2026 07 16 upstream merge

.bazelrc

@@ -54,6 +54,9 @@ build:unix --features=external_include_paths --host_features=external_include_pa
 # Disable deprecated cfg = "host" Bazel rule setting. Blocked on perfetto.
 # common --incompatible_disable_starlark_host_transitions
 
+# Globally disable the "diabolic behavior" of implicit __init__.py creation (https://github.com/bazel-contrib/rules_python/issues/2945)
+common --incompatible_default_to_explicit_init_py
+
 # Our dependencies (ICU, zlib, etc.) produce a lot of these warnings, so we disable them.
 build --per_file_copt='external@-Wno-error'
 build --per_file_copt='external@-Wno-suggest-override'
@@ -282,6 +285,11 @@ build:unix --cxxopt='-Wsuggest-override'
 build:linux --config=unix
 build:macos --config=unix
 
+# Disable the deprecated rules_cc macOS toolchain – no need to configure this since we always use
+# the apple_support one, this will be removed in the future. See https://github.com/bazelbuild/rules_cc/issues/754
+# for context.
+build:macos --repo_env=BAZEL_USE_LEGACY_MACOS_TOOLCHAIN=0
+
 # Support macOS 13 as the minimum version. There should be at least a warning when backward
 # compatibility is broken as -Wunguarded-availability-new is enabled by default. Only enable for
 # target configuration as host configuration tools are only used during the build process.

.bazelversion

@@ -1 +1 @@
-9.1.1
+9.2.0

.clang-tidy

@@ -67,7 +67,8 @@ Checks: >
   readability-use-concise-preprocessor-directives,
   jsg-visit-for-gc,
   workerd-consume,
-  workerd-unsafe-continuation-capture
+  workerd-unsafe-continuation-capture,
+  custom-iocontext-run-manual-capture
 
 # TODO: Fix and enable
 # bugprone-derived-method-shadowing-base-method
@@ -93,3 +94,43 @@ CheckOptions:
     value: "jsg/jsg.h|jsg/dom-exception.h"
   - key: cppcoreguidelines-missing-std-forward.ForwardFunction
     value: "kj::fwd"
+
+####
+# Custom checks.
+#
+# Query-based custom checks (see capnp-cpp's `.clang-tidy` for more examples).
+# These require clang-tidy's `--experimental-custom-checks` flag, which is passed
+# by `build/tools/clang_tidy/clang_tidy.bzl`.
+#
+# References:
+# - https://clang.llvm.org/extra/clang-tidy/QueryBasedCustomChecks.html
+# - https://clang.llvm.org/docs/LibASTMatchersReference.html
+CustomChecks:
+  - Name: iocontext-run-manual-capture
+    # `IoContext::run()` (and friends) accept a callback of either
+    # `(Worker::Lock&)` or `(Worker::Lock&, IoContext&)`. When the callback needs
+    # the IoContext, the two-argument form should be used so that the IoContext is
+    # passed in as a parameter, rather than capturing it manually in the lambda
+    # capture list (which is easy to get wrong with respect to lifetimes).
+    #
+    # This matches a call to `IoContext::run(...)` whose first argument is a lambda
+    # that captures a variable whose type is `IoContext` (by value, reference, or
+    # pointer), e.g. `ctx.run([&ctx](Worker::Lock& lock) { ... })`.
+    Query: |
+      match cxxMemberCallExpr(
+        callee(cxxMethodDecl(
+          hasName("run"),
+          ofClass(cxxRecordDecl(hasName("::workerd::IoContext")))
+        )),
+        hasArgument(0, ignoringImplicit(lambdaExpr(
+          hasAnyCapture(lambdaCapture(capturesVar(varDecl(hasType(qualType(anyOf(
+            hasDeclaration(cxxRecordDecl(hasName("::workerd::IoContext"))),
+            references(cxxRecordDecl(hasName("::workerd::IoContext"))),
+            pointsTo(cxxRecordDecl(hasName("::workerd::IoContext")))
+          )))))))
+        ).bind("lambda")))
+      ).bind("call")
+    Diagnostic:
+      - BindName: lambda
+        Message: "IoContext::run() lambda captures the IoContext manually; use the two-argument (Worker::Lock&, IoContext&) lambda form instead"
+        Level: Warning

AGENTS.md

@@ -111,7 +111,7 @@ Key elements: `modules` (embed JS/TS files), `compatibilityFlags`, `bindings` (s
 
 ### Dependencies
 
-- **Cap'n Proto source code** available in `external/capnp-cpp` - contains KJ C++ base library and
+- **Cap'n Proto source code** available in `external/+http+capnp-cpp/` - it contains KJ C++ base library and
   capnproto RPC library. Consult it for all questions about `kj/` and `capnproto/` includes and
   `kj::` and `capnp::` namespaces.
 
