Merge upstream rules_jvm_external 7.2 by vinnybod · Pull Request #87 · confluentinc/rules_jvm_external

Vincent Rose (vinnybod) · 2026-10-13T17:40:51Z

Rationale

Brings our fork up to date with upstream rules_jvm_external 7.2 (merged at e75220a), following the same merge approach as the previous upstream syncs. The only conflict was the generated rules_jvm_external_deps_install.json, which I resolved by repinning from the merged MODULE.bazel so our commons-logging addition is kept.

Diffs

Remaining difference between our fork and upstream 7.2: bazel-contrib/rules_jvm_external@7.2...confluentinc:rules_jvm_external:vinnybod/sync-upstream-7
Upstream changelog since our last sync: bazel-contrib/rules_jvm_external@7.0...7.2

Risk

Blast radius: Medium. Every consumer of this fork picks up the 7.1 and 7.2 upstream changes (resolver, Gradle, bzlmod layering fixes).
Change criticality: Low. No hand-written Confluent code changed; the one conflict was a generated lockfile.
Overall: Low-Medium.
Mitigations: Plain upstream merge with no local edits beyond the lockfile repin, and easy to revert as a single merge commit.

Why this is safe

The Confluent-specific changes (commons-logging dependency, CODEOWNERS, HeadProber back-out) merged without conflict, and //private/tools/... and //private/lib/... build cleanly after the merge. Upstream already released 7.2 with its own CI.

Pre-Submission Review

None run (merge of an upstream release; build sanity check only).

🤖 Generated with Claude Code

This involves rewriting the Android Kotlin app to avoid AppCompat as otherwise the `install` tag became a mess, and that's not what we're trying to demonstrate.

Gradle 9.x requires JVM 17 to run, so this also bumps the project's default Java toolchain in .bazelrc from 11 to 17. Downstream projects can continue targeting Java 11 with their own .bazelrc, though using the Gradle resolver will require JVM 17+. --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

The `filename:` query was a part of a legacy implementation of code search. The current equivalent is `path:` [1]. [1] github/docs#24666

…1152) (bazel-contrib#1546) Use Collections.synchronizedList and synchronized block in getExceptions() to prevent NullPointerException when multiple threads add exceptions concurrently during Maven resolution. Extract common addExceptionIfPresent method with null-safe event check. Add ErrorReportingListenerTest to verify thread safety. Closes bazel-contrib#1152

Invoke AddJarManifestEntry_deploy.jar with current_java_runtime in the exec configuration instead of executing the AddJarManifestEntry java_binary launcher. This preserves --tool_java_runtime_version and selects Java for the execution platform when the target and execution platforms differ. Treat AddJarManifestEntry_deploy.jar and JavaRuntimeInfo.files as action tools. Add jvm_import_uses_execution_platform_java_runtime_test with an Android s390x target platform. Android s390x has no Java runtime toolchain, so the test fails if StampJarManifest or CreateCompileJar resolves Java against the target platform. The test also verifies that both actions pass AddJarManifestEntry_deploy.jar to Java.

…esolving (bazel-contrib#1585) Replace the `Map<Coordinates, Path>` side-channel on `ResolutionResult` with a `Map<Coordinates, ResolvedArtifact>` that has an entry for every node in the resolved graph. Each `ResolvedArtifact` holds its coordinates and an optional path, so "this node has no known binary" is represented explicitly rather than inferred from an absent map entry. This is a pure refactoring: the Maven and Gradle resolvers populate the new shape from exactly the information they already had, the downloader still receives the same set of known paths, and the lock file, its format, and the resolved-artifact hashes are all unchanged. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

`amend_artifact` previously searched only the `artifacts` list, so a BOM (declared via `install(boms = ...)` or split out of a `from_toml` `libs.versions.toml` via `bom_modules`) could not be amended. The amendment failed with "No artifact found matching coordinates" because BOMs are tracked in a separate list that the amendment never searched. `amend_artifact` now searches both the artifacts and boms lists, so a BOM's version and other properties can be adjusted through the same mechanism as a regular artifact (for example, force-pinning a BOM version so transitive deps can't silently upgrade it). Add unit tests covering amendment of artifacts, BOMs, and the no-match case. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

…rib#1543)

)

…ntrib#1600)

) Closing the ProjectConnection alone leaves the Tooling API's daemon running for reuse. Call disconnect() on the connector so the daemon is shut down once pinning completes.

