Update Protobuf Bazel Workspace

[psamanoelton]

TensorBoard 2.21: Bazel 7.7.0 + protobuf 6.31.1 upgrade

Summary

This PR upgrades the local TensorBoard 2.21 branch to:

• Bazel 7.7.0
• protobuf 6.31.1
• gRPC 1.74.0

The goal is to align TensorBoard's local/source build more closely with TensorFlow 2.21 while preserving:

• local Bazel repo loading
• query / analysis
• wheel build
• installed wheel runtime
• full local bazel test //tensorboard/...

What changed

1. Bazel 7.7.0 migration

• Updated .bazelversion to 7.7.0.
• Updated WORKSPACE Bazel version checks from 6.x to 7.7.0+.
• Added Bazel 7 compatibility settings in .bazelrc:
  • --noenable_bzlmod
  • platform-specific C++17 flags
  • test-only --incompatible_default_to_explicit_init_py
  • test env cleanup for Python/runfiles leakage
• Added .bazelignore entries to avoid Bazel traversing local cache directories.

2. protobuf 6.31.1 alignment

• Upgraded Bazel-side protobuf in WORKSPACE to 6.31.1.
• Upgraded Bazel-side gRPC in WORKSPACE to 1.74.0.
• Updated pip requirements in:
  • tensorboard/pip_package/requirements.txt
  • tensorboard/pip_package/requirements_dev.txt
• Reworked tensorboard/defs/protos.bzl to use public py_proto_library and py_grpc_library instead of older protobuf internals removed in newer protobuf/rules stacks.

3. WORKSPACE / external repo compatibility

• Added tb_http_archive helper in third_party/repo.bzl for mirrored downloads and patch application.
• Introduced Bazel-7-compatible external repo wiring for:
  • rules_cc
  • rules_java
  • absl
  • protobuf repo mapping
  • gRPC repo mapping
• Added compatibility/proxy repos used by the newer protobuf/gRPC stack:
  • third_party/compatibility_proxy
  • third_party/protobuf_pip_deps
  • third_party/protobuf_pip_deps_setuptools

4. rules_closure / Soy / Java compatibility

• Patched rules_closure CLI usage in patches/rules_closure_soy_cli.patch.
• Added vendored third_party/safe_html_types to provide protobuf-6-compatible safe-html-types classes expected by Soy / Closure tooling.
• Added Flogger and Soy Java dependencies in WORKSPACE.

5. TensorBoard compat / Bazel Python behavior

• Kept tensorboard/compat/init.py on the lazy-module pattern, but switched internal imports to importlib.import_module(...) for safer loading.
• Updated tensorboard/compat/BUILD so the package variants carry the real __init__.py explicitly.
• Added tensorboard/compat/compat_test.py.
• Updated several BUILD files so TF-using libraries depend on the correct compat targets under Bazel 7 test/binary runfiles.

6. Test and runtime environment hardening

• Updated tensorboard/pip_package/test_pip_package.sh to:
  • isolate the smoke-test virtualenv
  • scrub Bazel/runfiles/Python env leakage
  • execute validation imports in isolated mode
• Updated tensorboard/manager.py and tensorboard/manager_test.py so managed subprocesses do not inherit Bazel test-only environment state.

7. Plugin summary import fixes

• Made V2 summary imports lazy in several plugin summary modules to avoid import-time tf2 resolution in no_tensorflow paths:
  • tensorboard/plugins/audio/summary.py
  • tensorboard/plugins/scalar/summary.py
  • tensorboard/plugins/text/summary.py
  • tensorboard/plugins/image/summary.py
  • tensorboard/plugins/histogram/summary.py

8. Miscellaneous compatibility fixes

• Added third_party/werkzeug.BUILD import-root fix.
• Added .gitattributes LF policy for Bazel/Starlark/shell files.
• Added Go toolchain repos in WORKSPACE for rules_webtesting.

Validation

Validated locally in Docker against a fresh clone of the protobuf branch.

Commands used:

pip install "tensorflow==2.21.0"
pip install -r ./tensorboard/pip_package/requirements.txt \
            -r ./tensorboard/pip_package/requirements_dev.txt
pip install --force-reinstall "urllib3==1.26.20" "six>=1.12,<2"

bazel build //tensorboard/pip_package:build_pip_package && \
    mkdir -p /tmp/tb_wheel && \
    ./bazel-bin/tensorboard/pip_package/build_pip_package /tmp/tb_wheel && \
    pip install /tmp/tb_wheel/tensorboard-*.whl
bazel run //tensorboard/pip_package:test_pip_package -- \
  --tf-version "tensorflow==2.21"
bazel run //tensorboard/data/server:update_protos
bazel test //tensorboard/... --test_output=errors --keep_going --cache_test_results=no

Additional manual runtime check:

from tensorboard.summary.writer.event_file_writer import EventFileWriter
from tensorboard.compat.proto.event_pb2 import Event
from tensorboard.compat.proto.summary_pb2 import Summary
import time

writer = EventFileWriter("logs/test_run")
for step in range(5):
    summary = Summary(value=[Summary.Value(tag="loss", simple_value=step * 0.5)])
    event = Event(wall_time=time.time(), step=step, summary=summary)
    writer.add_event(event)
writer.close()

Important notes for reviewers

Why test --incompatible_default_to_explicit_init_py is test-only

Using this flag globally fixed Bazel test runfiles but broke wheel packaging by changing the package tree copied into the pip wheel build. Scoping it to test keeps:

• Bazel Python tests green
• pip package build and test_pip_package green

Why third_party/safe_html_types is vendored

This is the largest part of the diff. It is included because the older Closure/Soy stack used by TensorBoard expects safe-html-types classes that remain compatible with protobuf-java 6.x. Without this vendored copy, the Bazel 7 / protobuf 6 migration fails later in Java/Soy tooling rather than in TensorBoard code directly.

Follow-up ideas

These are not required for this PR, but may be worth considering later:

• Revisit whether pip runtime protobuf should be pinned exactly to 6.31.1 instead of allowing newer 6.x/7.x.
• pip install --force-reinstall "urllib3==1.26.20" "six>=1.12,<2" (71 tests fails if not running this pip install).
• Consider refactoring some of the expanded WORKSPACE compatibility wiring into more focused third_party helpers.
• Revisit whether some subprocess environment cleanup in tensorboard/manager.py can be reduced now that test-only Bazel init-py behavior is explicit.

Final status

• Repo loading: passing
• bazel query //...: passing
• Focused build: passing
• Wheel build: passing
• Installed wheel smoke test: passing
• update_protos_test: passing
• Full bazel test //tensorboard/...: passing