)]}'
{
  "log": [
    {
      "commit": "03551fc150eb403b57d54e2d282eee1d750ee71b",
      "tree": "3608885ba2bc2586b80b4321dce0d0ec182a9c12",
      "parents": [
        "8c7747def1685ffa72270d10c54d2362d50b2f0e"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Thu Oct 22 10:35:53 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 22 14:35:53 2026 +0000"
      },
      "message": "Delete bazel-bazel-macos-ninja (#2952)\n\nThis pipeline appears to be unused. This will supercede #2929. There\nappear to be no builds:\nhttps://buildkite.com/bazel/bazel-bazel-macos-ninja.\n\nPart of b/534354348.\n\nCloses #2929."
    },
    {
      "commit": "8c7747def1685ffa72270d10c54d2362d50b2f0e",
      "tree": "df7744b0f81ae3eff9b84575f90b53e015308b56",
      "parents": [
        "3a8452f9e072e62598fdfa9e754aa56a4f731f22"
      ],
      "author": {
        "name": "Salma Samy",
        "email": "16399431+SalmaSamy@users.noreply.github.com",
        "time": "Thu Oct 22 12:15:34 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 22 14:15:34 2026 +0200"
      },
      "message": "Use all four us-central1 zones for regional MIGs (#2954)\n\n### Issue description\nWhen `gcloud compute instance-groups managed create` creates a regional\nMIG with `--region\u003dus-central1` and no `--zones` flag, GCE defaults to 3\nzones (`us-central1-b`, `us-central1-c`, `us-central1-f`) and never uses\n`us-central1-a`, reducing available capacity during stockouts.\n\n### How this PR solves it\n- Set `zones: us-central1-a,us-central1-b,us-central1-c,us-central1-f`\nunder `default_vm` in `buildkite/instances.yml`.\n- Pop `zones` in `buildkite/create_instances.py` and pass `--zones` when\ncreating regional MIGs.\n\nNote: This takes effect when each group is recreated with\n`create_instances.py`."
    },
    {
      "commit": "3a8452f9e072e62598fdfa9e754aa56a4f731f22",
      "tree": "e898bb579d87d8db818912158a91e70be3fbe96a",
      "parents": [
        "a1cac6acda7cb724b2e511758a64abc681238f64"
      ],
      "author": {
        "name": "Florian Weikert",
        "email": "fwe@google.com",
        "time": "Thu Oct 22 00:32:53 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 22 00:32:53 2026 +0200"
      },
      "message": "Hack: Fetch Bazel commit archive from GitHub (#2946)\n\nGooglesource.com is very unreliable for unauthenticated requests, so\nwe\u0027ll fetch the code from GitHub instead.\n\nExample:\nhttps://buildkite.com/bazel/google-bazel-presubmit/builds/111566#annotation-\u0027diff_failed\u0027"
    },
    {
      "commit": "a1cac6acda7cb724b2e511758a64abc681238f64",
      "tree": "8b93f372cc6c1d3988bf78da89ad6cedd003b27e",
      "parents": [
        "3d438d93de1642c681741dc62ede01f561303b2e"
      ],
      "author": {
        "name": "Xùdōng Yáng",
        "email": "wyverald@gmail.com",
        "time": "Wed Oct 21 15:59:16 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Oct 21 15:59:16 2026 -0400"
      },
      "message": "Skip cloning the repo in the first step of Google Bazel Presubmit, take 2 (#2938)\n\nReland of https://github.com/bazelbuild/continuous-integration/pull/2930\n\n### Original change description\n\nBy default, all \"command\" steps in a Buildkite job will clone the git\nrepo associated with the Buildkite pipeline. We can skip this checkout\nby setting `checkout: skip: true` in the step config.\n\nWe do this for the first step of Google Bazel Presubmit, which doesn\u0027t\nactually need more than the presubmit.yml file (except for checking if\nmodified files include sensitive yaml files -- which we now disable with\nan environment variable). To get the presubmit.yml, we directly fetch it\nfrom googlesource, though it\u0027s base64-encoded -- so we decode it.\n\n### Difference from\nhttps://github.com/bazelbuild/continuous-integration/pull/2930\n\nIt turns out `checkout: skip: true` is implemented as setting the\nenvironment variable `BUILDKITE_SKIP_CHECKOUT`, which propagates to all\nprinted steps. So the fix is simply to print all steps in bazelci.py\nwith `checkout: skip: false` by default. Conveniently, we can also skip\nthe checkout for the very last step (\"print shard summary\").\n\nAlso, the printed steps inherit the `--file_config` flag from the first\nstep, so we actually have to use `.bazelci/presubmit.yml` instead of\njust `presubmit.yml`.\n\n### Tested\n\nbazel-testing run:\nhttps://buildkite.com/bazel-testing/bazel-bazel-github-presubmit/builds/394/list?sid\u003d01a120c8-0420-4491-8245-685cfdbbcadf\u0026tab\u003doutput"
    },
    {
      "commit": "3d438d93de1642c681741dc62ede01f561303b2e",
      "tree": "7add3e329c987d64ed7b7f6cfb4679f27e34ba27",
      "parents": [
        "baa7d497bb757b519ccf16479be7f67820f7efc3"
      ],
      "author": {
        "name": "Salma Samy",
        "email": "16399431+SalmaSamy@users.noreply.github.com",
        "time": "Wed Oct 21 13:18:53 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Oct 21 15:18:53 2026 +0200"
      },
      "message": "Record per-agent snapshots in BigQuery (#2948)\n\n#### Issue description\n`infra_stats` only records aggregate agent counts per pool\n(`total_agents`, `busy_agents`, `idle_agents`), which cannot detect\nindividual agents that are stuck running a job for hours, stuck\ncanceling, paused, or idle while jobs are waiting in the queue.\n\n#### How this PR solves it\nA new table was added for agents and `collect_infra_metrics.py` now\nwrites agens data into\n`bazel-untrusted.bazel_ci_metrics.agent_snapshots`, reusing the agent\nlist already fetched from the Buildkite API and the poll `timestamp`\nfrom `infra_stats`."
    },
    {
      "commit": "baa7d497bb757b519ccf16479be7f67820f7efc3",
      "tree": "544e739c633b0d68b0c1cd9eb9b3a348728a8b98",
      "parents": [
        "08aee4f4db0482686cf9061d42c3196b68da17bc"
      ],
      "author": {
        "name": "Florian Weikert",
        "email": "fwe@google.com",
        "time": "Tue Oct 20 23:31:04 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 20 23:31:04 2026 +0200"
      },
      "message": "Lower priority for builds started by renovate bot (#2947)\n\nThis is a temporary workaround - eventually we should implement some\nsort of rate limiting."
    },
    {
      "commit": "08aee4f4db0482686cf9061d42c3196b68da17bc",
      "tree": "047d5f4e24b4b2be9f44b68d6ef4a10316d13e81",
      "parents": [
        "06aa02442461f20ce3a8c6700af0ec6b032c048f"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Tue Oct 20 14:14:25 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 20 12:14:25 2026 +0000"
      },
      "message": "Remove broken uuid symlink from bcr-pr-reviewer node_modules (#2945)\n\n## Problem\n\n#2913 removed the `uuid` package from\n`actions/bcr-pr-reviewer/node_modules`, but it kept the symlink\n`node_modules/.bin/uuid`. This symlink now points to a missing file\n(`../uuid/dist/bin/uuid`).\n\nGitHub Actions cannot download an action that has a broken symlink. All\nBCR workflows that use `bcr-pr-reviewer` at f28b08be failed with:\n\n```\nCould not find file \u0027.../actions/bcr-pr-reviewer/node_modules/.bin/uuid\u0027.\n```\n\nFailed run:\nhttps://github.com/bazelbuild/bazel-central-registry/actions/runs/37949666240/job/113884858819\nRollback:\nhttps://github.com/bazelbuild/bazel-central-registry/pull/11006\n\n## Fix\n\nRemove the broken symlink. No other broken symlinks exist under\n`actions/`. `uuid` is not in `package.json` or `package-lock.json`.\n\nAfter this PR is merged, the BCR workflows can be updated to the new\ncommit again."
    },
    {
      "commit": "06aa02442461f20ce3a8c6700af0ec6b032c048f",
      "tree": "6ae09362733fadfe4a111c3281505b137d9459e4",
      "parents": [
        "1eb3a9ac5c865cdf5c2c08a20777d6b6c9ec5b3f"
      ],
      "author": {
        "name": "Salma Samy",
        "email": "16399431+SalmaSamy@users.noreply.github.com",
        "time": "Mon Oct 19 11:18:12 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 19 13:18:12 2026 +0200"
      },
      "message": "Record expected agent pool size in infra_stats (#2932)\n\n### Issue description\n`infra_stats` records how many agents are connected, but not how many\nthere should be. To alert when a pool drops (e.g. below 25% of its\nsize), the expected size has to be hardcoded in the alert. Also, a pool\nwith 0 agents and no queued jobs writes no row at all, so a completely\ndead pool looks like \"no data\" instead of \"0 agents\".\n\n### How this PR solves it\n`collect_infra_metrics.py` now writes an `expected_agents` value with\nevery row:\n- Linux, arm64 and Windows pools: the `count` from `instances.yml`.\n- Mac pools (managed outside GCP): the highest `total_agents` seen in\nthe last 7 days.\n- If the lookup fails, the value is left empty and the poller carries\non.\n\nPools with an expected size now always get a row, even when they have 0\nagents.\n\nThe `expected_agents` column already exists in BigQuery and has been\nbackfilled for the last 3 months."
    },
    {
      "commit": "1eb3a9ac5c865cdf5c2c08a20777d6b6c9ec5b3f",
      "tree": "49f6bd8f6770c2a2f6cd1a344322a01708d23299",
      "parents": [
        "07fa042e1492acc6c75061dab00b9618e5f2a42c"
      ],
      "author": {
        "name": "hvadehra",
        "email": "hvd@google.com",
        "time": "Mon Oct 12 11:50:37 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 12 09:50:37 2026 +0000"
      },
      "message": "Update java_tools-release.yml (#2941)\n\nDrop `venv` creation and `pip install`. That needs more packages to be\ninstalled to work, instead we\u0027ll update the release process to not\nrequire any additional packages.\n\n\u003c!--\nThank you for contributing to Bazel CI!\nBefore submitting a pull request, please read the contribution\nguidelines:\n\nhttps://github.com/bazelbuild/continuous-integration/blob/master/CONTRIBUTING.md\n--\u003e\n\n### Issue description\n\u003c!--\nDescribe the problem, bug, or need this PR addresses.\nIf there is an existing issue, link it here (e.g. \"Fixes #1234\").\n--\u003e\n\n### How this PR solves it\n\u003c!--\nProvide a brief summary of the change and why this approach was chosen.\n--\u003e\n\n### Testing\n\u003c!--\nDescribe how this change was verified (e.g. a Buildkite build link on\nbazel-testing, or a local test run), or explain why testing is not\nneeded.\n--\u003e"
    },
    {
      "commit": "07fa042e1492acc6c75061dab00b9618e5f2a42c",
      "tree": "26c2734d356ddf6924d2e4de3ed5498225e1cf02",
      "parents": [
        "c3216e80e901104710e2a993e9e0a4af4738cbd4"
      ],
      "author": {
        "name": "hvadehra",
        "email": "hvd@google.com",
        "time": "Fri Oct 09 16:21:22 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 09 16:21:22 2026 +0200"
      },
      "message": "Update java_tools-release.yml (#2940)\n\n### Issue description\nBroken after\nhttps://github.com/bazelbuild/continuous-integration/pull/2850 which\nenabled https://peps.python.org/pep-0668/\n\n### How this PR solves it\nUse a venv for pip install.\n\n### Testing\nn/a"
    },
    {
      "commit": "c3216e80e901104710e2a993e9e0a4af4738cbd4",
      "tree": "fdf66c61eed89b001a3a92bfa8b180d6b7ad18e3",
      "parents": [
        "8523aca943ddb3cd696cec0a4c953ae41a095f30"
      ],
      "author": {
        "name": "KarolinaKalin",
        "email": "160865751+KarolinaKalin@users.noreply.github.com",
        "time": "Fri Oct 09 16:14:09 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 09 10:14:09 2026 -0400"
      },
      "message": "Update nginx.conf (#2939)"
    },
    {
      "commit": "8523aca943ddb3cd696cec0a4c953ae41a095f30",
      "tree": "3b753d4b48c53c32b804539b92693fe2e07c748f",
      "parents": [
        "2d09e5ce81836f80d15dc38903eedde538b09cca"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Thu Oct 08 15:21:43 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 08 15:21:43 2026 +0200"
      },
      "message": "Revert \"Skip cloning the repo in the first step of Google Bazel Presubmit\" (#2934)\n\nReverts bazelbuild/continuous-integration#2930"
    },
    {
      "commit": "2d09e5ce81836f80d15dc38903eedde538b09cca",
      "tree": "0cd68ddbea3285d853dcf8168619353a7c164a14",
      "parents": [
        "5a641b0866aacbdcff2a5dd6e2b419646ead35ec"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Thu Oct 08 14:54:16 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 08 12:54:16 2026 +0000"
      },
      "message": "Fix docker image hash update script (#2922)\n\nSimplifies and improves the automated hash update process. Move away\nfrom distro + architecture-aware update to more generic token-based\nfind-and-replace. This fixes a bug where arm64 image digests were not\nproperly updated in TF files\n\nThis generates\nhttps://github.com/bazelbuild/continuous-integration/pull/2923."
    },
    {
      "commit": "5a641b0866aacbdcff2a5dd6e2b419646ead35ec",
      "tree": "decd2350d4631ee5796ecd76c69e79d71341f140",
      "parents": [
        "1536c87d49245577d30e89cd5d2994567f403485"
      ],
      "author": {
        "name": "Xùdōng Yáng",
        "email": "wyverald@gmail.com",
        "time": "Thu Oct 08 14:49:30 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 08 14:49:30 2026 +0200"
      },
      "message": "Skip cloning the repo in the first step of Google Bazel Presubmit (#2930)\n\nBy default, all \"command\" steps in a Buildkite job will clone the git\nrepo associated with the Buildkite pipeline. We can skip this checkout\nby setting `checkout: skip: true` in the step config.\n\nWe do this for the first step of Google Bazel Presubmit, which doesn\u0027t\nactually need more than the presubmit.yml file (except for checking if\nmodified files include sensitive yaml files -- which we now disable with\nan environment variable). To get the presubmit.yml, we directly fetch it\nfrom googlesource, though it\u0027s base64-encoded -- so we decode it."
    },
    {
      "commit": "1536c87d49245577d30e89cd5d2994567f403485",
      "tree": "f20abb1521b9a02e80ab3a30ac0ea33ad2db136f",
      "parents": [
        "3e5877a297bfd58c408c6b49c0993a847a1cc053"
      ],
      "author": {
        "name": "David Ostrovsky",
        "email": "david@ostrovsky.org",
        "time": "Thu Oct 08 14:03:58 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 08 14:03:58 2026 +0200"
      },
      "message": "Update gerrit pipelines (#2928)\n\nUpdate Ubuntu version to 2404. For rbe build disable polygerrit build\nand limit rbe tests to javatests."
    },
    {
      "commit": "3e5877a297bfd58c408c6b49c0993a847a1cc053",
      "tree": "416b87bbbc738036c1f7bddb9502a016a8375f47",
      "parents": [
        "f28b08bed03847693d6f1e0518d8882a6fb0b32a"
      ],
      "author": {
        "name": "Salma Samy",
        "email": "16399431+SalmaSamy@users.noreply.github.com",
        "time": "Thu Oct 08 11:46:59 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 08 13:46:59 2026 +0200"
      },
      "message": "Add pull request template (#2926)\n\nAdd `.github/pull_request_template.md` with sections for the issue\ndescription, solution summary, and testing details.\nIt also links to `CONTRIBUTING.md` for CLA and contribution\nrequirements."
    },
    {
      "commit": "f28b08bed03847693d6f1e0518d8882a6fb0b32a",
      "tree": "2fce6ef0c74e50a7ea2712cc85bc0a7c83ec4eb0",
      "parents": [
        "4c592c07c339b8d2e8b701f4e77dc97c00d7cf58"
      ],
      "author": {
        "name": "Florian Weikert",
        "email": "fwe@google.com",
        "time": "Wed Oct 07 16:34:24 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Oct 07 16:34:24 2026 +0200"
      },
      "message": "Fix Windows args (#2927)"
    },
    {
      "commit": "4c592c07c339b8d2e8b701f4e77dc97c00d7cf58",
      "tree": "39203b57608a64e867b7a9fef10bd8dcf6c979a8",
      "parents": [
        "12df737d29511cf3a474b9ffa3f426fa8363547c"
      ],
      "author": {
        "name": "Florian Weikert",
        "email": "fwe@google.com",
        "time": "Tue Oct 06 18:18:11 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 18:18:11 2026 +0200"
      },
      "message": "Enable remote caching in bazel-release pipeline (#2925)\n\nConfigure RBE caching for Linux and Windows, and GCS caching for macOS,\nusing cache-silo-key\u003dbazel-release for cache isolation."
    },
    {
      "commit": "12df737d29511cf3a474b9ffa3f426fa8363547c",
      "tree": "ac780f356f23771d83b802756d288e68d6a25a17",
      "parents": [
        "618f68827b3b5f307699a51cd56bae98155694fd"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Tue Oct 06 16:18:42 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 16:18:42 2026 +0200"
      },
      "message": "Increase instance counts for Windows builds (#2924)\n\nTested manually, we do have enough quota"
    },
    {
      "commit": "618f68827b3b5f307699a51cd56bae98155694fd",
      "tree": "d30cc0db4e08d4f89f4be0fc806cccfb2d42b9ac",
      "parents": [
        "7db0defd1a29b86420123f806e43ecba22cb40bf"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Tue Oct 06 16:04:01 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 16:04:01 2026 +0200"
      },
      "message": "Rename mirror-404-artifacts-for-bazel to mirror-bazel-external-deps and use tools/mirror_external_deps.py (#2912)\n\nRename the `mirror-404-artifacts-for-bazel` pipeline to\n`mirror-bazel-external-deps` (\"Mirror Bazel External Deps\") and update\nit to check out `bazelbuild/bazel` and run\n`./tools/mirror_external_deps.py --upload` to discover and upload\nmissing external repository URLs to `gs://bazel-mirror`, replacing\n`buildkite/mirror_404_downloads.py`."
    },
    {
      "commit": "7db0defd1a29b86420123f806e43ecba22cb40bf",
      "tree": "6a113267272083eb06a29904b017bccbae76c356",
      "parents": [
        "74e122681ccc9882a2d1d6aa87206078a7350d3c"
      ],
      "author": {
        "name": "Florian Weikert",
        "email": "fwe@google.com",
        "time": "Tue Oct 06 04:13:55 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 04:13:55 2026 +0200"
      },
      "message": "Fix rockylinux8-java8 arm64 hash (#2920)\n\n\"Test on Rocky Linux 8 (arm64)\" in bazel-release.yml pulls the amd\nimage, thus failing.\n\nThis is an addendum to\nhttps://github.com/bazelbuild/continuous-integration/pull/2918. The\nculprit is\nhttps://github.com/bazelbuild/continuous-integration/pull/2909"
    },
    {
      "commit": "74e122681ccc9882a2d1d6aa87206078a7350d3c",
      "tree": "a048ccc2ca668dd63c120b690fab9d6ff431091b",
      "parents": [
        "1d1be701d78af57d4ba05fe3939a704c109523c2"
      ],
      "author": {
        "name": "Florian Weikert",
        "email": "fwe@google.com",
        "time": "Mon Oct 05 22:48:39 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 22:48:39 2026 +0200"
      },
      "message": "Fix incorrect rockylinux8-releaser sha on ARM64 (#2918)\n\nhttps://github.com/bazelbuild/continuous-integration/pull/2909 used the\namd sha for both amd and arm64"
    },
    {
      "commit": "1d1be701d78af57d4ba05fe3939a704c109523c2",
      "tree": "05e1524bcce6e98b1c0c1bb5e83392a8730738db",
      "parents": [
        "16995f47d427aa133bd608d0366d0e3ff6475d99"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Mon Oct 05 13:45:45 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 11:45:45 2026 +0000"
      },
      "message": "Add BCR downstream test script and pipeline (#2875)\n\nAdds `bcr_downstream.py` and the `BCR Downstream Test` pipeline. The\npipeline tests whether a new BCR module version breaks the modules that\ndirectly depend on it.\n\n- **Trigger**: a BCR PR with the `run-downstream-test` label, or a\nmanual build with `TARGET_MODULE` (e.g. `protobuf@latest`). A build\ntests one target module version. If a PR changes several, set\n`TARGET_MODULE` to pick one.\n- **Downstream modules**: the latest versions of the top 50 direct\ndependents of the target, ranked by BCR PageRank\n(`//tools:module_analyzer --dependents_of`).\n- **Override**: each job vendors the target with `bazel vendor` and adds\n`--override_module\u003d\u003ctarget\u003e\u003d\u003cvendored_path\u003e` to the downstream module\u0027s\n`.bazelrc`. This covers both anonymous module and `bcr_test_module`\ntasks.\n- **Bazel versions**: downstream tasks use the Bazel versions in their\nown `presubmit.yml`. Tasks on a major version that the target doesn\u0027t\ntest are skipped. If `USE_BAZEL_VERSION` is set, all tasks run with that\nversion instead. The target is vendored with each task\u0027s Bazel version,\nor `7.x` for Bazel 6, which has no `bazel vendor`.\n- **Options**: `SELECT_TOP_BCR_MODULES`, `MODULE_SELECTIONS`,\n`SMOKE_TEST_PERCENTAGE`, `EXCLUDE_DEV_DEPS` and `USE_BAZEL_VERSION` can\nbe set as environment variables, or in lowercase under\n`bcr_downstream_test` in the target\u0027s `presubmit.yml`. Environment\nvariables take precedence.\n- **CI usage**: by default, jobs use up to 10% of machines per queue\n(`CI_RESOURCE_PERCENTAGE`), in a separate\n`bcr-downstream-test-queue-\u003cqueue\u003e` concurrency group so they don\u0027t\nstarve `bcr-presubmit`. Job priority is -50, or -100 with the\n`low-ci-priority` label.\n\nThe pipeline is added in terraform and documented in the README.\n\nUses `--dependents_of` from\nhttps://github.com/bazelbuild/bazel-central-registry/pull/10649."
    },
    {
      "commit": "16995f47d427aa133bd608d0366d0e3ff6475d99",
      "tree": "d481bfeb54a4e3b1364205588b80aa6777d9b6c4",
      "parents": [
        "ed22a2ccb9136e7d92bf21886ea5515ea2ea3af0"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Mon Oct 05 13:23:41 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 13:23:41 2026 +0200"
      },
      "message": "Fix presubmit and postsubmit path handling vulnerabilities (#2917)\n\nAddresses b/569811973.\n\n- `bcr_presubmit.py`: Uses `git diff -z` to parse quoted paths\ncorrectly, preventing a bypass of symlink validations.\n- `bcr_postsubmit.py`: Verifies that the resolved path of the\ndestination attestation file is contained within the expected output\ndirectory using `pathlib.Path.resolve()`, preventing arbitrary file\nwrites via malicious symlinks."
    },
    {
      "commit": "ed22a2ccb9136e7d92bf21886ea5515ea2ea3af0",
      "tree": "7f2a8cdcccbd29bfb48785b2f254a185f4319157",
      "parents": [
        "3ed413730810ae9ffdacc9094c8cc63ded9f2807"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Mon Oct 05 13:19:05 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 11:19:05 2026 +0000"
      },
      "message": "Retry #2908 hash update (#2909)\n\nSame commit as before; should work now since the root cause of the prod\nCI RBE build failures (outdated mirror) has been resolved."
    },
    {
      "commit": "3ed413730810ae9ffdacc9094c8cc63ded9f2807",
      "tree": "f4786e749defa5c9ab154b8ddfd5abec888fe62d",
      "parents": [
        "54fb092c19fd7a91da5b6550f20b2c79f1193ee2"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Fri Oct 02 16:24:24 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 02 14:24:24 2026 +0000"
      },
      "message": "Allow instance groups to change zones when repairing VMs (#2914)\n\n## Summary\n\nEvery Linux and Windows agent VM runs a single job and then powers off\n(`disconnect-after-job\u003dtrue` + `ExecStopPost\u003d/bin/systemctl poweroff`).\nThe instance group then repairs the VM by recreating it, and by default\na repair must recreate the VM **in the same zone**. When that zone runs\nout of capacity, recreated VMs get stuck retrying there\n(`ZONE_RESOURCE_POOL_EXHAUSTED`), even if other zones in the region have\nroom. That\u0027s what happened to `bk-docker-arm64` and\n`bk-testing-docker-arm64` on 2026-10-01: all stuck VMs sat in\nus-central1-c.\n\nThis change sets\n[`--on-repair-allow-changing-zone\u003dyes`](https://cloud.google.com/compute/docs/instance-groups/autohealing-instances-in-migs)\nfor all regional instance groups so a repair can recreate the VM in\nanother zone. GCE requires `--force-update-on-repair` for that, which\nalso makes repaired VMs pick up the group\u0027s latest configuration.\n\n## Changes\n\n- `create_instances.py`: new `on_repair_allow_changing_zone` option.\nWhen it\u0027s set on a regional group, the MIG is created with\n`--force-update-on-repair --on-repair-allow-changing-zone yes`.\n- `instances.yml`: enable it in `default_vm`, so it applies to all\ninstance groups.\n\n## Notes\n\n- This doesn\u0027t reserve capacity, it only avoids getting stuck in one\nzone. Reservations would be needed to hold capacity across recreates.\n- Already enabled manually on `bk-testing-docker-arm64` and\n`bk-docker-arm64`. Other groups get it the next time\n`create_instances.py` recreates them.\n\n## Testing\n\nRan `create_instance_group()` against the real `instances.yml` with\n`gcloud` stubbed out. All 9 groups get both flags on the MIG create\ncommand, and instance templates are unchanged. `black --check` passes."
    },
    {
      "commit": "54fb092c19fd7a91da5b6550f20b2c79f1193ee2",
      "tree": "61b0f1f5656456e750b00172813d915b128305c4",
      "parents": [
        "2e6c3bb5d733faec36a7e45974a2a841969e91e6"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Fri Oct 02 16:02:34 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 02 14:02:34 2026 +0000"
      },
      "message": "Update dependencies (consolidate open Dependabot PRs) (#2913)\n\nConsolidates all open Dependabot PRs into a single update so they can be\nclosed.\n\n### Go (`go.mod`/`go.sum`)\n- `go.opentelemetry.io/otel` + `otel/sdk` (and related otel modules)\n1.44.0 → 1.45.0 (#2869, #2577)\n- Already at or above the target on master, so no change needed:\n`golang.org/x/crypto` (#2715), `golang.org/x/net` (#2708),\n`github.com/go-jose/go-jose/v4` (#2533)\n\n### dashboard/client\n- `next` + `@next/bundle-analyzer` 15.5.24 → 16.3.x, `postcss` → 8.5.28\n(#2762)\n- Next.js 16 removed `serverRuntimeConfig` / `next/config`, so\n`pages/api/[...slug].js` now reads `process.env.SERVER_URL` directly\n(same `http://localhost:8080` default). `tsconfig.json` gets the `jsx:\nreact-jsx` setting that Next 16 requires.\n- `query-string` 7 → 9.5.1, `decode-uri-component` → 0.5.0 (#2833)\n- `lodash` → 4.18.1 (#2527), `http-proxy-middleware` → 2.0.10 (#2690)\n- Transitive: `brace-expansion` 2.1.7 (#2905), `browserslist` 4.29.3\n(#2839), `postcss-selector-parser` 6.1.4 (#2837), `nanoid` 3.3.19\n(#2785), `ws` 7.5.13 (#2687), `follow-redirects` 1.16.1 (#2552),\n`picomatch` 2.3.2 (#2512), `yaml` 1.10.3 / 2.9.1 (#2511), `immutable`\n5.1.9 (#2494), `minimatch` 9.0.9 (#2479), `glob` 10.5.0 (#2406)\n- `micromatch` is already at 4.0.8, and `yarn.lock` no longer exists\n(#2028)\n\n### mintlify\n- `mint` → 4.2.970 (#2788, #2782), which brings `postcss` 8.5.23 and\n`js-yaml` 4.3.1\n- Transitive: `ip-address` 10.7.3 (#2894), `nanoid` 3.3.19 (#2787),\n`brace-expansion` 1.1.21 (#2773), `socket.io-parser` 4.2.7 (#2760),\n`body-parser` 1.20.8 (#2735)\n\n### actions\n- `bcr-pr-reviewer`, `release-helper`: `@actions/core` → 1.11.1, which\ndrops `uuid` (#2575, #2574). For `bcr-pr-reviewer`, the checked-in\n`node_modules` is updated too: `@actions/{core,exec,io}` are refreshed\nand `uuid` is removed.\n- `cherry_picker`, `update-lockfile`: `requests` 2.32.4 → 2.33.0 (#2516,\n#2515). `buildkite/docker/ubuntu1604` no longer exists (#2513).\n\n### agent\n- `bytes` 1.4.0 → 1.11.1 in `Cargo.lock` (#2453)\n\n### Testing\n- `go build ./...`\n- `next build` for dashboard/client\n- `mint version` for mintlify\n- `node --test` for actions/bcr-pr-reviewer (21/21 pass)\n\nCloses #2905, #2894, #2869, #2839, #2837, #2833, #2788, #2787, #2785,\n#2782, #2773, #2762, #2760, #2735, #2715, #2708, #2690, #2687, #2577,\n#2575, #2574, #2552, #2533, #2527, #2516, #2515, #2513, #2512, #2511,\n#2494, #2479, #2453, #2406, #2028"
    },
    {
      "commit": "2e6c3bb5d733faec36a7e45974a2a841969e91e6",
      "tree": "19f750f3988ca08122859d1b9b6c26baebf09b6d",
      "parents": [
        "210dbf1246211e799f5fd495bce0fcf34f0656b5"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Oct 02 15:24:26 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 02 15:24:26 2026 +0200"
      },
      "message": "Bump fast-uri from 3.1.2 to 3.1.8 in /mintlify (#2840)\n\nBumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.2 to\n3.1.8.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/releases\"\u003efast-uri\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.1.8\u003c/h2\u003e\n\u003ch2\u003e⚠️ Security Warning\u003c/h2\u003e\n\u003cp\u003eThis security release fixes the following medium-severity security\nadvisory:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj\"\u003eGHSA-hrr3-gc8f-f4qj\u003c/a\u003e\n— inconsistent host case normalization via percent-encoded octets\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eUsers of the v3.x release line should upgrade to v3.1.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/compare/v3.1.7...v3.1.8\"\u003ehttps://github.com/fastify/fast-uri/compare/v3.1.7...v3.1.8\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.1.7\u003c/h2\u003e\n\u003ch2\u003e⚠️ Security Warning\u003c/h2\u003e\n\u003cp\u003eThis is a security release that fixes the following high-severity\nsecurity advisories:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3\"\u003eGHSA-qw65-cvwx-89v3\u003c/a\u003e\n— authority injection via an unvalidated port in\n\u003ccode\u003eserialize()\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g\"\u003eGHSA-58mr-gqgx-xq4g\u003c/a\u003e\n— host confusion via unbalanced or misplaced IP-literal brackets\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eUsers of the v3.x release line should upgrade to v3.1.7.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/compare/v3.1.6...v3.1.7\"\u003ehttps://github.com/fastify/fast-uri/compare/v3.1.6...v3.1.7\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.1.6\u003c/h2\u003e\n\u003ch2\u003e⚠️ Security Warning\u003c/h2\u003e\n\u003cp\u003eThis release addresses the following high-severity security\nadvisories:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8\"\u003eGHSA-5jgf-p345-68v8\u003c/a\u003e\n— host confusion via skipped IDN canonicalization on scheme-relative\nreferences\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf\"\u003eGHSA-fph4-wmhf-6fwf\u003c/a\u003e\n— server-side request forgery via repeated hostname\npercent-decoding\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc\"\u003eGHSA-f65p-4m7j-42xc\u003c/a\u003e\n— server-side request forgery via malformed IPv6 normalization\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp\"\u003eGHSA-jqff-g426-hqxp\u003c/a\u003e\n— host confusion via percent-encoded scheme normalization\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eUsers of the v3.x release line should upgrade to v3.1.6.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/compare/v3.1.5...v3.1.6\"\u003ehttps://github.com/fastify/fast-uri/compare/v3.1.5...v3.1.6\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.1.5\u003c/h2\u003e\n\u003ch2\u003e⚠️ Security Warning\u003c/h2\u003e\n\u003cp\u003eFix for \u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7\"\u003ehttps://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/compare/v3.1.4...v3.1.5\"\u003ehttps://github.com/fastify/fast-uri/compare/v3.1.4...v3.1.5\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.1.4\u003c/h2\u003e\n\u003ch2\u003e⚠️ Security Release\u003c/h2\u003e\n\u003cp\u003eFix for \u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx\"\u003ehttps://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/compare/v3.1.3...v3.1.4\"\u003ehttps://github.com/fastify/fast-uri/compare/v3.1.3...v3.1.4\u003c/a\u003e\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/commit/ead3ab7bb134c989e972c8174632d0670023f269\"\u003e\u003ccode\u003eead3ab7\u003c/code\u003e\u003c/a\u003e\nBumped v3.1.8\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/commit/c88b59e3e3a20af1d5d6e499f48908d0fb12a66d\"\u003e\u003ccode\u003ec88b59e\u003c/code\u003e\u003c/a\u003e\nfix: normalize decoded reg-name case\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/commit/412e40abd4eb8beabfb952d80abf949a2baf27a3\"\u003e\u003ccode\u003e412e40a\u003c/code\u003e\u003c/a\u003e\nBumped v3.1.7\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/commit/9f4c943e4d2133e8d78e0941203879216255bb01\"\u003e\u003ccode\u003e9f4c943\u003c/code\u003e\u003c/a\u003e\nfix: backport port and IP-literal validation to v3.x (\u003ca\nhref\u003d\"https://redirect.github.com/fastify/fast-uri/issues/216\"\u003e#216\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/commit/1eb3ce436fe050807caba79f886ab894f485a588\"\u003e\u003ccode\u003e1eb3ce4\u003c/code\u003e\u003c/a\u003e\nfix: treat unterminated bracket hosts as reg-names again (\u003ca\nhref\u003d\"https://redirect.github.com/fastify/fast-uri/issues/214\"\u003e#214\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/commit/6f970b2951fd896aa0f3a7ff28eeb6640c137d33\"\u003e\u003ccode\u003e6f970b2\u003c/code\u003e\u003c/a\u003e\nBumped v3.1.6\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/commit/d941579a84273ec7e96bde596b1f7a8be447df2a\"\u003e\u003ccode\u003ed941579\u003c/code\u003e\u003c/a\u003e\nfix: never run IDN canonicalization on bracketed IP literals\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/commit/c0f0279cf370cb89ee56b04bbcde2a7afbe81aba\"\u003e\u003ccode\u003ec0f0279\u003c/code\u003e\u003c/a\u003e\ntest: adapt decoded-scheme handler assertion to 3.x (no mailto\nscheme)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862\"\u003e\u003ccode\u003e37f3417\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f\"\u003e\u003ccode\u003e607bfbe\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.8\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "210dbf1246211e799f5fd495bce0fcf34f0656b5",
      "tree": "d511ff95ea1d2d5e16004e5d2854b3d72f424104",
      "parents": [
        "811bfabadcb1bb1a5f32b1a388d49de3595065ca"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Oct 02 15:10:52 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 02 15:10:52 2026 +0200"
      },
      "message": "Bump next from 14.2.28 to 15.5.24 in /dashboard/client (#2845)\n\nBumps [next](https://github.com/vercel/next.js) from 14.2.28 to 15.5.24.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/vercel/next.js/releases\"\u003enext\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev15.5.24\u003c/h2\u003e\n\u003cp\u003eThis release contains security fixes for the following\nadvisories:\u003c/p\u003e\n\u003cp\u003eCritical:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36\"\u003eUnauthenticated\nRemote Code Execution on windows-hosted servers\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4\"\u003eUnauthenticated\nRemote Code Execution in Image Optimization API when AVIF files are\nused\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev15.5.23\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e[15.x] Port ReplyServer traversal guards to FlightClient \u003ca\nhref\u003d\"https://github.com/eps1lon\"\u003e\u003ccode\u003e@​eps1lon\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/vercel/next.js/pull/96405\"\u003evercel/next.js#96405\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/vercel/next.js/compare/v15.5.22...v15.5.23\"\u003ehttps://github.com/vercel/next.js/compare/v15.5.22...v15.5.23\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev15.5.22\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e[15.5] Reject TypeScript \u0026gt;\u003d 7.0 with an actionable error by \u003ca\nhref\u003d\"https://github.com/lukesandberg\"\u003e\u003ccode\u003e@​lukesandberg\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/vercel/next.js/pull/96110\"\u003evercel/next.js#96110\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/vercel/next.js/compare/v15.5.21...v15.5.22\"\u003ehttps://github.com/vercel/next.js/compare/v15.5.21...v15.5.22\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev15.5.21\u003c/h2\u003e\n\u003cp\u003eThis release contains security fixes for the following\nadvisories:\u003c/p\u003e\n\u003cp\u003eHigh:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj\"\u003eDenial\nof Service in App Router using Server Actions\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24\"\u003eMiddleware\n/ Proxy bypass in App Router applications using Turbopack and single\nlocale\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4\"\u003eServer-Side\nRequest Forgery in rewrites via attacker-controlled destination\nhostname\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x\"\u003eServer-Side\nRequest Forgery in Server Actions on custom servers\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eModerate:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742\"\u003eCache\nconfusion of response bodies for requests with bodies\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q\"\u003eCache\nconfusion of response bodies for requests with bodies containing invalid\nUTF-8 byte sequences\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch\"\u003eDenial\nof Service in the Image Optimization API using SVGs\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp\"\u003eUnauthenticated\ndisclosure of internal Server Function endpoints\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3\"\u003eUnbounded\nServer Action payload in Edge runtime\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/commit/b6c45b4042ff5c5b700831887115da3fc2bd2b1f\"\u003e\u003ccode\u003eb6c45b4\u003c/code\u003e\u003c/a\u003e\nv15.5.24\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3\"\u003e\u003ccode\u003eb0f3460\u003c/code\u003e\u003c/a\u003e\n[15.5.x] Fix ISR misses with backslashes in segments when deployed on\nWindows\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/commit/409772ec807def20132d251ad48fd8d8ad4c73c2\"\u003e\u003ccode\u003e409772e\u003c/code\u003e\u003c/a\u003e\n[15.5.x] [next/image]: disable avif image optimization\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/commit/9c44b882b7a2adcc9a7b3ebe3c302ad8f7fe28f3\"\u003e\u003ccode\u003e9c44b88\u003c/code\u003e\u003c/a\u003e\n[15.x] support sharp 0.34 and 0.35\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/commit/144fa5d4fdb0507770c4904905d66b2c205f1b3c\"\u003e\u003ccode\u003e144fa5d\u003c/code\u003e\u003c/a\u003e\n[15.5.x] Remove generated error codes (\u003ca\nhref\u003d\"https://redirect.github.com/vercel/next.js/issues/97783\"\u003e#97783\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/commit/ddd94f0ab8c12a8504a311e10f6c161d343785f4\"\u003e\u003ccode\u003eddd94f0\u003c/code\u003e\u003c/a\u003e\n[15.5.x] Authenticate Turborepo remote caching with OIDC instead of a\nstatic ...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/commit/1da7a0a04975be60159e306d010054fac48502ca\"\u003e\u003ccode\u003e1da7a0a\u003c/code\u003e\u003c/a\u003e\n[15.5] [ci] Use OIDC tokens to read private preview builds (\u003ca\nhref\u003d\"https://redirect.github.com/vercel/next.js/issues/97259\"\u003e#97259\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/commit/70ab0fe6256d77a15e71c446cbcbbf5bf89b3b94\"\u003e\u003ccode\u003e70ab0fe\u003c/code\u003e\u003c/a\u003e\n[15.x] Default deploy e2e tests to the repo next version (\u003ca\nhref\u003d\"https://redirect.github.com/vercel/next.js/issues/96899\"\u003e#96899\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/commit/e57d564456b23ec1149a1bfeb297af40bf9d3f59\"\u003e\u003ccode\u003ee57d564\u003c/code\u003e\u003c/a\u003e\nv15.5.23\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/commit/c4914aa654e0748af49240d488285e2d745fdcdf\"\u003e\u003ccode\u003ec4914aa\u003c/code\u003e\u003c/a\u003e\n[15.x] Port ReplyServer traversal guards to FlightClient (\u003ca\nhref\u003d\"https://redirect.github.com/vercel/next.js/issues/96405\"\u003e#96405\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/vercel/next.js/compare/v14.2.28...v15.5.24\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eMaintainer changes\u003c/summary\u003e\n\u003cp\u003eThis version was pushed to npm by \u003ca\nhref\u003d\"https://www.npmjs.com/~GitHub%20Actions\"\u003eGitHub Actions\u003c/a\u003e, a new\nreleaser for next since your current version.\u003c/p\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dnext\u0026package-manager\u003dnpm_and_yarn\u0026previous-version\u003d14.2.28\u0026new-version\u003d15.5.24)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the\n[Security Alerts\npage](https://github.com/bazelbuild/continuous-integration/network/alerts).\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "811bfabadcb1bb1a5f32b1a388d49de3595065ca",
      "tree": "df9b630eb33514d1bbe81dda75fcb6fb5731b037",
      "parents": [
        "a385e04f6ffa2652c599a254a6144666de269b8f"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Thu Oct 01 17:40:11 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 01 11:40:11 2026 -0400"
      },
      "message": "Add @bazel-io review comment command to BCR PR reviewer (#2901)\n\nAdd a `@bazel-io review` comment command to the BCR PR reviewer. It runs\nthe same review as the scheduled `review_prs` job, but only for the PR\nit\u0027s commented on.\n\n`review_prs` is scheduled every 20 minutes, but GitHub doesn\u0027t honor the\nschedule: in practice it runs every 3-5 hours, even though each run\ntakes less than 2 minutes. So PRs already approved by their module\nmaintainers can wait hours to be merged. With this command, anyone can\nask the bot to review and merge a PR right away.\n\n- **Trigger:** comment exactly `@bazel-io review` on a BCR PR. It\u0027s\nhandled by the existing `handle_comment` action type, and BCR\u0027s\n`handle_comment.yml` already runs for PR comments starting with\n`@bazel-io `, so no new workflow trigger is needed.\n- **Behavior:** the bot reacts 👀, waits for running `dismiss_approvals`\nworkflow runs (like `review_prs` does), then calls `reviewPR` for the\nPR. It reacts 🚀 if the PR was merged. Otherwise it replies with the\nreason: draft PR, more than 500 changed files, no module versions\nmodified, modules still missing maintainer approval, sensitive\n`metadata.json` changes or a new module, or approved but the merge\nfailed (usually pending or failing presubmit checks).\n- **Permissions:** anyone can use the command. It doesn\u0027t loosen any\nrule: the PR is still only approved and merged when every modified\nmodule has a maintainer approval on the current head and the required\nchecks pass.\n- **Refactoring:** `reviewPR` now returns `{ merged, message }`, and\n`runHandleComment` dispatches between `@bazel-io abandon` and `@bazel-io\nreview`. The scheduled `review_prs` job ignores the return value, so its\nbehavior is unchanged.\n- **Tests:** added `index.test.js` cases for the command with a fake\noctokit (merge, missing approval, merge failure, sensitive metadata,\ndraft, and non-matching comments).\n\nCo-authored-by: Xùdōng Yáng \u003cwyverald@gmail.com\u003e"
    },
    {
      "commit": "a385e04f6ffa2652c599a254a6144666de269b8f",
      "tree": "45546142d7f5f48a04d85ba364300a2e901c310b",
      "parents": [
        "c7d434c28f75a70ac557a056e5030435405dadfd"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Thu Oct 01 10:49:50 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 01 10:49:50 2026 -0400"
      },
      "message": "Revert \"Update hashes\" (#2908)\n\nReverts bazelbuild/continuous-integration#2891\n\nCausing presubmit failures:\nhttps://buildkite.com/bazel/google-bazel-presubmit/builds/110444#01a0f7e7-6611-44a8-b72c-718b56096733"
    },
    {
      "commit": "c7d434c28f75a70ac557a056e5030435405dadfd",
      "tree": "57118b575ebe9f82b95704926caa14d30749177f",
      "parents": [
        "15dcbb19a73e7cc56fca914f7adf415a0d1a6da4"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Thu Oct 01 10:19:51 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 01 10:19:51 2026 -0400"
      },
      "message": "Update hashes (#2891)\n\n... to latest version (as of 2026-09-28). These should be from:\nhttps://buildkite.com/bazel-trusted/create-linux-docker-images/builds/106\n\nThis commit also updates the update script to upgrade versions in the\n`pipelines` directory and the Docker image pre-download in\n`setup-docker.sh`."
    },
    {
      "commit": "15dcbb19a73e7cc56fca914f7adf415a0d1a6da4",
      "tree": "45546142d7f5f48a04d85ba364300a2e901c310b",
      "parents": [
        "2e888e3e64c217ffff9f375c45ccd1f371fad7fe"
      ],
      "author": {
        "name": "Salma Samy",
        "email": "16399431+SalmaSamy@users.noreply.github.com",
        "time": "Thu Oct 01 09:47:29 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 01 09:47:29 2026 +0000"
      },
      "message": "Move arm64 runner pools to regional MIGs (#2906)\n\nFollowing\nhttps://github.com/bazelbuild/continuous-integration/pull/2870, this\nmoves the arm64 pools to regional MIGs as well by removing the zone pin.\nc4a-standard-8 and hyperdisk-balanced are available in\nus-central1-a/b/c/f."
    },
    {
      "commit": "2e888e3e64c217ffff9f375c45ccd1f371fad7fe",
      "tree": "0208c5aab96f5278308a72635a8f043538d95564",
      "parents": [
        "3795d4b7f8301c9a170c291a0a8b97b548cfed40"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Thu Oct 01 11:16:53 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 01 09:16:53 2026 +0000"
      },
      "message": "Don\u0027t let self-authored PRs break the BCR PR reviewer (#2904)\n\nFixes #2885\n\nGitHub doesn\u0027t let you review your own PR. So when a BCR PR was opened\nby @bazel-io (e.g. bazelbuild/bazel-central-registry#10700), the\n`APPROVE` `createReview` call in `reviewPR` threw. The error also\nescaped `runPrReviewer` and stopped the whole `review_prs` loop, which\nmeant no other open PRs got auto-reviewed either (e.g.\nbazelbuild/bazel-central-registry#10699).\n\n### Changes\n- `reviewPR`: when the PR author is the authenticated bot account, the\nreviewer doesn\u0027t call `createReview` (it skips both `APPROVE` and\n`REQUEST_CHANGES`). If every module has its maintainers\u0027 approval, it\nposts a comment (only once) and requests a review from `bcr-maintainers`\ninstead. It still tries to merge, so the PR gets merged on a later run\nonce a BCR maintainer approves.\n- `runPrReviewer`: errors are caught per PR, so a failure on one PR no\nlonger blocks the rest. If any PR failed, the run is marked failed at\nthe end (`setFailed`) so the errors still show up.\n- Export `reviewPR`/`runPrReviewer` and add unit tests for: the normal\napprove+merge path, a self-authored PR, and one PR failing while the\nloop keeps going.\n\n### Testing\n`cd actions/bcr-pr-reviewer \u0026\u0026 node --test`: all 12 tests pass.\n\nNote: BCR workflows pin this action by SHA, so a follow-up BCR PR that\nbumps the SHA is needed for this to take effect."
    },
    {
      "commit": "3795d4b7f8301c9a170c291a0a8b97b548cfed40",
      "tree": "beaad080227aec3af116c32c2052ba8dd14ecdeb",
      "parents": [
        "080f19d6e3dc22dbfc710090e211abc1bd48f32d"
      ],
      "author": {
        "name": "Salma Samy",
        "email": "16399431+SalmaSamy@users.noreply.github.com",
        "time": "Wed Sep 30 10:37:20 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 30 10:37:20 2026 +0000"
      },
      "message": "Disable commit verification for google-rules-{cc,java}-presubmit (#2902)\n\nFollowing #2890\n\nExtend the `BUILDKITE_GIT_COMMIT_VERIFICATION\u003doff` to cover:\n- `google-bazel-presubmit`\n- `google-rules-cc-presubmit`\n- `google-rules-java-presubmit`"
    },
    {
      "commit": "080f19d6e3dc22dbfc710090e211abc1bd48f32d",
      "tree": "a09d40957829eba84e272ced925896cb63ecca38",
      "parents": [
        "673109b66346c8e6a5807f0ccd9921697cbba213"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Mon Sep 28 18:43:57 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 28 16:43:57 2026 +0000"
      },
      "message": "Disable Buildkite commit verification for google-bazel-presubmit (#2890)\n\nNew images pick up **Buildkite agent v4** (the agent is installed\nunpinned from the apt `stable` channel / GitHub `releases/latest`).\nAgent v4 defaults `git-commit-verification` to `strict`, which breaks\nevery `google-bazel-presubmit` job that lands on a new VM, e.g.\nhttps://buildkite.com/bazel/google-bazel-presubmit/builds/110111:\n\n```\n$ git merge-base --is-ancestor 5f1bfb3f... 864445577c...\n🚨 Error: commit verification failed: commit \"5f1bfb3f...\" is not on branch \"master\"\n```\n\nThose builds are created with `branch\u003dmaster` but check out an\nunsubmitted Gerrit change, which is never an ancestor of master. Agents\nstill on 3.137.0 pass, so failures are intermittent while old and new\nVMs are mixed.\n\n### Change\nSet `BUILDKITE_GIT_COMMIT_VERIFICATION\u003doff` for `google-bazel-presubmit`\nonly, in the agent `environment` hook on Linux\n(`startup-docker-pdssd.sh`) and Windows (`startup-windows-pdssd.ps1`)."
    },
    {
      "commit": "673109b66346c8e6a5807f0ccd9921697cbba213",
      "tree": "c1a014919675a93a373126b59b39fe606338ea6a",
      "parents": [
        "402e9c71908c59bfa3c66cb1b5fb6ba62d80aaee"
      ],
      "author": {
        "name": "Salma Samy",
        "email": "16399431+SalmaSamy@users.noreply.github.com",
        "time": "Mon Sep 28 12:23:40 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 28 14:23:40 2026 +0200"
      },
      "message": "Drop --experimental_remote_merkle_tree_cache from Gerrit pipeline (#2888)\n\n`--experimental_remote_merkle_tree_cache` was removed in Bazel 9.0.0\n(https://github.com/bazelbuild/bazel/commit/30ca50950fdaff032925efe64c2690a9f05e074d),\ncausing the `rbe_ubuntu2204` test step in the Gerrit pipeline (now on\nBazel 9.1.0) to fail:\nhttps://buildkite.com/bazel-testing/gerrit/builds/5."
    },
    {
      "commit": "402e9c71908c59bfa3c66cb1b5fb6ba62d80aaee",
      "tree": "a1a97fc6738c329169a9ea60ea81f6f67b6f7d45",
      "parents": [
        "a02e18fd19ed74e46103e484190b99b98e4e2e7f"
      ],
      "author": {
        "name": "Florian Weikert",
        "email": "fwe@google.com",
        "time": "Fri Sep 25 17:17:51 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 25 17:17:51 2026 +0200"
      },
      "message": "Exclude non-CI config files from check (#2887)\n\nPreviously the check was also blocking changes to GitHub actions, e.g.\nhttps://buildkite.com/bazel/bazel-books-bazel-docs/builds/569/canvas?sid\u003d01a0d5d2-0eac-43af-b86f-2fc084f1d103\u0026open\u003dfalse."
    },
    {
      "commit": "a02e18fd19ed74e46103e484190b99b98e4e2e7f",
      "tree": "b0c201a5eeb04be1c58867cdd4893a5ee34523f2",
      "parents": [
        "6d801a6fec9c969fcad52a6ed448d6e4e0372fea"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Fri Sep 25 16:13:36 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 25 16:13:36 2026 +0200"
      },
      "message": "Add BCR module mirrors to .bazelrc for smoke tests (#2886)"
    },
    {
      "commit": "6d801a6fec9c969fcad52a6ed448d6e4e0372fea",
      "tree": "16ddc3d7848e107a96c7410c3c261639da404b20",
      "parents": [
        "fb5e3670f6be37b61e7c18adbd27e195eef0c5ae"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Thu Sep 24 15:59:53 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 24 15:59:53 2026 -0400"
      },
      "message": "Pin all docker image versions (#2881)\n\nRemaining unpinned images were in the trusted org and the RBE presubmit\nconfig."
    },
    {
      "commit": "fb5e3670f6be37b61e7c18adbd27e195eef0c5ae",
      "tree": "60327a4b6fcbe9e3b71a2f6c816f1c9602de9fc0",
      "parents": [
        "ff75ea29cea571f5768ac35534256eedd1bbed39"
      ],
      "author": {
        "name": "Chi Wang",
        "email": "chiwang@google.com",
        "time": "Thu Sep 24 17:57:06 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 24 15:57:06 2026 +0000"
      },
      "message": "Release bazel_ci_rules 2.1.2 (#2884)\n\nExpose apple_support, bazel_features, and bazel_skylib to generated RBE\ntoolchain repositories to support rules_cc 0.2.25+.\n\nAddressing https://github.com/bazelbuild/bazel/issues/31296."
    },
    {
      "commit": "ff75ea29cea571f5768ac35534256eedd1bbed39",
      "tree": "23c39ba945744f3950adba724cf3f598b4e6b693",
      "parents": [
        "13de6e938c6fa7bbe1040a03210a4ff6abae7ca7"
      ],
      "author": {
        "name": "Salma Samy",
        "email": "16399431+SalmaSamy@users.noreply.github.com",
        "time": "Thu Sep 24 13:47:18 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 24 09:47:18 2026 -0400"
      },
      "message": "Restore Docker installation on host machine in setup-docker.sh (#2883)\n\nPR #2821 intended to remove Docker-in-Docker installations from worker\ncontainer images, but accidentally also removed Docker from\n`buildkite/setup-docker.sh`.\n\n`setup-docker.sh` is the startup script for the host GCE Linux VM that\nhosts the Buildkite agent and runs CI jobs in Docker containers. Without\nDocker installed on the host, the VM image creation pipeline\n(`create-linux-vm-image`) [fails and\nhangs](https://buildkite.com/bazel-trusted/create-linux-vm-image/builds/48#01a0ceb7-375d-4ab2-a202-1d7dc31658b7)\nwith _`\"/etc/docker/daemon.json: No such file or directory\"`_ error.\n\nThis PR restores the Docker installation on the host VM.\n\nTODO: We also need to make sure such problems fail and not just hang\nthere for hours."
    },
    {
      "commit": "13de6e938c6fa7bbe1040a03210a4ff6abae7ca7",
      "tree": "151d93adda07196b3568e6c82a0c999a16bb632f",
      "parents": [
        "bd6a90eceb738c010fd1a9b472e8b6c894e6ea4e"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Thu Sep 24 11:10:58 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 24 09:10:58 2026 +0000"
      },
      "message": "Unset ANDROID_HOME and ANDROID_NDK_HOME on the macos platform (#2882)\n\nOur Intel Mac machines (`macos` platform) have an outdated Android SDK\nthat doesn\u0027t work with the latest rules_android, so unset `ANDROID_HOME`\nand `ANDROID_NDK_HOME` for all builds on that platform.\n\nThe variables are unset before the task\u0027s `environment` is applied, so\npipelines can still set them explicitly if needed. `macos_arm64` is\nunaffected."
    },
    {
      "commit": "bd6a90eceb738c010fd1a9b472e8b6c894e6ea4e",
      "tree": "3c061b4caefc42fecaa6a0c4e61956f6886f47c7",
      "parents": [
        "386a1651b86c94b7a89dd55494b3a5d320fa9dcf"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Wed Sep 23 10:07:26 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 23 14:07:26 2026 +0000"
      },
      "message": "Don\u0027t use gcr.io/bazel-public/testing (#2876)\n\nWe should use the same images in the testing BK org as in the prod BK\norgs."
    },
    {
      "commit": "386a1651b86c94b7a89dd55494b3a5d320fa9dcf",
      "tree": "4cdedb1ba1a3ed50f8e8d87d2e4391c394c65704",
      "parents": [
        "d8389959c3529e679517d70bc2c6275af371eef5"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Wed Sep 23 14:15:57 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 23 14:15:57 2026 +0200"
      },
      "message": "Allow overriding GITHUB_REF via BAZELCI_GITHUB_REF in bazel-testing (#2878)\n\nAllow overriding the CI script branch/ref (`GITHUB_REF`) via the\n`BAZELCI_GITHUB_REF` environment variable when running in the\n`bazel-testing` Buildkite organization (`THIS_IS_TESTING \u003d\u003d True`).\n\n### Motivation\nCurrently, pipelines in `bazel-testing` share a single `testing` branch\nin `bazelbuild/continuous-integration` (`get_ci_script_ref()` falls back\nto `\"testing\"` whenever `BUILDKITE_REPO` is not\n`bazelbuild/continuous-integration`). When multiple engineers test CI\nchanges concurrently, pushing to `testing` risks overwriting in-flight\nexperiments.\n\n### Summary of Changes\n- **`buildkite/bazelci.py` (`get_ci_script_ref`)**: Check\n`os.environ.get(\"BAZELCI_GITHUB_REF\")` when `THIS_IS_TESTING` is `True`\n(matching existing testing override conventions like\n`BAZELCI_AGENT_REPO` and `BAZELCI_AGENT_VERSION`). Production and\ntrusted orgs (`THIS_IS_TESTING \u003d\u003d False`) continue to unconditionally\nreturn `\"master\"`.\n- **`buildkite/culprit_finder.py`**: Use `bazelci.GITHUB_REF` when\nconstructing `SCRIPT_URL` so `culprit_finder.py` also respects\n`BAZELCI_GITHUB_REF` (consistent with `bcr_presubmit.py` and\n`bcr_compatibility.py`).\n- **`buildkite/bazelci_test.py` (`GetCiScriptRefTest`)**: Add unit tests\nverifying that `BAZELCI_GITHUB_REF` overrides the script ref in\n`bazel-testing` and is ignored when `THIS_IS_TESTING` is `False`."
    },
    {
      "commit": "d8389959c3529e679517d70bc2c6275af371eef5",
      "tree": "18ae93b270182bfe8447794f455800d980f9e83b",
      "parents": [
        "8cdcd60e7004ecc755e6a8a4992c05abd8d8dd71"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Wed Sep 23 14:02:01 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 23 14:02:01 2026 +0200"
      },
      "message": "Update CODEOWNERS to the @bazelbuild/bazel-oss team (#2879)\n\nReplace the individual code owners with the `@bazelbuild/bazel-oss`\nGitHub team so that review requests are routed to the team instead of\nspecific people."
    },
    {
      "commit": "8cdcd60e7004ecc755e6a8a4992c05abd8d8dd71",
      "tree": "47df04df74753eef529c8e0d39e61cce14586bef",
      "parents": [
        "740224d8d703bb84a287dc9e0296683110fc4ad5"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Tue Sep 22 11:01:56 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 22 11:01:56 2026 -0400"
      },
      "message": "Don\u0027t install docker in docker (#2821)"
    },
    {
      "commit": "740224d8d703bb84a287dc9e0296683110fc4ad5",
      "tree": "23feebd783538139894a3208b31846fc2cadf0bc",
      "parents": [
        "33c3e765a63f94c9e848aab452d6dcd00edbeefd"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Tue Sep 22 10:34:20 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 22 10:34:20 2026 -0400"
      },
      "message": "Add script for programatically updating images (#2835)\n\n* Adds sentinel values in bazelci.py around the images dict for\nsimplicity\n* To run: `python3 update_image_hashes.py`"
    },
    {
      "commit": "33c3e765a63f94c9e848aab452d6dcd00edbeefd",
      "tree": "d206c5d5e19147f0296eb0923789382a9d4d542f",
      "parents": [
        "c44ccf37f19d7032d10321da06f2729dd2ba3a5c"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Mon Sep 21 13:06:38 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 21 13:06:38 2026 +0200"
      },
      "message": "Migrate GCE runner pools to Regional MIGs (RMIG) across us-central1 (#2870)\n\nMigrate Linux (x86) and Windows runner instance groups from zonal MIGs\n(in us-central1-c) to regional MIGs in us-central1 with ANY distribution\nshape to prevent capacity stockouts.\n\n### Problem\nUpgrading `default_vm` in single-zone `us-central1-c` caused severe\ncapacity exhaustion across Linux Docker and Windows runners, draining\nthe active runner fleet as runners terminated after each job.\n\n### Solution\n- Migrate runner pools to Regional Managed Instance Groups (RMIGs)\nacross `us-central1` using `--target-distribution-shape\u003dANY`. GCE will\ndynamically distribute VMs across `us-central1-a`, `b`, `c`, and `f`\nbased on real-time hardware capacity.\n- Inherit `region: us-central1` from `default_vm` for `bk-docker`,\n`bk-windows`, and their testing/trusted variants.\n- Retain explicit `zone: us-central1-c` on ARM64 pools\n(`c4a-standard-8`).\n- In `buildkite/create_instances.py`, set\n`target_distribution_shape\u003d\"ANY\"` for regional MIG creation and\nautomatically check for and delete legacy zonal MIGs with the same name\nto prevent naming and resource conflicts during migration.\n\n---------\n\nCo-authored-by: Salma Samy \u003c16399431+SalmaSamy@users.noreply.github.com\u003e"
    },
    {
      "commit": "c44ccf37f19d7032d10321da06f2729dd2ba3a5c",
      "tree": "5752a856d02d72ddecb80f90702d846e8933ea88",
      "parents": [
        "b7d15b493b6c37b604fa78ea727ccc2f5f0b204c"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Fri Sep 18 17:07:24 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 18 17:07:24 2026 -0400"
      },
      "message": "Delete deprecated Dockerfiles (#2871)\n\nThese images are no longer built, so we should delete them."
    },
    {
      "commit": "b7d15b493b6c37b604fa78ea727ccc2f5f0b204c",
      "tree": "da9f60822cdb6e418170f4afcc6623a99971ebd8",
      "parents": [
        "56d30a9547eaa0656a03921452aac315b2d3ebc6"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Fri Sep 18 10:34:43 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 18 16:34:43 2026 +0200"
      },
      "message": "Reduce unnecessary concurrent github curls (#2865)\n\nNightly image builds are failing because the curl command to get the\nlatest build tool versions are 404ing. This commit attempts to fix that\nissue by consolidating all of the separate calls into one call in\nbuild.sh."
    },
    {
      "commit": "56d30a9547eaa0656a03921452aac315b2d3ebc6",
      "tree": "1679031ac6154caf02265771a9a58a83511ac825",
      "parents": [
        "16cd0ced4422c424ae9be5b94e8dbe05fefd21e2"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Thu Sep 17 14:16:55 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 17 14:16:55 2026 -0400"
      },
      "message": "Revert \"Upgrade Bazel CI machines (#2689) (#2862)\" (#2868)\n\nThis reverts commit 1493d54dd8e43b89b840a6d053e658a8d5401679.\n\nThere is more demand and less supply for c3d machines in us-central1,\nand builds are choked waiting on more VM availability."
    },
    {
      "commit": "16cd0ced4422c424ae9be5b94e8dbe05fefd21e2",
      "tree": "e859a8746f6146868951b9ceed809c4be450b6d5",
      "parents": [
        "a47fbb80dfb7ca4e678b50c1a9921c7888e49882"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Wed Sep 16 16:37:55 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 16 20:37:55 2026 +0000"
      },
      "message": "Stop supporting debian11 (#2866)\n\nDebian 11 is past its EOL, and even past LTS.\nhttps://www.debian.org/News/2026/20260831\n\nDebian has stopped publishing older dependencies required by version 11,\nand we can no longer build it."
    },
    {
      "commit": "a47fbb80dfb7ca4e678b50c1a9921c7888e49882",
      "tree": "fc15d981e84083c57a744eabf14e6cb4ff08fd1a",
      "parents": [
        "1493d54dd8e43b89b840a6d053e658a8d5401679"
      ],
      "author": {
        "name": "Salma Samy",
        "email": "16399431+SalmaSamy@users.noreply.github.com",
        "time": "Wed Sep 16 16:31:09 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 16 14:31:09 2026 +0000"
      },
      "message": "Use more machines for windows (#2864)\n\nAllocate more windows machines since we usually see long wait time on\nthem"
    },
    {
      "commit": "1493d54dd8e43b89b840a6d053e658a8d5401679",
      "tree": "8a6eb4de79b1fd9030683662d703ba10d155e19f",
      "parents": [
        "6453385e6bca59f5c3820498bd8c71a2b7fd58d2"
      ],
      "author": {
        "name": "Salma Samy",
        "email": "16399431+SalmaSamy@users.noreply.github.com",
        "time": "Wed Sep 16 14:07:26 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 16 14:07:26 2026 +0200"
      },
      "message": "Upgrade Bazel CI machines (#2689) (#2862)\n\nMigrate Bazel CI runner fleet to C3D instances and scale pools\n\n- Upgrades CI runner pools from `c2-standard-30` to `c3d-standard-30`\nand scales the untrusted fleet sizes to improve build speed and queue\nthroughput.\n- Enables Google Virtual NIC (`GVNIC`) support on all custom runner\nimages. This is mandatory for GCP 3rd-generation machine types (like\nC3D) because they do not support legacy VirtIO networking.\n- Upgrades the base image builder VM to `c3d-standard-8`."
    },
    {
      "commit": "6453385e6bca59f5c3820498bd8c71a2b7fd58d2",
      "tree": "df0f0ff3c8d80136d247f6ea980c71bc50186491",
      "parents": [
        "37918fcfb03c41b3a66a067346847fcd7eb4e21c"
      ],
      "author": {
        "name": "Florian Weikert",
        "email": "fwe@google.com",
        "time": "Wed Sep 16 13:57:40 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 16 13:57:40 2026 +0200"
      },
      "message": "Fix GCE VM image creation pipelines (part 2) (#2794)\n\nThis change updates the final pipeline step to also re-create instances\nwith new images in the trusted org.\n\nIt can only be merged once\nhttps://github.com/bazelbuild/continuous-integration/pull/2793 has been\ndeployed via TF."
    },
    {
      "commit": "37918fcfb03c41b3a66a067346847fcd7eb4e21c",
      "tree": "bc9e9e738235b65a5507f44418495ad8b0bd64f2",
      "parents": [
        "8960f5e03d7911ab72855830da5937e88755c12f"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Wed Sep 16 13:04:17 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 16 11:04:17 2026 +0000"
      },
      "message": "Rename google-cloud-sdk to google-cloud-cli (#2863)\n\nFollow-up on\nhttps://github.com/bazelbuild/continuous-integration/pull/2847"
    },
    {
      "commit": "8960f5e03d7911ab72855830da5937e88755c12f",
      "tree": "faae74803741a94c4b9bf16cac94053bc081dcc1",
      "parents": [
        "b261804f4d97f5019468c108b9a8d2a7ea99e194"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Wed Sep 16 04:47:01 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 16 10:47:01 2026 +0200"
      },
      "message": "Improve message output for multiple EOL platforms (#2859)\n\nWhen multiple tasks in the same workflow use the same EOL platform, it\ngets printed many times in a row, which is not helpful. See\nhttps://buildkite.com/bazel/buildfarm-farmer/builds/13552#01a0a569-902e-44ae-a40e-9d2818fdacb3.\n\n```\nWARNING!! You are using end-of-life platforms: ubuntu2004, ubuntu2004,\nubuntu2004, ubuntu2004, ubuntu2004, ubuntu2004, ubuntu2004, ubuntu2004,\nubuntu2004\n```\n\nThis PR de-dupes the list and makes the output less spammy."
    },
    {
      "commit": "b261804f4d97f5019468c108b9a8d2a7ea99e194",
      "tree": "0fe86b1fa3593d2149a238ef3a444e5c6bba682a",
      "parents": [
        "6c4d19f4be484971101e439bcd7a9bde9d28da3f"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Wed Sep 16 10:45:39 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 16 10:45:39 2026 +0200"
      },
      "message": "Disable Cloud Robotics Core in downstream pipeline (#2858)\n\nDisables Cloud Robotics Core in the downstream pipeline\n(bazel-at-head-plus-downstream) due to incompatibility with Bazel@HEAD.\n\n\nhttps://buildkite.com/bazel/bazel-at-head-plus-downstream/builds/5754#01a0a33f-d3fd-4d12-9e43-ae9348f83f94"
    },
    {
      "commit": "6c4d19f4be484971101e439bcd7a9bde9d28da3f",
      "tree": "df362bb98457846c730189404678952f1cf92f28",
      "parents": [
        "12f133afd1d80b956076b45eee2c587705431056"
      ],
      "author": {
        "name": "Salma Samy",
        "email": "16399431+SalmaSamy@users.noreply.github.com",
        "time": "Wed Sep 16 10:44:27 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 16 10:44:27 2026 +0200"
      },
      "message": "Use new tokens created in secret manager (#2861)\n\nFollowing the work done in #2772\n\nUpdate release pipelines (bazel-release, java_tools-release,\nrules_java-release, and rules_platform-release) to retrieve GitHub,\nChocolatey, and GPG signing keys directly from GCP Secret Manager."
    },
    {
      "commit": "12f133afd1d80b956076b45eee2c587705431056",
      "tree": "cb78baba81bce3b7dad88d757de96b2eaff8f00e",
      "parents": [
        "3a11ed8c923ca9c60ce87d2bcf732fc3b1f77410"
      ],
      "author": {
        "name": "Salma Samy",
        "email": "16399431+SalmaSamy@users.noreply.github.com",
        "time": "Wed Sep 16 10:43:47 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 16 10:43:47 2026 +0200"
      },
      "message": "Use the token in secret manager instead of gs bucket (#2860)\n\nFollowing the work done in #2772"
    },
    {
      "commit": "3a11ed8c923ca9c60ce87d2bcf732fc3b1f77410",
      "tree": "4529c50cf72039ea55a7dd0046297f7ba74bb95c",
      "parents": [
        "ed745ba88c91db95bbff76da50f7fc138c707ad7"
      ],
      "author": {
        "name": "Claudio Bley",
        "email": "claudio.bley@gmail.com",
        "time": "Tue Sep 15 14:49:57 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 15 14:49:57 2026 +0000"
      },
      "message": "Fix vendoring for test module for Bazel 7 (#2857)\n\nIf the latest Bazel version in the matrix is 7.x, vendoring for a test\nmodule will fail since the `+` char is expected in the repo names:\n```\n* Moving vendored module source to /var/lib/buildkite-agent/builds/bk-docker-p7b3/bazel-org-repo-root/module_src\nTraceback (most recent call last):\n  File \"/usr/lib/python3.10/shutil.py\", line 816, in move\n    os.rename(src, real_dst)\nFileNotFoundError: [Errno 2] No such file or directory: \u0027/var/lib/buildkite-agent/builds/bk-docker-p7b3/bazel-org-repo-root/.temp_anonymous_module/vendor_src/rules_nixpkgs_core+\u0027 -\u003e \u0027/var/lib/buildkite-agent/builds/bk-docker-p7b3/bazel-org-repo-root/module_src\u0027\n```\n\nEnable the relevant flag for this major version."
    },
    {
      "commit": "ed745ba88c91db95bbff76da50f7fc138c707ad7",
      "tree": "a499d544c4c4dbbfebcec6e622feb1a8dbbec066",
      "parents": [
        "8f2dd52b6f8ab91d434093b847bbcd0e064f0e65"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Tue Sep 15 15:46:51 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 15 15:46:51 2026 +0200"
      },
      "message": "Remove ubuntu2004 from smoke test configurations (#2853)\n\nRemoved ubuntu2004 and ubuntu2004_arm64 from the smoke test\nconfigurations.\n\nFollowing https://github.com/bazelbuild/continuous-integration/pull/2846"
    },
    {
      "commit": "8f2dd52b6f8ab91d434093b847bbcd0e064f0e65",
      "tree": "ce128a18dbd848eb5ae2752990240b77acc83ef9",
      "parents": [
        "e57e75820021b20046f7799be8e2e730920c9664"
      ],
      "author": {
        "name": "Adin Cebic",
        "email": "cebic.ad@gmail.com",
        "time": "Tue Sep 15 15:37:21 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 15 13:37:21 2026 +0000"
      },
      "message": "Resolve buildifier asset URLs only for the selected release (#2852)\n\nFixing the failure in this [rules_swift Buildkite\nrun](https://buildkite.com/bazel/rules-swift-swift/builds/7823/list?jid\u003d01a0a32c-61fc-4ce4-a3a2-2f963980b42b\u0026tab\u003doutput)."
    },
    {
      "commit": "e57e75820021b20046f7799be8e2e730920c9664",
      "tree": "6c270c031e39faa9f6f30ed941d6acccfaa9661f",
      "parents": [
        "131afd9926fcff359ecf135940c90357b49c9178"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Tue Sep 15 14:13:12 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 15 12:13:12 2026 +0000"
      },
      "message": "Disable Buildfarm in downstream pipeline (#2856)\n\nDisables Buildfarm in the downstream pipeline\n(bazel-at-head-plus-downstream) due to persistent downstream test\nfailures.\n\n\nhttps://buildkite.com/bazel/bazel-at-head-plus-downstream/builds/5754#01a0a33f-d8fb-472d-a307-17621f6f7084"
    },
    {
      "commit": "131afd9926fcff359ecf135940c90357b49c9178",
      "tree": "955a8ca6317e90b23eea164c26064ac0b2b42b0b",
      "parents": [
        "bd5d945e0af780524812b2918cc1fe04096b3acc"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Sep 15 10:28:03 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 15 10:28:03 2026 +0200"
      },
      "message": "Bump google.golang.org/grpc from 1.83.1 to 1.83.2 (#2854)\n\nBumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from\n1.83.1 to 1.83.2.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/releases\"\u003egoogle.golang.org/grpc\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eRelease 1.83.2\u003c/h2\u003e\n\u003ch1\u003eSecurity\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eserver: Reject requests missing both \u003ccode\u003e:authority\u003c/code\u003e and\n\u003ccode\u003eHost\u003c/code\u003e headers with HTTP 400 and status\n\u003ccode\u003eInternal\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/pull/9365\"\u003egrpc/grpc-go#9365\u003c/a\u003e)\n\u003cul\u003e\n\u003cli\u003eSpecial Thanks: \u003ca\nhref\u003d\"https://github.com/winklemad\"\u003e\u003ccode\u003e@​winklemad\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/commit/030ee8becb20ce4315d6bf2dfa26bdd876169dc4\"\u003e\u003ccode\u003e030ee8b\u003c/code\u003e\u003c/a\u003e\nUpdate version to 1.83.2 (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9375\"\u003e#9375\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4\"\u003e\u003ccode\u003e8668b69\u003c/code\u003e\u003c/a\u003e\ncherry-pick \u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9365\"\u003e#9365\u003c/a\u003e to\nv1.83.x (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9366\"\u003e#9366\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/commit/a3e952d2b7c973b7ec6357676e55a2a9c9faaa0d\"\u003e\u003ccode\u003ea3e952d\u003c/code\u003e\u003c/a\u003e\ncherry-pick \u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9346\"\u003e#9346\u003c/a\u003e to\nv1.83.x and update x/net dependency (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9369\"\u003e#9369\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/commit/58f8fd9a002536548ac96e34621d761b29cc4f3e\"\u003e\u003ccode\u003e58f8fd9\u003c/code\u003e\u003c/a\u003e\nChange version to 1.83.2-dev (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9337\"\u003e#9337\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/compare/v1.83.1...v1.83.2\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dgoogle.golang.org/grpc\u0026package-manager\u003dgo_modules\u0026previous-version\u003d1.83.1\u0026new-version\u003d1.83.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the\n[Security Alerts\npage](https://github.com/bazelbuild/continuous-integration/network/alerts).\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "bd5d945e0af780524812b2918cc1fe04096b3acc",
      "tree": "2a55538342f503198a1c93594e5ff1aeded66324",
      "parents": [
        "05c17dc752cc69ac50134a19d62efcadb9a2fb42"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Tue Sep 15 10:27:23 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 15 10:27:23 2026 +0200"
      },
      "message": "Fix EolPlatforms unit tests crashing on PRs that modify config files (#2855)\n\n`create_initial_steps()` prepends a label-less `{\"block\": ...}` step to\npresubmit builds whose PR modifies a config file (anything matching\n`is_config_file()`, i.e. `*.yml` or a path containing `.bazelci`).\n\nThe `EolPlatforms` tests indexed `s[\"label\"]` on *every* step returned\nby `print_project_pipeline()`, so they blew up with `KeyError: \u0027label\u0027`\non any such PR, regardless of the content of the change. Example: #2853,\nwhere the only change is dropping two platforms from\n`smoke_test/smoke_test.yml`, yet the unit test job fails on Linux, macOS\nand Windows.\n\nPostsubmit is unaffected because `create_initial_steps()` returns `[]`\non the default branch, which is why this only ever shows up as a\npresubmit-only failure.\n\nFix: look the label up defensively, and skip non-dict steps (e.g. plain\n`\"wait\"`).\n\nVerified locally against the #2853 head commit:\n\n```\ncd buildkite\nBUILDKITE_BRANCH\u003dmeteorcloudy-patch-3 BUILDKITE_PIPELINE_DEFAULT_BRANCH\u003dmaster \\\n  BUILDKITE_COMMIT\u003d191d4b08733636654d77ff0dd59b5273d3c5f9e2 python3 bazelci_test.py EolPlatforms\n```\n\nfails with `KeyError: \u0027label\u0027` before this change and passes after it.\nFull suite: 38 tests, OK."
