Embed python stdlib modules

.bazelrc

@@ -46,8 +46,9 @@ import %workspace%/build/tools/clang_tidy/clang_tidy.bazelrc
 build --incompatible_remote_local_fallback_for_remote_cache
 
 # Use -isystem for cc_library includes attribute – this prevents warnings for misbehaving external
-# code.
-build:linux --features=external_include_paths --host_features=external_include_paths
+# code. Applies to both Linux and macOS via the shared `:unix` config (see the
+# `build:linux --config=unix` / `build:macos --config=unix` lines below).
+build:unix --features=external_include_paths --host_features=external_include_paths
 
 # Forward compatibility with future Bazel versions:
 # Disable deprecated cfg = "host" Bazel rule setting. Blocked on perfetto.

.bazelversion

@@ -1 +1 @@
-9.1.0
+9.1.1

.clang-tidy

@@ -1,4 +1,7 @@
 ---
+# This is workerd's base clang-tidy config. The default Bazel clang-tidy config
+# is generated by merging this file with dependency configs, such as capnp-cpp's
+# `.clang-tidy`, while preserving workerd-specific settings below.
 # TODO: We currently only enable select clang-tidy checks. While many checks provide little value or
 # produce false positives, try to incrementally enable most of them.
 # TODO: these checks are in progress of cleaning up

.github/workflows/_bazel.yml

@@ -121,13 +121,6 @@ jobs:
             # Strip comment in front of WORKERS_MIRROR_URL, then substitute secret to use it.
             sed -e '/WORKERS_MIRROR_URL/ { s@# *@@; s@WORKERS_MIRROR_URL@${{ secrets.WORKERS_MIRROR_URL }}@; }' -i.bak build/deps/nodejs.MODULE.bazel
           fi
-      - name: Bazel build (Windows workaround)
-        if: runner.os == 'Windows'
-        # HACK: Work around Bazel Windows bug: Some targets need to be compiled without symlink
-        # support. Since we still need symlinks to compile C++ code properly, compile these targets
-        # separately.
-        run: |
-          bazel --nowindows_enable_symlinks build ${{ inputs.extra_bazel_args }} --config=ci --profile build-win-workaround.bazel-profile.gz --remote_cache=https://bazel:${{ secrets.BAZEL_CACHE_KEY }}@bazel-remote-cache.devprod.cloudflare.dev //src/wpt:wpt-all@tsproject //src/node:node@tsproject //src/pyodide:pyodide_static@tsproject
       - name: Bazel build
         run: |
           bazel build --remote_cache=https://bazel:${{ secrets.BAZEL_CACHE_KEY }}@bazel-remote-cache.devprod.cloudflare.dev  --config=ci ${{ inputs.extra_bazel_args }} //...

AGENTS.md

@@ -300,6 +300,5 @@ See the markdown files in the `docs/` directory for additional information on sp
 
 - [development.md](docs/development.md) - Development environment setup and tools
 - [api-updates.md](docs/api-updates.md) - Guidelines for adding new JavaScript APIs
-- [pyodide.md](docs/pyodide.md) - Pyodide package management and updates
 
 Some source directories also contain README.md files with more specific information about that component. Proactively look for these when working in unfamiliar areas of the codebase. Proactively suggest updates to the documentation when it is missing or out of date, but do not make edits without confirming accuracy.

BUILD.bazel

@@ -34,6 +34,17 @@ npm_link_package(
     package = "@workerd/jsg",
 )
 
+genrule(
+    name = "merged_clang_tidy_config",
+    srcs = [
+        ":.clang-tidy",
+        "@capnp-cpp//:.clang-tidy",
+    ],
+    outs = ["merged.clang-tidy"],
+    cmd = "$(location //build/tools/clang_tidy:merge_clang_tidy_configs) $@ $(location :.clang-tidy) $(location @capnp-cpp//:.clang-tidy)",
+    tools = ["//build/tools/clang_tidy:merge_clang_tidy_configs"],
+)
+
 # Plugin to generate .js files
 capnp_es_bins.capnpc_js_binary(
     name = "capnpc_js_plugin",
@@ -142,6 +153,6 @@ selects.config_setting_group(
 # Clang-tidy config to use
 label_flag(
     name = "clang_tidy_config",
-    build_setting_default = ":.clang-tidy",
+    build_setting_default = ":merged_clang_tidy_config",
     visibility = ["//visibility:public"],
 )

