search term:

sbt 1.12.15 and 2.0.6

The headline features of sbt 1.12.15 and 2.0.6 are:

See also sbt 2.0 change summary for the details on sbt 2.0.

Hi everyone. On behalf of the sbt project, I am happy to announce sbt 1.12.15 and sbt 2.0.6.

How to upgrade

The sbt version used for your build is upgraded by putting the following in project/build.properties:

sbt.version=1.12.15

This mechanism allows that sbt 1.12.15 (or 2.0.6) is used only for the builds that you want.

Download the official sbt runner from SDKMAN, or download from https://github.com/sbt/sbt/releases/tag/v2.0.6 to upgrade the sbt shell script, sbtn, and the launcher.

Remote code execution via server

sbt team received a security report GHSA-m2pw-22cj-jq4v from Arpit Jain that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via the sbt server. sbt 1.12.15 and 2.0.6 fix this bug.

We recommend removing the serverConnectionType setting, or upgrading to a patched version or later:

Global / serverConnectionType := ConnectionType.Tcp

The remediation was implemented by @eed3si9n and @anatoliykmetyuk.

Other updates

Participation

Thanks to everyone who’s helped improve sbt and Zinc by using them, reporting bugs, improving our documentation, porting builds, porting plugins, and submitting and reviewing pull requests.

For anyone interested in helping sbt, there are many avenues for you to help, depending on your interest. If you’re interested, Contributing, “help wanted”, “good first issue”, and Discussions are good starting points.

FYI - Scala Days talk

I gave a talk in Scala Days 2025 about sbt 2.0 (recording, slide deck).

Scala Center is a non-profit center at EPFL to support education and open source.