protocolbuffers · anandolee · May 5, 2026 · Apr 30, 2026 · May 5, 2026 · May 5, 2026
diff --git a/.bazelci/presubmit.yml b/.bazelci/presubmit.yml
@@ -1,7 +1,7 @@
 # LINT.IfChange(bazelci_presubmit)
 matrix:
-  platform: ["debian10", "macos", "macos_arm64", "ubuntu2004", "windows"]
-  bazel: [8.x]
+  platform: ["debian12", "macos_arm64", "ubuntu2404", "windows"]
+  bazel: [8.x, 9.x]
 
 tasks:
   verify_targets:

diff --git a/.bazeliskrc b/.bazeliskrc
@@ -1 +1 @@
-USE_BAZEL_VERSION=8.0.1
+USE_BAZEL_VERSION=8.6.0
diff --git a/.bazelrc b/.bazelrc
@@ -3,6 +3,11 @@ build --cxxopt=-std=c++17 --host_cxxopt=-std=c++17
 # TODO: ErrorProne's SelfAssertions are violated in protobuf's test
 build --javacopt=-Xep:SelfAssertion:WARN
 
+# Disable prebuilt protoc on CI. On both main and release branches,
+# PROTOBUF_VERSION ordinarily points to the next release, which doesn't
+# exist and therefore doesn't have a prebuilt yet.
+#build --@com_google_protobuf//bazel/toolchains:prefer_prebuilt_protoc=false
+
 # This flag works around some issues with Rust linking.
 build --@rules_rust//rust/settings:experimental_use_cc_common_link=True
 
@@ -39,5 +44,10 @@ common --enable_platform_specific_config
 
 common --incompatible_check_testonly_for_output_files
 
+# Import Bazel 9 specific flags (such as --repo_contents_cache)
+# TODO: Remove it when --repo_contents_cache issue
+# has been resolved in bazel
+try-import-if-bazel-version >=9.0.0 %workspace%/ci/bazel9.bazelrc
+
 # Use clang-cl by default on Windows (see https://github.com/protocolbuffers/protobuf/issues/20085).
 build:windows --extra_toolchains=@local_config_cc//:cc-toolchain-x64_windows-clang-cl --extra_execution_platforms=//build_defs:x64_windows-clang-cl --host_platform=//build_defs:x64_windows-clang-cl
diff --git a/.bcr/presubmit.yml b/.bcr/presubmit.yml
@@ -2,8 +2,8 @@
 bcr_test_module:
   module_path: examples
   matrix:
-    platform: ["debian10", "macos", "macos_arm64", "ubuntu2004", "windows"]
-    bazel: [8.x]
+    platform: ["debian12", "macos_arm64", "ubuntu2404", "windows"]
+    bazel: [8.x, 9.x]
 
   tasks:
     verify_targets:

diff --git a/.github/workflows/test_bazel.yml b/.github/workflows/test_bazel.yml
@@ -27,7 +27,7 @@ jobs:
       fail-fast: false
       matrix:
         runner: [ ubuntu, windows, macos ]
-        bazelversion: [ '8.0.0' ]
+        bazelversion: [ '8.6.0', '9.0.0' ]
         bzlmod: [ true, false ]
         toolchain_resolution:
           # Default flags, uses from prebuilt protoc
@@ -36,6 +36,9 @@ jobs:
           - "--incompatible_enable_proto_toolchain_resolution=false"
           # Uses protoc from source.
           - "--@com_google_protobuf//bazel/flags:prefer_prebuilt_protoc=false"
+        exclude:
+          - bazelversion: '9.0.0'
+            bzlmod: false
     runs-on: ${{ matrix.runner }}-latest
     name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} Examples ${{ matrix.runner }} ${{ matrix.bazelversion }}${{ matrix.bzlmod && ' (bzlmod)' || '' }} ${{ matrix.toolchain_resolution && ' (toolchain resolution)' || '' }}
     steps:
@@ -84,7 +87,7 @@ jobs:
       fail-fast: false
       matrix:
         runner: [ ubuntu, windows, macos ]
-        bazelversion: [ '8.0.0' ]
+        bazelversion: [ '8.6.0', '9.0.0' ]
         bzlmod: [ true ]
         toolchain_resolution:
           # Default flags, uses from prebuilt protoc
@@ -122,7 +125,7 @@ jobs:
       - name: Run tests
         uses: protocolbuffers/protobuf-ci/bazel-docker@v5
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:8.0.1-d415763a389bb62a6f126b08c992e83f9f7dc1b4
+          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:9.0.0-7932bf8b25fb76a111e7257d151a6a58d5c3c671
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: "bazel-tests"
           bazel: test //bazel/...
@@ -145,4 +148,4 @@ jobs:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: "bazel-tests-${{ matrix.runner }}"
           bazel: test //bazel/...
-          version: 8.0.1
+          version: 8.6.0
diff --git a/.github/workflows/test_cpp.yml b/.github/workflows/test_cpp.yml
@@ -44,6 +44,10 @@ jobs:
             cache_key: Bazel8
             image: "us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:8.0.1-d415763a389bb62a6f126b08c992e83f9f7dc1b4"
             targets: "//src/... //third_party/utf8_range/..."
+          - config: { name: "Bazel9", flags: "--cxxopt=-Wno-self-assign-overloaded" }
+            cache_key: Bazel9
+            image: "us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:9.0.0-7932bf8b25fb76a111e7257d151a6a58d5c3c671"
+            targets: "//src/... //third_party/utf8_range/..."
           - config: { name: "TCMalloc" }
             cache_key: TcMalloc
             image: "us-docker.pkg.dev/protobuf-build/containers/test/linux/tcmalloc:8.0.1-d415763a389bb62a6f126b08c992e83f9f7dc1b4"

diff --git a/.github/workflows/test_java.yml b/.github/workflows/test_java.yml
@@ -30,23 +30,27 @@ jobs:
         include:
           - name: OpenJDK 8
             cache_key: '8'
-            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:8.0.1-8-b77fdae6d4771789dfc66a56bf8d806354e8011a
+            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:9.0.0-11-1c31a2985011c75c33dcdf646fc86898aac1ec5d
             # TODO: b/318555165 - enable the layering check. Currently it does
             # not work correctly with the toolchain in this Docker image.
             targets: //java/... //java/internal:java_version --features=-layering_check
             flags: --java_language_version=8
           - name: OpenJDK 11
             cache_key: '11'
-            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:8.0.1-11-b77fdae6d4771789dfc66a56bf8d806354e8011a
+            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:9.0.0-11-1c31a2985011c75c33dcdf646fc86898aac1ec5d
             targets: //java/... //java/internal:java_version //compatibility/...
             continuous-only: true
           - name: OpenJDK 17
             cache_key: '17'
-            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:8.0.1-17-168f9c9d015a0fa16611e1e9eede796fe9bfbb69
+            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:9.0.0-17-1c31a2985011c75c33dcdf646fc86898aac1ec5d
+            targets: //java/... //java/internal:java_version //compatibility/...
+          - name: OpenJDK 21 bazel 8
+            cache_key: 'bazel8'
+            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:8.6.0-21-856ad422dddd3b8fbd85e36129496b37bba174ef
             targets: //java/... //java/internal:java_version //compatibility/...
           - name: OpenJDK 21
             cache_key: '21'
-            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:8.0.1-21-7932bf8b25fb76a111e7257d151a6a58d5c3c671
+            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:9.0.0-21-1c31a2985011c75c33dcdf646fc86898aac1ec5d
             targets: //java/... //java/internal:java_version //compatibility/...
           # TODO: b/395623141 - restore this test once runtime uses / emulates aarch64.
           # - name: aarch64
@@ -101,7 +105,7 @@ jobs:
     - name: Generate maven artifacts with bazel and install using maven
       uses: protocolbuffers/protobuf-ci/bazel-docker@v5
       with:
-        image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:8.0.1-11-b77fdae6d4771789dfc66a56bf8d806354e8011a
+        image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:9.0.0-11-1c31a2985011c75c33dcdf646fc86898aac1ec5d
         credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
         bazel-cache: java_linux/11
         bash: |

