Update dependency rules_python to v2.3.4

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
rules_python	bazel_dep	minor	2.2.0 → 2.3.4

---

Release Notes

bazel-contrib/rules_python (rules_python)

v2.3.4

Compare Source

For more detailed setup instructions, see https://rules-python.readthedocs.io/en/latest/getting-started.html

For the user-facing changelog see here

Using Bzlmod

Add to your MODULE.bazel file:

bazel_dep(name = "rules_python", version = "2.3.4")

python = use_extension("@rules_python//python/extensions:python.bzl", "python")
python.toolchain(
    python_version = "3.13",
)

pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
pip.parse(
    hub_name = "pypi",
    python_version = "3.13",
    requirements_lock = "//:requirements_lock.txt",
)

use_repo(pip, "pypi")

Using WORKSPACE

Paste this snippet into your WORKSPACE file:

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "rules_python",
    sha256 = "a535712f12ba25253d73975ba2932994b5e53773f94b58fb3f8fa7827de8b6b7",
    strip_prefix = "rules_python-2.3.4",
    url = "https://github.com/bazel-contrib/rules_python/releases/download/2.3.4/rules_python-2.3.4.tar.gz",
)

load("@rules_python//python:repositories.bzl", "py_repositories")

py_repositories()

Gazelle plugin

Paste this snippet into your WORKSPACE file:

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
http_archive(
    name = "rules_python_gazelle_plugin",
    sha256 = "a535712f12ba25253d73975ba2932994b5e53773f94b58fb3f8fa7827de8b6b7",
    strip_prefix = "rules_python-2.3.4/gazelle",
    url = "https://github.com/bazel-contrib/rules_python/releases/download/2.3.4/rules_python-2.3.4.tar.gz",
)

# To compile the rules_python gazelle extension from source,

# we must fetch some third-party go dependencies that it uses.

load("@rules_python_gazelle_plugin//:deps.bzl", _py_gazelle_deps = "gazelle_deps")

_py_gazelle_deps()

What's Changed

• feat: Add win32 python versions by @​rsartor-cmd in #​4156

Full Changelog: bazel-contrib/rules_python@2.3.3...2.3.4

v2.3.3

Compare Source

{#v2-3-3-changed}

Changed

• (publish): The twine packages are now configured for three major platforms.

{#v2-3-3-fixed}

Fixed

• (gazelle) Fixed a regression from version 1.8.0 which broke module map
  generation for old-style namespace packages.
  (#​4135).
• (zipapp) Fixed handling of {obj}PyRuntimeInfo with files = None so creating
  zipapp archives does not error.

{#v2-3-2}

v2.3.2

Compare Source

{#v2-3-2-fixed}

Fixed

• (pypi) Fixed analysis failures in {obj}pip.parse for source-less wheels with
  dependencies. (#​4053)
• (pypi) Fixed the handling of optional args for the {obj}pip_archive and {obj}whl_archive
  repository rules within the {obj}whl_library. From now on we are dropping unsupported args.
• (pypi) Fixed {obj}pip.parse repository names for Git sources in uv.lock
  files by excluding URL query and fragment components
  (#​4084).

{#v2-3-1}

v2.3.1

Compare Source

{#v2-3-1-fixed}

Fixed

• Previous refactor that shipped with 2.3 introduced regression for the
  experimental repository cache users. This restores the previous behavior
  (#​3791).

{#v2-3-0}

v2.3.0

Compare Source

{#v2-3-0-changed}

Changed

• (gazelle) BREAKING rules_python 1.5.0 or higher is now required. The Python
  extension selects its standard library list on is_python_3.14, which earlier
  versions do not define.

