Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Config Migration Needed

• Select this checkbox to let Renovate create an automated Config Migration PR.

PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

• Update dependency com.google.auto.value:auto-value to v1.11.1
• Update dependency com.google.auto.value:auto-value-annotations to v1.11.1
• Update dependency junit:junit to v4.13.2
• Update dependency bazel_features to v1.51.0
• Update dependency bazel_lib to v3.5.0
• Update dependency bazel_skylib to v1.9.0
• Update dependency com.google.dagger:dagger to v2.60.1
• Update dependency com.google.dagger:dagger-compiler to v2.60.1
• Update dependency com.google.dagger:dagger-producers to v2.60.1
• Update dependency com.google.errorprone:error_prone_annotations to v2.50.0
• Update dependency com.google.guava:guava to v33.6.0-jre
• Update dependency com.google.truth:truth to v0.46
• Update dependency org.apache.commons:commons-compress to v1.28.0
• Update dependency org.jetbrains.kotlinx:kotlinx-coroutines-core to v1.11.0
• Update dependency rules_java to v8.16.1
• Update dependency rules_pkg to v1.2.0
• Update dependency rules_shell to v0.8.0
• Update dependency com.google.truth:truth to v1
• Update dependency dev.zacsweers.autoservice:auto-service-ksp to v1
• Update dependency platforms to v1
• Update dependency rules_java to v9

Detected Dependencies

bazel-module (1)

MODULE.bazel (38)

• platforms 0.0.11 → [Updates: 1.1.0]
• bazel_skylib 1.8.2 → [Updates: 1.9.0]
• rules_java 8.9.0 → [Updates: 8.16.1, 9.7.0]
• rules_license 1.0.0
• rules_android 0.7.3
• bazel_features 1.50.0 → [Updates: 1.51.0]
• bazel_lib 3.1.0 → [Updates: 3.5.0]
• rules_shell 0.4.1 → [Updates: 0.8.0]
• bazel_worker_api 0.0.11
• bazel_worker_java 0.0.11
• buildifier_prebuilt 8.5.1.3
• rules_multirun 0.14.0
• rules_jvm_external 7.0
• bazel_ci_rules 2.0.0
• rules_pkg 1.0.1 → [Updates: 1.2.0]
• stardoc 0.8.1
• rules_testing 0.9.0
• rules_bazel_integration_test 0.37.1
• com.google.code.findbugs:jsr305 3.0.2
• com.google.errorprone:error_prone_annotations 2.23.0 → [Updates: 2.50.0]
• junit:junit 4.13-beta-3 → [Updates: 4.13.2]
• com.google.guava:guava 33.0.0-jre → [Updates: 33.6.0-jre]
• com.google.truth:truth 0.45 → [Updates: 0.46, 1.4.5]
• com.google.auto.service:auto-service 1.1.1
• com.google.auto.service:auto-service-annotations 1.1.1
• com.google.auto.value:auto-value 1.11.0 → [Updates: 1.11.1]
• com.google.auto.value:auto-value-annotations 1.11.0 → [Updates: 1.11.1]
• com.google.dagger:dagger 2.57.2 → [Updates: 2.60.1]
• com.google.dagger:dagger-compiler 2.57.2 → [Updates: 2.60.1]
• com.google.dagger:dagger-producers 2.57.2 → [Updates: 2.60.1]
• javax.inject:javax.inject 1
• org.apache.commons:commons-compress 1.26.2 → [Updates: 1.28.0]
• com.eed3si9n.jarjar:jarjar 1.16.0
• dev.zacsweers.autoservice:auto-service-ksp jar → [Updates: 1.2.0]
• com.squareup.moshi:moshi 1.15.2
• com.squareup.moshi:moshi-kotlin 1.15.2
• com.squareup.moshi:moshi-kotlin-codegen 1.15.2
• org.jetbrains.kotlinx:kotlinx-coroutines-core 1.4.2 → [Updates: 1.11.0]

bazelisk (1)

.bazelversion (1)

• bazel 9.2.0

github-actions (3)

.github/workflows/publish.yaml (1)

• bazel-contrib/publish-to-bcr v1.4.2

.github/workflows/release.yml (4)

• actions/checkout v7
• actions/cache v6
• actions/setup-java v5
• softprops/action-gh-release v3

.github/workflows/stale.yml (1)

• actions/stale v10

---

• Check this box to trigger a request for Renovate to run again on this repository

[ulfjack]

@Bencodes , why did you close the update to rules_python 1.9 (https://github.com/bazel-contrib/rules_kotlin/pull/1522/changes)? This repository is actually running rules_python 1.7. The way Bazel dependency resolution works, it uses the latest version referenced in the dependency graph regardless of what you specify in the MODULE.bazel, and the latest version in this repo's dependency graph is 1.7:

$ grep "rules_python/1" MODULE.bazel.lock 
    "https://bcr.bazel.build/modules/rules_python/1.0.0/MODULE.bazel": "898a3d999c22caa585eb062b600f88654bf92efb204fa346fb55f6f8edffca43",
    "https://bcr.bazel.build/modules/rules_python/1.3.0/MODULE.bazel": "8361d57eafb67c09b75bf4bbe6be360e1b8f4f18118ab48037f2bd50aa2ccb13",
    "https://bcr.bazel.build/modules/rules_python/1.4.1/MODULE.bazel": "8991ad45bdc25018301d6b7e1d3626afc3c8af8aaf4bc04f23d0b99c938b73a6",
    "https://bcr.bazel.build/modules/rules_python/1.6.0/MODULE.bazel": "7e04ad8f8d5bea40451cf80b1bd8262552aa73f841415d20db96b7241bd027d8",
    "https://bcr.bazel.build/modules/rules_python/1.7.0/MODULE.bazel": "d01f995ecd137abf30238ad9ce97f8fc3ac57289c8b24bd0bf53324d937a14f8",
    "https://bcr.bazel.build/modules/rules_python/1.7.0/source.json": "028a084b65dcf8f4dc4f82f8778dbe65df133f234b316828a82e060d81bdce32",

The current MODULE.bazel declaration forces every project that depends on rules_kotlin (or rules_jvm_external, which depends on rules_kotlin) to pull an ancient version of rules_python's MODULE.bazel file even if it's never used.

[agluszak]

The current MODULE.bazel declaration forces every project that depends on rules_kotlin (or rules_jvm_external, which depends on rules_kotlin) to pull an ancient version of rules_python's MODULE.bazel file even if it's never used.

This is not strictly true. rules_kotlin uses separate MODULE.bazel and MODULE.release.bazel files (that gets swapped in when code is published to BCR), so unless you depend rules_kotlin built from source (via git_override etc.) rules_python is not pulled in. Proof: https://registry.bazel.build/modules/rules_kotlin#Dependency%20graph.

We've been considering removal of the .release MODULE file, but that would entail bootstrapping downstream, including compilation of proto files. This recently became significantly less of a burden because of prebuilt protoc.

[ulfjack]

Interesting; the latest version only has 6 dependencies, and no longer pulls in rules_python. Nice! I missed that before. Appreciate it.

That said, the other part of my comment still stands: the MODULE.bazel file declares 0.23.1, even though Bazel 9.1.0 uses 1.7 at head, which is ... confusing?

[agluszak]

Interesting; the latest version only has 6 dependencies, and no longer pulls in rules_python.

I think 2.1.3 was the last version with rules_python declared :)

That said, the other part of my comment still stands: the MODULE.bazel file declares 0.23.1, even though Bazel 9.1.0 uses 1.7 at head, which is ... confusing?

I agree, I'll bump these versions so we don't get the warnings about resolution at least.