Automated Dependency Updates for Bazel Module

Categories: bazel

Renovate supports updating Bazel Module dependencies.

File Matching¶

By default, Renovate will check any files matching the following regular expression: /(^|/|\.)MODULE\.bazel$/.

For details on how to extend a manager's managerFilePatterns value, please follow this link.

Supported datasources¶

This manager supports extracting the following datasources: bazel, crate, docker, github-tags, maven.

Dependency types¶

This manager extracts the following depType values:

`depType`	Description
`bazel_dep`	A direct Bazel module dependency via `bazel_dep`
`git_override`	A Git-based override for a Bazel module dependency via `git_override`
`archive_override`	An archive-based override for a Bazel module dependency via `archive_override`
`local_path_override`	A local path override for a Bazel module dependency via `local_path_override`
`single_version_override`	A version or registry override for a Bazel module dependency via `single_version_override`
`git_repository`	A Git repository dependency via `git_repository` in a module extension
`new_git_repository`	A Git repository with a custom BUILD file via `new_git_repository` in a module extension
`oci_pull`	An OCI container image pulled via the `oci.pull` module extension tag
`maven_install`	A Maven artifact installed via the `maven` module extension
`crate_spec`	A Rust crate dependency via the `crate.spec` module extension tag
`rules_img_pull`	A container image pulled via a `rules_img` repo rule in a module extension

Default config¶

{
  "managerFilePatterns": [
    "/(^|/|\\.)MODULE\\.bazel$/"
  ]
}

Lock File Maintenance¶

This manager supports lockFileMaintenance for the following file(s):

MODULE.bazel.lock

Additional Information¶

The bazel-module manager can update Bazel module (bzlmod) enabled workspaces.

Maven¶

It also takes care about maven artifacts initalized with bzlmod. For simplicity the name of extension variable is limited to maven*. E.g.:

maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven")

maven_1 = use_extension("@rules_jvm_external//:extensions.bzl", "maven")

Both install and artifact methods are supported:

maven.install(
    artifacts = [
        "org.seleniumhq.selenium:selenium-java:4.4.0",
    ],
)

maven.artifact(
    artifact = "javapoet",
    group = "com.squareup",
    neverlink = True,
    version = "1.11.1",
)

Docker¶

Similarly, it updates Docker / OCI images pulled with oci_pull.

Note that the extension must be called oci:

oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")

oci.pull(
    name = "nginx_image",
    digest = "sha256:287ff321f9e3cde74b600cc26197424404157a72043226cbbf07ee8304a2c720",
    image = "index.docker.io/library/nginx",
    platforms = ["linux/amd64"],
    tag = "1.27.1",
)

It also supports Docker images pulled with rules_img pull:

pull = use_repo_rule("@rules_img//img:pull.bzl", "pull")
pull(
    name = "ubuntu",
    digest = "sha256:1e622c5f9ac0c0144d577702ba5f2cce79fc8e3cf89ec88291739cd4eee3b7b9",
    registry = "index.docker.io",
    repository = "library/ubuntu",
    tag = "24.04",
)

Crate¶

It also supports Rust crate dependencies initialized with rules_rust crate_universe. For simplicity the name of extension variable is limited to crate*. E.g.:

crate = use_extension("@rules_rust//crate_universe:extension.bzl", "crate")

crate_1 = use_extension("@rules_rust//crate_universe:extension.bzl", "crate")

The spec method is supported:

crate.spec(
    package = "axum",
    version = "0.8.4",
)

crate.spec(
    package = "tokio",
    version = "1.45.1",
    features = [
        "full",
    ],
)

crate.spec(
    package = "custom_crate",
    git = "https://github.com/example/custom_crate.git",
    tag = "v1.0.0",
)

Lockfile support¶

The bazel-module manager updates the MODULE.bazel.lock file when dependencies change. After updating MODULE.bazel, Renovate runs bazel mod deps to regenerate the lockfile.

Requirements:

A MODULE.bazel.lock file must already exist in the repository
Bazelisk must be available (Renovate installs it automatically when using containerbase)
Bazelisk determines the correct Bazel version from the .bazelversion file in the repository (if present)

If no MODULE.bazel.lock file is found, the lockfile update step is skipped.

It will only run if the allowedUnsafeExecutions global option includes bazelModDeps.

Open items¶

The below list of features and bugs were current when this page was generated on April 03, 2026.

Feature requests¶

Renovate Bzlmod support requires version attribute even with git_override in place #33476

Bug reports¶

Bazelmod: registryUrls should set only for datasource=bazel #34545