Skip to content

Update dependency sbt/sbt to v2 - #27

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/sbt-sbt-2.x
Open

Update dependency sbt/sbt to v2#27
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/sbt-sbt-2.x

Conversation

@renovate

@renovate renovate Bot commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
sbt/sbt major 1.10.0 → 2.0.8

Release Notes

sbt/sbt (sbt/sbt)

v2.0.8: 2.0.8

Compare Source

🐛 bug fixes

Full Changelog: sbt/sbt@v2.0.7...v2.0.8

v2.0.7: 2.0.7

Compare Source

⚠️ Remote code execution vulnerability fix

sbt team received a security report GHSA-943m-f264-54p4 from @​stasimus that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via BSP, similar to a recent bug that was found in JSON-RPC. sbt 1.13.0 and 2.0.7 fix this bug.

Builds with the default serverConnectionType are not affected. In affected builds, we recommend removing the serverConnectionType setting, or upgrading to a patched version or later. In an affected build, the setting might look like this:

Global / serverConnectionType := ConnectionType.Tcp

The remediation was implemented by @​stasimus.

🚀 updates
🐛 bug fixes
behind the scenes

Full Changelog: sbt/sbt@v2.0.6...v2.0.7

v2.0.6: 2.0.6

Compare Source

Remote code execution vulnerability fix

sbt team received a security report GHSA-m2pw-22cj-jq4v from @​arpitjain099 that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via the sbt server. sbt 1.12.15 and 2.0.6 fix this bug.

We recommend removing the serverConnectionType setting, or upgrading to a patched version or later:

Global / serverConnectionType := ConnectionType.Tcp

The remediation was implemented by @​eed3si9n and @​anatoliykmetyuk.

🐛 bug fixes
🚀 updates

Full Changelog: sbt/sbt@v2.0.5...v2.0.6

v2.0.5: 2.0.5

Compare Source

changes with compatibility implications

  • fix: Changes the test ClassLoader to close by default, to fix AccessDeniedException by @​eed3si9n in #​9538. Set closeClassLoaders to false to opt out, or Test / fork := true to fork the tests that does not shutdown properly.

🐛 bug fixes

🚀 updates

Full Changelog: sbt/sbt@v2.0.4...v2.0.5

v2.0.4: 2.0.4

Compare Source

changes with compatibility implications
🐛 bug fixes
🐛 caching related bug fixes
🚀 updates
behind the scenes

Full Changelog: sbt/sbt@v2.0.3...v2.0.4

v2.0.3: 2.0.3

Compare Source

🐛 bug fixes

Full Changelog: sbt/sbt@v2.0.2...v2.0.3

v2.0.2: 2.0.2

Compare Source

🐛 bug fixes
updates
behind the scenes

Full Changelog: sbt/sbt@v2.0.1...v2.0.2

v2.0.1: 2.0.1

Compare Source

🐛 bug fixes
🚀 updates
behind the scenes

Full Changelog: sbt/sbt@v2.0.0...v2.0.1

v2.0.0: 2.0.0

Compare Source

See sbt 2.0 change summary.

Full Changelog: sbt/sbt@v1.12.12...v2.0.0

v1.13.0: 1.13.0

Compare Source

⚠️ Remote code execution vulnerability fix

sbt team received a security report GHSA-943m-f264-54p4 from @​stasimus that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via BSP, similar to a recent bug that was found in JSON-RPC. sbt 1.13.0 and 2.0.7 fix this bug.

Builds with the default serverConnectionType are not affected. In affected builds, we recommend removing the serverConnectionType setting, or upgrading to a patched version or later. In an affected build, the setting might look like this:

Global / serverConnectionType := ConnectionType.Tcp

The remediation was implemented by @​stasimus.

🚀 updates
🐛 bug fixes
behind the scenes
new contributors

Full Changelog: sbt/sbt@v1.12.15...v1.13.0

v1.12.15: 1.12.15

Compare Source

Remote code execution vulnerability fix

sbt team received a security report GHSA-m2pw-22cj-jq4v from @​arpitjain099 that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via the sbt server. sbt 1.12.15 and 2.0.6 fix this bug.

We recommend removing the serverConnectionType setting, or upgrading to a patched version or later:

Global / serverConnectionType := ConnectionType.Tcp

The remediation was implemented by @​eed3si9n and @​anatoliykmetyuk.

