[pull] master from tensorflow:master

.bazelrc

@@ -175,6 +175,13 @@ common --enable_workspace
 common --incompatible_enable_cc_toolchain_resolution
 common --repo_env USE_HERMETIC_CC_TOOLCHAIN=1
 
+# external_include_paths feature forces passing external repositories headers
+# via -isystem alters how Clang resolves their file paths. This feature with
+# old versions of rules_cc triggering errors.
+# Following lines can be removed after rules_cc will be updated to >= 0.2.22
+common --features=-external_include_paths
+common --host_features=-external_include_paths
+
 # TODO: Migrate for https://github.com/bazelbuild/bazel/issues/7260
 common:clang_local --noincompatible_enable_cc_toolchain_resolution
 common:clang_local --noincompatible_enable_android_toolchain_resolution

MODULE.bazel

@@ -36,7 +36,7 @@ bazel_dep(name = "google_cloud_cpp", version = "3.0.0-rc1", repo_name = "com_git
 bazel_dep(name = "crc32c", version = "1.1.0", repo_name = "com_github_google_crc32c")
 bazel_dep(name = "brotli", version = "1.1.0", repo_name = "org_brotli")
 bazel_dep(name = "rules_cc", version = "0.2.25")
-bazel_dep(name = "curl", version = "8.11.0.bcr.5")
+bazel_dep(name = "curl", version = "8.22.0")
 bazel_dep(name = "rules_webtesting", version = "0.4.1", repo_name = "io_bazel_rules_webtesting")
 bazel_dep(name = "rules_closure", version = "0.15.0", repo_name = "io_bazel_rules_closure")
 bazel_dep(name = "grpc", version = "1.78.0")
@@ -86,9 +86,9 @@ bazel_dep(name = "libprotobuf-mutator", version = "1.3", repo_name = "libprotobu
 bazel_dep(name = "rules_ml_toolchain")
 archive_override(
     module_name = "rules_ml_toolchain",
-    integrity = "sha256-izPVqzV2I7ox7EYzRzcRY6ogeLcHUr4LRP2xMrkWh6A=",
-    strip_prefix = "rules_ml_toolchain-236a498d8624bef88e35ce2518a833204b0db19f",
-    urls = ["https://github.com/google-ml-infra/rules_ml_toolchain/archive/236a498d8624bef88e35ce2518a833204b0db19f.tar.gz"],
+    integrity = "sha256-Z38HhfFL91M5oxh8un+pXhofiIoYVo7cLl+sh9UT/Hw=",
+    strip_prefix = "rules_ml_toolchain-f56a19573fec3543050a5f4bcd9a07a1de08e8ee",
+    urls = ["https://github.com/google-ml-infra/rules_ml_toolchain/archive/f56a19573fec3543050a5f4bcd9a07a1de08e8ee.tar.gz"],
 )
 
 bazel_dep(name = "xla", repo_name = "xla")

RELEASE.md

@@ -3562,7 +3562,7 @@ This release introduces several vulnerability fixes:
     *   Add `keepdims` argument to all `GlobalPooling` layers.
     *   Add `include_preprocessing` argument to `MobileNetV3` architectures to
         control the inclusion of `Rescaling` layer in the model.
-    *   Add optional argument (`force`) to `make_(train|test|predict)_funtion`
+    *   Add optional argument (`force`) to `make_(train|test|predict)_function`
         methods to skip the cached function and generate a new one. This is
         useful to regenerate in a single call the compiled training function
         when any `.trainable` attribute of any model's layer has changed.