…y. (bazel-contrib#1599) Top-level Kotlin functions, properties, and type aliases compile into a synthetic <File>Kt facade, so they were invisible to the class-name index and could not be attributed to an artifact in split packages. Read them from the @kotlin.Metadata annotation via kotlin-metadata-jvm and fold the public ones into the class index under their Kotlin source names.

`package-info.class` files only hold package-level annotations and cannot be referenced from production code, so they should never appear in the indexed class set.

Co-authored-by: Nikolay <n.matyushin@tawasal.ae>

The shared cache is now used unless RJE_UNSAFE_CACHE is set to "0" or "false". The CLI flag --use_unsafe_shared_cache has been replaced by --use_unique_cache, which opts out of the shared cache. Maven and Gradle docs updated accordingly. Coursier behaviour is unchanged for now. --------- Co-authored-by: Claude <noreply@anthropic.com>

…rib#1602) `bazel run @maven//:outdated` failed with "Unable to access jarfile" under --noenable_runfiles (the default on Windows) because the generated sh_binary passed cwd-relative rootpaths, which only resolve inside a materialised runfiles tree. Resolve the arguments with the Bash runfiles library instead, as :pin already does. Co-authored-by: Claude <noreply@anthropic.com>

The Gradle resolver was flattening multiple selected variants of the same module into a single dependency node. When a module was resolved both as its main jar and as test fixtures, we merged their outgoing dependencies and then stamped that merged child set onto both output coordinates. That can create self loops and main-to-test-fixtures back-edges in the generated lockfile, which Bazel cannot repair downstream. Fix this by keeping variant identity through resolution so each selected variant keeps its own dependency set. Variants are classified and artifacts are attached to them using Gradle capabilities, the canonical identity for feature variants, so any capability-based variant is handled, not just test fixtures. Requested test-fixtures classifiers resolve through Gradle's testFixtures(...) notation instead of being treated like an ad hoc classifier fetch.

…bazel-contrib#1589) Provides pluggable SPIs for rules_jvm_external's dependency resolution, allowing custom download/caching and authentication implementations (such as integrating with Bazel's remote fetcher/downloader APIs) to be registered via classpath plugins. Key Changes: 1. Public API Targets & SPIs: - Created public interfaces for MetadataService, DependencyMetadata, and DownloadService. - Added a generic SpiLoader utility to load classpath SPI service implementations (ensuring at most one implementation is loaded per SPI). - Exposed custom classpath library loading via the new resolver_extra_dependencies attribute. - Decomposed the API targets into fine-grained libraries: :api_core, :download_service, :metadata_service, and :spi_loader. - Relocated the build definition closer to the sources in //resolver/src/main/java/com/github/bazelbuild/rules_jvm_external/resolver/BUILD. - Flattened public SPI classes into a single package (com.github.bazelbuild.rules_jvm_external.resolver) to prevent split-package issues and avoid spanning multiple packages. 2. Aether & Downloader SPI Integration: - Replaced Aether's default HTTP transport with a custom HttpDownloaderTransporterFactory, routing all POM, BOM, and metadata lookups through the pluggable DownloadService SPI. - Extracted HttpDownloaderTransporter into its own top-level package-private class. - Renamed DownloadService.download to get to match HTTP verb naming conventions and align with head. - Implemented null-safe defensive copying of collections in DependencyMetadata constructor using Set.copyOf/Map.copyOf. 3. Inline URL Credentials Handling: - Aether downloads are now routed through the pluggable DownloadService SPI backed by HttpDownloader without inline credentials support (making both resolution and downloading fail consistently). Users must configure credentials via .netrc instead. - Deleted the shouldDownloadOverHttpWithAuthenticationPassedInOnRepoUrl test from ResolverTestBase.java since that flow does not work and is explicitly unsupported. 4. Cleanup & Optimization: - Removed final modifier from SpiLoader class and refactored joining logic to use Guava Joiner. - Removed redundant metadata caches and unused resolver binaries.

