Add Bazel9 test

#test-continuous

PiperOrigin-RevId: 908263056
diff --git a/.bazeliskrc b/.bazeliskrc
index 26244ad..1ab2228 100644
--- a/.bazeliskrc
+++ b/.bazeliskrc
@@ -1 +1 @@
-USE_BAZEL_VERSION=8.0.1
+USE_BAZEL_VERSION=8.6.0
diff --git a/.bazelrc b/.bazelrc
index ff1d99b..61d3bb1 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -3,6 +3,11 @@
 # TODO: ErrorProne's SelfAssertions are violated in protobuf's test
 build --javacopt=-Xep:SelfAssertion:WARN
 
+# Disable prebuilt protoc on CI. On both main and release branches,
+# PROTOBUF_VERSION ordinarily points to the next release, which doesn't
+# exist and therefore doesn't have a prebuilt yet.
+#build --@com_google_protobuf//bazel/toolchains:prefer_prebuilt_protoc=false
+
 # This flag works around some issues with Rust linking.
 build --@rules_rust//rust/settings:experimental_use_cc_common_link=True
 
@@ -39,5 +44,10 @@
 
 common --incompatible_check_testonly_for_output_files
 
+# Import Bazel 9 specific flags (such as --repo_contents_cache)
+# TODO: Remove it when --repo_contents_cache issue
+# has been resolved in bazel
+try-import-if-bazel-version >=9.0.0 %workspace%/ci/bazel9.bazelrc
+
 # Use clang-cl by default on Windows (see https://github.com/protocolbuffers/protobuf/issues/20085).
 build:windows --extra_toolchains=@local_config_cc//:cc-toolchain-x64_windows-clang-cl --extra_execution_platforms=//build_defs:x64_windows-clang-cl --host_platform=//build_defs:x64_windows-clang-cl
diff --git a/.github/workflows/test_bazel.yml b/.github/workflows/test_bazel.yml
index 9c28187..d2f0481 100644
--- a/.github/workflows/test_bazel.yml
+++ b/.github/workflows/test_bazel.yml
@@ -27,7 +27,7 @@
       fail-fast: false
       matrix:
         runner: [ ubuntu, windows, macos ]
-        bazelversion: [ '8.0.0' ]
+        bazelversion: [ '8.6.0', '9.0.0' ]
         bzlmod: [ true, false ]
         toolchain_resolution:
           # Default flags, uses from prebuilt protoc
@@ -36,6 +36,9 @@
           - "--incompatible_enable_proto_toolchain_resolution=false"
           # Uses protoc from source.
           - "--@com_google_protobuf//bazel/flags:prefer_prebuilt_protoc=false"
+        exclude:
+          - bazelversion: '9.0.0'
+            bzlmod: false
     runs-on: ${{ matrix.runner }}-latest
     name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} Examples ${{ matrix.runner }} ${{ matrix.bazelversion }}${{ matrix.bzlmod && ' (bzlmod)' || '' }} ${{ matrix.toolchain_resolution && ' (toolchain resolution)' || '' }}
     steps:
@@ -84,7 +87,7 @@
       fail-fast: false
       matrix:
         runner: [ ubuntu, windows, macos ]
-        bazelversion: [ '8.0.0' ]
+        bazelversion: [ '8.6.0', '9.0.0' ]
         bzlmod: [ true ]
         toolchain_resolution:
           # Default flags, uses from prebuilt protoc
@@ -122,7 +125,7 @@
       - name: Run tests
         uses: protocolbuffers/protobuf-ci/bazel-docker@v5
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:8.0.1-d415763a389bb62a6f126b08c992e83f9f7dc1b4
+          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:9.0.0-7932bf8b25fb76a111e7257d151a6a58d5c3c671
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: "bazel-tests"
           bazel: test //bazel/...
@@ -145,4 +148,4 @@
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: "bazel-tests-${{ matrix.runner }}"
           bazel: test //bazel/...
-          version: 8.0.1
+          version: 8.6.0
diff --git a/.github/workflows/test_cpp.yml b/.github/workflows/test_cpp.yml
index d2856e7..e94ed36 100644
--- a/.github/workflows/test_cpp.yml
+++ b/.github/workflows/test_cpp.yml
@@ -44,6 +44,10 @@
             cache_key: Bazel8
             image: "us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:8.0.1-d415763a389bb62a6f126b08c992e83f9f7dc1b4"
             targets: "//src/... //third_party/utf8_range/..."
+          - config: { name: "Bazel9", flags: "--cxxopt=-Wno-self-assign-overloaded" }
+            cache_key: Bazel9
+            image: "us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:9.0.0-7932bf8b25fb76a111e7257d151a6a58d5c3c671"
+            targets: "//src/... //third_party/utf8_range/..."
           - config: { name: "TCMalloc" }
             cache_key: TcMalloc
             image: "us-docker.pkg.dev/protobuf-build/containers/test/linux/tcmalloc:8.0.1-d415763a389bb62a6f126b08c992e83f9f7dc1b4"
diff --git a/.github/workflows/test_java.yml b/.github/workflows/test_java.yml
index aed632a..d0547f5 100644
--- a/.github/workflows/test_java.yml
+++ b/.github/workflows/test_java.yml
@@ -30,23 +30,27 @@
         include:
           - name: OpenJDK 8
             cache_key: '8'
-            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:8.0.1-8-b77fdae6d4771789dfc66a56bf8d806354e8011a
+            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:9.0.0-11-1c31a2985011c75c33dcdf646fc86898aac1ec5d
             # TODO: b/318555165 - enable the layering check. Currently it does
             # not work correctly with the toolchain in this Docker image.
             targets: //java/... //java/internal:java_version --features=-layering_check
             flags: --java_language_version=8
           - name: OpenJDK 11
             cache_key: '11'
-            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:8.0.1-11-b77fdae6d4771789dfc66a56bf8d806354e8011a
+            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:9.0.0-11-1c31a2985011c75c33dcdf646fc86898aac1ec5d
             targets: //java/... //java/internal:java_version //compatibility/...
             continuous-only: true
           - name: OpenJDK 17
             cache_key: '17'
-            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:8.0.1-17-168f9c9d015a0fa16611e1e9eede796fe9bfbb69
+            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:9.0.0-17-1c31a2985011c75c33dcdf646fc86898aac1ec5d
+            targets: //java/... //java/internal:java_version //compatibility/...
+          - name: OpenJDK 21 bazel 8
+            cache_key: 'bazel8'
+            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:8.6.0-21-856ad422dddd3b8fbd85e36129496b37bba174ef
             targets: //java/... //java/internal:java_version //compatibility/...
           - name: OpenJDK 21
             cache_key: '21'
-            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:8.0.1-21-7932bf8b25fb76a111e7257d151a6a58d5c3c671
+            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:9.0.0-21-1c31a2985011c75c33dcdf646fc86898aac1ec5d
             targets: //java/... //java/internal:java_version //compatibility/...
           # TODO: b/395623141 - restore this test once runtime uses / emulates aarch64.
           # - name: aarch64
@@ -101,7 +105,7 @@
     - name: Generate maven artifacts with bazel and install using maven
       uses: protocolbuffers/protobuf-ci/bazel-docker@v5
       with:
-        image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:8.0.1-11-b77fdae6d4771789dfc66a56bf8d806354e8011a
+        image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:9.0.0-11-1c31a2985011c75c33dcdf646fc86898aac1ec5d
         credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
         bazel-cache: java_linux/11
         bash: |
diff --git a/.github/workflows/test_ruby.yml b/.github/workflows/test_ruby.yml
index 63c7598..180dfcc 100644
--- a/.github/workflows/test_ruby.yml
+++ b/.github/workflows/test_ruby.yml
@@ -35,12 +35,14 @@
           - { name: Ruby 3.2, ruby: ruby-3.2.6, continuous-only: true }
           - { name: Ruby 3.3, ruby: ruby-3.3.6, continuous-only: true }
           - { name: Ruby 3.4, ruby: ruby-3.4.1, continuous-only: true }
-          # TODO: Remove the image property in the two entries below and update the configuration
-          # used by all the images the next time there is an update to the Dockerfile
-          - { name: Ruby 4.0, ruby: ruby-4.0.0, ffi: NATIVE, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.0.1-ruby-4.0.0-f1c24ed6acfbf6ec709b0de2f702209c9d3ac659' }
-          - { name: Ruby 4.0, ruby: ruby-4.0.0, ffi: FFI, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.0.1-ruby-4.0.0-f1c24ed6acfbf6ec709b0de2f702209c9d3ac659' }
+          - { name: Ruby 4.0, ruby: ruby-4.0.0, ffi: NATIVE }
+          - { name: Ruby 4.0, ruby: ruby-4.0.0, ffi: FFI }
+          - { name: Ruby 4.0 bazel 8, ruby: ruby-4.0.0, ffi: NATIVE, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.6.0-ruby-4.0.0-856ad422dddd3b8fbd85e36129496b37bba174ef' }
+          - { name: Ruby 4.0 bazel 8, ruby: ruby-4.4.4, ffi: FFI, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.6.0-ruby-4.0.0-856ad422dddd3b8fbd85e36129496b37bba174ef' }
           - { name: JRuby 9.4, ruby: jruby-9.4.9.0, ffi: NATIVE }
           - { name: JRuby 9.4, ruby: jruby-9.4.9.0, ffi: FFI }
+          - { name: JRuby 9.4 bazel 8, ruby: jruby-9.4.9.0, ffi: NATIVE, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.6.0-jruby-9.4.9.0-856ad422dddd3b8fbd85e36129496b37bba174ef' }
+          - { name: JRuby 9.4 bazel 8, ruby: jruby-9.4.9.0, ffi: FFI, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.6.0-jruby-9.4.9.0-856ad422dddd3b8fbd85e36129496b37bba174ef' }
 