@@ -246,6 +246,11 @@ C++ classes are exposed to JavaScript via JSG macros in `src/workerd/jsg/`. See
 - The `jsg-visit-for-gc` clang-tidy check (`//tools/clang-tidy:workerd-lint`)
   validates that GC-visitable fields are traced in `visitForGc()`. Run via
   `just clang-tidy <target>`. See `build/AGENTS.md` for details.
+- The `workerd-unsafe-continuation-capture` clang-tidy check flags lambdas
+  passed to async sinks (`kj/jsg::Promise::then`, `IoContext::run/awaitIo/...`,
+  `kj::evalLater`, ...) that capture bare references, `[this]`, or non-owning
+  views. See `docs/reference/detail/async-patterns.md` §Continuation Captures
+  for the safe-capture pattern catalog.
 
 ### Feature Management
 

BUILD.bazel

@@ -43,6 +43,7 @@ genrule(
     outs = ["merged.clang-tidy"],
     cmd = "$(location //build/tools/clang_tidy:merge_clang_tidy_configs) $@ $(location :.clang-tidy) $(location @capnp-cpp//:.clang-tidy)",
     tools = ["//build/tools/clang_tidy:merge_clang_tidy_configs"],
+    visibility = ["//visibility:public"],
 )
 
 # Plugin to generate .js files

MODULE.bazel

@@ -49,9 +49,6 @@ include("//build/deps:v8.MODULE.bazel")
 include("//build/deps:oci.MODULE.bazel")
 include("//build/deps/formatters:rustfmt.MODULE.bazel")
 
-# compatibility proxy is needed when using current rules_cc with Bazel 8
-compat = use_extension("@rules_cc//cc:extensions.bzl", "compatibility_proxy")
-use_repo(compat, "cc_compatibility_proxy")
-
+# Make local_config_cc available, used for retrieving Windows clang-cl toolchain
 cc_configure = use_extension("@rules_cc//cc:extensions.bzl", "cc_configure_extension")
 use_repo(cc_configure, "local_config_cc")

build/AGENTS.md

@@ -74,22 +74,22 @@ supports this:
 
 1. Add the check to `.clang-tidy` Checks list
 2. Add an entry to `CHECK_PATH_FILTERS` with an empty list (runs nowhere)
-3. Add packages as they are cleaned up
+3. Add file paths as they are cleaned up
 4. Remove the entry once fully rolled out (runs everywhere)
 
 Example:
 
 ```python
 CHECK_PATH_FILTERS = {
     "workerd-unsafe-continuation-capture": [
-        "//src/workerd/io",
-        "//src/workerd/api",
+        "src/workerd/io",
+        "src/workerd/api",
     ],
 }
 ```
 
-Package prefixes match themselves and all subpackages (`//src/workerd/io`
-matches `//src/workerd/io:*` and `//src/workerd/io/subdir:*`).
+Path prefixes match all files under that directory (`src/workerd/io`
+matches `src/workerd/io/foo.c++` and `src/workerd/io/subdir/bar.c++`).
 
 To run a filtered check everywhere during development:
 

build/config/BUILD.bazel

@@ -20,14 +20,3 @@ config_setting(
     values = {"define": "never_match=true"},  # This will never match
     visibility = ["//visibility:public"],
 )
-
-# Whether rules_rust binaries/tests should link via cc_common.link (see the
-# wd_rust_* macros). Always false standalone; an embedder may override this
-# when it needs these targets to link through the cc toolchain (e.g. to pick
-# up a custom allocator selected via --custom_malloc). Kept off here because
-# standalone workerd builds with non-hermetic system clang.
-config_setting(
-    name = "rust_cc_common_link",
-    values = {"define": "never_match=true"},  # This will never match
-    visibility = ["//visibility:public"],
-)