ci/official/envs/ci_default

@@ -37,8 +37,10 @@ TFCI_BAZEL_COMMON_ARGS=
 TFCI_BAZEL_TARGET_SELECTING_CONFIG_PREFIX=
 TFCI_BUILD_PIP_PACKAGE_BASE_ARGS=
 TFCI_BUILD_PIP_PACKAGE_WHEEL_NAME_ARG=
-# Mostly meant to be used for Windows.
-# For Windows, the same wheel is uploaded to both tensorflow_cpu, and tensorflow
+# Extra project names to publish the same wheel under, space separated.
+# Used by the platforms that have no CUDA build to differentiate from, and so
+# upload one wheel as both tensorflow and tensorflow_cpu: Windows, Linux arm64
+# and macOS arm64.
 TFCI_BUILD_PIP_PACKAGE_ADDITIONAL_WHEEL_NAMES=
 TFCI_DOCKER_ARGS=
 TFCI_DOCKER_ENABLE=

ci/official/envs/linux_arm64

@@ -18,6 +18,9 @@ TFCI_BAZEL_TARGET_SELECTING_CONFIG_PREFIX=linux_arm64
 # to tensorflow_cpu. These ARM builds are supposed to have the name "tensorflow"
 # despite lacking Nvidia CUDA support.
 TFCI_BUILD_PIP_PACKAGE_WHEEL_NAME_ARG="--repo_env=WHEEL_NAME=tensorflow"
+# The same wheel is also published as tensorflow_cpu, so that the package name
+# works on every platform TensorFlow ships. See the note in ci_default.
+TFCI_BUILD_PIP_PACKAGE_ADDITIONAL_WHEEL_NAMES="tensorflow_cpu"
 TFCI_DOCKER_ENABLE=1
 TFCI_DOCKER_IMAGE=us-docker.pkg.dev/ml-oss-artifacts-published/ml-public-container/ml-build-arm64:latest
 TFCI_DOCKER_PULL_ENABLE=1

ci/official/envs/macos_arm64

@@ -15,6 +15,9 @@
 TFCI_BAZEL_COMMON_ARGS="--repo_env=HERMETIC_PYTHON_VERSION=$TFCI_PYTHON_VERSION --repo_env=USE_PYWRAP_RULES=True --config release_macos_arm64"
 TFCI_BAZEL_TARGET_SELECTING_CONFIG_PREFIX=macos_arm64
 TFCI_BUILD_PIP_PACKAGE_WHEEL_NAME_ARG="--repo_env=WHEEL_NAME=tensorflow"
+# The same wheel is also published as tensorflow_cpu, so that the package name
+# works on every platform TensorFlow ships. See the note in ci_default.
+TFCI_BUILD_PIP_PACKAGE_ADDITIONAL_WHEEL_NAMES="tensorflow_cpu"
 TFCI_INDEX_HTML_ENABLE=1
 TFCI_LIB_SUFFIX="-cpu-darwin-arm64"
 TFCI_MACOS_BAZEL_TEST_DIR_ENABLE=1

ci/official/utilities/collect_additional_wheel.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+#
+# Copyright 2026 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+#
+# Usage: collect_additional_wheel.sh <wheel name>
+# This script is aware of TFCI_ variables, so it only needs the project name of
+# the wheel to collect.
+#
+# Copies the wheel that the additional-WHEEL_NAME build in wheel.sh just
+# produced out of bazel-bin and into TFCI_OUTPUT_DIR, and gives it the same
+# platform tag that rename_and_verify_wheels.sh gives the primary wheel.
+#
+# rename_and_verify_wheels.sh cannot do this itself: it expects exactly one
+# wheel to be present, and it has already run against the primary wheel by the
+# time this script is called.
+set -exo pipefail
+
+wheel_name="$1"
+
+# `find -printf` is a GNU extension, and macOS ships BSD find, so let `ls -t`
+# do the sorting instead and take the newest match.
+built_wheel=$("$TFCI_FIND_BIN" ./bazel-bin/tensorflow/tools/pip_package \
+  -iname "${wheel_name}*.whl" -exec ls -t {} + | head -n 1)
+# find exits 0 when it matches nothing, so say what went wrong rather than
+# leaving `cp` to report an empty path.
+if [[ -z "$built_wheel" ]]; then
+  echo "Error: the ${wheel_name} build produced no wheel under bazel-bin" >&2
+  exit 1
+fi
+cp "$built_wheel" "$TFCI_OUTPUT_DIR"
+
+# Repair the wheel with auditwheel, the same way the primary wheel was
+# repaired. Bazel tags Linux wheels `linux_<arch>`, and PyPI only accepts the
+# `manylinux_*` tag that auditwheel puts on in its place.
+if [[ "$TFCI_WHL_AUDIT_ENABLE" == "1" ]]; then
+  cd "$TFCI_OUTPUT_DIR"
+  python3 -m auditwheel repair --plat "$TFCI_WHL_AUDIT_PLAT" --wheel-dir . \
+    "$(basename "$built_wheel")"
+  # Drop the unrepaired wheel, keeping the newest one, the same way
+  # rename_and_verify_wheels.sh does for the primary wheel. If the wheel was
+  # already named correctly then auditwheel did not rename it, nothing is left
+  # over and `rm` gets no arguments, which is why it needs -f. Matching on the
+  # project name leaves the primary wheel alone.
+  ls -t "${wheel_name}"-*.whl | tail -n +2 | xargs rm -f
+fi