…into `http_file downloads (bazel-contrib#1604)

Making the example build under Bazel 9 needed protobuf pinned back to 33.4 (35.0 requires Bazel >= 8, which was breaking the 7.x cell), an explicit `rules_java` bazel_dep, and `load` statements for `java_library` and `java_proto_library` since Bazel 9 no longer autoloads them.

-noverify was removed in JDK 27 (deprecated since JDK 13) and now causes the launcher to fail with an unrecognized option error. It was only needed for proguarded coursier JARs from very old releases: coursier/coursier#1245

Signed-off-by: Simon Mavi Stewart <simon.m.stewart@gmail.com>

…ntrib#1626)

) When pinning a large dependency graph with resolver = "gradle", the pin aborted non-deterministically with FileAlreadyExistsException while copying a freshly-downloaded artifact into the local cache. The failing artifact differed from run to run: whichever one lost a race between parallel downloader threads. For the Gradle resolver, localRepository is the shared Gradle module cache, which the Gradle daemon and other worker threads write to concurrently. Downloader.performDownload cached downloads with Files.copy(REPLACE_EXISTING), which is not atomic: REPLACE_EXISTING only removes a target present at check time, so a target created in the TOCTOU window makes the copy fail. A plain copy also lets another worker observe a half-written cache file through the Files.exists check at the top of performDownload. Cache to a temp file in the destination directory, then atomically move it into place. These artifacts are content-addressed, so a destination another writer already produced is success, and FileAlreadyExistsException on the move is ignored.

…azel-contrib#1601) Coursier derives its default cache location from the JVM's `user.home`, which on Linux comes from the passwd database and ignores $HOME, while these rules derive the shared cache location from $HOME. When the two disagree (e.g. $HOME remapped to a network mount), repinning bypasses the shared cache and fails with "Error while trying to parse the path of file in the coursier cache". Pass the computed location to the spawned coursier process via COURSIER_CACHE, as the pinned flow already does. If no variable a cache location can be derived from is set, leave the environment untouched. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…-contrib#1614) When fetch_sources = True and an artifact publishes a main jar but no sources jar (for example the empty com.google.guava:listenablefuture jar that Guava depends on), the Maven and Gradle resolvers' shared download phase threw UriNotFoundException instead of treating the sources jar as absent, failing the whole resolution. Downloader.download now returns null for a missing sources/javadoc jar so the caller can skip it, matching the `if (sdm != null)` guard already in AbstractMain.getDependencyInfos. Adds a DownloaderTest unit reproducer plus end-to-end guava installs exercised via both the Maven and Gradle resolvers.

The example loaded `pkg_tar` from `@bazel_tools//tools/build_defs/pkg:pkg.bzl`, which has been deprecated in favor of rules_pkg for years and is slated for removal from `@bazel_tools`.

Fixes bazel-contrib#1489

…ib#1618 (bazel-contrib#1629) Filter testonly non-root artifacts before the conflicting-force check so that declarations layering drops cannot fail the build. Report equal-version force displacement with an RJE_VERBOSE-gated INFO diagnostic; the non-root declaration previously replaced the root's silently. Rename the addtional_artifact_message variable.

