From be9d5d014d883df758dc04931825c160c7e496c3 Mon Sep 17 00:00:00 2001
From: Protobuf Team Bot <protobuf-github-bot@google.com>
Date: Tue, 18 Jun 2024 11:57:46 -0700
Subject: [PATCH] upgrade test images to bazel 6.4

PiperOrigin-RevId: 644466391
---
 .github/workflows/test_bazel.yml   |   4 +-
 .github/workflows/test_cpp.yml     | 102 ++++++++++++++++++++---------
 .github/workflows/test_csharp.yml  |  33 ++++++++--
 .github/workflows/test_java.yml    |  14 ++--
 .github/workflows/test_php.yml     |  40 +++++++----
 .github/workflows/test_php_ext.yml |   6 +-
 .github/workflows/test_python.yml  |  20 +++---
 .github/workflows/test_ruby.yml    |  45 +++++++++----
 .github/workflows/test_rust.yml    |   6 +-
 .github/workflows/test_upb.yml     |  51 +++++++++------
 MODULE.bazel                       |   8 +--
 examples/MODULE.bazel              |   2 +-
 protobuf_deps.bzl                  |  19 ++----
 python/BUILD.bazel                 |  34 ++--------
 python/dist/BUILD.bazel            |  17 ++---
 python/dist/dist.bzl               |   2 +-
 python/dist/setup.py               |   3 +-
 python/dist/system_python.bzl      |   2 +-
 python/py_extension.bzl            |   4 +-
 toolchain/toolchains.bazelrc       |  24 +++----
 20 files changed, 253 insertions(+), 183 deletions(-)

diff --git a/.github/workflows/test_bazel.yml b/.github/workflows/test_bazel.yml
index 0569790b9bacc..c02c462f87f23 100644
--- a/.github/workflows/test_bazel.yml
+++ b/.github/workflows/test_bazel.yml
@@ -17,7 +17,7 @@ jobs:
       fail-fast: false
       matrix:
         runner: [ ubuntu, windows, macos ]
-        bazelversion: [ '7.1.2' ]
+        bazelversion: [ '6.4.0' ]
         bzlmod: [true, false ]
         include:
           - runner: ubuntu
@@ -46,7 +46,7 @@ jobs:
         run: echo "${{ matrix.bazelversion }}" > .bazelversion
 
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/bazel@v3
+        uses: protocolbuffers/protobuf-ci/bazel@b7-test
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: examples
diff --git a/.github/workflows/test_cpp.yml b/.github/workflows/test_cpp.yml
index 35ecae8633b6b..339048c6efe0c 100644
--- a/.github/workflows/test_cpp.yml
+++ b/.github/workflows/test_cpp.yml
@@ -16,6 +16,7 @@ jobs:
     strategy:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
+        bazel-version: ['6.4.0']
         config:
           - { name: Optimized, flags: --config=opt }
           - { name: Debug, flags: --config=dbg }
@@ -26,19 +27,19 @@ jobs:
           - { name: No-RTTI, flags: --cxxopt=-fno-rtti }
         include:
           # Set defaults
-          - image: us-docker.pkg.dev/protobuf-build/containers/test/linux/sanitize@sha256:3d959f731dc5c54af4865c31ee2bd581ec40028adcdf4c038f3122581f595191
+          - image: us-docker.pkg.dev/protobuf-build/containers/test/linux/sanitize:6.4.0-27cf7b86212020d7e552bc13b1e084abb971da75
           - targets: //pkg/... //src/... @com_google_protobuf_examples//... //third_party/utf8_range/...
 
           # Override cases with custom images
           - config: { name: "Bazel7" }
-            image: "us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.1.2-cf84e92285ca133b9c8104ad7b14d70e953cbb8e"
+            image: "us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:6.4.0-cf84e92285ca133b9c8104ad7b14d70e953cbb8e"
             targets: "//src/... //third_party/utf8_range/..."
           - config: { name: "TCMalloc" }
-            image: "us-docker.pkg.dev/protobuf-build/containers/test/linux/tcmalloc@sha256:1c5133455481f4d1bb8afa477029604f41f1a3c46cebe4d9958cf1af95b5c87c"
+            image: "us-docker.pkg.dev/protobuf-build/containers/test/linux/tcmalloc:6.4.0-27cf7b86212020d7e552bc13b1e084abb971da75
             targets: "//src/... //third_party/utf8_range/..."
           - config: { name: "aarch64" }
             targets: "//src/... //src/google/protobuf/compiler:protoc_aarch64_test //third_party/utf8_range/..."
-            image: "us-docker.pkg.dev/protobuf-build/containers/test/linux/emulation:6.3.0-aarch64-68e662b3a56b881804dc4e9d45f949791cbc4b94"
+            image: "us-docker.pkg.dev/protobuf-build/containers/test/linux/emulation:6.4.0-aarch64-08714ed7a713068c8418003a2d95f423d4b1eac9"
     name: Linux ${{ matrix.config.name }}
     runs-on: ${{ matrix.config.runner || 'ubuntu-latest' }}
     steps:
@@ -58,6 +59,7 @@ jobs:
     strategy:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
+        bazel-version: ['6.4.0']
         version: ['9.5', '13.1']
     name: Linux GCC ${{ matrix.version }}
     runs-on: ubuntu-latest
@@ -69,7 +71,7 @@ jobs:
       - name: Run tests
         uses: protocolbuffers/protobuf-ci/bazel-docker@v3
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/gcc:${{ matrix.version }}-6.3.0-63dd26c0c7a808d92673a3e52e848189d4ab0f17
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/gcc:${{ matrix.bazel-version }}-${{ matrix.version }}-27cf7b86212020d7e552bc13b1e084abb971da75
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: cpp_linux/gcc-${{ matrix.version }}
           bazel: test //pkg/... //src/... @com_google_protobuf_examples//... //third_party/utf8_range/...
@@ -79,6 +81,7 @@ jobs:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
         arch: [x86_64, aarch64]
+        bazel-version: ['6.4.0']
     name: Linux Release ${{ matrix.arch}}
     runs-on: ubuntu-20-4core
     steps:
@@ -91,7 +94,7 @@ jobs:
         id: cross-compile
         uses: protocolbuffers/protobuf-ci/cross-compile-protoc@v3
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:6.3.0-91a0ac83e968068672bc6001a4d474cfd9a50f1d
+          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           architecture: linux-${{ matrix.arch }}
       - name: Setup sccache
@@ -100,9 +103,11 @@ jobs:
           cache-prefix: linux-release-${{ matrix.arch }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@b7-test
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/emulation:${{ matrix.arch }}-384d5abe83a791c6b1ce04f5d7bc0b1f84a30d38
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/emulation:${{ matrix.bazel-version }}-${{ matrix.arch }}-08714ed7a713068c8418003a2d95f423d4b1eac9
+          staleness-image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
+          bazel-version: ${{ matrix.bazel-version }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           entrypoint: bash
           command: >
@@ -119,6 +124,7 @@ jobs:
     strategy:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
+        bazel-version: ['6.4.0']
         include:
           - flags: -Dprotobuf_BUILD_EXAMPLES=ON -DCMAKE_CXX_STANDARD=14
           - name: Ninja
@@ -146,9 +152,11 @@ jobs:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
 
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@b7-test
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/cmake:3.13.3-63dd26c0c7a808d92673a3e52e848189d4ab0f17
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/cmake:3.13.3-384d5abe83a791c6b1ce04f5d7bc0b1f84a30d38
+          staleness-image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
+          bazel-version: ${{ matrix.bazel-version }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           command: >-
             /test.sh ${{ matrix.flags}} ${{ env.SCCACHE_CMAKE_FLAGS }}
@@ -156,6 +164,10 @@ jobs:
             -Dprotobuf_ABSL_PROVIDER=package
 
   linux-cmake-install:
+    strategy:
+      fail-fast: false   # Don't cancel all jobs if one fails.
+      matrix:
+        bazel-version: ['6.4.0']
     name: Linux CMake Install
     runs-on: ubuntu-latest
     steps:
@@ -172,9 +184,11 @@ jobs:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
 
