chore(deps): update dependency sbt/sbt to v1.9.9 - autoclosed

[renovate]

This PR contains the following updates:

Package	Update	Change
sbt/sbt	minor	1.8.0 -> 1.9.9

---

Release Notes

sbt/sbt (sbt/sbt)

v1.9.9: 1.9.9

Compare Source

Bug fixes

• To fix console task on Scala 2.13.13, sbt 1.9.9 backports updates to JLine 3.24.1 and JAnsi 2.4.0 by @​hvesalai in https://github.com/sbt/sbt/pull/7503 / https://github.com/sbt/sbt/issues/7502
• To fix sbt 1.9.8's UnsatisfiedLinkError with stat, sbt 1.9.9 removes native code that was used to get the millisecond-precision timestamp that was broken (JDK-8177809) on JDK 8 prior to OpenJDK 8u302 by @​eed3si9n in https://github.com/sbt/io/pull/367

Full Changelog: sbt/sbt@v1.9.8...v1.9.9

v1.9.8: 1.9.8

Compare Source

updates

• Fixes IO.getModifiedOrZero on Alpine etc, by using clib stat() instead of non-standard __xstat64 abi by @​bratkartoffel in https://github.com/sbt/io/pull/362
• As a temporary fix for JLine issue, this disables vi-style effects inside emacs by @​hvesalai in https://github.com/sbt/sbt/pull/7420
• Backports fix for updateSbtClassifiers not downloading sources https://github.com/sbt/sbt/pull/7437 by @​azdrojowa123
• Backports missing logger methods that take Java Supplier https://github.com/sbt/sbt/pull/7447 by @​mkurz

Full Changelog: sbt/sbt@v1.9.7...v1.9.8

v1.9.7: 1.9.7

Compare Source

Highlights

• sbt 1.9.7 updates its IO module to 1.9.7, which fixes parent path traversal vulnerability in IO.unzip. This was discovered and reported by Kenji Yoshida (@​xuwei-k), and fixed by @​eed3si9n in io#360.

Zip Slip (arbitrary file write) vulnerability

See GHSA-h9mw-grgx-2fhf for the most up to date information. This affects all sbt versions prior to 1.9.7.

Path traversal vulnerabilty was discovered in IO.unzip code. This is a very common vulnerability known as Zip Slip, and was found and fixed in plexus-archiver, Ant, etc.

Given a specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. The follow is an example of a malicious entry:

+2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys

When executed on some path with six levels, IO.unzip could then overwrite a file under /root/. sbt main uses IO.unzip only in pullRemoteCache and Resolvers.remote, however, many projects use IO.unzip(...) directly to implement custom tasks and tests.

Non-determinism from AutoPlugins loading

We've known that occasionally some builds non-deterministically flip-flops its behavior when a task or a setting is set by two independent AutoPlugins, i.e. two plugins that neither depends on the other.

sbt 1.9.7 attempts to fix non-determinism of plugin loading order.
This was contributed by @​eed3si9n in #​7404.

Other updates and fixes

• Updates Coursier to 2.1.7 by @​regiskuckaertz in #​7392
• Updates Swoval to 2.1.12 by @​eatkins in io#353.
• Fixes .sbtopts support for sbt runner script on Windows by @​ptrdom in #​7393
• Adds documentation on scriptedSbt key by @​mdedetrich in #​7383
• Includes the URL in dependencyBrowseTree log by @​mkurz in #​7396

v1.9.6: 1.9.6

Compare Source

bug fix

• sbt 1.9.6 reverts "internal representation of class symbol names" change (https://github.com/sbt/zinc/pull/1244), which caused Scala compiler to generate wrong anonymous class name by @​eed3si9n in https://github.com/sbt/zinc/pull/1256. See https://github.com/scala/bug/issues/12868 for more details.