     name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} Linux ${{ matrix.name }} ${{ matrix.ffi == 'FFI' && ' FFI' || '' }}
     runs-on: ubuntu-latest
@@ -54,7 +56,7 @@
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
         uses: protocolbuffers/protobuf-ci/bazel-docker@v5
         with:
-          image: ${{ matrix.image || format('us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.0.1-{0}-b77fdae6d4771789dfc66a56bf8d806354e8011a', matrix.ruby) }}
+          image: ${{ matrix.image || format('us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:9.0.0-{0}-9fc33a0c378b5affd3c85d3f5ae4f330993048f7', matrix.ruby) }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: ruby_linux/${{ matrix.ruby }}
           bazel: test //ruby/... //ruby/tests:ruby_version --test_env=KOKORO_RUBY_VERSION --test_env=BAZEL=true ${{ matrix.ffi == 'FFI' && '--//ruby:ffi=enabled --test_env=PROTOCOL_BUFFERS_RUBY_IMPLEMENTATION=FFI' || '' }}
@@ -172,7 +174,7 @@
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
         uses: protocolbuffers/protobuf-ci/bazel@v5
         with:
-          version: 8.0.1 # Bazel version
+          version: 9.0.0 # Bazel version
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: ruby_macos/${{ matrix.version }}
           bazel: test //ruby/... --test_env=KOKORO_RUBY_VERSION=${{ matrix.version }} --test_env=BAZEL=true ${{ matrix.ffi == 'FFI' && '--//ruby:ffi=enabled --test_env=PROTOCOL_BUFFERS_RUBY_IMPLEMENTATION=FFI' || '' }}
@@ -187,13 +189,17 @@
           # Ruby versions for CRuby and JRuby.
           - { name: Ruby 3.1, ruby: ruby-3.1.6, ffi: NATIVE }
           - { name: Ruby 3.1, ruby: ruby-3.1.6, ffi: FFI }
-          - { name: Ruby 3.2, ruby: ruby-3.2.6, continuous-only: true}
-          - { name: Ruby 3.3, ruby: ruby-3.3.6, continuous-only: true}
+          - { name: Ruby 3.2, ruby: ruby-3.2.6, continuous-only: true }
+          - { name: Ruby 3.3, ruby: ruby-3.3.6, continuous-only: true }
           - { name: Ruby 3.4, ruby: ruby-3.4.1, continuous-only: true }
-          - { name: Ruby 4.0, ruby: ruby-4.0.0, ffi: NATIVE, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.0.1-ruby-4.0.0-f1c24ed6acfbf6ec709b0de2f702209c9d3ac659' }
-          - { name: Ruby 4.0, ruby: ruby-4.0.0, ffi: FFI, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.0.1-ruby-4.0.0-f1c24ed6acfbf6ec709b0de2f702209c9d3ac659' }
+          - { name: Ruby 4.0, ruby: ruby-4.0.0, ffi: NATIVE }
+          - { name: Ruby 4.0, ruby: ruby-4.0.0, ffi: FFI }
+          - { name: Ruby 4.0 bazel 8, ruby: ruby-4.0.0, ffi: NATIVE, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.6.0-ruby-4.0.0-856ad422dddd3b8fbd85e36129496b37bba174ef' }
+          - { name: Ruby 4.0 bazel 8, ruby: ruby-4.4.4, ffi: FFI, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.6.0-ruby-4.0.0-856ad422dddd3b8fbd85e36129496b37bba174ef' }
           - { name: JRuby 9.4, ruby: jruby-9.4.9.0, ffi: NATIVE }
           - { name: JRuby 9.4, ruby: jruby-9.4.9.0, ffi: FFI, continuous-only: true }
+          - { name: JRuby 9.4 bazel 8, ruby: jruby-9.4.9.0, ffi: NATIVE, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.6.0-jruby-9.4.9.0-856ad422dddd3b8fbd85e36129496b37bba174ef' }
+          - { name: JRuby 9.4 bazel 8, ruby: jruby-9.4.9.0, ffi: FFI, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.6.0-jruby-9.4.9.0-856ad422dddd3b8fbd85e36129496b37bba174ef' }
     name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} Install ${{ matrix.name }}${{ matrix.ffi == 'FFI' && ' FFI' || '' }}
     runs-on: ubuntu-latest
     steps:
@@ -206,14 +212,15 @@
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
         uses: protocolbuffers/protobuf-ci/bazel-docker@v5
         with:
-          image: ${{ matrix.image || format('us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:8.0.1-{0}-b77fdae6d4771789dfc66a56bf8d806354e8011a', matrix.ruby) }}
+          image: ${{ matrix.image || format('us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:9.0.0-{0}-9fc33a0c378b5affd3c85d3f5ae4f330993048f7', matrix.ruby) }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: ruby_install/${{ matrix.ruby }}_${{ matrix.bazel }}
           bash: >
             bazel --version;
             ruby --version;
             ./regenerate_stale_files.sh $BAZEL_FLAGS;
-            bazel build //ruby:release //:protoc ${{ matrix.ffi == 'FFI' && '--//ruby:ffi=enabled' || '' }} $BAZEL_FLAGS;
+            # TODO: Add --action_env=PATH to release builds before upgrade them to Bazel 9
+            bazel build //ruby:release //:protoc ${{ matrix.ffi == 'FFI' && '--//ruby:ffi=enabled' || '' }} --action_env=PATH $BAZEL_FLAGS;
             gem install bazel-bin/ruby/google-protobuf-*;
             bazel-bin/protoc --proto_path=src --proto_path=ruby/tests --proto_path=ruby --ruby_out=ruby tests/test_import_proto2.proto;
             bazel-bin/protoc --proto_path=src --proto_path=ruby/tests --proto_path=ruby --ruby_out=ruby tests/basic_test.proto;
diff --git a/MODULE.bazel b/MODULE.bazel
index 0da28d3..470b797 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -14,7 +14,7 @@
 # https://bazel.build/versions/6.0.0/build/bzlmod#version-resolution
 # Thus the highest version in their module graph is resolved.
 
