Upgrade Bazel to 9.0.0

.bazelrc

@@ -11,6 +11,8 @@ build --compilation_mode opt
 common --override_module=semmle_code=%workspace%/misc/bazel/semmle_code_stub
 
 build --repo_env=CC=clang --repo_env=CXX=clang++
+# Disable Android SDK auto-detection (we don't use it, and rules_android has Bazel 9 compatibility issues)
+build --repo_env=ANDROID_HOME=
 
 # print test output, like sembuild does.
 # Set to `errors` if this is too verbose.
@@ -34,7 +36,7 @@ common --@rules_dotnet//dotnet/settings:strict_deps=false
 common --@rules_rust//rust/toolchain/channel=nightly
 
 # Reduce this eventually to empty, once we've fixed all our usages of java, and https://github.com/bazel-contrib/rules_go/issues/4193 is fixed
-common --incompatible_autoload_externally="+@rules_java,+@rules_shell"
+common --incompatible_autoload_externally="+@rules_cc,+@rules_java,+@rules_shell"
 
 build --java_language_version=17
 build --tool_java_language_version=17

.bazelversion

@@ -1 +1 @@
-8.4.2
+9.0.0

MODULE.bazel

@@ -15,17 +15,19 @@ local_path_override(
 # see https://registry.bazel.build/ for a list of available packages
 
 bazel_dep(name = "platforms", version = "1.0.0")
-bazel_dep(name = "rules_go", version = "0.56.1")
+bazel_dep(name = "rules_cc", version = "0.2.16")
+bazel_dep(name = "rules_go", version = "0.59.0")
+bazel_dep(name = "rules_java", version = "9.0.3")
 bazel_dep(name = "rules_pkg", version = "1.0.1")
-bazel_dep(name = "rules_nodejs", version = "6.2.0-codeql.1")
+bazel_dep(name = "rules_nodejs", version = "6.7.3")
 bazel_dep(name = "rules_python", version = "0.40.0")
 bazel_dep(name = "rules_shell", version = "0.5.0")
 bazel_dep(name = "bazel_skylib", version = "1.8.1")
 bazel_dep(name = "abseil-cpp", version = "20240116.1", repo_name = "absl")
 bazel_dep(name = "nlohmann_json", version = "3.11.3", repo_name = "json")
 bazel_dep(name = "fmt", version = "12.1.0-codeql.1")
-bazel_dep(name = "rules_kotlin", version = "2.2.0-codeql.1")
-bazel_dep(name = "gazelle", version = "0.40.0")
+bazel_dep(name = "rules_kotlin", version = "2.2.2-codeql.1")
+bazel_dep(name = "gazelle", version = "0.47.0")
 bazel_dep(name = "rules_dotnet", version = "0.21.5-codeql.1")
 bazel_dep(name = "googletest", version = "1.14.0.bcr.1")
 bazel_dep(name = "rules_rust", version = "0.66.0")
@@ -188,6 +190,15 @@ pip.parse(
 )
 use_repo(pip, "codegen_deps")
 
+python = use_extension("@rules_python//python/extensions:python.bzl", "python")
+python.toolchain(
+    is_default = True,
+    python_version = "3.12",
+)
+use_repo(python, "python_3_12", "python_versions")
+
+register_toolchains("@python_versions//3.12:all")
+
 swift_deps = use_extension("//swift/third_party:load.bzl", "swift_deps")
 
 # following list can be kept in sync with `bazel mod tidy`

javascript/extractor/BUILD.bazel

@@ -1,3 +1,4 @@
+load("@rules_java//java:defs.bzl", "java_library")
 load("@rules_pkg//pkg:mappings.bzl", "pkg_files")
 load("@semmle_code//:common.bzl", "codeql_fat_jar", "codeql_java_project")
 

javascript/extractor/test/com/semmle/js/extractor/test/BUILD.bazel

@@ -1,3 +1,5 @@
+load("@rules_java//java:defs.bzl", "java_test")
+
 java_test(
     name = "test",
     srcs = glob(["**/*.java"]),

misc/bazel/cmake/cmake.bzl

@@ -1,3 +1,5 @@
+load("@rules_cc//cc/common:cc_info.bzl", "CcInfo")
+
 CmakeInfo = provider(
     fields = {
         "name": "",

misc/bazel/internal/zipmerge/BUILD.bazel

@@ -1,3 +1,5 @@
+load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library", "cc_test")
+
 cc_library(
     name = "lib",
     srcs = [
@@ -28,7 +30,7 @@ cc_test(
     linkstatic = True,  # required to build the test in the internal repo
     deps = [
         ":lib",
-        "@bazel_tools//tools/cpp/runfiles",
         "@googletest//:gtest_main",
+        "@rules_cc//cc/runfiles",
     ],
 )

misc/bazel/internal/zipmerge/zipmerge_test.cpp

@@ -9,9 +9,9 @@
 
 #include <gtest/gtest.h>
 #include <gmock/gmock.h>
-#include "tools/cpp/runfiles/runfiles.h"
+#include "rules_cc/cc/runfiles/runfiles.h"
 
