Download Latest Version
sbt-2.0.7.msi (14.9 MB)
Get an email when there's a new version of sbt
| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| sbt-2.0.7.zip.sha256 | 2026-08-21 | 80 Bytes | |
| sbt-2.0.7.zip.asc | 2026-08-21 | 833 Bytes | |
| sbt-2.0.7.zip | 2026-08-21 | 57.6 MB | |
| sbt-2.0.7.tgz.asc | 2026-08-21 | 833 Bytes | |
| sbt-2.0.7.tgz.sha256 | 2026-08-21 | 80 Bytes | |
| sbt-2.0.7.tgz | 2026-08-21 | 57.7 MB | |
| sbt-2.0.7.msi.asc | 2026-08-21 | 833 Bytes | |
| sbt-2.0.7.msi.sha256 | 2026-08-21 | 80 Bytes | |
| sbt-2.0.7.msi | 2026-08-21 | 14.9 MB | |
| 2.0.7 source code.tar.gz | 2026-08-21 | 3.4 MB | |
| 2.0.7 source code.zip | 2026-08-21 | 5.6 MB | |
| README.md | 2026-08-21 | 1.8 kB | |
| Totals: 12 Items | 139.2 MB | 0 | |
⚠️ Remote code execution vulnerability fix
sbt team received a security report GHSA-943m-f264-54p4 from @stasimus that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via BSP, similar to a recent bug that was found in JSON-RPC. sbt 1.13.0 and 2.0.7 fix this bug.
Builds with the default serverConnectionType are not affected. In affected builds, we recommend removing the serverConnectionType setting, or upgrading to a patched version or later. In an affected build, the setting might look like this:
:::scala
Global / serverConnectionType := ConnectionType.Tcp
The remediation was implemented by @stasimus.
🚀 updates
- perf: Stop re-converting the classpath in
compileOptionsby @hoangmaihuy in https://github.com/sbt/sbt/pull/9622
🐛 bug fixes
- fix: Guard diskcache against path traversal by @eed3si9n in https://github.com/sbt/sbt/pull/9605
- fix: Name the platform in
CrossVersion(module, scalaModuleInfo)by @kitbellew in [#9620] - fix: Avoid rewriting unchanged plugin descriptors by @unkarjedy in https://github.com/sbt/sbt/pull/9624
- fix: Fixes
scalacOptionsin BSP using VirtualFileRef by @azdrojowa123 in https://github.com/sbt/sbt/pull/9610 - fix: Fixes
-Vparsing in sbt runners by @anatoliykmetyuk in https://github.com/sbt/sbt/pull/9626 - fix: Fixes filesystem traversal order affecting cache stability by @christianharrington in [#9646]
behind the scenes
- ci: Remove cla-checker v1 by @eed3si9n in https://github.com/sbt/sbt/pull/9571
- Update sbtn to 2.0.0-8753a981 by @eed3si9n in https://github.com/sbt/sbt/pull/9630
Full Changelog: https://github.com/sbt/sbt/compare/v2.0.6...v2.0.7