Dependabot Support for Bazel MODULE.bazel Ecosystem – Community Input Requested

[markhallen]

Hi Bazel maintainers and community,

We’re excited to share that we’re kicking off an epic to add Bazel as a new ecosystem in Dependabot! Our goal is to enable automated dependency management for Bazel projects, starting with support for the MODULE.bazel (bzlmod) system.

Context & Motivation

• Bazel’s evolving dependency management: Bazel now supports two major approaches: legacy WORKSPACE files and the modern MODULE.bazel system (default since Bazel 6.0).
• Why MODULE.bazel first?
  • It’s the default for new projects since December 2022.
  • It utilizes semantic versioning and central registries.
  • The ecosystem is moving toward modules as the standard.
  • Community tools (e.g., Renovate) already support bzlmod.

Our Plan

We plan to begin with support for MODULE.bazel files, including:

• Custom parsing for bazel_dep() syntax and registry metadata.
• Support for Bazel Central Registry (registry.bazel.build) and custom registries.
• Automated updates and lockfile handling.

Community Input Needed

We want to ensure we’re building the most useful solution for Bazel users. Please help us by sharing:

1. Which dependency management approach would be most valuable for your Bazel projects—MODULE.bazel or WORKSPACE?
2. What is your current usage split between MODULE.bazel and WORKSPACE files?
3. Are there any specific update patterns or edge cases Dependabot should consider?

See our tracking issue here:
👉 dependabot/dependabot-core#2196 (comment)

Next Steps

• Collect feedback from Bazel maintainers and the community.
• Assess the need for legacy WORKSPACE support based on input.
• Incorporate feedback into our implementation plan.

We look forward to hearing your thoughts and collaborating to make Bazel dependency management easier for everyone!

Thanks,
The Dependabot Team

[meteorcloudy]

This is great, thanks for taking this initiative!

1. Which dependency management approach would be most valuable for your Bazel projects—MODULE.bazel or WORKSPACE?

Definitely MODULE.bazel, in fact, we are removing WORKSPACE entirely in Bazel 9.

2. What is your current usage split between MODULE.bazel and WORKSPACE files?

From the Bazel user survey earlier this year (Feb 2025):

So hopefully the majority of users are already on Bzlmod, and we'll continue to help the community to migrate.

3. Are there any specific update patterns or edge cases Dependabot should consider?

• The BCR mostly contains bazel rules and C++ dependencies, other language specific dependencies are often integrated via module extensions, like rules_foreign_cc, bazel-gazelle, etcs. See https://bazel.build/external/overview#ecosystem-integration. Supporting those could be a follow up work.
• MODULE.bazel supports include other MODULE.bazel-like files for the root project. So it's probably worth parsing and checking those.

/cc @Wyverald @kotlaja @fmeum

[robaiken]

@meteorcloudy We're going to implement version updates for MODULE.bazel first. Thanks for sharing the stats, the ~60% Bzlmod adoption from the survey is encouraging!

I'm not sure if we're going to be able to add the ecosystem integrations for language-specific dependencies, but I'll look into it as a follow-up after basic MODULE.bazel support. Are there other MODULE.bazel features or gotchas we should prioritize for the initial implementation?

[meteorcloudy]

We have a https://bazel.build/reference/command-line-reference#common_options-flag--check_direct_dependencies feature/flag which by default prints out warnings about version mismatch between the declared version vs the one in the resolved dependency graph. Updating those is basically a no-op, maybe it's a good starting point?

[meteorcloudy]

FYI, the renovate bot also added Bzlmod support: renovatebot/renovate#13658

[fmeum]

A major potential gotcha is that updates to MODULE.bazel typically require updating the lockfile MODULE.bazel.lock by running bazel mod deps (similar to go.mod/go.sum).

[Wyverald]

cc @cgrindel who wrote the Bzlmod integration with Renovate

[robaiken]

Hi Bazel team and community,

We've launched our Bazel updater in beta!

Would anyone be available for a quick call to discuss MODULE.bazel.lock generation? We want to ensure we're handling lockfiles correctly in our implementation. Let us know if you're available!

/cc @meteorcloudy @Wyverald @kotlaja @fmeum

[meteorcloudy]

Sure, however, next week is BazelCon. Can we meet the week of Nov 17? You can reach out to us on https://slack.bazel.build