MODULE.bazel

@@ -15,6 +15,7 @@ archive_override(
         "//:patches/sqlite/0002-macOS-missing-PATH-fix.patch",
         "//:patches/sqlite/0003-sqlite-complete-early-exit.patch",
         "//:patches/sqlite/0004-invalid-wal-on-rollback-fix.patch",
+        "//:patches/sqlite/0005-authorizer-rename-to-destination-name.patch",
     ],
     remote_file_integrity = {
         "MODULE.bazel": "sha256-+H38CSP6DtMT+YPSy9lplRLcfBApkukY4vdX6lBjDfI=",

build/AGENTS.md

@@ -65,4 +65,6 @@ Lives in `deps/`. Uses jsonc manifests + codegen:
 - `gen/` — **autogenerated**; do not hand-edit
 - `*.MODULE.bazel` (e.g., `rust.MODULE.bazel`, `v8.MODULE.bazel`) — included by root `MODULE.bazel`
 - `workerd-v8/` — separate Bazel module wrapping V8 dependency
-- `python/` — Pyodide package lists (versioned `.bzl` files)
+
+Pyodide package metadata lives in `build/python_metadata.bzl`; the checked-in, pre-filtered
+package lock files live in `src/pyodide/python-lock/`.

build/ci.bazelrc

@@ -9,6 +9,8 @@ build:ci --verbose_failures
 # closer towards the suggested value of 200. Note the number of maximum build jobs is controlled by
 # the --local_resources=cpu flag and still limited to the number of cores by default.
 build:ci --jobs=64
+# attempt to recover from remote cache errors without needing to retry build
+build:ci --rewind_lost_inputs
 # Do not check for changes in external repository files, should speed up bazel invocations after the first one
 build:ci --noexperimental_check_external_repository_files
 # Only build runfile trees when needed. Runfile trees are useful for directly invoking bazel-built

build/deps/dep_pyodide.bzl

@@ -12,23 +12,51 @@ def _pyodide_core(*, version, sha256, **_kwds):
     )
     return [name]
 
-def _pyodide_packages(*, tag, lockfile_hash, all_wheels_hash, **_kwds):
-    lock_name = "pyodide-lock_%s.json" % tag
-    http_file(
-        name = lock_name,
-        sha256 = lockfile_hash,
-        url = "https://github.com/cloudflare/pyodide-build-scripts/releases/download/%s/pyodide-lock.json" % tag,
-    )
+# Base URL the build downloads the stdlib wheels from.
+PYTHON_PACKAGES_URL = "https://pyodide-capnp-bin.edgeworker.net/"
+
+def _stdlib_wheels_repo_impl(rctx):
+    # Built-in Python package support has been removed, so workers can no longer
+    # request arbitrary packages. The checked-in lock files
+    # (src/pyodide/python-lock/) are pre-filtered to contain exactly the
+    # packages that are still loaded at runtime (the CPython stdlib modules and
+    # the shared libraries they depend on). We download just those wheels. They
+    # are embedded directly into the Pyodide bundle.
+    lock = json.decode(rctx.read(rctx.attr.lockfile))
+    for pkg in lock["packages"].values():
+        file_name = pkg["file_name"]
+        rctx.download(
+            url = "%spython-package-bucket/%s/%s" % (PYTHON_PACKAGES_URL, rctx.attr.tag, file_name),
+            output = file_name,
+            sha256 = pkg["sha256"],
+        )
+    rctx.file("BUILD.bazel", """\
+filegroup(
+    name = "whls",
+    srcs = glob(["*"], exclude = ["BUILD.bazel"]),
+    visibility = ["//visibility:public"],
+)
 
