diff --git a/tools/build_defs/apple/shared.bzl b/tools/build_defs/apple/shared.bzl
index f4c9737..0e3721f 100644
--- a/tools/build_defs/apple/shared.bzl
+++ b/tools/build_defs/apple/shared.bzl
@@ -58,8 +58,8 @@
   Call it similar to how you would call ctx.action:
     apple_action(ctx, outputs=[...], inputs=[...],...)
   """
-  execution_requirements = kw.get("execution_requirements", {})
-  execution_requirements += DARWIN_EXECUTION_REQUIREMENTS
+  execution_requirements = dict(kw.get("execution_requirements", {}))
+  execution_requirements.update(DARWIN_EXECUTION_REQUIREMENTS)
 
   no_sandbox = kw.pop("no_sandbox", False)
   if no_sandbox:
@@ -76,11 +76,13 @@
 
   if hasattr(apple_common, "apple_host_system_env"):
     xcode_config =  ctx.attr._xcode_config[apple_common.XcodeVersionConfig]
-    return (apple_common.target_apple_env(xcode_config, platform) +
-            apple_common.apple_host_system_env(xcode_config))
+    env = apple_common.target_apple_env(xcode_config, platform)
+    env.update(apple_common.apple_host_system_env(xcode_config))
   else:
-    return (ctx.fragments.apple.target_apple_env(platform) +
-            ctx.fragments.apple.apple_host_system_env())
+    env = ctx.fragments.apple.target_apple_env(platform)
+    env.update(ctx.fragments.apple.apple_host_system_env())
+
+  return env
 
 
 def xcrun_action(ctx, **kw):
@@ -92,7 +94,7 @@
   This method takes the same keyword arguments as ctx.action, however you don't
   need to specify the executable.
   """
-  env = kw.get("env", {})
-  kw["env"] = env + xcrun_env(ctx)
+  kw["env"] = dict(kw.get("env", {}))
+  kw["env"].update(xcrun_env(ctx))
 
   apple_action(ctx, executable=ctx.executable._xcrunwrapper, **kw)
diff --git a/tools/build_defs/docker/build.bzl b/tools/build_defs/docker/build.bzl
index f60ccbd..bd9da71 100644
--- a/tools/build_defs/docker/build.bzl
+++ b/tools/build_defs/docker/build.bzl
@@ -315,7 +315,7 @@
 
 docker_build_ = rule(
     implementation = _docker_build_impl,
-    attrs = {
+    attrs = dict({
         "base": attr.label(allow_files=docker_filetype),
         "data_path": attr.string(),
         "directory": attr.string(default="/"),
@@ -358,7 +358,7 @@
             cfg="host",
             executable=True,
             allow_files=True)
-    } + _hash_tools + _layer_tools,
+    }.items() + _hash_tools.items() + _layer_tools.items()),
     outputs = {
         "out": "%{name}.tar",
         "layer": "%{name}-layer.tar",
diff --git a/tools/build_defs/docker/bundle.bzl b/tools/build_defs/docker/bundle.bzl
index fa11b12..7aca215 100644
--- a/tools/build_defs/docker/bundle.bzl
+++ b/tools/build_defs/docker/bundle.bzl
@@ -68,12 +68,12 @@
 
 docker_bundle_ = rule(
     implementation = _docker_bundle_impl,
-    attrs = {
+    attrs = dict({
         "images": attr.string_dict(),
         # Implicit dependencies.
         "image_targets": attr.label_list(allow_files=True),
         "image_target_strings": attr.string_list(),
-    } + _layer_tools,
+    }.items() + _layer_tools.items()),
     outputs = {
         "out": "%{name}.tar",
     },
diff --git a/tools/build_defs/repo/git.bzl b/tools/build_defs/repo/git.bzl
index 2375b21..5147951 100644
--- a/tools/build_defs/repo/git.bzl
+++ b/tools/build_defs/repo/git.bzl
@@ -79,11 +79,11 @@
 
 
 new_git_repository = repository_rule(
-    implementation=_new_git_repository_implementation,
-    attrs=_common_attrs + {
+    implementation = _new_git_repository_implementation,
+    attrs = dict(_common_attrs.items() + {
         'build_file': attr.label(allow_single_file=True),
         'build_file_content': attr.string(),
-    }
+    }.items())
 )
 """Clone an external git repository.
 