…ib#1631)

…ml (bazel-contrib#1612)

Conflict in rules_jvm_external_deps_install.json resolved by repinning @rules_jvm_external_deps from the merged MODULE.bazel (keeps the commons-logging addition). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Copilot

🟡 Changes recommended

Resolver authentication, SPI cache ownership, BOM replacement, and renamed Kotlin facade indexing have unresolved correctness issues.

3 open findings

What changed in this PR

Merges upstream rules_jvm_external 7.2, updating resolver extensibility, Gradle/Maven behavior, lockfiles, examples, tests, and release automation while preserving fork-specific dependencies.

Changes:

Adds resolver SPIs, shared-cache defaults, Gradle variant handling, and Maven transport changes.
Expands lockfile, Kotlin indexing, publishing, dependency-layering, and regression coverage.
Updates examples, documentation, Java 17 defaults, and BCR publishing automation.

File	Description
`tests/unit/version_conflict_policy_test.bzl`	Tests resolver pinning policies.
`tests/unit/version_catalogs_test.bzl`	Tests TOML BOM markers.
`tests/unit/v3_lock_file_test.bzl`	Tests null-checksum artifacts.
`tests/unit/jvm_import/jvm_import_test.bzl`	Tests execution Java runtime use.
`tests/unit/jvm_import/BUILD`	Adds test target platform.
`tests/unit/dependency_tree_parser_test.bzl`	Tests exclusions and overrides.
`tests/unit/coursier_test.bzl`	Expands cache and duplicate tests.
`tests/unit/concat_coursier_options_test.bzl`	Tests option concatenation.
`tests/unit/build_tests/BUILD`	Adds missing-source builds.
`tests/unit/BUILD`	Registers new unit suites.
`tests/unit/amend_artifact_test.bzl`	Tests artifact/BOM amendments.
`tests/integration/override_targets/BUILD`	Tests original AAR targets.
`tests/integration/libs.versions.toml`	Adds BOM field example.
`tests/integration/gradle-classifier-pinning-deps.golden.unix`	Adds Gradle pinning baseline.
`tests/integration/coursier-pinned-layering-deps.golden.unix`	Adds pinned layering baseline.
`tests/integration/coursier-layering-deps.golden.unix`	Adds layering baseline.
`tests/integration/coursier_higher_layer/MODULE.bazel`	Adds layered Coursier module.
`tests/integration/BUILD`	Adds layering integration tests.
`tests/custom_maven_install/regression_testing_gradle_index.json`	Updates generated Kotlin index.
`tests/custom_maven_install/policy_pinned_testing_install.json`	Migrates lockfile to v3.
`tests/custom_maven_install/maven_missing_source_jar_install.json`	Adds Maven source regression lockfile.
`tests/custom_maven_install/m2local_testing_with_pinned_file_install.json`	Updates m2local lockfile.
`tests/custom_maven_install/gradle_missing_source_jar_install.json`	Adds Gradle source regression lockfile.
`tests/custom_maven_install/from_files_install.json`	Adds TOML BOM input hash.
`tests/custom_maven_install/coursier_resolved_install.json`	Refreshes generated resolution metadata.
`tests/custom_maven_install/bom_only_pinning_install.json`	Adds BOM-only lockfile.
`tests/com/github/bazelbuild/rules_jvm_external/resolver/ui/BUILD`	Registers console listener test.
`tests/com/github/bazelbuild/rules_jvm_external/resolver/ui/AnsiConsoleListenerTest.java`	Tests terminal elision.
`tests/com/github/bazelbuild/rules_jvm_external/resolver/ResolverTestBase.java`	Adapts resolved artifact assertions.
`tests/com/github/bazelbuild/rules_jvm_external/resolver/MavenRepo.java`	Adds artifact-only fixtures.
`tests/com/github/bazelbuild/rules_jvm_external/resolver/maven/MavenResolverTest.java`	Tests duplicate direct versions.
`tests/com/github/bazelbuild/rules_jvm_external/resolver/maven/ErrorReportingListenerTest.java`	Tests concurrent error recording.
`tests/com/github/bazelbuild/rules_jvm_external/resolver/maven/DownloaderTest.java`	Tests cache races and missing sources.
`tests/com/github/bazelbuild/rules_jvm_external/resolver/maven/BUILD`	Registers Maven tests.
`tests/com/github/bazelbuild/rules_jvm_external/resolver/gradle/GradleResolverLoggingTest.java`	Tests SLF4J provider selection.
`tests/com/github/bazelbuild/rules_jvm_external/resolver/gradle/GradleResolvedDependencyImplTest.java`	Tests feature variants.
`tests/com/github/bazelbuild/rules_jvm_external/resolver/gradle/GradleBuildScriptGeneratorTestFixturesTest.java`	Tests test-fixture notation.
`tests/com/github/bazelbuild/rules_jvm_external/resolver/gradle/fixtures/testFixturesVariant/sample-2.0.module`	Adds Gradle fixture metadata.
