diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9fab545..a582099 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,177 @@
+## Release 8.8.1 (2026-09-24)
+
+```
+
+Release Notes:
+
+```
+
+## Release 10.0.0-pre.20260911.2 (2026-09-18)
+
+```
+Baseline: d4c275b89348663ec7b84e58f75ec8ab46f62101
+
+Cherry picks:
+
+   + 27f9635b3723ff4a2e5b782c768b80b160e8722e:
+     Make the hash codes of providers and configured targets stable.
+```
+
+Incompatible changes:
+
+  - --experimental_sibling_repository_layout is now a no-op.
+
+Important changes:
+
+  - Support `dict(label, string)` aspect attributes in `query
+    --output=proto`.
+  - Transitive rule and toolchain resolution errors are now formatted
+    into a multi-line indented hierarchy.
+    Fixes https://github.com/bazelbuild/bazel/issues/15791
+  - Fix NullPointerException and improve error messages when Starlark
+    implicit output templates reference unset or unknown attributes.
+
+This release contains contributions from many people at Google, as well as Chris McDonald, David Zbarsky, Fabian Meumertzheim, James Judd, Tamir Duberstein, Vladimir Sitnikov.
+
+## Release 10.0.0-pre.20260908.2 (2026-09-15)
+
+```
+Baseline: 6a4878da6a4abeca65ceb60d5bc772123fa53c4a
+
+Cherry picks:
+
+   + 2ce8da8d5c24d7ccf2f6becdc16d7262f2f3c882:
+     Rollback of
+     https://github.com/bazelbuild/bazel/commit/f72ac81d9b589a62012f49
+     b32cf915f4a64c8cfb.
+```
+
+Important changes:
+
+  - Invalidate cached action execution results when remote
+    cache/executor endpoints or `--remote_instance_name` change
+    between invocations.
+  - Fix issue where `bazel test --nobuild` failed with
+    `TEST_WITH_NOANALYZE` instead of succeeding after analysis.
+  - With Build without the Bytes, a requested top-level output that
+    was deleted locally is now reliably redownloaded in the next
+    build that requests it, even if other invocations ran in between.
+  - Avoid redundant remote CAS uploads when using combined disk and
+    remote caching with a cold disk cache.
+  - Fix incremental remote builds failing to create output
+    directories beneath stale dangling symlinks.
+  - credential-helper: treat `null` values in response as unset.
+  - Fixed a rare crash with `NullPointerException` in
+    `ActionInputMap.getIndex` when an action discovers additional
+    inputs while executing.
+  - Add `repository_ctx.patch(directory)`
+  - Disk cache entries deleted by a concurrent garbage collection are
+    now treated as cache misses and don't result in failures.
+  - Fix an issue where Java compilation actions re-execute on every
+    build due to an Action Cache digest mismatch when
+    `--experimental_output_paths=strip` and in-memory `.jdeps` files
+    are enabled.
+  - Credential helper failures now abort HTTP downloads instead of
+    continuing without authentication.
+
+This release contains contributions from many people at Google, as well as Armando Montanez, Fabian Meumertzheim, George Gensure, Henner Zeller, James Judd, Jason Bedard, Jonathan Perry, Keith Smiley, Ming Zhao, Morax, Tamir Duberstein, Yannic Bonenberger.
+
+## Release 10.0.0-pre.20260902.1 (2026-09-10)
+
+```
+Baseline: e2e4c35d7400a1f3cdf3e337bb53e4fa0eafd001
+```
+
+Important changes:
+
+  - Starlark `fail()` calls now format error messages with `Error: `
+    instead of `Error in fail: `.
+    Resolves https://github.com/bazelbuild/bazel/issues/21523.
+  - Aquery now supports the `config(expr, word)` function.
+  - Fixed unnecessary remote-cache hits in incremental BwoB builds
+    after a previous invocation used a broader remote output download
+    policy.
+  - Fix an issue on Windows where empty environment variables (e.g.
+    `--action_env=VAR=`) caused test execution failures in the test
+    wrapper.
+  - `--experimental_override_platform_cpu_name` renamed to
+    `--override_platform_cpu_name`
+  - The macOS sandbox now allows actions to bind sockets when network
+    access is blocked, matching the behavior of the Linux sandbox.
+    Note that macOS cannot restrict inbound connections by peer, so
+    an action that listens on a non-loopback address is reachable
+    from other hosts on the network; outbound traffic remains
+    restricted to loopback.
+  - Clean up unused stashed sandbox directories when shutting down
+    the Bazel server.
+  - Downloader rewrites to endpoints that refuse connections no
+    longer repeat the connector's full retry sequence.
+  - Fix `grep: invalid option -- P` errors on macOS when running
+    release and documentation scripts.
+  - Remote execution, remote caching, and auth flags can now be reset
+    to their default unset state on the command line by passing an
+    empty value (e.g., `--remote_cache=`, `--remote_executor=`,
+    `--google_credentials=`).