🐛 bug fixes
behind the scenes

Full Changelog: sbt/sbt@v1.12.14...v1.12.15

v1.12.14: 1.12.14

Compare Source

🐛 bug fixes

updates

behind the scenes

Full Changelog: sbt/sbt@v1.12.13...v1.12.14

v1.12.13: 1.12.13

Compare Source

🐛 bug fixes

Full Changelog: sbt/sbt@v1.12.12...v1.12.13

v1.12.12: 1.12.12

Compare Source

bug fixes

behind the scenes

Full Changelog: sbt/sbt@v1.12.11...v1.12.12

v1.12.11: 1.12.11

Compare Source

bug fix

Full Changelog: sbt/sbt@v1.12.10...v1.12.11

v1.12.10: 1.12.10

Compare Source

updates

🐛 bug fixes

behind the scenes

new contributors

Full Changelog: sbt/sbt@v1.12.9...v1.12.10

v1.12.9: 1.12.9

Compare Source

Updates

Full Changelog: sbt/sbt@v1.12.8...v1.12.9

v1.12.8: 1.12.8

Compare Source

updates

behind the scenes

Full Changelog: sbt/sbt@v1.12.7...v1.12.8

v1.12.7: 1.12.7

Compare Source

CVE-2026-32948 Source dependency feature (via crafted VCS URL) leading to arbitrary code execution on Windows

sbt 1.12.7 fixes CVE-2026-32948 (GHSA-x4ff-q6h8-v7gw). Recently @​anatoliykmetyuk at Scala Center discovered a vulnerability in sbt's source dependency feature ProjectRef(...) and RootProject(...). The URL for the version control system allows branch specification via the URL fragment, which is passed to Windows cmd shell. A malicious user can craft an URL that allows arbitrary code execution.

Anatolii also provided a fix from a private fork 1ce945 and 3a474a. We recommend upgrading to sbt 1.12.7, especially if you're on Windows.

updates

Full Changelog: sbt/sbt@v1.12.6...v1.12.7

v1.12.6: 1.12.6

Compare Source

updates

Full Changelog: sbt/sbt@v1.12.5...v1.12.6

v1.12.5: 1.12.5

Compare Source

updates

🐛 bug fixes

Full Changelog: sbt/sbt@v1.12.4...v1.12.5

v1.12.4: 1.12.4

Compare Source

  • backport: Respect scalaOrganization in compiler bridge resolution by @​tanishiking in #​8799
  • backport: Fixes .jvmopts parse error on Windows Git Bash by reverting "Handle JVM parameters with spaces in dot files" by @​eed3si9n in #​8798

Full Changelog: sbt/sbt@v1.12.3...v1.12.4

v1.12.3: 1.12.3

Compare Source

updates

Full Changelog: sbt/sbt@v1.12.2...v1.12.3

v1.12.2: 1.12.2

Compare Source

updates

Full Changelog: sbt/sbt@v1.12.1...v1.12.2

v1.12.1: 1.12.1

Compare Source

bug fixes

behind the scenes

Full Changelog: sbt/sbt@v1.12.0...v1.12.1

v1.12.0: 1.12.0

Compare Source

changes with compatibility implications

  • dependencyTree displays internal config, which includes Provided by @​eed3si9n in #​8359
  • Scaladoc now requires Compile / doc / compilers scoped to doc task

🚀 updates

🐛 bug fixes

behind the scenes

new contributors

Full Changelog: sbt/sbt@v1.11.7...v1.12.0

v1.11.7: 1.11.7

Compare Source

🚀 updates
🐛 bug fixes
🎬 behind the scenes

Full Changelog: sbt/sbt@v1.11.6...v1.11.7

v1.11.6: 1.11.6

Compare Source

🚀 sbt launcher 1.5.0
🐛 bug fixes
🎬 behind the scene

Full Changelog: sbt/sbt@v1.11.5...v1.11.6

v1.11.5: 1.11.5

Compare Source

changes with compatibility implications
  • sbtn is built using ubuntu-22.04 image, which will require similar Linux version with glibc 2.32 and above.
🚀 features and other updates
  • Adds Scala 3.8.0 support. See below
  • Adds Scala Nightly repository resolver. See below
  • Adds --jvm-client to the sbt runner script to launch JVM client. See below
  • Central Repository publishing: Shows validation errors if present by @​unkarjedy in #​8191
  • Central Repository publishing: Includes the root subproject name into the deployment by @​jeanmarc in #​8219
  • Reduces sbtn outputs by @​eed3si9n in #​8234
Scala Nightly repository

Scala Team now publishes nightlies to a dedicated Artifactory instance. sbt 1.11.5 adds a new resolver for this:

resolvers += Resolver.scalaNightlyRepository

ThisBuild / scalaVersion := "3.8.0-RC1-bin-20250823-712d5bc-NIGHTLY"
Compile / scalacOptions += "-language:experimental.captureChecking"

This was contributed by @​hamzaremmal in sbt/librarymanagement#532

Scala 3.8.0 support

Scala 3.8.0 will in-source the Scala standard library (scala-library) instead of using one from Scala 2.13. sbt 1.11.5 relaxes the Coursier same-version enforcement to support Scala 3.8.0.