    },
    {
      "commit": "05c17dc752cc69ac50134a19d62efcadb9a2fb42",
      "tree": "b8a09e2042c8030c9e602b0cbebd685f13d4000f",
      "parents": [
        "e6ac64cd5862a4ae9511eb2c4c4700acdd752ef3"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Sep 15 10:15:34 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 15 10:15:34 2026 +0200"
      },
      "message": "Bump google.golang.org/grpc from 1.79.3 to 1.83.1 (#2838)\n\nBumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from\n1.79.3 to 1.83.1.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/releases\"\u003egoogle.golang.org/grpc\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eRelease 1.83.1\u003c/h2\u003e\n\u003ch1\u003eSecurity\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003exds/rbac: Fix a bug where nested \u003ccode\u003ePrincipal\u003c/code\u003e or\n\u003ccode\u003ePermission\u003c/code\u003e rules with \u003ccode\u003e:scheme\u003c/code\u003e or\n\u003ccode\u003egrpc-\u003c/code\u003e prefixed header matchers were not rejected, which\ncould cause DENY rules to fail open. (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9258\"\u003e#9258\u003c/a\u003e)\n\u003cul\u003e\n\u003cli\u003eSpecial Thanks: \u003ca\nhref\u003d\"https://github.com/nvxbug\"\u003e\u003ccode\u003e@​nvxbug\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003exds/rbac: Fix a bug where the \u003ccode\u003ehost\u003c/code\u003e header matcher was\nnot being replaced with \u003ccode\u003e:authority\u003c/code\u003e in nested\n\u003ccode\u003ePrincipal\u003c/code\u003e or \u003ccode\u003ePermission\u003c/code\u003e rules. (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9258\"\u003e#9258\u003c/a\u003e)\n\u003cul\u003e\n\u003cli\u003eSpecial Thanks: \u003ca\nhref\u003d\"https://github.com/nvxbug\"\u003e\u003ccode\u003e@​nvxbug\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003exds/rbac: Fix a bug where a header matcher whose name was not\nlowercase, such as \u003ccode\u003eX-Role\u003c/code\u003e, matched no header, which could\ncause DENY rules to fail open. (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9332\"\u003e#9332\u003c/a\u003e)\n\u003cul\u003e\n\u003cli\u003eSpecial Thanks: \u003ca\nhref\u003d\"https://github.com/alimony\"\u003e\u003ccode\u003e@​alimony\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003exds/rbac: Fix a bug where a \u003ccode\u003e:scheme\u003c/code\u003e or\n\u003ccode\u003egrpc-\u003c/code\u003e prefixed header matcher was accepted when its name\nwas not lowercase. (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9332\"\u003e#9332\u003c/a\u003e)\n\u003cul\u003e\n\u003cli\u003eSpecial Thanks: \u003ca\nhref\u003d\"https://github.com/alimony\"\u003e\u003ccode\u003e@​alimony\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003exds/rbac: Fix a bug where a \u003ccode\u003eHost\u003c/code\u003e header matcher was not\nreplaced with \u003ccode\u003e:authority\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9332\"\u003e#9332\u003c/a\u003e)\n\u003cul\u003e\n\u003cli\u003eSpecial Thanks: \u003ca\nhref\u003d\"https://github.com/alimony\"\u003e\u003ccode\u003e@​alimony\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003ePerformance\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003etransport: Restrict memory overhead of buffering small data frames.\n(\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9331\"\u003e#9331\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eRelease 1.83.0\u003c/h2\u003e\n\u003ch1\u003eSecurity\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eserver: Stop reading from connections when flooded by HTTP/2 frames\nto mitigate resource exhaustion. The default value for this limit is 100\nframes, excluding DATA and HEADERS, and may be changed by setting\nenvironment variable\n\u003ccode\u003eGRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003exds/rbac: Support \u003ccode\u003eMetadata\u003c/code\u003e and\n\u003ccode\u003eRequestedServerName\u003c/code\u003e permissions matcher fields. If present\nin a DENY rule, previously these would be ignored and fail-open.\u003c/li\u003e\n\u003cli\u003exds/rbac: Fix panic when parsing unsupported fields in\n\u003ccode\u003eNotRule\u003c/code\u003e/\u003ccode\u003eNotId\u003c/code\u003e permissions.\u003c/li\u003e\n\u003cli\u003exds/rbac: Support the deprecated \u003ccode\u003esource_ip\u003c/code\u003e principal\nidentifier by treating it as equivalent to\n\u003ccode\u003edirect_remote_ip\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003exds: Fix panic when parsing route header matchers configured with\nempty \u003ccode\u003eexact_match\u003c/code\u003e, \u003ccode\u003eprefix_match\u003c/code\u003e, or\n\u003ccode\u003esuffix_match\u003c/code\u003e strings. (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9223\"\u003e#9223\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eNew Features\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003exds/googlec2p: Enable DirectPath over Interconnect support for\non-premises clients via the \u003ccode\u003eforce-xds\u003c/code\u003e target URI query\nparameter. (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9133\"\u003e#9133\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003exds: Enable xDS configuration to control which fields get propagated\nfrom ORCA backend metric reports to LRS load reports. (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9145\"\u003e#9145\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eauthz: Add \u003ccode\u003eOnPolicyUpdate\u003c/code\u003e callback to\n\u003ccode\u003eFileWatcherOptions\u003c/code\u003e to notify when an authz policy is loaded\nor updated. (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9142\"\u003e#9142\u003c/a\u003e)\n\u003cul\u003e\n\u003cli\u003eSpecial Thanks: \u003ca\nhref\u003d\"https://github.com/hnefatl\"\u003e\u003ccode\u003e@​hnefatl\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003exds: Add support for the GCP Authentication HTTP Filter, which\nautomatically fetches and attaches GCP Service Account Identity JWT\ntokens to outgoing RPCs.\n\u003cul\u003e\n\u003cli\u003eThis feature can be enabled by setting environment variable\n\u003ccode\u003eGRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER\u003dtrue\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9119\"\u003e#9119\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003exds: Add support for xDS-based HTTP CONNECT proxies.\n\u003cul\u003e\n\u003cli\u003eThis feature can be enabled by setting environment variable\n\u003ccode\u003eGRPC_EXPERIMENTAL_XDS_HTTP_CONNECT\u003dtrue\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9151\"\u003e#9151\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003exds: Add support for \u003ccode\u003econtains_match\u003c/code\u003e in route header\nmatchers. (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9223\"\u003e#9223\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eBug Fixes\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003ecredentials/alts: Fix panic when processing malformed frames by\nvalidating that the message frame length exceeds the message type field\nsize. (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9197\"\u003e#9197\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003egrpc: Fix compilation on Plan 9 targets (\u003ccode\u003eGOOS\u003dplan9\u003c/code\u003e),\nbroken since v1.81.0. (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9255\"\u003e#9255\u003c/a\u003e)\n\u003cul\u003e\n\u003cli\u003eSpecial Thanks: \u003ca\nhref\u003d\"https://github.com/Yusufihsangorgel\"\u003e\u003ccode\u003e@​Yusufihsangorgel\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eRelease 1.82.2\u003c/h2\u003e\n\u003ch1\u003eSecurity\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eserver: Reject requests missing both \u003ccode\u003e:authority\u003c/code\u003e and\n\u003ccode\u003eHost\u003c/code\u003e headers with HTTP 400 and status\n\u003ccode\u003eInternal\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/pull/9365\"\u003egrpc/grpc-go#9365\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/commit/1550d9e0cddb30ce99e61a2102e8294a49461e5e\"\u003e\u003ccode\u003e1550d9e\u003c/code\u003e\u003c/a\u003e\nChange version to 1.83.1 (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9336\"\u003e#9336\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe\"\u003e\u003ccode\u003eebba6f3\u003c/code\u003e\u003c/a\u003e\nCherry-pick \u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9258\"\u003e#9258\u003c/a\u003e\nand \u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9332\"\u003e#9332\u003c/a\u003e\ninto v1.83.x (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9335\"\u003e#9335\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77\"\u003e\u003ccode\u003e8cfeca0\u003c/code\u003e\u003c/a\u003e\nCherry-pick \u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9331\"\u003e#9331\u003c/a\u003e to\nv1.83.x (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9333\"\u003e#9333\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/commit/dec6951305e88906696f1d0a00dd2439363bc708\"\u003e\u003ccode\u003edec6951\u003c/code\u003e\u003c/a\u003e\nChange version to 1.83.1-dev (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9229\"\u003e#9229\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/commit/4c226daff88f54441d70f710815e07b81fb162b2\"\u003e\u003ccode\u003e4c226da\u003c/code\u003e\u003c/a\u003e\nChange version to 1.83.0 (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9228\"\u003e#9228\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/commit/c198988aa9297cb9428c7afaaee4363d0082b838\"\u003e\u003ccode\u003ec198988\u003c/code\u003e\u003c/a\u003e\nCherrypick 9223 into v1.83.x (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9279\"\u003e#9279\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/commit/8ce3ebf24af3c206bacf279adcf9c3a88981df68\"\u003e\u003ccode\u003e8ce3ebf\u003c/code\u003e\u003c/a\u003e\nCherrypick PR 9255 into v1.83.x (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9263\"\u003e#9263\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/commit/e39384978cf59c70634f900a7aa93d7483886696\"\u003e\u003ccode\u003ee393849\u003c/code\u003e\u003c/a\u003e\nCherry-pick recent changes from master (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9240\"\u003e#9240\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/commit/2a112a82f5c53ab3b89b5aa4a02b4195e2706879\"\u003e\u003ccode\u003e2a112a8\u003c/code\u003e\u003c/a\u003e\nauthz: add onPolicyUpdate callback to authz file watcher (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9142\"\u003e#9142\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/commit/1a80fca960d39ae4d7d6f2d9323ca2d243fd44bb\"\u003e\u003ccode\u003e1a80fca\u003c/code\u003e\u003c/a\u003e\nvet: adds a check to disallow usage of regex.Compile in xDS code (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9216\"\u003e#9216\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/compare/v1.79.3...v1.83.1\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dgoogle.golang.org/grpc\u0026package-manager\u003dgo_modules\u0026previous-version\u003d1.79.3\u0026new-version\u003d1.83.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the\n[Security Alerts\npage](https://github.com/bazelbuild/continuous-integration/network/alerts).\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "e6ac64cd5862a4ae9511eb2c4c4700acdd752ef3",
      "tree": "7b0e8463ea19a463050417aed63dbb3b26a7e26f",
      "parents": [
        "92707fc8b1676d614e93b731e680a4913f3a9147"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Mon Sep 14 12:50:33 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 14 16:50:33 2026 +0000"
      },
      "message": "Update dockerfiles to install google-cloud-cli (#2847)\n\ngoogle-cloud-sdk got renamed to google-cloud-cli."
    },
    {
      "commit": "92707fc8b1676d614e93b731e680a4913f3a9147",
      "tree": "fcbb99741ac3dedfe0e43032fc303ae73b301307",
      "parents": [
        "8371ba898104e5fc9a8ebfa211b18ef3d67c03c7"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Mon Sep 14 12:32:58 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 14 16:32:58 2026 +0000"
      },
      "message": "Stop building ubuntu 18 and 20 (#2846)\n\nThese platforms are far past EOL. We will stop building them. This PR\nalso adds a warning in the buildkite UI for deprecated platforms, and\nadds a unit test asserting that the warning is correct."
    },
    {
      "commit": "8371ba898104e5fc9a8ebfa211b18ef3d67c03c7",
      "tree": "9bcd50b1656476c6b2ce110d523283967fd27b6d",
      "parents": [
        "ec25a0569cdfb917998286a2b93f5ec3d2a46168"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Fri Sep 11 09:41:35 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 11 13:41:35 2026 +0000"
      },
      "message": "Delete unused pipelines (#2851)\n\nFollow-up to #2850."
    },
    {
      "commit": "ec25a0569cdfb917998286a2b93f5ec3d2a46168",
      "tree": "93711cf9d02db244a5448c5847191e0cdedc0133",
      "parents": [
        "58a1a3ccd983f2a057803488a843e5245da2f6dc"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Fri Sep 11 03:21:33 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 11 09:21:33 2026 +0200"
      },
      "message": "Delete ubuntu 16, 18, 20 RBE toolchains (#2848)"
    },
    {
      "commit": "58a1a3ccd983f2a057803488a843e5245da2f6dc",
      "tree": "e7400970a43429e722275262111f8901a568d9fe",
      "parents": [
        "f4aed6bd3869ba8986e7982c9011dcfcd80cfa12"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Thu Sep 10 17:08:09 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 10 21:08:09 2026 +0000"
      },
      "message": "Cleanup/update more EOL ubuntu platforms (#2850)\n\nScoped to bazel_bench.py, docgen/*, doc/*, pipelines/*."
    },
    {
      "commit": "f4aed6bd3869ba8986e7982c9011dcfcd80cfa12",
      "tree": "1c4378ae9646c65bbf3f11f23c4b0f037d0f2796",
      "parents": [
        "130fb532228a2c0d87873aec0134a0a711d43bd5"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Thu Sep 10 16:01:00 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 10 16:01:00 2026 -0400"
      },
      "message": "Remove EOL platforms from README (#2849)"
    },
    {
      "commit": "130fb532228a2c0d87873aec0134a0a711d43bd5",
      "tree": "a5e3a01f7a964f7a43aa36824eab767267f899cd",
      "parents": [
        "76ea83db5c98449c761e041caa7f463ef515595d"
      ],
      "author": {
        "name": "Katika Mohaseen",
        "email": "mohaseenhackerone@gmail.com",
        "time": "Wed Sep 09 19:47:45 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 09 14:17:45 2026 +0000"
      },
      "message": "Shell-quote values interpolated into Buildkite pipeline commands (#2824)\n\nFollow-up to #2666: apply `shlex.quote` consistently to the remaining\npipeline-command builders so every value interpolated into a\n`project_pipeline` command line is quoted the same way.\n\n- `create_config_validation_steps`: quote `--file_config` (the config\nfile name comes from the PR\u0027s modified files)\n- `upload_project_pipeline_step`: quote `project_name`,\n`git_repository`, `http_config`, `file_config` and `git_commit` instead\nof manual double quotes / raw interpolation\n\nUpdates the corresponding test expectation to the `shlex.quote` style."
