Vulnerability fix for IO.unzip sbt team received a security report GHSA-p8jf-532w-4p65 from Stas Shevchenko that despite previous attempt to fix it, IO.unzip and its variants contain a zip slip vulnerability. sbt 1.13.1 and 2.0.12 fix this bug. bug fixes and updates fix: Fix watch termination callbacks losing their source by @mkurz in #9902 fix: Fix task progress and logger retention across evalua…
Vulnerability fix for IO.unzip sbt team received a security report GHSA-p8jf-532w-4p65 from Stas Shevchenko that despite previous attempt to fix it, IO.unzip and its variants contain a zip slip vulnerability. sbt 1.13.1 and 2.0.12 fix this bug. updates and bug fixes fix: End the client connection when the channel's write thread stops by @retronym in #9991 Update sbtn to 2.1.0-e5346417 in #9996 fix…
Vulnerability fix for IO.unzip sbt team received a security report GHSA-p8jf-532w-4p65 from Stas Shevchenko that despite previous attempt to fix it, IO.unzip and its variants contain a zip slip vulnerability. Changes with compatibility implications Metabuild is updated to Scala 3.9. Apache Ivy is removed from the dependency. Scala 3.9 sbt 2.1.0 updates the Scala version used by the metabuild to Sc…
🐛 bug fixes fix: Fix AccessDeniedException writing SemanticDB by @eed3si9n in #9878 fix: Fixes .m2/settings.xml overriding sbtResolvers by @eed3si9n in #9828 fix: Keep accepting after a client fails by @kitbellew in #9691 fix: Fix task output lost by the thin client under CPU load by @eed3si9n in #9868 fix: Read all forked test output before reporting the fork's exit by @eugkhp in #9860 fix: Use P…
Changes with compatibility implications Metabuild is updated to Scala 3.9. Apache Ivy is removed from the dependency. Scala 3.9 sbt 2.1.0 updates the Scala version used by the metabuild to Scala 3.9.0. Since both sbt 2.x and Scala 3.x are only backward compatible across minor versions, appropriate Scala version must be used for building sbt plugins. Also a plugin built using sbt 2.1.x will not wor…
changes with compatibility implications sbt runner script honors JAVA_HOME environment variable by @anatoliykmetyuk in #9825 🚀 updates deps: Updates to Coursier 2.1.26, and sets user agent header by @eed3si9n in #9784, #9852, #9786 and #9818 🐛 bug fixes fix: Removes write permission from the CAS to prevent cache corruption by @eed3si9n in #9847 fix: Implements copy-on-write for symlinks by @eed3si…
updates and bug fixes fix: Restore cross-suffixed artifactIds in sbt 1 plugin POMs by @mkurz in #9804 fix: Restore sbt 1 plugin POM metadata by @mkurz in #9806 fix: Hash the boot classpath in sorted order by @hoangmaihuy in #9809 fix: Derive Maven paths from module and artifact names by @mkurz in #9811 fix: Restore the pipelining early output on an action-cache hit by @PhoenixmitX in #9793 fix: pu…
updates and bug fixes fix: Fixes Windows runner handling of sbt bsp by @stasimus in #9766 fix: Do not duplicate platform axes on a row by @kitbellew in #9757 fix: Warn on output declarations in uncached tasks by @anatoliykmetyuk in #9770 Allow adding rows and configuring them separately, and through any method by @kitbellew in #9765 fix: Update to Gigahorse 0.9.6 for pre-authentication by @eed3si9…
🐛 bug fixes fix: Fixes AccessDeniedException on Windows by creating JAR in situ by @eed3si9n in sbt/io#558 fix: Fixes unhermetic semanticdbTargetRoot in the compile cache key by @christianharrington in #9711 fix: Fixes pipelined build with Java sources by @anatoliykmetyuk in #9574 fix: Keep macro subprojects off the pipelined classpath by @stasimus in #9719 fix: Fixes sbt runner script not startin…