This was pair programmed by @​hamzaremmal + @​eed3si9n during Scala Days 2025 as #​8226

sbt --jvm-client

sbt 1.11.5 runner script adds new --jvm-client flag to launch the JVM version of the thin client. The implementation is the Scala code which sbtn is based on. This will be useful on platforms or CPU architectures that we do not build sbtn.

This was contributed by @​eed3si9n in #​8232

🎬 behind the scene
new contributors

Full Changelog: sbt/sbt@v1.11.4...v1.11.5

v1.11.4: 1.11.4

Compare Source

Updates

Full Changelog: sbt/sbt@v1.11.3...v1.11.4

v1.11.3: 1.11.3

Compare Source

updates

  • Adds sonaUploadRequestTimeout setting to configure the upload timeout when publishing to the Central Repo by @​guizmaii in #​8171
  • fix: Adds support for pluginCrossBuild/sbtBinaryVersion "1.3", which is used by IntelliJ Scala plugin (fixes #​8166) by @​unkarjedy in #​8167
  • fix: Fixes the import order to satisfy SemanticDB by @​inglor in #​8162

new contributors

Full Changelog: sbt/sbt@v1.11.2...v1.11.3

v1.11.2: 1.11.2

Compare Source

updates

Full Changelog: sbt/sbt@v1.11.1...v1.11.2

v1.11.1: 1.11.1

Compare Source

updates

behind the scene

Full Changelog: sbt/sbt@v1.11.0...v1.11.1

v1.11.0: 1.11.0

Compare Source

Central Repository publishing

The Central Repository (aka Maven Central) has long been the pillar of the JVM ecosystem including Scala. The mechanism to publish libraries to the Central has been hosted by Sonatype as OSS Repository Hosting (OSSRH) via HTTP PUT, but in March it was announced that the endpoint will be sunset in June 2025 in favor of the Central Portal at https://central.sonatype.com/.

sbt 1.11.0 implements a built-in support to publish to Central Repository via the Central Portal. To publish to the Central Portal, first set ThisBuild / publishTo setting to the localStaging repository:

ThisBuild / publishTo := {
  val centralSnapshots = "https://central.sonatype.com/repository/maven-snapshots/"
  if (isSnapshot.value) Some("central-snapshots" at centralSnapshots)
  else localStaging.value
}

Add credentials to the host central.sonatype.com using the generated user token user name and password. sbt 1.11.0 will read from the environment variables SONATYPE_USERNAME and SONATYPE_PASSWORD and append a credential for central.sonatype.com out-of-box, which might be useful for automatic publishing from the CI environment, such as GitHub Actions.

- run: sbt ci-release
  env:
    PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }}
    PGP_SECRET: ${{ secrets.PGP_SECRET }}
    SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
    SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}

When you're ready to publish, call publishSigned task (available via sbt-pgp). At this point, the JARs and POM files will be staged to your local target/sona-staging directory.

Next, call sonaUpload to upload to the Central Portal and manually release the bundle, or call sonaRelease to upload and automatically release to the Central Repository.

This was contributed by @​eed3si9n in #​8126. The feature was i

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/sbt-sbt-2.x branch from 424011f to c1692e7 Compare July 4, 2026 00:03
@mergify

mergify Bot commented Jul 4, 2026

Copy link
Copy Markdown

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

@renovate
renovate Bot force-pushed the renovate/sbt-sbt-2.x branch 2 times, most recently from 571055b to e9239e6 Compare July 18, 2026 10:58
@renovate
renovate Bot force-pushed the renovate/sbt-sbt-2.x branch from e9239e6 to a1d1b98 Compare July 27, 2026 01:58
@renovate
renovate Bot force-pushed the renovate/sbt-sbt-2.x branch 2 times, most recently from 24e3edb to b87abea Compare August 8, 2026 15:45
@renovate
renovate Bot force-pushed the renovate/sbt-sbt-2.x branch from b87abea to c24a9b4 Compare September 1, 2026 06:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants