sbt Files

⚠️ Remote code execution vulnerability fix

sbt team received a security report GHSA-943m-f264-54p4 from @stasimus that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via BSP, similar to a recent bug that was found in JSON-RPC. sbt 1.13.0 and 2.0.7 fix this bug.

Builds with the default serverConnectionType are not affected. In affected builds, we recommend removing the serverConnectionType setting, or upgrading to a patched version or later. In an affected build, the setting might look like this:

:::scala
Global / serverConnectionType := ConnectionType.Tcp

The remediation was implemented by @stasimus.

🚀 updates

• Scala 3.9 REPL support by @Gedochao in https://github.com/sbt/sbt/pull/9564
• IO.jarParallel and IO.zipParallel by @hoangmaihuy in https://github.com/sbt/io/pull/540

🐛 bug fixes

• fix: Avoid rewriting unchanged plugin descriptors by @unkarjedy in https://github.com/sbt/sbt/pull/9613
• fix: Fixes -V parsing in sbt runners by @anatoliykmetyuk in https://github.com/sbt/sbt/pull/9626

behind the scenes

• ci: Remove cla-checker v1 by @eed3si9n in https://github.com/sbt/sbt/pull/9572
• Update sbtn to 2.0.0-8753a981 by @eed3si9n in https://github.com/sbt/sbt/pull/9635
• Bump IO to 1.13.0 by @eed3si9n in https://github.com/sbt/sbt/pull/9648

new contributors

• @Gedochao made their first contribution in https://github.com/sbt/sbt/pull/9564

Full Changelog: https://github.com/sbt/sbt/compare/v1.12.15...v1.13.0