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@b7-test
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/cmake:3.13.3-63dd26c0c7a808d92673a3e52e848189d4ab0f17
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/cmake:3.13.3-384d5abe83a791c6b1ce04f5d7bc0b1f84a30d38
+          staleness-image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
+          bazel-version: ${{ matrix.bazel-version }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           command: >-
             /install.sh -DCMAKE_CXX_STANDARD=14 ${{ env.SCCACHE_CMAKE_FLAGS }}
@@ -189,6 +203,10 @@ jobs:
             -Dprotobuf_USE_EXTERNAL_GTEST=ON -Dprotobuf_ABSL_PROVIDER=package
 
   linux-cmake-examples:
+    strategy:
+      fail-fast: false   # Don't cancel all jobs if one fails.
+      matrix:
+        bazel-version: ['6.4.0']
     name: Linux CMake Examples
     runs-on: ubuntu-latest
     steps:
@@ -204,9 +222,11 @@ jobs:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
 
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@b7-test
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/cmake:3.13.3-63dd26c0c7a808d92673a3e52e848189d4ab0f17
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/cmake:3.13.3-384d5abe83a791c6b1ce04f5d7bc0b1f84a30d38
+          staleness-image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
+          bazel-version: ${{ matrix.bazel-version }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           command: >-
             /install.sh -DCMAKE_CXX_STANDARD=14 ${{ env.SCCACHE_CMAKE_FLAGS }}
@@ -221,6 +241,8 @@ jobs:
     strategy:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
+        bazel-version: ['6.4.0']
+        gcc-version: ['12.2']
         include:
           - name: C++14
             flags: -DCMAKE_CXX_STANDARD=14
@@ -245,9 +267,11 @@ jobs:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
 
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@b7-test
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/gcc:12.2-6.3.0-63dd26c0c7a808d92673a3e52e848189d4ab0f17
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/gcc:${{ matrix.bazel-version }}-${{ matrix.gcc-version }}-27cf7b86212020d7e552bc13b1e084abb971da75
+          staleness-image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
+          bazel-version: ${{ matrix.bazel-version }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           entrypoint: bash
           command: >-
@@ -260,6 +284,10 @@ jobs:
               sccache -s'
 
   linux-cmake-submodules:
+    strategy:
+      fail-fast: false   # Don't cancel all jobs if one fails.
+      matrix:
+        bazel-version: ['6.4.0']
     name: Linux CMake Submodules
     runs-on: ubuntu-latest
     steps:
@@ -276,15 +304,21 @@ jobs:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
 
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@b7-test
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/cmake:3.13.3-63dd26c0c7a808d92673a3e52e848189d4ab0f17
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/cmake:3.13.3-384d5abe83a791c6b1ce04f5d7bc0b1f84a30d38
+          staleness-image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
+          bazel-version: ${{ matrix.bazel-version }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           command: >-
             /test.sh ${{ env.SCCACHE_CMAKE_FLAGS }}
             -Dprotobuf_BUILD_CONFORMANCE=ON -Dprotobuf_BUILD_EXAMPLES=ON -DCMAKE_CXX_STANDARD=14
 
   linux-cmake-32-bit:
+    strategy:
+      fail-fast: false   # Don't cancel all jobs if one fails.
+      matrix:
+        bazel-version: ['6.4.0']
     name: Linux CMake 32-bit
     runs-on: ubuntu-latest
     steps:
@@ -301,9 +335,11 @@ jobs:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
 
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@b7-test
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/32bit@sha256:8275360dc5d676f3470872d79087901c0e4153453976bea908a92c82e8d209ea
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/32bit@sha256:429f924aec315704b4233adcbe4b29006116f27769db98acd176b9eb69c31299
+          staleness-image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
+          bazel-version: ${{ matrix.bazel-version }}
           platform: linux/386
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           command: >-
@@ -322,29 +358,32 @@ jobs:
         include:
           - name: MacOS Bazel
             os: macos-12
-            cache_key: macos-12
+            cache_key: macos-12-bazel6
             bazel: test //src/... //third_party/utf8_range/...
-          - name: MacOS Bazel 7
+            bazel_version: '6.4.0'
+          - name: MacOS Bazel
             os: macos-12
             cache_key: macos-12-bazel7
             bazel: test //src/... //third_party/utf8_range/...
             bazel_version: '7.1.2'
           - name: MacOS Apple Silicon (build only) Bazel
             os: macos-12
-            cache_key: macos-12-arm
+            cache_key: macos-12-arm-bazel6
             # Current github runners are all Intel based, so just build/compile
             # for Apple Silicon to detect issues there.
             bazel: build --cpu=darwin_arm64 //src/... //third_party/utf8_range/...
+            bazel_version: '6.4.0'
           - name: Windows Bazel
             os: windows-2022
-            cache_key: windows-2022
+            cache_key: windows-2022-bazel6
             bazel: test //src/...  @com_google_protobuf_examples//... --test_tag_filters=-conformance --build_tag_filters=-conformance
-          - name: Windows Bazel 7
+            bazel_version: '6.4.0'
+          - name: Windows Bazel 
             os: windows-2022
             cache_key: windows-2022-bazel7
             bazel: test //src/...  @com_google_protobuf_examples//... --test_tag_filters=-conformance --build_tag_filters=-conformance
             bazel_version: '7.1.2'
-    name: ${{ matrix.name }}
+    name: ${{ matrix.name }} ${{ matrix.bazel_version }}
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout pending changes
@@ -352,17 +391,18 @@ jobs:
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/bazel@v3
+        uses: protocolbuffers/protobuf-ci/bazel@b7-test
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel: ${{ matrix.bazel }}
           bazel-cache: cpp_${{ matrix.cache_key }}
-          version: ${{ matrix.bazel_version || '6.3.0' }}
+          version: ${{ matrix.bazel_version }}
 
   non-linux-cmake:
     strategy:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
+        bazel-version: ['6.4.0']
         include:
           # TODO: investigate and fix
           # - name: MacOS CMake
@@ -452,9 +492,10 @@ jobs:
       # Install phase.
       - name: Configure CMake for install
         if: matrix.install-flags
-        uses: protocolbuffers/protobuf-ci/bash@v3
+        uses: protocolbuffers/protobuf-ci/bash@b7-test
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
+          bazel-version: ${{ matrix.bazel-version || '6.4.0' }}
           command: cmake . ${{ matrix.install-flags }} ${{ env.SCCACHE_CMAKE_FLAGS }} -Dprotobuf_ALLOW_CCACHE=ON
       - name: Build for install
         if: matrix.install-flags
@@ -474,9 +515,10 @@ jobs:
         run: cmake --build . --target clean && rm CMakeCache.txt
 
       - name: Configure CMake
-        uses: protocolbuffers/protobuf-ci/bash@v3
+        uses: protocolbuffers/protobuf-ci/bash@b7-test
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
+          bazel-version: ${{ matrix.bazel-version }}
           command: cmake . ${{ matrix.flags }} ${{ env.SCCACHE_CMAKE_FLAGS }} -Dprotobuf_ALLOW_CCACHE=ON 
 
       - name: Build
diff --git a/.github/workflows/test_csharp.yml b/.github/workflows/test_csharp.yml
index 8b04ff4d91658..ac3fcd122826c 100644
--- a/.github/workflows/test_csharp.yml
+++ b/.github/workflows/test_csharp.yml
@@ -13,8 +13,12 @@ permissions:
 
 jobs:
   linux:
+    strategy:
+      fail-fast: false   # Don't cancel all jobs if one fails.
+      matrix:
+        bazel-version: ['6.4.0']
     name: Linux
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22-4core
     steps:
       - name: Checkout pending changes
         uses: protocolbuffers/protobuf-ci/checkout@v3
@@ -23,11 +27,13 @@ jobs:
 
