Use patched latest fmt and rules_dotnet modules by jketema · Pull Request #22954 · github/codeql

jketema · 2026-10-30T10:27:49Z

Summary

Update the patched fmt module to 12.2.0.bcr.1-codeql.1, based on the BCR 12.2.0.bcr.1 entry.
Preserve the existing local overlay and Windows FMT_UNICODE=0 workaround without restoring the upstream /utf-8 compiler option.
Use patched rules_dotnet 0.22.2 and update the .NET SDK to 10.0.201.

Validation

Changed Bazel files pass buildifier; registry metadata and overlay hashes were regenerated and verified.
Verified the fmt BUILD overlay is byte-for-byte identical to the original PR's Windows workaround, with consistent patched version references.

Copilot

🟡 Changes recommended

Active findings remain, including a moderate Windows build-regression risk from removing the prior MSVC workaround and a typo in a new comment.

2 open issues

What changed in this PR

Updates CodeQL’s Bazel dependencies to patched releases of fmt 12.2.0 and rules_dotnet 0.22.2, while retaining the .NET SDK pin at 10.0.100.

Changes:

Upgrades root dependencies to fmt 12.2.0-codeql.1 and rules_dotnet 0.22.2-codeql.1.
Adds registry metadata, source definitions, overlays, and integrity information for both modules.
Adds rules_dotnet patches for module versioning and NuGet archive behavior.
Validation confirmed metadata hashes, patch application, and buildifier formatting; Bazel resolution remains blocked by TLS certificate validation.

File	Description
`MODULE.bazel`	Selects the updated `fmt` and `rules_dotnet` modules.
`misc/bazel/registry/modules/rules_dotnet/metadata.json`	Registers the new `rules_dotnet` version.
`misc/bazel/registry/modules/rules_dotnet/0.22.2-codeql.1/source.json`	Defines the release archive, integrity hash, and patches.
`misc/bazel/registry/modules/rules_dotnet/0.22.2-codeql.1/patches/revert_additional_files_in_nuget_archive.patch`	Restores the desired NuGet archive behavior.
`misc/bazel/registry/modules/rules_dotnet/0.22.2-codeql.1/patches/module_dot_bazel_version.patch`	Sets the patched module version.
`misc/bazel/registry/modules/rules_dotnet/0.22.2-codeql.1/MODULE.bazel`	Configures the pinned .NET SDK and module dependencies. Review note: the comment contains the typo `buit`, which should be `built`.
`misc/bazel/registry/modules/fmt/metadata.json`	Registers the new `fmt` version.
`misc/bazel/registry/modules/fmt/12.2.0-codeql.1/source.json`	Defines the `fmt` archive, overlays, and integrity hashes.
`misc/bazel/registry/modules/fmt/12.2.0-codeql.1/overlay/MODULE.bazel`	Provides patched module metadata and dependencies.
`misc/bazel/registry/modules/fmt/12.2.0-codeql.1/overlay/BUILD.bazel`	Defines the `fmt` Bazel target, licensing, and package metadata. Review note: preserve the MSVC `FMT_UNICODE=0` define from the prior overlay unless the upgrade has a verified fix for the known Windows UTF-8 build failure.
`misc/bazel/registry/modules/fmt/12.2.0-codeql.1/MODULE.bazel`	Provides the versioned `fmt` module definition.

This pull request requires changes.

_{Review effort: Lite (auto)}

Add and use patched registry versions for fmt 12.2.0 and rules_dotnet 0.22.2, preserving the Windows Unicode workaround, NuGet archive patch, and rules_shell declaration. Update the root and module .NET SDK toolchains to 10.0.201. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Use fmt 12.2.0.bcr.1 metadata with a CodeQL version suffix, preserving the existing Windows FMT_UNICODE=0 overlay instead of the upstream /utf-8 option. Regenerate module declarations and overlay integrity hashes.

Copilot

🟡 Changes recommended

An active moderate finding remains because the Bazel SDK pin and the companion dependency-fetching SDK pin are inconsistent, requiring synchronized updates.

1 open issue

Keep dependency-fetching SDK pin in sync with Bazel SDK · New

2 resolved since last review

_{Review effort: Lite (auto)}

Use 10.0.201 for dependency fetching without global.json, extractor and test setup, and stub generation, matching the updated Bazel build SDK.

michaelnebel

Thank you for doing this!
I have added a couple of comments.
We should also run DCA after the comments have been addressed.

michaelnebel · 2026-11-04T07:59:24Z

+        dotnet-version: 10.0.201
    - name: Build Extractor
      shell: bash
      run: scripts/create-extractor-pack.sh


In the create-extractor-pack.sh script we should also update -p:RuntimeFrameworkVersion=10.0.0 to -p:RuntimeFrameworkVersion=10.0.5 (otherwise the extractor still targets the runtime shipped with .NET 10.0.100).

I'll update, but my understanding of this is that it is unrelated to what we actually ship, as we do not use create-extractor-pack.sh when we create actual releases.

