diff --git a/CHANGELOG.md b/CHANGELOG.md index b65a233f1e..c7a5a8fad5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -60,12 +60,12 @@ END_UNRELEASED_TEMPLATE * (gazelle) Types for exposed members of `python.ParserOutput` are now all public. * (gazelle) Removed the requirement for `__init__.py`, `__main__.py`, or `__test__.py` files to be present in a directory to generate a `BUILD.bazel` file. -* (toolchain) Updated the following toolchains to build 20250702 to patch CVE-2025-47273: +* (toolchain) Updated the following toolchains to build 20250708 to patch CVE-2025-47273: * 3.9.23 * 3.10.18 * 3.11.13 * 3.12.11 - * 3.14.0b3 + * 3.14.0b4 * (toolchain) Python 3.13 now references 3.13.5 * (gazelle) Switched back to smacker/go-tree-sitter, fixing [#2630](https://github.com/bazel-contrib/rules_python/issues/2630) @@ -105,7 +105,7 @@ END_UNRELEASED_TEMPLATE * 3.11.13 * 3.12.11 * 3.13.5 - * 3.14.0b3 + * 3.14.0b4 * (gazelle): New annotation `gazelle:include_pytest_conftest`. When not set (the default) or `true`, gazelle will inject any `conftest.py` file found in the same directory as a {obj}`py_test` target to that {obj}`py_test` target's `deps`. diff --git a/python/private/print_toolchain_checksums.bzl b/python/private/print_toolchain_checksums.bzl index eaaa5b9d75..bd370baf10 100644 --- a/python/private/print_toolchain_checksums.bzl +++ b/python/private/print_toolchain_checksums.bzl @@ -28,6 +28,7 @@ def print_toolchains_checksums(name): template = """\ cat > "$@" <<'EOF' #!/bin/bash +set -euo pipefail set -o errexit -o nounset -o pipefail @@ -54,28 +55,9 @@ EOF def _commands_for_version(*, python_version, metadata): lines = [] - lines += [ - "cat <