`tests/com/github/bazelbuild/rules_jvm_external/resolver/gradle/fixtures/testFixturesVariant/sample-1.0.module`	Adds Gradle fixture metadata.
`tests/com/github/bazelbuild/rules_jvm_external/resolver/gradle/fixtures/strictTransitiveConstraint/app-1.0.module`	Adds strict-constraint fixture.
`tests/com/github/bazelbuild/rules_jvm_external/resolver/gradle/fixtures/BUILD`	Exposes new fixtures.
`tests/com/github/bazelbuild/rules_jvm_external/resolver/gradle/BUILD`	Registers Gradle tests.
`tests/com/github/bazelbuild/rules_jvm_external/resolver/BUILD`	Adds public resolver dependency.
`tests/com/github/bazelbuild/rules_jvm_external/maven/MavenPublisherTest.java`	Tests POM-only and archive publishing.
`tests/com/github/bazelbuild/rules_jvm_external/jar/testdata/TopLevel.kt`	Adds Kotlin indexing fixture.
`tests/com/github/bazelbuild/rules_jvm_external/jar/MergeJarsTest.java`	Tests executable-jar exclusions.
`tests/com/github/bazelbuild/rules_jvm_external/jar/BUILD`	Builds Kotlin fixture.
`tests/bazel_run_tests.sh`	Expands integration regressions.
`resolver/src/main/java/com/github/bazelbuild/rules_jvm_external/resolver/ResolutionRequest.java`	Adds public resolution requests.
`resolver/src/main/java/com/github/bazelbuild/rules_jvm_external/resolver/MetadataService.java`	Adds metadata SPI.
`resolver/src/main/java/com/github/bazelbuild/rules_jvm_external/resolver/DownloadService.java`	Adds download SPI.
`resolver/src/main/java/com/github/bazelbuild/rules_jvm_external/resolver/DependencyMetadata.java`	Defines SPI metadata results.
`resolver/src/main/java/com/github/bazelbuild/rules_jvm_external/resolver/Artifact.java`	Adds public artifact model.
`resolver/BUILD`	Exposes resolver API library.
`RELEASING.md`	Documents automated BCR publishing.
`README.md`	Updates links and cache defaults.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/ui/AnsiConsoleListener.java`	Fixes line-width elision.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/SpiLoader.java`	Adds single-provider SPI loading.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/ResolvedArtifact.java`	Models resolved paths.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/ResolutionResult.java`	Returns resolved artifacts.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/remote/META-INF/services/com.github.bazelbuild.rules_jvm_external.resolver.remote.MetadataService`	Adds empty service registration.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/remote/LocalMetadataService.java`	Implements local metadata lookup.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/remote/HttpDownloader.java`	Integrates download SPI.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/remote/Downloader.java`	Handles optional artifacts and cache races.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/remote/BUILD`	Adds metadata/SPI dependencies.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/maven/MavenResolver.java`	Uses custom Maven transport.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/maven/HttpDownloaderTransporterFactory.java`	Adds Aether transporter factory.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/maven/HttpDownloaderTransporter.java`	Bridges Aether downloads to SPI.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/maven/ErrorReportingListener.java`	Makes error collection thread-safe.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/maven/BUILD`	Exposes Maven resolver library.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/lockfile/V3LockFile.java`	Represents missing checksums explicitly.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/lockfile/BUILD`	Extends test visibility.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/gradle/models/GradleResolvedDependencyImpl.java`	Tracks variants and deduplicates artifacts.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/gradle/models/GradleResolvedDependency.java`	Extends variant model API.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/gradle/models/GradleResolvedArtifactImpl.java`	Stores artifact capabilities.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/gradle/models/GradleResolvedArtifact.java`	Extends artifact model API.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/gradle/logback.xml`	Removes Logback configuration.