chore: upgrade to Bazel 8

.aspect/bazelrc/BUILD.bazel

@@ -11,10 +11,11 @@ load("@aspect_bazel_lib//lib:bazelrc_presets.bzl", "write_aspect_bazelrc_presets
 write_aspect_bazelrc_presets(
     name = "update_aspect_bazelrc_presets",
     presets = [
-        "bazel7",
+        "bazel8",
         "convenience",
         "correctness",
         "debug",
+        "java",
         "javascript",
         "performance",
     ],

.aspect/bazelrc/bazel8.bazelrc

@@ -0,0 +1 @@
+# No Bazel 8 specific flag presets yet.

.aspect/bazelrc/correctness.bazelrc

@@ -24,7 +24,7 @@ test --test_verbose_timeout_warnings
 # Allow the Bazel server to check directory sources for changes. Ensures that the Bazel server
 # notices when a directory changes, if you have a directory listed in the srcs of some target.
 # Recommended when using
-# [copy_directory](https://github.com/aspect-build/bazel-lib/blob/main/docs/copy_directory.md) and
+# [copy_directory](https://github.com/bazel-contrib/bazel-lib/blob/main/docs/copy_directory.md) and
 # [rules_js](https://github.com/aspect-build/rules_js) since npm package are source directories
 # inputs to copy_directory actions.
 # Docs: https://bazel.build/reference/command-line-reference#flag--host_jvm_args
@@ -42,17 +42,6 @@ test --incompatible_exclusive_test_sandboxed
 # Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_strict_action_env
 build --incompatible_strict_action_env
 
-# Propagate tags from a target declaration to the actions' execution requirements.
-# Ensures that tags applied in your BUILD file, like `tags=["no-remote"]`
-# get propagated to actions created by the rule.
-# Without this option, you rely on rules authors to manually check the tags you passed
-# and apply relevant ones to the actions they create.
-# See https://github.com/bazelbuild/bazel/issues/8830 for details.
-# Docs: https://bazel.build/reference/command-line-reference#flag--experimental_allow_tags_propagation
-build --experimental_allow_tags_propagation
-fetch --experimental_allow_tags_propagation
-query --experimental_allow_tags_propagation
-
 # Do not automatically create `__init__.py` files in the runfiles of Python targets. Fixes the wrong
 # default that comes from Google's internal monorepo by using `__init__.py` to delimit a Python
 # package. Precisely, when a `py_binary` or `py_test` target has `legacy_create_init` set to `auto (the

.aspect/bazelrc/java.bazelrc

@@ -0,0 +1,27 @@
+# Aspect recommended Bazel flags when using rules_java and rules_jvm_external
+
+# Pin java versions to desired language level
+# See https://bazel.build/docs/bazel-and-java#java-versions
+# and https://en.wikipedia.org/wiki/Java_version_history
+
+# What version of Java are the source files in this repo?
+# See https://bazel.build/docs/user-manual#java-language-version
+common --java_language_version=17
+
+# The Java language version used to build tools that are executed during a build
+# See https://bazel.build/docs/user-manual#tool-java-language-version
+common --tool_java_language_version=17
+
+# The version of JVM to use to execute the code and run the tests.
+# NB: The default value is local_jdk which is non-hermetic.
+# See https://bazel.build/docs/user-manual#java-runtime-version
+common --java_runtime_version=remotejdk_17
+
+# The version of JVM used to execute tools that are needed during a build.
+# See https://bazel.build/docs/user-manual#tool-java-runtime-version
+common --tool_java_runtime_version=remotejdk_17
+
+# Repository rules, such as rules_jvm_external: put Bazel's JDK on the path.
+# Avoids non-hermeticity from dependency on a JAVA_HOME pointing at a system JDK
+# see https://github.com/bazelbuild/rules_jvm_external/issues/445
+common --repo_env=JAVA_HOME=../bazel_tools/jdk

