sbt 1.13.0 and 2.0.7

The headline features of sbt 1.13.0 are

• Vulnerability fix for remote code execution via BSP when serverConnectionType is set to Tcp
• Scala 3.9.0 REPL support

Hi everyone. On behalf of the sbt project, I am happy to announce sbt 1.13.0 and sbt 2.0.7. See also sbt 2.0 change summary for the details on sbt 2.0.

How to upgrade

The sbt version used for your build is upgraded by putting the following in project/build.properties:

sbt.version=1.13.0

This mechanism allows that sbt 1.13.0 (or 2.0.7) is used only for the builds that you want.

Download the official sbt runner from SDKMAN, or download from https://github.com/sbt/sbt/releases/tag/v2.0.7 to upgrade the sbt shell script, sbtn, and the launcher.

Remote code execution via BSP

sbt team received a security report GHSA-943m-f264-54p4 from Stas Shevchenko that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via BSP. sbt 1.13.0 and 2.0.7 fix this bug.

Builds with the default serverConnectionType are not affected. We recommend removing the serverConnectionType setting, or upgrading to a patched version or later. In an affected build, the setting might look like this:

Global / serverConnectionType := ConnectionType.Tcp

Since BSP does not have authentication, BSP support will be dropped when the connection type is set to Tcp. The remediation was implemented by Stas as well.

Scala 3.9 REPL support

Scala 3.9 (at the time 3.9.0-RC6) has adopted JLine 4.0.14, as opposed to JLine 3.x used by sbt 1.x. sbt 1.13.0 implements a workaround that allows console task to run with Scala 3.9.

This was contributed by @Gedochao as #9564.

Other updates

• IO.jarParallel and IO.zipParallel by @hoangmaihuy in io#540

🐛 Other bug fixes

• fix: Avoid rewriting unchanged plugin descriptors by @unkarjedy in #9613
• fix: Fixes -V parsing in sbt runners by @anatoliykmetyuk in #9626

🐛 sbt 2.x bug fixes

• fix: Guard diskcache against path traversal by @eed3si9n in #9605
• fix: Name the platform in CrossVersion(module, scalaModuleInfo) by @kitbellew in #9620
• fix: Fixes scalacOptions in BSP using VirtualFileRef by @azdrojowa123 in #9610
• fix: Fixes filesystem traversal order affecting cache stability by @christianharrington in #9646

Participation

sbt 1.13.0 and 2.0.7 are brought to you by 9 contributors. Eugene Yokota (eed3si9n), Albert Meltzer, Aleksandra Zdrojowa, Anatolii Kmetiuk, Christian Harrington, Dmitrii Naumenko, Mai Huy Hoàng, Piotr Chabelski, Stas Shevchenko.

Thanks to everyone who’s helped improve sbt and Zinc by using them, reporting bugs, improving our documentation, porting builds, porting plugins, and submitting and reviewing pull requests.

For anyone interested in helping sbt, there are many avenues for you to help, depending on your interest. If you’re interested, Contributing, “help wanted”, “good first issue”, and Discussions are good starting points.

FYI - Scala Days talk

I gave a talk in Scala Days 2025 about sbt 2.0 (recording, slide deck).

Donate to Scala Center

Scala Center is a non-profit center at EPFL to support education and open source.

• The Scala Center Fundraising Campaign