylev in #4248
• feat(rules): expose pytest_test rule for public use by @aignas in #4244
• agents: add create-news skill and news entry review auditor by @rickeylev in #4252
• agents: document test construct comments and rule domain separation by @rickeylev in #4255
• fix(toolchains): exclude pycache symlinks from runtime files by @stevendee-recon in #4233
• build(release): harden the release tools workflow by @rickeylev in #4256
• agents(starlark): require is_ prefix for config_setting names by @rickeylev in #4258
• feat(packaging): support Python toolchain make variables in py_wheel by @rickeylev in #4257
• fix(toolchains): mark the python extension os- and arch-dependent by @andrewfish0 in #4259
• agents: refine news, docs, and starlark rules by @rickeylev in #4260
• agents(ci): automatically unblock Buildkite presubmit approval steps by @rickeylev in #4268
• ci: use dict/sets for build_flags and test_flags in presubmit.yml by @rickeylev in #4263
• build(deps): bump bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml from 1.5.0 to 1.5.1 by @dependabot[bot] in #4265
• build(deps): bump zipp from 4.1.0 to 4.1.1 in /tools/publish by @dependabot[bot] in #4266
• build(deps): bump pycparser from 3.0 to 3.11 in /tools/publish by @dependabot[bot] in #4267
• agents: add process-dependabot-prs skill by @rickeylev in #4270
• fix(sphinx): prefix sphinx binary paths with ./ in run script (#4201) by @kaycebasques in #4261
• fix(toolchains): write regular pycache files when pyc caching is disabled by @rickeylev in #4264
• agents: require user-visible docs prose and workaround comments by @rickeylev in #4271
• build(release): cross-compile the release tools in presubmit by @rickeylev in #4262
• build(uv): bump default uv to 0.13.1 by @gfrankliu in #4273
• fix(gazelle): migrate to official tree-sitter Go bindings by @dougthor42 in #4272
• fix(zipapp): forward termination signals by @jpneufeld in #4161
• agents(rules): use comma-separated string for globs frontmatter by @rickeylev in #4275
• build(release): upload release artifacts and checksums to GitHub release by @rickeylev in #4274
• agents: document git archive export-subst, precondition, and daemon rules by @rickeylev in #4277
• agents: require factoring non-trivial scripts into standalone files by @rickeylev in #4279
• build(release): build all release deliverables in presubmit by @rickeylev in #4281
• agents: document workflow presubmit rules and fix deleted packages sort by @rickeylev in #4288
• build: add BuildBuddy RBE and BES configurations by @rickeylev in #4289
• build(deps): bump bazel-contrib/setup-bazel from 0.19.0 to 0.19.1 by @dependabot[bot] in #4284
• build(deps): bump more-itertools from 11.1.0 to 11.2.1 in /tools/publish by @dependabot[bot] in #4285
• agents: require local setup-bazel composite action in workflows by @rickeylev in #4290
• workflows: retry transient Bazel download failures in setup-bazel by @rickeylev in #4291
• fix(gazelle): Remove targets without srcs, even if they have an imports attribute. by @dougthor42 in #4283
• build(release): use BuildBuddy RBE for release artifact builds by @rickeylev in #4293
• agents: forbid compatibility logic for older Bazel versions by @rickeylev in #4298
• build(deps): bump the uv group across 10 directories with 1 update by @dependabot[bot] in #4297
• refactor(toolchains): configure prebuilt and from-source tool toolchains by @rickeylev in #4280
• fix(gazelle): embed default stdlib list for non-Bazel Go builds by @udaya2899 in #4197
• build(release): comment on PRs when added to release tracking issue by @rickeylev in #4302
• build(release): sync changelog for v2.4.3 backports by @rickeylev in #4303
• workflow: enable BuildBuddy BES and remote cache on macOS and Windows by @rickeylev in #4300
• workflows: update actions/github-script to v9 by @rickeylev in #4305
• build(release): cross-build all Linux release artifacts in one RBE job by @rickeylev in #4304
• agents: add composite action dependabot, secret PR, and merge queue rules by @rickeylev in #4307
• agents: document repo rule, internal label, and workflow rules by @rickeylev in #4306
• agents: add shell scripting rule and artifact staging/Starlark rules by @rickeylev in #4308
• build(ci): optimize BuildBuddy RBE caching and inject CI build metadata by @rickeylev in #4313
• agents: add bazelrc rules and clarify script execution conventions by @rickeylev in #4314
• refactor(examples): replace compile_pip_requirements with uv lock rule by @rickeylev in #4312
• agents: retry GitHub Actions jobs and handle setup-bazel network flakes by @rickeylev in #4320
• tests: add integration test for prebuilt exe_zip_maker toolchain by @rickeylev in #4309
• fix(pypi): upgrade pip to 26.2.2 and pip-tools to 7.6.2 by @rickeylev in #4310
• chore(release): sync changelog for v2.4.4 backports by @github-actions[bot] in #4322
• build: configure dependabot uv updates for dev lockfiles by @rickeylev in #4324
• refactor(examples): replace requirements.txt lockfiles with uv.lock by @rickeylev in #4323
• workflow: download Bazelisk and Bazel with retries and mirror fallback by @rickeylev in #4325
• fix(uv): upgrade default uv to 0.13.5 by @rickeylev in #4329
• workflow: update Bazelisk to 1.30.0 by @rickeylev in #4330
• agents: check downloaded tool versions and clarify review subagent by @rickeylev in #4334
• chore(release): sync changelog for v2.4.5 backports by @github-actions[bot] in #4333
• build(deps): bump black from 26.5.1 to 26.10.1 in /tests/uv/lock/workspaces in the uv group across 1 directory by @dependabot[bot] in #4336