+
+This release contains contributions from many people at Google, as well as Alex Eagle, Angus Lees, Armando Montanez, Fabian Meumertzheim, Fabian Meumertzheim, Henner Zeller, jjj-n, Jonathan Perry, justinswe, Keith Smiley, Kip Hamiltons, Salma Samy, Samuel Bronson, Tyler Breisacher, zozo123.
+
+## Release 10.0.0-pre.20260826.1 (2026-09-08)
+
+```
+Baseline: 609cb51089a86f7e40552a1f79c16992376f06db
+
+Cherry picks:
+
+   + bd75cfcf5c906fb6b88515c993edcd34bfadeecb:
+     Update protobuf to 36.0.bcr.1
+     (https://github.com/bazelbuild/bazel/pull/30886)
+```
+
+Incompatible changes:
+
+  - `--rewind_lost_inputs` is now enabled by default. Builds with
+    BwoB automatically recover from remote cache eviction by
+    rewinding actions that generated lost inputs.
+
+New features:
+
+  - With the new
+    `--experimental_keep_change_prunable_nodes_during_gc` flag,
+    Skyframe will keep computed nodes that aren't requested by the
+    current evaluation but whose dependencies would be verified clean
+    after change pruning.
+
+Important changes:
+
+  - `--server_javabase` and nojdk builds of Bazel can now use JREs in
+    addition to JDKs.
+  - Test targets can now be built for a target platform that no
+    execution platform is compatible with, e.g. to cross-compile
+    them. Running such a test fails with an error at execution time
+    instead of failing analysis.
+  - Disk cache action results are now always trusted with
+    `--rewind_lost_inputs`, even if Build without the Bytes makes it
+    so that the outputs are not available locally.
+  - Cycles between `MODULE.bazel` files connected via `include()` are
+    now reported as an error instead of hanging the build.
+  - Fixed a crash while evaluating `MODULE.bazel` files when Skyframe
+    dropped its temporary state in response to memory pressure.
+  - Fixed a build failure with `--execution_log_compact_file` when a
+    C++ action template has no inputs.
+  - Files uploaded to the disk cache are now copied with a
+    copy-on-write clone where the filesystem supports it, so a cache
+    entry can share its blocks with the output it was uploaded from.
+  - Module extensions are now correctly rerun when the root module
+    changes the `dev_dependency` value of a `use_extension` call,
+    which is visible to extensions as
+    `module_ctx.root_module_has_non_dev_dependency`.
+  - None
+    RELNOTES: None
+  - The C++ include scanner now properly resolves headers that are
+    generated at build time and included as part of the toolchain.
+
+This release contains contributions from many people at Google, as well as Alex Eagle, Armando Montanez, Benjamin Peterson, Chi Wang, David Ostrovsky, David Zbarsky, Fabian Meumertzheim, Fabian Meumertzheim, Fabian Meumertzheim, Fabian Meumertzheim, Garrett Holmstrom, Han-Wen Nienhuys, Herdiyan Adam Putra, Hoyt Summers Pittman, JonathanPerry651, Jordan Mele, Ladd Van Tol, Rahul Butani, Rajkaran Yadav, Tamir Duberstein, Tyler French, wade-arista.
+
 ## Release 8.8.0 (2026-08-31)
 
 ```
@@ -4829,11 +5003,11 @@
 
   - Bazel no longer increases the delay between progress updates when
     there is no cursor control.
-  - `--incompatible_always_include_files_in_data` is flipped
-    to true. See https://github.com/bazelbuild/bazel/issues/16654 for
+  - `--incompatible_always_include_files_in_data` is flipped
+    to true. See https://github.com/bazelbuild/bazel/issues/16654 for
     details.
-  - `cquery --output=files` also outputs source files.
-    
+  - `cquery --output=files` also outputs source files.
+    
     Closes #16602.
   - `--incompatible_strict_conflict_checks` is flipped to true. See
     https://github.com/bazelbuild/bazel/issues/16729 for details.
@@ -4841,10 +5015,10 @@
     configuration. Mitigation is to set Python version on the targets.
   - `--features` only applies to targets built in the target
     configuration, and `--host_features` is used for the host / exec
-    configuration (gated behind `--incompatible_use_host_features`)
-    
-    Fixes https://github.com/bazelbuild/bazel/issues/13839
-    
+    configuration (gated behind `--incompatible_use_host_features`)
+    
+    Fixes https://github.com/bazelbuild/bazel/issues/13839
+    
     Closes #16626.
 
 New features:
@@ -4859,11 +5033,11 @@
     accepted by the `Rlocation` function of runfiles libraries. This
     is the preferred way to access data dependencies at runtime and
     works on all platforms, even when runfiles are not enabled (e.g.,
-    on Windows by default).