       # TODO Run this with Bazel once codegen is handled properly.
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@b7-test
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/csharp:3.1.415-6.0.100-66964dc8b07b6d1fc73a5cc14e59e84c1c534cea
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/csharp:${{ matrix.bazel-version }}-3.1.415-6.0.100-08714ed7a713068c8418003a2d95f423d4b1eac9
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           entrypoint: /bin/bash
+          bazel-version: ${{ matrix.bazel-version }}
+          staleness-image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
           command: >-
             -c "
             cd csharp &&
@@ -39,14 +45,18 @@ jobs:
         run: sudo rm -rf _build .repository-cache
 
       - name: Run conformance tests
-        uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+        uses: protocolbuffers/protobuf-ci/bazel-docker@b7-test
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/csharp:3.1.415-6.0.100-66964dc8b07b6d1fc73a5cc14e59e84c1c534cea
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/csharp:${{ matrix.bazel-version }}-3.1.415-6.0.100-08714ed7a713068c8418003a2d95f423d4b1eac9
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: csharp_linux
           bazel: test //csharp:conformance_test --action_env=DOTNET_CLI_TELEMETRY_OPTOUT=1 --test_env=DOTNET_CLI_HOME=/home/bazel
 
   windows:
+    strategy:
+      fail-fast: false   # Don't cancel all jobs if one fails.
+      matrix:
+        bazel-version: ['6.4.0']
     name: Windows
     runs-on: windows-2019
     steps:
@@ -73,11 +83,16 @@ jobs:
         uses: protocolbuffers/protobuf-ci/bash@v3
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
+          bazel-version: ${{ matrix.bazel-version }}
           command: |
             dotnet build csharp/src/Google.Protobuf.sln
             dotnet test csharp/src/Google.Protobuf.Test/Google.Protobuf.Test.csproj
 
   linux-aarch64:
+    strategy:
+      fail-fast: false   # Don't cancel all jobs if one fails.
+      matrix:
+        bazel-version: ['6.4.0']
     name: Linux aarch64
     runs-on: ubuntu-latest
     steps:
@@ -89,10 +104,12 @@ jobs:
       - name: Build protobuf C# tests under x86_64 docker image
         # Tests are built "dotnet publish" because we want all the dependencies to the copied to the destination directory
         # (we want to avoid references to ~/.nuget that won't be available in the subsequent docker run)
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@b7-test
         with:
           image: mcr.microsoft.com/dotnet/sdk:6.0.100-bullseye-slim
+          staleness-image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
+          bazel-version: ${{ matrix.bazel-version }}
           command: >-
             /bin/bash -cex '
             DOTNET_CLI_TELEMETRY_OPTOUT=true
@@ -106,11 +123,13 @@ jobs:
         #   running under current user's UID and GID. To be able to do that, we need to provide a home directory for the user
         #   otherwise the UID would be homeless under the docker container and pip install wouldn't work. For simplicity,
         #   we just run map the user's home to a throwaway temporary directory
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@b7-test
         with:
           image: mcr.microsoft.com/dotnet/sdk:6.0.100-bullseye-slim-arm64v8
+          staleness-image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
           skip-staleness-check: true
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
+          bazel-version: ${{ matrix.bazel-version }}
           command: >-
             /bin/bash -cex '
             DOTNET_CLI_TELEMETRY_OPTOUT=true
diff --git a/.github/workflows/test_java.yml b/.github/workflows/test_java.yml
index e0cb69558f029..40866ee8ec5b5 100644
--- a/.github/workflows/test_java.yml
+++ b/.github/workflows/test_java.yml
@@ -19,21 +19,21 @@ jobs:
         include:
           - name: OpenJDK 8
             version: '8'
-            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:8-1fdbb997433cb22c1e49ef75ad374a8d6bb88702
+            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:8-27cf7b86212020d7e552bc13b1e084abb971da75
             # TODO: b/318555165 - enable the layering check. Currently it does
             # not work correctly with the toolchain in this Docker image.
             targets: //java/... //java/internal:java_version //compatibility/... --features=-layering_check
           - name: OpenJDK 11
             version: '11'
-            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:11-1fdbb997433cb22c1e49ef75ad374a8d6bb88702
+            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:11-27cf7b86212020d7e552bc13b1e084abb971da75
             targets: //java/... //java/internal:java_version //compatibility/...
           - name: OpenJDK 17
             version: '17'
-            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:17-1fdbb997433cb22c1e49ef75ad374a8d6bb88702
+            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:17-27cf7b86212020d7e552bc13b1e084abb971da75
             targets: //java/... //java/internal:java_version //compatibility/...
           - name: aarch64
             version: 'aarch64'
-            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/emulation:aarch64-63dd26c0c7a808d92673a3e52e848189d4ab0f17
+            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/emulation:aarch64-08714ed7a713068c8418003a2d95f423d4b1eac9
             targets: //java/... //compatibility/... //src/google/protobuf/compiler:protoc_aarch64_test
 
     name: Linux ${{ matrix.name }}
@@ -63,7 +63,7 @@ jobs:
   #     - name: Run Linkage Monitor test
   #       uses: protocolbuffers/protobuf-ci/bazel-docker@v3
   #       with:
-  #         image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:8-1fdbb997433cb22c1e49ef75ad374a8d6bb88702
+  #         image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:8-27cf7b86212020d7e552bc13b1e084abb971da75
   #         credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
   #         bazel-cache: java_linux/8
   #         # TODO: b/318555165 - enable the layering check. Currently it does
@@ -82,7 +82,7 @@ jobs:
       id: build-protoc
       uses: protocolbuffers/protobuf-ci/cross-compile-protoc@v3
       with:
-        image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:6.3.0-91a0ac83e968068672bc6001a4d474cfd9a50f1d
+        image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:6.4.0-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
         credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
         architecture: linux-x86_64
     - name: Move protoc into place and clean up
@@ -96,7 +96,7 @@ jobs:
     - name: Generate pom.xml files from the template
       uses: protocolbuffers/protobuf-ci/bazel-docker@v3
       with:
-        image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:11-1fdbb997433cb22c1e49ef75ad374a8d6bb88702
+        image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:11-27cf7b86212020d7e552bc13b1e084abb971da75
         credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
         bazel-cache: java_linux/11
         # protobuf-java and protobuf-java-util are the member of the BOM
diff --git a/.github/workflows/test_php.yml b/.github/workflows/test_php.yml
index 86d24954b2c81..6953b30e5d953 100644
--- a/.github/workflows/test_php.yml
+++ b/.github/workflows/test_php.yml
@@ -17,6 +17,7 @@ jobs:
     strategy:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
+        bazel-version: ['6.4.0']
         include:
           - name: 8.1 Optimized
             version: "8.1.14"
@@ -41,7 +42,7 @@ jobs:
             command: composer test \&\& composer test_c
 
     name: Linux ${{ matrix.name}}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22-4core
     steps:
       - name: Checkout pending changes
         uses: protocolbuffers/protobuf-ci/checkout@v3
@@ -53,9 +54,11 @@ jobs:
           cache-prefix: php-${{ matrix.version-short }}
           directory: php
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@b7-test
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/php:${{ matrix.version }}-66964dc8b07b6d1fc73a5cc14e59e84c1c534cea
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/php:${{ matrix.bazel-version }}-${{ matrix.version }}-27cf7b86212020d7e552bc13b1e084abb971da75
+          staleness-image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
+          bazel-version: ${{ matrix.bazel-version }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           extra-flags: -e COMPOSER_HOME=/workspace/composer-cache
           command: ${{ matrix.command }}
@@ -65,6 +68,7 @@ jobs:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
         version: ['8.1']
+        bazel-version: ['6.4.0']
         suffix: [ '', '-zts']
         test: ['test', 'test_c']
         exclude:
@@ -77,9 +81,9 @@ jobs:
             test_name: ' Extension'
 