Done in 77a4a35

If the actual release automatically target the runtime framework version shipped with the .NET version (10.0.201), then we should probably update here anyway (otherwise there is a discrepancy between what the scripts creates and what we ship).

michaelnebel · 2026-11-04T08:02:00Z

+          dotnet-version: 10.0.201
      - name: Extractor unit tests
        run: |
          dotnet tool restore


To use the runtime shipped with .NET 10.0.201, we should update -p:RuntimeFrameworkVersion=10.0.0 to p:RuntimeFrameworkVersion=10.0.5 (see my comment below)

For the tests the RuntimeFrameworkVersion is set here

michaelnebel · 2026-11-04T08:09:34Z

 bazel_dep(name = "rules_kotlin", version = "2.4.21-codeql.1")
 bazel_dep(name = "gazelle", version = "0.54.0")
-bazel_dep(name = "rules_dotnet", version = "0.21.5-codeql.1")
+bazel_dep(name = "rules_dotnet", version = "0.22.2-codeql.1")


Is there an internal PR updating the rules_dotnet version number in MODULE.bazel in semmle-code?

Not yet. That's next on my list.

It's also not critical. Bazel will pick up 0.22.2-codeql.1 when you're on a new enough ql commit.

michaelnebel · 2026-11-04T09:27:17Z


 dotnet = use_extension("@rules_dotnet//dotnet:extensions.bzl", "dotnet")
-dotnet.toolchain(dotnet_version = "10.0.100")
+dotnet.toolchain(dotnet_version = "10.0.201")


In relation to your comment about what we ship: I suppose that bazel will automatically target the runtime shipped with .NET 10.0.201 SDK (which is 10.0.5)?

michaelnebel

Excellent - thank you for the updates and clarifications.

michaelnebel · 2026-11-04T09:29:53Z

+        dotnet-version: 10.0.201
    - name: Build Extractor
      shell: bash
      run: scripts/create-extractor-pack.sh


If the actual release automatically target the runtime framework version shipped with the .NET version (10.0.201), then we should probably update here anyway (otherwise there is a discrepancy between what the scripts creates and what we ship).

michaelnebel

Excellent, thank you!
Please run DCA before merging.

Also, we will need to do this again in the very near future as soon as rules_dotnet has support for .NET 11.

jketema · 2026-11-04T09:58:00Z

Please run DCA before merging.

Started one.

jketema · 2026-11-04T18:47:33Z

@michaelnebel DCA eventually finished. Results look a bit messy, but that might be normal?

Copilot AI auto review requested due to automatic review settings October 30, 2026 10:27

jketema requested review from a team as code owners October 30, 2026 10:27

Copilot started reviewing on behalf of jketema October 30, 2026 10:28

View session

Copilot AI reviewed Oct 30, 2026

View reviewed changes

Comment thread misc/bazel/registry/modules/fmt/12.2.0-codeql.1/overlay/BUILD.bazel Resolved

Comment thread misc/bazel/registry/modules/rules_dotnet/0.22.2-codeql.1/MODULE.bazel Resolved

jketema marked this pull request as draft October 30, 2026 10:35

jketema force-pushed the copilot/patch-latest-bazel-deps branch 3 times, most recently from 0ac7b21 to e4e9f06 Compare November 3, 2026 18:31

jketema and others added 2 commits November 3, 2026 18:41

Update patched fmt to 12.2.0.bcr.1-codeql.1

0eb898f

Use fmt 12.2.0.bcr.1 metadata with a CodeQL version suffix, preserving the existing Windows FMT_UNICODE=0 overlay instead of the upstream /utf-8 option. Regenerate module declarations and overlay integrity hashes.

jketema force-pushed the copilot/patch-latest-bazel-deps branch from e4e9f06 to 0eb898f Compare November 3, 2026 18:42

jketema marked this pull request as ready for review November 3, 2026 19:21

jketema requested an auto review from Copilot November 3, 2026 19:21

Copilot started reviewing on behalf of jketema November 3, 2026 19:22

View session

Copilot AI reviewed Nov 3, 2026

View reviewed changes

Comment thread MODULE.bazel Resolved

Synchronize C# SDK pins with the Bazel toolchain

972a631

Use 10.0.201 for dependency fetching without global.json, extractor and test setup, and stub generation, matching the updated Bazel build SDK.

jketema requested a review from a team as a code owner November 3, 2026 19:33

github-actions Bot added the C# label Nov 3, 2026

michaelnebel reviewed Nov 4, 2026

View reviewed changes

Update C# runtime version

77a4a35

michaelnebel reviewed Nov 4, 2026

View reviewed changes

Update C# runtime in tests

aed0286

michaelnebel approved these changes Nov 4, 2026

View reviewed changes

Conversation

jketema commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

michaelnebel left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

michaelnebel left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

michaelnebel left a comment

Choose a reason for hiding this comment

Uh oh!

jketema commented Nov 4, 2026

Uh oh!

jketema commented Nov 4, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jketema commented Oct 30, 2026 •

edited

Loading