Changes with compatibility implications Metabuild is updated to Scala 3.9. Apache Ivy is removed from the dependency. Scala 3.9 on metabuild sbt 2.1.0 updates the Scala version used by the metabuild to Scala 3.9.0. Since both sbt 2.x and Scala 3.x are only backward compatible across minor versions, appropriate Scala version must be used for building sbt plugins. Also a plugin built using sbt 2.1.x…
🐛 bug fixes fix: Fixes ThisBuild-scoped bare settings by @eed3si9n in #9674 fix: Fixes TestReportListener not receiving endGroup after a LinkageError by @unkarjedy in #9667 fix: Fixes the ability to extend TestResultLogger by @unkarjedy in #9655 fix: Fixes --addPluginSbtFile getting lost after reboot by @azdrojowa123 in #9669 fix: Fixes JDK 17 domain socket deadlocks by @eed3si9n in #9671 fix: Kee…
⚠️ Remote code execution vulnerability fix sbt team received a security report GHSA-943m-f264-54p4 from @stasimus that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via BSP, similar to a recent bug that was found in JSON-RPC. sbt 1.13.0 and 2.0.7 fix this bug. Builds with the default serverConnectionType are not affected. In affected builds, we…
⚠️ Remote code execution vulnerability fix sbt team received a security report GHSA-943m-f264-54p4 from @stasimus that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via BSP, similar to a recent bug that was found in JSON-RPC. sbt 1.13.0 and 2.0.7 fix this bug. Builds with the default serverConnectionType are not affected. In affected builds, we…
⚠️ Remote code execution vulnerability fix sbt team received a security report GHSA-m2pw-22cj-jq4v from @arpitjain099 that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via the sbt server. sbt 1.12.15 and 2.0.6 fix this bug. We recommend removing the serverConnectionType setting, or upgrading to a patched version or later: Global / serverConnec…
⚠️ Remote code execution vulnerability fix sbt team received a security report GHSA-m2pw-22cj-jq4v from @arpitjain099 that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via the sbt server. sbt 1.12.15 and 2.0.6 fix this bug. Builds with the default serverConnectionType are not affected. In affected builds, we recommend removing the serverConnec…
changes with compatibility implications fix: Changes the test ClassLoader to close by default, to fix AccessDeniedException by @eed3si9n in #9538. Set closeClassLoaders to false to opt out, or Test / fork := true to fork the tests that does not shutdown properly. 🐛 bug fixes fix: Fixes a/build.sbt setting leakage by @eed3si9n in #9519 fix: Fixes sbt runner failing to start sbtn on Windows by @ColO…
changes with compatibility implications fix: Forked run uses working directory by @jozanek in #9442 🐛 bug fixes fix: Fixes test ClassLoader retention issues by @kevin-lee in #9485 fix: Fixes common settings with a plugin with extraProjects by @eed3si9n in #9495 fix: Fixes dependency tree rendering on some libraries by @anatoliykmetyuk in #9371 fix: Fixes tests not detecting stale resources by @eed…
🐛 bug fixes fix: Backports the packager cache fix for CVE-2026-26032 by @raboof in sbt/ivy#57 deps: sjson-new 0.10.3, which transitively updates Jawn to 1.7.0 for GHSA-cc4v-rvgp-2pf3 and GHSA-w4cm-gvhj-cgw6 by @eed3si9n in #9460 fix: Fixes BSP dependency parsing by @anatoliykmetyuk in #9451 fix: Fixes JVM option capability in the launcher config by @anatoliykmetyuk in #9452 fix: Fixes sbt shutdown…