diff --git a/.github/workflows/test_ruby.yml b/.github/workflows/test_ruby.yml
@@ -35,12 +35,14 @@ jobs:
           - { name: Ruby 3.2, ruby: ruby-3.2.6, continuous-only: true }
           - { name: Ruby 3.3, ruby: ruby-3.3.6, continuous-only: true }
           - { name: Ruby 3.4, ruby: ruby-3.4.1, continuous-only: true }
-          # TODO: Remove the image property in the two entries below and update the configuration
-          # used by all the images the next time there is an update to the Dockerfile
-          - { name: Ruby 4.0, ruby: ruby-4.0.0, ffi: NATIVE, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.0.1-ruby-4.0.0-f1c24ed6acfbf6ec709b0de2f702209c9d3ac659' }
-          - { name: Ruby 4.0, ruby: ruby-4.0.0, ffi: FFI, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.0.1-ruby-4.0.0-f1c24ed6acfbf6ec709b0de2f702209c9d3ac659' }
+          - { name: Ruby 4.0, ruby: ruby-4.0.0, ffi: NATIVE }
+          - { name: Ruby 4.0, ruby: ruby-4.0.0, ffi: FFI }
+          - { name: Ruby 4.0 bazel 8, ruby: ruby-4.0.0, ffi: NATIVE, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.6.0-ruby-4.0.0-856ad422dddd3b8fbd85e36129496b37bba174ef' }
+          - { name: Ruby 4.0 bazel 8, ruby: ruby-4.4.4, ffi: FFI, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.6.0-ruby-4.0.0-856ad422dddd3b8fbd85e36129496b37bba174ef' }
           - { name: JRuby 9.4, ruby: jruby-9.4.9.0, ffi: NATIVE }
           - { name: JRuby 9.4, ruby: jruby-9.4.9.0, ffi: FFI }
+          - { name: JRuby 9.4 bazel 8, ruby: jruby-9.4.9.0, ffi: NATIVE, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.6.0-jruby-9.4.9.0-856ad422dddd3b8fbd85e36129496b37bba174ef' }
+          - { name: JRuby 9.4 bazel 8, ruby: jruby-9.4.9.0, ffi: FFI, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.6.0-jruby-9.4.9.0-856ad422dddd3b8fbd85e36129496b37bba174ef' }
 