.aspect/bazelrc/performance.bazelrc

@@ -1,9 +1,3 @@
-# Don't apply `--noremote_upload_local_results` and `--noremote_accept_cached` to the disk cache.
-# If you have both `--noremote_upload_local_results` and `--disk_cache`, then this fixes a bug where
-# Bazel doesn't write to the local disk cache as it treats as a remote cache.
-# Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_remote_results_ignore_disk
-build --incompatible_remote_results_ignore_disk
-
 # Directories used by sandboxed non-worker execution may be reused to avoid unnecessary setup costs.
 # Save time on Sandbox creation and deletion when many of the same kind of action run during the
 # build.
@@ -18,3 +12,16 @@ build --experimental_reuse_sandbox_directories
 # author.
 # Docs: https://bazel.build/reference/command-line-reference#flag--legacy_external_runfiles
 build --nolegacy_external_runfiles
+
+# Avoid creating a runfiles tree for binaries or tests until it is needed.
+# Docs: https://bazel.build/reference/command-line-reference#flag--build_runfile_links
+# See https://github.com/bazelbuild/bazel/issues/6627
+#
+# This may break local workflows that `build` a binary target, then run the resulting program
+# outside of `bazel run`. In those cases, the script will need to call
+# `bazel build --build_runfile_links //my/binary:target` and then execute the resulting program.
+build --nobuild_runfile_links
+
+# Needed prior to Bazel 8; see
+# https://github.com/bazelbuild/bazel/issues/20577
+coverage --build_runfile_links

.aspect/workflows/deps.lock.json

@@ -0,0 +1,87 @@
+{
+  "$schema": "https://raw.githubusercontent.com/theoremlp/rules_multitool/main/lockfile.schema.json",
+  "circleci-config-merge": {
+    "binaries": [
+      {
+        "kind": "archive",
+        "url": "https://github.com/suzuki-shunsuke/circleci-config-merge/releases/download/v1.1.6/circleci-config-merge_1.1.6_linux_arm64.tar.gz",
+        "file": "circleci-config-merge",
+        "sha256": "31a5d542644af6af4b82c7cce59cf1088213f2b51c3816f327c6950e02bacd6b",
+        "os": "linux",
+        "cpu": "arm64"
+      },
+      {
+        "kind": "archive",
+        "url": "https://github.com/suzuki-shunsuke/circleci-config-merge/releases/download/v1.1.6/circleci-config-merge_1.1.6_linux_amd64.tar.gz",
+        "file": "circleci-config-merge",
+        "sha256": "dde6099fb7528590f5a224b77205dfa97c1d0f37257ff37dec0da787b65f5bec",
+        "os": "linux",
+        "cpu": "x86_64"
+      },
+      {
+        "kind": "archive",
+        "url": "https://github.com/suzuki-shunsuke/circleci-config-merge/releases/download/v1.1.6/circleci-config-merge_1.1.6_darwin_arm64.tar.gz",
+        "file": "circleci-config-merge",
+        "sha256": "edc41e2eb49545947e990bbf9e39fec7ffc421bd9b853576f89f1f69f447a6be",
+        "os": "macos",
+        "cpu": "arm64"
+      },
+      {
+        "kind": "archive",
+        "url": "https://github.com/suzuki-shunsuke/circleci-config-merge/releases/download/v1.1.6/circleci-config-merge_1.1.6_darwin_amd64.tar.gz",
+        "file": "circleci-config-merge",
+        "sha256": "bc728349d0da60ae7c31ab9d27dc8e3d12a1f8e4ff2e24d057ff44d3b44bf2a0",
+        "os": "macos",
+        "cpu": "x86_64"
+      },
+      {
+        "kind": "archive",
+        "url": "https://github.com/suzuki-shunsuke/circleci-config-merge/releases/download/v1.1.6/circleci-config-merge_1.1.6_windows_arm64.zip",
+        "file": "circleci-config-merge.exe",
+        "sha256": "f29886c2e65027efe3fc648cacb9adf3b2fc9665e86737271bd0d78a754b461c",
+        "os": "windows",
+        "cpu": "arm64"
+      },
+      {
+        "kind": "archive",
+        "url": "https://github.com/suzuki-shunsuke/circleci-config-merge/releases/download/v1.1.6/circleci-config-merge_1.1.6_windows_amd64.zip",
+        "file": "circleci-config-merge.exe",
+        "sha256": "14e2bd8fcfd72dc5c990a51a76ba0d03e97f8d3301ed6f0017961b25b75cdb99",
+        "os": "windows",
+        "cpu": "x86_64"
+      }
+    ]
+  },
+  "rosetta": {
+    "binaries": [
+      {
+        "kind": "file",
+        "os": "linux",
+        "cpu": "arm64",
+        "url": "https://static.aspect.build/aspect/5.11.0/rosetta_real_linux_arm64",
+        "sha256": "ab0b1c12093d91d327359f5d7fe0b0f1a3e8d59a242075624bafba9c24ac7d25"
+      },
+      {
+        "kind": "file",
+        "os": "linux",
+        "cpu": "x86_64",
+        "url": "https://static.aspect.build/aspect/5.11.0/rosetta_real_linux_x86_64",
+        "sha256": "5a00dac4eb2c99aef30c71a1fa2678a7733206f20193a9b5dfc656cd1e388364"
+      },
+      {
+        "kind": "file",
+        "os": "macos",
+        "cpu": "arm64",
+        "url": "https://static.aspect.build/aspect/5.11.0/rosetta_real_darwin_arm64",
+        "sha256": "ce659dc6ca6e9e973d4b3e6264ea30d05a2d13ae8419ee9615e1e4e7ebf0309f"
+      },
+      {
+        "kind": "file",
+        "os": "macos",
+        "cpu": "x86_64",
+        "url": "https://static.aspect.build/aspect/5.11.0/rosetta_real_darwin_x86_64",
+        "sha256": "e55e92c6f2f741859b044fc6bb03f545e270a5ed339339dbfa3f27e15dfa3be1"
+      }
+    ]
+  }
+}