-bazel_dep(name = "apple_support", version = "1.16.0", repo_name = "build_bazel_apple_support")
+bazel_dep(name = "apple_support", version = "2.3.0", repo_name = "build_bazel_apple_support")
 
 # Unused but must be pinned to avoid old broken versions
 bazel_dep(name = "rules_proto", version = "7.1.0")
@@ -33,14 +33,14 @@
 # other dependencies
 bazel_dep(name = "bazel_features", version = "1.33.0", repo_name = "proto_bazel_features")
 bazel_dep(name = "bazel_skylib", version = "1.9.0")
-bazel_dep(name = "jsoncpp", version = "1.9.6.bcr.1")
+bazel_dep(name = "jsoncpp", version = "1.9.6.bcr.2")
 bazel_dep(name = "rules_java", version = "8.6.1")
 bazel_dep(name = "rules_jvm_external", version = "6.7")
-bazel_dep(name = "rules_kotlin", version = "2.2.2")
+bazel_dep(name = "rules_kotlin", version = "2.3.20")
 bazel_dep(name = "rules_license", version = "1.0.0")
 bazel_dep(name = "rules_pkg", version = "1.0.1")
 bazel_dep(name = "rules_python", version = "1.6.0")
-bazel_dep(name = "rules_rust", version = "0.63.0")
+bazel_dep(name = "rules_rust", version = "0.69.0")
 
 bazel_dep(name = "rules_ruby", version = "0.20.1", dev_dependency = True)
 
@@ -307,17 +307,16 @@
     urls = ["https://github.com/protocolbuffers/protobuf/releases/download/v25.0/protobuf-25.0.tar.gz"],
 )
 
