diff --git a/reference/command-line-reference.mdx b/reference/command-line-reference.mdx
index deabe770..6f51089e 100644
--- a/reference/command-line-reference.mdx
+++ b/reference/command-line-reference.mdx
@@ -601,12 +601,6 @@ This option affects semantics of the Starlark language or the build API accessib
Tags:
[`loading_and_analysis`](#effect_tag_LOADING_AND_ANALYSIS), [`experimental`](#metadata_tag_EXPERIMENTAL)
-`--[no]experimental_repository_ctx_wasm_compilation` default: "false"
-: If true enables compilation of WebAssembly modules.
-
- Tags:
- [`loading_and_analysis`](#effect_tag_LOADING_AND_ANALYSIS), [`experimental`](#metadata_tag_EXPERIMENTAL)
-
`--[no]experimental_sibling_repository_layout` default: "false"
: If set to true, non-main repositories are planted as symlinks to the main repository in the execution root. That is, all repositories are direct children of the $output_base/execution_root directory. This has the side effect of freeing up $output_base/execution_root/**main**/external for the real top-level 'external' directory.
@@ -1810,14 +1804,14 @@ Miscellaneous options, not otherwise categorized.:
`--[no]show_timestamps` default: "false"
: Include timestamps in messages
-`--tls_certificate=` default: see description
-: Specify a path to a TLS certificate that is trusted to sign server certificates. An empty value resets the flag to its default.
+`--tls_certificate=` default: see description
+: Specify a path to a TLS certificate that is trusted to sign server certificates.
-`--tls_client_certificate=` default: see description
-: Specify the TLS client certificate to use; you also need to provide a client key to enable client authentication. An empty value resets the flag to its default.
+`--tls_client_certificate=` default: see description
+: Specify the TLS client certificate to use; you also need to provide a client key to enable client authentication.
-`--tls_client_key=` default: see description
-: Specify the TLS client key to use; you also need to provide a client certificate to enable client authentication. An empty value resets the flag to its default.
+`--tls_client_key=` default: see description
+: Specify the TLS client key to use; you also need to provide a client certificate to enable client authentication.
`--ui_actions_shown=` default: "8"
: Number of concurrent actions shown in the detailed progress bar; each action is shown on a separate line. The progress bar always shows at least one one, all numbers less than 1 are mapped to 1.
@@ -4593,12 +4587,6 @@ Remote caching and execution options:
`--[no]remote_verify_downloads` default: "true"
: If set to true, Bazel will compute the hash sum of all remote downloads and discard the remotely cached values if they don't match the expected value.
-`--[no]rewind_lost_inputs` default: "false"
-: Whether to use action rewinding to recover from lost inputs.
-
- Tags:
- [`execution`](#effect_tag_EXECUTION)
-
Miscellaneous options, not otherwise categorized.:
`--[no]allow_analysis_cache_discard` default: "true"
diff --git a/release/index.mdx b/release/index.mdx
index 6fb24547..822c08f5 100644
--- a/release/index.mdx
+++ b/release/index.mdx
@@ -15,7 +15,7 @@ information about Bazel's release model.
| ----------- | ------------- | -------------- | -------------- |
| Bazel 10 | Rolling| [Check rolling release page](/release/rolling) | N/A |
| Bazel 9 | Active| [9.1.0](https://github.com/bazelbuild/bazel/releases/tag/9.1.0) | Dec 2028 |
-| Bazel 8 | Maintenance| [8.7.0](https://github.com/bazelbuild/bazel/releases/tag/8.7.0) | Dec 2027 |
+| Bazel 8 | Maintenance| [8.6.0](https://github.com/bazelbuild/bazel/releases/tag/8.6.0) | Dec 2027 |
| Bazel 7 | Maintenance| [7.7.1](https://github.com/bazelbuild/bazel/releases/tag/7.7.1) | Dec 2026 |
| Bazel 6 | Deprecated | [6.6.0](https://github.com/bazelbuild/bazel/releases/tag/6.6.0) | Dec 2025 |
| Bazel 5 | Deprecated | [5.4.1](https://github.com/bazelbuild/bazel/releases/tag/5.4.1) | Jan 2025 |
diff --git a/rules/lib/builtins/ToolchainContext.mdx b/rules/lib/builtins/ToolchainContext.mdx
index 24326f9a..d792e7e6 100644
--- a/rules/lib/builtins/ToolchainContext.mdx
+++ b/rules/lib/builtins/ToolchainContext.mdx
@@ -2,16 +2,4 @@
title: 'ToolchainContext'
---
-Holds toolchains available for a particular exec group. Toolchain targets are accessed by indexing with the toolchain type, as in `ctx.toolchains["//pkg:my_toolchain_type"]`. If the toolchain was optional and no toolchain was resolved, this will return `None`. Accessing toolchains of an aspect or rule via `ctx.toolchains` returns the indexed toolchain as a `ToolchainInfo` provider. While when using aspects, `ToolchainContext` is also used to hold the toolchains of the base target. It can be accessed by `ctx.rule.toolchains["//pkg:my_toolchain_type"]` and it returns the list of providers resulted from applying the aspects on these toolchain targets.