build/deps/BUILD

@@ -0,0 +1,58 @@
+# Bazel makes it difficult to define link options so that they can be set to different values for
+# tool/test binaries and across different C++ and Rust binaries – define a common configuration for
+# linker flags for workerd and downstream builds.
+
+load("@rules_cc//cc:cc_library.bzl", "cc_library")
+
+cc_library(
+    name = "linkopts_common",
+    # -dead_strip is the macOS equivalent of -ffunction-sections, -Wl,--gc-sections.
+    # -no_exported_symbols is used to not include the exports trie, which significantly reduces
+    # binary sizes. Unfortunately, the flag and the exports trie are poorly documented. Based
+    # on analyzing the binary sections with and without the flag, the information being removed
+    # consists of weak binding info, export binding info and stub bindings as described in
+    # http://www.newosxbook.com/articles/DYLD.html. The flag itself is described in
+    # https://www.wwdcnotes.com/notes/wwdc22/110362/.
+    # The affected sections appear to not be needed for debugging and are only used when
+    # external code needs to look up bindings in a binary, e.g. when loading a plugin
+    # (mac-specific feature). In particular, the symbol table is not affected (the name of the
+    # flag is misleading here).
+    linkopts = select({
+        "@//:use_dead_strip": [
+            "-Wl,-dead_strip",
+            "-Wl,-no_exported_symbols",
+        ],
+        "//conditions:default": [""],
+    }),
+    visibility = ["//visibility:public"],
+)
+
+cc_library(
+    name = "linkopts_default",
+    # For test binaries, reduce thinLTO optimizations and inlining to speed up linking. This
+    # only has an effect if thinLTO is enabled. -Wl,--lto-O0 results in disabling cross-optimization
+    # entirely without affecting codegen optimizations within a translation unit. Also limit thinLTO
+    # parallelism since our many test binaries may lead to resource exhaustion, but are unlikely to
+    # be on the critical path of a build step.
+    # TODO(someday): We used to turn down thinLTO optimization slightly less – maybe there's a use
+    # case for these settings somewhere still?
+    # linkopts = ["-Wl,--lto-O1", "-Wl,-mllvm,-import-instr-limit=5"],
+    linkopts = select({
+        "@platforms//os:linux": [
+            "-Wl,--lto-O0",
+            "-Wl,--thinlto-jobs=4",
+        ],
+        "//conditions:default": [""],
+    }),
+    visibility = ["//visibility:public"],
+    deps = [":linkopts_common"],
+)
+
+# link options to use with tools where we don't want to compromise performance, e.g. workerd. At
+# present, this is identical to linkopts_common, but we may want to move some linker optimizations
+# here in the future.
+cc_library(
+    name = "linkopts_tool",
+    visibility = ["//visibility:public"],
+    deps = [":linkopts_common"],
+)

build/deps/deps.jsonc

@@ -56,7 +56,7 @@
       "owner": "fastfloat",
       "repo": "fast_float",
       "branch": "main",
-      "freeze_commit": "05087a303dad9c98768b33c829d398223a649bc6",
+      "freeze_commit": "34164f547b7df3f5d794ff67e9f885c36819ebfc",
       "build_file_content": "cc_library(name = 'fast_float', hdrs = glob(['include/fast_float/*.h']), visibility = ['//visibility:public'], include_prefix = 'third_party/fast_float/src')",
       "use_module_bazel_from_bcr": "8.0.2"
     },
@@ -67,7 +67,7 @@
       "use_bazel_dep": true,
       "owner": "Maratyszcza",
       "repo": "FP16",
-      "freeze_commit": "3d2de1816307bac63c16a297e8c4dc501b4076df",
+      "freeze_commit": "782eea126dc5c755827be751a099eb01826175cf",
       "build_file_content": "exports_files(glob(['**']))",
       "use_module_bazel_from_bcr": "0.0.0-20210320-0a92994"
     },

build/deps/gen/deps.MODULE.bazel

@@ -27,10 +27,10 @@ bazel_dep(name = "brotli", version = "1.2.0.bcr.1")
 # capnp-cpp
 http.archive(
     name = "capnp-cpp",
-    sha256 = "94e5bcd03d14b8f1a1713e2477941e00b130b63b5a1aad97a10ff5edf05b6765",
-    strip_prefix = "capnproto-capnproto-e9fa5c7/c++",
+    sha256 = "fb221d3727b12fe3165b8dbbdfbf6f3d7073b353e434f1b9de9022618a3ed446",
+    strip_prefix = "capnproto-capnproto-bd8232b/c++",
     type = "tgz",
-    url = "https://github.com/capnproto/capnproto/tarball/e9fa5c7dc98192fc0dc0098ec770db68f997a938",
+    url = "https://github.com/capnproto/capnproto/tarball/bd8232ba2e09761c0901d1f64d14c83c17832001",
 )
 use_repo(http, "capnp-cpp")
 