-    
-    Work towards #16124
-    Fixes #10923
-    
+    on Windows by default).
+    
+    Work towards #16124
+    Fixes #10923
+    
     Closes #16428.
   - Starlark `print()` statements are now emitted iff the line of
     code is executed. They are no longer replayed on subsequent
@@ -4895,12 +5069,12 @@
     involve module extensions.
   - Added a new `max_compatibility_level` attribute to the
     `bazel_dep` directive, which allows version selection to upgrade
-    a dependency up to the specified compatibility level.
-    
+    a dependency up to the specified compatibility level.
+    
     Co-authored-by: Brentley Jones <github@brentleyjones.com>
   - `--experimental_remote_grpc_log` has been renamed to
-    `--remote_grpc_log`
-    
+    `--remote_grpc_log`
+    
     Closes #18180.
 
 This release contains contributions from many people at Google, as well as Ben Lee, Brentley Jones, Ezekiel Warren, Fabian Meumertzheim, keertk, Keith Smiley, Krzysztof Naglik, kshyanashree, lunch-glide-pepper, oquenchil, Patrick Balestra, Son Luong Ngoc, Ted Kaplan, Ted Kaplan, UebelAndre, Xùdōng Yáng, Yannic, yuzhy8701.
@@ -6299,8 +6473,8 @@
 Incompatible changes:
 
   - GrpcRemoteDownloader only includes relevant headers instead of
-    sending all credentials.
-    
+    sending all credentials.
+    
     Closes #16439.
 
 Important changes:
@@ -6861,17 +7035,17 @@
 Incompatible changes:
 
   - GrpcRemoteDownloader only includes relevant headers instead of
-    sending all credentials.
-    
+    sending all credentials.
+    
     Closes #16439.
   - analysis_test moved into testing.analysis_test
 
 Important changes:
 
-  - alias() can now select() directly on constraint_value()
-    
-    Fixes https://github.com/bazelbuild/bazel/issues/13047.
-    
+  - alias() can now select() directly on constraint_value()
+    
+    Fixes https://github.com/bazelbuild/bazel/issues/13047.
+    
     Closes #14310.
   - Fixed an issue where Bazel could erroneously report a test passes
     in coverage mode without actually running the test.
@@ -6879,16 +7053,16 @@
   - Add coverage configuration fragment, used to expose
     output_generator label.
   - Bazel now no longer includes system headers on macOS in coverage
-    reports (#14969).
-    
+    reports (#14969).
+    
     Closes #14971.
-  - Starlark test rules can use the new inherited_environment
+  - Starlark test rules can use the new inherited_environment
     parameter of testing.TestEnvironment to specify environment
-    variables
-    whose values should be inherited from the shell environment.
-    
+    variables
+    whose values should be inherited from the shell environment.
+    
     Closes #14849.
-  - none
+  - none
     RELNOTES:none
   - Enable merging permissions during Android manifest merging with
     the --merge_android_manifest_permissions flag.
@@ -6896,16 +7070,16 @@
     the MODULE.bazel file, to replace the
     {execution_platforms,toolchains}_to_register attributes on the
     module() directive.
-  - Add support for fetching RPC credentials from credential helper.
-    
-    Progress on https://github.com/bazelbuild/bazel/issues/15856
-    
+  - Add support for fetching RPC credentials from credential helper.
+    
+    Progress on https://github.com/bazelbuild/bazel/issues/15856
+    
     Closes #15947.
   - `cquery`'s new output mode
     [`--output=files`](https://bazel.build/docs/cquery#files-output)
     lists the output files of the targets matching the query. It
-    takes the current value of `--output_groups` into account.
-    
+    takes the current value of `--output_groups` into account.
+    
     Closes #15552.
   - Fix for desugaring failure on Bazel+Android+Windows build
     scenario.
@@ -6914,11 +7088,11 @@
     accepted by the `Rlocation` function of runfiles libraries. This
     is the preferred way to access data dependencies at runtime and
     works on all platforms, even when runfiles are not enabled (e.g.,
-    on Windows by default).
-    
-    Work towards #16124
-    Fixes #10923
-    
+    on Windows by default).
+    
+    Work towards #16124
+    Fixes #10923
+    
     Closes #16667.
 
 This release contains contributions from many people at Google, as well as amberdixon, Andreas Fuchs, Benjamin Peterson, Brentley Jones, Chenchu Kolli, Dan Fleming, Danny Wolf, Emil Kattainen, Fabian Meumertzheim, Gowroji Sunil, hvadehra, Juh-Roch, Keith Smiley, Krzysztof Naglik, kshyanashree, Niyas Sait, Noa Resare, Oliver Eikemeier, oquenchil, Peter Mounce, Philipp Schrader, Ryan Beasley, Thi Doãn, Xùdōng Yáng, Yannic, Zhongpeng Lin.