-bazel_dep(name = "com_google_protobuf_previous_release", version = "29.0", dev_dependency = True)
+bazel_dep(name = "com_google_protobuf_previous_release", version = "33.0", dev_dependency = True)
 archive_override(
     module_name = "com_google_protobuf_previous_release",
-    integrity = "sha256-EKDVjzmhqQnpXgDougtbHcZNApl/dBFRlTorNln254w=",
+    integrity = "sha256-y8U2BkcGtijc/lB77zhu8+IhTVY2V2EilvF4GqFV7gc=",
     patch_strip = 1,
     patches = [
-        "@com_google_protobuf//:patches/protobuf_v29/0001-Update-module-name.patch",
-        "@com_google_protobuf//:patches/protobuf_v29/0002-bazel9.patch",
+        "@com_google_protobuf//:patches/protobuf_v33/0001-Update-module-name.patch",
     ],
-    strip_prefix = "protobuf-29.0",
-    urls = ["https://github.com/protocolbuffers/protobuf/releases/download/v29.0/protobuf-29.0.tar.gz"],
+    strip_prefix = "protobuf-33.0",
+    urls = ["https://github.com/protocolbuffers/protobuf/releases/download/v33.0/protobuf-33.0.tar.gz"],
 )
 
 # Register C++ toolchains for cross-compilation. These are used for compiling release binaries of
diff --git a/bazel/tests/cc_toolchain_tests.bzl b/bazel/tests/cc_toolchain_tests.bzl
index 448feed..e878f1c 100644
--- a/bazel/tests/cc_toolchain_tests.bzl
+++ b/bazel/tests/cc_toolchain_tests.bzl
@@ -19,7 +19,7 @@
         name = name,
         tests = [
             _test_cc_toolchain_uses_protoc_minimal_when_prefer_prebuilt_flag_unset,
-            _test_cc_toolchain_uses_full_protoc_by_default,
+            _test_cc_toolchain_uses_prebuilt_protoc_when_prefer_prebuilt_flag_set,
         ],
     )
 
@@ -51,7 +51,7 @@
     # so the cc_toolchain should use protoc_minimal.
     action.argv().contains_predicate(matching.str_matches("*protoc_minimal*"))
 
-def _test_cc_toolchain_uses_full_protoc_by_default(name):
+def _test_cc_toolchain_uses_prebuilt_protoc_when_prefer_prebuilt_flag_set(name):
     util.helper_target(
         proto_library,
         name = name + "_proto",
@@ -67,15 +67,14 @@
     analysis_test(
         name = name,
         target = name + "_compile",
-        impl = _test_cc_toolchain_uses_full_protoc_by_default_impl,
+        impl = _test_cc_toolchain_uses_prebuilt_protoc_when_prefer_prebuilt_flag_set_impl,
+        config_settings = {_PREFER_PREBUILT_PROTOC: True},
     )
 
-def _test_cc_toolchain_uses_full_protoc_by_default_impl(env, target):
+def _test_cc_toolchain_uses_prebuilt_protoc_when_prefer_prebuilt_flag_set_impl(env, target):
     # Find the compile action
     action = env.expect.that_target(target).action_named("GenProto")
 
-    # By default (prefer_prebuilt_protoc is True), protoc_minimal_do_not_use is None,
-    # so the cc_toolchain should use the full protoc (not protoc_minimal).
-    # The protoc path should end with "/protoc" not contain "protoc_minimal"
-    action.argv().contains_predicate(matching.str_matches("*/protoc"))
+    # When prefer_prebuilt_protoc is True, protoc_minimal_do_not_use is not set,
+    # so the cc_toolchain should use prebuilt protoc instead of protoc_minimal.
     action.argv().not_contains_predicate(matching.str_matches("*protoc_minimal*"))
diff --git a/ci/Windows.bazelrc b/ci/Windows.bazelrc
index 9341c0b..911ab37 100644
--- a/ci/Windows.bazelrc
+++ b/ci/Windows.bazelrc
@@ -9,3 +9,5 @@
 build:clang-cl --extra_execution_platforms=//build_defs:x64_windows-clang-cl --host_platform=//build_defs:x64_windows-clang-cl
 build:msvc-cl --extra_execution_platforms=//build_defs:x64_windows-msvc-cl --host_platform=//build_defs:x64_windows-msvc-cl
 build --config=clang-cl
+# Set BAZEL_SH, this is needed for bazel 8.6.0 WORKSPACE on windows
+build --action_env=BAZEL_SH="C:/Program Files/Git/bin/bash.exe"
diff --git a/ci/bazel9.bazelrc b/ci/bazel9.bazelrc
index 4d70285..251ef29 100644
--- a/ci/bazel9.bazelrc
+++ b/ci/bazel9.bazelrc
@@ -1 +1,3 @@
 build --incompatible_exclude_starlark_flags_from_exec_config
+# TODO: Remove --repo_contents_cache
+common --repo_contents_cache=
diff --git a/ci/common.bazelrc b/ci/common.bazelrc
index a19b7af..f12a7a2 100644
--- a/ci/common.bazelrc
+++ b/ci/common.bazelrc
@@ -49,10 +49,11 @@
 build --incompatible_enable_android_toolchain_resolution
 build --incompatible_enable_apple_toolchain_resolution
 build --incompatible_exclusive_test_sandboxed
-build --incompatible_remote_use_new_exit_code_for_lost_inputs
-build --incompatible_sandbox_hermetic_tmp
 build --incompatible_top_level_aspects_require_providers
 build --incompatible_use_cc_configure_from_rules_cc
+# Disable prebuilt protoc which doesn't work for tests at HEAD which do not
+# have a published protoc prebuilt release
+build --@com_google_protobuf//bazel/toolchains:prefer_prebuilt_protoc=false
 try-import-if-bazel-version >=9.0.0 %workspace%/ci/bazel9.bazelrc
 