@@ -52,10 +52,10 @@ archive_override(
     build_file_content = "cc_library(name = 'fast_float', hdrs = glob(['include/fast_float/*.h']), visibility = ['//visibility:public'], include_prefix = 'third_party/fast_float/src')",
     remote_file_integrity = {"MODULE.bazel": "sha256-Q1BGZO/fpMbPE0libIcTXJuHkmMlxyBFjzlu7iVWjto="},
     remote_file_urls = {"MODULE.bazel": ["https://raw.githubusercontent.com/bazelbuild/bazel-central-registry/refs/heads/main/modules/fast_float/8.0.2/MODULE.bazel"]},
-    sha256 = "aa2ab8d370d1011a7a6d4ab90589b298b7e5973fe00041c06ecc7298328c25b4",
-    strip_prefix = "fastfloat-fast_float-05087a3",
+    sha256 = "9b239eaa54c58fc3a1bb7e1a11030b67211e38ce7f4781b41b004f26f6fd1528",
+    strip_prefix = "fastfloat-fast_float-34164f5",
     type = "tgz",
-    url = "https://github.com/fastfloat/fast_float/tarball/05087a303dad9c98768b33c829d398223a649bc6",
+    url = "https://github.com/fastfloat/fast_float/tarball/34164f547b7df3f5d794ff67e9f885c36819ebfc",
 )
 
 # fp16
@@ -65,10 +65,10 @@ archive_override(
     build_file_content = "exports_files(glob(['**']))",
     remote_file_integrity = {"MODULE.bazel": "sha256-2YAHXAyoWo6FapWo2MBLpWyewByY+F4tSWUMbYt8gmg="},
     remote_file_urls = {"MODULE.bazel": ["https://raw.githubusercontent.com/bazelbuild/bazel-central-registry/refs/heads/main/modules/fp16/0.0.0-20210320-0a92994/MODULE.bazel"]},
-    sha256 = "81686dc45a7897cf958ee99f655879a066dde41db5fc1379a1e8db338ad17589",
-    strip_prefix = "Maratyszcza-FP16-3d2de18",
+    sha256 = "ee835b205fabb4035d2c64a2dda54f2e8ff720f9f77a1945b8fa71ba61290c70",
+    strip_prefix = "Maratyszcza-FP16-782eea1",
     type = "tgz",
-    url = "https://github.com/Maratyszcza/FP16/tarball/3d2de1816307bac63c16a297e8c4dc501b4076df",
+    url = "https://github.com/Maratyszcza/FP16/tarball/782eea126dc5c755827be751a099eb01826175cf",
 )
 
 # highway
@@ -136,10 +136,10 @@ bazel_dep(name = "tcmalloc", version = "0.0.0-20250927-12f2552")
 # workerd-cxx
 http.archive(
     name = "workerd-cxx",
-    sha256 = "d4db1075562a134a19dee7751adfc79bba95cad7740bb42d5621c4dfd78158d3",
-    strip_prefix = "cloudflare-workerd-cxx-5cb35c5",
+    sha256 = "f3213d568e0d135753da8e3f3c16c5a4f2c508c567d567a608e85ba61d98aa2c",
+    strip_prefix = "cloudflare-workerd-cxx-61285bf",
     type = "tgz",
-    url = "https://github.com/cloudflare/workerd-cxx/tarball/5cb35c57a904f3c949b13583a66a4ae55ebb6eda",
+    url = "https://github.com/cloudflare/workerd-cxx/tarball/61285bf53ffed51e4bc47d795f0e92461ce41ab4",
 )
 use_repo(http, "workerd-cxx")
 