     name: Linux 32-bit ${{ matrix.version}}${{ matrix.suffix_name }}${{ matrix.test_name }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22-4core
     env:
-      image: us-docker.pkg.dev/protobuf-build/containers/test/linux/32bit@sha256:836f2cedcfe351d9a30055076630408e61994fc7d783e8333a99570968990eeb
+      image: us-docker.pkg.dev/protobuf-build/containers/test/linux/32bit@sha256:429f924aec315704b4233adcbe4b29006116f27769db98acd176b9eb69c31299
     steps:
       - name: Checkout pending changes
         uses: protocolbuffers/protobuf-ci/checkout@v3
@@ -90,7 +94,7 @@ jobs:
         id: cross-compile
         uses: protocolbuffers/protobuf-ci/cross-compile-protoc@v3
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:6.3.0-91a0ac83e968068672bc6001a4d474cfd9a50f1d
+          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           architecture: linux-i386
 
@@ -101,9 +105,11 @@ jobs:
           directory: php
 
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@b7-test
         with:
           image: ${{ env.image }}
+          bazel-version: ${{ matrix.bazel-version }}
+          staleness-image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e 
           platform: linux/386
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           extra-flags: -e COMPOSER_HOME=/workspace/composer-cache -e PROTOC=/workspace/${{ steps.cross-compile.outputs.protoc }}
@@ -115,8 +121,12 @@ jobs:
             composer ${{ matrix.test }}'
 
   linux-aarch64:
+    strategy:
+      fail-fast: false   # Don't cancel all jobs if one fails.
+      matrix:
+        bazel-version: ['6.4.0']
     name: Linux aarch64
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22-4core
     steps:
       - name: Checkout pending changes
         uses: protocolbuffers/protobuf-ci/checkout@v3
@@ -127,7 +137,7 @@ jobs:
         id: cross-compile
         uses: protocolbuffers/protobuf-ci/cross-compile-protoc@v3
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:6.3.0-91a0ac83e968068672bc6001a4d474cfd9a50f1d
+          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           architecture: linux-aarch64
 
@@ -138,10 +148,13 @@ jobs:
           directory: php
 
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@b7-test
         with:
+          # TODO: b/ - Update to aarch64 image once it is available.
           image: us-docker.pkg.dev/protobuf-build/containers/test/linux/php-aarch64@sha256:77ff9fdec867bbfb290ee0b10d8b7a3e5e434155daa5ec93de7341c7592b858d
+          staleness-image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
           platform: linux/arm64
+          bazel-version: ${{ matrix.bazel-version }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           extra-flags: -e COMPOSER_HOME=/workspace/composer-cache -e PROTOC=/workspace/${{ steps.cross-compile.outputs.protoc }}
           command: >-
@@ -156,6 +169,7 @@ jobs:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
         version: ['8.2', '8.3']
+        bazel-version: ['6.4.0']
 
     name: MacOS PHP ${{ matrix.version }}
     runs-on: macos-12
@@ -186,9 +200,10 @@ jobs:
           directory: php
 
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/bash@v3
+        uses: protocolbuffers/protobuf-ci/bash@b7-test
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
+          bazel-version: ${{ matrix.bazel-version }}
           command: |
             pushd php
             php -v
@@ -198,8 +213,9 @@ jobs:
             popd
 
       - name: Run conformance tests
-        uses: protocolbuffers/protobuf-ci/bazel@v3
+        uses: protocolbuffers/protobuf-ci/bazel@b7-test
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: php_macos/${{ matrix.version }}
+          bazel-version: ${{ matrix.bazel-version }}
           bazel: test //php:conformance_test_c --action_env=PATH --test_env=PATH
diff --git a/.github/workflows/test_php_ext.yml b/.github/workflows/test_php_ext.yml
index dfe1951b11044..a4c309d03826c 100644
--- a/.github/workflows/test_php_ext.yml
+++ b/.github/workflows/test_php_ext.yml
@@ -26,6 +26,7 @@ jobs:
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: php_ext/${{ matrix.version }}
+          version: 7.1.2
           bash: >
             ./regenerate_stale_files.sh $BAZEL_FLAGS;
             bazel build //php:release $BAZEL_FLAGS;
@@ -41,6 +42,7 @@ jobs:
     strategy:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
+        bazel-version: ['7.1.2']
         version: ["8.1", "8.2", "8.3"]
     name: Build ${{ matrix.version }}
     runs-on: ubuntu-latest
@@ -50,9 +52,11 @@ jobs:
           name: protobuf-php-release
 
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@b7-test
         with:
           image: us-docker.pkg.dev/protobuf-build/containers/test/linux/php-extension:${{ matrix.version }}-a48f26c08d9a803dd0177dda63563f6ea6f7b2d4
+          staleness-image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-bec4e87effd62da1d4f9a13d377e37bcb80376c9
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
+          bazel-version: ${{ matrix.bazel-version }}
           skip-staleness-check: true
           command: protobuf-*.tgz
diff --git a/.github/workflows/test_python.yml b/.github/workflows/test_python.yml
index b48da36aabf2b..ef05a6bfacb8d 100644
--- a/.github/workflows/test_python.yml
+++ b/.github/workflows/test_python.yml
@@ -16,9 +16,10 @@ jobs:
     strategy:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
+        bazel-version: ["6.4.0"]
         type: [ Pure, C++]
         # TODO: b/309627662 - Add coverage for Python 3.12.
-        version: ["3.8", "3.9", "3.10", "3.11"]
+        version: ["3.9", "3.10", "3.11"]
         include:
           - type: Pure
             targets: //python/... //python:python_version_test
@@ -27,11 +28,10 @@ jobs:
             targets: //python/... //python:python_version_test
             flags: --define=use_fast_cpp_protos=true
           - type: C++
-            version: aarch64
             targets: //python/... //python:aarch64_test
             # TODO Enable this once conformance tests are fixed.
-            flags: --define=use_fast_cpp_protos=true --test_tag_filters=-conformance
-            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/emulation:aarch64-63dd26c0c7a808d92673a3e52e848189d4ab0f17
+            flags: --define=use_fast_cpp_protos=true --test_tag_filters=-conformance --test_verbose_timeout_warnings
+            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/emulation:6.4.0-aarch64-08714ed7a713068c8418003a2d95f423d4b1eac9
 
     name: Linux ${{ matrix.type }} ${{ matrix.version }}
     runs-on: ubuntu-latest
@@ -41,9 +41,9 @@ jobs:
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+        uses: protocolbuffers/protobuf-ci/bazel-docker@b7-test
         with:
-          image: ${{ matrix.image || format('us-docker.pkg.dev/protobuf-build/containers/test/linux/python:{0}-63dd26c0c7a808d92673a3e52e848189d4ab0f17', matrix.version) }}
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/python:${{ matrix.bazel-version }}-${{ matrix.version }}-27cf7b86212020d7e552bc13b1e084abb971da75
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: python_linux/${{ matrix.type }}_${{ matrix.version }}
           bazel: test ${{ matrix.targets }} ${{ matrix.flags }} --test_env=KOKORO_PYTHON_VERSION
@@ -57,6 +57,7 @@ jobs:
         type: [ Pure, C++]
         # TODO Consider expanding this set of versions.
         version: [ "3.12" ]
+        bazel-version: ["6.4.0"]
         include:
           - type: Pure
             targets: //python/... //python:python_version_test
@@ -88,14 +89,15 @@ jobs:
           source venv/bin/activate
 