@@ -7294,11 +7468,11 @@
 
   - Bazel no longer increases the delay between progress updates when
     there is no cursor control.
-  - `--incompatible_always_include_files_in_data` is flipped
-    to true. See https://github.com/bazelbuild/bazel/issues/16654 for
+  - `--incompatible_always_include_files_in_data` is flipped
+    to true. See https://github.com/bazelbuild/bazel/issues/16654 for
     details.
-  - `cquery --output=files` also outputs source files.
-    
+  - `cquery --output=files` also outputs source files.
+    
     Closes #16602.
   - `--incompatible_strict_conflict_checks` is flipped to true. See
     https://github.com/bazelbuild/bazel/issues/16729 for details.
@@ -7306,10 +7480,10 @@
     configuration. Mitigation is to set Python version on the targets.
   - `--features` only applies to targets built in the target
     configuration, and `--host_features` is used for the host / exec
-    configuration (gated behind `--incompatible_use_host_features`)
-    
-    Fixes https://github.com/bazelbuild/bazel/issues/13839
-    
+    configuration (gated behind `--incompatible_use_host_features`)
+    
+    Fixes https://github.com/bazelbuild/bazel/issues/13839
+    
     Closes #16626.
 
 Important changes:
@@ -7319,11 +7493,11 @@
     accepted by the `Rlocation` function of runfiles libraries. This
     is the preferred way to access data dependencies at runtime and
     works on all platforms, even when runfiles are not enabled (e.g.,
-    on Windows by default).
-    
-    Work towards #16124
-    Fixes #10923
-    
+    on Windows by default).
+    
+    Work towards #16124
+    Fixes #10923
+    
     Closes #16428.
   - Starlark `print()` statements are now emitted iff the line of
     code is executed. They are no longer replayed on subsequent
@@ -8212,11 +8386,11 @@
 
   - Bazel no longer increases the delay between progress updates when
     there is no cursor control.
-  - `--incompatible_always_include_files_in_data` is flipped
-    to true. See https://github.com/bazelbuild/bazel/issues/16654 for
+  - `--incompatible_always_include_files_in_data` is flipped
+    to true. See https://github.com/bazelbuild/bazel/issues/16654 for
     details.
-  - `cquery --output=files` also outputs source files.
-    
+  - `cquery --output=files` also outputs source files.
+    
     Closes #16602.
   - `--incompatible_strict_conflict_checks` is flipped to true. See
     https://github.com/bazelbuild/bazel/issues/16729 for details.
@@ -8224,10 +8398,10 @@
     configuration. Mitigation is to set Python version on the targets.
   - `--features` only applies to targets built in the target
     configuration, and `--host_features` is used for the host / exec
-    configuration (gated behind `--incompatible_use_host_features`)
-    
-    Fixes https://github.com/bazelbuild/bazel/issues/13839
-    
+    configuration (gated behind `--incompatible_use_host_features`)
+    
+    Fixes https://github.com/bazelbuild/bazel/issues/13839
+    
     Closes #16626.
 
 Important changes:
@@ -8237,11 +8411,11 @@
     accepted by the `Rlocation` function of runfiles libraries. This
     is the preferred way to access data dependencies at runtime and
     works on all platforms, even when runfiles are not enabled (e.g.,
-    on Windows by default).
-    
-    Work towards #16124
-    Fixes #10923
-    
+    on Windows by default).
+    
+    Work towards #16124
+    Fixes #10923
+    
     Closes #16428.
   - Starlark `print()` statements are now emitted iff the line of
     code is executed. They are no longer replayed on subsequent
@@ -8714,11 +8888,11 @@
 
   - Bazel no longer increases the delay between progress updates when
     there is no cursor control.
-  - `--incompatible_always_include_files_in_data` is flipped
-    to true. See https://github.com/bazelbuild/bazel/issues/16654 for
+  - `--incompatible_always_include_files_in_data` is flipped
+    to true. See https://github.com/bazelbuild/bazel/issues/16654 for
     details.
-  - `cquery --output=files` also outputs source files.
-    
+  - `cquery --output=files` also outputs source files.
+    
     Closes #16602.
   - `--incompatible_strict_conflict_checks` is flipped to true. See
     https://github.com/bazelbuild/bazel/issues/16729 for details.
@@ -8726,10 +8900,10 @@
     configuration. Mitigation is to set Python version on the targets.
   - `--features` only applies to targets built in the target
     configuration, and `--host_features` is used for the host / exec
-    configuration (gated behind `--incompatible_use_host_features`)
-    
-    Fixes https://github.com/bazelbuild/bazel/issues/13839
-    
+    configuration (gated behind `--incompatible_use_host_features`)
+    
+    Fixes https://github.com/bazelbuild/bazel/issues/13839
+    
     Closes #16626.