Full Changelog: sbt/sbt@v1.9.5...v1.9.6

v1.9.5: 1.9.5

Compare Source

Update: ⚠️ sbt 1.9.5 is broken, because it causes Scala compiler to generate wrong class names for anonymous class on lambda. While we investigate please refrain from publishing libraries with it.
https://github.com/scala/bug/issues/12868#issuecomment-1720848704

highlights

• Switches to pre-compiled compiler bridge for Scala 2.13.12+ #​7374 by @​eed3si9n
• Fixes NPE when just -X is passed to scalacOptions zinc#1246 by @​unkarjedy

other updates

• Fixes internal representation of class symbol names zinc#1244 by @​dwijnand
• Fixes NumberFormatException in CrossVersionUtil.binaryScalaVersion lm#426 by @​HelloKunal
• Fixes scripted client/server instability on Windows #​7087 by @​mdedetrich
• Fixes sbt launcher script bug on Windows #​7365 by @​JD557
• Fixes help command on oldshell #​7358 by @​azdrojowa123
• Adds allModuleReports to UpdateReport lm#428 by @​mdedetrich
• Handles javac warning messages zinc#1228 by @​Arthurm1
• Enables inliner for Scala 2.13 compiler bridge zinc#1247 by @​mdedetrich

new contributors

• @​azdrojowa123 made their first contribution in https://github.com/sbt/sbt/pull/7358
• @​JD557 made their first contribution in https://github.com/sbt/sbt/pull/7367

Full Changelog: sbt/sbt@v1.9.4...v1.9.5

v1.9.4: 1.9.4

Compare Source

CVE-2022-46751

CVE-2022-46751 is a security vulnerability discovered in Apache Ivy, but found also in Coursier.

With coordination with Apache Foundation, Adrien Piquerez (@​adpi2) from Scala Center backported the fix to both our Ivy 2.3 fork and Coursier. sbt 1.9.4 updates them to the fixed versions.

Other updates

• Fixes sbt_script lookup by replacing all spaces with %20 (not only the first one) in the path. by @​arturaz in https://github.com/sbt/sbt/pull/7349
• Fixes scala-debug-adapter#543: Maintain order of internal deps by @​adpi2 in https://github.com/sbt/sbt/pull/7347
• Removes conscriptConfigs task, not used and needed(?) anymore by @​mkurz in https://github.com/sbt/sbt/pull/7353
• Adds a Scala 3 seed to the sbt new menu by @​SethTisue in https://github.com/sbt/sbt/pull/7354

new contributors

• @​arturaz made their first contribution in https://github.com/sbt/sbt/pull/7349

Full Changelog: sbt/sbt@v1.9.3...v1.9.4

v1.9.3: 1.9.3

Compare Source

Actionable diagnostics (aka quickfix)

Actionable diagnostics, or quickfix, is an area in Scala tooling that's been getting attention since Chris Kipp presented it in the March 2023 Tooling Summit. Chris has written the roadmap and sent sbt/sbt#7242 that kickstarted the effort, but now there's been steady progress in Build Server Protocol, Dotty, Scala 2.13, IntelliJ, Zinc, etc. Metals 1.0.0, for example, is now capable of surfacing code actions as a quickfix.

sbt 1.9.3 adds a new interface called AnalysisCallback2 to relay code actions from the compiler(s) to Zinc's Analysis file. Future version of Scala 2.13.x (and hopefully Scala 3) will release with proper code actions, but as a demo I've implemented a code action for procedure syntax usages even on current Scala 2.13.11 with -deprecation flag.