 # We cannot yet build successfully with the following flags:
@@ -69,6 +70,8 @@
 #   --incompatible_disable_objc_library_transition
 #   --incompatible_fail_on_unknown_attributes
 #   --incompatible_merge_fixed_and_default_shell_env
+#   --incompatible_remote_use_new_exit_code_for_lost_inputs
+#   --incompatible_sandbox_hermetic_tmp
 
 # For easier debugging of build failures.
 common --announce_rc
diff --git a/examples/.bazelrc b/examples/.bazelrc
index 7873d89..55fd1dc 100644
--- a/examples/.bazelrc
+++ b/examples/.bazelrc
@@ -3,7 +3,15 @@
 build:linux --cxxopt=-std=c++17 --host_cxxopt=-std=c++17
 build:macos --cxxopt=-std=c++17 --host_cxxopt=-std=c++17
 
+# Disable prebuilt protoc which doesn't work for tests at HEAD which do not
+# have a published protoc prebuilt release
+build --@com_google_protobuf//bazel/toolchains:prefer_prebuilt_protoc=false
+
 common:windows --cxxopt=/std:c++17 --host_cxxopt=/std:c++17 --enable_runfiles
 
 build --experimental_remote_cache_eviction_retries=5
 build --remote_download_outputs=all
+
+# Import Bazel 9 specific flags (such as --repo_contents_cache)
+# TODO: Remove it when --repo_contents_cache issue has been resolved in bazel
+try-import-if-bazel-version >=9.0.0 %workspace%/../ci/bazel9.bazelrc
diff --git a/examples/WORKSPACE b/examples/WORKSPACE
index c79527c..437d82b 100644
--- a/examples/WORKSPACE
+++ b/examples/WORKSPACE
@@ -1,6 +1,6 @@
 workspace(name = "com_google_protobuf_examples")
 
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+# load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
 # This protobuf repository is required for proto_library rule.
 # It provides the protocol compiler binary (i.e., protoc).
@@ -57,6 +57,11 @@
 
 rules_jvm_external_setup()
 
+# For bazel 8.6.0 WORKSPACE on windows
+load("@rules_shell//shell:repositories.bzl", "rules_shell_toolchains")
+
+rules_shell_toolchains()
+
 load("@rules_jvm_external//:defs.bzl", "maven_install")
 
