Remote code execution vulnerability fix sbt team received a security report GHSA-m2pw-22cj-jq4v from @arpitjain099 that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via the sbt server. sbt 1.12.15 and 2.0.6 fix this bug. We recommend removing the serverConnectionType setting, or upgrading to a patched version or later: Global / serverConnectio…
Remote code execution vulnerability fix sbt team received a security report GHSA-m2pw-22cj-jq4v from @arpitjain099 that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via the sbt server. sbt 1.12.15 and 2.0.6 fix this bug. We recommend removing the serverConnectionType setting, or upgrading to a patched version or later: Global / serverConnectio…
changes with compatibility implications fix: Changes the test ClassLoader to close by default, to fix AccessDeniedException by @eed3si9n in #9538. Set closeClassLoaders to false to opt out, or Test / fork := true to fork the tests that does not shutdown properly. 🐛 bug fixes fix: Fixes a/build.sbt setting leakage by @eed3si9n in #9519 fix: Fixes sbt runner failing to start sbtn on Windows by @ColO…
changes with compatibility implications fix: Forked run uses working directory by @jozanek in #9442 🐛 bug fixes fix: Fixes test ClassLoader retention issues by @kevin-lee in #9485 fix: Fixes common settings with a plugin with extraProjects by @eed3si9n in #9495 fix: Fixes dependency tree rendering on some libraries by @anatoliykmetyuk in #9371 fix: Fixes tests not detecting stale resources by @eed…
🐛 bug fixes fix: Backports the packager cache fix for CVE-2026-26032 by @raboof in sbt/ivy#57 deps: sjson-new 0.10.3, which transitively updates Jawn to 1.7.0 for GHSA-cc4v-rvgp-2pf3 and GHSA-w4cm-gvhj-cgw6 by @eed3si9n in #9460 fix: Fixes BSP dependency parsing by @anatoliykmetyuk in #9451 fix: Fixes JVM option capability in the launcher config by @anatoliykmetyuk in #9452 fix: Fixes sbt shutdown…
🐛 bug fixes fix: Backports the packager cache fix for CVE-2026-26032 by @raboof in sbt/ivy#57 deps: sjson-new 0.15.1, which transitively updates Jawn to 1.7.0 for GHSA-cc4v-rvgp-2pf3 and GHSA-w4cm-gvhj-cgw6 by @eed3si9n in #9458 fix: Fixes JVM option capability in the launcher config by @anatoliykmetyuk in #9452 Full Changelog: v2.0.2...v2.0.3
🐛 bug fixes fix: Fixes remote cache ByteStream timeout by @yhefamly in #9413 fix: Fixes metabuild dependency downgrade via plugin by @anatoliykmetyuk in #9426 fix: Fixes build pipelining by @anatoliykmetyuk in #9425 fix: Fixes auto import of givens by @xuwei-k in #9409 fix: Fixes sbtn stdout relaying by @BrianHotopp in #9411 / #9414 fix: Fixes shutdownall in sbt runner by @eed3si9n in #9435 fix: F…
🐛 bug fixes fix: Fixes sbt runner parsing build.properties with whitespaces by @anatoliykmetyuk in #9374 fix: Fixes global plugin loading by @eed3si9n in #9391 / #9380 fix: Fixes sbt runner support on OpenBSD by @eed3si9n in #9394 fix: Fixes --allow-empty and --sbt-create by @anatoliykmetyuk in #9370 fix: Fixes BSP publishDiagnostics propagation by @anatoliykmetyuk in #9376 fix: Fixes macro expans…
🐛 bug fixes fix: Fixes file permissions by @eed3si9n + @xuwei-k in sbt/io#527 / #9350 fix: Fixes ArrayIndexOutOfBoundsException error when Unix domain socket is closed by @merlinorg in sbt/ipcsocket#77 Full Changelog: v1.12.12...v1.12.13
See sbt 2.0 change summary. Full Changelog: v1.12.12...v2.0.0
bug fixes fix: Fixes console that references Java module classes on JDK 9+ by @BrianHotopp in #9327 fix: Fixes sbt --version to now show JDK warnings on JDK 25 by @bitloi in #8822 fix: Fixes stdout/stderr not displaying on sbtn by @BrianHotopp in #9265 fix: Ensure resources are copied atomically by @anatoliykmetyuk in #9196 behind the scenes Update sbtn to 2.0.0-f0d2fae4 by @eed3si9n in #9334 test…
🐛 bug fixes fix: Fixes packageDirectory zip publication race by @bitloi in #9047 fix: Fixes chunked upload/download by @eed3si9n in #9318 fix: Fixes console / javaOptions + console / forked by default by @eed3si9n in #9322 Full Changelog: v2.0.0-RC15...v2.0.0-RC16
🐛 bug fixes fix: ByteStream chunked upload/download by @eed3si9n in #9298 fix: Fixes publishing platform-specific artifacts (like Scala Native) by @arashi01 in #9293 fix: Fixes cross build caching by @eed3si9n in #9305 deps: Update to Scala 3.8.4 by @xuwei-k + @eed3si9n in #9302 / sbt/io#522 Full Changelog: v2.0.0-RC14...v2.0.0-RC15
🐛 bug fixes fix: Fixes Scala Native artifact publishing by @anatoliykmetyuk in #9118 fix: Fix duplicate autoplugins packageBin mappings by @anatoliykmetyuk in #9255 perf: Parallelize dependency resolution when no progress bar is rendered by @BrianHotopp in #9270 fix: Report a missing input file clearly by @BrianHotopp in #9271 fix: Reimplement FarmHash without using sun.misc.Unsafe by @eed3si9n in…
2.0.0-RC13-1
Execution log sbt 2.0.0 adds experimental execution log feature to debug caching issues. The execution log can be enabled with sbt.experimental_execution_log system property has either true or a file path: $ sbt --server -Dsbt.experimental_execution_log=true compile This will generate an execution log file in target/global-logging/exec-log****.log: { "input": { "digest": "sha256-a50da1cd086987bc27…
bug fix fix: Rollback eviction error in Test by @eed3si9n in sbt/librarymanagement#600 Full Changelog: v1.12.10...v1.12.11