     name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} Linux ${{ matrix.name }} ${{ matrix.ffi == 'FFI' && ' FFI' || '' }}
     runs-on: ubuntu-latest
@@ -54,7 +56,7 @@ jobs:
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
         uses: protocolbuffers/protobuf-ci/bazel-docker@v5
         with:
-          image: ${{ matrix.image || format('us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.0.1-{0}-b77fdae6d4771789dfc66a56bf8d806354e8011a', matrix.ruby) }}
+          image: ${{ matrix.image || format('us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:9.0.0-{0}-9fc33a0c378b5affd3c85d3f5ae4f330993048f7', matrix.ruby) }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: ruby_linux/${{ matrix.ruby }}
           bazel: test //ruby/... //ruby/tests:ruby_version --test_env=KOKORO_RUBY_VERSION --test_env=BAZEL=true ${{ matrix.ffi == 'FFI' && '--//ruby:ffi=enabled --test_env=PROTOCOL_BUFFERS_RUBY_IMPLEMENTATION=FFI' || '' }}
@@ -172,7 +174,7 @@ jobs:
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
         uses: protocolbuffers/protobuf-ci/bazel@v5
         with:
-          version: 8.0.1 # Bazel version
+          version: 9.0.0 # Bazel version
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: ruby_macos/${{ matrix.version }}
           bazel: test //ruby/... --test_env=KOKORO_RUBY_VERSION=${{ matrix.version }} --test_env=BAZEL=true ${{ matrix.ffi == 'FFI' && '--//ruby:ffi=enabled --test_env=PROTOCOL_BUFFERS_RUBY_IMPLEMENTATION=FFI' || '' }}
@@ -187,13 +189,17 @@ jobs:
           # Ruby versions for CRuby and JRuby.
           - { name: Ruby 3.1, ruby: ruby-3.1.6, ffi: NATIVE }
           - { name: Ruby 3.1, ruby: ruby-3.1.6, ffi: FFI }
-          - { name: Ruby 3.2, ruby: ruby-3.2.6, continuous-only: true}
-          - { name: Ruby 3.3, ruby: ruby-3.3.6, continuous-only: true}
+          - { name: Ruby 3.2, ruby: ruby-3.2.6, continuous-only: true }
+          - { name: Ruby 3.3, ruby: ruby-3.3.6, continuous-only: true }
           - { name: Ruby 3.4, ruby: ruby-3.4.1, continuous-only: true }
-          - { name: Ruby 4.0, ruby: ruby-4.0.0, ffi: NATIVE, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.0.1-ruby-4.0.0-f1c24ed6acfbf6ec709b0de2f702209c9d3ac659' }
-          - { name: Ruby 4.0, ruby: ruby-4.0.0, ffi: FFI, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.0.1-ruby-4.0.0-f1c24ed6acfbf6ec709b0de2f702209c9d3ac659' }
+          - { name: Ruby 4.0, ruby: ruby-4.0.0, ffi: NATIVE }
+          - { name: Ruby 4.0, ruby: ruby-4.0.0, ffi: FFI }
+          - { name: Ruby 4.0 bazel 8, ruby: ruby-4.0.0, ffi: NATIVE, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.6.0-ruby-4.0.0-856ad422dddd3b8fbd85e36129496b37bba174ef' }
+          - { name: Ruby 4.0 bazel 8, ruby: ruby-4.4.4, ffi: FFI, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.6.0-ruby-4.0.0-856ad422dddd3b8fbd85e36129496b37bba174ef' }
           - { name: JRuby 9.4, ruby: jruby-9.4.9.0, ffi: NATIVE }
           - { name: JRuby 9.4, ruby: jruby-9.4.9.0, ffi: FFI, continuous-only: true }
+          - { name: JRuby 9.4 bazel 8, ruby: jruby-9.4.9.0, ffi: NATIVE, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.6.0-jruby-9.4.9.0-856ad422dddd3b8fbd85e36129496b37bba174ef' }
+          - { name: JRuby 9.4 bazel 8, ruby: jruby-9.4.9.0, ffi: FFI, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.6.0-jruby-9.4.9.0-856ad422dddd3b8fbd85e36129496b37bba174ef' }
     name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} Install ${{ matrix.name }}${{ matrix.ffi == 'FFI' && ' FFI' || '' }}
     runs-on: ubuntu-latest
     steps:
@@ -206,14 +212,15 @@ jobs:
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
         uses: protocolbuffers/protobuf-ci/bazel-docker@v5
         with:
-          image: ${{ matrix.image || format('us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.0.1-{0}-b77fdae6d4771789dfc66a56bf8d806354e8011a', matrix.ruby) }}
+          image: ${{ matrix.image || format('us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:9.0.0-{0}-9fc33a0c378b5affd3c85d3f5ae4f330993048f7', matrix.ruby) }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: ruby_install/${{ matrix.ruby }}_${{ matrix.bazel }}
           bash: >
             bazel --version;
             ruby --version;
             ./regenerate_stale_files.sh $BAZEL_FLAGS;
-            bazel build //ruby:release //:protoc ${{ matrix.ffi == 'FFI' && '--//ruby:ffi=enabled' || '' }} $BAZEL_FLAGS;
+            # TODO: Add --action_env=PATH to release builds before upgrade them to Bazel 9
+            bazel build //ruby:release //:protoc ${{ matrix.ffi == 'FFI' && '--//ruby:ffi=enabled' || '' }} --action_env=PATH $BAZEL_FLAGS;
             gem install bazel-bin/ruby/google-protobuf-*;
             bazel-bin/protoc --proto_path=src --proto_path=ruby/tests --proto_path=ruby --ruby_out=ruby tests/test_import_proto2.proto;
             bazel-bin/protoc --proto_path=src --proto_path=ruby/tests --proto_path=ruby --ruby_out=ruby tests/basic_test.proto;