-    # Use @workerd prefix on build_file so we can use this from edgeworker too
-    archive_name = "all_pyodide_wheels_%s" % tag
-    http_archive(
-        name = archive_name,
-        build_file = "@workerd//:build/BUILD.all_pyodide_wheels",
-        sha256 = all_wheels_hash,
-        urls = ["https://github.com/cloudflare/pyodide-build-scripts/releases/download/%s/all_wheels.zip" % tag],
+# Individual wheels, so they can be embedded into the Pyodide bundle one data module at a time.
+exports_files(glob(["*"], exclude = ["BUILD.bazel"]))
+""")
+
+_stdlib_wheels_repo = repository_rule(
+    implementation = _stdlib_wheels_repo_impl,
+    attrs = {
+        "tag": attr.string(mandatory = True),
+        "lockfile": attr.label(mandatory = True, allow_single_file = True),
+    },
+)
+
+def _pyodide_packages(*, tag, **_kwds):
+    name = "all_pyodide_wheels_%s" % tag
+    _stdlib_wheels_repo(
+        name = name,
+        tag = tag,
+        lockfile = "@workerd//src/pyodide:python-lock/pyodide-lock_%s.json" % tag,
     )
-    return [lock_name, archive_name]
+    return [name]
 
 VENDOR_R2 = "https://pub-25a5b2f2f1b84655b185a505c7a3ad23.r2.dev/"
 
@@ -83,16 +111,10 @@ def _snapshot_http_files_version(
         baseline_snapshot = None,
         baseline_snapshot_hash = None,
         baseline_snapshot_integrity = None,
-        numpy_snapshot = None,
-        numpy_snapshot_integrity = None,
-        fastapi_snapshot = None,
-        fastapi_snapshot_integrity = None,
         dedicated_fastapi_snapshot = None,
         dedicated_fastapi_snapshot_integrity = None,
         **_kwds):
     return (_snapshot_http_file(name, "baseline-snapshot/", baseline_snapshot, baseline_snapshot_integrity, baseline_snapshot_hash) +
-            _snapshot_http_file(name, "test-snapshot/", numpy_snapshot, numpy_snapshot_integrity, None) +
-            _snapshot_http_file(name, "test-snapshot/", fastapi_snapshot, fastapi_snapshot_integrity, None) +
             _snapshot_http_file(name, "", dedicated_fastapi_snapshot, dedicated_fastapi_snapshot_integrity, None, VENDOR_R2))
 
 def _snapshot_http_files():

build/deps/deps.jsonc

@@ -56,7 +56,7 @@
       "owner": "fastfloat",
       "repo": "fast_float",
       "branch": "main",
-      "freeze_commit": "cb1d42aaa1e14b09e1452cfdef373d051b8c02a4",
+      "freeze_commit": "05087a303dad9c98768b33c829d398223a649bc6",
       "build_file_content": "cc_library(name = 'fast_float', hdrs = glob(['include/fast_float/*.h']), visibility = ['//visibility:public'], include_prefix = 'third_party/fast_float/src')",
       "use_module_bazel_from_bcr": "8.0.2"
     },
@@ -78,7 +78,7 @@
       "use_bazel_dep": true,
       "owner": "google",
       "repo": "highway",
-      "freeze_commit": "84379d1c73de9681b54fbe1c035a23c7bd5d272d",
+      "freeze_commit": "2607d3b5b0113992fe84d3848859eae13b3b52c1",
       "use_module_bazel_from_bcr": "1.3.0"
     },
     {
@@ -102,7 +102,7 @@
       "repo": "perfetto",
       "patches": [
         "//:patches/perfetto/0001-Don-t-attempt-to-use-rules_android.patch",
-        "//:patches/perfetto/0002-disable-info-level-logging.patch"
+        "//:patches/perfetto/0002-disable-info-level-logging-re2.patch"
       ]
     },
     {

build/deps/gen/build_deps.MODULE.bazel

@@ -5,7 +5,7 @@ http = use_extension("@//:build/exts/http.bzl", "http")
 git_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
 
 # abseil-cpp
-bazel_dep(name = "abseil-cpp", version = "20260107.1")
+bazel_dep(name = "abseil-cpp", version = "20260526.0")
 
