feat(core): switch to script bootstrap as a default

CHANGELOG.md

@@ -60,17 +60,27 @@ END_UNRELEASED_TEMPLATE
 * (gazelle) Types for exposed members of `python.ParserOutput` are now all public.
 * (gazelle) Removed the requirement for `__init__.py`, `__main__.py`, or `__test__.py` files to be
   present in a directory to generate a `BUILD.bazel` file.
-* (toolchain) Updated the following toolchains to build 20250708 to patch CVE-2025-47273:
+* (toolchain) Updated the following toolchains to build [20250723] to patch CVE-2025-47273:
     * 3.9.23
     * 3.10.18
     * 3.11.13
     * 3.12.11
-    * 3.14.0b4
+    * 3.14.0rc1
 * (toolchain) Python 3.13 now references 3.13.5
 * (gazelle) Switched back to smacker/go-tree-sitter, fixing
   [#2630](https://github.com/bazel-contrib/rules_python/issues/2630)
 * (ci) We are now testing on Ubuntu 22.04 for RBE and non-RBE configurations.
-* (core) #!/usr/bin/env bash is now used as a shebang in the stage1 bootstrap template.
+* (core) `#!/usr/bin/env bash` is now used as a shebang in the stage1 bootstrap template.
+* If using the (deprecated) autodetecting/runtime_env toolchain, then the Python
+  version specified at build-time *must* match the Python version used at
+  runtime (the {obj}`--@rules_python//python/config_settings:python_version`
+  flag and the {attr}`python_version` attribute control the build-time version
+  for a target). If they don't match, dependencies won't be importable. (Such a
+  misconfiguration was unlikely to work to begin with; this is called out as an
+  FYI).
+* (rules) {obj}`--bootstrap_impl=script` is the default for non-Windows.
+
+[20250723]: https://github.com/astral-sh/python-build-standalone/releases/tag/20250723
 
 {#v0-0-0-fixed}
 ### Fixed
@@ -108,7 +118,7 @@ END_UNRELEASED_TEMPLATE
     * 3.11.13
     * 3.12.11
     * 3.13.5
-    * 3.14.0b4
+    * 3.14.0rc1
 * (gazelle): New annotation `gazelle:include_pytest_conftest`. When not set (the
   default) or `true`, gazelle will inject any `conftest.py` file found in the same
   directory as a {obj}`py_test` target to that {obj}`py_test` target's `deps`.

docs/api/rules_python/python/config_settings/index.md

@@ -245,8 +245,12 @@ Values:
 ::::{bzl:flag} bootstrap_impl
 Determine how programs implement their startup process.
 
+The default for this depends on the platform:
+* Windows: `system_python` (**always** used)
+* Other: `script`
+
 Values:
-* `system_python`: (default) Use a bootstrap that requires a system Python available
+* `system_python`: Use a bootstrap that requires a system Python available
   in order to start programs. This requires
   {obj}`PyRuntimeInfo.bootstrap_template` to be a Python program.
 * `script`: Use a bootstrap that uses an arbitrary executable script (usually a
@@ -269,6 +273,11 @@ instead.
 :::{versionadded} 0.33.0
 :::
 
+:::{versionchanged} VERSION_NEXT_FEATURE
+* The default for non-Windows changed from `system_python` to `script`.
+* On Windows, the value is forced to `system_python`.
+:::
+
 ::::
 
 ::::{bzl:flag} current_config

python/config_settings/BUILD.bazel

@@ -90,7 +90,7 @@ string_flag(
 
 rp_string_flag(
     name = "bootstrap_impl",
-    build_setting_default = BootstrapImplFlag.SYSTEM_PYTHON,
+    build_setting_default = BootstrapImplFlag.SCRIPT,
     override = select({
         # Windows doesn't yet support bootstrap=script, so force disable it
         ":_is_windows": BootstrapImplFlag.SYSTEM_PYTHON,

tests/python/python_tests.bzl

@@ -326,7 +326,7 @@ def _test_toolchain_ordering(env):
         "3.11": "3.11.13",
         "3.12": "3.12.11",
         "3.13": "3.13.5",
-        "3.14": "3.14.0b4",
+        "3.14": "3.14.0rc1",
         "3.8": "3.8.20",
         "3.9": "3.9.23",
     })

tests/toolchains/python_toolchain_test.py

@@ -27,18 +27,14 @@ def test_expected_toolchain_matches(self):
         )
         self.assertIn(expected, settings["toolchain_label"], msg)
 
-        if sys.version_info.releaselevel == "final":
-            actual = "{v.major}.{v.minor}.{v.micro}".format(v=sys.version_info)
-        elif sys.version_info.releaselevel in ["beta"]:
-            actual = (
-                "{v.major}.{v.minor}.{v.micro}{v.releaselevel[0]}{v.serial}".format(
-                    v=sys.version_info
-                )
-            )
-        else:
-            raise NotImplementedError(
-                "Unsupported release level, please update the test"
+        actual = "{v.major}.{v.minor}.{v.micro}".format(v=sys.version_info)
+        if sys.version_info.releaselevel != "final":
+            release_prefix = (
+                "rc"
+                if sys.version_info.releaselevel == "candidate"
+                else sys.version_info.releaselevel[0]
             )
+            actual = f"{actual}{release_prefix}{sys.version_info.serial}"
         self.assertEqual(actual, expect_version)
 
 

tests/toolchains/transitions/transitions_tests.bzl

@@ -64,7 +64,7 @@ def _impl(ctx):
     if got_version.releaselevel != "final":
         got = "{}{}{}".format(
             got,
-            got_version.releaselevel[0],
+            "rc" if got_version.releaselevel == "candidate" else got_version.releaselevel[0],
             got_version.serial,
         )