 
 Important changes:
@@ -8739,11 +8913,11 @@
     accepted by the `Rlocation` function of runfiles libraries. This
     is the preferred way to access data dependencies at runtime and
     works on all platforms, even when runfiles are not enabled (e.g.,
-    on Windows by default).
-    
-    Work towards #16124
-    Fixes #10923
-    
+    on Windows by default).
+    
+    Work towards #16124
+    Fixes #10923
+    
     Closes #16428.
   - Starlark `print()` statements are now emitted iff the line of
     code is executed. They are no longer replayed on subsequent
@@ -9115,11 +9289,11 @@
 
   - Bazel no longer increases the delay between progress updates when
     there is no cursor control.
-  - `--incompatible_always_include_files_in_data` is flipped
-    to true. See https://github.com/bazelbuild/bazel/issues/16654 for
+  - `--incompatible_always_include_files_in_data` is flipped
+    to true. See https://github.com/bazelbuild/bazel/issues/16654 for
     details.
-  - `cquery --output=files` also outputs source files.
-    
+  - `cquery --output=files` also outputs source files.
+    
     Closes #16602.
   - `--incompatible_strict_conflict_checks` is flipped to true. See
     https://github.com/bazelbuild/bazel/issues/16729 for details.
@@ -9127,10 +9301,10 @@
     configuration. Mitigation is to set Python version on the targets.
   - `--features` only applies to targets built in the target
     configuration, and `--host_features` is used for the host / exec
-    configuration (gated behind `--incompatible_use_host_features`)
-    
-    Fixes https://github.com/bazelbuild/bazel/issues/13839
-    
+    configuration (gated behind `--incompatible_use_host_features`)
+    
+    Fixes https://github.com/bazelbuild/bazel/issues/13839
+    
     Closes #16626.
 
 Important changes:
@@ -9140,11 +9314,11 @@
     accepted by the `Rlocation` function of runfiles libraries. This
     is the preferred way to access data dependencies at runtime and
     works on all platforms, even when runfiles are not enabled (e.g.,
-    on Windows by default).
-    
-    Work towards #16124
-    Fixes #10923
-    
+    on Windows by default).
+    
+    Work towards #16124
+    Fixes #10923
+    
     Closes #16428.
   - Starlark `print()` statements are now emitted iff the line of
     code is executed. They are no longer replayed on subsequent
@@ -9621,11 +9795,11 @@
     #16355, #16323, and #16391.
   - Bazel no longer increases the delay between progress updates when
     there is no cursor control.
-  - `--incompatible_always_include_files_in_data` is flipped
-    to true. See https://github.com/bazelbuild/bazel/issues/16654 for
+  - `--incompatible_always_include_files_in_data` is flipped
+    to true. See https://github.com/bazelbuild/bazel/issues/16654 for
     details.
-  - `cquery --output=files` also outputs source files.
-    
+  - `cquery --output=files` also outputs source files.
+    
     Closes #16602.
   - `--incompatible_strict_conflict_checks` is flipped to true. See
     https://github.com/bazelbuild/bazel/issues/16729 for details.
@@ -9844,11 +10018,11 @@
     accepted by the `Rlocation` function of runfiles libraries. This
     is the preferred way to access data dependencies at runtime and
     works on all platforms, even when runfiles are not enabled (e.g.,
-    on Windows by default).
-    
-    Work towards #16124
-    Fixes #10923
-    
+    on Windows by default).
+    
+    Work towards #16124
+    Fixes #10923
+    
     Closes #16428.
   - Starlark `print()` statements are now emitted iff the line of
     code is executed. They are no longer replayed on subsequent
@@ -10388,17 +10562,17 @@
 Incompatible changes:
 
   - GrpcRemoteDownloader only includes relevant headers instead of
-    sending all credentials.
-    
+    sending all credentials.
+    
     Closes #16439.
   - analysis_test moved into testing.analysis_test
 
 Important changes:
 
-  - alias() can now select() directly on constraint_value()
-    
-    Fixes https://github.com/bazelbuild/bazel/issues/13047.
-    
+  - alias() can now select() directly on constraint_value()
+    
+    Fixes https://github.com/bazelbuild/bazel/issues/13047.
+    
     Closes #14310.
   - Fixed an issue where Bazel could erroneously report a test passes
     in coverage mode without actually running the test.
@@ -10406,16 +10580,16 @@
   - Add coverage configuration fragment, used to expose
     output_generator label.
   - Bazel now no longer includes system headers on macOS in coverage
-    reports (#14969).
-    
+    reports (#14969).
+    
     Closes #14971.
-  - Starlark test rules can use the new inherited_environment
+  - Starlark test rules can use the new inherited_environment
     parameter of testing.TestEnvironment to specify environment
-    variables
-    whose values should be inherited from the shell environment.
-    
+    variables
+    whose values should be inherited from the shell environment.
+    
     Closes #14849.
-  - none
+  - none
     RELNOTES:none
   - Enable merging permissions during Android manifest merging with
     the --merge_android_manifest_permissions flag.
