chore(deps): bump rules_python from 1.8.3 to 2.3.0

[dependabot]

Bumps rules_python from 1.8.3 to 2.3.0.

Release notes

Sourced from rules_python's releases.

2.3.0

For more detailed setup instructions, see https://rules-python.readthedocs.io/en/latest/getting-started.html

For the user-facing changelog see here

Using Bzlmod

Add to your MODULE.bazel file:

bazel_dep(name = "rules_python", version = "2.3.0")
python = use_extension("@​rules_python//python/extensions:python.bzl", "python")
python.toolchain(
python_version = "3.13",
)
pip = use_extension("@​rules_python//python/extensions:pip.bzl", "pip")
pip.parse(
hub_name = "pypi",
python_version = "3.13",
requirements_lock = "//:requirements_lock.txt",
)
use_repo(pip, "pypi")

Using WORKSPACE

Paste this snippet into your WORKSPACE file:

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
http_archive(
name = "rules_python",
sha256 = "70c519e8f0a5d9244c0d3496a6993bd42edf111c4499b68ce2f155c26fc8d4ee",
strip_prefix = "rules_python-2.3.0",
url = "https://github.com/bazel-contrib/rules_python/releases/download/2.3.0/rules_python-2.3.0.tar.gz",
)
load("@​rules_python//python:repositories.bzl", "py_repositories")
py_repositories()

Gazelle plugin

Paste this snippet into your WORKSPACE file:

... (truncated)

Changelog

Sourced from rules_python's changelog.

2.3.0 - 2026-08-07

{#v2-3-0-changed}

Changed

• (gazelle) BREAKING rules_python 1.5.0 or higher is now required. The Python extension selects its standard library list on is_python_3.14, which earlier versions do not define.

{#v2-3-0-fixed}

Fixed

• Fixed py_binary_rule_builder() / py_test_rule_builder() (from python/api/executables.bzl) failing at analysis time with a visibility error when used to construct a custom rule from an external module.
• (compile_pip_requirements) Add the explicit data attribute and forward it directly to the generated py_binary, so files passed via data can be referenced from extra_args using $(location ...).
• (coverage) The warning about a missing bundled coverage.py wheel is no longer emitted as we are now falling back to a pure python wheel (#3950).
• (gazelle) The Python extension now uses the correct standard library module list for python_version 3.13 and 3.14; previously both fell back to the 3.11 list, so modules added or removed since then (e.g. compression.zstd, telnetlib) were misclassified. The fallback list for unrecognized versions is now the newest available one rather than 3.11 (#3978).
• (pypi) Allow uv_lock to be specified in pip.parse without requiring requirements_lock (or other os-specific requirement file attributes) to be set.
• (pypi) Fixed the fixed-point loop that resolves self-referencing extras (pkg[extra] entries in a package's own Requires-Dist). The loop compared the number of extras discovered in the current round against the number known before it, rather than against the size of the merged set. As a result it could stop before every extra was resolved, silently dropping dependencies only reachable through two or more pkg[extra] hops, and for the common case of a package with no self-referencing extras it never converged at all, running all 10000 rounds while evaluating each wheel's generated BUILD file (#4039).
• (pypi) Requirement --hash=<algo>:<digest> pins and Simple API #<algo>=<digest> URL fragments are now parsed for all hash algorithms instead of silently dropping everything except sha256. Non-sha256 pins are matched against the digests advertised by the index and downloads are verified using the corresponding Subresource Integrity value, and the pins are kept in the requirement line when falling back to pip (#3972). As part of this, whl_library repos created by pip.parse now always pass the digest via the integrity attribute (SRI format) instead of sha256, and the lock file facts store digests as <algo>:<digest> values (the facts version was bumped, so cached index information is refreshed once).
• (pypi) pip.parse(uv_lock = ...) no longer exposes uv workspace/root members

... (truncated)

Commits

• 54df9b7 fix(pypi): resolve self-referencing extras to a real fixed point (#4039)
• 56e8240 feat(bzlmod): make init.py generation configurable module-wide (#3997)
• d8bb5eb Prepare release v2.3.0 (#4011)
• e84926a chore(release): fix duplicate argument in NamedTemporaryFile (#4014)
• 1a00958 chore(release): indent multi-line bullet points in changelog (#4013)
• 753795d chore(release): ignore .agents directory in version marker replacement (#4012)
• 81b3260 build: add static type checking for runfiles with rules_pyrefly (#4009)
• c2b3648 refactor(toolchain): rename abi_tag to soabi to eliminate PEP ambiguity (#4008)
• 71a7e31 fix(sphinxdocs): fix path resolution for conf.py in separate directory (#4006)
• 20773d6 fix(sphinxdocs): materialize source symlinks to resolve relative cross-refere...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Documentation preview for this pull request is available at:
pr-56: https://eclipse-score.github.io/infrastructure/pr-56/