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/gradle/GradleResolver.java`	Handles feature-variant graphs.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/gradle/GradleProject.java`	Disconnects Gradle daemons.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/gradle/GradleBuildScriptGenerator.java`	Generates variant-aware notation.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/gradle/data/build.gradle.hbs`	Uses generated dependency notation.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/gradle/BUILD`	Exposes Gradle resolver library.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/cmd/ResolverConfig.java`	Makes shared caches default.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/cmd/BUILD`	Adds resolver API dependency.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/cmd/AbstractMain.java`	Integrates metadata SPI.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/resolver/BUILD`	Splits resolver implementation sources.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/maven/MavenPublisher.java`	Supports POM-only and compound archives.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/jar/MergeJars.java`	Reads preambled ZIP exclusions.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/jar/KotlinTopLevel.java`	Extracts Kotlin top-level declarations.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/jar/IndexJar.java`	Indexes AAR and Kotlin contents.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/jar/BUILD`	Adds Kotlin metadata dependencies.
`private/tools/java/com/github/bazelbuild/rules_jvm_external/BUILD`	Splits coordinates library.
`private/rules/v3_lock_file.bzl`	Avoids synthetic files without checksums.
`private/rules/pin_dependencies.bzl`	Includes hash file in outputs.
`private/rules/maven_install.bzl`	Adds resolver classpath extensions.
`private/rules/jvm_import.bzl`	Runs jar tools with execution Java.
`private/outdated.sh`	Adds robust runfiles lookup.
`private/extensions/download_pinned_deps.bzl`	Skips fileless artifacts.
`private/dependency_tree_parser.bzl`	Applies exclusions and override fixes.
`gradle.BUILD.bazel`	Reformats Gradle runtime import.
`examples/spring_boot/src/test/java/hello/HelloControllerTest.java`	Updates Spring test imports.
`examples/spring_boot/src/test/java/hello/HelloControllerIT.java`	Updates REST test setup.
`examples/spring_boot/src/test/java/hello/BUILD`	Adds Spring 4 dependencies.
`examples/spring_boot/MODULE.bazel`	Upgrades Spring Boot example.
`examples/simple/MODULE.bazel`	Refreshes example dependencies.
`examples/scala_akka/src/main/scala/hello/Server.scala`	Clarifies Scala result type.
`examples/scala_akka/MODULE.bazel`	Upgrades Scala/Akka dependencies.
`examples/scala_akka/BUILD`	Updates PureConfig targets.
`examples/protobuf-java/MODULE.bazel`	Upgrades Protobuf and Skylib.
`examples/protobuf-java/maven_install.json`	Refreshes Protobuf lockfile.
`examples/pom_file_generation/MODULE.bazel`	Refreshes POM example dependencies.
`examples/kt_android_local_test/MODULE.bazel`	Upgrades Android test dependencies.
`examples/java-export/src/main/proto/BUILD`	Loads Java rule definitions.
`examples/java-export/src/main/java/com/github/bazelbuild/rulesjvmexternal/example/export/BUILD`	Migrates packaging rule load.
`examples/java-export/MODULE.bazel`	Adds Java/pkg modules and upgrades dependencies.
`examples/android_local_test/MODULE.bazel`	Upgrades Android dependencies.
`examples/android_kotlin_app/src/res/values/styles.xml`	Uses platform Material theme.
`examples/android_kotlin_app/src/java/com/example/bazel/MainActivity.kt`	Migrates to ComponentActivity.
`examples/android_kotlin_app/src/BUILD`	Simplifies Android dependencies.
`examples/android_kotlin_app/MODULE.bazel`	Refreshes Android app dependencies.
`docs/bzlmod-api.md`	Documents layered pinning.
`BUILD`	Exposes Kotlin implementation API.
`.github/workflows/release.yaml`	Triggers BCR publishing.
`.github/workflows/publish.yaml`	Configures reusable BCR workflow.
`.bcr/source.template.json`	Adds BCR source template.
`.bcr/presubmit.yml`	Adds BCR test matrix.
`.bcr/metadata.template.json`	Adds BCR metadata template.
`.bazelrc`	Moves builds to Java 17.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+    locator.setServices(
+        TransporterFactory.class,
+        new HttpDownloaderTransporterFactory(downloadService),
+        new FileTransporterFactory());