build/deps/python.MODULE.bazel

@@ -24,31 +24,31 @@ use_repo(
     "all_pyodide_wheels_20250808",
     "beautifulsoup4_src_0.26.0a2",
     "beautifulsoup4_src_0.28.2",
-    "beautifulsoup4_src_314.0.0",
+    "beautifulsoup4_src_314.0.2",
     "beautifulsoup4_src_development",
     "fastapi_src_0.26.0a2",
     "fastapi_src_0.28.2",
     "numpy_src_0.28.2",
-    "numpy_src_314.0.0",
+    "numpy_src_314.0.2",
     "numpy_src_development",
     "pyodide-0.26.0a2",
     "pyodide-0.28.2",
-    "pyodide-314.0.0",
+    "pyodide-314.0.2",
     "pyodide-snapshot-baseline-4569679fb.bin",
+    "pyodide-snapshot-baseline-484e61538.bin",
     "pyodide-snapshot-baseline-61eedf943.bin",
-    "pyodide-snapshot-baseline-8816cf608.bin",
     "pyodide-snapshot-snapshot_a6b652a95810783f5078b9a5dbd4a07c30718acb4ff724e82c25db7353dd7f2d.bin",
     "pyodide_0.26.0a2_2024-03-01_83.capnp.bin",
     "pyodide_0.28.2_2025-01-16_14.capnp.bin",
-    "pyodide_314.0.0_2026-06-10_6.capnp.bin",
+    "pyodide_314.0.2_2026-06-10_12.capnp.bin",
     "pyodide_dev.capnp.bin",
     "pytest-asyncio_src_0.26.0a2",
     "pytest-asyncio_src_0.28.2",
-    "pytest-asyncio_src_314.0.0",
+    "pytest-asyncio_src_314.0.2",
     "pytest-asyncio_src_development",
     "python-workers-runtime-sdk_src_0.26.0a2",
     "python-workers-runtime-sdk_src_0.28.2",
-    "python-workers-runtime-sdk_src_314.0.0",
+    "python-workers-runtime-sdk_src_314.0.2",
     "python-workers-runtime-sdk_src_development",
     "scipy_src_0.26.0a2",
     "shapely_src_0.28.2",

build/deps/v8.MODULE.bazel

@@ -18,9 +18,9 @@ http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "ht
 
 git_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
 
-VERSION = "15.0.245.14"
+VERSION = "15.1.206.7"
 
-INTEGRITY = "sha256-6Txsw77ZX2BQoqTdA0WQQ5C2EmgUu6lYQAkT/wJ2UUM="
+INTEGRITY = "sha256-BToQQPeqVh//fw86DQYHhNVBzyfJ7f+Wlwlfz4nRBZs="
 
 PATCHES = [
     "0001-Allow-manually-setting-ValueDeserializer-format-vers.patch",
@@ -58,10 +58,9 @@ PATCHES = [
     "0033-Return-false-on-Object.hasOwnProperty-with-intercept.patch",
     "0034-Remove-V8-MODULE.bazel-llvm-toolchain-and-libcxx-rep.patch",
     "0035-Remove-libcxx-dep-from-defs.bzl-not-resolvable-via-h.patch",
-    "0036-Fix-non-portable-std-atomic_flag-construction-in-run.patch",
-    "0037-Fix-ExtendedMap-layout-on-Windows.patch",
-    "0038-Fix-CFunction-MemorySpan-declarations-on-Windows.patch",
-    "0039-Properly-depend-on-llvm-libc.patch",
+    "0036-Fix-ExtendedMap-layout-on-Windows.patch",
+    "0037-Fix-CFunction-MemorySpan-declarations-on-Windows.patch",
+    "0038-Properly-depend-on-llvm-libc.patch",
 ]
 
 http_archive(
@@ -83,7 +82,7 @@ git_repository(
 git_repository(
     name = "com_googlesource_chromium_icu",
     build_file = "@v8//:bazel/BUILD.icu",
-    commit = "ee5f27adc28bd3f15b2c293f726d14d2e336cbd5",
+    commit = "d578f2e8b7bd5938e21cfb6bf15c079e0aa5b738",
     patch_cmds = ["find source -name BUILD.bazel | xargs rm"],
     patch_cmds_win = ["Get-ChildItem -Path source -File -Include BUILD.bazel -Recurse | Remove-Item"],
     remote = "https://chromium.googlesource.com/chromium/deps/icu.git",

build/kj_test.bzl

@@ -16,19 +16,12 @@ def kj_test(
         srcs = [src],
         deps = [
             "@capnp-cpp//src/kj:kj-test",
+            "//build/deps:linkopts_default",
         ] + deps,
         linkstatic = select({
             "@platforms//os:linux": 0,
             "//conditions:default": 1,
         }),
-        # For test binaries, reduce thinLTO optimizations and inlining to speed up linking. This
-        # only has an effect if thinLTO is enabled. Also apply dead_strip on macOS to manage binary
-        # sizes.
-        linkopts = select({
-            "@platforms//os:linux": ["-Wl,--lto-O1", "-Wl,-mllvm,-import-instr-limit=5"],
-            "@//:use_dead_strip": ["-Wl,-dead_strip", "-Wl,-no_exported_symbols"],
-            "//conditions:default": [""],
-        }),
         data = data,
         tags = tags,
         target_compatible_with = select({