diff --git a/MODULE.bazel b/MODULE.bazel
@@ -14,7 +14,7 @@ module(
 # https://bazel.build/versions/6.0.0/build/bzlmod#version-resolution
 # Thus the highest version in their module graph is resolved.
 
-bazel_dep(name = "apple_support", version = "1.16.0", repo_name = "build_bazel_apple_support")
+bazel_dep(name = "apple_support", version = "2.3.0", repo_name = "build_bazel_apple_support")
 
 # Unused but must be pinned to avoid old broken versions
 bazel_dep(name = "rules_proto", version = "7.1.0")
@@ -33,14 +33,14 @@ bazel_dep(name = "zlib", version = "1.3.1.bcr.5")
 # other dependencies
 bazel_dep(name = "bazel_features", version = "1.33.0", repo_name = "proto_bazel_features")
 bazel_dep(name = "bazel_skylib", version = "1.9.0")
-bazel_dep(name = "jsoncpp", version = "1.9.6.bcr.1")
+bazel_dep(name = "jsoncpp", version = "1.9.6.bcr.2")
 bazel_dep(name = "rules_java", version = "8.6.1")
 bazel_dep(name = "rules_jvm_external", version = "6.7")
-bazel_dep(name = "rules_kotlin", version = "2.2.2")
+bazel_dep(name = "rules_kotlin", version = "2.3.20")
 bazel_dep(name = "rules_license", version = "1.0.0")
 bazel_dep(name = "rules_pkg", version = "1.0.1")
 bazel_dep(name = "rules_python", version = "1.6.0")
-bazel_dep(name = "rules_rust", version = "0.63.0")
+bazel_dep(name = "rules_rust", version = "0.69.0")
 
 bazel_dep(name = "rules_ruby", version = "0.20.1", dev_dependency = True)
 
@@ -307,17 +307,16 @@ archive_override(
     urls = ["https://github.com/protocolbuffers/protobuf/releases/download/v25.0/protobuf-25.0.tar.gz"],
 )
 
-bazel_dep(name = "com_google_protobuf_previous_release", version = "29.0", dev_dependency = True)
+bazel_dep(name = "com_google_protobuf_previous_release", version = "33.0", dev_dependency = True)
 archive_override(
     module_name = "com_google_protobuf_previous_release",
-    integrity = "sha256-EKDVjzmhqQnpXgDougtbHcZNApl/dBFRlTorNln254w=",
+    integrity = "sha256-y8U2BkcGtijc/lB77zhu8+IhTVY2V2EilvF4GqFV7gc=",
     patch_strip = 1,
     patches = [
-        "@com_google_protobuf//:patches/protobuf_v29/0001-Update-module-name.patch",
-        "@com_google_protobuf//:patches/protobuf_v29/0002-bazel9.patch",
+        "@com_google_protobuf//:patches/protobuf_v33/0001-Update-module-name.patch",
     ],
-    strip_prefix = "protobuf-29.0",
-    urls = ["https://github.com/protocolbuffers/protobuf/releases/download/v29.0/protobuf-29.0.tar.gz"],
+    strip_prefix = "protobuf-33.0",
+    urls = ["https://github.com/protocolbuffers/protobuf/releases/download/v33.0/protobuf-33.0.tar.gz"],
 )
 