{#v2-3-0-fixed}

Fixed

• Fixed py_binary_rule_builder() / py_test_rule_builder() (from python/api/executables.bzl)
  failing at analysis time with a visibility error when used to construct a custom rule from an
  external module.
• (compile_pip_requirements) Add the explicit data attribute and forward it
  directly to the generated py_binary, so files passed via data can be
  referenced from extra_args using $(location ...).
• (coverage) The warning about a missing bundled coverage.py wheel is no longer
  emitted as we are now falling back to a pure python wheel
  (#​3950).
• (gazelle) The Python extension now uses the correct standard library module list for
  python_version 3.13 and 3.14; previously both fell back to the 3.11 list, so modules
  added or removed since then (e.g. compression.zstd, telnetlib) were misclassified. The
  fallback list for unrecognized versions is now the newest available one rather than 3.11
  (#​3978).
• (pypi) Allow uv_lock to be specified in pip.parse without requiring
  requirements_lock (or other os-specific requirement file attributes) to be
  set.
• (pypi) Fixed the fixed-point loop that resolves self-referencing extras
  (pkg[extra] entries in a package's own Requires-Dist). The loop compared
  the number of extras discovered in the current round against the number known
  before it, rather than against the size of the merged set. As a result it
  could stop before every extra was resolved, silently dropping dependencies
  only reachable through two or more pkg[extra] hops, and for the common case
  of a package with no self-referencing extras it never converged at all,
  running all 10000 rounds while evaluating each wheel's generated BUILD file
  (#​4039).
• (pypi) Requirement --hash=<algo>:<digest> pins and Simple API
  #<algo>=<digest> URL fragments are now parsed for all hash algorithms
  instead of silently dropping everything except sha256. Non-sha256 pins are
  matched against the digests advertised by the index and downloads are verified
  using the corresponding Subresource Integrity value, and the pins are kept in
  the requirement line when falling back to pip
  (#​3972).
  As part of this, whl_library repos created by pip.parse now always pass
  the digest via the integrity attribute (SRI format) instead of sha256,
  and the lock file facts store digests as <algo>:<digest> values (the facts
  version was bumped, so cached index information is refreshed once).
• (pypi) pip.parse(uv_lock = ...) no longer exposes uv workspace/root members
  that resolve to no wheel or sdist (e.g. source = { virtual = "." } or editable
  installs). Previously these source-less packages were added to the hub's
  all_requirements / all_whl_requirements with an alias to a subpackage that
  does not exist, breaking analysis for anything enumerating the full set such as
  modules_mapping(wheels = all_whl_requirements)
  (#​3934).
• (pypi) correctly parse the index_url for each wheel so that the source registry is forwarded to
  the {obj}whl_library. This is so that the purl for package_metadata can be correctly
  constructed.
• (pypi) fixed the URL normalization function to correctly handle local paths
  enabling wheel sources files to point to an absolute path. Currently it supports
  the file://<absolute_path> for linux and windows like paths. We also support
  envsubst for the said paths from now on.

{#v2-3-0-added}

Added

• (bzlmod) Added MODULE.bazel flag aliases for Starlark-defined flags:
  build_python_zip, incompatible_default_to_explicit_init_py,
  python_path, and experimental_python_import_all_repositories.
• (bzlmod) Added the {obj}explicit_init_py tag class to the `{obj}`config module extension for configuring implicit __init__.py file
  generation module-wide.
  (#​3997,
  #​2945)
• (cc) Added experimental {obj}py_extension macro for creating C/C++ Python
  extension modules
  (#​3283).
  (cc) Added libc, platform_machine, platform_tag, soabi, and
  sys_platform attributes and info fields to {obj}py_cc_toolchain /
  {obj}PyCcToolchainInfo.
• (pip,python) Added pyproject_toml attribute to {obj}pip.default, {obj}pip.parse and {obj}python.defaults to read the default Python version from the requires-python field of pyproject.toml.
• (py_test) Added an opt-in safeguard against py_test targets that silently
  pass without running any tests. Set
  {obj}--@rules_python//python/config_settings:validate_test_main=enabled to
  fail the build when a test's main module only contains inert top-level
  statements (definitions, imports, assignments) and never invokes a test
  runner (#​3824).

{#v2-2-0}

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[deepsource-io]

DeepSource Code Review

We reviewed changes in 1c25b27...4d58c87 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
C & C++		Sep 22, 2026 6:05p.m.	Review ↗
Docker		Sep 22, 2026 6:05p.m.	Review ↗
Python		Sep 22, 2026 6:05p.m.	Review ↗
Secrets		Sep 22, 2026 6:05p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: ab3c69ee-6925-4f03-b392-40adaa6bda56

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}