    },
    {
      "commit": "76ea83db5c98449c761e041caa7f463ef515595d",
      "tree": "f3909d0d37b9d8604dc28937b694f988a8a5167f",
      "parents": [
        "cbd585b91e9bdab73a5779cbcc1f02b4855cc216"
      ],
      "author": {
        "name": "bor_p",
        "email": "36397564+bor-p-s@users.noreply.github.com",
        "time": "Wed Sep 09 16:11:26 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 09 14:11:26 2026 +0000"
      },
      "message": "Bound the BEP artifact-upload wait with a timeout (#2843)\n\n### Description\n\nAdds a `timeout` parameter to `execute_command()`, passed through to\n`subprocess.run`. `upload_test_logs_from_bep()` uses it on the\n`bazelci-agent artifact upload` call with a 2 hour limit; on timeout the\nprocess is killed, the failure is logged, and the function returns\nwithout re-raising, since the build\u0027s pass/fail result is already\ndecided by `bazel test` before this step runs -- a killed upload only\nloses debug artifacts, not the build outcome. The same timeout is\napplied to the `java.log` upload in the same function, which had the\nsame unbounded `execute_command()` call.\n\nThe 2 hour value is an estimate, not a measurement. The only\nnormal-runtime data available is from rules_scala itself (macOS\n`test_rules_scala`: 40-55 min); other projects on this shared fleet may\nrun longer, worth confirming with maintainers before treating this as\nfinal. A real fix inside `bazelci-agent` itself (detecting that the\nwriter process died) needs a new agent release; out of scope here.\n\n### Motivation\n\n\n[rules_scala#1906](https://github.com/bazel-contrib/rules_scala/issues/1906)\nfound jobs that stall inside `upload_test_logs_from_bep()` until\nBuildkite\u0027s 8 hour step timeout kills them. This stays invisible because\nthe build still ends up green (a fast retry on some builds, `soft_fail`\non others), so the job burns most of 8 hours doing nothing and nobody\nnotices.\n\nThe exact hang mechanism inside `bazelci-agent` remains unverified --\nthe leading theory (bazel exits before writing `lastMessage`, so the\nagent waits forever) failed to reproduce with the real binaries. That\u0027s\nwhy this bounds the wait from the outside instead of targeting a\nspecific mechanism.\n\n---------\n\nCo-authored-by: bor-p-s \u003cbpapevis@virtusity.com\u003e"
    },
    {
      "commit": "cbd585b91e9bdab73a5779cbcc1f02b4855cc216",
      "tree": "f30dae03e7e2d96f719da2a11d0af28bf87cd8cf",
      "parents": [
        "84da22f541e864dead54845eabf54b1e09cb4963"
      ],
      "author": {
        "name": "Showta Ishizaki",
        "email": "zakinko@snowrabbit.org",
        "time": "Wed Sep 09 22:27:40 2026 +0900"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 09 13:27:40 2026 +0000"
      },
      "message": "setup-freebsd.sh: install what building Bazel needs (#2836)\n\nReworked to the script alone, following the comment above: the platform\nentry is gone, and what is left is a fix to a file already in the\nrepository.\n\nbuildkite/setup-freebsd.sh has been here since 2017 and no platform\nrefers to it, so nothing has run it in that time. It installs bazel,\ngit,\nwget and zip. Building Bazel from source also needs bash, which is not\nin\nthe FreeBSD base system and which every bootstrap script names in its\nshebang; a JDK; and python3, since rules_python ships no CPython for\nFreeBSD and the build falls back to the system interpreter. This adds\nthe\nthree.\n\nChecked on a stock FreeBSD 15.1 (Vultr\u0027s image): before the script bash,\njavac and bazel are absent; after it, all three are on the path.\n\nOne thing this does not cover, because it is not this repository\u0027s: with\nJAVA_HOME unset, Bazel\u0027s own buildenv.sh defaults to\n/usr/local/openjdk11\non FreeBSD, which is exactly what the bazel package installs, and that\nis\ntoo old to build Bazel. That is a change for bazelbuild/bazel,\nbazelbuild/bazel#31051."
    },
    {
      "commit": "84da22f541e864dead54845eabf54b1e09cb4963",
      "tree": "2082faab53c50b0bc92ce5fe88bfa057945ae7de",
      "parents": [
        "de1d60db5f5f057fcf772584dff9a2f1940b45ec"
      ],
      "author": {
        "name": "herdiyanitdev",
        "email": "82978131+herdiyana256@users.noreply.github.com",
        "time": "Mon Sep 07 17:43:43 2026 +0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 07 10:43:43 2026 +0000"
      },
      "message": "bcr-pr-reviewer: check review freshness by commit_id, not commit timestamp (#2841)\n\n`getPrApprovers()` decides whether a maintainer\u0027s existing approval\nstill applies to the PR\u0027s current content by comparing each review\u0027s\n`submitted_at` against the head commit\u0027s date\n(`latestCommit.commit.author.date`). A commit\u0027s author date is fully\ncontrolled by whoever creates the commit (`GIT_AUTHOR_DATE` / `git\ncommit --date`) and GitHub preserves it on push, so the freshness cutoff\nis attacker-controlled. By backdating a newly pushed head commit to a\ntime before an earlier approval, a stale approval of an earlier\ninnocuous commit keeps counting as valid for the new head the reviewer\nnever saw. `reviewPR()` feeds this `approvers` set directly into the\nauto-approve + squash-merge decision, and since `CODEOWNERS` delegates\nthe whole `modules/` tree to this bot, the freshness check is the guard\nthat decides what merges into the registry.\n\nThis is the same freshness check hardened in #2764 (which stopped merge\ncommits from being excluded from the cutoff) and complements #2653\n(which pinned the merge to the analyzed head SHA); both kept the\ntimestamp comparison, which is what this change removes.\n\nThe fix compares each review\u0027s `commit_id` against the current PR head\nSHA instead of comparing timestamps. A review only vouches for the exact\ncommit it was submitted against, so it is fresh iff its `commit_id`\nequals the head. This is timestamp-free and also handles the\nmerge-commit case without special-casing parent counts.\n\n`index.test.js` is updated to `commit_id` fixtures and adds a regression\ntest for the backdated-head-commit case; it keeps the checks that a\ngenuinely head-matching approval still counts and that a later\nnon-approving review overrides an earlier approval. `node --test`\npasses."
    },
    {
      "commit": "de1d60db5f5f057fcf772584dff9a2f1940b45ec",
      "tree": "77ba78c66242596bb2389de278e4356baeac4b61",
      "parents": [
        "705db9bc77cf9bf8f82df76ac22338f6e745b4fb"
      ],
      "author": {
        "name": "BarakSrour",
        "email": "85163444+BarakSrour@users.noreply.github.com",
        "time": "Mon Sep 07 06:35:31 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 07 10:35:31 2026 +0000"
      },
      "message": "bcr-pr-reviewer: validate module version directories before diffing (#2842)\n\n## Summary\n\n`runDiffModule()` interpolates version strings directly into the paths\nit hands to `diff`:\n\n```js\nconst previousVersion \u003d metadata.versions[versionIndex - 1];\nconst diffArgs \u003d [\u0027--color\u003dalways\u0027, \u0027-urN\u0027,\n                  `modules/${moduleName}/${previousVersion}`,\n                  `modules/${moduleName}/${versionName}`];\n```\n\n`previousVersion` is read out of the module\u0027s `metadata.json` at\n`refs/pull/${prNumber}/head`, so its value comes from the PR being\nreviewed and is chosen by whoever opened that PR. A `versions` entry\nsuch as `\"../../..\"` makes `diff` descend outside the module directory,\nand `diff -urN` prints the contents of the files it finds to stdout,\nwhich the action logs.\n\n`generate_module_diff.yml` in `bazel-central-registry` runs this on\n`pull_request` for any PR touching `modules/**`, so reaching it needs\nonly an ordinary PR.\n\n## Impact\n\nLimited, and deliberately stated as such. That workflow uses the default\n`github.token` on a `pull_request` trigger, so a fork PR gets a\nread-only token and no repository secrets. What the bug gives is a read\nof runner-local files into a public workflow log, not code execution and\nnot access to anything the PR author does not already have.\n\nThis is the same input, in the same workflow, that #2220 handled by\nreplacing `execSync` with `spawnSync`. That change removed the shell, so\nthe string can no longer be interpreted as a command, but it is still\nused as a path. #2220 was filed as an ordinary PR on the reasoning that\nthis workflow\u0027s permissions are limited enough not to warrant a private\nreport, and this is strictly the milder of the two, so I have followed\nthe same route. Happy to move it if you would rather it went to the\nsecurity team.\n\n## Fix\n\nAdd `moduleVersionDir(moduleName, version)`, which resolves the\ncandidate directory and returns `null` unless it sits directly inside\n`modules/\u003cmoduleName\u003e/`, and skip a module whose version fails that\ntest.\n\nThe check is a containment test on the resolved path rather than a\npattern match on the version string, so it does not need to know the\nBazel version grammar and does not reject versions containing dots,\ndashes or plus signs. Output for legitimate input is byte-for-byte\nunchanged.\n\n## Test plan\n\n- `node -c index.js`: parses cleanly.\n- `npm test`: 7/7 pass (the 3 existing `getPrApprovers` tests plus 4 new\nones covering `../../..`, `..`, `../other_module/1.0.0`, `nested/1.0.0`,\n`/etc`, `/etc/passwd`, `.` and `\"\"`, and asserting that `0.9.0-rc.1..2`\nand `1.0.0+build.5` are still accepted).\n- Ran the unmodified action end to end against a stubbed GitHub API and\na fabricated PR, in a directory tree laid out like the runner\u0027s, in\nthree arms:\n- legitimate `previousVersion` of `0.9.0`: `diff --color\u003dalways -urN\nmodules/testmod/0.9.0 modules/testmod/1.0.0`, normal output;\n- `previousVersion` of `../../..`: `diff --color\u003dalways -urN\nmodules/testmod/../../.. modules/testmod/1.0.0`, and the contents of a\nfile placed outside the checkout appear in the action\u0027s output;\n- `previousVersion` of `0.9.0-rc.1..2`: stays inside the module\ndirectory, confirming that the dots are not what matters.\n- Re-ran the identical three arms against the patched file: arm 1 output\nunchanged, arm 3 unchanged, arm 2 now stops at `Refusing to diff module\ntestmod: a version does not name a directory inside modules/testmod/`\nwith no file contents in the log."
    },
    {
      "commit": "705db9bc77cf9bf8f82df76ac22338f6e745b4fb",
      "tree": "56d1a215db43a06cef014e79abca65cd3a74d125",
      "parents": [
        "957b0ac44549a70ccb951361b804d07d955aeb79"
      ],
      "author": {
        "name": "MalwareBro",
        "email": "106037584+MalwareBro@users.noreply.github.com",
        "time": "Mon Sep 07 13:19:09 2026 +0300"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 07 12:19:09 2026 +0200"
      },
      "message": "cherry_picker: validate commit IDs parsed from the issue body (#2816)\n\n### What\n\nValidate the commit IDs that `cherrypick_with_commits.py` parses out of\nthe issue body, accepting only git object names (7–40 hex characters).\n\n### Why\n\nThe on-demand cherry-pick flow reads commit IDs from the `### Commit\nIDs` section of the issue body:\n\n```python\nissue_body_dict[\"commits\"] \u003d get_middle_text(...).replace(\" \", \"\").split(\",\")\n```\n\nThat normalisation strips spaces and splits on commas, but it preserves\na leading dash. Each entry is then passed to git as an argv element:\n\n```python\nsubprocess.run([\"git\", \"diff-tree\", \"--no-commit-id\", \"--name-only\", commit_id, \"-r\", \"-m\"])\n```\n\nBecause `commit_id` sits in an argument position, a value such as\n`--output\u003d\u003cpath\u003e` is interpreted by git as an *option* rather than a\nrevision. `git diff-tree` honours `--output\u003d\u003cfile\u003e` and\ncreates/truncates that file, so a malformed entry can write to a path on\nthe runner instead of being rejected as an invalid revision. Relative\npaths are accepted, so the target is not confined to the checkout\ndirectory.\n\nThe commit IDs come from the issue body, which is user-authored content,\nso it seems worth constraining them to values git will only ever treat\nas revisions.\n\nThe existing `subprocess` calls already use list form without\n`shell\u003dTrue`, so there is no shell involved here — this is purely about\ngit\u0027s own option parsing.\n\n### How\n\nFilter empty entries (so a trailing comma stays tolerated) and require\neach remaining entry to match `^[0-9a-fA-F]{7,40}$`. Anything else is\nreported back on the issue using the existing `issue_comment` helper,\nfollowing the error-reporting style already used in this script, and the\nrun exits cleanly.\n\nVerified that the pattern accepts short (7) and full (40) hashes in\neither case, and rejects `--output\u003d...`, bare options such as `-r`,\nover-short values, and non-hex strings."
    },
    {
      "commit": "957b0ac44549a70ccb951361b804d07d955aeb79",
      "tree": "ef3800dc31d0c7d15145427ffdce9598b1ed901b",
      "parents": [
        "f38395f861d8cdd4bb928ec554c32151f5f9bf4c"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Tue Sep 01 14:15:06 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 01 14:15:06 2026 -0400"
      },
      "message": "Update and clarify docker docs (#2832)"
    },
    {
      "commit": "f38395f861d8cdd4bb928ec554c32151f5f9bf4c",
      "tree": "68ca5100cc9dc6d06253bb13dd7d16fb1b6d64b8",
      "parents": [
        "b4d39fc2c3a3498416ec46a25a8554389c65296d"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Tue Sep 01 13:43:59 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 01 13:43:59 2026 -0400"
      },
      "message": "Pin terraform images (#2826)"
    },
    {
      "commit": "b4d39fc2c3a3498416ec46a25a8554389c65296d",
      "tree": "ec439360887677a35eaa2e2f1075ecd11624eed0",
      "parents": [
        "b083e2340a904ef1a3b7677c091dc59d3e73e154"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Tue Sep 01 17:07:43 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 01 17:07:43 2026 +0200"
      },
      "message": "Remove docker plugin from docker-update pipeline (#2834)\n\nSince Docker socket mounting was removed (`/var/run/docker.sock`),\ndocker-in-docker is no longer supported on CI agent containers.\n\nThis removes the `docker#v3.8.0` plugin from\n`pipelines/docker-update.yml` so that Docker commands execute directly\non the host VM agent."
    },
    {
      "commit": "b083e2340a904ef1a3b7677c091dc59d3e73e154",
      "tree": "74c0f0f906ba2b320aecf831d276ba43eb2b2989",
      "parents": [
        "d464ae8a58fa3589bc5dea2533782cf30ec52985"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Mon Aug 31 11:21:26 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 31 15:21:26 2026 +0000"
      },
      "message": "Build docker images nightly (#2831)"
    },
    {
      "commit": "d464ae8a58fa3589bc5dea2533782cf30ec52985",
      "tree": "eb7d93223e3563c21921a9307827dda52400f205",
      "parents": [
        "701f675d9205f7c4c0f77d4cdc925fee855b6cb9"
      ],
      "author": {
        "name": "Adil Burak Şen",
        "email": "56400880+adilburaksen@users.noreply.github.com",
        "time": "Mon Aug 31 13:30:54 2026 +0300"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 31 12:30:54 2026 +0200"
      },
      "message": "bcr-pr-reviewer: pin auto-merge to the analyzed head SHA (#2653)\n\n## Problem\n\nIn `actions/bcr-pr-reviewer/index.js`, `reviewPR()` re-fetches the PR\nhead SHA and aborts if it changed since the analysis began (the\n`initialHeadSha !\u003d\u003d currentHeadSha` check). However, the subsequent\nauto-merge call:\n\n```js\nawait octokit.rest.pulls.merge({\n  owner, repo, pull_number: prNumber, merge_method: \u0027squash\u0027,\n});\n```\n\ndoes not pass a `sha`, so it merges whatever the PR head is at merge\ntime. There is a window between the staleness check / approval and this\nmerge in which a new commit could be pushed, causing the bot to merge\ncontent that was not the analyzed and approved commit.\n\n## Change\n\nPass `sha: currentHeadSha` (the commit that was analyzed and approved)\nto `pulls.merge`. GitHub\u0027s merge API rejects the merge with `409\nConflict` if the provided SHA is not the current head, so the bot will\nnot merge commits that were pushed after analysis.\n\nThis is a defense-in-depth hardening of the existing staleness check; it\ndoes not change behavior for PRs whose head is unchanged."
    },
    {
      "commit": "701f675d9205f7c4c0f77d4cdc925fee855b6cb9",
      "tree": "9f2a4504b09cf4086907dce9935f4ea5dc3ebbe0",
      "parents": [
        "3c76142af05d57bee0243d39098cb6efad915d17"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Thu Aug 27 14:35:35 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 27 14:35:35 2026 -0400"
      },
      "message": "Rebalance Linux vs Windows VMs (#2830)\n\nThe Windows queue is really backed up right now, and the Linux queue is\nunderutilized, so we should rebalance the VM distribution."
    },
    {
      "commit": "3c76142af05d57bee0243d39098cb6efad915d17",
      "tree": "57cb14fdb1bc4d564eb58bc3fba5cc31165f04db",
      "parents": [
        "4cbdfd8af9ca568952e7aeaa95bb37cb7f3a12ee"
      ],
      "author": {
        "name": "Florian Weikert",
        "email": "fwe@google.com",
        "time": "Thu Aug 27 18:17:38 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 27 18:17:38 2026 +0200"
      },
      "message": "Reapply \"Fix priority of most important trusted pipelines.\" (#2822) (#2829)\n\nThis reverts commit 5b81ed94dbe89092ac599d8d08e9ad72509e95b6.\n\nAdditional fix: Explicitly set priority value - TF doesn\u0027t like\nundefined variables, and $try doesn\u0027t help either."