 # apple_support
 bazel_dep(name = "apple_support", version = "2.5.4")
@@ -14,10 +14,10 @@ bazel_dep(name = "apple_support", version = "2.5.4")
 bazel_dep(name = "aspect_rules_esbuild", version = "0.26.0")
 
 # aspect_rules_js
-bazel_dep(name = "aspect_rules_js", version = "3.1.1")
+bazel_dep(name = "aspect_rules_js", version = "3.1.2")
 
 # aspect_rules_ts
-bazel_dep(name = "aspect_rules_ts", version = "3.8.9")
+bazel_dep(name = "aspect_rules_ts", version = "3.8.10")
 
 # bazel_lib
 bazel_dep(name = "bazel_lib", version = "3.3.1")
@@ -79,7 +79,7 @@ bazel_dep(name = "rules_nodejs", version = "6.7.4")
 bazel_dep(name = "rules_oci", version = "2.3.0")
 
 # rules_python
-bazel_dep(name = "rules_python", version = "2.0.1")
+bazel_dep(name = "rules_python", version = "2.0.2")
 
 # rules_rust
 bazel_dep(name = "rules_rust", version = "0.70.0")
@@ -91,53 +91,53 @@ bazel_dep(name = "rules_shell", version = "0.8.0")
 http.archive(
     name = "wasm_tools_linux_arm64",
     build_file_content = "exports_files([\"wasm-tools\"])",
-    sha256 = "cb7a3ae7a79aeb3dbcdb1d06eedea7bb45e6d5c7a21e960e14e45d582b2b9f97",
-    strip_prefix = "wasm-tools-1.248.0-aarch64-linux",
+    sha256 = "a6f7684f4bc618068cf9ae09cf3c1ccfe72a97061324c8f7a15f409f6a4c18c3",
+    strip_prefix = "wasm-tools-1.250.0-aarch64-linux",
     type = "tgz",
-    url = "https://github.com/bytecodealliance/wasm-tools/releases/download/v1.248.0/wasm-tools-1.248.0-aarch64-linux.tar.gz",
+    url = "https://github.com/bytecodealliance/wasm-tools/releases/download/v1.250.0/wasm-tools-1.250.0-aarch64-linux.tar.gz",
 )
 use_repo(http, "wasm_tools_linux_arm64")
 
 # wasm_tools_linux_x64
 http.archive(
     name = "wasm_tools_linux_x64",
     build_file_content = "exports_files([\"wasm-tools\"])",
-    sha256 = "dcd7d587b0f4644aabc85cd4471cb795de84f36a68ee01201d5261f87c0d6349",
-    strip_prefix = "wasm-tools-1.248.0-x86_64-linux",
+    sha256 = "b746c34e7c4162b8812eb29397ebe076834e496a8c46fe68d793379a2741eb50",
+    strip_prefix = "wasm-tools-1.250.0-x86_64-linux",
     type = "tgz",
-    url = "https://github.com/bytecodealliance/wasm-tools/releases/download/v1.248.0/wasm-tools-1.248.0-x86_64-linux.tar.gz",
+    url = "https://github.com/bytecodealliance/wasm-tools/releases/download/v1.250.0/wasm-tools-1.250.0-x86_64-linux.tar.gz",
 )
 use_repo(http, "wasm_tools_linux_x64")
 
 # wasm_tools_macos_arm64
 http.archive(
     name = "wasm_tools_macos_arm64",
     build_file_content = "exports_files([\"wasm-tools\"])",
-    sha256 = "4e03e9e342176a9c52e0c25b9707c7f809daeb0f4986742258c69749681efe79",
-    strip_prefix = "wasm-tools-1.248.0-aarch64-macos",
+    sha256 = "1efe40e1923a80947db3a9a8b84c64442c539988a25cfd4ebe516d00bb5c4ba3",
+    strip_prefix = "wasm-tools-1.250.0-aarch64-macos",
     type = "tgz",
-    url = "https://github.com/bytecodealliance/wasm-tools/releases/download/v1.248.0/wasm-tools-1.248.0-aarch64-macos.tar.gz",
+    url = "https://github.com/bytecodealliance/wasm-tools/releases/download/v1.250.0/wasm-tools-1.250.0-aarch64-macos.tar.gz",
 )
 use_repo(http, "wasm_tools_macos_arm64")
 
