Description of the bug:

A cc_shared_library that depends on a cc_static_library will deduplicate the linkopts thereof. This can yield incorrect link lines for flags that can validly appear multiple times (e.g., -framework for MacOS platforms, -L, etc).

Note that this behavior is not exhibited by cc_binary. Note also that if the same linkopt appears in multiple dependencies, it will appear once for each such dependency.

Which category does this issue belong to?

C++ Rules

What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

cc_library(
    name = "static",
    srcs = ["static.cpp"],
    linkopts = ["-framework", "Security", "-framework", "IOKit"],
)

cc_shared_library(
    name = "shared",
    deps = [":static"],
)

cc_binary(
    name = "binary",
    deps = [":static"],
)

Output for bazel aquery "mnemonic(CppLink, //:shared)" includes the flags:

    -framework \
    Security \
    IOKit \

whereas output for bazel aquery "mnemonic(CppLink, //:binary)" includes the flags:

    -framework \
    Security \
    -framework \
    IOKit \

Consequently, the link line for //:shared is malformed and fails to link.

Which operating system are you running Bazel on?

MacOS

What is the output of bazel info release?

release 8.4.2

If bazel info release returns development version or (@non-git), tell us how you built Bazel.

No response

What's the output of git remote get-url origin; git rev-parse HEAD ?

If this is a regression, please try to identify the Bazel commit where the bug was introduced with bazelisk --bisect.

No response

Have you found anything relevant by searching the web?

No response

Any other information, logs, or outputs that you want to share?

I haven't tested this (as my dev environment isn't set up to build bazel), but I believe this line may be the issue - the use of depset on user_link_flags may be causing the deduplication.