 maven_install(
diff --git a/examples/example_without_cc_toolchain/.bazelrc b/examples/example_without_cc_toolchain/.bazelrc
index 90f2a44..512d7b6 100644
--- a/examples/example_without_cc_toolchain/.bazelrc
+++ b/examples/example_without_cc_toolchain/.bazelrc
@@ -4,3 +4,7 @@
 # But, users should be able to use pre-built protoc toolchains instead.
 common --incompatible_enable_proto_toolchain_resolution
 common --@com_google_protobuf//bazel/toolchains:prefer_prebuilt_protoc
+
+# Import Bazel 9 specific flags (such as --repo_contents_cache)
+# TODO: Remove it when --repo_contents_cache issue has been resolved in bazel
+try-import-if-bazel-version >=9.0.0 %workspace%/../../ci/bazel9.bazelrc
diff --git a/maven_install.json b/maven_install.json
index b617e7d..d4a8caa 100644
--- a/maven_install.json
+++ b/maven_install.json
@@ -1,6 +1,6 @@
 {
   "__AUTOGENERATED_FILE_DO_NOT_MODIFY_THIS_FILE_MANUALLY": "THERE_IS_NO_DATA_ONLY_ZUUL",
-  "__INPUT_ARTIFACTS_HASH": 771645571,
+  "__INPUT_ARTIFACTS_HASH": 1681618567,
   "__RESOLVED_ARTIFACTS_HASH": -1085701786,
   "conflict_resolution": {
     "com.google.errorprone:error_prone_annotations:2.5.1": "com.google.errorprone:error_prone_annotations:2.18.0"
diff --git a/patches/protobuf_v29/0001-Update-module-name.patch b/patches/protobuf_v29/0001-Update-module-name.patch
deleted file mode 100644
index 858475a..0000000
--- a/patches/protobuf_v29/0001-Update-module-name.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/MODULE.bazel b/MODULE.bazel
-index 400186b53..1194db9ca 100644
---- a/MODULE.bazel
-+++ b/MODULE.bazel
-@@ -2,7 +2,7 @@
- # https://github.com/protocolbuffers/protobuf/issues/14313
- 
- module(
--    name = "protobuf",
-+    name = "com_google_protobuf_previous_release",
-     version = "29.0",  # Automatically updated on release
-     compatibility_level = 1,
-     repo_name = "com_google_protobuf",
diff --git a/patches/protobuf_v29/0002-bazel9.patch b/patches/protobuf_v29/0002-bazel9.patch
deleted file mode 100644
index 94d7fbc..0000000
--- a/patches/protobuf_v29/0002-bazel9.patch
+++ /dev/null
@@ -1,280 +0,0 @@
-commit fc4d962f0bdfcaa1cc1b2e306301eec48719d847
-Author:     Keith Smiley <keithbsmiley@gmail.com>
-AuthorDate: Tue Mar 3 15:14:28 2026 -0800
-Commit:     Keith Smiley <keithbsmiley@gmail.com>
-CommitDate: Tue Mar 3 15:20:01 2026 -0800
-
-    NEED
-
-diff --git a/bazel/upb_c_proto_library.bzl b/bazel/upb_c_proto_library.bzl
-index ebeebed..0bdf741 100644
---- a/bazel/upb_c_proto_library.bzl
-+++ b/bazel/upb_c_proto_library.bzl
-@@ -1,5 +1,6 @@
- """upb_c_proto_library() exposes upb's generated C API for protobuf (foo.upb.h)"""
- 
-+load("@rules_cc//cc/common:cc_info.bzl", "CcInfo")
- load("//bazel:upb_minitable_proto_library.bzl", "UpbMinitableCcInfo", "upb_minitable_proto_library_aspect")
- load("//bazel/common:proto_info.bzl", "ProtoInfo")
- load("//bazel/private:upb_proto_library_internal/aspect.bzl", "upb_proto_aspect_impl")
-diff --git a/bazel/upb_minitable_proto_library.bzl b/bazel/upb_minitable_proto_library.bzl
-index 0a17842..a77c572 100644
---- a/bazel/upb_minitable_proto_library.bzl
-+++ b/bazel/upb_minitable_proto_library.bzl
-@@ -1,5 +1,7 @@
- """upb_minitable_proto_library() exposes upb's generated minitables (foo.upb_minitable.h)"""
- 
-+load("@rules_cc//cc/common:cc_common.bzl", "cc_common")
-+load("@rules_cc//cc/common:cc_info.bzl", "CcInfo")
- load("//bazel/common:proto_info.bzl", "ProtoInfo")
- load("//bazel/private:upb_proto_library_internal/aspect.bzl", "upb_proto_aspect_impl")
- load("//bazel/private:upb_proto_library_internal/cc_library_func.bzl", "upb_use_cpp_toolchain")
-diff --git a/bazel/upb_proto_reflection_library.bzl b/bazel/upb_proto_reflection_library.bzl
-index 8347dfb..fb28ef3 100644
---- a/bazel/upb_proto_reflection_library.bzl
-+++ b/bazel/upb_proto_reflection_library.bzl
-@@ -1,5 +1,6 @@
- """upb_c_proto_reflection_library() exposes upb reflection for protobuf (foo.upbdefs.h)"""
- 
-+load("@rules_cc//cc/common:cc_info.bzl", "CcInfo")
- load("//bazel:upb_minitable_proto_library.bzl", "UpbMinitableCcInfo", "upb_minitable_proto_library_aspect")
- load("//bazel/common:proto_common.bzl", "proto_common")
- load("//bazel/common:proto_info.bzl", "ProtoInfo")
-diff --git a/build_defs/cc_proto_blacklist_test.bzl b/build_defs/cc_proto_blacklist_test.bzl
-index 260abde..2c100d9 100644
---- a/build_defs/cc_proto_blacklist_test.bzl
-+++ b/build_defs/cc_proto_blacklist_test.bzl
-@@ -1,6 +1,7 @@
- """Contains a unittest to verify that `cc_proto_library` does not generate code for blacklisted `.proto` sources (i.e. WKPs)."""
- 
- load("@bazel_skylib//lib:unittest.bzl", "asserts", "unittest")
-+load("@rules_cc//cc/common:cc_info.bzl", "CcInfo")
- 
- def _cc_proto_blacklist_test_impl(ctx):
-     """Verifies that there are no C++ compile actions for Well-Known-Protos.
-diff --git a/src/google/protobuf/BUILD.bazel b/src/google/protobuf/BUILD.bazel
-index 5cfd160..c9117de 100644
---- a/src/google/protobuf/BUILD.bazel
-+++ b/src/google/protobuf/BUILD.bazel
-@@ -452,7 +452,6 @@ cc_library(
-         "@com_google_absl//absl/numeric:bits",
-         "@com_google_absl//absl/synchronization",
-         "@com_google_absl//absl/types:span",
--        "@com_google_absl//absl/utility:if_constexpr",
-     ],
- )
- 
-@@ -578,7 +577,6 @@ cc_library(
-         "@com_google_absl//absl/time",
-         "@com_google_absl//absl/types:optional",
-         "@com_google_absl//absl/types:span",