 # wasm_tools_macos_x64
 http.archive(
     name = "wasm_tools_macos_x64",
     build_file_content = "exports_files([\"wasm-tools\"])",
-    sha256 = "188568c2990bb4c09a0936d84bfb6255199f97e4844cd45f418b59c3d6238788",
-    strip_prefix = "wasm-tools-1.248.0-x86_64-macos",
+    sha256 = "491edeb43ba81154b44da5f8da7dba64a4a3fed5ab4985c58e9a48d1b75ad41b",
+    strip_prefix = "wasm-tools-1.250.0-x86_64-macos",
     type = "tgz",
-    url = "https://github.com/bytecodealliance/wasm-tools/releases/download/v1.248.0/wasm-tools-1.248.0-x86_64-macos.tar.gz",
+    url = "https://github.com/bytecodealliance/wasm-tools/releases/download/v1.250.0/wasm-tools-1.250.0-x86_64-macos.tar.gz",
 )
 use_repo(http, "wasm_tools_macos_x64")
 
 # wasm_tools_windows_x64
 http.archive(
     name = "wasm_tools_windows_x64",
     build_file_content = "exports_files([\"wasm-tools.exe\"])",
-    sha256 = "09063f9c0bc07f412d58a8c1a0202260231d8a94a9dfb7b81892d517de995c1c",
-    strip_prefix = "wasm-tools-1.248.0-x86_64-windows/",
+    sha256 = "e6ab7924618d1caeb6eaa9debdf2a20ad9248f830731493776b283e42e1cd62e",
+    strip_prefix = "wasm-tools-1.250.0-x86_64-windows/",
     type = "zip",
-    url = "https://github.com/bytecodealliance/wasm-tools/releases/download/v1.248.0/wasm-tools-1.248.0-x86_64-windows.zip",
+    url = "https://github.com/bytecodealliance/wasm-tools/releases/download/v1.250.0/wasm-tools-1.250.0-x86_64-windows.zip",
 )
 use_repo(http, "wasm_tools_windows_x64")

build/deps/gen/deps.MODULE.bazel

@@ -27,10 +27,10 @@ bazel_dep(name = "brotli", version = "1.2.0.bcr.1")
 # capnp-cpp
 http.archive(
     name = "capnp-cpp",
-    sha256 = "a87651d1772c138643e1fc28ca0cbc8eda0445ca265bc200c083c31a75919386",
-    strip_prefix = "capnproto-capnproto-911e53d/c++",
+    sha256 = "b2c065b37cd6daac4d30943bd1574f6e70b59ac1a217c859cef7d0cf7ba94efa",
+    strip_prefix = "capnproto-capnproto-fd6aad7/c++",
     type = "tgz",
-    url = "https://github.com/capnproto/capnproto/tarball/911e53d67841687afe9a349fd8c0d39fe024515a",
+    url = "https://github.com/capnproto/capnproto/tarball/fd6aad7ca96cf4c9e2bcbd74d4132691bfa8e898",
 )
 use_repo(http, "capnp-cpp")
 
@@ -52,10 +52,10 @@ archive_override(
     build_file_content = "cc_library(name = 'fast_float', hdrs = glob(['include/fast_float/*.h']), visibility = ['//visibility:public'], include_prefix = 'third_party/fast_float/src')",
     remote_file_integrity = {"MODULE.bazel": "sha256-Q1BGZO/fpMbPE0libIcTXJuHkmMlxyBFjzlu7iVWjto="},
     remote_file_urls = {"MODULE.bazel": ["https://raw.githubusercontent.com/bazelbuild/bazel-central-registry/refs/heads/main/modules/fast_float/8.0.2/MODULE.bazel"]},
-    sha256 = "8f1dc06ac2ea1a39343c1bfbd8319134f295677ed04f0a4e63c296f5bd4d20d6",
-    strip_prefix = "fastfloat-fast_float-cb1d42a",
+    sha256 = "aa2ab8d370d1011a7a6d4ab90589b298b7e5973fe00041c06ecc7298328c25b4",
+    strip_prefix = "fastfloat-fast_float-05087a3",
     type = "tgz",
-    url = "https://github.com/fastfloat/fast_float/tarball/cb1d42aaa1e14b09e1452cfdef373d051b8c02a4",
+    url = "https://github.com/fastfloat/fast_float/tarball/05087a303dad9c98768b33c829d398223a649bc6",
 )
 