This was contributed by Eugene Yokota (@​eed3si9n) in zinc#1226. Special thanks to @​lrytz for identifying this issue in zinc#1214.

other updates

• Adds M1/M2/Aarch64 build of sbtn into the installer by @​julienrf in https://github.com/sbt/sbt/pull/7329
• Fixes scripted tests timing out after 5 minutes by @​eed3si9n in https://github.com/sbt/sbt/pull/7336

Full Changelog: sbt/sbt@v1.9.2...v1.9.3

v1.9.2: 1.9.2

Compare Source

Fix

• Let ++ fall back to a bincompat Scala version by @​eed3si9n in https://github.com/sbt/sbt/pull/7328

Full Changelog: sbt/sbt@v1.9.1...v1.9.2

v1.9.1: 1.9.1

Compare Source

Change to Scala CLA

sbt 1.9.1 is the first release of sbt after changing to Scala CLA in #​7306 etc. A number of contributors to sbt voiced concerns about donating our work to Lightbend after 2022, and Lightbend, Scala Center, and I agreed on changing the contributor license agreement such that the copyright would tranfer to Scala Center, a non-profit organization. sbt and its subcompoments, including Zinc, will remain available under Apache v2 license.

Updates

• Fixes "Repository for publishing is not specified" error even when publish / skip is set true by @​adpi2 in #​7295
• Fixes scripted test not working when sbtPluginPublishLegacyMavenStyle := false by @​adpi2 in #​7286
• Fixes copy-pasting to sbt console being slow by @​andrzejressel in #​7280
• Fixes missing range in BSP Diagnostic by @​adpi2 in #​7298
• Fixes zip64 offset writing by @​dwijnand in zinc#1206
• Fixes a typo in the description of exportPipelining key by @​alexklibisz in #​7291
• dependencyBrowseGraph and dependencyDot render in color by @​sideeffffect in #​7301. This can be opted-out using dependencyDotNodeColors setting.
• Adds softwaremill/tapir.g8 to sbt new default menu by @​katlasik in #​7300
• Makes sbt new default menu extensible via templateDescriptions setting key and templateRunLocal input key by @​eed3si9n in #​7304
• Adds Hedgehog Scala to default test framework by @​kevin-lee in #​7287
• Updates semanticdbVersion to 4.7.8 by @​ckipp01 in #​7294
• Updates JNA to 5.13.0 by @​xuwei-k in io#346
• Updates Scala 2.13 for Zinc etc to 2.13.11 by @​mkurz in #​7279
• Updates sbtn to 1.9.0 by @​mkurz in #​7290
• Updates Scala Toolkit to 0.2.0 by @​eed3si9n in #​7318

Behind the scene

• Adds @tailrec annotation by @​xuwei-k in zinc#1209
• Updates Scala versions in scripted tests by @​xuwei-k in #​7312
• Many typo fixes by @​xuwei-k in #​7313
• Fixes Scaladoc warnings by @​xuwei-k in #​7314
• Typo fix in DEVELOPING.md by @​dongxuwang in #​7299
• Avoids deprecated java.net.URL constructor by @​xuwei-k in #​7315
• Refactors filter to withFilter where possible by @​xuwei-k in #​7317

new contributors

• @​andrzejressel made their first contribution in https://github.com/sbt/sbt/pull/7280
• @​kevin-lee made their first contribution in https://github.com/sbt/sbt/pull/7287
• @​alexklibisz made their first contribution in https://github.com/sbt/sbt/pull/7291
• @​dongxuwang made their first contribution in https://github.com/sbt/sbt/pull/7299
• @​katlasik made their first contribution in https://github.com/sbt/sbt/pull/7300

Full Changelog: sbt/sbt@v1.9.0...v1.9.1

v1.9.0: 1.9.0

Compare Source

Changes with compatibility implications

• Deprecates IntegrationTest configuration. See below.
• Updates underlying Coursier to 2.1.2 by @​eed3si9n.

Deprecation of IntegrationTest configuration

sbt 1.9.0 deprecates IntegrationTest configuration. (RFC-3 proposes to deprecate general use of configuration axis beyond Compile and Test, and this is the first installment of the change.)