--        "@com_google_absl//absl/utility:if_constexpr",
-     ],
- )
- 
-diff --git a/src/google/protobuf/compiler/java/full/BUILD.bazel b/src/google/protobuf/compiler/java/full/BUILD.bazel
-index 1fb6f07..b5b2cbd 100644
---- a/src/google/protobuf/compiler/java/full/BUILD.bazel
-+++ b/src/google/protobuf/compiler/java/full/BUILD.bazel
-@@ -1,3 +1,5 @@
-+load("@rules_cc//cc:cc_library.bzl", "cc_library")
-+
- # We use abbreviated target names in this directory to work around:
- #     https://github.com/bazelbuild/bazel/issues/18683
- cc_library(
-diff --git a/src/google/protobuf/compiler/java/lite/BUILD.bazel b/src/google/protobuf/compiler/java/lite/BUILD.bazel
-index 1046739..92e82cc 100644
---- a/src/google/protobuf/compiler/java/lite/BUILD.bazel
-+++ b/src/google/protobuf/compiler/java/lite/BUILD.bazel
-@@ -1,3 +1,5 @@
-+load("@rules_cc//cc:cc_library.bzl", "cc_library")
-+
- cc_library(
-     name = "field_generators",
-     srcs = [
-diff --git a/src/google/protobuf/compiler/kotlin/BUILD.bazel b/src/google/protobuf/compiler/kotlin/BUILD.bazel
-index 5555ade..2ecc09a 100644
---- a/src/google/protobuf/compiler/kotlin/BUILD.bazel
-+++ b/src/google/protobuf/compiler/kotlin/BUILD.bazel
-@@ -1,3 +1,5 @@
-+load("@rules_cc//cc:cc_library.bzl", "cc_library")
-+
- cc_library(
-     name = "kotlin",
-     srcs = ["generator.cc"],
-diff --git a/src/google/protobuf/compiler/php/BUILD.bazel b/src/google/protobuf/compiler/php/BUILD.bazel
-index 7e21518..271e67b 100644
---- a/src/google/protobuf/compiler/php/BUILD.bazel
-+++ b/src/google/protobuf/compiler/php/BUILD.bazel
-@@ -2,6 +2,7 @@
- # Protocol Buffers Compiler - PHP code generator
- ################################################################################
- 
-+load("@rules_cc//cc:cc_test.bzl", "cc_test")
- load("@rules_cc//cc:defs.bzl", "cc_library")
- load("@rules_pkg//pkg:mappings.bzl", "pkg_files", "strip_prefix")
- load("//build_defs:cpp_opts.bzl", "COPTS")
-diff --git a/src/google/protobuf/compiler/rust/BUILD.bazel b/src/google/protobuf/compiler/rust/BUILD.bazel
-index 91c8145..50d0aa7 100644
---- a/src/google/protobuf/compiler/rust/BUILD.bazel
-+++ b/src/google/protobuf/compiler/rust/BUILD.bazel
-@@ -2,6 +2,7 @@
- # Protocol Buffers Compiler - Rust code generator
- ################################################################################
- 
-+load("@rules_cc//cc:cc_test.bzl", "cc_test")
- load("@rules_cc//cc:defs.bzl", "cc_library")
- load("//build_defs:cpp_opts.bzl", "COPTS")
- 
-diff --git a/src/google/protobuf/compiler/test_plugin_injection.bzl b/src/google/protobuf/compiler/test_plugin_injection.bzl
-index aec2544..210d942 100644
---- a/src/google/protobuf/compiler/test_plugin_injection.bzl
-+++ b/src/google/protobuf/compiler/test_plugin_injection.bzl
-@@ -28,6 +28,7 @@
- # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- 
-+load("@rules_cc//cc:cc_library.bzl", "cc_library")
- load("//build_defs:cpp_opts.bzl", "COPTS")
- 
- # This works around https://github.com/bazelbuild/bazel/issues/19124 by using a generated header to
-@@ -55,8 +56,7 @@ cat <<'EOF' >$(OUTS)
-         visibility = ["//visibility:private"],
-         testonly = True,
-     )
--
--    native.cc_library(
-+    cc_library(
-         name = name,
-         hdrs = [hdr],
-         strip_include_prefix = "/src",
-diff --git a/third_party/utf8_range/BUILD.bazel b/third_party/utf8_range/BUILD.bazel
-index 90b1088..2e07ede 100644
---- a/third_party/utf8_range/BUILD.bazel
-+++ b/third_party/utf8_range/BUILD.bazel
-@@ -4,6 +4,8 @@
- # license that can be found in the LICENSE file or at
- # https://opensource.org/licenses/MIT.
- 
-+load("@rules_cc//cc:cc_library.bzl", "cc_library")
-+load("@rules_cc//cc:cc_test.bzl", "cc_test")
- load("@rules_license//rules:license.bzl", "license")
- 
- DEFAULT_VISIBILITY = [
-diff --git a/upb/BUILD b/upb/BUILD
-index b282b6e..b5cbcfe 100644
---- a/upb/BUILD
-+++ b/upb/BUILD
-@@ -6,7 +6,7 @@
- # https://developers.google.com/open-source/licenses/bsd
- 
- load("@bazel_skylib//rules:common_settings.bzl", "bool_flag")
--load("@rules_python//python:defs.bzl", "py_binary")
-+load("@rules_cc//cc:cc_library.bzl", "cc_library")
- load("//bazel/private:upb_proto_library_internal/copts.bzl", "upb_proto_library_copts")
- load(
-     "//upb/bazel:amalgamation.bzl",
-diff --git a/upb/port/BUILD b/upb/port/BUILD
-index 9088825..a8e9a13 100644
---- a/upb/port/BUILD
-+++ b/upb/port/BUILD
-@@ -5,6 +5,7 @@
- # license that can be found in the LICENSE file or at
- # https://developers.google.com/open-source/licenses/bsd
- 
-+load("@rules_cc//cc:cc_library.bzl", "cc_library")
- load("//upb/bazel:build_defs.bzl", "UPB_DEFAULT_COPTS")
- 
- package(default_applicable_licenses = ["//:license"])
-diff --git a/upb_generator/bootstrap_compiler.bzl b/upb_generator/bootstrap_compiler.bzl
-index be2ff5f..8d9a017 100644
---- a/upb_generator/bootstrap_compiler.bzl
-+++ b/upb_generator/bootstrap_compiler.bzl
-@@ -1,5 +1,7 @@
- """Macros that implement bootstrapping for the upb code generator."""
- 
-+load("@rules_cc//cc:cc_binary.bzl", "cc_binary")
-+load("@rules_cc//cc:cc_library.bzl", "cc_library")
- load(
-     "//bazel:upb_minitable_proto_library.bzl",
-     "upb_minitable_proto_library",
-@@ -53,7 +55,7 @@ def bootstrap_cc_library(name, visibility = [], deps = [], bootstrap_deps = [],
-           upb_proto_library().
-     """
-     for stage in _stages:
--        native.cc_library(
-+        cc_library(
-             name = name + stage,