-using bazel::tools::cpp::runfiles::Runfiles;
+using rules_cc::cc::runfiles::Runfiles;
 using namespace std::string_literals;
 namespace fs = std::filesystem;
 

misc/bazel/registry/modules/rules_kotlin/2.2.0-codeql.1/source.json

@@ -2,8 +2,8 @@
     "integrity": "sha256-4STROYYIW8ChW+LIXBQVurVwhEK3jSSf4iv430OlNA0=",
     "url": "https://github.com/bazelbuild/rules_kotlin/releases/download/v2.2.0/rules_kotlin-v2.2.0.tar.gz",
     "patches": {
-        "codeql_do_not_emit_jdeps.patch": "sha256-gIlhXEY71vlCkpr5wj2vm3yv6RwcuKLhgbTGqdVvQfU=",
-        "codeql_add_language_version_option.patch": "sha256-HoH8NWXxmYHmm/SxaugRdXgMntvcQx5gRLW2yQIvWhM="
+        "codeql_add_language_version_option.patch": "sha256-HoH8NWXxmYHmm/SxaugRdXgMntvcQx5gRLW2yQIvWhM=",
+        "codeql_do_not_emit_jdeps.patch": "sha256-gIlhXEY71vlCkpr5wj2vm3yv6RwcuKLhgbTGqdVvQfU="
     },
     "patch_strip": 1
 }

misc/bazel/registry/modules/rules_kotlin/2.2.2-codeql.1/MODULE.bazel

@@ -0,0 +1,38 @@
+module(
+    name = "rules_kotlin",
+    version = "2.2.2-codeql.1",
+    compatibility_level = 1,
+    repo_name = "rules_kotlin",
+)
+
+bazel_dep(name = "platforms", version = "0.0.11")
+bazel_dep(name = "bazel_skylib", version = "1.7.1")
+bazel_dep(name = "rules_java", version = "8.9.0")
+bazel_dep(name = "rules_android", version = "0.6.4")
+bazel_dep(name = "bazel_features", version = "1.25.0")
+bazel_dep(name = "protobuf", version = "29.0", repo_name = "com_google_protobuf")
+bazel_dep(name = "rules_proto", version = "6.0.2", repo_name = "rules_proto")
+bazel_dep(name = "abseil-py", version = "2.1.0", repo_name = "py_absl")
+bazel_dep(name = "rules_cc", version = "0.0.16")
+bazel_dep(name = "bazel_worker_api", version = "0.0.8")
+bazel_dep(name = "bazel_worker_java", version = "0.0.8")
+
+rules_java_toolchains = use_extension("@rules_java//java:extensions.bzl", "toolchains")
+use_repo(rules_java_toolchains, "remote_java_tools")
+
+rules_kotlin_extensions = use_extension(
+    "//src/main/starlark/core/repositories:bzlmod_setup.bzl",
+    "rules_kotlin_extensions",
+)
+use_repo(
+    rules_kotlin_extensions,
+    "com_github_google_ksp",
+    "com_github_jetbrains_kotlin",
+    "com_github_pinterest_ktlint",
+    "kotlin_build_tools_impl",
+    "kotlinx_serialization_core_jvm",
+    "kotlinx_serialization_json",
+    "kotlinx_serialization_json_jvm",
+)
+
+register_toolchains("//kotlin/internal:default_toolchain")

misc/bazel/registry/modules/rules_kotlin/2.2.2-codeql.1/patches/codeql_add_language_version_option.patch

@@ -0,0 +1,30 @@
+--- a/src/main/starlark/core/options/opts.kotlinc.bzl	2000-01-01 01:00:00.000000000 +0100
++++ b/src/main/starlark/core/options/opts.kotlinc.bzl	2025-11-17 16:51:01.012063056 +0100
+@@ -51,6 +51,11 @@
+         return None
+     return ["-Xjdk-release=%s" % version]
+
++def _map_language_version_to_flag(version):
++    if not version:
++        return None
++    return ["-language-version=%s" % version, "-api-version=%s" % version]
++
+ _KOPTS_ALL = {
+     "include_stdlibs": struct(
+         args = dict(
+@@ -495,6 +500,15 @@
+         value_to_flag = None,
+         map_value_to_flag = _map_warning_level,
+     ),
++    "language_version": struct(
++        args = dict(
++            default = "1.9",
++            doc = "-language-version",
++        ),
++        type = attr.string,
++        value_to_flag = None,
++        map_value_to_flag = _map_language_version_to_flag,
++    ),
+ }
+
+ def _merge(key, rule_defined):

misc/bazel/registry/modules/rules_kotlin/2.2.2-codeql.1/patches/codeql_do_not_emit_jdeps.patch

