[saahilp18]

Warning

If this update causes issues, contact #incident-62343-language-tools.
Do not revert this PR. Reverting returns the repository to an untrusted Bazel version.

Mitigates #incident-62343 by upgrading Bazel 7.2.1 to 8.8.2, which removes the compromised CA. The campaign targets are 8.8.2 for Bazel 8 and earlier and 9.3.1 for Bazel 9.

• Upgrade the repository pin used by Bazelisk in CI and preserve Bazel 7 optional-file glob behavior.
• Declare the platforms module explicitly for the existing toolchain constraints and docs targets; Bazel 8 no longer supplies this dependency implicitly.
• Regenerate MODULE.bazel.lock and refresh the two Stardoc signatures whose keyword-argument display changes under Bazel 8. Existing direct dependency versions are unchanged.
• Scan all 102 tracked files for pins, nested workspaces, Bazel flags, BUILD/Starlark rules, Go SDK/C toolchain setup, runfiles, CI, release paths, fixtures, and expected outputs. This repository has one workspace and no nested pins; CI already uses the root pin.

flowchart LR
  subgraph Before
    A[CI / local Bazelisk] --> B[Bazel 7.2.1]
    B --> C[Implicit platforms / optional globs]
  end
  subgraph After
    D[CI / local Bazelisk] --> E[Bazel 8.8.2]
    E --> F[Explicit platforms / preserved optional globs]
  end

Loading

Validation:

• bzl query //...: passed, all 19 packages loaded.
• Pinned buildifier 8.0.3: MODULE.bazel formatting passed.
• Static pin/flag/workspace checks and git diff --check: passed.
• bzl test --config=ci //...: passed, all 75 build targets and six tests, covering four Go unit-test targets, buildifier, and generated-doc freshness.
• Bootstrapped the documented host OCI tool; built the release archive and gzip/zstd OCI examples. Asserted both generated indexes contain linux/amd64 and linux/arm64 manifests.

Report issues or questions in #incident-62343-language-tools.

🤖 Created with opencode

[saahilp18]

/merge -p incident

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-10-23 20:25:07 UTC ℹ️ Start processing command /merge -p incident

---

2026-10-23 20:25:12 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in main is approximately 0s (p90).

---

2026-10-23 22:25:30 UTC ❌ MergeQueue: The build pipeline has timeout

The merge request has been interrupted because the build 0 took longer than expected. The current limit for the base branch 'main' is 120 minutes.