Description:

Envoy API depends on the target @com_google_protobuf//src/google/protobuf/compiler:retention which does not grant visibility outside of Protobuf itself:

In the WORKSPACE model, this is patched out via

Downstream patches are not allowed with Bzlmod as this breaks automatic dependency resolution (see #34355 for a WIP PR adding Bzlmod support). We need to find a way to make envoy compatible with upstream Protobuf without patches or upstream necessary patches.

This is blocking addition of Bzlmod support. Bzlmod support was introduced as experimental in Bazel 5, fully introduced in Bazel 6, defaulted in Bazel 7, WORKSPACE support is disabled by default in Bazel 8 and will be removed in Bazel 9.