-
-## Members
-
-* [toolchain_types](#toolchain_types)
-
-## toolchain_types
-
-```
-sequence ToolchainContext.toolchain_types()
-```
-
-Returns the resolved toolchain type labels.
\ No newline at end of file
+Holds toolchains available for a particular exec group. Toolchain targets are accessed by indexing with the toolchain type, as in `ctx.toolchains["//pkg:my_toolchain_type"]`. If the toolchain was optional and no toolchain was resolved, this will return `None`. Accessing toolchains of an aspect or rule via `ctx.toolchains` returns the indexed toolchain as a `ToolchainInfo` provider. While when using aspects, `ToolchainContext` is also used to hold the toolchains of the base target. It can be accessed by `ctx.rule.toolchains["//pkg:my_toolchain_type"]` and it returns the list of providers resulted from applying the aspects on these toolchain targets.
\ No newline at end of file
diff --git a/rules/lib/toplevel/cc_common.mdx b/rules/lib/toplevel/cc_common.mdx
index 6ed7e5fc..9b48c9a6 100644
--- a/rules/lib/toplevel/cc_common.mdx
+++ b/rules/lib/toplevel/cc_common.mdx
@@ -57,7 +57,7 @@ The key used to retrieve the provider that contains information about the C++ to
## compile
```
-tuple cc_common.compile(*, actions, feature_configuration, cc_toolchain, srcs=[], public_hdrs=[], private_hdrs=[], includes=[], local_includes=[], quote_includes=[], system_includes=[], framework_includes=[], defines=[], local_defines=[], include_prefix='', strip_include_prefix='', user_compile_flags=[], conly_flags=[], cxx_flags=[], compilation_contexts=[], name, disallow_pic_outputs=False, disallow_nopic_outputs=False, additional_inputs=[], module_interfaces=unbound)
+tuple cc_common.compile(*, actions, feature_configuration, cc_toolchain, srcs=[], public_hdrs=[], private_hdrs=[], includes=[], quote_includes=[], system_includes=[], framework_includes=[], defines=[], local_defines=[], include_prefix='', strip_include_prefix='', user_compile_flags=[], conly_flags=[], cxx_flags=[], compilation_contexts=[], name, disallow_pic_outputs=False, disallow_nopic_outputs=False, additional_inputs=[], module_interfaces=unbound)
```
Should be used for C++ compilation. Returns tuple of (`CompilationContext`, `CcCompilationOutputs`).
@@ -73,7 +73,6 @@ Should be used for C++ compilation. Returns tuple of (`CompilationContext`, `CcC
| `public_hdrs` | [sequence](../core/list); default is `[]` List of headers needed for compilation of srcs and may be included by dependent rules transitively. |
| `private_hdrs` | [sequence](../core/list); default is `[]` List of headers needed for compilation of srcs and NOT to be included by dependent rules. |
| `includes` | [sequence](../core/list); or [depset](../builtins/depset); default is `[]` Search paths for header files referenced both by angle bracket and quotes. Usually passed with -I. Propagated to dependents transitively. |
-| `local_includes` | [sequence](../core/list); or [depset](../builtins/depset); default is `[]` Search paths for header files referenced by angle brackets and quotes. Usually passed with -I. Not propagated to dependents transitively. |
| `quote_includes` | [sequence](../core/list); default is `[]` Search paths for header files referenced by quotes, e.g. #include "foo/bar/header.h". They can be either relative to the exec root or absolute. Usually passed with -iquote. Propagated to dependents transitively. |
| `system_includes` | [sequence](../core/list); default is `[]` Search paths for header files referenced by angle brackets, e.g. #include <foo/bar/header.h>. They can be either relative to the exec root or absolute. Usually passed with -isystem. Propagated to dependents transitively. |
| `framework_includes` | [sequence](../core/list); default is `[]` Search paths for header files from Apple frameworks. They can be either relative to the exec root or absolute. Usually passed with -F. Propagated to dependents transitively. |
diff --git a/upstream b/upstream
index 10efaccb..ea41d20a 160000
--- a/upstream
+++ b/upstream
@@ -1 +1 @@
-Subproject commit 10efaccb1d885a37ece9b9e32e3f99bc7c513368
+Subproject commit ea41d20a9482d93f08f558a30d02548a46214984