.bazelrc

@@ -1,8 +1,9 @@
 # Import Aspect bazelrc presets
-import %workspace%/.aspect/bazelrc/bazel7.bazelrc
+import %workspace%/.aspect/bazelrc/bazel8.bazelrc
 import %workspace%/.aspect/bazelrc/convenience.bazelrc
 import %workspace%/.aspect/bazelrc/correctness.bazelrc
 import %workspace%/.aspect/bazelrc/debug.bazelrc
+import %workspace%/.aspect/bazelrc/java.bazelrc
 import %workspace%/.aspect/bazelrc/javascript.bazelrc
 import %workspace%/.aspect/bazelrc/performance.bazelrc
 

.bazelversion

@@ -1,4 +1,4 @@
-7.4.1
+8.0.0
 
 # The first line of this file is the version of Bazel that Bazelisk will
 # download. We use the latest version of Bazel because we rely on strong testing

.circleci/BUILD.bazel

@@ -4,32 +4,12 @@ CIRCLECI_ORG = "aspect-build"
 
 CIRCLECI_USER_CONFIG_FILE = "//.circleci:user.yml"
 
-alias(
-    name = "rosetta",
-    actual = select({
-        "@bazel_tools//src/conditions:darwin_arm64": "@rosetta_darwin_aarch64//file:rosetta",
-        "@bazel_tools//src/conditions:darwin_x86_64": "@rosetta_darwin_x86_64//file:rosetta",
-        "@bazel_tools//src/conditions:linux_aarch64": "@rosetta_linux_aarch64//file:rosetta",
-        "@bazel_tools//src/conditions:linux_x86_64": "@rosetta_linux_x86_64//file:rosetta",
-    }),
-)
-
-alias(
-    name = "circleci-config-merge",
-    actual = select({
-        "@bazel_tools//src/conditions:darwin_arm64": "@circleci_config_merge_darwin_aarch64//:circleci-config-merge",
-        "@bazel_tools//src/conditions:darwin_x86_64": "@circleci_config_merge_darwin_x86_64//:circleci-config-merge",
-        "@bazel_tools//src/conditions:linux_aarch64": "@circleci_config_merge_linux_aarch64//:circleci-config-merge",
-        "@bazel_tools//src/conditions:linux_x86_64": "@circleci_config_merge_linux_x86_64//:circleci-config-merge",
-    }),
-)
-
 genrule(
     name = "aspect_workflows_config",
     srcs = ["//.aspect/workflows:config.yaml"],
     outs = [":aspect-workflows-config.yml"],
-    cmd = "CI=1 CIRCLE_PROJECT_USERNAME={0} ASPECT_WORKFLOWS_DISABLE_TRACES_COLLECTION=1 $(execpath :rosetta) steps --configuration .aspect/workflows/config.yaml --host circleci > $@".format(CIRCLECI_ORG),
-    tools = [":rosetta"],
+    cmd = "CI=1 CIRCLE_PROJECT_USERNAME={0} ASPECT_WORKFLOWS_DISABLE_TRACES_COLLECTION=1 $(execpath @multitool//tools/rosetta) steps --configuration .aspect/workflows/config.yaml --host circleci > $@".format(CIRCLECI_ORG),
+    tools = ["@multitool//tools/rosetta"],
 )
 
 genrule(
@@ -39,8 +19,8 @@ genrule(
         CIRCLECI_USER_CONFIG_FILE,
     ],
     outs = [":_config.yml"],
-    cmd = "echo -e '# GENERATED FILE - DO NOT EDIT!\\n# Update with: bazel run //.circleci:write_merged_config' > $@ && $(execpath :circleci-config-merge) merge $(execpath :aspect-workflows-config.yml) $(execpath {0}) >> $@".format(CIRCLECI_USER_CONFIG_FILE),
-    tools = [":circleci-config-merge"],
+    cmd = "echo -e '# GENERATED FILE - DO NOT EDIT!\\n# Update with: bazel run //.circleci:write_merged_config' > $@ && $(execpath @multitool//tools/circleci-config-merge) merge $(execpath :aspect-workflows-config.yml) $(execpath {0}) >> $@".format(CIRCLECI_USER_CONFIG_FILE),
+    tools = ["@multitool//tools/circleci-config-merge"],
 )
 
 write_source_file(

MODULE.bazel

@@ -5,32 +5,33 @@
 # the code will use the same version of all of these tools and libraries listed.
 # For bzlmod dependencies, this implements the "single version policy".
 