diff --git a/tools/build_defs/repo/maven_rules.bzl b/tools/build_defs/repo/maven_rules.bzl
index a27431c..a17bf6f 100644
--- a/tools/build_defs/repo/maven_rules.bzl
+++ b/tools/build_defs/repo/maven_rules.bzl
@@ -292,12 +292,12 @@
   _maven_artifact_impl(ctx, "aar", _maven_aar_build_file_template)
 
 maven_jar = repository_rule(
-    implementation=_maven_jar_impl,
-    attrs=_common_maven_rule_attrs + {
+    implementation = _maven_jar_impl,
+    attrs = dict(_common_maven_rule_attrs.items() + {
         # Needed for compatability reasons with the native maven_jar rule.
         "repository": attr.string(default = ""),
         "server": attr.label(default = None),
-    },
+    }.items()),
     local=False,
 )
 
diff --git a/tools/build_rules/java_rules_skylark.bzl b/tools/build_rules/java_rules_skylark.bzl
index 4b12958..ec10383 100644
--- a/tools/build_rules/java_rules_skylark.bzl
+++ b/tools/build_rules/java_rules_skylark.bzl
@@ -211,14 +211,14 @@
     fragments = ['java'],
 )
 
-java_binary_attrs_common = java_library_attrs + {
+java_binary_attrs_common = dict(java_library_attrs)
+java_binary_attrs_common.update({
     "jvm_flags": attr.string_list(),
     "jvm": attr.label(default=Label("//tools/jdk:jdk"), allow_files=True),
-}
+})
 
-java_binary_attrs = java_binary_attrs_common + {
-    "main_class": attr.string(mandatory=True),
-}
+java_binary_attrs = dict(java_binary_attrs_common)
+java_binary_attrs["main_class"] = attr.string(mandatory=True)
 
 java_binary_outputs = {
     "class_jar": "lib%{name}.jar",
@@ -243,12 +243,12 @@
 
 java_test = rule(java_binary_impl,
    executable = True,
-   attrs = java_binary_attrs_common + {
-       "main_class": attr.string(default="org.junit.runner.JUnitCore"),
+   attrs = dict(java_binary_attrs_common.items() + [
+       ("main_class", attr.string(default="org.junit.runner.JUnitCore")),
        # TODO(bazel-team): it would be better if we could offer a
        # test_class attribute, but the "args" attribute is hard
        # coded in the bazel infrastructure.
-   },
+   ]),
    outputs = java_binary_outputs,
    test = True,
    fragments = ['java', 'cpp'],
diff --git a/tools/cpp/unix_cc_configure.bzl b/tools/cpp/unix_cc_configure.bzl
index 4657ba4..1df03d2 100644
--- a/tools/cpp/unix_cc_configure.bzl
+++ b/tools/cpp/unix_cc_configure.bzl
@@ -103,7 +103,7 @@
 
 def _get_tool_paths(repository_ctx, darwin, cc, overriden_tools):
   """Compute the path to the various tools. Doesn't %-escape the result!"""
-  return {k: _find_tool(repository_ctx, k, overriden_tools)
+  return dict({k: _find_tool(repository_ctx, k, overriden_tools)
           for k in [
               "ld",
               "cpp",
@@ -113,11 +113,11 @@
               "objcopy",
               "objdump",
               "strip",
-          ]} + {
+          ]}.items() + {
               "gcc": cc,
               "ar": "/usr/bin/libtool"
                     if darwin else which(repository_ctx, "ar", "/usr/bin/ar")
-          }
+          }.items())
 
 
 def _escaped_cplus_include_paths(repository_ctx):