@@ -10423,16 +10597,16 @@
     the MODULE.bazel file, to replace the
     {execution_platforms,toolchains}_to_register attributes on the
     module() directive.
-  - Add support for fetching RPC credentials from credential helper.
-    
-    Progress on https://github.com/bazelbuild/bazel/issues/15856
-    
+  - Add support for fetching RPC credentials from credential helper.
+    
+    Progress on https://github.com/bazelbuild/bazel/issues/15856
+    
     Closes #15947.
   - `cquery`'s new output mode
     [`--output=files`](https://bazel.build/docs/cquery#files-output)
     lists the output files of the targets matching the query. It
-    takes the current value of `--output_groups` into account.
-    
+    takes the current value of `--output_groups` into account.
+    
     Closes #15552.
   - Fix for desugaring failure on Bazel+Android+Windows build
     scenario.
@@ -10441,11 +10615,11 @@
     accepted by the `Rlocation` function of runfiles libraries. This
     is the preferred way to access data dependencies at runtime and
     works on all platforms, even when runfiles are not enabled (e.g.,
-    on Windows by default).
-    
-    Work towards #16124
-    Fixes #10923
-    
+    on Windows by default).
+    
+    Work towards #16124
+    Fixes #10923
+    
     Closes #16667.
 
 This release contains contributions from many people at Google, as well as amberdixon, Andreas Fuchs, Benjamin Peterson, Brentley Jones, Chenchu Kolli, Dan Fleming, Danny Wolf, Emil Kattainen, Fabian Meumertzheim, Gowroji Sunil, hvadehra, Juh-Roch, Keith Smiley, Krzysztof Naglik, kshyanashree, Niyas Sait, Noa Resare, Oliver Eikemeier, oquenchil, Peter Mounce, Philipp Schrader, Ryan Beasley, Thi Doãn, Xùdōng Yáng, Yannic, Zhongpeng Lin.
@@ -11470,8 +11644,8 @@
   - Remove `--experimental_profile_cpu_usage`.
   - flipped --incompatible_java_common_parameters (see #12373)
   - GrpcRemoteDownloader only includes relevant headers instead of
-    sending all credentials.
-    
+    sending all credentials.
+    
     Closes #16439.
 
 New features:
@@ -11654,10 +11828,10 @@
     renamed to  --incompatible_existing_rules_immutable_view
   - Bazel no longer supports Java 8. From this version on, the
     minimum required JDK is OpenJDK 11.
-  - alias() can now select() directly on constraint_value()
-    
-    Fixes https://github.com/bazelbuild/bazel/issues/13047.
-    
+  - alias() can now select() directly on constraint_value()
+    
+    Fixes https://github.com/bazelbuild/bazel/issues/13047.
+    
     Closes #14310.
   - Fixed an issue where Bazel could erroneously report a test passes
     in coverage mode without actually running the test.
@@ -11665,16 +11839,16 @@
   - Add coverage configuration fragment, used to expose
     output_generator label.
   - Bazel now no longer includes system headers on macOS in coverage
-    reports (#14969).
-    
+    reports (#14969).
+    
     Closes #14971.
-  - Starlark test rules can use the new inherited_environment
+  - Starlark test rules can use the new inherited_environment
     parameter of testing.TestEnvironment to specify environment
-    variables
-    whose values should be inherited from the shell environment.
-    
+    variables
+    whose values should be inherited from the shell environment.
+    
     Closes #14849.
-  - none
+  - none
     RELNOTES:none
   - Enable merging permissions during Android manifest merging with
     the --merge_android_manifest_permissions flag.
@@ -11682,16 +11856,16 @@
     the MODULE.bazel file, to replace the
     {execution_platforms,toolchains}_to_register attributes on the
     module() directive.
-  - Add support for fetching RPC credentials from credential helper.
-    
-    Progress on https://github.com/bazelbuild/bazel/issues/15856
-    
+  - Add support for fetching RPC credentials from credential helper.
+    
+    Progress on https://github.com/bazelbuild/bazel/issues/15856
+    
     Closes #15947.
   - `cquery`'s new output mode
     [`--output=files`](https://bazel.build/docs/cquery#files-output)
     lists the output files of the targets matching the query. It
-    takes the current value of `--output_groups` into account.
-    
+    takes the current value of `--output_groups` into account.
+    
     Closes #15552.
   - Fix for desugaring failure on Bazel+Android+Windows build
     scenario.
@@ -12409,8 +12583,8 @@
 Incompatible changes:
 
   - GrpcRemoteDownloader only includes relevant headers instead of
-    sending all credentials.
-    
+    sending all credentials.
+    
     Closes #16439.
 
 Important changes:
@@ -13155,10 +13329,10 @@
 
 Important changes:
 
-  - alias() can now select() directly on constraint_value()
-    
-    Fixes https://github.com/bazelbuild/bazel/issues/13047.