-bazel_dep(name = "apple_support", version = "1.11.1")
-bazel_dep(name = "aspect_bazel_lib", version = "2.8.0")
+bazel_dep(name = "apple_support", version = "1.15.1")
+bazel_dep(name = "aspect_bazel_lib", version = "2.10.0")
 bazel_dep(name = "aspect_rules_js", version = "2.0.0")
 bazel_dep(name = "aspect_rules_lint", version = "1.0.0-rc10")
 bazel_dep(name = "aspect_rules_swc", version = "2.0.0")
 bazel_dep(name = "aspect_rules_ts", version = "3.0.0")
-bazel_dep(name = "bazel_skylib", version = "1.4.2")
+bazel_dep(name = "bazel_skylib", version = "1.7.1")
 bazel_dep(name = "buildifier_prebuilt", version = "6.4.0")
-bazel_dep(name = "gazelle", version = "0.32.0")
+bazel_dep(name = "gazelle", version = "0.36.0")
 bazel_dep(name = "googletest", version = "1.15.2")
 bazel_dep(name = "rules_apple", version = "3.0.0")
 bazel_dep(name = "rules_buf", version = "0.3.0")
+bazel_dep(name = "rules_cc", version = "0.1.0")
 bazel_dep(name = "rules_go", version = "0.48.0")
-bazel_dep(name = "rules_java", version = "7.4.0")
-bazel_dep(name = "rules_jvm_external", version = "4.5")
+bazel_dep(name = "rules_java", version = "8.6.1")
+bazel_dep(name = "rules_jvm_external", version = "6.3")
 bazel_dep(name = "rules_multitool", version = "0.12.0")
-bazel_dep(name = "rules_proto", version = "6.0.0")
-bazel_dep(name = "rules_python", version = "0.35.0")
+bazel_dep(name = "rules_proto", version = "7.1.0")
+bazel_dep(name = "rules_python", version = "0.40.0")
 bazel_dep(name = "rules_python_gazelle_plugin", version = "0.35.0")
 bazel_dep(name = "rules_swift", version = "1.12.0")
 bazel_dep(name = "rules_swift_package_manager", version = "0.12.0")
 bazel_dep(name = "rules_uv", version = "0.25.0")
 bazel_dep(name = "rules_xcodeproj", version = "1.11.0")
 bazel_dep(name = "sqlite3", version = "3.42.0.bcr.1")  # C code for SQLite.
 bazel_dep(name = "toolchains_llvm", version = "1.1.2")
-bazel_dep(name = "toolchains_protoc", version = "0.3.1")
+bazel_dep(name = "toolchains_protoc", version = "0.3.6")
 
 # Just like in the old WORKSPACE file approach, you can directly grab some code
 # with HTTP and make it available. The syntax is slightly different,
@@ -64,6 +65,7 @@ http_jar(
 # Fetch tools
 # https://blog.aspect.build/run-tools-installed-by-bazel
 multitool = use_extension("@rules_multitool//multitool:extension.bzl", "multitool")
+multitool.hub(lockfile = "//.aspect/workflows:deps.lock.json")
 multitool.hub(lockfile = "//tools:tools.lock.json")
 use_repo(multitool, "multitool")
 
@@ -92,7 +94,7 @@ use_repo(buf, "rules_buf_toolchains")
 protoc = use_extension("@toolchains_protoc//protoc:extensions.bzl", "protoc")
 protoc.toolchain(
     google_protobuf = "com_google_protobuf",
-    version = "LATEST",
+    version = "v28.2",
 )
 use_repo(protoc, "com_google_protobuf", "toolchains_protoc_hub")
 
@@ -137,7 +139,7 @@ use_repo(pip, "pip")
 maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven")
 maven.install(
     artifacts = [
-        "com.google.protobuf:protobuf-java:4.27.1",
+        "com.google.protobuf:protobuf-java:4.28.0",
         "io.grpc:grpc-all:1.51.1",
     ],
     lock_file = "//:maven_install.json",

angular-ngc/.bazelversion

@@ -0,0 +1 @@
+7.4.1

bzlmod/.bazelversion

@@ -0,0 +1 @@
+7.4.1