    },
    {
      "commit": "4cbdfd8af9ca568952e7aeaa95bb37cb7f3a12ee",
      "tree": "6276f6255da472da1ac7b5387126280677685bfd",
      "parents": [
        "72b3b3bcd2659f6efac15dd073e6580c4f43f4e8"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Wed Aug 26 15:11:23 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 26 19:11:23 2026 +0000"
      },
      "message": "Remove docker socket from terraform configs (#2820)"
    },
    {
      "commit": "72b3b3bcd2659f6efac15dd073e6580c4f43f4e8",
      "tree": "1186c9dd2c941c4a39334ba92855660afee0f521",
      "parents": [
        "5b81ed94dbe89092ac599d8d08e9ad72509e95b6"
      ],
      "author": {
        "name": "Florian Weikert",
        "email": "fwe@google.com",
        "time": "Wed Aug 26 19:47:58 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 26 17:47:58 2026 +0000"
      },
      "message": "Upload generated docs during docs presubmit. (#2825)\n\nTested:\nhttps://buildkite.com/bazel-testing/bazel-bazel/builds/9943#01a03ec8-ce77-4538-8f56-3d0c527dbce5"
    },
    {
      "commit": "5b81ed94dbe89092ac599d8d08e9ad72509e95b6",
      "tree": "5927866547191c9d329d3772258bb251718d812b",
      "parents": [
        "3598c2f92baa66fcd3ad686df216027b42c14d91"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Wed Aug 26 14:04:03 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 26 14:04:03 2026 +0200"
      },
      "message": "Revert \"Fix priority of most important trusted pipelines.\" (#2822)\n\nReverts bazelbuild/continuous-integration#2795\n\nDue to\nhttps://github.com/bazelbuild/continuous-integration/actions/runs/32885286970"
    },
    {
      "commit": "3598c2f92baa66fcd3ad686df216027b42c14d91",
      "tree": "a689a68ba69a8128f992d9f99bf5df823f5fb3e8",
      "parents": [
        "87cc1cd21a0c69dd64d46a0cdd1dc00f27468120"
      ],
      "author": {
        "name": "herdiyanitdev",
        "email": "82978131+herdiyana256@users.noreply.github.com",
        "time": "Wed Aug 26 16:41:57 2026 +0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 26 09:41:57 2026 +0000"
      },
      "message": "Validate module name and version derived from PR paths in bcr_presubmit.py (#2759)\n\n`module_name` and `module_version` in `bcr_presubmit.py` are derived\nfrom a pull request\u0027s changed file paths (`modules/\u003cname\u003e/\u003cversion\u003e/`)\nvia `get_target_modules()`, using a regex whose only constraint is \"no\nslash\" (`modules\\/([^\\/]+)\\/([^\\/]+)\\/`). Both values can therefore\ncontain arbitrary shell and Starlark metacharacters.\n\nTwo sinks interpolate these values unescaped:\n- The shell command string built in `add_presubmit_jobs()` (partially\naddressed by #2739\u0027s `shlex.quote` fix at that one call site).\n- The generated `MODULE.bazel` content in `create_anonymous_repo()`:\n  ```python\nscratch_file(root, \"MODULE.bazel\", [\"bazel_dep(name \u003d \u0027%s\u0027, version \u003d\n\u0027%s\u0027)\" % (module_name, module_version)])\n  ```\nA `module_name`/`module_version` containing a single quote closes the\nStarlark string literal early, letting the rest of the payload be parsed\nas new top-level `MODULE.bazel` statements (e.g. `load(...)` + a\nrepository rule invocation), evaluated when `bazel vendor` runs during\n`anonymous_module_runner`/`test_module_runner`. This sink is unaffected\nby #2739, since `shlex.quote` only protects shell-argument parsing, not\nthe raw string value that later reaches this `%`-format call.\n\nThis patch rejects any `module_name`/`module_version` that doesn\u0027t match\nthe character set Bzlmod itself accepts\n(https://bazel.build/external/module#module_name, `#version`) at the\npoint they\u0027re derived from the PR path in\n`get_target_modules()`/`get_modules_with_metadata_change()`. Validating\nat the source closes both the already-partially-fixed shell sink and the\nstill-open `MODULE.bazel` sink (and any future sink in this file) at a\nsingle choke point, rather than escaping per call site.\n\nNormal module names/versions (e.g. `rules_foo` / `1.2.3`, `protobuf` /\n`27.0-rc1`) are unaffected. Anything containing quotes, backticks,\nsemicolons, dollar signs, spaces, or uppercase letters in the name is\nnow rejected before it reaches any downstream sink."
    },
    {
      "commit": "87cc1cd21a0c69dd64d46a0cdd1dc00f27468120",
      "tree": "ee9739ed67e344d9b6fa3691bf62de0544df3bb3",
      "parents": [
        "05c3f85a9dadf4c102d234cb830a5a62cf715579"
      ],
      "author": {
        "name": "herdiyanitdev",
        "email": "82978131+herdiyana256@users.noreply.github.com",
        "time": "Wed Aug 26 16:37:02 2026 +0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 26 11:37:02 2026 +0200"
      },
      "message": "Fix stale-approval bypass in BCR PR reviewer\u0027s review-freshness check (#2764)\n\n## Summary\n\n`actions/bcr-pr-reviewer/index.js`\u0027s `getPrApprovers()` decides whether\nan existing GitHub review is still valid by comparing its `submitted_at`\nagainst the timestamp of \"the latest commit\" -- but it computes that\ntimestamp only from commits whose `parents.length \u003d\u003d\u003d 1`, explicitly\nfiltering out merge commits:\n\n```js\n// Filter out the merge commits whose parents length is larger than 1\nconst nonMergeCommits \u003d commits.filter(commit \u003d\u003e commit.parents.length \u003d\u003d\u003d 1);\nconst latestCommit \u003d nonMergeCommits[nonMergeCommits.length - 1];\nconst latestCommitTime \u003d new Date(latestCommit.commit.author.date);\n...\nreviewEvents.forEach(review \u003d\u003e {\n  if (new Date(review.submitted_at) \u003c latestCommitTime) {\n    return; // review is stale, ignore it\n  }\n  ...\n});\n```\n\nA merge commit can itself carry diff content -- conflict resolution, or\ncontent brought in from whatever was merged -- so excluding it from \"the\nlatest commit\" means a review submitted *before* that merge commit still\ncounts as approving the PR\u0027s *current* head, even though the reviewer\nnever saw the merge commit\u0027s content.\n\nConcretely: a contributor gets an early, innocuous commit approved by a\nmaintainer, then pushes a merge commit that changes the PR\u0027s actual\ncontent. `getPrApprovers()` still returns that maintainer as a current\napprover, because the merge commit is invisible to its freshness\ncalculation.\n\n`reviewPR()` (in the same file) uses `getPrApprovers()`\u0027s output to\ndecide whether to submit its own `APPROVE` review and call\n`pulls.merge()`:\n\n```js\nif (allModulesApproved \u0026\u0026 !hasSensitiveMetadataChange) {\n  if (!approvers.has(myLogin)) {\n    await octokit.rest.pulls.createReview({ ..., event: \u0027APPROVE\u0027, ... });\n  }\n  await octokit.rest.pulls.merge({ ... });\n  ...\n}\n```\n\nSo this bug lets the bot submit its own fresh `APPROVE` review and merge\na PR based on a maintainer\u0027s approval of content that is no longer\nwhat\u0027s actually being merged.\n\n**Why this is the sole gate, not defense-in-depth:**\n`bazel-central-registry`\u0027s `CODEOWNERS` file explicitly excludes\n`modules/` from GitHub\u0027s native code-owner review requirement:\n```\n*          @bazelbuild/bcr-maintainers\n/modules/\n```\nwith the comment \"which has a bot that manages review requests\" -- i.e.\nthis bot\u0027s own approval decision is the *only* review gate for module\nchanges, there\u0027s no redundant native check backing it up for that path.\n\nI verified the mechanics with a standalone script (not just by reading\nthe source) that reproduces `getPrApprovers()`\u0027s exact logic against\nfabricated commit/review data shaped like the real GitHub API responses:\na review approving commit C1, followed by a 2-parent merge commit C2 as\nthe new PR head, still returns the reviewer as an approver of C2\u0027s\ncontent.\n\n## Fix\n\nUse the PR\u0027s actual last commit (`commits[commits.length - 1]`) as the\nfreshness cutoff, without excluding merge commits. `pulls.listCommits`\nalready returns commits in chronological order, so the last entry is\nalways the true current PR head regardless of its parent count --\nthere\u0027s no need to special-case merge commits at all.\n\nAlso fixed two accidentally-undeclared variables (`existingSubmittedAt`,\n`submittedAt`) in the same block (missing `const`, silently created\nimplicit globals in this non-strict-mode script).\n\n## Test plan\n\n- `node -c index.js`: parses cleanly.\n- Added `index.test.js` (Node\u0027s built-in `node:test` runner, zero new\ndependencies -- this action\u0027s `package.json` had no test setup at all\nbefore this) with a fake `octokit` object supplying fabricated\n`listCommits`/`listReviews` data directly, covering:\n1. The bypass scenario above -- asserts the stale approval no longer\ncounts.\n2. A review genuinely submitted *after* a merge commit -- asserts it\nstill counts (no regression for the legitimate \"approve after syncing\nwith main\" case).\n  3. The plain no-merge-commits case -- asserts unaffected.\n- `npm test` (updated from the placeholder `\"no test specified\"` script\nto `node --test`): all 3 pass.\n\nIndependent from, and a different root cause than, my two earlier fixes\nin this file\u0027s sibling\n(`buildkite/bazel-central-registry/bcr_presubmit.py`, #2739 and #2759)\n-- this one\u0027s in the PR-reviewer bot\u0027s own approval logic, not the\npresubmit command/Starlark generation."
    },
    {
      "commit": "05c3f85a9dadf4c102d234cb830a5a62cf715579",
      "tree": "a476f0692b982bb33a97e605bbe6d9af5b38cd67",
      "parents": [
        "2fdaf2c135840ef72f52993c8c66984065255d88"
      ],
      "author": {
        "name": "Florian Weikert",
        "email": "fwe@google.com",
        "time": "Tue Aug 25 20:41:53 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 25 18:41:53 2026 +0000"
      },
      "message": "Fix priority of most important trusted pipelines. (#2795)\n\n- Infra pipelines (create VM/Docker images) run at highest priority 100\nsince we might need them to fix outages.\n- Release builds run at next highest priority 50 - it\u0027s the next most\nimportant pipeline which should not be blocked by the backlog of\nhttps://buildkite.com/bazel-trusted/publish-bazel-binaries\n- All other pipelines run at default priority 0\n\nCo-authored-by: Xùdōng Yáng \u003cwyverald@gmail.com\u003e"
    },
    {
      "commit": "2fdaf2c135840ef72f52993c8c66984065255d88",
      "tree": "ed79094df65a112ca598baf7be0d61ca66d935ac",
      "parents": [
        "b24a8a986b062fb78bb8bfabb71dd50cecd3304b"
      ],
      "author": {
        "name": "Florian Weikert",
        "email": "fwe@google.com",
        "time": "Tue Aug 25 14:31:38 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 25 14:31:38 2026 +0200"
      },
      "message": "Fix GCE VM image creation pipelines (part 1) (#2793)\n\n- Introduce new env variable to also re-create trusted instance groups\nin the final step. This is currently a no-op - we need to deploy this\nchange via TF, then update\nhttps://github.com/bazelbuild/continuous-integration/blob/master/pipelines/publish-vm-image.yml.\n- Change image VM location -\nhttps://github.com/bazelbuild/continuous-integration/commit/8b0cc1baa274f7e575cdf1e2c3103879ad26027b\nwasn\u0027t enough, we\u0027re still running into quota issues in us-central1-c"
    },
    {
      "commit": "b24a8a986b062fb78bb8bfabb71dd50cecd3304b",
      "tree": "9c1d533f38754555fe2132e2d4999ac63ada32ab",
      "parents": [
        "021d3385e611ad6da11688f845f7e59419f0f0fa"
      ],
      "author": {
        "name": "Ian (Hee) Cha",
        "email": "heec@google.com",
        "time": "Tue Aug 25 07:48:56 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 25 07:48:56 2026 +0000"
      },
      "message": "Migrate from gsutil to gcloud storage for `mirror.sh` (#2818)\n\nIn order for `mirror.sh` to work for mirroring artifacts, we are\nreplacing `gsutil` to `gcloud storage` as per the Google official\nguidelines."
    },
    {
      "commit": "021d3385e611ad6da11688f845f7e59419f0f0fa",
      "tree": "ec931eedb88f3689c61338f7bf5a9d9ba9c76c6b",
      "parents": [
        "51fc8f4e16a1d36ffa2ea85cc42c65ea44ba02af"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Mon Aug 24 15:13:57 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 24 15:13:57 2026 -0400"
      },
      "message": "Remove docker mount from pipeline ymls (#2819)\n\nThese should not have been necessary in the first place."
    },
    {
      "commit": "51fc8f4e16a1d36ffa2ea85cc42c65ea44ba02af",
      "tree": "05ac85aa898c2023cd59dae875b38bc60fb9cba8",
      "parents": [
        "47d5ff02f7c1108d72b1d9182bf64d43ce2c539e"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Mon Aug 24 14:34:04 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 24 14:34:04 2026 -0400"
      },
      "message": "Remove docker socket mount (#2817)\n\nMost uses of this mount point should have been refactored or removed."
    },
    {
      "commit": "47d5ff02f7c1108d72b1d9182bf64d43ce2c539e",
      "tree": "6211de66baf9630ed0d359c73f60c0de1f2fee85",
      "parents": [
        "438f023b193d850461a45b8cb172ef2516cd8133"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Fri Aug 21 11:36:50 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 21 09:36:50 2026 +0000"
      },
      "message": "Fix build event JSON file path conversion flag (#2805)\n\n(Create a small change to see if our CI Smoke Test works)"
    },
    {
      "commit": "438f023b193d850461a45b8cb172ef2516cd8133",
      "tree": "58d05a532560ddfc59095326612b195be06e5e1a",
      "parents": [
        "2e09259514e759f3b1bc1586b3dac09b607222e5"
      ],
      "author": {
        "name": "Yun Peng",
        "email": "pcloudy@google.com",
        "time": "Thu Aug 20 23:49:46 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 20 21:49:46 2026 +0000"
      },
      "message": "bcr-pr-reviewer: Avoid repeating identical comments on PRs (#2803)\n\nPreviously, `postComment` only checked whether an identical comment had\nbeen posted in the past 14 days. This caused informational notices (such\nas sensitive metadata modification warnings, file limit alerts, and\nmaintainer notifications) to be re-posted every 2–4 weeks whenever PR\nactivity occurred.\n\nThese repeated comments generated notification noise and interfered with\nGitHub\u0027s stale bot action by repeatedly resetting the PR\u0027s activity\ntimestamp, preventing inactive PRs from being automatically closed. See\nhttps://github.com/bazelbuild/bazel-central-registry/pull/8523\n\nThis PR updates `postComment` to check all existing comments on the PR\nso that identical bot comments are only posted once."
    },
    {
      "commit": "2e09259514e759f3b1bc1586b3dac09b607222e5",
      "tree": "3b23b285615bf862ab824e060cd838a65b42035f",
      "parents": [
        "34b3e3871f8b0da8fc970cfb605736128f25eb1e"
      ],
      "author": {
        "name": "Ted",
        "email": "tedx@google.com",
        "time": "Thu Aug 20 14:11:29 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 20 14:11:29 2026 -0400"
      },
      "message": "Update buildtools repo URL (#2813)\n\nThe buildtools repo is now under bazel-contrib."
    }
  ],
  "next": "34b3e3871f8b0da8fc970cfb605736128f25eb1e"
}