Repository navigation
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Active findings remain, including a moderate Windows build-regression risk from removing the prior MSVC workaround and a typo in a new comment.
2 open issues
What changed in this PR
Updates CodeQL’s Bazel dependencies to patched releases of fmt 12.2.0 and rules_dotnet 0.22.2, while retaining the .NET SDK pin at 10.0.100.
Changes:
- Upgrades root dependencies to
fmt 12.2.0-codeql.1andrules_dotnet 0.22.2-codeql.1. - Adds registry metadata, source definitions, overlays, and integrity information for both modules.
- Adds
rules_dotnetpatches for module versioning and NuGet archive behavior. - Validation confirmed metadata hashes, patch application, and buildifier formatting; Bazel resolution remains blocked by TLS certificate validation.
| File | Description |
|---|---|
MODULE.bazel |
Selects the updated fmt and rules_dotnet modules. |
misc/bazel/registry/modules/rules_dotnet/metadata.json |
Registers the new rules_dotnet version. |
misc/bazel/registry/modules/rules_dotnet/0.22.2-codeql.1/source.json |
Defines the release archive, integrity hash, and patches. |
misc/bazel/registry/modules/rules_dotnet/0.22.2-codeql.1/patches/revert_additional_files_in_nuget_archive.patch |
Restores the desired NuGet archive behavior. |
misc/bazel/registry/modules/rules_dotnet/0.22.2-codeql.1/patches/module_dot_bazel_version.patch |
Sets the patched module version. |
misc/bazel/registry/modules/rules_dotnet/0.22.2-codeql.1/MODULE.bazel |
Configures the pinned .NET SDK and module dependencies. Review note: the comment contains the typo buit, which should be built. |
misc/bazel/registry/modules/fmt/metadata.json |
Registers the new fmt version. |
misc/bazel/registry/modules/fmt/12.2.0-codeql.1/source.json |
Defines the fmt archive, overlays, and integrity hashes. |
misc/bazel/registry/modules/fmt/12.2.0-codeql.1/overlay/MODULE.bazel |
Provides patched module metadata and dependencies. |
misc/bazel/registry/modules/fmt/12.2.0-codeql.1/overlay/BUILD.bazel |
Defines the fmt Bazel target, licensing, and package metadata. Review note: preserve the MSVC FMT_UNICODE=0 define from the prior overlay unless the upgrade has a verified fix for the known Windows UTF-8 build failure. |
misc/bazel/registry/modules/fmt/12.2.0-codeql.1/MODULE.bazel |
Provides the versioned fmt module definition. |
This pull request requires changes.
Review effort: Lite (auto)
jketema
marked this pull request as draft
October 30, 2026 10:35
jketema
force-pushed
the
copilot/patch-latest-bazel-deps
branch
3 times, most recently
from
November 3, 2026 18:31
0ac7b21 to
e4e9f06
Compare
Add and use patched registry versions for fmt 12.2.0 and rules_dotnet 0.22.2, preserving the Windows Unicode workaround, NuGet archive patch, and rules_shell declaration. Update the root and module .NET SDK toolchains to 10.0.201. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Use fmt 12.2.0.bcr.1 metadata with a CodeQL version suffix, preserving the existing Windows FMT_UNICODE=0 overlay instead of the upstream /utf-8 option. Regenerate module declarations and overlay integrity hashes.
jketema
force-pushed
the
copilot/patch-latest-bazel-deps
branch
from
November 3, 2026 18:42
e4e9f06 to
0eb898f
Compare
jketema
marked this pull request as ready for review
November 3, 2026 19:21
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
An active moderate finding remains because the Bazel SDK pin and the companion dependency-fetching SDK pin are inconsistent, requiring synchronized updates.
1 open issue
2 resolved since last review
Review effort: Lite (auto)
Use 10.0.201 for dependency fetching without global.json, extractor and test setup, and stub generation, matching the updated Bazel build SDK.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
12.2.0.bcr.1-codeql.1, based on the BCR 12.2.0.bcr.1 entry.FMT_UNICODE=0workaround without restoring the upstream/utf-8compiler option.Validation