diff --git a/README.md b/README.md
index 725a35d..e74d20a 100644
--- a/README.md
+++ b/README.md
@@ -36,9 +36,9 @@
 
 ```python
 load("@com_googlesource_gerrit_bazlets//:gerrit_api.bzl", "gerrit_api")
-gerrit_api(version = "3.1.6",
-           plugin_api_sha1 = "e57f6465c9805f568082bffffd61a2771f10d68a",
-           acceptance_framework_sha1 = "ebfd50383f8593678b451c81dbc332db8e8da188")
+gerrit_api(version = "3.2.1",
+           plugin_api_sha1 = "47019cf43ef7e6e8d2d5c0aeba0407d23c93699c",
+           acceptance_framework_sha1 = "6252cab6d1f76202e57858fcffb428424e90b128")
 ```
 
 If the version ends in `-SNAPSHOT`, the jars are consumed from the local
@@ -47,7 +47,7 @@
 
 ```python
 load("@com_googlesource_gerrit_bazlets//:gerrit_api.bzl", "gerrit_api")
-gerrit_api(version = "3.1.7-SNAPSHOT")
+gerrit_api(version = "3.3.0-SNAPSHOT")
 ```
 
 <a name="basic-example"></a>
diff --git a/bouncycastle.bzl b/bouncycastle.bzl
index 02960bc..d9025bf 100644
--- a/bouncycastle.bzl
+++ b/bouncycastle.bzl
@@ -5,23 +5,23 @@
 """
 
 # This should be the same version used in Gerrit.
-BC_VERS = "1.60"
+BC_VERS = "1.61"
 
 def bouncycastle_repos():
     maven_jar(
         name = "bouncycastle_bcprov",
         artifact = "org.bouncycastle:bcprov-jdk15on:" + BC_VERS,
-        sha1 = "bd47ad3bd14b8e82595c7adaa143501e60842a84",
+        sha1 = "00df4b474e71be02c1349c3292d98886f888d1f7",
     )
     maven_jar(
         name = "bouncycastle_bcpg",
         artifact = "org.bouncycastle:bcpg-jdk15on:" + BC_VERS,
-        sha1 = "13c7a199c484127daad298996e95818478431a2c",
+        sha1 = "422656435514ab8a28752b117d5d2646660a0ace",
     )
     maven_jar(
         name = "bouncycastle_bcpkix",
         artifact = "org.bouncycastle:bcpkix-jdk15on:" + BC_VERS,
-        sha1 = "d0c46320fbc07be3a24eb13a56cee4e3d38e0c75",
+        sha1 = "89bb3aa5b98b48e584eee2a7401b7682a46779b4",
     )
     native.bind(
         name = "bcprov",
diff --git a/gerrit_api.bzl b/gerrit_api.bzl
index 332a493..a30b320 100644
--- a/gerrit_api.bzl
+++ b/gerrit_api.bzl
@@ -7,9 +7,9 @@
 gerrit_api is rule for fetching Gerrit plugin API using Bazel.
 """
 
-def gerrit_api(version = "3.1.6",
-               plugin_api_sha1 = "e57f6465c9805f568082bffffd61a2771f10d68a",
-               acceptance_framework_sha1 = "ebfd50383f8593678b451c81dbc332db8e8da188"):
+def gerrit_api(version = "3.2.1",
+               plugin_api_sha1 = "47019cf43ef7e6e8d2d5c0aeba0407d23c93699c",
+               acceptance_framework_sha1 = "6252cab6d1f76202e57858fcffb428424e90b128"):
     gerrit_api_version(
         name = "gerrit_api_version",
         version = version,
diff --git a/tools/pkg_war.bzl b/tools/pkg_war.bzl
index 931450b..2952a03 100644
--- a/tools/pkg_war.bzl
+++ b/tools/pkg_war.bzl
@@ -67,7 +67,7 @@
         inputs.append(dep)
 
     if ctx.attr.web_xml:
-        for web_xml in ctx.attr.web_xml.files:
+        for web_xml in ctx.attr.web_xml.files.to_list():
             inputs.append(web_xml)
             cmd = cmd + _add_file(ctx.attr.name, web_xml, build_output + "/WEB-INF/")