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/bazel@v3
+        uses: protocolbuffers/protobuf-ci/bazel@b7-test
         env:
           KOKORO_PYTHON_VERSION: ${{ matrix.version }}
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: python_macos/${{ matrix.type }}_${{ matrix.version }}
+          version: ${{ matrix.bazel-version }}
           bazel: >-
-            test ${{ matrix.targets }} ${{ matrix.flags }}
+            test --test_output=errors ${{ matrix.targets }} ${{ matrix.flags }}
             --test_env=KOKORO_PYTHON_VERSION=${{ matrix.version }}
-            --macos_minimum_os=10.9
+            --macos_minimum_os=10.9 -s --sandbox_debug
           exclude-targets: -//python/pb_unit_tests/...
diff --git a/.github/workflows/test_ruby.yml b/.github/workflows/test_ruby.yml
index 8d754189ce916..05c011f0ab7f9 100644
--- a/.github/workflows/test_ruby.yml
+++ b/.github/workflows/test_ruby.yml
@@ -16,6 +16,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        bazel-version: ['6.4.0']
         include:
           # Test both FFI and Native implementations on the highest and lowest
           # Ruby versions for CRuby and JRuby, but only on Bazel 5.x.
@@ -36,9 +37,9 @@ jobs:
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+        uses: protocolbuffers/protobuf-ci/bazel-docker@b7-test
         with:
-          image: ${{ matrix.image || format('us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:{0}-6.3.0-9848710ff1370795ee7517570a20b81e140112ec', matrix.ruby) }}
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:${{ matrix.bazel-version }}-${{ matrix.ruby }}-27cf7b86212020d7e552bc13b1e084abb971da75
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: ruby_linux/${{ matrix.ruby }}_${{ matrix.bazel }}
           bazel: test //ruby/... //ruby/tests:ruby_version --test_env=KOKORO_RUBY_VERSION --test_env=BAZEL=true ${{ matrix.ffi == 'FFI' && '--//ruby:ffi=enabled --test_env=PROTOCOL_BUFFERS_RUBY_IMPLEMENTATION=FFI' || '' }}
@@ -51,8 +52,12 @@ jobs:
 #          path: logs
 
   linux-32bit:
+    strategy:
+      fail-fast: false   # Don't cancel all jobs if one fails.
+      matrix:
+        bazel-version: ['6.4.0']
     name: Linux 32-bit
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20-4core
     steps:
       - name: Checkout pending changes
         uses: protocolbuffers/protobuf-ci/checkout@v3
@@ -63,7 +68,8 @@ jobs:
         id: cross-compile
         uses: protocolbuffers/protobuf-ci/cross-compile-protoc@v3
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:6.3.0-91a0ac83e968068672bc6001a4d474cfd9a50f1d
+          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
+          staleness-image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           architecture: linux-i386
 
@@ -71,10 +77,12 @@ jobs:
         uses: protocolbuffers/protobuf-ci/docker@v3
         with:
           image: i386/ruby:3.0.2-buster
+          staleness-image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
+          bazel-version: ${{ matrix.bazel-version }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           command: >-
             /bin/bash -cex '
-            gem install bundler -v 2.5.6;
+            gem install bundler -v 2.5.13;
             cd /workspace/ruby;
             bundle;
             PROTOC=/workspace/${{ steps.cross-compile.outputs.protoc }} rake;
@@ -82,8 +90,12 @@ jobs:
             PROTOC=/workspace/${{ steps.cross-compile.outputs.protoc }} rake test'
 
   linux-aarch64:
+    strategy:
+      fail-fast: false   # Don't cancel all jobs if one fails.
+      matrix:
+        bazel-version: ['6.4.0']
     name: Linux aarch64
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20-4core
     steps:
       - name: Checkout pending changes
         uses: protocolbuffers/protobuf-ci/checkout@v3
@@ -94,18 +106,20 @@ jobs:
         id: cross-compile
         uses: protocolbuffers/protobuf-ci/cross-compile-protoc@v3
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:6.3.0-91a0ac83e968068672bc6001a4d474cfd9a50f1d
+          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           architecture: linux-aarch64
 
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@b7-test
         with:
           image: arm64v8/ruby:3.0.2-buster
+          staleness-image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
+          bazel-version: ${{ matrix.bazel-version }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           command: >-
             /bin/bash -cex '
-            gem install bundler -v 2.5.6;
+            gem install bundler -v 2.5.13;
             cd /workspace/ruby;
             bundle;
             PROTOC=/workspace/${{ steps.cross-compile.outputs.protoc }} rake;
@@ -116,6 +130,7 @@ jobs:
     strategy:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
+        bazel-version: ['6.4.0']
         include:
         # Test both FFI and Native implementations on the highest and lowest
         # Ruby versions for CRuby, but only on Bazel 5.x.
@@ -144,20 +159,22 @@ jobs:
         run: ruby --version | grep ${{ matrix.version }} || (echo "Invalid Ruby version - $(ruby --version)" && exit 1)
 
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/bazel@v3
+        uses: protocolbuffers/protobuf-ci/bazel@b7-test
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: ruby_macos/${{ matrix.version }}
+          version: ${{ matrix.bazel-version }}
           bazel: test //ruby/... --test_env=KOKORO_RUBY_VERSION=${{ matrix.version }} --test_env=BAZEL=true ${{ matrix.ffi == 'FFI' && '--//ruby:ffi=enabled --test_env=PROTOCOL_BUFFERS_RUBY_IMPLEMENTATION=FFI' || '' }}
 
   test_ruby_gems:
     strategy:
       fail-fast: false
       matrix:
+        bazel-version: ['6.4.0']
         include:
           # Test both FFI and Native implementations on the highest and lowest
           # Ruby versions for CRuby and JRuby, but only on Bazel 5.x.
-          - { name: Ruby 3.0, ruby: ruby-3.0.2, ffi: NATIVE}
+          - { name: Ruby 3.0, ruby: ruby-3.0.2, ffi: NATIVE }
           - { name: Ruby 3.0, ruby: ruby-3.0.2, ffi: FFI}
           - { name: Ruby 3.1, ruby: ruby-3.1.0}
           - { name: Ruby 3.2, ruby: ruby-3.2.0}
@@ -173,11 +190,11 @@ jobs:
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+        uses: protocolbuffers/protobuf-ci/bazel-docker@b7-test
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:${{ matrix.ruby }}-6.3.0-9848710ff1370795ee7517570a20b81e140112ec
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:${{ matrix.bazel-version }}-${{ matrix.ruby }}-2d59f978645853c5156710320db037095b6a39e5
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
-          bazel-cache: ruby_install/${{ matrix.ruby }}_${{ matrix.bazel }}
+          bazel-cache: ruby_install/${{ matrix.ruby }}_${{ matrix.bazel-version }}
           bash: >
             bazel --version;
             ruby --version;
diff --git a/.github/workflows/test_rust.yml b/.github/workflows/test_rust.yml
index 00c2e4b7bb45f..e2615d3b02b0e 100644
--- a/.github/workflows/test_rust.yml
+++ b/.github/workflows/test_rust.yml
@@ -13,6 +13,10 @@ permissions:
 