@@ -0,0 +1,14 @@
+Emitting jdeps is broken for the 2.0.0 kotlin extractor, and we don't need those files.
+Patching it here rather than passing `--@rules_kotlin//kotlin/settings:jvm_emit_jdeps=false`
+allows us to not have to specify that option (and therefore pull in `rules_kotlin`) in `semmle-code`.
+--- a/kotlin/settings/BUILD.bazel
++++ b/kotlin/settings/BUILD.bazel
+@@ -16,6 +16,6 @@ release_archive(
+ # Flag that controls the emission of jdeps files during kotlin jvm compilation.
+ bool_flag(
+     name = "jvm_emit_jdeps",
+-    build_setting_default = True,  # Upstream default behavior
++    build_setting_default = False,
+     visibility = ["//visibility:public"],
+ )
+

misc/bazel/registry/modules/rules_kotlin/2.2.2-codeql.1/source.json

@@ -0,0 +1,9 @@
+{
+    "integrity": "sha256-QR2yavs0ksyDUbW1NJkxUir+LFTyZRttEncwoSVtD2A=",
+    "url": "https://github.com/bazelbuild/rules_kotlin/releases/download/v2.2.2/rules_kotlin-v2.2.2.tar.gz",
+    "patches": {
+        "codeql_add_language_version_option.patch": "sha256-HoH8NWXxmYHmm/SxaugRdXgMntvcQx5gRLW2yQIvWhM=",
+        "codeql_do_not_emit_jdeps.patch": "sha256-gIlhXEY71vlCkpr5wj2vm3yv6RwcuKLhgbTGqdVvQfU="
+    },
+    "patch_strip": 1
+}

misc/bazel/registry/modules/rules_kotlin/metadata.json

@@ -22,6 +22,7 @@
     ],
     "versions": [
         "2.2.0-codeql.1",
+        "2.2.2-codeql.1"
     ],
     "yanked_versions": {}
 }

misc/bazel/registry/modules/rules_nodejs/metadata.json

@@ -1,5 +1,3 @@
 {
     "versions": [
-        "6.2.0-codeql.1"
-    ]
-}
+    "6.2.0-codeql.1"

misc/codegen/BUILD.bazel

@@ -5,6 +5,9 @@ py_binary(
     srcs = ["codegen.py"],
     data = [
         "//misc/codegen/templates:cpp",
+        "//misc/codegen/templates:dbscheme",
+        "//misc/codegen/templates:ql",
+        "//misc/codegen/templates:rust",
         "//misc/codegen/templates:trap",
     ],
     visibility = ["//visibility:public"],

misc/codegen/templates/BUILD.bazel

@@ -1,5 +1,10 @@
 package(default_visibility = ["//misc/codegen:__subpackages__"])
 
+filegroup(
+    name = "dbscheme",
+    srcs = ["dbscheme.mustache"],
+)
+
 filegroup(
     name = "trap",
     srcs = glob(["trap_*.mustache"]),
@@ -9,3 +14,13 @@ filegroup(
     name = "cpp",
     srcs = glob(["cpp_*.mustache"]),
 )
+
+filegroup(
+    name = "ql",
+    srcs = glob(["ql_*.mustache"]),
+)
+
+filegroup(
+    name = "rust",
+    srcs = glob(["rust_*.mustache"]),
+)

shared/cpp/BUILD.bazel

@@ -1,3 +1,5 @@
+load("@rules_cc//cc:defs.bzl", "cc_library")
+
 cc_library(
     name = "extractor_shared",
     srcs = glob(["*.cpp"]),

swift/logging/BUILD.bazel

@@ -1,3 +1,5 @@
+load("@rules_cc//cc:defs.bzl", "cc_library")
+
 cc_library(
     name = "logging",
     srcs = glob(["*.cpp"]),

swift/rules.bzl

@@ -1,3 +1,5 @@
+load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
+load("@rules_cc//cc/common:cc_info.bzl", "CcInfo")
 load("//misc/bazel:os.bzl", "os_select")
 
 # TODO: make a shared library with the internal repos for transitions
@@ -124,7 +126,7 @@ def _wrap_cc(rule, kwargs):
     )
 
 def swift_cc_binary(**kwargs):
-    _wrap_cc(native.cc_binary, kwargs)
+    _wrap_cc(cc_binary, kwargs)
 
 def swift_cc_library(**kwargs):
-    _wrap_cc(native.cc_library, kwargs)
+    _wrap_cc(cc_library, kwargs)