• build(deps): bump pluggy from 1.6.0 to 1.7.0 in /dev by @dependabot[bot] in #4327
• build(deps): bump pytest-mock from 3.15.1 to 3.17.0 in /dev by @dependabot[bot] in #4328
• build(deps): bump docutils from 0.22.4 to 0.23 in /dev by @dependabot[bot] in #4326
• build(deps): bump certifi in dev uv.lock files by @rickeylev in #4337
• agents: comment superseding PR when closing duplicate Dependabot PRs by @rickeylev in #4338
• fix(toolchains): use target Python version for exec tools on Bazel 10 by @rickeylev in #4335
• agents: streamline code review report format to omit passing prose by @rickeylev in #4340
• fix: don't materialize rules_python under the remote repo contents cache by @sputt in #4294
• agents: prompt user via ask_question on sync auth failures by @rickeylev in #4342
• build: group dependabot updates into user-facing and dev-only PRs by @rickeylev in #4344
• fix: recover cached venvs from dangling package symlinks by @sean0407 in #4318
• fix(uv): read and write workspace uv.lock in lock() .run target by @rickeylev in #4343
• build(deps-user): Bump the "user-facing" group with 1 update across multiple ecosystems by @dependabot[bot] in #4345
• fix(pypi): fetch retained wheel archives lazily by @charleysaintNV in #4316
• agents: add PR comment etiquette and AI oversight disclosure rules by @rickeylev in #4346
• agents: expand code review rules and review-code sub-agents by @rickeylev in #4347
• agents: clarify purpose and comment handling in AI disclosure rule by @rickeylev in #4348
• tests: format cached_venv_dangling_symlink_test.py with ruff by @rickeylev in #4349
• docs: add GitHub Actions postsubmit CI status badge to README by @rickeylev in #4350
• agents: rename buildkite-retry-job to retry-ci-job and refactor providers by @rickeylev in #4351
• agents: add continuous Dependabot PR monitor to process-dependabot-prs by @rickeylev in #4352
• docs(uv): remove experimental notices from uv integration by @rickeylev in #4353
• agents: clarify automatic comment footer and surface AI disclosure in pr_info.md by @rickeylev in #4355
• agents: make @rickeylev sole code owner of agent configs by @rickeylev in #4356
• agents: add GitHub Actions workflow security review rules by @rickeylev in #4359
• docs(uv): document uv.lock support in locking and download docs by @rickeylev in #4354
• feat: add PyInfo.direct_implicit_pyc_files and PyExecutableInfo.venv_runfiles by @FrankPortman in #4341
• workflows: harden GitHub Actions YAML against injection by @rickeylev in #4361
• build(deps-dev): Bump certifi from 2026.10.19 to 2026.10.23 in /dev by @dependabot[bot] in #4362
• agents: avoid complex inline expressions and refine workflow guardrails by @rickeylev in #4363
• feat(uv): support WORKSPACE builds in the lock() macro by @rickeylev in #4360
• agents: refine Starlark data serialization, docstring, and WORKSPACE rules by @rickeylev in #4364
• refactor(examples): migrate remaining lockfiles to uv lock() by @rickeylev in #4365
• build(deps-dev): Bump certifi from 2026.10.19 to 2026.10.23 in /gazelle/examples/bzlmod_build_file_generation by @dependabot[bot] in #4367
• build(deps-dev): Bump pylint from 2.15.10 to 4.0.9 in /gazelle/examples/bzlmod_build_file_generation by @dependabot[bot] in #4368
• fix: preserve venv symlink setting in exec config by @finn-ball in #4372
• build(deps-user): Bump the "user-facing" group with 1 update across multiple ecosystems by @dependabot[bot] in #4378
• feat(toolchains): update Python toolchains to latest patch releases by @rickeylev in #4369
• chore(release): sync changelog for v2.4.6 backports by @github-actions[bot] in #4380
• fix(bzlmod): support Python versions not in MINOR_MAPPING by @rickeylev in #4366
• build(deps): bump urllib3 in dev uv.lock files by @rickeylev in #4381
• fix(toolchains): include libpython in python_repository attrs by @rickeylev in #4382
• build(deps-dev): Bump pylint from 2.17.7 to 4.0.9 in /examples/bzlmod by @dependabot[bot] in #4383
• feat(uv): add @uv//:uv and //python/uv/bin:uv targets to run uv by @rickeylev in #4371
• fix: don't materialize rules_python when reading the artifacts manifest by @sputt in #4370
• fix: tolerate absolute interpreter paths for lock update by @tyler-yankee in #4384
• fix: quote paths in stage1_bootstrap_template.sh by @Wyverald in #4386
• fix(pypi): generate namespace package initializers without a shell by @tamird in #4385
• Prepare release v2.5.0 by @github-actions[bot] in #4389

New Contributors

• @stanbot8 made their first contribution in #4026
• @muravev-vasilii made their first contribution in #4039
• @JoHoenk made their first contribution in #4041
• @henriquejsza made their first contribution in #4086
• @belitskiy made their first contribution in #4071
• @anisayakmitra-in made their first contribution in #4117
• @hawkinsp made their first contribution in #4122
• @tomatotomata made their first contribution in #4007
• @nicdumz made their first contribution in #4125
• @kocolosk made their first contribution in #4157
• @alloveras made their first contribution in #4160
• @zakinko made their first contribution in #4184
• @stevendee-recon made their first contribution in #4233
• @andrewfish0 made their first contribution in #4259
• @jpneufeld made their first contribution in #4161
• @sean0407 made their first contribution in #4318
• @charleysaintNV made their first contribution in #4316
• @finn-ball made their first contribution in #4372
• @tyler-yankee made their first contribution in #4384
• @tamird made their first contribution in #4385

Full Changelog: 2.3.0-rc0...2.5.0-rc0