The recommended migration path is to create a subproject named "integration", or "foo-integration" etc.

lazy val integration = (project in file("integration"))
  .dependsOn(core) // your current subproject
  .settings(
    publish / skip := true,
    // test dependencies
    libraryDependencies += something % Test,
  )

From the shell you can run:

> integration/test

Assuming these are slow tests compared to the regular tests, I might not aggregate them at all from other subprojects, and maybe only run it on CI, but it's up to you.

Why deprecate IntegrationTest? IntegrationTest was a demoware for the idea of custom configuration axis, and now that we are planning to deprecate the mechanism to simplify sbt, we wanted to stop advertising it. We won't remove it during sbt 1.x series, but deprecation signals the non-recommendation status.

This was contributed by @​eed3si9n and @​mdedetrich in lm#414/#​7261.

POM consistency of sbt plugin publishing

sbt 1.9.0 publishes sbt plugin to Maven repository in a POM-consistent way. sbt has been publishing POM file of sbt plugins as sbt-something-1.2.3.pom even though the artifact URL is suffixed as sbt-something_2.12_1.0. This allowed "sbt-something" to be registered by Maven Central, allowing search. However, as more plugins moved to Maven Central, it was considered that keeping POM consisntency rule was more important, especially for corporate repositories to proxy them.

sbt 1.9.0 will publish using both the conventional POM-inconsistent style and POM-consistent style so prior sbt releases can still consume the plugin. However, this can be opted-out using sbtPluginPublishLegacyMavenStyle setting.

This fix was contributed by Adrien Piquerez (@​adpi2) at Scala Center in coursier#2633, sbt#7096 etc. Special thanks to William Narmontas (@​ScalaWilliam) and Wudong Liu (@​wudong) whose experimental plugin sbt-vspp paved the way for this feature.

sbt new, a text-based adventure

sbt 1.9.0 adds text-based menu when sbt new or sbt init is called without arguments:

$ sbt -Dsbt.version=1.9.0-RC2 init
....

Welcome to sbt new!
Here are some templates to get started:
 a) scala/toolkit.local               - Scala Toolkit (beta) by Scala Center and VirtusLab
 b) typelevel/toolkit.local           - Toolkit to start building Typelevel apps
 c) sbt/cross-platform.local          - A cross-JVM/JS/Native project
 d) scala/scala-seed.g8               - Scala 2 seed template
 e) playframework/play-scala-seed.g8  - A Play project in Scala
 f) playframework/play-java-seed.g8   - A Play project in Java
 g) scala-js/vite.g8                  - A Scala.JS + Vite project
 i) holdenk/sparkProjectTemplate.g8   - A Scala Spark project
 m) spotify/scio.g8                   - A Scio project
 n) disneystreaming/smithy4s.g8       - A Smithy4s project
 q) quit
Select a template (default: a):

Unlike Giter8, .local template creates build.sbt etc in the current directory, and reboots into an sbt session.

This was contributed by Eugene Yokota (@​eed3si9n) in #​7228.

Actionable diagnostics steps

sbt 1.9.0 adds actions to Problem, allowing the compiler to suggest code edits as part of the compiler warnings and errors in a structual manner.

See Roadmap for actionable diagnostics for more details. The changes were contributed by @​ckipp01 in #​7242 and @​eed3si9n in bsp#527/#​7251/zinc#1186 etc.

releaseNotesURL setting

sbt 1.9.0 adds releaseNotesURL setting, which creates info.releaseNotesUrl property in the POM file. This will then be used by Scala Steward. See
Add release notes URLs to your POMs for details.

This was contributed by Arman Bilge in lm#410.