-    
+  - alias() can now select() directly on constraint_value()
+    
+    Fixes https://github.com/bazelbuild/bazel/issues/13047.
+    
     Closes #14310.
   - Fixed an issue where Bazel could erroneously report a test passes
     in coverage mode without actually running the test.
@@ -13166,16 +13340,16 @@
   - Add coverage configuration fragment, used to expose
     output_generator label.
   - Bazel now no longer includes system headers on macOS in coverage
-    reports (#14969).
-    
+    reports (#14969).
+    
     Closes #14971.
-  - Starlark test rules can use the new inherited_environment
+  - Starlark test rules can use the new inherited_environment
     parameter of testing.TestEnvironment to specify environment
-    variables
-    whose values should be inherited from the shell environment.
-    
+    variables
+    whose values should be inherited from the shell environment.
+    
     Closes #14849.
-  - none
+  - none
     RELNOTES:none
   - Enable merging permissions during Android manifest merging with
     the --merge_android_manifest_permissions flag.
@@ -13183,16 +13357,16 @@
     the MODULE.bazel file, to replace the
     {execution_platforms,toolchains}_to_register attributes on the
     module() directive.
-  - Add support for fetching RPC credentials from credential helper.
-    
-    Progress on https://github.com/bazelbuild/bazel/issues/15856
-    
+  - Add support for fetching RPC credentials from credential helper.
+    
+    Progress on https://github.com/bazelbuild/bazel/issues/15856
+    
     Closes #15947.
   - `cquery`'s new output mode
     [`--output=files`](https://bazel.build/docs/cquery#files-output)
     lists the output files of the targets matching the query. It
-    takes the current value of `--output_groups` into account.
-    
+    takes the current value of `--output_groups` into account.
+    
     Closes #15552.
   - Fix for desugaring failure on Bazel+Android+Windows build
     scenario.
@@ -13687,10 +13861,10 @@
 
 Important changes:
 
-  - alias() can now select() directly on constraint_value()
-    
-    Fixes https://github.com/bazelbuild/bazel/issues/13047.
-    
+  - alias() can now select() directly on constraint_value()
+    
+    Fixes https://github.com/bazelbuild/bazel/issues/13047.
+    
     Closes #14310.
   - Fixed an issue where Bazel could erroneously report a test passes
     in coverage mode without actually running the test.
@@ -13698,16 +13872,16 @@
   - Add coverage configuration fragment, used to expose
     output_generator label.
   - Bazel now no longer includes system headers on macOS in coverage
-    reports (#14969).
-    
+    reports (#14969).
+    
     Closes #14971.
-  - Starlark test rules can use the new inherited_environment
+  - Starlark test rules can use the new inherited_environment
     parameter of testing.TestEnvironment to specify environment
-    variables
-    whose values should be inherited from the shell environment.
-    
+    variables
+    whose values should be inherited from the shell environment.
+    
     Closes #14849.
-  - none
+  - none
     RELNOTES:none
   - Enable merging permissions during Android manifest merging with
     the --merge_android_manifest_permissions flag.
@@ -13715,16 +13889,16 @@
     the MODULE.bazel file, to replace the
     {execution_platforms,toolchains}_to_register attributes on the
     module() directive.
-  - Add support for fetching RPC credentials from credential helper.
-    
-    Progress on https://github.com/bazelbuild/bazel/issues/15856
-    
+  - Add support for fetching RPC credentials from credential helper.
+    
+    Progress on https://github.com/bazelbuild/bazel/issues/15856
+    
     Closes #15947.
   - `cquery`'s new output mode
     [`--output=files`](https://bazel.build/docs/cquery#files-output)
     lists the output files of the targets matching the query. It
-    takes the current value of `--output_groups` into account.
-    
+    takes the current value of `--output_groups` into account.
+    
     Closes #15552.
   - Fix for desugaring failure on Bazel+Android+Windows build
     scenario.
@@ -14462,10 +14636,10 @@
 
 Important changes:
 
-  - alias() can now select() directly on constraint_value()
-    
-    Fixes https://github.com/bazelbuild/bazel/issues/13047.
-    
+  - alias() can now select() directly on constraint_value()
+    
+    Fixes https://github.com/bazelbuild/bazel/issues/13047.
+    
     Closes #14310.
   - Fixed an issue where Bazel could erroneously report a test passes
     in coverage mode without actually running the test.
@@ -14473,16 +14647,16 @@
   - Add coverage configuration fragment, used to expose
     output_generator label.
   - Bazel now no longer includes system headers on macOS in coverage
-    reports (#14969).
-    
+    reports (#14969).
+    
     Closes #14971.
-  - Starlark test rules can use the new inherited_environment
+  - Starlark test rules can use the new inherited_environment
     parameter of testing.TestEnvironment to specify environment
-    variables
-    whose values should be inherited from the shell environment.