 jobs:
   linux:
+    strategy:
+      fail-fast: false   # Don't cancel all jobs if one fails.
+      matrix:
+        bazel-version: ['6.4.0']
     name: Linux
     runs-on: ubuntu-latest
     steps:
@@ -23,7 +27,7 @@ jobs:
       - name: Run tests
         uses: protocolbuffers/protobuf-ci/bazel-docker@v3
         with:
-          image: "us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.1.1-97f82260fd504923d8af642d567afb2d83a1959d"
+          image: "us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e"
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: rust_linux
           bazel: >-
diff --git a/.github/workflows/test_upb.yml b/.github/workflows/test_upb.yml
index 945b7c01b4f4c..c5c22d09d40ad 100644
--- a/.github/workflows/test_upb.yml
+++ b/.github/workflows/test_upb.yml
@@ -17,7 +17,7 @@ jobs:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
         config:
-          - { name: "Bazel 7", bazel_version: "7.1.1" }
+          - { name: "Bazel 7", bazel_version: "7.1.2" }
           - { name: "Fastbuild" }
           - { name: "Optimized", flags: "-c opt" }
           - { name: "ASAN", flags: "--config=asan -c dbg", exclude-targets: "-//benchmarks:benchmark -//python/...", runner: ubuntu-22-4core }
@@ -35,9 +35,9 @@ jobs:
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+        uses: protocolbuffers/protobuf-ci/bazel-docker@b7-test
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/sanitize:${{ matrix.config.bazel_version || '6.3.0' }}-75f2a85ece6526cc3d54087018c0f1097d78d42b
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/sanitize:${{ matrix.config.bazel_version || '6.4.0' }}-27cf7b86212020d7e552bc13b1e084abb971da75
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: upb-bazel
           bazel: test --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 //bazel/... //benchmarks/... //lua/... //python/... //upb/... //upb_generator/... ${{ matrix.config.flags }}
@@ -46,6 +46,9 @@ jobs:
   linux-gcc:
     strategy:
       fail-fast: false   # Don't cancel all jobs if one fails.
+      matrix:
+        bazel-version: ["6.4.0"]
+        gcc-version: ["12.2"]
     name: GCC Optimized
     runs-on: ubuntu-latest
     steps:
@@ -54,9 +57,9 @@ jobs:
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+        uses: protocolbuffers/protobuf-ci/bazel-docker@b7-test
         with:
-          image: "us-docker.pkg.dev/protobuf-build/containers/test/linux/gcc:12.2-6.3.0-63dd26c0c7a808d92673a3e52e848189d4ab0f17"
+          image: "us-docker.pkg.dev/protobuf-build/containers/test/linux/gcc:${{ matrix.bazel-version }}-${{ matrix.gcc-version }}-27cf7b86212020d7e552bc13b1e084abb971da75"
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: "upb-bazel-gcc"
           bazel: test --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 -c opt //bazel/... //benchmarks/... //lua/... //python/... //upb/... //upb_generator/...
@@ -64,6 +67,8 @@ jobs:
   windows:
     strategy:
       fail-fast: false   # Don't cancel all jobs if one fails.
+      matrix:
+        bazel-version: ["6.4.0"]
     name: Windows
     runs-on: windows-2022
     steps:
@@ -81,7 +86,7 @@ jobs:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: "upb-bazel-windows"
           bazel: test --cxxopt=/std:c++17 --host_cxxopt=/std:c++17 //upb/... //upb_generator/... //python/...
-          version: 6.3.0
+          version: ${{ matrix.bazel-version }}
           exclude-targets: -//python:conformance_test -//upb/reflection:def_builder_test
 
   macos:
@@ -103,16 +108,18 @@ jobs:
           cache: pip
           cache-dependency-path: 'python/requirements.txt'
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/bazel@v3
+        uses: protocolbuffers/protobuf-ci/bazel@b7-test
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: "upb-bazel-macos"
-          bazel: ${{ matrix.config.bazel-command }} --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 ${{ matrix.config.flags }} //bazel/... //benchmarks/... //lua/... //python/... //upb/... //upb_generator/...
-          version: 6.3.0
+          bazel: ${{ matrix.config.bazel-command }} --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 ${{ matrix.config.flags }} //bazel/... //benchmarks/... //lua/... //hpb_generator/... //python/... //upb/... //upb_generator/...
+          version: 6.4.0
 
   no-python:
     strategy:
       fail-fast: false   # Don't cancel all jobs if one fails.
+      matrix:
+        bazel-version: ["6.4.0"]
     name: No System Python
     runs-on: ubuntu-latest
     steps:
@@ -121,9 +128,9 @@ jobs:
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+        uses: protocolbuffers/protobuf-ci/bazel-docker@b7-test
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:6.3.0-91a0ac83e968068672bc6001a4d474cfd9a50f1d
+          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:${{ matrix.bazel-version }}-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: "upb-bazel-no-python"
           bash: >-
@@ -133,6 +140,10 @@ jobs:
             bazel test $BAZEL_FLAGS --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 //python/... -- -//python/dist:source_wheel
 
   build_wheels:
+    strategy:
+      fail-fast: false   # Don't cancel all jobs if one fails.
+      matrix:
+        bazel-version: ["6.4.0"]
     name: Build Wheels
     runs-on: ubuntu-latest
     if: ${{ github.event_name != 'pull_request_target' }}
@@ -142,12 +153,12 @@ jobs:
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Build Wheels
-        uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+        uses: protocolbuffers/protobuf-ci/bazel-docker@b7-test
         with:
-          image: us-docker.pkg.dev/protobuf-build/release-containers/linux/apple:6.3.0-53225851b051e66f8543e972c143f35be757a181
+          image: us-docker.pkg.dev/protobuf-build/release-containers/linux/apple:${{ matrix.bazel-version }}-5be0f4fde927ca702ed4cebe096bfb632d6d9a36
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: upb-bazel-python
-          bazel: build --crosstool_top=//toolchain:clang_suite --//toolchain:release=true --symlink_prefix=/ -c dbg //python/dist //python/dist:test_wheel //python/dist:source_wheel
+          bazel: build --crosstool_top=//toolchain:clang_suite --//toolchain:release=true --symlink_prefix=/ --incompatible_enable_cc_toolchain_resolution=false -c dbg //python/dist //python/dist:test_wheel //python/dist:source_wheel
       - name: Move Wheels
         run: mkdir wheels && find _build/out \( -name 'protobuf*.whl' -o -name 'protobuf-*.tar.gz' \) -exec mv '{}' wheels ';'
       - uses: actions/upload-artifact@v3
@@ -171,22 +182,20 @@ jobs:
           # a single wheel. As a result we can just test the oldest and newest
           # supported Python versions and assume this gives us sufficient test
           # coverage.
-          - { os: ubuntu-latest, python-version: "3.8", architecture: x64, type: 'binary' }
-          - { os: macos-12, python-version: "3.8", architecture: x64, type: 'binary' }
+          - { os: ubuntu-latest, python-version: "3.9", architecture: x64, type: 'binary' }
+          - { os: macos-12, python-version: "3.9", architecture: x64, type: 'binary' }
           - { os: ubuntu-latest, python-version: "3.12", architecture: x64, type: 'binary' }
           - { os: macos-13, python-version: "3.12", architecture: x64, type: 'binary' }
-          - { os: ubuntu-latest, python-version: "3.8", architecture: x64, type: 'source' }
-          - { os: macos-12, python-version: "3.8", architecture: x64, type: 'source' }
+          - { os: ubuntu-latest, python-version: "3.9", architecture: x64, type: 'source' }
+          - { os: macos-12, python-version: "3.9", architecture: x64, type: 'source' }
           - { os: ubuntu-latest, python-version: "3.12", architecture: x64, type: 'source' }
           - { os: macos-13, python-version: "3.12", architecture: x64, type: 'source' }
 