Other updates

• Updates Scala 2.13 cross build for Zinc to 2.13.10 to address CVE-2022-36944 by @​rhuddleston
• Updates underlying Scala to 2.12.18 for JDK 21-ea in #​7271 by @​eed3si9n.
• Fixes Zinc incremental compilation looping infinitely zinc#1182 by @​CarstonSchilds
• Fixes libraryDependencySchemes not overriding assumedVersionScheme lm#415 by @​adriaanm
• Fixes spurious whitespace in the runner script by @​keynmol in #​7134
• Makes RunProfiler available by @​dragos in #​7215
• Makes publishLocal / skip work by @​mdedetrich in #​7165
• Fixes NullPointerError under -Vdebug by @​som-snytt in zinc#1141
• Fixes Maven settings.xml properties expansion by @​nrinaudo in lm#413
• Adds FileFilter.nothing and FileFilter.everything by @​mdedetrich in io#340
• Adds Resolver.ApacheMavenSnapshotsRepo by @​mdedetrich
• Avoids deprecated java.net.URL constructor by @​xuwei-k in io#341
• Updates to Swoval 2.1.10 by @​eatkins in io#343
• Updates to sbt-giter8-resolver 0.16.2 by @​eed3si9n
• Fixes dead lock between LoggerContext and Terminal by @​adpi2 in #​7191
• Notifies ClassFileManager from IncOptions in Incremental.prune by @​lrytz in zinc1148
• Updates usage info for java-home in the runner script by @​liang3zy22 in #​7171
• Deprecates misspelled Problem#diagnosticRelatedInforamation by @​ckipp01 in #​7241
• Adds built-in support for weaver-cats test framework #​7263 by @​kubukoz

Behind the scene

• Replaces olafurpg/setup-scala with actions/setup-java by @​mzuehlke in #​7154
• Uses sonatypeOssRepos instead of sonatypeRepo by @​yoshinorin in #​7227

v1.8.3: 1.8.3

Compare Source

Security fix

• Fixes sbt.io.IO.withTemporaryFile not limiting access on Unix-like systems in io#344/zinc#1185 by @​eed3si9n

IO.withTemporaryFile fix

sbt 1.8.3 fixes sbt.io.IO.withTemporaryFile etc not limiting access on Unix-like systems. Prior to this patch release, some functions were using java.io.File.createTempFile, which does not set strict file permissions, as opposed to the NIO-equivalent that does.

This means that on a shared Unix-like systems, build user or plugin's use of sbt.io.IO.withTemporaryFile etc would have exposed the information to other users.

This issue was reported by Oleksandr Zolotko at IBM, and was fixed by Eugene Yokota (@​eed3si9n) in io#344/zinc#1185.

Other updates

sbt 1.8.3 backports Zinc and IO fixes from 1.9.0-RC2 as well.

• Fixes Zinc incremental compilation looping infinitely zinc#1182 by @​CarstonSchilds
• Fixes spurious whitespace in the runner script by @​keynmol in #​7134
• Fixes NullPointerError under -Vdebug by @​som-snytt in zinc#1141
• Avoids deprecated java.net.URL constructor by @​xuwei-k in io#341
• Updates to Swoval 2.1.10 by @​eatkins in io#343
• Notifies ClassFileManager from IncOptions in Incremental.prune by @​lrytz in zinc1148
• Adds FileFilter.nothing and FileFilter.everything by @​mdedetrich in io#340

v1.8.2: 1.8.2

Compare Source

updates

• Fixes M1/M2/Aarch64 Mac support by #​7120 by @​eed3si9n
• Fixes glibc 2.31/Debian 11/Ubuntu 20.04 compatibility #​7118 by @​eed3si9n

v1.8.1: 1.8.1

Compare Source

Bug fixes

• Fixes slf4j 2.x getting pulled into the metabuild #​7115 by @​eed3si9n
• Fixes BSP support on Windows by making PATH environment variable case insensitive by #​7085 by @​dos65

Updates

• Adds sbtn (GraalVM native client) for Linux on Aarch64 ipcsocket#33, #​7108 etc by @​mkurz and @​eed3si9n

New Contributors

• @​dos65 made their first contribution in https://github.com/sbt/sbt/pull/7085

Full Changelog: sbt/sbt@v1.8.0...v1.8.1

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.