Release 9.3.1rc1 (2026-10-21)

Release Notes:

Core:

• Preserve packages in top-level alias chains across pre-execution cache discards. (#31912)

ExternalDeps:

• Close the channel of a lock file when acquiring a lock fails (#31845) (#31896)

General:

• Release 9.3.0 (2026-10-07)
• Remove distrusted eMudhra and Sectigo AAA root CA certificates from the bundled JDK (#31920)

Performance:

• Rewind an action whose output was lost before it could be downloaded (#31902)

Acknowledgements:

This release contains contributions from many people at Google, as well as bazel.build machine account, Fabian Meumertzheim, Xùdōng Yáng.

Notice: Bazel installers contain binaries licensed under the GPLv2 with
Classpath exception. Those installers should always be redistributed along with
the source code.

Some versions of Bazel contain a bundled version of OpenJDK. The license of the
bundled OpenJDK and other open-source components can be displayed by running
the command bazel license. The vendor and version information of the bundled
OpenJDK can be displayed by running the command bazel info java-runtime.
The binaries and source-code of the bundled OpenJDK can be
downloaded from our mirror server.

Security: All our binaries are signed with our
public key 3D5919B448457EE0.