           # Windows uses the full API up until Python 3.10.
-          - { os: windows-2019, python-version: "3.8", architecture: x86, type: 'binary' }
           - { os: windows-2019, python-version: "3.9", architecture: x86, type: 'binary' }
           - { os: windows-2019, python-version: "3.10", architecture: x86, type: 'binary' }
           - { os: windows-2019, python-version: "3.11", architecture: x86, type: 'binary' }
           - { os: windows-2019, python-version: "3.12", architecture: x86, type: 'binary' }
-          - { os: windows-2019, python-version: "3.8", architecture: x64, type: 'binary' }
           - { os: windows-2019, python-version: "3.9", architecture: x64, type: 'binary' }
           - { os: windows-2019, python-version: "3.10", architecture: x64, type: 'binary' }
           - { os: windows-2019, python-version: "3.11", architecture: x64, type: 'binary' }
@@ -251,7 +260,7 @@ jobs:
     strategy:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
-        python-version: ["3.8", "3.12"]
+        python-version: ["3.9", "3.12"]
     runs-on: ubuntu-latest
     if: ${{ github.event_name != 'pull_request_target' }}
     steps:
diff --git a/MODULE.bazel b/MODULE.bazel
index 343bd0ad9af09..8fe15043753ab 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -12,13 +12,13 @@ module(
 # Bzlmod follows MVS:
 # https://bazel.build/versions/6.0.0/build/bzlmod#version-resolution
 # Thus the highest version in their module graph is resolved.
-bazel_dep(name = "abseil-cpp", version = "20230802.0.bcr.1", repo_name = "com_google_absl")
+bazel_dep(name = "abseil-cpp", version = "20230802.2", repo_name = "com_google_absl")
 bazel_dep(name = "bazel_skylib", version = "1.4.1")
 bazel_dep(name = "jsoncpp", version = "1.9.5")
-bazel_dep(name = "rules_cc", version = "0.0.9")
+bazel_dep(name = "rules_cc", version = "0.0.10-rc1")
 bazel_dep(name = "rules_fuzzing", version = "0.5.2")
-bazel_dep(name = "rules_java", version = "5.3.5")
-bazel_dep(name = "rules_jvm_external", version = "5.1")
+bazel_dep(name = "rules_java", version = "5.5.1")
+bazel_dep(name = "rules_jvm_external", version = "5.3")
 bazel_dep(name = "rules_pkg", version = "0.7.0")
 bazel_dep(name = "rules_python", version = "0.28.0")
 bazel_dep(name = "rules_rust", version = "0.45.1")
diff --git a/examples/MODULE.bazel b/examples/MODULE.bazel
index 617f6601bcf07..60bad2b16cdba 100644
--- a/examples/MODULE.bazel
+++ b/examples/MODULE.bazel
@@ -7,7 +7,7 @@ local_path_override(
 )
 
 bazel_dep(name = "bazel_skylib", version = "1.0.3")
-bazel_dep(name = "rules_cc", version = "0.0.1")
+bazel_dep(name = "rules_cc", version = "0.0.10-rc1")
 bazel_dep(name = "rules_java", version = "7.3.0")
 bazel_dep(name = "rules_pkg", version = "0.7.0")
 bazel_dep(name = "rules_python", version = "0.25.0")
diff --git a/protobuf_deps.bzl b/protobuf_deps.bzl
index 92ce54fb771ec..25fd842a5295d 100644
--- a/protobuf_deps.bzl
+++ b/protobuf_deps.bzl
@@ -90,11 +90,10 @@ def protobuf_deps():
         )
 
     if not native.existing_rule("rules_cc"):
-        _github_archive(
+        http_archive(
             name = "rules_cc",
-            repo = "https://github.com/bazelbuild/rules_cc",
-            commit = "c8c38f8c710cbbf834283e4777916b68261b359c",  # 0.0.9
-            sha256 = "5f862a44bbd032e1b48ed53c9c211ba2a1da60e10c5baa01c97369c249299ecb",
+            urls = ["https://github.com/bazelbuild/rules_cc/releases/download/0.0.10-rc1/rules_cc-0.0.10-rc1.tar.gz"],
+            sha256 = "d75a040c32954da0d308d3f2ea2ba735490f49b3a7aa3e4b40259ca4b814f825",
         )
 
     if not native.existing_rule("rules_java"):
@@ -173,16 +172,8 @@ def protobuf_deps():
 
     # Python Downloads
     python_source_archive(
-        name = "python-3.8.0",
-        sha256 = "f1069ad3cae8e7ec467aa98a6565a62a48ef196cb8f1455a245a08db5e1792df",
-    )
-    python_nuget_package(
-        name = "nuget_python_i686_3.8.0",
-        sha256 = "87a6481f5eef30b42ac12c93f06f73bd0b8692f26313b76a6615d1641c4e7bca",
-    )
-    python_nuget_package(
-        name = "nuget_python_x86-64_3.8.0",
-        sha256 = "96c61321ce90dd053c8a04f305a5f6cc6d91350b862db34440e4a4f069b708a0",
+        name = "python-3.9.0",
+        sha256 = "df796b2dc8ef085edae2597a41c1c0a63625ebd92487adaef2fed22b567873e8",
     )
     python_nuget_package(
         name = "nuget_python_i686_3.9.0",
diff --git a/python/BUILD.bazel b/python/BUILD.bazel
index 3e34bbdbc48b8..69f3ef46cd343 100644
--- a/python/BUILD.bazel
+++ b/python/BUILD.bazel
@@ -27,7 +27,7 @@ package(
 )
 
 LIMITED_API_FLAG_SELECT = {
-    ":limited_api_3.8": ["-DPy_LIMITED_API=0x03080000"],
+    ":limited_api_3.9": ["-DPy_LIMITED_API=0x03090000"],
     ":limited_api_3.10": ["-DPy_LIMITED_API=0x030a0000"],
     "//conditions:default": [],
 }
@@ -42,7 +42,6 @@ string_flag(
     build_setting_default = "system",
     values = [
         "system",
-        "38",
         "39",
         "310",
         "311",
@@ -50,37 +49,11 @@ string_flag(
 )
 
 config_setting(
-    name = "limited_api_3.8",
+    name = "limited_api_3.9",
     flag_values = {
         ":limited_api": "True",
-        ":python_version": "38",
-    },
-)
-
-config_setting(
-    name = "full_api_3.8_win32",
-    flag_values = {
-        ":limited_api": "False",
-        ":python_version": "38",
-    },
-    values = {"cpu": "win32"},
-)
-
-config_setting(
-    name = "full_api_3.8_win64",
-    flag_values = {
-        ":limited_api": "False",
-        ":python_version": "38",
+        ":python_version": "39",
     },
-    values = {"cpu": "win64"},
-)
-
-selects.config_setting_group(
-    name = "full_api_3.8",
-    match_any = [
-        ":full_api_3.8_win32",
-        ":full_api_3.8_win64",
-    ],
 )
 
 config_setting(
@@ -184,6 +157,7 @@ filegroup(
 py_extension(
     name = "_message",
     srcs = [":message_srcs"],
+    # end:google_only
     copts = UPB_DEFAULT_COPTS + select(LIMITED_API_FLAG_SELECT) + [
         # The Python API requires patterns that are ISO C incompatible, like
         # casts between function pointers and object pointers.
diff --git a/python/dist/BUILD.bazel b/python/dist/BUILD.bazel
index 265d9b8851a70..1028ad2324cf2 100644
--- a/python/dist/BUILD.bazel
+++ b/python/dist/BUILD.bazel
@@ -300,7 +300,6 @@ genrule(
 py_wheel(
     name = "binary_wheel",
     abi = select({
-        "//python:full_api_3.8": "cp38",
         "//python:full_api_3.9": "cp39",
         "//conditions:default": "abi3",
     }),
@@ -309,7 +308,6 @@ py_wheel(
     classifiers = [
         "Programming Language :: Python",
         "Programming Language :: Python :: 3",
-        "Programming Language :: Python :: 3.8",
         "Programming Language :: Python :: 3.9",
         "Programming Language :: Python :: 3.10",
         "Programming Language :: Python :: 3.11",
@@ -332,11 +330,10 @@ py_wheel(
         ":windows_x86_64": "win_amd64",
         "//conditions:default": "any",
     }),
-    python_requires = ">=3.8",
+    python_requires = ">=3.9",
     # LINT.IfChange(python_tag)
     python_tag = selects.with_or({
-        ("//python:limited_api_3.8", "//python:full_api_3.8"): "cp38",
-        "//python:full_api_3.9": "cp39",
+        ("//python:limited_api_3.9", "//python:full_api_3.9"): "cp39",
         "//python:limited_api_3.10": "cp310",
         "//conditions:default": "cp" + SYSTEM_PYTHON_VERSION,
     }),
@@ -370,7 +367,6 @@ py_wheel(
     classifiers = [
         "Programming Language :: Python",
         "Programming Language :: Python :: 3",
-        "Programming Language :: Python :: 3.8",
         "Programming Language :: Python :: 3.9",
         "Programming Language :: Python :: 3.10",
         "Programming Language :: Python :: 3.11",
@@ -383,7 +379,7 @@ py_wheel(
     homepage = "https://developers.google.com/protocol-buffers/",
     license = "3-Clause BSD License",
     platform = "any",
-    python_requires = ">=3.8",
+    python_requires = ">=3.9",
     python_tag = "py3",
     strip_path_prefixes = [
         "python/",
@@ -439,7 +435,6 @@ py_dist(
     # Windows needs version-specific wheels until 3.10.
     # LINT.IfChange(full_api_version)
     full_api_versions = [
-        "38",
         "39",
     ],
     # LINT.ThenChange(:python_tag)
@@ -453,9 +448,9 @@ py_dist(
     limited_api_wheels = {
         "win32": "310",
         "win64": "310",
-        "linux-x86_64": "38",
-        "linux-aarch_64": "38",
-        "osx-universal2": "38",
+        "linux-x86_64": "39",
+        "linux-aarch_64": "39",
+        "osx-universal2": "39",
     },
     # LINT.ThenChange(:python_tag)
     pure_python_wheel = ":pure_python_wheel",
diff --git a/python/dist/dist.bzl b/python/dist/dist.bzl
index 061125ede6376..c059547744f23 100644
--- a/python/dist/dist.bzl
+++ b/python/dist/dist.bzl
@@ -18,7 +18,7 @@ def _get_suffix(limited_api, python_version, cpu):
 
     if python_version == "system":
         python_version = SYSTEM_PYTHON_VERSION
-        if int(python_version) < 38:
+        if int(python_version) < 39:
             python_version += "m"
         abis = {
             "darwin_arm64": "darwin",
diff --git a/python/dist/setup.py b/python/dist/setup.py
index 534e3fb5cd097..669cb305dc689 100755
--- a/python/dist/setup.py
+++ b/python/dist/setup.py
@@ -54,7 +54,6 @@ def GetVersion():
     classifiers=[
         'Programming Language :: Python',
         'Programming Language :: Python :: 3',
-        'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
         'Programming Language :: Python :: 3.10',
         'Programming Language :: Python :: 3.11',
@@ -75,5 +74,5 @@ def GetVersion():
             extra_link_args=extra_link_args,
         )
     ],
-    python_requires='>=3.8',
+    python_requires='>=3.9',
 )
diff --git a/python/dist/system_python.bzl b/python/dist/system_python.bzl
index db5b30e0b61b0..76ee09250b99a 100644
--- a/python/dist/system_python.bzl
+++ b/python/dist/system_python.bzl
@@ -266,6 +266,6 @@ system_python = repository_rule(
     implementation = _system_python_impl,
     local = True,
     attrs = {
-        "minimum_python_version": attr.string(default = "3.7"),
+        "minimum_python_version": attr.string(default = "3.9"),
     },
 )
diff --git a/python/py_extension.bzl b/python/py_extension.bzl
index 9a2828b950d30..6833e6e9bc0c4 100644
--- a/python/py_extension.bzl
+++ b/python/py_extension.bzl
@@ -27,9 +27,7 @@ def py_extension(name, srcs, copts, deps = [], **kwargs):
         linkshared = True,
         linkstatic = True,
         deps = deps + select({
-            "//python:limited_api_3.8": ["@python-3.8.0//:python_headers"],
-            "//python:full_api_3.8_win32": ["@nuget_python_i686_3.8.0//:python_full_api"],
-            "//python:full_api_3.8_win64": ["@nuget_python_x86-64_3.8.0//:python_full_api"],
+            "//python:limited_api_3.9": ["@python-3.9.0//:python_headers"],
             "//python:full_api_3.9_win32": ["@nuget_python_i686_3.9.0//:python_full_api"],
             "//python:full_api_3.9_win64": ["@nuget_python_x86-64_3.9.0//:python_full_api"],
             "//python:limited_api_3.10_win32": ["@nuget_python_i686_3.10.0//:python_limited_api"],
diff --git a/toolchain/toolchains.bazelrc b/toolchain/toolchains.bazelrc
index 30784b9bea9df..5caca3ddbf082 100644
--- a/toolchain/toolchains.bazelrc
+++ b/toolchain/toolchains.bazelrc
@@ -2,15 +2,15 @@ build:cross_config --crosstool_top=//toolchain:clang_suite
 build:cross_config --//toolchain:release=true
 build:cross_config --host_crosstool_top=@bazel_tools//tools/cpp:toolchain
 
-build:linux-aarch_64 --config=cross_config --cpu=linux-aarch_64
-build:linux-aarch64 --config=cross_config --cpu=linux-aarch_64
-build:linux-ppcle_64 --config=cross_config --cpu=linux-ppcle_64
-build:linux-ppc64le --config=cross_config --cpu=linux-ppcle_64
-build:linux-s390_64 --config=cross_config --cpu=linux-s390_64
-build:linux-x86_32 --config=cross_config --cpu=linux-x86_32
-build:linux-i386 --config=cross_config --cpu=linux-x86_32
-build:linux-x86_64 --config=cross_config --cpu=linux-x86_64
-build:osx-aarch_64 --config=cross_config --action_env=MACOSX_DEPLOYMENT_TARGET=10.9 --cpu=osx-aarch_64
-build:osx-x86_64 --config=cross_config --action_env=MACOSX_DEPLOYMENT_TARGET=10.9 --cpu=osx-x86_64
-build:win32 --config=cross_config --cpu=win32
-build:win64 --config=cross_config --cpu=win64
+build:linux-aarch_64 --config=cross_config --cpu=linux-aarch_64 --incompatible_enable_cc_toolchain_resolution=false
+build:linux-aarch64 --config=cross_config --cpu=linux-aarch_64 --incompatible_enable_cc_toolchain_resolution=false
+build:linux-ppcle_64 --config=cross_config --cpu=linux-ppcle_64 --incompatible_enable_cc_toolchain_resolution=false
+build:linux-ppc64le --config=cross_config --cpu=linux-ppcle_64 --incompatible_enable_cc_toolchain_resolution=false
+build:linux-s390_64 --config=cross_config --cpu=linux-s390_64 --incompatible_enable_cc_toolchain_resolution=false
+build:linux-x86_32 --config=cross_config --cpu=linux-x86_32 --incompatible_enable_cc_toolchain_resolution=false
+build:linux-i386 --config=cross_config --cpu=linux-x86_32 --incompatible_enable_cc_toolchain_resolution=false
+build:linux-x86_64 --config=cross_config --cpu=linux-x86_64 --incompatible_enable_cc_toolchain_resolution=false
+build:osx-aarch_64 --config=cross_config --action_env=MACOSX_DEPLOYMENT_TARGET=10.9 --cpu=osx-aarch_64 --incompatible_enable_cc_toolchain_resolution=false
+build:osx-x86_64 --config=cross_config --action_env=MACOSX_DEPLOYMENT_TARGET=10.9 --cpu=osx-x86_64 --incompatible_enable_cc_toolchain_resolution=false
+build:win32 --config=cross_config --cpu=win32 --incompatible_enable_cc_toolchain_resolution=false
+build:win64 --config=cross_config --cpu=win64 --incompatible_enable_cc_toolchain_resolution=false