-             deps = deps + [dep + stage for dep in bootstrap_deps],
-             visibility = _stage_visibility(stage, visibility),
-@@ -77,7 +79,7 @@ def bootstrap_cc_binary(name, visibility = [], deps = [], bootstrap_deps = [], *
-           upb_proto_library().
-     """
-     for stage in _stages:
--        native.cc_binary(
-+        cc_binary(
-             name = name + stage,
-             deps = deps + [dep + stage for dep in bootstrap_deps],
-             visibility = _stage_visibility(stage, visibility),
-@@ -212,7 +214,7 @@ def bootstrap_upb_proto_library(
-     _stage0_proto_staleness_test(name, oss_src_files, oss_src_rules, oss_strip_prefix)
- 
-     # stage0 uses checked-in protos, and has no MiniTable.
--    native.cc_library(
-+    cc_library(
-         name = name + "_stage0",
-         srcs = _generated_hdrs_and_srcs(oss_src_files, "stage0", "upb"),
-         hdrs = [bootstrap_hdr],
-@@ -231,8 +233,7 @@ def bootstrap_upb_proto_library(
-     # Generate stage1 protos (C API and MiniTables) using stage0 compiler.
-     _generate_stage1_proto(name, src_files, src_rules, "upb", kwargs)
-     _generate_stage1_proto(name, src_files, src_rules, "upb_minitable", kwargs)
--
--    native.cc_library(
-+    cc_library(
-         name = name + "_minitable_stage1",
-         srcs = _generated_files(src_files, "stage1", "upb_minitable", "c"),
-         hdrs = _generated_files(src_files, "stage1", "upb_minitable", "h"),
-@@ -243,7 +244,7 @@ def bootstrap_upb_proto_library(
-         ] + [dep + "_minitable_stage1" for dep in deps],
-         **kwargs
-     )
--    native.cc_library(
-+    cc_library(
-         name = name + "_stage1",
-         srcs = _generated_files(src_files, "stage1", "upb", "h"),
-         hdrs = [bootstrap_hdr],
-@@ -262,7 +263,7 @@ def bootstrap_upb_proto_library(
-         deps = proto_lib_deps,
-         **kwargs
-     )
--    native.cc_library(
-+    cc_library(
-         name = name,
-         hdrs = [bootstrap_hdr],
-         deps = [name + "_upb_proto"],
-diff --git a/upb_generator/common/BUILD b/upb_generator/common/BUILD
-index 8687b7f..982ba6f 100644
---- a/upb_generator/common/BUILD
-+++ b/upb_generator/common/BUILD
-@@ -5,6 +5,8 @@
- # license that can be found in the LICENSE file or at
- # https://developers.google.com/open-source/licenses/bsd
- 
-+load("@rules_cc//cc:cc_library.bzl", "cc_library")
-+
- package(default_applicable_licenses = ["//:license"])
- 
- # Note: this library should not depend on upb reflection or C++ proto
-diff --git a/upb_generator/minitable/BUILD b/upb_generator/minitable/BUILD
-index a5eadfe..62a153e 100644
---- a/upb_generator/minitable/BUILD
-+++ b/upb_generator/minitable/BUILD
-@@ -5,6 +5,7 @@
- # license that can be found in the LICENSE file or at
- # https://developers.google.com/open-source/licenses/bsd
- 
-+load("@rules_cc//cc:cc_library.bzl", "cc_library")
- load("//bazel/toolchains:proto_lang_toolchain.bzl", "proto_lang_toolchain")
- load("//upb/bazel:build_defs.bzl", "UPB_DEFAULT_CPPOPTS")
- load(
diff --git a/patches/protobuf_v33/0001-Update-module-name.patch b/patches/protobuf_v33/0001-Update-module-name.patch
new file mode 100644
index 0000000..a6580c4
--- /dev/null
+++ b/patches/protobuf_v33/0001-Update-module-name.patch
@@ -0,0 +1,21 @@
+--- a/MODULE.bazel
++++ b/MODULE.bazel
+@@ -5,3 +5,3 @@
+ module(
+-    name = "protobuf",
++    name = "com_google_protobuf_previous_release",
+     version = "33.0",  # Automatically updated on release
+@@ -293,13 +293,1 @@
+ )
+-
+-bazel_dep(name = "com_google_protobuf_previous_release", version = "29.0", dev_dependency = True)
+-archive_override(
+-    module_name = "com_google_protobuf_previous_release",
+-    integrity = "sha256-EKDVjzmhqQnpXgDougtbHcZNApl/dBFRlTorNln254w=",
+-    patch_strip = 1,
+-    patches = [
+-        "@com_google_protobuf//:patches/protobuf_v29/0001-Update-module-name.patch",
+-    ],
+-    strip_prefix = "protobuf-29.0",
+-    urls = ["https://github.com/protocolbuffers/protobuf/releases/download/v29.0/protobuf-29.0.tar.gz"],
+-)
diff --git a/third_party/jsoncpp.BUILD b/third_party/jsoncpp.BUILD
index b013e4f..8960b48 100644
--- a/third_party/jsoncpp.BUILD
+++ b/third_party/jsoncpp.BUILD
@@ -24,7 +24,6 @@
     ],
     copts = [
         "-DJSON_USE_EXCEPTION=0",
-        "-DJSON_HAS_INT64",
     ],
     includes = ["include"],
     visibility = ["//visibility:public"],
diff --git a/upb/bazel/private/oss/amalgamate.py b/upb/bazel/private/oss/amalgamate.py
index dd54cb4..f0cbde9 100755
--- a/upb/bazel/private/oss/amalgamate.py
+++ b/upb/bazel/private/oss/amalgamate.py
@@ -44,12 +44,12 @@
 
 class Amalgamator:
 
-  def __init__(self, h_out, c_out):
+  def __init__(self, output_h, output_c, h_out_filename):
     self.include_paths = ["."]
     self.included = set()
-    self.output_h = open(h_out, "w")
-    self.output_c = open(c_out, "w")
-    self.h_out = h_out.split("/")[-1]
+    self.output_h = output_h
+    self.output_c = output_c
+    self.h_out = h_out_filename
 
   def amalgamate(self, h_files, c_files):
     self.h_files = set(h_files)
@@ -138,7 +138,7 @@
 
 c_out = sys.argv[1]
 h_out = sys.argv[2]
-amalgamator = Amalgamator(h_out, c_out)
+
 c_files = []
 h_files = []
 
@@ -149,4 +149,6 @@
   else:
     c_files.append(arg)
 
-amalgamator.amalgamate(h_files, c_files)
+with open(h_out, "w") as output_h, open(c_out, "w") as output_c:
+  amalgamator = Amalgamator(output_h, output_c, h_out.split("/")[-1])
+  amalgamator.amalgamate(h_files, c_files)