-    
+    variables
+    whose values should be inherited from the shell environment.
+    
     Closes #14849.
-  - none
+  - none
     RELNOTES:none
   - Enable merging permissions during Android manifest merging with
     the --merge_android_manifest_permissions flag.
@@ -14490,16 +14664,16 @@
     the MODULE.bazel file, to replace the
     {execution_platforms,toolchains}_to_register attributes on the
     module() directive.
-  - Add support for fetching RPC credentials from credential helper.
-    
-    Progress on https://github.com/bazelbuild/bazel/issues/15856
-    
+  - Add support for fetching RPC credentials from credential helper.
+    
+    Progress on https://github.com/bazelbuild/bazel/issues/15856
+    
     Closes #15947.
   - `cquery`'s new output mode
     [`--output=files`](https://bazel.build/docs/cquery#files-output)
     lists the output files of the targets matching the query. It
-    takes the current value of `--output_groups` into account.
-    
+    takes the current value of `--output_groups` into account.
+    
     Closes #15552.
   - Fix for desugaring failure on Bazel+Android+Windows build
     scenario.
@@ -15162,10 +15336,10 @@
 
 Important changes:
 
-  - alias() can now select() directly on constraint_value()
-    
-    Fixes https://github.com/bazelbuild/bazel/issues/13047.
-    
+  - alias() can now select() directly on constraint_value()
+    
+    Fixes https://github.com/bazelbuild/bazel/issues/13047.
+    
     Closes #14310.
   - Fixed an issue where Bazel could erroneously report a test passes
     in coverage mode without actually running the test.
@@ -15173,14 +15347,14 @@
   - Add coverage configuration fragment, used to expose
     output_generator label.
   - Bazel now no longer includes system headers on macOS in coverage
-    reports (#14969).
-    
+    reports (#14969).
+    
     Closes #14971.
-  - Starlark test rules can use the new inherited_environment
+  - Starlark test rules can use the new inherited_environment
     parameter of testing.TestEnvironment to specify environment
-    variables
-    whose values should be inherited from the shell environment.
-    
+    variables
+    whose values should be inherited from the shell environment.
+    
     Closes #14849.
 
 This release contains contributions from many people at Google, as well as amberdixon, Andreas Fuchs, Benjamin Peterson, Brentley Jones, Chenchu Kolli, Dan Fleming, Danny Wolf, Fabian Meumertzheim, hvadehra, Keith Smiley, Niyas Sait, Noa Resare, Oliver Eikemeier, oquenchil, Peter Mounce, Philipp Schrader, Thi Doãn, Xùdōng Yáng, Yannic, Zhongpeng Lin.
@@ -15702,10 +15876,10 @@
 
 Important changes:
 
-  - alias() can now select() directly on constraint_value()
-    
-    Fixes https://github.com/bazelbuild/bazel/issues/13047.
-    
+  - alias() can now select() directly on constraint_value()
+    
+    Fixes https://github.com/bazelbuild/bazel/issues/13047.
+    
     Closes #14310.
   - Fixed an issue where Bazel could erroneously report a test passes
     in coverage mode without actually running the test.
@@ -15713,8 +15887,8 @@
   - Add coverage configuration fragment, used to expose
     output_generator label.
   - Bazel now no longer includes system headers on macOS in coverage
-    reports (#14969).
-    
+    reports (#14969).
+    
     Closes #14971.
 
 This release contains contributions from many people at Google, as well as amberdixon, Benjamin Peterson, Brentley Jones, Dan Fleming, Danny Wolf, Fabian Meumertzheim, Keith Smiley, Niyas Sait, Noa Resare, Oliver Eikemeier, oquenchil, Philipp Schrader, Xùdōng Yáng, Yannic.
@@ -15974,10 +16148,10 @@
 
 Important changes:
 
-  - alias() can now select() directly on constraint_value()
-    
-    Fixes https://github.com/bazelbuild/bazel/issues/13047.
-    
+  - alias() can now select() directly on constraint_value()
+    
+    Fixes https://github.com/bazelbuild/bazel/issues/13047.
+    
     Closes #14310.
   - Fixed an issue where Bazel could erroneously report a test passes
     in coverage mode without actually running the test.
@@ -15985,8 +16159,8 @@
   - Add coverage configuration fragment, used to expose
     output_generator label.
   - Bazel now no longer includes system headers on macOS in coverage
-    reports (#14969).
-    
+    reports (#14969).
+    
     Closes #14971.
 
 This release contains contributions from many people at Google, as well as amberdixon, Benjamin Peterson, Brentley Jones, Dan Fleming, Danny Wolf, Fabian Meumertzheim, Keith Smiley, Niyas Sait, Noa Resare, Oliver Eikemeier, oquenchil, Philipp Schrader, Xùdōng Yáng, Yannic.