+      if (isKotlinFileFacade(entry.getName())) {
+        for (String declaration : KotlinTopLevel.topLevelDeclarationNames(zis.readAllBytes())) {
+          classes.add(packageName.isEmpty() ? declaration : packageName + "." + declaration);
+        }


+    if (!"file".equals(uri.getScheme())) {
+      Files.deleteIfExists(downloaded);
+    }


Andrius Bankauskas (Andrius-B) and others added 30 commits May 15, 2026 17:37

Prefer getenv to env.get (bazel-contrib#1568)

4df0012

update environment variable handling for pinning (bazel-contrib#1573)

4476a21

Fix MavenPublisher to support POM-only publications (bazel-contrib#1574)

bca5471

Bump the deps in the Spring Boot examples (bazel-contrib#1580)

aa34b3f

Update remaining examples (bazel-contrib#1581)

96b3926

This involves rewriting the Android Kotlin app to avoid AppCompat as otherwise the `install` tag became a mess, and that's not what we're trying to demonstrate.

Fix link to docs/bzlmod.md in README.md (bazel-contrib#1564)

18abf9c

Fix GitHub search query in README (bazel-contrib#1550)

b99243e

The `filename:` query was a part of a legacy implementation of code search. The current equivalent is `path:` [1]. [1] github/docs#24666

Allow boms to be defined in the gradle version catalogues (bazel-cont…

e37e630

…rib#1543)

Apply Maven exclusions to generated deps (bazel-contrib#1594)

7d65543

Fix BOM-only pinning (bazel-contrib#1592)

9772dfa

Fix null shasum artifacts in v3 locks (bazel-contrib#1591)

8378beb

Preserve compound archive extensions when publishing (bazel-contrib#1590

87f4451

)

Add publish-to-bcr automation (bazel-contrib#1587)

8f8a17e

Fix resolver NPE for no-binary artifacts (bazel-contrib#1595)

723d203

Fix TOML AAR overrides using original artifact copy targets (bazel-co…

c0ff7f6

…ntrib#1600)

fix: stop Gradle daemons after dependency resolution (bazel-contrib#1598

32fd664

) Closing the ProjectConnection alone leaves the Tooling API's daemon running for reuse. Call disconnect() on the connector so the daemon is shut down once pinning completes.

Skip package-info.class when indexing jars (bazel-contrib#1597)

38ac77b

`package-info.class` files only hold package-level annotations and cannot be referenced from production code, so they should never appear in the indexed class set.

