sbt 1.13.1 and 2.0.12

The headline features of sbt 1.13.1 are

• Vulnerability fix for IO.unzip
• Zinc 1.13.0, with over-compilation fixes backported from Zinc 2.x
• sbt server and thin client robustness fixes

Hi everyone. On behalf of the sbt project, I am happy to announce sbt 1.13.1 and sbt 2.0.12. See also sbt 2.0 change summary for the details on sbt 2.0.

How to upgrade

The sbt version used for your build is upgraded by putting the following in project/build.properties:

sbt.version=1.13.1

This mechanism allows that sbt 1.13.1 (or 2.0.12) is used only for the builds that you want.

Download the official sbt runner from SDKMAN, or download from https://github.com/sbt/sbt/releases/tag/v2.0.12 to upgrade the sbt shell script, sbtn, and the launcher.

Vulnerability fix for IO.unzip

sbt team received a security report GHSA-p8jf-532w-4p65 from Stas Shevchenko that despite previous attempt to fix it, IO.unzip and its variants contain a zip slip vulnerability. sbt 1.13.1 and 2.0.12 fix this bug.

Zinc 1.13.0 over-compilation fixes

sbt 1.13.1 updates Zinc to 1.13.0, which backports a series of incremental compilation fixes to the 1.x series:

• fix: Fixes over-compilation of inheritance by @lrytz in zinc#1799
• Over-compilation fixes by @retronym, @lrytz, and @eed3si9n in zinc#1838
• Tell objects and classes apart in inheritance dependency tracking by @lrytz and @retronym in zinc#1839
• Record macro type-argument dependencies for every caller and argument-list shape by @retronym in zinc#1850
• Reuse one hasher across name groups in NameHashing by @retronym in zinc#1853

Other updates and bug fixes

• fix: End the client connection when the channel’s write thread stops by @retronym in #9991
• fix: Fixes run task by @xuwei-k in #9963
• Updates sbtn to 2.1.0-e5346417 by @eed3si9n in #9996
• fix: Report compile failures with usePipelining instead of cancelling by @mkurz in #9969
• fix: Handle CancellationException gracefully with usePipelining by @mkurz in #8718
• fix: Pass Java sources to scalac when pipelining by @stasimus in zinc#1790
• Adds Terminal.withRawInput for reading single keys by @mkurz in #9948
• perf: Avoid per-call allocations in getModifiedTimeOrZero by @retronym in io#571
• fix: Fixes watch termination callbacks losing their source by @mkurz in #9902
• fix: Fixes task progress and logger retention across evaluations by @mkurz in #9915
• fix: Release the task progress of aborted evaluations by @mkurz in #9935
• fix: Fixes file inputs and reloads failing after a failed load hook by @mkurz in #9926
• fix: Make logging robust against closed sbtn by @mkurz in #9911
• fix: Don’t miss a sentinel that is being submitted when cancelling by @mkurz in #9973
• fix: Fail when FileTreeView can’t list a directory by @eugkhp in io#573

Participation

sbt 1.13.1 and 2.0.12 are brought to you by 8 contributors. Lukas Rytz, Eugene Yokota (eed3si9n), Jason Zaugg (retronym), Matthias Kurz, Kenji Yoshida (xuwei-k), Stas Shevchenko, Eugene (eugkhp), and Jozef Koval.

Thanks to everyone who’s helped improve sbt and Zinc by using them, reporting bugs, improving our documentation, porting builds, porting plugins, and submitting and reviewing pull requests.

For anyone interested in helping sbt, there are many avenues for you to help, depending on your interest. If you’re interested, Contributing, “help wanted”, “good first issue”, and Discussions are good starting points.

Donate to Scala Center

Scala Center is a non-profit center at EPFL to support education and open source.

• The Scala Center Fundraising Campaign