🐛 bug fixes fix: Backports the packager cache fix for CVE-2026-26032 by @raboof in sbt/ivy#57 deps: sjson-new 0.15.1, which transitively updates Jawn to 1.7.0 for GHSA-cc4v-rvgp-2pf3 and GHSA-w4cm-gvhj-cgw6 by @eed3si9n in #9458 fix: Fixes JVM option capability in the launcher config by @anatoliykmetyuk in #9452 Full Changelog: v2.0.2...v2.0.3
🐛 bug fixes fix: Fixes remote cache ByteStream timeout by @yhefamly in #9413 fix: Fixes metabuild dependency downgrade via plugin by @anatoliykmetyuk in #9426 fix: Fixes build pipelining by @anatoliykmetyuk in #9425 fix: Fixes auto import of givens by @xuwei-k in #9409 fix: Fixes sbtn stdout relaying by @BrianHotopp in #9411 / #9414 fix: Fixes shutdownall in sbt runner by @eed3si9n in #9435 fix: F…
🐛 bug fixes fix: Fixes sbt runner parsing build.properties with whitespaces by @anatoliykmetyuk in #9374 fix: Fixes global plugin loading by @eed3si9n in #9391 / #9380 fix: Fixes sbt runner support on OpenBSD by @eed3si9n in #9394 fix: Fixes --allow-empty and --sbt-create by @anatoliykmetyuk in #9370 fix: Fixes BSP publishDiagnostics propagation by @anatoliykmetyuk in #9376 fix: Fixes macro expans…
🐛 bug fixes fix: Fixes file permissions by @eed3si9n + @xuwei-k in sbt/io#527 / #9350 fix: Fixes ArrayIndexOutOfBoundsException error when Unix domain socket is closed by @merlinorg in sbt/ipcsocket#77 Full Changelog: v1.12.12...v1.12.13
See sbt 2.0 change summary. Full Changelog: v1.12.12...v2.0.0
bug fixes fix: Fixes console that references Java module classes on JDK 9+ by @BrianHotopp in #9327 fix: Fixes sbt --version to now show JDK warnings on JDK 25 by @bitloi in #8822 fix: Fixes stdout/stderr not displaying on sbtn by @BrianHotopp in #9265 fix: Ensure resources are copied atomically by @anatoliykmetyuk in #9196 behind the scenes Update sbtn to 2.0.0-f0d2fae4 by @eed3si9n in #9334 test…
🐛 bug fixes fix: Fixes packageDirectory zip publication race by @bitloi in #9047 fix: Fixes chunked upload/download by @eed3si9n in #9318 fix: Fixes console / javaOptions + console / forked by default by @eed3si9n in #9322 Full Changelog: v2.0.0-RC15...v2.0.0-RC16
🐛 bug fixes fix: ByteStream chunked upload/download by @eed3si9n in #9298 fix: Fixes publishing platform-specific artifacts (like Scala Native) by @arashi01 in #9293 fix: Fixes cross build caching by @eed3si9n in #9305 deps: Update to Scala 3.8.4 by @xuwei-k + @eed3si9n in #9302 / sbt/io#522 Full Changelog: v2.0.0-RC14...v2.0.0-RC15
🐛 bug fixes fix: Fixes Scala Native artifact publishing by @anatoliykmetyuk in #9118 fix: Fix duplicate autoplugins packageBin mappings by @anatoliykmetyuk in #9255 perf: Parallelize dependency resolution when no progress bar is rendered by @BrianHotopp in #9270 fix: Report a missing input file clearly by @BrianHotopp in #9271 fix: Reimplement FarmHash without using sun.misc.Unsafe by @eed3si9n in…
2.0.0-RC13-1
Execution log sbt 2.0.0 adds experimental execution log feature to debug caching issues. The execution log can be enabled with sbt.experimental_execution_log system property has either true or a file path: $ sbt --server -Dsbt.experimental_execution_log=true compile This will generate an execution log file in target/global-logging/exec-log****.log: { "input": { "digest": "sha256-a50da1cd086987bc27…
bug fix fix: Rollback eviction error in Test by @eed3si9n in sbt/librarymanagement#600 Full Changelog: v1.12.10...v1.12.11