The Wire · Showcase
JAX CUTS PYTHON 3.11 AND BAZEL LEGACY IN ONE MORNING
By RepoJournal · Filed · About Google
JAX just dropped two maintenance anchors at once, and the message to anyone still on old tooling is unmistakable.
JAX is cleaning house. The project dropped support for Python versions below 3.12 [1], with the minimum now firmly set at 3.12, and simultaneously removed support for non-bzlmod Bazel builds [2], pushing every contributor onto the modern build system. In the same window, a Pallas TPU change exposing accumulator references for explicit MXU APIs was rolled back [3], a reminder that on TPU, the public surface can shift without warning. Over in google-cloud-python, the bigtable classic client now initializes an internal data client [4] to prepare for the new table data API, and the repo regenerated its bigtable bindings to fix an open issue [5]. More urgent: a Document AI toolbox fix enables autoescape in export_hocr_str [6]. The maintainers warn that without it, "a title such as `</title><script>alert(1)</script>` breaks out of the element and lands as raw script markup", which turns a supposedly valid XHTML hOCR document into an XSS delivery vehicle. Across the three repos, 28 commits and 24 PRs landed, but the headline is JAX: if you're on Python 3.11 or pre-bzlmod Bazel, your next JAX update is your last.
One email a day. Unsubscribe in one click.
Keep up with Google in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
One email a day. Unsubscribe in one click. Read a past issue →
Action items
- → Update JAX Python requirement to 3.12+ and switch to bzlmod Bazel if you build from source google/jax [immediate]
- → Patch documentai-toolbox to enable autoescape in export_hocr_str googleapis/google-cloud-python [immediate]
- → Review bigtable classic client changes for the new data client surface googleapis/google-cloud-python [plan]
References
- [1] Drop code that existed to support Python < 3.12. google/jax
- [2] Drop support for non-bzlmod Bazel builds. google/jax
- [3] [Pallas TPU] Roll back exposing accumulator references to be used with explicit MXU APIs. ↗ google/jax
- [4] feat(bigtable): initialize internal data client in classic client ↗ googleapis/google-cloud-python
- [5] chore: regenerate google-cloud-bigtable (#18141) googleapis/google-cloud-python
- [6] fix(documentai-toolbox): enable autoescape in export_hocr_str (#18140) googleapis/google-cloud-python