Release 10.0.0-pre.20260723.1 (2026-07-30)

Baseline: d1e2d982496ec3c4806674ca45eed38faacdcf57

Cherry picks:

   + e16c8f93f1be6f41cc881b2900e38b96940846f0:
     Fix release script for rolling releases

Incompatible changes:

  - in min() and max(), the key callback is now prohibited from
    mutating the sequence being iterated over
  - `--test_tmpdir=` now resets a value from a bazelrc to
    the default execroot temp directory instead of creating `_tmp` in
    the
    workspace. Use `--test_tmpdir=.` to retain workspace-relative
    behavior.
  - Bind mounts specified via `--sandbox_add_mount_pair` (or
    `-M`/`-m` flags in `linux-sandbox`) are now correctly remounted
    read-only when using the hermetic sandbox (with
    `--experimental_sandbox_hermetic`). Build actions that write to
    these paths will now fail with a read-only filesystem error.
  - `--use_target_platform_for_tests` is now a no-op. By default,
    tests are executed on an execution platform that has all
    constraints of the target platform, making this flag obsolete. To
    migrate, make sure that your target platform or a platform with
    at least the same constraints is registered as an execution
    platform.

New features:

  - `--worker_sandboxing` can now be scoped per worker-key mnemonic
    with `--worker_sandboxing=<mnemonic>=<boolean>`.

Important changes:

  - If --incompatible_symbolic_macro_strict_attrs is enabled,
    invalid attribute values in symbolic macros fail the build
    (matching
    the behavior of rules).
  - Added a new `instance_id` field to the `BuildMetrics` BES event,
    in order to help diff between the current and previous builds on
    the running server.
  - `--experimental_remote_scrubbing_config=` now disables remote
    cache key scrubbing, allowing command-line overrides of scrubbing
    configs set in .bazelrc.
  - "$ bazel config x86-opt": you can now inspect configs based on
    output path prefixes, not just config checksum prefixes.
  - The JDK bundled with Bazel has been updated to 26.
  - Action rewinding (`--rewind_lost_inputs`) can now succeed even if
    the remote cache doesn't verify that AC entries aren't stale.
  - Running `bazel shutdown` no longer results in stale lockfile data
    being written.
  - Starlark debug server now binds to the configured address
    (defaulting to 127.0.0.1) via
    --experimental_skylark_debug_server_address.

This release contains contributions from many people at Google, as well as Adin Cebic, Alexander Scott, Armando Montanez, Dan Halperin, David Zbarsky, Fabian Meumertzheim, Fabian Meumertzheim, giria660, Guillaume Maudoux, Han-Wen Nienhuys, jcater, Keith Smiley, Kobi Hikri, Son Luong Ngoc, Steve Barrau, Tamir Duberstein, teaugene, Yossi Eliaz, zozo123.

CHANGELOG.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6391759..165da40 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,65 @@
+## Release 10.0.0-pre.20260723.1 (2026-07-30)
+
+```
+Baseline: d1e2d982496ec3c4806674ca45eed38faacdcf57
+
+Cherry picks:
+
+   + e16c8f93f1be6f41cc881b2900e38b96940846f0:
+     Fix release script for rolling releases
+```
+
+Incompatible changes:
+
+  - in min() and max(), the key callback is now prohibited from
+    mutating the sequence being iterated over
+  - `--test_tmpdir=` now resets a value from a bazelrc to
+    the default execroot temp directory instead of creating `_tmp` in
+    the
+    workspace. Use `--test_tmpdir=.` to retain workspace-relative
+    behavior.
+  - Bind mounts specified via `--sandbox_add_mount_pair` (or
+    `-M`/`-m` flags in `linux-sandbox`) are now correctly remounted
+    read-only when using the hermetic sandbox (with
+    `--experimental_sandbox_hermetic`). Build actions that write to
+    these paths will now fail with a read-only filesystem error.
+  - `--use_target_platform_for_tests` is now a no-op. By default,
+    tests are executed on an execution platform that has all
+    constraints of the target platform, making this flag obsolete. To
+    migrate, make sure that your target platform or a platform with
+    at least the same constraints is registered as an execution
+    platform.
+
+New features:
+
+  - `--worker_sandboxing` can now be scoped per worker-key mnemonic
+    with `--worker_sandboxing=<mnemonic>=<boolean>`.
+
+Important changes:
+
+  - If --incompatible_symbolic_macro_strict_attrs is enabled,
+    invalid attribute values in symbolic macros fail the build
+    (matching
+    the behavior of rules).
+  - Added a new `instance_id` field to the `BuildMetrics` BES event,
+    in order to help diff between the current and previous builds on
+    the running server.
+  - `--experimental_remote_scrubbing_config=` now disables remote
+    cache key scrubbing, allowing command-line overrides of scrubbing
+    configs set in .bazelrc.
+  - "$ bazel config x86-opt": you can now inspect configs based on
+    output path prefixes, not just config checksum prefixes.
+  - The JDK bundled with Bazel has been updated to 26.
+  - Action rewinding (`--rewind_lost_inputs`) can now succeed even if
+    the remote cache doesn't verify that AC entries aren't stale.
+  - Running `bazel shutdown` no longer results in stale lockfile data
+    being written.
+  - Starlark debug server now binds to the configured address
+    (defaulting to 127.0.0.1) via
+    --experimental_skylark_debug_server_address.
+
+This release contains contributions from many people at Google, as well as Adin Cebic, Alexander Scott, Armando Montanez, Dan Halperin, David Zbarsky, Fabian Meumertzheim, Fabian Meumertzheim, giria660, Guillaume Maudoux, Han-Wen Nienhuys, jcater, Keith Smiley, Kobi Hikri, Son Luong Ngoc, Steve Barrau, Tamir Duberstein, teaugene, Yossi Eliaz, zozo123.
+
 ## Release 10.0.0-pre.20260710.1 (2026-07-22)
 
 ```