Don't deduplicate additional_coursier_options (bazel-contrib#1596)

b6dd5dc

Co-authored-by: Nikolay <n.matyushin@tawasal.ae>

fix: honour pinned versions in external resolvers (bazel-contrib#1606)

c1b3e5e

BOM/POM coordinates condition marked as skipped must not be turned …

5eb595d

…into `http_file downloads (bazel-contrib#1604)

Simon Mavi Stewart (shs96c) and others added 19 commits July 23, 2026 15:59

Return repo_metadata from repository rules (bazel-contrib#1616)

63aa53e

Remove -noverify (bazel-contrib#1620)

e98a2bc

-noverify was removed in JDK 27 (deprecated since JDK 13) and now causes the launcher to fail with an unrecognized option error. It was only needed for proguarded coursier JARs from very old releases: coursier/coursier#1245

perf: speed up java export exclusions (bazel-contrib#1624)

6c20569

Signed-off-by: Simon Mavi Stewart <simon.m.stewart@gmail.com>

fix: Improve Gradle resolver console output (bazel-contrib#1623)

794bfda

build: update rules_kotlin to 2.4.0 (bazel-contrib#1621)

ae4da88

feat: expose kt_defs.bzl via public bzl_library for stardoc (bazel-co…

449754d

…ntrib#1626)

Handle overrides for fileless artifacts (bazel-contrib#1625)

72233eb

Use rules_pkg in the java-export example (bazel-contrib#1628)

bc5c4de

The example loaded `pkg_tar` from `@bazel_tools//tools/build_defs/pkg:pkg.bzl`, which has been deprecated in favor of rules_pkg for years and is slated for removal from `@bazel_tools`.

Encapsulate bzlmod dependency layering (bazel-contrib#1618)

4f38388

Add support for AAR files to IndexJar (bazel-contrib#1490)

dcf5381

Fixes bazel-contrib#1489

fix: honour pinned versions in layered coursier installs (bazel-contr…

cbac915

…ib#1631)

fix(publish): Apparently we need a specific version of the publish ya…

7f53fc5

…ml (bazel-contrib#1612)

chore: prep for the 7.2 release (bazel-contrib#1633)

e75220a

Merge upstream rules_jvm_external 7.2 into master

f8710d0

Conflict in rules_jvm_external_deps_install.json resolved by repinning @rules_jvm_external_deps from the merged MODULE.bazel (keeps the commons-logging addition). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Copilot AI balanced review requested due to automatic review settings October 13, 2026 17:40

Copilot started reviewing on behalf of Vincent Rose (vinnybod) October 13, 2026 17:41

View session

Copilot AI reviewed Oct 13, 2026

View reviewed changes

Vincent Rose (vinnybod) marked this pull request as ready for review October 13, 2026 18:57

Vincent Rose (vinnybod) requested a review from a team as a code owner October 13, 2026 18:57

Vincent Rose (vinnybod) enabled auto-merge October 13, 2026 18:57

Vincent Rose (vinnybod) assigned Sunghoon Park (supark-cflt) Oct 13, 2026

Sunghoon Park (supark-cflt) approved these changes Oct 13, 2026

View reviewed changes

Vincent Rose (vinnybod) disabled auto-merge October 13, 2026 20:29

Vincent Rose (vinnybod) merged commit f00ccf0 into master Oct 13, 2026
3 checks passed

Vincent Rose (vinnybod) deleted the vinnybod/sync-upstream-7 branch October 13, 2026 20:29

Navigation Menu

Repository navigation

Merge upstream rules_jvm_external 7.2 - #87

Merge upstream rules_jvm_external 7.2#87
Vincent Rose (vinnybod) merged 51 commits into
masterfrom
vinnybod/sync-upstream-7

Vincent Rose (vinnybod) commented Oct 13, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Conversation

Vincent Rose (vinnybod) commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rationale

Diffs

Risk

Why this is safe

Pre-Submission Review

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Vincent Rose (vinnybod) commented Oct 13, 2026 •

edited

Loading