 # fp16
@@ -77,10 +77,10 @@ archive_override(
     module_name = "highway",
     remote_file_integrity = {"MODULE.bazel": "sha256-2UVSfmwaox6VsgqN+q+Ci+ofGKIJCDc+psSq2YsurfQ="},
     remote_file_urls = {"MODULE.bazel": ["https://raw.githubusercontent.com/bazelbuild/bazel-central-registry/refs/heads/main/modules/highway/1.3.0/MODULE.bazel"]},
-    sha256 = "840fa6f31239aa9f900e2aa8a62330950881501981343f70d7db868529bcd15b",
-    strip_prefix = "google-highway-84379d1",
+    sha256 = "4fa8749ccaf7d47c4a9e0ff635d0347eecf432901c92a131f64e30ff5094c2e9",
+    strip_prefix = "google-highway-2607d3b",
     type = "tgz",
-    url = "https://github.com/google/highway/tarball/84379d1c73de9681b54fbe1c035a23c7bd5d272d",
+    url = "https://github.com/google/highway/tarball/2607d3b5b0113992fe84d3848859eae13b3b52c1",
 )
 
 # nbytes
@@ -111,12 +111,12 @@ archive_override(
     patch_strip = 1,
     patches = [
         "//:patches/perfetto/0001-Don-t-attempt-to-use-rules_android.patch",
-        "//:patches/perfetto/0002-disable-info-level-logging.patch",
+        "//:patches/perfetto/0002-disable-info-level-logging-re2.patch",
     ],
-    sha256 = "90aea67f5ac88ae7bb56bc24574beb5cd924a5ae9d861826a6fd151c13b4767b",
-    strip_prefix = "google-perfetto-b34c975",
+    sha256 = "daa181f99c264de1edd2e5c67890f79dd2ea728a29ed3a0f1699dc2624b7521e",
+    strip_prefix = "google-perfetto-4c2a81c",
     type = "tgz",
-    url = "https://api.github.com/repos/google/perfetto/tarball/v54.0",
+    url = "https://api.github.com/repos/google/perfetto/tarball/v56.0",
 )
 
 # simdutf
@@ -136,10 +136,10 @@ bazel_dep(name = "tcmalloc", version = "0.0.0-20250927-12f2552")
 # workerd-cxx
 http.archive(
     name = "workerd-cxx",
-    sha256 = "31052a6fec0da501196a4f026469b837ef688c49b455fc437cdb70281f6b38cb",
-    strip_prefix = "cloudflare-workerd-cxx-a53da2e",
+    sha256 = "9646dec14f91a4be66f6232ffa0feaac9f529cc22f507db162c7752ffb4e28dc",
+    strip_prefix = "cloudflare-workerd-cxx-ece882c",
     type = "tgz",
-    url = "https://github.com/cloudflare/workerd-cxx/tarball/a53da2e9d35710dcad089574625b6c01cf9535d3",
+    url = "https://github.com/cloudflare/workerd-cxx/tarball/ece882c9b1ba99ddaddaeb97fe3da27874eff79e",
 )
 use_repo(http, "workerd-cxx")
 
@@ -148,7 +148,7 @@ bazel_dep(name = "zlib")
 git_override(
     module_name = "zlib",
     build_file = "//:build/BUILD.zlib",
-    commit = "5c1dfd53066bf58d3d28197f715717dd88762443",
+    commit = "3246f1b60849cc505e231c5d19d0cbf358093555",
     patch_strip = 1,
     patches = [
         "//:patches/zlib/0001-Add-dummy-MODULE.bazel.patch",