bazel central registry lacks releaseTimestamp

[jkanywhere]

Tell us more.

I use renovate to maintain in my MODULE.bazel

My renovate config contains "minimumReleaseAge": "7 days",

It appears that renovate cannot determine when modules are released to Bazel Central Registry, but that information is available on github.

I get the following in logs

DEBUG: Marking 4 release(s) as pending, as they do not have a releaseTimestamp and we're running with minimumReleaseAgeBehaviour=timestamp-required (repository=spirl/spirl)
       "depName": "aspect_bazel_lib",
       "versions": ["2.22.5", "2.22.4", "2.22.2", "2.22.0"],
       "check": "minimumReleaseAge"

DEBUG: Marking 1 release(s) as pending, as they do not have a releaseTimestamp and we're running with minimumReleaseAgeBehaviour=timestamp-required (repository=spirl/spirl)
       "depName": "gazelle",
       "versions": ["0.48.0"],
       "check": "minimumReleaseAge"

DEBUG: Marking 1 release(s) as pending, as they do not have a releaseTimestamp and we're running with minimumReleaseAgeBehaviour=timestamp-required (repository=spirl/spirl)
       "depName": "bazel_skylib",
       "versions": ["1.9.0"],
       "check": "minimumReleaseAge"

More details from the logs:

               {
                 "datasource": "bazel",
                 "depType": "bazel_dep",
                 "depName": "aspect_bazel_lib",
                 "currentValue": "2.21.2",
                 "updates": [
                   {
                     "bucket": "non-major",
                     "newVersion": "2.22.5",
                     "newValue": "2.22.5",
                     "newMajor": 2,
                     "newMinor": 22,
                     "newPatch": 5,
                     "updateType": "minor",
                     "isBreaking": false,
                     "pendingChecks": true,
                     "branchName": "renovate/aspect_bazel_lib-2.x"
                   }
                 ],
                 "packageName": "aspect_bazel_lib",
                 "versioning": "bazel-module",
                 "warnings": [],
                 "registryUrl": "https://github.com/raw/bazelbuild/bazel-central-registry/main",
                 "homepage": "https://docs.aspect.build/rules/aspect_bazel_lib",
                 "currentVersion": "2.21.2",
                 "isSingleVersion": true,
                 "fixedVersion": "2.21.2"
               },

               {
                 "datasource": "bazel",
                 "depType": "bazel_dep",
                 "depName": "gazelle",
                 "currentValue": "0.47.0",
                 "updates": [
                   {
                     "bucket": "non-major",
                     "newVersion": "0.48.0",
                     "newValue": "0.48.0",
                     "newMajor": 0,
                     "newMinor": 48,
                     "newPatch": 0,
                     "updateType": "minor",
                     "isBreaking": false,
                     "pendingChecks": true,
                     "branchName": "renovate/gazelle"
                   }
                 ],
                 "packageName": "gazelle",
                 "versioning": "bazel-module",
                 "warnings": [],
                 "sourceUrl": "https://github.com/bazel-contrib/bazel-gazelle",
                 "registryUrl": "https://github.com/raw/bazelbuild/bazel-central-registry/main",
                 "currentVersion": "0.47.0",
                 "isSingleVersion": true,
                 "fixedVersion": "0.47.0"
               },

               {
                 "datasource": "bazel",
                 "depType": "bazel_dep",
                 "depName": "bazel_skylib",
                 "currentValue": "1.8.2",
                 "updates": [
                   {
                     "bucket": "non-major",
                     "newVersion": "1.9.0",
                     "newValue": "1.9.0",
                     "newMajor": 1,
                     "newMinor": 9,
                     "newPatch": 0,
                     "updateType": "minor",
                     "isBreaking": false,
                     "pendingChecks": true,
                     "branchName": "renovate/bazel_skylib-1.x"
                   }
                 ],
                 "packageName": "bazel_skylib",
                 "versioning": "bazel-module",
                 "warnings": [],
                 "sourceUrl": "https://github.com/bazelbuild/bazel-skylib",
                 "registryUrl": "https://github.com/raw/bazelbuild/bazel-central-registry/main",
                 "currentVersion": "1.8.2",
                 "isSingleVersion": true,
                 "fixedVersion": "1.8.2"
               },

However, for each component there is a published date available.

aspect_bazel_lib: https://registry.bazel.build/modules/aspect_bazel_lib 2.22.5 "published 3 months ago" -> bazelbuild/bazel-central-registry@a92a650

On registry.bazel.build it only shows "days ago", but clicking on the link navigates to a specific commit with a full timestamp
gazelle: https://registry.bazel.build/modules/gazelle version 0.48.0 -> bazelbuild/bazel-central-registry@87560db

bazel_skylib https://registry.bazel.build/modules/bazel_skylib 1.9.0 "published 3 months ago" -> bazelbuild/bazel-central-registry@e42de35

[jamietanna]

Looking into this in more depth:

• For a package such as aspect_bazel_lib, we'll look up https://github.com/bazelbuild/bazel-central-registry/blob/main/modules/aspect_bazel_lib/metadata.json
  • In there we can see no releaseTimestamp information
• If we look at the version's metadata (https://github.com/bazelbuild/bazel-central-registry/blob/main/modules/aspect_bazel_lib/2.22.5/source.json) we can't see any other information

I guess that the timestamp is based on the commit that introduced those files?