 # Register C++ toolchains for cross-compilation. These are used for compiling release binaries of

diff --git a/bazel/tests/cc_toolchain_tests.bzl b/bazel/tests/cc_toolchain_tests.bzl
@@ -19,7 +19,7 @@ def cc_toolchain_test_suite(name):
         name = name,
         tests = [
             _test_cc_toolchain_uses_protoc_minimal_when_prefer_prebuilt_flag_unset,
-            _test_cc_toolchain_uses_full_protoc_by_default,
+            _test_cc_toolchain_uses_prebuilt_protoc_when_prefer_prebuilt_flag_set,
         ],
     )
 
@@ -51,7 +51,7 @@ def _test_cc_toolchain_uses_protoc_minimal_when_prefer_prebuilt_flag_unset_impl(
     # so the cc_toolchain should use protoc_minimal.
     action.argv().contains_predicate(matching.str_matches("*protoc_minimal*"))
 
-def _test_cc_toolchain_uses_full_protoc_by_default(name):
+def _test_cc_toolchain_uses_prebuilt_protoc_when_prefer_prebuilt_flag_set(name):
     util.helper_target(
         proto_library,
         name = name + "_proto",
@@ -67,15 +67,14 @@ def _test_cc_toolchain_uses_full_protoc_by_default(name):
     analysis_test(
         name = name,
         target = name + "_compile",
-        impl = _test_cc_toolchain_uses_full_protoc_by_default_impl,
+        impl = _test_cc_toolchain_uses_prebuilt_protoc_when_prefer_prebuilt_flag_set_impl,
+        config_settings = {_PREFER_PREBUILT_PROTOC: True},
     )
 
-def _test_cc_toolchain_uses_full_protoc_by_default_impl(env, target):
+def _test_cc_toolchain_uses_prebuilt_protoc_when_prefer_prebuilt_flag_set_impl(env, target):
     # Find the compile action
     action = env.expect.that_target(target).action_named("GenProto")
 
-    # By default (prefer_prebuilt_protoc is True), protoc_minimal_do_not_use is None,
-    # so the cc_toolchain should use the full protoc (not protoc_minimal).
-    # The protoc path should end with "/protoc" not contain "protoc_minimal"
-    action.argv().contains_predicate(matching.str_matches("*/protoc"))
+    # When prefer_prebuilt_protoc is True, protoc_minimal_do_not_use is not set,
+    # so the cc_toolchain should use prebuilt protoc instead of protoc_minimal.
     action.argv().not_contains_predicate(matching.str_matches("*protoc_minimal*"))
diff --git a/ci/Windows.bazelrc b/ci/Windows.bazelrc
@@ -9,3 +9,5 @@ build --extra_toolchains=@local_config_cc//:cc-toolchain-x64_windows-clang-cl
 build:clang-cl --extra_execution_platforms=//build_defs:x64_windows-clang-cl --host_platform=//build_defs:x64_windows-clang-cl
 build:msvc-cl --extra_execution_platforms=//build_defs:x64_windows-msvc-cl --host_platform=//build_defs:x64_windows-msvc-cl
 build --config=clang-cl
+# Set BAZEL_SH, this is needed for bazel 8.6.0 WORKSPACE on windows
+build --action_env=BAZEL_SH="C:/Program Files/Git/bin/bash.exe"
diff --git a/ci/bazel9.bazelrc b/ci/bazel9.bazelrc
@@ -1 +1,3 @@
 build --incompatible_exclude_starlark_flags_from_exec_config
+# TODO: Remove --repo_contents_cache
+common --repo_contents_cache=