ci/official/wheel.sh

@@ -62,8 +62,9 @@ if [[ -n "$TFCI_BUILD_PIP_PACKAGE_ADDITIONAL_WHEEL_NAMES" ]]; then
     echo "Building for additional WHEEL_NAME: ${wheel_name}"
     CURRENT_WHEEL_NAME_ARG="--repo_env=WHEEL_NAME=${wheel_name}"
     tfrun bazel $TFCI_BAZEL_BAZELRC_ARGS build $TFCI_BAZEL_COMMON_ARGS --config=cuda_wheel //tensorflow/tools/pip_package:wheel $TFCI_BUILD_PIP_PACKAGE_BASE_ARGS $CURRENT_WHEEL_NAME_ARG $HERMETIC_CUDA_UMD_BUILD_FLAGS
-    # Copy the wheel that was just created
-    tfrun bash -c "$TFCI_FIND_BIN ./bazel-bin/tensorflow/tools/pip_package -iname "${wheel_name}*.whl" -printf '%T+ %p\n' | sort | tail -n 1 | awk '{print \$2}' | xargs -I {} cp {} $TFCI_OUTPUT_DIR"
+    # Copy the wheel that was just created, and platform-tag it to match the
+    # primary wheel.
+    tfrun bash ./ci/official/utilities/collect_additional_wheel.sh "${wheel_name}"
   done
 fi
 

tensorflow/compiler/aot/BUILD

@@ -148,7 +148,6 @@ cc_library(
         "@xla//xla/client:client_library",
         "@xla//xla/client:compile_only_client",
         "@xla//xla/hlo/builder:xla_computation",
-        "@xla//xla/pjrt:pjrt_compiler",
         "@xla//xla/service:compiler",
         "@xla//xla/service/cpu:cpu_aot_compilation_result",
         "@xla//xla/service/cpu:cpu_compiler",

tensorflow/compiler/aot/compile.cc

@@ -42,7 +42,6 @@ limitations under the License.
 #include "xla/client/client_library.h"
 #include "xla/client/compile_only_client.h"
 #include "xla/hlo/builder/xla_computation.h"
-#include "xla/pjrt/pjrt_compiler.h"
 #include "xla/service/compiler.h"
 #include "xla/service/cpu/cpu_aot_compilation_result.h"
 #include "xla/shape.h"
@@ -175,10 +174,8 @@ absl::Status CompileGraph(GraphDef graph_def, const tf2xla::Config& config,
         graph_def, config, &computation, flags.debug_info,
         flags.debug_info_path_begin_marker));
   } else {
-    TF_ASSIGN_OR_RETURN(auto* pjrt_compiler,
-                        xla::GetDefaultPjRtCompiler(xla::CpuName()));
     TF_RETURN_IF_ERROR(ConvertGraphDefToXla(std::move(graph_def), config,
-                                            pjrt_compiler, &computation));
+                                            client, &computation));
   }
 
   if (flags.experimental_quantize && *quantize_xla) {