If so, that may be a slightly expensive lookup for us to make (as we'll need to do an additional API call per release, per package) - thoughts @viceice ?

The "best case" I'd go for is that the metadata.json contains that metadata, so there's a single source-of-truth for all users, and it allows us to reduce API calls

[viceice]

agreed, it should be published into the metadata, otherwise it's too expensive.

is the commit digest inside the registry metadata? that would be unique and could be cached for long time

[jkanywhere]

I understand you are requesting a change to the bazel-central-registry. Do I understand properly?

I created a companion issue bazelbuild/bazel-central-registry#8245 to see if they would be OK adding release timestamp to the metadata.

[viceice]

yes

[jkanywhere]

@jamietanna

I guess that the timestamp is based on the commit that introduced those files?

If so, that may be a slightly expensive lookup for us to make (as we'll need to do an additional API call per release, per package) - thoughts @viceice ?

Yes, the commit timestamp is good for release time.

please clarify, what is the extra API call?

I see that I can find the content of source.json at the same time as the committedDate:

❯ GH_TOKEN=$(gh auth token); curl -s -X POST "https://github.com/api/graphql" \
    -H "Authorization: Bearer $GH_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"query": "{ repository(owner: \"bazelbuild\", name: \"bazel-central-registry\") { object(expression:\"main:modules/aspect_bazel_lib/2.22.5/source.json\") { ... on Blob { text } } ref(qualifiedName: \"main\") { target { ... on Commit { history(first: 1, path: \"modules/aspect_bazel_lib/2.22.5/source.json\") { nodes { committedDate } } } } } } }" }'  | jq .
{
  "data": {
    "repository": {
      "object": {
        "text": "{\n    \"integrity\": \"sha256-lOGSAzyoAn8m3nHJAApn75xzaVwriOLFWQRRcJF+rQw=\",\n    \"strip_prefix\": \"bazel-lib-2.22.5\",\n    \"url\": \"https://github.com/bazel-contrib/bazel-lib/releases/download/v2.22.5/bazel-lib-v2.22.5.tar.gz\",\n    \"patches\": {\n        \"go_dev_dep.patch\": \"sha256-ljcGZtJnam+xng7XW+SH8unAx6lpwTyySPNhhH/5qB8=\",\n        \"module_dot_bazel_version.patch\": \"sha256-frSOXuGkpdz5R3esZUt6MCkysonqBryZTaO1VyReaDE=\"\n    },\n    \"patch_strip\": 1\n}\n"
      },
      "ref": {
        "target": {
          "history": {
            "nodes": [
              {
                "committedDate": "2026-01-12T21:30:50Z"
              }
            ]
          }
        }
      }
    }
  }
}

[viceice]

we don't use GitHub API to fetch that file

renovate/lib/modules/datasource/bazel/index.ts

Line 17 in 467b5d2

'https://github.com/raw/bazelbuild/bazel-central-registry/main';

[jwnimmer-tri]

Here's a suggestion:

If you fetch e.g. https://registry.bazel.build/modules/gazelle and parse it, there is an element <script id="__NEXT_DATA__" type="application/json">...</script> that contains all the JSON you need:

{
  "props": {
    "pageProps": {
      "metadata": {
        "homepage": "https://github.com/bazel-contrib/bazel-gazelle",
        "maintainers": [
...
        ],
        "repository": [
          "github:bazel-contrib/bazel-gazelle"
        ],
        "versions": [
          "0.26.0",
          "0.27.0",
...
          "0.49.0",
          "0.50.0"
        ],
        "yanked_versions": {
          "0.26.0": "Obsolete experimental version that emits debug prints. Update to 0.30.0 or higher",
          "0.27.0": "Obsolete experimental version that emits debug prints. Update to 0.30.0 or higher",
          "0.28.0": "Obsolete experimental version that emits debug prints. Update to 0.30.0 or higher"
        }
      },
      "versionInfos": [
        {
          "version": "0.50.0",
          "submission": {
            "status": [
              "A"
            ],
            "files": [
              "modules/gazelle/0.50.0/source.json"
            ],
            "hash": "9c7e00f6cb5f41e16a0cb6f74720f30f34ffb535",
            "authorDate": "2026-04-07 21:12:55 +0200",
            "authorDateRel": "3 days ago",
            "authorDateIso": "2026-04-07T19:12:55Z"
          },
...

Note in particular the authorDateIso for "version": "0.50.0".

If you're not comfortable ingesting the HTML, plausibly we could ask https://github.com/bazel-contrib/bcr-ui to also add that as a standalone json file on the website.

This would only work for the central registry (not other registries the user might have specified in their config file), but that still covers a wide majority of users.